# Flog Txt Version 1
# Analyzer Version: 3.1.2
# Analyzer Build Date: Oct 28 2019 11:51:53
# Log Creation Date: 01.11.2019 10:47:09.709

Process:
	id = "1"
	image_name = "d2.exe"
	filename = "c:\\users\\fd1hvy\\desktop\\d2.exe"
	page_root = "0x665c5000"
	os_pid = "0xce8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\d2.exe\" "
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0xac8

	[0037.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff74 | out: lpSystemTimeAsFileTime=0x19ff74*(dwLowDateTime=0xcc78d139, dwHighDateTime=0x1d590a1)) 
	[0037.505] GetCurrentProcessId () returned 0xce8
	[0037.505] GetCurrentThreadId () returned 0xac8
	[0037.505] GetTickCount () returned 0x1149ec2
	[0037.505] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff6c | out: lpPerformanceCount=0x19ff6c*=12863221227) returned 1
	[0037.523] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\d2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) 
	[0037.523] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x5d0000
	[0037.523] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0037.523] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0
	[0037.523] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20
	[0037.523] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40
	[0037.524] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00
	[0037.524] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0037.524] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0
	[0037.524] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0037.524] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0
	[0037.524] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0037.524] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0
	[0037.524] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0037.524] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0
	[0037.525] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0037.525] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0
	[0037.525] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0037.525] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0
	[0037.525] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0037.525] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0
	[0037.526] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0037.526] GetProcAddress (hModule=0x75e90000, lpProcName="DecodePointer") returned 0x77c11ec0
	[0037.526] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x214) returned 0x5d05a8
	[0037.526] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0037.526] GetProcAddress (hModule=0x75e90000, lpProcName="DecodePointer") returned 0x77c11ec0
	[0037.526] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000
	[0037.526] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0
	[0037.527] GetProcAddress (hModule=0x75e90000, lpProcName="DecodePointer") returned 0x77c11ec0
	[0037.527] GetCurrentThreadId () returned 0xac8
	[0037.527] GetStartupInfoA (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\d2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) 
	[0037.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x800) returned 0x5d07c8
	[0037.527] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0037.527] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0037.527] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0037.527] SetHandleCount (uNumber=0x20) returned 0x20
	[0037.527] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\d2.exe\" "
	[0037.527] GetEnvironmentStringsW () returned 0x612510*
	[0037.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xaca) returned 0x5d0fd0
	[0037.528] FreeEnvironmentStringsW (penv=0x612510) returned 1
	[0037.528] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4377f0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\d2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\d2.exe")) returned 0x1e
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x46) returned 0x5d1aa8
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x94) returned 0x5d1af8
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3e) returned 0x5d1b98
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x50) returned 0x5d1be0
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x6e) returned 0x5d1c38
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x78) returned 0x5d1cb0
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x62) returned 0x5d1d30
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x28) returned 0x5d1da0
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x48) returned 0x5d1dd0
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1a) returned 0x5d1e20
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2e) returned 0x5d1e48
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x56) returned 0x5d1e80
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2a) returned 0x5d1ee0
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2e) returned 0x5d1f18
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x44) returned 0x5d1f50
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1c) returned 0x5d1fa0
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x182) returned 0x5d1fc8
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x7c) returned 0x5d2158
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x36) returned 0x5d21e0
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3a) returned 0x5d2220
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x90) returned 0x5d2268
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x24) returned 0x5d2300
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x30) returned 0x5d2330
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x36) returned 0x5d2368
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x48) returned 0x5d23a8
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x52) returned 0x5d23f8
	[0037.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3c) returned 0x5d2458
	[0037.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xd6) returned 0x5d24a0
	[0037.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2e) returned 0x5d2580
	[0037.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1e) returned 0x5d25b8
	[0037.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2c) returned 0x5d25e0
	[0037.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x50) returned 0x5d2618
	[0037.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4e) returned 0x5d2670
	[0037.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x24) returned 0x5d26c8
	[0037.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x42) returned 0x5d26f8
	[0037.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x20) returned 0x5d2748
	[0037.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x38) returned 0x5d2770
	[0037.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x24) returned 0x5d27b0
	[0037.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d0fd0 | out: hHeap=0x5d0000) returned 1
	[0037.530] GetLastError () returned 0x0
	[0037.530] SetLastError (dwErrCode=0x0) 
	[0037.530] GetLastError () returned 0x0
	[0037.530] SetLastError (dwErrCode=0x0) 
	[0037.530] GetLastError () returned 0x0
	[0037.530] SetLastError (dwErrCode=0x0) 
	[0037.530] GetACP () returned 0x4e4
	[0037.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x220) returned 0x5d27e0
	[0037.531] GetLastError () returned 0x0
	[0037.531] SetLastError (dwErrCode=0x0) 
	[0037.531] IsValidCodePage (CodePage=0x4e4) returned 1
	[0037.531] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1
	[0037.531] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1
	[0037.531] GetLastError () returned 0x0
	[0037.531] SetLastError (dwErrCode=0x0) 
	[0037.531] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f8d8 | out: lpCharType=0x19f8d8) returned 1
	[0037.531] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0037.531] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ៯AĀ") returned 256
	[0037.531] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ៯AĀ", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1
	[0037.531] GetLastError () returned 0x0
	[0037.531] SetLastError (dwErrCode=0x0) 
	[0037.531] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1
	[0037.531] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0037.531] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0037.531] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0037.531] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0037.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿó\n\x152\x94þ\x19", lpUsedDefaultChar=0x0) returned 256
	[0037.531] GetLastError () returned 0x0
	[0037.532] SetLastError (dwErrCode=0x0) 
	[0037.532] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0037.532] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0037.532] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0037.532] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256
	[0037.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿó\n\x152\x94þ\x19", lpUsedDefaultChar=0x0) returned 256
	[0037.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x800) returned 0x5d0fd0
	[0037.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x80) returned 0x5d17d8
	[0037.532] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4085ed) returned 0x0
	[0037.533] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5d17d8) returned 0x80
	[0037.533] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.533] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.533] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.534] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.534] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.534] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.534] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.534] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.534] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.534] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.534] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.534] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.534] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.534] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.534] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.534] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.535] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.535] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.535] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.535] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.535] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.535] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.535] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.535] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.535] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.535] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.535] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.535] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.535] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.535] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.535] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.535] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.536] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.536] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.536] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.536] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.536] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.536] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.536] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.536] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.536] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.536] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.536] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.536] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.536] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.536] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.536] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.537] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.537] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.537] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.537] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.537] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.537] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.537] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.537] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.537] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.537] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.537] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.537] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.537] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.537] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.537] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.537] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.537] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.538] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.538] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.538] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.538] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.538] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.538] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.538] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.538] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.538] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.538] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.538] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.538] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.538] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.538] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.538] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.539] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.539] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.539] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.539] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.539] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.539] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.539] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.539] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.539] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.539] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.539] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.539] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.539] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.539] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.539] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.540] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.540] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.540] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.540] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.540] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.540] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.540] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.540] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.540] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.540] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.540] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.540] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.540] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.540] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.540] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.540] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.541] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.541] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.541] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.541] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.541] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.589] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.589] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.589] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.589] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.589] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.589] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.590] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.590] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.590] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.590] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.590] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.590] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.590] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.590] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.590] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.590] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.590] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.591] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.591] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.591] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.591] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.591] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.591] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.591] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.591] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.591] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.591] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.592] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.592] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.592] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.592] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.592] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.592] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.592] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.592] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.592] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.592] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.593] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.593] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.593] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.593] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.593] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.593] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.593] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.593] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.593] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.593] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.593] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.594] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.594] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.594] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.594] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.594] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.594] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.594] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.594] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.594] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.594] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.594] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.594] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.594] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.594] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.594] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.594] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.595] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.595] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.595] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.595] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.595] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.595] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.595] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.595] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.595] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.595] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.595] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.596] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.596] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.596] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.596] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.596] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.596] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.596] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.596] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.597] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.597] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.597] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.597] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.597] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.597] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.597] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.597] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.598] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.598] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.598] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.598] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.598] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.598] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.598] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.598] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.598] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.599] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.599] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.599] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.599] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.599] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.599] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.599] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.599] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.599] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.599] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.600] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.600] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.600] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.600] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.600] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.600] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.600] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.600] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.600] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.600] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.601] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.601] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.601] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.601] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.601] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.601] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.601] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.601] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.601] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.601] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.601] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.601] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.601] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.601] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.601] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.602] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.602] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.602] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.602] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.602] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.602] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.602] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.602] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.602] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.602] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.602] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.602] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.602] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.602] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.602] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.603] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.603] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.603] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.603] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.603] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.603] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.603] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.603] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.603] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.603] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.603] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.603] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.603] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.604] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.604] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.604] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.604] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.604] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.604] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.604] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.604] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.604] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.604] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.604] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.604] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.605] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.605] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.605] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.605] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.605] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.605] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.605] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.605] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.605] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.605] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.605] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.605] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.605] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.605] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.605] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.605] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.606] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.606] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.606] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.606] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.606] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.606] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.606] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.606] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.606] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.606] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.606] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.606] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.606] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.606] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.606] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.606] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.607] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.607] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.607] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.607] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.607] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.607] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.607] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.607] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.607] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.607] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.607] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.607] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.607] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.607] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.607] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.608] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.608] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.608] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.608] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.608] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.608] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.608] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.608] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.608] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.608] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.608] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.608] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.608] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.608] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.608] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.608] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.609] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.609] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.609] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.609] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.609] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.609] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.609] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.609] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.609] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.609] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.609] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.609] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.609] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.609] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.609] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.610] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.610] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.610] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.610] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.610] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.610] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.610] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.610] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.610] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.610] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.610] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.610] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.610] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.610] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.610] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.611] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.611] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.611] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.611] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.611] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.611] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.611] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.611] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.611] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.611] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.611] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.611] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.611] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.611] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.611] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.612] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.612] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.612] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.612] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.612] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.612] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.612] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.612] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.612] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.612] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.612] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.612] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.612] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.612] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.612] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.612] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.613] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.613] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.613] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.613] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.613] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.613] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.613] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.613] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.613] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.613] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.613] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.613] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.613] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.613] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.613] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.613] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.614] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.614] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.614] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.614] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.614] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.614] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.614] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.614] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.614] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.614] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.614] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.614] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.614] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.614] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.614] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.614] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.615] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.615] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.615] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.615] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.615] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.615] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.615] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.615] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.615] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.615] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.615] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.615] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.615] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.615] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.615] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.616] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.616] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.616] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.616] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.616] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.616] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.616] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.616] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.616] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.616] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.616] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.616] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.616] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.616] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.616] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.617] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.617] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.617] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.617] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.617] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.617] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.617] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.617] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.617] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.617] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.617] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.617] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.617] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.617] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.617] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.617] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.618] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.618] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.618] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.618] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.618] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.618] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.618] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.618] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.618] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.618] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.618] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.618] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.618] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.618] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.618] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.618] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.619] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.619] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.619] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.619] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.619] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.619] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.619] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.619] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.619] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.619] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.619] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.619] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.619] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.620] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.620] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.620] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.620] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.620] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.620] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.620] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.620] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.620] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.620] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.620] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.620] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.620] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.620] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.620] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.621] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.621] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.621] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.621] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.621] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.621] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.621] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.621] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.621] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.621] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.621] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.621] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.621] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.621] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.621] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.622] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.622] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.622] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.622] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.622] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.622] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.622] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.622] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.622] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.622] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.622] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.622] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.622] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.622] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.622] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.623] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.623] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.623] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.623] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.623] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.623] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.623] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.623] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.623] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.623] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.623] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.623] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.623] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.623] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.623] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.623] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.624] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.624] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.624] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.624] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.624] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.624] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.624] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.624] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.624] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.624] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.624] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.624] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.624] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.624] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.624] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.624] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.625] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.625] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.625] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.625] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.625] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.625] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.625] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.625] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.625] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.625] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.625] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.625] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.625] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.625] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.625] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.626] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.626] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.626] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.626] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.626] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.626] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.626] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.626] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.626] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.626] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.626] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.626] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.626] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.626] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.626] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.626] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.627] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.627] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.627] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.627] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.627] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.627] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.627] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.627] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.627] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.627] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.627] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.627] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.627] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.627] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.627] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.628] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.628] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.628] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.628] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.628] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.628] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.628] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.628] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.628] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.628] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.628] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.628] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.628] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.628] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.628] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.628] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.629] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.629] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.629] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.629] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.629] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.629] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.629] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.629] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.629] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.629] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.629] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.629] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.629] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.629] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.629] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.629] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.629] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.630] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.630] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.630] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.630] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.630] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.630] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.630] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.630] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.630] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.630] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.630] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.630] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.630] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.630] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0037.630] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0037.631] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0037.631] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0042.035] lstrlenW (lpString="") returned 0
	[0042.035] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.035] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.044] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.044] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.044] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.044] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.044] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.044] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.044] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.044] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.044] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.044] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.044] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.044] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.044] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.044] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.044] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.045] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.045] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.045] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.045] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.045] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.045] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.045] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.045] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.045] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.045] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.045] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.045] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.045] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.045] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.045] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.046] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.046] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.046] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.046] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.046] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.046] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.046] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.046] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.046] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.046] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.046] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.046] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.046] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.046] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.046] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.047] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.047] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.047] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.047] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.047] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.047] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.047] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.047] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.047] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.047] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.047] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.047] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.047] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.047] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.047] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.048] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.048] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.048] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.048] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.048] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.048] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.048] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.048] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.048] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.048] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.048] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.048] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.048] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.048] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.048] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.048] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.049] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.049] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.049] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.049] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.049] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.049] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.049] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.049] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.049] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.049] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.049] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.049] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.049] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.049] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.050] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.050] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.050] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.050] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.050] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.050] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.050] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.050] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.050] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.050] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.050] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.050] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.050] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.050] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.050] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.050] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.051] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.051] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.051] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.051] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.051] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.051] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.051] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.051] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.052] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.052] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.052] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.052] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.052] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.052] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.052] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.052] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.052] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.052] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.052] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.052] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.053] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.053] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.053] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.053] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.053] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.053] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.053] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.053] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.053] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.053] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.053] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.053] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.053] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.053] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.053] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.054] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.054] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.054] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.054] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.054] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.054] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.054] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.054] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.054] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.054] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.054] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.054] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.054] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.054] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.054] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.055] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.055] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.055] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.055] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.055] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.055] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.055] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.055] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.055] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.055] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.055] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.055] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.055] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.055] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.055] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.056] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.056] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.056] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.056] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.056] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.056] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.056] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.056] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.056] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.056] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.056] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.056] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.056] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.056] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.056] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.057] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.057] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.057] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.057] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.057] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.057] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.057] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.057] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.057] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.057] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.057] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.057] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.057] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.057] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.057] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.058] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.058] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.058] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.058] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.058] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.058] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.058] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.058] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.058] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.058] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.058] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.058] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.058] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.058] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.058] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.059] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.059] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.059] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.059] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.059] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.059] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.059] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.059] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.059] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.059] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.059] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.059] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.059] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.059] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.059] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.060] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.060] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.060] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.060] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.060] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.060] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.060] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.060] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.060] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.060] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.060] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.060] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.060] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.060] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.060] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.061] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.061] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.061] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.061] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.061] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.061] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.061] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.061] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.061] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.061] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.061] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.061] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.061] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.061] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.061] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.062] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.062] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.062] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.062] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.062] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.062] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.062] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.062] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.062] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.062] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.062] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.062] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.062] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.062] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.062] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.063] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.063] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.063] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.063] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.063] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.063] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.063] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.063] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.063] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.063] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.063] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.063] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.063] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.063] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.063] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.064] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.064] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.064] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.064] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.064] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.064] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.064] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.064] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.064] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.064] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.064] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.064] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.064] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.064] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.064] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.065] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.065] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.065] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.065] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.065] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.065] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.065] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.065] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.065] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.065] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.065] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.065] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.065] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.065] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.065] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.066] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.066] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.066] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.066] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.066] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.066] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.066] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.066] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.066] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.066] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.066] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.066] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.066] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.066] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.066] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.067] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.067] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.119] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.119] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.119] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.119] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.119] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.120] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.120] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.120] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.120] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.120] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.120] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.120] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.120] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.120] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.120] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.120] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.120] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.120] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.120] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.120] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.121] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.121] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.121] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.121] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.121] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.121] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.121] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.121] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.121] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.121] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.121] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.121] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.121] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.121] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.121] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.122] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0042.122] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0042.229] VirtualProtect (in: lpAddress=0x612510, dwSize=0x13b5f, flNewProtect=0x40, lpflOldProtect=0x19d2c0 | out: lpflOldProtect=0x19d2c0*=0x4) returned 1
	[0042.246] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000
	[0042.246] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalAlloc") returned 0x75ea5750
	[0042.246] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010
	[0042.246] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760
	[0042.246] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualAlloc") returned 0x75ea6970
	[0042.247] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0
	[0042.247] GetProcAddress (hModule=0x75e90000, lpProcName="Module32First") returned 0x75edfc90
	[0042.247] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0
	[0042.247] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0xe4
	[0042.251] Module32First (hSnapshot=0xe4, lpme=0x19cbe8) returned 1
	[0042.252] VirtualAlloc (lpAddress=0x0, dwSize=0x18050, flAllocationType=0x1000, flProtect=0x40) returned 0x450000
	[0042.257] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryA") returned 0x75ea5a80
	[0042.257] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000
	[0042.258] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualAlloc") returned 0x75ea6970
	[0042.258] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualProtect") returned 0x75ea6a30
	[0042.258] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualFree") returned 0x75ea69d0
	[0042.258] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersionExA") returned 0x75ea56d0
	[0042.258] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0
	[0042.258] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0
	[0042.258] GetProcAddress (hModule=0x75e90000, lpProcName="SetErrorMode") returned 0x75ea6500
	[0042.258] SetErrorMode (uMode=0x400) returned 0x0
	[0042.258] SetErrorMode (uMode=0x0) returned 0x400
	[0042.258] GetVersionExA (in: lpVersionInformation=0x19bb18*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x60a7f0, dwBuildNumber=0x60abb8, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19bb18*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0042.258] VirtualAlloc (lpAddress=0x0, dwSize=0x17200, flAllocationType=0x1000, flProtect=0x4) returned 0x470000
	[0042.261] VirtualProtect (in: lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x40, lpflOldProtect=0x19cba0 | out: lpflOldProtect=0x19cba0*=0x2) returned 1
	[0042.266] VirtualFree (lpAddress=0x470000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0042.267] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000
	[0042.267] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0
	[0042.267] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryA") returned 0x75ea5a80
	[0042.267] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0
	[0042.267] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0
	[0042.267] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250
	[0042.267] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010
	[0042.267] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0
	[0042.267] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20
	[0042.267] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0
	[0042.267] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74460000
	[0042.807] GetProcAddress (hModule=0x74460000, lpProcName="atexit") returned 0x7447c544
	[0042.807] atexit (param_1=0x450920) returned 0
	[0042.808] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000
	[0042.808] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0
	[0042.808] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0
	[0042.808] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40
	[0042.808] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70
	[0042.808] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500
	[0042.808] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40
	[0042.808] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameA") returned 0x75ed3780
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40
	[0042.809] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiW") returned 0x75ea6bf0
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0
	[0042.810] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0
	[0042.811] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0
	[0042.811] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40
	[0042.811] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0
	[0042.811] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceFrequency") returned 0x75ea5dc0
	[0042.811] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20
	[0042.811] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100
	[0042.811] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020
	[0042.811] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180
	[0042.812] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130
	[0042.812] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0
	[0042.812] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0
	[0042.812] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0
	[0042.812] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630
	[0042.812] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0
	[0042.812] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0
	[0042.813] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590
	[0042.813] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0
	[0042.813] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610
	[0042.813] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430
	[0042.813] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410
	[0042.813] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0
	[0042.813] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0
	[0042.813] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTime") returned 0x75ea54e0
	[0042.813] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0
	[0042.814] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010
	[0042.814] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0
	[0042.814] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0
	[0042.814] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750
	[0042.814] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000
	[0042.814] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580
	[0042.814] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0
	[0042.814] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530
	[0042.814] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60
	[0042.814] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0
	[0042.814] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90
	[0042.814] GetProcAddress (hModule=0x761b0000, lpProcName="OpenSCManagerW") returned 0x761d0540
	[0042.814] GetProcAddress (hModule=0x761b0000, lpProcName="OpenServiceW") returned 0x761cfa20
	[0042.814] GetProcAddress (hModule=0x761b0000, lpProcName="CloseServiceHandle") returned 0x761cfc00
	[0042.815] GetProcAddress (hModule=0x761b0000, lpProcName="ControlService") returned 0x761e26d0
	[0042.815] GetProcAddress (hModule=0x761b0000, lpProcName="QueryServiceStatus") returned 0x761d2380
	[0042.815] GetProcAddress (hModule=0x761b0000, lpProcName="EnumDependentServicesW") returned 0x761e2f70
	[0042.815] GetProcAddress (hModule=0x761b0000, lpProcName="EnumServicesStatusExW") returned 0x761cfc80
	[0042.815] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000
	[0045.902] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210
	[0045.902] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76480000
	[0051.539] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730
	[0051.539] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000
	[0051.539] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070
	[0051.539] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x741e0000
	[0051.677] GetProcAddress (hModule=0x741e0000, lpProcName="WNetCloseEnum") returned 0x741e2640
	[0051.677] GetProcAddress (hModule=0x741e0000, lpProcName="WNetOpenEnumW") returned 0x741e2790
	[0051.677] GetProcAddress (hModule=0x741e0000, lpProcName="WNetEnumResourceW") returned 0x741e2410
	[0051.677] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x746a0000
	[0051.917] GetProcAddress (hModule=0x746a0000, lpProcName="WSAStartup") returned 0x746a5b40
	[0051.917] GetProcAddress (hModule=0x746a0000, lpProcName="socket") returned 0x746b4510
	[0051.917] GetProcAddress (hModule=0x746a0000, lpProcName="send") returned 0x746a5030
	[0051.918] GetProcAddress (hModule=0x746a0000, lpProcName="recv") returned 0x746b0c50
	[0051.918] GetProcAddress (hModule=0x746a0000, lpProcName="connect") returned 0x746a5410
	[0051.918] GetProcAddress (hModule=0x746a0000, lpProcName="closesocket") returned 0x746b0910
	[0051.918] GetProcAddress (hModule=0x746a0000, lpProcName="gethostbyname") returned 0x746d6cb0
	[0051.918] GetProcAddress (hModule=0x746a0000, lpProcName="inet_addr") returned 0x746b9160
	[0051.918] GetProcAddress (hModule=0x746a0000, lpProcName="ntohl") returned 0x746a49d0
	[0051.919] GetProcAddress (hModule=0x746a0000, lpProcName="htonl") returned 0x746a49d0
	[0051.919] GetProcAddress (hModule=0x746a0000, lpProcName="htons") returned 0x746b8ff0
	[0051.919] GetProcessHeap () returned 0x600000
	[0051.920] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x20) returned 0x630f48
	[0051.920] QueryPerformanceCounter (in: lpPerformanceCount=0x19c9f0 | out: lpPerformanceCount=0x19c9f0*=14304478514) returned 1
	[0051.935] GetTickCount () returned 0x114d727
	[0051.935] GetCurrentProcessId () returned 0xce8
	[0051.936] GetTickCount () returned 0x114d727
	[0051.936] GetTickCount () returned 0x114d727
	[0051.937] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x20) returned 0x630cc8
	[0051.937] GetVersion () returned 0x23f00206
	[0051.938] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x7) returned 0x62ab38
	[0051.938] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x62ba38
	[0051.938] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62ba38, Size=0x20) returned 0x630ef8
	[0051.938] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ef8, Size=0x40) returned 0x62b770
	[0051.938] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x631b60
	[0051.976] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_B93J12A") returned 0x0
	[0051.976] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_B93J12A") returned 0x1f0
	[0051.976] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62ab38 | out: hHeap=0x600000) returned 1
	[0051.977] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0051.977] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62b770 | out: hHeap=0x600000) returned 1
	[0051.977] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x7) returned 0x62aa48
	[0051.977] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x62ba38
	[0051.977] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62ba38, Size=0x20) returned 0x630f20
	[0051.977] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630f20, Size=0x40) returned 0x62b5c0
	[0051.977] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x641b68
	[0051.978] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_B93J12U") returned 0x0
	[0051.978] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_B93J12U") returned 0x1f4
	[0051.978] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62aa48 | out: hHeap=0x600000) returned 1
	[0051.978] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0051.978] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62b5c0 | out: hHeap=0x600000) returned 1
	[0051.978] GetVersion () returned 0x23f00206
	[0051.978] GetCurrentProcess () returned 0xffffffff
	[0051.978] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19c9dc | out: TokenHandle=0x19c9dc*=0x1f8) returned 1
	[0051.978] GetTokenInformation (in: TokenHandle=0x1f8, TokenInformationClass=0x14, TokenInformation=0x19c9d8, TokenInformationLength=0x4, ReturnLength=0x19c9e4 | out: TokenInformation=0x19c9d8, ReturnLength=0x19c9e4) returned 1
	[0051.978] CloseHandle (hObject=0x1f8) returned 1
	[0051.979] WaitForSingleObject (hHandle=0x1f4, dwMilliseconds=0x0) returned 0x0
	[0051.979] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x3e8) returned 0x0
	[0051.979] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x14) returned 0x62a218
	[0051.979] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x62ba38
	[0051.979] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62ba38, Size=0x20) returned 0x630e80
	[0051.979] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e80, Size=0x40) returned 0x62b260
	[0051.980] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b260, Size=0x80) returned 0x629b78
	[0051.980] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x629b78, Size=0x100) returned 0x62b8d8
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x34) returned 0x62caf8
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x62a968
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x62aa48
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62aa68
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x62bd08
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x62aa78
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x62bd20
	[0051.981] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62aa78, Size=0x8) returned 0x62ab18
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x62bae0
	[0051.981] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62ab18, Size=0x10) returned 0x62ba68
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x62bba0
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x62ba38
	[0051.981] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62ba68, Size=0x20) returned 0x630cf0
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x62ba68
	[0051.981] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x62bb10
	[0051.982] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62a968, Size=0x8) returned 0x62aa78
	[0051.982] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62aa48, Size=0x8) returned 0x62ab18
	[0051.982] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62aa48
	[0051.982] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x62ba80
	[0051.982] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x62ab38
	[0051.982] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x62ba98
	[0051.982] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62ab38, Size=0x8) returned 0x62a968
	[0051.982] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x62bab0
	[0052.159] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62a968, Size=0x10) returned 0x62bac8
	[0052.159] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x62baf8
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62ab38
	[0052.160] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62bac8, Size=0x20) returned 0x630b38
	[0052.160] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62aa78, Size=0x10) returned 0x62bac8
	[0052.160] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62ab18, Size=0x10) returned 0x62bb28
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62ab18
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x62bb40
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x62a968
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x62bdf8
	[0052.160] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62a968, Size=0x8) returned 0x62aa78
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62a968
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x62bdb0
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x62c400
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x62bd38
	[0052.160] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c400, Size=0x8) returned 0x62c380
	[0052.160] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62bac8, Size=0x20) returned 0x630db8
	[0052.160] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62bb28, Size=0x20) returned 0x630d40
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c410
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x62bac8
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x62c4d0
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x62bb28
	[0052.160] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c4d0, Size=0x8) returned 0x62c4b0
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x14) returned 0x62a158
	[0052.160] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x14) returned 0x62a2f8
	[0052.160] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0052.160] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62b8d8 | out: hHeap=0x600000) returned 1
	[0052.161] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19ca28 | out: lpWSAData=0x19ca28) returned 0
	[0052.165] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x62bd80
	[0052.165] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62bd80, Size=0x20) returned 0x630d68
	[0052.165] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630d68, Size=0x40) returned 0x62b2a8
	[0052.165] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b2a8, Size=0x80) returned 0x62b940
	[0052.165] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b940, Size=0x100) returned 0x656a68
	[0052.165] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x62bd50
	[0052.165] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62bd50, Size=0x20) returned 0x630ac0
	[0052.165] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ac0, Size=0x40) returned 0x62b5c0
	[0052.165] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b5c0, Size=0x80) returned 0x657858
	[0052.166] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x657858, Size=0x100) returned 0x657b78
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x62bd50
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x62c490
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x62bde0
	[0052.166] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c490, Size=0x8) returned 0x62c3c0
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x14) returned 0x62a1f8
	[0052.166] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c3c0, Size=0x10) returned 0x62bdc8
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x18) returned 0x62a138
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1a) returned 0x630b60
	[0052.166] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62bdc8, Size=0x20) returned 0x630f70
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1c) returned 0x630d68
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x16) returned 0x62a1d8
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1a) returned 0x630c00
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x62bd68
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x62c3f0
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40) returned 0x62b650
	[0052.166] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c3f0, Size=0x8) returned 0x62c420
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x3c) returned 0x62b410
	[0052.166] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c420, Size=0x10) returned 0x62bdc8
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x14) returned 0x62a238
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x18) returned 0x62a0f8
	[0052.166] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62bdc8, Size=0x20) returned 0x630d90
	[0052.166] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x24) returned 0x62c160
	[0052.166] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0052.166] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x600000) returned 1
	[0052.166] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0052.166] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x657b78 | out: hHeap=0x600000) returned 1
	[0052.167] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x630e30
	[0052.171] EnumServicesStatusExW (in: hSCManager=0x630e30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19c9c4, lpServicesReturned=0x19c9dc, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19c9c4, lpServicesReturned=0x19c9dc, lpResumeHandle=0x0) returned 0
	[0052.172] GetLastError () returned 0xea
	[0052.172] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d48) returned 0x659e10
	[0052.172] EnumServicesStatusExW (in: hSCManager=0x630e30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x659e10, cbBufSize=0x1d48, pcbBytesNeeded=0x19c9c4, lpServicesReturned=0x19c9dc, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x659e10, pcbBytesNeeded=0x19c9c4, lpServicesReturned=0x19c9dc, lpResumeHandle=0x0) returned 1
	[0052.174] CloseServiceHandle (hSCObject=0x630e30) returned 1
	[0052.174] lstrlenW (lpString="Appinfo") returned 7
	[0052.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0052.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0052.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0052.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0052.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0052.176] lstrlenW (lpString="AppXSvc") returned 7
	[0052.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0052.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0052.176] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0052.177] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0052.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0052.177] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0052.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0052.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0052.177] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0052.177] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0052.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0052.177] lstrlenW (lpString="Audiosrv") returned 8
	[0052.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0052.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0052.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0052.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0052.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0052.177] lstrlenW (lpString="BFE") returned 3
	[0052.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0052.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0052.177] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0052.177] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0052.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0052.177] lstrlenW (lpString="BITS") returned 4
	[0052.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0052.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0052.177] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0052.177] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0052.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0052.177] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0052.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0052.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0052.194] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0052.194] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0052.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0052.194] lstrlenW (lpString="CDPSvc") returned 6
	[0052.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0052.195] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0052.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0052.195] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0052.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0052.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0052.195] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0052.195] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0052.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0052.195] lstrlenW (lpString="CryptSvc") returned 8
	[0052.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0052.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0052.195] lstrlenW (lpString="DcomLaunch") returned 10
	[0052.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0052.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0052.195] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0052.195] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0052.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0052.195] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0052.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0052.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0052.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0052.196] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0052.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0052.196] lstrlenW (lpString="Dhcp") returned 4
	[0052.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0052.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0052.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0052.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0052.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0052.196] lstrlenW (lpString="Dnscache") returned 8
	[0052.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0052.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0052.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0052.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0052.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0052.196] lstrlenW (lpString="DoSvc") returned 5
	[0052.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0052.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0052.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0052.196] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0052.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0052.196] lstrlenW (lpString="DPS") returned 3
	[0052.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0052.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0052.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0052.197] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0052.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0052.197] lstrlenW (lpString="DusmSvc") returned 7
	[0052.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0052.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0052.197] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0052.197] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0052.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0052.197] lstrlenW (lpString="EventLog") returned 8
	[0052.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0052.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0052.197] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0052.197] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0052.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0052.197] lstrlenW (lpString="EventSystem") returned 11
	[0052.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0052.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0052.197] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0052.197] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0052.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0052.197] lstrlenW (lpString="FontCache") returned 9
	[0052.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0052.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0052.197] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0052.198] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0052.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0052.198] lstrlenW (lpString="gpsvc") returned 5
	[0052.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0052.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0052.198] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0052.198] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0052.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0052.198] lstrlenW (lpString="iphlpsvc") returned 8
	[0052.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0052.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0052.198] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0052.198] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0052.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0052.198] lstrlenW (lpString="KeyIso") returned 6
	[0052.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0052.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0052.198] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0052.198] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0052.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0052.198] lstrlenW (lpString="LanmanServer") returned 12
	[0052.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0052.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0052.198] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0052.198] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0052.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0052.198] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0052.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0052.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0052.198] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0052.199] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0052.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0052.199] lstrlenW (lpString="lfsvc") returned 5
	[0052.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0052.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0052.199] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0052.199] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0052.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0052.199] lstrlenW (lpString="lmhosts") returned 7
	[0052.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0052.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0052.199] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0052.199] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0052.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0052.199] lstrlenW (lpString="LSM") returned 3
	[0052.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0052.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0052.199] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0052.199] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0052.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0052.199] lstrlenW (lpString="MpsSvc") returned 6
	[0052.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0052.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0052.199] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0052.199] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0052.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0052.200] lstrlenW (lpString="NcbService") returned 10
	[0052.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0052.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0052.200] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0052.200] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0052.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0052.200] lstrlenW (lpString="netprofm") returned 8
	[0052.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0052.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0052.200] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0052.200] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0052.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0052.200] lstrlenW (lpString="NgcSvc") returned 6
	[0052.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0052.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0052.200] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0052.200] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0052.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0052.200] lstrlenW (lpString="NlaSvc") returned 6
	[0052.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0052.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0052.200] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0052.200] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0052.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0052.201] lstrlenW (lpString="nsi") returned 3
	[0052.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0052.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0052.201] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0052.201] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0052.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0052.201] lstrlenW (lpString="PcaSvc") returned 6
	[0052.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0052.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0052.201] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0052.201] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0052.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0052.201] lstrlenW (lpString="PlugPlay") returned 8
	[0052.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0052.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0052.201] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0052.201] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0052.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0052.201] lstrlenW (lpString="Power") returned 5
	[0052.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0052.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0052.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0052.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0052.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0052.201] lstrlenW (lpString="ProfSvc") returned 7
	[0052.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0052.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0052.201] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0052.202] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0052.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0052.202] lstrlenW (lpString="RpcEptMapper") returned 12
	[0052.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0052.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0052.202] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0052.202] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0052.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0052.202] lstrlenW (lpString="RpcSs") returned 5
	[0052.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0052.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0052.202] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0052.202] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0052.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0052.202] lstrlenW (lpString="SamSs") returned 5
	[0052.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0052.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0052.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0052.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0052.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0052.202] lstrlenW (lpString="Schedule") returned 8
	[0052.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0052.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0052.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0052.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0052.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0052.202] lstrlenW (lpString="SecurityHealthService") returned 21
	[0052.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0052.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0052.203] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0052.203] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0052.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0052.203] lstrlenW (lpString="SENS") returned 4
	[0052.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0052.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0052.203] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0052.203] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0052.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0052.203] lstrlenW (lpString="ShellHWDetection") returned 16
	[0052.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0052.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0052.203] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0052.203] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0052.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0052.203] lstrlenW (lpString="Spooler") returned 7
	[0052.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0052.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0052.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0052.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0052.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0052.203] lstrlenW (lpString="SSDPSRV") returned 7
	[0052.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0052.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0052.203] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0052.203] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0052.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0052.204] lstrlenW (lpString="StateRepository") returned 15
	[0052.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0052.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0052.204] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0052.204] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0052.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0052.204] lstrlenW (lpString="SysMain") returned 7
	[0052.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0052.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0052.204] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0052.204] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0052.204] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x659e10 | out: hHeap=0x600000) returned 1
	[0052.204] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x244
	[0052.240] Process32FirstW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0052.241] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0052.241] lstrlenW (lpString="System") returned 6
	[0052.241] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0052.242] lstrlenW (lpString="smss.exe") returned 8
	[0052.242] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0052.242] lstrlenW (lpString="csrss.exe") returned 9
	[0052.243] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0052.243] lstrlenW (lpString="wininit.exe") returned 11
	[0052.243] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0052.244] lstrlenW (lpString="csrss.exe") returned 9
	[0052.244] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0052.244] lstrlenW (lpString="winlogon.exe") returned 12
	[0052.244] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0052.245] lstrlenW (lpString="services.exe") returned 12
	[0052.245] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0052.246] lstrlenW (lpString="lsass.exe") returned 9
	[0052.246] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.246] lstrlenW (lpString="svchost.exe") returned 11
	[0052.246] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0052.247] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0052.247] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0052.247] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0052.247] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.248] lstrlenW (lpString="svchost.exe") returned 11
	[0052.248] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0052.248] lstrlenW (lpString="dwm.exe") returned 7
	[0052.248] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.249] lstrlenW (lpString="svchost.exe") returned 11
	[0052.249] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.288] lstrlenW (lpString="svchost.exe") returned 11
	[0052.288] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.288] lstrlenW (lpString="svchost.exe") returned 11
	[0052.289] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.289] lstrlenW (lpString="svchost.exe") returned 11
	[0052.289] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.290] lstrlenW (lpString="svchost.exe") returned 11
	[0052.290] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.290] lstrlenW (lpString="svchost.exe") returned 11
	[0052.290] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.291] lstrlenW (lpString="svchost.exe") returned 11
	[0052.291] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.291] lstrlenW (lpString="svchost.exe") returned 11
	[0052.291] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.292] lstrlenW (lpString="svchost.exe") returned 11
	[0052.292] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0052.292] lstrlenW (lpString="spoolsv.exe") returned 11
	[0052.292] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.293] lstrlenW (lpString="svchost.exe") returned 11
	[0052.293] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.293] lstrlenW (lpString="svchost.exe") returned 11
	[0052.294] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0052.294] lstrlenW (lpString="audiodg.exe") returned 11
	[0052.294] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0052.295] lstrlenW (lpString="sihost.exe") returned 10
	[0052.295] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.295] lstrlenW (lpString="svchost.exe") returned 11
	[0052.295] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0052.296] lstrlenW (lpString="taskhostw.exe") returned 13
	[0052.296] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0052.296] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0052.296] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0052.297] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0052.297] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0052.297] lstrlenW (lpString="explorer.exe") returned 12
	[0052.297] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0052.298] lstrlenW (lpString="Memory Compression") returned 18
	[0052.298] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0052.298] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0052.298] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0052.299] lstrlenW (lpString="SearchUI.exe") returned 12
	[0052.299] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0052.299] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0052.300] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0052.300] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0052.300] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0052.301] lstrlenW (lpString="taskhostw.exe") returned 13
	[0052.301] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0052.301] lstrlenW (lpString="UsoClient.exe") returned 13
	[0052.301] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0052.302] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0052.302] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0052.302] lstrlenW (lpString="taskhostw.exe") returned 13
	[0052.302] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0052.305] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0052.305] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0052.305] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0052.305] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0052.306] lstrlenW (lpString="msoia.exe") returned 9
	[0052.306] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0052.306] lstrlenW (lpString="msoia.exe") returned 9
	[0052.306] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0052.307] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0052.307] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0052.307] lstrlenW (lpString="screensaver.exe") returned 15
	[0052.307] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0052.308] lstrlenW (lpString="nancyedge.exe") returned 13
	[0052.308] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0052.308] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0052.309] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0052.309] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0052.309] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0052.310] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0052.310] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0052.310] lstrlenW (lpString="percentage.exe") returned 14
	[0052.310] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0052.311] lstrlenW (lpString="hh_him.exe") returned 10
	[0052.311] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0052.311] lstrlenW (lpString="nba.exe") returned 7
	[0052.311] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0052.312] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0052.312] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0052.312] lstrlenW (lpString="citizenship.exe") returned 15
	[0052.312] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0052.313] lstrlenW (lpString="beam removable.exe") returned 18
	[0052.313] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0052.314] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0052.314] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0052.314] lstrlenW (lpString="crest-boating.exe") returned 17
	[0052.314] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0052.315] lstrlenW (lpString="wrist.exe") returned 9
	[0052.315] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0052.316] lstrlenW (lpString="indicationwage.exe") returned 18
	[0052.316] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0052.316] lstrlenW (lpString="theepub.exe") returned 11
	[0052.317] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0052.317] lstrlenW (lpString="dllhost.exe") returned 11
	[0052.317] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0052.318] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0052.318] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0052.323] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0052.323] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0052.324] lstrlenW (lpString="webpage.exe") returned 11
	[0052.324] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0052.324] lstrlenW (lpString="distributed.exe") returned 15
	[0052.324] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0052.325] lstrlenW (lpString="ann.exe") returned 7
	[0052.325] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0052.338] lstrlenW (lpString="conhost.exe") returned 11
	[0052.338] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0052.338] lstrlenW (lpString="conhost.exe") returned 11
	[0052.338] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.339] lstrlenW (lpString="svchost.exe") returned 11
	[0052.339] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0052.340] lstrlenW (lpString="d2.exe") returned 6
	[0052.340] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0052.340] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0052.340] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0052.341] lstrlenW (lpString="conhost.exe") returned 11
	[0052.341] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0052.342] CloseHandle (hObject=0x244) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62b650 | out: hHeap=0x600000) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62b410 | out: hHeap=0x600000) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62a238 | out: hHeap=0x600000) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62a0f8 | out: hHeap=0x600000) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62c160 | out: hHeap=0x600000) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62bde0 | out: hHeap=0x600000) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62a1f8 | out: hHeap=0x600000) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62a138 | out: hHeap=0x600000) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630b60 | out: hHeap=0x600000) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630d68 | out: hHeap=0x600000) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62a1d8 | out: hHeap=0x600000) returned 1
	[0052.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630c00 | out: hHeap=0x600000) returned 1
	[0052.342] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x659de8
	[0052.343] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x669df0
	[0052.343] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6580f0
	[0052.343] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6580f0, Size=0x20) returned 0x630b60
	[0052.343] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630b60, Size=0x40) returned 0x62b770
	[0052.343] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x658108
	[0052.343] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658108, Size=0x20) returned 0x630e08
	[0052.344] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x658288
	[0052.344] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658288, Size=0x20) returned 0x630d68
	[0052.344] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6580d8
	[0052.344] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6580d8, Size=0x20) returned 0x630e30
	[0052.344] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e30, Size=0x40) returned 0x62b410
	[0052.344] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x669df0, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\d2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\d2.exe")) returned 0x1e
	[0052.344] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x679df8
	[0052.344] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x689e00
	[0052.345] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6580a8
	[0052.345] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6580a8, Size=0x20) returned 0x630e30
	[0052.345] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e30, Size=0x40) returned 0x62b260
	[0052.345] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b260, Size=0x80) returned 0x657638
	[0052.345] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x657638, Size=0x100) returned 0x658628
	[0052.345] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.345] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x658628 | out: hHeap=0x600000) returned 1
	[0052.345] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\d2.exe", lpDst=0x679df8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\d2.exe") returned 0x1b
	[0052.345] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x689e00 | out: hHeap=0x600000) returned 1
	[0052.346] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x679df8 | out: hHeap=0x600000) returned 1
	[0052.346] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x100000) returned 0x91e020
	[0052.349] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6580d8
	[0052.349] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6580d8, Size=0x20) returned 0x630e30
	[0052.349] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x658360
	[0052.361] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658360, Size=0x20) returned 0x630e58
	[0052.361] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0052.361] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0052.361] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x0) returned 1
	[0052.361] lstrlenW (lpString="kernel32.dll") returned 12
	[0052.361] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630e30 | out: hHeap=0x600000) returned 1
	[0052.361] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0052.361] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630e58 | out: hHeap=0x600000) returned 1
	[0052.361] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\d2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0052.361] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\d2.exe" (normalized: "c:\\windows\\system32\\d2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0052.363] ReadFile (in: hFile=0x244, lpBuffer=0x91e020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x91e020*, lpNumberOfBytesRead=0x19c9d0*=0x3ee00, lpOverlapped=0x0) returned 1
	[0052.376] WriteFile (in: hFile=0x248, lpBuffer=0x91e020*, nNumberOfBytesToWrite=0x3ee00, lpNumberOfBytesWritten=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x91e020*, lpNumberOfBytesWritten=0x19c9d0*=0x3ee00, lpOverlapped=0x0) returned 1
	[0052.409] ReadFile (in: hFile=0x244, lpBuffer=0x91e020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x91e020*, lpNumberOfBytesRead=0x19c9d0*=0x0, lpOverlapped=0x0) returned 1
	[0052.409] CloseHandle (hObject=0x248) returned 1
	[0052.415] CloseHandle (hObject=0x244) returned 1
	[0052.415] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6582b8
	[0052.415] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6582b8, Size=0x20) returned 0x630bb0
	[0052.415] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6581f8
	[0052.415] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6581f8, Size=0x20) returned 0x630ac0
	[0052.415] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0052.415] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0052.415] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0052.415] lstrlenW (lpString="kernel32.dll") returned 12
	[0052.415] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630ac0 | out: hHeap=0x600000) returned 1
	[0052.415] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0052.416] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630bb0 | out: hHeap=0x600000) returned 1
	[0052.416] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x91e020 | out: hHeap=0x600000) returned 1
	[0052.420] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x658138
	[0052.420] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658138, Size=0x20) returned 0x630e30
	[0052.420] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e30, Size=0x40) returned 0x62b5c0
	[0052.420] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b5c0, Size=0x80) returned 0x657390
	[0052.420] lstrlenW (lpString="C:\\WINDOWS\\System32\\d2.exe") returned 26
	[0052.420] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0052.421] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x5c) returned 0x658aa8
	[0052.421] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19c9a4 | out: phkResult=0x19c9a4*=0x244) returned 0x0
	[0052.421] RegSetValueExW (in: hKey=0x244, lpValueName="d2.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\d2.exe", cbData=0x34 | out: lpData="C:\\WINDOWS\\System32\\d2.exe") returned 0x0
	[0052.421] RegCloseKey (hKey=0x244) returned 0x0
	[0052.421] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x658aa8 | out: hHeap=0x600000) returned 1
	[0052.421] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0052.421] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x657390 | out: hHeap=0x600000) returned 1
	[0052.421] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x679df8
	[0052.422] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x689e00
	[0052.422] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x658330
	[0052.422] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658330, Size=0x20) returned 0x630ca0
	[0052.422] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ca0, Size=0x40) returned 0x62b7b8
	[0052.422] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b7b8, Size=0x80) returned 0x656d30
	[0052.422] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x656d30, Size=0x100) returned 0x658628
	[0052.422] lstrlenW (lpString="") returned 0
	[0052.422] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.422] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8c) returned 0x658730
	[0052.422] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19c950 | out: phkResult=0x19c950*=0x244) returned 0x0
	[0052.422] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19c95c, lpData=0x689e00, lpcbData=0x19c988*=0x7fff | out: lpType=0x19c95c*=0x0, lpData=0x689e00*=0x53, lpcbData=0x19c988*=0x7fff) returned 0x2
	[0052.422] RegCloseKey (hKey=0x244) returned 0x0
	[0052.422] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x658730 | out: hHeap=0x600000) returned 1
	[0052.422] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.422] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8c) returned 0x658730
	[0052.422] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19c950 | out: phkResult=0x19c950*=0x248) returned 0x0
	[0052.424] RegQueryValueExW (in: hKey=0x248, lpValueName="Startup", lpReserved=0x0, lpType=0x19c95c, lpData=0x689e00, lpcbData=0x19c988*=0x7fff | out: lpType=0x19c95c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19c988*=0x98) returned 0x0
	[0052.424] RegCloseKey (hKey=0x248) returned 0x0
	[0052.424] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x658730 | out: hHeap=0x600000) returned 1
	[0052.424] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0052.424] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.424] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x658628 | out: hHeap=0x600000) returned 1
	[0052.424] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", lpDst=0x679df8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe") returned 0x55
	[0052.424] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x689e00 | out: hHeap=0x600000) returned 1
	[0052.424] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x679df8 | out: hHeap=0x600000) returned 1
	[0052.425] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x100000) returned 0x915020
	[0052.472] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x658288
	[0052.473] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658288, Size=0x20) returned 0x630e30
	[0052.473] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6582e8
	[0052.473] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6582e8, Size=0x20) returned 0x630b88
	[0052.473] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0052.473] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0052.473] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0052.473] lstrlenW (lpString="kernel32.dll") returned 12
	[0052.473] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630e30 | out: hHeap=0x600000) returned 1
	[0052.473] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0052.473] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630b88 | out: hHeap=0x600000) returned 1
	[0052.473] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\d2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0052.483] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c
	[0052.485] ReadFile (in: hFile=0x248, lpBuffer=0x915020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x915020*, lpNumberOfBytesRead=0x19c9d0*=0x3ee00, lpOverlapped=0x0) returned 1
	[0052.503] WriteFile (in: hFile=0x24c, lpBuffer=0x915020*, nNumberOfBytesToWrite=0x3ee00, lpNumberOfBytesWritten=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x915020*, lpNumberOfBytesWritten=0x19c9d0*=0x3ee00, lpOverlapped=0x0) returned 1
	[0052.509] ReadFile (in: hFile=0x248, lpBuffer=0x915020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x915020*, lpNumberOfBytesRead=0x19c9d0*=0x0, lpOverlapped=0x0) returned 1
	[0052.509] CloseHandle (hObject=0x24c) returned 1
	[0052.522] CloseHandle (hObject=0x248) returned 1
	[0052.522] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x658330
	[0052.522] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658330, Size=0x20) returned 0x630b60
	[0052.522] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6580f0
	[0052.522] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6580f0, Size=0x20) returned 0x630e30
	[0052.523] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0052.523] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0052.523] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0052.523] lstrlenW (lpString="kernel32.dll") returned 12
	[0052.523] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630e30 | out: hHeap=0x600000) returned 1
	[0052.523] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0052.523] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630b60 | out: hHeap=0x600000) returned 1
	[0052.523] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x915020 | out: hHeap=0x600000) returned 1
	[0052.528] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x679df8
	[0052.528] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x689e00
	[0052.528] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6581f8
	[0052.528] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6581f8, Size=0x20) returned 0x630ca0
	[0052.528] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ca0, Size=0x40) returned 0x62b7b8
	[0052.528] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b7b8, Size=0x80) returned 0x657858
	[0052.528] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x657858, Size=0x100) returned 0x658628
	[0052.528] lstrlenW (lpString="") returned 0
	[0052.528] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.528] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8c) returned 0x658730
	[0052.529] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19c950 | out: phkResult=0x19c950*=0x248) returned 0x0
	[0052.529] RegQueryValueExW (in: hKey=0x248, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19c95c, lpData=0x689e00, lpcbData=0x19c988*=0x7fff | out: lpType=0x19c95c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19c988*=0x78) returned 0x0
	[0052.529] RegCloseKey (hKey=0x248) returned 0x0
	[0052.529] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x658730 | out: hHeap=0x600000) returned 1
	[0052.529] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0052.529] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.529] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x658628 | out: hHeap=0x600000) returned 1
	[0052.529] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", lpDst=0x679df8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe") returned 0x44
	[0052.529] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x689e00 | out: hHeap=0x600000) returned 1
	[0052.529] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x679df8 | out: hHeap=0x600000) returned 1
	[0052.530] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x100000) returned 0x91c020
	[0052.533] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6582e8
	[0052.533] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6582e8, Size=0x20) returned 0x630e30
	[0052.533] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x658240
	[0052.533] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658240, Size=0x20) returned 0x630ac0
	[0052.533] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0052.533] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0052.533] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0052.533] lstrlenW (lpString="kernel32.dll") returned 12
	[0052.533] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630e30 | out: hHeap=0x600000) returned 1
	[0052.533] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0052.533] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630ac0 | out: hHeap=0x600000) returned 1
	[0052.533] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\d2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0052.533] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c
	[0052.534] ReadFile (in: hFile=0x248, lpBuffer=0x91c020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x91c020*, lpNumberOfBytesRead=0x19c9d0*=0x3ee00, lpOverlapped=0x0) returned 1
	[0052.546] WriteFile (in: hFile=0x24c, lpBuffer=0x91c020*, nNumberOfBytesToWrite=0x3ee00, lpNumberOfBytesWritten=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x91c020*, lpNumberOfBytesWritten=0x19c9d0*=0x3ee00, lpOverlapped=0x0) returned 1
	[0052.550] ReadFile (in: hFile=0x248, lpBuffer=0x91c020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x91c020*, lpNumberOfBytesRead=0x19c9d0*=0x0, lpOverlapped=0x0) returned 1
	[0052.551] CloseHandle (hObject=0x24c) returned 1
	[0052.603] CloseHandle (hObject=0x248) returned 1
	[0052.603] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x658240
	[0052.603] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658240, Size=0x20) returned 0x630b60
	[0052.603] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6581f8
	[0052.603] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6581f8, Size=0x20) returned 0x630ac0
	[0052.603] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0052.603] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0052.603] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0052.604] lstrlenW (lpString="kernel32.dll") returned 12
	[0052.604] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630ac0 | out: hHeap=0x600000) returned 1
	[0052.604] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0052.604] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630b60 | out: hHeap=0x600000) returned 1
	[0052.604] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x91c020 | out: hHeap=0x600000) returned 1
	[0052.609] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x659de8 | out: hHeap=0x600000) returned 1
	[0052.609] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x669df0 | out: hHeap=0x600000) returned 1
	[0052.611] lstrlenW (lpString="%windir%\\System32") returned 17
	[0052.611] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62b770 | out: hHeap=0x600000) returned 1
	[0052.611] lstrlenW (lpString="%appdata%") returned 9
	[0052.611] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630e08 | out: hHeap=0x600000) returned 1
	[0052.611] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0052.611] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630d68 | out: hHeap=0x600000) returned 1
	[0052.611] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0052.611] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62b410 | out: hHeap=0x600000) returned 1
	[0052.611] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6581e0
	[0052.611] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6581e0, Size=0x20) returned 0x630d68
	[0052.611] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630d68, Size=0x40) returned 0x62b260
	[0052.611] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b260, Size=0x80) returned 0x657390
	[0052.611] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x658078
	[0052.611] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658078, Size=0x20) returned 0x630b88
	[0052.611] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1fffc) returned 0x659de8
	[0052.612] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x679df0
	[0052.612] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x689df8
	[0052.612] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6581e0
	[0052.612] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6581e0, Size=0x20) returned 0x630ed0
	[0052.612] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ed0, Size=0x40) returned 0x62b260
	[0052.612] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b260, Size=0x80) returned 0x657308
	[0052.612] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x657308, Size=0x100) returned 0x658628
	[0052.612] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.612] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x658628 | out: hHeap=0x600000) returned 1
	[0052.612] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x679df0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0052.612] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x689df8 | out: hHeap=0x600000) returned 1
	[0052.613] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x679df0 | out: hHeap=0x600000) returned 1
	[0052.613] CreatePipe (in: hReadPipe=0x19c990, hWritePipe=0x19c994, lpPipeAttributes=0x19c980, nSize=0x0 | out: hReadPipe=0x19c990*=0x24c, hWritePipe=0x19c994*=0x250) returned 1
	[0052.614] CreatePipe (in: hReadPipe=0x19ca00, hWritePipe=0x19ca04, lpPipeAttributes=0x19c980, nSize=0x0 | out: hReadPipe=0x19ca00*=0x254, hWritePipe=0x19ca04*=0x258) returned 1
	[0052.614] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1
	[0052.614] SetHandleInformation (hObject=0x254, dwMask=0x1, dwFlags=0x0) returned 1
	[0052.614] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19c9a0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x24c, hStdOutput=0x258, hStdError=0x258), lpProcessInformation=0x19c9f0 | out: lpCommandLine=0x0, lpProcessInformation=0x19c9f0*(hProcess=0x260, hThread=0x25c, dwProcessId=0xe5c, dwThreadId=0xf14)) returned 1
	[0052.881] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0052.881] WriteFile (in: hFile=0x250, lpBuffer=0x657390*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19c99c, lpOverlapped=0x0 | out: lpBuffer=0x657390*, lpNumberOfBytesWritten=0x19c99c*=0x41, lpOverlapped=0x0) returned 1
	[0052.881] CloseHandle (hObject=0x260) returned 1
	[0052.881] CloseHandle (hObject=0x25c) returned 1
	[0052.881] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x659de8 | out: hHeap=0x600000) returned 1
	[0052.882] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0052.882] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x657390 | out: hHeap=0x600000) returned 1
	[0052.882] lstrlenW (lpString="%comspec%") returned 9
	[0052.882] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630b88 | out: hHeap=0x600000) returned 1
	[0052.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0052.882] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x658288
	[0052.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x658288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260
	[0052.883] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c430
	[0052.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x62c430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268
	[0052.884] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x658360
	[0052.884] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658360, Size=0x20) returned 0x630ac0
	[0052.884] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ac0, Size=0x40) returned 0x62b5c0
	[0052.884] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0052.884] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xd0) returned 0x62eb30
	[0052.884] GetLogicalDrives () returned 0x4
	[0052.884] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10014) returned 0x659de8
	[0052.884] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6581b0
	[0052.885] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6581b0, Size=0x20) returned 0x630ac0
	[0052.885] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ac0, Size=0x40) returned 0x62b380
	[0052.885] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b380, Size=0x80) returned 0x657968
	[0052.885] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x657968, Size=0x100) returned 0x6586b8
	[0052.885] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6586b8, Size=0x200) returned 0x6586b8
	[0052.885] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6586b8, Size=0x400) returned 0x669e08
	[0052.885] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x669e08, Size=0x800) returned 0x669e08
	[0052.885] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x669e08, Size=0x1000) returned 0x669e08
	[0052.885] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x66ae10
	[0052.885] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6580c0
	[0052.885] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x658228
	[0052.885] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x62c4f0
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x658138
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x62c4e0
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658078
	[0052.886] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c4e0, Size=0x8) returned 0x62c330
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658240
	[0052.886] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c330, Size=0x10) returned 0x6581e0
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x6580d8
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658258
	[0052.886] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6581e0, Size=0x20) returned 0x630d68
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658150
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c300
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xe) returned 0x658090
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xe) returned 0x6581b0
	[0052.886] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630d68, Size=0x40) returned 0x62b650
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xe) returned 0x658198
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xe) returned 0x6580f0
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xe) returned 0x6582e8
	[0052.886] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xe) returned 0x6581e0
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x6580a8
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658300
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c4e0
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658360
	[0052.887] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b650, Size=0x80) returned 0x657638
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658270
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x6582a0
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658168
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658120
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x6582b8
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x6581f8
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658330
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c3f0
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658108
	[0052.887] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658408
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x658390
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x6583a8
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x658420
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x6583d8
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x6583f0
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x6583c0
	[0052.888] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x657638, Size=0x100) returned 0x6586b8
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658438
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x658378
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x62bde0
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x67b2e0
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b400
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b1f0
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c310
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b388
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b160
	[0052.888] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b2f8
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x6) returned 0x62c3a0
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b178
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b310
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c420
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b3b8
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b1a8
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67b298
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b3e8
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b1d8
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b190
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xe) returned 0x67b418
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b1c0
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x67b328
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b3d0
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b340
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b208
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b250
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c330
	[0052.889] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b430
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b358
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b280
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b2b0
	[0052.890] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6586b8, Size=0x200) returned 0x6586b8
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b3a0
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c490
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b2c8
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b268
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b220
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b370
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b238
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b148
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b448
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b598
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b4a8
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67b5c8
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67b5e0
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b5f8
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b5b0
	[0052.890] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67b580
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67b508
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b4d8
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67b538
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67b478
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b4c0
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b460
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b568
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c3b0
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b520
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b490
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b4f0
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c4a0
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b550
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67afb0
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67af68
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67aef0
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67ae48
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67afc8
	[0052.891] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b058
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b070
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67b118
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67af20
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b088
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67af38
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67afe0
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67af80
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67aff8
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b0a0
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b100
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b0b8
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67af50
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b010
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b0d0
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c350
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x6) returned 0x62c470
	[0052.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b130
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67af08
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67ae60
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67af98
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b028
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67b040
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67ae78
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67b0e8
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67ae90
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67aea8
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67aec0
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67aed8
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c038
	[0052.893] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6586b8, Size=0x400) returned 0x67c228
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bed0
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c020
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67bea0
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bd50
	[0052.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bd68
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bff0
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67bd80
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bde0
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bd98
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c008
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c320
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67be40
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67bdb0
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bfa8
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67be58
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bdc8
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bdf8
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xe) returned 0x67bf78
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bfd8
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67be10
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bf30
	[0052.894] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bf18
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67be28
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67be70
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67be88
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67beb8
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c340
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bee8
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bf48
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bf00
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bf60
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bf90
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bfc0
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c1b8
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c098
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c170
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xe) returned 0x67c188
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c128
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xe) returned 0x67c080
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c1a0
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c110
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c068
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c1d0
	[0052.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c0b0
	[0052.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67c1e8
	[0052.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c0c8
	[0052.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c158
	[0052.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c200
	[0052.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c140
	[0052.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c050
	[0052.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c0e0
	[0052.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c0f8
	[0052.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67baf8
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bbd0
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bd20
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bb10
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bc30
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bbe8
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bc00
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bc48
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bd08
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bb88
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x67bcd8
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x12) returned 0x62a1d8
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bc18
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bd38
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bc60
	[0052.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bc78
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bcc0
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bae0
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bab0
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bcf0
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67ba98
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bac8
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bc90
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bca8
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bb70
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67ba50
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67ba68
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67ba80
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bb28
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bb40
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bb58
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67bba0
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67bbb8
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67c978
	[0052.907] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67cac8
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xe) returned 0x67cae0
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67ca08
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c440
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67c960
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c3c0
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67cab0
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67cbe8
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67ca20
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67caf8
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67cba0
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67cbb8
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67cb40
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67ca80
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67cc18
	[0052.908] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67c990
	[0052.909] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67cb70
	[0052.909] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67cb28
	[0052.909] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x67cc30
	[0052.909] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67cc48
	[0052.909] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8) returned 0x62c3d0
	[0052.909] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67cb88
	[0052.909] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xa) returned 0x67ca98
	[0052.909] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67c228, Size=0x800) returned 0x67ce38
	[0052.909] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0052.909] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x669e08 | out: hHeap=0x600000) returned 1
	[0052.909] lstrlenW (lpString="") returned 0
	[0052.910] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67db08 | out: hHeap=0x600000) returned 1
	[0052.910] lstrlenW (lpString=".money") returned 6
	[0052.910] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c4f0, Size=0x8) returned 0x62c560
	[0052.910] lstrlenW (lpString=".money") returned 6
	[0052.910] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67dad8 | out: hHeap=0x600000) returned 1
	[0052.910] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67db80, Size=0x20) returned 0x630e08
	[0052.910] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e08, Size=0x40) returned 0x62b0b0
	[0052.910] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b0b0, Size=0x80) returned 0x656fd8
	[0052.910] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c4f0, Size=0x8) returned 0x62c590
	[0052.910] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c590, Size=0x10) returned 0x67daa8
	[0052.910] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67daa8, Size=0x20) returned 0x630f20
	[0052.910] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0052.910] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x656fd8 | out: hHeap=0x600000) returned 1
	[0052.910] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67da60, Size=0x20) returned 0x630e30
	[0052.910] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e30, Size=0x40) returned 0x62b770
	[0052.910] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0052.910] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0052.910] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62b770 | out: hHeap=0x600000) returned 1
	[0052.910] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67db68, Size=0x20) returned 0x630ac0
	[0052.910] lstrlenW (lpString="Info.hta") returned 8
	[0052.910] lstrlenW (lpString="Info.hta") returned 8
	[0052.910] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630ac0 | out: hHeap=0x600000) returned 1
	[0052.911] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x67de48, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\d2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\d2.exe")) returned 0x1e
	[0052.911] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67de48 | out: hHeap=0x600000) returned 1
	[0052.914] lstrlenW (lpString="d2.exe") returned 6
	[0052.914] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630f20, Size=0x40) returned 0x62b260
	[0052.914] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67daa8, Size=0x20) returned 0x630e30
	[0052.915] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67d9a0, Size=0x20) returned 0x630b88
	[0052.915] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630b88, Size=0x40) returned 0x62b2a8
	[0052.915] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b2a8, Size=0x80) returned 0x657390
	[0052.915] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x657390, Size=0x100) returned 0x6586b8
	[0052.915] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.915] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6586b8 | out: hHeap=0x600000) returned 1
	[0052.915] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x67de48, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0052.915] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x68de50 | out: hHeap=0x600000) returned 1
	[0052.916] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67de48 | out: hHeap=0x600000) returned 1
	[0052.916] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c530, Size=0x8) returned 0x62c600
	[0052.916] lstrlenW (lpString="%windir%;") returned 9
	[0052.916] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630e30 | out: hHeap=0x600000) returned 1
	[0052.916] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0052.916] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66ae10 | out: hHeap=0x600000) returned 1
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67d9a0, Size=0x20) returned 0x630e30
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e30, Size=0x40) returned 0x62b0b0
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b0b0, Size=0x80) returned 0x6571f8
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6571f8, Size=0x100) returned 0x6586b8
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c530, Size=0x8) returned 0x62c680
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c680, Size=0x10) returned 0x67d9a0
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67d9a0, Size=0x20) returned 0x630b60
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c500, Size=0x8) returned 0x62c6c0
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c6b0, Size=0x8) returned 0x62c500
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c590, Size=0x8) returned 0x62c540
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c540, Size=0x10) returned 0x67dc10
	[0052.917] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67dc10, Size=0x20) returned 0x630c00
	[0052.918] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c6c0, Size=0x10) returned 0x67dc10
	[0052.918] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c500, Size=0x10) returned 0x67d9e8
	[0052.918] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c550, Size=0x8) returned 0x62c640
	[0052.918] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c630, Size=0x8) returned 0x62c530
	[0052.918] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67dc10, Size=0x20) returned 0x630e30
	[0052.918] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67d9e8, Size=0x20) returned 0x630b88
	[0052.918] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c610, Size=0x8) returned 0x62c5f0
	[0052.918] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0052.918] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6586b8 | out: hHeap=0x600000) returned 1
	[0052.918] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67daf0, Size=0x20) returned 0x630ac0
	[0052.918] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x669e08, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0052.918] lstrlenW (lpString="C:\\") returned 3
	[0052.918] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19c8e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19c8e4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0052.919] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x669e08 | out: hHeap=0x600000) returned 1
	[0052.920] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c5b0, Size=0x82) returned 0x658748
	[0052.920] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c610, Size=0x100) returned 0x6587d8
	[0052.920] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x658748, Size=0x104) returned 0x67c2b8
	[0052.920] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6587d8, Size=0x200) returned 0x67c3c8
	[0052.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62c550 | out: hHeap=0x600000) returned 1
	[0052.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67c3c8 | out: hHeap=0x600000) returned 1
	[0052.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67dca0 | out: hHeap=0x600000) returned 1
	[0052.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x657528 | out: hHeap=0x600000) returned 1
	[0052.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67dc10 | out: hHeap=0x600000) returned 1
	[0052.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x656d30 | out: hHeap=0x600000) returned 1
	[0052.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67ddf0 | out: hHeap=0x600000) returned 1
	[0052.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67c2b8 | out: hHeap=0x600000) returned 1
	[0052.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67ddd8 | out: hHeap=0x600000) returned 1
	[0052.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6588e0 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67dd48 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67c228 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67dd18 | out: hHeap=0x600000) returned 1
	[0052.922] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67ddd8, Size=0x20) returned 0x630ea8
	[0052.922] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ea8, Size=0x40) returned 0x62b650
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62c620 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67db08 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6586b8 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x657858 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67daf0 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62c6c0 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67db80 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62c160 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62a478 | out: hHeap=0x600000) returned 1
	[0052.922] lstrlenW (lpString="%systemdrive%") returned 13
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630ac0 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x657748 | out: hHeap=0x600000) returned 1
	[0052.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62c590 | out: hHeap=0x600000) returned 1
	[0052.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x659de8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0052.923] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67daf0, Size=0x20) returned 0x630e58
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e58, Size=0x40) returned 0x62b410
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b410, Size=0x80) returned 0x657308
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x657308, Size=0x100) returned 0x6586b8
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6586b8, Size=0x200) returned 0x6586b8
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6586b8, Size=0x400) returned 0x67c228
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67c228, Size=0x800) returned 0x66be10
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66be10, Size=0x1000) returned 0x66be10
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c610, Size=0x8) returned 0x62c550
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62c550, Size=0x10) returned 0x67ddf0
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67ddf0, Size=0x20) returned 0x630e58
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e58, Size=0x40) returned 0x62b0f8
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b0f8, Size=0x80) returned 0x657060
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x657060, Size=0x100) returned 0x6586b8
	[0052.924] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6586b8, Size=0x200) returned 0x6586b8
	[0052.925] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6586b8, Size=0x400) returned 0x67c228
	[0052.925] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x67c228, Size=0x800) returned 0x6a0288
	[0052.925] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0052.925] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66be10 | out: hHeap=0x600000) returned 1
	[0052.925] lstrlenW (lpString="") returned 0
	[0052.925] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6a0010 | out: hHeap=0x600000) returned 1
	[0052.925] lstrlenW (lpString=".money") returned 6
	[0052.925] lstrlenW (lpString=".money") returned 6
	[0052.925] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6a0100 | out: hHeap=0x600000) returned 1
	[0052.925] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69ff98, Size=0x20) returned 0x630e58
	[0052.925] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e58, Size=0x40) returned 0x62b380
	[0052.925] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b380, Size=0x80) returned 0x657a78
	[0052.925] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f158, Size=0x8) returned 0x69f1f8
	[0052.925] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f1f8, Size=0x10) returned 0x6a0130
	[0052.925] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a0130, Size=0x20) returned 0x630e80
	[0052.925] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0052.925] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x657a78 | out: hHeap=0x600000) returned 1
	[0052.925] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69ffe0, Size=0x20) returned 0x630c28
	[0052.926] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630c28, Size=0x40) returned 0x62b770
	[0052.926] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0052.926] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0052.926] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62b770 | out: hHeap=0x600000) returned 1
	[0052.926] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69ff38, Size=0x20) returned 0x630ac0
	[0052.926] lstrlenW (lpString="Info.hta") returned 8
	[0052.926] lstrlenW (lpString="Info.hta") returned 8
	[0052.926] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630ac0 | out: hHeap=0x600000) returned 1
	[0052.926] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6a0a90, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\d2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\d2.exe")) returned 0x1e
	[0052.926] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6a0a90 | out: hHeap=0x600000) returned 1
	[0052.926] lstrlenW (lpString="d2.exe") returned 6
	[0052.926] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e80, Size=0x40) returned 0x62b380
	[0052.926] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a0190, Size=0x20) returned 0x630e58
	[0052.927] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a0100, Size=0x20) returned 0x630e80
	[0052.927] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630e80, Size=0x40) returned 0x62b770
	[0052.927] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b770, Size=0x80) returned 0x657170
	[0052.927] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x657170, Size=0x100) returned 0x6586b8
	[0052.927] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.927] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6586b8 | out: hHeap=0x600000) returned 1
	[0052.927] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6a0a90, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0052.927] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6b0a98 | out: hHeap=0x600000) returned 1
	[0054.168] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6a0a90 | out: hHeap=0x600000) returned 1
	[0054.169] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f0b8, Size=0x8) returned 0x69f218
	[0054.169] lstrlenW (lpString="%windir%;") returned 9
	[0054.169] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630e58 | out: hHeap=0x600000) returned 1
	[0054.169] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0054.169] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x68de68 | out: hHeap=0x600000) returned 1
	[0054.169] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a0190, Size=0x20) returned 0x630ac0
	[0054.169] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ac0, Size=0x40) returned 0x66f0b8
	[0054.169] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f0b8, Size=0x80) returned 0x6570e8
	[0054.169] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6570e8, Size=0x100) returned 0x66e700
	[0054.169] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f258, Size=0x8) returned 0x69f1f8
	[0054.169] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f1f8, Size=0x10) returned 0x6a01a8
	[0054.169] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a01a8, Size=0x20) returned 0x630ac0
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f178, Size=0x8) returned 0x69f1c8
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f0d8, Size=0x8) returned 0x69f0f8
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f1f8, Size=0x8) returned 0x69f138
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f138, Size=0x10) returned 0x69ff50
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69ff50, Size=0x20) returned 0x630ca0
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f1c8, Size=0x10) returned 0x69ff50
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f0f8, Size=0x10) returned 0x6a01c0
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f0d8, Size=0x8) returned 0x69f0f8
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f1c8, Size=0x8) returned 0x69f138
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69ff50, Size=0x20) returned 0x630e58
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a01c0, Size=0x20) returned 0x630ef8
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f158, Size=0x8) returned 0x69f168
	[0054.170] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0054.170] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66e700 | out: hHeap=0x600000) returned 1
	[0054.170] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a0250, Size=0x20) returned 0x631218
	[0054.171] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x68de68, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0054.171] lstrlenW (lpString="C:\\") returned 3
	[0054.171] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19c8e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19c8e4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0054.171] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x68de68 | out: hHeap=0x600000) returned 1
	[0054.172] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f258, Size=0x82) returned 0x66e700
	[0054.172] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f188, Size=0x100) returned 0x66c4e0
	[0054.172] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66e700, Size=0x104) returned 0x67c228
	[0054.172] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66c4e0, Size=0x200) returned 0x6c2178
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x69f158 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6c2178 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66f230 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x656ca8 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66f0b0 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6574a0 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66efc0 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67c228 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66f158 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66e790 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66f0c8 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66c5e8 | out: hHeap=0x600000) returned 1
	[0054.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66f050 | out: hHeap=0x600000) returned 1
	[0054.173] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f068, Size=0x20) returned 0x631240
	[0054.173] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x631240, Size=0x40) returned 0x670d68
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x69f1c8 | out: hHeap=0x600000) returned 1
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6a0250 | out: hHeap=0x600000) returned 1
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67c580 | out: hHeap=0x600000) returned 1
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x658288 | out: hHeap=0x600000) returned 1
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x656e40 | out: hHeap=0x600000) returned 1
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x69ff50 | out: hHeap=0x600000) returned 1
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x69f208 | out: hHeap=0x600000) returned 1
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66f140 | out: hHeap=0x600000) returned 1
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62c0d0 | out: hHeap=0x600000) returned 1
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x62a578 | out: hHeap=0x600000) returned 1
	[0054.174] lstrlenW (lpString="%systemdrive%") returned 13
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631218 | out: hHeap=0x600000) returned 1
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x600000) returned 1
	[0054.174] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x69f178 | out: hHeap=0x600000) returned 1
	[0054.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x67de48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c
	[0054.175] WaitForMultipleObjects (nCount=0x2, lpHandles=0x62eb30*=0x264, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 2
	os_tid = 0xd1c


Thread:
	id = 4
	os_tid = 0x368

	[0054.076] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x69ff20
	[0054.076] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69ff20, Size=0x20) returned 0x630ea8
	[0054.076] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ea8, Size=0x40) returned 0x62b410
	[0054.076] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b410, Size=0x80) returned 0x656c20
	[0054.077] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x656c20, Size=0x100) returned 0x67c228
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6a0160
	[0054.077] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a0160, Size=0x20) returned 0x630ed0
	[0054.077] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ed0, Size=0x40) returned 0x62b0b0
	[0054.077] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x62b0b0, Size=0x80) returned 0x657638
	[0054.077] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x657638, Size=0x100) returned 0x67c330
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x6a0160
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x69f1c8
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x69ff98
	[0054.077] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f1c8, Size=0x8) returned 0x69f128
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x14) returned 0x62a3f8
	[0054.077] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f128, Size=0x10) returned 0x69ffb0
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x18) returned 0x62a478
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1a) returned 0x630e80
	[0054.077] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69ffb0, Size=0x20) returned 0x630c28
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1c) returned 0x630ea8
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x16) returned 0x62a2d8
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1a) returned 0x630bd8
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xc) returned 0x6a0178
	[0054.077] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x4) returned 0x69f188
	[0054.078] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40) returned 0x62b770
	[0054.078] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f188, Size=0x8) returned 0x69f128
	[0054.078] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x3c) returned 0x62b2a8
	[0054.078] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x69f128, Size=0x10) returned 0x6a0190
	[0054.078] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x14) returned 0x62a138
	[0054.078] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x18) returned 0x62a458
	[0054.078] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a0190, Size=0x20) returned 0x630c50
	[0054.078] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x24) returned 0x62c280
	[0054.078] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0054.078] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67c228 | out: hHeap=0x600000) returned 1
	[0054.078] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0054.078] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x67c330 | out: hHeap=0x600000) returned 1
	[0054.078] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x630ef8
	[0054.080] EnumServicesStatusExW (in: hSCManager=0x630ef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0054.088] GetLastError () returned 0xea
	[0054.088] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d48) returned 0x66ef20
	[0054.088] EnumServicesStatusExW (in: hSCManager=0x630ef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x66ef20, cbBufSize=0x1d48, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x66ef20, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0054.093] CloseServiceHandle (hSCObject=0x630ef8) returned 1
	[0054.096] lstrlenW (lpString="Appinfo") returned 7
	[0054.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0054.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0054.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0054.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0054.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0054.096] lstrlenW (lpString="AppXSvc") returned 7
	[0054.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0054.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0054.096] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0054.096] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0054.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0054.096] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0054.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0054.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0054.096] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0054.096] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0054.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0054.096] lstrlenW (lpString="Audiosrv") returned 8
	[0054.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0054.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0054.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0054.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0054.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0054.097] lstrlenW (lpString="BFE") returned 3
	[0054.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0054.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0054.097] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0054.097] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0054.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0054.097] lstrlenW (lpString="BITS") returned 4
	[0054.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0054.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0054.097] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0054.097] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0054.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0054.097] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0054.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0054.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0054.097] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0054.097] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0054.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0054.097] lstrlenW (lpString="CDPSvc") returned 6
	[0054.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0054.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0054.097] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0054.097] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0054.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0054.098] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0054.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0054.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0054.098] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0054.098] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0054.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0054.098] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0054.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0054.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0054.098] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0054.098] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0054.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0054.098] lstrlenW (lpString="CryptSvc") returned 8
	[0054.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0054.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0054.098] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0054.098] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0054.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0054.098] lstrlenW (lpString="DcomLaunch") returned 10
	[0054.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0054.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0054.098] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0054.098] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0054.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0054.098] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0054.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0054.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0054.099] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0054.099] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0054.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0054.099] lstrlenW (lpString="Dhcp") returned 4
	[0054.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0054.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0054.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0054.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0054.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0054.099] lstrlenW (lpString="Dnscache") returned 8
	[0054.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0054.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0054.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0054.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0054.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0054.099] lstrlenW (lpString="DoSvc") returned 5
	[0054.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0054.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0054.099] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0054.100] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0054.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0054.100] lstrlenW (lpString="DPS") returned 3
	[0054.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0054.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0054.100] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0054.100] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0054.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0054.100] lstrlenW (lpString="DusmSvc") returned 7
	[0054.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0054.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0054.100] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0054.100] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0054.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0054.100] lstrlenW (lpString="EventLog") returned 8
	[0054.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0054.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0054.100] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0054.100] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0054.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0054.100] lstrlenW (lpString="EventSystem") returned 11
	[0054.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0054.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0054.101] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0054.101] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0054.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0054.101] lstrlenW (lpString="FontCache") returned 9
	[0054.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0054.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0054.101] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0054.101] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0054.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0054.101] lstrlenW (lpString="gpsvc") returned 5
	[0054.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0054.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0054.101] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0054.101] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0054.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0054.101] lstrlenW (lpString="iphlpsvc") returned 8
	[0054.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0054.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0054.101] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0054.101] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0054.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0054.101] lstrlenW (lpString="KeyIso") returned 6
	[0054.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0054.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0054.102] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0054.102] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0054.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0054.102] lstrlenW (lpString="LanmanServer") returned 12
	[0054.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0054.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0054.102] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0054.102] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0054.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0054.102] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0054.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0054.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0054.102] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0054.102] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0054.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0054.102] lstrlenW (lpString="lfsvc") returned 5
	[0054.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0054.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0054.102] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0054.103] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0054.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0054.103] lstrlenW (lpString="lmhosts") returned 7
	[0054.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0054.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0054.103] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0054.103] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0054.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0054.103] lstrlenW (lpString="LSM") returned 3
	[0054.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0054.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0054.103] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0054.103] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0054.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0054.103] lstrlenW (lpString="MpsSvc") returned 6
	[0054.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0054.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0054.103] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0054.103] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0054.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0054.103] lstrlenW (lpString="NcbService") returned 10
	[0054.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0054.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0054.103] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0054.103] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0054.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0054.104] lstrlenW (lpString="netprofm") returned 8
	[0054.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0054.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0054.104] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0054.104] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0054.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0054.104] lstrlenW (lpString="NgcSvc") returned 6
	[0054.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0054.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0054.104] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0054.104] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0054.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0054.104] lstrlenW (lpString="NlaSvc") returned 6
	[0054.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0054.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0054.104] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0054.104] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0054.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0054.104] lstrlenW (lpString="nsi") returned 3
	[0054.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0054.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0054.105] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0054.105] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0054.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0054.105] lstrlenW (lpString="PcaSvc") returned 6
	[0054.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0054.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0054.105] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0054.105] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0054.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0054.105] lstrlenW (lpString="PlugPlay") returned 8
	[0054.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0054.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0054.105] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0054.105] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0054.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0054.105] lstrlenW (lpString="Power") returned 5
	[0054.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0054.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0054.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0054.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0054.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0054.106] lstrlenW (lpString="ProfSvc") returned 7
	[0054.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0054.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0054.106] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0054.106] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0054.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0054.106] lstrlenW (lpString="RpcEptMapper") returned 12
	[0054.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0054.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0054.106] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0054.106] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0054.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0054.106] lstrlenW (lpString="RpcSs") returned 5
	[0054.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0054.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0054.106] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0054.106] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0054.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0054.106] lstrlenW (lpString="SamSs") returned 5
	[0054.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0054.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0054.106] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0054.106] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0054.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0054.107] lstrlenW (lpString="Schedule") returned 8
	[0054.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0054.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0054.107] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0054.107] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0054.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0054.107] lstrlenW (lpString="SecurityHealthService") returned 21
	[0054.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0054.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0054.107] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0054.107] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0054.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0054.107] lstrlenW (lpString="SENS") returned 4
	[0054.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0054.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0054.107] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0054.107] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0054.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0054.107] lstrlenW (lpString="ShellHWDetection") returned 16
	[0054.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0054.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0054.107] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0054.107] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0054.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0054.108] lstrlenW (lpString="Spooler") returned 7
	[0054.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0054.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0054.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0054.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0054.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0054.108] lstrlenW (lpString="SSDPSRV") returned 7
	[0054.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0054.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0054.108] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0054.108] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0054.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0054.108] lstrlenW (lpString="StateRepository") returned 15
	[0054.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0054.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0054.108] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0054.108] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0054.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0054.108] lstrlenW (lpString="SysMain") returned 7
	[0054.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0054.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0054.108] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0054.108] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0054.109] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x66ef20 | out: hHeap=0x600000) returned 1
	[0054.109] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x298
	[0054.263] Process32FirstW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0054.264] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0054.264] lstrlenW (lpString="System") returned 6
	[0054.264] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0054.265] lstrlenW (lpString="smss.exe") returned 8
	[0054.265] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0054.265] lstrlenW (lpString="csrss.exe") returned 9
	[0054.265] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0054.266] lstrlenW (lpString="wininit.exe") returned 11
	[0054.266] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0054.266] lstrlenW (lpString="csrss.exe") returned 9
	[0054.267] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0054.267] lstrlenW (lpString="winlogon.exe") returned 12
	[0054.267] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0054.268] lstrlenW (lpString="services.exe") returned 12
	[0054.268] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0054.268] lstrlenW (lpString="lsass.exe") returned 9
	[0054.269] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.269] lstrlenW (lpString="svchost.exe") returned 11
	[0054.269] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0054.270] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0054.270] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0054.270] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0054.270] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.271] lstrlenW (lpString="svchost.exe") returned 11
	[0054.271] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0054.271] lstrlenW (lpString="dwm.exe") returned 7
	[0054.271] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.272] lstrlenW (lpString="svchost.exe") returned 11
	[0054.272] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.272] lstrlenW (lpString="svchost.exe") returned 11
	[0054.273] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.273] lstrlenW (lpString="svchost.exe") returned 11
	[0054.273] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.274] lstrlenW (lpString="svchost.exe") returned 11
	[0054.274] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.274] lstrlenW (lpString="svchost.exe") returned 11
	[0054.274] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.275] lstrlenW (lpString="svchost.exe") returned 11
	[0054.275] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.275] lstrlenW (lpString="svchost.exe") returned 11
	[0054.275] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.276] lstrlenW (lpString="svchost.exe") returned 11
	[0054.276] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.276] lstrlenW (lpString="svchost.exe") returned 11
	[0054.276] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0054.277] lstrlenW (lpString="spoolsv.exe") returned 11
	[0054.277] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.277] lstrlenW (lpString="svchost.exe") returned 11
	[0054.277] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.278] lstrlenW (lpString="svchost.exe") returned 11
	[0054.278] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0054.278] lstrlenW (lpString="audiodg.exe") returned 11
	[0054.279] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0054.279] lstrlenW (lpString="sihost.exe") returned 10
	[0054.279] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.279] lstrlenW (lpString="svchost.exe") returned 11
	[0054.280] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0054.280] lstrlenW (lpString="taskhostw.exe") returned 13
	[0054.280] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0054.281] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0054.281] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0054.281] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0054.281] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0054.282] lstrlenW (lpString="explorer.exe") returned 12
	[0054.282] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0054.282] lstrlenW (lpString="Memory Compression") returned 18
	[0054.282] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0054.283] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0054.283] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0054.283] lstrlenW (lpString="SearchUI.exe") returned 12
	[0054.283] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0054.284] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0054.284] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0054.284] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0054.284] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0054.285] lstrlenW (lpString="taskhostw.exe") returned 13
	[0054.285] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0054.285] lstrlenW (lpString="UsoClient.exe") returned 13
	[0054.285] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0054.286] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0054.286] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0054.286] lstrlenW (lpString="taskhostw.exe") returned 13
	[0054.287] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0054.287] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0054.287] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0054.288] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0054.288] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0054.288] lstrlenW (lpString="msoia.exe") returned 9
	[0054.288] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0054.289] lstrlenW (lpString="msoia.exe") returned 9
	[0054.289] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0054.289] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0054.289] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0054.290] lstrlenW (lpString="screensaver.exe") returned 15
	[0054.290] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0054.291] lstrlenW (lpString="nancyedge.exe") returned 13
	[0054.291] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0054.291] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0054.291] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0054.292] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0054.292] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0054.292] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0054.292] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0054.293] lstrlenW (lpString="percentage.exe") returned 14
	[0054.293] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0054.340] lstrlenW (lpString="hh_him.exe") returned 10
	[0054.341] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0054.341] lstrlenW (lpString="nba.exe") returned 7
	[0054.341] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0054.342] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0054.342] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0054.342] lstrlenW (lpString="citizenship.exe") returned 15
	[0054.342] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0054.343] lstrlenW (lpString="beam removable.exe") returned 18
	[0054.343] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0054.343] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0054.344] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0054.344] lstrlenW (lpString="crest-boating.exe") returned 17
	[0054.344] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0054.345] lstrlenW (lpString="wrist.exe") returned 9
	[0054.345] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0054.346] lstrlenW (lpString="indicationwage.exe") returned 18
	[0054.346] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0054.346] lstrlenW (lpString="theepub.exe") returned 11
	[0054.346] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0054.347] lstrlenW (lpString="dllhost.exe") returned 11
	[0054.347] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0054.348] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0054.348] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0054.348] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0054.348] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0054.349] lstrlenW (lpString="webpage.exe") returned 11
	[0054.349] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0054.350] lstrlenW (lpString="distributed.exe") returned 15
	[0054.350] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0054.351] lstrlenW (lpString="ann.exe") returned 7
	[0054.351] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0054.351] lstrlenW (lpString="conhost.exe") returned 11
	[0054.351] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0054.352] lstrlenW (lpString="conhost.exe") returned 11
	[0054.352] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.352] lstrlenW (lpString="svchost.exe") returned 11
	[0054.352] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0054.353] lstrlenW (lpString="d2.exe") returned 6
	[0054.353] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0054.354] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0054.354] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0054.354] lstrlenW (lpString="conhost.exe") returned 11
	[0054.354] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0054.355] lstrlenW (lpString="dllhost.exe") returned 11
	[0054.355] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0054.355] lstrlenW (lpString="cmd.exe") returned 7
	[0054.356] Process32NextW (in: hSnapshot=0x298, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0
	[0054.356] CloseHandle (hObject=0x298) returned 1
	[0054.356] Sleep (dwMilliseconds=0x1f4) 
	[0055.630] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x631088
	[0055.631] EnumServicesStatusExW (in: hSCManager=0x631088, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0055.631] GetLastError () returned 0xea
	[0055.631] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1ce8) returned 0x672f38
	[0055.631] EnumServicesStatusExW (in: hSCManager=0x631088, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x672f38, cbBufSize=0x1ce8, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x672f38, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0055.632] CloseServiceHandle (hSCObject=0x631088) returned 1
	[0055.632] lstrlenW (lpString="Appinfo") returned 7
	[0055.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0055.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0055.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0055.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0055.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0055.633] lstrlenW (lpString="AppXSvc") returned 7
	[0055.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0055.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0055.633] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0055.633] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0055.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0055.633] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0055.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0055.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0055.633] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0055.633] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0055.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0055.633] lstrlenW (lpString="Audiosrv") returned 8
	[0055.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0055.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0055.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0055.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0055.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0055.633] lstrlenW (lpString="BFE") returned 3
	[0055.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0055.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0055.633] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0055.634] lstrlenW (lpString="BITS") returned 4
	[0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0055.634] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0055.634] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0055.634] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0055.634] lstrlenW (lpString="CDPSvc") returned 6
	[0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0055.634] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0055.634] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0055.634] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0055.634] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0055.635] lstrlenW (lpString="CryptSvc") returned 8
	[0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0055.635] lstrlenW (lpString="DcomLaunch") returned 10
	[0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0055.635] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0055.635] lstrlenW (lpString="Dhcp") returned 4
	[0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0055.636] lstrlenW (lpString="Dnscache") returned 8
	[0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0055.636] lstrlenW (lpString="DoSvc") returned 5
	[0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0055.636] lstrlenW (lpString="DPS") returned 3
	[0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0055.636] lstrlenW (lpString="DusmSvc") returned 7
	[0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0055.636] lstrlenW (lpString="EventLog") returned 8
	[0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0055.637] lstrlenW (lpString="EventSystem") returned 11
	[0055.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0055.637] lstrlenW (lpString="FontCache") returned 9
	[0055.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0055.637] lstrlenW (lpString="gpsvc") returned 5
	[0055.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0055.638] lstrlenW (lpString="iphlpsvc") returned 8
	[0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0055.638] lstrlenW (lpString="KeyIso") returned 6
	[0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0055.638] lstrlenW (lpString="LanmanServer") returned 12
	[0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0055.638] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0055.639] lstrlenW (lpString="lfsvc") returned 5
	[0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0055.639] lstrlenW (lpString="lmhosts") returned 7
	[0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0055.639] lstrlenW (lpString="LSM") returned 3
	[0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0055.639] lstrlenW (lpString="MpsSvc") returned 6
	[0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0055.639] lstrlenW (lpString="NcbService") returned 10
	[0055.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0055.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0055.640] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0055.640] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0055.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0055.640] lstrlenW (lpString="netprofm") returned 8
	[0055.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0055.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0055.640] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0055.640] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0055.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0055.640] lstrlenW (lpString="NlaSvc") returned 6
	[0055.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0055.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0055.640] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0055.640] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0055.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0055.640] lstrlenW (lpString="nsi") returned 3
	[0055.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0055.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0055.640] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0055.641] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0055.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0055.641] lstrlenW (lpString="PcaSvc") returned 6
	[0055.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0055.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0055.641] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0055.641] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0055.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0055.641] lstrlenW (lpString="PlugPlay") returned 8
	[0055.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0055.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0055.641] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0055.641] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0055.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0055.641] lstrlenW (lpString="Power") returned 5
	[0055.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0055.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0055.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0055.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0055.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0055.641] lstrlenW (lpString="ProfSvc") returned 7
	[0055.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0055.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0055.641] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0055.641] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0055.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0055.641] lstrlenW (lpString="RpcEptMapper") returned 12
	[0055.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0055.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0055.642] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0055.642] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0055.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0055.642] lstrlenW (lpString="RpcSs") returned 5
	[0055.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0055.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0055.642] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0055.642] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0055.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0055.642] lstrlenW (lpString="SamSs") returned 5
	[0055.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0055.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0055.642] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0055.642] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0055.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0055.642] lstrlenW (lpString="Schedule") returned 8
	[0055.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0055.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0055.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0055.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0055.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0055.642] lstrlenW (lpString="SecurityHealthService") returned 21
	[0055.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0055.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0055.642] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0055.643] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0055.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0055.643] lstrlenW (lpString="SENS") returned 4
	[0055.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0055.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0055.643] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0055.643] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0055.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0055.643] lstrlenW (lpString="ShellHWDetection") returned 16
	[0055.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0055.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0055.643] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0055.643] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0055.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0055.643] lstrlenW (lpString="Spooler") returned 7
	[0055.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0055.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0055.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0055.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0055.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0055.643] lstrlenW (lpString="SSDPSRV") returned 7
	[0055.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0055.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0055.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0055.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0055.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0055.644] lstrlenW (lpString="StateRepository") returned 15
	[0055.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0055.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0055.644] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0055.644] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0055.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0055.644] lstrlenW (lpString="SysMain") returned 7
	[0055.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0055.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0055.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0055.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0055.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0055.644] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0055.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0055.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0055.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0055.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0055.645] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x672f38 | out: hHeap=0x600000) returned 1
	[0055.645] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a0
	[0055.789] Process32FirstW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0055.789] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0055.790] lstrlenW (lpString="System") returned 6
	[0055.790] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0055.790] lstrlenW (lpString="smss.exe") returned 8
	[0055.791] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0055.791] lstrlenW (lpString="csrss.exe") returned 9
	[0055.791] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0055.792] lstrlenW (lpString="wininit.exe") returned 11
	[0055.792] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0055.792] lstrlenW (lpString="csrss.exe") returned 9
	[0055.792] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0055.793] lstrlenW (lpString="winlogon.exe") returned 12
	[0055.793] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0055.793] lstrlenW (lpString="services.exe") returned 12
	[0055.793] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0055.794] lstrlenW (lpString="lsass.exe") returned 9
	[0055.794] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.794] lstrlenW (lpString="svchost.exe") returned 11
	[0055.794] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0055.795] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0055.795] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0055.795] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0055.795] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.796] lstrlenW (lpString="svchost.exe") returned 11
	[0055.796] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0055.796] lstrlenW (lpString="dwm.exe") returned 7
	[0055.796] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.797] lstrlenW (lpString="svchost.exe") returned 11
	[0055.797] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.797] lstrlenW (lpString="svchost.exe") returned 11
	[0055.797] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.798] lstrlenW (lpString="svchost.exe") returned 11
	[0055.798] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.798] lstrlenW (lpString="svchost.exe") returned 11
	[0055.798] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.799] lstrlenW (lpString="svchost.exe") returned 11
	[0055.799] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.799] lstrlenW (lpString="svchost.exe") returned 11
	[0055.800] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.800] lstrlenW (lpString="svchost.exe") returned 11
	[0055.800] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.801] lstrlenW (lpString="svchost.exe") returned 11
	[0055.801] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.801] lstrlenW (lpString="svchost.exe") returned 11
	[0055.801] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0055.802] lstrlenW (lpString="spoolsv.exe") returned 11
	[0055.802] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.802] lstrlenW (lpString="svchost.exe") returned 11
	[0055.802] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.803] lstrlenW (lpString="svchost.exe") returned 11
	[0055.803] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0055.803] lstrlenW (lpString="audiodg.exe") returned 11
	[0055.803] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0055.804] lstrlenW (lpString="sihost.exe") returned 10
	[0055.804] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.842] lstrlenW (lpString="svchost.exe") returned 11
	[0055.842] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0055.842] lstrlenW (lpString="taskhostw.exe") returned 13
	[0055.842] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0055.843] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0055.843] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0055.843] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0055.843] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0055.844] lstrlenW (lpString="explorer.exe") returned 12
	[0055.844] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0055.844] lstrlenW (lpString="Memory Compression") returned 18
	[0055.845] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0055.845] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0055.845] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0055.846] lstrlenW (lpString="SearchUI.exe") returned 12
	[0055.846] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0055.846] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0055.846] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0055.847] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0055.847] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0055.847] lstrlenW (lpString="taskhostw.exe") returned 13
	[0055.847] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0055.848] lstrlenW (lpString="UsoClient.exe") returned 13
	[0055.848] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0055.848] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0055.849] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0055.849] lstrlenW (lpString="taskhostw.exe") returned 13
	[0055.849] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0055.850] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0055.850] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0055.850] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0055.850] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0055.851] lstrlenW (lpString="msoia.exe") returned 9
	[0055.851] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0055.852] lstrlenW (lpString="msoia.exe") returned 9
	[0055.852] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0055.852] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0055.852] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0055.853] lstrlenW (lpString="screensaver.exe") returned 15
	[0055.853] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0055.853] lstrlenW (lpString="nancyedge.exe") returned 13
	[0055.853] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0055.854] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0055.854] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0055.855] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0055.855] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0055.855] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0055.855] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0055.856] lstrlenW (lpString="percentage.exe") returned 14
	[0055.856] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0055.856] lstrlenW (lpString="hh_him.exe") returned 10
	[0055.857] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0055.859] lstrlenW (lpString="nba.exe") returned 7
	[0055.859] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0055.859] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0055.859] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0055.860] lstrlenW (lpString="citizenship.exe") returned 15
	[0055.860] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0055.860] lstrlenW (lpString="beam removable.exe") returned 18
	[0055.860] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0055.861] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0055.861] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0055.862] lstrlenW (lpString="crest-boating.exe") returned 17
	[0055.862] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0055.862] lstrlenW (lpString="wrist.exe") returned 9
	[0055.862] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0055.863] lstrlenW (lpString="indicationwage.exe") returned 18
	[0055.863] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0055.864] lstrlenW (lpString="theepub.exe") returned 11
	[0055.864] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0055.865] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0055.865] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0055.867] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0055.867] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0055.867] lstrlenW (lpString="webpage.exe") returned 11
	[0055.867] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0055.868] lstrlenW (lpString="distributed.exe") returned 15
	[0055.868] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0055.869] lstrlenW (lpString="ann.exe") returned 7
	[0055.869] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.869] lstrlenW (lpString="conhost.exe") returned 11
	[0055.869] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.870] lstrlenW (lpString="conhost.exe") returned 11
	[0055.870] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.871] lstrlenW (lpString="svchost.exe") returned 11
	[0055.871] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0055.871] lstrlenW (lpString="d2.exe") returned 6
	[0055.871] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0055.872] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0055.872] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.873] lstrlenW (lpString="conhost.exe") returned 11
	[0055.873] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0055.873] lstrlenW (lpString="dllhost.exe") returned 11
	[0055.873] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0055.874] lstrlenW (lpString="cmd.exe") returned 7
	[0055.874] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.875] lstrlenW (lpString="conhost.exe") returned 11
	[0055.875] Process32NextW (in: hSnapshot=0x2a0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0055.875] CloseHandle (hObject=0x2a0) returned 1
	[0055.875] Sleep (dwMilliseconds=0x1f4) 
	[0057.326] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6310d8
	[0057.327] EnumServicesStatusExW (in: hSCManager=0x6310d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0057.328] GetLastError () returned 0xea
	[0057.328] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x673cd8
	[0057.329] EnumServicesStatusExW (in: hSCManager=0x6310d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x673cd8, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x673cd8, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0057.329] CloseServiceHandle (hSCObject=0x6310d8) returned 1
	[0057.330] lstrlenW (lpString="Appinfo") returned 7
	[0057.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0057.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0057.330] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0057.330] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0057.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0057.330] lstrlenW (lpString="AppXSvc") returned 7
	[0057.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0057.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0057.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0057.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0057.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0057.330] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0057.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0057.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0057.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0057.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0057.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0057.330] lstrlenW (lpString="Audiosrv") returned 8
	[0057.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0057.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0057.330] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0057.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0057.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0057.331] lstrlenW (lpString="BFE") returned 3
	[0057.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0057.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0057.331] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0057.331] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0057.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0057.331] lstrlenW (lpString="BITS") returned 4
	[0057.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0057.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0057.331] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0057.331] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0057.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0057.331] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0057.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0057.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0057.331] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0057.331] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0057.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0057.331] lstrlenW (lpString="CDPSvc") returned 6
	[0057.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0057.332] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0057.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0057.332] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0057.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0057.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0057.332] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0057.332] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0057.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0057.332] lstrlenW (lpString="CryptSvc") returned 8
	[0057.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0057.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0057.332] lstrlenW (lpString="DcomLaunch") returned 10
	[0057.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0057.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0057.333] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0057.333] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0057.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0057.333] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0057.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0057.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0057.333] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0057.333] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0057.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0057.333] lstrlenW (lpString="Dhcp") returned 4
	[0057.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0057.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0057.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0057.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0057.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0057.333] lstrlenW (lpString="Dnscache") returned 8
	[0057.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0057.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0057.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0057.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0057.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0057.334] lstrlenW (lpString="DoSvc") returned 5
	[0057.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0057.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0057.334] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0057.334] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0057.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0057.334] lstrlenW (lpString="DPS") returned 3
	[0057.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0057.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0057.334] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0057.334] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0057.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0057.334] lstrlenW (lpString="DusmSvc") returned 7
	[0057.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0057.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0057.334] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0057.334] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0057.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0057.334] lstrlenW (lpString="EventLog") returned 8
	[0057.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0057.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0057.335] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0057.335] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0057.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0057.335] lstrlenW (lpString="EventSystem") returned 11
	[0057.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0057.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0057.335] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0057.335] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0057.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0057.335] lstrlenW (lpString="FontCache") returned 9
	[0057.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0057.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0057.335] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0057.335] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0057.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0057.335] lstrlenW (lpString="gpsvc") returned 5
	[0057.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0057.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0057.335] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0057.335] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0057.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0057.336] lstrlenW (lpString="iphlpsvc") returned 8
	[0057.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0057.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0057.336] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0057.336] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0057.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0057.336] lstrlenW (lpString="KeyIso") returned 6
	[0057.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0057.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0057.336] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0057.336] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0057.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0057.336] lstrlenW (lpString="LanmanServer") returned 12
	[0057.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0057.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0057.336] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0057.336] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0057.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0057.336] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0057.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0057.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0057.336] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0057.336] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0057.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0057.337] lstrlenW (lpString="lfsvc") returned 5
	[0057.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0057.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0057.337] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0057.337] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0057.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0057.337] lstrlenW (lpString="lmhosts") returned 7
	[0057.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0057.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0057.337] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0057.337] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0057.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0057.337] lstrlenW (lpString="LSM") returned 3
	[0057.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0057.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0057.337] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0057.337] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0057.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0057.337] lstrlenW (lpString="MapsBroker") returned 10
	[0057.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0057.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0057.337] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0057.338] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0057.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0057.338] lstrlenW (lpString="MpsSvc") returned 6
	[0057.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0057.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0057.338] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0057.338] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0057.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0057.338] lstrlenW (lpString="NcbService") returned 10
	[0057.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0057.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0057.338] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0057.338] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0057.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0057.338] lstrlenW (lpString="netprofm") returned 8
	[0057.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0057.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0057.338] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0057.338] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0057.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0057.338] lstrlenW (lpString="NlaSvc") returned 6
	[0057.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0057.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0057.338] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0057.339] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0057.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0057.339] lstrlenW (lpString="nsi") returned 3
	[0057.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0057.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0057.339] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0057.339] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0057.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0057.339] lstrlenW (lpString="PcaSvc") returned 6
	[0057.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0057.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0057.339] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0057.339] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0057.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0057.339] lstrlenW (lpString="PlugPlay") returned 8
	[0057.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0057.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0057.339] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0057.339] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0057.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0057.339] lstrlenW (lpString="Power") returned 5
	[0057.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0057.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0057.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0057.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0057.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0057.339] lstrlenW (lpString="ProfSvc") returned 7
	[0057.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0057.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0057.340] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0057.340] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0057.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0057.340] lstrlenW (lpString="RpcEptMapper") returned 12
	[0057.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0057.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0057.340] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0057.340] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0057.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0057.340] lstrlenW (lpString="RpcSs") returned 5
	[0057.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0057.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0057.340] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0057.340] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0057.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0057.340] lstrlenW (lpString="SamSs") returned 5
	[0057.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0057.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0057.341] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0057.341] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0057.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0057.341] lstrlenW (lpString="Schedule") returned 8
	[0057.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0057.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0057.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0057.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0057.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0057.341] lstrlenW (lpString="SecurityHealthService") returned 21
	[0057.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0057.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0057.341] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0057.341] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0057.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0057.341] lstrlenW (lpString="SENS") returned 4
	[0057.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0057.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0057.341] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0057.341] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0057.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0057.342] lstrlenW (lpString="ShellHWDetection") returned 16
	[0057.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0057.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0057.342] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0057.342] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0057.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0057.342] lstrlenW (lpString="Spooler") returned 7
	[0057.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0057.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0057.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0057.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0057.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0057.342] lstrlenW (lpString="SSDPSRV") returned 7
	[0057.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0057.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0057.342] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0057.342] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0057.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0057.342] lstrlenW (lpString="StateRepository") returned 15
	[0057.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0057.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0057.343] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0057.343] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0057.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0057.343] lstrlenW (lpString="SysMain") returned 7
	[0057.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0057.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0057.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0057.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0057.343] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x673cd8 | out: hHeap=0x600000) returned 1
	[0057.343] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f0
	[0057.578] Process32FirstW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0057.579] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0057.579] lstrlenW (lpString="System") returned 6
	[0057.579] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0057.580] lstrlenW (lpString="smss.exe") returned 8
	[0057.580] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0057.581] lstrlenW (lpString="csrss.exe") returned 9
	[0057.581] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0057.585] lstrlenW (lpString="wininit.exe") returned 11
	[0057.585] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0057.585] lstrlenW (lpString="csrss.exe") returned 9
	[0057.585] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0057.586] lstrlenW (lpString="winlogon.exe") returned 12
	[0057.586] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0057.586] lstrlenW (lpString="services.exe") returned 12
	[0057.586] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0057.587] lstrlenW (lpString="lsass.exe") returned 9
	[0057.587] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.587] lstrlenW (lpString="svchost.exe") returned 11
	[0057.588] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0057.588] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0057.588] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0057.589] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0057.589] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.589] lstrlenW (lpString="svchost.exe") returned 11
	[0057.589] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0057.590] lstrlenW (lpString="dwm.exe") returned 7
	[0057.590] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.591] lstrlenW (lpString="svchost.exe") returned 11
	[0057.591] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.591] lstrlenW (lpString="svchost.exe") returned 11
	[0057.591] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.592] lstrlenW (lpString="svchost.exe") returned 11
	[0057.592] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.592] lstrlenW (lpString="svchost.exe") returned 11
	[0057.592] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.593] lstrlenW (lpString="svchost.exe") returned 11
	[0057.593] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.593] lstrlenW (lpString="svchost.exe") returned 11
	[0057.593] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.594] lstrlenW (lpString="svchost.exe") returned 11
	[0057.594] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.594] lstrlenW (lpString="svchost.exe") returned 11
	[0057.594] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.595] lstrlenW (lpString="svchost.exe") returned 11
	[0057.595] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0057.596] lstrlenW (lpString="spoolsv.exe") returned 11
	[0057.596] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.596] lstrlenW (lpString="svchost.exe") returned 11
	[0057.596] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.597] lstrlenW (lpString="svchost.exe") returned 11
	[0057.597] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0057.597] lstrlenW (lpString="audiodg.exe") returned 11
	[0057.597] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0057.598] lstrlenW (lpString="sihost.exe") returned 10
	[0057.598] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.598] lstrlenW (lpString="svchost.exe") returned 11
	[0057.598] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0057.599] lstrlenW (lpString="taskhostw.exe") returned 13
	[0057.599] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0057.599] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0057.600] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0057.600] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0057.600] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0057.601] lstrlenW (lpString="explorer.exe") returned 12
	[0057.601] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0057.601] lstrlenW (lpString="Memory Compression") returned 18
	[0057.601] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0057.602] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0057.602] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0057.602] lstrlenW (lpString="SearchUI.exe") returned 12
	[0057.602] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0057.603] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0057.603] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0057.603] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0057.603] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0057.604] lstrlenW (lpString="taskhostw.exe") returned 13
	[0057.604] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0057.604] lstrlenW (lpString="UsoClient.exe") returned 13
	[0057.605] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0057.605] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0057.605] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0057.606] lstrlenW (lpString="taskhostw.exe") returned 13
	[0057.606] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0057.606] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0057.606] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0057.607] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0057.607] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0057.607] lstrlenW (lpString="msoia.exe") returned 9
	[0057.607] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0057.608] lstrlenW (lpString="msoia.exe") returned 9
	[0057.608] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0057.608] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0057.608] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0057.609] lstrlenW (lpString="screensaver.exe") returned 15
	[0057.609] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0057.609] lstrlenW (lpString="nancyedge.exe") returned 13
	[0057.609] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0057.805] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0057.805] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0057.805] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0057.805] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0057.806] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0057.806] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0057.806] lstrlenW (lpString="percentage.exe") returned 14
	[0057.806] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0057.807] lstrlenW (lpString="hh_him.exe") returned 10
	[0057.807] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0057.807] lstrlenW (lpString="nba.exe") returned 7
	[0057.807] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0057.808] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0057.808] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0057.809] lstrlenW (lpString="citizenship.exe") returned 15
	[0057.809] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0057.809] lstrlenW (lpString="beam removable.exe") returned 18
	[0057.809] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0057.810] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0057.810] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0057.811] lstrlenW (lpString="crest-boating.exe") returned 17
	[0057.811] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0057.811] lstrlenW (lpString="wrist.exe") returned 9
	[0057.811] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0057.812] lstrlenW (lpString="indicationwage.exe") returned 18
	[0057.812] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0057.813] lstrlenW (lpString="theepub.exe") returned 11
	[0057.813] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0057.813] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0057.813] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0057.814] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0057.814] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0057.815] lstrlenW (lpString="webpage.exe") returned 11
	[0057.815] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0057.815] lstrlenW (lpString="distributed.exe") returned 15
	[0057.816] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0057.816] lstrlenW (lpString="ann.exe") returned 7
	[0057.816] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.817] lstrlenW (lpString="conhost.exe") returned 11
	[0057.817] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.818] lstrlenW (lpString="conhost.exe") returned 11
	[0057.818] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.818] lstrlenW (lpString="svchost.exe") returned 11
	[0057.819] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0057.819] lstrlenW (lpString="d2.exe") returned 6
	[0057.819] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0057.820] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0057.820] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.820] lstrlenW (lpString="conhost.exe") returned 11
	[0057.820] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0057.821] lstrlenW (lpString="dllhost.exe") returned 11
	[0057.821] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0057.822] lstrlenW (lpString="cmd.exe") returned 7
	[0057.822] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.822] lstrlenW (lpString="conhost.exe") returned 11
	[0057.822] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.823] lstrlenW (lpString="svchost.exe") returned 11
	[0057.823] Process32NextW (in: hSnapshot=0x2f0, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0057.823] CloseHandle (hObject=0x2f0) returned 1
	[0057.823] Sleep (dwMilliseconds=0x1f4) 
	[0058.802] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6311a0
	[0058.803] EnumServicesStatusExW (in: hSCManager=0x6311a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0058.804] GetLastError () returned 0xea
	[0058.804] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x4221d48
	[0058.804] EnumServicesStatusExW (in: hSCManager=0x6311a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4221d48, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4221d48, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0058.805] CloseServiceHandle (hSCObject=0x6311a0) returned 1
	[0058.805] lstrlenW (lpString="Appinfo") returned 7
	[0058.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0058.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0058.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0058.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0058.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0058.805] lstrlenW (lpString="AppXSvc") returned 7
	[0058.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0058.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0058.805] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0058.805] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0058.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0058.805] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0058.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0058.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0058.806] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0058.806] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0058.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0058.806] lstrlenW (lpString="Audiosrv") returned 8
	[0058.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0058.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0058.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0058.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0058.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0058.806] lstrlenW (lpString="BFE") returned 3
	[0058.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0058.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0058.806] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0058.806] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0058.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0058.806] lstrlenW (lpString="BITS") returned 4
	[0058.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0058.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0058.806] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0058.806] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0058.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0058.806] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0058.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0058.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0058.807] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0058.807] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0058.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0058.807] lstrlenW (lpString="CDPSvc") returned 6
	[0058.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0058.807] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0058.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0058.807] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0058.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0058.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0058.807] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0058.807] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0058.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0058.807] lstrlenW (lpString="CryptSvc") returned 8
	[0058.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0058.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0058.807] lstrlenW (lpString="DcomLaunch") returned 10
	[0058.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0058.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0058.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0058.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0058.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0058.808] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0058.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0058.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0058.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0058.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0058.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0058.808] lstrlenW (lpString="Dhcp") returned 4
	[0058.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0058.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0058.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0058.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0058.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0058.808] lstrlenW (lpString="Dnscache") returned 8
	[0058.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0058.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0058.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0058.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0058.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0058.808] lstrlenW (lpString="DoSvc") returned 5
	[0058.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0058.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0058.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0058.809] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0058.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0058.809] lstrlenW (lpString="DPS") returned 3
	[0058.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0058.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0058.809] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0058.809] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0058.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0058.809] lstrlenW (lpString="DusmSvc") returned 7
	[0058.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0058.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0058.809] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0058.809] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0058.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0058.809] lstrlenW (lpString="EventLog") returned 8
	[0058.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0058.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0058.809] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0058.809] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0058.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0058.809] lstrlenW (lpString="EventSystem") returned 11
	[0058.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0058.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0058.809] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0058.809] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0058.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0058.810] lstrlenW (lpString="FontCache") returned 9
	[0058.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0058.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0058.810] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0058.810] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0058.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0058.810] lstrlenW (lpString="gpsvc") returned 5
	[0058.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0058.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0058.810] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0058.810] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0058.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0058.810] lstrlenW (lpString="iphlpsvc") returned 8
	[0058.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0058.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0058.810] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0058.810] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0058.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0058.810] lstrlenW (lpString="KeyIso") returned 6
	[0058.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0058.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0058.810] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0058.810] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0058.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0058.810] lstrlenW (lpString="LanmanServer") returned 12
	[0058.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0058.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0058.811] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0058.811] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0058.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0058.811] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0058.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0058.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0058.811] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0058.811] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0058.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0058.811] lstrlenW (lpString="lfsvc") returned 5
	[0058.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0058.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0058.811] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0058.811] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0058.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0058.811] lstrlenW (lpString="lmhosts") returned 7
	[0058.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0058.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0058.811] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0058.811] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0058.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0058.811] lstrlenW (lpString="LSM") returned 3
	[0058.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0058.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0058.811] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0058.811] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0058.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0058.812] lstrlenW (lpString="MapsBroker") returned 10
	[0058.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0058.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0058.812] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0058.812] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0058.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0058.812] lstrlenW (lpString="MpsSvc") returned 6
	[0058.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0058.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0058.812] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0058.812] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0058.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0058.812] lstrlenW (lpString="NcbService") returned 10
	[0058.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0058.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0058.812] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0058.812] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0058.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0058.812] lstrlenW (lpString="netprofm") returned 8
	[0058.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0058.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0058.812] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0058.812] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0058.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0058.813] lstrlenW (lpString="NlaSvc") returned 6
	[0058.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0058.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0058.813] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0058.813] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0058.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0058.813] lstrlenW (lpString="nsi") returned 3
	[0058.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0058.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0058.813] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0058.813] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0058.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0058.813] lstrlenW (lpString="PcaSvc") returned 6
	[0058.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0058.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0058.813] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0058.813] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0058.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0058.813] lstrlenW (lpString="PlugPlay") returned 8
	[0058.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0058.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0058.813] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0058.813] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0058.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0058.813] lstrlenW (lpString="Power") returned 5
	[0058.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0058.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0058.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0058.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0058.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0058.814] lstrlenW (lpString="ProfSvc") returned 7
	[0058.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0058.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0058.814] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0058.814] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0058.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0058.814] lstrlenW (lpString="RpcEptMapper") returned 12
	[0058.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0058.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0058.814] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0058.814] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0058.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0058.814] lstrlenW (lpString="RpcSs") returned 5
	[0058.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0058.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0058.814] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0058.814] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0058.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0058.814] lstrlenW (lpString="SamSs") returned 5
	[0058.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0058.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0058.814] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0058.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0058.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0058.815] lstrlenW (lpString="Schedule") returned 8
	[0058.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0058.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0058.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0058.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0058.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0058.815] lstrlenW (lpString="SecurityHealthService") returned 21
	[0058.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0058.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0058.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0058.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0058.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0058.815] lstrlenW (lpString="SENS") returned 4
	[0058.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0058.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0058.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0058.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0058.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0058.815] lstrlenW (lpString="ShellHWDetection") returned 16
	[0058.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0058.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0058.815] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0058.815] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0058.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0058.815] lstrlenW (lpString="Spooler") returned 7
	[0058.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0058.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0058.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0058.816] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0058.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0058.816] lstrlenW (lpString="SSDPSRV") returned 7
	[0058.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0058.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0058.816] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0058.816] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0058.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0058.816] lstrlenW (lpString="StateRepository") returned 15
	[0058.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0058.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0058.816] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0058.816] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0058.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0058.816] lstrlenW (lpString="SysMain") returned 7
	[0058.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0058.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0058.816] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0058.816] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0058.816] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4221d48 | out: hHeap=0x600000) returned 1
	[0058.816] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324
	[0059.220] Process32FirstW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0059.220] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0059.221] lstrlenW (lpString="System") returned 6
	[0059.221] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0059.222] lstrlenW (lpString="smss.exe") returned 8
	[0059.222] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0059.223] lstrlenW (lpString="csrss.exe") returned 9
	[0059.223] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0059.223] lstrlenW (lpString="wininit.exe") returned 11
	[0059.223] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0059.224] lstrlenW (lpString="csrss.exe") returned 9
	[0059.224] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0059.225] lstrlenW (lpString="winlogon.exe") returned 12
	[0059.225] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0059.226] lstrlenW (lpString="services.exe") returned 12
	[0059.226] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0059.226] lstrlenW (lpString="lsass.exe") returned 9
	[0059.226] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.227] lstrlenW (lpString="svchost.exe") returned 11
	[0059.227] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0059.227] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0059.227] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0059.228] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0059.228] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.228] lstrlenW (lpString="svchost.exe") returned 11
	[0059.229] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0059.229] lstrlenW (lpString="dwm.exe") returned 7
	[0059.229] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.230] lstrlenW (lpString="svchost.exe") returned 11
	[0059.230] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.230] lstrlenW (lpString="svchost.exe") returned 11
	[0059.230] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.231] lstrlenW (lpString="svchost.exe") returned 11
	[0059.231] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.232] lstrlenW (lpString="svchost.exe") returned 11
	[0059.232] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.232] lstrlenW (lpString="svchost.exe") returned 11
	[0059.232] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.233] lstrlenW (lpString="svchost.exe") returned 11
	[0059.233] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.233] lstrlenW (lpString="svchost.exe") returned 11
	[0059.233] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.234] lstrlenW (lpString="svchost.exe") returned 11
	[0059.234] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.235] lstrlenW (lpString="svchost.exe") returned 11
	[0059.235] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0059.235] lstrlenW (lpString="spoolsv.exe") returned 11
	[0059.235] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.236] lstrlenW (lpString="svchost.exe") returned 11
	[0059.236] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.237] lstrlenW (lpString="svchost.exe") returned 11
	[0059.237] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0059.237] lstrlenW (lpString="audiodg.exe") returned 11
	[0059.237] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0059.238] lstrlenW (lpString="sihost.exe") returned 10
	[0059.238] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.238] lstrlenW (lpString="svchost.exe") returned 11
	[0059.239] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0059.239] lstrlenW (lpString="taskhostw.exe") returned 13
	[0059.239] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0059.240] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0059.240] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0059.241] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0059.241] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0059.242] lstrlenW (lpString="explorer.exe") returned 12
	[0059.242] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0059.242] lstrlenW (lpString="Memory Compression") returned 18
	[0059.242] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0059.243] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0059.243] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0059.243] lstrlenW (lpString="SearchUI.exe") returned 12
	[0059.244] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0059.244] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0059.244] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0059.245] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0059.245] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0059.245] lstrlenW (lpString="taskhostw.exe") returned 13
	[0059.245] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0059.246] lstrlenW (lpString="UsoClient.exe") returned 13
	[0059.246] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0059.246] lstrlenW (lpString="taskhostw.exe") returned 13
	[0059.247] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0059.247] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0059.247] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0059.248] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0059.248] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0059.515] lstrlenW (lpString="msoia.exe") returned 9
	[0059.515] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0059.515] lstrlenW (lpString="msoia.exe") returned 9
	[0059.515] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0059.516] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0059.516] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0059.517] lstrlenW (lpString="screensaver.exe") returned 15
	[0059.517] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0059.517] lstrlenW (lpString="nancyedge.exe") returned 13
	[0059.517] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0059.518] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0059.518] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0059.518] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0059.518] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0059.519] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0059.519] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0059.520] lstrlenW (lpString="percentage.exe") returned 14
	[0059.520] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0059.520] lstrlenW (lpString="hh_him.exe") returned 10
	[0059.521] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0059.521] lstrlenW (lpString="nba.exe") returned 7
	[0059.521] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0059.522] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0059.522] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0059.522] lstrlenW (lpString="citizenship.exe") returned 15
	[0059.522] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0059.523] lstrlenW (lpString="beam removable.exe") returned 18
	[0059.523] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0059.523] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0059.523] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0059.524] lstrlenW (lpString="crest-boating.exe") returned 17
	[0059.524] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0059.525] lstrlenW (lpString="wrist.exe") returned 9
	[0059.525] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0059.526] lstrlenW (lpString="indicationwage.exe") returned 18
	[0059.526] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0059.527] lstrlenW (lpString="theepub.exe") returned 11
	[0059.527] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0059.528] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0059.528] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0059.528] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0059.528] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0059.529] lstrlenW (lpString="webpage.exe") returned 11
	[0059.529] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0059.530] lstrlenW (lpString="distributed.exe") returned 15
	[0059.530] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0059.530] lstrlenW (lpString="ann.exe") returned 7
	[0059.531] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.531] lstrlenW (lpString="conhost.exe") returned 11
	[0059.531] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.532] lstrlenW (lpString="conhost.exe") returned 11
	[0059.532] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.533] lstrlenW (lpString="svchost.exe") returned 11
	[0059.533] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0059.534] lstrlenW (lpString="d2.exe") returned 6
	[0059.534] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0059.534] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0059.534] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.535] lstrlenW (lpString="conhost.exe") returned 11
	[0059.535] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0059.536] lstrlenW (lpString="dllhost.exe") returned 11
	[0059.536] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0059.536] lstrlenW (lpString="cmd.exe") returned 7
	[0059.536] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.537] lstrlenW (lpString="conhost.exe") returned 11
	[0059.537] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.538] lstrlenW (lpString="svchost.exe") returned 11
	[0059.538] Process32NextW (in: hSnapshot=0x324, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0059.538] CloseHandle (hObject=0x324) returned 1
	[0059.538] Sleep (dwMilliseconds=0x1f4) 
	[0060.401] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x631218
	[0060.433] EnumServicesStatusExW (in: hSCManager=0x631218, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0060.434] GetLastError () returned 0xea
	[0060.434] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x3632790
	[0060.434] EnumServicesStatusExW (in: hSCManager=0x631218, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3632790, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3632790, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0060.435] CloseServiceHandle (hSCObject=0x631218) returned 1
	[0060.435] lstrlenW (lpString="Appinfo") returned 7
	[0060.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0060.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0060.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0060.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0060.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0060.435] lstrlenW (lpString="AppXSvc") returned 7
	[0060.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0060.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0060.435] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0060.435] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0060.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0060.435] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0060.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0060.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0060.435] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0060.436] lstrlenW (lpString="Audiosrv") returned 8
	[0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0060.436] lstrlenW (lpString="BFE") returned 3
	[0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0060.436] lstrlenW (lpString="BITS") returned 4
	[0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0060.436] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0060.437] lstrlenW (lpString="CDPSvc") returned 6
	[0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0060.437] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0060.437] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0060.437] lstrlenW (lpString="CryptSvc") returned 8
	[0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0060.437] lstrlenW (lpString="DcomLaunch") returned 10
	[0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0060.438] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0060.438] lstrlenW (lpString="Dhcp") returned 4
	[0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0060.438] lstrlenW (lpString="Dnscache") returned 8
	[0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0060.438] lstrlenW (lpString="DoSvc") returned 5
	[0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0060.439] lstrlenW (lpString="DPS") returned 3
	[0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0060.439] lstrlenW (lpString="DusmSvc") returned 7
	[0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0060.439] lstrlenW (lpString="EventLog") returned 8
	[0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0060.439] lstrlenW (lpString="EventSystem") returned 11
	[0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0060.440] lstrlenW (lpString="FontCache") returned 9
	[0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0060.440] lstrlenW (lpString="gpsvc") returned 5
	[0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0060.440] lstrlenW (lpString="iphlpsvc") returned 8
	[0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0060.440] lstrlenW (lpString="KeyIso") returned 6
	[0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0060.441] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0060.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0060.441] lstrlenW (lpString="LanmanServer") returned 12
	[0060.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0060.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0060.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0060.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0060.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0060.441] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0060.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0060.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0060.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0060.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0060.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0060.441] lstrlenW (lpString="lfsvc") returned 5
	[0060.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0060.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0060.441] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0060.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0060.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0060.441] lstrlenW (lpString="lmhosts") returned 7
	[0060.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0060.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0060.441] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0060.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0060.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0060.442] lstrlenW (lpString="LSM") returned 3
	[0060.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0060.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0060.442] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0060.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0060.442] lstrlenW (lpString="MapsBroker") returned 10
	[0060.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0060.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0060.442] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0060.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0060.442] lstrlenW (lpString="MpsSvc") returned 6
	[0060.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0060.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0060.442] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0060.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0060.442] lstrlenW (lpString="NcbService") returned 10
	[0060.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0060.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0060.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0060.442] lstrlenW (lpString="netprofm") returned 8
	[0060.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0060.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0060.442] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0060.443] lstrlenW (lpString="NlaSvc") returned 6
	[0060.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0060.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0060.443] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0060.443] lstrlenW (lpString="nsi") returned 3
	[0060.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0060.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0060.443] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0060.443] lstrlenW (lpString="PcaSvc") returned 6
	[0060.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0060.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0060.443] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0060.443] lstrlenW (lpString="PlugPlay") returned 8
	[0060.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0060.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0060.443] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0060.444] lstrlenW (lpString="Power") returned 5
	[0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0060.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0060.444] lstrlenW (lpString="ProfSvc") returned 7
	[0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0060.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0060.444] lstrlenW (lpString="RpcEptMapper") returned 12
	[0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0060.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0060.444] lstrlenW (lpString="RpcSs") returned 5
	[0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0060.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0060.445] lstrlenW (lpString="SamSs") returned 5
	[0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0060.445] lstrlenW (lpString="Schedule") returned 8
	[0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0060.445] lstrlenW (lpString="SecurityHealthService") returned 21
	[0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0060.445] lstrlenW (lpString="SENS") returned 4
	[0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0060.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0060.446] lstrlenW (lpString="ShellHWDetection") returned 16
	[0060.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0060.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0060.446] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0060.446] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0060.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0060.446] lstrlenW (lpString="Spooler") returned 7
	[0060.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0060.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0060.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0060.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0060.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0060.446] lstrlenW (lpString="SSDPSRV") returned 7
	[0060.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0060.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0060.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0060.446] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0060.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0060.446] lstrlenW (lpString="StateRepository") returned 15
	[0060.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0060.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0060.446] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0060.446] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0060.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0060.446] lstrlenW (lpString="SysMain") returned 7
	[0060.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0060.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0060.447] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0060.447] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0060.447] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3632790 | out: hHeap=0x600000) returned 1
	[0060.447] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368
	[0060.935] Process32FirstW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0060.936] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0060.936] lstrlenW (lpString="System") returned 6
	[0060.936] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0060.937] lstrlenW (lpString="smss.exe") returned 8
	[0060.937] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0060.938] lstrlenW (lpString="csrss.exe") returned 9
	[0060.938] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0060.938] lstrlenW (lpString="wininit.exe") returned 11
	[0060.938] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0060.939] lstrlenW (lpString="csrss.exe") returned 9
	[0060.939] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0060.939] lstrlenW (lpString="winlogon.exe") returned 12
	[0060.939] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0060.940] lstrlenW (lpString="services.exe") returned 12
	[0060.940] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0060.940] lstrlenW (lpString="lsass.exe") returned 9
	[0060.941] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.941] lstrlenW (lpString="svchost.exe") returned 11
	[0060.941] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0060.942] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0060.942] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0060.942] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0060.942] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.943] lstrlenW (lpString="svchost.exe") returned 11
	[0060.943] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0060.943] lstrlenW (lpString="dwm.exe") returned 7
	[0060.943] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.944] lstrlenW (lpString="svchost.exe") returned 11
	[0060.944] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.947] lstrlenW (lpString="svchost.exe") returned 11
	[0060.948] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.948] lstrlenW (lpString="svchost.exe") returned 11
	[0060.948] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.949] lstrlenW (lpString="svchost.exe") returned 11
	[0060.949] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.949] lstrlenW (lpString="svchost.exe") returned 11
	[0060.949] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.950] lstrlenW (lpString="svchost.exe") returned 11
	[0060.950] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.950] lstrlenW (lpString="svchost.exe") returned 11
	[0060.950] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.951] lstrlenW (lpString="svchost.exe") returned 11
	[0060.951] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.951] lstrlenW (lpString="svchost.exe") returned 11
	[0060.951] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0060.952] lstrlenW (lpString="spoolsv.exe") returned 11
	[0060.952] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.953] lstrlenW (lpString="svchost.exe") returned 11
	[0060.953] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.953] lstrlenW (lpString="svchost.exe") returned 11
	[0060.953] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0060.954] lstrlenW (lpString="audiodg.exe") returned 11
	[0060.954] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0060.954] lstrlenW (lpString="sihost.exe") returned 10
	[0060.955] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.955] lstrlenW (lpString="svchost.exe") returned 11
	[0060.955] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0060.956] lstrlenW (lpString="taskhostw.exe") returned 13
	[0060.956] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0060.956] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0060.956] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0060.957] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0060.957] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0060.957] lstrlenW (lpString="explorer.exe") returned 12
	[0060.957] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0060.958] lstrlenW (lpString="Memory Compression") returned 18
	[0060.958] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0060.959] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0060.959] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0060.959] lstrlenW (lpString="SearchUI.exe") returned 12
	[0060.959] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0060.960] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0060.960] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0060.960] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0060.960] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0060.961] lstrlenW (lpString="taskhostw.exe") returned 13
	[0060.961] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0060.962] lstrlenW (lpString="UsoClient.exe") returned 13
	[0060.962] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0060.962] lstrlenW (lpString="taskhostw.exe") returned 13
	[0060.962] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0060.963] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0060.963] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0061.405] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0061.405] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0061.406] lstrlenW (lpString="msoia.exe") returned 9
	[0061.406] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0061.406] lstrlenW (lpString="msoia.exe") returned 9
	[0061.406] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0061.407] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0061.407] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0061.407] lstrlenW (lpString="screensaver.exe") returned 15
	[0061.407] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0061.408] lstrlenW (lpString="nancyedge.exe") returned 13
	[0061.408] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0061.409] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0061.409] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0061.409] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0061.409] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0061.410] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0061.410] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0061.410] lstrlenW (lpString="percentage.exe") returned 14
	[0061.410] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0061.411] lstrlenW (lpString="hh_him.exe") returned 10
	[0061.411] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0061.412] lstrlenW (lpString="nba.exe") returned 7
	[0061.412] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0061.412] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0061.412] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0061.413] lstrlenW (lpString="citizenship.exe") returned 15
	[0061.413] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0061.413] lstrlenW (lpString="beam removable.exe") returned 18
	[0061.413] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0061.414] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0061.414] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0061.414] lstrlenW (lpString="crest-boating.exe") returned 17
	[0061.414] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0061.415] lstrlenW (lpString="wrist.exe") returned 9
	[0061.415] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0061.416] lstrlenW (lpString="indicationwage.exe") returned 18
	[0061.416] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0061.417] lstrlenW (lpString="theepub.exe") returned 11
	[0061.417] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0061.418] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0061.418] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0061.419] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0061.419] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0061.419] lstrlenW (lpString="webpage.exe") returned 11
	[0061.419] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0061.420] lstrlenW (lpString="distributed.exe") returned 15
	[0061.420] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0061.421] lstrlenW (lpString="ann.exe") returned 7
	[0061.421] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.421] lstrlenW (lpString="conhost.exe") returned 11
	[0061.421] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.422] lstrlenW (lpString="conhost.exe") returned 11
	[0061.422] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.423] lstrlenW (lpString="svchost.exe") returned 11
	[0061.423] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0061.423] lstrlenW (lpString="d2.exe") returned 6
	[0061.423] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0061.424] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0061.424] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.425] lstrlenW (lpString="conhost.exe") returned 11
	[0061.425] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0061.425] lstrlenW (lpString="dllhost.exe") returned 11
	[0061.425] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0061.426] lstrlenW (lpString="cmd.exe") returned 7
	[0061.426] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.426] lstrlenW (lpString="conhost.exe") returned 11
	[0061.426] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.427] lstrlenW (lpString="svchost.exe") returned 11
	[0061.427] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0061.428] CloseHandle (hObject=0x368) returned 1
	[0061.428] Sleep (dwMilliseconds=0x1f4) 
	[0062.349] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x631178
	[0062.350] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0062.350] GetLastError () returned 0xea
	[0062.350] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x670f30
	[0062.351] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x670f30, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x670f30, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0062.351] CloseServiceHandle (hSCObject=0x631178) returned 1
	[0062.352] lstrlenW (lpString="Appinfo") returned 7
	[0062.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0062.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0062.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0062.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0062.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0062.352] lstrlenW (lpString="AppXSvc") returned 7
	[0062.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0062.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0062.352] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0062.352] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0062.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0062.352] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0062.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0062.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0062.352] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0062.352] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0062.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0062.352] lstrlenW (lpString="Audiosrv") returned 8
	[0062.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0062.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0062.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0062.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0062.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0062.352] lstrlenW (lpString="BFE") returned 3
	[0062.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0062.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0062.353] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0062.353] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0062.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0062.353] lstrlenW (lpString="BITS") returned 4
	[0062.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0062.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0062.353] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0062.353] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0062.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0062.353] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0062.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0062.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0062.353] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0062.353] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0062.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0062.353] lstrlenW (lpString="CDPSvc") returned 6
	[0062.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0062.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0062.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0062.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0062.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0062.353] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0062.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0062.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0062.354] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0062.354] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0062.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0062.354] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0062.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0062.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0062.354] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0062.354] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0062.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0062.354] lstrlenW (lpString="CryptSvc") returned 8
	[0062.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0062.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0062.354] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0062.354] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0062.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0062.354] lstrlenW (lpString="DcomLaunch") returned 10
	[0062.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0062.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0062.354] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0062.354] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0062.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0062.355] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0062.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0062.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0062.355] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0062.355] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0062.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0062.355] lstrlenW (lpString="Dhcp") returned 4
	[0062.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0062.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0062.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0062.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0062.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0062.355] lstrlenW (lpString="Dnscache") returned 8
	[0062.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0062.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0062.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0062.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0062.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0062.355] lstrlenW (lpString="DoSvc") returned 5
	[0062.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0062.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0062.356] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0062.356] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0062.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0062.356] lstrlenW (lpString="DPS") returned 3
	[0062.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0062.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0062.356] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0062.356] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0062.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0062.356] lstrlenW (lpString="DusmSvc") returned 7
	[0062.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0062.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0062.356] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0062.356] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0062.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0062.356] lstrlenW (lpString="EventLog") returned 8
	[0062.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0062.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0062.356] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0062.356] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0062.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0062.356] lstrlenW (lpString="EventSystem") returned 11
	[0062.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0062.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0062.357] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0062.357] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0062.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0062.357] lstrlenW (lpString="FontCache") returned 9
	[0062.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0062.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0062.357] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0062.357] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0062.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0062.357] lstrlenW (lpString="gpsvc") returned 5
	[0062.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0062.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0062.357] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0062.357] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0062.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0062.357] lstrlenW (lpString="iphlpsvc") returned 8
	[0062.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0062.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0062.358] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0062.358] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0062.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0062.358] lstrlenW (lpString="KeyIso") returned 6
	[0062.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0062.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0062.358] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0062.358] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0062.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0062.358] lstrlenW (lpString="LanmanServer") returned 12
	[0062.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0062.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0062.358] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0062.358] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0062.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0062.358] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0062.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0062.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0062.358] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0062.358] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0062.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0062.359] lstrlenW (lpString="lfsvc") returned 5
	[0062.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0062.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0062.359] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0062.359] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0062.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0062.359] lstrlenW (lpString="lmhosts") returned 7
	[0062.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0062.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0062.359] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0062.359] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0062.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0062.359] lstrlenW (lpString="LSM") returned 3
	[0062.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0062.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0062.359] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0062.359] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0062.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0062.359] lstrlenW (lpString="MapsBroker") returned 10
	[0062.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0062.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0062.359] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0062.360] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0062.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0062.360] lstrlenW (lpString="MpsSvc") returned 6
	[0062.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0062.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0062.360] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0062.360] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0062.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0062.360] lstrlenW (lpString="NcbService") returned 10
	[0062.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0062.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0062.360] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0062.360] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0062.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0062.360] lstrlenW (lpString="netprofm") returned 8
	[0062.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0062.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0062.360] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0062.360] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0062.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0062.360] lstrlenW (lpString="NlaSvc") returned 6
	[0062.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0062.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0062.360] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0062.361] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0062.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0062.361] lstrlenW (lpString="nsi") returned 3
	[0062.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0062.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0062.361] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0062.361] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0062.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0062.361] lstrlenW (lpString="PcaSvc") returned 6
	[0062.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0062.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0062.361] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0062.361] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0062.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0062.361] lstrlenW (lpString="PlugPlay") returned 8
	[0062.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0062.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0062.361] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0062.361] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0062.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0062.361] lstrlenW (lpString="Power") returned 5
	[0062.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0062.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0062.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0062.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0062.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0062.362] lstrlenW (lpString="ProfSvc") returned 7
	[0062.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0062.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0062.362] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0062.362] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0062.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0062.362] lstrlenW (lpString="RpcEptMapper") returned 12
	[0062.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0062.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0062.362] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0062.362] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0062.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0062.362] lstrlenW (lpString="RpcSs") returned 5
	[0062.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0062.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0062.362] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0062.362] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0062.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0062.363] lstrlenW (lpString="SamSs") returned 5
	[0062.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0062.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0062.363] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0062.363] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0062.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0062.363] lstrlenW (lpString="Schedule") returned 8
	[0062.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0062.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0062.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0062.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0062.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0062.363] lstrlenW (lpString="SecurityHealthService") returned 21
	[0062.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0062.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0062.363] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0062.363] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0062.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0062.363] lstrlenW (lpString="SENS") returned 4
	[0062.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0062.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0062.363] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0062.363] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0062.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0062.363] lstrlenW (lpString="ShellHWDetection") returned 16
	[0062.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0062.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0062.364] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0062.364] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0062.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0062.364] lstrlenW (lpString="Spooler") returned 7
	[0062.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0062.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0062.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0062.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0062.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0062.643] lstrlenW (lpString="SSDPSRV") returned 7
	[0062.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0062.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0062.643] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0062.643] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0062.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0062.643] lstrlenW (lpString="StateRepository") returned 15
	[0062.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0062.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0062.644] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0062.644] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0062.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0062.644] lstrlenW (lpString="SysMain") returned 7
	[0062.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0062.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0062.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0062.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0062.644] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x670f30 | out: hHeap=0x600000) returned 1
	[0062.644] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360
	[0062.652] Process32FirstW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0062.652] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0062.653] lstrlenW (lpString="System") returned 6
	[0062.653] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0062.653] lstrlenW (lpString="smss.exe") returned 8
	[0062.653] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0062.654] lstrlenW (lpString="csrss.exe") returned 9
	[0062.654] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0062.654] lstrlenW (lpString="wininit.exe") returned 11
	[0062.654] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0062.655] lstrlenW (lpString="csrss.exe") returned 9
	[0062.655] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0062.656] lstrlenW (lpString="winlogon.exe") returned 12
	[0062.656] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0062.656] lstrlenW (lpString="services.exe") returned 12
	[0062.656] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0062.657] lstrlenW (lpString="lsass.exe") returned 9
	[0062.657] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.657] lstrlenW (lpString="svchost.exe") returned 11
	[0062.657] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0062.658] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0062.658] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0062.658] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0062.658] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.659] lstrlenW (lpString="svchost.exe") returned 11
	[0062.659] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0062.660] lstrlenW (lpString="dwm.exe") returned 7
	[0062.660] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.660] lstrlenW (lpString="svchost.exe") returned 11
	[0062.660] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.661] lstrlenW (lpString="svchost.exe") returned 11
	[0062.661] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.661] lstrlenW (lpString="svchost.exe") returned 11
	[0062.661] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.662] lstrlenW (lpString="svchost.exe") returned 11
	[0062.662] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.662] lstrlenW (lpString="svchost.exe") returned 11
	[0062.663] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.667] lstrlenW (lpString="svchost.exe") returned 11
	[0062.667] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.668] lstrlenW (lpString="svchost.exe") returned 11
	[0062.668] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.668] lstrlenW (lpString="svchost.exe") returned 11
	[0062.668] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.669] lstrlenW (lpString="svchost.exe") returned 11
	[0062.669] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0062.669] lstrlenW (lpString="spoolsv.exe") returned 11
	[0062.669] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.670] lstrlenW (lpString="svchost.exe") returned 11
	[0062.670] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.670] lstrlenW (lpString="svchost.exe") returned 11
	[0062.670] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0062.671] lstrlenW (lpString="audiodg.exe") returned 11
	[0062.671] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0062.671] lstrlenW (lpString="sihost.exe") returned 10
	[0062.671] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.672] lstrlenW (lpString="svchost.exe") returned 11
	[0062.672] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0062.673] lstrlenW (lpString="taskhostw.exe") returned 13
	[0062.673] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0062.673] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0062.673] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0062.674] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0062.674] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0062.674] lstrlenW (lpString="explorer.exe") returned 12
	[0062.674] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0062.675] lstrlenW (lpString="Memory Compression") returned 18
	[0062.675] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0062.675] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0062.676] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0062.676] lstrlenW (lpString="SearchUI.exe") returned 12
	[0062.676] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0062.678] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0062.678] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0062.679] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0062.679] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0062.679] lstrlenW (lpString="taskhostw.exe") returned 13
	[0062.679] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0062.680] lstrlenW (lpString="UsoClient.exe") returned 13
	[0062.680] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0062.680] lstrlenW (lpString="taskhostw.exe") returned 13
	[0062.680] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0062.681] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0062.681] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0062.681] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0062.682] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0062.682] lstrlenW (lpString="msoia.exe") returned 9
	[0062.682] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0062.683] lstrlenW (lpString="msoia.exe") returned 9
	[0062.683] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0062.683] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0062.683] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0063.362] lstrlenW (lpString="screensaver.exe") returned 15
	[0063.362] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0063.362] lstrlenW (lpString="nancyedge.exe") returned 13
	[0063.362] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0063.363] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0063.363] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0063.363] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0063.363] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0063.364] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0063.364] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0063.365] lstrlenW (lpString="percentage.exe") returned 14
	[0063.365] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0063.366] lstrlenW (lpString="hh_him.exe") returned 10
	[0063.366] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0063.366] lstrlenW (lpString="nba.exe") returned 7
	[0063.366] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0063.370] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0063.370] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0063.371] lstrlenW (lpString="citizenship.exe") returned 15
	[0063.371] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0063.371] lstrlenW (lpString="beam removable.exe") returned 18
	[0063.372] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0063.372] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0063.372] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0063.373] lstrlenW (lpString="crest-boating.exe") returned 17
	[0063.373] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0063.374] lstrlenW (lpString="wrist.exe") returned 9
	[0063.374] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0063.374] lstrlenW (lpString="indicationwage.exe") returned 18
	[0063.374] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0063.375] lstrlenW (lpString="theepub.exe") returned 11
	[0063.375] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0063.376] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0063.376] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0063.377] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0063.377] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0063.378] lstrlenW (lpString="webpage.exe") returned 11
	[0063.378] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0063.378] lstrlenW (lpString="distributed.exe") returned 15
	[0063.378] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0063.379] lstrlenW (lpString="ann.exe") returned 7
	[0063.379] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0063.380] lstrlenW (lpString="conhost.exe") returned 11
	[0063.380] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0063.381] lstrlenW (lpString="conhost.exe") returned 11
	[0063.381] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0063.381] lstrlenW (lpString="svchost.exe") returned 11
	[0063.381] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0063.382] lstrlenW (lpString="d2.exe") returned 6
	[0063.382] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0063.383] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0063.383] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0063.383] lstrlenW (lpString="conhost.exe") returned 11
	[0063.384] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0063.384] lstrlenW (lpString="dllhost.exe") returned 11
	[0063.384] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0063.385] lstrlenW (lpString="cmd.exe") returned 7
	[0063.385] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0063.385] lstrlenW (lpString="conhost.exe") returned 11
	[0063.386] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0063.386] lstrlenW (lpString="svchost.exe") returned 11
	[0063.386] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0063.387] CloseHandle (hObject=0x360) returned 1
	[0063.387] Sleep (dwMilliseconds=0x1f4) 
	[0064.411] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x631178
	[0064.412] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0064.412] GetLastError () returned 0xea
	[0064.413] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x669e08
	[0064.413] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x669e08, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x669e08, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0064.414] CloseServiceHandle (hSCObject=0x631178) returned 1
	[0064.414] lstrlenW (lpString="Appinfo") returned 7
	[0064.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0064.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0064.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0064.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0064.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0064.414] lstrlenW (lpString="AppXSvc") returned 7
	[0064.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0064.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0064.414] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0064.414] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0064.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0064.415] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0064.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0064.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0064.415] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0064.415] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0064.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0064.415] lstrlenW (lpString="Audiosrv") returned 8
	[0064.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0064.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0064.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0064.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0064.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0064.415] lstrlenW (lpString="BFE") returned 3
	[0064.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0064.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0064.415] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0064.415] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0064.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0064.415] lstrlenW (lpString="BITS") returned 4
	[0064.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0064.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0064.416] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0064.416] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0064.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0064.416] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0064.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0064.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0064.416] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0064.416] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0064.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0064.416] lstrlenW (lpString="CDPSvc") returned 6
	[0064.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0064.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0064.416] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0064.416] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0064.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0064.416] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0064.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0064.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0064.416] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0064.416] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0064.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0064.416] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0064.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0064.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0064.417] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0064.417] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0064.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0064.417] lstrlenW (lpString="CryptSvc") returned 8
	[0064.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0064.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0064.417] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0064.417] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0064.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0064.417] lstrlenW (lpString="DcomLaunch") returned 10
	[0064.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0064.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0064.417] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0064.417] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0064.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0064.417] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0064.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0064.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0064.417] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0064.417] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0064.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0064.417] lstrlenW (lpString="Dhcp") returned 4
	[0064.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0064.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0064.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0064.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0064.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0064.418] lstrlenW (lpString="Dnscache") returned 8
	[0064.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0064.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0064.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0064.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0064.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0064.418] lstrlenW (lpString="DoSvc") returned 5
	[0064.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0064.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0064.418] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0064.418] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0064.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0064.418] lstrlenW (lpString="DPS") returned 3
	[0064.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0064.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0064.418] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0064.418] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0064.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0064.418] lstrlenW (lpString="DusmSvc") returned 7
	[0064.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0064.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0064.419] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0064.419] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0064.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0064.419] lstrlenW (lpString="EventLog") returned 8
	[0064.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0064.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0064.419] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0064.419] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0064.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0064.419] lstrlenW (lpString="EventSystem") returned 11
	[0064.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0064.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0064.419] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0064.419] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0064.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0064.419] lstrlenW (lpString="FontCache") returned 9
	[0064.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0064.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0064.419] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0064.419] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0064.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0064.419] lstrlenW (lpString="gpsvc") returned 5
	[0064.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0064.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0064.419] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0064.419] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0064.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0064.420] lstrlenW (lpString="iphlpsvc") returned 8
	[0064.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0064.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0064.420] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0064.420] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0064.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0064.420] lstrlenW (lpString="KeyIso") returned 6
	[0064.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0064.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0064.420] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0064.420] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0064.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0064.420] lstrlenW (lpString="LanmanServer") returned 12
	[0064.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0064.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0064.420] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0064.420] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0064.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0064.420] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0064.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0064.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0064.420] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0064.420] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0064.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0064.420] lstrlenW (lpString="lfsvc") returned 5
	[0064.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0064.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0064.421] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0064.421] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0064.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0064.421] lstrlenW (lpString="lmhosts") returned 7
	[0064.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0064.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0064.421] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0064.421] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0064.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0064.421] lstrlenW (lpString="LSM") returned 3
	[0064.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0064.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0064.421] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0064.421] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0064.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0064.421] lstrlenW (lpString="MapsBroker") returned 10
	[0064.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0064.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0064.421] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0064.421] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0064.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0064.421] lstrlenW (lpString="MpsSvc") returned 6
	[0064.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0064.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0064.421] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0064.422] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0064.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0064.422] lstrlenW (lpString="NcbService") returned 10
	[0064.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0064.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0064.422] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0064.422] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0064.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0064.422] lstrlenW (lpString="netprofm") returned 8
	[0064.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0064.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0064.422] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0064.422] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0064.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0064.422] lstrlenW (lpString="NlaSvc") returned 6
	[0064.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0064.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0064.422] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0064.422] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0064.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0064.422] lstrlenW (lpString="nsi") returned 3
	[0064.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0064.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0064.422] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0064.422] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0064.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0064.423] lstrlenW (lpString="PcaSvc") returned 6
	[0064.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0064.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0064.423] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0064.423] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0064.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0064.423] lstrlenW (lpString="PlugPlay") returned 8
	[0064.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0064.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0064.423] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0064.423] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0064.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0064.423] lstrlenW (lpString="Power") returned 5
	[0064.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0064.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0064.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0064.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0064.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0064.423] lstrlenW (lpString="ProfSvc") returned 7
	[0064.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0064.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0064.423] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0064.423] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0064.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0064.424] lstrlenW (lpString="RpcEptMapper") returned 12
	[0064.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0064.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0064.424] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0064.424] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0064.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0064.424] lstrlenW (lpString="RpcSs") returned 5
	[0064.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0064.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0064.424] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0064.424] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0064.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0064.424] lstrlenW (lpString="SamSs") returned 5
	[0064.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0064.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0064.424] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0064.424] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0064.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0064.424] lstrlenW (lpString="Schedule") returned 8
	[0064.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0064.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0064.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0064.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0064.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0064.424] lstrlenW (lpString="SecurityHealthService") returned 21
	[0064.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0064.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0064.425] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0064.425] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0064.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0064.425] lstrlenW (lpString="SENS") returned 4
	[0064.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0064.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0064.425] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0064.425] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0064.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0064.425] lstrlenW (lpString="ShellHWDetection") returned 16
	[0064.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0064.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0064.425] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0064.425] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0064.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0064.425] lstrlenW (lpString="Spooler") returned 7
	[0064.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0064.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0064.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0064.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0064.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0064.425] lstrlenW (lpString="SSDPSRV") returned 7
	[0064.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0064.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0064.425] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0064.426] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0064.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0064.426] lstrlenW (lpString="StateRepository") returned 15
	[0064.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0064.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0064.426] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0064.426] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0064.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0064.426] lstrlenW (lpString="SysMain") returned 7
	[0064.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0064.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0064.426] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0064.426] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0064.426] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x669e08 | out: hHeap=0x600000) returned 1
	[0064.426] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378
	[0064.843] Process32FirstW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0064.844] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0064.844] lstrlenW (lpString="System") returned 6
	[0064.844] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0064.845] lstrlenW (lpString="smss.exe") returned 8
	[0064.845] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0064.845] lstrlenW (lpString="csrss.exe") returned 9
	[0064.845] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0064.846] lstrlenW (lpString="wininit.exe") returned 11
	[0064.846] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0064.846] lstrlenW (lpString="csrss.exe") returned 9
	[0064.846] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0064.847] lstrlenW (lpString="winlogon.exe") returned 12
	[0064.847] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0064.848] lstrlenW (lpString="services.exe") returned 12
	[0064.848] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0064.848] lstrlenW (lpString="lsass.exe") returned 9
	[0064.848] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.849] lstrlenW (lpString="svchost.exe") returned 11
	[0064.849] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0064.850] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0064.850] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0064.851] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0064.851] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.851] lstrlenW (lpString="svchost.exe") returned 11
	[0064.851] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0064.852] lstrlenW (lpString="dwm.exe") returned 7
	[0064.852] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.852] lstrlenW (lpString="svchost.exe") returned 11
	[0064.852] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.853] lstrlenW (lpString="svchost.exe") returned 11
	[0064.853] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.854] lstrlenW (lpString="svchost.exe") returned 11
	[0064.854] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.854] lstrlenW (lpString="svchost.exe") returned 11
	[0064.854] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.855] lstrlenW (lpString="svchost.exe") returned 11
	[0064.855] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.855] lstrlenW (lpString="svchost.exe") returned 11
	[0064.855] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.856] lstrlenW (lpString="svchost.exe") returned 11
	[0064.856] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.856] lstrlenW (lpString="svchost.exe") returned 11
	[0064.856] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.857] lstrlenW (lpString="svchost.exe") returned 11
	[0064.857] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0064.857] lstrlenW (lpString="spoolsv.exe") returned 11
	[0064.858] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.858] lstrlenW (lpString="svchost.exe") returned 11
	[0064.858] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.859] lstrlenW (lpString="svchost.exe") returned 11
	[0064.859] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0064.859] lstrlenW (lpString="audiodg.exe") returned 11
	[0064.859] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0064.860] lstrlenW (lpString="sihost.exe") returned 10
	[0064.860] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.860] lstrlenW (lpString="svchost.exe") returned 11
	[0064.860] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0064.861] lstrlenW (lpString="taskhostw.exe") returned 13
	[0064.861] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0064.861] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0064.862] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0064.862] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0064.862] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0064.863] lstrlenW (lpString="explorer.exe") returned 12
	[0064.863] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0064.863] lstrlenW (lpString="Memory Compression") returned 18
	[0064.863] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0064.864] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0064.864] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0064.865] lstrlenW (lpString="SearchUI.exe") returned 12
	[0064.865] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0064.865] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0064.865] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0064.866] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0064.866] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0064.866] lstrlenW (lpString="taskhostw.exe") returned 13
	[0064.866] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0064.867] lstrlenW (lpString="UsoClient.exe") returned 13
	[0064.867] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0064.867] lstrlenW (lpString="taskhostw.exe") returned 13
	[0064.867] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0064.868] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0064.868] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0064.869] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0064.869] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0064.869] lstrlenW (lpString="msoia.exe") returned 9
	[0064.869] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0064.870] lstrlenW (lpString="msoia.exe") returned 9
	[0064.870] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0064.870] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0064.870] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0064.871] lstrlenW (lpString="screensaver.exe") returned 15
	[0064.871] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0064.872] lstrlenW (lpString="nancyedge.exe") returned 13
	[0064.872] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0064.872] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0064.872] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0064.873] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0064.873] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0064.873] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0064.873] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0064.874] lstrlenW (lpString="percentage.exe") returned 14
	[0064.874] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0064.874] lstrlenW (lpString="hh_him.exe") returned 10
	[0064.874] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0064.875] lstrlenW (lpString="nba.exe") returned 7
	[0064.875] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0064.875] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0064.876] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0064.876] lstrlenW (lpString="citizenship.exe") returned 15
	[0064.876] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0064.877] lstrlenW (lpString="beam removable.exe") returned 18
	[0064.877] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0064.877] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0064.877] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0064.878] lstrlenW (lpString="crest-boating.exe") returned 17
	[0064.878] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0064.879] lstrlenW (lpString="wrist.exe") returned 9
	[0064.879] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0065.299] lstrlenW (lpString="indicationwage.exe") returned 18
	[0065.299] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0065.300] lstrlenW (lpString="theepub.exe") returned 11
	[0065.300] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0065.301] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0065.301] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0065.302] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0065.302] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0065.303] lstrlenW (lpString="webpage.exe") returned 11
	[0065.303] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0065.303] lstrlenW (lpString="distributed.exe") returned 15
	[0065.303] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0065.304] lstrlenW (lpString="ann.exe") returned 7
	[0065.304] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0065.305] lstrlenW (lpString="conhost.exe") returned 11
	[0065.305] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0065.305] lstrlenW (lpString="conhost.exe") returned 11
	[0065.305] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0065.306] lstrlenW (lpString="svchost.exe") returned 11
	[0065.306] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0065.307] lstrlenW (lpString="d2.exe") returned 6
	[0065.307] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0065.307] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0065.307] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0065.308] lstrlenW (lpString="conhost.exe") returned 11
	[0065.308] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0065.309] lstrlenW (lpString="dllhost.exe") returned 11
	[0065.309] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0065.309] lstrlenW (lpString="cmd.exe") returned 7
	[0065.309] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0065.310] lstrlenW (lpString="conhost.exe") returned 11
	[0065.310] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0065.311] lstrlenW (lpString="svchost.exe") returned 11
	[0065.311] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0065.312] CloseHandle (hObject=0x378) returned 1
	[0065.312] Sleep (dwMilliseconds=0x1f4) 
	[0066.083] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x631178
	[0066.084] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0066.086] GetLastError () returned 0xea
	[0066.086] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x670f30
	[0066.087] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x670f30, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x670f30, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0066.088] CloseServiceHandle (hSCObject=0x631178) returned 1
	[0066.088] lstrlenW (lpString="Appinfo") returned 7
	[0066.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0066.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0066.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0066.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0066.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0066.088] lstrlenW (lpString="AppXSvc") returned 7
	[0066.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0066.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0066.088] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0066.088] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0066.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0066.088] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0066.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0066.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0066.088] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0066.089] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0066.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0066.089] lstrlenW (lpString="Audiosrv") returned 8
	[0066.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0066.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0066.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0066.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0066.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0066.089] lstrlenW (lpString="BFE") returned 3
	[0066.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0066.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0066.089] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0066.089] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0066.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0066.089] lstrlenW (lpString="BITS") returned 4
	[0066.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0066.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0066.089] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0066.089] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0066.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0066.089] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0066.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0066.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0066.089] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0066.089] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0066.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0066.089] lstrlenW (lpString="CDPSvc") returned 6
	[0066.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0066.090] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0066.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0066.090] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0066.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0066.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0066.090] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0066.090] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0066.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0066.090] lstrlenW (lpString="CryptSvc") returned 8
	[0066.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0066.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0066.090] lstrlenW (lpString="DcomLaunch") returned 10
	[0066.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0066.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0066.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0066.091] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0066.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0066.091] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0066.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0066.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0066.091] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0066.091] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0066.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0066.091] lstrlenW (lpString="Dhcp") returned 4
	[0066.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0066.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0066.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0066.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0066.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0066.091] lstrlenW (lpString="Dnscache") returned 8
	[0066.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0066.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0066.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0066.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0066.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0066.091] lstrlenW (lpString="DoSvc") returned 5
	[0066.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0066.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0066.091] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0066.091] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0066.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0066.092] lstrlenW (lpString="DPS") returned 3
	[0066.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0066.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0066.092] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0066.092] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0066.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0066.092] lstrlenW (lpString="DusmSvc") returned 7
	[0066.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0066.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0066.092] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0066.092] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0066.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0066.092] lstrlenW (lpString="EventLog") returned 8
	[0066.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0066.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0066.092] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0066.092] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0066.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0066.092] lstrlenW (lpString="EventSystem") returned 11
	[0066.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0066.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0066.093] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0066.093] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0066.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0066.093] lstrlenW (lpString="FontCache") returned 9
	[0066.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0066.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0066.093] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0066.093] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0066.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0066.093] lstrlenW (lpString="gpsvc") returned 5
	[0066.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0066.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0066.093] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0066.093] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0066.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0066.093] lstrlenW (lpString="iphlpsvc") returned 8
	[0066.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0066.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0066.093] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0066.093] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0066.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0066.093] lstrlenW (lpString="KeyIso") returned 6
	[0066.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0066.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0066.093] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0066.093] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0066.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0066.094] lstrlenW (lpString="LanmanServer") returned 12
	[0066.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0066.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0066.094] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0066.094] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0066.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0066.094] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0066.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0066.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0066.094] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0066.094] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0066.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0066.094] lstrlenW (lpString="lfsvc") returned 5
	[0066.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0066.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0066.094] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0066.094] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0066.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0066.094] lstrlenW (lpString="lmhosts") returned 7
	[0066.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0066.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0066.094] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0066.095] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0066.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0066.095] lstrlenW (lpString="LSM") returned 3
	[0066.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0066.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0066.095] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0066.095] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0066.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0066.095] lstrlenW (lpString="MapsBroker") returned 10
	[0066.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0066.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0066.095] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0066.095] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0066.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0066.095] lstrlenW (lpString="MpsSvc") returned 6
	[0066.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0066.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0066.095] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0066.095] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0066.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0066.095] lstrlenW (lpString="NcbService") returned 10
	[0066.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0066.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0066.096] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0066.096] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0066.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0066.096] lstrlenW (lpString="netprofm") returned 8
	[0066.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0066.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0066.096] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0066.096] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0066.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0066.096] lstrlenW (lpString="NlaSvc") returned 6
	[0066.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0066.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0066.096] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0066.096] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0066.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0066.096] lstrlenW (lpString="nsi") returned 3
	[0066.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0066.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0066.096] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0066.097] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0066.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0066.097] lstrlenW (lpString="PcaSvc") returned 6
	[0066.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0066.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0066.097] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0066.097] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0066.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0066.097] lstrlenW (lpString="PlugPlay") returned 8
	[0066.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0066.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0066.097] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0066.097] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0066.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0066.097] lstrlenW (lpString="Power") returned 5
	[0066.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0066.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0066.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0066.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0066.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0066.098] lstrlenW (lpString="ProfSvc") returned 7
	[0066.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0066.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0066.098] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0066.098] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0066.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0066.098] lstrlenW (lpString="RpcEptMapper") returned 12
	[0066.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0066.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0066.098] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0066.098] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0066.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0066.595] lstrlenW (lpString="RpcSs") returned 5
	[0066.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0066.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0066.595] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0066.595] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0066.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0066.595] lstrlenW (lpString="SamSs") returned 5
	[0066.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0066.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0066.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0066.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0066.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0066.596] lstrlenW (lpString="Schedule") returned 8
	[0066.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0066.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0066.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0066.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0066.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0066.596] lstrlenW (lpString="SecurityHealthService") returned 21
	[0066.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0066.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0066.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0066.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0066.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0066.596] lstrlenW (lpString="SENS") returned 4
	[0066.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0066.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0066.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0066.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0066.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0066.596] lstrlenW (lpString="ShellHWDetection") returned 16
	[0066.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0066.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0066.597] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0066.597] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0066.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0066.597] lstrlenW (lpString="Spooler") returned 7
	[0066.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0066.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0066.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0066.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0066.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0066.597] lstrlenW (lpString="SSDPSRV") returned 7
	[0066.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0066.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0066.597] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0066.597] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0066.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0066.597] lstrlenW (lpString="StateRepository") returned 15
	[0066.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0066.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0066.597] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0066.597] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0066.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0066.597] lstrlenW (lpString="SysMain") returned 7
	[0066.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0066.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0066.597] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0066.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0066.598] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x670f30 | out: hHeap=0x600000) returned 1
	[0066.598] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368
	[0066.607] Process32FirstW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0066.608] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0066.609] lstrlenW (lpString="System") returned 6
	[0066.609] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0066.609] lstrlenW (lpString="smss.exe") returned 8
	[0066.609] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0066.610] lstrlenW (lpString="csrss.exe") returned 9
	[0066.610] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0066.610] lstrlenW (lpString="wininit.exe") returned 11
	[0066.610] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0066.611] lstrlenW (lpString="csrss.exe") returned 9
	[0066.611] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0066.612] lstrlenW (lpString="winlogon.exe") returned 12
	[0066.612] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0066.612] lstrlenW (lpString="services.exe") returned 12
	[0066.612] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0066.613] lstrlenW (lpString="lsass.exe") returned 9
	[0066.613] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.613] lstrlenW (lpString="svchost.exe") returned 11
	[0066.613] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0066.614] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0066.614] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0066.615] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0066.615] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.615] lstrlenW (lpString="svchost.exe") returned 11
	[0066.615] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0066.616] lstrlenW (lpString="dwm.exe") returned 7
	[0066.616] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.617] lstrlenW (lpString="svchost.exe") returned 11
	[0066.617] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.617] lstrlenW (lpString="svchost.exe") returned 11
	[0066.617] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.618] lstrlenW (lpString="svchost.exe") returned 11
	[0066.618] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.618] lstrlenW (lpString="svchost.exe") returned 11
	[0066.618] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.619] lstrlenW (lpString="svchost.exe") returned 11
	[0066.619] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.619] lstrlenW (lpString="svchost.exe") returned 11
	[0066.619] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.620] lstrlenW (lpString="svchost.exe") returned 11
	[0066.620] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.621] lstrlenW (lpString="svchost.exe") returned 11
	[0066.621] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.621] lstrlenW (lpString="svchost.exe") returned 11
	[0066.621] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0066.622] lstrlenW (lpString="spoolsv.exe") returned 11
	[0066.622] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.622] lstrlenW (lpString="svchost.exe") returned 11
	[0066.622] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.623] lstrlenW (lpString="svchost.exe") returned 11
	[0066.623] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0066.624] lstrlenW (lpString="audiodg.exe") returned 11
	[0066.624] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0066.624] lstrlenW (lpString="sihost.exe") returned 10
	[0066.624] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.625] lstrlenW (lpString="svchost.exe") returned 11
	[0066.625] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0066.625] lstrlenW (lpString="taskhostw.exe") returned 13
	[0066.625] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0066.626] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0066.626] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0066.627] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0066.627] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0066.627] lstrlenW (lpString="explorer.exe") returned 12
	[0066.627] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0066.628] lstrlenW (lpString="Memory Compression") returned 18
	[0066.628] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0066.628] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0066.628] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0066.629] lstrlenW (lpString="SearchUI.exe") returned 12
	[0066.629] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0067.086] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0067.086] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0067.087] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0067.087] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0067.088] lstrlenW (lpString="taskhostw.exe") returned 13
	[0067.088] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0067.089] lstrlenW (lpString="UsoClient.exe") returned 13
	[0067.089] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0067.089] lstrlenW (lpString="taskhostw.exe") returned 13
	[0067.089] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0067.090] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0067.090] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0067.091] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0067.091] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0067.092] lstrlenW (lpString="msoia.exe") returned 9
	[0067.092] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0067.093] lstrlenW (lpString="msoia.exe") returned 9
	[0067.093] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0067.093] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0067.093] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0067.094] lstrlenW (lpString="screensaver.exe") returned 15
	[0067.094] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0067.095] lstrlenW (lpString="nancyedge.exe") returned 13
	[0067.095] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0067.095] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0067.095] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0067.096] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0067.096] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0067.097] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0067.097] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0067.098] lstrlenW (lpString="percentage.exe") returned 14
	[0067.098] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0067.098] lstrlenW (lpString="hh_him.exe") returned 10
	[0067.098] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0067.099] lstrlenW (lpString="nba.exe") returned 7
	[0067.099] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0067.100] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0067.100] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0067.101] lstrlenW (lpString="citizenship.exe") returned 15
	[0067.101] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0067.102] lstrlenW (lpString="beam removable.exe") returned 18
	[0067.102] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0067.103] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0067.103] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0067.104] lstrlenW (lpString="crest-boating.exe") returned 17
	[0067.104] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0067.105] lstrlenW (lpString="wrist.exe") returned 9
	[0067.105] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0067.106] lstrlenW (lpString="indicationwage.exe") returned 18
	[0067.106] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0067.107] lstrlenW (lpString="theepub.exe") returned 11
	[0067.107] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0067.108] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0067.108] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0067.108] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0067.109] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0067.109] lstrlenW (lpString="webpage.exe") returned 11
	[0067.109] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0067.110] lstrlenW (lpString="distributed.exe") returned 15
	[0067.110] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0067.111] lstrlenW (lpString="ann.exe") returned 7
	[0067.111] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0067.112] lstrlenW (lpString="conhost.exe") returned 11
	[0067.112] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0067.113] lstrlenW (lpString="conhost.exe") returned 11
	[0067.113] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0067.114] lstrlenW (lpString="svchost.exe") returned 11
	[0067.114] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0067.115] lstrlenW (lpString="d2.exe") returned 6
	[0067.115] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0067.115] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0067.115] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0067.116] lstrlenW (lpString="conhost.exe") returned 11
	[0067.116] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0067.117] lstrlenW (lpString="dllhost.exe") returned 11
	[0067.117] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0067.118] lstrlenW (lpString="cmd.exe") returned 7
	[0067.118] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0067.118] lstrlenW (lpString="conhost.exe") returned 11
	[0067.118] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0067.119] lstrlenW (lpString="svchost.exe") returned 11
	[0067.119] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0067.120] CloseHandle (hObject=0x368) returned 1
	[0067.120] Sleep (dwMilliseconds=0x1f4) 
	[0067.838] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x631178
	[0067.839] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0067.839] GetLastError () returned 0xea
	[0067.839] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x670f30
	[0067.839] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x670f30, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x670f30, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0067.840] CloseServiceHandle (hSCObject=0x631178) returned 1
	[0067.840] lstrlenW (lpString="Appinfo") returned 7
	[0067.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0067.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0067.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0067.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0067.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0067.841] lstrlenW (lpString="AppXSvc") returned 7
	[0067.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0067.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0067.841] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0067.841] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0067.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0067.841] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0067.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0067.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0067.841] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0067.841] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0067.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0067.841] lstrlenW (lpString="Audiosrv") returned 8
	[0067.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0067.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0067.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0067.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0067.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0067.841] lstrlenW (lpString="BFE") returned 3
	[0067.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0067.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0067.841] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0067.841] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0067.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0067.842] lstrlenW (lpString="BITS") returned 4
	[0067.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0067.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0067.842] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0067.842] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0067.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0067.842] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0067.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0067.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0067.842] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0067.842] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0067.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0067.842] lstrlenW (lpString="CDPSvc") returned 6
	[0067.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0067.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0067.842] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0067.842] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0067.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0067.842] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0067.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0067.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0067.842] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0067.842] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0067.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0067.842] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0067.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0067.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0067.842] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0067.842] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0067.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0067.843] lstrlenW (lpString="CryptSvc") returned 8
	[0067.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0067.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0067.843] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0067.843] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0067.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0067.843] lstrlenW (lpString="DcomLaunch") returned 10
	[0067.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0067.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0067.843] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0067.843] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0067.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0067.843] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0067.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0067.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0067.843] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0067.843] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0067.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0067.843] lstrlenW (lpString="Dhcp") returned 4
	[0067.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0067.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0067.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0067.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0067.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0067.843] lstrlenW (lpString="Dnscache") returned 8
	[0067.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0067.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0067.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0067.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0067.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0067.844] lstrlenW (lpString="DoSvc") returned 5
	[0067.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0067.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0067.844] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0067.844] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0067.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0067.844] lstrlenW (lpString="DPS") returned 3
	[0067.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0067.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0067.844] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0067.844] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0067.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0067.844] lstrlenW (lpString="DusmSvc") returned 7
	[0067.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0067.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0067.844] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0067.844] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0067.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0067.844] lstrlenW (lpString="EventLog") returned 8
	[0067.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0067.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0067.844] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0067.844] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0067.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0067.845] lstrlenW (lpString="EventSystem") returned 11
	[0067.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0067.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0067.845] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0067.845] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0067.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0067.845] lstrlenW (lpString="FontCache") returned 9
	[0067.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0067.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0067.845] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0067.845] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0067.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0067.845] lstrlenW (lpString="gpsvc") returned 5
	[0067.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0067.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0067.845] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0067.845] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0067.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0067.845] lstrlenW (lpString="iphlpsvc") returned 8
	[0067.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0067.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0067.845] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0067.845] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0067.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0067.845] lstrlenW (lpString="KeyIso") returned 6
	[0067.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0067.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0067.846] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0067.846] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0067.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0067.846] lstrlenW (lpString="LanmanServer") returned 12
	[0067.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0067.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0067.846] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0067.846] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0067.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0067.846] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0067.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0067.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0067.846] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0067.846] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0067.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0067.846] lstrlenW (lpString="lfsvc") returned 5
	[0067.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0067.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0067.846] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0067.846] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0067.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0067.846] lstrlenW (lpString="lmhosts") returned 7
	[0067.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0067.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0067.846] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0067.847] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0067.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0067.847] lstrlenW (lpString="LSM") returned 3
	[0067.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0067.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0067.847] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0067.847] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0067.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0067.847] lstrlenW (lpString="MapsBroker") returned 10
	[0067.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0067.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0067.847] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0067.847] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0067.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0067.847] lstrlenW (lpString="MpsSvc") returned 6
	[0067.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0067.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0067.847] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0067.847] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0067.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0067.847] lstrlenW (lpString="NcbService") returned 10
	[0067.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0067.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0067.847] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0067.847] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0067.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0067.847] lstrlenW (lpString="netprofm") returned 8
	[0067.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0067.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0067.848] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0067.848] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0067.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0067.848] lstrlenW (lpString="NlaSvc") returned 6
	[0067.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0067.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0067.848] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0067.848] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0067.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0067.848] lstrlenW (lpString="nsi") returned 3
	[0067.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0067.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0067.848] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0067.848] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0068.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0068.010] lstrlenW (lpString="PcaSvc") returned 6
	[0068.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0068.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0068.010] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0068.010] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0068.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0068.010] lstrlenW (lpString="PlugPlay") returned 8
	[0068.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0068.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0068.010] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0068.011] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0068.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0068.011] lstrlenW (lpString="Power") returned 5
	[0068.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0068.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0068.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0068.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0068.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0068.011] lstrlenW (lpString="ProfSvc") returned 7
	[0068.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0068.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0068.011] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0068.011] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0068.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0068.011] lstrlenW (lpString="RpcEptMapper") returned 12
	[0068.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0068.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0068.011] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0068.011] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0068.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0068.011] lstrlenW (lpString="RpcSs") returned 5
	[0068.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0068.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0068.011] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0068.011] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0068.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0068.011] lstrlenW (lpString="SamSs") returned 5
	[0068.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0068.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0068.011] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0068.012] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0068.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0068.012] lstrlenW (lpString="Schedule") returned 8
	[0068.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0068.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0068.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0068.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0068.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0068.012] lstrlenW (lpString="SecurityHealthService") returned 21
	[0068.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0068.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0068.012] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0068.012] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0068.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0068.012] lstrlenW (lpString="SENS") returned 4
	[0068.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0068.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0068.012] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0068.012] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0068.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0068.012] lstrlenW (lpString="ShellHWDetection") returned 16
	[0068.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0068.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0068.012] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0068.012] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0068.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0068.012] lstrlenW (lpString="Spooler") returned 7
	[0068.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0068.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0068.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0068.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0068.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0068.013] lstrlenW (lpString="SSDPSRV") returned 7
	[0068.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0068.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0068.013] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0068.013] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0068.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0068.013] lstrlenW (lpString="StateRepository") returned 15
	[0068.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0068.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0068.013] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0068.013] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0068.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0068.013] lstrlenW (lpString="SysMain") returned 7
	[0068.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0068.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0068.013] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0068.013] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0068.013] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x670f30 | out: hHeap=0x600000) returned 1
	[0068.013] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318
	[0068.019] Process32FirstW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0068.019] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0068.020] lstrlenW (lpString="System") returned 6
	[0068.020] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0068.021] lstrlenW (lpString="smss.exe") returned 8
	[0068.021] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0068.021] lstrlenW (lpString="csrss.exe") returned 9
	[0068.021] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0068.022] lstrlenW (lpString="wininit.exe") returned 11
	[0068.022] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0068.022] lstrlenW (lpString="csrss.exe") returned 9
	[0068.022] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0068.023] lstrlenW (lpString="winlogon.exe") returned 12
	[0068.023] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0068.024] lstrlenW (lpString="services.exe") returned 12
	[0068.024] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0068.024] lstrlenW (lpString="lsass.exe") returned 9
	[0068.024] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.025] lstrlenW (lpString="svchost.exe") returned 11
	[0068.025] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0068.025] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0068.025] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0068.026] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0068.026] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.027] lstrlenW (lpString="svchost.exe") returned 11
	[0068.027] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0068.027] lstrlenW (lpString="dwm.exe") returned 7
	[0068.027] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.028] lstrlenW (lpString="svchost.exe") returned 11
	[0068.028] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.028] lstrlenW (lpString="svchost.exe") returned 11
	[0068.028] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.029] lstrlenW (lpString="svchost.exe") returned 11
	[0068.029] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.030] lstrlenW (lpString="svchost.exe") returned 11
	[0068.030] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.030] lstrlenW (lpString="svchost.exe") returned 11
	[0068.030] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.031] lstrlenW (lpString="svchost.exe") returned 11
	[0068.031] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.031] lstrlenW (lpString="svchost.exe") returned 11
	[0068.032] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.032] lstrlenW (lpString="svchost.exe") returned 11
	[0068.032] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.033] lstrlenW (lpString="svchost.exe") returned 11
	[0068.033] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0068.033] lstrlenW (lpString="spoolsv.exe") returned 11
	[0068.033] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.034] lstrlenW (lpString="svchost.exe") returned 11
	[0068.034] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.035] lstrlenW (lpString="svchost.exe") returned 11
	[0068.035] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0068.035] lstrlenW (lpString="audiodg.exe") returned 11
	[0068.035] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0068.036] lstrlenW (lpString="sihost.exe") returned 10
	[0068.036] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.037] lstrlenW (lpString="svchost.exe") returned 11
	[0068.037] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0068.038] lstrlenW (lpString="taskhostw.exe") returned 13
	[0068.038] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0068.038] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0068.038] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0068.039] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0068.039] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0068.039] lstrlenW (lpString="explorer.exe") returned 12
	[0068.039] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0068.040] lstrlenW (lpString="Memory Compression") returned 18
	[0068.040] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0068.041] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0068.041] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0068.041] lstrlenW (lpString="SearchUI.exe") returned 12
	[0068.041] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0068.042] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0068.042] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0068.042] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0068.042] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0068.043] lstrlenW (lpString="taskhostw.exe") returned 13
	[0068.043] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0068.044] lstrlenW (lpString="UsoClient.exe") returned 13
	[0068.044] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0068.044] lstrlenW (lpString="taskhostw.exe") returned 13
	[0068.044] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0068.045] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0068.045] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0068.046] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0068.046] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0068.046] lstrlenW (lpString="msoia.exe") returned 9
	[0068.046] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0068.047] lstrlenW (lpString="msoia.exe") returned 9
	[0068.047] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0068.047] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0068.047] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0068.048] lstrlenW (lpString="screensaver.exe") returned 15
	[0068.048] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0068.049] lstrlenW (lpString="nancyedge.exe") returned 13
	[0068.049] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0068.049] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0068.050] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0068.050] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0068.050] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0068.051] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0068.051] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0068.490] lstrlenW (lpString="percentage.exe") returned 14
	[0068.490] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0068.490] lstrlenW (lpString="hh_him.exe") returned 10
	[0068.490] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0068.491] lstrlenW (lpString="nba.exe") returned 7
	[0068.491] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0068.491] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0068.491] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0068.492] lstrlenW (lpString="citizenship.exe") returned 15
	[0068.492] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0068.492] lstrlenW (lpString="beam removable.exe") returned 18
	[0068.492] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0068.493] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0068.493] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0068.494] lstrlenW (lpString="crest-boating.exe") returned 17
	[0068.494] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0068.494] lstrlenW (lpString="wrist.exe") returned 9
	[0068.495] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0068.495] lstrlenW (lpString="indicationwage.exe") returned 18
	[0068.495] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0068.496] lstrlenW (lpString="theepub.exe") returned 11
	[0068.496] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0068.497] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0068.497] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0068.497] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0068.497] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0068.498] lstrlenW (lpString="webpage.exe") returned 11
	[0068.498] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0068.499] lstrlenW (lpString="distributed.exe") returned 15
	[0068.499] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0068.499] lstrlenW (lpString="ann.exe") returned 7
	[0068.500] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0068.500] lstrlenW (lpString="conhost.exe") returned 11
	[0068.500] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0068.501] lstrlenW (lpString="conhost.exe") returned 11
	[0068.501] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.501] lstrlenW (lpString="svchost.exe") returned 11
	[0068.502] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0068.502] lstrlenW (lpString="d2.exe") returned 6
	[0068.502] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0068.503] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0068.503] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0068.504] lstrlenW (lpString="conhost.exe") returned 11
	[0068.504] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0068.504] lstrlenW (lpString="dllhost.exe") returned 11
	[0068.505] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0068.505] lstrlenW (lpString="cmd.exe") returned 7
	[0068.505] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0068.506] lstrlenW (lpString="conhost.exe") returned 11
	[0068.506] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0068.507] lstrlenW (lpString="svchost.exe") returned 11
	[0068.507] Process32NextW (in: hSnapshot=0x318, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0068.507] CloseHandle (hObject=0x318) returned 1
	[0068.507] Sleep (dwMilliseconds=0x1f4) 
	[0069.375] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6311a0
	[0069.375] EnumServicesStatusExW (in: hSCManager=0x6311a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0069.375] GetLastError () returned 0xea
	[0069.376] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x670f30
	[0069.376] EnumServicesStatusExW (in: hSCManager=0x6311a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x670f30, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x670f30, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0069.376] CloseServiceHandle (hSCObject=0x6311a0) returned 1
	[0069.376] lstrlenW (lpString="Appinfo") returned 7
	[0069.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0069.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0069.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0069.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0069.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0069.377] lstrlenW (lpString="AppXSvc") returned 7
	[0069.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0069.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0069.377] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0069.377] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0069.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0069.377] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0069.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0069.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0069.377] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0069.377] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0069.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0069.377] lstrlenW (lpString="Audiosrv") returned 8
	[0069.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0069.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0069.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0069.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0069.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0069.377] lstrlenW (lpString="BFE") returned 3
	[0069.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0069.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0069.377] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0069.377] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0069.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0069.378] lstrlenW (lpString="BITS") returned 4
	[0069.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0069.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0069.378] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0069.378] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0069.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0069.378] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0069.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0069.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0069.378] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0069.378] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0069.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0069.378] lstrlenW (lpString="CDPSvc") returned 6
	[0069.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0069.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0069.378] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0069.378] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0069.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0069.378] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0069.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0069.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0069.379] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0069.379] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0069.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0069.379] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0069.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0069.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0069.379] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0069.379] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0069.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0069.379] lstrlenW (lpString="CryptSvc") returned 8
	[0069.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0069.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0069.379] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0069.379] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0069.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0069.379] lstrlenW (lpString="DcomLaunch") returned 10
	[0069.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0069.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0069.379] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0069.379] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0069.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0069.379] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0069.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0069.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0069.379] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0069.380] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0069.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0069.380] lstrlenW (lpString="Dhcp") returned 4
	[0069.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0069.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0069.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0069.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0069.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0069.380] lstrlenW (lpString="Dnscache") returned 8
	[0069.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0069.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0069.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0069.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0069.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0069.380] lstrlenW (lpString="DoSvc") returned 5
	[0069.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0069.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0069.380] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0069.380] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0069.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0069.380] lstrlenW (lpString="DPS") returned 3
	[0069.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0069.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0069.381] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0069.381] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0069.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0069.381] lstrlenW (lpString="DusmSvc") returned 7
	[0069.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0069.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0069.381] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0069.381] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0069.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0069.381] lstrlenW (lpString="EventLog") returned 8
	[0069.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0069.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0069.381] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0069.381] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0069.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0069.381] lstrlenW (lpString="EventSystem") returned 11
	[0069.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0069.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0069.381] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0069.381] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0069.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0069.381] lstrlenW (lpString="FontCache") returned 9
	[0069.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0069.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0069.381] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0069.382] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0069.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0069.382] lstrlenW (lpString="gpsvc") returned 5
	[0069.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0069.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0069.382] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0069.382] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0069.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0069.382] lstrlenW (lpString="iphlpsvc") returned 8
	[0069.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0069.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0069.382] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0069.382] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0069.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0069.382] lstrlenW (lpString="KeyIso") returned 6
	[0069.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0069.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0069.382] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0069.382] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0069.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0069.382] lstrlenW (lpString="LanmanServer") returned 12
	[0069.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0069.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0069.382] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0069.382] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0069.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0069.383] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0069.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0069.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0069.383] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0069.383] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0069.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0069.383] lstrlenW (lpString="lfsvc") returned 5
	[0069.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0069.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0069.383] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0069.383] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0069.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0069.383] lstrlenW (lpString="lmhosts") returned 7
	[0069.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0069.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0069.383] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0069.383] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0069.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0069.383] lstrlenW (lpString="LSM") returned 3
	[0069.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0069.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0069.383] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0069.383] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0069.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0069.383] lstrlenW (lpString="MapsBroker") returned 10
	[0069.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0069.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0069.383] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0069.383] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0069.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0069.384] lstrlenW (lpString="MpsSvc") returned 6
	[0069.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0069.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0069.384] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0069.384] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0069.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0069.384] lstrlenW (lpString="NcbService") returned 10
	[0069.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0069.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0069.728] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0069.728] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0069.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0069.729] lstrlenW (lpString="netprofm") returned 8
	[0069.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0069.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0069.729] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0069.729] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0069.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0069.729] lstrlenW (lpString="NlaSvc") returned 6
	[0069.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0069.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0069.729] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0069.729] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0069.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0069.729] lstrlenW (lpString="nsi") returned 3
	[0069.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0069.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0069.729] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0069.729] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0069.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0069.729] lstrlenW (lpString="PcaSvc") returned 6
	[0069.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0069.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0069.730] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0069.730] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0069.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0069.730] lstrlenW (lpString="PlugPlay") returned 8
	[0069.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0069.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0069.730] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0069.730] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0069.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0069.730] lstrlenW (lpString="Power") returned 5
	[0069.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0069.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0069.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0069.730] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0069.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0069.730] lstrlenW (lpString="ProfSvc") returned 7
	[0069.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0069.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0069.730] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0069.730] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0069.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0069.731] lstrlenW (lpString="RpcEptMapper") returned 12
	[0069.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0069.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0069.731] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0069.731] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0069.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0069.731] lstrlenW (lpString="RpcSs") returned 5
	[0069.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0069.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0069.731] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0069.731] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0069.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0069.731] lstrlenW (lpString="SamSs") returned 5
	[0069.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0069.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0069.731] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0069.731] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0069.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0069.731] lstrlenW (lpString="Schedule") returned 8
	[0069.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0069.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0069.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0069.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0069.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0069.732] lstrlenW (lpString="SecurityHealthService") returned 21
	[0069.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0069.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0069.732] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0069.732] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0069.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0069.732] lstrlenW (lpString="SENS") returned 4
	[0069.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0069.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0069.732] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0069.732] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0069.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0069.732] lstrlenW (lpString="ShellHWDetection") returned 16
	[0069.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0069.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0069.732] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0069.732] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0069.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0069.732] lstrlenW (lpString="Spooler") returned 7
	[0069.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0069.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0069.733] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0069.733] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0069.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0069.733] lstrlenW (lpString="SSDPSRV") returned 7
	[0069.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0069.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0069.733] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0069.733] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0069.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0069.733] lstrlenW (lpString="StateRepository") returned 15
	[0069.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0069.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0069.733] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0069.733] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0069.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0069.733] lstrlenW (lpString="SysMain") returned 7
	[0069.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0069.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0069.733] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0069.733] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0069.733] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x670f30 | out: hHeap=0x600000) returned 1
	[0069.733] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374
	[0069.739] Process32FirstW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0069.739] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0069.740] lstrlenW (lpString="System") returned 6
	[0069.740] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0069.740] lstrlenW (lpString="smss.exe") returned 8
	[0069.741] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0069.741] lstrlenW (lpString="csrss.exe") returned 9
	[0069.741] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0069.742] lstrlenW (lpString="wininit.exe") returned 11
	[0069.742] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0069.742] lstrlenW (lpString="csrss.exe") returned 9
	[0069.742] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0069.743] lstrlenW (lpString="winlogon.exe") returned 12
	[0069.743] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0069.744] lstrlenW (lpString="services.exe") returned 12
	[0069.744] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0069.744] lstrlenW (lpString="lsass.exe") returned 9
	[0069.744] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.745] lstrlenW (lpString="svchost.exe") returned 11
	[0069.745] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0069.746] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0069.746] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0069.746] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0069.746] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.747] lstrlenW (lpString="svchost.exe") returned 11
	[0069.747] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0069.747] lstrlenW (lpString="dwm.exe") returned 7
	[0069.747] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.748] lstrlenW (lpString="svchost.exe") returned 11
	[0069.748] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.748] lstrlenW (lpString="svchost.exe") returned 11
	[0069.748] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.749] lstrlenW (lpString="svchost.exe") returned 11
	[0069.749] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.749] lstrlenW (lpString="svchost.exe") returned 11
	[0069.750] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.750] lstrlenW (lpString="svchost.exe") returned 11
	[0069.750] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.751] lstrlenW (lpString="svchost.exe") returned 11
	[0069.751] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.751] lstrlenW (lpString="svchost.exe") returned 11
	[0069.751] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.752] lstrlenW (lpString="svchost.exe") returned 11
	[0069.752] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.752] lstrlenW (lpString="svchost.exe") returned 11
	[0069.752] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0069.753] lstrlenW (lpString="spoolsv.exe") returned 11
	[0069.753] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.753] lstrlenW (lpString="svchost.exe") returned 11
	[0069.754] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.754] lstrlenW (lpString="svchost.exe") returned 11
	[0069.754] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0069.755] lstrlenW (lpString="audiodg.exe") returned 11
	[0069.755] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0069.755] lstrlenW (lpString="sihost.exe") returned 10
	[0069.755] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.756] lstrlenW (lpString="svchost.exe") returned 11
	[0069.756] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0069.756] lstrlenW (lpString="taskhostw.exe") returned 13
	[0069.756] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0069.757] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0069.757] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0069.757] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0069.757] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0069.758] lstrlenW (lpString="explorer.exe") returned 12
	[0069.758] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0069.758] lstrlenW (lpString="Memory Compression") returned 18
	[0069.758] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0069.759] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0069.759] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0069.760] lstrlenW (lpString="SearchUI.exe") returned 12
	[0069.760] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0069.760] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0069.760] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0069.761] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0069.761] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0069.761] lstrlenW (lpString="taskhostw.exe") returned 13
	[0069.761] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0069.762] lstrlenW (lpString="UsoClient.exe") returned 13
	[0069.762] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0069.762] lstrlenW (lpString="taskhostw.exe") returned 13
	[0069.762] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0069.763] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0069.763] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0069.763] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0069.764] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0069.764] lstrlenW (lpString="msoia.exe") returned 9
	[0069.764] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0069.765] lstrlenW (lpString="msoia.exe") returned 9
	[0069.765] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0069.765] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0069.765] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0069.766] lstrlenW (lpString="screensaver.exe") returned 15
	[0069.766] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0069.766] lstrlenW (lpString="nancyedge.exe") returned 13
	[0069.766] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0069.767] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0069.767] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0069.767] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0069.767] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0069.768] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0069.768] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0069.768] lstrlenW (lpString="percentage.exe") returned 14
	[0069.768] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0069.769] lstrlenW (lpString="hh_him.exe") returned 10
	[0069.769] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0069.769] lstrlenW (lpString="nba.exe") returned 7
	[0069.769] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0069.770] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0069.770] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0069.770] lstrlenW (lpString="citizenship.exe") returned 15
	[0069.770] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0069.771] lstrlenW (lpString="beam removable.exe") returned 18
	[0069.771] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0069.771] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0069.771] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0069.772] lstrlenW (lpString="crest-boating.exe") returned 17
	[0069.772] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0069.773] lstrlenW (lpString="wrist.exe") returned 9
	[0069.773] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0069.773] lstrlenW (lpString="indicationwage.exe") returned 18
	[0069.773] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0069.774] lstrlenW (lpString="theepub.exe") returned 11
	[0069.774] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0070.072] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0070.072] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0070.073] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0070.073] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0070.074] lstrlenW (lpString="webpage.exe") returned 11
	[0070.074] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0070.075] lstrlenW (lpString="distributed.exe") returned 15
	[0070.075] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0070.076] lstrlenW (lpString="ann.exe") returned 7
	[0070.076] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0070.076] lstrlenW (lpString="conhost.exe") returned 11
	[0070.077] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0070.077] lstrlenW (lpString="conhost.exe") returned 11
	[0070.077] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0070.078] lstrlenW (lpString="svchost.exe") returned 11
	[0070.078] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0070.079] lstrlenW (lpString="d2.exe") returned 6
	[0070.079] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0070.080] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0070.080] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0070.081] lstrlenW (lpString="conhost.exe") returned 11
	[0070.081] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0070.082] lstrlenW (lpString="dllhost.exe") returned 11
	[0070.082] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0070.082] lstrlenW (lpString="cmd.exe") returned 7
	[0070.083] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0070.083] lstrlenW (lpString="conhost.exe") returned 11
	[0070.083] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0070.084] lstrlenW (lpString="svchost.exe") returned 11
	[0070.084] Process32NextW (in: hSnapshot=0x374, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0070.085] CloseHandle (hObject=0x374) returned 1
	[0070.085] Sleep (dwMilliseconds=0x1f4) 
	[0071.042] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6310b0
	[0071.043] EnumServicesStatusExW (in: hSCManager=0x6310b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0071.044] GetLastError () returned 0xea
	[0071.044] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x670f30
	[0071.044] EnumServicesStatusExW (in: hSCManager=0x6310b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x670f30, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x670f30, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0071.045] CloseServiceHandle (hSCObject=0x6310b0) returned 1
	[0071.045] lstrlenW (lpString="Appinfo") returned 7
	[0071.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0071.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0071.045] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0071.045] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0071.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0071.045] lstrlenW (lpString="AppXSvc") returned 7
	[0071.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0071.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0071.045] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0071.046] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0071.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0071.046] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0071.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0071.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0071.046] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0071.046] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0071.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0071.046] lstrlenW (lpString="Audiosrv") returned 8
	[0071.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0071.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0071.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0071.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0071.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0071.046] lstrlenW (lpString="BFE") returned 3
	[0071.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0071.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0071.046] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0071.046] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0071.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0071.046] lstrlenW (lpString="BITS") returned 4
	[0071.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0071.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0071.046] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0071.046] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0071.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0071.046] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0071.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0071.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0071.047] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0071.047] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0071.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0071.047] lstrlenW (lpString="CDPSvc") returned 6
	[0071.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0071.047] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0071.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0071.047] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0071.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0071.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0071.047] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0071.047] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0071.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0071.047] lstrlenW (lpString="CryptSvc") returned 8
	[0071.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0071.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0071.048] lstrlenW (lpString="DcomLaunch") returned 10
	[0071.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0071.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0071.048] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0071.048] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0071.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0071.048] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0071.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0071.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0071.048] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0071.048] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0071.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0071.048] lstrlenW (lpString="Dhcp") returned 4
	[0071.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0071.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0071.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0071.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0071.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0071.048] lstrlenW (lpString="Dnscache") returned 8
	[0071.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0071.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0071.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0071.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0071.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0071.048] lstrlenW (lpString="DoSvc") returned 5
	[0071.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0071.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0071.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0071.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0071.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0071.049] lstrlenW (lpString="DPS") returned 3
	[0071.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0071.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0071.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0071.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0071.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0071.049] lstrlenW (lpString="DusmSvc") returned 7
	[0071.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0071.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0071.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0071.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0071.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0071.049] lstrlenW (lpString="EventLog") returned 8
	[0071.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0071.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0071.049] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0071.049] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0071.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0071.049] lstrlenW (lpString="EventSystem") returned 11
	[0071.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0071.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0071.049] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0071.049] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0071.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0071.049] lstrlenW (lpString="FontCache") returned 9
	[0071.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0071.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0071.050] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0071.050] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0071.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0071.050] lstrlenW (lpString="gpsvc") returned 5
	[0071.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0071.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0071.050] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0071.050] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0071.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0071.050] lstrlenW (lpString="iphlpsvc") returned 8
	[0071.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0071.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0071.050] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0071.050] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0071.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0071.050] lstrlenW (lpString="KeyIso") returned 6
	[0071.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0071.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0071.050] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0071.050] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0071.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0071.050] lstrlenW (lpString="LanmanServer") returned 12
	[0071.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0071.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0071.050] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0071.051] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0071.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0071.051] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0071.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0071.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0071.051] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0071.051] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0071.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0071.051] lstrlenW (lpString="lfsvc") returned 5
	[0071.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0071.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0071.051] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0071.051] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0071.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0071.051] lstrlenW (lpString="lmhosts") returned 7
	[0071.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0071.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0071.051] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0071.051] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0071.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0071.051] lstrlenW (lpString="LSM") returned 3
	[0071.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0071.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0071.051] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0071.051] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0071.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0071.051] lstrlenW (lpString="MapsBroker") returned 10
	[0071.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0071.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0071.052] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0071.052] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0071.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0071.052] lstrlenW (lpString="MpsSvc") returned 6
	[0071.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0071.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0071.052] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0071.052] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0071.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0071.052] lstrlenW (lpString="NcbService") returned 10
	[0071.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0071.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0071.052] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0071.052] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0071.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0071.052] lstrlenW (lpString="netprofm") returned 8
	[0071.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0071.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0071.052] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0071.052] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0071.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0071.052] lstrlenW (lpString="NlaSvc") returned 6
	[0071.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0071.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0071.052] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0071.053] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0071.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0071.053] lstrlenW (lpString="nsi") returned 3
	[0071.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0071.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0071.053] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0071.053] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0071.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0071.053] lstrlenW (lpString="PcaSvc") returned 6
	[0071.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0071.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0071.053] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0071.053] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0071.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0071.053] lstrlenW (lpString="PlugPlay") returned 8
	[0071.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0071.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0071.053] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0071.053] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0071.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0071.053] lstrlenW (lpString="Power") returned 5
	[0071.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0071.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0071.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0071.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0071.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0071.054] lstrlenW (lpString="ProfSvc") returned 7
	[0071.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0071.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0071.054] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0071.054] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0071.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0071.054] lstrlenW (lpString="RpcEptMapper") returned 12
	[0071.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0071.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0071.054] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0071.054] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0071.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0071.054] lstrlenW (lpString="RpcSs") returned 5
	[0071.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0071.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0071.054] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0071.054] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0071.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0071.054] lstrlenW (lpString="SamSs") returned 5
	[0071.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0071.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0071.054] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0071.054] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0071.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0071.054] lstrlenW (lpString="Schedule") returned 8
	[0071.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0071.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0071.055] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0071.055] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0071.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0071.055] lstrlenW (lpString="SecurityHealthService") returned 21
	[0071.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0071.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0071.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0071.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0071.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0071.055] lstrlenW (lpString="SENS") returned 4
	[0071.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0071.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0071.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0071.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0071.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0071.055] lstrlenW (lpString="ShellHWDetection") returned 16
	[0071.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0071.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0071.055] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0071.055] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0071.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0071.055] lstrlenW (lpString="Spooler") returned 7
	[0071.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0071.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0071.055] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0071.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0071.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0071.056] lstrlenW (lpString="SSDPSRV") returned 7
	[0071.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0071.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0071.473] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0071.473] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0071.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0071.473] lstrlenW (lpString="StateRepository") returned 15
	[0071.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0071.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0071.473] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0071.473] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0071.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0071.473] lstrlenW (lpString="SysMain") returned 7
	[0071.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0071.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0071.474] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0071.474] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0071.474] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x670f30 | out: hHeap=0x600000) returned 1
	[0071.474] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394
	[0071.481] Process32FirstW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0071.482] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0071.482] lstrlenW (lpString="System") returned 6
	[0071.482] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0071.483] lstrlenW (lpString="smss.exe") returned 8
	[0071.483] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0071.484] lstrlenW (lpString="csrss.exe") returned 9
	[0071.484] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0071.484] lstrlenW (lpString="wininit.exe") returned 11
	[0071.484] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0071.485] lstrlenW (lpString="csrss.exe") returned 9
	[0071.485] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0071.486] lstrlenW (lpString="winlogon.exe") returned 12
	[0071.486] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0071.487] lstrlenW (lpString="services.exe") returned 12
	[0071.487] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0071.487] lstrlenW (lpString="lsass.exe") returned 9
	[0071.487] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.488] lstrlenW (lpString="svchost.exe") returned 11
	[0071.488] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0071.488] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0071.489] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0071.489] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0071.489] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.490] lstrlenW (lpString="svchost.exe") returned 11
	[0071.490] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0071.490] lstrlenW (lpString="dwm.exe") returned 7
	[0071.490] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.491] lstrlenW (lpString="svchost.exe") returned 11
	[0071.491] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.491] lstrlenW (lpString="svchost.exe") returned 11
	[0071.491] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.492] lstrlenW (lpString="svchost.exe") returned 11
	[0071.492] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.492] lstrlenW (lpString="svchost.exe") returned 11
	[0071.492] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.493] lstrlenW (lpString="svchost.exe") returned 11
	[0071.493] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.494] lstrlenW (lpString="svchost.exe") returned 11
	[0071.494] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.494] lstrlenW (lpString="svchost.exe") returned 11
	[0071.494] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.495] lstrlenW (lpString="svchost.exe") returned 11
	[0071.495] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.495] lstrlenW (lpString="svchost.exe") returned 11
	[0071.495] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0071.496] lstrlenW (lpString="spoolsv.exe") returned 11
	[0071.496] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.496] lstrlenW (lpString="svchost.exe") returned 11
	[0071.496] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.497] lstrlenW (lpString="svchost.exe") returned 11
	[0071.497] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0071.498] lstrlenW (lpString="audiodg.exe") returned 11
	[0071.498] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0071.498] lstrlenW (lpString="sihost.exe") returned 10
	[0071.498] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.499] lstrlenW (lpString="svchost.exe") returned 11
	[0071.499] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0071.499] lstrlenW (lpString="taskhostw.exe") returned 13
	[0071.499] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0071.500] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0071.500] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0071.500] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0071.500] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0071.501] lstrlenW (lpString="explorer.exe") returned 12
	[0071.501] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0071.501] lstrlenW (lpString="Memory Compression") returned 18
	[0071.501] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0071.502] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0071.502] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0071.503] lstrlenW (lpString="SearchUI.exe") returned 12
	[0071.503] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0071.503] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0071.503] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0071.504] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0071.504] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0071.504] lstrlenW (lpString="taskhostw.exe") returned 13
	[0071.504] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0071.505] lstrlenW (lpString="UsoClient.exe") returned 13
	[0071.505] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0071.505] lstrlenW (lpString="taskhostw.exe") returned 13
	[0071.505] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0071.506] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0071.506] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0071.506] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0071.506] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0071.890] lstrlenW (lpString="msoia.exe") returned 9
	[0071.908] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0071.916] lstrlenW (lpString="msoia.exe") returned 9
	[0071.916] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0071.916] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0071.916] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0071.917] lstrlenW (lpString="screensaver.exe") returned 15
	[0071.917] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0071.918] lstrlenW (lpString="nancyedge.exe") returned 13
	[0071.918] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0071.918] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0071.918] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0071.919] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0071.919] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0071.919] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0071.919] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0071.920] lstrlenW (lpString="percentage.exe") returned 14
	[0071.920] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0071.920] lstrlenW (lpString="hh_him.exe") returned 10
	[0071.921] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0071.921] lstrlenW (lpString="nba.exe") returned 7
	[0071.921] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0071.922] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0071.922] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0071.922] lstrlenW (lpString="citizenship.exe") returned 15
	[0071.922] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0071.923] lstrlenW (lpString="beam removable.exe") returned 18
	[0071.923] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0071.923] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0071.923] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0071.924] lstrlenW (lpString="crest-boating.exe") returned 17
	[0071.924] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0071.925] lstrlenW (lpString="wrist.exe") returned 9
	[0071.925] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0071.925] lstrlenW (lpString="indicationwage.exe") returned 18
	[0071.925] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0071.926] lstrlenW (lpString="theepub.exe") returned 11
	[0071.926] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0071.927] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0071.927] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0071.927] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0071.928] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0071.928] lstrlenW (lpString="webpage.exe") returned 11
	[0071.928] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0071.929] lstrlenW (lpString="distributed.exe") returned 15
	[0071.929] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0071.930] lstrlenW (lpString="ann.exe") returned 7
	[0071.930] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0071.930] lstrlenW (lpString="conhost.exe") returned 11
	[0071.930] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0071.932] lstrlenW (lpString="conhost.exe") returned 11
	[0071.932] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.933] lstrlenW (lpString="svchost.exe") returned 11
	[0071.933] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0071.934] lstrlenW (lpString="d2.exe") returned 6
	[0071.934] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0071.934] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0071.934] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0071.935] lstrlenW (lpString="conhost.exe") returned 11
	[0071.935] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0071.936] lstrlenW (lpString="dllhost.exe") returned 11
	[0071.936] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0071.936] lstrlenW (lpString="cmd.exe") returned 7
	[0071.936] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0071.937] lstrlenW (lpString="conhost.exe") returned 11
	[0071.937] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.937] lstrlenW (lpString="svchost.exe") returned 11
	[0071.937] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0071.938] lstrlenW (lpString="mode.com") returned 8
	[0071.938] Process32NextW (in: hSnapshot=0x394, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0071.939] CloseHandle (hObject=0x394) returned 1
	[0071.939] Sleep (dwMilliseconds=0x1f4) 
	[0072.784] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6310b0
	[0072.785] EnumServicesStatusExW (in: hSCManager=0x6310b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0072.785] GetLastError () returned 0xea
	[0072.785] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x3632f98
	[0072.786] EnumServicesStatusExW (in: hSCManager=0x6310b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3632f98, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3632f98, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0072.787] CloseServiceHandle (hSCObject=0x6310b0) returned 1
	[0072.787] lstrlenW (lpString="Appinfo") returned 7
	[0072.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0072.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0072.787] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0072.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0072.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0072.787] lstrlenW (lpString="AppXSvc") returned 7
	[0072.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0072.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0072.787] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0072.787] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0072.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0072.787] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0072.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0072.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0072.787] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0072.787] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0072.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0072.787] lstrlenW (lpString="Audiosrv") returned 8
	[0072.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0072.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0072.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0072.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0072.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0072.788] lstrlenW (lpString="BFE") returned 3
	[0072.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0072.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0072.788] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0072.788] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0072.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0072.788] lstrlenW (lpString="BITS") returned 4
	[0072.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0072.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0072.788] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0072.788] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0072.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0072.788] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0072.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0072.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0072.788] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0072.788] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0072.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0072.788] lstrlenW (lpString="CDPSvc") returned 6
	[0072.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0072.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0072.788] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0072.788] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0072.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0072.788] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0072.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0072.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0072.789] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0072.789] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0072.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0072.789] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0072.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0072.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0072.789] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0072.789] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0072.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0072.789] lstrlenW (lpString="CryptSvc") returned 8
	[0072.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0072.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0072.789] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0072.789] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0072.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0072.789] lstrlenW (lpString="DcomLaunch") returned 10
	[0072.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0072.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0072.789] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0072.789] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0072.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0072.789] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0072.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0072.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0072.789] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0072.789] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0072.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0072.789] lstrlenW (lpString="Dhcp") returned 4
	[0072.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0072.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0072.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0072.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0072.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0072.790] lstrlenW (lpString="Dnscache") returned 8
	[0072.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0072.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0072.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0072.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0072.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0072.790] lstrlenW (lpString="DoSvc") returned 5
	[0072.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0072.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0072.790] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0072.790] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0072.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0072.790] lstrlenW (lpString="DPS") returned 3
	[0072.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0072.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0072.790] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0072.790] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0072.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0072.790] lstrlenW (lpString="DusmSvc") returned 7
	[0072.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0072.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0072.790] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0072.790] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0072.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0072.790] lstrlenW (lpString="EventLog") returned 8
	[0072.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0072.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0072.791] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0072.791] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0072.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0072.791] lstrlenW (lpString="EventSystem") returned 11
	[0072.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0072.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0072.791] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0072.791] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0072.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0072.791] lstrlenW (lpString="FontCache") returned 9
	[0072.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0072.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0072.791] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0072.791] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0072.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0072.791] lstrlenW (lpString="gpsvc") returned 5
	[0072.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0072.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0072.791] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0072.791] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0072.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0072.791] lstrlenW (lpString="iphlpsvc") returned 8
	[0072.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0072.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0072.791] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0072.791] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0072.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0072.792] lstrlenW (lpString="KeyIso") returned 6
	[0072.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0072.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0072.792] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0072.792] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0072.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0072.792] lstrlenW (lpString="LanmanServer") returned 12
	[0072.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0072.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0072.792] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0072.792] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0072.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0072.792] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0072.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0072.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0072.792] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0072.792] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0072.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0072.792] lstrlenW (lpString="lfsvc") returned 5
	[0072.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0072.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0072.792] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0072.792] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0072.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0072.793] lstrlenW (lpString="lmhosts") returned 7
	[0072.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0072.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0072.793] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0072.793] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0072.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0072.793] lstrlenW (lpString="LSM") returned 3
	[0072.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0072.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0072.793] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0072.793] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0072.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0072.793] lstrlenW (lpString="MapsBroker") returned 10
	[0072.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0072.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0072.793] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0072.793] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0072.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0072.793] lstrlenW (lpString="MpsSvc") returned 6
	[0072.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0072.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0072.793] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0072.793] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0072.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0072.793] lstrlenW (lpString="NcbService") returned 10
	[0072.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0072.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0072.793] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0072.794] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0072.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0072.794] lstrlenW (lpString="netprofm") returned 8
	[0072.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0072.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0072.794] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0072.794] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0072.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0072.794] lstrlenW (lpString="NlaSvc") returned 6
	[0072.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0072.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0072.794] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0072.794] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0072.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0072.794] lstrlenW (lpString="nsi") returned 3
	[0072.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0072.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0072.794] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0072.794] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0072.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0072.794] lstrlenW (lpString="PcaSvc") returned 6
	[0072.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0072.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0072.794] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0072.794] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0072.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0072.794] lstrlenW (lpString="PlugPlay") returned 8
	[0072.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0072.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0072.795] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0072.795] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0072.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0072.795] lstrlenW (lpString="Power") returned 5
	[0072.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0072.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0072.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0072.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0072.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0072.795] lstrlenW (lpString="ProfSvc") returned 7
	[0072.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0072.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0072.795] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0072.795] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0072.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0072.795] lstrlenW (lpString="RpcEptMapper") returned 12
	[0072.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0072.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0072.795] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0072.795] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0072.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0072.795] lstrlenW (lpString="RpcSs") returned 5
	[0072.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0072.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0072.795] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0072.795] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0072.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0072.796] lstrlenW (lpString="SamSs") returned 5
	[0072.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0072.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0072.796] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0072.796] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0072.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0072.796] lstrlenW (lpString="Schedule") returned 8
	[0072.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0072.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0072.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0072.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0072.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0072.796] lstrlenW (lpString="SecurityHealthService") returned 21
	[0072.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0072.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0072.796] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0072.796] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0072.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0072.796] lstrlenW (lpString="SENS") returned 4
	[0072.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0072.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0072.796] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0072.796] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0072.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0072.796] lstrlenW (lpString="ShellHWDetection") returned 16
	[0072.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0072.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0072.797] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0072.797] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0072.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0072.797] lstrlenW (lpString="Spooler") returned 7
	[0072.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0072.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0072.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0072.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0072.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0072.797] lstrlenW (lpString="SSDPSRV") returned 7
	[0072.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0072.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0072.797] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0072.797] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0072.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0072.797] lstrlenW (lpString="StateRepository") returned 15
	[0072.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0072.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0072.798] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0072.798] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0072.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0072.798] lstrlenW (lpString="SysMain") returned 7
	[0072.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0072.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0072.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0072.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0072.798] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378
	[0072.949] Process32FirstW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0072.950] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0072.950] lstrlenW (lpString="System") returned 6
	[0072.950] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0072.951] lstrlenW (lpString="smss.exe") returned 8
	[0072.951] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0072.951] lstrlenW (lpString="csrss.exe") returned 9
	[0072.951] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0072.952] lstrlenW (lpString="wininit.exe") returned 11
	[0072.952] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0072.952] lstrlenW (lpString="csrss.exe") returned 9
	[0072.952] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0072.953] lstrlenW (lpString="winlogon.exe") returned 12
	[0072.953] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0072.953] lstrlenW (lpString="services.exe") returned 12
	[0072.953] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0072.954] lstrlenW (lpString="lsass.exe") returned 9
	[0072.954] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.954] lstrlenW (lpString="svchost.exe") returned 11
	[0072.954] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0072.955] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0072.955] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0072.955] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0072.956] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.956] lstrlenW (lpString="svchost.exe") returned 11
	[0072.956] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0072.957] lstrlenW (lpString="dwm.exe") returned 7
	[0072.957] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.959] lstrlenW (lpString="svchost.exe") returned 11
	[0072.959] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.959] lstrlenW (lpString="svchost.exe") returned 11
	[0072.959] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.960] lstrlenW (lpString="svchost.exe") returned 11
	[0072.960] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.960] lstrlenW (lpString="svchost.exe") returned 11
	[0072.960] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.961] lstrlenW (lpString="svchost.exe") returned 11
	[0072.961] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.961] lstrlenW (lpString="svchost.exe") returned 11
	[0072.961] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.962] lstrlenW (lpString="svchost.exe") returned 11
	[0072.962] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.963] lstrlenW (lpString="svchost.exe") returned 11
	[0072.963] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.963] lstrlenW (lpString="svchost.exe") returned 11
	[0072.963] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0072.964] lstrlenW (lpString="spoolsv.exe") returned 11
	[0072.964] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.965] lstrlenW (lpString="svchost.exe") returned 11
	[0072.965] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.965] lstrlenW (lpString="svchost.exe") returned 11
	[0072.965] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0072.966] lstrlenW (lpString="audiodg.exe") returned 11
	[0072.966] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0072.967] lstrlenW (lpString="sihost.exe") returned 10
	[0072.967] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0072.967] lstrlenW (lpString="svchost.exe") returned 11
	[0072.967] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0072.968] lstrlenW (lpString="taskhostw.exe") returned 13
	[0072.968] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0072.968] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0072.968] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0072.969] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0072.969] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0072.970] lstrlenW (lpString="explorer.exe") returned 12
	[0072.970] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0072.970] lstrlenW (lpString="Memory Compression") returned 18
	[0072.970] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0072.971] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0072.971] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0072.971] lstrlenW (lpString="SearchUI.exe") returned 12
	[0072.971] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0072.972] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0072.972] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0072.972] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0072.972] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0072.973] lstrlenW (lpString="taskhostw.exe") returned 13
	[0072.973] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0072.974] lstrlenW (lpString="UsoClient.exe") returned 13
	[0072.974] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0072.974] lstrlenW (lpString="taskhostw.exe") returned 13
	[0072.974] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0072.975] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0072.975] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0072.975] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0072.975] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0072.976] lstrlenW (lpString="msoia.exe") returned 9
	[0072.976] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0072.976] lstrlenW (lpString="msoia.exe") returned 9
	[0072.977] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0072.977] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0072.977] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0072.978] lstrlenW (lpString="screensaver.exe") returned 15
	[0072.978] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0072.978] lstrlenW (lpString="nancyedge.exe") returned 13
	[0072.978] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0072.979] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0072.979] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0072.979] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0072.979] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0073.334] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0073.343] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0073.344] lstrlenW (lpString="percentage.exe") returned 14
	[0073.344] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0073.344] lstrlenW (lpString="hh_him.exe") returned 10
	[0073.345] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0073.345] lstrlenW (lpString="nba.exe") returned 7
	[0073.345] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0073.346] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0073.346] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0073.346] lstrlenW (lpString="citizenship.exe") returned 15
	[0073.346] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0073.347] lstrlenW (lpString="beam removable.exe") returned 18
	[0073.347] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0073.347] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0073.347] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0073.348] lstrlenW (lpString="crest-boating.exe") returned 17
	[0073.348] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0073.349] lstrlenW (lpString="wrist.exe") returned 9
	[0073.349] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0073.350] lstrlenW (lpString="indicationwage.exe") returned 18
	[0073.350] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0073.351] lstrlenW (lpString="theepub.exe") returned 11
	[0073.351] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0073.351] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0073.352] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0073.352] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0073.352] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0073.353] lstrlenW (lpString="webpage.exe") returned 11
	[0073.353] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0073.354] lstrlenW (lpString="distributed.exe") returned 15
	[0073.354] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0073.355] lstrlenW (lpString="ann.exe") returned 7
	[0073.355] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0073.355] lstrlenW (lpString="conhost.exe") returned 11
	[0073.355] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0073.356] lstrlenW (lpString="conhost.exe") returned 11
	[0073.356] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.357] lstrlenW (lpString="svchost.exe") returned 11
	[0073.357] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0073.358] lstrlenW (lpString="d2.exe") returned 6
	[0073.358] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0073.359] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0073.359] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0073.359] lstrlenW (lpString="conhost.exe") returned 11
	[0073.359] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0073.360] lstrlenW (lpString="dllhost.exe") returned 11
	[0073.360] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0073.361] lstrlenW (lpString="cmd.exe") returned 7
	[0073.361] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0073.361] lstrlenW (lpString="conhost.exe") returned 11
	[0073.361] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.362] lstrlenW (lpString="svchost.exe") returned 11
	[0073.362] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0073.362] lstrlenW (lpString="mode.com") returned 8
	[0073.363] Process32NextW (in: hSnapshot=0x378, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0073.363] CloseHandle (hObject=0x378) returned 1
	[0073.364] Sleep (dwMilliseconds=0x1f4) 
	[0074.277] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6310b0
	[0074.278] EnumServicesStatusExW (in: hSCManager=0x6310b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0074.278] GetLastError () returned 0xea
	[0074.278] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x3634fa8
	[0074.279] EnumServicesStatusExW (in: hSCManager=0x6310b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3634fa8, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3634fa8, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0074.279] CloseServiceHandle (hSCObject=0x6310b0) returned 1
	[0074.280] lstrlenW (lpString="Appinfo") returned 7
	[0074.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0074.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0074.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0074.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0074.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0074.280] lstrlenW (lpString="AppXSvc") returned 7
	[0074.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0074.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0074.280] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0074.280] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0074.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0074.280] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0074.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0074.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0074.280] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0074.280] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0074.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0074.281] lstrlenW (lpString="Audiosrv") returned 8
	[0074.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0074.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0074.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0074.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0074.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0074.281] lstrlenW (lpString="BFE") returned 3
	[0074.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0074.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0074.281] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0074.281] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0074.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0074.281] lstrlenW (lpString="BITS") returned 4
	[0074.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0074.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0074.281] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0074.281] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0074.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0074.281] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0074.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0074.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0074.282] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0074.282] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0074.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0074.282] lstrlenW (lpString="CDPSvc") returned 6
	[0074.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0074.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0074.282] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0074.282] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0074.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0074.282] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0074.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0074.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0074.282] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0074.282] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0074.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0074.282] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0074.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0074.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0074.282] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0074.282] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0074.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0074.282] lstrlenW (lpString="CryptSvc") returned 8
	[0074.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0074.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0074.283] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0074.283] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0074.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0074.283] lstrlenW (lpString="DcomLaunch") returned 10
	[0074.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0074.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0074.283] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0074.283] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0074.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0074.283] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0074.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0074.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0074.283] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0074.283] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0074.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0074.283] lstrlenW (lpString="Dhcp") returned 4
	[0074.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0074.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0074.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0074.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0074.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0074.283] lstrlenW (lpString="Dnscache") returned 8
	[0074.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0074.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0074.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0074.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0074.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0074.284] lstrlenW (lpString="DoSvc") returned 5
	[0074.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0074.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0074.284] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0074.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0074.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0074.284] lstrlenW (lpString="DPS") returned 3
	[0074.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0074.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0074.284] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0074.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0074.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0074.284] lstrlenW (lpString="DusmSvc") returned 7
	[0074.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0074.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0074.284] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0074.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0074.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0074.285] lstrlenW (lpString="EventLog") returned 8
	[0074.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0074.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0074.285] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0074.285] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0074.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0074.285] lstrlenW (lpString="EventSystem") returned 11
	[0074.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0074.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0074.795] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0074.795] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0074.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0074.796] lstrlenW (lpString="FontCache") returned 9
	[0074.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0074.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0074.796] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0074.796] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0074.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0074.796] lstrlenW (lpString="gpsvc") returned 5
	[0074.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0074.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0074.796] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0074.796] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0074.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0074.796] lstrlenW (lpString="iphlpsvc") returned 8
	[0074.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0074.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0074.796] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0074.796] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0074.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0074.796] lstrlenW (lpString="KeyIso") returned 6
	[0074.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0074.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0074.796] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0074.796] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0074.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0074.797] lstrlenW (lpString="LanmanServer") returned 12
	[0074.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0074.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0074.797] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0074.797] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0074.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0074.797] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0074.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0074.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0074.797] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0074.797] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0074.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0074.797] lstrlenW (lpString="lfsvc") returned 5
	[0074.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0074.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0074.797] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0074.797] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0074.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0074.797] lstrlenW (lpString="lmhosts") returned 7
	[0074.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0074.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0074.797] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0074.797] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0074.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0074.797] lstrlenW (lpString="LSM") returned 3
	[0074.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0074.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0074.798] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0074.798] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0074.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0074.798] lstrlenW (lpString="MapsBroker") returned 10
	[0074.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0074.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0074.798] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0074.798] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0074.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0074.798] lstrlenW (lpString="MpsSvc") returned 6
	[0074.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0074.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0074.798] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0074.798] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0074.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0074.798] lstrlenW (lpString="NcbService") returned 10
	[0074.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0074.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0074.798] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0074.798] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0074.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0074.798] lstrlenW (lpString="netprofm") returned 8
	[0074.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0074.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0074.799] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0074.799] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0074.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0074.799] lstrlenW (lpString="NlaSvc") returned 6
	[0074.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0074.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0074.799] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0074.799] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0074.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0074.799] lstrlenW (lpString="nsi") returned 3
	[0074.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0074.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0074.799] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0074.799] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0074.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0074.799] lstrlenW (lpString="PcaSvc") returned 6
	[0074.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0074.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0074.799] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0074.799] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0074.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0074.799] lstrlenW (lpString="PlugPlay") returned 8
	[0074.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0074.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0074.800] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0074.800] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0074.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0074.800] lstrlenW (lpString="Power") returned 5
	[0074.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0074.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0074.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0074.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0074.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0074.800] lstrlenW (lpString="ProfSvc") returned 7
	[0074.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0074.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0074.800] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0074.800] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0074.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0074.800] lstrlenW (lpString="RpcEptMapper") returned 12
	[0074.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0074.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0074.801] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0074.801] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0074.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0074.801] lstrlenW (lpString="RpcSs") returned 5
	[0074.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0074.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0074.801] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0074.801] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0074.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0074.801] lstrlenW (lpString="SamSs") returned 5
	[0074.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0074.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0074.801] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0074.802] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0074.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0074.802] lstrlenW (lpString="Schedule") returned 8
	[0074.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0074.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0074.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0074.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0074.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0074.802] lstrlenW (lpString="SecurityHealthService") returned 21
	[0074.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0074.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0074.802] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0074.802] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0074.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0074.802] lstrlenW (lpString="SENS") returned 4
	[0074.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0074.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0074.802] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0074.802] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0074.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0074.803] lstrlenW (lpString="ShellHWDetection") returned 16
	[0074.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0074.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0074.803] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0074.803] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0074.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0074.803] lstrlenW (lpString="Spooler") returned 7
	[0074.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0074.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0074.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0074.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0074.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0074.803] lstrlenW (lpString="SSDPSRV") returned 7
	[0074.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0074.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0074.803] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0074.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0074.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0074.804] lstrlenW (lpString="StateRepository") returned 15
	[0074.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0074.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0074.804] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0074.804] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0074.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0074.804] lstrlenW (lpString="SysMain") returned 7
	[0074.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0074.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0074.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0074.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0074.805] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344
	[0074.811] Process32FirstW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0074.811] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0074.812] lstrlenW (lpString="System") returned 6
	[0074.812] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0074.813] lstrlenW (lpString="smss.exe") returned 8
	[0074.813] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0074.813] lstrlenW (lpString="csrss.exe") returned 9
	[0074.814] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0074.814] lstrlenW (lpString="wininit.exe") returned 11
	[0074.814] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0074.815] lstrlenW (lpString="csrss.exe") returned 9
	[0074.815] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0074.816] lstrlenW (lpString="winlogon.exe") returned 12
	[0074.816] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0074.817] lstrlenW (lpString="services.exe") returned 12
	[0074.817] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0074.817] lstrlenW (lpString="lsass.exe") returned 9
	[0074.817] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.818] lstrlenW (lpString="svchost.exe") returned 11
	[0074.818] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0074.819] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0074.819] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0074.819] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0074.819] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.820] lstrlenW (lpString="svchost.exe") returned 11
	[0074.820] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0074.820] lstrlenW (lpString="dwm.exe") returned 7
	[0074.820] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.821] lstrlenW (lpString="svchost.exe") returned 11
	[0074.821] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.821] lstrlenW (lpString="svchost.exe") returned 11
	[0074.821] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.822] lstrlenW (lpString="svchost.exe") returned 11
	[0074.822] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.823] lstrlenW (lpString="svchost.exe") returned 11
	[0074.823] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.823] lstrlenW (lpString="svchost.exe") returned 11
	[0074.823] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.824] lstrlenW (lpString="svchost.exe") returned 11
	[0074.824] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.824] lstrlenW (lpString="svchost.exe") returned 11
	[0074.824] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.825] lstrlenW (lpString="svchost.exe") returned 11
	[0074.825] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.826] lstrlenW (lpString="svchost.exe") returned 11
	[0074.826] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0074.826] lstrlenW (lpString="spoolsv.exe") returned 11
	[0074.826] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.827] lstrlenW (lpString="svchost.exe") returned 11
	[0074.827] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.240] lstrlenW (lpString="svchost.exe") returned 11
	[0075.240] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0075.241] lstrlenW (lpString="audiodg.exe") returned 11
	[0075.241] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0075.241] lstrlenW (lpString="sihost.exe") returned 10
	[0075.242] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.242] lstrlenW (lpString="svchost.exe") returned 11
	[0075.242] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0075.243] lstrlenW (lpString="taskhostw.exe") returned 13
	[0075.243] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0075.243] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0075.244] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0075.244] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0075.244] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0075.245] lstrlenW (lpString="explorer.exe") returned 12
	[0075.245] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0075.245] lstrlenW (lpString="Memory Compression") returned 18
	[0075.246] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0075.246] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0075.246] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0075.247] lstrlenW (lpString="SearchUI.exe") returned 12
	[0075.247] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0075.248] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0075.248] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0075.248] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0075.248] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0075.249] lstrlenW (lpString="taskhostw.exe") returned 13
	[0075.249] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0075.250] lstrlenW (lpString="UsoClient.exe") returned 13
	[0075.250] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0075.250] lstrlenW (lpString="taskhostw.exe") returned 13
	[0075.251] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0075.251] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0075.251] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0075.252] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0075.252] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0075.252] lstrlenW (lpString="msoia.exe") returned 9
	[0075.252] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0075.253] lstrlenW (lpString="msoia.exe") returned 9
	[0075.253] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0075.254] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0075.254] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0075.254] lstrlenW (lpString="screensaver.exe") returned 15
	[0075.254] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0075.255] lstrlenW (lpString="nancyedge.exe") returned 13
	[0075.255] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0075.256] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0075.256] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0075.256] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0075.256] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0075.257] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0075.257] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0075.257] lstrlenW (lpString="percentage.exe") returned 14
	[0075.257] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0075.258] lstrlenW (lpString="hh_him.exe") returned 10
	[0075.258] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0075.259] lstrlenW (lpString="nba.exe") returned 7
	[0075.259] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0075.259] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0075.259] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0075.260] lstrlenW (lpString="citizenship.exe") returned 15
	[0075.260] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0075.260] lstrlenW (lpString="beam removable.exe") returned 18
	[0075.260] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0075.261] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0075.261] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0075.261] lstrlenW (lpString="crest-boating.exe") returned 17
	[0075.262] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0075.262] lstrlenW (lpString="wrist.exe") returned 9
	[0075.262] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0075.263] lstrlenW (lpString="indicationwage.exe") returned 18
	[0075.263] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0075.264] lstrlenW (lpString="theepub.exe") returned 11
	[0075.264] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0075.264] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0075.264] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0075.265] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0075.265] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0075.266] lstrlenW (lpString="webpage.exe") returned 11
	[0075.266] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0075.266] lstrlenW (lpString="distributed.exe") returned 15
	[0075.267] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0075.267] lstrlenW (lpString="ann.exe") returned 7
	[0075.267] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0075.268] lstrlenW (lpString="conhost.exe") returned 11
	[0075.268] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0075.268] lstrlenW (lpString="conhost.exe") returned 11
	[0075.269] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.269] lstrlenW (lpString="svchost.exe") returned 11
	[0075.269] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0075.270] lstrlenW (lpString="d2.exe") returned 6
	[0075.270] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0075.271] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0075.271] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0075.271] lstrlenW (lpString="conhost.exe") returned 11
	[0075.272] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0075.272] lstrlenW (lpString="dllhost.exe") returned 11
	[0075.272] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0075.273] lstrlenW (lpString="cmd.exe") returned 7
	[0075.273] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0075.274] lstrlenW (lpString="conhost.exe") returned 11
	[0075.274] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.274] lstrlenW (lpString="svchost.exe") returned 11
	[0075.274] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0075.275] lstrlenW (lpString="mode.com") returned 8
	[0075.275] Process32NextW (in: hSnapshot=0x344, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0075.275] CloseHandle (hObject=0x344) returned 1
	[0075.276] Sleep (dwMilliseconds=0x1f4) 
	[0076.161] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x631178
	[0076.692] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0076.693] GetLastError () returned 0xea
	[0076.693] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x363afd0
	[0076.694] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x363afd0, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x363afd0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0076.694] CloseServiceHandle (hSCObject=0x631178) returned 1
	[0076.695] lstrlenW (lpString="Appinfo") returned 7
	[0076.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0076.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0076.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0076.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0076.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0076.695] lstrlenW (lpString="AppXSvc") returned 7
	[0076.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0076.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0076.695] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0076.695] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0076.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0076.695] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0076.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0076.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0076.695] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0076.695] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0076.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0076.695] lstrlenW (lpString="Audiosrv") returned 8
	[0076.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0076.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0076.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0076.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0076.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0076.695] lstrlenW (lpString="BFE") returned 3
	[0076.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0076.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0076.696] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0076.696] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0076.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0076.696] lstrlenW (lpString="BITS") returned 4
	[0076.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0076.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0076.696] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0076.696] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0076.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0076.696] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0076.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0076.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0076.696] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0076.696] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0076.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0076.696] lstrlenW (lpString="CDPSvc") returned 6
	[0076.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0076.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0076.696] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0076.696] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0076.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0076.696] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0076.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0076.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0076.697] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0076.697] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0076.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0076.697] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0076.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0076.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0076.697] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0076.697] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0076.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0076.697] lstrlenW (lpString="CryptSvc") returned 8
	[0076.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0076.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0076.697] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0076.697] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0076.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0076.697] lstrlenW (lpString="DcomLaunch") returned 10
	[0076.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0076.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0076.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0076.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0076.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0076.697] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0076.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0076.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0076.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0076.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0076.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0076.697] lstrlenW (lpString="Dhcp") returned 4
	[0076.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0076.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0076.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0076.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0076.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0076.698] lstrlenW (lpString="Dnscache") returned 8
	[0076.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0076.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0076.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0076.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0076.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0076.698] lstrlenW (lpString="DoSvc") returned 5
	[0076.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0076.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0076.698] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0076.698] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0076.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0076.698] lstrlenW (lpString="DPS") returned 3
	[0076.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0076.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0076.698] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0076.698] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0076.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0076.698] lstrlenW (lpString="DusmSvc") returned 7
	[0076.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0076.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0076.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0076.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0076.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0076.699] lstrlenW (lpString="EventLog") returned 8
	[0076.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0076.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0076.699] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0076.699] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0076.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0076.699] lstrlenW (lpString="EventSystem") returned 11
	[0076.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0076.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0076.699] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0076.699] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0076.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0076.699] lstrlenW (lpString="FontCache") returned 9
	[0076.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0076.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0076.699] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0076.699] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0076.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0076.699] lstrlenW (lpString="gpsvc") returned 5
	[0076.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0076.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0076.700] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0076.700] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0076.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0076.700] lstrlenW (lpString="iphlpsvc") returned 8
	[0076.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0076.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0076.700] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0076.700] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0076.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0076.700] lstrlenW (lpString="KeyIso") returned 6
	[0076.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0076.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0076.700] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0076.700] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0076.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0076.700] lstrlenW (lpString="LanmanServer") returned 12
	[0076.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0076.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0076.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0076.700] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0076.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0076.700] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0076.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0076.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0076.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0076.700] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0076.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0076.701] lstrlenW (lpString="lfsvc") returned 5
	[0076.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0076.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0076.701] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0076.701] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0076.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0076.701] lstrlenW (lpString="lmhosts") returned 7
	[0076.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0076.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0076.701] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0076.701] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0076.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0076.701] lstrlenW (lpString="LSM") returned 3
	[0076.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0076.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0076.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0076.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0076.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0076.701] lstrlenW (lpString="MapsBroker") returned 10
	[0076.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0076.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0076.701] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0076.701] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0076.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0076.702] lstrlenW (lpString="MpsSvc") returned 6
	[0076.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0076.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0076.702] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0076.702] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0076.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0076.702] lstrlenW (lpString="NcbService") returned 10
	[0076.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0076.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0076.702] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0076.702] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0076.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0076.702] lstrlenW (lpString="netprofm") returned 8
	[0076.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0076.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0076.702] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0076.702] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0076.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0076.702] lstrlenW (lpString="NlaSvc") returned 6
	[0076.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0076.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0076.703] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0076.703] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0076.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0076.703] lstrlenW (lpString="nsi") returned 3
	[0076.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0076.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0076.703] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0076.703] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0076.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0076.703] lstrlenW (lpString="PcaSvc") returned 6
	[0076.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0076.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0076.703] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0076.703] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0076.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0076.703] lstrlenW (lpString="PlugPlay") returned 8
	[0076.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0076.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0076.703] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0076.703] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0076.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0076.703] lstrlenW (lpString="Power") returned 5
	[0076.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0076.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0076.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0076.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0076.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0076.704] lstrlenW (lpString="ProfSvc") returned 7
	[0076.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0076.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0076.704] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0076.704] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0076.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0076.704] lstrlenW (lpString="RpcEptMapper") returned 12
	[0076.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0076.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0076.704] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0076.704] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0076.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0076.704] lstrlenW (lpString="RpcSs") returned 5
	[0076.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0076.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0076.704] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0076.704] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0076.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0076.704] lstrlenW (lpString="SamSs") returned 5
	[0076.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0076.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0076.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0076.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0076.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0076.705] lstrlenW (lpString="Schedule") returned 8
	[0076.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0076.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0076.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0076.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0076.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0076.705] lstrlenW (lpString="SecurityHealthService") returned 21
	[0076.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0076.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0076.705] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0076.705] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0076.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0076.705] lstrlenW (lpString="SENS") returned 4
	[0076.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0076.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0076.705] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0076.705] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0076.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0076.705] lstrlenW (lpString="ShellHWDetection") returned 16
	[0076.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0076.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0076.705] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0076.705] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0076.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0076.705] lstrlenW (lpString="Spooler") returned 7
	[0076.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0076.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0076.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0076.706] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0076.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0076.706] lstrlenW (lpString="SSDPSRV") returned 7
	[0076.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0076.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0076.706] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0076.706] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0076.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0076.706] lstrlenW (lpString="StateRepository") returned 15
	[0076.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0076.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0076.706] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0076.706] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0076.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0076.706] lstrlenW (lpString="SysMain") returned 7
	[0076.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0076.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0076.706] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0076.706] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0076.706] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368
	[0077.214] Process32FirstW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0077.215] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0077.215] lstrlenW (lpString="System") returned 6
	[0077.215] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0077.216] lstrlenW (lpString="smss.exe") returned 8
	[0077.216] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0077.217] lstrlenW (lpString="csrss.exe") returned 9
	[0077.217] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0077.217] lstrlenW (lpString="wininit.exe") returned 11
	[0077.217] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0077.218] lstrlenW (lpString="csrss.exe") returned 9
	[0077.218] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0077.218] lstrlenW (lpString="winlogon.exe") returned 12
	[0077.218] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0077.219] lstrlenW (lpString="services.exe") returned 12
	[0077.219] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0077.219] lstrlenW (lpString="lsass.exe") returned 9
	[0077.219] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.220] lstrlenW (lpString="svchost.exe") returned 11
	[0077.220] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0077.220] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0077.221] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0077.221] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0077.221] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.222] lstrlenW (lpString="svchost.exe") returned 11
	[0077.222] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0077.222] lstrlenW (lpString="dwm.exe") returned 7
	[0077.222] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.223] lstrlenW (lpString="svchost.exe") returned 11
	[0077.223] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.223] lstrlenW (lpString="svchost.exe") returned 11
	[0077.223] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.224] lstrlenW (lpString="svchost.exe") returned 11
	[0077.224] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.225] lstrlenW (lpString="svchost.exe") returned 11
	[0077.225] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.225] lstrlenW (lpString="svchost.exe") returned 11
	[0077.225] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.226] lstrlenW (lpString="svchost.exe") returned 11
	[0077.226] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.226] lstrlenW (lpString="svchost.exe") returned 11
	[0077.226] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.227] lstrlenW (lpString="svchost.exe") returned 11
	[0077.227] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.227] lstrlenW (lpString="svchost.exe") returned 11
	[0077.227] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0077.228] lstrlenW (lpString="spoolsv.exe") returned 11
	[0077.228] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.228] lstrlenW (lpString="svchost.exe") returned 11
	[0077.228] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.229] lstrlenW (lpString="svchost.exe") returned 11
	[0077.229] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0077.230] lstrlenW (lpString="audiodg.exe") returned 11
	[0077.230] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0077.230] lstrlenW (lpString="sihost.exe") returned 10
	[0077.230] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.231] lstrlenW (lpString="svchost.exe") returned 11
	[0077.231] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0077.231] lstrlenW (lpString="taskhostw.exe") returned 13
	[0077.231] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0077.232] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0077.232] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0077.232] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0077.232] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0077.233] lstrlenW (lpString="explorer.exe") returned 12
	[0077.233] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0077.233] lstrlenW (lpString="Memory Compression") returned 18
	[0077.233] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0077.234] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0077.234] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0077.235] lstrlenW (lpString="SearchUI.exe") returned 12
	[0077.235] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0077.235] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0077.235] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0077.236] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0077.236] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0077.236] lstrlenW (lpString="taskhostw.exe") returned 13
	[0077.236] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0077.237] lstrlenW (lpString="UsoClient.exe") returned 13
	[0077.237] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0077.237] lstrlenW (lpString="taskhostw.exe") returned 13
	[0077.237] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0077.238] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0077.238] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0077.238] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0077.238] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0077.280] lstrlenW (lpString="msoia.exe") returned 9
	[0077.280] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0077.280] lstrlenW (lpString="msoia.exe") returned 9
	[0077.280] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0077.281] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0077.281] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0077.281] lstrlenW (lpString="screensaver.exe") returned 15
	[0077.281] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0077.282] lstrlenW (lpString="nancyedge.exe") returned 13
	[0077.282] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0077.283] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0077.283] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0077.283] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0077.283] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0077.284] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0077.284] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0077.284] lstrlenW (lpString="percentage.exe") returned 14
	[0077.284] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0077.285] lstrlenW (lpString="hh_him.exe") returned 10
	[0077.285] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0077.286] lstrlenW (lpString="nba.exe") returned 7
	[0077.286] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0077.286] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0077.286] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0077.287] lstrlenW (lpString="citizenship.exe") returned 15
	[0077.287] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0077.288] lstrlenW (lpString="beam removable.exe") returned 18
	[0077.288] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0077.288] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0077.288] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0077.289] lstrlenW (lpString="crest-boating.exe") returned 17
	[0077.289] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0077.290] lstrlenW (lpString="wrist.exe") returned 9
	[0077.290] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0077.290] lstrlenW (lpString="indicationwage.exe") returned 18
	[0077.290] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0077.291] lstrlenW (lpString="theepub.exe") returned 11
	[0077.291] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0077.292] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0077.292] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0077.293] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0077.293] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0077.293] lstrlenW (lpString="webpage.exe") returned 11
	[0077.293] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0077.294] lstrlenW (lpString="distributed.exe") returned 15
	[0077.294] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0077.295] lstrlenW (lpString="ann.exe") returned 7
	[0077.295] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0077.295] lstrlenW (lpString="conhost.exe") returned 11
	[0077.295] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0077.296] lstrlenW (lpString="conhost.exe") returned 11
	[0077.296] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.297] lstrlenW (lpString="svchost.exe") returned 11
	[0077.297] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0077.297] lstrlenW (lpString="d2.exe") returned 6
	[0077.297] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0077.298] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0077.298] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0077.299] lstrlenW (lpString="conhost.exe") returned 11
	[0077.299] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0077.299] lstrlenW (lpString="dllhost.exe") returned 11
	[0077.299] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0077.300] lstrlenW (lpString="cmd.exe") returned 7
	[0077.300] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0077.300] lstrlenW (lpString="conhost.exe") returned 11
	[0077.301] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.301] lstrlenW (lpString="svchost.exe") returned 11
	[0077.302] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0077.302] lstrlenW (lpString="mode.com") returned 8
	[0077.302] Process32NextW (in: hSnapshot=0x368, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0077.303] CloseHandle (hObject=0x368) returned 1
	[0077.303] Sleep (dwMilliseconds=0x1f4) 
	[0078.137] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x631178
	[0078.174] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0078.174] GetLastError () returned 0xea
	[0078.174] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x363cfd8
	[0078.175] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x363cfd8, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x363cfd8, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0078.176] CloseServiceHandle (hSCObject=0x631178) returned 1
	[0078.176] lstrlenW (lpString="Appinfo") returned 7
	[0078.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0078.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0078.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0078.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0078.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0078.176] lstrlenW (lpString="AppXSvc") returned 7
	[0078.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0078.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0078.176] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0078.176] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0078.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0078.177] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0078.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0078.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0078.177] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0078.177] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0078.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0078.177] lstrlenW (lpString="Audiosrv") returned 8
	[0078.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0078.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0078.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0078.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0078.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0078.177] lstrlenW (lpString="BFE") returned 3
	[0078.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0078.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0078.177] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0078.177] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0078.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0078.177] lstrlenW (lpString="BITS") returned 4
	[0078.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0078.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0078.177] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0078.177] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0078.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0078.177] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0078.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0078.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0078.178] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0078.178] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0078.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0078.178] lstrlenW (lpString="CDPSvc") returned 6
	[0078.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0078.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0078.178] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0078.178] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0078.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0078.178] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0078.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0078.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0078.178] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0078.178] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0078.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0078.178] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0078.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0078.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0078.178] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0078.178] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0078.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0078.178] lstrlenW (lpString="CryptSvc") returned 8
	[0078.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0078.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0078.179] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0078.179] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0078.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0078.179] lstrlenW (lpString="DcomLaunch") returned 10
	[0078.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0078.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0078.179] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0078.179] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0078.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0078.179] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0078.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0078.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0078.179] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0078.179] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0078.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0078.179] lstrlenW (lpString="Dhcp") returned 4
	[0078.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0078.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0078.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0078.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0078.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0078.179] lstrlenW (lpString="Dnscache") returned 8
	[0078.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0078.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0078.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0078.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0078.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0078.180] lstrlenW (lpString="DoSvc") returned 5
	[0078.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0078.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0078.180] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0078.180] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0078.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0078.180] lstrlenW (lpString="DPS") returned 3
	[0078.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0078.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0078.180] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0078.180] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0078.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0078.180] lstrlenW (lpString="DusmSvc") returned 7
	[0078.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0078.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0078.180] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0078.181] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0078.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0078.181] lstrlenW (lpString="EventLog") returned 8
	[0078.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0078.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0078.181] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0078.181] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0078.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0078.181] lstrlenW (lpString="EventSystem") returned 11
	[0078.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0078.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0078.181] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0078.181] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0078.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0078.181] lstrlenW (lpString="FontCache") returned 9
	[0078.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0078.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0078.181] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0078.181] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0078.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0078.181] lstrlenW (lpString="gpsvc") returned 5
	[0078.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0078.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0078.182] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0078.182] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0078.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0078.182] lstrlenW (lpString="iphlpsvc") returned 8
	[0078.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0078.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0078.182] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0078.182] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0078.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0078.182] lstrlenW (lpString="KeyIso") returned 6
	[0078.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0078.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0078.182] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0078.182] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0078.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0078.182] lstrlenW (lpString="LanmanServer") returned 12
	[0078.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0078.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0078.182] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0078.182] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0078.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0078.182] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0078.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0078.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0078.183] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0078.183] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0078.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0078.183] lstrlenW (lpString="lfsvc") returned 5
	[0078.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0078.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0078.183] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0078.183] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0078.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0078.183] lstrlenW (lpString="lmhosts") returned 7
	[0078.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0078.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0078.183] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0078.183] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0078.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0078.183] lstrlenW (lpString="LSM") returned 3
	[0078.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0078.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0078.183] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0078.183] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0078.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0078.183] lstrlenW (lpString="MapsBroker") returned 10
	[0078.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0078.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0078.184] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0078.184] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0078.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0078.184] lstrlenW (lpString="MpsSvc") returned 6
	[0078.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0078.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0078.184] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0078.184] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0078.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0078.184] lstrlenW (lpString="NcbService") returned 10
	[0078.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0078.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0078.184] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0078.184] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0078.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0078.184] lstrlenW (lpString="netprofm") returned 8
	[0078.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0078.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0078.184] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0078.184] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0078.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0078.184] lstrlenW (lpString="NlaSvc") returned 6
	[0078.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0078.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0078.185] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0078.185] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0078.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0078.185] lstrlenW (lpString="nsi") returned 3
	[0078.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0078.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0078.185] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0078.185] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0078.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0078.185] lstrlenW (lpString="PcaSvc") returned 6
	[0078.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0078.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0078.185] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0078.185] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0078.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0078.185] lstrlenW (lpString="PlugPlay") returned 8
	[0078.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0078.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0078.185] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0078.185] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0078.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0078.185] lstrlenW (lpString="Power") returned 5
	[0078.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0078.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0078.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0078.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0078.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0078.186] lstrlenW (lpString="ProfSvc") returned 7
	[0078.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0078.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0078.186] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0078.186] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0078.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0078.186] lstrlenW (lpString="RpcEptMapper") returned 12
	[0078.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0078.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0078.186] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0078.186] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0078.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0078.186] lstrlenW (lpString="RpcSs") returned 5
	[0078.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0078.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0078.186] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0078.187] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0078.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0078.187] lstrlenW (lpString="SamSs") returned 5
	[0078.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0078.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0078.187] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0078.187] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0078.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0078.187] lstrlenW (lpString="Schedule") returned 8
	[0078.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0078.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0078.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0078.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0078.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0078.187] lstrlenW (lpString="SecurityHealthService") returned 21
	[0078.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0078.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0078.187] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0078.187] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0078.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0078.187] lstrlenW (lpString="SENS") returned 4
	[0078.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0078.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0078.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0078.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0078.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0078.188] lstrlenW (lpString="ShellHWDetection") returned 16
	[0078.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0078.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0078.188] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0078.188] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0078.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0078.188] lstrlenW (lpString="Spooler") returned 7
	[0078.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0078.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0078.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0078.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0078.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0078.188] lstrlenW (lpString="SSDPSRV") returned 7
	[0078.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0078.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0078.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0078.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0078.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0078.188] lstrlenW (lpString="StateRepository") returned 15
	[0078.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0078.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0078.189] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0078.189] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0078.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0078.189] lstrlenW (lpString="SysMain") returned 7
	[0078.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0078.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0078.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0078.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0078.189] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360
	[0078.511] Process32FirstW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0078.512] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0078.512] lstrlenW (lpString="System") returned 6
	[0078.513] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0078.513] lstrlenW (lpString="smss.exe") returned 8
	[0078.513] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0078.514] lstrlenW (lpString="csrss.exe") returned 9
	[0078.514] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0078.514] lstrlenW (lpString="wininit.exe") returned 11
	[0078.514] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0078.515] lstrlenW (lpString="csrss.exe") returned 9
	[0078.515] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0078.515] lstrlenW (lpString="winlogon.exe") returned 12
	[0078.515] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0078.516] lstrlenW (lpString="services.exe") returned 12
	[0078.516] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0078.517] lstrlenW (lpString="lsass.exe") returned 9
	[0078.517] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.517] lstrlenW (lpString="svchost.exe") returned 11
	[0078.517] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0078.518] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0078.518] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0078.518] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0078.519] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.519] lstrlenW (lpString="svchost.exe") returned 11
	[0078.519] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0078.520] lstrlenW (lpString="dwm.exe") returned 7
	[0078.520] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.521] lstrlenW (lpString="svchost.exe") returned 11
	[0078.521] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.521] lstrlenW (lpString="svchost.exe") returned 11
	[0078.522] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.522] lstrlenW (lpString="svchost.exe") returned 11
	[0078.522] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.523] lstrlenW (lpString="svchost.exe") returned 11
	[0078.523] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.523] lstrlenW (lpString="svchost.exe") returned 11
	[0078.523] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.524] lstrlenW (lpString="svchost.exe") returned 11
	[0078.524] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.524] lstrlenW (lpString="svchost.exe") returned 11
	[0078.524] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.525] lstrlenW (lpString="svchost.exe") returned 11
	[0078.525] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.526] lstrlenW (lpString="svchost.exe") returned 11
	[0078.526] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0078.526] lstrlenW (lpString="spoolsv.exe") returned 11
	[0078.526] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.527] lstrlenW (lpString="svchost.exe") returned 11
	[0078.527] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.527] lstrlenW (lpString="svchost.exe") returned 11
	[0078.527] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0078.528] lstrlenW (lpString="audiodg.exe") returned 11
	[0078.528] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0078.528] lstrlenW (lpString="sihost.exe") returned 10
	[0078.528] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.529] lstrlenW (lpString="svchost.exe") returned 11
	[0078.529] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0078.529] lstrlenW (lpString="taskhostw.exe") returned 13
	[0078.529] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0078.530] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0078.530] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0078.531] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0078.531] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0078.531] lstrlenW (lpString="explorer.exe") returned 12
	[0078.531] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0078.532] lstrlenW (lpString="Memory Compression") returned 18
	[0078.532] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0078.532] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0078.532] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0078.533] lstrlenW (lpString="SearchUI.exe") returned 12
	[0078.533] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0078.533] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0078.533] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0078.534] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0078.534] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0078.534] lstrlenW (lpString="taskhostw.exe") returned 13
	[0078.534] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0078.535] lstrlenW (lpString="UsoClient.exe") returned 13
	[0078.535] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0078.535] lstrlenW (lpString="taskhostw.exe") returned 13
	[0078.536] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0078.536] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0078.536] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0078.537] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0078.537] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0078.537] lstrlenW (lpString="msoia.exe") returned 9
	[0078.537] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0078.538] lstrlenW (lpString="msoia.exe") returned 9
	[0078.538] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0078.538] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0078.538] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0078.539] lstrlenW (lpString="screensaver.exe") returned 15
	[0078.539] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0078.539] lstrlenW (lpString="nancyedge.exe") returned 13
	[0078.539] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0078.540] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0078.540] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0078.540] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0078.541] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0078.541] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0078.541] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0078.542] lstrlenW (lpString="percentage.exe") returned 14
	[0078.542] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0078.542] lstrlenW (lpString="hh_him.exe") returned 10
	[0078.542] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0078.543] lstrlenW (lpString="nba.exe") returned 7
	[0078.543] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0078.543] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0078.543] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0078.544] lstrlenW (lpString="citizenship.exe") returned 15
	[0078.544] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0078.544] lstrlenW (lpString="beam removable.exe") returned 18
	[0078.544] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0078.545] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0078.545] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0078.546] lstrlenW (lpString="crest-boating.exe") returned 17
	[0078.546] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0078.546] lstrlenW (lpString="wrist.exe") returned 9
	[0078.546] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0078.547] lstrlenW (lpString="indicationwage.exe") returned 18
	[0078.547] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0078.548] lstrlenW (lpString="theepub.exe") returned 11
	[0078.548] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0078.548] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0078.549] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0078.549] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0078.549] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0078.550] lstrlenW (lpString="webpage.exe") returned 11
	[0078.550] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0078.975] lstrlenW (lpString="distributed.exe") returned 15
	[0078.975] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0078.975] lstrlenW (lpString="ann.exe") returned 7
	[0078.975] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0078.976] lstrlenW (lpString="conhost.exe") returned 11
	[0078.976] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0078.977] lstrlenW (lpString="conhost.exe") returned 11
	[0078.977] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.977] lstrlenW (lpString="svchost.exe") returned 11
	[0078.977] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0078.978] lstrlenW (lpString="d2.exe") returned 6
	[0078.978] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0078.979] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0078.979] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0078.980] lstrlenW (lpString="conhost.exe") returned 11
	[0078.980] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0078.980] lstrlenW (lpString="dllhost.exe") returned 11
	[0078.980] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0078.981] lstrlenW (lpString="cmd.exe") returned 7
	[0078.981] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0078.981] lstrlenW (lpString="conhost.exe") returned 11
	[0078.981] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.982] lstrlenW (lpString="svchost.exe") returned 11
	[0078.982] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0078.983] lstrlenW (lpString="mode.com") returned 8
	[0078.983] Process32NextW (in: hSnapshot=0x360, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0078.983] CloseHandle (hObject=0x360) returned 1
	[0078.983] Sleep (dwMilliseconds=0x1f4) 
	[0080.169] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x631178
	[0080.170] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0080.170] GetLastError () returned 0xea
	[0080.170] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x363cfd8
	[0080.171] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x363cfd8, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x363cfd8, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0080.171] CloseServiceHandle (hSCObject=0x631178) returned 1
	[0080.172] lstrlenW (lpString="Appinfo") returned 7
	[0080.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0080.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0080.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0080.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0080.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0080.172] lstrlenW (lpString="AppXSvc") returned 7
	[0080.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0080.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0080.172] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0080.172] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0080.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0080.172] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0080.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0080.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0080.172] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0080.172] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0080.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0080.172] lstrlenW (lpString="Audiosrv") returned 8
	[0080.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0080.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0080.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0080.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0080.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0080.173] lstrlenW (lpString="BFE") returned 3
	[0080.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0080.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0080.173] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0080.173] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0080.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0080.173] lstrlenW (lpString="BITS") returned 4
	[0080.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0080.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0080.173] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0080.173] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0080.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0080.173] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0080.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0080.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0080.173] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0080.173] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0080.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0080.173] lstrlenW (lpString="CDPSvc") returned 6
	[0080.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0080.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0080.173] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0080.173] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0080.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0080.174] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0080.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0080.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0080.174] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0080.174] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0080.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0080.174] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0080.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0080.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0080.174] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0080.174] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0080.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0080.174] lstrlenW (lpString="CryptSvc") returned 8
	[0080.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0080.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0080.174] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0080.174] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0080.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0080.174] lstrlenW (lpString="DcomLaunch") returned 10
	[0080.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0080.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0080.174] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0080.174] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0080.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0080.174] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0080.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0080.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0080.174] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0080.174] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0080.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0080.175] lstrlenW (lpString="Dhcp") returned 4
	[0080.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0080.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0080.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0080.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0080.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0080.175] lstrlenW (lpString="Dnscache") returned 8
	[0080.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0080.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0080.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0080.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0080.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0080.175] lstrlenW (lpString="DoSvc") returned 5
	[0080.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0080.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0080.175] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0080.175] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0080.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0080.175] lstrlenW (lpString="DPS") returned 3
	[0080.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0080.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0080.175] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0080.175] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0080.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0080.175] lstrlenW (lpString="DusmSvc") returned 7
	[0080.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0080.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0080.176] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0080.176] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0080.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0080.176] lstrlenW (lpString="EventLog") returned 8
	[0080.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0080.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0080.176] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0080.176] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0080.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0080.176] lstrlenW (lpString="EventSystem") returned 11
	[0080.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0080.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0080.176] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0080.176] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0080.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0080.176] lstrlenW (lpString="FontCache") returned 9
	[0080.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0080.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0080.176] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0080.176] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0080.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0080.177] lstrlenW (lpString="gpsvc") returned 5
	[0080.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0080.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0080.177] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0080.177] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0080.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0080.177] lstrlenW (lpString="iphlpsvc") returned 8
	[0080.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0080.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0080.177] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0080.177] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0080.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0080.177] lstrlenW (lpString="KeyIso") returned 6
	[0080.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0080.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0080.177] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0080.177] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0080.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0080.177] lstrlenW (lpString="LanmanServer") returned 12
	[0080.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0080.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0080.177] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0080.177] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0080.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0080.177] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0080.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0080.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0080.177] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0080.178] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0080.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0080.178] lstrlenW (lpString="lfsvc") returned 5
	[0080.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0080.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0080.178] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0080.178] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0080.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0080.178] lstrlenW (lpString="lmhosts") returned 7
	[0080.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0080.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0080.178] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0080.178] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0080.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0080.178] lstrlenW (lpString="LSM") returned 3
	[0080.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0080.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0080.178] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0080.178] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0080.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0080.178] lstrlenW (lpString="MapsBroker") returned 10
	[0080.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0080.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0080.178] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0080.178] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0080.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0080.179] lstrlenW (lpString="MpsSvc") returned 6
	[0080.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0080.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0080.179] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0080.179] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0080.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0080.179] lstrlenW (lpString="NcbService") returned 10
	[0080.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0080.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0080.179] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0080.179] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0080.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0080.179] lstrlenW (lpString="netprofm") returned 8
	[0080.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0080.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0080.179] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0080.179] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0080.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0080.179] lstrlenW (lpString="NlaSvc") returned 6
	[0080.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0080.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0080.179] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0080.179] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0080.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0080.179] lstrlenW (lpString="nsi") returned 3
	[0080.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0080.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0080.180] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0080.180] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0080.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0080.180] lstrlenW (lpString="PcaSvc") returned 6
	[0080.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0080.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0080.180] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0080.180] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0080.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0080.180] lstrlenW (lpString="PlugPlay") returned 8
	[0080.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0080.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0080.180] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0080.180] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0080.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0080.180] lstrlenW (lpString="Power") returned 5
	[0080.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0080.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0080.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0080.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0080.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0080.180] lstrlenW (lpString="ProfSvc") returned 7
	[0080.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0080.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0080.181] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0080.181] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0080.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0080.181] lstrlenW (lpString="RpcEptMapper") returned 12
	[0080.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0080.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0080.181] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0080.181] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0080.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0080.181] lstrlenW (lpString="RpcSs") returned 5
	[0080.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0080.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0080.181] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0080.181] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0080.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0080.181] lstrlenW (lpString="SamSs") returned 5
	[0080.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0080.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0080.181] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0080.181] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0080.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0080.181] lstrlenW (lpString="Schedule") returned 8
	[0080.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0080.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0080.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0080.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0080.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0080.181] lstrlenW (lpString="SecurityHealthService") returned 21
	[0080.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0080.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0080.182] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0080.182] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0080.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0080.182] lstrlenW (lpString="SENS") returned 4
	[0080.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0080.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0080.182] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0080.182] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0080.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0080.182] lstrlenW (lpString="ShellHWDetection") returned 16
	[0080.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0080.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0080.182] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0080.182] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0080.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0080.182] lstrlenW (lpString="Spooler") returned 7
	[0080.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0080.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0080.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0080.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0080.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0080.182] lstrlenW (lpString="SSDPSRV") returned 7
	[0080.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0080.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0080.182] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0080.182] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0080.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0080.182] lstrlenW (lpString="StateRepository") returned 15
	[0080.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0080.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0080.183] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0080.183] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0080.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0080.183] lstrlenW (lpString="SysMain") returned 7
	[0080.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0080.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0080.183] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0080.183] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0080.183] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390
	[0080.188] Process32FirstW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0080.189] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0080.189] lstrlenW (lpString="System") returned 6
	[0080.190] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0080.190] lstrlenW (lpString="smss.exe") returned 8
	[0080.190] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0080.191] lstrlenW (lpString="csrss.exe") returned 9
	[0080.191] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0080.191] lstrlenW (lpString="wininit.exe") returned 11
	[0080.191] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0080.604] lstrlenW (lpString="csrss.exe") returned 9
	[0080.604] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0080.605] lstrlenW (lpString="winlogon.exe") returned 12
	[0080.605] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0080.605] lstrlenW (lpString="services.exe") returned 12
	[0080.606] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0080.606] lstrlenW (lpString="lsass.exe") returned 9
	[0080.606] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.607] lstrlenW (lpString="svchost.exe") returned 11
	[0080.607] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0080.607] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0080.607] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0080.608] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0080.608] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.608] lstrlenW (lpString="svchost.exe") returned 11
	[0080.608] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0080.609] lstrlenW (lpString="dwm.exe") returned 7
	[0080.609] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.609] lstrlenW (lpString="svchost.exe") returned 11
	[0080.610] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.610] lstrlenW (lpString="svchost.exe") returned 11
	[0080.610] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.611] lstrlenW (lpString="svchost.exe") returned 11
	[0080.611] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.611] lstrlenW (lpString="svchost.exe") returned 11
	[0080.611] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.612] lstrlenW (lpString="svchost.exe") returned 11
	[0080.612] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.612] lstrlenW (lpString="svchost.exe") returned 11
	[0080.612] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.613] lstrlenW (lpString="svchost.exe") returned 11
	[0080.613] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.614] lstrlenW (lpString="svchost.exe") returned 11
	[0080.614] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.615] lstrlenW (lpString="svchost.exe") returned 11
	[0080.615] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0080.615] lstrlenW (lpString="spoolsv.exe") returned 11
	[0080.615] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.616] lstrlenW (lpString="svchost.exe") returned 11
	[0080.616] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.616] lstrlenW (lpString="svchost.exe") returned 11
	[0080.616] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0080.617] lstrlenW (lpString="audiodg.exe") returned 11
	[0080.617] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0080.617] lstrlenW (lpString="sihost.exe") returned 10
	[0080.617] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0080.618] lstrlenW (lpString="svchost.exe") returned 11
	[0080.618] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0080.619] lstrlenW (lpString="taskhostw.exe") returned 13
	[0080.619] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0080.619] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0080.619] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0080.620] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0080.620] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0080.620] lstrlenW (lpString="explorer.exe") returned 12
	[0080.620] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0080.621] lstrlenW (lpString="Memory Compression") returned 18
	[0080.621] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0080.621] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0080.621] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0080.622] lstrlenW (lpString="SearchUI.exe") returned 12
	[0080.622] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0080.623] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0080.623] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0080.623] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0080.623] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0080.624] lstrlenW (lpString="taskhostw.exe") returned 13
	[0080.624] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0080.624] lstrlenW (lpString="UsoClient.exe") returned 13
	[0080.624] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0080.625] lstrlenW (lpString="taskhostw.exe") returned 13
	[0080.625] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0080.626] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0080.626] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0080.626] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0080.626] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0080.627] lstrlenW (lpString="msoia.exe") returned 9
	[0080.627] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0080.627] lstrlenW (lpString="msoia.exe") returned 9
	[0080.627] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0080.628] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0080.628] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0080.629] lstrlenW (lpString="screensaver.exe") returned 15
	[0080.629] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0080.635] lstrlenW (lpString="nancyedge.exe") returned 13
	[0080.635] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0080.635] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0080.635] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0080.636] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0080.636] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0080.636] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0080.637] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0080.637] lstrlenW (lpString="percentage.exe") returned 14
	[0080.637] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0080.638] lstrlenW (lpString="hh_him.exe") returned 10
	[0080.638] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0080.638] lstrlenW (lpString="nba.exe") returned 7
	[0080.638] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0080.639] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0080.639] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0080.639] lstrlenW (lpString="citizenship.exe") returned 15
	[0080.639] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0080.640] lstrlenW (lpString="beam removable.exe") returned 18
	[0080.640] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0080.641] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0080.641] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0080.641] lstrlenW (lpString="crest-boating.exe") returned 17
	[0080.641] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0080.642] lstrlenW (lpString="wrist.exe") returned 9
	[0080.642] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0080.643] lstrlenW (lpString="indicationwage.exe") returned 18
	[0080.643] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0080.644] lstrlenW (lpString="theepub.exe") returned 11
	[0080.644] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0081.182] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0081.182] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0081.183] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0081.183] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0081.183] lstrlenW (lpString="webpage.exe") returned 11
	[0081.183] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0081.184] lstrlenW (lpString="distributed.exe") returned 15
	[0081.184] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0081.185] lstrlenW (lpString="ann.exe") returned 7
	[0081.185] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0081.186] lstrlenW (lpString="conhost.exe") returned 11
	[0081.186] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0081.186] lstrlenW (lpString="conhost.exe") returned 11
	[0081.186] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.187] lstrlenW (lpString="svchost.exe") returned 11
	[0081.187] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0081.188] lstrlenW (lpString="d2.exe") returned 6
	[0081.188] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0081.188] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0081.189] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0081.189] lstrlenW (lpString="conhost.exe") returned 11
	[0081.189] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0081.190] lstrlenW (lpString="dllhost.exe") returned 11
	[0081.190] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0081.190] lstrlenW (lpString="cmd.exe") returned 7
	[0081.191] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0081.191] lstrlenW (lpString="conhost.exe") returned 11
	[0081.191] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.192] lstrlenW (lpString="svchost.exe") returned 11
	[0081.192] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0081.193] lstrlenW (lpString="mode.com") returned 8
	[0081.193] Process32NextW (in: hSnapshot=0x390, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0081.194] CloseHandle (hObject=0x390) returned 1
	[0081.194] Sleep (dwMilliseconds=0x1f4) 
	[0082.089] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6311a0
	[0082.089] EnumServicesStatusExW (in: hSCManager=0x6311a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0082.090] GetLastError () returned 0xea
	[0082.090] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x4223d50
	[0082.090] EnumServicesStatusExW (in: hSCManager=0x6311a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4223d50, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4223d50, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0082.090] CloseServiceHandle (hSCObject=0x6311a0) returned 1
	[0082.091] lstrlenW (lpString="Appinfo") returned 7
	[0082.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0082.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0082.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0082.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0082.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0082.091] lstrlenW (lpString="AppXSvc") returned 7
	[0082.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0082.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0082.091] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0082.091] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0082.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0082.091] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0082.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0082.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0082.091] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0082.091] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0082.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0082.091] lstrlenW (lpString="Audiosrv") returned 8
	[0082.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0082.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0082.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0082.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0082.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0082.092] lstrlenW (lpString="BFE") returned 3
	[0082.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0082.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0082.092] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0082.092] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0082.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0082.092] lstrlenW (lpString="BITS") returned 4
	[0082.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0082.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0082.092] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0082.092] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0082.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0082.092] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0082.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0082.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0082.092] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0082.092] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0082.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0082.092] lstrlenW (lpString="CDPSvc") returned 6
	[0082.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0082.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0082.092] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0082.092] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0082.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0082.093] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0082.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0082.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0082.093] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0082.093] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0082.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0082.093] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0082.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0082.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0082.093] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0082.093] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0082.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0082.093] lstrlenW (lpString="CryptSvc") returned 8
	[0082.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0082.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0082.093] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0082.093] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0082.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0082.093] lstrlenW (lpString="DcomLaunch") returned 10
	[0082.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0082.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0082.093] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0082.093] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0082.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0082.093] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0082.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0082.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0082.094] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0082.094] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0082.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0082.094] lstrlenW (lpString="Dhcp") returned 4
	[0082.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0082.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0082.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0082.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0082.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0082.094] lstrlenW (lpString="Dnscache") returned 8
	[0082.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0082.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0082.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0082.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0082.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0082.094] lstrlenW (lpString="DoSvc") returned 5
	[0082.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0082.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0082.094] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0082.094] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0082.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0082.094] lstrlenW (lpString="DPS") returned 3
	[0082.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0082.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0082.094] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0082.094] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0082.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0082.094] lstrlenW (lpString="DusmSvc") returned 7
	[0082.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0082.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0082.095] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0082.095] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0082.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0082.095] lstrlenW (lpString="EventLog") returned 8
	[0082.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0082.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0082.095] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0082.095] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0082.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0082.095] lstrlenW (lpString="EventSystem") returned 11
	[0082.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0082.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0082.095] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0082.095] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0082.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0082.095] lstrlenW (lpString="FontCache") returned 9
	[0082.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0082.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0082.095] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0082.095] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0082.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0082.095] lstrlenW (lpString="gpsvc") returned 5
	[0082.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0082.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0082.095] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0082.095] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0082.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0082.095] lstrlenW (lpString="iphlpsvc") returned 8
	[0082.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0082.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0082.096] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0082.096] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0082.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0082.096] lstrlenW (lpString="KeyIso") returned 6
	[0082.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0082.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0082.096] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0082.096] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0082.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0082.096] lstrlenW (lpString="LanmanServer") returned 12
	[0082.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0082.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0082.096] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0082.096] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0082.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0082.096] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0082.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0082.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0082.096] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0082.096] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0082.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0082.096] lstrlenW (lpString="lfsvc") returned 5
	[0082.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0082.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0082.096] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0082.096] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0082.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0082.097] lstrlenW (lpString="lmhosts") returned 7
	[0082.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0082.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0082.097] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0082.097] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0082.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0082.097] lstrlenW (lpString="LSM") returned 3
	[0082.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0082.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0082.097] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0082.097] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0082.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0082.097] lstrlenW (lpString="MapsBroker") returned 10
	[0082.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0082.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0082.097] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0082.097] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0082.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0082.097] lstrlenW (lpString="MpsSvc") returned 6
	[0082.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0082.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0082.097] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0082.097] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0082.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0082.097] lstrlenW (lpString="NcbService") returned 10
	[0082.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0082.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0082.097] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0082.098] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0082.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0082.098] lstrlenW (lpString="netprofm") returned 8
	[0082.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0082.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0082.559] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0082.559] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0082.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0082.559] lstrlenW (lpString="NlaSvc") returned 6
	[0082.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0082.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0082.559] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0082.559] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0082.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0082.559] lstrlenW (lpString="nsi") returned 3
	[0082.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0082.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0082.559] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0082.559] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0082.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0082.560] lstrlenW (lpString="PcaSvc") returned 6
	[0082.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0082.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0082.560] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0082.560] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0082.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0082.560] lstrlenW (lpString="PlugPlay") returned 8
	[0082.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0082.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0082.560] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0082.560] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0082.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0082.560] lstrlenW (lpString="Power") returned 5
	[0082.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0082.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0082.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0082.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0082.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0082.560] lstrlenW (lpString="ProfSvc") returned 7
	[0082.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0082.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0082.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0082.560] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0082.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0082.561] lstrlenW (lpString="RpcEptMapper") returned 12
	[0082.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0082.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0082.561] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0082.561] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0082.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0082.561] lstrlenW (lpString="RpcSs") returned 5
	[0082.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0082.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0082.561] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0082.561] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0082.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0082.561] lstrlenW (lpString="SamSs") returned 5
	[0082.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0082.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0082.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0082.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0082.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0082.561] lstrlenW (lpString="Schedule") returned 8
	[0082.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0082.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0082.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0082.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0082.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0082.562] lstrlenW (lpString="SecurityHealthService") returned 21
	[0082.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0082.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0082.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0082.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0082.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0082.562] lstrlenW (lpString="SENS") returned 4
	[0082.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0082.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0082.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0082.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0082.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0082.562] lstrlenW (lpString="ShellHWDetection") returned 16
	[0082.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0082.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0082.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0082.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0082.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0082.562] lstrlenW (lpString="Spooler") returned 7
	[0082.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0082.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0082.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0082.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0082.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0082.563] lstrlenW (lpString="SSDPSRV") returned 7
	[0082.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0082.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0082.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0082.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0082.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0082.563] lstrlenW (lpString="StateRepository") returned 15
	[0082.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0082.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0082.563] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0082.563] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0082.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0082.563] lstrlenW (lpString="SysMain") returned 7
	[0082.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0082.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0082.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0082.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0082.563] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320
	[0082.570] Process32FirstW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0082.570] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0082.571] lstrlenW (lpString="System") returned 6
	[0082.571] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0082.571] lstrlenW (lpString="smss.exe") returned 8
	[0082.571] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0082.572] lstrlenW (lpString="csrss.exe") returned 9
	[0082.572] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0082.572] lstrlenW (lpString="wininit.exe") returned 11
	[0082.572] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0082.573] lstrlenW (lpString="csrss.exe") returned 9
	[0082.573] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0082.573] lstrlenW (lpString="winlogon.exe") returned 12
	[0082.574] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0082.574] lstrlenW (lpString="services.exe") returned 12
	[0082.574] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0082.575] lstrlenW (lpString="lsass.exe") returned 9
	[0082.575] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.575] lstrlenW (lpString="svchost.exe") returned 11
	[0082.575] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0082.576] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0082.576] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0082.576] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0082.576] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.577] lstrlenW (lpString="svchost.exe") returned 11
	[0082.577] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0082.577] lstrlenW (lpString="dwm.exe") returned 7
	[0082.577] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.578] lstrlenW (lpString="svchost.exe") returned 11
	[0082.578] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.578] lstrlenW (lpString="svchost.exe") returned 11
	[0082.578] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.579] lstrlenW (lpString="svchost.exe") returned 11
	[0082.579] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.579] lstrlenW (lpString="svchost.exe") returned 11
	[0082.579] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.580] lstrlenW (lpString="svchost.exe") returned 11
	[0082.580] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.581] lstrlenW (lpString="svchost.exe") returned 11
	[0082.581] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.581] lstrlenW (lpString="svchost.exe") returned 11
	[0082.581] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.582] lstrlenW (lpString="svchost.exe") returned 11
	[0082.582] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.582] lstrlenW (lpString="svchost.exe") returned 11
	[0082.582] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0082.583] lstrlenW (lpString="spoolsv.exe") returned 11
	[0082.583] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.583] lstrlenW (lpString="svchost.exe") returned 11
	[0082.583] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.584] lstrlenW (lpString="svchost.exe") returned 11
	[0082.584] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0082.584] lstrlenW (lpString="audiodg.exe") returned 11
	[0082.584] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0082.585] lstrlenW (lpString="sihost.exe") returned 10
	[0082.585] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.585] lstrlenW (lpString="svchost.exe") returned 11
	[0082.585] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0082.586] lstrlenW (lpString="taskhostw.exe") returned 13
	[0082.586] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0082.586] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0082.587] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0082.587] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0082.587] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0082.588] lstrlenW (lpString="explorer.exe") returned 12
	[0082.588] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0082.588] lstrlenW (lpString="Memory Compression") returned 18
	[0082.588] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0082.589] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0082.589] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0082.589] lstrlenW (lpString="SearchUI.exe") returned 12
	[0082.589] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0082.590] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0082.590] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0082.590] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0082.590] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0082.591] lstrlenW (lpString="taskhostw.exe") returned 13
	[0082.591] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0082.591] lstrlenW (lpString="UsoClient.exe") returned 13
	[0082.591] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0082.592] lstrlenW (lpString="taskhostw.exe") returned 13
	[0082.592] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0082.592] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0082.592] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0082.593] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0082.593] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0082.593] lstrlenW (lpString="msoia.exe") returned 9
	[0082.593] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0082.594] lstrlenW (lpString="msoia.exe") returned 9
	[0082.594] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0082.595] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0082.595] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0082.595] lstrlenW (lpString="screensaver.exe") returned 15
	[0082.595] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0082.596] lstrlenW (lpString="nancyedge.exe") returned 13
	[0082.596] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0082.596] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0082.596] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0082.597] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0082.597] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0082.597] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0082.597] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0083.036] lstrlenW (lpString="percentage.exe") returned 14
	[0083.036] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0083.037] lstrlenW (lpString="hh_him.exe") returned 10
	[0083.037] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0083.037] lstrlenW (lpString="nba.exe") returned 7
	[0083.037] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0083.038] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0083.038] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0083.038] lstrlenW (lpString="citizenship.exe") returned 15
	[0083.038] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0083.039] lstrlenW (lpString="beam removable.exe") returned 18
	[0083.039] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0083.039] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0083.039] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0083.040] lstrlenW (lpString="crest-boating.exe") returned 17
	[0083.040] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0083.041] lstrlenW (lpString="wrist.exe") returned 9
	[0083.041] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0083.041] lstrlenW (lpString="indicationwage.exe") returned 18
	[0083.041] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0083.042] lstrlenW (lpString="theepub.exe") returned 11
	[0083.042] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0083.043] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0083.043] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0083.043] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0083.043] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0083.044] lstrlenW (lpString="webpage.exe") returned 11
	[0083.044] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0083.045] lstrlenW (lpString="distributed.exe") returned 15
	[0083.045] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0083.045] lstrlenW (lpString="ann.exe") returned 7
	[0083.045] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0083.046] lstrlenW (lpString="conhost.exe") returned 11
	[0083.046] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0083.047] lstrlenW (lpString="conhost.exe") returned 11
	[0083.047] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0083.047] lstrlenW (lpString="svchost.exe") returned 11
	[0083.047] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0083.048] lstrlenW (lpString="d2.exe") returned 6
	[0083.048] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0083.049] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0083.049] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0083.049] lstrlenW (lpString="conhost.exe") returned 11
	[0083.049] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0083.050] lstrlenW (lpString="dllhost.exe") returned 11
	[0083.050] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0083.050] lstrlenW (lpString="cmd.exe") returned 7
	[0083.050] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0083.051] lstrlenW (lpString="conhost.exe") returned 11
	[0083.052] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0083.052] lstrlenW (lpString="svchost.exe") returned 11
	[0083.052] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0083.053] lstrlenW (lpString="mode.com") returned 8
	[0083.053] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0083.053] lstrlenW (lpString="LogonUI.exe") returned 11
	[0083.053] Process32NextW (in: hSnapshot=0x320, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0083.054] CloseHandle (hObject=0x320) returned 1
	[0083.054] Sleep (dwMilliseconds=0x1f4) 
	[0084.172] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6311a0
	[0084.172] EnumServicesStatusExW (in: hSCManager=0x6311a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0084.173] GetLastError () returned 0xea
	[0084.173] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x4284588
	[0084.173] EnumServicesStatusExW (in: hSCManager=0x6311a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4284588, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4284588, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0084.174] CloseServiceHandle (hSCObject=0x6311a0) returned 1
	[0084.174] lstrlenW (lpString="Appinfo") returned 7
	[0084.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0084.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0084.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0084.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0084.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0084.174] lstrlenW (lpString="AppXSvc") returned 7
	[0084.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0084.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0084.174] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0084.174] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0084.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0084.174] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0084.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0084.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0084.174] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0084.175] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0084.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0084.175] lstrlenW (lpString="Audiosrv") returned 8
	[0084.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0084.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0084.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0084.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0084.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0084.175] lstrlenW (lpString="BFE") returned 3
	[0084.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0084.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0084.175] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0084.175] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0084.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0084.175] lstrlenW (lpString="BITS") returned 4
	[0084.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0084.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0084.175] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0084.175] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0084.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0084.175] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0084.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0084.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0084.175] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0084.175] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0084.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0084.175] lstrlenW (lpString="CDPSvc") returned 6
	[0084.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0084.176] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0084.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0084.176] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0084.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0084.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0084.176] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0084.176] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0084.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0084.176] lstrlenW (lpString="CryptSvc") returned 8
	[0084.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0084.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0084.176] lstrlenW (lpString="DcomLaunch") returned 10
	[0084.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0084.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0084.176] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0084.177] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0084.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0084.177] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0084.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0084.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0084.177] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0084.177] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0084.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0084.177] lstrlenW (lpString="Dhcp") returned 4
	[0084.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0084.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0084.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0084.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0084.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0084.177] lstrlenW (lpString="Dnscache") returned 8
	[0084.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0084.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0084.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0084.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0084.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0084.177] lstrlenW (lpString="DoSvc") returned 5
	[0084.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0084.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0084.177] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0084.177] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0084.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0084.177] lstrlenW (lpString="DPS") returned 3
	[0084.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0084.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0084.178] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0084.178] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0084.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0084.178] lstrlenW (lpString="DusmSvc") returned 7
	[0084.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0084.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0084.178] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0084.178] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0084.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0084.178] lstrlenW (lpString="EventLog") returned 8
	[0084.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0084.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0084.178] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0084.178] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0084.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0084.178] lstrlenW (lpString="EventSystem") returned 11
	[0084.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0084.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0084.178] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0084.178] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0084.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0084.178] lstrlenW (lpString="FontCache") returned 9
	[0084.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0084.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0084.179] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0084.179] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0084.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0084.179] lstrlenW (lpString="gpsvc") returned 5
	[0084.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0084.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0084.179] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0084.179] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0084.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0084.179] lstrlenW (lpString="iphlpsvc") returned 8
	[0084.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0084.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0084.179] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0084.179] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0084.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0084.179] lstrlenW (lpString="KeyIso") returned 6
	[0084.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0084.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0084.179] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0084.179] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0084.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0084.179] lstrlenW (lpString="LanmanServer") returned 12
	[0084.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0084.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0084.179] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0084.179] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0084.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0084.180] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0084.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0084.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0084.180] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0084.180] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0084.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0084.180] lstrlenW (lpString="lfsvc") returned 5
	[0084.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0084.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0084.180] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0084.180] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0084.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0084.180] lstrlenW (lpString="lmhosts") returned 7
	[0084.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0084.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0084.180] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0084.180] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0084.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0084.180] lstrlenW (lpString="LSM") returned 3
	[0084.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0084.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0084.180] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0084.180] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0084.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0084.180] lstrlenW (lpString="MapsBroker") returned 10
	[0084.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0084.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0084.181] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0084.181] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0084.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0084.181] lstrlenW (lpString="MpsSvc") returned 6
	[0084.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0084.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0084.181] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0084.181] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0084.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0084.181] lstrlenW (lpString="NcbService") returned 10
	[0084.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0084.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0084.181] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0084.181] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0084.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0084.181] lstrlenW (lpString="netprofm") returned 8
	[0084.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0084.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0084.181] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0084.181] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0084.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0084.181] lstrlenW (lpString="NlaSvc") returned 6
	[0084.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0084.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0084.181] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0084.181] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0084.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0084.182] lstrlenW (lpString="nsi") returned 3
	[0084.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0084.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0084.182] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0084.182] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0084.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0084.182] lstrlenW (lpString="PcaSvc") returned 6
	[0084.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0084.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0084.182] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0084.182] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0084.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0084.182] lstrlenW (lpString="PlugPlay") returned 8
	[0084.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0084.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0084.182] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0084.182] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0084.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0084.182] lstrlenW (lpString="Power") returned 5
	[0084.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0084.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0084.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0084.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0084.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0084.182] lstrlenW (lpString="ProfSvc") returned 7
	[0084.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0084.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0084.183] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0084.183] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0084.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0084.183] lstrlenW (lpString="RpcEptMapper") returned 12
	[0084.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0084.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0084.183] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0084.183] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0084.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0084.183] lstrlenW (lpString="RpcSs") returned 5
	[0084.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0084.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0084.183] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0084.183] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0084.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0084.183] lstrlenW (lpString="SamSs") returned 5
	[0084.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0084.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0084.183] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0084.183] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0084.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0084.183] lstrlenW (lpString="Schedule") returned 8
	[0084.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0084.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0084.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0084.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0084.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0084.184] lstrlenW (lpString="SecurityHealthService") returned 21
	[0084.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0084.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0084.184] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0084.184] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0084.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0084.184] lstrlenW (lpString="SENS") returned 4
	[0084.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0084.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0084.184] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0084.184] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0084.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0084.184] lstrlenW (lpString="ShellHWDetection") returned 16
	[0084.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0084.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0084.184] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0084.184] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0084.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0084.184] lstrlenW (lpString="Spooler") returned 7
	[0084.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0084.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0084.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0084.185] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0084.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0084.185] lstrlenW (lpString="SSDPSRV") returned 7
	[0084.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0084.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0084.185] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0084.185] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0084.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0084.185] lstrlenW (lpString="StateRepository") returned 15
	[0084.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0084.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0084.185] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0084.185] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0084.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0084.185] lstrlenW (lpString="SysMain") returned 7
	[0084.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0084.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0084.185] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0084.185] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0084.185] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c
	[0084.190] Process32FirstW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0084.191] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0084.191] lstrlenW (lpString="System") returned 6
	[0084.520] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0084.542] lstrlenW (lpString="smss.exe") returned 8
	[0084.542] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0084.543] lstrlenW (lpString="csrss.exe") returned 9
	[0084.543] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0084.543] lstrlenW (lpString="wininit.exe") returned 11
	[0084.543] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0084.544] lstrlenW (lpString="csrss.exe") returned 9
	[0084.544] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0084.544] lstrlenW (lpString="winlogon.exe") returned 12
	[0084.544] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0084.545] lstrlenW (lpString="services.exe") returned 12
	[0084.545] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0084.545] lstrlenW (lpString="lsass.exe") returned 9
	[0084.545] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.546] lstrlenW (lpString="svchost.exe") returned 11
	[0084.546] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0084.546] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0084.546] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0084.547] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0084.547] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.547] lstrlenW (lpString="svchost.exe") returned 11
	[0084.548] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0084.548] lstrlenW (lpString="dwm.exe") returned 7
	[0084.548] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.549] lstrlenW (lpString="svchost.exe") returned 11
	[0084.549] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.549] lstrlenW (lpString="svchost.exe") returned 11
	[0084.549] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.550] lstrlenW (lpString="svchost.exe") returned 11
	[0084.550] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.550] lstrlenW (lpString="svchost.exe") returned 11
	[0084.550] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.551] lstrlenW (lpString="svchost.exe") returned 11
	[0084.551] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.551] lstrlenW (lpString="svchost.exe") returned 11
	[0084.551] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.552] lstrlenW (lpString="svchost.exe") returned 11
	[0084.552] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.552] lstrlenW (lpString="svchost.exe") returned 11
	[0084.552] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.553] lstrlenW (lpString="svchost.exe") returned 11
	[0084.553] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0084.553] lstrlenW (lpString="spoolsv.exe") returned 11
	[0084.553] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.554] lstrlenW (lpString="svchost.exe") returned 11
	[0084.554] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.555] lstrlenW (lpString="svchost.exe") returned 11
	[0084.555] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0084.555] lstrlenW (lpString="audiodg.exe") returned 11
	[0084.555] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0084.556] lstrlenW (lpString="sihost.exe") returned 10
	[0084.556] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.556] lstrlenW (lpString="svchost.exe") returned 11
	[0084.556] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0084.557] lstrlenW (lpString="taskhostw.exe") returned 13
	[0084.557] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0084.557] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0084.558] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0084.558] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0084.558] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0084.559] lstrlenW (lpString="explorer.exe") returned 12
	[0084.559] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0084.559] lstrlenW (lpString="Memory Compression") returned 18
	[0084.559] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0084.560] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0084.560] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0084.560] lstrlenW (lpString="SearchUI.exe") returned 12
	[0084.560] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0084.561] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0084.561] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0084.561] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0084.561] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0084.562] lstrlenW (lpString="taskhostw.exe") returned 13
	[0084.562] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0084.562] lstrlenW (lpString="UsoClient.exe") returned 13
	[0084.562] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0084.563] lstrlenW (lpString="taskhostw.exe") returned 13
	[0084.563] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0084.563] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0084.563] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0084.564] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0084.564] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0084.564] lstrlenW (lpString="msoia.exe") returned 9
	[0084.565] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0084.565] lstrlenW (lpString="msoia.exe") returned 9
	[0084.565] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0084.566] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0084.566] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0084.566] lstrlenW (lpString="screensaver.exe") returned 15
	[0084.566] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0084.567] lstrlenW (lpString="nancyedge.exe") returned 13
	[0084.567] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0084.567] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0084.567] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0084.568] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0084.568] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0084.568] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0084.568] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0084.569] lstrlenW (lpString="percentage.exe") returned 14
	[0084.569] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0084.569] lstrlenW (lpString="hh_him.exe") returned 10
	[0084.570] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0084.570] lstrlenW (lpString="nba.exe") returned 7
	[0084.570] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0084.571] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0084.571] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0084.571] lstrlenW (lpString="citizenship.exe") returned 15
	[0084.571] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0084.572] lstrlenW (lpString="beam removable.exe") returned 18
	[0084.572] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0084.572] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0084.572] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0084.573] lstrlenW (lpString="crest-boating.exe") returned 17
	[0084.573] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0084.574] lstrlenW (lpString="wrist.exe") returned 9
	[0084.574] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0084.575] lstrlenW (lpString="indicationwage.exe") returned 18
	[0084.575] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0084.575] lstrlenW (lpString="theepub.exe") returned 11
	[0084.575] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0084.576] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0084.576] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0084.577] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0084.577] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0084.577] lstrlenW (lpString="webpage.exe") returned 11
	[0084.577] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0084.578] lstrlenW (lpString="distributed.exe") returned 15
	[0084.578] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0084.579] lstrlenW (lpString="ann.exe") returned 7
	[0084.579] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0084.579] lstrlenW (lpString="conhost.exe") returned 11
	[0084.579] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0084.580] lstrlenW (lpString="conhost.exe") returned 11
	[0084.580] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.581] lstrlenW (lpString="svchost.exe") returned 11
	[0084.581] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0084.581] lstrlenW (lpString="d2.exe") returned 6
	[0084.581] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0084.582] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0084.582] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0084.583] lstrlenW (lpString="conhost.exe") returned 11
	[0084.583] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0084.583] lstrlenW (lpString="dllhost.exe") returned 11
	[0084.583] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0084.584] lstrlenW (lpString="cmd.exe") returned 7
	[0084.584] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0084.584] lstrlenW (lpString="conhost.exe") returned 11
	[0084.584] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.585] lstrlenW (lpString="svchost.exe") returned 11
	[0084.585] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0085.018] lstrlenW (lpString="mode.com") returned 8
	[0085.019] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0085.019] lstrlenW (lpString="LogonUI.exe") returned 11
	[0085.019] Process32NextW (in: hSnapshot=0x38c, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0085.020] CloseHandle (hObject=0x38c) returned 1
	[0085.020] Sleep (dwMilliseconds=0x1f4) 
	[0085.865] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x631178
	[0085.866] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0085.866] GetLastError () returned 0xea
	[0085.866] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d5a) returned 0x4233d58
	[0085.868] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4233d58, cbBufSize=0x1d5a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4233d58, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0085.869] CloseServiceHandle (hSCObject=0x631178) returned 1
	[0085.869] lstrlenW (lpString="Appinfo") returned 7
	[0085.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0085.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0085.869] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0085.869] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0085.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0085.869] lstrlenW (lpString="AppXSvc") returned 7
	[0085.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0085.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0085.870] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0085.870] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0085.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0085.870] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0085.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0085.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0085.870] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0085.870] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0085.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0085.870] lstrlenW (lpString="Audiosrv") returned 8
	[0085.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0085.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0085.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0085.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0085.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0085.870] lstrlenW (lpString="BFE") returned 3
	[0085.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0085.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0085.871] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0085.871] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0085.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0085.871] lstrlenW (lpString="BITS") returned 4
	[0085.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0085.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0085.871] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0085.871] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0085.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0085.871] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0085.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0085.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0085.871] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0085.871] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0085.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0085.871] lstrlenW (lpString="CDPSvc") returned 6
	[0085.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0085.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0085.872] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0085.872] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0085.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0085.872] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0085.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0085.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0085.872] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0085.872] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0085.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0085.872] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0085.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0085.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0085.872] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0085.872] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0085.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0085.872] lstrlenW (lpString="CryptSvc") returned 8
	[0085.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0085.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0085.872] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0085.872] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0085.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0085.873] lstrlenW (lpString="DcomLaunch") returned 10
	[0085.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0085.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0085.873] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0085.873] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0085.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0085.873] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0085.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0085.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0085.873] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0085.873] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0085.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0085.873] lstrlenW (lpString="Dhcp") returned 4
	[0085.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0085.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0085.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0085.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0085.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0085.873] lstrlenW (lpString="Dnscache") returned 8
	[0085.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0085.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0085.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0085.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0085.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0085.874] lstrlenW (lpString="DoSvc") returned 5
	[0085.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0085.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0085.874] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0085.874] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0085.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0085.874] lstrlenW (lpString="DPS") returned 3
	[0085.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0085.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0085.874] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0085.874] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0085.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0085.874] lstrlenW (lpString="DusmSvc") returned 7
	[0085.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0085.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0085.875] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0085.875] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0085.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0085.875] lstrlenW (lpString="EventLog") returned 8
	[0085.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0085.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0085.875] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0085.875] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0085.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0085.875] lstrlenW (lpString="EventSystem") returned 11
	[0085.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0085.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0086.136] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0086.136] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0086.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0086.136] lstrlenW (lpString="FontCache") returned 9
	[0086.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0086.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0086.137] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0086.137] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0086.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0086.137] lstrlenW (lpString="gpsvc") returned 5
	[0086.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0086.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0086.137] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0086.137] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0086.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0086.137] lstrlenW (lpString="iphlpsvc") returned 8
	[0086.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0086.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0086.137] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0086.137] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0086.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0086.137] lstrlenW (lpString="KeyIso") returned 6
	[0086.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0086.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0086.137] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0086.137] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0086.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0086.137] lstrlenW (lpString="LanmanServer") returned 12
	[0086.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0086.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0086.138] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0086.138] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0086.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0086.138] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0086.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0086.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0086.138] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0086.138] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0086.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0086.138] lstrlenW (lpString="lfsvc") returned 5
	[0086.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0086.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0086.138] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0086.138] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0086.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0086.138] lstrlenW (lpString="lmhosts") returned 7
	[0086.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0086.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0086.138] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0086.138] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0086.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0086.138] lstrlenW (lpString="LSM") returned 3
	[0086.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0086.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0086.139] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0086.139] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0086.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0086.139] lstrlenW (lpString="MapsBroker") returned 10
	[0086.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0086.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0086.139] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0086.139] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0086.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0086.139] lstrlenW (lpString="MpsSvc") returned 6
	[0086.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0086.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0086.139] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0086.139] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0086.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0086.139] lstrlenW (lpString="NcbService") returned 10
	[0086.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0086.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0086.139] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0086.139] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0086.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0086.139] lstrlenW (lpString="netprofm") returned 8
	[0086.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0086.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0086.140] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0086.140] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0086.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0086.140] lstrlenW (lpString="NlaSvc") returned 6
	[0086.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0086.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0086.140] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0086.140] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0086.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0086.140] lstrlenW (lpString="nsi") returned 3
	[0086.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0086.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0086.140] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0086.140] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0086.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0086.140] lstrlenW (lpString="PcaSvc") returned 6
	[0086.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0086.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0086.140] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0086.140] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0086.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0086.140] lstrlenW (lpString="PlugPlay") returned 8
	[0086.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0086.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0086.141] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0086.141] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0086.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0086.141] lstrlenW (lpString="Power") returned 5
	[0086.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0086.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0086.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0086.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0086.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0086.141] lstrlenW (lpString="ProfSvc") returned 7
	[0086.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0086.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0086.141] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0086.141] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0086.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0086.141] lstrlenW (lpString="RpcEptMapper") returned 12
	[0086.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0086.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0086.141] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0086.141] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0086.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0086.142] lstrlenW (lpString="RpcSs") returned 5
	[0086.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0086.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0086.142] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0086.142] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0086.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0086.142] lstrlenW (lpString="SamSs") returned 5
	[0086.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0086.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0086.142] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0086.142] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0086.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0086.142] lstrlenW (lpString="Schedule") returned 8
	[0086.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0086.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0086.142] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0086.142] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0086.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0086.142] lstrlenW (lpString="SecurityHealthService") returned 21
	[0086.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0086.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0086.142] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0086.142] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0086.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0086.143] lstrlenW (lpString="SENS") returned 4
	[0086.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0086.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0086.143] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0086.143] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0086.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0086.143] lstrlenW (lpString="ShellHWDetection") returned 16
	[0086.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0086.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0086.143] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0086.143] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0086.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0086.143] lstrlenW (lpString="Spooler") returned 7
	[0086.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0086.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0086.143] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0086.143] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0086.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0086.143] lstrlenW (lpString="SSDPSRV") returned 7
	[0086.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0086.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0086.143] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0086.143] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0086.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0086.143] lstrlenW (lpString="StateRepository") returned 15
	[0086.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0086.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0086.144] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0086.144] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0086.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0086.144] lstrlenW (lpString="SysMain") returned 7
	[0086.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0086.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0086.144] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0086.144] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0086.144] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340
	[0086.149] Process32FirstW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0086.150] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0086.152] lstrlenW (lpString="System") returned 6
	[0086.152] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0086.152] lstrlenW (lpString="smss.exe") returned 8
	[0086.152] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0086.153] lstrlenW (lpString="csrss.exe") returned 9
	[0086.153] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0086.154] lstrlenW (lpString="wininit.exe") returned 11
	[0086.154] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0086.154] lstrlenW (lpString="csrss.exe") returned 9
	[0086.154] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0086.155] lstrlenW (lpString="winlogon.exe") returned 12
	[0086.155] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0086.155] lstrlenW (lpString="services.exe") returned 12
	[0086.155] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0086.156] lstrlenW (lpString="lsass.exe") returned 9
	[0086.156] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.157] lstrlenW (lpString="svchost.exe") returned 11
	[0086.157] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0086.157] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0086.157] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0086.158] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0086.158] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.158] lstrlenW (lpString="svchost.exe") returned 11
	[0086.158] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0086.159] lstrlenW (lpString="dwm.exe") returned 7
	[0086.159] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.160] lstrlenW (lpString="svchost.exe") returned 11
	[0086.160] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.161] lstrlenW (lpString="svchost.exe") returned 11
	[0086.161] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.161] lstrlenW (lpString="svchost.exe") returned 11
	[0086.161] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.162] lstrlenW (lpString="svchost.exe") returned 11
	[0086.162] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.162] lstrlenW (lpString="svchost.exe") returned 11
	[0086.162] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.163] lstrlenW (lpString="svchost.exe") returned 11
	[0086.163] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.163] lstrlenW (lpString="svchost.exe") returned 11
	[0086.164] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.164] lstrlenW (lpString="svchost.exe") returned 11
	[0086.164] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.165] lstrlenW (lpString="svchost.exe") returned 11
	[0086.165] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0086.165] lstrlenW (lpString="spoolsv.exe") returned 11
	[0086.165] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.166] lstrlenW (lpString="svchost.exe") returned 11
	[0086.166] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.167] lstrlenW (lpString="svchost.exe") returned 11
	[0086.167] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0086.168] lstrlenW (lpString="audiodg.exe") returned 11
	[0086.168] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0086.168] lstrlenW (lpString="sihost.exe") returned 10
	[0086.168] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.169] lstrlenW (lpString="svchost.exe") returned 11
	[0086.169] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0086.169] lstrlenW (lpString="taskhostw.exe") returned 13
	[0086.169] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0086.170] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0086.170] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0086.263] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0086.278] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0086.288] lstrlenW (lpString="explorer.exe") returned 12
	[0086.288] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0086.289] lstrlenW (lpString="Memory Compression") returned 18
	[0086.289] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0086.289] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0086.290] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0086.290] lstrlenW (lpString="SearchUI.exe") returned 12
	[0086.290] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0086.291] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0086.291] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0086.292] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0086.292] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0086.292] lstrlenW (lpString="taskhostw.exe") returned 13
	[0086.292] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0086.293] lstrlenW (lpString="UsoClient.exe") returned 13
	[0086.293] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0086.293] lstrlenW (lpString="taskhostw.exe") returned 13
	[0086.293] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0086.294] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0086.294] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0086.294] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0086.294] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0086.295] lstrlenW (lpString="msoia.exe") returned 9
	[0086.295] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0086.296] lstrlenW (lpString="msoia.exe") returned 9
	[0086.296] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0086.296] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0086.296] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1
	[0086.297] lstrlenW (lpString="screensaver.exe") returned 15
	[0086.297] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nancyedge.exe")) returned 1
	[0086.297] lstrlenW (lpString="nancyedge.exe") returned 13
	[0086.297] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ix-telephony-religion.exe")) returned 1
	[0086.298] lstrlenW (lpString="ix-telephony-religion.exe") returned 25
	[0086.298] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="brushspiritforces.exe")) returned 1
	[0086.298] lstrlenW (lpString="brushspiritforces.exe") returned 21
	[0086.298] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests production meanwhile.exe")) returned 1
	[0086.299] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0086.299] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="percentage.exe")) returned 1
	[0086.299] lstrlenW (lpString="percentage.exe") returned 14
	[0086.299] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="hh_him.exe")) returned 1
	[0086.300] lstrlenW (lpString="hh_him.exe") returned 10
	[0086.300] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba.exe")) returned 1
	[0086.301] lstrlenW (lpString="nba.exe") returned 7
	[0086.301] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en-regard-organization.exe")) returned 1
	[0086.301] lstrlenW (lpString="en-regard-organization.exe") returned 26
	[0086.301] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="citizenship.exe")) returned 1
	[0086.302] lstrlenW (lpString="citizenship.exe") returned 15
	[0086.302] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1
	[0086.302] lstrlenW (lpString="beam removable.exe") returned 18
	[0086.302] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation customs denial.exe")) returned 1
	[0086.303] lstrlenW (lpString="federation customs denial.exe") returned 29
	[0086.303] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crest-boating.exe")) returned 1
	[0086.304] lstrlenW (lpString="crest-boating.exe") returned 17
	[0086.304] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1
	[0086.304] lstrlenW (lpString="wrist.exe") returned 9
	[0086.304] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicationwage.exe")) returned 1
	[0086.305] lstrlenW (lpString="indicationwage.exe") returned 18
	[0086.305] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="theepub.exe")) returned 1
	[0086.306] lstrlenW (lpString="theepub.exe") returned 11
	[0086.306] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure-recruitment.exe")) returned 1
	[0086.307] lstrlenW (lpString="expenditure-recruitment.exe") returned 27
	[0086.307] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter_thinking_patents.exe")) returned 1
	[0086.307] lstrlenW (lpString="charter_thinking_patents.exe") returned 28
	[0086.307] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="webpage.exe")) returned 1
	[0086.308] lstrlenW (lpString="webpage.exe") returned 11
	[0086.308] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed.exe")) returned 1
	[0086.309] lstrlenW (lpString="distributed.exe") returned 15
	[0086.309] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ann.exe")) returned 1
	[0086.309] lstrlenW (lpString="ann.exe") returned 7
	[0086.310] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0086.310] lstrlenW (lpString="conhost.exe") returned 11
	[0086.310] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0086.311] lstrlenW (lpString="conhost.exe") returned 11
	[0086.311] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.311] lstrlenW (lpString="svchost.exe") returned 11
	[0086.311] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0086.312] lstrlenW (lpString="d2.exe") returned 6
	[0086.312] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0086.313] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0086.313] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0086.314] lstrlenW (lpString="conhost.exe") returned 11
	[0086.314] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0086.314] lstrlenW (lpString="dllhost.exe") returned 11
	[0086.314] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xce8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0086.315] lstrlenW (lpString="cmd.exe") returned 7
	[0086.315] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0086.315] lstrlenW (lpString="conhost.exe") returned 11
	[0086.315] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.316] lstrlenW (lpString="svchost.exe") returned 11
	[0086.316] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0086.317] lstrlenW (lpString="mode.com") returned 8
	[0086.317] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0086.317] lstrlenW (lpString="LogonUI.exe") returned 11
	[0086.317] Process32NextW (in: hSnapshot=0x340, lppe=0xa0fd2c | out: lppe=0xa0fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0086.318] CloseHandle (hObject=0x340) returned 1
	[0086.318] Sleep (dwMilliseconds=0x1f4) 
	[0087.210] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x631178
	[0087.229] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 0
	[0087.230] GetLastError () returned 0xea
	[0087.230] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1d4a) returned 0x4277598
	[0087.231] EnumServicesStatusExW (in: hSCManager=0x631178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4277598, cbBufSize=0x1d4a, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4277598, pcbBytesNeeded=0xa0ff3c, lpServicesReturned=0xa0ff54, lpResumeHandle=0x0) returned 1
	[0087.232] CloseServiceHandle (hSCObject=0x631178) returned 1
	[0087.232] lstrlenW (lpString="Appinfo") returned 7
	[0087.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0087.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0087.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0087.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0087.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0087.232] lstrlenW (lpString="AppXSvc") returned 7
	[0087.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0087.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0087.232] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0087.232] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0087.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0087.232] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0087.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0087.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0087.232] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0087.232] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0087.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0087.232] lstrlenW (lpString="Audiosrv") returned 8
	[0087.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0087.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0087.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0087.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0087.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0087.233] lstrlenW (lpString="BFE") returned 3
	[0087.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0087.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0087.233] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0087.233] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0087.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0087.233] lstrlenW (lpString="BITS") returned 4
	[0087.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0087.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0087.233] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0087.233] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0087.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0087.233] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0087.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0087.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0087.233] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0087.233] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0087.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0087.233] lstrlenW (lpString="CDPSvc") returned 6
	[0087.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0087.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0087.233] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0087.233] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0087.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0087.233] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0087.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0087.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0087.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0087.234] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0087.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0087.234] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0087.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0087.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0087.234] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0087.234] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0087.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0087.234] lstrlenW (lpString="CryptSvc") returned 8
	[0087.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0087.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0087.234] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0087.234] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0087.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0087.234] lstrlenW (lpString="DcomLaunch") returned 10
	[0087.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0087.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0087.234] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0087.234] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0087.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0087.234] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0087.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0087.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0087.234] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0087.234] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0087.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0087.234] lstrlenW (lpString="Dhcp") returned 4
	[0087.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0087.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0087.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0087.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0087.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0087.235] lstrlenW (lpString="Dnscache") returned 8
	[0087.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0087.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0087.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0087.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0087.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0087.235] lstrlenW (lpString="DoSvc") returned 5
	[0087.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0087.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0087.235] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0087.235] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0087.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0087.235] lstrlenW (lpString="DPS") returned 3
	[0087.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0087.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0087.235] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0087.235] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0087.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0087.235] lstrlenW (lpString="DusmSvc") returned 7
	[0087.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0087.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0087.235] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0087.235] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0087.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0087.235] lstrlenW (lpString="EventLog") returned 8
	[0087.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0087.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0087.236] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0087.236] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0087.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0087.236] lstrlenW (lpString="EventSystem") returned 11
	[0087.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0087.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0087.236] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0087.236] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0087.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0087.236] lstrlenW (lpString="FontCache") returned 9
	[0087.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0087.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0087.236] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0087.236] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0087.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0087.236] lstrlenW (lpString="gpsvc") returned 5
	[0087.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0087.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0087.236] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0087.236] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0087.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0087.236] lstrlenW (lpString="iphlpsvc") returned 8
	[0087.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0087.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0087.236] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0087.236] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0087.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0087.237] lstrlenW (lpString="KeyIso") returned 6
	[0087.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0087.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0087.237] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0087.237] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0087.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0087.237] lstrlenW (lpString="LanmanServer") returned 12
	[0087.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0087.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0087.237] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0087.237] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0087.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0087.237] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0087.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0087.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0087.237] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0087.237] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0087.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0087.237] lstrlenW (lpString="lfsvc") returned 5
	[0087.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0087.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0087.237] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0087.237] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0087.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0087.237] lstrlenW (lpString="lmhosts") returned 7
	[0087.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0087.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0087.238] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0087.238] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0087.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0087.238] lstrlenW (lpString="LSM") returned 3
	[0087.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0087.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0087.238] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0087.238] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0087.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0087.238] lstrlenW (lpString="MpsSvc") returned 6
	[0087.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0087.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0087.238] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0087.238] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0087.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0087.238] lstrlenW (lpString="NcbService") returned 10
	[0087.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0087.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0087.238] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0087.238] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0087.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0087.238] lstrlenW (lpString="netprofm") returned 8
	[0087.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0087.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0087.238] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0087.238] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0087.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0087.238] lstrlenW (lpString="NlaSvc") returned 6
	[0087.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0087.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0087.239] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0087.239] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0087.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0087.239] lstrlenW (lpString="nsi") returned 3
	[0087.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0087.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0087.239] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0087.239] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0087.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0087.239] lstrlenW (lpString="PcaSvc") returned 6
	[0087.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0087.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0087.239] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0087.239] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0087.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0087.239] lstrlenW (lpString="PlugPlay") returned 8
	[0087.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0087.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0087.239] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0087.239] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0087.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0087.239] lstrlenW (lpString="Power") returned 5
	[0087.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0087.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0087.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0087.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0087.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0087.239] lstrlenW (lpString="ProfSvc") returned 7
	[0087.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0087.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0087.239] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0087.240] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0087.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0087.240] lstrlenW (lpString="RpcEptMapper") returned 12
	[0087.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0087.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0087.240] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0087.240] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0087.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0087.240] lstrlenW (lpString="RpcSs") returned 5
	[0087.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0087.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0087.240] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0087.240] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0087.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0087.240] lstrlenW (lpString="SamSs") returned 5
	[0087.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0087.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0087.240] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0087.240] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0087.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0087.240] lstrlenW (lpString="Schedule") returned 8
	[0087.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0087.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0087.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0087.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0087.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0087.240] lstrlenW (lpString="SecurityHealthService") returned 21
	[0087.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0087.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0087.241] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0087.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0087.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0087.241] lstrlenW (lpString="SENS") returned 4
	[0087.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0087.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0087.241] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0087.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0087.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0087.241] lstrlenW (lpString="ShellHWDetection") returned 16
	[0087.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0087.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0087.241] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0087.241] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0087.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0087.241] lstrlenW (lpString="Spooler") returned 7
	[0087.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0087.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0087.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0087.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0087.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0087.241] lstrlenW (lpString="sppsvc") returned 6
	[0087.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1
	[0087.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1
	[0087.241] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1
	[0087.242] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1
	[0087.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1
	[0087.242] lstrlenW (lpString="SSDPSRV") returned 7
	[0087.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0087.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0087.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0087.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0087.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0087.242] lstrlenW (lpString="StateRepository") returned 15
	[0087.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0087.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0087.242] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0087.242] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0087.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0087.242] lstrlenW (lpString="SysMain") returned 7
	[0087.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0087.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0087.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0087.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0087.242] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) 

Thread:
	id = 5
	os_tid = 0x798

	[0054.079] WaitForSingleObject (hHandle=0x19ca1c, dwMilliseconds=0xffffffff) returned 0xffffffff
	[0054.079] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x658288 | out: hHeap=0x600000) returned 1

Thread:
	id = 6
	os_tid = 0x910

	[0054.081] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6a0070
	[0054.081] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a0070, Size=0x20) returned 0x630ca0
	[0054.081] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x630ca0, Size=0x40) returned 0x62b7b8
	[0054.081] GetLogicalDrives () returned 0x4
	[0054.081] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x6b0a98
	[0054.082] GetComputerNameW (in: lpBuffer=0x6b0a9c, nSize=0x27aff64 | out: lpBuffer="NQDPDE", nSize=0x27aff64) returned 1
	[0054.082] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1000) returned 0x6c0aa0
	[0054.082] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x27aff34 | out: lphEnum=0x27aff34*=0x62a7f8) returned 0x0
	[0054.083] WNetEnumResourceW (in: hEnum=0x62a7f8, lpcCount=0x27aff30, lpBuffer=0x6c0aa0, lpBufferSize=0x27aff38 | out: lpcCount=0x27aff30, lpBuffer=0x6c0aa0, lpBufferSize=0x27aff38) returned 0x103
	[0054.089] WNetCloseEnum (hEnum=0x62a7f8) returned 0x0
	[0054.089] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x27aff34 | out: lphEnum=0x27aff34*=0x6f4228) returned 0x0
	[0057.490] WNetEnumResourceW (in: hEnum=0x6f4228, lpcCount=0x27aff30, lpBuffer=0x6c0aa0, lpBufferSize=0x27aff38 | out: lpcCount=0x27aff30, lpBuffer=0x6c0aa0, lpBufferSize=0x27aff38) returned 0x0
	[0057.490] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1000) returned 0x3584778
	[0057.490] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6c0aa0, lphEnum=0x27aff08 | out: lphEnum=0x27aff08*=0x62a7d8) returned 0x0
	[0057.492] WNetEnumResourceW (in: hEnum=0x62a7d8, lpcCount=0x27aff04, lpBuffer=0x3584778, lpBufferSize=0x27aff0c | out: lpcCount=0x27aff04, lpBuffer=0x3584778, lpBufferSize=0x27aff0c) returned 0x103
	[0057.492] WNetCloseEnum (hEnum=0x62a7d8) returned 0x0
	[0057.492] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1000) returned 0x3582768
	[0057.492] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6c0ac0, lphEnum=0x27aff08 | out: lphEnum=0x27aff08*=0x0) returned 0x4b8
	[0075.375] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1000) returned 0x429c5f8
	[0075.375] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6c0ae0, lphEnum=0x27aff08 | out: lphEnum=0x27aff08*=0x0) returned 0x4c6
	[0075.379] WNetEnumResourceW (in: hEnum=0x6f4228, lpcCount=0x27aff30, lpBuffer=0x6c0aa0, lpBufferSize=0x27aff38 | out: lpcCount=0x27aff30, lpBuffer=0x6c0aa0, lpBufferSize=0x27aff38) returned 0x103
	[0075.379] WNetCloseEnum (hEnum=0x6f4228) returned 0x0
	[0075.379] GetLogicalDrives () returned 0x4
	[0075.379] Sleep (dwMilliseconds=0x64) 
	[0075.770] GetLogicalDrives () returned 0x4
	[0075.770] Sleep (dwMilliseconds=0x64) 
	[0076.277] GetLogicalDrives () returned 0x4
	[0076.277] Sleep (dwMilliseconds=0x64) 
	[0077.081] GetLogicalDrives () returned 0x4
	[0077.106] Sleep (dwMilliseconds=0x64) 
	[0077.279] GetLogicalDrives () returned 0x4
	[0077.279] Sleep (dwMilliseconds=0x64) 
	[0077.838] GetLogicalDrives () returned 0x4
	[0077.838] Sleep (dwMilliseconds=0x64) 
	[0078.318] GetLogicalDrives () returned 0x4
	[0078.318] Sleep (dwMilliseconds=0x64) 
	[0078.853] GetLogicalDrives () returned 0x4
	[0078.853] Sleep (dwMilliseconds=0x64) 
	[0080.026] GetLogicalDrives () returned 0x4
	[0080.026] Sleep (dwMilliseconds=0x64) 
	[0080.595] GetLogicalDrives () returned 0x4
	[0080.595] Sleep (dwMilliseconds=0x64) 
	[0081.194] GetLogicalDrives () returned 0x4
	[0081.194] Sleep (dwMilliseconds=0x64) 
	[0081.687] GetLogicalDrives () returned 0x4
	[0081.687] Sleep (dwMilliseconds=0x64) 
	[0082.204] GetLogicalDrives () returned 0x4
	[0082.204] Sleep (dwMilliseconds=0x64) 
	[0082.716] GetLogicalDrives () returned 0x4
	[0082.716] Sleep (dwMilliseconds=0x64) 
	[0083.223] GetLogicalDrives () returned 0x4
	[0083.223] Sleep (dwMilliseconds=0x64) 
	[0083.583] GetLogicalDrives () returned 0x4
	[0083.592] Sleep (dwMilliseconds=0x64) 
	[0084.488] GetLogicalDrives () returned 0x4
	[0084.508] Sleep (dwMilliseconds=0x64) 
	[0085.020] GetLogicalDrives () returned 0x4
	[0085.020] Sleep (dwMilliseconds=0x64) 
	[0085.466] GetLogicalDrives () returned 0x4
	[0085.466] Sleep (dwMilliseconds=0x64) 
	[0085.935] GetLogicalDrives () returned 0x4
	[0085.935] Sleep (dwMilliseconds=0x64) 
	[0086.258] GetLogicalDrives () returned 0x4
	[0086.259] Sleep (dwMilliseconds=0x64) 
	[0086.658] GetLogicalDrives () returned 0x4
	[0086.658] Sleep (dwMilliseconds=0x64) 
	[0087.139] GetLogicalDrives () returned 0x4
	[0087.148] Sleep (dwMilliseconds=0x64) 

Thread:
	id = 7
	os_tid = 0x39c

	[0054.083] GetTickCount () returned 0x114df84
	[0054.083] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x24) returned 0x62c160
	[0054.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62c160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284
	[0054.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62c160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288
	[0054.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62c160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c
	[0054.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62c160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290
	[0054.086] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6a0190
	[0054.086] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a0190, Size=0x20) returned 0x630ca0
	[0054.086] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x6a0190
	[0054.086] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6a0190, Size=0x20) returned 0x630ed0
	[0054.087] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0054.087] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0054.087] Wow64DisableWow64FsRedirection (in: OldValue=0x28eff7c | out: OldValue=0x28eff7c*=0x0) returned 1
	[0054.087] lstrlenW (lpString="kernel32.dll") returned 12
	[0054.087] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630ca0 | out: hHeap=0x600000) returned 1
	[0054.087] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0054.087] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x630ed0 | out: hHeap=0x600000) returned 1
	[0054.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x659de8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294
	[0054.088] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0054.304] GetTickCount () returned 0x114e06e
	[0054.304] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0055.630] GetTickCount () returned 0x114e58f
	[0055.630] GetTickCount () returned 0x114e58f
	[0055.630] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0055.858] GetTickCount () returned 0x114e679
	[0055.858] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0057.175] GetTickCount () returned 0x114eb9a
	[0057.175] GetTickCount () returned 0x114eb9a
	[0057.175] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0057.427] GetTickCount () returned 0x114eca3
	[0057.427] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0057.804] GetTickCount () returned 0x114ee1a
	[0057.805] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0058.442] GetTickCount () returned 0x114f08b
	[0058.442] GetTickCount () returned 0x114f09b
	[0058.442] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0059.061] GetTickCount () returned 0x114f2fc
	[0059.061] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0059.477] GetTickCount () returned 0x114f492
	[0059.477] GetTickCount () returned 0x114f492
	[0059.477] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0060.167] GetTickCount () returned 0x114f752
	[0060.167] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0060.631] GetTickCount () returned 0x114f917
	[0060.631] GetTickCount () returned 0x114f917
	[0060.631] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0061.308] GetTickCount () returned 0x114fbc6
	[0061.308] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0061.930] GetTickCount () returned 0x114fe28
	[0061.930] GetTickCount () returned 0x114fe28
	[0061.930] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0062.412] GetTickCount () returned 0x115001c
	[0062.412] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0063.007] GetTickCount () returned 0x115027d
	[0063.028] GetTickCount () returned 0x115027d
	[0063.028] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0063.694] GetTickCount () returned 0x115051d
	[0063.694] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0064.339] GetTickCount () returned 0x115079d
	[0064.339] GetTickCount () returned 0x115079d
	[0064.339] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0064.880] GetTickCount () returned 0x11509c0
	[0064.880] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0065.348] GetTickCount () returned 0x1150b95
	[0065.348] GetTickCount () returned 0x1150b95
	[0065.349] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0065.935] GetTickCount () returned 0x1150dd7
	[0065.935] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0066.557] GetTickCount () returned 0x1151048
	[0066.557] GetTickCount () returned 0x1151048
	[0066.557] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0067.120] GetTickCount () returned 0x115127b
	[0067.120] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0067.520] GetTickCount () returned 0x1151411
	[0067.520] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0067.838] GetTickCount () returned 0x1151549
	[0067.838] GetTickCount () returned 0x1151549
	[0067.838] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0068.192] GetTickCount () returned 0x11516a1
	[0068.192] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0068.712] GetTickCount () returned 0x11518b4
	[0068.712] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0069.241] GetTickCount () returned 0x1151ab8
	[0069.241] GetTickCount () returned 0x1151ab8
	[0069.241] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0069.668] GetTickCount () returned 0x1151c6e
	[0069.668] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0070.071] GetTickCount () returned 0x1151df4
	[0070.071] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0070.842] GetTickCount () returned 0x1152101
	[0070.842] GetTickCount () returned 0x1152101
	[0070.845] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0071.329] GetTickCount () returned 0x11522e6
	[0071.329] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0071.594] GetTickCount () returned 0x11523ef
	[0071.594] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0072.291] GetTickCount () returned 0x115269f
	[0072.291] GetTickCount () returned 0x115269f
	[0072.291] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0072.781] GetTickCount () returned 0x1152883
	[0072.781] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0072.983] GetTickCount () returned 0x115294e
	[0072.983] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0073.428] GetTickCount () returned 0x1152b14
	[0073.428] GetTickCount () returned 0x1152b14
	[0073.428] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0073.866] GetTickCount () returned 0x1152cc9
	[0073.866] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0074.436] GetTickCount () returned 0x1152f0b
	[0074.436] GetTickCount () returned 0x1152f0b
	[0074.436] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0074.942] GetTickCount () returned 0x11530ff
	[0074.942] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0075.367] GetTickCount () returned 0x11532a5
	[0075.368] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0075.770] GetTickCount () returned 0x115343b
	[0075.770] GetTickCount () returned 0x115343b
	[0075.770] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0076.277] GetTickCount () returned 0x115362f
	[0076.277] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0077.106] GetTickCount () returned 0x115396b
	[0077.106] GetTickCount () returned 0x115396b
	[0077.106] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0077.279] GetTickCount () returned 0x1153a17
	[0077.279] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0077.772] GetTickCount () returned 0x1153c0b
	[0077.778] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0078.227] GetTickCount () returned 0x1153dd0
	[0078.236] GetTickCount () returned 0x1153dd0
	[0078.236] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0078.620] GetTickCount () returned 0x1153f57
	[0078.620] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0079.615] GetTickCount () returned 0x115433f
	[0079.615] GetTickCount () returned 0x115433f
	[0079.615] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0080.194] GetTickCount () returned 0x1154581
	[0080.194] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0080.815] GetTickCount () returned 0x11547e3
	[0080.815] GetTickCount () returned 0x11547e3
	[0080.815] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0081.261] GetTickCount () returned 0x11549a8
	[0081.261] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0081.693] GetTickCount () returned 0x1154b5d
	[0081.693] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0082.203] GetTickCount () returned 0x1154d51
	[0082.203] GetTickCount () returned 0x1154d51
	[0082.203] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0082.715] GetTickCount () returned 0x1154f55
	[0082.715] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0083.223] GetTickCount () returned 0x1155158
	[0083.223] GetTickCount () returned 0x1155158
	[0083.223] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0083.592] GetTickCount () returned 0x11552c0
	[0083.592] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0084.334] GetTickCount () returned 0x11555bd
	[0084.334] GetTickCount () returned 0x11555bd
	[0084.334] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0084.864] GetTickCount () returned 0x11557c1
	[0084.864] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0085.420] GetTickCount () returned 0x11559f4
	[0085.420] GetTickCount () returned 0x11559f4
	[0085.420] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0085.875] GetTickCount () returned 0x1155bb9
	[0085.875] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0086.248] GetTickCount () returned 0x1155d30
	[0086.248] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0086.657] GetTickCount () returned 0x1155ec6
	[0086.657] GetTickCount () returned 0x1155ec6
	[0086.657] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102
	[0087.148] GetTickCount () returned 0x11560aa
	[0087.148] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) 

Thread:
	id = 8
	os_tid = 0xeb8

	[0055.934] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x35a0740
	[0055.935] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x35b0748
	[0055.935] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f008
	[0055.936] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x6) returned 0x69f1c8
	[0055.936] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f218
	[0055.936] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x100000) returned 0x3da2020
	[0055.939] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f230
	[0055.939] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f230, Size=0x20) returned 0x631150
	[0055.939] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f230
	[0055.939] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f230, Size=0x20) returned 0x6311c8
	[0055.939] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0055.939] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0055.939] Wow64DisableWow64FsRedirection (in: OldValue=0x266ff50 | out: OldValue=0x266ff50*=0x0) returned 1
	[0055.939] lstrlenW (lpString="kernel32.dll") returned 12
	[0055.939] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631150 | out: hHeap=0x600000) returned 1
	[0055.939] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0055.939] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6311c8 | out: hHeap=0x600000) returned 1
	[0055.940] Sleep (dwMilliseconds=0x64) 
	[0057.208] lstrcmpiW (lpString1=".log", lpString2=".money") returned -1
	[0057.208] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0057.208] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0057.217] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=42674) returned 1
	[0057.217] CloseHandle (hObject=0x2c8) returned 1
	[0057.217] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20
	[0057.217] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0057.218] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0057.218] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.218] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.218] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0057.218] GetLastError () returned 0x0
	[0057.218] ReadFile (in: hFile=0x2c8, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xa6b2, lpOverlapped=0x0) returned 1
	[0057.232] WriteFile (in: hFile=0x2cc, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xa6c0, lpOverlapped=0x0) returned 1
	[0057.234] ReadFile (in: hFile=0x2c8, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.234] WriteFile (in: hFile=0x2cc, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0057.234] SetEndOfFile (hFile=0x2cc) returned 1
	[0057.234] CloseHandle (hObject=0x2cc) returned 1
	[0057.236] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.236] SetEndOfFile (hFile=0x2c8) returned 1
	[0057.237] CloseHandle (hObject=0x2c8) returned 1
	[0057.237] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0057.237] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1
	[0057.238] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.238] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.238] lstrlenW (lpString=".doc") returned 4
	[0057.238] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0057.238] lstrlenW (lpString=".docx") returned 5
	[0057.238] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1
	[0057.238] lstrlenW (lpString=".pdf") returned 4
	[0057.238] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0057.238] lstrlenW (lpString=".xls") returned 4
	[0057.238] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0057.238] lstrlenW (lpString=".xlsx") returned 5
	[0057.238] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1
	[0057.238] lstrlenW (lpString=".ppt") returned 4
	[0057.238] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0057.238] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.238] lstrlenW (lpString=".zip") returned 4
	[0057.238] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0057.238] lstrlenW (lpString=".rar") returned 4
	[0057.239] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0057.239] lstrlenW (lpString=".bz2") returned 4
	[0057.239] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0057.239] lstrlenW (lpString=".7z") returned 3
	[0057.239] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0057.239] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.239] lstrlenW (lpString=".dbf") returned 4
	[0057.239] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0057.239] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.239] lstrlenW (lpString=".1cd") returned 4
	[0057.239] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0057.239] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.239] lstrlenW (lpString=".jpg") returned 4
	[0057.239] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0057.239] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.239] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.239] lstrlenW (lpString=".doc") returned 4
	[0057.240] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0057.240] lstrlenW (lpString=".docx") returned 5
	[0057.240] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1
	[0057.240] lstrlenW (lpString=".pdf") returned 4
	[0057.240] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0057.240] lstrlenW (lpString=".xls") returned 4
	[0057.240] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0057.240] lstrlenW (lpString=".xlsx") returned 5
	[0057.240] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1
	[0057.240] lstrlenW (lpString=".ppt") returned 4
	[0057.240] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0057.240] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.240] lstrlenW (lpString=".zip") returned 4
	[0057.240] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0057.240] lstrlenW (lpString=".rar") returned 4
	[0057.240] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0057.240] lstrlenW (lpString=".bz2") returned 4
	[0057.240] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0057.240] lstrlenW (lpString=".7z") returned 3
	[0057.240] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0057.240] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.240] lstrlenW (lpString=".dbf") returned 4
	[0057.240] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0057.240] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.240] lstrlenW (lpString=".1cd") returned 4
	[0057.240] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0057.241] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.241] lstrlenW (lpString=".jpg") returned 4
	[0057.241] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0057.241] lstrcmpiW (lpString1=".log", lpString2=".money") returned -1
	[0057.241] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32
	[0057.241] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0057.274] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=6004) returned 1
	[0057.274] CloseHandle (hObject=0x2c8) returned 1
	[0057.274] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20
	[0057.274] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0057.274] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0057.274] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.274] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.275] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0057.275] GetLastError () returned 0x0
	[0057.275] ReadFile (in: hFile=0x2c8, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1774, lpOverlapped=0x0) returned 1
	[0057.277] WriteFile (in: hFile=0x2cc, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1780, lpOverlapped=0x0) returned 1
	[0057.278] ReadFile (in: hFile=0x2c8, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.278] WriteFile (in: hFile=0x2cc, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x114, lpOverlapped=0x0) returned 1
	[0057.278] SetEndOfFile (hFile=0x2cc) returned 1
	[0057.278] CloseHandle (hObject=0x2cc) returned 1
	[0057.279] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.279] SetEndOfFile (hFile=0x2c8) returned 1
	[0057.280] CloseHandle (hObject=0x2c8) returned 1
	[0057.280] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0057.280] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1
	[0057.281] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.281] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.281] lstrlenW (lpString=".doc") returned 4
	[0057.281] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0057.281] lstrlenW (lpString=".docx") returned 5
	[0057.281] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1
	[0057.281] lstrlenW (lpString=".pdf") returned 4
	[0057.281] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0057.281] lstrlenW (lpString=".xls") returned 4
	[0057.281] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0057.281] lstrlenW (lpString=".xlsx") returned 5
	[0057.281] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1
	[0057.281] lstrlenW (lpString=".ppt") returned 4
	[0057.281] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0057.281] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.281] lstrlenW (lpString=".zip") returned 4
	[0057.281] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0057.281] lstrlenW (lpString=".rar") returned 4
	[0057.281] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0057.281] lstrlenW (lpString=".bz2") returned 4
	[0057.281] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0057.281] lstrlenW (lpString=".7z") returned 3
	[0057.282] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0057.282] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.282] lstrlenW (lpString=".dbf") returned 4
	[0057.282] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0057.282] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.282] lstrlenW (lpString=".1cd") returned 4
	[0057.282] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0057.282] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.282] lstrlenW (lpString=".jpg") returned 4
	[0057.282] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0057.282] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.282] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.282] lstrlenW (lpString=".doc") returned 4
	[0057.282] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0057.282] lstrlenW (lpString=".docx") returned 5
	[0057.282] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1
	[0057.282] lstrlenW (lpString=".pdf") returned 4
	[0057.282] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0057.282] lstrlenW (lpString=".xls") returned 4
	[0057.282] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0057.282] lstrlenW (lpString=".xlsx") returned 5
	[0057.283] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1
	[0057.283] lstrlenW (lpString=".ppt") returned 4
	[0057.283] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0057.283] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.283] lstrlenW (lpString=".zip") returned 4
	[0057.283] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0057.283] lstrlenW (lpString=".rar") returned 4
	[0057.283] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0057.283] lstrlenW (lpString=".bz2") returned 4
	[0057.283] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0057.283] lstrlenW (lpString=".7z") returned 3
	[0057.283] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0057.283] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.283] lstrlenW (lpString=".dbf") returned 4
	[0057.283] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0057.283] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.283] lstrlenW (lpString=".1cd") returned 4
	[0057.283] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0057.283] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0057.283] lstrlenW (lpString=".jpg") returned 4
	[0057.283] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0057.284] Sleep (dwMilliseconds=0x64) 
	[0057.631] Sleep (dwMilliseconds=0x64) 
	[0058.005] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0058.005] lstrlenW (lpString="eula.rtf") returned 8
	[0058.005] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.007] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=7567) returned 1
	[0058.007] CloseHandle (hObject=0x2f0) returned 1
	[0058.007] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80
	[0058.007] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.007] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.007] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.007] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.007] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0058.026] GetLastError () returned 0x0
	[0058.026] ReadFile (in: hFile=0x2f0, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1d8f, lpOverlapped=0x0) returned 1
	[0058.035] WriteFile (in: hFile=0x304, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1d90, lpOverlapped=0x0) returned 1
	[0058.036] ReadFile (in: hFile=0x2f0, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.036] WriteFile (in: hFile=0x304, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0058.036] SetEndOfFile (hFile=0x304) returned 1
	[0058.037] CloseHandle (hObject=0x304) returned 1
	[0058.037] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.037] SetEndOfFile (hFile=0x2f0) returned 1
	[0058.038] CloseHandle (hObject=0x2f0) returned 1
	[0058.038] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.039] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1
	[0058.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.039] lstrlenW (lpString=".doc") returned 4
	[0058.039] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.039] lstrlenW (lpString=".docx") returned 5
	[0058.039] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.039] lstrlenW (lpString=".pdf") returned 4
	[0058.039] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.039] lstrlenW (lpString=".xls") returned 4
	[0058.039] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.039] lstrlenW (lpString=".xlsx") returned 5
	[0058.040] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.040] lstrlenW (lpString=".ppt") returned 4
	[0058.040] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.040] lstrlenW (lpString=".zip") returned 4
	[0058.040] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.040] lstrlenW (lpString=".rar") returned 4
	[0058.040] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.040] lstrlenW (lpString=".bz2") returned 4
	[0058.040] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.040] lstrlenW (lpString=".7z") returned 3
	[0058.040] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.040] lstrlenW (lpString=".dbf") returned 4
	[0058.040] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.040] lstrlenW (lpString=".1cd") returned 4
	[0058.040] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.040] lstrlenW (lpString=".jpg") returned 4
	[0058.040] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.041] lstrlenW (lpString=".doc") returned 4
	[0058.041] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.041] lstrlenW (lpString=".docx") returned 5
	[0058.041] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.041] lstrlenW (lpString=".pdf") returned 4
	[0058.041] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.041] lstrlenW (lpString=".xls") returned 4
	[0058.041] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.041] lstrlenW (lpString=".xlsx") returned 5
	[0058.041] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.041] lstrlenW (lpString=".ppt") returned 4
	[0058.041] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.041] lstrlenW (lpString=".zip") returned 4
	[0058.041] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.041] lstrlenW (lpString=".rar") returned 4
	[0058.041] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.041] lstrlenW (lpString=".bz2") returned 4
	[0058.041] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.041] lstrlenW (lpString=".7z") returned 3
	[0058.041] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.041] lstrlenW (lpString=".dbf") returned 4
	[0058.041] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.041] lstrlenW (lpString=".1cd") returned 4
	[0058.041] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0058.042] lstrlenW (lpString=".jpg") returned 4
	[0058.042] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.042] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0058.042] lstrlenW (lpString="eula.rtf") returned 8
	[0058.042] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0058.045] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3726) returned 1
	[0058.045] CloseHandle (hObject=0x2fc) returned 1
	[0058.045] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80
	[0058.045] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.045] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0058.045] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.045] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.045] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0058.063] GetLastError () returned 0x0
	[0058.063] ReadFile (in: hFile=0x2fc, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xe8e, lpOverlapped=0x0) returned 1
	[0058.065] WriteFile (in: hFile=0x304, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe90, lpOverlapped=0x0) returned 1
	[0058.066] ReadFile (in: hFile=0x2fc, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.066] WriteFile (in: hFile=0x304, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0058.066] SetEndOfFile (hFile=0x304) returned 1
	[0058.066] CloseHandle (hObject=0x304) returned 1
	[0058.067] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.067] SetEndOfFile (hFile=0x2fc) returned 1
	[0058.068] CloseHandle (hObject=0x2fc) returned 1
	[0058.068] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.068] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1
	[0058.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.069] lstrlenW (lpString=".doc") returned 4
	[0058.069] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.069] lstrlenW (lpString=".docx") returned 5
	[0058.069] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.069] lstrlenW (lpString=".pdf") returned 4
	[0058.069] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.069] lstrlenW (lpString=".xls") returned 4
	[0058.069] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.069] lstrlenW (lpString=".xlsx") returned 5
	[0058.069] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.069] lstrlenW (lpString=".ppt") returned 4
	[0058.069] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.069] lstrlenW (lpString=".zip") returned 4
	[0058.069] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.069] lstrlenW (lpString=".rar") returned 4
	[0058.069] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.069] lstrlenW (lpString=".bz2") returned 4
	[0058.069] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.069] lstrlenW (lpString=".7z") returned 3
	[0058.070] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.070] lstrlenW (lpString=".dbf") returned 4
	[0058.070] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.070] lstrlenW (lpString=".1cd") returned 4
	[0058.070] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.070] lstrlenW (lpString=".jpg") returned 4
	[0058.070] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.070] lstrlenW (lpString=".doc") returned 4
	[0058.070] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.070] lstrlenW (lpString=".docx") returned 5
	[0058.070] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.070] lstrlenW (lpString=".pdf") returned 4
	[0058.070] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.070] lstrlenW (lpString=".xls") returned 4
	[0058.070] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.070] lstrlenW (lpString=".xlsx") returned 5
	[0058.070] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.070] lstrlenW (lpString=".ppt") returned 4
	[0058.071] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.071] lstrlenW (lpString=".zip") returned 4
	[0058.071] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.071] lstrlenW (lpString=".rar") returned 4
	[0058.071] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.071] lstrlenW (lpString=".bz2") returned 4
	[0058.071] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.071] lstrlenW (lpString=".7z") returned 3
	[0058.071] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.071] lstrlenW (lpString=".dbf") returned 4
	[0058.071] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.071] lstrlenW (lpString=".1cd") returned 4
	[0058.071] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0058.071] lstrlenW (lpString=".jpg") returned 4
	[0058.071] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.071] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0058.071] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0058.071] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0058.072] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=80970) returned 1
	[0058.072] CloseHandle (hObject=0x2fc) returned 1
	[0058.072] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80
	[0058.072] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.072] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0058.072] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.072] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.072] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0058.072] GetLastError () returned 0x0
	[0058.073] ReadFile (in: hFile=0x2fc, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x13c4a, lpOverlapped=0x0) returned 1
	[0058.075] WriteFile (in: hFile=0x304, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x13c50, lpOverlapped=0x0) returned 1
	[0058.077] ReadFile (in: hFile=0x2fc, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.077] WriteFile (in: hFile=0x304, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0058.078] SetEndOfFile (hFile=0x304) returned 1
	[0058.078] CloseHandle (hObject=0x304) returned 1
	[0058.080] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.080] SetEndOfFile (hFile=0x2fc) returned 1
	[0058.081] CloseHandle (hObject=0x2fc) returned 1
	[0058.081] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.082] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1
	[0058.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.082] lstrlenW (lpString=".doc") returned 4
	[0058.082] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.082] lstrlenW (lpString=".docx") returned 5
	[0058.082] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.082] lstrlenW (lpString=".pdf") returned 4
	[0058.082] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.082] lstrlenW (lpString=".xls") returned 4
	[0058.082] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.082] lstrlenW (lpString=".xlsx") returned 5
	[0058.082] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.082] lstrlenW (lpString=".ppt") returned 4
	[0058.082] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.082] lstrlenW (lpString=".zip") returned 4
	[0058.082] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.083] lstrlenW (lpString=".rar") returned 4
	[0058.083] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.083] lstrlenW (lpString=".bz2") returned 4
	[0058.083] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.083] lstrlenW (lpString=".7z") returned 3
	[0058.592] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.614] lstrlenW (lpString=".dbf") returned 4
	[0058.614] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.614] lstrlenW (lpString=".1cd") returned 4
	[0058.614] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.614] lstrlenW (lpString=".jpg") returned 4
	[0058.615] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.615] lstrlenW (lpString=".doc") returned 4
	[0058.615] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.615] lstrlenW (lpString=".docx") returned 5
	[0058.615] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.615] lstrlenW (lpString=".pdf") returned 4
	[0058.615] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.615] lstrlenW (lpString=".xls") returned 4
	[0058.615] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.615] lstrlenW (lpString=".xlsx") returned 5
	[0058.615] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.615] lstrlenW (lpString=".ppt") returned 4
	[0058.615] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.615] lstrlenW (lpString=".zip") returned 4
	[0058.615] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.615] lstrlenW (lpString=".rar") returned 4
	[0058.615] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.615] lstrlenW (lpString=".bz2") returned 4
	[0058.616] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.616] lstrlenW (lpString=".7z") returned 3
	[0058.616] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.616] lstrlenW (lpString=".dbf") returned 4
	[0058.616] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.616] lstrlenW (lpString=".1cd") returned 4
	[0058.616] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0058.616] lstrlenW (lpString=".jpg") returned 4
	[0058.616] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.616] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0058.616] lstrlenW (lpString="eula.rtf") returned 8
	[0058.616] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.617] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3188) returned 1
	[0058.617] CloseHandle (hObject=0x2f0) returned 1
	[0058.617] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80
	[0058.617] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.617] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.617] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.617] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.617] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0058.626] GetLastError () returned 0x0
	[0058.626] ReadFile (in: hFile=0x2f0, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xc74, lpOverlapped=0x0) returned 1
	[0058.629] WriteFile (in: hFile=0x2f4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xc80, lpOverlapped=0x0) returned 1
	[0058.630] ReadFile (in: hFile=0x2f0, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.630] WriteFile (in: hFile=0x2f4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0058.631] SetEndOfFile (hFile=0x2f4) returned 1
	[0058.631] CloseHandle (hObject=0x2f4) returned 1
	[0058.631] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.631] SetEndOfFile (hFile=0x2f0) returned 1
	[0058.632] CloseHandle (hObject=0x2f0) returned 1
	[0058.632] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.633] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1
	[0058.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.633] lstrlenW (lpString=".doc") returned 4
	[0058.633] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.633] lstrlenW (lpString=".docx") returned 5
	[0058.633] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.633] lstrlenW (lpString=".pdf") returned 4
	[0058.633] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.633] lstrlenW (lpString=".xls") returned 4
	[0058.633] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.633] lstrlenW (lpString=".xlsx") returned 5
	[0058.633] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.633] lstrlenW (lpString=".ppt") returned 4
	[0058.633] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.634] lstrlenW (lpString=".zip") returned 4
	[0058.634] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.634] lstrlenW (lpString=".rar") returned 4
	[0058.634] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.634] lstrlenW (lpString=".bz2") returned 4
	[0058.634] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.634] lstrlenW (lpString=".7z") returned 3
	[0058.634] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.634] lstrlenW (lpString=".dbf") returned 4
	[0058.634] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.634] lstrlenW (lpString=".1cd") returned 4
	[0058.634] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.634] lstrlenW (lpString=".jpg") returned 4
	[0058.634] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.634] lstrlenW (lpString=".doc") returned 4
	[0058.634] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.634] lstrlenW (lpString=".docx") returned 5
	[0058.634] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.634] lstrlenW (lpString=".pdf") returned 4
	[0058.635] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.635] lstrlenW (lpString=".xls") returned 4
	[0058.635] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.635] lstrlenW (lpString=".xlsx") returned 5
	[0058.635] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.635] lstrlenW (lpString=".ppt") returned 4
	[0058.635] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.635] lstrlenW (lpString=".zip") returned 4
	[0058.635] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.635] lstrlenW (lpString=".rar") returned 4
	[0058.635] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.635] lstrlenW (lpString=".bz2") returned 4
	[0058.635] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.635] lstrlenW (lpString=".7z") returned 3
	[0058.635] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.635] lstrlenW (lpString=".dbf") returned 4
	[0058.635] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.635] lstrlenW (lpString=".1cd") returned 4
	[0058.635] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0058.635] lstrlenW (lpString=".jpg") returned 4
	[0058.635] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.636] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0058.636] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0058.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.636] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=77232) returned 1
	[0058.637] CloseHandle (hObject=0x2f0) returned 1
	[0058.637] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80
	[0058.637] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.637] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.637] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.637] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.637] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0058.637] GetLastError () returned 0x0
	[0058.637] ReadFile (in: hFile=0x2f0, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x12db0, lpOverlapped=0x0) returned 1
	[0058.640] WriteFile (in: hFile=0x2f4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x12dc0, lpOverlapped=0x0) returned 1
	[0058.642] ReadFile (in: hFile=0x2f0, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.642] WriteFile (in: hFile=0x2f4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0058.642] SetEndOfFile (hFile=0x2f4) returned 1
	[0058.642] CloseHandle (hObject=0x2f4) returned 1
	[0058.644] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.644] SetEndOfFile (hFile=0x2f0) returned 1
	[0058.646] CloseHandle (hObject=0x2f0) returned 1
	[0058.646] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.646] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1
	[0058.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.646] lstrlenW (lpString=".doc") returned 4
	[0058.647] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.647] lstrlenW (lpString=".docx") returned 5
	[0058.647] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.647] lstrlenW (lpString=".pdf") returned 4
	[0058.647] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.647] lstrlenW (lpString=".xls") returned 4
	[0058.647] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.647] lstrlenW (lpString=".xlsx") returned 5
	[0058.647] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.647] lstrlenW (lpString=".ppt") returned 4
	[0058.647] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.647] lstrlenW (lpString=".zip") returned 4
	[0058.647] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.647] lstrlenW (lpString=".rar") returned 4
	[0058.647] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.647] lstrlenW (lpString=".bz2") returned 4
	[0058.647] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.647] lstrlenW (lpString=".7z") returned 3
	[0058.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.647] lstrlenW (lpString=".dbf") returned 4
	[0058.647] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.647] lstrlenW (lpString=".1cd") returned 4
	[0058.647] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.648] lstrlenW (lpString=".jpg") returned 4
	[0058.648] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.648] lstrlenW (lpString=".doc") returned 4
	[0058.648] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.648] lstrlenW (lpString=".docx") returned 5
	[0058.648] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.648] lstrlenW (lpString=".pdf") returned 4
	[0058.648] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.648] lstrlenW (lpString=".xls") returned 4
	[0058.648] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.648] lstrlenW (lpString=".xlsx") returned 5
	[0058.648] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.648] lstrlenW (lpString=".ppt") returned 4
	[0058.648] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.648] lstrlenW (lpString=".zip") returned 4
	[0058.648] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.648] lstrlenW (lpString=".rar") returned 4
	[0058.648] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.649] lstrlenW (lpString=".bz2") returned 4
	[0058.649] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.649] lstrlenW (lpString=".7z") returned 3
	[0058.649] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.649] lstrlenW (lpString=".dbf") returned 4
	[0058.649] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.649] lstrlenW (lpString=".1cd") returned 4
	[0058.649] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0058.649] lstrlenW (lpString=".jpg") returned 4
	[0058.649] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.649] Sleep (dwMilliseconds=0x64) 
	[0059.162] Sleep (dwMilliseconds=0x64) 
	[0059.539] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0059.539] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0059.539] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.898] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=72076) returned 1
	[0059.899] CloseHandle (hObject=0x33c) returned 1
	[0059.899] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80
	[0059.899] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.899] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.899] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.899] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.899] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0059.899] GetLastError () returned 0x0
	[0059.899] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1198c, lpOverlapped=0x0) returned 1
	[0059.903] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x11990, lpOverlapped=0x0) returned 1
	[0059.905] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.905] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0059.905] SetEndOfFile (hFile=0x340) returned 1
	[0059.905] CloseHandle (hObject=0x340) returned 1
	[0059.907] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.907] SetEndOfFile (hFile=0x33c) returned 1
	[0059.909] CloseHandle (hObject=0x33c) returned 1
	[0059.909] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.909] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1
	[0059.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.909] lstrlenW (lpString=".doc") returned 4
	[0059.909] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.909] lstrlenW (lpString=".docx") returned 5
	[0059.909] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.910] lstrlenW (lpString=".pdf") returned 4
	[0059.910] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.910] lstrlenW (lpString=".xls") returned 4
	[0059.910] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.910] lstrlenW (lpString=".xlsx") returned 5
	[0059.910] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.910] lstrlenW (lpString=".ppt") returned 4
	[0059.910] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.910] lstrlenW (lpString=".zip") returned 4
	[0059.910] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.910] lstrlenW (lpString=".rar") returned 4
	[0059.910] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.910] lstrlenW (lpString=".bz2") returned 4
	[0059.910] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.910] lstrlenW (lpString=".7z") returned 3
	[0059.910] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.910] lstrlenW (lpString=".dbf") returned 4
	[0059.910] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.910] lstrlenW (lpString=".1cd") returned 4
	[0059.910] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.910] lstrlenW (lpString=".jpg") returned 4
	[0059.910] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.911] lstrlenW (lpString=".doc") returned 4
	[0059.911] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.911] lstrlenW (lpString=".docx") returned 5
	[0059.911] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.911] lstrlenW (lpString=".pdf") returned 4
	[0059.911] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.911] lstrlenW (lpString=".xls") returned 4
	[0059.911] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.911] lstrlenW (lpString=".xlsx") returned 5
	[0059.911] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.911] lstrlenW (lpString=".ppt") returned 4
	[0059.911] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.911] lstrlenW (lpString=".zip") returned 4
	[0059.911] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.911] lstrlenW (lpString=".rar") returned 4
	[0059.911] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.911] lstrlenW (lpString=".bz2") returned 4
	[0059.911] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.911] lstrlenW (lpString=".7z") returned 3
	[0059.911] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.911] lstrlenW (lpString=".dbf") returned 4
	[0059.911] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.911] lstrlenW (lpString=".1cd") returned 4
	[0059.912] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0059.912] lstrlenW (lpString=".jpg") returned 4
	[0059.912] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.912] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0059.912] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0059.912] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.912] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=79634) returned 1
	[0059.912] CloseHandle (hObject=0x33c) returned 1
	[0059.915] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80
	[0059.915] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.916] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.916] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.916] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.916] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0059.919] GetLastError () returned 0x0
	[0059.919] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x13712, lpOverlapped=0x0) returned 1
	[0059.922] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x13720, lpOverlapped=0x0) returned 1
	[0059.924] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.924] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0059.924] SetEndOfFile (hFile=0x340) returned 1
	[0059.926] CloseHandle (hObject=0x340) returned 1
	[0059.928] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.928] SetEndOfFile (hFile=0x33c) returned 1
	[0059.929] CloseHandle (hObject=0x33c) returned 1
	[0059.929] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.930] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1
	[0059.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.930] lstrlenW (lpString=".doc") returned 4
	[0059.930] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.930] lstrlenW (lpString=".docx") returned 5
	[0059.930] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.930] lstrlenW (lpString=".pdf") returned 4
	[0059.930] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.930] lstrlenW (lpString=".xls") returned 4
	[0059.930] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.930] lstrlenW (lpString=".xlsx") returned 5
	[0059.930] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.930] lstrlenW (lpString=".ppt") returned 4
	[0059.930] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.930] lstrlenW (lpString=".zip") returned 4
	[0059.930] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.930] lstrlenW (lpString=".rar") returned 4
	[0059.931] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.931] lstrlenW (lpString=".bz2") returned 4
	[0059.931] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.931] lstrlenW (lpString=".7z") returned 3
	[0059.931] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.931] lstrlenW (lpString=".dbf") returned 4
	[0059.931] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.931] lstrlenW (lpString=".1cd") returned 4
	[0059.931] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.931] lstrlenW (lpString=".jpg") returned 4
	[0059.931] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.931] lstrlenW (lpString=".doc") returned 4
	[0059.931] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.931] lstrlenW (lpString=".docx") returned 5
	[0059.931] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.931] lstrlenW (lpString=".pdf") returned 4
	[0059.931] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.931] lstrlenW (lpString=".xls") returned 4
	[0059.931] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.931] lstrlenW (lpString=".xlsx") returned 5
	[0059.931] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.932] lstrlenW (lpString=".ppt") returned 4
	[0059.932] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.932] lstrlenW (lpString=".zip") returned 4
	[0059.932] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.932] lstrlenW (lpString=".rar") returned 4
	[0059.932] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.932] lstrlenW (lpString=".bz2") returned 4
	[0059.932] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.932] lstrlenW (lpString=".7z") returned 3
	[0059.932] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.932] lstrlenW (lpString=".dbf") returned 4
	[0059.932] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.932] lstrlenW (lpString=".1cd") returned 4
	[0059.932] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0059.932] lstrlenW (lpString=".jpg") returned 4
	[0059.932] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.932] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0059.933] lstrlenW (lpString="eula.rtf") returned 8
	[0059.933] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.933] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3046) returned 1
	[0059.933] CloseHandle (hObject=0x33c) returned 1
	[0059.933] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80
	[0059.933] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.933] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.933] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.933] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.933] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0059.935] GetLastError () returned 0x0
	[0059.935] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xbe6, lpOverlapped=0x0) returned 1
	[0059.948] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xbf0, lpOverlapped=0x0) returned 1
	[0059.949] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.949] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0059.950] SetEndOfFile (hFile=0x340) returned 1
	[0059.950] CloseHandle (hObject=0x340) returned 1
	[0059.950] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.950] SetEndOfFile (hFile=0x33c) returned 1
	[0059.951] CloseHandle (hObject=0x33c) returned 1
	[0059.951] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.952] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1
	[0059.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.952] lstrlenW (lpString=".doc") returned 4
	[0059.952] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.952] lstrlenW (lpString=".docx") returned 5
	[0059.952] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.952] lstrlenW (lpString=".pdf") returned 4
	[0059.952] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.952] lstrlenW (lpString=".xls") returned 4
	[0059.952] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.952] lstrlenW (lpString=".xlsx") returned 5
	[0059.952] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.952] lstrlenW (lpString=".ppt") returned 4
	[0059.952] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.952] lstrlenW (lpString=".zip") returned 4
	[0059.952] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.952] lstrlenW (lpString=".rar") returned 4
	[0059.953] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.953] lstrlenW (lpString=".bz2") returned 4
	[0059.953] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.953] lstrlenW (lpString=".7z") returned 3
	[0059.953] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.953] lstrlenW (lpString=".dbf") returned 4
	[0059.953] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.953] lstrlenW (lpString=".1cd") returned 4
	[0059.953] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.953] lstrlenW (lpString=".jpg") returned 4
	[0059.953] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.953] lstrlenW (lpString=".doc") returned 4
	[0059.953] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.953] lstrlenW (lpString=".docx") returned 5
	[0059.953] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.953] lstrlenW (lpString=".pdf") returned 4
	[0059.953] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.954] lstrlenW (lpString=".xls") returned 4
	[0059.954] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.954] lstrlenW (lpString=".xlsx") returned 5
	[0059.954] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.954] lstrlenW (lpString=".ppt") returned 4
	[0059.954] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.954] lstrlenW (lpString=".zip") returned 4
	[0059.954] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.954] lstrlenW (lpString=".rar") returned 4
	[0059.954] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.954] lstrlenW (lpString=".bz2") returned 4
	[0059.954] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.954] lstrlenW (lpString=".7z") returned 3
	[0059.954] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.954] lstrlenW (lpString=".dbf") returned 4
	[0059.954] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.954] lstrlenW (lpString=".1cd") returned 4
	[0059.954] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0059.955] lstrlenW (lpString=".jpg") returned 4
	[0059.955] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.955] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0059.955] lstrlenW (lpString="eula.rtf") returned 8
	[0059.955] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.955] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=4040) returned 1
	[0059.955] CloseHandle (hObject=0x33c) returned 1
	[0059.955] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80
	[0059.955] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.955] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.956] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.956] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.956] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0059.980] GetLastError () returned 0x0
	[0059.980] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xfc8, lpOverlapped=0x0) returned 1
	[0059.981] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xfd0, lpOverlapped=0x0) returned 1
	[0059.982] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.982] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0059.983] SetEndOfFile (hFile=0x340) returned 1
	[0059.983] CloseHandle (hObject=0x340) returned 1
	[0059.983] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.983] SetEndOfFile (hFile=0x33c) returned 1
	[0059.984] CloseHandle (hObject=0x33c) returned 1
	[0059.984] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.985] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1
	[0059.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.985] lstrlenW (lpString=".doc") returned 4
	[0059.985] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.985] lstrlenW (lpString=".docx") returned 5
	[0059.985] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.985] lstrlenW (lpString=".pdf") returned 4
	[0059.985] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.985] lstrlenW (lpString=".xls") returned 4
	[0059.985] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.985] lstrlenW (lpString=".xlsx") returned 5
	[0059.985] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.985] lstrlenW (lpString=".ppt") returned 4
	[0059.985] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.985] lstrlenW (lpString=".zip") returned 4
	[0059.985] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.986] lstrlenW (lpString=".rar") returned 4
	[0059.986] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.986] lstrlenW (lpString=".bz2") returned 4
	[0059.986] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.986] lstrlenW (lpString=".7z") returned 3
	[0059.986] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.986] lstrlenW (lpString=".dbf") returned 4
	[0059.986] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.986] lstrlenW (lpString=".1cd") returned 4
	[0059.986] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.986] lstrlenW (lpString=".jpg") returned 4
	[0059.986] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.986] lstrlenW (lpString=".doc") returned 4
	[0059.986] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.986] lstrlenW (lpString=".docx") returned 5
	[0059.986] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.986] lstrlenW (lpString=".pdf") returned 4
	[0059.986] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.986] lstrlenW (lpString=".xls") returned 4
	[0059.986] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.986] lstrlenW (lpString=".xlsx") returned 5
	[0059.986] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.986] lstrlenW (lpString=".ppt") returned 4
	[0059.987] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.987] lstrlenW (lpString=".zip") returned 4
	[0059.987] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.987] lstrlenW (lpString=".rar") returned 4
	[0059.987] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.987] lstrlenW (lpString=".bz2") returned 4
	[0059.987] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.987] lstrlenW (lpString=".7z") returned 3
	[0059.987] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.987] lstrlenW (lpString=".dbf") returned 4
	[0059.987] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.987] lstrlenW (lpString=".1cd") returned 4
	[0059.987] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0059.987] lstrlenW (lpString=".jpg") returned 4
	[0059.987] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.987] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0059.988] lstrlenW (lpString="eula.rtf") returned 8
	[0059.988] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.988] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3683) returned 1
	[0059.988] CloseHandle (hObject=0x33c) returned 1
	[0059.988] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80
	[0059.988] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.988] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.988] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.988] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.988] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0059.991] GetLastError () returned 0x0
	[0059.991] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xe63, lpOverlapped=0x0) returned 1
	[0059.992] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe70, lpOverlapped=0x0) returned 1
	[0059.993] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.993] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0059.993] SetEndOfFile (hFile=0x340) returned 1
	[0059.993] CloseHandle (hObject=0x340) returned 1
	[0059.994] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.994] SetEndOfFile (hFile=0x33c) returned 1
	[0059.995] CloseHandle (hObject=0x33c) returned 1
	[0059.995] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.995] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1
	[0059.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.996] lstrlenW (lpString=".doc") returned 4
	[0059.996] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.996] lstrlenW (lpString=".docx") returned 5
	[0059.996] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.996] lstrlenW (lpString=".pdf") returned 4
	[0059.996] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.996] lstrlenW (lpString=".xls") returned 4
	[0059.996] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.996] lstrlenW (lpString=".xlsx") returned 5
	[0059.996] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.996] lstrlenW (lpString=".ppt") returned 4
	[0059.996] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.996] lstrlenW (lpString=".zip") returned 4
	[0059.996] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.996] lstrlenW (lpString=".rar") returned 4
	[0059.996] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.996] lstrlenW (lpString=".bz2") returned 4
	[0059.996] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.996] lstrlenW (lpString=".7z") returned 3
	[0059.996] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.996] lstrlenW (lpString=".dbf") returned 4
	[0059.996] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.996] lstrlenW (lpString=".1cd") returned 4
	[0059.997] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.997] lstrlenW (lpString=".jpg") returned 4
	[0059.997] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.997] lstrlenW (lpString=".doc") returned 4
	[0059.997] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.997] lstrlenW (lpString=".docx") returned 5
	[0059.997] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.997] lstrlenW (lpString=".pdf") returned 4
	[0059.997] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.997] lstrlenW (lpString=".xls") returned 4
	[0059.997] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.997] lstrlenW (lpString=".xlsx") returned 5
	[0059.997] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.997] lstrlenW (lpString=".ppt") returned 4
	[0059.997] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.997] lstrlenW (lpString=".zip") returned 4
	[0059.997] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.997] lstrlenW (lpString=".rar") returned 4
	[0059.997] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.997] lstrlenW (lpString=".bz2") returned 4
	[0059.997] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.997] lstrlenW (lpString=".7z") returned 3
	[0059.997] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.998] lstrlenW (lpString=".dbf") returned 4
	[0059.998] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.998] lstrlenW (lpString=".1cd") returned 4
	[0059.998] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0059.998] lstrlenW (lpString=".jpg") returned 4
	[0059.998] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.998] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0059.998] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0059.998] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.998] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=80738) returned 1
	[0059.998] CloseHandle (hObject=0x33c) returned 1
	[0059.998] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80
	[0059.998] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.998] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0059.999] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.999] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.999] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0059.999] GetLastError () returned 0x0
	[0059.999] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x13b62, lpOverlapped=0x0) returned 1
	[0060.001] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x13b70, lpOverlapped=0x0) returned 1
	[0060.003] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.004] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.004] SetEndOfFile (hFile=0x340) returned 1
	[0060.004] CloseHandle (hObject=0x340) returned 1
	[0060.006] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.006] SetEndOfFile (hFile=0x33c) returned 1
	[0060.007] CloseHandle (hObject=0x33c) returned 1
	[0060.008] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.008] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1
	[0060.008] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.008] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.008] lstrlenW (lpString=".doc") returned 4
	[0060.008] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.008] lstrlenW (lpString=".docx") returned 5
	[0060.008] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.008] lstrlenW (lpString=".pdf") returned 4
	[0060.008] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.008] lstrlenW (lpString=".xls") returned 4
	[0060.008] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.008] lstrlenW (lpString=".xlsx") returned 5
	[0060.008] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.008] lstrlenW (lpString=".ppt") returned 4
	[0060.009] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.009] lstrlenW (lpString=".zip") returned 4
	[0060.009] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.009] lstrlenW (lpString=".rar") returned 4
	[0060.009] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.009] lstrlenW (lpString=".bz2") returned 4
	[0060.009] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.009] lstrlenW (lpString=".7z") returned 3
	[0060.009] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.009] lstrlenW (lpString=".dbf") returned 4
	[0060.009] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.009] lstrlenW (lpString=".1cd") returned 4
	[0060.009] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.009] lstrlenW (lpString=".jpg") returned 4
	[0060.009] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.009] lstrlenW (lpString=".doc") returned 4
	[0060.009] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.010] lstrlenW (lpString=".docx") returned 5
	[0060.010] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.010] lstrlenW (lpString=".pdf") returned 4
	[0060.010] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.010] lstrlenW (lpString=".xls") returned 4
	[0060.010] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.010] lstrlenW (lpString=".xlsx") returned 5
	[0060.010] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.010] lstrlenW (lpString=".ppt") returned 4
	[0060.010] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.010] lstrlenW (lpString=".zip") returned 4
	[0060.010] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.010] lstrlenW (lpString=".rar") returned 4
	[0060.010] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.010] lstrlenW (lpString=".bz2") returned 4
	[0060.010] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.010] lstrlenW (lpString=".7z") returned 3
	[0060.010] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.010] lstrlenW (lpString=".dbf") returned 4
	[0060.010] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.010] lstrlenW (lpString=".1cd") returned 4
	[0060.010] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0060.011] lstrlenW (lpString=".jpg") returned 4
	[0060.011] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.011] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0060.011] lstrlenW (lpString="eula.rtf") returned 8
	[0060.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.012] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=54456) returned 1
	[0060.012] CloseHandle (hObject=0x340) returned 1
	[0060.012] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80
	[0060.012] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.012] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.012] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.012] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0060.045] GetLastError () returned 0x0
	[0060.047] ReadFile (in: hFile=0x340, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xd4b8, lpOverlapped=0x0) returned 1
	[0060.100] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xd4c0, lpOverlapped=0x0) returned 1
	[0060.102] ReadFile (in: hFile=0x340, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.102] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.102] SetEndOfFile (hFile=0x344) returned 1
	[0060.102] CloseHandle (hObject=0x344) returned 1
	[0060.104] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.104] SetEndOfFile (hFile=0x340) returned 1
	[0060.106] CloseHandle (hObject=0x340) returned 1
	[0060.106] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.107] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1
	[0060.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.107] lstrlenW (lpString=".doc") returned 4
	[0060.107] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.107] lstrlenW (lpString=".docx") returned 5
	[0060.107] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.107] lstrlenW (lpString=".pdf") returned 4
	[0060.107] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.107] lstrlenW (lpString=".xls") returned 4
	[0060.107] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.107] lstrlenW (lpString=".xlsx") returned 5
	[0060.107] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.107] lstrlenW (lpString=".ppt") returned 4
	[0060.107] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.107] lstrlenW (lpString=".zip") returned 4
	[0060.108] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.108] lstrlenW (lpString=".rar") returned 4
	[0060.108] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.108] lstrlenW (lpString=".bz2") returned 4
	[0060.108] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.108] lstrlenW (lpString=".7z") returned 3
	[0060.108] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.108] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.108] lstrlenW (lpString=".dbf") returned 4
	[0060.108] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.108] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.108] lstrlenW (lpString=".1cd") returned 4
	[0060.108] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.108] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.108] lstrlenW (lpString=".jpg") returned 4
	[0060.108] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.108] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.108] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.108] lstrlenW (lpString=".doc") returned 4
	[0060.108] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.108] lstrlenW (lpString=".docx") returned 5
	[0060.108] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.108] lstrlenW (lpString=".pdf") returned 4
	[0060.108] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.108] lstrlenW (lpString=".xls") returned 4
	[0060.108] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.108] lstrlenW (lpString=".xlsx") returned 5
	[0060.108] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.108] lstrlenW (lpString=".ppt") returned 4
	[0060.108] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.109] lstrlenW (lpString=".zip") returned 4
	[0060.109] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.109] lstrlenW (lpString=".rar") returned 4
	[0060.109] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.109] lstrlenW (lpString=".bz2") returned 4
	[0060.109] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.109] lstrlenW (lpString=".7z") returned 3
	[0060.109] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.109] lstrlenW (lpString=".dbf") returned 4
	[0060.109] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.109] lstrlenW (lpString=".1cd") returned 4
	[0060.109] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0060.109] lstrlenW (lpString=".jpg") returned 4
	[0060.109] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.109] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0060.109] lstrlenW (lpString="eula.rtf") returned 8
	[0060.109] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.110] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3859) returned 1
	[0060.110] CloseHandle (hObject=0x340) returned 1
	[0060.110] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80
	[0060.110] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.110] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.110] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.110] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.110] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0060.112] GetLastError () returned 0x0
	[0060.112] ReadFile (in: hFile=0x340, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xf13, lpOverlapped=0x0) returned 1
	[0060.113] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xf20, lpOverlapped=0x0) returned 1
	[0060.114] ReadFile (in: hFile=0x340, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.114] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.114] SetEndOfFile (hFile=0x344) returned 1
	[0060.114] CloseHandle (hObject=0x344) returned 1
	[0060.115] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.115] SetEndOfFile (hFile=0x340) returned 1
	[0060.116] CloseHandle (hObject=0x340) returned 1
	[0060.116] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.116] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1
	[0060.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.117] lstrlenW (lpString=".doc") returned 4
	[0060.117] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.117] lstrlenW (lpString=".docx") returned 5
	[0060.117] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.117] lstrlenW (lpString=".pdf") returned 4
	[0060.117] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.117] lstrlenW (lpString=".xls") returned 4
	[0060.117] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.117] lstrlenW (lpString=".xlsx") returned 5
	[0060.117] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.117] lstrlenW (lpString=".ppt") returned 4
	[0060.117] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.117] lstrlenW (lpString=".zip") returned 4
	[0060.117] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.117] lstrlenW (lpString=".rar") returned 4
	[0060.117] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.117] lstrlenW (lpString=".bz2") returned 4
	[0060.117] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.117] lstrlenW (lpString=".7z") returned 3
	[0060.117] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.117] lstrlenW (lpString=".dbf") returned 4
	[0060.117] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.117] lstrlenW (lpString=".1cd") returned 4
	[0060.118] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.118] lstrlenW (lpString=".jpg") returned 4
	[0060.118] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.118] lstrlenW (lpString=".doc") returned 4
	[0060.118] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.118] lstrlenW (lpString=".docx") returned 5
	[0060.118] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.118] lstrlenW (lpString=".pdf") returned 4
	[0060.118] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.118] lstrlenW (lpString=".xls") returned 4
	[0060.118] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.118] lstrlenW (lpString=".xlsx") returned 5
	[0060.118] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.118] lstrlenW (lpString=".ppt") returned 4
	[0060.118] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.118] lstrlenW (lpString=".zip") returned 4
	[0060.118] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.118] lstrlenW (lpString=".rar") returned 4
	[0060.118] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.118] lstrlenW (lpString=".bz2") returned 4
	[0060.118] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.119] lstrlenW (lpString=".7z") returned 3
	[0060.119] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.119] lstrlenW (lpString=".dbf") returned 4
	[0060.119] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.119] lstrlenW (lpString=".1cd") returned 4
	[0060.119] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0060.119] lstrlenW (lpString=".jpg") returned 4
	[0060.119] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.119] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.119] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.119] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.119] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=76818) returned 1
	[0060.119] CloseHandle (hObject=0x340) returned 1
	[0060.119] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80
	[0060.120] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.120] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.120] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.120] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.120] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0060.120] GetLastError () returned 0x0
	[0060.120] ReadFile (in: hFile=0x340, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x12c12, lpOverlapped=0x0) returned 1
	[0060.123] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x12c20, lpOverlapped=0x0) returned 1
	[0060.125] ReadFile (in: hFile=0x340, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.125] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.125] SetEndOfFile (hFile=0x344) returned 1
	[0060.125] CloseHandle (hObject=0x344) returned 1
	[0060.127] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.127] SetEndOfFile (hFile=0x340) returned 1
	[0060.128] CloseHandle (hObject=0x340) returned 1
	[0060.128] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.128] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1
	[0060.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.129] lstrlenW (lpString=".doc") returned 4
	[0060.129] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.129] lstrlenW (lpString=".docx") returned 5
	[0060.129] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.129] lstrlenW (lpString=".pdf") returned 4
	[0060.129] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.129] lstrlenW (lpString=".xls") returned 4
	[0060.129] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.129] lstrlenW (lpString=".xlsx") returned 5
	[0060.129] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.129] lstrlenW (lpString=".ppt") returned 4
	[0060.129] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.129] lstrlenW (lpString=".zip") returned 4
	[0060.129] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.129] lstrlenW (lpString=".rar") returned 4
	[0060.129] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.129] lstrlenW (lpString=".bz2") returned 4
	[0060.129] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.129] lstrlenW (lpString=".7z") returned 3
	[0060.130] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.130] lstrlenW (lpString=".dbf") returned 4
	[0060.130] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.130] lstrlenW (lpString=".1cd") returned 4
	[0060.130] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.130] lstrlenW (lpString=".jpg") returned 4
	[0060.130] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.130] lstrlenW (lpString=".doc") returned 4
	[0060.130] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.130] lstrlenW (lpString=".docx") returned 5
	[0060.130] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.130] lstrlenW (lpString=".pdf") returned 4
	[0060.130] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.130] lstrlenW (lpString=".xls") returned 4
	[0060.130] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.130] lstrlenW (lpString=".xlsx") returned 5
	[0060.130] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.130] lstrlenW (lpString=".ppt") returned 4
	[0060.130] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.130] lstrlenW (lpString=".zip") returned 4
	[0060.130] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.130] lstrlenW (lpString=".rar") returned 4
	[0060.131] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.131] lstrlenW (lpString=".bz2") returned 4
	[0060.131] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.131] lstrlenW (lpString=".7z") returned 3
	[0060.131] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.131] lstrlenW (lpString=".dbf") returned 4
	[0060.131] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.131] lstrlenW (lpString=".1cd") returned 4
	[0060.131] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0060.131] lstrlenW (lpString=".jpg") returned 4
	[0060.131] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.131] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0060.131] lstrlenW (lpString="eula.rtf") returned 8
	[0060.131] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.131] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=5827) returned 1
	[0060.132] CloseHandle (hObject=0x340) returned 1
	[0060.132] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80
	[0060.132] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.132] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.132] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.132] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.132] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.492] GetLastError () returned 0x0
	[0060.492] ReadFile (in: hFile=0x340, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x16c3, lpOverlapped=0x0) returned 1
	[0060.494] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x16d0, lpOverlapped=0x0) returned 1
	[0060.495] ReadFile (in: hFile=0x340, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.495] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.495] SetEndOfFile (hFile=0x314) returned 1
	[0060.495] CloseHandle (hObject=0x314) returned 1
	[0060.496] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.496] SetEndOfFile (hFile=0x340) returned 1
	[0060.497] CloseHandle (hObject=0x340) returned 1
	[0060.497] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.497] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1
	[0060.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.498] lstrlenW (lpString=".doc") returned 4
	[0060.498] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.498] lstrlenW (lpString=".docx") returned 5
	[0060.498] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.498] lstrlenW (lpString=".pdf") returned 4
	[0060.498] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.498] lstrlenW (lpString=".xls") returned 4
	[0060.498] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.498] lstrlenW (lpString=".xlsx") returned 5
	[0060.498] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.498] lstrlenW (lpString=".ppt") returned 4
	[0060.498] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.498] lstrlenW (lpString=".zip") returned 4
	[0060.498] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.498] lstrlenW (lpString=".rar") returned 4
	[0060.498] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.498] lstrlenW (lpString=".bz2") returned 4
	[0060.498] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.498] lstrlenW (lpString=".7z") returned 3
	[0060.498] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.498] lstrlenW (lpString=".dbf") returned 4
	[0060.498] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.498] lstrlenW (lpString=".1cd") returned 4
	[0060.499] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.499] lstrlenW (lpString=".jpg") returned 4
	[0060.499] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.499] lstrlenW (lpString=".doc") returned 4
	[0060.499] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.499] lstrlenW (lpString=".docx") returned 5
	[0060.499] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.499] lstrlenW (lpString=".pdf") returned 4
	[0060.499] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.499] lstrlenW (lpString=".xls") returned 4
	[0060.499] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.499] lstrlenW (lpString=".xlsx") returned 5
	[0060.499] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.499] lstrlenW (lpString=".ppt") returned 4
	[0060.499] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.499] lstrlenW (lpString=".zip") returned 4
	[0060.499] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.499] lstrlenW (lpString=".rar") returned 4
	[0060.499] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.500] lstrlenW (lpString=".bz2") returned 4
	[0060.500] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.500] lstrlenW (lpString=".7z") returned 3
	[0060.500] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.500] lstrlenW (lpString=".dbf") returned 4
	[0060.500] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.500] lstrlenW (lpString=".1cd") returned 4
	[0060.500] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0060.500] lstrlenW (lpString=".jpg") returned 4
	[0060.500] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.500] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.500] lstrlenW (lpString="Parameterinfo.xml") returned 17
	[0060.500] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.501] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=201796) returned 1
	[0060.501] CloseHandle (hObject=0x340) returned 1
	[0060.501] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80
	[0060.501] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.501] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.501] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.501] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.501] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.501] GetLastError () returned 0x0
	[0060.501] ReadFile (in: hFile=0x340, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x31444, lpOverlapped=0x0) returned 1
	[0060.506] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x31450, lpOverlapped=0x0) returned 1
	[0060.510] ReadFile (in: hFile=0x340, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.510] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.510] SetEndOfFile (hFile=0x314) returned 1
	[0060.510] CloseHandle (hObject=0x314) returned 1
	[0060.516] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.516] SetEndOfFile (hFile=0x340) returned 1
	[0060.518] CloseHandle (hObject=0x340) returned 1
	[0060.518] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.518] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1
	[0060.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.519] lstrlenW (lpString=".doc") returned 4
	[0060.519] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.519] lstrlenW (lpString=".docx") returned 5
	[0060.519] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0060.519] lstrlenW (lpString=".pdf") returned 4
	[0060.519] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.519] lstrlenW (lpString=".xls") returned 4
	[0060.519] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.519] lstrlenW (lpString=".xlsx") returned 5
	[0060.519] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0060.519] lstrlenW (lpString=".ppt") returned 4
	[0060.519] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.519] lstrlenW (lpString=".zip") returned 4
	[0060.519] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.519] lstrlenW (lpString=".rar") returned 4
	[0060.519] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.519] lstrlenW (lpString=".bz2") returned 4
	[0060.519] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.519] lstrlenW (lpString=".7z") returned 3
	[0060.520] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.520] lstrlenW (lpString=".dbf") returned 4
	[0060.520] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.520] lstrlenW (lpString=".1cd") returned 4
	[0060.520] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.520] lstrlenW (lpString=".jpg") returned 4
	[0060.520] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.520] lstrlenW (lpString=".doc") returned 4
	[0060.520] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.520] lstrlenW (lpString=".docx") returned 5
	[0060.520] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0060.520] lstrlenW (lpString=".pdf") returned 4
	[0060.520] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.520] lstrlenW (lpString=".xls") returned 4
	[0060.520] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.520] lstrlenW (lpString=".xlsx") returned 5
	[0060.520] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0060.520] lstrlenW (lpString=".ppt") returned 4
	[0060.520] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.521] lstrlenW (lpString=".zip") returned 4
	[0060.521] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.521] lstrlenW (lpString=".rar") returned 4
	[0060.521] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.521] lstrlenW (lpString=".bz2") returned 4
	[0060.521] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.521] lstrlenW (lpString=".7z") returned 3
	[0060.521] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.521] lstrlenW (lpString=".dbf") returned 4
	[0060.521] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.521] lstrlenW (lpString=".1cd") returned 4
	[0060.521] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0060.521] lstrlenW (lpString=".jpg") returned 4
	[0060.521] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.521] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.521] lstrlenW (lpString="UiInfo.xml") returned 10
	[0060.521] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.522] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=39042) returned 1
	[0060.522] CloseHandle (hObject=0x314) returned 1
	[0060.522] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80
	[0060.522] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.522] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.522] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.523] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.524] GetLastError () returned 0x0
	[0060.524] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x9882, lpOverlapped=0x0) returned 1
	[0061.006] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x9890, lpOverlapped=0x0) returned 1
	[0061.007] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.007] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0061.008] SetEndOfFile (hFile=0x340) returned 1
	[0061.008] CloseHandle (hObject=0x340) returned 1
	[0061.009] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.009] SetEndOfFile (hFile=0x314) returned 1
	[0061.010] CloseHandle (hObject=0x314) returned 1
	[0061.010] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.010] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1
	[0061.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.011] lstrlenW (lpString=".doc") returned 4
	[0061.011] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.011] lstrlenW (lpString=".docx") returned 5
	[0061.011] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0061.011] lstrlenW (lpString=".pdf") returned 4
	[0061.011] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.011] lstrlenW (lpString=".xls") returned 4
	[0061.011] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.011] lstrlenW (lpString=".xlsx") returned 5
	[0061.011] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0061.011] lstrlenW (lpString=".ppt") returned 4
	[0061.011] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.011] lstrlenW (lpString=".zip") returned 4
	[0061.011] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.011] lstrlenW (lpString=".rar") returned 4
	[0061.011] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.011] lstrlenW (lpString=".bz2") returned 4
	[0061.012] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.012] lstrlenW (lpString=".7z") returned 3
	[0061.012] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.012] lstrlenW (lpString=".dbf") returned 4
	[0061.012] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.012] lstrlenW (lpString=".1cd") returned 4
	[0061.012] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.012] lstrlenW (lpString=".jpg") returned 4
	[0061.012] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.012] lstrlenW (lpString=".doc") returned 4
	[0061.012] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.012] lstrlenW (lpString=".docx") returned 5
	[0061.012] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0061.013] lstrlenW (lpString=".pdf") returned 4
	[0061.013] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.013] lstrlenW (lpString=".xls") returned 4
	[0061.013] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.013] lstrlenW (lpString=".xlsx") returned 5
	[0061.013] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0061.013] lstrlenW (lpString=".ppt") returned 4
	[0061.013] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.013] lstrlenW (lpString=".zip") returned 4
	[0061.013] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.013] lstrlenW (lpString=".rar") returned 4
	[0061.013] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.013] lstrlenW (lpString=".bz2") returned 4
	[0061.013] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.013] lstrlenW (lpString=".7z") returned 3
	[0061.013] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.013] lstrlenW (lpString=".dbf") returned 4
	[0061.013] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.014] lstrlenW (lpString=".1cd") returned 4
	[0061.014] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0061.014] lstrlenW (lpString=".jpg") returned 4
	[0061.014] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.014] lstrcmpiW (lpString1=".bmp", lpString2=".money") returned -1
	[0061.014] lstrlenW (lpString="watermark.bmp") returned 13
	[0061.014] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0061.014] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=104072) returned 1
	[0061.014] CloseHandle (hObject=0x314) returned 1
	[0061.014] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80
	[0061.015] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.015] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0061.015] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.015] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.015] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0061.015] GetLastError () returned 0x0
	[0061.015] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x19688, lpOverlapped=0x0) returned 1
	[0061.018] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x19690, lpOverlapped=0x0) returned 1
	[0061.021] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.021] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xee, lpOverlapped=0x0) returned 1
	[0061.021] SetEndOfFile (hFile=0x340) returned 1
	[0061.021] CloseHandle (hObject=0x340) returned 1
	[0061.024] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.024] SetEndOfFile (hFile=0x314) returned 1
	[0061.025] CloseHandle (hObject=0x314) returned 1
	[0061.025] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.026] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1
	[0061.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.026] lstrlenW (lpString=".doc") returned 4
	[0061.026] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0061.026] lstrlenW (lpString=".docx") returned 5
	[0061.026] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1
	[0061.026] lstrlenW (lpString=".pdf") returned 4
	[0061.026] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0061.026] lstrlenW (lpString=".xls") returned 4
	[0061.026] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0061.026] lstrlenW (lpString=".xlsx") returned 5
	[0061.027] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1
	[0061.027] lstrlenW (lpString=".ppt") returned 4
	[0061.027] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0061.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.027] lstrlenW (lpString=".zip") returned 4
	[0061.027] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0061.027] lstrlenW (lpString=".rar") returned 4
	[0061.027] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0061.027] lstrlenW (lpString=".bz2") returned 4
	[0061.027] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0061.027] lstrlenW (lpString=".7z") returned 3
	[0061.027] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0061.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.027] lstrlenW (lpString=".dbf") returned 4
	[0061.027] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0061.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.027] lstrlenW (lpString=".1cd") returned 4
	[0061.027] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0061.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.027] lstrlenW (lpString=".jpg") returned 4
	[0061.027] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0061.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.027] lstrlenW (lpString=".doc") returned 4
	[0061.028] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0061.028] lstrlenW (lpString=".docx") returned 5
	[0061.028] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1
	[0061.028] lstrlenW (lpString=".pdf") returned 4
	[0061.028] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0061.028] lstrlenW (lpString=".xls") returned 4
	[0061.028] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0061.028] lstrlenW (lpString=".xlsx") returned 5
	[0061.028] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1
	[0061.028] lstrlenW (lpString=".ppt") returned 4
	[0061.028] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0061.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.028] lstrlenW (lpString=".zip") returned 4
	[0061.028] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0061.028] lstrlenW (lpString=".rar") returned 4
	[0061.028] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0061.028] lstrlenW (lpString=".bz2") returned 4
	[0061.028] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0061.028] lstrlenW (lpString=".7z") returned 3
	[0061.028] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0061.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.028] lstrlenW (lpString=".dbf") returned 4
	[0061.028] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0061.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.029] lstrlenW (lpString=".1cd") returned 4
	[0061.029] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0061.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0061.029] lstrlenW (lpString=".jpg") returned 4
	[0061.029] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0061.029] lstrcmpiW (lpString1=".LOG", lpString2=".money") returned -1
	[0061.029] lstrlenW (lpString="BCD.LOG") returned 7
	[0061.029] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.029] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.029] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.029] lstrlenW (lpString=".doc") returned 4
	[0061.029] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0061.029] lstrlenW (lpString=".docx") returned 5
	[0061.029] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0061.029] lstrlenW (lpString=".pdf") returned 4
	[0061.029] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0061.029] lstrlenW (lpString=".xls") returned 4
	[0061.029] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0061.029] lstrlenW (lpString=".xlsx") returned 5
	[0061.029] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0061.030] lstrlenW (lpString=".ppt") returned 4
	[0061.030] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0061.030] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.030] lstrlenW (lpString=".zip") returned 4
	[0061.030] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0061.030] lstrlenW (lpString=".rar") returned 4
	[0061.030] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0061.030] lstrlenW (lpString=".bz2") returned 4
	[0061.030] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0061.030] lstrlenW (lpString=".7z") returned 3
	[0061.030] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0061.030] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.030] lstrlenW (lpString=".dbf") returned 4
	[0061.030] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0061.030] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.030] lstrlenW (lpString=".1cd") returned 4
	[0061.030] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0061.030] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.030] lstrlenW (lpString=".jpg") returned 4
	[0061.030] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0061.030] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.030] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.031] lstrlenW (lpString=".doc") returned 4
	[0061.031] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0061.031] lstrlenW (lpString=".docx") returned 5
	[0061.031] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0061.031] lstrlenW (lpString=".pdf") returned 4
	[0061.031] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0061.031] lstrlenW (lpString=".xls") returned 4
	[0061.031] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0061.031] lstrlenW (lpString=".xlsx") returned 5
	[0061.031] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0061.031] lstrlenW (lpString=".ppt") returned 4
	[0061.031] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0061.031] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.031] lstrlenW (lpString=".zip") returned 4
	[0061.031] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0061.031] lstrlenW (lpString=".rar") returned 4
	[0061.031] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0061.031] lstrlenW (lpString=".bz2") returned 4
	[0061.031] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0061.031] lstrlenW (lpString=".7z") returned 3
	[0061.031] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0061.031] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.031] lstrlenW (lpString=".dbf") returned 4
	[0061.031] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0061.031] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.031] lstrlenW (lpString=".1cd") returned 4
	[0061.031] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0061.031] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0061.032] lstrlenW (lpString=".jpg") returned 4
	[0061.032] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0061.032] lstrcmpiW (lpString1=".DAT", lpString2=".money") returned -1
	[0061.032] lstrlenW (lpString="BOOTSTAT.DAT") returned 12
	[0061.032] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0061.033] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=65536) returned 1
	[0061.033] CloseHandle (hObject=0x314) returned 1
	[0061.033] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26
	[0061.033] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.033] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0061.033] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.033] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.033] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0061.033] GetLastError () returned 0x0
	[0061.033] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x10000, lpOverlapped=0x0) returned 1
	[0061.036] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x10010, lpOverlapped=0x0) returned 1
	[0061.041] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.041] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0061.041] SetEndOfFile (hFile=0x340) returned 1
	[0061.041] CloseHandle (hObject=0x340) returned 1
	[0061.399] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.399] SetEndOfFile (hFile=0x314) returned 1
	[0061.400] CloseHandle (hObject=0x314) returned 1
	[0061.400] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x26) returned 1
	[0061.401] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1
	[0061.401] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.401] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.401] lstrlenW (lpString=".doc") returned 4
	[0061.401] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0061.402] lstrlenW (lpString=".docx") returned 5
	[0061.402] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0061.402] lstrlenW (lpString=".pdf") returned 4
	[0061.402] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0061.402] lstrlenW (lpString=".xls") returned 4
	[0061.402] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0061.402] lstrlenW (lpString=".xlsx") returned 5
	[0061.402] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0061.402] lstrlenW (lpString=".ppt") returned 4
	[0061.402] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0061.402] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.402] lstrlenW (lpString=".zip") returned 4
	[0061.402] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0061.402] lstrlenW (lpString=".rar") returned 4
	[0061.402] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0061.402] lstrlenW (lpString=".bz2") returned 4
	[0061.402] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0061.402] lstrlenW (lpString=".7z") returned 3
	[0061.402] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0061.402] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.402] lstrlenW (lpString=".dbf") returned 4
	[0061.402] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0061.402] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.402] lstrlenW (lpString=".1cd") returned 4
	[0061.403] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0061.403] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.403] lstrlenW (lpString=".jpg") returned 4
	[0061.403] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0061.403] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.403] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.403] lstrlenW (lpString=".doc") returned 4
	[0061.403] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0061.403] lstrlenW (lpString=".docx") returned 5
	[0061.403] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0061.403] lstrlenW (lpString=".pdf") returned 4
	[0061.403] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0061.403] lstrlenW (lpString=".xls") returned 4
	[0061.403] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0061.403] lstrlenW (lpString=".xlsx") returned 5
	[0061.403] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0061.403] lstrlenW (lpString=".ppt") returned 4
	[0061.403] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0061.403] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.403] lstrlenW (lpString=".zip") returned 4
	[0061.403] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0061.403] lstrlenW (lpString=".rar") returned 4
	[0061.403] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0061.403] lstrlenW (lpString=".bz2") returned 4
	[0061.404] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0061.404] lstrlenW (lpString=".7z") returned 3
	[0061.404] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0061.404] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.404] lstrlenW (lpString=".dbf") returned 4
	[0061.404] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0061.404] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.404] lstrlenW (lpString=".1cd") returned 4
	[0061.404] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0061.404] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0061.404] lstrlenW (lpString=".jpg") returned 4
	[0061.404] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0061.404] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.404] lstrlenW (lpString="auxbase.xml") returned 11
	[0061.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0061.428] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1434) returned 1
	[0061.428] CloseHandle (hObject=0x368) returned 1
	[0061.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20
	[0061.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.429] lstrlenW (lpString=".doc") returned 4
	[0061.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.429] lstrlenW (lpString=".docx") returned 5
	[0061.429] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0061.429] lstrlenW (lpString=".pdf") returned 4
	[0061.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.429] lstrlenW (lpString=".xls") returned 4
	[0061.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.429] lstrlenW (lpString=".xlsx") returned 5
	[0061.429] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0061.429] lstrlenW (lpString=".ppt") returned 4
	[0061.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.429] lstrlenW (lpString=".zip") returned 4
	[0061.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.429] lstrlenW (lpString=".rar") returned 4
	[0061.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.429] lstrlenW (lpString=".bz2") returned 4
	[0061.430] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.430] lstrlenW (lpString=".7z") returned 3
	[0061.430] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.430] lstrlenW (lpString=".dbf") returned 4
	[0061.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.430] lstrlenW (lpString=".1cd") returned 4
	[0061.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.430] lstrlenW (lpString=".jpg") returned 4
	[0061.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.430] lstrlenW (lpString=".doc") returned 4
	[0061.430] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.430] lstrlenW (lpString=".docx") returned 5
	[0061.430] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0061.430] lstrlenW (lpString=".pdf") returned 4
	[0061.430] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.430] lstrlenW (lpString=".xls") returned 4
	[0061.430] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.430] lstrlenW (lpString=".xlsx") returned 5
	[0061.430] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0061.430] lstrlenW (lpString=".ppt") returned 4
	[0061.430] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.430] lstrlenW (lpString=".zip") returned 4
	[0061.431] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.431] lstrlenW (lpString=".rar") returned 4
	[0061.431] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.431] lstrlenW (lpString=".bz2") returned 4
	[0061.431] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.431] lstrlenW (lpString=".7z") returned 3
	[0061.431] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.431] lstrlenW (lpString=".dbf") returned 4
	[0061.431] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.431] lstrlenW (lpString=".1cd") returned 4
	[0061.431] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0061.431] lstrlenW (lpString=".jpg") returned 4
	[0061.431] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.431] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.431] lstrlenW (lpString="auxpad.xml") returned 10
	[0061.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0061.432] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=212) returned 1
	[0061.432] CloseHandle (hObject=0x368) returned 1
	[0061.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20
	[0061.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.433] lstrlenW (lpString=".doc") returned 4
	[0061.433] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.433] lstrlenW (lpString=".docx") returned 5
	[0061.433] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0061.433] lstrlenW (lpString=".pdf") returned 4
	[0061.433] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.433] lstrlenW (lpString=".xls") returned 4
	[0061.433] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.433] lstrlenW (lpString=".xlsx") returned 5
	[0061.433] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0061.433] lstrlenW (lpString=".ppt") returned 4
	[0061.433] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.433] lstrlenW (lpString=".zip") returned 4
	[0061.433] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.433] lstrlenW (lpString=".rar") returned 4
	[0061.433] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.433] lstrlenW (lpString=".bz2") returned 4
	[0061.433] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.433] lstrlenW (lpString=".7z") returned 3
	[0061.433] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.433] lstrlenW (lpString=".dbf") returned 4
	[0061.434] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.434] lstrlenW (lpString=".1cd") returned 4
	[0061.434] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.434] lstrlenW (lpString=".jpg") returned 4
	[0061.434] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.434] lstrlenW (lpString=".doc") returned 4
	[0061.434] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.434] lstrlenW (lpString=".docx") returned 5
	[0061.434] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0061.434] lstrlenW (lpString=".pdf") returned 4
	[0061.434] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.434] lstrlenW (lpString=".xls") returned 4
	[0061.434] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.434] lstrlenW (lpString=".xlsx") returned 5
	[0061.434] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0061.434] lstrlenW (lpString=".ppt") returned 4
	[0061.434] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.434] lstrlenW (lpString=".zip") returned 4
	[0061.434] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.434] lstrlenW (lpString=".rar") returned 4
	[0061.434] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.434] lstrlenW (lpString=".bz2") returned 4
	[0061.434] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.435] lstrlenW (lpString=".7z") returned 3
	[0061.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.435] lstrlenW (lpString=".dbf") returned 4
	[0061.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.435] lstrlenW (lpString=".1cd") returned 4
	[0061.435] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0061.435] lstrlenW (lpString=".jpg") returned 4
	[0061.435] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.435] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.435] lstrlenW (lpString="insertbase.xml") returned 14
	[0061.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0061.436] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=903) returned 1
	[0061.436] CloseHandle (hObject=0x368) returned 1
	[0061.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20
	[0061.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.436] lstrlenW (lpString=".doc") returned 4
	[0061.436] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.437] lstrlenW (lpString=".docx") returned 5
	[0061.437] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0061.437] lstrlenW (lpString=".pdf") returned 4
	[0061.437] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.437] lstrlenW (lpString=".xls") returned 4
	[0061.437] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.437] lstrlenW (lpString=".xlsx") returned 5
	[0061.437] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0061.437] lstrlenW (lpString=".ppt") returned 4
	[0061.437] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.437] lstrlenW (lpString=".zip") returned 4
	[0061.437] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.437] lstrlenW (lpString=".rar") returned 4
	[0061.437] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.437] lstrlenW (lpString=".bz2") returned 4
	[0061.437] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.437] lstrlenW (lpString=".7z") returned 3
	[0061.437] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.437] lstrlenW (lpString=".dbf") returned 4
	[0061.437] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.437] lstrlenW (lpString=".1cd") returned 4
	[0061.437] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.437] lstrlenW (lpString=".jpg") returned 4
	[0061.437] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.438] lstrlenW (lpString=".doc") returned 4
	[0061.438] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.438] lstrlenW (lpString=".docx") returned 5
	[0061.438] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0061.438] lstrlenW (lpString=".pdf") returned 4
	[0061.438] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.438] lstrlenW (lpString=".xls") returned 4
	[0061.438] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.438] lstrlenW (lpString=".xlsx") returned 5
	[0061.438] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0061.438] lstrlenW (lpString=".ppt") returned 4
	[0061.438] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.438] lstrlenW (lpString=".zip") returned 4
	[0061.438] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.438] lstrlenW (lpString=".rar") returned 4
	[0061.438] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.438] lstrlenW (lpString=".bz2") returned 4
	[0061.438] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.438] lstrlenW (lpString=".7z") returned 3
	[0061.438] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.438] lstrlenW (lpString=".dbf") returned 4
	[0061.438] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.438] lstrlenW (lpString=".1cd") returned 4
	[0061.438] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0061.438] lstrlenW (lpString=".jpg") returned 4
	[0061.438] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.439] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.439] lstrlenW (lpString="insert.xml") returned 10
	[0061.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0061.439] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=215) returned 1
	[0061.439] CloseHandle (hObject=0x314) returned 1
	[0061.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20
	[0061.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.440] lstrlenW (lpString=".doc") returned 4
	[0061.440] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.440] lstrlenW (lpString=".docx") returned 5
	[0061.440] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0061.440] lstrlenW (lpString=".pdf") returned 4
	[0061.440] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.440] lstrlenW (lpString=".xls") returned 4
	[0061.440] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.440] lstrlenW (lpString=".xlsx") returned 5
	[0061.440] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0061.440] lstrlenW (lpString=".ppt") returned 4
	[0061.440] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.440] lstrlenW (lpString=".zip") returned 4
	[0061.440] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.440] lstrlenW (lpString=".rar") returned 4
	[0061.440] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.440] lstrlenW (lpString=".bz2") returned 4
	[0061.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.441] lstrlenW (lpString=".7z") returned 3
	[0061.441] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.441] lstrlenW (lpString=".dbf") returned 4
	[0061.441] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.441] lstrlenW (lpString=".1cd") returned 4
	[0061.441] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.441] lstrlenW (lpString=".jpg") returned 4
	[0061.441] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.441] lstrlenW (lpString=".doc") returned 4
	[0061.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.441] lstrlenW (lpString=".docx") returned 5
	[0061.441] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0061.441] lstrlenW (lpString=".pdf") returned 4
	[0061.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.441] lstrlenW (lpString=".xls") returned 4
	[0061.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.441] lstrlenW (lpString=".xlsx") returned 5
	[0061.441] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0061.441] lstrlenW (lpString=".ppt") returned 4
	[0061.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.441] lstrlenW (lpString=".zip") returned 4
	[0061.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.442] lstrlenW (lpString=".rar") returned 4
	[0061.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.442] lstrlenW (lpString=".bz2") returned 4
	[0061.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.442] lstrlenW (lpString=".7z") returned 3
	[0061.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.442] lstrlenW (lpString=".dbf") returned 4
	[0061.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.442] lstrlenW (lpString=".1cd") returned 4
	[0061.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0061.442] lstrlenW (lpString=".jpg") returned 4
	[0061.442] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.442] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.442] lstrlenW (lpString="ea.xml") returned 6
	[0061.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0061.443] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=384) returned 1
	[0061.443] CloseHandle (hObject=0x314) returned 1
	[0061.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20
	[0061.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.443] lstrlenW (lpString=".doc") returned 4
	[0061.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.443] lstrlenW (lpString=".docx") returned 5
	[0061.443] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.444] lstrlenW (lpString=".pdf") returned 4
	[0061.444] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.444] lstrlenW (lpString=".xls") returned 4
	[0061.444] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.444] lstrlenW (lpString=".xlsx") returned 5
	[0061.444] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.444] lstrlenW (lpString=".ppt") returned 4
	[0061.444] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.444] lstrlenW (lpString=".zip") returned 4
	[0061.444] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.444] lstrlenW (lpString=".rar") returned 4
	[0061.444] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.444] lstrlenW (lpString=".bz2") returned 4
	[0061.444] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.444] lstrlenW (lpString=".7z") returned 3
	[0061.444] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.444] lstrlenW (lpString=".dbf") returned 4
	[0061.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.444] lstrlenW (lpString=".1cd") returned 4
	[0061.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.444] lstrlenW (lpString=".jpg") returned 4
	[0061.444] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.444] lstrlenW (lpString=".doc") returned 4
	[0061.445] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.445] lstrlenW (lpString=".docx") returned 5
	[0061.445] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.445] lstrlenW (lpString=".pdf") returned 4
	[0061.445] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.445] lstrlenW (lpString=".xls") returned 4
	[0061.445] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.445] lstrlenW (lpString=".xlsx") returned 5
	[0061.445] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.445] lstrlenW (lpString=".ppt") returned 4
	[0061.445] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.445] lstrlenW (lpString=".zip") returned 4
	[0061.445] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.445] lstrlenW (lpString=".rar") returned 4
	[0061.445] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.445] lstrlenW (lpString=".bz2") returned 4
	[0061.445] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.445] lstrlenW (lpString=".7z") returned 3
	[0061.445] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.445] lstrlenW (lpString=".dbf") returned 4
	[0061.445] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.445] lstrlenW (lpString=".1cd") returned 4
	[0061.445] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0061.445] lstrlenW (lpString=".jpg") returned 4
	[0061.445] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.446] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.446] lstrlenW (lpString="keypadbase.xml") returned 14
	[0061.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0061.446] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=903) returned 1
	[0061.446] CloseHandle (hObject=0x314) returned 1
	[0061.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20
	[0061.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0061.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0061.446] lstrlenW (lpString=".doc") returned 4
	[0061.446] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.446] lstrlenW (lpString=".docx") returned 5
	[0061.446] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0061.447] lstrlenW (lpString=".pdf") returned 4
	[0061.447] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.447] lstrlenW (lpString=".xls") returned 4
	[0061.447] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.447] lstrlenW (lpString=".xlsx") returned 5
	[0061.447] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0061.447] lstrlenW (lpString=".ppt") returned 4
	[0061.447] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0061.447] lstrlenW (lpString=".zip") returned 4
	[0061.447] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.447] lstrlenW (lpString=".rar") returned 4
	[0061.447] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.447] lstrlenW (lpString=".bz2") returned 4
	[0061.447] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.447] lstrlenW (lpString=".7z") returned 3
	[0061.447] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0061.447] lstrlenW (lpString=".dbf") returned 4
	[0061.447] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.942] SetFilePointerEx (hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0) 
	[0062.943] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.943] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.943] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.943] GetLastError () returned 0x0
	[0062.943] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x3bb, lpOverlapped=0x0) returned 1
	[0062.944] WriteFile (in: hFile=0x350, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x3c0, lpOverlapped=0x0) returned 1
	[0062.945] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.946] WriteFile (in: hFile=0x350, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0062.946] SetEndOfFile (hFile=0x350) returned 1
	[0062.946] CloseHandle (hObject=0x350) returned 1
	[0062.947] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.947] SetEndOfFile (hFile=0x344) returned 1
	[0062.948] CloseHandle (hObject=0x344) returned 1
	[0062.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.948] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1
	[0062.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.948] lstrlenW (lpString=".doc") returned 4
	[0062.948] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0062.948] lstrlenW (lpString=".docx") returned 5
	[0062.948] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0062.948] lstrlenW (lpString=".pdf") returned 4
	[0062.948] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1
	[0062.949] lstrlenW (lpString=".xls") returned 4
	[0062.949] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1
	[0062.949] lstrlenW (lpString=".xlsx") returned 5
	[0062.949] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1
	[0062.949] lstrlenW (lpString=".ppt") returned 4
	[0062.949] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1
	[0062.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.949] lstrlenW (lpString=".zip") returned 4
	[0062.949] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1
	[0062.949] lstrlenW (lpString=".rar") returned 4
	[0062.949] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1
	[0062.949] lstrlenW (lpString=".bz2") returned 4
	[0062.949] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0062.949] lstrlenW (lpString=".7z") returned 3
	[0062.949] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0062.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.949] lstrlenW (lpString=".dbf") returned 4
	[0062.949] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0062.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.949] lstrlenW (lpString=".1cd") returned 4
	[0062.949] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0062.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.949] lstrlenW (lpString=".jpg") returned 4
	[0062.949] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1
	[0062.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.950] lstrlenW (lpString=".doc") returned 4
	[0062.950] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0062.950] lstrlenW (lpString=".docx") returned 5
	[0062.950] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0062.950] lstrlenW (lpString=".pdf") returned 4
	[0062.950] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1
	[0062.950] lstrlenW (lpString=".xls") returned 4
	[0062.950] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1
	[0062.950] lstrlenW (lpString=".xlsx") returned 5
	[0062.950] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1
	[0062.950] lstrlenW (lpString=".ppt") returned 4
	[0062.950] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1
	[0062.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.950] lstrlenW (lpString=".zip") returned 4
	[0062.950] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1
	[0062.950] lstrlenW (lpString=".rar") returned 4
	[0062.950] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1
	[0062.950] lstrlenW (lpString=".bz2") returned 4
	[0062.950] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0062.950] lstrlenW (lpString=".7z") returned 3
	[0062.950] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0062.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.950] lstrlenW (lpString=".dbf") returned 4
	[0062.950] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0062.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.950] lstrlenW (lpString=".1cd") returned 4
	[0062.951] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0062.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0062.951] lstrlenW (lpString=".jpg") returned 4
	[0062.951] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1
	[0062.951] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0062.951] lstrlenW (lpString="AppXManifest.xml") returned 16
	[0062.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0062.951] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=5944055) returned 1
	[0062.951] CloseHandle (hObject=0x344) returned 1
	[0062.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20
	[0062.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[admin@stex777.com].money")) returned 1
	[0062.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0062.952] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc64 | out: lpNewFilePointer=0x0) returned 1
	[0062.952] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1
	[0062.952] ReadFile (in: hFile=0x344, lpBuffer=0x3da2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x3da2058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0062.955] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1
	[0062.955] ReadFile (in: hFile=0x344, lpBuffer=0x3de2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x3de2058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0062.962] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x266fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0062.962] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1
	[0062.962] ReadFile (in: hFile=0x344, lpBuffer=0x3e22058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e22058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0062.977] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.977] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x266fca8, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fca8*=0xc010c, lpOverlapped=0x0) returned 1
	[0063.559] SetEndOfFile (hFile=0x344) returned 1
	[0063.559] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x42c85a8
	[0063.559] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1
	[0063.559] WriteFile (in: hFile=0x344, lpBuffer=0x42c85a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c85a8*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0063.561] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1
	[0063.561] WriteFile (in: hFile=0x344, lpBuffer=0x42c85a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c85a8*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0063.566] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1
	[0063.566] WriteFile (in: hFile=0x344, lpBuffer=0x42c85a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c85a8*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0063.569] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c85a8 | out: hHeap=0x600000) returned 1
	[0063.571] CloseHandle (hObject=0x344) returned 1
	[0065.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0065.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.615] lstrlenW (lpString=".doc") returned 4
	[0065.615] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0065.615] lstrlenW (lpString=".docx") returned 5
	[0065.615] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0065.615] lstrlenW (lpString=".pdf") returned 4
	[0065.615] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0065.615] lstrlenW (lpString=".xls") returned 4
	[0065.615] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0065.615] lstrlenW (lpString=".xlsx") returned 5
	[0065.615] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0065.615] lstrlenW (lpString=".ppt") returned 4
	[0065.615] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0065.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.615] lstrlenW (lpString=".zip") returned 4
	[0065.615] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0065.615] lstrlenW (lpString=".rar") returned 4
	[0065.615] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0065.615] lstrlenW (lpString=".bz2") returned 4
	[0065.616] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0065.616] lstrlenW (lpString=".7z") returned 3
	[0065.616] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0065.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.616] lstrlenW (lpString=".dbf") returned 4
	[0065.616] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0065.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.616] lstrlenW (lpString=".1cd") returned 4
	[0065.616] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0065.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.616] lstrlenW (lpString=".jpg") returned 4
	[0065.616] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0065.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.616] lstrlenW (lpString=".doc") returned 4
	[0065.616] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0065.616] lstrlenW (lpString=".docx") returned 5
	[0065.616] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0065.616] lstrlenW (lpString=".pdf") returned 4
	[0065.616] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0065.617] lstrlenW (lpString=".xls") returned 4
	[0065.617] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0065.617] lstrlenW (lpString=".xlsx") returned 5
	[0065.617] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0065.617] lstrlenW (lpString=".ppt") returned 4
	[0065.617] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0065.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.617] lstrlenW (lpString=".zip") returned 4
	[0065.617] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0065.617] lstrlenW (lpString=".rar") returned 4
	[0065.617] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0065.617] lstrlenW (lpString=".bz2") returned 4
	[0065.617] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0065.617] lstrlenW (lpString=".7z") returned 3
	[0065.617] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0065.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.617] lstrlenW (lpString=".dbf") returned 4
	[0065.617] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0065.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.617] lstrlenW (lpString=".1cd") returned 4
	[0065.617] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0065.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0065.618] lstrlenW (lpString=".jpg") returned 4
	[0065.618] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0065.618] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0065.618] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53
	[0065.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0066.405] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1261) returned 1
	[0066.405] CloseHandle (hObject=0x33c) returned 1
	[0066.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0066.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0066.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0066.406] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.406] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0066.406] GetLastError () returned 0x0
	[0066.406] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0066.408] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0066.409] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.409] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.409] SetEndOfFile (hFile=0x318) returned 1
	[0066.409] CloseHandle (hObject=0x318) returned 1
	[0066.410] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.410] SetEndOfFile (hFile=0x33c) returned 1
	[0066.411] CloseHandle (hObject=0x33c) returned 1
	[0066.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0066.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1
	[0066.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.412] lstrlenW (lpString=".doc") returned 4
	[0066.412] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.412] lstrlenW (lpString=".docx") returned 5
	[0066.412] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.412] lstrlenW (lpString=".pdf") returned 4
	[0066.412] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.413] lstrlenW (lpString=".xls") returned 4
	[0066.413] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.413] lstrlenW (lpString=".xlsx") returned 5
	[0066.413] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.413] lstrlenW (lpString=".ppt") returned 4
	[0066.413] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.413] lstrlenW (lpString=".zip") returned 4
	[0066.413] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.413] lstrlenW (lpString=".rar") returned 4
	[0066.413] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.413] lstrlenW (lpString=".bz2") returned 4
	[0066.413] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.413] lstrlenW (lpString=".7z") returned 3
	[0066.413] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.413] lstrlenW (lpString=".dbf") returned 4
	[0066.413] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.413] lstrlenW (lpString=".1cd") returned 4
	[0066.413] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.413] lstrlenW (lpString=".jpg") returned 4
	[0066.413] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.414] lstrlenW (lpString=".doc") returned 4
	[0066.414] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.414] lstrlenW (lpString=".docx") returned 5
	[0066.414] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.414] lstrlenW (lpString=".pdf") returned 4
	[0066.414] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.414] lstrlenW (lpString=".xls") returned 4
	[0066.414] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.414] lstrlenW (lpString=".xlsx") returned 5
	[0066.414] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.414] lstrlenW (lpString=".ppt") returned 4
	[0066.414] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.414] lstrlenW (lpString=".zip") returned 4
	[0066.414] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.414] lstrlenW (lpString=".rar") returned 4
	[0066.414] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.414] lstrlenW (lpString=".bz2") returned 4
	[0066.414] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.414] lstrlenW (lpString=".7z") returned 3
	[0066.414] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.414] lstrlenW (lpString=".dbf") returned 4
	[0066.414] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.414] lstrlenW (lpString=".1cd") returned 4
	[0066.414] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0066.415] lstrlenW (lpString=".jpg") returned 4
	[0066.415] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.415] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0066.415] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53
	[0066.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0066.416] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1261) returned 1
	[0066.416] CloseHandle (hObject=0x318) returned 1
	[0066.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0066.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0066.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0066.416] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.416] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.416] GetLastError () returned 0x0
	[0066.416] ReadFile (in: hFile=0x318, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0066.418] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0066.419] ReadFile (in: hFile=0x318, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.419] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.419] SetEndOfFile (hFile=0x314) returned 1
	[0066.419] CloseHandle (hObject=0x314) returned 1
	[0066.439] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.439] SetEndOfFile (hFile=0x318) returned 1
	[0066.440] CloseHandle (hObject=0x318) returned 1
	[0066.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0066.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1
	[0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.441] lstrlenW (lpString=".doc") returned 4
	[0066.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.441] lstrlenW (lpString=".docx") returned 5
	[0066.441] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.441] lstrlenW (lpString=".pdf") returned 4
	[0066.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.441] lstrlenW (lpString=".xls") returned 4
	[0066.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.441] lstrlenW (lpString=".xlsx") returned 5
	[0066.441] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.441] lstrlenW (lpString=".ppt") returned 4
	[0066.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.441] lstrlenW (lpString=".zip") returned 4
	[0066.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.441] lstrlenW (lpString=".rar") returned 4
	[0066.441] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.442] lstrlenW (lpString=".bz2") returned 4
	[0066.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.442] lstrlenW (lpString=".7z") returned 3
	[0066.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.442] lstrlenW (lpString=".dbf") returned 4
	[0066.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.442] lstrlenW (lpString=".1cd") returned 4
	[0066.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.442] lstrlenW (lpString=".jpg") returned 4
	[0066.989] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.989] lstrlenW (lpString=".doc") returned 4
	[0066.989] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.989] lstrlenW (lpString=".docx") returned 5
	[0066.990] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.990] lstrlenW (lpString=".pdf") returned 4
	[0066.990] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.990] lstrlenW (lpString=".xls") returned 4
	[0066.990] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.990] lstrlenW (lpString=".xlsx") returned 5
	[0066.990] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.990] lstrlenW (lpString=".ppt") returned 4
	[0066.990] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.990] lstrlenW (lpString=".zip") returned 4
	[0066.990] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.990] lstrlenW (lpString=".rar") returned 4
	[0066.990] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.990] lstrlenW (lpString=".bz2") returned 4
	[0066.990] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.990] lstrlenW (lpString=".7z") returned 3
	[0066.990] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.990] lstrlenW (lpString=".dbf") returned 4
	[0066.990] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.990] lstrlenW (lpString=".1cd") returned 4
	[0066.990] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0066.990] lstrlenW (lpString=".jpg") returned 4
	[0066.990] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.991] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0066.991] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53
	[0066.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0067.011] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=9216) returned 1
	[0067.011] CloseHandle (hObject=0x374) returned 1
	[0067.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0067.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0067.011] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.011] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0067.421] GetLastError () returned 0x0
	[0067.421] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2400, lpOverlapped=0x0) returned 1
	[0067.423] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2410, lpOverlapped=0x0) returned 1
	[0067.424] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.424] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.424] SetEndOfFile (hFile=0x38c) returned 1
	[0067.424] CloseHandle (hObject=0x38c) returned 1
	[0067.425] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.425] SetEndOfFile (hFile=0x374) returned 1
	[0067.426] CloseHandle (hObject=0x374) returned 1
	[0067.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.427] lstrlenW (lpString=".doc") returned 4
	[0067.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.427] lstrlenW (lpString=".docx") returned 5
	[0067.427] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.427] lstrlenW (lpString=".pdf") returned 4
	[0067.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.427] lstrlenW (lpString=".xls") returned 4
	[0067.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.427] lstrlenW (lpString=".xlsx") returned 5
	[0067.427] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.427] lstrlenW (lpString=".ppt") returned 4
	[0067.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.427] lstrlenW (lpString=".zip") returned 4
	[0067.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.427] lstrlenW (lpString=".rar") returned 4
	[0067.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.427] lstrlenW (lpString=".bz2") returned 4
	[0067.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.427] lstrlenW (lpString=".7z") returned 3
	[0067.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.428] lstrlenW (lpString=".dbf") returned 4
	[0067.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.428] lstrlenW (lpString=".1cd") returned 4
	[0067.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.428] lstrlenW (lpString=".jpg") returned 4
	[0067.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.428] lstrlenW (lpString=".doc") returned 4
	[0067.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.428] lstrlenW (lpString=".docx") returned 5
	[0067.428] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.428] lstrlenW (lpString=".pdf") returned 4
	[0067.428] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.428] lstrlenW (lpString=".xls") returned 4
	[0067.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.428] lstrlenW (lpString=".xlsx") returned 5
	[0067.428] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.428] lstrlenW (lpString=".ppt") returned 4
	[0067.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.428] lstrlenW (lpString=".zip") returned 4
	[0067.428] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.429] lstrlenW (lpString=".rar") returned 4
	[0067.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.429] lstrlenW (lpString=".bz2") returned 4
	[0067.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.429] lstrlenW (lpString=".7z") returned 3
	[0067.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.429] lstrlenW (lpString=".dbf") returned 4
	[0067.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.429] lstrlenW (lpString=".1cd") returned 4
	[0067.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0067.429] lstrlenW (lpString=".jpg") returned 4
	[0067.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.429] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.429] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53
	[0067.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0067.430] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3754) returned 1
	[0067.430] CloseHandle (hObject=0x374) returned 1
	[0067.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0067.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0067.430] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.430] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0067.430] GetLastError () returned 0x0
	[0067.430] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xeaa, lpOverlapped=0x0) returned 1
	[0067.432] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0067.433] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.433] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.433] SetEndOfFile (hFile=0x38c) returned 1
	[0067.433] CloseHandle (hObject=0x38c) returned 1
	[0067.434] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.434] SetEndOfFile (hFile=0x374) returned 1
	[0067.435] CloseHandle (hObject=0x374) returned 1
	[0067.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.435] lstrlenW (lpString=".doc") returned 4
	[0067.435] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.435] lstrlenW (lpString=".docx") returned 5
	[0067.435] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.435] lstrlenW (lpString=".pdf") returned 4
	[0067.435] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.435] lstrlenW (lpString=".xls") returned 4
	[0067.435] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.435] lstrlenW (lpString=".xlsx") returned 5
	[0067.436] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.436] lstrlenW (lpString=".ppt") returned 4
	[0067.436] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.436] lstrlenW (lpString=".zip") returned 4
	[0067.436] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.436] lstrlenW (lpString=".rar") returned 4
	[0067.436] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.436] lstrlenW (lpString=".bz2") returned 4
	[0067.436] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.436] lstrlenW (lpString=".7z") returned 3
	[0067.436] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.436] lstrlenW (lpString=".dbf") returned 4
	[0067.436] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.436] lstrlenW (lpString=".1cd") returned 4
	[0067.436] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.436] lstrlenW (lpString=".jpg") returned 4
	[0067.436] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.437] lstrlenW (lpString=".doc") returned 4
	[0067.437] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.437] lstrlenW (lpString=".docx") returned 5
	[0067.437] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.437] lstrlenW (lpString=".pdf") returned 4
	[0067.437] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.437] lstrlenW (lpString=".xls") returned 4
	[0067.437] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.437] lstrlenW (lpString=".xlsx") returned 5
	[0067.437] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.437] lstrlenW (lpString=".ppt") returned 4
	[0067.437] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.437] lstrlenW (lpString=".zip") returned 4
	[0067.437] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.437] lstrlenW (lpString=".rar") returned 4
	[0067.437] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.437] lstrlenW (lpString=".bz2") returned 4
	[0067.437] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.437] lstrlenW (lpString=".7z") returned 3
	[0067.437] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.437] lstrlenW (lpString=".dbf") returned 4
	[0067.437] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.438] lstrlenW (lpString=".1cd") returned 4
	[0067.438] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0067.438] lstrlenW (lpString=".jpg") returned 4
	[0067.438] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.438] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.438] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53
	[0067.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0067.438] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1261) returned 1
	[0067.438] CloseHandle (hObject=0x374) returned 1
	[0067.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0067.439] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.439] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0067.439] GetLastError () returned 0x0
	[0067.439] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.440] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.441] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.441] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.442] SetEndOfFile (hFile=0x38c) returned 1
	[0067.442] CloseHandle (hObject=0x38c) returned 1
	[0067.443] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.444] SetEndOfFile (hFile=0x374) returned 1
	[0067.445] CloseHandle (hObject=0x374) returned 1
	[0067.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.445] lstrlenW (lpString=".doc") returned 4
	[0067.445] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.445] lstrlenW (lpString=".docx") returned 5
	[0067.445] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.445] lstrlenW (lpString=".pdf") returned 4
	[0067.446] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.446] lstrlenW (lpString=".xls") returned 4
	[0067.446] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.446] lstrlenW (lpString=".xlsx") returned 5
	[0067.446] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.446] lstrlenW (lpString=".ppt") returned 4
	[0067.446] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.446] lstrlenW (lpString=".zip") returned 4
	[0067.446] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.446] lstrlenW (lpString=".rar") returned 4
	[0067.446] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.446] lstrlenW (lpString=".bz2") returned 4
	[0067.446] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.446] lstrlenW (lpString=".7z") returned 3
	[0067.446] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.446] lstrlenW (lpString=".dbf") returned 4
	[0067.446] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.446] lstrlenW (lpString=".1cd") returned 4
	[0067.446] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.446] lstrlenW (lpString=".jpg") returned 4
	[0067.446] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.447] lstrlenW (lpString=".doc") returned 4
	[0067.447] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.447] lstrlenW (lpString=".docx") returned 5
	[0067.447] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.447] lstrlenW (lpString=".pdf") returned 4
	[0067.447] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.447] lstrlenW (lpString=".xls") returned 4
	[0067.447] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.447] lstrlenW (lpString=".xlsx") returned 5
	[0067.447] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.447] lstrlenW (lpString=".ppt") returned 4
	[0067.447] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.447] lstrlenW (lpString=".zip") returned 4
	[0067.447] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.447] lstrlenW (lpString=".rar") returned 4
	[0067.447] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.447] lstrlenW (lpString=".bz2") returned 4
	[0067.447] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.447] lstrlenW (lpString=".7z") returned 3
	[0067.448] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.448] lstrlenW (lpString=".dbf") returned 4
	[0067.448] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.448] lstrlenW (lpString=".1cd") returned 4
	[0067.448] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0067.448] lstrlenW (lpString=".jpg") returned 4
	[0067.448] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.449] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.449] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53
	[0067.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0067.449] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1261) returned 1
	[0067.449] CloseHandle (hObject=0x374) returned 1
	[0067.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0067.452] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.452] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0067.453] GetLastError () returned 0x0
	[0067.453] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.455] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.456] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.456] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.456] SetEndOfFile (hFile=0x38c) returned 1
	[0067.456] CloseHandle (hObject=0x38c) returned 1
	[0067.457] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.457] SetEndOfFile (hFile=0x374) returned 1
	[0067.634] CloseHandle (hObject=0x374) returned 1
	[0067.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.635] lstrlenW (lpString=".doc") returned 4
	[0067.635] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.635] lstrlenW (lpString=".docx") returned 5
	[0067.635] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.635] lstrlenW (lpString=".pdf") returned 4
	[0067.635] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.635] lstrlenW (lpString=".xls") returned 4
	[0067.635] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.635] lstrlenW (lpString=".xlsx") returned 5
	[0067.635] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.635] lstrlenW (lpString=".ppt") returned 4
	[0067.635] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.635] lstrlenW (lpString=".zip") returned 4
	[0067.635] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.635] lstrlenW (lpString=".rar") returned 4
	[0067.635] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.635] lstrlenW (lpString=".bz2") returned 4
	[0067.635] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.635] lstrlenW (lpString=".7z") returned 3
	[0067.635] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.635] lstrlenW (lpString=".dbf") returned 4
	[0067.635] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.636] lstrlenW (lpString=".1cd") returned 4
	[0067.636] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.636] lstrlenW (lpString=".jpg") returned 4
	[0067.636] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.636] lstrlenW (lpString=".doc") returned 4
	[0067.636] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.636] lstrlenW (lpString=".docx") returned 5
	[0067.636] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.636] lstrlenW (lpString=".pdf") returned 4
	[0067.636] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.636] lstrlenW (lpString=".xls") returned 4
	[0067.636] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.636] lstrlenW (lpString=".xlsx") returned 5
	[0067.636] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.636] lstrlenW (lpString=".ppt") returned 4
	[0067.636] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.637] lstrlenW (lpString=".zip") returned 4
	[0067.637] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.637] lstrlenW (lpString=".rar") returned 4
	[0067.637] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.637] lstrlenW (lpString=".bz2") returned 4
	[0067.637] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.637] lstrlenW (lpString=".7z") returned 3
	[0067.637] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.637] lstrlenW (lpString=".dbf") returned 4
	[0067.637] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.637] lstrlenW (lpString=".1cd") returned 4
	[0067.637] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0067.637] lstrlenW (lpString=".jpg") returned 4
	[0067.637] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.637] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0067.638] lstrlenW (lpString="AG00021_.GIF") returned 12
	[0067.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0067.802] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=14873) returned 1
	[0067.802] CloseHandle (hObject=0x378) returned 1
	[0067.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220
	[0067.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0067.802] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.802] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.803] GetLastError () returned 0x0
	[0067.803] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x3a19, lpOverlapped=0x0) returned 1
	[0067.804] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x3a20, lpOverlapped=0x0) returned 1
	[0067.806] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.806] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0067.806] SetEndOfFile (hFile=0x318) returned 1
	[0067.806] CloseHandle (hObject=0x318) returned 1
	[0067.807] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.807] SetEndOfFile (hFile=0x378) returned 1
	[0067.808] CloseHandle (hObject=0x378) returned 1
	[0067.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1
	[0067.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.809] lstrlenW (lpString=".doc") returned 4
	[0067.809] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0067.809] lstrlenW (lpString=".docx") returned 5
	[0067.809] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0067.809] lstrlenW (lpString=".pdf") returned 4
	[0067.809] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0067.809] lstrlenW (lpString=".xls") returned 4
	[0067.809] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0067.809] lstrlenW (lpString=".xlsx") returned 5
	[0067.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0067.809] lstrlenW (lpString=".ppt") returned 4
	[0067.809] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0067.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.809] lstrlenW (lpString=".zip") returned 4
	[0067.809] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0067.809] lstrlenW (lpString=".rar") returned 4
	[0067.809] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0067.809] lstrlenW (lpString=".bz2") returned 4
	[0067.809] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0067.810] lstrlenW (lpString=".7z") returned 3
	[0067.810] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0067.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.810] lstrlenW (lpString=".dbf") returned 4
	[0067.810] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0067.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.810] lstrlenW (lpString=".1cd") returned 4
	[0067.810] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0067.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.810] lstrlenW (lpString=".jpg") returned 4
	[0067.810] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0067.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.810] lstrlenW (lpString=".doc") returned 4
	[0067.810] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0067.810] lstrlenW (lpString=".docx") returned 5
	[0067.810] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0067.810] lstrlenW (lpString=".pdf") returned 4
	[0067.810] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0067.810] lstrlenW (lpString=".xls") returned 4
	[0067.810] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0067.810] lstrlenW (lpString=".xlsx") returned 5
	[0067.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0067.810] lstrlenW (lpString=".ppt") returned 4
	[0067.810] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0067.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.811] lstrlenW (lpString=".zip") returned 4
	[0067.811] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0067.811] lstrlenW (lpString=".rar") returned 4
	[0067.811] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0067.811] lstrlenW (lpString=".bz2") returned 4
	[0067.811] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0067.811] lstrlenW (lpString=".7z") returned 3
	[0067.811] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0067.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.811] lstrlenW (lpString=".dbf") returned 4
	[0067.811] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0067.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.811] lstrlenW (lpString=".1cd") returned 4
	[0067.811] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0067.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0067.811] lstrlenW (lpString=".jpg") returned 4
	[0067.811] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0067.811] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0067.811] lstrlenW (lpString="AG00037_.GIF") returned 12
	[0067.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0067.812] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=6684) returned 1
	[0067.812] CloseHandle (hObject=0x378) returned 1
	[0067.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220
	[0067.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0067.812] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.812] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.813] GetLastError () returned 0x0
	[0067.813] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1a1c, lpOverlapped=0x0) returned 1
	[0067.814] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1a20, lpOverlapped=0x0) returned 1
	[0067.815] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.815] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0067.815] SetEndOfFile (hFile=0x318) returned 1
	[0067.815] CloseHandle (hObject=0x318) returned 1
	[0067.816] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.816] SetEndOfFile (hFile=0x378) returned 1
	[0067.817] CloseHandle (hObject=0x378) returned 1
	[0067.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1
	[0067.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.818] lstrlenW (lpString=".doc") returned 4
	[0067.818] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0067.818] lstrlenW (lpString=".docx") returned 5
	[0067.818] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0067.818] lstrlenW (lpString=".pdf") returned 4
	[0067.818] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0067.818] lstrlenW (lpString=".xls") returned 4
	[0067.818] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0067.818] lstrlenW (lpString=".xlsx") returned 5
	[0067.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0067.818] lstrlenW (lpString=".ppt") returned 4
	[0067.818] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0067.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.819] lstrlenW (lpString=".zip") returned 4
	[0067.819] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0067.819] lstrlenW (lpString=".rar") returned 4
	[0067.819] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0067.819] lstrlenW (lpString=".bz2") returned 4
	[0067.819] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0067.819] lstrlenW (lpString=".7z") returned 3
	[0067.819] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0067.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.819] lstrlenW (lpString=".dbf") returned 4
	[0067.819] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0067.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.819] lstrlenW (lpString=".1cd") returned 4
	[0067.819] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0067.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.819] lstrlenW (lpString=".jpg") returned 4
	[0067.819] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0067.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.819] lstrlenW (lpString=".doc") returned 4
	[0067.819] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0067.819] lstrlenW (lpString=".docx") returned 5
	[0067.819] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0067.819] lstrlenW (lpString=".pdf") returned 4
	[0067.819] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0067.819] lstrlenW (lpString=".xls") returned 4
	[0067.819] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0067.820] lstrlenW (lpString=".xlsx") returned 5
	[0067.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0067.820] lstrlenW (lpString=".ppt") returned 4
	[0067.820] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0067.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.820] lstrlenW (lpString=".zip") returned 4
	[0067.820] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0067.820] lstrlenW (lpString=".rar") returned 4
	[0067.820] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0067.820] lstrlenW (lpString=".bz2") returned 4
	[0067.820] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0067.820] lstrlenW (lpString=".7z") returned 3
	[0067.820] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0067.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.820] lstrlenW (lpString=".dbf") returned 4
	[0067.820] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0067.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.820] lstrlenW (lpString=".1cd") returned 4
	[0067.820] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0067.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0067.820] lstrlenW (lpString=".jpg") returned 4
	[0067.820] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0067.820] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0067.820] lstrlenW (lpString="AG00038_.GIF") returned 12
	[0067.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0067.821] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3251) returned 1
	[0067.821] CloseHandle (hObject=0x378) returned 1
	[0067.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220
	[0067.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0067.821] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.821] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.821] GetLastError () returned 0x0
	[0067.821] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xcb3, lpOverlapped=0x0) returned 1
	[0067.823] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xcc0, lpOverlapped=0x0) returned 1
	[0067.824] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.824] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0067.824] SetEndOfFile (hFile=0x318) returned 1
	[0067.824] CloseHandle (hObject=0x318) returned 1
	[0067.825] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.825] SetEndOfFile (hFile=0x378) returned 1
	[0067.826] CloseHandle (hObject=0x378) returned 1
	[0067.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1
	[0067.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.826] lstrlenW (lpString=".doc") returned 4
	[0067.826] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0067.826] lstrlenW (lpString=".docx") returned 5
	[0067.826] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0067.826] lstrlenW (lpString=".pdf") returned 4
	[0067.826] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0067.827] lstrlenW (lpString=".xls") returned 4
	[0067.827] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0067.827] lstrlenW (lpString=".xlsx") returned 5
	[0067.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0067.827] lstrlenW (lpString=".ppt") returned 4
	[0067.827] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.827] lstrlenW (lpString=".zip") returned 4
	[0067.827] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0067.827] lstrlenW (lpString=".rar") returned 4
	[0067.827] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0067.827] lstrlenW (lpString=".bz2") returned 4
	[0067.827] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0067.827] lstrlenW (lpString=".7z") returned 3
	[0067.827] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.827] lstrlenW (lpString=".dbf") returned 4
	[0067.827] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.827] lstrlenW (lpString=".1cd") returned 4
	[0067.827] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.827] lstrlenW (lpString=".jpg") returned 4
	[0067.827] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.827] lstrlenW (lpString=".doc") returned 4
	[0067.828] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0067.828] lstrlenW (lpString=".docx") returned 5
	[0067.828] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0067.828] lstrlenW (lpString=".pdf") returned 4
	[0067.828] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0067.828] lstrlenW (lpString=".xls") returned 4
	[0067.828] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0067.828] lstrlenW (lpString=".xlsx") returned 5
	[0067.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0067.828] lstrlenW (lpString=".ppt") returned 4
	[0067.828] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0067.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.828] lstrlenW (lpString=".zip") returned 4
	[0067.828] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0067.828] lstrlenW (lpString=".rar") returned 4
	[0067.828] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0067.828] lstrlenW (lpString=".bz2") returned 4
	[0067.828] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0067.828] lstrlenW (lpString=".7z") returned 3
	[0067.828] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0067.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.828] lstrlenW (lpString=".dbf") returned 4
	[0067.828] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0067.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.828] lstrlenW (lpString=".1cd") returned 4
	[0067.828] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0067.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0067.828] lstrlenW (lpString=".jpg") returned 4
	[0067.828] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0067.829] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0067.829] lstrlenW (lpString="AG00040_.GIF") returned 12
	[0067.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0067.829] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=8097) returned 1
	[0067.829] CloseHandle (hObject=0x378) returned 1
	[0067.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220
	[0067.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0067.829] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.829] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.830] GetLastError () returned 0x0
	[0067.830] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1fa1, lpOverlapped=0x0) returned 1
	[0067.831] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1fb0, lpOverlapped=0x0) returned 1
	[0067.832] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.832] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0067.832] SetEndOfFile (hFile=0x318) returned 1
	[0067.833] CloseHandle (hObject=0x318) returned 1
	[0067.833] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.833] SetEndOfFile (hFile=0x378) returned 1
	[0067.834] CloseHandle (hObject=0x378) returned 1
	[0067.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1
	[0067.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.835] lstrlenW (lpString=".doc") returned 4
	[0067.835] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0067.835] lstrlenW (lpString=".docx") returned 5
	[0067.835] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0067.835] lstrlenW (lpString=".pdf") returned 4
	[0067.835] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0067.835] lstrlenW (lpString=".xls") returned 4
	[0067.835] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0067.835] lstrlenW (lpString=".xlsx") returned 5
	[0067.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0067.835] lstrlenW (lpString=".ppt") returned 4
	[0067.835] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0067.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.835] lstrlenW (lpString=".zip") returned 4
	[0067.835] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0067.835] lstrlenW (lpString=".rar") returned 4
	[0067.835] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0067.835] lstrlenW (lpString=".bz2") returned 4
	[0067.835] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0067.835] lstrlenW (lpString=".7z") returned 3
	[0067.835] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0067.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.836] lstrlenW (lpString=".dbf") returned 4
	[0067.836] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0067.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.836] lstrlenW (lpString=".1cd") returned 4
	[0067.836] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0067.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.836] lstrlenW (lpString=".jpg") returned 4
	[0067.836] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0067.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.836] lstrlenW (lpString=".doc") returned 4
	[0067.836] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0067.836] lstrlenW (lpString=".docx") returned 5
	[0067.836] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0067.836] lstrlenW (lpString=".pdf") returned 4
	[0067.836] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0067.836] lstrlenW (lpString=".xls") returned 4
	[0067.836] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0067.836] lstrlenW (lpString=".xlsx") returned 5
	[0067.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0067.836] lstrlenW (lpString=".ppt") returned 4
	[0067.836] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0067.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.836] lstrlenW (lpString=".zip") returned 4
	[0067.836] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0067.836] lstrlenW (lpString=".rar") returned 4
	[0067.836] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0067.836] lstrlenW (lpString=".bz2") returned 4
	[0067.836] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0067.836] lstrlenW (lpString=".7z") returned 3
	[0067.837] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0067.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.837] lstrlenW (lpString=".dbf") returned 4
	[0067.837] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0067.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.837] lstrlenW (lpString=".1cd") returned 4
	[0067.837] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0067.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0067.837] lstrlenW (lpString=".jpg") returned 4
	[0067.837] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0067.837] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0067.837] lstrlenW (lpString="AG00052_.GIF") returned 12
	[0067.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0068.380] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=7686) returned 1
	[0068.380] CloseHandle (hObject=0x368) returned 1
	[0068.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220
	[0068.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0068.380] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.381] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.382] GetLastError () returned 0x0
	[0068.382] ReadFile (in: hFile=0x368, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1e06, lpOverlapped=0x0) returned 1
	[0068.385] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1e10, lpOverlapped=0x0) returned 1
	[0068.386] ReadFile (in: hFile=0x368, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.386] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.386] SetEndOfFile (hFile=0x364) returned 1
	[0068.386] CloseHandle (hObject=0x364) returned 1
	[0068.387] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.387] SetEndOfFile (hFile=0x368) returned 1
	[0068.388] CloseHandle (hObject=0x368) returned 1
	[0068.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1
	[0068.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.389] lstrlenW (lpString=".doc") returned 4
	[0068.389] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.389] lstrlenW (lpString=".docx") returned 5
	[0068.389] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.389] lstrlenW (lpString=".pdf") returned 4
	[0068.389] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.389] lstrlenW (lpString=".xls") returned 4
	[0068.389] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.389] lstrlenW (lpString=".xlsx") returned 5
	[0068.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.389] lstrlenW (lpString=".ppt") returned 4
	[0068.389] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.389] lstrlenW (lpString=".zip") returned 4
	[0068.390] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.390] lstrlenW (lpString=".rar") returned 4
	[0068.390] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.390] lstrlenW (lpString=".bz2") returned 4
	[0068.390] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.390] lstrlenW (lpString=".7z") returned 3
	[0068.390] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.390] lstrlenW (lpString=".dbf") returned 4
	[0068.390] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.390] lstrlenW (lpString=".1cd") returned 4
	[0068.390] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.390] lstrlenW (lpString=".jpg") returned 4
	[0068.390] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.390] lstrlenW (lpString=".doc") returned 4
	[0068.390] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.390] lstrlenW (lpString=".docx") returned 5
	[0068.390] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.390] lstrlenW (lpString=".pdf") returned 4
	[0068.391] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.391] lstrlenW (lpString=".xls") returned 4
	[0068.391] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.391] lstrlenW (lpString=".xlsx") returned 5
	[0068.391] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.391] lstrlenW (lpString=".ppt") returned 4
	[0068.391] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.391] lstrlenW (lpString=".zip") returned 4
	[0068.391] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.391] lstrlenW (lpString=".rar") returned 4
	[0068.391] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.391] lstrlenW (lpString=".bz2") returned 4
	[0068.391] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.391] lstrlenW (lpString=".7z") returned 3
	[0068.391] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.391] lstrlenW (lpString=".dbf") returned 4
	[0068.391] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.391] lstrlenW (lpString=".1cd") returned 4
	[0068.391] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0068.392] lstrlenW (lpString=".jpg") returned 4
	[0068.392] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.392] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.392] lstrlenW (lpString="AG00090_.GIF") returned 12
	[0068.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0068.403] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=517) returned 1
	[0068.403] CloseHandle (hObject=0x33c) returned 1
	[0068.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220
	[0068.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0068.404] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.404] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0068.405] GetLastError () returned 0x0
	[0068.405] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x205, lpOverlapped=0x0) returned 1
	[0068.407] WriteFile (in: hFile=0x34c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x210, lpOverlapped=0x0) returned 1
	[0068.408] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.408] WriteFile (in: hFile=0x34c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.417] SetEndOfFile (hFile=0x34c) returned 1
	[0068.418] CloseHandle (hObject=0x34c) returned 1
	[0068.418] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.418] SetEndOfFile (hFile=0x33c) returned 1
	[0068.419] CloseHandle (hObject=0x33c) returned 1
	[0068.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1
	[0068.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.420] lstrlenW (lpString=".doc") returned 4
	[0068.420] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.420] lstrlenW (lpString=".docx") returned 5
	[0068.420] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.420] lstrlenW (lpString=".pdf") returned 4
	[0068.420] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.420] lstrlenW (lpString=".xls") returned 4
	[0068.420] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.420] lstrlenW (lpString=".xlsx") returned 5
	[0068.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.420] lstrlenW (lpString=".ppt") returned 4
	[0068.420] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.420] lstrlenW (lpString=".zip") returned 4
	[0068.420] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.420] lstrlenW (lpString=".rar") returned 4
	[0068.420] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.420] lstrlenW (lpString=".bz2") returned 4
	[0068.420] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.421] lstrlenW (lpString=".7z") returned 3
	[0068.421] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.421] lstrlenW (lpString=".dbf") returned 4
	[0068.421] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.421] lstrlenW (lpString=".1cd") returned 4
	[0068.421] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.421] lstrlenW (lpString=".jpg") returned 4
	[0068.421] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.421] lstrlenW (lpString=".doc") returned 4
	[0068.421] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.421] lstrlenW (lpString=".docx") returned 5
	[0068.421] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.421] lstrlenW (lpString=".pdf") returned 4
	[0068.421] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.421] lstrlenW (lpString=".xls") returned 4
	[0068.421] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.421] lstrlenW (lpString=".xlsx") returned 5
	[0068.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.421] lstrlenW (lpString=".ppt") returned 4
	[0068.421] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.421] lstrlenW (lpString=".zip") returned 4
	[0068.421] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.422] lstrlenW (lpString=".rar") returned 4
	[0068.422] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.422] lstrlenW (lpString=".bz2") returned 4
	[0068.422] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.422] lstrlenW (lpString=".7z") returned 3
	[0068.422] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.422] lstrlenW (lpString=".dbf") returned 4
	[0068.422] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.422] lstrlenW (lpString=".1cd") returned 4
	[0068.422] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0068.422] lstrlenW (lpString=".jpg") returned 4
	[0068.422] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.422] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.422] lstrlenW (lpString="AG00103_.GIF") returned 12
	[0068.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0068.422] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=12702) returned 1
	[0068.422] CloseHandle (hObject=0x33c) returned 1
	[0068.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220
	[0068.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0068.423] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.423] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0068.423] GetLastError () returned 0x0
	[0068.423] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x319e, lpOverlapped=0x0) returned 1
	[0068.432] WriteFile (in: hFile=0x34c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x31a0, lpOverlapped=0x0) returned 1
	[0068.433] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.433] WriteFile (in: hFile=0x34c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.433] SetEndOfFile (hFile=0x34c) returned 1
	[0068.433] CloseHandle (hObject=0x34c) returned 1
	[0068.435] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.436] SetEndOfFile (hFile=0x33c) returned 1
	[0068.436] CloseHandle (hObject=0x33c) returned 1
	[0068.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1
	[0068.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.437] lstrlenW (lpString=".doc") returned 4
	[0068.437] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.437] lstrlenW (lpString=".docx") returned 5
	[0068.437] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.437] lstrlenW (lpString=".pdf") returned 4
	[0068.437] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.437] lstrlenW (lpString=".xls") returned 4
	[0068.437] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.437] lstrlenW (lpString=".xlsx") returned 5
	[0068.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.438] lstrlenW (lpString=".ppt") returned 4
	[0068.438] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.438] lstrlenW (lpString=".zip") returned 4
	[0068.438] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.438] lstrlenW (lpString=".rar") returned 4
	[0068.438] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.438] lstrlenW (lpString=".bz2") returned 4
	[0068.438] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.438] lstrlenW (lpString=".7z") returned 3
	[0068.438] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.438] lstrlenW (lpString=".dbf") returned 4
	[0068.438] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.438] lstrlenW (lpString=".1cd") returned 4
	[0068.438] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.438] lstrlenW (lpString=".jpg") returned 4
	[0068.438] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.439] lstrlenW (lpString=".doc") returned 4
	[0068.439] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.439] lstrlenW (lpString=".docx") returned 5
	[0068.439] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.439] lstrlenW (lpString=".pdf") returned 4
	[0068.439] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.439] lstrlenW (lpString=".xls") returned 4
	[0068.439] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.439] lstrlenW (lpString=".xlsx") returned 5
	[0068.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.439] lstrlenW (lpString=".ppt") returned 4
	[0068.439] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.439] lstrlenW (lpString=".zip") returned 4
	[0068.439] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.439] lstrlenW (lpString=".rar") returned 4
	[0068.439] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.439] lstrlenW (lpString=".bz2") returned 4
	[0068.439] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.440] lstrlenW (lpString=".7z") returned 3
	[0068.440] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.440] lstrlenW (lpString=".dbf") returned 4
	[0068.440] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.440] lstrlenW (lpString=".1cd") returned 4
	[0068.440] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0068.440] lstrlenW (lpString=".jpg") returned 4
	[0068.440] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.440] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.440] lstrlenW (lpString="AG00126_.GIF") returned 12
	[0068.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0068.441] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3140) returned 1
	[0068.441] CloseHandle (hObject=0x33c) returned 1
	[0068.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220
	[0068.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0068.441] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.441] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0068.442] GetLastError () returned 0x0
	[0068.442] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xc44, lpOverlapped=0x0) returned 1
	[0068.740] WriteFile (in: hFile=0x34c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xc50, lpOverlapped=0x0) returned 1
	[0068.741] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.741] WriteFile (in: hFile=0x34c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.741] SetEndOfFile (hFile=0x34c) returned 1
	[0068.967] CloseHandle (hObject=0x34c) returned 1
	[0069.000] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.000] SetEndOfFile (hFile=0x33c) returned 1
	[0069.001] CloseHandle (hObject=0x33c) returned 1
	[0069.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1
	[0069.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.002] lstrlenW (lpString=".doc") returned 4
	[0069.002] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.002] lstrlenW (lpString=".docx") returned 5
	[0069.002] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.002] lstrlenW (lpString=".pdf") returned 4
	[0069.002] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.002] lstrlenW (lpString=".xls") returned 4
	[0069.002] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.002] lstrlenW (lpString=".xlsx") returned 5
	[0069.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.002] lstrlenW (lpString=".ppt") returned 4
	[0069.002] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.002] lstrlenW (lpString=".zip") returned 4
	[0069.002] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.002] lstrlenW (lpString=".rar") returned 4
	[0069.002] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.002] lstrlenW (lpString=".bz2") returned 4
	[0069.002] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.002] lstrlenW (lpString=".7z") returned 3
	[0069.002] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.002] lstrlenW (lpString=".dbf") returned 4
	[0069.002] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.002] lstrlenW (lpString=".1cd") returned 4
	[0069.002] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.002] lstrlenW (lpString=".jpg") returned 4
	[0069.003] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.003] lstrlenW (lpString=".doc") returned 4
	[0069.003] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.003] lstrlenW (lpString=".docx") returned 5
	[0069.003] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.003] lstrlenW (lpString=".pdf") returned 4
	[0069.003] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.003] lstrlenW (lpString=".xls") returned 4
	[0069.003] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.003] lstrlenW (lpString=".xlsx") returned 5
	[0069.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.003] lstrlenW (lpString=".ppt") returned 4
	[0069.003] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.003] lstrlenW (lpString=".zip") returned 4
	[0069.003] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.003] lstrlenW (lpString=".rar") returned 4
	[0069.003] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.003] lstrlenW (lpString=".bz2") returned 4
	[0069.003] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.003] lstrlenW (lpString=".7z") returned 3
	[0069.003] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.003] lstrlenW (lpString=".dbf") returned 4
	[0069.003] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.004] lstrlenW (lpString=".1cd") returned 4
	[0069.004] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.004] lstrlenW (lpString=".jpg") returned 4
	[0069.004] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.004] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.004] lstrlenW (lpString="AG00161_.GIF") returned 12
	[0069.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0069.006] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=7583) returned 1
	[0069.006] CloseHandle (hObject=0x34c) returned 1
	[0069.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220
	[0069.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0069.006] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.006] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0069.007] GetLastError () returned 0x0
	[0069.007] ReadFile (in: hFile=0x34c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1d9f, lpOverlapped=0x0) returned 1
	[0069.020] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1da0, lpOverlapped=0x0) returned 1
	[0069.021] ReadFile (in: hFile=0x34c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.021] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.021] SetEndOfFile (hFile=0x390) returned 1
	[0069.021] CloseHandle (hObject=0x390) returned 1
	[0069.022] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.022] SetEndOfFile (hFile=0x34c) returned 1
	[0069.023] CloseHandle (hObject=0x34c) returned 1
	[0069.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1
	[0069.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.023] lstrlenW (lpString=".doc") returned 4
	[0069.023] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.023] lstrlenW (lpString=".docx") returned 5
	[0069.024] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.024] lstrlenW (lpString=".pdf") returned 4
	[0069.024] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.024] lstrlenW (lpString=".xls") returned 4
	[0069.024] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.024] lstrlenW (lpString=".xlsx") returned 5
	[0069.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.024] lstrlenW (lpString=".ppt") returned 4
	[0069.024] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.024] lstrlenW (lpString=".zip") returned 4
	[0069.024] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.024] lstrlenW (lpString=".rar") returned 4
	[0069.024] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.024] lstrlenW (lpString=".bz2") returned 4
	[0069.024] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.024] lstrlenW (lpString=".7z") returned 3
	[0069.024] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.025] lstrlenW (lpString=".dbf") returned 4
	[0069.025] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.025] lstrlenW (lpString=".1cd") returned 4
	[0069.025] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.025] lstrlenW (lpString=".jpg") returned 4
	[0069.025] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.025] lstrlenW (lpString=".doc") returned 4
	[0069.025] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.025] lstrlenW (lpString=".docx") returned 5
	[0069.025] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.025] lstrlenW (lpString=".pdf") returned 4
	[0069.026] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.026] lstrlenW (lpString=".xls") returned 4
	[0069.026] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.026] lstrlenW (lpString=".xlsx") returned 5
	[0069.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.026] lstrlenW (lpString=".ppt") returned 4
	[0069.026] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.026] lstrlenW (lpString=".zip") returned 4
	[0069.026] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.026] lstrlenW (lpString=".rar") returned 4
	[0069.026] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.026] lstrlenW (lpString=".bz2") returned 4
	[0069.026] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.026] lstrlenW (lpString=".7z") returned 3
	[0069.026] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.026] lstrlenW (lpString=".dbf") returned 4
	[0069.026] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.026] lstrlenW (lpString=".1cd") returned 4
	[0069.026] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0069.026] lstrlenW (lpString=".jpg") returned 4
	[0069.027] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.027] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.027] lstrlenW (lpString="AG00164_.GIF") returned 12
	[0069.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0069.027] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=13254) returned 1
	[0069.027] CloseHandle (hObject=0x34c) returned 1
	[0069.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220
	[0069.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0069.032] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.032] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0069.032] GetLastError () returned 0x0
	[0069.032] ReadFile (in: hFile=0x34c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x33c6, lpOverlapped=0x0) returned 1
	[0069.041] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x33d0, lpOverlapped=0x0) returned 1
	[0069.042] ReadFile (in: hFile=0x34c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.042] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.042] SetEndOfFile (hFile=0x390) returned 1
	[0069.042] CloseHandle (hObject=0x390) returned 1
	[0069.043] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.043] SetEndOfFile (hFile=0x34c) returned 1
	[0069.044] CloseHandle (hObject=0x34c) returned 1
	[0069.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1
	[0069.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.045] lstrlenW (lpString=".doc") returned 4
	[0069.045] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.045] lstrlenW (lpString=".docx") returned 5
	[0069.045] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.045] lstrlenW (lpString=".pdf") returned 4
	[0069.045] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.045] lstrlenW (lpString=".xls") returned 4
	[0069.045] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.045] lstrlenW (lpString=".xlsx") returned 5
	[0069.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.046] lstrlenW (lpString=".ppt") returned 4
	[0069.046] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.046] lstrlenW (lpString=".zip") returned 4
	[0069.046] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.046] lstrlenW (lpString=".rar") returned 4
	[0069.046] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.046] lstrlenW (lpString=".bz2") returned 4
	[0069.046] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.046] lstrlenW (lpString=".7z") returned 3
	[0069.046] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.046] lstrlenW (lpString=".dbf") returned 4
	[0069.047] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.047] lstrlenW (lpString=".1cd") returned 4
	[0069.047] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.047] lstrlenW (lpString=".jpg") returned 4
	[0069.047] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.047] lstrlenW (lpString=".doc") returned 4
	[0069.047] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.047] lstrlenW (lpString=".docx") returned 5
	[0069.047] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.047] lstrlenW (lpString=".pdf") returned 4
	[0069.047] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.047] lstrlenW (lpString=".xls") returned 4
	[0069.047] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.047] lstrlenW (lpString=".xlsx") returned 5
	[0069.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.048] lstrlenW (lpString=".ppt") returned 4
	[0069.048] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.048] lstrlenW (lpString=".zip") returned 4
	[0069.048] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.048] lstrlenW (lpString=".rar") returned 4
	[0069.048] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.048] lstrlenW (lpString=".bz2") returned 4
	[0069.048] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.048] lstrlenW (lpString=".7z") returned 3
	[0069.048] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.048] lstrlenW (lpString=".dbf") returned 4
	[0069.048] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.048] lstrlenW (lpString=".1cd") returned 4
	[0069.048] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0069.048] lstrlenW (lpString=".jpg") returned 4
	[0069.048] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.049] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.049] lstrlenW (lpString="AG00167_.GIF") returned 12
	[0069.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0069.050] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=4894) returned 1
	[0069.050] CloseHandle (hObject=0x390) returned 1
	[0069.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220
	[0069.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0069.052] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.052] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0069.052] GetLastError () returned 0x0
	[0069.052] ReadFile (in: hFile=0x388, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x131e, lpOverlapped=0x0) returned 1
	[0069.062] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1320, lpOverlapped=0x0) returned 1
	[0069.063] ReadFile (in: hFile=0x388, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.063] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.063] SetEndOfFile (hFile=0x33c) returned 1
	[0069.063] CloseHandle (hObject=0x33c) returned 1
	[0069.064] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.064] SetEndOfFile (hFile=0x388) returned 1
	[0069.065] CloseHandle (hObject=0x388) returned 1
	[0069.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1
	[0069.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.425] lstrlenW (lpString=".doc") returned 4
	[0069.425] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.425] lstrlenW (lpString=".docx") returned 5
	[0069.425] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.425] lstrlenW (lpString=".pdf") returned 4
	[0069.425] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.425] lstrlenW (lpString=".xls") returned 4
	[0069.425] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.425] lstrlenW (lpString=".xlsx") returned 5
	[0069.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.425] lstrlenW (lpString=".ppt") returned 4
	[0069.425] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.425] lstrlenW (lpString=".zip") returned 4
	[0069.425] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.425] lstrlenW (lpString=".rar") returned 4
	[0069.425] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.426] lstrlenW (lpString=".bz2") returned 4
	[0069.426] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.426] lstrlenW (lpString=".7z") returned 3
	[0069.426] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.426] lstrlenW (lpString=".dbf") returned 4
	[0069.426] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.426] lstrlenW (lpString=".1cd") returned 4
	[0069.426] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.426] lstrlenW (lpString=".jpg") returned 4
	[0069.426] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.426] lstrlenW (lpString=".doc") returned 4
	[0069.426] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.426] lstrlenW (lpString=".docx") returned 5
	[0069.426] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.426] lstrlenW (lpString=".pdf") returned 4
	[0069.426] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.426] lstrlenW (lpString=".xls") returned 4
	[0069.426] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.427] lstrlenW (lpString=".xlsx") returned 5
	[0069.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.427] lstrlenW (lpString=".ppt") returned 4
	[0069.427] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.427] lstrlenW (lpString=".zip") returned 4
	[0069.427] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.427] lstrlenW (lpString=".rar") returned 4
	[0069.427] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.427] lstrlenW (lpString=".bz2") returned 4
	[0069.427] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.427] lstrlenW (lpString=".7z") returned 3
	[0069.427] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.427] lstrlenW (lpString=".dbf") returned 4
	[0069.427] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.427] lstrlenW (lpString=".1cd") returned 4
	[0069.427] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0069.427] lstrlenW (lpString=".jpg") returned 4
	[0069.427] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.428] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.428] lstrlenW (lpString="AG00175_.GIF") returned 12
	[0069.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.086] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3378) returned 1
	[0070.086] CloseHandle (hObject=0x374) returned 1
	[0070.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220
	[0070.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.086] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.087] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.096] GetLastError () returned 0x0
	[0070.096] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xd32, lpOverlapped=0x0) returned 1
	[0070.097] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xd40, lpOverlapped=0x0) returned 1
	[0070.098] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.099] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.099] SetEndOfFile (hFile=0x314) returned 1
	[0070.099] CloseHandle (hObject=0x314) returned 1
	[0070.100] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.100] SetEndOfFile (hFile=0x374) returned 1
	[0070.101] CloseHandle (hObject=0x374) returned 1
	[0070.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1
	[0070.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.102] lstrlenW (lpString=".doc") returned 4
	[0070.102] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.102] lstrlenW (lpString=".docx") returned 5
	[0070.102] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.102] lstrlenW (lpString=".pdf") returned 4
	[0070.102] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.102] lstrlenW (lpString=".xls") returned 4
	[0070.102] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.102] lstrlenW (lpString=".xlsx") returned 5
	[0070.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.102] lstrlenW (lpString=".ppt") returned 4
	[0070.102] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.102] lstrlenW (lpString=".zip") returned 4
	[0070.102] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.102] lstrlenW (lpString=".rar") returned 4
	[0070.102] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.102] lstrlenW (lpString=".bz2") returned 4
	[0070.102] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.102] lstrlenW (lpString=".7z") returned 3
	[0070.102] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.102] lstrlenW (lpString=".dbf") returned 4
	[0070.102] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.103] lstrlenW (lpString=".1cd") returned 4
	[0070.103] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.103] lstrlenW (lpString=".jpg") returned 4
	[0070.103] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.103] lstrlenW (lpString=".doc") returned 4
	[0070.103] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.103] lstrlenW (lpString=".docx") returned 5
	[0070.103] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.103] lstrlenW (lpString=".pdf") returned 4
	[0070.103] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.103] lstrlenW (lpString=".xls") returned 4
	[0070.103] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.103] lstrlenW (lpString=".xlsx") returned 5
	[0070.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.103] lstrlenW (lpString=".ppt") returned 4
	[0070.103] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.104] lstrlenW (lpString=".zip") returned 4
	[0070.104] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.104] lstrlenW (lpString=".rar") returned 4
	[0070.104] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.104] lstrlenW (lpString=".bz2") returned 4
	[0070.104] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.104] lstrlenW (lpString=".7z") returned 3
	[0070.104] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.104] lstrlenW (lpString=".dbf") returned 4
	[0070.104] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.104] lstrlenW (lpString=".1cd") returned 4
	[0070.104] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.104] lstrlenW (lpString=".jpg") returned 4
	[0070.104] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.104] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.104] lstrlenW (lpString="AN00853_.WMF") returned 12
	[0070.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.105] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=20578) returned 1
	[0070.105] CloseHandle (hObject=0x374) returned 1
	[0070.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220
	[0070.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.105] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.105] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.105] GetLastError () returned 0x0
	[0070.105] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x5062, lpOverlapped=0x0) returned 1
	[0070.107] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x5070, lpOverlapped=0x0) returned 1
	[0070.108] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.108] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.109] SetEndOfFile (hFile=0x314) returned 1
	[0070.109] CloseHandle (hObject=0x314) returned 1
	[0070.110] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.110] SetEndOfFile (hFile=0x374) returned 1
	[0070.111] CloseHandle (hObject=0x374) returned 1
	[0070.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1
	[0070.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.112] lstrlenW (lpString=".doc") returned 4
	[0070.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.112] lstrlenW (lpString=".docx") returned 5
	[0070.112] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.112] lstrlenW (lpString=".pdf") returned 4
	[0070.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.112] lstrlenW (lpString=".xls") returned 4
	[0070.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.112] lstrlenW (lpString=".xlsx") returned 5
	[0070.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.112] lstrlenW (lpString=".ppt") returned 4
	[0070.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.112] lstrlenW (lpString=".zip") returned 4
	[0070.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.112] lstrlenW (lpString=".rar") returned 4
	[0070.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.113] lstrlenW (lpString=".bz2") returned 4
	[0070.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.113] lstrlenW (lpString=".7z") returned 3
	[0070.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.113] lstrlenW (lpString=".dbf") returned 4
	[0070.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.113] lstrlenW (lpString=".1cd") returned 4
	[0070.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.113] lstrlenW (lpString=".jpg") returned 4
	[0070.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.113] lstrlenW (lpString=".doc") returned 4
	[0070.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.113] lstrlenW (lpString=".docx") returned 5
	[0070.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.113] lstrlenW (lpString=".pdf") returned 4
	[0070.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.113] lstrlenW (lpString=".xls") returned 4
	[0070.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.113] lstrlenW (lpString=".xlsx") returned 5
	[0070.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.113] lstrlenW (lpString=".ppt") returned 4
	[0070.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.114] lstrlenW (lpString=".zip") returned 4
	[0070.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.114] lstrlenW (lpString=".rar") returned 4
	[0070.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.114] lstrlenW (lpString=".bz2") returned 4
	[0070.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.114] lstrlenW (lpString=".7z") returned 3
	[0070.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.114] lstrlenW (lpString=".dbf") returned 4
	[0070.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.114] lstrlenW (lpString=".1cd") returned 4
	[0070.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0070.114] lstrlenW (lpString=".jpg") returned 4
	[0070.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.114] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.115] lstrlenW (lpString="AN00914_.WMF") returned 12
	[0070.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.115] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=10832) returned 1
	[0070.115] CloseHandle (hObject=0x374) returned 1
	[0070.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220
	[0070.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.115] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.115] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.116] GetLastError () returned 0x0
	[0070.116] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2a50, lpOverlapped=0x0) returned 1
	[0070.117] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2a60, lpOverlapped=0x0) returned 1
	[0070.119] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.119] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.119] SetEndOfFile (hFile=0x314) returned 1
	[0070.119] CloseHandle (hObject=0x314) returned 1
	[0070.120] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.120] SetEndOfFile (hFile=0x374) returned 1
	[0070.121] CloseHandle (hObject=0x374) returned 1
	[0070.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1
	[0070.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.121] lstrlenW (lpString=".doc") returned 4
	[0070.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.121] lstrlenW (lpString=".docx") returned 5
	[0070.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.121] lstrlenW (lpString=".pdf") returned 4
	[0070.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.121] lstrlenW (lpString=".xls") returned 4
	[0070.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.121] lstrlenW (lpString=".xlsx") returned 5
	[0070.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.122] lstrlenW (lpString=".ppt") returned 4
	[0070.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.122] lstrlenW (lpString=".zip") returned 4
	[0070.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.122] lstrlenW (lpString=".rar") returned 4
	[0070.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.122] lstrlenW (lpString=".bz2") returned 4
	[0070.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.122] lstrlenW (lpString=".7z") returned 3
	[0070.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.122] lstrlenW (lpString=".dbf") returned 4
	[0070.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.122] lstrlenW (lpString=".1cd") returned 4
	[0070.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.122] lstrlenW (lpString=".jpg") returned 4
	[0070.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.123] lstrlenW (lpString=".doc") returned 4
	[0070.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.123] lstrlenW (lpString=".docx") returned 5
	[0070.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.123] lstrlenW (lpString=".pdf") returned 4
	[0070.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.123] lstrlenW (lpString=".xls") returned 4
	[0070.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.123] lstrlenW (lpString=".xlsx") returned 5
	[0070.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.123] lstrlenW (lpString=".ppt") returned 4
	[0070.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.123] lstrlenW (lpString=".zip") returned 4
	[0070.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.123] lstrlenW (lpString=".rar") returned 4
	[0070.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.123] lstrlenW (lpString=".bz2") returned 4
	[0070.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.123] lstrlenW (lpString=".7z") returned 3
	[0070.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.123] lstrlenW (lpString=".dbf") returned 4
	[0070.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.123] lstrlenW (lpString=".1cd") returned 4
	[0070.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0070.124] lstrlenW (lpString=".jpg") returned 4
	[0070.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.124] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.124] lstrlenW (lpString="AN00932_.WMF") returned 12
	[0070.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.124] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=14428) returned 1
	[0070.124] CloseHandle (hObject=0x374) returned 1
	[0070.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220
	[0070.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.125] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.125] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.125] GetLastError () returned 0x0
	[0070.125] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x385c, lpOverlapped=0x0) returned 1
	[0070.127] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x3860, lpOverlapped=0x0) returned 1
	[0070.128] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.128] WriteFile (in: hFile=0x314, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.128] SetEndOfFile (hFile=0x314) returned 1
	[0070.128] CloseHandle (hObject=0x314) returned 1
	[0070.129] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.129] SetEndOfFile (hFile=0x374) returned 1
	[0070.130] CloseHandle (hObject=0x374) returned 1
	[0070.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1
	[0070.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.131] lstrlenW (lpString=".doc") returned 4
	[0070.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.131] lstrlenW (lpString=".docx") returned 5
	[0070.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.131] lstrlenW (lpString=".pdf") returned 4
	[0070.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.131] lstrlenW (lpString=".xls") returned 4
	[0070.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.131] lstrlenW (lpString=".xlsx") returned 5
	[0070.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.131] lstrlenW (lpString=".ppt") returned 4
	[0070.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.131] lstrlenW (lpString=".zip") returned 4
	[0070.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.132] lstrlenW (lpString=".rar") returned 4
	[0070.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.132] lstrlenW (lpString=".bz2") returned 4
	[0070.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.132] lstrlenW (lpString=".7z") returned 3
	[0070.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.132] lstrlenW (lpString=".dbf") returned 4
	[0070.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.132] lstrlenW (lpString=".1cd") returned 4
	[0070.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.132] lstrlenW (lpString=".jpg") returned 4
	[0070.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.132] lstrlenW (lpString=".doc") returned 4
	[0070.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.132] lstrlenW (lpString=".docx") returned 5
	[0070.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.132] lstrlenW (lpString=".pdf") returned 4
	[0070.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.132] lstrlenW (lpString=".xls") returned 4
	[0070.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.133] lstrlenW (lpString=".xlsx") returned 5
	[0070.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.133] lstrlenW (lpString=".ppt") returned 4
	[0070.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.133] lstrlenW (lpString=".zip") returned 4
	[0070.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.133] lstrlenW (lpString=".rar") returned 4
	[0070.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.133] lstrlenW (lpString=".bz2") returned 4
	[0070.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.133] lstrlenW (lpString=".7z") returned 3
	[0070.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.133] lstrlenW (lpString=".dbf") returned 4
	[0070.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.133] lstrlenW (lpString=".1cd") returned 4
	[0070.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0070.133] lstrlenW (lpString=".jpg") returned 4
	[0070.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.134] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.134] lstrlenW (lpString="AN00965_.WMF") returned 12
	[0070.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.726] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=7072) returned 1
	[0070.727] CloseHandle (hObject=0x374) returned 1
	[0070.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220
	[0070.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.820] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.820] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.821] GetLastError () returned 0x0
	[0070.821] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1ba0, lpOverlapped=0x0) returned 1
	[0070.823] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1bb0, lpOverlapped=0x0) returned 1
	[0070.824] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.824] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.824] SetEndOfFile (hFile=0x364) returned 1
	[0070.824] CloseHandle (hObject=0x364) returned 1
	[0070.825] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.825] SetEndOfFile (hFile=0x374) returned 1
	[0070.826] CloseHandle (hObject=0x374) returned 1
	[0070.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1
	[0070.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.827] lstrlenW (lpString=".doc") returned 4
	[0070.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.827] lstrlenW (lpString=".docx") returned 5
	[0070.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.827] lstrlenW (lpString=".pdf") returned 4
	[0070.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.827] lstrlenW (lpString=".xls") returned 4
	[0070.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.827] lstrlenW (lpString=".xlsx") returned 5
	[0070.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.827] lstrlenW (lpString=".ppt") returned 4
	[0070.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.827] lstrlenW (lpString=".zip") returned 4
	[0070.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.827] lstrlenW (lpString=".rar") returned 4
	[0070.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.827] lstrlenW (lpString=".bz2") returned 4
	[0070.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.827] lstrlenW (lpString=".7z") returned 3
	[0070.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.827] lstrlenW (lpString=".dbf") returned 4
	[0070.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.828] lstrlenW (lpString=".1cd") returned 4
	[0070.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.828] lstrlenW (lpString=".jpg") returned 4
	[0070.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.828] lstrlenW (lpString=".doc") returned 4
	[0070.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.828] lstrlenW (lpString=".docx") returned 5
	[0070.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.828] lstrlenW (lpString=".pdf") returned 4
	[0070.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.828] lstrlenW (lpString=".xls") returned 4
	[0070.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.828] lstrlenW (lpString=".xlsx") returned 5
	[0070.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.828] lstrlenW (lpString=".ppt") returned 4
	[0070.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.828] lstrlenW (lpString=".zip") returned 4
	[0070.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.828] lstrlenW (lpString=".rar") returned 4
	[0070.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.828] lstrlenW (lpString=".bz2") returned 4
	[0070.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.829] lstrlenW (lpString=".7z") returned 3
	[0070.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.829] lstrlenW (lpString=".dbf") returned 4
	[0070.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.829] lstrlenW (lpString=".1cd") returned 4
	[0070.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0070.829] lstrlenW (lpString=".jpg") returned 4
	[0070.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.829] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.829] lstrlenW (lpString="AN02122_.WMF") returned 12
	[0070.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.830] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=7540) returned 1
	[0070.830] CloseHandle (hObject=0x374) returned 1
	[0070.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220
	[0070.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.830] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.830] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.831] GetLastError () returned 0x0
	[0070.831] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1d74, lpOverlapped=0x0) returned 1
	[0070.832] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1d80, lpOverlapped=0x0) returned 1
	[0070.833] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.833] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.833] SetEndOfFile (hFile=0x364) returned 1
	[0070.834] CloseHandle (hObject=0x364) returned 1
	[0070.834] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.834] SetEndOfFile (hFile=0x374) returned 1
	[0070.835] CloseHandle (hObject=0x374) returned 1
	[0070.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1
	[0070.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.840] lstrlenW (lpString=".doc") returned 4
	[0070.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.840] lstrlenW (lpString=".docx") returned 5
	[0070.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.840] lstrlenW (lpString=".pdf") returned 4
	[0070.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.840] lstrlenW (lpString=".xls") returned 4
	[0070.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.840] lstrlenW (lpString=".xlsx") returned 5
	[0070.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.840] lstrlenW (lpString=".ppt") returned 4
	[0070.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.840] lstrlenW (lpString=".zip") returned 4
	[0070.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.840] lstrlenW (lpString=".rar") returned 4
	[0070.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.840] lstrlenW (lpString=".bz2") returned 4
	[0070.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.840] lstrlenW (lpString=".7z") returned 3
	[0070.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.840] lstrlenW (lpString=".dbf") returned 4
	[0070.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.840] lstrlenW (lpString=".1cd") returned 4
	[0070.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.841] lstrlenW (lpString=".jpg") returned 4
	[0070.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.841] lstrlenW (lpString=".doc") returned 4
	[0070.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.841] lstrlenW (lpString=".docx") returned 5
	[0070.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.841] lstrlenW (lpString=".pdf") returned 4
	[0070.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.841] lstrlenW (lpString=".xls") returned 4
	[0070.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.841] lstrlenW (lpString=".xlsx") returned 5
	[0070.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.841] lstrlenW (lpString=".ppt") returned 4
	[0070.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.841] lstrlenW (lpString=".zip") returned 4
	[0070.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.841] lstrlenW (lpString=".rar") returned 4
	[0070.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.841] lstrlenW (lpString=".bz2") returned 4
	[0070.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.841] lstrlenW (lpString=".7z") returned 3
	[0070.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.841] lstrlenW (lpString=".dbf") returned 4
	[0070.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.842] lstrlenW (lpString=".1cd") returned 4
	[0070.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0070.842] lstrlenW (lpString=".jpg") returned 4
	[0070.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.842] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.842] lstrlenW (lpString="AN02559_.WMF") returned 12
	[0070.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.843] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=6632) returned 1
	[0070.843] CloseHandle (hObject=0x374) returned 1
	[0070.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220
	[0070.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.843] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.843] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.844] GetLastError () returned 0x0
	[0070.844] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x19e8, lpOverlapped=0x0) returned 1
	[0070.845] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x19f0, lpOverlapped=0x0) returned 1
	[0070.846] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.846] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.846] SetEndOfFile (hFile=0x364) returned 1
	[0070.847] CloseHandle (hObject=0x364) returned 1
	[0070.847] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.847] SetEndOfFile (hFile=0x374) returned 1
	[0070.848] CloseHandle (hObject=0x374) returned 1
	[0070.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1
	[0070.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.849] lstrlenW (lpString=".doc") returned 4
	[0070.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.849] lstrlenW (lpString=".docx") returned 5
	[0070.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.849] lstrlenW (lpString=".pdf") returned 4
	[0070.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.849] lstrlenW (lpString=".xls") returned 4
	[0070.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.849] lstrlenW (lpString=".xlsx") returned 5
	[0070.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.849] lstrlenW (lpString=".ppt") returned 4
	[0070.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.849] lstrlenW (lpString=".zip") returned 4
	[0070.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.849] lstrlenW (lpString=".rar") returned 4
	[0070.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.849] lstrlenW (lpString=".bz2") returned 4
	[0070.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.849] lstrlenW (lpString=".7z") returned 3
	[0070.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.849] lstrlenW (lpString=".dbf") returned 4
	[0070.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.850] lstrlenW (lpString=".1cd") returned 4
	[0070.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.850] lstrlenW (lpString=".jpg") returned 4
	[0070.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.850] lstrlenW (lpString=".doc") returned 4
	[0070.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.850] lstrlenW (lpString=".docx") returned 5
	[0070.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.850] lstrlenW (lpString=".pdf") returned 4
	[0070.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.850] lstrlenW (lpString=".xls") returned 4
	[0070.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.850] lstrlenW (lpString=".xlsx") returned 5
	[0070.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.850] lstrlenW (lpString=".ppt") returned 4
	[0070.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.850] lstrlenW (lpString=".zip") returned 4
	[0070.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.850] lstrlenW (lpString=".rar") returned 4
	[0070.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.851] lstrlenW (lpString=".bz2") returned 4
	[0070.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.851] lstrlenW (lpString=".7z") returned 3
	[0070.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.851] lstrlenW (lpString=".dbf") returned 4
	[0070.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.851] lstrlenW (lpString=".1cd") returned 4
	[0070.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0070.851] lstrlenW (lpString=".jpg") returned 4
	[0070.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.851] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.851] lstrlenW (lpString="AN02724_.WMF") returned 12
	[0070.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.851] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2108) returned 1
	[0070.852] CloseHandle (hObject=0x374) returned 1
	[0070.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220
	[0070.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0070.852] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.852] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.852] GetLastError () returned 0x0
	[0071.140] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x83c, lpOverlapped=0x0) returned 1
	[0071.142] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x840, lpOverlapped=0x0) returned 1
	[0071.143] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.143] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.143] SetEndOfFile (hFile=0x364) returned 1
	[0071.143] CloseHandle (hObject=0x364) returned 1
	[0071.144] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.144] SetEndOfFile (hFile=0x374) returned 1
	[0071.145] CloseHandle (hObject=0x374) returned 1
	[0071.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1
	[0071.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.146] lstrlenW (lpString=".doc") returned 4
	[0071.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.146] lstrlenW (lpString=".docx") returned 5
	[0071.146] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.146] lstrlenW (lpString=".pdf") returned 4
	[0071.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.146] lstrlenW (lpString=".xls") returned 4
	[0071.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.146] lstrlenW (lpString=".xlsx") returned 5
	[0071.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.146] lstrlenW (lpString=".ppt") returned 4
	[0071.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.146] lstrlenW (lpString=".zip") returned 4
	[0071.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.146] lstrlenW (lpString=".rar") returned 4
	[0071.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.146] lstrlenW (lpString=".bz2") returned 4
	[0071.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.146] lstrlenW (lpString=".7z") returned 3
	[0071.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.146] lstrlenW (lpString=".dbf") returned 4
	[0071.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.147] lstrlenW (lpString=".1cd") returned 4
	[0071.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.147] lstrlenW (lpString=".jpg") returned 4
	[0071.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.147] lstrlenW (lpString=".doc") returned 4
	[0071.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.147] lstrlenW (lpString=".docx") returned 5
	[0071.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.147] lstrlenW (lpString=".pdf") returned 4
	[0071.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.147] lstrlenW (lpString=".xls") returned 4
	[0071.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.147] lstrlenW (lpString=".xlsx") returned 5
	[0071.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.147] lstrlenW (lpString=".ppt") returned 4
	[0071.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.147] lstrlenW (lpString=".zip") returned 4
	[0071.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.147] lstrlenW (lpString=".rar") returned 4
	[0071.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.147] lstrlenW (lpString=".bz2") returned 4
	[0071.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.148] lstrlenW (lpString=".7z") returned 3
	[0071.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.148] lstrlenW (lpString=".dbf") returned 4
	[0071.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.148] lstrlenW (lpString=".1cd") returned 4
	[0071.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.148] lstrlenW (lpString=".jpg") returned 4
	[0071.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.148] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.148] lstrlenW (lpString="AN04206_.WMF") returned 12
	[0071.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.148] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=7668) returned 1
	[0071.148] CloseHandle (hObject=0x374) returned 1
	[0071.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220
	[0071.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.149] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.149] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.149] GetLastError () returned 0x0
	[0071.149] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1df4, lpOverlapped=0x0) returned 1
	[0071.151] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1e00, lpOverlapped=0x0) returned 1
	[0071.152] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.153] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.153] SetEndOfFile (hFile=0x364) returned 1
	[0071.153] CloseHandle (hObject=0x364) returned 1
	[0071.153] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.153] SetEndOfFile (hFile=0x374) returned 1
	[0071.154] CloseHandle (hObject=0x374) returned 1
	[0071.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1
	[0071.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.155] lstrlenW (lpString=".doc") returned 4
	[0071.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.155] lstrlenW (lpString=".docx") returned 5
	[0071.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.155] lstrlenW (lpString=".pdf") returned 4
	[0071.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.155] lstrlenW (lpString=".xls") returned 4
	[0071.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.155] lstrlenW (lpString=".xlsx") returned 5
	[0071.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.155] lstrlenW (lpString=".ppt") returned 4
	[0071.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.156] lstrlenW (lpString=".zip") returned 4
	[0071.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.156] lstrlenW (lpString=".rar") returned 4
	[0071.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.156] lstrlenW (lpString=".bz2") returned 4
	[0071.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.156] lstrlenW (lpString=".7z") returned 3
	[0071.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.156] lstrlenW (lpString=".dbf") returned 4
	[0071.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.156] lstrlenW (lpString=".1cd") returned 4
	[0071.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.156] lstrlenW (lpString=".jpg") returned 4
	[0071.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.156] lstrlenW (lpString=".doc") returned 4
	[0071.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.157] lstrlenW (lpString=".docx") returned 5
	[0071.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.157] lstrlenW (lpString=".pdf") returned 4
	[0071.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.157] lstrlenW (lpString=".xls") returned 4
	[0071.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.157] lstrlenW (lpString=".xlsx") returned 5
	[0071.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.157] lstrlenW (lpString=".ppt") returned 4
	[0071.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.157] lstrlenW (lpString=".zip") returned 4
	[0071.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.157] lstrlenW (lpString=".rar") returned 4
	[0071.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.157] lstrlenW (lpString=".bz2") returned 4
	[0071.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.157] lstrlenW (lpString=".7z") returned 3
	[0071.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.157] lstrlenW (lpString=".dbf") returned 4
	[0071.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.158] lstrlenW (lpString=".1cd") returned 4
	[0071.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0071.158] lstrlenW (lpString=".jpg") returned 4
	[0071.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.158] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.158] lstrlenW (lpString="AN04225_.WMF") returned 12
	[0071.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.158] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=8492) returned 1
	[0071.158] CloseHandle (hObject=0x374) returned 1
	[0071.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220
	[0071.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.159] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.159] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.159] GetLastError () returned 0x0
	[0071.159] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x212c, lpOverlapped=0x0) returned 1
	[0071.161] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2130, lpOverlapped=0x0) returned 1
	[0071.162] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.162] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.162] SetEndOfFile (hFile=0x364) returned 1
	[0071.162] CloseHandle (hObject=0x364) returned 1
	[0071.163] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.163] SetEndOfFile (hFile=0x374) returned 1
	[0071.164] CloseHandle (hObject=0x374) returned 1
	[0071.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1
	[0071.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.165] lstrlenW (lpString=".doc") returned 4
	[0071.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.165] lstrlenW (lpString=".docx") returned 5
	[0071.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.165] lstrlenW (lpString=".pdf") returned 4
	[0071.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.165] lstrlenW (lpString=".xls") returned 4
	[0071.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.166] lstrlenW (lpString=".xlsx") returned 5
	[0071.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.166] lstrlenW (lpString=".ppt") returned 4
	[0071.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.166] lstrlenW (lpString=".zip") returned 4
	[0071.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.166] lstrlenW (lpString=".rar") returned 4
	[0071.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.166] lstrlenW (lpString=".bz2") returned 4
	[0071.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.166] lstrlenW (lpString=".7z") returned 3
	[0071.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.166] lstrlenW (lpString=".dbf") returned 4
	[0071.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.166] lstrlenW (lpString=".1cd") returned 4
	[0071.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.166] lstrlenW (lpString=".jpg") returned 4
	[0071.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.167] lstrlenW (lpString=".doc") returned 4
	[0071.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.167] lstrlenW (lpString=".docx") returned 5
	[0071.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.167] lstrlenW (lpString=".pdf") returned 4
	[0071.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.167] lstrlenW (lpString=".xls") returned 4
	[0071.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.167] lstrlenW (lpString=".xlsx") returned 5
	[0071.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.167] lstrlenW (lpString=".ppt") returned 4
	[0071.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.167] lstrlenW (lpString=".zip") returned 4
	[0071.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.167] lstrlenW (lpString=".rar") returned 4
	[0071.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.167] lstrlenW (lpString=".bz2") returned 4
	[0071.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.168] lstrlenW (lpString=".7z") returned 3
	[0071.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.168] lstrlenW (lpString=".dbf") returned 4
	[0071.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.168] lstrlenW (lpString=".1cd") returned 4
	[0071.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0071.168] lstrlenW (lpString=".jpg") returned 4
	[0071.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.168] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.168] lstrlenW (lpString="AN04235_.WMF") returned 12
	[0071.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.169] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=7804) returned 1
	[0071.169] CloseHandle (hObject=0x374) returned 1
	[0071.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220
	[0071.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.170] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.170] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.170] GetLastError () returned 0x0
	[0071.170] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1e7c, lpOverlapped=0x0) returned 1
	[0071.172] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1e80, lpOverlapped=0x0) returned 1
	[0071.173] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.173] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.173] SetEndOfFile (hFile=0x364) returned 1
	[0071.173] CloseHandle (hObject=0x364) returned 1
	[0071.174] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.174] SetEndOfFile (hFile=0x374) returned 1
	[0071.174] CloseHandle (hObject=0x374) returned 1
	[0071.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1
	[0071.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.175] lstrlenW (lpString=".doc") returned 4
	[0071.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.175] lstrlenW (lpString=".docx") returned 5
	[0071.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.175] lstrlenW (lpString=".pdf") returned 4
	[0071.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.175] lstrlenW (lpString=".xls") returned 4
	[0071.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.176] lstrlenW (lpString=".xlsx") returned 5
	[0071.176] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.176] lstrlenW (lpString=".ppt") returned 4
	[0071.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.176] lstrlenW (lpString=".zip") returned 4
	[0071.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.176] lstrlenW (lpString=".rar") returned 4
	[0071.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.176] lstrlenW (lpString=".bz2") returned 4
	[0071.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.176] lstrlenW (lpString=".7z") returned 3
	[0071.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.176] lstrlenW (lpString=".dbf") returned 4
	[0071.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.176] lstrlenW (lpString=".1cd") returned 4
	[0071.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.176] lstrlenW (lpString=".jpg") returned 4
	[0071.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.177] lstrlenW (lpString=".doc") returned 4
	[0071.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.177] lstrlenW (lpString=".docx") returned 5
	[0071.177] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.177] lstrlenW (lpString=".pdf") returned 4
	[0071.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.177] lstrlenW (lpString=".xls") returned 4
	[0071.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.177] lstrlenW (lpString=".xlsx") returned 5
	[0071.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.177] lstrlenW (lpString=".ppt") returned 4
	[0071.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.177] lstrlenW (lpString=".zip") returned 4
	[0071.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.177] lstrlenW (lpString=".rar") returned 4
	[0071.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.177] lstrlenW (lpString=".bz2") returned 4
	[0071.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.177] lstrlenW (lpString=".7z") returned 3
	[0071.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.177] lstrlenW (lpString=".dbf") returned 4
	[0071.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.177] lstrlenW (lpString=".1cd") returned 4
	[0071.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0071.178] lstrlenW (lpString=".jpg") returned 4
	[0071.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.178] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.178] lstrlenW (lpString="AN04267_.WMF") returned 12
	[0071.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.178] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=7804) returned 1
	[0071.179] CloseHandle (hObject=0x374) returned 1
	[0071.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220
	[0071.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.179] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.179] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.179] GetLastError () returned 0x0
	[0071.179] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1e7c, lpOverlapped=0x0) returned 1
	[0071.532] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1e80, lpOverlapped=0x0) returned 1
	[0071.533] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.533] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.533] SetEndOfFile (hFile=0x364) returned 1
	[0071.533] CloseHandle (hObject=0x364) returned 1
	[0071.534] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.534] SetEndOfFile (hFile=0x374) returned 1
	[0071.535] CloseHandle (hObject=0x374) returned 1
	[0071.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1
	[0071.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.536] lstrlenW (lpString=".doc") returned 4
	[0071.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.536] lstrlenW (lpString=".docx") returned 5
	[0071.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.536] lstrlenW (lpString=".pdf") returned 4
	[0071.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.536] lstrlenW (lpString=".xls") returned 4
	[0071.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.536] lstrlenW (lpString=".xlsx") returned 5
	[0071.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.536] lstrlenW (lpString=".ppt") returned 4
	[0071.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.536] lstrlenW (lpString=".zip") returned 4
	[0071.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.536] lstrlenW (lpString=".rar") returned 4
	[0071.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.537] lstrlenW (lpString=".bz2") returned 4
	[0071.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.537] lstrlenW (lpString=".7z") returned 3
	[0071.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.537] lstrlenW (lpString=".dbf") returned 4
	[0071.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.537] lstrlenW (lpString=".1cd") returned 4
	[0071.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.537] lstrlenW (lpString=".jpg") returned 4
	[0071.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.537] lstrlenW (lpString=".doc") returned 4
	[0071.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.537] lstrlenW (lpString=".docx") returned 5
	[0071.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.537] lstrlenW (lpString=".pdf") returned 4
	[0071.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.538] lstrlenW (lpString=".xls") returned 4
	[0071.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.538] lstrlenW (lpString=".xlsx") returned 5
	[0071.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.538] lstrlenW (lpString=".ppt") returned 4
	[0071.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.538] lstrlenW (lpString=".zip") returned 4
	[0071.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.538] lstrlenW (lpString=".rar") returned 4
	[0071.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.538] lstrlenW (lpString=".bz2") returned 4
	[0071.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.538] lstrlenW (lpString=".7z") returned 3
	[0071.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.538] lstrlenW (lpString=".dbf") returned 4
	[0071.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.538] lstrlenW (lpString=".1cd") returned 4
	[0071.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0071.539] lstrlenW (lpString=".jpg") returned 4
	[0071.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.539] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.539] lstrlenW (lpString="BD00155_.WMF") returned 12
	[0071.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.539] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=11636) returned 1
	[0071.539] CloseHandle (hObject=0x374) returned 1
	[0071.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220
	[0071.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.540] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.540] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.541] GetLastError () returned 0x0
	[0071.541] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2d74, lpOverlapped=0x0) returned 1
	[0071.542] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0071.543] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.543] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.544] SetEndOfFile (hFile=0x364) returned 1
	[0071.544] CloseHandle (hObject=0x364) returned 1
	[0071.544] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.544] SetEndOfFile (hFile=0x374) returned 1
	[0071.545] CloseHandle (hObject=0x374) returned 1
	[0071.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1
	[0071.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.546] lstrlenW (lpString=".doc") returned 4
	[0071.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.546] lstrlenW (lpString=".docx") returned 5
	[0071.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.546] lstrlenW (lpString=".pdf") returned 4
	[0071.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.546] lstrlenW (lpString=".xls") returned 4
	[0071.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.546] lstrlenW (lpString=".xlsx") returned 5
	[0071.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.546] lstrlenW (lpString=".ppt") returned 4
	[0071.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.546] lstrlenW (lpString=".zip") returned 4
	[0071.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.546] lstrlenW (lpString=".rar") returned 4
	[0071.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.547] lstrlenW (lpString=".bz2") returned 4
	[0071.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.547] lstrlenW (lpString=".7z") returned 3
	[0071.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.547] lstrlenW (lpString=".dbf") returned 4
	[0071.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.547] lstrlenW (lpString=".1cd") returned 4
	[0071.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.547] lstrlenW (lpString=".jpg") returned 4
	[0071.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.547] lstrlenW (lpString=".doc") returned 4
	[0071.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.547] lstrlenW (lpString=".docx") returned 5
	[0071.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.547] lstrlenW (lpString=".pdf") returned 4
	[0071.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.547] lstrlenW (lpString=".xls") returned 4
	[0071.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.547] lstrlenW (lpString=".xlsx") returned 5
	[0071.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.548] lstrlenW (lpString=".ppt") returned 4
	[0071.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.548] lstrlenW (lpString=".zip") returned 4
	[0071.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.548] lstrlenW (lpString=".rar") returned 4
	[0071.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.548] lstrlenW (lpString=".bz2") returned 4
	[0071.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.548] lstrlenW (lpString=".7z") returned 3
	[0071.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.548] lstrlenW (lpString=".dbf") returned 4
	[0071.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.548] lstrlenW (lpString=".1cd") returned 4
	[0071.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0071.548] lstrlenW (lpString=".jpg") returned 4
	[0071.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.549] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.549] lstrlenW (lpString="BD00160_.WMF") returned 12
	[0071.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.549] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=22516) returned 1
	[0071.549] CloseHandle (hObject=0x374) returned 1
	[0071.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220
	[0071.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.549] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.550] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.550] GetLastError () returned 0x0
	[0071.550] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x57f4, lpOverlapped=0x0) returned 1
	[0071.552] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x5800, lpOverlapped=0x0) returned 1
	[0071.553] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.553] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.553] SetEndOfFile (hFile=0x364) returned 1
	[0071.554] CloseHandle (hObject=0x364) returned 1
	[0071.555] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.555] SetEndOfFile (hFile=0x374) returned 1
	[0071.556] CloseHandle (hObject=0x374) returned 1
	[0071.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1
	[0071.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.557] lstrlenW (lpString=".doc") returned 4
	[0071.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.557] lstrlenW (lpString=".docx") returned 5
	[0071.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.557] lstrlenW (lpString=".pdf") returned 4
	[0071.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.557] lstrlenW (lpString=".xls") returned 4
	[0071.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.557] lstrlenW (lpString=".xlsx") returned 5
	[0071.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.557] lstrlenW (lpString=".ppt") returned 4
	[0071.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.557] lstrlenW (lpString=".zip") returned 4
	[0071.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.557] lstrlenW (lpString=".rar") returned 4
	[0071.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.557] lstrlenW (lpString=".bz2") returned 4
	[0071.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.557] lstrlenW (lpString=".7z") returned 3
	[0071.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.558] lstrlenW (lpString=".dbf") returned 4
	[0071.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.558] lstrlenW (lpString=".1cd") returned 4
	[0071.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.558] lstrlenW (lpString=".jpg") returned 4
	[0071.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.558] lstrlenW (lpString=".doc") returned 4
	[0071.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.558] lstrlenW (lpString=".docx") returned 5
	[0071.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.558] lstrlenW (lpString=".pdf") returned 4
	[0071.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.558] lstrlenW (lpString=".xls") returned 4
	[0071.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.558] lstrlenW (lpString=".xlsx") returned 5
	[0071.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.558] lstrlenW (lpString=".ppt") returned 4
	[0071.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.558] lstrlenW (lpString=".zip") returned 4
	[0071.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.559] lstrlenW (lpString=".rar") returned 4
	[0071.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.559] lstrlenW (lpString=".bz2") returned 4
	[0071.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.559] lstrlenW (lpString=".7z") returned 3
	[0071.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.559] lstrlenW (lpString=".dbf") returned 4
	[0071.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.559] lstrlenW (lpString=".1cd") returned 4
	[0071.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0071.559] lstrlenW (lpString=".jpg") returned 4
	[0071.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.559] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.559] lstrlenW (lpString="BD00173_.WMF") returned 12
	[0071.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.560] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=16180) returned 1
	[0071.560] CloseHandle (hObject=0x374) returned 1
	[0071.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220
	[0071.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0071.560] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.560] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.561] GetLastError () returned 0x0
	[0071.561] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x3f34, lpOverlapped=0x0) returned 1
	[0071.562] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x3f40, lpOverlapped=0x0) returned 1
	[0071.563] ReadFile (in: hFile=0x374, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.563] WriteFile (in: hFile=0x364, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.564] SetEndOfFile (hFile=0x364) returned 1
	[0071.564] CloseHandle (hObject=0x364) returned 1
	[0071.565] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.565] SetEndOfFile (hFile=0x374) returned 1
	[0071.566] CloseHandle (hObject=0x374) returned 1
	[0071.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1
	[0071.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.566] lstrlenW (lpString=".doc") returned 4
	[0071.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.567] lstrlenW (lpString=".docx") returned 5
	[0071.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.567] lstrlenW (lpString=".pdf") returned 4
	[0071.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.567] lstrlenW (lpString=".xls") returned 4
	[0071.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.567] lstrlenW (lpString=".xlsx") returned 5
	[0071.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.567] lstrlenW (lpString=".ppt") returned 4
	[0071.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.567] lstrlenW (lpString=".zip") returned 4
	[0071.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.567] lstrlenW (lpString=".rar") returned 4
	[0071.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.567] lstrlenW (lpString=".bz2") returned 4
	[0071.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.567] lstrlenW (lpString=".7z") returned 3
	[0071.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.567] lstrlenW (lpString=".dbf") returned 4
	[0071.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.567] lstrlenW (lpString=".1cd") returned 4
	[0071.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.568] lstrlenW (lpString=".jpg") returned 4
	[0071.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.568] lstrlenW (lpString=".doc") returned 4
	[0071.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.568] lstrlenW (lpString=".docx") returned 5
	[0071.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.568] lstrlenW (lpString=".pdf") returned 4
	[0071.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.568] lstrlenW (lpString=".xls") returned 4
	[0071.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.568] lstrlenW (lpString=".xlsx") returned 5
	[0071.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.568] lstrlenW (lpString=".ppt") returned 4
	[0071.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.568] lstrlenW (lpString=".zip") returned 4
	[0071.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.568] lstrlenW (lpString=".rar") returned 4
	[0071.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.569] lstrlenW (lpString=".bz2") returned 4
	[0071.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.569] lstrlenW (lpString=".7z") returned 3
	[0071.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.569] lstrlenW (lpString=".dbf") returned 4
	[0071.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.569] lstrlenW (lpString=".1cd") returned 4
	[0071.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0071.569] lstrlenW (lpString=".jpg") returned 4
	[0071.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.569] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.569] lstrlenW (lpString="BD05119_.WMF") returned 12
	[0071.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.139] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=17236) returned 1
	[0072.139] CloseHandle (hObject=0x380) returned 1
	[0072.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220
	[0072.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.140] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.140] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.140] GetLastError () returned 0x0
	[0072.141] ReadFile (in: hFile=0x380, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4354, lpOverlapped=0x0) returned 1
	[0072.142] WriteFile (in: hFile=0x350, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4360, lpOverlapped=0x0) returned 1
	[0072.143] ReadFile (in: hFile=0x380, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.143] WriteFile (in: hFile=0x350, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.144] SetEndOfFile (hFile=0x350) returned 1
	[0072.144] CloseHandle (hObject=0x350) returned 1
	[0072.145] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.145] SetEndOfFile (hFile=0x380) returned 1
	[0072.146] CloseHandle (hObject=0x380) returned 1
	[0072.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1
	[0072.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.147] lstrlenW (lpString=".doc") returned 4
	[0072.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.147] lstrlenW (lpString=".docx") returned 5
	[0072.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.147] lstrlenW (lpString=".pdf") returned 4
	[0072.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.147] lstrlenW (lpString=".xls") returned 4
	[0072.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.147] lstrlenW (lpString=".xlsx") returned 5
	[0072.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.147] lstrlenW (lpString=".ppt") returned 4
	[0072.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.147] lstrlenW (lpString=".zip") returned 4
	[0072.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.147] lstrlenW (lpString=".rar") returned 4
	[0072.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.147] lstrlenW (lpString=".bz2") returned 4
	[0072.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.148] lstrlenW (lpString=".7z") returned 3
	[0072.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.148] lstrlenW (lpString=".dbf") returned 4
	[0072.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.149] lstrlenW (lpString=".1cd") returned 4
	[0072.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.149] lstrlenW (lpString=".jpg") returned 4
	[0072.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.150] lstrlenW (lpString=".doc") returned 4
	[0072.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.150] lstrlenW (lpString=".docx") returned 5
	[0072.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.150] lstrlenW (lpString=".pdf") returned 4
	[0072.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.150] lstrlenW (lpString=".xls") returned 4
	[0072.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.150] lstrlenW (lpString=".xlsx") returned 5
	[0072.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.150] lstrlenW (lpString=".ppt") returned 4
	[0072.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.150] lstrlenW (lpString=".zip") returned 4
	[0072.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.151] lstrlenW (lpString=".rar") returned 4
	[0072.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.151] lstrlenW (lpString=".bz2") returned 4
	[0072.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.151] lstrlenW (lpString=".7z") returned 3
	[0072.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.151] lstrlenW (lpString=".dbf") returned 4
	[0072.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.151] lstrlenW (lpString=".1cd") returned 4
	[0072.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.151] lstrlenW (lpString=".jpg") returned 4
	[0072.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.151] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.152] lstrlenW (lpString="BD06200_.WMF") returned 12
	[0072.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.152] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=16676) returned 1
	[0072.152] CloseHandle (hObject=0x380) returned 1
	[0072.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220
	[0072.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.152] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.153] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.153] GetLastError () returned 0x0
	[0072.153] ReadFile (in: hFile=0x380, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4124, lpOverlapped=0x0) returned 1
	[0072.155] WriteFile (in: hFile=0x350, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4130, lpOverlapped=0x0) returned 1
	[0072.156] ReadFile (in: hFile=0x380, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.156] WriteFile (in: hFile=0x350, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.156] SetEndOfFile (hFile=0x350) returned 1
	[0072.156] CloseHandle (hObject=0x350) returned 1
	[0072.158] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.158] SetEndOfFile (hFile=0x380) returned 1
	[0072.159] CloseHandle (hObject=0x380) returned 1
	[0072.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1
	[0072.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.160] lstrlenW (lpString=".doc") returned 4
	[0072.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.160] lstrlenW (lpString=".docx") returned 5
	[0072.160] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.160] lstrlenW (lpString=".pdf") returned 4
	[0072.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.161] lstrlenW (lpString=".xls") returned 4
	[0072.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.161] lstrlenW (lpString=".xlsx") returned 5
	[0072.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.161] lstrlenW (lpString=".ppt") returned 4
	[0072.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.161] lstrlenW (lpString=".zip") returned 4
	[0072.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.161] lstrlenW (lpString=".rar") returned 4
	[0072.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.161] lstrlenW (lpString=".bz2") returned 4
	[0072.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.161] lstrlenW (lpString=".7z") returned 3
	[0072.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.161] lstrlenW (lpString=".dbf") returned 4
	[0072.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.161] lstrlenW (lpString=".1cd") returned 4
	[0072.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.161] lstrlenW (lpString=".jpg") returned 4
	[0072.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.161] lstrlenW (lpString=".doc") returned 4
	[0072.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.161] lstrlenW (lpString=".docx") returned 5
	[0072.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.162] lstrlenW (lpString=".pdf") returned 4
	[0072.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.162] lstrlenW (lpString=".xls") returned 4
	[0072.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.162] lstrlenW (lpString=".xlsx") returned 5
	[0072.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.162] lstrlenW (lpString=".ppt") returned 4
	[0072.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.163] lstrlenW (lpString=".zip") returned 4
	[0072.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.163] lstrlenW (lpString=".rar") returned 4
	[0072.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.163] lstrlenW (lpString=".bz2") returned 4
	[0072.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.163] lstrlenW (lpString=".7z") returned 3
	[0072.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.163] lstrlenW (lpString=".dbf") returned 4
	[0072.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.163] lstrlenW (lpString=".1cd") returned 4
	[0072.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.163] lstrlenW (lpString=".jpg") returned 4
	[0072.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.163] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.163] lstrlenW (lpString="BD07761_.WMF") returned 12
	[0072.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.164] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=26748) returned 1
	[0072.164] CloseHandle (hObject=0x350) returned 1
	[0072.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220
	[0072.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.166] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.166] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.166] GetLastError () returned 0x0
	[0072.166] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x687c, lpOverlapped=0x0) returned 1
	[0072.172] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x6880, lpOverlapped=0x0) returned 1
	[0072.174] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.174] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.174] SetEndOfFile (hFile=0x390) returned 1
	[0072.174] CloseHandle (hObject=0x390) returned 1
	[0072.175] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.175] SetEndOfFile (hFile=0x350) returned 1
	[0072.177] CloseHandle (hObject=0x350) returned 1
	[0072.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1
	[0072.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.178] lstrlenW (lpString=".doc") returned 4
	[0072.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.178] lstrlenW (lpString=".docx") returned 5
	[0072.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.178] lstrlenW (lpString=".pdf") returned 4
	[0072.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.178] lstrlenW (lpString=".xls") returned 4
	[0072.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.178] lstrlenW (lpString=".xlsx") returned 5
	[0072.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.178] lstrlenW (lpString=".ppt") returned 4
	[0072.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.178] lstrlenW (lpString=".zip") returned 4
	[0072.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.178] lstrlenW (lpString=".rar") returned 4
	[0072.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.178] lstrlenW (lpString=".bz2") returned 4
	[0072.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.178] lstrlenW (lpString=".7z") returned 3
	[0072.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.178] lstrlenW (lpString=".dbf") returned 4
	[0072.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.178] lstrlenW (lpString=".1cd") returned 4
	[0072.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.179] lstrlenW (lpString=".jpg") returned 4
	[0072.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.179] lstrlenW (lpString=".doc") returned 4
	[0072.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.179] lstrlenW (lpString=".docx") returned 5
	[0072.179] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.179] lstrlenW (lpString=".pdf") returned 4
	[0072.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.179] lstrlenW (lpString=".xls") returned 4
	[0072.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.179] lstrlenW (lpString=".xlsx") returned 5
	[0072.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.179] lstrlenW (lpString=".ppt") returned 4
	[0072.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.179] lstrlenW (lpString=".zip") returned 4
	[0072.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.179] lstrlenW (lpString=".rar") returned 4
	[0072.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.179] lstrlenW (lpString=".bz2") returned 4
	[0072.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.179] lstrlenW (lpString=".7z") returned 3
	[0072.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.179] lstrlenW (lpString=".dbf") returned 4
	[0072.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.180] lstrlenW (lpString=".1cd") returned 4
	[0072.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.180] lstrlenW (lpString=".jpg") returned 4
	[0072.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.180] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.180] lstrlenW (lpString="BD07804_.WMF") returned 12
	[0072.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.180] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=4924) returned 1
	[0072.180] CloseHandle (hObject=0x350) returned 1
	[0072.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220
	[0072.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.181] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.181] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.181] GetLastError () returned 0x0
	[0072.181] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x133c, lpOverlapped=0x0) returned 1
	[0072.589] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1340, lpOverlapped=0x0) returned 1
	[0072.590] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.590] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.590] SetEndOfFile (hFile=0x390) returned 1
	[0072.591] CloseHandle (hObject=0x390) returned 1
	[0072.592] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.592] SetEndOfFile (hFile=0x350) returned 1
	[0072.593] CloseHandle (hObject=0x350) returned 1
	[0072.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1
	[0072.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.594] lstrlenW (lpString=".doc") returned 4
	[0072.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.594] lstrlenW (lpString=".docx") returned 5
	[0072.594] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.594] lstrlenW (lpString=".pdf") returned 4
	[0072.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.594] lstrlenW (lpString=".xls") returned 4
	[0072.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.594] lstrlenW (lpString=".xlsx") returned 5
	[0072.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.594] lstrlenW (lpString=".ppt") returned 4
	[0072.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.594] lstrlenW (lpString=".zip") returned 4
	[0072.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.594] lstrlenW (lpString=".rar") returned 4
	[0072.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.595] lstrlenW (lpString=".bz2") returned 4
	[0072.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.595] lstrlenW (lpString=".7z") returned 3
	[0072.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.595] lstrlenW (lpString=".dbf") returned 4
	[0072.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.595] lstrlenW (lpString=".1cd") returned 4
	[0072.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.595] lstrlenW (lpString=".jpg") returned 4
	[0072.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.595] lstrlenW (lpString=".doc") returned 4
	[0072.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.595] lstrlenW (lpString=".docx") returned 5
	[0072.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.595] lstrlenW (lpString=".pdf") returned 4
	[0072.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.595] lstrlenW (lpString=".xls") returned 4
	[0072.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.595] lstrlenW (lpString=".xlsx") returned 5
	[0072.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.595] lstrlenW (lpString=".ppt") returned 4
	[0072.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.596] lstrlenW (lpString=".zip") returned 4
	[0072.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.596] lstrlenW (lpString=".rar") returned 4
	[0072.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.596] lstrlenW (lpString=".bz2") returned 4
	[0072.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.596] lstrlenW (lpString=".7z") returned 3
	[0072.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.596] lstrlenW (lpString=".dbf") returned 4
	[0072.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.596] lstrlenW (lpString=".1cd") returned 4
	[0072.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.596] lstrlenW (lpString=".jpg") returned 4
	[0072.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.596] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0072.596] lstrlenW (lpString="BD10890_.GIF") returned 12
	[0072.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.597] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=13515) returned 1
	[0072.597] CloseHandle (hObject=0x350) returned 1
	[0072.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220
	[0072.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.598] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.598] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.598] GetLastError () returned 0x0
	[0072.598] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x34cb, lpOverlapped=0x0) returned 1
	[0072.600] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x34d0, lpOverlapped=0x0) returned 1
	[0072.601] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.601] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.601] SetEndOfFile (hFile=0x390) returned 1
	[0072.601] CloseHandle (hObject=0x390) returned 1
	[0072.602] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.602] SetEndOfFile (hFile=0x350) returned 1
	[0072.603] CloseHandle (hObject=0x350) returned 1
	[0072.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1
	[0072.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.604] lstrlenW (lpString=".doc") returned 4
	[0072.604] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0072.604] lstrlenW (lpString=".docx") returned 5
	[0072.604] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0072.604] lstrlenW (lpString=".pdf") returned 4
	[0072.604] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0072.604] lstrlenW (lpString=".xls") returned 4
	[0072.604] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0072.604] lstrlenW (lpString=".xlsx") returned 5
	[0072.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0072.604] lstrlenW (lpString=".ppt") returned 4
	[0072.604] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0072.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.604] lstrlenW (lpString=".zip") returned 4
	[0072.604] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0072.604] lstrlenW (lpString=".rar") returned 4
	[0072.604] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0072.604] lstrlenW (lpString=".bz2") returned 4
	[0072.604] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0072.605] lstrlenW (lpString=".7z") returned 3
	[0072.605] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0072.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.605] lstrlenW (lpString=".dbf") returned 4
	[0072.605] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0072.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.605] lstrlenW (lpString=".1cd") returned 4
	[0072.605] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0072.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.605] lstrlenW (lpString=".jpg") returned 4
	[0072.605] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0072.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.605] lstrlenW (lpString=".doc") returned 4
	[0072.605] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0072.605] lstrlenW (lpString=".docx") returned 5
	[0072.605] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0072.605] lstrlenW (lpString=".pdf") returned 4
	[0072.605] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0072.605] lstrlenW (lpString=".xls") returned 4
	[0072.605] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0072.605] lstrlenW (lpString=".xlsx") returned 5
	[0072.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0072.606] lstrlenW (lpString=".ppt") returned 4
	[0072.606] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0072.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.606] lstrlenW (lpString=".zip") returned 4
	[0072.606] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0072.606] lstrlenW (lpString=".rar") returned 4
	[0072.606] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0072.606] lstrlenW (lpString=".bz2") returned 4
	[0072.606] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0072.606] lstrlenW (lpString=".7z") returned 3
	[0072.606] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0072.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.606] lstrlenW (lpString=".dbf") returned 4
	[0072.606] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0072.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.606] lstrlenW (lpString=".1cd") returned 4
	[0072.606] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0072.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0072.606] lstrlenW (lpString=".jpg") returned 4
	[0072.606] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0072.607] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0072.607] lstrlenW (lpString="BD10972_.GIF") returned 12
	[0072.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.607] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=20189) returned 1
	[0072.607] CloseHandle (hObject=0x350) returned 1
	[0072.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220
	[0072.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.608] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.608] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.612] GetLastError () returned 0x0
	[0072.612] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4edd, lpOverlapped=0x0) returned 1
	[0072.614] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4ee0, lpOverlapped=0x0) returned 1
	[0072.615] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.615] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.615] SetEndOfFile (hFile=0x390) returned 1
	[0072.615] CloseHandle (hObject=0x390) returned 1
	[0072.616] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.617] SetEndOfFile (hFile=0x350) returned 1
	[0072.617] CloseHandle (hObject=0x350) returned 1
	[0072.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1
	[0072.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.618] lstrlenW (lpString=".doc") returned 4
	[0072.618] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0072.618] lstrlenW (lpString=".docx") returned 5
	[0072.618] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0072.618] lstrlenW (lpString=".pdf") returned 4
	[0072.618] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0072.618] lstrlenW (lpString=".xls") returned 4
	[0072.618] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0072.618] lstrlenW (lpString=".xlsx") returned 5
	[0072.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0072.618] lstrlenW (lpString=".ppt") returned 4
	[0072.619] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0072.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.619] lstrlenW (lpString=".zip") returned 4
	[0072.619] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0072.619] lstrlenW (lpString=".rar") returned 4
	[0072.619] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0072.619] lstrlenW (lpString=".bz2") returned 4
	[0072.619] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0072.619] lstrlenW (lpString=".7z") returned 3
	[0072.619] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0072.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.619] lstrlenW (lpString=".dbf") returned 4
	[0072.619] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0072.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.619] lstrlenW (lpString=".1cd") returned 4
	[0072.619] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0072.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.619] lstrlenW (lpString=".jpg") returned 4
	[0072.619] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0072.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.619] lstrlenW (lpString=".doc") returned 4
	[0072.619] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0072.619] lstrlenW (lpString=".docx") returned 5
	[0072.620] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0072.620] lstrlenW (lpString=".pdf") returned 4
	[0072.620] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0072.620] lstrlenW (lpString=".xls") returned 4
	[0072.620] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0072.620] lstrlenW (lpString=".xlsx") returned 5
	[0072.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0072.620] lstrlenW (lpString=".ppt") returned 4
	[0072.620] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0072.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.620] lstrlenW (lpString=".zip") returned 4
	[0072.620] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0072.620] lstrlenW (lpString=".rar") returned 4
	[0072.620] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0072.620] lstrlenW (lpString=".bz2") returned 4
	[0072.620] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0072.620] lstrlenW (lpString=".7z") returned 3
	[0072.620] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0072.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.620] lstrlenW (lpString=".dbf") returned 4
	[0072.620] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0072.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.620] lstrlenW (lpString=".1cd") returned 4
	[0072.621] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0072.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0072.621] lstrlenW (lpString=".jpg") returned 4
	[0072.621] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0072.621] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0072.621] lstrlenW (lpString="BD19563_.GIF") returned 12
	[0072.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.621] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=20454) returned 1
	[0072.621] CloseHandle (hObject=0x350) returned 1
	[0072.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220
	[0072.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.622] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.622] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.622] GetLastError () returned 0x0
	[0072.622] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4fe6, lpOverlapped=0x0) returned 1
	[0072.936] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4ff0, lpOverlapped=0x0) returned 1
	[0072.937] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.937] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.938] SetEndOfFile (hFile=0x390) returned 1
	[0073.115] CloseHandle (hObject=0x390) returned 1
	[0073.116] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.116] SetEndOfFile (hFile=0x350) returned 1
	[0073.117] CloseHandle (hObject=0x350) returned 1
	[0073.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1
	[0073.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.118] lstrlenW (lpString=".doc") returned 4
	[0073.118] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0073.118] lstrlenW (lpString=".docx") returned 5
	[0073.118] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0073.118] lstrlenW (lpString=".pdf") returned 4
	[0073.118] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0073.118] lstrlenW (lpString=".xls") returned 4
	[0073.118] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0073.118] lstrlenW (lpString=".xlsx") returned 5
	[0073.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0073.118] lstrlenW (lpString=".ppt") returned 4
	[0073.118] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0073.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.118] lstrlenW (lpString=".zip") returned 4
	[0073.118] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0073.118] lstrlenW (lpString=".rar") returned 4
	[0073.118] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0073.118] lstrlenW (lpString=".bz2") returned 4
	[0073.118] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0073.118] lstrlenW (lpString=".7z") returned 3
	[0073.118] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0073.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.118] lstrlenW (lpString=".dbf") returned 4
	[0073.118] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0073.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.118] lstrlenW (lpString=".1cd") returned 4
	[0073.119] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0073.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.119] lstrlenW (lpString=".jpg") returned 4
	[0073.119] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0073.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.119] lstrlenW (lpString=".doc") returned 4
	[0073.119] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0073.119] lstrlenW (lpString=".docx") returned 5
	[0073.119] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0073.119] lstrlenW (lpString=".pdf") returned 4
	[0073.119] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0073.119] lstrlenW (lpString=".xls") returned 4
	[0073.119] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0073.119] lstrlenW (lpString=".xlsx") returned 5
	[0073.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0073.119] lstrlenW (lpString=".ppt") returned 4
	[0073.119] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0073.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.119] lstrlenW (lpString=".zip") returned 4
	[0073.119] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0073.119] lstrlenW (lpString=".rar") returned 4
	[0073.119] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0073.119] lstrlenW (lpString=".bz2") returned 4
	[0073.119] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0073.119] lstrlenW (lpString=".7z") returned 3
	[0073.119] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0073.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.120] lstrlenW (lpString=".dbf") returned 4
	[0073.120] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0073.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.120] lstrlenW (lpString=".1cd") returned 4
	[0073.120] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0073.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.120] lstrlenW (lpString=".jpg") returned 4
	[0073.120] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0073.120] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.120] lstrlenW (lpString="BL00148_.WMF") returned 12
	[0073.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.121] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1696) returned 1
	[0073.121] CloseHandle (hObject=0x350) returned 1
	[0073.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220
	[0073.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.121] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.121] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.122] GetLastError () returned 0x0
	[0073.122] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x6a0, lpOverlapped=0x0) returned 1
	[0073.123] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x6b0, lpOverlapped=0x0) returned 1
	[0073.124] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.124] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.124] SetEndOfFile (hFile=0x390) returned 1
	[0073.124] CloseHandle (hObject=0x390) returned 1
	[0073.125] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.125] SetEndOfFile (hFile=0x350) returned 1
	[0073.126] CloseHandle (hObject=0x350) returned 1
	[0073.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1
	[0073.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.127] lstrlenW (lpString=".doc") returned 4
	[0073.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.127] lstrlenW (lpString=".docx") returned 5
	[0073.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.127] lstrlenW (lpString=".pdf") returned 4
	[0073.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.127] lstrlenW (lpString=".xls") returned 4
	[0073.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.127] lstrlenW (lpString=".xlsx") returned 5
	[0073.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.127] lstrlenW (lpString=".ppt") returned 4
	[0073.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.127] lstrlenW (lpString=".zip") returned 4
	[0073.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.127] lstrlenW (lpString=".rar") returned 4
	[0073.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.127] lstrlenW (lpString=".bz2") returned 4
	[0073.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.127] lstrlenW (lpString=".7z") returned 3
	[0073.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.127] lstrlenW (lpString=".dbf") returned 4
	[0073.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.127] lstrlenW (lpString=".1cd") returned 4
	[0073.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.128] lstrlenW (lpString=".jpg") returned 4
	[0073.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.128] lstrlenW (lpString=".doc") returned 4
	[0073.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.128] lstrlenW (lpString=".docx") returned 5
	[0073.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.128] lstrlenW (lpString=".pdf") returned 4
	[0073.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.128] lstrlenW (lpString=".xls") returned 4
	[0073.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.128] lstrlenW (lpString=".xlsx") returned 5
	[0073.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.128] lstrlenW (lpString=".ppt") returned 4
	[0073.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.128] lstrlenW (lpString=".zip") returned 4
	[0073.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.128] lstrlenW (lpString=".rar") returned 4
	[0073.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.129] lstrlenW (lpString=".bz2") returned 4
	[0073.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.129] lstrlenW (lpString=".7z") returned 3
	[0073.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.129] lstrlenW (lpString=".dbf") returned 4
	[0073.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.129] lstrlenW (lpString=".1cd") returned 4
	[0073.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.129] lstrlenW (lpString=".jpg") returned 4
	[0073.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.129] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.129] lstrlenW (lpString="BL00152_.WMF") returned 12
	[0073.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.130] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1516) returned 1
	[0073.130] CloseHandle (hObject=0x350) returned 1
	[0073.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220
	[0073.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.130] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.130] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.131] GetLastError () returned 0x0
	[0073.131] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x5ec, lpOverlapped=0x0) returned 1
	[0073.132] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x5f0, lpOverlapped=0x0) returned 1
	[0073.133] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.133] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.133] SetEndOfFile (hFile=0x390) returned 1
	[0073.133] CloseHandle (hObject=0x390) returned 1
	[0073.134] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.134] SetEndOfFile (hFile=0x350) returned 1
	[0073.135] CloseHandle (hObject=0x350) returned 1
	[0073.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1
	[0073.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.135] lstrlenW (lpString=".doc") returned 4
	[0073.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.135] lstrlenW (lpString=".docx") returned 5
	[0073.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.135] lstrlenW (lpString=".pdf") returned 4
	[0073.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.136] lstrlenW (lpString=".xls") returned 4
	[0073.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.136] lstrlenW (lpString=".xlsx") returned 5
	[0073.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.136] lstrlenW (lpString=".ppt") returned 4
	[0073.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.136] lstrlenW (lpString=".zip") returned 4
	[0073.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.136] lstrlenW (lpString=".rar") returned 4
	[0073.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.136] lstrlenW (lpString=".bz2") returned 4
	[0073.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.136] lstrlenW (lpString=".7z") returned 3
	[0073.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.136] lstrlenW (lpString=".dbf") returned 4
	[0073.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.136] lstrlenW (lpString=".1cd") returned 4
	[0073.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.136] lstrlenW (lpString=".jpg") returned 4
	[0073.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.137] lstrlenW (lpString=".doc") returned 4
	[0073.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.137] lstrlenW (lpString=".docx") returned 5
	[0073.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.137] lstrlenW (lpString=".pdf") returned 4
	[0073.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.137] lstrlenW (lpString=".xls") returned 4
	[0073.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.137] lstrlenW (lpString=".xlsx") returned 5
	[0073.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.137] lstrlenW (lpString=".ppt") returned 4
	[0073.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.137] lstrlenW (lpString=".zip") returned 4
	[0073.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.137] lstrlenW (lpString=".rar") returned 4
	[0073.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.137] lstrlenW (lpString=".bz2") returned 4
	[0073.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.137] lstrlenW (lpString=".7z") returned 3
	[0073.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.137] lstrlenW (lpString=".dbf") returned 4
	[0073.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.137] lstrlenW (lpString=".1cd") returned 4
	[0073.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.138] lstrlenW (lpString=".jpg") returned 4
	[0073.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.138] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.138] lstrlenW (lpString="BL00194_.WMF") returned 12
	[0073.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.138] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3986) returned 1
	[0073.138] CloseHandle (hObject=0x350) returned 1
	[0073.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220
	[0073.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.139] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.139] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.139] GetLastError () returned 0x0
	[0073.139] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xf92, lpOverlapped=0x0) returned 1
	[0073.140] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xfa0, lpOverlapped=0x0) returned 1
	[0073.141] ReadFile (in: hFile=0x350, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.141] WriteFile (in: hFile=0x390, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.141] SetEndOfFile (hFile=0x390) returned 1
	[0073.142] CloseHandle (hObject=0x390) returned 1
	[0073.142] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.142] SetEndOfFile (hFile=0x350) returned 1
	[0073.143] CloseHandle (hObject=0x350) returned 1
	[0073.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1
	[0073.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.144] lstrlenW (lpString=".doc") returned 4
	[0073.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.144] lstrlenW (lpString=".docx") returned 5
	[0073.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.144] lstrlenW (lpString=".pdf") returned 4
	[0073.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.144] lstrlenW (lpString=".xls") returned 4
	[0073.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.144] lstrlenW (lpString=".xlsx") returned 5
	[0073.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.144] lstrlenW (lpString=".ppt") returned 4
	[0073.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.144] lstrlenW (lpString=".zip") returned 4
	[0073.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.144] lstrlenW (lpString=".rar") returned 4
	[0073.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.144] lstrlenW (lpString=".bz2") returned 4
	[0073.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.145] lstrlenW (lpString=".7z") returned 3
	[0073.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.145] lstrlenW (lpString=".dbf") returned 4
	[0073.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.145] lstrlenW (lpString=".1cd") returned 4
	[0073.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.145] lstrlenW (lpString=".jpg") returned 4
	[0073.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.145] lstrlenW (lpString=".doc") returned 4
	[0073.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.145] lstrlenW (lpString=".docx") returned 5
	[0073.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.145] lstrlenW (lpString=".pdf") returned 4
	[0073.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.145] lstrlenW (lpString=".xls") returned 4
	[0073.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.145] lstrlenW (lpString=".xlsx") returned 5
	[0073.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.146] lstrlenW (lpString=".ppt") returned 4
	[0073.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.146] lstrlenW (lpString=".zip") returned 4
	[0073.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.146] lstrlenW (lpString=".rar") returned 4
	[0073.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.146] lstrlenW (lpString=".bz2") returned 4
	[0073.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.146] lstrlenW (lpString=".7z") returned 3
	[0073.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.146] lstrlenW (lpString=".dbf") returned 4
	[0073.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.146] lstrlenW (lpString=".1cd") returned 4
	[0073.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.146] lstrlenW (lpString=".jpg") returned 4
	[0073.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.146] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.146] lstrlenW (lpString="BL00195_.WMF") returned 12
	[0073.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0073.719] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=8070) returned 1
	[0073.719] CloseHandle (hObject=0x378) returned 1
	[0073.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220
	[0073.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0073.719] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.719] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0073.720] GetLastError () returned 0x0
	[0073.720] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1f86, lpOverlapped=0x0) returned 1
	[0073.721] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1f90, lpOverlapped=0x0) returned 1
	[0073.722] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.722] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.722] SetEndOfFile (hFile=0x38c) returned 1
	[0073.723] CloseHandle (hObject=0x38c) returned 1
	[0073.723] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.723] SetEndOfFile (hFile=0x378) returned 1
	[0073.724] CloseHandle (hObject=0x378) returned 1
	[0073.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1
	[0073.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.725] lstrlenW (lpString=".doc") returned 4
	[0073.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.725] lstrlenW (lpString=".docx") returned 5
	[0073.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.725] lstrlenW (lpString=".pdf") returned 4
	[0073.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.725] lstrlenW (lpString=".xls") returned 4
	[0073.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.725] lstrlenW (lpString=".xlsx") returned 5
	[0073.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.725] lstrlenW (lpString=".ppt") returned 4
	[0073.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.726] lstrlenW (lpString=".zip") returned 4
	[0073.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.726] lstrlenW (lpString=".rar") returned 4
	[0073.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.726] lstrlenW (lpString=".bz2") returned 4
	[0073.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.726] lstrlenW (lpString=".7z") returned 3
	[0073.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.726] lstrlenW (lpString=".dbf") returned 4
	[0073.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.726] lstrlenW (lpString=".1cd") returned 4
	[0073.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.726] lstrlenW (lpString=".jpg") returned 4
	[0073.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.727] lstrlenW (lpString=".doc") returned 4
	[0073.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.727] lstrlenW (lpString=".docx") returned 5
	[0073.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.727] lstrlenW (lpString=".pdf") returned 4
	[0073.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.727] lstrlenW (lpString=".xls") returned 4
	[0073.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.727] lstrlenW (lpString=".xlsx") returned 5
	[0073.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.727] lstrlenW (lpString=".ppt") returned 4
	[0073.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.727] lstrlenW (lpString=".zip") returned 4
	[0073.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.727] lstrlenW (lpString=".rar") returned 4
	[0073.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.727] lstrlenW (lpString=".bz2") returned 4
	[0073.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.727] lstrlenW (lpString=".7z") returned 3
	[0073.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.727] lstrlenW (lpString=".dbf") returned 4
	[0073.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.728] lstrlenW (lpString=".1cd") returned 4
	[0073.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0073.728] lstrlenW (lpString=".jpg") returned 4
	[0073.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.728] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.728] lstrlenW (lpString="BL00254_.WMF") returned 12
	[0073.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0073.729] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1736) returned 1
	[0073.729] CloseHandle (hObject=0x378) returned 1
	[0073.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220
	[0073.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0073.729] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.729] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0073.730] GetLastError () returned 0x0
	[0073.730] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x6c8, lpOverlapped=0x0) returned 1
	[0073.731] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x6d0, lpOverlapped=0x0) returned 1
	[0073.732] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.732] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.732] SetEndOfFile (hFile=0x38c) returned 1
	[0073.732] CloseHandle (hObject=0x38c) returned 1
	[0073.733] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.733] SetEndOfFile (hFile=0x378) returned 1
	[0073.734] CloseHandle (hObject=0x378) returned 1
	[0073.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1
	[0073.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.735] lstrlenW (lpString=".doc") returned 4
	[0073.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.735] lstrlenW (lpString=".docx") returned 5
	[0073.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.735] lstrlenW (lpString=".pdf") returned 4
	[0073.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.735] lstrlenW (lpString=".xls") returned 4
	[0073.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.735] lstrlenW (lpString=".xlsx") returned 5
	[0073.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.735] lstrlenW (lpString=".ppt") returned 4
	[0073.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.735] lstrlenW (lpString=".zip") returned 4
	[0073.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.735] lstrlenW (lpString=".rar") returned 4
	[0073.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.735] lstrlenW (lpString=".bz2") returned 4
	[0073.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.736] lstrlenW (lpString=".7z") returned 3
	[0073.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.736] lstrlenW (lpString=".dbf") returned 4
	[0073.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.736] lstrlenW (lpString=".1cd") returned 4
	[0073.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.736] lstrlenW (lpString=".jpg") returned 4
	[0073.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.736] lstrlenW (lpString=".doc") returned 4
	[0073.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.736] lstrlenW (lpString=".docx") returned 5
	[0073.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.736] lstrlenW (lpString=".pdf") returned 4
	[0073.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.736] lstrlenW (lpString=".xls") returned 4
	[0073.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.736] lstrlenW (lpString=".xlsx") returned 5
	[0073.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.737] lstrlenW (lpString=".ppt") returned 4
	[0073.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.737] lstrlenW (lpString=".zip") returned 4
	[0073.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.737] lstrlenW (lpString=".rar") returned 4
	[0073.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.737] lstrlenW (lpString=".bz2") returned 4
	[0073.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.737] lstrlenW (lpString=".7z") returned 3
	[0073.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.737] lstrlenW (lpString=".dbf") returned 4
	[0073.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.737] lstrlenW (lpString=".1cd") returned 4
	[0073.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0073.737] lstrlenW (lpString=".jpg") returned 4
	[0073.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.737] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.737] lstrlenW (lpString="BL00261_.WMF") returned 12
	[0073.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0073.738] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=12482) returned 1
	[0073.738] CloseHandle (hObject=0x378) returned 1
	[0073.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220
	[0073.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0073.739] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.739] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0073.739] GetLastError () returned 0x0
	[0073.739] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x30c2, lpOverlapped=0x0) returned 1
	[0073.741] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x30d0, lpOverlapped=0x0) returned 1
	[0073.742] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.742] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.742] SetEndOfFile (hFile=0x38c) returned 1
	[0073.742] CloseHandle (hObject=0x38c) returned 1
	[0073.743] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.743] SetEndOfFile (hFile=0x378) returned 1
	[0073.744] CloseHandle (hObject=0x378) returned 1
	[0073.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1
	[0073.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.745] lstrlenW (lpString=".doc") returned 4
	[0073.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.745] lstrlenW (lpString=".docx") returned 5
	[0073.745] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.745] lstrlenW (lpString=".pdf") returned 4
	[0073.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.745] lstrlenW (lpString=".xls") returned 4
	[0073.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.745] lstrlenW (lpString=".xlsx") returned 5
	[0073.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.745] lstrlenW (lpString=".ppt") returned 4
	[0073.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.746] lstrlenW (lpString=".zip") returned 4
	[0073.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.746] lstrlenW (lpString=".rar") returned 4
	[0073.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.746] lstrlenW (lpString=".bz2") returned 4
	[0073.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.746] lstrlenW (lpString=".7z") returned 3
	[0073.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.746] lstrlenW (lpString=".dbf") returned 4
	[0073.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.746] lstrlenW (lpString=".1cd") returned 4
	[0073.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.747] lstrlenW (lpString=".jpg") returned 4
	[0073.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.747] lstrlenW (lpString=".doc") returned 4
	[0073.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.747] lstrlenW (lpString=".docx") returned 5
	[0073.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.747] lstrlenW (lpString=".pdf") returned 4
	[0073.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.747] lstrlenW (lpString=".xls") returned 4
	[0073.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.747] lstrlenW (lpString=".xlsx") returned 5
	[0073.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.747] lstrlenW (lpString=".ppt") returned 4
	[0073.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.748] lstrlenW (lpString=".zip") returned 4
	[0073.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.748] lstrlenW (lpString=".rar") returned 4
	[0073.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.748] lstrlenW (lpString=".bz2") returned 4
	[0073.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.748] lstrlenW (lpString=".7z") returned 3
	[0073.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.748] lstrlenW (lpString=".dbf") returned 4
	[0073.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.748] lstrlenW (lpString=".1cd") returned 4
	[0073.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0073.748] lstrlenW (lpString=".jpg") returned 4
	[0073.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.749] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.749] lstrlenW (lpString="BL00262_.WMF") returned 12
	[0073.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0073.749] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2556) returned 1
	[0073.749] CloseHandle (hObject=0x378) returned 1
	[0073.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220
	[0073.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0073.750] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.750] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0073.750] GetLastError () returned 0x0
	[0073.750] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x9fc, lpOverlapped=0x0) returned 1
	[0074.112] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xa00, lpOverlapped=0x0) returned 1
	[0074.114] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.114] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.114] SetEndOfFile (hFile=0x38c) returned 1
	[0074.152] CloseHandle (hObject=0x38c) returned 1
	[0074.153] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.153] SetEndOfFile (hFile=0x378) returned 1
	[0074.154] CloseHandle (hObject=0x378) returned 1
	[0074.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1
	[0074.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.155] lstrlenW (lpString=".doc") returned 4
	[0074.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.155] lstrlenW (lpString=".docx") returned 5
	[0074.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.155] lstrlenW (lpString=".pdf") returned 4
	[0074.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.155] lstrlenW (lpString=".xls") returned 4
	[0074.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.155] lstrlenW (lpString=".xlsx") returned 5
	[0074.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.156] lstrlenW (lpString=".ppt") returned 4
	[0074.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.156] lstrlenW (lpString=".zip") returned 4
	[0074.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.156] lstrlenW (lpString=".rar") returned 4
	[0074.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.156] lstrlenW (lpString=".bz2") returned 4
	[0074.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.156] lstrlenW (lpString=".7z") returned 3
	[0074.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.156] lstrlenW (lpString=".dbf") returned 4
	[0074.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.156] lstrlenW (lpString=".1cd") returned 4
	[0074.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.156] lstrlenW (lpString=".jpg") returned 4
	[0074.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.156] lstrlenW (lpString=".doc") returned 4
	[0074.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.156] lstrlenW (lpString=".docx") returned 5
	[0074.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.157] lstrlenW (lpString=".pdf") returned 4
	[0074.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.157] lstrlenW (lpString=".xls") returned 4
	[0074.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.157] lstrlenW (lpString=".xlsx") returned 5
	[0074.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.157] lstrlenW (lpString=".ppt") returned 4
	[0074.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.157] lstrlenW (lpString=".zip") returned 4
	[0074.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.157] lstrlenW (lpString=".rar") returned 4
	[0074.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.157] lstrlenW (lpString=".bz2") returned 4
	[0074.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.157] lstrlenW (lpString=".7z") returned 3
	[0074.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.157] lstrlenW (lpString=".dbf") returned 4
	[0074.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.157] lstrlenW (lpString=".1cd") returned 4
	[0074.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.157] lstrlenW (lpString=".jpg") returned 4
	[0074.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.158] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.158] lstrlenW (lpString="BL00526_.WMF") returned 12
	[0074.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.158] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=27552) returned 1
	[0074.158] CloseHandle (hObject=0x378) returned 1
	[0074.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220
	[0074.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.159] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.159] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.159] GetLastError () returned 0x0
	[0074.159] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x6ba0, lpOverlapped=0x0) returned 1
	[0074.161] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x6bb0, lpOverlapped=0x0) returned 1
	[0074.162] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.163] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.163] SetEndOfFile (hFile=0x38c) returned 1
	[0074.163] CloseHandle (hObject=0x38c) returned 1
	[0074.164] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.164] SetEndOfFile (hFile=0x378) returned 1
	[0074.165] CloseHandle (hObject=0x378) returned 1
	[0074.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1
	[0074.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.166] lstrlenW (lpString=".doc") returned 4
	[0074.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.166] lstrlenW (lpString=".docx") returned 5
	[0074.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.166] lstrlenW (lpString=".pdf") returned 4
	[0074.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.166] lstrlenW (lpString=".xls") returned 4
	[0074.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.166] lstrlenW (lpString=".xlsx") returned 5
	[0074.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.166] lstrlenW (lpString=".ppt") returned 4
	[0074.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.166] lstrlenW (lpString=".zip") returned 4
	[0074.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.166] lstrlenW (lpString=".rar") returned 4
	[0074.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.167] lstrlenW (lpString=".bz2") returned 4
	[0074.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.167] lstrlenW (lpString=".7z") returned 3
	[0074.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.167] lstrlenW (lpString=".dbf") returned 4
	[0074.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.167] lstrlenW (lpString=".1cd") returned 4
	[0074.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.167] lstrlenW (lpString=".jpg") returned 4
	[0074.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.167] lstrlenW (lpString=".doc") returned 4
	[0074.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.167] lstrlenW (lpString=".docx") returned 5
	[0074.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.167] lstrlenW (lpString=".pdf") returned 4
	[0074.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.167] lstrlenW (lpString=".xls") returned 4
	[0074.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.167] lstrlenW (lpString=".xlsx") returned 5
	[0074.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.167] lstrlenW (lpString=".ppt") returned 4
	[0074.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.168] lstrlenW (lpString=".zip") returned 4
	[0074.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.168] lstrlenW (lpString=".rar") returned 4
	[0074.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.168] lstrlenW (lpString=".bz2") returned 4
	[0074.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.168] lstrlenW (lpString=".7z") returned 3
	[0074.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.168] lstrlenW (lpString=".dbf") returned 4
	[0074.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.168] lstrlenW (lpString=".1cd") returned 4
	[0074.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0074.168] lstrlenW (lpString=".jpg") returned 4
	[0074.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.168] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.168] lstrlenW (lpString="BL00648_.WMF") returned 12
	[0074.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.169] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=11500) returned 1
	[0074.169] CloseHandle (hObject=0x378) returned 1
	[0074.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220
	[0074.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.169] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.169] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.170] GetLastError () returned 0x0
	[0074.170] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2cec, lpOverlapped=0x0) returned 1
	[0074.171] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2cf0, lpOverlapped=0x0) returned 1
	[0074.172] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.172] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.172] SetEndOfFile (hFile=0x38c) returned 1
	[0074.172] CloseHandle (hObject=0x38c) returned 1
	[0074.173] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.173] SetEndOfFile (hFile=0x378) returned 1
	[0074.174] CloseHandle (hObject=0x378) returned 1
	[0074.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1
	[0074.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.175] lstrlenW (lpString=".doc") returned 4
	[0074.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.175] lstrlenW (lpString=".docx") returned 5
	[0074.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.175] lstrlenW (lpString=".pdf") returned 4
	[0074.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.175] lstrlenW (lpString=".xls") returned 4
	[0074.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.175] lstrlenW (lpString=".xlsx") returned 5
	[0074.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.175] lstrlenW (lpString=".ppt") returned 4
	[0074.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.175] lstrlenW (lpString=".zip") returned 4
	[0074.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.175] lstrlenW (lpString=".rar") returned 4
	[0074.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.176] lstrlenW (lpString=".bz2") returned 4
	[0074.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.176] lstrlenW (lpString=".7z") returned 3
	[0074.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.176] lstrlenW (lpString=".dbf") returned 4
	[0074.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.176] lstrlenW (lpString=".1cd") returned 4
	[0074.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.176] lstrlenW (lpString=".jpg") returned 4
	[0074.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.176] lstrlenW (lpString=".doc") returned 4
	[0074.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.177] lstrlenW (lpString=".docx") returned 5
	[0074.177] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.177] lstrlenW (lpString=".pdf") returned 4
	[0074.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.177] lstrlenW (lpString=".xls") returned 4
	[0074.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.177] lstrlenW (lpString=".xlsx") returned 5
	[0074.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.177] lstrlenW (lpString=".ppt") returned 4
	[0074.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.177] lstrlenW (lpString=".zip") returned 4
	[0074.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.177] lstrlenW (lpString=".rar") returned 4
	[0074.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.177] lstrlenW (lpString=".bz2") returned 4
	[0074.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.177] lstrlenW (lpString=".7z") returned 3
	[0074.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.177] lstrlenW (lpString=".dbf") returned 4
	[0074.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.177] lstrlenW (lpString=".1cd") returned 4
	[0074.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0074.177] lstrlenW (lpString=".jpg") returned 4
	[0074.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.178] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.178] lstrlenW (lpString="BL00921_.WMF") returned 12
	[0074.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.178] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=4408) returned 1
	[0074.178] CloseHandle (hObject=0x378) returned 1
	[0074.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220
	[0074.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.178] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.178] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.179] GetLastError () returned 0x0
	[0074.179] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1138, lpOverlapped=0x0) returned 1
	[0074.180] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1140, lpOverlapped=0x0) returned 1
	[0074.181] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.181] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.181] SetEndOfFile (hFile=0x38c) returned 1
	[0074.182] CloseHandle (hObject=0x38c) returned 1
	[0074.182] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.182] SetEndOfFile (hFile=0x378) returned 1
	[0074.183] CloseHandle (hObject=0x378) returned 1
	[0074.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1
	[0074.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.184] lstrlenW (lpString=".doc") returned 4
	[0074.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.184] lstrlenW (lpString=".docx") returned 5
	[0074.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.184] lstrlenW (lpString=".pdf") returned 4
	[0074.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.184] lstrlenW (lpString=".xls") returned 4
	[0074.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.184] lstrlenW (lpString=".xlsx") returned 5
	[0074.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.184] lstrlenW (lpString=".ppt") returned 4
	[0074.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.184] lstrlenW (lpString=".zip") returned 4
	[0074.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.184] lstrlenW (lpString=".rar") returned 4
	[0074.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.185] lstrlenW (lpString=".bz2") returned 4
	[0074.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.185] lstrlenW (lpString=".7z") returned 3
	[0074.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.185] lstrlenW (lpString=".dbf") returned 4
	[0074.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.185] lstrlenW (lpString=".1cd") returned 4
	[0074.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.185] lstrlenW (lpString=".jpg") returned 4
	[0074.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.185] lstrlenW (lpString=".doc") returned 4
	[0074.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.185] lstrlenW (lpString=".docx") returned 5
	[0074.185] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.185] lstrlenW (lpString=".pdf") returned 4
	[0074.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.185] lstrlenW (lpString=".xls") returned 4
	[0074.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.185] lstrlenW (lpString=".xlsx") returned 5
	[0074.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.185] lstrlenW (lpString=".ppt") returned 4
	[0074.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.186] lstrlenW (lpString=".zip") returned 4
	[0074.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.186] lstrlenW (lpString=".rar") returned 4
	[0074.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.186] lstrlenW (lpString=".bz2") returned 4
	[0074.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.186] lstrlenW (lpString=".7z") returned 3
	[0074.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.186] lstrlenW (lpString=".dbf") returned 4
	[0074.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.186] lstrlenW (lpString=".1cd") returned 4
	[0074.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0074.186] lstrlenW (lpString=".jpg") returned 4
	[0074.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.186] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.186] lstrlenW (lpString="BL00923_.WMF") returned 12
	[0074.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.187] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=6256) returned 1
	[0074.187] CloseHandle (hObject=0x378) returned 1
	[0074.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220
	[0074.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.187] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.187] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.187] GetLastError () returned 0x0
	[0074.187] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1870, lpOverlapped=0x0) returned 1
	[0074.686] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1880, lpOverlapped=0x0) returned 1
	[0074.687] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.687] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.687] SetEndOfFile (hFile=0x38c) returned 1
	[0074.688] CloseHandle (hObject=0x38c) returned 1
	[0074.688] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.688] SetEndOfFile (hFile=0x378) returned 1
	[0074.689] CloseHandle (hObject=0x378) returned 1
	[0074.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1
	[0074.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.690] lstrlenW (lpString=".doc") returned 4
	[0074.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.690] lstrlenW (lpString=".docx") returned 5
	[0074.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.690] lstrlenW (lpString=".pdf") returned 4
	[0074.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.690] lstrlenW (lpString=".xls") returned 4
	[0074.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.690] lstrlenW (lpString=".xlsx") returned 5
	[0074.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.690] lstrlenW (lpString=".ppt") returned 4
	[0074.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.691] lstrlenW (lpString=".zip") returned 4
	[0074.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.691] lstrlenW (lpString=".rar") returned 4
	[0074.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.691] lstrlenW (lpString=".bz2") returned 4
	[0074.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.691] lstrlenW (lpString=".7z") returned 3
	[0074.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.691] lstrlenW (lpString=".dbf") returned 4
	[0074.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.691] lstrlenW (lpString=".1cd") returned 4
	[0074.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.691] lstrlenW (lpString=".jpg") returned 4
	[0074.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.692] lstrlenW (lpString=".doc") returned 4
	[0074.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.692] lstrlenW (lpString=".docx") returned 5
	[0074.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.692] lstrlenW (lpString=".pdf") returned 4
	[0074.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.692] lstrlenW (lpString=".xls") returned 4
	[0074.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.692] lstrlenW (lpString=".xlsx") returned 5
	[0074.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.692] lstrlenW (lpString=".ppt") returned 4
	[0074.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.692] lstrlenW (lpString=".zip") returned 4
	[0074.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.692] lstrlenW (lpString=".rar") returned 4
	[0074.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.693] lstrlenW (lpString=".bz2") returned 4
	[0074.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.693] lstrlenW (lpString=".7z") returned 3
	[0074.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.693] lstrlenW (lpString=".dbf") returned 4
	[0074.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.693] lstrlenW (lpString=".1cd") returned 4
	[0074.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0074.693] lstrlenW (lpString=".jpg") returned 4
	[0074.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.693] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.693] lstrlenW (lpString="BS00184_.WMF") returned 12
	[0074.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.694] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=4976) returned 1
	[0074.694] CloseHandle (hObject=0x378) returned 1
	[0074.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220
	[0074.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.695] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.695] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.696] GetLastError () returned 0x0
	[0074.696] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1370, lpOverlapped=0x0) returned 1
	[0074.697] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1380, lpOverlapped=0x0) returned 1
	[0074.698] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.698] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.698] SetEndOfFile (hFile=0x38c) returned 1
	[0074.698] CloseHandle (hObject=0x38c) returned 1
	[0074.700] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.700] SetEndOfFile (hFile=0x378) returned 1
	[0074.701] CloseHandle (hObject=0x378) returned 1
	[0074.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1
	[0074.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.702] lstrlenW (lpString=".doc") returned 4
	[0074.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.702] lstrlenW (lpString=".docx") returned 5
	[0074.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.702] lstrlenW (lpString=".pdf") returned 4
	[0074.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.702] lstrlenW (lpString=".xls") returned 4
	[0074.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.702] lstrlenW (lpString=".xlsx") returned 5
	[0074.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.702] lstrlenW (lpString=".ppt") returned 4
	[0074.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.703] lstrlenW (lpString=".zip") returned 4
	[0074.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.703] lstrlenW (lpString=".rar") returned 4
	[0074.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.703] lstrlenW (lpString=".bz2") returned 4
	[0074.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.703] lstrlenW (lpString=".7z") returned 3
	[0074.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.703] lstrlenW (lpString=".dbf") returned 4
	[0074.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.703] lstrlenW (lpString=".1cd") returned 4
	[0074.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.703] lstrlenW (lpString=".jpg") returned 4
	[0074.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.703] lstrlenW (lpString=".doc") returned 4
	[0074.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.703] lstrlenW (lpString=".docx") returned 5
	[0074.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.703] lstrlenW (lpString=".pdf") returned 4
	[0074.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.704] lstrlenW (lpString=".xls") returned 4
	[0074.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.704] lstrlenW (lpString=".xlsx") returned 5
	[0074.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.704] lstrlenW (lpString=".ppt") returned 4
	[0074.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.704] lstrlenW (lpString=".zip") returned 4
	[0074.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.704] lstrlenW (lpString=".rar") returned 4
	[0074.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.704] lstrlenW (lpString=".bz2") returned 4
	[0074.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.704] lstrlenW (lpString=".7z") returned 3
	[0074.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.704] lstrlenW (lpString=".dbf") returned 4
	[0074.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.704] lstrlenW (lpString=".1cd") returned 4
	[0074.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0074.704] lstrlenW (lpString=".jpg") returned 4
	[0074.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.705] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.705] lstrlenW (lpString="BS00186_.WMF") returned 12
	[0074.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.705] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=12788) returned 1
	[0074.705] CloseHandle (hObject=0x378) returned 1
	[0074.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220
	[0074.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.706] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.706] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.706] GetLastError () returned 0x0
	[0074.706] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x31f4, lpOverlapped=0x0) returned 1
	[0074.708] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x3200, lpOverlapped=0x0) returned 1
	[0074.709] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.710] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.710] SetEndOfFile (hFile=0x38c) returned 1
	[0074.710] CloseHandle (hObject=0x38c) returned 1
	[0074.711] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.711] SetEndOfFile (hFile=0x378) returned 1
	[0074.712] CloseHandle (hObject=0x378) returned 1
	[0074.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1
	[0074.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.713] lstrlenW (lpString=".doc") returned 4
	[0074.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.713] lstrlenW (lpString=".docx") returned 5
	[0074.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.713] lstrlenW (lpString=".pdf") returned 4
	[0074.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.713] lstrlenW (lpString=".xls") returned 4
	[0074.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.714] lstrlenW (lpString=".xlsx") returned 5
	[0074.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.714] lstrlenW (lpString=".ppt") returned 4
	[0074.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.714] lstrlenW (lpString=".zip") returned 4
	[0074.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.714] lstrlenW (lpString=".rar") returned 4
	[0074.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.714] lstrlenW (lpString=".bz2") returned 4
	[0074.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.714] lstrlenW (lpString=".7z") returned 3
	[0074.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.714] lstrlenW (lpString=".dbf") returned 4
	[0074.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.715] lstrlenW (lpString=".1cd") returned 4
	[0074.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.715] lstrlenW (lpString=".jpg") returned 4
	[0074.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.715] lstrlenW (lpString=".doc") returned 4
	[0074.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.715] lstrlenW (lpString=".docx") returned 5
	[0074.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.715] lstrlenW (lpString=".pdf") returned 4
	[0074.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.715] lstrlenW (lpString=".xls") returned 4
	[0074.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.716] lstrlenW (lpString=".xlsx") returned 5
	[0074.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.716] lstrlenW (lpString=".ppt") returned 4
	[0074.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.716] lstrlenW (lpString=".zip") returned 4
	[0074.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.716] lstrlenW (lpString=".rar") returned 4
	[0074.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.716] lstrlenW (lpString=".bz2") returned 4
	[0074.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.716] lstrlenW (lpString=".7z") returned 3
	[0074.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.716] lstrlenW (lpString=".dbf") returned 4
	[0074.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.717] lstrlenW (lpString=".1cd") returned 4
	[0074.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0074.717] lstrlenW (lpString=".jpg") returned 4
	[0074.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.717] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.717] lstrlenW (lpString="BS00200_.WMF") returned 12
	[0074.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.718] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3104) returned 1
	[0074.718] CloseHandle (hObject=0x378) returned 1
	[0074.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220
	[0074.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0074.718] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.718] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.719] GetLastError () returned 0x0
	[0074.719] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xc20, lpOverlapped=0x0) returned 1
	[0075.080] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xc30, lpOverlapped=0x0) returned 1
	[0075.081] ReadFile (in: hFile=0x378, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.081] WriteFile (in: hFile=0x38c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.081] SetEndOfFile (hFile=0x38c) returned 1
	[0075.081] CloseHandle (hObject=0x38c) returned 1
	[0075.082] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.082] SetEndOfFile (hFile=0x378) returned 1
	[0075.083] CloseHandle (hObject=0x378) returned 1
	[0075.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1
	[0075.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.380] lstrlenW (lpString=".doc") returned 4
	[0075.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.380] lstrlenW (lpString=".docx") returned 5
	[0075.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.380] lstrlenW (lpString=".pdf") returned 4
	[0075.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.380] lstrlenW (lpString=".xls") returned 4
	[0075.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.380] lstrlenW (lpString=".xlsx") returned 5
	[0075.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.380] lstrlenW (lpString=".ppt") returned 4
	[0075.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.380] lstrlenW (lpString=".zip") returned 4
	[0075.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.381] lstrlenW (lpString=".rar") returned 4
	[0075.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.381] lstrlenW (lpString=".bz2") returned 4
	[0075.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.381] lstrlenW (lpString=".7z") returned 3
	[0075.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.381] lstrlenW (lpString=".dbf") returned 4
	[0075.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.381] lstrlenW (lpString=".1cd") returned 4
	[0075.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.381] lstrlenW (lpString=".jpg") returned 4
	[0075.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.382] lstrlenW (lpString=".doc") returned 4
	[0075.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.382] lstrlenW (lpString=".docx") returned 5
	[0075.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.382] lstrlenW (lpString=".pdf") returned 4
	[0075.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.382] lstrlenW (lpString=".xls") returned 4
	[0075.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.382] lstrlenW (lpString=".xlsx") returned 5
	[0075.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.382] lstrlenW (lpString=".ppt") returned 4
	[0075.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.382] lstrlenW (lpString=".zip") returned 4
	[0075.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.382] lstrlenW (lpString=".rar") returned 4
	[0075.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.382] lstrlenW (lpString=".bz2") returned 4
	[0075.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.382] lstrlenW (lpString=".7z") returned 3
	[0075.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.383] lstrlenW (lpString=".dbf") returned 4
	[0075.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.383] lstrlenW (lpString=".1cd") returned 4
	[0075.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.383] lstrlenW (lpString=".jpg") returned 4
	[0075.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.383] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.383] lstrlenW (lpString="BS01603_.WMF") returned 12
	[0075.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.384] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=7176) returned 1
	[0075.384] CloseHandle (hObject=0x35c) returned 1
	[0075.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220
	[0075.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.385] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.385] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0075.386] GetLastError () returned 0x0
	[0075.386] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1c08, lpOverlapped=0x0) returned 1
	[0075.387] WriteFile (in: hFile=0x374, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1c10, lpOverlapped=0x0) returned 1
	[0075.388] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.388] WriteFile (in: hFile=0x374, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.388] SetEndOfFile (hFile=0x374) returned 1
	[0075.389] CloseHandle (hObject=0x374) returned 1
	[0075.390] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.390] SetEndOfFile (hFile=0x35c) returned 1
	[0075.391] CloseHandle (hObject=0x35c) returned 1
	[0075.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1
	[0075.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.392] lstrlenW (lpString=".doc") returned 4
	[0075.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.392] lstrlenW (lpString=".docx") returned 5
	[0075.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.392] lstrlenW (lpString=".pdf") returned 4
	[0075.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.392] lstrlenW (lpString=".xls") returned 4
	[0075.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.392] lstrlenW (lpString=".xlsx") returned 5
	[0075.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.393] lstrlenW (lpString=".ppt") returned 4
	[0075.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.393] lstrlenW (lpString=".zip") returned 4
	[0075.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.393] lstrlenW (lpString=".rar") returned 4
	[0075.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.393] lstrlenW (lpString=".bz2") returned 4
	[0075.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.393] lstrlenW (lpString=".7z") returned 3
	[0075.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.393] lstrlenW (lpString=".dbf") returned 4
	[0075.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.393] lstrlenW (lpString=".1cd") returned 4
	[0075.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.393] lstrlenW (lpString=".jpg") returned 4
	[0075.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.394] lstrlenW (lpString=".doc") returned 4
	[0075.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.394] lstrlenW (lpString=".docx") returned 5
	[0075.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.394] lstrlenW (lpString=".pdf") returned 4
	[0075.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.394] lstrlenW (lpString=".xls") returned 4
	[0075.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.394] lstrlenW (lpString=".xlsx") returned 5
	[0075.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.394] lstrlenW (lpString=".ppt") returned 4
	[0075.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.394] lstrlenW (lpString=".zip") returned 4
	[0075.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.395] lstrlenW (lpString=".rar") returned 4
	[0075.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.395] lstrlenW (lpString=".bz2") returned 4
	[0075.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.395] lstrlenW (lpString=".7z") returned 3
	[0075.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.395] lstrlenW (lpString=".dbf") returned 4
	[0075.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.395] lstrlenW (lpString=".1cd") returned 4
	[0075.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0075.395] lstrlenW (lpString=".jpg") returned 4
	[0075.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.396] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.396] lstrlenW (lpString="BS01634_.WMF") returned 12
	[0075.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.396] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3494) returned 1
	[0075.396] CloseHandle (hObject=0x35c) returned 1
	[0075.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220
	[0075.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.397] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.397] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0075.771] GetLastError () returned 0x0
	[0075.771] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xda6, lpOverlapped=0x0) returned 1
	[0075.773] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xdb0, lpOverlapped=0x0) returned 1
	[0075.774] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.774] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.774] SetEndOfFile (hFile=0x33c) returned 1
	[0075.774] CloseHandle (hObject=0x33c) returned 1
	[0075.776] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.776] SetEndOfFile (hFile=0x35c) returned 1
	[0075.777] CloseHandle (hObject=0x35c) returned 1
	[0075.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1
	[0075.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.777] lstrlenW (lpString=".doc") returned 4
	[0075.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString=".docx") returned 5
	[0075.778] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.778] lstrlenW (lpString=".pdf") returned 4
	[0075.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString=".xls") returned 4
	[0075.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.778] lstrlenW (lpString=".xlsx") returned 5
	[0075.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.778] lstrlenW (lpString=".ppt") returned 4
	[0075.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.778] lstrlenW (lpString=".zip") returned 4
	[0075.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.778] lstrlenW (lpString=".rar") returned 4
	[0075.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString=".bz2") returned 4
	[0075.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString=".7z") returned 3
	[0075.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.778] lstrlenW (lpString=".dbf") returned 4
	[0075.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.778] lstrlenW (lpString=".1cd") returned 4
	[0075.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.778] lstrlenW (lpString=".jpg") returned 4
	[0075.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.779] lstrlenW (lpString=".doc") returned 4
	[0075.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.779] lstrlenW (lpString=".docx") returned 5
	[0075.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.779] lstrlenW (lpString=".pdf") returned 4
	[0075.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.779] lstrlenW (lpString=".xls") returned 4
	[0075.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.779] lstrlenW (lpString=".xlsx") returned 5
	[0075.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.779] lstrlenW (lpString=".ppt") returned 4
	[0075.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.779] lstrlenW (lpString=".zip") returned 4
	[0075.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.779] lstrlenW (lpString=".rar") returned 4
	[0075.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.779] lstrlenW (lpString=".bz2") returned 4
	[0075.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.779] lstrlenW (lpString=".7z") returned 3
	[0075.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.779] lstrlenW (lpString=".dbf") returned 4
	[0075.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.779] lstrlenW (lpString=".1cd") returned 4
	[0075.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0075.779] lstrlenW (lpString=".jpg") returned 4
	[0075.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.780] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.780] lstrlenW (lpString="BS01638_.WMF") returned 12
	[0075.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.780] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=10538) returned 1
	[0075.780] CloseHandle (hObject=0x35c) returned 1
	[0075.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220
	[0075.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.780] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.780] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0075.781] GetLastError () returned 0x0
	[0075.781] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x292a, lpOverlapped=0x0) returned 1
	[0075.783] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2930, lpOverlapped=0x0) returned 1
	[0075.784] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.784] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.784] SetEndOfFile (hFile=0x33c) returned 1
	[0075.784] CloseHandle (hObject=0x33c) returned 1
	[0075.785] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.786] SetEndOfFile (hFile=0x35c) returned 1
	[0075.786] CloseHandle (hObject=0x35c) returned 1
	[0075.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1
	[0075.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.787] lstrlenW (lpString=".doc") returned 4
	[0075.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.787] lstrlenW (lpString=".docx") returned 5
	[0075.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.787] lstrlenW (lpString=".pdf") returned 4
	[0075.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.787] lstrlenW (lpString=".xls") returned 4
	[0075.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.787] lstrlenW (lpString=".xlsx") returned 5
	[0075.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.787] lstrlenW (lpString=".ppt") returned 4
	[0075.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.788] lstrlenW (lpString=".zip") returned 4
	[0075.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.788] lstrlenW (lpString=".rar") returned 4
	[0075.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.788] lstrlenW (lpString=".bz2") returned 4
	[0075.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.788] lstrlenW (lpString=".7z") returned 3
	[0075.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.788] lstrlenW (lpString=".dbf") returned 4
	[0075.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.788] lstrlenW (lpString=".1cd") returned 4
	[0075.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.788] lstrlenW (lpString=".jpg") returned 4
	[0075.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.788] lstrlenW (lpString=".doc") returned 4
	[0075.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.788] lstrlenW (lpString=".docx") returned 5
	[0075.788] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.788] lstrlenW (lpString=".pdf") returned 4
	[0075.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.788] lstrlenW (lpString=".xls") returned 4
	[0075.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.789] lstrlenW (lpString=".xlsx") returned 5
	[0075.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.789] lstrlenW (lpString=".ppt") returned 4
	[0075.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.789] lstrlenW (lpString=".zip") returned 4
	[0075.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.789] lstrlenW (lpString=".rar") returned 4
	[0075.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString=".bz2") returned 4
	[0075.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString=".7z") returned 3
	[0075.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.789] lstrlenW (lpString=".dbf") returned 4
	[0075.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.789] lstrlenW (lpString=".1cd") returned 4
	[0075.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0075.789] lstrlenW (lpString=".jpg") returned 4
	[0075.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.790] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.790] lstrlenW (lpString="BS01639_.WMF") returned 12
	[0075.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.790] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=4236) returned 1
	[0075.790] CloseHandle (hObject=0x35c) returned 1
	[0075.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220
	[0075.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.791] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.791] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0075.791] GetLastError () returned 0x0
	[0075.791] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x108c, lpOverlapped=0x0) returned 1
	[0075.793] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1090, lpOverlapped=0x0) returned 1
	[0075.794] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.794] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.794] SetEndOfFile (hFile=0x33c) returned 1
	[0075.794] CloseHandle (hObject=0x33c) returned 1
	[0075.795] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.795] SetEndOfFile (hFile=0x35c) returned 1
	[0075.796] CloseHandle (hObject=0x35c) returned 1
	[0075.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1
	[0075.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.797] lstrlenW (lpString=".doc") returned 4
	[0075.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.797] lstrlenW (lpString=".docx") returned 5
	[0075.797] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.797] lstrlenW (lpString=".pdf") returned 4
	[0075.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.797] lstrlenW (lpString=".xls") returned 4
	[0075.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.797] lstrlenW (lpString=".xlsx") returned 5
	[0075.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.797] lstrlenW (lpString=".ppt") returned 4
	[0075.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.797] lstrlenW (lpString=".zip") returned 4
	[0075.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.797] lstrlenW (lpString=".rar") returned 4
	[0075.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.797] lstrlenW (lpString=".bz2") returned 4
	[0075.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.797] lstrlenW (lpString=".7z") returned 3
	[0075.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.798] lstrlenW (lpString=".dbf") returned 4
	[0075.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.798] lstrlenW (lpString=".1cd") returned 4
	[0075.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.798] lstrlenW (lpString=".jpg") returned 4
	[0075.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.798] lstrlenW (lpString=".doc") returned 4
	[0075.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString=".docx") returned 5
	[0075.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.798] lstrlenW (lpString=".pdf") returned 4
	[0075.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString=".xls") returned 4
	[0075.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.798] lstrlenW (lpString=".xlsx") returned 5
	[0075.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.798] lstrlenW (lpString=".ppt") returned 4
	[0075.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.799] lstrlenW (lpString=".zip") returned 4
	[0075.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.799] lstrlenW (lpString=".rar") returned 4
	[0075.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.799] lstrlenW (lpString=".bz2") returned 4
	[0075.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.799] lstrlenW (lpString=".7z") returned 3
	[0075.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.799] lstrlenW (lpString=".dbf") returned 4
	[0075.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.799] lstrlenW (lpString=".1cd") returned 4
	[0075.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0075.799] lstrlenW (lpString=".jpg") returned 4
	[0075.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.799] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.800] lstrlenW (lpString="CG1606.WMF") returned 10
	[0075.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.800] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3564) returned 1
	[0075.800] CloseHandle (hObject=0x35c) returned 1
	[0075.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220
	[0075.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.801] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.801] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0075.802] GetLastError () returned 0x0
	[0075.802] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xdec, lpOverlapped=0x0) returned 1
	[0075.803] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xdf0, lpOverlapped=0x0) returned 1
	[0075.804] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.804] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0075.804] SetEndOfFile (hFile=0x33c) returned 1
	[0075.804] CloseHandle (hObject=0x33c) returned 1
	[0075.805] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.805] SetEndOfFile (hFile=0x35c) returned 1
	[0075.806] CloseHandle (hObject=0x35c) returned 1
	[0075.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1
	[0075.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.807] lstrlenW (lpString=".doc") returned 4
	[0075.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.807] lstrlenW (lpString=".docx") returned 5
	[0075.807] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0075.807] lstrlenW (lpString=".pdf") returned 4
	[0075.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.807] lstrlenW (lpString=".xls") returned 4
	[0075.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.808] lstrlenW (lpString=".xlsx") returned 5
	[0075.808] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0075.808] lstrlenW (lpString=".ppt") returned 4
	[0075.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.808] lstrlenW (lpString=".zip") returned 4
	[0075.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.808] lstrlenW (lpString=".rar") returned 4
	[0075.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.808] lstrlenW (lpString=".bz2") returned 4
	[0075.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.808] lstrlenW (lpString=".7z") returned 3
	[0075.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.808] lstrlenW (lpString=".dbf") returned 4
	[0075.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.809] lstrlenW (lpString=".1cd") returned 4
	[0075.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.809] lstrlenW (lpString=".jpg") returned 4
	[0075.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.809] lstrlenW (lpString=".doc") returned 4
	[0075.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.809] lstrlenW (lpString=".docx") returned 5
	[0075.809] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0075.809] lstrlenW (lpString=".pdf") returned 4
	[0075.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.809] lstrlenW (lpString=".xls") returned 4
	[0075.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.809] lstrlenW (lpString=".xlsx") returned 5
	[0075.809] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0075.809] lstrlenW (lpString=".ppt") returned 4
	[0075.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.810] lstrlenW (lpString=".zip") returned 4
	[0075.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.810] lstrlenW (lpString=".rar") returned 4
	[0075.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.810] lstrlenW (lpString=".bz2") returned 4
	[0075.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.810] lstrlenW (lpString=".7z") returned 3
	[0075.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.810] lstrlenW (lpString=".dbf") returned 4
	[0075.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.810] lstrlenW (lpString=".1cd") returned 4
	[0075.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0075.810] lstrlenW (lpString=".jpg") returned 4
	[0075.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.811] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.811] lstrlenW (lpString="CLASSIC1.WMF") returned 12
	[0075.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.811] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2422) returned 1
	[0075.811] CloseHandle (hObject=0x35c) returned 1
	[0075.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220
	[0075.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0075.812] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.812] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0075.812] GetLastError () returned 0x0
	[0075.812] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x976, lpOverlapped=0x0) returned 1
	[0076.162] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x980, lpOverlapped=0x0) returned 1
	[0076.163] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.163] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.163] SetEndOfFile (hFile=0x33c) returned 1
	[0076.163] CloseHandle (hObject=0x33c) returned 1
	[0076.165] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.165] SetEndOfFile (hFile=0x35c) returned 1
	[0076.166] CloseHandle (hObject=0x35c) returned 1
	[0076.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1
	[0076.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.166] lstrlenW (lpString=".doc") returned 4
	[0076.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.167] lstrlenW (lpString=".docx") returned 5
	[0076.167] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0076.167] lstrlenW (lpString=".pdf") returned 4
	[0076.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.167] lstrlenW (lpString=".xls") returned 4
	[0076.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.167] lstrlenW (lpString=".xlsx") returned 5
	[0076.167] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0076.167] lstrlenW (lpString=".ppt") returned 4
	[0076.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.167] lstrlenW (lpString=".zip") returned 4
	[0076.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.167] lstrlenW (lpString=".rar") returned 4
	[0076.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.167] lstrlenW (lpString=".bz2") returned 4
	[0076.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.167] lstrlenW (lpString=".7z") returned 3
	[0076.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.167] lstrlenW (lpString=".dbf") returned 4
	[0076.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.168] lstrlenW (lpString=".1cd") returned 4
	[0076.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.168] lstrlenW (lpString=".jpg") returned 4
	[0076.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.168] lstrlenW (lpString=".doc") returned 4
	[0076.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.168] lstrlenW (lpString=".docx") returned 5
	[0076.168] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0076.168] lstrlenW (lpString=".pdf") returned 4
	[0076.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.168] lstrlenW (lpString=".xls") returned 4
	[0076.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.168] lstrlenW (lpString=".xlsx") returned 5
	[0076.168] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0076.168] lstrlenW (lpString=".ppt") returned 4
	[0076.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.168] lstrlenW (lpString=".zip") returned 4
	[0076.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.169] lstrlenW (lpString=".rar") returned 4
	[0076.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.169] lstrlenW (lpString=".bz2") returned 4
	[0076.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.169] lstrlenW (lpString=".7z") returned 3
	[0076.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.169] lstrlenW (lpString=".dbf") returned 4
	[0076.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.169] lstrlenW (lpString=".1cd") returned 4
	[0076.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.169] lstrlenW (lpString=".jpg") returned 4
	[0076.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.169] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.169] lstrlenW (lpString="DD00255_.WMF") returned 12
	[0076.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.170] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2690) returned 1
	[0076.170] CloseHandle (hObject=0x35c) returned 1
	[0076.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220
	[0076.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.176] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.176] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.177] GetLastError () returned 0x0
	[0076.177] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xa82, lpOverlapped=0x0) returned 1
	[0076.178] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xa90, lpOverlapped=0x0) returned 1
	[0076.179] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.179] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.180] SetEndOfFile (hFile=0x33c) returned 1
	[0076.180] CloseHandle (hObject=0x33c) returned 1
	[0076.181] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.181] SetEndOfFile (hFile=0x35c) returned 1
	[0076.182] CloseHandle (hObject=0x35c) returned 1
	[0076.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1
	[0076.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.182] lstrlenW (lpString=".doc") returned 4
	[0076.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.183] lstrlenW (lpString=".docx") returned 5
	[0076.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.183] lstrlenW (lpString=".pdf") returned 4
	[0076.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.183] lstrlenW (lpString=".xls") returned 4
	[0076.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.183] lstrlenW (lpString=".xlsx") returned 5
	[0076.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.183] lstrlenW (lpString=".ppt") returned 4
	[0076.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.183] lstrlenW (lpString=".zip") returned 4
	[0076.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.183] lstrlenW (lpString=".rar") returned 4
	[0076.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.183] lstrlenW (lpString=".bz2") returned 4
	[0076.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.183] lstrlenW (lpString=".7z") returned 3
	[0076.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.183] lstrlenW (lpString=".dbf") returned 4
	[0076.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.183] lstrlenW (lpString=".1cd") returned 4
	[0076.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.183] lstrlenW (lpString=".jpg") returned 4
	[0076.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.184] lstrlenW (lpString=".doc") returned 4
	[0076.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.184] lstrlenW (lpString=".docx") returned 5
	[0076.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.184] lstrlenW (lpString=".pdf") returned 4
	[0076.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.184] lstrlenW (lpString=".xls") returned 4
	[0076.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.184] lstrlenW (lpString=".xlsx") returned 5
	[0076.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.184] lstrlenW (lpString=".ppt") returned 4
	[0076.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.184] lstrlenW (lpString=".zip") returned 4
	[0076.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.184] lstrlenW (lpString=".rar") returned 4
	[0076.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.184] lstrlenW (lpString=".bz2") returned 4
	[0076.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.184] lstrlenW (lpString=".7z") returned 3
	[0076.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.184] lstrlenW (lpString=".dbf") returned 4
	[0076.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.184] lstrlenW (lpString=".1cd") returned 4
	[0076.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0076.185] lstrlenW (lpString=".jpg") returned 4
	[0076.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.185] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.185] lstrlenW (lpString="DD00256_.WMF") returned 12
	[0076.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.185] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2832) returned 1
	[0076.185] CloseHandle (hObject=0x35c) returned 1
	[0076.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220
	[0076.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.186] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.186] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.186] GetLastError () returned 0x0
	[0076.186] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xb10, lpOverlapped=0x0) returned 1
	[0076.187] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xb20, lpOverlapped=0x0) returned 1
	[0076.188] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.188] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.189] SetEndOfFile (hFile=0x33c) returned 1
	[0076.189] CloseHandle (hObject=0x33c) returned 1
	[0076.189] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.189] SetEndOfFile (hFile=0x35c) returned 1
	[0076.190] CloseHandle (hObject=0x35c) returned 1
	[0076.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1
	[0076.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.191] lstrlenW (lpString=".doc") returned 4
	[0076.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.191] lstrlenW (lpString=".docx") returned 5
	[0076.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.191] lstrlenW (lpString=".pdf") returned 4
	[0076.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.191] lstrlenW (lpString=".xls") returned 4
	[0076.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.191] lstrlenW (lpString=".xlsx") returned 5
	[0076.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.191] lstrlenW (lpString=".ppt") returned 4
	[0076.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.191] lstrlenW (lpString=".zip") returned 4
	[0076.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.191] lstrlenW (lpString=".rar") returned 4
	[0076.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.192] lstrlenW (lpString=".bz2") returned 4
	[0076.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.192] lstrlenW (lpString=".7z") returned 3
	[0076.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.192] lstrlenW (lpString=".dbf") returned 4
	[0076.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.192] lstrlenW (lpString=".1cd") returned 4
	[0076.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.192] lstrlenW (lpString=".jpg") returned 4
	[0076.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.192] lstrlenW (lpString=".doc") returned 4
	[0076.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.192] lstrlenW (lpString=".docx") returned 5
	[0076.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.192] lstrlenW (lpString=".pdf") returned 4
	[0076.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.192] lstrlenW (lpString=".xls") returned 4
	[0076.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.193] lstrlenW (lpString=".xlsx") returned 5
	[0076.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.193] lstrlenW (lpString=".ppt") returned 4
	[0076.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.193] lstrlenW (lpString=".zip") returned 4
	[0076.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.193] lstrlenW (lpString=".rar") returned 4
	[0076.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.193] lstrlenW (lpString=".bz2") returned 4
	[0076.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.193] lstrlenW (lpString=".7z") returned 3
	[0076.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.193] lstrlenW (lpString=".dbf") returned 4
	[0076.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.193] lstrlenW (lpString=".1cd") returned 4
	[0076.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0076.193] lstrlenW (lpString=".jpg") returned 4
	[0076.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.194] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.194] lstrlenW (lpString="DD00261_.WMF") returned 12
	[0076.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.194] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=37974) returned 1
	[0076.194] CloseHandle (hObject=0x35c) returned 1
	[0076.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220
	[0076.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.194] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.194] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.195] GetLastError () returned 0x0
	[0076.195] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x9456, lpOverlapped=0x0) returned 1
	[0076.197] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x9460, lpOverlapped=0x0) returned 1
	[0076.198] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.198] WriteFile (in: hFile=0x33c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.198] SetEndOfFile (hFile=0x33c) returned 1
	[0076.198] CloseHandle (hObject=0x33c) returned 1
	[0076.200] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.200] SetEndOfFile (hFile=0x35c) returned 1
	[0076.201] CloseHandle (hObject=0x35c) returned 1
	[0076.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1
	[0076.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.202] lstrlenW (lpString=".doc") returned 4
	[0076.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.202] lstrlenW (lpString=".docx") returned 5
	[0076.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.202] lstrlenW (lpString=".pdf") returned 4
	[0076.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.202] lstrlenW (lpString=".xls") returned 4
	[0076.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.202] lstrlenW (lpString=".xlsx") returned 5
	[0076.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.202] lstrlenW (lpString=".ppt") returned 4
	[0076.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.202] lstrlenW (lpString=".zip") returned 4
	[0076.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.202] lstrlenW (lpString=".rar") returned 4
	[0076.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.202] lstrlenW (lpString=".bz2") returned 4
	[0076.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.202] lstrlenW (lpString=".7z") returned 3
	[0076.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.202] lstrlenW (lpString=".dbf") returned 4
	[0076.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.203] lstrlenW (lpString=".1cd") returned 4
	[0076.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.203] lstrlenW (lpString=".jpg") returned 4
	[0076.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.203] lstrlenW (lpString=".doc") returned 4
	[0076.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.203] lstrlenW (lpString=".docx") returned 5
	[0076.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.203] lstrlenW (lpString=".pdf") returned 4
	[0076.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.203] lstrlenW (lpString=".xls") returned 4
	[0076.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.203] lstrlenW (lpString=".xlsx") returned 5
	[0076.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.203] lstrlenW (lpString=".ppt") returned 4
	[0076.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.203] lstrlenW (lpString=".zip") returned 4
	[0076.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.203] lstrlenW (lpString=".rar") returned 4
	[0076.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.203] lstrlenW (lpString=".bz2") returned 4
	[0076.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.203] lstrlenW (lpString=".7z") returned 3
	[0076.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.204] lstrlenW (lpString=".dbf") returned 4
	[0076.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.204] lstrlenW (lpString=".1cd") returned 4
	[0076.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0076.204] lstrlenW (lpString=".jpg") returned 4
	[0076.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.204] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.204] lstrlenW (lpString="DD00297_.WMF") returned 12
	[0076.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.218] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=40030) returned 1
	[0076.238] CloseHandle (hObject=0x384) returned 1
	[0076.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220
	[0076.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.239] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.239] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.239] GetLastError () returned 0x0
	[0076.239] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x9c5e, lpOverlapped=0x0) returned 1
	[0076.241] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x9c60, lpOverlapped=0x0) returned 1
	[0076.243] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.243] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.243] SetEndOfFile (hFile=0x35c) returned 1
	[0076.243] CloseHandle (hObject=0x35c) returned 1
	[0076.244] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.245] SetEndOfFile (hFile=0x384) returned 1
	[0076.246] CloseHandle (hObject=0x384) returned 1
	[0076.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1
	[0076.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.247] lstrlenW (lpString=".doc") returned 4
	[0076.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.247] lstrlenW (lpString=".docx") returned 5
	[0076.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.247] lstrlenW (lpString=".pdf") returned 4
	[0076.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.247] lstrlenW (lpString=".xls") returned 4
	[0076.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.247] lstrlenW (lpString=".xlsx") returned 5
	[0076.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.247] lstrlenW (lpString=".ppt") returned 4
	[0076.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.247] lstrlenW (lpString=".zip") returned 4
	[0076.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.247] lstrlenW (lpString=".rar") returned 4
	[0076.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.247] lstrlenW (lpString=".bz2") returned 4
	[0076.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.247] lstrlenW (lpString=".7z") returned 3
	[0076.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.247] lstrlenW (lpString=".dbf") returned 4
	[0076.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.248] lstrlenW (lpString=".1cd") returned 4
	[0076.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.248] lstrlenW (lpString=".jpg") returned 4
	[0076.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.248] lstrlenW (lpString=".doc") returned 4
	[0076.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.248] lstrlenW (lpString=".docx") returned 5
	[0076.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.248] lstrlenW (lpString=".pdf") returned 4
	[0076.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.248] lstrlenW (lpString=".xls") returned 4
	[0076.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.249] lstrlenW (lpString=".xlsx") returned 5
	[0076.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.249] lstrlenW (lpString=".ppt") returned 4
	[0076.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.249] lstrlenW (lpString=".zip") returned 4
	[0076.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.249] lstrlenW (lpString=".rar") returned 4
	[0076.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.249] lstrlenW (lpString=".bz2") returned 4
	[0076.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.249] lstrlenW (lpString=".7z") returned 3
	[0076.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.249] lstrlenW (lpString=".dbf") returned 4
	[0076.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.249] lstrlenW (lpString=".1cd") returned 4
	[0076.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0076.249] lstrlenW (lpString=".jpg") returned 4
	[0076.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.250] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.250] lstrlenW (lpString="DD00414_.WMF") returned 12
	[0076.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.250] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=42908) returned 1
	[0076.250] CloseHandle (hObject=0x384) returned 1
	[0076.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220
	[0076.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.250] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.250] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.251] GetLastError () returned 0x0
	[0076.251] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xa79c, lpOverlapped=0x0) returned 1
	[0076.253] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xa7a0, lpOverlapped=0x0) returned 1
	[0076.255] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.255] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.255] SetEndOfFile (hFile=0x35c) returned 1
	[0076.255] CloseHandle (hObject=0x35c) returned 1
	[0076.257] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.257] SetEndOfFile (hFile=0x384) returned 1
	[0076.258] CloseHandle (hObject=0x384) returned 1
	[0076.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1
	[0076.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.258] lstrlenW (lpString=".doc") returned 4
	[0076.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.258] lstrlenW (lpString=".docx") returned 5
	[0076.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.258] lstrlenW (lpString=".pdf") returned 4
	[0076.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.259] lstrlenW (lpString=".xls") returned 4
	[0076.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.259] lstrlenW (lpString=".xlsx") returned 5
	[0076.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.259] lstrlenW (lpString=".ppt") returned 4
	[0076.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.259] lstrlenW (lpString=".zip") returned 4
	[0076.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.259] lstrlenW (lpString=".rar") returned 4
	[0076.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.259] lstrlenW (lpString=".bz2") returned 4
	[0076.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.259] lstrlenW (lpString=".7z") returned 3
	[0076.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.259] lstrlenW (lpString=".dbf") returned 4
	[0076.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.259] lstrlenW (lpString=".1cd") returned 4
	[0076.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.259] lstrlenW (lpString=".jpg") returned 4
	[0076.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.260] lstrlenW (lpString=".doc") returned 4
	[0076.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.260] lstrlenW (lpString=".docx") returned 5
	[0076.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.260] lstrlenW (lpString=".pdf") returned 4
	[0076.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.260] lstrlenW (lpString=".xls") returned 4
	[0076.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.260] lstrlenW (lpString=".xlsx") returned 5
	[0076.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.260] lstrlenW (lpString=".ppt") returned 4
	[0076.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.260] lstrlenW (lpString=".zip") returned 4
	[0076.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.260] lstrlenW (lpString=".rar") returned 4
	[0076.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.260] lstrlenW (lpString=".bz2") returned 4
	[0076.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.260] lstrlenW (lpString=".7z") returned 3
	[0076.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.261] lstrlenW (lpString=".dbf") returned 4
	[0076.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.261] lstrlenW (lpString=".1cd") returned 4
	[0076.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0076.261] lstrlenW (lpString=".jpg") returned 4
	[0076.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.261] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.261] lstrlenW (lpString="DD00419_.WMF") returned 12
	[0076.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.262] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=712) returned 1
	[0076.262] CloseHandle (hObject=0x384) returned 1
	[0076.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220
	[0076.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.263] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.263] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.263] GetLastError () returned 0x0
	[0076.263] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2c8, lpOverlapped=0x0) returned 1
	[0076.264] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2d0, lpOverlapped=0x0) returned 1
	[0076.268] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.268] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.268] SetEndOfFile (hFile=0x35c) returned 1
	[0076.268] CloseHandle (hObject=0x35c) returned 1
	[0076.270] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.270] SetEndOfFile (hFile=0x384) returned 1
	[0076.271] CloseHandle (hObject=0x384) returned 1
	[0076.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1
	[0076.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.271] lstrlenW (lpString=".doc") returned 4
	[0076.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.272] lstrlenW (lpString=".docx") returned 5
	[0076.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.272] lstrlenW (lpString=".pdf") returned 4
	[0076.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.272] lstrlenW (lpString=".xls") returned 4
	[0076.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.272] lstrlenW (lpString=".xlsx") returned 5
	[0076.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.272] lstrlenW (lpString=".ppt") returned 4
	[0076.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.272] lstrlenW (lpString=".zip") returned 4
	[0076.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.272] lstrlenW (lpString=".rar") returned 4
	[0076.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.272] lstrlenW (lpString=".bz2") returned 4
	[0076.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.272] lstrlenW (lpString=".7z") returned 3
	[0076.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.272] lstrlenW (lpString=".dbf") returned 4
	[0076.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.273] lstrlenW (lpString=".1cd") returned 4
	[0076.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.273] lstrlenW (lpString=".jpg") returned 4
	[0076.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.273] lstrlenW (lpString=".doc") returned 4
	[0076.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.273] lstrlenW (lpString=".docx") returned 5
	[0076.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.273] lstrlenW (lpString=".pdf") returned 4
	[0076.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.273] lstrlenW (lpString=".xls") returned 4
	[0076.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.273] lstrlenW (lpString=".xlsx") returned 5
	[0076.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.273] lstrlenW (lpString=".ppt") returned 4
	[0076.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.273] lstrlenW (lpString=".zip") returned 4
	[0076.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.274] lstrlenW (lpString=".rar") returned 4
	[0076.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.274] lstrlenW (lpString=".bz2") returned 4
	[0076.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.274] lstrlenW (lpString=".7z") returned 3
	[0076.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.274] lstrlenW (lpString=".dbf") returned 4
	[0076.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.274] lstrlenW (lpString=".1cd") returned 4
	[0076.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0076.274] lstrlenW (lpString=".jpg") returned 4
	[0076.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.274] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.274] lstrlenW (lpString="DD00437_.WMF") returned 12
	[0076.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.275] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1932) returned 1
	[0076.275] CloseHandle (hObject=0x384) returned 1
	[0076.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220
	[0076.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.275] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.275] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.276] GetLastError () returned 0x0
	[0076.276] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x78c, lpOverlapped=0x0) returned 1
	[0076.951] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x790, lpOverlapped=0x0) returned 1
	[0076.952] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.952] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.952] SetEndOfFile (hFile=0x35c) returned 1
	[0076.952] CloseHandle (hObject=0x35c) returned 1
	[0076.952] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.952] SetEndOfFile (hFile=0x384) returned 1
	[0076.953] CloseHandle (hObject=0x384) returned 1
	[0076.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1
	[0076.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.954] lstrlenW (lpString=".doc") returned 4
	[0076.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.954] lstrlenW (lpString=".docx") returned 5
	[0076.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.954] lstrlenW (lpString=".pdf") returned 4
	[0076.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.954] lstrlenW (lpString=".xls") returned 4
	[0076.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.954] lstrlenW (lpString=".xlsx") returned 5
	[0076.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.954] lstrlenW (lpString=".ppt") returned 4
	[0076.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.954] lstrlenW (lpString=".zip") returned 4
	[0076.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.954] lstrlenW (lpString=".rar") returned 4
	[0076.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.954] lstrlenW (lpString=".bz2") returned 4
	[0076.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.954] lstrlenW (lpString=".7z") returned 3
	[0076.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.954] lstrlenW (lpString=".dbf") returned 4
	[0076.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.954] lstrlenW (lpString=".1cd") returned 4
	[0076.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.955] lstrlenW (lpString=".jpg") returned 4
	[0076.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.955] lstrlenW (lpString=".doc") returned 4
	[0076.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.956] lstrlenW (lpString=".docx") returned 5
	[0076.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.956] lstrlenW (lpString=".pdf") returned 4
	[0076.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.956] lstrlenW (lpString=".xls") returned 4
	[0076.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.956] lstrlenW (lpString=".xlsx") returned 5
	[0076.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.956] lstrlenW (lpString=".ppt") returned 4
	[0076.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.956] lstrlenW (lpString=".zip") returned 4
	[0076.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.956] lstrlenW (lpString=".rar") returned 4
	[0076.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.957] lstrlenW (lpString=".bz2") returned 4
	[0076.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.957] lstrlenW (lpString=".7z") returned 3
	[0076.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.957] lstrlenW (lpString=".dbf") returned 4
	[0076.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.957] lstrlenW (lpString=".1cd") returned 4
	[0076.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0076.957] lstrlenW (lpString=".jpg") returned 4
	[0076.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.957] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.957] lstrlenW (lpString="DD01151_.WMF") returned 12
	[0076.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.958] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2960) returned 1
	[0076.958] CloseHandle (hObject=0x384) returned 1
	[0076.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220
	[0076.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.958] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.958] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.959] GetLastError () returned 0x0
	[0076.959] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xb90, lpOverlapped=0x0) returned 1
	[0076.960] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xba0, lpOverlapped=0x0) returned 1
	[0076.961] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.961] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.961] SetEndOfFile (hFile=0x35c) returned 1
	[0076.961] CloseHandle (hObject=0x35c) returned 1
	[0076.961] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.961] SetEndOfFile (hFile=0x384) returned 1
	[0076.962] CloseHandle (hObject=0x384) returned 1
	[0076.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1
	[0076.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.963] lstrlenW (lpString=".doc") returned 4
	[0076.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.963] lstrlenW (lpString=".docx") returned 5
	[0076.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.963] lstrlenW (lpString=".pdf") returned 4
	[0076.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.963] lstrlenW (lpString=".xls") returned 4
	[0076.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.963] lstrlenW (lpString=".xlsx") returned 5
	[0076.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.963] lstrlenW (lpString=".ppt") returned 4
	[0076.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.963] lstrlenW (lpString=".zip") returned 4
	[0076.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.963] lstrlenW (lpString=".rar") returned 4
	[0076.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.963] lstrlenW (lpString=".bz2") returned 4
	[0076.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.963] lstrlenW (lpString=".7z") returned 3
	[0076.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.963] lstrlenW (lpString=".dbf") returned 4
	[0076.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.963] lstrlenW (lpString=".1cd") returned 4
	[0076.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.963] lstrlenW (lpString=".jpg") returned 4
	[0076.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.964] lstrlenW (lpString=".doc") returned 4
	[0076.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.964] lstrlenW (lpString=".docx") returned 5
	[0076.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.964] lstrlenW (lpString=".pdf") returned 4
	[0076.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.964] lstrlenW (lpString=".xls") returned 4
	[0076.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.964] lstrlenW (lpString=".xlsx") returned 5
	[0076.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.964] lstrlenW (lpString=".ppt") returned 4
	[0076.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.964] lstrlenW (lpString=".zip") returned 4
	[0076.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.964] lstrlenW (lpString=".rar") returned 4
	[0076.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.964] lstrlenW (lpString=".bz2") returned 4
	[0076.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.964] lstrlenW (lpString=".7z") returned 3
	[0076.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.964] lstrlenW (lpString=".dbf") returned 4
	[0076.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.964] lstrlenW (lpString=".1cd") returned 4
	[0076.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0076.964] lstrlenW (lpString=".jpg") returned 4
	[0076.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.965] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.965] lstrlenW (lpString="DD01152_.WMF") returned 12
	[0076.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.965] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2960) returned 1
	[0076.965] CloseHandle (hObject=0x384) returned 1
	[0076.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220
	[0076.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.966] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.966] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.966] GetLastError () returned 0x0
	[0076.966] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xb90, lpOverlapped=0x0) returned 1
	[0076.967] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xba0, lpOverlapped=0x0) returned 1
	[0076.969] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.970] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.970] SetEndOfFile (hFile=0x35c) returned 1
	[0076.970] CloseHandle (hObject=0x35c) returned 1
	[0076.970] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.970] SetEndOfFile (hFile=0x384) returned 1
	[0076.971] CloseHandle (hObject=0x384) returned 1
	[0076.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1
	[0076.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.971] lstrlenW (lpString=".doc") returned 4
	[0076.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.971] lstrlenW (lpString=".docx") returned 5
	[0076.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.971] lstrlenW (lpString=".pdf") returned 4
	[0076.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.971] lstrlenW (lpString=".xls") returned 4
	[0076.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.971] lstrlenW (lpString=".xlsx") returned 5
	[0076.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.972] lstrlenW (lpString=".ppt") returned 4
	[0076.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.972] lstrlenW (lpString=".zip") returned 4
	[0076.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.972] lstrlenW (lpString=".rar") returned 4
	[0076.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.972] lstrlenW (lpString=".bz2") returned 4
	[0076.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.972] lstrlenW (lpString=".7z") returned 3
	[0076.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.972] lstrlenW (lpString=".dbf") returned 4
	[0076.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.972] lstrlenW (lpString=".1cd") returned 4
	[0076.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.972] lstrlenW (lpString=".jpg") returned 4
	[0076.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.972] lstrlenW (lpString=".doc") returned 4
	[0076.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.972] lstrlenW (lpString=".docx") returned 5
	[0076.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.973] lstrlenW (lpString=".pdf") returned 4
	[0076.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.973] lstrlenW (lpString=".xls") returned 4
	[0076.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.973] lstrlenW (lpString=".xlsx") returned 5
	[0076.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.973] lstrlenW (lpString=".ppt") returned 4
	[0076.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.973] lstrlenW (lpString=".zip") returned 4
	[0076.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.973] lstrlenW (lpString=".rar") returned 4
	[0076.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.973] lstrlenW (lpString=".bz2") returned 4
	[0076.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.973] lstrlenW (lpString=".7z") returned 3
	[0076.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.973] lstrlenW (lpString=".dbf") returned 4
	[0076.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.973] lstrlenW (lpString=".1cd") returned 4
	[0076.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0076.973] lstrlenW (lpString=".jpg") returned 4
	[0076.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.974] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.974] lstrlenW (lpString="DD01157_.WMF") returned 12
	[0076.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.974] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3588) returned 1
	[0076.974] CloseHandle (hObject=0x384) returned 1
	[0076.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220
	[0076.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0076.974] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.974] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.975] GetLastError () returned 0x0
	[0076.975] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xe04, lpOverlapped=0x0) returned 1
	[0076.976] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe10, lpOverlapped=0x0) returned 1
	[0076.977] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.977] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.977] SetEndOfFile (hFile=0x35c) returned 1
	[0076.977] CloseHandle (hObject=0x35c) returned 1
	[0076.977] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.977] SetEndOfFile (hFile=0x384) returned 1
	[0076.978] CloseHandle (hObject=0x384) returned 1
	[0076.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1
	[0076.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.979] lstrlenW (lpString=".doc") returned 4
	[0076.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.979] lstrlenW (lpString=".docx") returned 5
	[0076.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.979] lstrlenW (lpString=".pdf") returned 4
	[0076.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.979] lstrlenW (lpString=".xls") returned 4
	[0076.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.979] lstrlenW (lpString=".xlsx") returned 5
	[0076.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.979] lstrlenW (lpString=".ppt") returned 4
	[0076.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.979] lstrlenW (lpString=".zip") returned 4
	[0076.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.979] lstrlenW (lpString=".rar") returned 4
	[0076.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.979] lstrlenW (lpString=".bz2") returned 4
	[0076.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.979] lstrlenW (lpString=".7z") returned 3
	[0076.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.979] lstrlenW (lpString=".dbf") returned 4
	[0076.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.979] lstrlenW (lpString=".1cd") returned 4
	[0076.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.980] lstrlenW (lpString=".jpg") returned 4
	[0076.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.980] lstrlenW (lpString=".doc") returned 4
	[0076.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.980] lstrlenW (lpString=".docx") returned 5
	[0076.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.980] lstrlenW (lpString=".pdf") returned 4
	[0076.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.980] lstrlenW (lpString=".xls") returned 4
	[0076.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.980] lstrlenW (lpString=".xlsx") returned 5
	[0076.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.980] lstrlenW (lpString=".ppt") returned 4
	[0076.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.980] lstrlenW (lpString=".zip") returned 4
	[0076.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.980] lstrlenW (lpString=".rar") returned 4
	[0076.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.980] lstrlenW (lpString=".bz2") returned 4
	[0076.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.980] lstrlenW (lpString=".7z") returned 3
	[0076.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.980] lstrlenW (lpString=".dbf") returned 4
	[0076.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.981] lstrlenW (lpString=".1cd") returned 4
	[0076.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0076.981] lstrlenW (lpString=".jpg") returned 4
	[0076.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.981] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.981] lstrlenW (lpString="DD01160_.WMF") returned 12
	[0076.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.000] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2228) returned 1
	[0077.000] CloseHandle (hObject=0x384) returned 1
	[0077.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220
	[0077.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.020] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.020] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.021] GetLastError () returned 0x0
	[0077.021] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x8b4, lpOverlapped=0x0) returned 1
	[0077.022] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0077.023] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.024] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.024] SetEndOfFile (hFile=0x340) returned 1
	[0077.024] CloseHandle (hObject=0x340) returned 1
	[0077.024] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.024] SetEndOfFile (hFile=0x384) returned 1
	[0077.025] CloseHandle (hObject=0x384) returned 1
	[0077.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1
	[0077.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.026] lstrlenW (lpString=".doc") returned 4
	[0077.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.026] lstrlenW (lpString=".docx") returned 5
	[0077.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.026] lstrlenW (lpString=".pdf") returned 4
	[0077.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.026] lstrlenW (lpString=".xls") returned 4
	[0077.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.026] lstrlenW (lpString=".xlsx") returned 5
	[0077.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.026] lstrlenW (lpString=".ppt") returned 4
	[0077.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.026] lstrlenW (lpString=".zip") returned 4
	[0077.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.026] lstrlenW (lpString=".rar") returned 4
	[0077.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.026] lstrlenW (lpString=".bz2") returned 4
	[0077.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.026] lstrlenW (lpString=".7z") returned 3
	[0077.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.027] lstrlenW (lpString=".dbf") returned 4
	[0077.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.027] lstrlenW (lpString=".1cd") returned 4
	[0077.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.027] lstrlenW (lpString=".jpg") returned 4
	[0077.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.027] lstrlenW (lpString=".doc") returned 4
	[0077.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.027] lstrlenW (lpString=".docx") returned 5
	[0077.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.027] lstrlenW (lpString=".pdf") returned 4
	[0077.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.027] lstrlenW (lpString=".xls") returned 4
	[0077.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.027] lstrlenW (lpString=".xlsx") returned 5
	[0077.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.027] lstrlenW (lpString=".ppt") returned 4
	[0077.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.028] lstrlenW (lpString=".zip") returned 4
	[0077.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.028] lstrlenW (lpString=".rar") returned 4
	[0077.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.028] lstrlenW (lpString=".bz2") returned 4
	[0077.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.028] lstrlenW (lpString=".7z") returned 3
	[0077.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.028] lstrlenW (lpString=".dbf") returned 4
	[0077.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.028] lstrlenW (lpString=".1cd") returned 4
	[0077.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0077.028] lstrlenW (lpString=".jpg") returned 4
	[0077.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.028] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.028] lstrlenW (lpString="DD01167_.WMF") returned 12
	[0077.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.029] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2080) returned 1
	[0077.029] CloseHandle (hObject=0x384) returned 1
	[0077.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220
	[0077.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.029] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.029] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.030] GetLastError () returned 0x0
	[0077.030] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x820, lpOverlapped=0x0) returned 1
	[0077.031] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x830, lpOverlapped=0x0) returned 1
	[0077.032] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.032] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.032] SetEndOfFile (hFile=0x340) returned 1
	[0077.033] CloseHandle (hObject=0x340) returned 1
	[0077.033] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.033] SetEndOfFile (hFile=0x384) returned 1
	[0077.034] CloseHandle (hObject=0x384) returned 1
	[0077.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1
	[0077.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.034] lstrlenW (lpString=".doc") returned 4
	[0077.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.034] lstrlenW (lpString=".docx") returned 5
	[0077.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.034] lstrlenW (lpString=".pdf") returned 4
	[0077.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.034] lstrlenW (lpString=".xls") returned 4
	[0077.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.034] lstrlenW (lpString=".xlsx") returned 5
	[0077.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.034] lstrlenW (lpString=".ppt") returned 4
	[0077.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.035] lstrlenW (lpString=".zip") returned 4
	[0077.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.035] lstrlenW (lpString=".rar") returned 4
	[0077.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.035] lstrlenW (lpString=".bz2") returned 4
	[0077.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.035] lstrlenW (lpString=".7z") returned 3
	[0077.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.036] lstrlenW (lpString=".dbf") returned 4
	[0077.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.036] lstrlenW (lpString=".1cd") returned 4
	[0077.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.036] lstrlenW (lpString=".jpg") returned 4
	[0077.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.037] lstrlenW (lpString=".doc") returned 4
	[0077.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString=".docx") returned 5
	[0077.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.037] lstrlenW (lpString=".pdf") returned 4
	[0077.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString=".xls") returned 4
	[0077.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.037] lstrlenW (lpString=".xlsx") returned 5
	[0077.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.037] lstrlenW (lpString=".ppt") returned 4
	[0077.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.037] lstrlenW (lpString=".zip") returned 4
	[0077.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.037] lstrlenW (lpString=".rar") returned 4
	[0077.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString=".bz2") returned 4
	[0077.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString=".7z") returned 3
	[0077.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.037] lstrlenW (lpString=".dbf") returned 4
	[0077.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.038] lstrlenW (lpString=".1cd") returned 4
	[0077.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0077.038] lstrlenW (lpString=".jpg") returned 4
	[0077.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.038] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.038] lstrlenW (lpString="DD01168_.WMF") returned 12
	[0077.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.039] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2004) returned 1
	[0077.039] CloseHandle (hObject=0x384) returned 1
	[0077.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220
	[0077.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.039] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.039] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.040] GetLastError () returned 0x0
	[0077.040] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x7d4, lpOverlapped=0x0) returned 1
	[0077.041] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x7e0, lpOverlapped=0x0) returned 1
	[0077.042] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.042] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.042] SetEndOfFile (hFile=0x340) returned 1
	[0077.043] CloseHandle (hObject=0x340) returned 1
	[0077.043] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.043] SetEndOfFile (hFile=0x384) returned 1
	[0077.044] CloseHandle (hObject=0x384) returned 1
	[0077.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1
	[0077.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.044] lstrlenW (lpString=".doc") returned 4
	[0077.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.044] lstrlenW (lpString=".docx") returned 5
	[0077.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.044] lstrlenW (lpString=".pdf") returned 4
	[0077.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.045] lstrlenW (lpString=".xls") returned 4
	[0077.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.045] lstrlenW (lpString=".xlsx") returned 5
	[0077.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.045] lstrlenW (lpString=".ppt") returned 4
	[0077.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.045] lstrlenW (lpString=".zip") returned 4
	[0077.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.045] lstrlenW (lpString=".rar") returned 4
	[0077.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.045] lstrlenW (lpString=".bz2") returned 4
	[0077.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.045] lstrlenW (lpString=".7z") returned 3
	[0077.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.045] lstrlenW (lpString=".dbf") returned 4
	[0077.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.045] lstrlenW (lpString=".1cd") returned 4
	[0077.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.045] lstrlenW (lpString=".jpg") returned 4
	[0077.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.045] lstrlenW (lpString=".doc") returned 4
	[0077.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.046] lstrlenW (lpString=".docx") returned 5
	[0077.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.046] lstrlenW (lpString=".pdf") returned 4
	[0077.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.046] lstrlenW (lpString=".xls") returned 4
	[0077.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.046] lstrlenW (lpString=".xlsx") returned 5
	[0077.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.046] lstrlenW (lpString=".ppt") returned 4
	[0077.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.046] lstrlenW (lpString=".zip") returned 4
	[0077.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.046] lstrlenW (lpString=".rar") returned 4
	[0077.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.046] lstrlenW (lpString=".bz2") returned 4
	[0077.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.046] lstrlenW (lpString=".7z") returned 3
	[0077.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.047] lstrlenW (lpString=".dbf") returned 4
	[0077.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.047] lstrlenW (lpString=".1cd") returned 4
	[0077.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0077.047] lstrlenW (lpString=".jpg") returned 4
	[0077.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.047] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.047] lstrlenW (lpString="DD01169_.WMF") returned 12
	[0077.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.048] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2020) returned 1
	[0077.048] CloseHandle (hObject=0x384) returned 1
	[0077.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220
	[0077.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.048] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.049] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.049] GetLastError () returned 0x0
	[0077.049] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x7e4, lpOverlapped=0x0) returned 1
	[0077.051] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0077.053] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.053] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.053] SetEndOfFile (hFile=0x340) returned 1
	[0077.053] CloseHandle (hObject=0x340) returned 1
	[0077.053] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.053] SetEndOfFile (hFile=0x384) returned 1
	[0077.054] CloseHandle (hObject=0x384) returned 1
	[0077.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1
	[0077.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.055] lstrlenW (lpString=".doc") returned 4
	[0077.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.055] lstrlenW (lpString=".docx") returned 5
	[0077.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.055] lstrlenW (lpString=".pdf") returned 4
	[0077.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.055] lstrlenW (lpString=".xls") returned 4
	[0077.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.056] lstrlenW (lpString=".xlsx") returned 5
	[0077.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.056] lstrlenW (lpString=".ppt") returned 4
	[0077.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.056] lstrlenW (lpString=".zip") returned 4
	[0077.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.056] lstrlenW (lpString=".rar") returned 4
	[0077.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.056] lstrlenW (lpString=".bz2") returned 4
	[0077.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.056] lstrlenW (lpString=".7z") returned 3
	[0077.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.056] lstrlenW (lpString=".dbf") returned 4
	[0077.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.056] lstrlenW (lpString=".1cd") returned 4
	[0077.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.057] lstrlenW (lpString=".jpg") returned 4
	[0077.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.057] lstrlenW (lpString=".doc") returned 4
	[0077.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.057] lstrlenW (lpString=".docx") returned 5
	[0077.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.057] lstrlenW (lpString=".pdf") returned 4
	[0077.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.057] lstrlenW (lpString=".xls") returned 4
	[0077.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.057] lstrlenW (lpString=".xlsx") returned 5
	[0077.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.057] lstrlenW (lpString=".ppt") returned 4
	[0077.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.057] lstrlenW (lpString=".zip") returned 4
	[0077.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.058] lstrlenW (lpString=".rar") returned 4
	[0077.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.058] lstrlenW (lpString=".bz2") returned 4
	[0077.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.058] lstrlenW (lpString=".7z") returned 3
	[0077.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.058] lstrlenW (lpString=".dbf") returned 4
	[0077.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.058] lstrlenW (lpString=".1cd") returned 4
	[0077.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0077.058] lstrlenW (lpString=".jpg") returned 4
	[0077.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.059] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.059] lstrlenW (lpString="DD01170_.WMF") returned 12
	[0077.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.059] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2404) returned 1
	[0077.059] CloseHandle (hObject=0x384) returned 1
	[0077.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220
	[0077.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.060] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.060] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.060] GetLastError () returned 0x0
	[0077.060] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x964, lpOverlapped=0x0) returned 1
	[0077.245] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x970, lpOverlapped=0x0) returned 1
	[0077.246] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.246] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.247] SetEndOfFile (hFile=0x340) returned 1
	[0077.379] CloseHandle (hObject=0x340) returned 1
	[0077.379] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.379] SetEndOfFile (hFile=0x384) returned 1
	[0077.380] CloseHandle (hObject=0x384) returned 1
	[0077.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1
	[0077.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.381] lstrlenW (lpString=".doc") returned 4
	[0077.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.381] lstrlenW (lpString=".docx") returned 5
	[0077.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.381] lstrlenW (lpString=".pdf") returned 4
	[0077.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.381] lstrlenW (lpString=".xls") returned 4
	[0077.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.381] lstrlenW (lpString=".xlsx") returned 5
	[0077.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.381] lstrlenW (lpString=".ppt") returned 4
	[0077.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.381] lstrlenW (lpString=".zip") returned 4
	[0077.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.381] lstrlenW (lpString=".rar") returned 4
	[0077.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.381] lstrlenW (lpString=".bz2") returned 4
	[0077.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.381] lstrlenW (lpString=".7z") returned 3
	[0077.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.381] lstrlenW (lpString=".dbf") returned 4
	[0077.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.381] lstrlenW (lpString=".1cd") returned 4
	[0077.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.382] lstrlenW (lpString=".jpg") returned 4
	[0077.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.382] lstrlenW (lpString=".doc") returned 4
	[0077.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.382] lstrlenW (lpString=".docx") returned 5
	[0077.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.382] lstrlenW (lpString=".pdf") returned 4
	[0077.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.382] lstrlenW (lpString=".xls") returned 4
	[0077.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.382] lstrlenW (lpString=".xlsx") returned 5
	[0077.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.382] lstrlenW (lpString=".ppt") returned 4
	[0077.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.382] lstrlenW (lpString=".zip") returned 4
	[0077.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.382] lstrlenW (lpString=".rar") returned 4
	[0077.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.382] lstrlenW (lpString=".bz2") returned 4
	[0077.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.382] lstrlenW (lpString=".7z") returned 3
	[0077.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.382] lstrlenW (lpString=".dbf") returned 4
	[0077.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.383] lstrlenW (lpString=".1cd") returned 4
	[0077.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0077.383] lstrlenW (lpString=".jpg") returned 4
	[0077.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.383] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.383] lstrlenW (lpString="DD01585_.WMF") returned 12
	[0077.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.383] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2524) returned 1
	[0077.383] CloseHandle (hObject=0x384) returned 1
	[0077.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220
	[0077.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.384] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.384] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.384] GetLastError () returned 0x0
	[0077.384] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x9dc, lpOverlapped=0x0) returned 1
	[0077.385] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x9e0, lpOverlapped=0x0) returned 1
	[0077.386] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.386] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.387] SetEndOfFile (hFile=0x340) returned 1
	[0077.387] CloseHandle (hObject=0x340) returned 1
	[0077.387] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.387] SetEndOfFile (hFile=0x384) returned 1
	[0077.388] CloseHandle (hObject=0x384) returned 1
	[0077.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1
	[0077.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.388] lstrlenW (lpString=".doc") returned 4
	[0077.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.388] lstrlenW (lpString=".docx") returned 5
	[0077.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.388] lstrlenW (lpString=".pdf") returned 4
	[0077.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.388] lstrlenW (lpString=".xls") returned 4
	[0077.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.388] lstrlenW (lpString=".xlsx") returned 5
	[0077.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.388] lstrlenW (lpString=".ppt") returned 4
	[0077.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.389] lstrlenW (lpString=".zip") returned 4
	[0077.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.389] lstrlenW (lpString=".rar") returned 4
	[0077.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.389] lstrlenW (lpString=".bz2") returned 4
	[0077.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.389] lstrlenW (lpString=".7z") returned 3
	[0077.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.389] lstrlenW (lpString=".dbf") returned 4
	[0077.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.389] lstrlenW (lpString=".1cd") returned 4
	[0077.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.389] lstrlenW (lpString=".jpg") returned 4
	[0077.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.389] lstrlenW (lpString=".doc") returned 4
	[0077.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.389] lstrlenW (lpString=".docx") returned 5
	[0077.389] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.389] lstrlenW (lpString=".pdf") returned 4
	[0077.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.389] lstrlenW (lpString=".xls") returned 4
	[0077.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.389] lstrlenW (lpString=".xlsx") returned 5
	[0077.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.389] lstrlenW (lpString=".ppt") returned 4
	[0077.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.390] lstrlenW (lpString=".zip") returned 4
	[0077.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.390] lstrlenW (lpString=".rar") returned 4
	[0077.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.390] lstrlenW (lpString=".bz2") returned 4
	[0077.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.390] lstrlenW (lpString=".7z") returned 3
	[0077.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.390] lstrlenW (lpString=".dbf") returned 4
	[0077.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.390] lstrlenW (lpString=".1cd") returned 4
	[0077.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0077.390] lstrlenW (lpString=".jpg") returned 4
	[0077.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.390] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.390] lstrlenW (lpString="DD01586_.WMF") returned 12
	[0077.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.391] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2324) returned 1
	[0077.391] CloseHandle (hObject=0x384) returned 1
	[0077.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220
	[0077.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.391] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.391] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.392] GetLastError () returned 0x0
	[0077.392] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x914, lpOverlapped=0x0) returned 1
	[0077.393] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x920, lpOverlapped=0x0) returned 1
	[0077.394] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.394] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.394] SetEndOfFile (hFile=0x340) returned 1
	[0077.394] CloseHandle (hObject=0x340) returned 1
	[0077.394] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.394] SetEndOfFile (hFile=0x384) returned 1
	[0077.395] CloseHandle (hObject=0x384) returned 1
	[0077.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1
	[0077.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.396] lstrlenW (lpString=".doc") returned 4
	[0077.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.396] lstrlenW (lpString=".docx") returned 5
	[0077.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.396] lstrlenW (lpString=".pdf") returned 4
	[0077.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.396] lstrlenW (lpString=".xls") returned 4
	[0077.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.396] lstrlenW (lpString=".xlsx") returned 5
	[0077.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.396] lstrlenW (lpString=".ppt") returned 4
	[0077.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.396] lstrlenW (lpString=".zip") returned 4
	[0077.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.396] lstrlenW (lpString=".rar") returned 4
	[0077.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.396] lstrlenW (lpString=".bz2") returned 4
	[0077.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.396] lstrlenW (lpString=".7z") returned 3
	[0077.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.396] lstrlenW (lpString=".dbf") returned 4
	[0077.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.397] lstrlenW (lpString=".1cd") returned 4
	[0077.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.397] lstrlenW (lpString=".jpg") returned 4
	[0077.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.397] lstrlenW (lpString=".doc") returned 4
	[0077.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.397] lstrlenW (lpString=".docx") returned 5
	[0077.397] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.397] lstrlenW (lpString=".pdf") returned 4
	[0077.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.397] lstrlenW (lpString=".xls") returned 4
	[0077.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.397] lstrlenW (lpString=".xlsx") returned 5
	[0077.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.397] lstrlenW (lpString=".ppt") returned 4
	[0077.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.397] lstrlenW (lpString=".zip") returned 4
	[0077.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.397] lstrlenW (lpString=".rar") returned 4
	[0077.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.397] lstrlenW (lpString=".bz2") returned 4
	[0077.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.397] lstrlenW (lpString=".7z") returned 3
	[0077.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.398] lstrlenW (lpString=".dbf") returned 4
	[0077.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.398] lstrlenW (lpString=".1cd") returned 4
	[0077.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0077.398] lstrlenW (lpString=".jpg") returned 4
	[0077.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.398] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.398] lstrlenW (lpString="DD01628_.WMF") returned 12
	[0077.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.399] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=19068) returned 1
	[0077.399] CloseHandle (hObject=0x384) returned 1
	[0077.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220
	[0077.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.399] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.399] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.400] GetLastError () returned 0x0
	[0077.400] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4a7c, lpOverlapped=0x0) returned 1
	[0077.401] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4a80, lpOverlapped=0x0) returned 1
	[0077.402] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.402] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.403] SetEndOfFile (hFile=0x340) returned 1
	[0077.403] CloseHandle (hObject=0x340) returned 1
	[0077.403] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.403] SetEndOfFile (hFile=0x384) returned 1
	[0077.404] CloseHandle (hObject=0x384) returned 1
	[0077.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1
	[0077.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.404] lstrlenW (lpString=".doc") returned 4
	[0077.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.404] lstrlenW (lpString=".docx") returned 5
	[0077.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.404] lstrlenW (lpString=".pdf") returned 4
	[0077.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.404] lstrlenW (lpString=".xls") returned 4
	[0077.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.404] lstrlenW (lpString=".xlsx") returned 5
	[0077.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.405] lstrlenW (lpString=".ppt") returned 4
	[0077.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.405] lstrlenW (lpString=".zip") returned 4
	[0077.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.405] lstrlenW (lpString=".rar") returned 4
	[0077.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.405] lstrlenW (lpString=".bz2") returned 4
	[0077.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.405] lstrlenW (lpString=".7z") returned 3
	[0077.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.405] lstrlenW (lpString=".dbf") returned 4
	[0077.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.405] lstrlenW (lpString=".1cd") returned 4
	[0077.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.405] lstrlenW (lpString=".jpg") returned 4
	[0077.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.405] lstrlenW (lpString=".doc") returned 4
	[0077.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.405] lstrlenW (lpString=".docx") returned 5
	[0077.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.405] lstrlenW (lpString=".pdf") returned 4
	[0077.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.405] lstrlenW (lpString=".xls") returned 4
	[0077.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.406] lstrlenW (lpString=".xlsx") returned 5
	[0077.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.406] lstrlenW (lpString=".ppt") returned 4
	[0077.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.406] lstrlenW (lpString=".zip") returned 4
	[0077.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.406] lstrlenW (lpString=".rar") returned 4
	[0077.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.406] lstrlenW (lpString=".bz2") returned 4
	[0077.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.406] lstrlenW (lpString=".7z") returned 3
	[0077.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.406] lstrlenW (lpString=".dbf") returned 4
	[0077.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.406] lstrlenW (lpString=".1cd") returned 4
	[0077.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0077.406] lstrlenW (lpString=".jpg") returned 4
	[0077.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.406] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.406] lstrlenW (lpString="DD01629_.WMF") returned 12
	[0077.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.407] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=580) returned 1
	[0077.407] CloseHandle (hObject=0x384) returned 1
	[0077.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220
	[0077.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.408] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.408] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.408] GetLastError () returned 0x0
	[0077.408] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x244, lpOverlapped=0x0) returned 1
	[0077.409] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x250, lpOverlapped=0x0) returned 1
	[0077.838] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.838] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.838] SetEndOfFile (hFile=0x340) returned 1
	[0077.839] CloseHandle (hObject=0x340) returned 1
	[0077.839] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.839] SetEndOfFile (hFile=0x384) returned 1
	[0077.839] CloseHandle (hObject=0x384) returned 1
	[0077.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1
	[0077.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.840] lstrlenW (lpString=".doc") returned 4
	[0077.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.840] lstrlenW (lpString=".docx") returned 5
	[0077.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.840] lstrlenW (lpString=".pdf") returned 4
	[0077.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.840] lstrlenW (lpString=".xls") returned 4
	[0077.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.840] lstrlenW (lpString=".xlsx") returned 5
	[0077.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.840] lstrlenW (lpString=".ppt") returned 4
	[0077.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.841] lstrlenW (lpString=".zip") returned 4
	[0077.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.841] lstrlenW (lpString=".rar") returned 4
	[0077.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.841] lstrlenW (lpString=".bz2") returned 4
	[0077.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.841] lstrlenW (lpString=".7z") returned 3
	[0077.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.841] lstrlenW (lpString=".dbf") returned 4
	[0077.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.841] lstrlenW (lpString=".1cd") returned 4
	[0077.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.841] lstrlenW (lpString=".jpg") returned 4
	[0077.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.841] lstrlenW (lpString=".doc") returned 4
	[0077.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.841] lstrlenW (lpString=".docx") returned 5
	[0077.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.841] lstrlenW (lpString=".pdf") returned 4
	[0077.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.841] lstrlenW (lpString=".xls") returned 4
	[0077.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.842] lstrlenW (lpString=".xlsx") returned 5
	[0077.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.842] lstrlenW (lpString=".ppt") returned 4
	[0077.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.842] lstrlenW (lpString=".zip") returned 4
	[0077.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.842] lstrlenW (lpString=".rar") returned 4
	[0077.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.842] lstrlenW (lpString=".bz2") returned 4
	[0077.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.842] lstrlenW (lpString=".7z") returned 3
	[0077.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.842] lstrlenW (lpString=".dbf") returned 4
	[0077.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.842] lstrlenW (lpString=".1cd") returned 4
	[0077.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0077.842] lstrlenW (lpString=".jpg") returned 4
	[0077.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.842] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.843] lstrlenW (lpString="EN00222_.WMF") returned 12
	[0077.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.843] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=12356) returned 1
	[0077.843] CloseHandle (hObject=0x384) returned 1
	[0077.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220
	[0077.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.843] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.843] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.844] GetLastError () returned 0x0
	[0077.844] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x3044, lpOverlapped=0x0) returned 1
	[0077.845] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x3050, lpOverlapped=0x0) returned 1
	[0077.846] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.847] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.847] SetEndOfFile (hFile=0x340) returned 1
	[0077.847] CloseHandle (hObject=0x340) returned 1
	[0077.847] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.847] SetEndOfFile (hFile=0x384) returned 1
	[0077.848] CloseHandle (hObject=0x384) returned 1
	[0077.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1
	[0077.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.849] lstrlenW (lpString=".doc") returned 4
	[0077.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.849] lstrlenW (lpString=".docx") returned 5
	[0077.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.849] lstrlenW (lpString=".pdf") returned 4
	[0077.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.849] lstrlenW (lpString=".xls") returned 4
	[0077.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.849] lstrlenW (lpString=".xlsx") returned 5
	[0077.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.849] lstrlenW (lpString=".ppt") returned 4
	[0077.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.849] lstrlenW (lpString=".zip") returned 4
	[0077.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.849] lstrlenW (lpString=".rar") returned 4
	[0077.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.849] lstrlenW (lpString=".bz2") returned 4
	[0077.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.849] lstrlenW (lpString=".7z") returned 3
	[0077.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.849] lstrlenW (lpString=".dbf") returned 4
	[0077.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.850] lstrlenW (lpString=".1cd") returned 4
	[0077.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.850] lstrlenW (lpString=".jpg") returned 4
	[0077.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.850] lstrlenW (lpString=".doc") returned 4
	[0077.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.850] lstrlenW (lpString=".docx") returned 5
	[0077.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.850] lstrlenW (lpString=".pdf") returned 4
	[0077.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.850] lstrlenW (lpString=".xls") returned 4
	[0077.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.850] lstrlenW (lpString=".xlsx") returned 5
	[0077.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.850] lstrlenW (lpString=".ppt") returned 4
	[0077.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.850] lstrlenW (lpString=".zip") returned 4
	[0077.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.850] lstrlenW (lpString=".rar") returned 4
	[0077.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.851] lstrlenW (lpString=".bz2") returned 4
	[0077.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.851] lstrlenW (lpString=".7z") returned 3
	[0077.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.851] lstrlenW (lpString=".dbf") returned 4
	[0077.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.851] lstrlenW (lpString=".1cd") returned 4
	[0077.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0077.851] lstrlenW (lpString=".jpg") returned 4
	[0077.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.851] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.851] lstrlenW (lpString="EN00242_.WMF") returned 12
	[0077.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.852] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=6780) returned 1
	[0077.852] CloseHandle (hObject=0x384) returned 1
	[0077.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220
	[0077.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.852] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.852] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.852] GetLastError () returned 0x0
	[0077.852] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1a7c, lpOverlapped=0x0) returned 1
	[0077.854] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1a80, lpOverlapped=0x0) returned 1
	[0077.855] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.855] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.855] SetEndOfFile (hFile=0x340) returned 1
	[0077.855] CloseHandle (hObject=0x340) returned 1
	[0077.855] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.855] SetEndOfFile (hFile=0x384) returned 1
	[0077.856] CloseHandle (hObject=0x384) returned 1
	[0077.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1
	[0077.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.857] lstrlenW (lpString=".doc") returned 4
	[0077.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.857] lstrlenW (lpString=".docx") returned 5
	[0077.857] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.857] lstrlenW (lpString=".pdf") returned 4
	[0077.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.857] lstrlenW (lpString=".xls") returned 4
	[0077.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.857] lstrlenW (lpString=".xlsx") returned 5
	[0077.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.857] lstrlenW (lpString=".ppt") returned 4
	[0077.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.857] lstrlenW (lpString=".zip") returned 4
	[0077.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.857] lstrlenW (lpString=".rar") returned 4
	[0077.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.857] lstrlenW (lpString=".bz2") returned 4
	[0077.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.857] lstrlenW (lpString=".7z") returned 3
	[0077.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.857] lstrlenW (lpString=".dbf") returned 4
	[0077.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.858] lstrlenW (lpString=".1cd") returned 4
	[0077.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.858] lstrlenW (lpString=".jpg") returned 4
	[0077.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.858] lstrlenW (lpString=".doc") returned 4
	[0077.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.858] lstrlenW (lpString=".docx") returned 5
	[0077.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.858] lstrlenW (lpString=".pdf") returned 4
	[0077.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.858] lstrlenW (lpString=".xls") returned 4
	[0077.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.858] lstrlenW (lpString=".xlsx") returned 5
	[0077.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.858] lstrlenW (lpString=".ppt") returned 4
	[0077.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.858] lstrlenW (lpString=".zip") returned 4
	[0077.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.858] lstrlenW (lpString=".rar") returned 4
	[0077.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.858] lstrlenW (lpString=".bz2") returned 4
	[0077.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.858] lstrlenW (lpString=".7z") returned 3
	[0077.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.859] lstrlenW (lpString=".dbf") returned 4
	[0077.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.859] lstrlenW (lpString=".1cd") returned 4
	[0077.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0077.859] lstrlenW (lpString=".jpg") returned 4
	[0077.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.859] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.859] lstrlenW (lpString="EN00319_.WMF") returned 12
	[0077.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.859] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2280) returned 1
	[0077.859] CloseHandle (hObject=0x384) returned 1
	[0077.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220
	[0077.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.860] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.860] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.860] GetLastError () returned 0x0
	[0077.860] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x8e8, lpOverlapped=0x0) returned 1
	[0077.862] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x8f0, lpOverlapped=0x0) returned 1
	[0077.862] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.863] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.863] SetEndOfFile (hFile=0x340) returned 1
	[0077.863] CloseHandle (hObject=0x340) returned 1
	[0077.863] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.863] SetEndOfFile (hFile=0x384) returned 1
	[0077.864] CloseHandle (hObject=0x384) returned 1
	[0077.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1
	[0077.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.865] lstrlenW (lpString=".doc") returned 4
	[0077.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.865] lstrlenW (lpString=".docx") returned 5
	[0077.865] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.865] lstrlenW (lpString=".pdf") returned 4
	[0077.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.865] lstrlenW (lpString=".xls") returned 4
	[0077.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.865] lstrlenW (lpString=".xlsx") returned 5
	[0077.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.865] lstrlenW (lpString=".ppt") returned 4
	[0077.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.865] lstrlenW (lpString=".zip") returned 4
	[0077.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.865] lstrlenW (lpString=".rar") returned 4
	[0077.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.865] lstrlenW (lpString=".bz2") returned 4
	[0077.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.865] lstrlenW (lpString=".7z") returned 3
	[0077.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.865] lstrlenW (lpString=".dbf") returned 4
	[0077.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.866] lstrlenW (lpString=".1cd") returned 4
	[0077.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.866] lstrlenW (lpString=".jpg") returned 4
	[0077.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.866] lstrlenW (lpString=".doc") returned 4
	[0077.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.866] lstrlenW (lpString=".docx") returned 5
	[0077.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.866] lstrlenW (lpString=".pdf") returned 4
	[0077.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.866] lstrlenW (lpString=".xls") returned 4
	[0077.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.866] lstrlenW (lpString=".xlsx") returned 5
	[0077.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.866] lstrlenW (lpString=".ppt") returned 4
	[0077.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.866] lstrlenW (lpString=".zip") returned 4
	[0077.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.866] lstrlenW (lpString=".rar") returned 4
	[0077.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.867] lstrlenW (lpString=".bz2") returned 4
	[0077.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.867] lstrlenW (lpString=".7z") returned 3
	[0077.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.867] lstrlenW (lpString=".dbf") returned 4
	[0077.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.867] lstrlenW (lpString=".1cd") returned 4
	[0077.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0077.867] lstrlenW (lpString=".jpg") returned 4
	[0077.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.867] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.867] lstrlenW (lpString="EN00320_.WMF") returned 12
	[0077.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.868] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=736) returned 1
	[0077.868] CloseHandle (hObject=0x384) returned 1
	[0077.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220
	[0077.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.868] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.869] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.869] GetLastError () returned 0x0
	[0077.869] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2e0, lpOverlapped=0x0) returned 1
	[0077.870] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2f0, lpOverlapped=0x0) returned 1
	[0077.871] ReadFile (in: hFile=0x384, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.871] WriteFile (in: hFile=0x340, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.872] SetEndOfFile (hFile=0x340) returned 1
	[0077.872] CloseHandle (hObject=0x340) returned 1
	[0077.872] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.872] SetEndOfFile (hFile=0x384) returned 1
	[0077.873] CloseHandle (hObject=0x384) returned 1
	[0077.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1
	[0077.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.873] lstrlenW (lpString=".doc") returned 4
	[0077.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.873] lstrlenW (lpString=".docx") returned 5
	[0077.873] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.873] lstrlenW (lpString=".pdf") returned 4
	[0077.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.873] lstrlenW (lpString=".xls") returned 4
	[0077.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.873] lstrlenW (lpString=".xlsx") returned 5
	[0077.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.874] lstrlenW (lpString=".ppt") returned 4
	[0077.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.874] lstrlenW (lpString=".zip") returned 4
	[0077.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.874] lstrlenW (lpString=".rar") returned 4
	[0077.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.874] lstrlenW (lpString=".bz2") returned 4
	[0077.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.874] lstrlenW (lpString=".7z") returned 3
	[0077.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.874] lstrlenW (lpString=".dbf") returned 4
	[0077.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.874] lstrlenW (lpString=".1cd") returned 4
	[0077.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.874] lstrlenW (lpString=".jpg") returned 4
	[0077.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.874] lstrlenW (lpString=".doc") returned 4
	[0077.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.874] lstrlenW (lpString=".docx") returned 5
	[0077.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.874] lstrlenW (lpString=".pdf") returned 4
	[0077.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.874] lstrlenW (lpString=".xls") returned 4
	[0077.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.875] lstrlenW (lpString=".xlsx") returned 5
	[0077.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.875] lstrlenW (lpString=".ppt") returned 4
	[0077.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.875] lstrlenW (lpString=".zip") returned 4
	[0077.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.875] lstrlenW (lpString=".rar") returned 4
	[0077.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.875] lstrlenW (lpString=".bz2") returned 4
	[0077.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.875] lstrlenW (lpString=".7z") returned 3
	[0077.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.875] lstrlenW (lpString=".dbf") returned 4
	[0077.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.875] lstrlenW (lpString=".1cd") returned 4
	[0077.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0077.875] lstrlenW (lpString=".jpg") returned 4
	[0077.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.875] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.875] lstrlenW (lpString="EN00397_.WMF") returned 12
	[0077.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0077.876] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=17308) returned 1
	[0077.876] CloseHandle (hObject=0x384) returned 1
	[0078.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220
	[0078.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.226] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.226] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0078.226] GetLastError () returned 0x0
	[0078.226] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x439c, lpOverlapped=0x0) returned 1
	[0078.228] WriteFile (in: hFile=0x370, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x43a0, lpOverlapped=0x0) returned 1
	[0078.229] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.229] WriteFile (in: hFile=0x370, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.229] SetEndOfFile (hFile=0x370) returned 1
	[0078.229] CloseHandle (hObject=0x370) returned 1
	[0078.229] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.229] SetEndOfFile (hFile=0x344) returned 1
	[0078.230] CloseHandle (hObject=0x344) returned 1
	[0078.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1
	[0078.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.231] lstrlenW (lpString=".doc") returned 4
	[0078.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.231] lstrlenW (lpString=".docx") returned 5
	[0078.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.231] lstrlenW (lpString=".pdf") returned 4
	[0078.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.231] lstrlenW (lpString=".xls") returned 4
	[0078.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.231] lstrlenW (lpString=".xlsx") returned 5
	[0078.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.231] lstrlenW (lpString=".ppt") returned 4
	[0078.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.232] lstrlenW (lpString=".zip") returned 4
	[0078.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.232] lstrlenW (lpString=".rar") returned 4
	[0078.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.232] lstrlenW (lpString=".bz2") returned 4
	[0078.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.232] lstrlenW (lpString=".7z") returned 3
	[0078.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.232] lstrlenW (lpString=".dbf") returned 4
	[0078.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.232] lstrlenW (lpString=".1cd") returned 4
	[0078.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.232] lstrlenW (lpString=".jpg") returned 4
	[0078.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.232] lstrlenW (lpString=".doc") returned 4
	[0078.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.232] lstrlenW (lpString=".docx") returned 5
	[0078.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.233] lstrlenW (lpString=".pdf") returned 4
	[0078.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.233] lstrlenW (lpString=".xls") returned 4
	[0078.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.233] lstrlenW (lpString=".xlsx") returned 5
	[0078.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.233] lstrlenW (lpString=".ppt") returned 4
	[0078.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.233] lstrlenW (lpString=".zip") returned 4
	[0078.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.233] lstrlenW (lpString=".rar") returned 4
	[0078.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.233] lstrlenW (lpString=".bz2") returned 4
	[0078.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.233] lstrlenW (lpString=".7z") returned 3
	[0078.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.233] lstrlenW (lpString=".dbf") returned 4
	[0078.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.233] lstrlenW (lpString=".1cd") returned 4
	[0078.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0078.233] lstrlenW (lpString=".jpg") returned 4
	[0078.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.234] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.234] lstrlenW (lpString="FD00361_.WMF") returned 12
	[0078.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.234] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=4074) returned 1
	[0078.234] CloseHandle (hObject=0x344) returned 1
	[0078.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220
	[0078.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.234] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.234] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0078.235] GetLastError () returned 0x0
	[0078.235] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xfea, lpOverlapped=0x0) returned 1
	[0078.236] WriteFile (in: hFile=0x370, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xff0, lpOverlapped=0x0) returned 1
	[0078.237] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.237] WriteFile (in: hFile=0x370, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.238] SetEndOfFile (hFile=0x370) returned 1
	[0078.238] CloseHandle (hObject=0x370) returned 1
	[0078.238] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.238] SetEndOfFile (hFile=0x344) returned 1
	[0078.239] CloseHandle (hObject=0x344) returned 1
	[0078.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1
	[0078.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.240] lstrlenW (lpString=".doc") returned 4
	[0078.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.240] lstrlenW (lpString=".docx") returned 5
	[0078.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.240] lstrlenW (lpString=".pdf") returned 4
	[0078.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.240] lstrlenW (lpString=".xls") returned 4
	[0078.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.240] lstrlenW (lpString=".xlsx") returned 5
	[0078.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.240] lstrlenW (lpString=".ppt") returned 4
	[0078.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.240] lstrlenW (lpString=".zip") returned 4
	[0078.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.240] lstrlenW (lpString=".rar") returned 4
	[0078.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.240] lstrlenW (lpString=".bz2") returned 4
	[0078.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.240] lstrlenW (lpString=".7z") returned 3
	[0078.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.240] lstrlenW (lpString=".dbf") returned 4
	[0078.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.240] lstrlenW (lpString=".1cd") returned 4
	[0078.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.241] lstrlenW (lpString=".jpg") returned 4
	[0078.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.241] lstrlenW (lpString=".doc") returned 4
	[0078.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.241] lstrlenW (lpString=".docx") returned 5
	[0078.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.241] lstrlenW (lpString=".pdf") returned 4
	[0078.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.241] lstrlenW (lpString=".xls") returned 4
	[0078.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.241] lstrlenW (lpString=".xlsx") returned 5
	[0078.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.241] lstrlenW (lpString=".ppt") returned 4
	[0078.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.241] lstrlenW (lpString=".zip") returned 4
	[0078.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.241] lstrlenW (lpString=".rar") returned 4
	[0078.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.241] lstrlenW (lpString=".bz2") returned 4
	[0078.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.241] lstrlenW (lpString=".7z") returned 3
	[0078.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.242] lstrlenW (lpString=".dbf") returned 4
	[0078.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.242] lstrlenW (lpString=".1cd") returned 4
	[0078.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0078.242] lstrlenW (lpString=".jpg") returned 4
	[0078.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.242] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.242] lstrlenW (lpString="FD00369_.WMF") returned 12
	[0078.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.242] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=8552) returned 1
	[0078.242] CloseHandle (hObject=0x344) returned 1
	[0078.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220
	[0078.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.243] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.243] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0078.243] GetLastError () returned 0x0
	[0078.243] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2168, lpOverlapped=0x0) returned 1
	[0078.245] WriteFile (in: hFile=0x370, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2170, lpOverlapped=0x0) returned 1
	[0078.246] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.246] WriteFile (in: hFile=0x370, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.246] SetEndOfFile (hFile=0x370) returned 1
	[0078.246] CloseHandle (hObject=0x370) returned 1
	[0078.246] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.246] SetEndOfFile (hFile=0x344) returned 1
	[0078.247] CloseHandle (hObject=0x344) returned 1
	[0078.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1
	[0078.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.248] lstrlenW (lpString=".doc") returned 4
	[0078.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.248] lstrlenW (lpString=".docx") returned 5
	[0078.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.248] lstrlenW (lpString=".pdf") returned 4
	[0078.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.248] lstrlenW (lpString=".xls") returned 4
	[0078.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.248] lstrlenW (lpString=".xlsx") returned 5
	[0078.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.248] lstrlenW (lpString=".ppt") returned 4
	[0078.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.248] lstrlenW (lpString=".zip") returned 4
	[0078.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.248] lstrlenW (lpString=".rar") returned 4
	[0078.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.248] lstrlenW (lpString=".bz2") returned 4
	[0078.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.248] lstrlenW (lpString=".7z") returned 3
	[0078.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.248] lstrlenW (lpString=".dbf") returned 4
	[0078.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.249] lstrlenW (lpString=".1cd") returned 4
	[0078.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.249] lstrlenW (lpString=".jpg") returned 4
	[0078.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.249] lstrlenW (lpString=".doc") returned 4
	[0078.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.249] lstrlenW (lpString=".docx") returned 5
	[0078.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.249] lstrlenW (lpString=".pdf") returned 4
	[0078.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.249] lstrlenW (lpString=".xls") returned 4
	[0078.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.249] lstrlenW (lpString=".xlsx") returned 5
	[0078.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.249] lstrlenW (lpString=".ppt") returned 4
	[0078.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.249] lstrlenW (lpString=".zip") returned 4
	[0078.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.249] lstrlenW (lpString=".rar") returned 4
	[0078.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.249] lstrlenW (lpString=".bz2") returned 4
	[0078.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.250] lstrlenW (lpString=".7z") returned 3
	[0078.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.250] lstrlenW (lpString=".dbf") returned 4
	[0078.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.250] lstrlenW (lpString=".1cd") returned 4
	[0078.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0078.250] lstrlenW (lpString=".jpg") returned 4
	[0078.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.250] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.250] lstrlenW (lpString="FD00382_.WMF") returned 12
	[0078.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.251] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=8424) returned 1
	[0078.251] CloseHandle (hObject=0x344) returned 1
	[0078.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220
	[0078.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.251] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.251] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0078.251] GetLastError () returned 0x0
	[0078.252] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x20e8, lpOverlapped=0x0) returned 1
	[0078.253] WriteFile (in: hFile=0x370, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x20f0, lpOverlapped=0x0) returned 1
	[0078.255] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.255] WriteFile (in: hFile=0x370, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.255] SetEndOfFile (hFile=0x370) returned 1
	[0078.255] CloseHandle (hObject=0x370) returned 1
	[0078.255] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.255] SetEndOfFile (hFile=0x344) returned 1
	[0078.256] CloseHandle (hObject=0x344) returned 1
	[0078.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1
	[0078.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.257] lstrlenW (lpString=".doc") returned 4
	[0078.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.257] lstrlenW (lpString=".docx") returned 5
	[0078.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.257] lstrlenW (lpString=".pdf") returned 4
	[0078.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.257] lstrlenW (lpString=".xls") returned 4
	[0078.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.257] lstrlenW (lpString=".xlsx") returned 5
	[0078.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.257] lstrlenW (lpString=".ppt") returned 4
	[0078.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.257] lstrlenW (lpString=".zip") returned 4
	[0078.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.257] lstrlenW (lpString=".rar") returned 4
	[0078.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.257] lstrlenW (lpString=".bz2") returned 4
	[0078.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.257] lstrlenW (lpString=".7z") returned 3
	[0078.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.258] lstrlenW (lpString=".dbf") returned 4
	[0078.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.258] lstrlenW (lpString=".1cd") returned 4
	[0078.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.258] lstrlenW (lpString=".jpg") returned 4
	[0078.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.258] lstrlenW (lpString=".doc") returned 4
	[0078.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.258] lstrlenW (lpString=".docx") returned 5
	[0078.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.258] lstrlenW (lpString=".pdf") returned 4
	[0078.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.258] lstrlenW (lpString=".xls") returned 4
	[0078.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.258] lstrlenW (lpString=".xlsx") returned 5
	[0078.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.258] lstrlenW (lpString=".ppt") returned 4
	[0078.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.259] lstrlenW (lpString=".zip") returned 4
	[0078.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.259] lstrlenW (lpString=".rar") returned 4
	[0078.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.259] lstrlenW (lpString=".bz2") returned 4
	[0078.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.259] lstrlenW (lpString=".7z") returned 3
	[0078.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.259] lstrlenW (lpString=".dbf") returned 4
	[0078.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.259] lstrlenW (lpString=".1cd") returned 4
	[0078.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0078.259] lstrlenW (lpString=".jpg") returned 4
	[0078.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.259] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.259] lstrlenW (lpString="FD00397_.WMF") returned 12
	[0078.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.260] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=10816) returned 1
	[0078.260] CloseHandle (hObject=0x344) returned 1
	[0078.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220
	[0078.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.260] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.260] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0078.261] GetLastError () returned 0x0
	[0078.261] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2a40, lpOverlapped=0x0) returned 1
	[0078.591] WriteFile (in: hFile=0x370, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2a50, lpOverlapped=0x0) returned 1
	[0078.592] ReadFile (in: hFile=0x344, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.592] WriteFile (in: hFile=0x370, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.593] SetEndOfFile (hFile=0x370) returned 1
	[0080.034] CloseHandle (hObject=0x370) returned 1
	[0080.041] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.042] SetEndOfFile (hFile=0x344) returned 1
	[0080.042] CloseHandle (hObject=0x344) returned 1
	[0080.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1
	[0080.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.061] lstrlenW (lpString=".doc") returned 4
	[0080.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.074] lstrlenW (lpString=".docx") returned 5
	[0080.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.074] lstrlenW (lpString=".pdf") returned 4
	[0080.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.074] lstrlenW (lpString=".xls") returned 4
	[0080.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.074] lstrlenW (lpString=".xlsx") returned 5
	[0080.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.074] lstrlenW (lpString=".ppt") returned 4
	[0080.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.075] lstrlenW (lpString=".zip") returned 4
	[0080.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.075] lstrlenW (lpString=".rar") returned 4
	[0080.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.075] lstrlenW (lpString=".bz2") returned 4
	[0080.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.075] lstrlenW (lpString=".7z") returned 3
	[0080.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.075] lstrlenW (lpString=".dbf") returned 4
	[0080.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.075] lstrlenW (lpString=".1cd") returned 4
	[0080.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.075] lstrlenW (lpString=".jpg") returned 4
	[0080.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.075] lstrlenW (lpString=".doc") returned 4
	[0080.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.075] lstrlenW (lpString=".docx") returned 5
	[0080.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.075] lstrlenW (lpString=".pdf") returned 4
	[0080.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.075] lstrlenW (lpString=".xls") returned 4
	[0080.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.075] lstrlenW (lpString=".xlsx") returned 5
	[0080.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.076] lstrlenW (lpString=".ppt") returned 4
	[0080.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.076] lstrlenW (lpString=".zip") returned 4
	[0080.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.076] lstrlenW (lpString=".rar") returned 4
	[0080.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.076] lstrlenW (lpString=".bz2") returned 4
	[0080.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.076] lstrlenW (lpString=".7z") returned 3
	[0080.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.076] lstrlenW (lpString=".dbf") returned 4
	[0080.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.076] lstrlenW (lpString=".1cd") returned 4
	[0080.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0080.076] lstrlenW (lpString=".jpg") returned 4
	[0080.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.076] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.076] lstrlenW (lpString="FD00814_.WMF") returned 12
	[0080.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0080.077] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=42704) returned 1
	[0080.077] CloseHandle (hObject=0x33c) returned 1
	[0080.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220
	[0080.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0080.078] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.078] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0080.078] GetLastError () returned 0x0
	[0080.078] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xa6d0, lpOverlapped=0x0) returned 1
	[0080.080] WriteFile (in: hFile=0x374, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xa6e0, lpOverlapped=0x0) returned 1
	[0080.082] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.082] WriteFile (in: hFile=0x374, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.082] SetEndOfFile (hFile=0x374) returned 1
	[0080.082] CloseHandle (hObject=0x374) returned 1
	[0080.082] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.082] SetEndOfFile (hFile=0x33c) returned 1
	[0080.084] CloseHandle (hObject=0x33c) returned 1
	[0080.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1
	[0080.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.084] lstrlenW (lpString=".doc") returned 4
	[0080.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.084] lstrlenW (lpString=".docx") returned 5
	[0080.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.084] lstrlenW (lpString=".pdf") returned 4
	[0080.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.084] lstrlenW (lpString=".xls") returned 4
	[0080.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.084] lstrlenW (lpString=".xlsx") returned 5
	[0080.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.084] lstrlenW (lpString=".ppt") returned 4
	[0080.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.084] lstrlenW (lpString=".zip") returned 4
	[0080.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.085] lstrlenW (lpString=".rar") returned 4
	[0080.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.085] lstrlenW (lpString=".bz2") returned 4
	[0080.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.085] lstrlenW (lpString=".7z") returned 3
	[0080.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.085] lstrlenW (lpString=".dbf") returned 4
	[0080.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.085] lstrlenW (lpString=".1cd") returned 4
	[0080.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.085] lstrlenW (lpString=".jpg") returned 4
	[0080.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.085] lstrlenW (lpString=".doc") returned 4
	[0080.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.085] lstrlenW (lpString=".docx") returned 5
	[0080.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.085] lstrlenW (lpString=".pdf") returned 4
	[0080.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.085] lstrlenW (lpString=".xls") returned 4
	[0080.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.085] lstrlenW (lpString=".xlsx") returned 5
	[0080.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.085] lstrlenW (lpString=".ppt") returned 4
	[0080.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.086] lstrlenW (lpString=".zip") returned 4
	[0080.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.086] lstrlenW (lpString=".rar") returned 4
	[0080.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.086] lstrlenW (lpString=".bz2") returned 4
	[0080.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.086] lstrlenW (lpString=".7z") returned 3
	[0080.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.086] lstrlenW (lpString=".dbf") returned 4
	[0080.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.086] lstrlenW (lpString=".1cd") returned 4
	[0080.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0080.086] lstrlenW (lpString=".jpg") returned 4
	[0080.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.086] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.086] lstrlenW (lpString="FD00965_.WMF") returned 12
	[0080.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0080.087] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=15164) returned 1
	[0080.087] CloseHandle (hObject=0x33c) returned 1
	[0080.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220
	[0080.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0080.087] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.087] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0080.087] GetLastError () returned 0x0
	[0080.087] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x3b3c, lpOverlapped=0x0) returned 1
	[0080.089] WriteFile (in: hFile=0x374, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x3b40, lpOverlapped=0x0) returned 1
	[0080.090] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.090] WriteFile (in: hFile=0x374, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.090] SetEndOfFile (hFile=0x374) returned 1
	[0080.090] CloseHandle (hObject=0x374) returned 1
	[0080.090] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.090] SetEndOfFile (hFile=0x33c) returned 1
	[0080.091] CloseHandle (hObject=0x33c) returned 1
	[0080.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1
	[0080.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.092] lstrlenW (lpString=".doc") returned 4
	[0080.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.092] lstrlenW (lpString=".docx") returned 5
	[0080.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.092] lstrlenW (lpString=".pdf") returned 4
	[0080.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.092] lstrlenW (lpString=".xls") returned 4
	[0080.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.092] lstrlenW (lpString=".xlsx") returned 5
	[0080.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.092] lstrlenW (lpString=".ppt") returned 4
	[0080.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.092] lstrlenW (lpString=".zip") returned 4
	[0080.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.092] lstrlenW (lpString=".rar") returned 4
	[0080.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.092] lstrlenW (lpString=".bz2") returned 4
	[0080.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.092] lstrlenW (lpString=".7z") returned 3
	[0080.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.093] lstrlenW (lpString=".dbf") returned 4
	[0080.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.093] lstrlenW (lpString=".1cd") returned 4
	[0080.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.093] lstrlenW (lpString=".jpg") returned 4
	[0080.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.093] lstrlenW (lpString=".doc") returned 4
	[0080.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.093] lstrlenW (lpString=".docx") returned 5
	[0080.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.093] lstrlenW (lpString=".pdf") returned 4
	[0080.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.093] lstrlenW (lpString=".xls") returned 4
	[0080.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.093] lstrlenW (lpString=".xlsx") returned 5
	[0080.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.093] lstrlenW (lpString=".ppt") returned 4
	[0080.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.093] lstrlenW (lpString=".zip") returned 4
	[0080.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.093] lstrlenW (lpString=".rar") returned 4
	[0080.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.094] lstrlenW (lpString=".bz2") returned 4
	[0080.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.094] lstrlenW (lpString=".7z") returned 3
	[0080.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.094] lstrlenW (lpString=".dbf") returned 4
	[0080.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.094] lstrlenW (lpString=".1cd") returned 4
	[0080.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0080.094] lstrlenW (lpString=".jpg") returned 4
	[0080.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.094] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.094] lstrlenW (lpString="FD01074_.WMF") returned 12
	[0080.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0080.094] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=4634) returned 1
	[0080.094] CloseHandle (hObject=0x33c) returned 1
	[0080.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220
	[0080.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0080.095] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.095] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0080.095] GetLastError () returned 0x0
	[0080.095] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x121a, lpOverlapped=0x0) returned 1
	[0080.097] WriteFile (in: hFile=0x374, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1220, lpOverlapped=0x0) returned 1
	[0080.119] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.119] WriteFile (in: hFile=0x374, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.119] SetEndOfFile (hFile=0x374) returned 1
	[0080.120] CloseHandle (hObject=0x374) returned 1
	[0080.120] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.120] SetEndOfFile (hFile=0x33c) returned 1
	[0080.121] CloseHandle (hObject=0x33c) returned 1
	[0080.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1
	[0080.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.121] lstrlenW (lpString=".doc") returned 4
	[0080.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.121] lstrlenW (lpString=".docx") returned 5
	[0080.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.121] lstrlenW (lpString=".pdf") returned 4
	[0080.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.122] lstrlenW (lpString=".xls") returned 4
	[0080.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.122] lstrlenW (lpString=".xlsx") returned 5
	[0080.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.122] lstrlenW (lpString=".ppt") returned 4
	[0080.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.122] lstrlenW (lpString=".zip") returned 4
	[0080.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.122] lstrlenW (lpString=".rar") returned 4
	[0080.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.122] lstrlenW (lpString=".bz2") returned 4
	[0080.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.122] lstrlenW (lpString=".7z") returned 3
	[0080.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.122] lstrlenW (lpString=".dbf") returned 4
	[0080.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.122] lstrlenW (lpString=".1cd") returned 4
	[0080.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.122] lstrlenW (lpString=".jpg") returned 4
	[0080.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.122] lstrlenW (lpString=".doc") returned 4
	[0080.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.123] lstrlenW (lpString=".docx") returned 5
	[0080.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.123] lstrlenW (lpString=".pdf") returned 4
	[0080.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.123] lstrlenW (lpString=".xls") returned 4
	[0080.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.123] lstrlenW (lpString=".xlsx") returned 5
	[0080.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.123] lstrlenW (lpString=".ppt") returned 4
	[0080.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.123] lstrlenW (lpString=".zip") returned 4
	[0080.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.123] lstrlenW (lpString=".rar") returned 4
	[0080.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.123] lstrlenW (lpString=".bz2") returned 4
	[0080.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.123] lstrlenW (lpString=".7z") returned 3
	[0080.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.123] lstrlenW (lpString=".dbf") returned 4
	[0080.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.123] lstrlenW (lpString=".1cd") returned 4
	[0080.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0080.123] lstrlenW (lpString=".jpg") returned 4
	[0080.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.124] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.124] lstrlenW (lpString="FD01084_.WMF") returned 12
	[0080.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0080.124] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2412) returned 1
	[0080.124] CloseHandle (hObject=0x33c) returned 1
	[0080.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220
	[0080.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0080.125] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.125] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0080.125] GetLastError () returned 0x0
	[0080.125] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x96c, lpOverlapped=0x0) returned 1
	[0080.594] WriteFile (in: hFile=0x374, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x970, lpOverlapped=0x0) returned 1
	[0080.595] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.595] WriteFile (in: hFile=0x374, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.595] SetEndOfFile (hFile=0x374) returned 1
	[0081.304] CloseHandle (hObject=0x374) returned 1
	[0081.337] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.337] SetEndOfFile (hFile=0x33c) returned 1
	[0081.338] CloseHandle (hObject=0x33c) returned 1
	[0081.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1
	[0081.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.338] lstrlenW (lpString=".doc") returned 4
	[0081.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.338] lstrlenW (lpString=".docx") returned 5
	[0081.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.338] lstrlenW (lpString=".pdf") returned 4
	[0081.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.338] lstrlenW (lpString=".xls") returned 4
	[0081.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.338] lstrlenW (lpString=".xlsx") returned 5
	[0081.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.339] lstrlenW (lpString=".ppt") returned 4
	[0081.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.339] lstrlenW (lpString=".zip") returned 4
	[0081.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.339] lstrlenW (lpString=".rar") returned 4
	[0081.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.339] lstrlenW (lpString=".bz2") returned 4
	[0081.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.339] lstrlenW (lpString=".7z") returned 3
	[0081.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.339] lstrlenW (lpString=".dbf") returned 4
	[0081.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.339] lstrlenW (lpString=".1cd") returned 4
	[0081.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.339] lstrlenW (lpString=".jpg") returned 4
	[0081.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.339] lstrlenW (lpString=".doc") returned 4
	[0081.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.339] lstrlenW (lpString=".docx") returned 5
	[0081.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.340] lstrlenW (lpString=".pdf") returned 4
	[0081.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.340] lstrlenW (lpString=".xls") returned 4
	[0081.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.340] lstrlenW (lpString=".xlsx") returned 5
	[0081.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.340] lstrlenW (lpString=".ppt") returned 4
	[0081.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.340] lstrlenW (lpString=".zip") returned 4
	[0081.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.340] lstrlenW (lpString=".rar") returned 4
	[0081.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.340] lstrlenW (lpString=".bz2") returned 4
	[0081.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.340] lstrlenW (lpString=".7z") returned 3
	[0081.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.340] lstrlenW (lpString=".dbf") returned 4
	[0081.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.340] lstrlenW (lpString=".1cd") returned 4
	[0081.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0081.340] lstrlenW (lpString=".jpg") returned 4
	[0081.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.341] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.341] lstrlenW (lpString="FD01658_.WMF") returned 12
	[0081.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.341] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=17924) returned 1
	[0081.341] CloseHandle (hObject=0x33c) returned 1
	[0081.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220
	[0081.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.342] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.342] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0081.342] GetLastError () returned 0x0
	[0081.342] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4604, lpOverlapped=0x0) returned 1
	[0081.344] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4610, lpOverlapped=0x0) returned 1
	[0081.345] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.345] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.345] SetEndOfFile (hFile=0x344) returned 1
	[0081.345] CloseHandle (hObject=0x344) returned 1
	[0081.345] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.345] SetEndOfFile (hFile=0x33c) returned 1
	[0081.346] CloseHandle (hObject=0x33c) returned 1
	[0081.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1
	[0081.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.347] lstrlenW (lpString=".doc") returned 4
	[0081.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.347] lstrlenW (lpString=".docx") returned 5
	[0081.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.347] lstrlenW (lpString=".pdf") returned 4
	[0081.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.347] lstrlenW (lpString=".xls") returned 4
	[0081.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.347] lstrlenW (lpString=".xlsx") returned 5
	[0081.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.347] lstrlenW (lpString=".ppt") returned 4
	[0081.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.347] lstrlenW (lpString=".zip") returned 4
	[0081.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.347] lstrlenW (lpString=".rar") returned 4
	[0081.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.347] lstrlenW (lpString=".bz2") returned 4
	[0081.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.347] lstrlenW (lpString=".7z") returned 3
	[0081.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.347] lstrlenW (lpString=".dbf") returned 4
	[0081.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.348] lstrlenW (lpString=".1cd") returned 4
	[0081.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.348] lstrlenW (lpString=".jpg") returned 4
	[0081.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.348] lstrlenW (lpString=".doc") returned 4
	[0081.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.348] lstrlenW (lpString=".docx") returned 5
	[0081.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.349] lstrlenW (lpString=".pdf") returned 4
	[0081.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.349] lstrlenW (lpString=".xls") returned 4
	[0081.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.349] lstrlenW (lpString=".xlsx") returned 5
	[0081.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.349] lstrlenW (lpString=".ppt") returned 4
	[0081.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.349] lstrlenW (lpString=".zip") returned 4
	[0081.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.349] lstrlenW (lpString=".rar") returned 4
	[0081.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.349] lstrlenW (lpString=".bz2") returned 4
	[0081.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.349] lstrlenW (lpString=".7z") returned 3
	[0081.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.349] lstrlenW (lpString=".dbf") returned 4
	[0081.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.349] lstrlenW (lpString=".1cd") returned 4
	[0081.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0081.349] lstrlenW (lpString=".jpg") returned 4
	[0081.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.350] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.350] lstrlenW (lpString="FD01659_.WMF") returned 12
	[0081.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.350] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=31180) returned 1
	[0081.350] CloseHandle (hObject=0x33c) returned 1
	[0081.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220
	[0081.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.351] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.351] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0081.351] GetLastError () returned 0x0
	[0081.351] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x79cc, lpOverlapped=0x0) returned 1
	[0081.353] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x79d0, lpOverlapped=0x0) returned 1
	[0081.355] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.355] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.355] SetEndOfFile (hFile=0x344) returned 1
	[0081.355] CloseHandle (hObject=0x344) returned 1
	[0081.355] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.355] SetEndOfFile (hFile=0x33c) returned 1
	[0081.356] CloseHandle (hObject=0x33c) returned 1
	[0081.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1
	[0081.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.357] lstrlenW (lpString=".doc") returned 4
	[0081.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.357] lstrlenW (lpString=".docx") returned 5
	[0081.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.357] lstrlenW (lpString=".pdf") returned 4
	[0081.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.357] lstrlenW (lpString=".xls") returned 4
	[0081.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.357] lstrlenW (lpString=".xlsx") returned 5
	[0081.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.357] lstrlenW (lpString=".ppt") returned 4
	[0081.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.357] lstrlenW (lpString=".zip") returned 4
	[0081.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.357] lstrlenW (lpString=".rar") returned 4
	[0081.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.357] lstrlenW (lpString=".bz2") returned 4
	[0081.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.357] lstrlenW (lpString=".7z") returned 3
	[0081.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.357] lstrlenW (lpString=".dbf") returned 4
	[0081.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.358] lstrlenW (lpString=".1cd") returned 4
	[0081.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.358] lstrlenW (lpString=".jpg") returned 4
	[0081.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.358] lstrlenW (lpString=".doc") returned 4
	[0081.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.358] lstrlenW (lpString=".docx") returned 5
	[0081.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.358] lstrlenW (lpString=".pdf") returned 4
	[0081.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.358] lstrlenW (lpString=".xls") returned 4
	[0081.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.358] lstrlenW (lpString=".xlsx") returned 5
	[0081.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.358] lstrlenW (lpString=".ppt") returned 4
	[0081.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.358] lstrlenW (lpString=".zip") returned 4
	[0081.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.358] lstrlenW (lpString=".rar") returned 4
	[0081.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.358] lstrlenW (lpString=".bz2") returned 4
	[0081.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.358] lstrlenW (lpString=".7z") returned 3
	[0081.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.359] lstrlenW (lpString=".dbf") returned 4
	[0081.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.359] lstrlenW (lpString=".1cd") returned 4
	[0081.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0081.359] lstrlenW (lpString=".jpg") returned 4
	[0081.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.359] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.359] lstrlenW (lpString="FD01660_.WMF") returned 12
	[0081.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.359] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=12958) returned 1
	[0081.359] CloseHandle (hObject=0x33c) returned 1
	[0081.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220
	[0081.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.360] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.360] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0081.360] GetLastError () returned 0x0
	[0081.360] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x329e, lpOverlapped=0x0) returned 1
	[0081.362] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x32a0, lpOverlapped=0x0) returned 1
	[0081.363] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.363] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.363] SetEndOfFile (hFile=0x344) returned 1
	[0081.363] CloseHandle (hObject=0x344) returned 1
	[0081.363] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.363] SetEndOfFile (hFile=0x33c) returned 1
	[0081.364] CloseHandle (hObject=0x33c) returned 1
	[0081.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1
	[0081.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.365] lstrlenW (lpString=".doc") returned 4
	[0081.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.365] lstrlenW (lpString=".docx") returned 5
	[0081.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.365] lstrlenW (lpString=".pdf") returned 4
	[0081.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.365] lstrlenW (lpString=".xls") returned 4
	[0081.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.365] lstrlenW (lpString=".xlsx") returned 5
	[0081.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.365] lstrlenW (lpString=".ppt") returned 4
	[0081.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.365] lstrlenW (lpString=".zip") returned 4
	[0081.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.366] lstrlenW (lpString=".rar") returned 4
	[0081.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.366] lstrlenW (lpString=".bz2") returned 4
	[0081.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.366] lstrlenW (lpString=".7z") returned 3
	[0081.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.366] lstrlenW (lpString=".dbf") returned 4
	[0081.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.366] lstrlenW (lpString=".1cd") returned 4
	[0081.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.366] lstrlenW (lpString=".jpg") returned 4
	[0081.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.366] lstrlenW (lpString=".doc") returned 4
	[0081.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.366] lstrlenW (lpString=".docx") returned 5
	[0081.366] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.366] lstrlenW (lpString=".pdf") returned 4
	[0081.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.367] lstrlenW (lpString=".xls") returned 4
	[0081.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.367] lstrlenW (lpString=".xlsx") returned 5
	[0081.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.367] lstrlenW (lpString=".ppt") returned 4
	[0081.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.367] lstrlenW (lpString=".zip") returned 4
	[0081.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.367] lstrlenW (lpString=".rar") returned 4
	[0081.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.367] lstrlenW (lpString=".bz2") returned 4
	[0081.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.367] lstrlenW (lpString=".7z") returned 3
	[0081.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.367] lstrlenW (lpString=".dbf") returned 4
	[0081.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.367] lstrlenW (lpString=".1cd") returned 4
	[0081.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0081.367] lstrlenW (lpString=".jpg") returned 4
	[0081.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.368] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.368] lstrlenW (lpString="FD02068_.WMF") returned 12
	[0081.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.368] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2488) returned 1
	[0081.368] CloseHandle (hObject=0x33c) returned 1
	[0081.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220
	[0081.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.368] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.368] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0081.369] GetLastError () returned 0x0
	[0081.369] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x9b8, lpOverlapped=0x0) returned 1
	[0081.370] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0081.371] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.371] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.371] SetEndOfFile (hFile=0x344) returned 1
	[0081.371] CloseHandle (hObject=0x344) returned 1
	[0081.371] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.371] SetEndOfFile (hFile=0x33c) returned 1
	[0081.372] CloseHandle (hObject=0x33c) returned 1
	[0081.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1
	[0081.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.373] lstrlenW (lpString=".doc") returned 4
	[0081.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.373] lstrlenW (lpString=".docx") returned 5
	[0081.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.373] lstrlenW (lpString=".pdf") returned 4
	[0081.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.373] lstrlenW (lpString=".xls") returned 4
	[0081.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.373] lstrlenW (lpString=".xlsx") returned 5
	[0081.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.373] lstrlenW (lpString=".ppt") returned 4
	[0081.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.373] lstrlenW (lpString=".zip") returned 4
	[0081.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.373] lstrlenW (lpString=".rar") returned 4
	[0081.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.373] lstrlenW (lpString=".bz2") returned 4
	[0081.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.373] lstrlenW (lpString=".7z") returned 3
	[0081.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.373] lstrlenW (lpString=".dbf") returned 4
	[0081.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.374] lstrlenW (lpString=".1cd") returned 4
	[0081.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.374] lstrlenW (lpString=".jpg") returned 4
	[0081.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.375] lstrlenW (lpString=".doc") returned 4
	[0081.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.375] lstrlenW (lpString=".docx") returned 5
	[0081.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.375] lstrlenW (lpString=".pdf") returned 4
	[0081.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.375] lstrlenW (lpString=".xls") returned 4
	[0081.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.375] lstrlenW (lpString=".xlsx") returned 5
	[0081.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.375] lstrlenW (lpString=".ppt") returned 4
	[0081.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.375] lstrlenW (lpString=".zip") returned 4
	[0081.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.375] lstrlenW (lpString=".rar") returned 4
	[0081.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.375] lstrlenW (lpString=".bz2") returned 4
	[0081.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.375] lstrlenW (lpString=".7z") returned 3
	[0081.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.375] lstrlenW (lpString=".dbf") returned 4
	[0081.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.376] lstrlenW (lpString=".1cd") returned 4
	[0081.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0081.376] lstrlenW (lpString=".jpg") returned 4
	[0081.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.376] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.376] lstrlenW (lpString="FD02071_.WMF") returned 12
	[0081.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.376] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2188) returned 1
	[0081.376] CloseHandle (hObject=0x33c) returned 1
	[0081.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220
	[0081.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.377] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.377] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0081.377] GetLastError () returned 0x0
	[0081.377] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x88c, lpOverlapped=0x0) returned 1
	[0081.693] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x890, lpOverlapped=0x0) returned 1
	[0081.884] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.884] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.884] SetEndOfFile (hFile=0x344) returned 1
	[0081.885] CloseHandle (hObject=0x344) returned 1
	[0081.885] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.885] SetEndOfFile (hFile=0x33c) returned 1
	[0081.886] CloseHandle (hObject=0x33c) returned 1
	[0081.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1
	[0081.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.886] lstrlenW (lpString=".doc") returned 4
	[0081.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.886] lstrlenW (lpString=".docx") returned 5
	[0081.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.886] lstrlenW (lpString=".pdf") returned 4
	[0081.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.886] lstrlenW (lpString=".xls") returned 4
	[0081.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.886] lstrlenW (lpString=".xlsx") returned 5
	[0081.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.886] lstrlenW (lpString=".ppt") returned 4
	[0081.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.887] lstrlenW (lpString=".zip") returned 4
	[0081.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.887] lstrlenW (lpString=".rar") returned 4
	[0081.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.887] lstrlenW (lpString=".bz2") returned 4
	[0081.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.887] lstrlenW (lpString=".7z") returned 3
	[0081.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.887] lstrlenW (lpString=".dbf") returned 4
	[0081.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.887] lstrlenW (lpString=".1cd") returned 4
	[0081.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.887] lstrlenW (lpString=".jpg") returned 4
	[0081.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.887] lstrlenW (lpString=".doc") returned 4
	[0081.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.887] lstrlenW (lpString=".docx") returned 5
	[0081.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.887] lstrlenW (lpString=".pdf") returned 4
	[0081.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.887] lstrlenW (lpString=".xls") returned 4
	[0081.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.888] lstrlenW (lpString=".xlsx") returned 5
	[0081.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.888] lstrlenW (lpString=".ppt") returned 4
	[0081.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.888] lstrlenW (lpString=".zip") returned 4
	[0081.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.888] lstrlenW (lpString=".rar") returned 4
	[0081.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.888] lstrlenW (lpString=".bz2") returned 4
	[0081.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.888] lstrlenW (lpString=".7z") returned 3
	[0081.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.888] lstrlenW (lpString=".dbf") returned 4
	[0081.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.888] lstrlenW (lpString=".1cd") returned 4
	[0081.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0081.888] lstrlenW (lpString=".jpg") returned 4
	[0081.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.888] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.888] lstrlenW (lpString="HH00443_.WMF") returned 12
	[0081.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.889] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3298) returned 1
	[0081.889] CloseHandle (hObject=0x33c) returned 1
	[0081.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220
	[0081.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.890] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.890] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0081.890] GetLastError () returned 0x0
	[0081.890] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xce2, lpOverlapped=0x0) returned 1
	[0081.891] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xcf0, lpOverlapped=0x0) returned 1
	[0081.892] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.892] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.893] SetEndOfFile (hFile=0x344) returned 1
	[0081.893] CloseHandle (hObject=0x344) returned 1
	[0081.893] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.893] SetEndOfFile (hFile=0x33c) returned 1
	[0081.894] CloseHandle (hObject=0x33c) returned 1
	[0081.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1
	[0081.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.894] lstrlenW (lpString=".doc") returned 4
	[0081.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.894] lstrlenW (lpString=".docx") returned 5
	[0081.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.894] lstrlenW (lpString=".pdf") returned 4
	[0081.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.895] lstrlenW (lpString=".xls") returned 4
	[0081.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.895] lstrlenW (lpString=".xlsx") returned 5
	[0081.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.895] lstrlenW (lpString=".ppt") returned 4
	[0081.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.895] lstrlenW (lpString=".zip") returned 4
	[0081.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.895] lstrlenW (lpString=".rar") returned 4
	[0081.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.895] lstrlenW (lpString=".bz2") returned 4
	[0081.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.895] lstrlenW (lpString=".7z") returned 3
	[0081.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.895] lstrlenW (lpString=".dbf") returned 4
	[0081.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.896] lstrlenW (lpString=".1cd") returned 4
	[0081.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.896] lstrlenW (lpString=".jpg") returned 4
	[0081.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.896] lstrlenW (lpString=".doc") returned 4
	[0081.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.896] lstrlenW (lpString=".docx") returned 5
	[0081.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.896] lstrlenW (lpString=".pdf") returned 4
	[0081.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.896] lstrlenW (lpString=".xls") returned 4
	[0081.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.896] lstrlenW (lpString=".xlsx") returned 5
	[0081.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.896] lstrlenW (lpString=".ppt") returned 4
	[0081.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.896] lstrlenW (lpString=".zip") returned 4
	[0081.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.897] lstrlenW (lpString=".rar") returned 4
	[0081.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.897] lstrlenW (lpString=".bz2") returned 4
	[0081.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.897] lstrlenW (lpString=".7z") returned 3
	[0081.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.897] lstrlenW (lpString=".dbf") returned 4
	[0081.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.897] lstrlenW (lpString=".1cd") returned 4
	[0081.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0081.897] lstrlenW (lpString=".jpg") returned 4
	[0081.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.897] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.897] lstrlenW (lpString="HH00513_.WMF") returned 12
	[0081.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.898] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=818) returned 1
	[0081.898] CloseHandle (hObject=0x33c) returned 1
	[0081.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220
	[0081.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.898] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.898] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0081.899] GetLastError () returned 0x0
	[0081.899] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x332, lpOverlapped=0x0) returned 1
	[0081.900] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x340, lpOverlapped=0x0) returned 1
	[0081.901] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.901] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.901] SetEndOfFile (hFile=0x344) returned 1
	[0081.901] CloseHandle (hObject=0x344) returned 1
	[0081.901] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.902] SetEndOfFile (hFile=0x33c) returned 1
	[0081.902] CloseHandle (hObject=0x33c) returned 1
	[0081.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1
	[0081.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.903] lstrlenW (lpString=".doc") returned 4
	[0081.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.903] lstrlenW (lpString=".docx") returned 5
	[0081.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.903] lstrlenW (lpString=".pdf") returned 4
	[0081.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.903] lstrlenW (lpString=".xls") returned 4
	[0081.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.903] lstrlenW (lpString=".xlsx") returned 5
	[0081.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.903] lstrlenW (lpString=".ppt") returned 4
	[0081.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.903] lstrlenW (lpString=".zip") returned 4
	[0081.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.904] lstrlenW (lpString=".rar") returned 4
	[0081.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.904] lstrlenW (lpString=".bz2") returned 4
	[0081.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.904] lstrlenW (lpString=".7z") returned 3
	[0081.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.904] lstrlenW (lpString=".dbf") returned 4
	[0081.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.904] lstrlenW (lpString=".1cd") returned 4
	[0081.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.904] lstrlenW (lpString=".jpg") returned 4
	[0081.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.904] lstrlenW (lpString=".doc") returned 4
	[0081.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.904] lstrlenW (lpString=".docx") returned 5
	[0081.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.904] lstrlenW (lpString=".pdf") returned 4
	[0081.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.904] lstrlenW (lpString=".xls") returned 4
	[0081.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.904] lstrlenW (lpString=".xlsx") returned 5
	[0081.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.905] lstrlenW (lpString=".ppt") returned 4
	[0081.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.905] lstrlenW (lpString=".zip") returned 4
	[0081.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.905] lstrlenW (lpString=".rar") returned 4
	[0081.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.905] lstrlenW (lpString=".bz2") returned 4
	[0081.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.905] lstrlenW (lpString=".7z") returned 3
	[0081.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.905] lstrlenW (lpString=".dbf") returned 4
	[0081.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.905] lstrlenW (lpString=".1cd") returned 4
	[0081.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0081.905] lstrlenW (lpString=".jpg") returned 4
	[0081.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.906] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.906] lstrlenW (lpString="HH00524_.WMF") returned 12
	[0081.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.906] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=14688) returned 1
	[0081.906] CloseHandle (hObject=0x33c) returned 1
	[0081.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220
	[0081.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0081.906] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.907] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0081.907] GetLastError () returned 0x0
	[0081.907] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x3960, lpOverlapped=0x0) returned 1
	[0081.908] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x3970, lpOverlapped=0x0) returned 1
	[0081.910] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.910] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.910] SetEndOfFile (hFile=0x344) returned 1
	[0081.910] CloseHandle (hObject=0x344) returned 1
	[0081.910] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.910] SetEndOfFile (hFile=0x33c) returned 1
	[0081.911] CloseHandle (hObject=0x33c) returned 1
	[0081.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1
	[0081.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.912] lstrlenW (lpString=".doc") returned 4
	[0081.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.912] lstrlenW (lpString=".docx") returned 5
	[0081.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.912] lstrlenW (lpString=".pdf") returned 4
	[0081.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.912] lstrlenW (lpString=".xls") returned 4
	[0081.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.912] lstrlenW (lpString=".xlsx") returned 5
	[0081.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.912] lstrlenW (lpString=".ppt") returned 4
	[0081.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.913] lstrlenW (lpString=".zip") returned 4
	[0081.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.913] lstrlenW (lpString=".rar") returned 4
	[0081.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.913] lstrlenW (lpString=".bz2") returned 4
	[0081.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.913] lstrlenW (lpString=".7z") returned 3
	[0081.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.913] lstrlenW (lpString=".dbf") returned 4
	[0081.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.913] lstrlenW (lpString=".1cd") returned 4
	[0081.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.913] lstrlenW (lpString=".jpg") returned 4
	[0081.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.914] lstrlenW (lpString=".doc") returned 4
	[0081.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.914] lstrlenW (lpString=".docx") returned 5
	[0081.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.914] lstrlenW (lpString=".pdf") returned 4
	[0081.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.914] lstrlenW (lpString=".xls") returned 4
	[0081.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.914] lstrlenW (lpString=".xlsx") returned 5
	[0081.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.914] lstrlenW (lpString=".ppt") returned 4
	[0081.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.914] lstrlenW (lpString=".zip") returned 4
	[0081.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.914] lstrlenW (lpString=".rar") returned 4
	[0081.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.915] lstrlenW (lpString=".bz2") returned 4
	[0081.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.915] lstrlenW (lpString=".7z") returned 3
	[0081.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.915] lstrlenW (lpString=".dbf") returned 4
	[0081.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.915] lstrlenW (lpString=".1cd") returned 4
	[0081.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0081.915] lstrlenW (lpString=".jpg") returned 4
	[0081.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.916] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.916] lstrlenW (lpString="HH00526_.WMF") returned 12
	[0081.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.646] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=13538) returned 1
	[0082.646] CloseHandle (hObject=0x33c) returned 1
	[0082.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220
	[0082.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.647] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.647] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0082.647] GetLastError () returned 0x0
	[0082.647] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x34e2, lpOverlapped=0x0) returned 1
	[0082.649] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x34f0, lpOverlapped=0x0) returned 1
	[0082.650] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.650] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0082.650] SetEndOfFile (hFile=0x344) returned 1
	[0082.650] CloseHandle (hObject=0x344) returned 1
	[0082.650] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.650] SetEndOfFile (hFile=0x33c) returned 1
	[0082.651] CloseHandle (hObject=0x33c) returned 1
	[0082.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0082.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1
	[0082.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.652] lstrlenW (lpString=".doc") returned 4
	[0082.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0082.652] lstrlenW (lpString=".docx") returned 5
	[0082.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0082.652] lstrlenW (lpString=".pdf") returned 4
	[0082.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0082.652] lstrlenW (lpString=".xls") returned 4
	[0082.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0082.652] lstrlenW (lpString=".xlsx") returned 5
	[0082.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0082.652] lstrlenW (lpString=".ppt") returned 4
	[0082.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0082.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.652] lstrlenW (lpString=".zip") returned 4
	[0082.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0082.653] lstrlenW (lpString=".rar") returned 4
	[0082.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0082.653] lstrlenW (lpString=".bz2") returned 4
	[0082.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0082.653] lstrlenW (lpString=".7z") returned 3
	[0082.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0082.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.653] lstrlenW (lpString=".dbf") returned 4
	[0082.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0082.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.653] lstrlenW (lpString=".1cd") returned 4
	[0082.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0082.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.653] lstrlenW (lpString=".jpg") returned 4
	[0082.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0082.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.653] lstrlenW (lpString=".doc") returned 4
	[0082.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0082.653] lstrlenW (lpString=".docx") returned 5
	[0082.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0082.653] lstrlenW (lpString=".pdf") returned 4
	[0082.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0082.653] lstrlenW (lpString=".xls") returned 4
	[0082.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0082.653] lstrlenW (lpString=".xlsx") returned 5
	[0082.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0082.654] lstrlenW (lpString=".ppt") returned 4
	[0082.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0082.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.654] lstrlenW (lpString=".zip") returned 4
	[0082.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0082.654] lstrlenW (lpString=".rar") returned 4
	[0082.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0082.654] lstrlenW (lpString=".bz2") returned 4
	[0082.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0082.654] lstrlenW (lpString=".7z") returned 3
	[0082.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0082.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.654] lstrlenW (lpString=".dbf") returned 4
	[0082.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0082.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.654] lstrlenW (lpString=".1cd") returned 4
	[0082.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0082.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0082.654] lstrlenW (lpString=".jpg") returned 4
	[0082.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0082.654] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0082.654] lstrlenW (lpString="HH00546_.WMF") returned 12
	[0082.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.655] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3718) returned 1
	[0082.655] CloseHandle (hObject=0x33c) returned 1
	[0082.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220
	[0082.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.655] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.655] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0082.655] GetLastError () returned 0x0
	[0082.656] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xe86, lpOverlapped=0x0) returned 1
	[0082.657] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xe90, lpOverlapped=0x0) returned 1
	[0082.658] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.658] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0082.658] SetEndOfFile (hFile=0x344) returned 1
	[0082.658] CloseHandle (hObject=0x344) returned 1
	[0082.658] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.658] SetEndOfFile (hFile=0x33c) returned 1
	[0082.659] CloseHandle (hObject=0x33c) returned 1
	[0082.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0082.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1
	[0082.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.660] lstrlenW (lpString=".doc") returned 4
	[0082.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0082.660] lstrlenW (lpString=".docx") returned 5
	[0082.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0082.660] lstrlenW (lpString=".pdf") returned 4
	[0082.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0082.660] lstrlenW (lpString=".xls") returned 4
	[0082.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0082.660] lstrlenW (lpString=".xlsx") returned 5
	[0082.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0082.660] lstrlenW (lpString=".ppt") returned 4
	[0082.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0082.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.660] lstrlenW (lpString=".zip") returned 4
	[0082.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0082.660] lstrlenW (lpString=".rar") returned 4
	[0082.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0082.660] lstrlenW (lpString=".bz2") returned 4
	[0082.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0082.661] lstrlenW (lpString=".7z") returned 3
	[0082.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0082.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.661] lstrlenW (lpString=".dbf") returned 4
	[0082.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0082.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.661] lstrlenW (lpString=".1cd") returned 4
	[0082.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0082.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.661] lstrlenW (lpString=".jpg") returned 4
	[0082.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0082.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.661] lstrlenW (lpString=".doc") returned 4
	[0082.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0082.661] lstrlenW (lpString=".docx") returned 5
	[0082.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0082.661] lstrlenW (lpString=".pdf") returned 4
	[0082.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0082.661] lstrlenW (lpString=".xls") returned 4
	[0082.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0082.661] lstrlenW (lpString=".xlsx") returned 5
	[0082.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0082.662] lstrlenW (lpString=".ppt") returned 4
	[0082.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0082.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.662] lstrlenW (lpString=".zip") returned 4
	[0082.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0082.662] lstrlenW (lpString=".rar") returned 4
	[0082.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0082.662] lstrlenW (lpString=".bz2") returned 4
	[0082.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0082.662] lstrlenW (lpString=".7z") returned 3
	[0082.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0082.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.662] lstrlenW (lpString=".dbf") returned 4
	[0082.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0082.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.662] lstrlenW (lpString=".1cd") returned 4
	[0082.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0082.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0082.662] lstrlenW (lpString=".jpg") returned 4
	[0082.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0082.663] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0082.663] lstrlenW (lpString="HH00601_.WMF") returned 12
	[0082.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.663] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1468) returned 1
	[0082.663] CloseHandle (hObject=0x33c) returned 1
	[0082.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220
	[0082.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.663] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.663] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0082.664] GetLastError () returned 0x0
	[0082.664] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x5bc, lpOverlapped=0x0) returned 1
	[0082.665] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0082.667] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.667] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0082.667] SetEndOfFile (hFile=0x344) returned 1
	[0082.667] CloseHandle (hObject=0x344) returned 1
	[0082.667] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.667] SetEndOfFile (hFile=0x33c) returned 1
	[0082.668] CloseHandle (hObject=0x33c) returned 1
	[0082.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0082.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1
	[0082.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.669] lstrlenW (lpString=".doc") returned 4
	[0082.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0082.669] lstrlenW (lpString=".docx") returned 5
	[0082.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0082.669] lstrlenW (lpString=".pdf") returned 4
	[0082.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0082.669] lstrlenW (lpString=".xls") returned 4
	[0082.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0082.669] lstrlenW (lpString=".xlsx") returned 5
	[0082.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0082.669] lstrlenW (lpString=".ppt") returned 4
	[0082.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0082.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.669] lstrlenW (lpString=".zip") returned 4
	[0082.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0082.669] lstrlenW (lpString=".rar") returned 4
	[0082.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0082.669] lstrlenW (lpString=".bz2") returned 4
	[0082.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0082.669] lstrlenW (lpString=".7z") returned 3
	[0082.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0082.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.670] lstrlenW (lpString=".dbf") returned 4
	[0082.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0082.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.670] lstrlenW (lpString=".1cd") returned 4
	[0082.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0082.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.670] lstrlenW (lpString=".jpg") returned 4
	[0082.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0082.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.670] lstrlenW (lpString=".doc") returned 4
	[0082.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0082.670] lstrlenW (lpString=".docx") returned 5
	[0082.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0082.670] lstrlenW (lpString=".pdf") returned 4
	[0082.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0082.670] lstrlenW (lpString=".xls") returned 4
	[0082.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0082.670] lstrlenW (lpString=".xlsx") returned 5
	[0082.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0082.670] lstrlenW (lpString=".ppt") returned 4
	[0082.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0082.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.671] lstrlenW (lpString=".zip") returned 4
	[0082.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0082.671] lstrlenW (lpString=".rar") returned 4
	[0082.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0082.671] lstrlenW (lpString=".bz2") returned 4
	[0082.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0082.671] lstrlenW (lpString=".7z") returned 3
	[0082.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0082.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.671] lstrlenW (lpString=".dbf") returned 4
	[0082.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0082.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.671] lstrlenW (lpString=".1cd") returned 4
	[0082.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0082.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0082.671] lstrlenW (lpString=".jpg") returned 4
	[0082.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0082.671] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0082.672] lstrlenW (lpString="HH00602_.WMF") returned 12
	[0082.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.672] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1400) returned 1
	[0082.672] CloseHandle (hObject=0x33c) returned 1
	[0082.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220
	[0082.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.672] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.672] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0082.673] GetLastError () returned 0x0
	[0082.673] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x578, lpOverlapped=0x0) returned 1
	[0082.674] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x580, lpOverlapped=0x0) returned 1
	[0082.675] ReadFile (in: hFile=0x33c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.675] WriteFile (in: hFile=0x344, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0082.675] SetEndOfFile (hFile=0x344) returned 1
	[0082.675] CloseHandle (hObject=0x344) returned 1
	[0082.675] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.675] SetEndOfFile (hFile=0x33c) returned 1
	[0082.676] CloseHandle (hObject=0x33c) returned 1
	[0082.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0082.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1
	[0082.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.677] lstrlenW (lpString=".doc") returned 4
	[0082.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0082.677] lstrlenW (lpString=".docx") returned 5
	[0082.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0082.677] lstrlenW (lpString=".pdf") returned 4
	[0082.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0082.677] lstrlenW (lpString=".xls") returned 4
	[0082.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0082.677] lstrlenW (lpString=".xlsx") returned 5
	[0082.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0082.677] lstrlenW (lpString=".ppt") returned 4
	[0082.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0082.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.677] lstrlenW (lpString=".zip") returned 4
	[0082.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0082.677] lstrlenW (lpString=".rar") returned 4
	[0082.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0082.677] lstrlenW (lpString=".bz2") returned 4
	[0082.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0082.678] lstrlenW (lpString=".7z") returned 3
	[0082.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0082.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.678] lstrlenW (lpString=".dbf") returned 4
	[0082.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0082.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.678] lstrlenW (lpString=".1cd") returned 4
	[0082.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0082.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.678] lstrlenW (lpString=".jpg") returned 4
	[0082.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0082.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.678] lstrlenW (lpString=".doc") returned 4
	[0082.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0082.678] lstrlenW (lpString=".docx") returned 5
	[0082.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0082.678] lstrlenW (lpString=".pdf") returned 4
	[0082.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0082.678] lstrlenW (lpString=".xls") returned 4
	[0082.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0082.678] lstrlenW (lpString=".xlsx") returned 5
	[0082.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0082.678] lstrlenW (lpString=".ppt") returned 4
	[0082.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0082.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.678] lstrlenW (lpString=".zip") returned 4
	[0082.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0082.679] lstrlenW (lpString=".rar") returned 4
	[0082.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0082.679] lstrlenW (lpString=".bz2") returned 4
	[0082.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0082.679] lstrlenW (lpString=".7z") returned 3
	[0082.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0082.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.679] lstrlenW (lpString=".dbf") returned 4
	[0082.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0082.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.679] lstrlenW (lpString=".1cd") returned 4
	[0082.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0082.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0082.679] lstrlenW (lpString=".jpg") returned 4
	[0082.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0082.679] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0082.679] lstrlenW (lpString="HH00612_.WMF") returned 12
	[0082.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.287] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=12632) returned 1
	[0083.287] CloseHandle (hObject=0x314) returned 1
	[0083.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220
	[0083.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.289] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.289] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.289] GetLastError () returned 0x0
	[0083.289] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x3158, lpOverlapped=0x0) returned 1
	[0083.291] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x3160, lpOverlapped=0x0) returned 1
	[0083.292] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.292] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.292] SetEndOfFile (hFile=0x2d4) returned 1
	[0083.293] CloseHandle (hObject=0x2d4) returned 1
	[0083.293] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.293] SetEndOfFile (hFile=0x314) returned 1
	[0083.294] CloseHandle (hObject=0x314) returned 1
	[0083.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1
	[0083.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.294] lstrlenW (lpString=".doc") returned 4
	[0083.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.294] lstrlenW (lpString=".docx") returned 5
	[0083.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.294] lstrlenW (lpString=".pdf") returned 4
	[0083.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.294] lstrlenW (lpString=".xls") returned 4
	[0083.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.294] lstrlenW (lpString=".xlsx") returned 5
	[0083.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.294] lstrlenW (lpString=".ppt") returned 4
	[0083.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.295] lstrlenW (lpString=".zip") returned 4
	[0083.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.295] lstrlenW (lpString=".rar") returned 4
	[0083.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.295] lstrlenW (lpString=".bz2") returned 4
	[0083.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.295] lstrlenW (lpString=".7z") returned 3
	[0083.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.295] lstrlenW (lpString=".dbf") returned 4
	[0083.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.295] lstrlenW (lpString=".1cd") returned 4
	[0083.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.295] lstrlenW (lpString=".jpg") returned 4
	[0083.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.295] lstrlenW (lpString=".doc") returned 4
	[0083.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.295] lstrlenW (lpString=".docx") returned 5
	[0083.295] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.295] lstrlenW (lpString=".pdf") returned 4
	[0083.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.295] lstrlenW (lpString=".xls") returned 4
	[0083.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.296] lstrlenW (lpString=".xlsx") returned 5
	[0083.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.296] lstrlenW (lpString=".ppt") returned 4
	[0083.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.296] lstrlenW (lpString=".zip") returned 4
	[0083.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.296] lstrlenW (lpString=".rar") returned 4
	[0083.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.296] lstrlenW (lpString=".bz2") returned 4
	[0083.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.296] lstrlenW (lpString=".7z") returned 3
	[0083.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.296] lstrlenW (lpString=".dbf") returned 4
	[0083.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.296] lstrlenW (lpString=".1cd") returned 4
	[0083.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0083.296] lstrlenW (lpString=".jpg") returned 4
	[0083.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.296] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.297] lstrlenW (lpString="HH00623_.WMF") returned 12
	[0083.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.297] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=10644) returned 1
	[0083.297] CloseHandle (hObject=0x314) returned 1
	[0083.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220
	[0083.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.297] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.297] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.298] GetLastError () returned 0x0
	[0083.298] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2994, lpOverlapped=0x0) returned 1
	[0083.299] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x29a0, lpOverlapped=0x0) returned 1
	[0083.300] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.300] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.300] SetEndOfFile (hFile=0x2d4) returned 1
	[0083.301] CloseHandle (hObject=0x2d4) returned 1
	[0083.301] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.301] SetEndOfFile (hFile=0x314) returned 1
	[0083.302] CloseHandle (hObject=0x314) returned 1
	[0083.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1
	[0083.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.303] lstrlenW (lpString=".doc") returned 4
	[0083.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.303] lstrlenW (lpString=".docx") returned 5
	[0083.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.303] lstrlenW (lpString=".pdf") returned 4
	[0083.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.303] lstrlenW (lpString=".xls") returned 4
	[0083.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.303] lstrlenW (lpString=".xlsx") returned 5
	[0083.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.303] lstrlenW (lpString=".ppt") returned 4
	[0083.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.303] lstrlenW (lpString=".zip") returned 4
	[0083.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.303] lstrlenW (lpString=".rar") returned 4
	[0083.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.303] lstrlenW (lpString=".bz2") returned 4
	[0083.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.303] lstrlenW (lpString=".7z") returned 3
	[0083.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.303] lstrlenW (lpString=".dbf") returned 4
	[0083.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.303] lstrlenW (lpString=".1cd") returned 4
	[0083.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.304] lstrlenW (lpString=".jpg") returned 4
	[0083.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.304] lstrlenW (lpString=".doc") returned 4
	[0083.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.304] lstrlenW (lpString=".docx") returned 5
	[0083.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.304] lstrlenW (lpString=".pdf") returned 4
	[0083.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.304] lstrlenW (lpString=".xls") returned 4
	[0083.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.304] lstrlenW (lpString=".xlsx") returned 5
	[0083.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.304] lstrlenW (lpString=".ppt") returned 4
	[0083.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.304] lstrlenW (lpString=".zip") returned 4
	[0083.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.304] lstrlenW (lpString=".rar") returned 4
	[0083.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.304] lstrlenW (lpString=".bz2") returned 4
	[0083.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.304] lstrlenW (lpString=".7z") returned 3
	[0083.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.305] lstrlenW (lpString=".dbf") returned 4
	[0083.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.305] lstrlenW (lpString=".1cd") returned 4
	[0083.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0083.305] lstrlenW (lpString=".jpg") returned 4
	[0083.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.305] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.305] lstrlenW (lpString="HH00625_.WMF") returned 12
	[0083.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.305] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2116) returned 1
	[0083.305] CloseHandle (hObject=0x314) returned 1
	[0083.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220
	[0083.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.306] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.306] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.306] GetLastError () returned 0x0
	[0083.306] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x844, lpOverlapped=0x0) returned 1
	[0083.308] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x850, lpOverlapped=0x0) returned 1
	[0083.308] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.309] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.309] SetEndOfFile (hFile=0x2d4) returned 1
	[0083.309] CloseHandle (hObject=0x2d4) returned 1
	[0083.309] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.309] SetEndOfFile (hFile=0x314) returned 1
	[0083.310] CloseHandle (hObject=0x314) returned 1
	[0083.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1
	[0083.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.310] lstrlenW (lpString=".doc") returned 4
	[0083.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.310] lstrlenW (lpString=".docx") returned 5
	[0083.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.310] lstrlenW (lpString=".pdf") returned 4
	[0083.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.311] lstrlenW (lpString=".xls") returned 4
	[0083.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.311] lstrlenW (lpString=".xlsx") returned 5
	[0083.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.311] lstrlenW (lpString=".ppt") returned 4
	[0083.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.311] lstrlenW (lpString=".zip") returned 4
	[0083.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.311] lstrlenW (lpString=".rar") returned 4
	[0083.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.311] lstrlenW (lpString=".bz2") returned 4
	[0083.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.311] lstrlenW (lpString=".7z") returned 3
	[0083.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.311] lstrlenW (lpString=".dbf") returned 4
	[0083.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.311] lstrlenW (lpString=".1cd") returned 4
	[0083.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.311] lstrlenW (lpString=".jpg") returned 4
	[0083.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.312] lstrlenW (lpString=".doc") returned 4
	[0083.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.312] lstrlenW (lpString=".docx") returned 5
	[0083.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.312] lstrlenW (lpString=".pdf") returned 4
	[0083.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.312] lstrlenW (lpString=".xls") returned 4
	[0083.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.312] lstrlenW (lpString=".xlsx") returned 5
	[0083.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.312] lstrlenW (lpString=".ppt") returned 4
	[0083.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.312] lstrlenW (lpString=".zip") returned 4
	[0083.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.312] lstrlenW (lpString=".rar") returned 4
	[0083.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.312] lstrlenW (lpString=".bz2") returned 4
	[0083.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.312] lstrlenW (lpString=".7z") returned 3
	[0083.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.312] lstrlenW (lpString=".dbf") returned 4
	[0083.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.312] lstrlenW (lpString=".1cd") returned 4
	[0083.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0083.313] lstrlenW (lpString=".jpg") returned 4
	[0083.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.313] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.313] lstrlenW (lpString="HH00636_.WMF") returned 12
	[0083.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.313] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1568) returned 1
	[0083.313] CloseHandle (hObject=0x314) returned 1
	[0083.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220
	[0083.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.313] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.314] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.314] GetLastError () returned 0x0
	[0083.314] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x620, lpOverlapped=0x0) returned 1
	[0083.315] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x630, lpOverlapped=0x0) returned 1
	[0083.316] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.316] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.316] SetEndOfFile (hFile=0x2d4) returned 1
	[0083.316] CloseHandle (hObject=0x2d4) returned 1
	[0083.317] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.317] SetEndOfFile (hFile=0x314) returned 1
	[0083.317] CloseHandle (hObject=0x314) returned 1
	[0083.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1
	[0083.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.318] lstrlenW (lpString=".doc") returned 4
	[0083.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.318] lstrlenW (lpString=".docx") returned 5
	[0083.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.318] lstrlenW (lpString=".pdf") returned 4
	[0083.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.318] lstrlenW (lpString=".xls") returned 4
	[0083.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.318] lstrlenW (lpString=".xlsx") returned 5
	[0083.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.318] lstrlenW (lpString=".ppt") returned 4
	[0083.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.318] lstrlenW (lpString=".zip") returned 4
	[0083.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.318] lstrlenW (lpString=".rar") returned 4
	[0083.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.318] lstrlenW (lpString=".bz2") returned 4
	[0083.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.319] lstrlenW (lpString=".7z") returned 3
	[0083.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.319] lstrlenW (lpString=".dbf") returned 4
	[0083.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.319] lstrlenW (lpString=".1cd") returned 4
	[0083.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.319] lstrlenW (lpString=".jpg") returned 4
	[0083.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.319] lstrlenW (lpString=".doc") returned 4
	[0083.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.319] lstrlenW (lpString=".docx") returned 5
	[0083.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.319] lstrlenW (lpString=".pdf") returned 4
	[0083.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.319] lstrlenW (lpString=".xls") returned 4
	[0083.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.319] lstrlenW (lpString=".xlsx") returned 5
	[0083.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.319] lstrlenW (lpString=".ppt") returned 4
	[0083.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.319] lstrlenW (lpString=".zip") returned 4
	[0083.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.320] lstrlenW (lpString=".rar") returned 4
	[0083.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.320] lstrlenW (lpString=".bz2") returned 4
	[0083.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.320] lstrlenW (lpString=".7z") returned 3
	[0083.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.320] lstrlenW (lpString=".dbf") returned 4
	[0083.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.320] lstrlenW (lpString=".1cd") returned 4
	[0083.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0083.320] lstrlenW (lpString=".jpg") returned 4
	[0083.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.320] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.320] lstrlenW (lpString="HH00669_.WMF") returned 12
	[0083.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.321] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=11490) returned 1
	[0083.321] CloseHandle (hObject=0x314) returned 1
	[0083.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220
	[0083.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.321] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.321] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.322] GetLastError () returned 0x0
	[0083.322] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2ce2, lpOverlapped=0x0) returned 1
	[0083.555] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2cf0, lpOverlapped=0x0) returned 1
	[0083.556] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.556] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.556] SetEndOfFile (hFile=0x2d4) returned 1
	[0083.557] CloseHandle (hObject=0x2d4) returned 1
	[0083.557] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.557] SetEndOfFile (hFile=0x314) returned 1
	[0083.558] CloseHandle (hObject=0x314) returned 1
	[0083.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1
	[0083.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.558] lstrlenW (lpString=".doc") returned 4
	[0083.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.558] lstrlenW (lpString=".docx") returned 5
	[0083.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.558] lstrlenW (lpString=".pdf") returned 4
	[0083.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.558] lstrlenW (lpString=".xls") returned 4
	[0083.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.558] lstrlenW (lpString=".xlsx") returned 5
	[0083.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.558] lstrlenW (lpString=".ppt") returned 4
	[0083.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.559] lstrlenW (lpString=".zip") returned 4
	[0083.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.559] lstrlenW (lpString=".rar") returned 4
	[0083.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.559] lstrlenW (lpString=".bz2") returned 4
	[0083.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.559] lstrlenW (lpString=".7z") returned 3
	[0083.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.559] lstrlenW (lpString=".dbf") returned 4
	[0083.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.559] lstrlenW (lpString=".1cd") returned 4
	[0083.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.559] lstrlenW (lpString=".jpg") returned 4
	[0083.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.559] lstrlenW (lpString=".doc") returned 4
	[0083.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.559] lstrlenW (lpString=".docx") returned 5
	[0083.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.559] lstrlenW (lpString=".pdf") returned 4
	[0083.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString=".xls") returned 4
	[0083.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.560] lstrlenW (lpString=".xlsx") returned 5
	[0083.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.560] lstrlenW (lpString=".ppt") returned 4
	[0083.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.560] lstrlenW (lpString=".zip") returned 4
	[0083.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.560] lstrlenW (lpString=".rar") returned 4
	[0083.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString=".bz2") returned 4
	[0083.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString=".7z") returned 3
	[0083.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.560] lstrlenW (lpString=".dbf") returned 4
	[0083.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.560] lstrlenW (lpString=".1cd") returned 4
	[0083.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0083.560] lstrlenW (lpString=".jpg") returned 4
	[0083.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.560] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.561] lstrlenW (lpString="HH01461_.WMF") returned 12
	[0083.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.561] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=5958) returned 1
	[0083.561] CloseHandle (hObject=0x314) returned 1
	[0083.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220
	[0083.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.561] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.562] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.562] GetLastError () returned 0x0
	[0083.562] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1746, lpOverlapped=0x0) returned 1
	[0083.564] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1750, lpOverlapped=0x0) returned 1
	[0083.565] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.565] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.565] SetEndOfFile (hFile=0x2d4) returned 1
	[0083.565] CloseHandle (hObject=0x2d4) returned 1
	[0083.565] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.565] SetEndOfFile (hFile=0x314) returned 1
	[0083.566] CloseHandle (hObject=0x314) returned 1
	[0083.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1
	[0083.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.567] lstrlenW (lpString=".doc") returned 4
	[0083.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.567] lstrlenW (lpString=".docx") returned 5
	[0083.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.567] lstrlenW (lpString=".pdf") returned 4
	[0083.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.567] lstrlenW (lpString=".xls") returned 4
	[0083.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.567] lstrlenW (lpString=".xlsx") returned 5
	[0083.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.567] lstrlenW (lpString=".ppt") returned 4
	[0083.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.567] lstrlenW (lpString=".zip") returned 4
	[0083.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.567] lstrlenW (lpString=".rar") returned 4
	[0083.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.567] lstrlenW (lpString=".bz2") returned 4
	[0083.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.567] lstrlenW (lpString=".7z") returned 3
	[0083.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.567] lstrlenW (lpString=".dbf") returned 4
	[0083.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.567] lstrlenW (lpString=".1cd") returned 4
	[0083.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.568] lstrlenW (lpString=".jpg") returned 4
	[0083.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.568] lstrlenW (lpString=".doc") returned 4
	[0083.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString=".docx") returned 5
	[0083.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.568] lstrlenW (lpString=".pdf") returned 4
	[0083.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString=".xls") returned 4
	[0083.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.568] lstrlenW (lpString=".xlsx") returned 5
	[0083.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.568] lstrlenW (lpString=".ppt") returned 4
	[0083.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.568] lstrlenW (lpString=".zip") returned 4
	[0083.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.568] lstrlenW (lpString=".rar") returned 4
	[0083.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString=".bz2") returned 4
	[0083.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString=".7z") returned 3
	[0083.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.569] lstrlenW (lpString=".dbf") returned 4
	[0083.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.569] lstrlenW (lpString=".1cd") returned 4
	[0083.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0083.569] lstrlenW (lpString=".jpg") returned 4
	[0083.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.569] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.569] lstrlenW (lpString="HH01618_.WMF") returned 12
	[0083.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.570] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=7296) returned 1
	[0083.570] CloseHandle (hObject=0x314) returned 1
	[0083.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220
	[0083.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.570] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.570] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.571] GetLastError () returned 0x0
	[0083.571] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1c80, lpOverlapped=0x0) returned 1
	[0083.572] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1c90, lpOverlapped=0x0) returned 1
	[0083.573] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.573] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.573] SetEndOfFile (hFile=0x2d4) returned 1
	[0083.573] CloseHandle (hObject=0x2d4) returned 1
	[0083.573] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.573] SetEndOfFile (hFile=0x314) returned 1
	[0083.574] CloseHandle (hObject=0x314) returned 1
	[0083.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1
	[0083.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.575] lstrlenW (lpString=".doc") returned 4
	[0083.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.575] lstrlenW (lpString=".docx") returned 5
	[0083.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.575] lstrlenW (lpString=".pdf") returned 4
	[0083.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.575] lstrlenW (lpString=".xls") returned 4
	[0083.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.575] lstrlenW (lpString=".xlsx") returned 5
	[0083.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.575] lstrlenW (lpString=".ppt") returned 4
	[0083.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.575] lstrlenW (lpString=".zip") returned 4
	[0083.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.575] lstrlenW (lpString=".rar") returned 4
	[0083.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.575] lstrlenW (lpString=".bz2") returned 4
	[0083.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.575] lstrlenW (lpString=".7z") returned 3
	[0083.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.576] lstrlenW (lpString=".dbf") returned 4
	[0083.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.576] lstrlenW (lpString=".1cd") returned 4
	[0083.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.576] lstrlenW (lpString=".jpg") returned 4
	[0083.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.576] lstrlenW (lpString=".doc") returned 4
	[0083.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.576] lstrlenW (lpString=".docx") returned 5
	[0083.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.576] lstrlenW (lpString=".pdf") returned 4
	[0083.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.576] lstrlenW (lpString=".xls") returned 4
	[0083.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.576] lstrlenW (lpString=".xlsx") returned 5
	[0083.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.576] lstrlenW (lpString=".ppt") returned 4
	[0083.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.576] lstrlenW (lpString=".zip") returned 4
	[0083.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.577] lstrlenW (lpString=".rar") returned 4
	[0083.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.577] lstrlenW (lpString=".bz2") returned 4
	[0083.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.577] lstrlenW (lpString=".7z") returned 3
	[0083.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.577] lstrlenW (lpString=".dbf") returned 4
	[0083.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.577] lstrlenW (lpString=".1cd") returned 4
	[0083.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0083.577] lstrlenW (lpString=".jpg") returned 4
	[0083.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.577] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.577] lstrlenW (lpString="HH01759_.WMF") returned 12
	[0083.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.578] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=5414) returned 1
	[0083.578] CloseHandle (hObject=0x314) returned 1
	[0083.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220
	[0083.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.578] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.578] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.583] GetLastError () returned 0x0
	[0083.583] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1526, lpOverlapped=0x0) returned 1
	[0083.584] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1530, lpOverlapped=0x0) returned 1
	[0083.585] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.585] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.585] SetEndOfFile (hFile=0x2d4) returned 1
	[0083.585] CloseHandle (hObject=0x2d4) returned 1
	[0083.585] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.585] SetEndOfFile (hFile=0x314) returned 1
	[0083.586] CloseHandle (hObject=0x314) returned 1
	[0083.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1
	[0083.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.587] lstrlenW (lpString=".doc") returned 4
	[0083.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.587] lstrlenW (lpString=".docx") returned 5
	[0083.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.587] lstrlenW (lpString=".pdf") returned 4
	[0083.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.587] lstrlenW (lpString=".xls") returned 4
	[0083.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.587] lstrlenW (lpString=".xlsx") returned 5
	[0083.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.587] lstrlenW (lpString=".ppt") returned 4
	[0083.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.587] lstrlenW (lpString=".zip") returned 4
	[0083.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.587] lstrlenW (lpString=".rar") returned 4
	[0083.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.587] lstrlenW (lpString=".bz2") returned 4
	[0083.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.588] lstrlenW (lpString=".7z") returned 3
	[0083.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.588] lstrlenW (lpString=".dbf") returned 4
	[0083.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.588] lstrlenW (lpString=".1cd") returned 4
	[0083.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.588] lstrlenW (lpString=".jpg") returned 4
	[0083.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.588] lstrlenW (lpString=".doc") returned 4
	[0083.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.588] lstrlenW (lpString=".docx") returned 5
	[0083.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.588] lstrlenW (lpString=".pdf") returned 4
	[0083.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.588] lstrlenW (lpString=".xls") returned 4
	[0083.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.588] lstrlenW (lpString=".xlsx") returned 5
	[0083.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.589] lstrlenW (lpString=".ppt") returned 4
	[0083.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.589] lstrlenW (lpString=".zip") returned 4
	[0083.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.589] lstrlenW (lpString=".rar") returned 4
	[0083.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.589] lstrlenW (lpString=".bz2") returned 4
	[0083.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.589] lstrlenW (lpString=".7z") returned 3
	[0083.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.589] lstrlenW (lpString=".dbf") returned 4
	[0083.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.589] lstrlenW (lpString=".1cd") returned 4
	[0083.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0083.589] lstrlenW (lpString=".jpg") returned 4
	[0083.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.590] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.590] lstrlenW (lpString="HH01875_.WMF") returned 12
	[0083.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.590] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2616) returned 1
	[0083.590] CloseHandle (hObject=0x314) returned 1
	[0083.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220
	[0083.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.590] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.591] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.591] GetLastError () returned 0x0
	[0083.591] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xa38, lpOverlapped=0x0) returned 1
	[0084.192] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xa40, lpOverlapped=0x0) returned 1
	[0084.194] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.194] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.194] SetEndOfFile (hFile=0x2d4) returned 1
	[0084.194] CloseHandle (hObject=0x2d4) returned 1
	[0084.195] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.195] SetEndOfFile (hFile=0x314) returned 1
	[0084.196] CloseHandle (hObject=0x314) returned 1
	[0084.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1
	[0084.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.196] lstrlenW (lpString=".doc") returned 4
	[0084.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.196] lstrlenW (lpString=".docx") returned 5
	[0084.196] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.196] lstrlenW (lpString=".pdf") returned 4
	[0084.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.197] lstrlenW (lpString=".xls") returned 4
	[0084.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.197] lstrlenW (lpString=".xlsx") returned 5
	[0084.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.197] lstrlenW (lpString=".ppt") returned 4
	[0084.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.197] lstrlenW (lpString=".zip") returned 4
	[0084.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.197] lstrlenW (lpString=".rar") returned 4
	[0084.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.197] lstrlenW (lpString=".bz2") returned 4
	[0084.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.197] lstrlenW (lpString=".7z") returned 3
	[0084.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.197] lstrlenW (lpString=".dbf") returned 4
	[0084.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.197] lstrlenW (lpString=".1cd") returned 4
	[0084.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.197] lstrlenW (lpString=".jpg") returned 4
	[0084.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.198] lstrlenW (lpString=".doc") returned 4
	[0084.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.198] lstrlenW (lpString=".docx") returned 5
	[0084.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.198] lstrlenW (lpString=".pdf") returned 4
	[0084.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.198] lstrlenW (lpString=".xls") returned 4
	[0084.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.198] lstrlenW (lpString=".xlsx") returned 5
	[0084.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.198] lstrlenW (lpString=".ppt") returned 4
	[0084.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.198] lstrlenW (lpString=".zip") returned 4
	[0084.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.198] lstrlenW (lpString=".rar") returned 4
	[0084.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.198] lstrlenW (lpString=".bz2") returned 4
	[0084.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.198] lstrlenW (lpString=".7z") returned 3
	[0084.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.199] lstrlenW (lpString=".dbf") returned 4
	[0084.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.199] lstrlenW (lpString=".1cd") returned 4
	[0084.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0084.199] lstrlenW (lpString=".jpg") returned 4
	[0084.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.199] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.199] lstrlenW (lpString="IN00046_.WMF") returned 12
	[0084.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.200] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1158) returned 1
	[0084.200] CloseHandle (hObject=0x314) returned 1
	[0084.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220
	[0084.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.201] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.201] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0084.201] GetLastError () returned 0x0
	[0084.201] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x486, lpOverlapped=0x0) returned 1
	[0084.203] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x490, lpOverlapped=0x0) returned 1
	[0084.204] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.204] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.204] SetEndOfFile (hFile=0x2d4) returned 1
	[0084.204] CloseHandle (hObject=0x2d4) returned 1
	[0084.204] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.204] SetEndOfFile (hFile=0x314) returned 1
	[0084.205] CloseHandle (hObject=0x314) returned 1
	[0084.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1
	[0084.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.206] lstrlenW (lpString=".doc") returned 4
	[0084.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.206] lstrlenW (lpString=".docx") returned 5
	[0084.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.206] lstrlenW (lpString=".pdf") returned 4
	[0084.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.206] lstrlenW (lpString=".xls") returned 4
	[0084.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.206] lstrlenW (lpString=".xlsx") returned 5
	[0084.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.206] lstrlenW (lpString=".ppt") returned 4
	[0084.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.206] lstrlenW (lpString=".zip") returned 4
	[0084.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.206] lstrlenW (lpString=".rar") returned 4
	[0084.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.206] lstrlenW (lpString=".bz2") returned 4
	[0084.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.206] lstrlenW (lpString=".7z") returned 3
	[0084.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.207] lstrlenW (lpString=".dbf") returned 4
	[0084.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.207] lstrlenW (lpString=".1cd") returned 4
	[0084.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.207] lstrlenW (lpString=".jpg") returned 4
	[0084.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.207] lstrlenW (lpString=".doc") returned 4
	[0084.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.207] lstrlenW (lpString=".docx") returned 5
	[0084.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.207] lstrlenW (lpString=".pdf") returned 4
	[0084.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.207] lstrlenW (lpString=".xls") returned 4
	[0084.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.207] lstrlenW (lpString=".xlsx") returned 5
	[0084.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.207] lstrlenW (lpString=".ppt") returned 4
	[0084.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.207] lstrlenW (lpString=".zip") returned 4
	[0084.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.208] lstrlenW (lpString=".rar") returned 4
	[0084.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.208] lstrlenW (lpString=".bz2") returned 4
	[0084.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.208] lstrlenW (lpString=".7z") returned 3
	[0084.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.208] lstrlenW (lpString=".dbf") returned 4
	[0084.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.208] lstrlenW (lpString=".1cd") returned 4
	[0084.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0084.208] lstrlenW (lpString=".jpg") returned 4
	[0084.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.208] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.208] lstrlenW (lpString="IN00118_.WMF") returned 12
	[0084.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.209] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=792) returned 1
	[0084.209] CloseHandle (hObject=0x314) returned 1
	[0084.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220
	[0084.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.209] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.209] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0084.210] GetLastError () returned 0x0
	[0084.210] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x318, lpOverlapped=0x0) returned 1
	[0084.211] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x320, lpOverlapped=0x0) returned 1
	[0084.213] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.213] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.213] SetEndOfFile (hFile=0x2d4) returned 1
	[0084.213] CloseHandle (hObject=0x2d4) returned 1
	[0084.213] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.213] SetEndOfFile (hFile=0x314) returned 1
	[0084.214] CloseHandle (hObject=0x314) returned 1
	[0084.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1
	[0084.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.215] lstrlenW (lpString=".doc") returned 4
	[0084.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.215] lstrlenW (lpString=".docx") returned 5
	[0084.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.215] lstrlenW (lpString=".pdf") returned 4
	[0084.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.215] lstrlenW (lpString=".xls") returned 4
	[0084.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.215] lstrlenW (lpString=".xlsx") returned 5
	[0084.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.215] lstrlenW (lpString=".ppt") returned 4
	[0084.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.215] lstrlenW (lpString=".zip") returned 4
	[0084.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.215] lstrlenW (lpString=".rar") returned 4
	[0084.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.215] lstrlenW (lpString=".bz2") returned 4
	[0084.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.215] lstrlenW (lpString=".7z") returned 3
	[0084.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.216] lstrlenW (lpString=".dbf") returned 4
	[0084.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.216] lstrlenW (lpString=".1cd") returned 4
	[0084.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.216] lstrlenW (lpString=".jpg") returned 4
	[0084.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.216] lstrlenW (lpString=".doc") returned 4
	[0084.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.216] lstrlenW (lpString=".docx") returned 5
	[0084.216] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.216] lstrlenW (lpString=".pdf") returned 4
	[0084.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.216] lstrlenW (lpString=".xls") returned 4
	[0084.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.216] lstrlenW (lpString=".xlsx") returned 5
	[0084.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.216] lstrlenW (lpString=".ppt") returned 4
	[0084.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.217] lstrlenW (lpString=".zip") returned 4
	[0084.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.217] lstrlenW (lpString=".rar") returned 4
	[0084.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.217] lstrlenW (lpString=".bz2") returned 4
	[0084.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.217] lstrlenW (lpString=".7z") returned 3
	[0084.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.217] lstrlenW (lpString=".dbf") returned 4
	[0084.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.217] lstrlenW (lpString=".1cd") returned 4
	[0084.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0084.217] lstrlenW (lpString=".jpg") returned 4
	[0084.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.218] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.218] lstrlenW (lpString="IN00177_.WMF") returned 12
	[0084.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.218] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1074) returned 1
	[0084.218] CloseHandle (hObject=0x314) returned 1
	[0084.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220
	[0084.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.218] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.218] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0084.219] GetLastError () returned 0x0
	[0084.219] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x432, lpOverlapped=0x0) returned 1
	[0084.220] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x440, lpOverlapped=0x0) returned 1
	[0084.221] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.221] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.221] SetEndOfFile (hFile=0x2d4) returned 1
	[0084.222] CloseHandle (hObject=0x2d4) returned 1
	[0084.222] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.222] SetEndOfFile (hFile=0x314) returned 1
	[0084.223] CloseHandle (hObject=0x314) returned 1
	[0084.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1
	[0084.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.224] lstrlenW (lpString=".doc") returned 4
	[0084.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.224] lstrlenW (lpString=".docx") returned 5
	[0084.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.224] lstrlenW (lpString=".pdf") returned 4
	[0084.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.224] lstrlenW (lpString=".xls") returned 4
	[0084.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.224] lstrlenW (lpString=".xlsx") returned 5
	[0084.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.224] lstrlenW (lpString=".ppt") returned 4
	[0084.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.224] lstrlenW (lpString=".zip") returned 4
	[0084.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.224] lstrlenW (lpString=".rar") returned 4
	[0084.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.224] lstrlenW (lpString=".bz2") returned 4
	[0084.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.224] lstrlenW (lpString=".7z") returned 3
	[0084.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.224] lstrlenW (lpString=".dbf") returned 4
	[0084.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.225] lstrlenW (lpString=".1cd") returned 4
	[0084.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.225] lstrlenW (lpString=".jpg") returned 4
	[0084.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.225] lstrlenW (lpString=".doc") returned 4
	[0084.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.225] lstrlenW (lpString=".docx") returned 5
	[0084.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.225] lstrlenW (lpString=".pdf") returned 4
	[0084.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.225] lstrlenW (lpString=".xls") returned 4
	[0084.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.225] lstrlenW (lpString=".xlsx") returned 5
	[0084.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.225] lstrlenW (lpString=".ppt") returned 4
	[0084.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.225] lstrlenW (lpString=".zip") returned 4
	[0084.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.225] lstrlenW (lpString=".rar") returned 4
	[0084.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.225] lstrlenW (lpString=".bz2") returned 4
	[0084.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.225] lstrlenW (lpString=".7z") returned 3
	[0084.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.226] lstrlenW (lpString=".dbf") returned 4
	[0084.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.226] lstrlenW (lpString=".1cd") returned 4
	[0084.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0084.226] lstrlenW (lpString=".jpg") returned 4
	[0084.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.226] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.226] lstrlenW (lpString="IN00204_.WMF") returned 12
	[0084.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.226] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1848) returned 1
	[0084.227] CloseHandle (hObject=0x314) returned 1
	[0084.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220
	[0084.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.227] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.227] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0084.227] GetLastError () returned 0x0
	[0084.228] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x738, lpOverlapped=0x0) returned 1
	[0084.743] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x740, lpOverlapped=0x0) returned 1
	[0084.744] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.744] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.744] SetEndOfFile (hFile=0x2d4) returned 1
	[0084.744] CloseHandle (hObject=0x2d4) returned 1
	[0084.744] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.744] SetEndOfFile (hFile=0x314) returned 1
	[0084.745] CloseHandle (hObject=0x314) returned 1
	[0084.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1
	[0084.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.746] lstrlenW (lpString=".doc") returned 4
	[0084.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.746] lstrlenW (lpString=".docx") returned 5
	[0084.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.746] lstrlenW (lpString=".pdf") returned 4
	[0084.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.746] lstrlenW (lpString=".xls") returned 4
	[0084.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.746] lstrlenW (lpString=".xlsx") returned 5
	[0084.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.746] lstrlenW (lpString=".ppt") returned 4
	[0084.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.746] lstrlenW (lpString=".zip") returned 4
	[0084.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.746] lstrlenW (lpString=".rar") returned 4
	[0084.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.746] lstrlenW (lpString=".bz2") returned 4
	[0084.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.746] lstrlenW (lpString=".7z") returned 3
	[0084.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.747] lstrlenW (lpString=".dbf") returned 4
	[0084.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.747] lstrlenW (lpString=".1cd") returned 4
	[0084.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.747] lstrlenW (lpString=".jpg") returned 4
	[0084.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.747] lstrlenW (lpString=".doc") returned 4
	[0084.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.747] lstrlenW (lpString=".docx") returned 5
	[0084.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.747] lstrlenW (lpString=".pdf") returned 4
	[0084.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.747] lstrlenW (lpString=".xls") returned 4
	[0084.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.747] lstrlenW (lpString=".xlsx") returned 5
	[0084.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.747] lstrlenW (lpString=".ppt") returned 4
	[0084.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.748] lstrlenW (lpString=".zip") returned 4
	[0084.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.748] lstrlenW (lpString=".rar") returned 4
	[0084.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.748] lstrlenW (lpString=".bz2") returned 4
	[0084.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.748] lstrlenW (lpString=".7z") returned 3
	[0084.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.748] lstrlenW (lpString=".dbf") returned 4
	[0084.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.748] lstrlenW (lpString=".1cd") returned 4
	[0084.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0084.748] lstrlenW (lpString=".jpg") returned 4
	[0084.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.748] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0084.748] lstrlenW (lpString="J0075478.GIF") returned 12
	[0084.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.749] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1220) returned 1
	[0084.749] CloseHandle (hObject=0x314) returned 1
	[0084.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220
	[0084.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.749] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.749] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0084.750] GetLastError () returned 0x0
	[0084.750] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4c4, lpOverlapped=0x0) returned 1
	[0084.751] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4d0, lpOverlapped=0x0) returned 1
	[0084.752] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.753] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.753] SetEndOfFile (hFile=0x2d4) returned 1
	[0084.753] CloseHandle (hObject=0x2d4) returned 1
	[0084.753] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.753] SetEndOfFile (hFile=0x314) returned 1
	[0084.754] CloseHandle (hObject=0x314) returned 1
	[0084.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1
	[0084.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.755] lstrlenW (lpString=".doc") returned 4
	[0084.755] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0084.755] lstrlenW (lpString=".docx") returned 5
	[0084.755] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0084.755] lstrlenW (lpString=".pdf") returned 4
	[0084.755] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0084.755] lstrlenW (lpString=".xls") returned 4
	[0084.755] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0084.755] lstrlenW (lpString=".xlsx") returned 5
	[0084.755] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0084.755] lstrlenW (lpString=".ppt") returned 4
	[0084.755] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0084.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.755] lstrlenW (lpString=".zip") returned 4
	[0084.755] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0084.755] lstrlenW (lpString=".rar") returned 4
	[0084.755] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0084.755] lstrlenW (lpString=".bz2") returned 4
	[0084.755] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0084.755] lstrlenW (lpString=".7z") returned 3
	[0084.755] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0084.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.755] lstrlenW (lpString=".dbf") returned 4
	[0084.756] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0084.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.756] lstrlenW (lpString=".1cd") returned 4
	[0084.756] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0084.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.756] lstrlenW (lpString=".jpg") returned 4
	[0084.756] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0084.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.756] lstrlenW (lpString=".doc") returned 4
	[0084.756] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0084.756] lstrlenW (lpString=".docx") returned 5
	[0084.756] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0084.756] lstrlenW (lpString=".pdf") returned 4
	[0084.756] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0084.756] lstrlenW (lpString=".xls") returned 4
	[0084.756] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0084.756] lstrlenW (lpString=".xlsx") returned 5
	[0084.756] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0084.756] lstrlenW (lpString=".ppt") returned 4
	[0084.756] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0084.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.756] lstrlenW (lpString=".zip") returned 4
	[0084.757] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0084.757] lstrlenW (lpString=".rar") returned 4
	[0084.757] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0084.757] lstrlenW (lpString=".bz2") returned 4
	[0084.757] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0084.757] lstrlenW (lpString=".7z") returned 3
	[0084.757] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0084.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.757] lstrlenW (lpString=".dbf") returned 4
	[0084.757] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0084.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.757] lstrlenW (lpString=".1cd") returned 4
	[0084.757] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0084.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0084.757] lstrlenW (lpString=".jpg") returned 4
	[0084.757] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0084.758] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.758] lstrlenW (lpString="J0086384.WMF") returned 12
	[0084.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.758] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=9734) returned 1
	[0084.758] CloseHandle (hObject=0x314) returned 1
	[0084.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220
	[0084.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.759] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.759] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0084.759] GetLastError () returned 0x0
	[0084.759] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2606, lpOverlapped=0x0) returned 1
	[0084.761] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2610, lpOverlapped=0x0) returned 1
	[0084.762] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.762] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.762] SetEndOfFile (hFile=0x2d4) returned 1
	[0084.762] CloseHandle (hObject=0x2d4) returned 1
	[0084.762] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.762] SetEndOfFile (hFile=0x314) returned 1
	[0084.763] CloseHandle (hObject=0x314) returned 1
	[0084.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1
	[0084.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.764] lstrlenW (lpString=".doc") returned 4
	[0084.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.764] lstrlenW (lpString=".docx") returned 5
	[0084.764] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0084.764] lstrlenW (lpString=".pdf") returned 4
	[0084.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.764] lstrlenW (lpString=".xls") returned 4
	[0084.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.764] lstrlenW (lpString=".xlsx") returned 5
	[0084.764] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0084.764] lstrlenW (lpString=".ppt") returned 4
	[0084.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.764] lstrlenW (lpString=".zip") returned 4
	[0084.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.764] lstrlenW (lpString=".rar") returned 4
	[0084.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.764] lstrlenW (lpString=".bz2") returned 4
	[0084.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.765] lstrlenW (lpString=".7z") returned 3
	[0084.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.765] lstrlenW (lpString=".dbf") returned 4
	[0084.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.765] lstrlenW (lpString=".1cd") returned 4
	[0084.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.765] lstrlenW (lpString=".jpg") returned 4
	[0084.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.765] lstrlenW (lpString=".doc") returned 4
	[0084.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.765] lstrlenW (lpString=".docx") returned 5
	[0084.765] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0084.765] lstrlenW (lpString=".pdf") returned 4
	[0084.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.765] lstrlenW (lpString=".xls") returned 4
	[0084.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.765] lstrlenW (lpString=".xlsx") returned 5
	[0084.765] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0084.765] lstrlenW (lpString=".ppt") returned 4
	[0084.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.765] lstrlenW (lpString=".zip") returned 4
	[0084.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.765] lstrlenW (lpString=".rar") returned 4
	[0084.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.766] lstrlenW (lpString=".bz2") returned 4
	[0084.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.766] lstrlenW (lpString=".7z") returned 3
	[0084.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.766] lstrlenW (lpString=".dbf") returned 4
	[0084.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.766] lstrlenW (lpString=".1cd") returned 4
	[0084.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0084.766] lstrlenW (lpString=".jpg") returned 4
	[0084.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.766] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.766] lstrlenW (lpString="J0086420.WMF") returned 12
	[0084.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.767] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=9596) returned 1
	[0084.767] CloseHandle (hObject=0x314) returned 1
	[0084.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220
	[0084.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.767] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.767] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0084.767] GetLastError () returned 0x0
	[0084.767] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x257c, lpOverlapped=0x0) returned 1
	[0084.769] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2580, lpOverlapped=0x0) returned 1
	[0084.770] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.770] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.770] SetEndOfFile (hFile=0x2d4) returned 1
	[0084.770] CloseHandle (hObject=0x2d4) returned 1
	[0084.770] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.770] SetEndOfFile (hFile=0x314) returned 1
	[0084.771] CloseHandle (hObject=0x314) returned 1
	[0084.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1
	[0084.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.772] lstrlenW (lpString=".doc") returned 4
	[0084.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.772] lstrlenW (lpString=".docx") returned 5
	[0084.772] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0084.772] lstrlenW (lpString=".pdf") returned 4
	[0084.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.772] lstrlenW (lpString=".xls") returned 4
	[0084.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.772] lstrlenW (lpString=".xlsx") returned 5
	[0084.772] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0084.772] lstrlenW (lpString=".ppt") returned 4
	[0084.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.772] lstrlenW (lpString=".zip") returned 4
	[0084.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.772] lstrlenW (lpString=".rar") returned 4
	[0084.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.772] lstrlenW (lpString=".bz2") returned 4
	[0084.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.772] lstrlenW (lpString=".7z") returned 3
	[0084.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.773] lstrlenW (lpString=".dbf") returned 4
	[0084.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.773] lstrlenW (lpString=".1cd") returned 4
	[0084.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.773] lstrlenW (lpString=".jpg") returned 4
	[0084.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.773] lstrlenW (lpString=".doc") returned 4
	[0084.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.773] lstrlenW (lpString=".docx") returned 5
	[0084.773] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0084.773] lstrlenW (lpString=".pdf") returned 4
	[0084.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.773] lstrlenW (lpString=".xls") returned 4
	[0084.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.773] lstrlenW (lpString=".xlsx") returned 5
	[0084.773] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0084.774] lstrlenW (lpString=".ppt") returned 4
	[0084.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.774] lstrlenW (lpString=".zip") returned 4
	[0084.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.774] lstrlenW (lpString=".rar") returned 4
	[0084.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.774] lstrlenW (lpString=".bz2") returned 4
	[0084.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.774] lstrlenW (lpString=".7z") returned 3
	[0084.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.774] lstrlenW (lpString=".dbf") returned 4
	[0084.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.774] lstrlenW (lpString=".1cd") returned 4
	[0084.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0084.774] lstrlenW (lpString=".jpg") returned 4
	[0084.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.774] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.774] lstrlenW (lpString="J0086424.WMF") returned 12
	[0084.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.775] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=17016) returned 1
	[0084.775] CloseHandle (hObject=0x314) returned 1
	[0084.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220
	[0084.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0084.776] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.776] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0084.777] GetLastError () returned 0x0
	[0084.777] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4278, lpOverlapped=0x0) returned 1
	[0085.267] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4280, lpOverlapped=0x0) returned 1
	[0085.269] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.269] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.269] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.269] CloseHandle (hObject=0x2d4) returned 1
	[0085.269] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.269] SetEndOfFile (hFile=0x314) returned 1
	[0085.270] CloseHandle (hObject=0x314) returned 1
	[0085.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1
	[0085.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.271] lstrlenW (lpString=".doc") returned 4
	[0085.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.271] lstrlenW (lpString=".docx") returned 5
	[0085.271] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0085.271] lstrlenW (lpString=".pdf") returned 4
	[0085.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.271] lstrlenW (lpString=".xls") returned 4
	[0085.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.271] lstrlenW (lpString=".xlsx") returned 5
	[0085.271] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0085.271] lstrlenW (lpString=".ppt") returned 4
	[0085.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.271] lstrlenW (lpString=".zip") returned 4
	[0085.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.271] lstrlenW (lpString=".rar") returned 4
	[0085.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.271] lstrlenW (lpString=".bz2") returned 4
	[0085.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.271] lstrlenW (lpString=".7z") returned 3
	[0085.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.271] lstrlenW (lpString=".dbf") returned 4
	[0085.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.271] lstrlenW (lpString=".1cd") returned 4
	[0085.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.271] lstrlenW (lpString=".jpg") returned 4
	[0085.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.272] lstrlenW (lpString=".doc") returned 4
	[0085.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.272] lstrlenW (lpString=".docx") returned 5
	[0085.272] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0085.272] lstrlenW (lpString=".pdf") returned 4
	[0085.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.272] lstrlenW (lpString=".xls") returned 4
	[0085.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.272] lstrlenW (lpString=".xlsx") returned 5
	[0085.272] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0085.272] lstrlenW (lpString=".ppt") returned 4
	[0085.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.272] lstrlenW (lpString=".zip") returned 4
	[0085.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.272] lstrlenW (lpString=".rar") returned 4
	[0085.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.272] lstrlenW (lpString=".bz2") returned 4
	[0085.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.272] lstrlenW (lpString=".7z") returned 3
	[0085.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.272] lstrlenW (lpString=".dbf") returned 4
	[0085.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.273] lstrlenW (lpString=".1cd") returned 4
	[0085.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0085.273] lstrlenW (lpString=".jpg") returned 4
	[0085.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.273] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.273] lstrlenW (lpString="J0090781.WMF") returned 12
	[0085.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0085.274] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=5314) returned 1
	[0085.274] CloseHandle (hObject=0x314) returned 1
	[0085.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220
	[0085.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0085.274] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.274] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.274] GetLastError () returned 0x0
	[0085.275] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x14c2, lpOverlapped=0x0) returned 1
	[0085.276] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x14d0, lpOverlapped=0x0) returned 1
	[0085.278] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.278] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.278] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.278] CloseHandle (hObject=0x2d4) returned 1
	[0085.278] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.278] SetEndOfFile (hFile=0x314) returned 1
	[0085.279] CloseHandle (hObject=0x314) returned 1
	[0085.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1
	[0085.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.280] lstrlenW (lpString=".doc") returned 4
	[0085.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.280] lstrlenW (lpString=".docx") returned 5
	[0085.280] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0085.280] lstrlenW (lpString=".pdf") returned 4
	[0085.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.280] lstrlenW (lpString=".xls") returned 4
	[0085.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.280] lstrlenW (lpString=".xlsx") returned 5
	[0085.280] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0085.280] lstrlenW (lpString=".ppt") returned 4
	[0085.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.280] lstrlenW (lpString=".zip") returned 4
	[0085.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.280] lstrlenW (lpString=".rar") returned 4
	[0085.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.280] lstrlenW (lpString=".bz2") returned 4
	[0085.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.280] lstrlenW (lpString=".7z") returned 3
	[0085.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.281] lstrlenW (lpString=".dbf") returned 4
	[0085.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.281] lstrlenW (lpString=".1cd") returned 4
	[0085.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.281] lstrlenW (lpString=".jpg") returned 4
	[0085.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.281] lstrlenW (lpString=".doc") returned 4
	[0085.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.281] lstrlenW (lpString=".docx") returned 5
	[0085.281] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0085.281] lstrlenW (lpString=".pdf") returned 4
	[0085.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.281] lstrlenW (lpString=".xls") returned 4
	[0085.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.281] lstrlenW (lpString=".xlsx") returned 5
	[0085.281] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0085.281] lstrlenW (lpString=".ppt") returned 4
	[0085.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.281] lstrlenW (lpString=".zip") returned 4
	[0085.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.281] lstrlenW (lpString=".rar") returned 4
	[0085.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.282] lstrlenW (lpString=".bz2") returned 4
	[0085.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.282] lstrlenW (lpString=".7z") returned 3
	[0085.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.282] lstrlenW (lpString=".dbf") returned 4
	[0085.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.282] lstrlenW (lpString=".1cd") returned 4
	[0085.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0085.282] lstrlenW (lpString=".jpg") returned 4
	[0085.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.282] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.282] lstrlenW (lpString="J0090783.WMF") returned 12
	[0085.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0085.283] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=6934) returned 1
	[0085.283] CloseHandle (hObject=0x314) returned 1
	[0085.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220
	[0085.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0085.283] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.283] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.284] GetLastError () returned 0x0
	[0085.284] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1b16, lpOverlapped=0x0) returned 1
	[0085.285] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0085.286] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.286] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.286] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.286] CloseHandle (hObject=0x2d4) returned 1
	[0085.286] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.286] SetEndOfFile (hFile=0x314) returned 1
	[0085.287] CloseHandle (hObject=0x314) returned 1
	[0085.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1
	[0085.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.288] lstrlenW (lpString=".doc") returned 4
	[0085.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.288] lstrlenW (lpString=".docx") returned 5
	[0085.288] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0085.288] lstrlenW (lpString=".pdf") returned 4
	[0085.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.288] lstrlenW (lpString=".xls") returned 4
	[0085.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.288] lstrlenW (lpString=".xlsx") returned 5
	[0085.288] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0085.288] lstrlenW (lpString=".ppt") returned 4
	[0085.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.288] lstrlenW (lpString=".zip") returned 4
	[0085.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.288] lstrlenW (lpString=".rar") returned 4
	[0085.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.288] lstrlenW (lpString=".bz2") returned 4
	[0085.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.289] lstrlenW (lpString=".7z") returned 3
	[0085.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.289] lstrlenW (lpString=".dbf") returned 4
	[0085.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.289] lstrlenW (lpString=".1cd") returned 4
	[0085.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.289] lstrlenW (lpString=".jpg") returned 4
	[0085.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.289] lstrlenW (lpString=".doc") returned 4
	[0085.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.289] lstrlenW (lpString=".docx") returned 5
	[0085.289] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0085.289] lstrlenW (lpString=".pdf") returned 4
	[0085.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.289] lstrlenW (lpString=".xls") returned 4
	[0085.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.289] lstrlenW (lpString=".xlsx") returned 5
	[0085.289] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0085.289] lstrlenW (lpString=".ppt") returned 4
	[0085.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.290] lstrlenW (lpString=".zip") returned 4
	[0085.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.290] lstrlenW (lpString=".rar") returned 4
	[0085.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.290] lstrlenW (lpString=".bz2") returned 4
	[0085.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.290] lstrlenW (lpString=".7z") returned 3
	[0085.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.290] lstrlenW (lpString=".dbf") returned 4
	[0085.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.290] lstrlenW (lpString=".1cd") returned 4
	[0085.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0085.290] lstrlenW (lpString=".jpg") returned 4
	[0085.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.290] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.290] lstrlenW (lpString="J0093905.WMF") returned 12
	[0085.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0085.291] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=42050) returned 1
	[0085.291] CloseHandle (hObject=0x314) returned 1
	[0085.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220
	[0085.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0085.291] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.291] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.292] GetLastError () returned 0x0
	[0085.292] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xa442, lpOverlapped=0x0) returned 1
	[0085.294] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xa450, lpOverlapped=0x0) returned 1
	[0085.295] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.295] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.295] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.296] CloseHandle (hObject=0x2d4) returned 1
	[0085.296] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.296] SetEndOfFile (hFile=0x314) returned 1
	[0085.297] CloseHandle (hObject=0x314) returned 1
	[0085.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1
	[0085.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.297] lstrlenW (lpString=".doc") returned 4
	[0085.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.297] lstrlenW (lpString=".docx") returned 5
	[0085.297] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0085.297] lstrlenW (lpString=".pdf") returned 4
	[0085.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.298] lstrlenW (lpString=".xls") returned 4
	[0085.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.298] lstrlenW (lpString=".xlsx") returned 5
	[0085.298] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0085.298] lstrlenW (lpString=".ppt") returned 4
	[0085.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.298] lstrlenW (lpString=".zip") returned 4
	[0085.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.298] lstrlenW (lpString=".rar") returned 4
	[0085.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.298] lstrlenW (lpString=".bz2") returned 4
	[0085.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.298] lstrlenW (lpString=".7z") returned 3
	[0085.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.298] lstrlenW (lpString=".dbf") returned 4
	[0085.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.298] lstrlenW (lpString=".1cd") returned 4
	[0085.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.298] lstrlenW (lpString=".jpg") returned 4
	[0085.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.298] lstrlenW (lpString=".doc") returned 4
	[0085.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.299] lstrlenW (lpString=".docx") returned 5
	[0085.299] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0085.299] lstrlenW (lpString=".pdf") returned 4
	[0085.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.299] lstrlenW (lpString=".xls") returned 4
	[0085.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.299] lstrlenW (lpString=".xlsx") returned 5
	[0085.299] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0085.299] lstrlenW (lpString=".ppt") returned 4
	[0085.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.299] lstrlenW (lpString=".zip") returned 4
	[0085.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.299] lstrlenW (lpString=".rar") returned 4
	[0085.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.299] lstrlenW (lpString=".bz2") returned 4
	[0085.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.299] lstrlenW (lpString=".7z") returned 3
	[0085.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.299] lstrlenW (lpString=".dbf") returned 4
	[0085.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.299] lstrlenW (lpString=".1cd") returned 4
	[0085.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0085.300] lstrlenW (lpString=".jpg") returned 4
	[0085.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.300] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.300] lstrlenW (lpString="J0098497.WMF") returned 12
	[0085.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0085.300] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=4970) returned 1
	[0085.300] CloseHandle (hObject=0x314) returned 1
	[0085.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220
	[0085.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0085.301] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.301] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.301] GetLastError () returned 0x0
	[0085.301] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x136a, lpOverlapped=0x0) returned 1
	[0085.491] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0085.493] ReadFile (in: hFile=0x314, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.493] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.493] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.493] CloseHandle (hObject=0x2d4) returned 1
	[0085.494] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.494] SetEndOfFile (hFile=0x314) returned 1
	[0085.494] CloseHandle (hObject=0x314) returned 1
	[0085.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1
	[0085.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.830] lstrlenW (lpString=".doc") returned 4
	[0085.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.830] lstrlenW (lpString=".docx") returned 5
	[0085.830] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0085.830] lstrlenW (lpString=".pdf") returned 4
	[0085.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.830] lstrlenW (lpString=".xls") returned 4
	[0085.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.830] lstrlenW (lpString=".xlsx") returned 5
	[0085.830] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0085.830] lstrlenW (lpString=".ppt") returned 4
	[0085.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.830] lstrlenW (lpString=".zip") returned 4
	[0085.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.830] lstrlenW (lpString=".rar") returned 4
	[0085.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.830] lstrlenW (lpString=".bz2") returned 4
	[0085.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.830] lstrlenW (lpString=".7z") returned 3
	[0085.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.830] lstrlenW (lpString=".dbf") returned 4
	[0085.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.830] lstrlenW (lpString=".1cd") returned 4
	[0085.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.830] lstrlenW (lpString=".jpg") returned 4
	[0085.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.831] lstrlenW (lpString=".doc") returned 4
	[0085.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.831] lstrlenW (lpString=".docx") returned 5
	[0085.831] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0085.831] lstrlenW (lpString=".pdf") returned 4
	[0085.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.831] lstrlenW (lpString=".xls") returned 4
	[0085.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.831] lstrlenW (lpString=".xlsx") returned 5
	[0085.831] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0085.831] lstrlenW (lpString=".ppt") returned 4
	[0085.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.831] lstrlenW (lpString=".zip") returned 4
	[0085.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.831] lstrlenW (lpString=".rar") returned 4
	[0085.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.831] lstrlenW (lpString=".bz2") returned 4
	[0085.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.831] lstrlenW (lpString=".7z") returned 3
	[0085.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.831] lstrlenW (lpString=".dbf") returned 4
	[0085.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.832] lstrlenW (lpString=".1cd") returned 4
	[0085.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0085.832] lstrlenW (lpString=".jpg") returned 4
	[0085.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.832] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.832] lstrlenW (lpString="J0099169.WMF") returned 12
	[0085.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0085.832] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=10192) returned 1
	[0085.832] CloseHandle (hObject=0x354) returned 1
	[0085.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220
	[0085.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0085.833] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.833] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.833] GetLastError () returned 0x0
	[0085.833] ReadFile (in: hFile=0x354, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x27d0, lpOverlapped=0x0) returned 1
	[0085.835] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x27e0, lpOverlapped=0x0) returned 1
	[0085.836] ReadFile (in: hFile=0x354, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.836] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.837] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.837] CloseHandle (hObject=0x2d4) returned 1
	[0085.837] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.837] SetEndOfFile (hFile=0x354) returned 1
	[0085.840] CloseHandle (hObject=0x354) returned 1
	[0085.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1
	[0085.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.841] lstrlenW (lpString=".doc") returned 4
	[0085.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.841] lstrlenW (lpString=".docx") returned 5
	[0085.841] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0085.841] lstrlenW (lpString=".pdf") returned 4
	[0085.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.841] lstrlenW (lpString=".xls") returned 4
	[0085.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.841] lstrlenW (lpString=".xlsx") returned 5
	[0085.841] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0085.841] lstrlenW (lpString=".ppt") returned 4
	[0085.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.841] lstrlenW (lpString=".zip") returned 4
	[0085.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.841] lstrlenW (lpString=".rar") returned 4
	[0085.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.842] lstrlenW (lpString=".bz2") returned 4
	[0085.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.842] lstrlenW (lpString=".7z") returned 3
	[0085.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.842] lstrlenW (lpString=".dbf") returned 4
	[0085.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.842] lstrlenW (lpString=".1cd") returned 4
	[0085.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.842] lstrlenW (lpString=".jpg") returned 4
	[0085.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.843] lstrlenW (lpString=".doc") returned 4
	[0085.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.843] lstrlenW (lpString=".docx") returned 5
	[0085.843] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0085.843] lstrlenW (lpString=".pdf") returned 4
	[0085.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.843] lstrlenW (lpString=".xls") returned 4
	[0085.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.843] lstrlenW (lpString=".xlsx") returned 5
	[0085.843] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0085.843] lstrlenW (lpString=".ppt") returned 4
	[0085.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.843] lstrlenW (lpString=".zip") returned 4
	[0085.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.843] lstrlenW (lpString=".rar") returned 4
	[0085.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.843] lstrlenW (lpString=".bz2") returned 4
	[0085.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.843] lstrlenW (lpString=".7z") returned 3
	[0085.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.843] lstrlenW (lpString=".dbf") returned 4
	[0085.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.843] lstrlenW (lpString=".1cd") returned 4
	[0085.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0085.844] lstrlenW (lpString=".jpg") returned 4
	[0085.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.844] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.844] lstrlenW (lpString="J0099170.WMF") returned 12
	[0085.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0085.845] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=24292) returned 1
	[0085.845] CloseHandle (hObject=0x354) returned 1
	[0085.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220
	[0085.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0085.846] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.846] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.846] GetLastError () returned 0x0
	[0085.846] ReadFile (in: hFile=0x354, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x5ee4, lpOverlapped=0x0) returned 1
	[0085.848] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x5ef0, lpOverlapped=0x0) returned 1
	[0085.850] ReadFile (in: hFile=0x354, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.850] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.850] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.850] CloseHandle (hObject=0x2d4) returned 1
	[0085.850] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.850] SetEndOfFile (hFile=0x354) returned 1
	[0085.851] CloseHandle (hObject=0x354) returned 1
	[0085.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1
	[0085.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.852] lstrlenW (lpString=".doc") returned 4
	[0085.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.852] lstrlenW (lpString=".docx") returned 5
	[0085.853] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0085.853] lstrlenW (lpString=".pdf") returned 4
	[0085.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.853] lstrlenW (lpString=".xls") returned 4
	[0085.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.853] lstrlenW (lpString=".xlsx") returned 5
	[0085.853] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0085.853] lstrlenW (lpString=".ppt") returned 4
	[0085.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.853] lstrlenW (lpString=".zip") returned 4
	[0085.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.853] lstrlenW (lpString=".rar") returned 4
	[0085.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.853] lstrlenW (lpString=".bz2") returned 4
	[0085.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.853] lstrlenW (lpString=".7z") returned 3
	[0085.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.853] lstrlenW (lpString=".dbf") returned 4
	[0085.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.854] lstrlenW (lpString=".1cd") returned 4
	[0085.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.854] lstrlenW (lpString=".jpg") returned 4
	[0085.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.854] lstrlenW (lpString=".doc") returned 4
	[0085.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.854] lstrlenW (lpString=".docx") returned 5
	[0085.854] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0085.855] lstrlenW (lpString=".pdf") returned 4
	[0085.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.855] lstrlenW (lpString=".xls") returned 4
	[0085.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.855] lstrlenW (lpString=".xlsx") returned 5
	[0085.855] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0085.855] lstrlenW (lpString=".ppt") returned 4
	[0085.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.855] lstrlenW (lpString=".zip") returned 4
	[0085.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.855] lstrlenW (lpString=".rar") returned 4
	[0085.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.855] lstrlenW (lpString=".bz2") returned 4
	[0085.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.855] lstrlenW (lpString=".7z") returned 3
	[0085.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.856] lstrlenW (lpString=".dbf") returned 4
	[0085.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.856] lstrlenW (lpString=".1cd") returned 4
	[0085.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0085.856] lstrlenW (lpString=".jpg") returned 4
	[0085.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.856] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.856] lstrlenW (lpString="J0099171.WMF") returned 12
	[0085.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0085.857] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=8754) returned 1
	[0085.857] CloseHandle (hObject=0x354) returned 1
	[0085.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220
	[0085.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0085.858] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.858] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.858] GetLastError () returned 0x0
	[0085.858] ReadFile (in: hFile=0x354, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2232, lpOverlapped=0x0) returned 1
	[0085.860] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2240, lpOverlapped=0x0) returned 1
	[0085.861] ReadFile (in: hFile=0x354, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.861] WriteFile (in: hFile=0x2d4, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.861] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.861] CloseHandle (hObject=0x2d4) returned 1
	[0085.861] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.862] SetEndOfFile (hFile=0x354) returned 1
	[0085.863] CloseHandle (hObject=0x354) returned 1
	[0085.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1
	[0085.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0085.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0085.863] lstrlenW (lpString=".doc") returned 4
	[0085.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.863] lstrlenW (lpString=".docx") returned 5
	[0085.863] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0085.864] lstrlenW (lpString=".pdf") returned 4
	[0085.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.864] lstrlenW (lpString=".xls") returned 4
	[0085.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.864] lstrlenW (lpString=".xlsx") returned 5
	[0085.864] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0085.864] lstrlenW (lpString=".ppt") returned 4
	[0085.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0085.864] lstrlenW (lpString=".zip") returned 4
	[0085.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.864] lstrlenW (lpString=".rar") returned 4
	[0085.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.134] lstrlenW (lpString=".bz2") returned 4
	[0086.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.134] lstrlenW (lpString=".7z") returned 3
	[0086.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0086.134] lstrlenW (lpString=".dbf") returned 4
	[0086.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0086.135] lstrlenW (lpString=".1cd") returned 4
	[0086.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0086.135] lstrlenW (lpString=".jpg") returned 4
	[0086.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0086.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0086.135] lstrlenW (lpString=".doc") returned 4
	[0086.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.135] lstrlenW (lpString=".docx") returned 5
	[0086.135] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0086.135] lstrlenW (lpString=".pdf") returned 4
	[0086.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.135] lstrlenW (lpString=".xls") returned 4
	[0086.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.135] lstrlenW (lpString=".xlsx") returned 5
	[0086.135] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0086.135] lstrlenW (lpString=".ppt") returned 4
	[0086.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0086.135] lstrlenW (lpString=".zip") returned 4
	[0086.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.135] lstrlenW (lpString=".rar") returned 4
	[0086.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.135] lstrlenW (lpString=".bz2") returned 4
	[0086.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.135] lstrlenW (lpString=".7z") returned 3
	[0086.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0086.136] lstrlenW (lpString=".dbf") returned 4
	[0086.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0086.136] lstrlenW (lpString=".1cd") returned 4
	[0086.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0086.136] lstrlenW (lpString=".jpg") returned 4
	[0086.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.136] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0086.136] lstrlenW (lpString="J0099176.WMF") returned 12
	[0086.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.659] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2488) returned 1
	[0086.659] CloseHandle (hObject=0x390) returned 1
	[0086.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220
	[0086.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.659] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.659] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0086.660] GetLastError () returned 0x0
	[0086.660] ReadFile (in: hFile=0x390, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x9b8, lpOverlapped=0x0) returned 1
	[0086.661] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0086.662] ReadFile (in: hFile=0x390, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.662] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.662] SetEndOfFile (hFile=0x35c) returned 1
	[0086.662] CloseHandle (hObject=0x35c) returned 1
	[0086.662] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.662] SetEndOfFile (hFile=0x390) returned 1
	[0086.663] CloseHandle (hObject=0x390) returned 1
	[0086.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1
	[0086.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.664] lstrlenW (lpString=".doc") returned 4
	[0086.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.664] lstrlenW (lpString=".docx") returned 5
	[0086.664] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0086.664] lstrlenW (lpString=".pdf") returned 4
	[0086.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.664] lstrlenW (lpString=".xls") returned 4
	[0086.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.664] lstrlenW (lpString=".xlsx") returned 5
	[0086.664] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0086.664] lstrlenW (lpString=".ppt") returned 4
	[0086.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.664] lstrlenW (lpString=".zip") returned 4
	[0086.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.664] lstrlenW (lpString=".rar") returned 4
	[0086.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.664] lstrlenW (lpString=".bz2") returned 4
	[0086.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.664] lstrlenW (lpString=".7z") returned 3
	[0086.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.665] lstrlenW (lpString=".dbf") returned 4
	[0086.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.665] lstrlenW (lpString=".1cd") returned 4
	[0086.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.665] lstrlenW (lpString=".jpg") returned 4
	[0086.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.665] lstrlenW (lpString=".doc") returned 4
	[0086.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.665] lstrlenW (lpString=".docx") returned 5
	[0086.665] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0086.665] lstrlenW (lpString=".pdf") returned 4
	[0086.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.665] lstrlenW (lpString=".xls") returned 4
	[0086.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.665] lstrlenW (lpString=".xlsx") returned 5
	[0086.665] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0086.665] lstrlenW (lpString=".ppt") returned 4
	[0086.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.665] lstrlenW (lpString=".zip") returned 4
	[0086.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.665] lstrlenW (lpString=".rar") returned 4
	[0086.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.666] lstrlenW (lpString=".bz2") returned 4
	[0086.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.667] lstrlenW (lpString=".7z") returned 3
	[0086.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.668] lstrlenW (lpString=".dbf") returned 4
	[0086.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.668] lstrlenW (lpString=".1cd") returned 4
	[0086.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0086.668] lstrlenW (lpString=".jpg") returned 4
	[0086.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.668] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0086.668] lstrlenW (lpString="J0099186.JPG") returned 12
	[0086.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.669] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=16738) returned 1
	[0086.669] CloseHandle (hObject=0x390) returned 1
	[0086.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220
	[0086.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.669] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.669] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0086.670] GetLastError () returned 0x0
	[0086.670] ReadFile (in: hFile=0x390, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x4162, lpOverlapped=0x0) returned 1
	[0086.671] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x4170, lpOverlapped=0x0) returned 1
	[0086.672] ReadFile (in: hFile=0x390, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.672] WriteFile (in: hFile=0x35c, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.673] SetEndOfFile (hFile=0x35c) returned 1
	[0086.673] CloseHandle (hObject=0x35c) returned 1
	[0086.673] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.673] SetEndOfFile (hFile=0x390) returned 1
	[0086.674] CloseHandle (hObject=0x390) returned 1
	[0086.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1
	[0086.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.674] lstrlenW (lpString=".doc") returned 4
	[0086.674] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.674] lstrlenW (lpString=".docx") returned 5
	[0086.675] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0086.675] lstrlenW (lpString=".pdf") returned 4
	[0086.675] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.675] lstrlenW (lpString=".xls") returned 4
	[0086.675] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.675] lstrlenW (lpString=".xlsx") returned 5
	[0086.675] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0086.675] lstrlenW (lpString=".ppt") returned 4
	[0086.675] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.675] lstrlenW (lpString=".zip") returned 4
	[0086.675] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.675] lstrlenW (lpString=".rar") returned 4
	[0086.675] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.675] lstrlenW (lpString=".bz2") returned 4
	[0086.675] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.675] lstrlenW (lpString=".7z") returned 3
	[0086.675] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.675] lstrlenW (lpString=".dbf") returned 4
	[0086.675] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.675] lstrlenW (lpString=".1cd") returned 4
	[0086.675] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.675] lstrlenW (lpString=".jpg") returned 4
	[0086.675] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.676] lstrlenW (lpString=".doc") returned 4
	[0086.676] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.676] lstrlenW (lpString=".docx") returned 5
	[0086.676] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0086.676] lstrlenW (lpString=".pdf") returned 4
	[0086.676] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.676] lstrlenW (lpString=".xls") returned 4
	[0086.676] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.676] lstrlenW (lpString=".xlsx") returned 5
	[0086.676] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0086.676] lstrlenW (lpString=".ppt") returned 4
	[0086.676] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.676] lstrlenW (lpString=".zip") returned 4
	[0086.676] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.676] lstrlenW (lpString=".rar") returned 4
	[0086.676] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.676] lstrlenW (lpString=".bz2") returned 4
	[0086.676] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.676] lstrlenW (lpString=".7z") returned 3
	[0086.676] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.676] lstrlenW (lpString=".dbf") returned 4
	[0086.676] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.676] lstrlenW (lpString=".1cd") returned 4
	[0086.677] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0086.677] lstrlenW (lpString=".jpg") returned 4
	[0086.677] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.677] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0086.677] lstrlenW (lpString="J0099187.JPG") returned 12
	[0086.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0086.678] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=24528) returned 1
	[0086.678] CloseHandle (hObject=0x35c) returned 1
	[0086.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220
	[0086.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0086.678] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.678] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0086.679] GetLastError () returned 0x0
	[0086.679] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x5fd0, lpOverlapped=0x0) returned 1
	[0086.680] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x5fe0, lpOverlapped=0x0) returned 1
	[0086.681] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.681] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.682] SetEndOfFile (hFile=0x318) returned 1
	[0086.682] CloseHandle (hObject=0x318) returned 1
	[0086.682] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.682] SetEndOfFile (hFile=0x35c) returned 1
	[0086.683] CloseHandle (hObject=0x35c) returned 1
	[0086.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1
	[0086.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.683] lstrlenW (lpString=".doc") returned 4
	[0086.684] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.684] lstrlenW (lpString=".docx") returned 5
	[0086.684] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0086.684] lstrlenW (lpString=".pdf") returned 4
	[0086.684] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.684] lstrlenW (lpString=".xls") returned 4
	[0086.684] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.684] lstrlenW (lpString=".xlsx") returned 5
	[0086.684] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0086.684] lstrlenW (lpString=".ppt") returned 4
	[0086.684] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.684] lstrlenW (lpString=".zip") returned 4
	[0086.684] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.684] lstrlenW (lpString=".rar") returned 4
	[0086.684] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.684] lstrlenW (lpString=".bz2") returned 4
	[0086.684] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.684] lstrlenW (lpString=".7z") returned 3
	[0086.684] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.684] lstrlenW (lpString=".dbf") returned 4
	[0086.684] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.684] lstrlenW (lpString=".1cd") returned 4
	[0086.684] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.684] lstrlenW (lpString=".jpg") returned 4
	[0086.685] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.685] lstrlenW (lpString=".doc") returned 4
	[0086.685] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.685] lstrlenW (lpString=".docx") returned 5
	[0086.685] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0086.685] lstrlenW (lpString=".pdf") returned 4
	[0086.685] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.685] lstrlenW (lpString=".xls") returned 4
	[0086.685] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.685] lstrlenW (lpString=".xlsx") returned 5
	[0086.685] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0086.685] lstrlenW (lpString=".ppt") returned 4
	[0086.685] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.685] lstrlenW (lpString=".zip") returned 4
	[0086.685] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.685] lstrlenW (lpString=".rar") returned 4
	[0086.685] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.685] lstrlenW (lpString=".bz2") returned 4
	[0086.685] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.685] lstrlenW (lpString=".7z") returned 3
	[0086.686] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.686] lstrlenW (lpString=".dbf") returned 4
	[0086.686] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.686] lstrlenW (lpString=".1cd") returned 4
	[0086.686] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0086.686] lstrlenW (lpString=".jpg") returned 4
	[0086.686] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.686] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0086.686] lstrlenW (lpString="J0099188.JPG") returned 12
	[0086.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0086.686] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=9080) returned 1
	[0086.687] CloseHandle (hObject=0x35c) returned 1
	[0086.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220
	[0086.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0086.687] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.687] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0086.687] GetLastError () returned 0x0
	[0086.688] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x2378, lpOverlapped=0x0) returned 1
	[0086.689] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x2380, lpOverlapped=0x0) returned 1
	[0086.690] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.690] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.690] SetEndOfFile (hFile=0x318) returned 1
	[0086.691] CloseHandle (hObject=0x318) returned 1
	[0086.691] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.691] SetEndOfFile (hFile=0x35c) returned 1
	[0086.692] CloseHandle (hObject=0x35c) returned 1
	[0086.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1
	[0086.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.692] lstrlenW (lpString=".doc") returned 4
	[0086.692] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.692] lstrlenW (lpString=".docx") returned 5
	[0086.692] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0086.692] lstrlenW (lpString=".pdf") returned 4
	[0086.692] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.692] lstrlenW (lpString=".xls") returned 4
	[0086.692] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.692] lstrlenW (lpString=".xlsx") returned 5
	[0086.692] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0086.693] lstrlenW (lpString=".ppt") returned 4
	[0086.693] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.693] lstrlenW (lpString=".zip") returned 4
	[0086.693] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.693] lstrlenW (lpString=".rar") returned 4
	[0086.693] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.693] lstrlenW (lpString=".bz2") returned 4
	[0086.693] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.693] lstrlenW (lpString=".7z") returned 3
	[0086.693] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.693] lstrlenW (lpString=".dbf") returned 4
	[0086.693] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.693] lstrlenW (lpString=".1cd") returned 4
	[0086.693] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.693] lstrlenW (lpString=".jpg") returned 4
	[0086.693] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.693] lstrlenW (lpString=".doc") returned 4
	[0086.693] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.694] lstrlenW (lpString=".docx") returned 5
	[0086.694] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0086.694] lstrlenW (lpString=".pdf") returned 4
	[0086.694] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.694] lstrlenW (lpString=".xls") returned 4
	[0086.694] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.694] lstrlenW (lpString=".xlsx") returned 5
	[0086.694] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0086.694] lstrlenW (lpString=".ppt") returned 4
	[0086.694] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.694] lstrlenW (lpString=".zip") returned 4
	[0086.694] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.694] lstrlenW (lpString=".rar") returned 4
	[0086.694] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.694] lstrlenW (lpString=".bz2") returned 4
	[0086.694] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.694] lstrlenW (lpString=".7z") returned 3
	[0086.694] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.694] lstrlenW (lpString=".dbf") returned 4
	[0086.694] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.694] lstrlenW (lpString=".1cd") returned 4
	[0086.694] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0086.695] lstrlenW (lpString=".jpg") returned 4
	[0086.695] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.695] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0086.695] lstrlenW (lpString="J0099189.JPG") returned 12
	[0086.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0086.695] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=8076) returned 1
	[0086.695] CloseHandle (hObject=0x35c) returned 1
	[0086.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220
	[0086.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0086.696] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.696] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0086.696] GetLastError () returned 0x0
	[0086.696] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1f8c, lpOverlapped=0x0) returned 1
	[0087.065] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1f90, lpOverlapped=0x0) returned 1
	[0087.066] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.066] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.066] SetEndOfFile (hFile=0x318) returned 1
	[0087.066] CloseHandle (hObject=0x318) returned 1
	[0087.066] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.066] SetEndOfFile (hFile=0x35c) returned 1
	[0087.067] CloseHandle (hObject=0x35c) returned 1
	[0087.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1
	[0087.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.068] lstrlenW (lpString=".doc") returned 4
	[0087.068] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0087.068] lstrlenW (lpString=".docx") returned 5
	[0087.068] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0087.068] lstrlenW (lpString=".pdf") returned 4
	[0087.068] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0087.068] lstrlenW (lpString=".xls") returned 4
	[0087.068] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0087.068] lstrlenW (lpString=".xlsx") returned 5
	[0087.068] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0087.068] lstrlenW (lpString=".ppt") returned 4
	[0087.068] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0087.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.068] lstrlenW (lpString=".zip") returned 4
	[0087.068] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0087.068] lstrlenW (lpString=".rar") returned 4
	[0087.068] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0087.068] lstrlenW (lpString=".bz2") returned 4
	[0087.068] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0087.068] lstrlenW (lpString=".7z") returned 3
	[0087.068] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0087.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.068] lstrlenW (lpString=".dbf") returned 4
	[0087.068] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0087.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.068] lstrlenW (lpString=".1cd") returned 4
	[0087.068] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0087.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.069] lstrlenW (lpString=".jpg") returned 4
	[0087.069] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0087.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.069] lstrlenW (lpString=".doc") returned 4
	[0087.069] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0087.069] lstrlenW (lpString=".docx") returned 5
	[0087.069] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0087.069] lstrlenW (lpString=".pdf") returned 4
	[0087.069] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0087.069] lstrlenW (lpString=".xls") returned 4
	[0087.069] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0087.069] lstrlenW (lpString=".xlsx") returned 5
	[0087.069] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0087.069] lstrlenW (lpString=".ppt") returned 4
	[0087.069] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0087.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.069] lstrlenW (lpString=".zip") returned 4
	[0087.069] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0087.069] lstrlenW (lpString=".rar") returned 4
	[0087.069] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0087.069] lstrlenW (lpString=".bz2") returned 4
	[0087.069] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0087.069] lstrlenW (lpString=".7z") returned 3
	[0087.069] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0087.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.069] lstrlenW (lpString=".dbf") returned 4
	[0087.069] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0087.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.070] lstrlenW (lpString=".1cd") returned 4
	[0087.070] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0087.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0087.070] lstrlenW (lpString=".jpg") returned 4
	[0087.070] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0087.070] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0087.070] lstrlenW (lpString="J0099201.GIF") returned 12
	[0087.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0087.070] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=51401) returned 1
	[0087.070] CloseHandle (hObject=0x35c) returned 1
	[0087.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220
	[0087.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0087.071] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.071] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0087.071] GetLastError () returned 0x0
	[0087.071] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xc8c9, lpOverlapped=0x0) returned 1
	[0087.074] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xc8d0, lpOverlapped=0x0) returned 1
	[0087.076] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.076] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.076] SetEndOfFile (hFile=0x318) returned 1
	[0087.076] CloseHandle (hObject=0x318) returned 1
	[0087.076] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.076] SetEndOfFile (hFile=0x35c) returned 1
	[0087.077] CloseHandle (hObject=0x35c) returned 1
	[0087.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1
	[0087.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.078] lstrlenW (lpString=".doc") returned 4
	[0087.078] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.078] lstrlenW (lpString=".docx") returned 5
	[0087.078] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1
	[0087.078] lstrlenW (lpString=".pdf") returned 4
	[0087.078] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.078] lstrlenW (lpString=".xls") returned 4
	[0087.078] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.078] lstrlenW (lpString=".xlsx") returned 5
	[0087.078] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1
	[0087.078] lstrlenW (lpString=".ppt") returned 4
	[0087.078] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.078] lstrlenW (lpString=".zip") returned 4
	[0087.078] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.078] lstrlenW (lpString=".rar") returned 4
	[0087.078] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.078] lstrlenW (lpString=".bz2") returned 4
	[0087.078] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.078] lstrlenW (lpString=".7z") returned 3
	[0087.079] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.079] lstrlenW (lpString=".dbf") returned 4
	[0087.079] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.079] lstrlenW (lpString=".1cd") returned 4
	[0087.079] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.079] lstrlenW (lpString=".jpg") returned 4
	[0087.079] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.079] lstrlenW (lpString=".doc") returned 4
	[0087.079] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.079] lstrlenW (lpString=".docx") returned 5
	[0087.079] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1
	[0087.079] lstrlenW (lpString=".pdf") returned 4
	[0087.079] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.079] lstrlenW (lpString=".xls") returned 4
	[0087.079] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.079] lstrlenW (lpString=".xlsx") returned 5
	[0087.079] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1
	[0087.079] lstrlenW (lpString=".ppt") returned 4
	[0087.079] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.079] lstrlenW (lpString=".zip") returned 4
	[0087.079] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.079] lstrlenW (lpString=".rar") returned 4
	[0087.080] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.080] lstrlenW (lpString=".bz2") returned 4
	[0087.080] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.080] lstrlenW (lpString=".7z") returned 3
	[0087.080] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.080] lstrlenW (lpString=".dbf") returned 4
	[0087.080] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.080] lstrlenW (lpString=".1cd") returned 4
	[0087.080] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0087.080] lstrlenW (lpString=".jpg") returned 4
	[0087.080] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.080] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0087.080] lstrlenW (lpString="J0099202.GIF") returned 12
	[0087.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0087.081] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=4967) returned 1
	[0087.081] CloseHandle (hObject=0x35c) returned 1
	[0087.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220
	[0087.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0087.081] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.081] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0087.081] GetLastError () returned 0x0
	[0087.082] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x1367, lpOverlapped=0x0) returned 1
	[0087.083] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0087.084] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.084] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.084] SetEndOfFile (hFile=0x318) returned 1
	[0087.084] CloseHandle (hObject=0x318) returned 1
	[0087.084] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.084] SetEndOfFile (hFile=0x35c) returned 1
	[0087.085] CloseHandle (hObject=0x35c) returned 1
	[0087.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1
	[0087.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.086] lstrlenW (lpString=".doc") returned 4
	[0087.086] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.086] lstrlenW (lpString=".docx") returned 5
	[0087.086] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0087.086] lstrlenW (lpString=".pdf") returned 4
	[0087.086] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.086] lstrlenW (lpString=".xls") returned 4
	[0087.086] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.086] lstrlenW (lpString=".xlsx") returned 5
	[0087.086] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0087.086] lstrlenW (lpString=".ppt") returned 4
	[0087.086] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.086] lstrlenW (lpString=".zip") returned 4
	[0087.086] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.086] lstrlenW (lpString=".rar") returned 4
	[0087.086] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.086] lstrlenW (lpString=".bz2") returned 4
	[0087.086] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.086] lstrlenW (lpString=".7z") returned 3
	[0087.086] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.086] lstrlenW (lpString=".dbf") returned 4
	[0087.086] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.086] lstrlenW (lpString=".1cd") returned 4
	[0087.086] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.087] lstrlenW (lpString=".jpg") returned 4
	[0087.087] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.087] lstrlenW (lpString=".doc") returned 4
	[0087.087] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.087] lstrlenW (lpString=".docx") returned 5
	[0087.087] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0087.087] lstrlenW (lpString=".pdf") returned 4
	[0087.087] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.087] lstrlenW (lpString=".xls") returned 4
	[0087.087] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.087] lstrlenW (lpString=".xlsx") returned 5
	[0087.087] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0087.087] lstrlenW (lpString=".ppt") returned 4
	[0087.087] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.087] lstrlenW (lpString=".zip") returned 4
	[0087.087] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.087] lstrlenW (lpString=".rar") returned 4
	[0087.087] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.087] lstrlenW (lpString=".bz2") returned 4
	[0087.087] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.087] lstrlenW (lpString=".7z") returned 3
	[0087.087] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.087] lstrlenW (lpString=".dbf") returned 4
	[0087.087] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.088] lstrlenW (lpString=".1cd") returned 4
	[0087.088] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0087.088] lstrlenW (lpString=".jpg") returned 4
	[0087.088] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.088] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0087.088] lstrlenW (lpString="J0099203.GIF") returned 12
	[0087.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0087.089] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3904) returned 1
	[0087.089] CloseHandle (hObject=0x35c) returned 1
	[0087.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220
	[0087.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0087.089] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.089] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0087.090] GetLastError () returned 0x0
	[0087.090] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0xf40, lpOverlapped=0x0) returned 1
	[0087.091] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xf50, lpOverlapped=0x0) returned 1
	[0087.092] ReadFile (in: hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.092] WriteFile (in: hFile=0x318, lpBuffer=0x3da2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x3da2020*, lpNumberOfBytesWritten=0x266fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.092] SetEndOfFile (hFile=0x318) returned 1
	[0087.092] CloseHandle (hObject=0x318) returned 1
	[0087.092] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.093] SetEndOfFile (hFile=0x35c) returned 1
	[0087.093] CloseHandle (hObject=0x35c) returned 1
	[0087.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1
	[0087.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.094] lstrlenW (lpString=".doc") returned 4
	[0087.094] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.094] lstrlenW (lpString=".docx") returned 5
	[0087.094] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0087.094] lstrlenW (lpString=".pdf") returned 4
	[0087.094] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.094] lstrlenW (lpString=".xls") returned 4
	[0087.094] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.094] lstrlenW (lpString=".xlsx") returned 5
	[0087.094] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0087.094] lstrlenW (lpString=".ppt") returned 4
	[0087.094] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.094] lstrlenW (lpString=".zip") returned 4
	[0087.094] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.094] lstrlenW (lpString=".rar") returned 4
	[0087.095] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.095] lstrlenW (lpString=".bz2") returned 4
	[0087.095] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.095] lstrlenW (lpString=".7z") returned 3
	[0087.095] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.095] lstrlenW (lpString=".dbf") returned 4
	[0087.095] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.095] lstrlenW (lpString=".1cd") returned 4
	[0087.095] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.095] lstrlenW (lpString=".jpg") returned 4
	[0087.095] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.095] lstrlenW (lpString=".doc") returned 4
	[0087.095] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.095] lstrlenW (lpString=".docx") returned 5
	[0087.095] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0087.095] lstrlenW (lpString=".pdf") returned 4
	[0087.095] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.095] lstrlenW (lpString=".xls") returned 4
	[0087.095] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.095] lstrlenW (lpString=".xlsx") returned 5
	[0087.095] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0087.095] lstrlenW (lpString=".ppt") returned 4
	[0087.095] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.096] lstrlenW (lpString=".zip") returned 4
	[0087.096] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.096] lstrlenW (lpString=".rar") returned 4
	[0087.096] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.096] lstrlenW (lpString=".bz2") returned 4
	[0087.096] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.096] lstrlenW (lpString=".7z") returned 3
	[0087.096] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.096] lstrlenW (lpString=".dbf") returned 4
	[0087.096] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.096] lstrlenW (lpString=".1cd") returned 4
	[0087.096] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0087.096] lstrlenW (lpString=".jpg") returned 4
	[0087.096] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.096] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0087.096] lstrlenW (lpString="J0099204.WMF") returned 12
	[0087.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0087.097] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=17854) returned 1
	[0087.097] CloseHandle (hObject=0x35c) returned 1
	[0087.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220
	[0087.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0087.097] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.097] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0087.098] GetLastError () returned 0x0
	[0087.098] ReadFile (hFile=0x35c, lpBuffer=0x3da2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0) 

Thread:
	id = 9
	os_tid = 0xdd8

	[0055.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x68de68
	[0055.892] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x6a0a90
	[0055.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66ef60
	[0055.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x6) returned 0x69f158
	[0055.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f128
	[0055.893] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x100000) returned 0x3339020
	[0055.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f200
	[0055.896] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f200, Size=0x20) returned 0x6311f0
	[0055.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f230
	[0055.896] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f230, Size=0x20) returned 0x631178
	[0055.896] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0055.896] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0055.896] Wow64DisableWow64FsRedirection (in: OldValue=0x2a2ff50 | out: OldValue=0x2a2ff50*=0x0) returned 1
	[0055.896] lstrlenW (lpString="kernel32.dll") returned 12
	[0055.896] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6311f0 | out: hHeap=0x600000) returned 1
	[0055.896] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0055.897] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631178 | out: hHeap=0x600000) returned 1
	[0055.897] Sleep (dwMilliseconds=0x64) 
	[0057.284] Sleep (dwMilliseconds=0x64) 
	[0057.630] Sleep (dwMilliseconds=0x64) 
	[0058.008] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0058.008] lstrlenW (lpString="eula.rtf") returned 8
	[0058.008] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0058.008] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=6309) returned 1
	[0058.008] CloseHandle (hObject=0x2fc) returned 1
	[0058.009] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80
	[0058.009] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.009] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0058.009] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.009] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.009] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0058.012] GetLastError () returned 0x0
	[0058.012] ReadFile (in: hFile=0x2fc, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x18a5, lpOverlapped=0x0) returned 1
	[0058.028] WriteFile (in: hFile=0x300, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x18b0, lpOverlapped=0x0) returned 1
	[0058.029] ReadFile (in: hFile=0x2fc, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.029] WriteFile (in: hFile=0x300, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0058.029] SetEndOfFile (hFile=0x300) returned 1
	[0058.029] CloseHandle (hObject=0x300) returned 1
	[0058.030] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.030] SetEndOfFile (hFile=0x2fc) returned 1
	[0058.031] CloseHandle (hObject=0x2fc) returned 1
	[0058.031] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.031] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1
	[0058.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.031] lstrlenW (lpString=".doc") returned 4
	[0058.031] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.032] lstrlenW (lpString=".docx") returned 5
	[0058.032] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.032] lstrlenW (lpString=".pdf") returned 4
	[0058.032] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.032] lstrlenW (lpString=".xls") returned 4
	[0058.032] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.032] lstrlenW (lpString=".xlsx") returned 5
	[0058.032] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.032] lstrlenW (lpString=".ppt") returned 4
	[0058.032] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.032] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.032] lstrlenW (lpString=".zip") returned 4
	[0058.032] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.032] lstrlenW (lpString=".rar") returned 4
	[0058.032] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.032] lstrlenW (lpString=".bz2") returned 4
	[0058.032] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.032] lstrlenW (lpString=".7z") returned 3
	[0058.032] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.032] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.032] lstrlenW (lpString=".dbf") returned 4
	[0058.032] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.032] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.032] lstrlenW (lpString=".1cd") returned 4
	[0058.032] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.032] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.032] lstrlenW (lpString=".jpg") returned 4
	[0058.032] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.033] lstrlenW (lpString=".doc") returned 4
	[0058.033] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.033] lstrlenW (lpString=".docx") returned 5
	[0058.033] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.033] lstrlenW (lpString=".pdf") returned 4
	[0058.033] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.033] lstrlenW (lpString=".xls") returned 4
	[0058.033] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.033] lstrlenW (lpString=".xlsx") returned 5
	[0058.033] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.033] lstrlenW (lpString=".ppt") returned 4
	[0058.033] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.033] lstrlenW (lpString=".zip") returned 4
	[0058.033] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.033] lstrlenW (lpString=".rar") returned 4
	[0058.033] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.033] lstrlenW (lpString=".bz2") returned 4
	[0058.033] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.033] lstrlenW (lpString=".7z") returned 3
	[0058.033] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.034] lstrlenW (lpString=".dbf") returned 4
	[0058.034] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.034] lstrlenW (lpString=".1cd") returned 4
	[0058.034] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0058.034] lstrlenW (lpString=".jpg") returned 4
	[0058.034] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.034] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0058.034] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0058.034] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.043] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=60816) returned 1
	[0058.043] CloseHandle (hObject=0x2f0) returned 1
	[0058.043] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80
	[0058.043] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.043] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.043] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.043] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.043] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0058.044] GetLastError () returned 0x0
	[0058.044] ReadFile (in: hFile=0x2f0, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xed90, lpOverlapped=0x0) returned 1
	[0058.057] WriteFile (in: hFile=0x304, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xeda0, lpOverlapped=0x0) returned 1
	[0058.059] ReadFile (in: hFile=0x2f0, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.059] WriteFile (in: hFile=0x304, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0058.059] SetEndOfFile (hFile=0x304) returned 1
	[0058.060] CloseHandle (hObject=0x304) returned 1
	[0058.061] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.062] SetEndOfFile (hFile=0x2f0) returned 1
	[0058.581] CloseHandle (hObject=0x2f0) returned 1
	[0058.581] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.582] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1
	[0058.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.583] lstrlenW (lpString=".doc") returned 4
	[0058.583] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.583] lstrlenW (lpString=".docx") returned 5
	[0058.583] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.583] lstrlenW (lpString=".pdf") returned 4
	[0058.583] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.583] lstrlenW (lpString=".xls") returned 4
	[0058.583] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.583] lstrlenW (lpString=".xlsx") returned 5
	[0058.583] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.583] lstrlenW (lpString=".ppt") returned 4
	[0058.583] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.583] lstrlenW (lpString=".zip") returned 4
	[0058.583] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.583] lstrlenW (lpString=".rar") returned 4
	[0058.583] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.583] lstrlenW (lpString=".bz2") returned 4
	[0058.583] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.584] lstrlenW (lpString=".7z") returned 3
	[0058.584] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.584] lstrlenW (lpString=".dbf") returned 4
	[0058.584] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.584] lstrlenW (lpString=".1cd") returned 4
	[0058.584] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.584] lstrlenW (lpString=".jpg") returned 4
	[0058.584] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.584] lstrlenW (lpString=".doc") returned 4
	[0058.584] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.584] lstrlenW (lpString=".docx") returned 5
	[0058.584] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.584] lstrlenW (lpString=".pdf") returned 4
	[0058.584] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.584] lstrlenW (lpString=".xls") returned 4
	[0058.584] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.584] lstrlenW (lpString=".xlsx") returned 5
	[0058.584] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.584] lstrlenW (lpString=".ppt") returned 4
	[0058.584] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.585] lstrlenW (lpString=".zip") returned 4
	[0058.585] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.585] lstrlenW (lpString=".rar") returned 4
	[0058.585] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.585] lstrlenW (lpString=".bz2") returned 4
	[0058.585] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.585] lstrlenW (lpString=".7z") returned 3
	[0058.585] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.585] lstrlenW (lpString=".dbf") returned 4
	[0058.585] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.585] lstrlenW (lpString=".1cd") returned 4
	[0058.585] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0058.585] lstrlenW (lpString=".jpg") returned 4
	[0058.585] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.585] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0058.585] lstrlenW (lpString="eula.rtf") returned 8
	[0058.585] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.586] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=8876) returned 1
	[0058.586] CloseHandle (hObject=0x2f0) returned 1
	[0058.586] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80
	[0058.586] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.586] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.587] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.587] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.587] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0058.588] GetLastError () returned 0x0
	[0058.589] ReadFile (in: hFile=0x2f0, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x22ac, lpOverlapped=0x0) returned 1
	[0058.593] WriteFile (in: hFile=0x2f4, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x22b0, lpOverlapped=0x0) returned 1
	[0058.594] ReadFile (in: hFile=0x2f0, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.594] WriteFile (in: hFile=0x2f4, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0058.594] SetEndOfFile (hFile=0x2f4) returned 1
	[0058.594] CloseHandle (hObject=0x2f4) returned 1
	[0058.595] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.595] SetEndOfFile (hFile=0x2f0) returned 1
	[0058.596] CloseHandle (hObject=0x2f0) returned 1
	[0058.596] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.597] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1
	[0058.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.597] lstrlenW (lpString=".doc") returned 4
	[0058.597] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.597] lstrlenW (lpString=".docx") returned 5
	[0058.597] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.597] lstrlenW (lpString=".pdf") returned 4
	[0058.597] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.597] lstrlenW (lpString=".xls") returned 4
	[0058.597] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.597] lstrlenW (lpString=".xlsx") returned 5
	[0058.597] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.597] lstrlenW (lpString=".ppt") returned 4
	[0058.597] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.597] lstrlenW (lpString=".zip") returned 4
	[0058.597] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.598] lstrlenW (lpString=".rar") returned 4
	[0058.598] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.598] lstrlenW (lpString=".bz2") returned 4
	[0058.598] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.598] lstrlenW (lpString=".7z") returned 3
	[0058.598] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.598] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.598] lstrlenW (lpString=".dbf") returned 4
	[0058.598] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.598] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.598] lstrlenW (lpString=".1cd") returned 4
	[0058.598] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.598] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.598] lstrlenW (lpString=".jpg") returned 4
	[0058.598] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.598] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.598] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.598] lstrlenW (lpString=".doc") returned 4
	[0058.600] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.600] lstrlenW (lpString=".docx") returned 5
	[0058.600] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.600] lstrlenW (lpString=".pdf") returned 4
	[0058.600] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.600] lstrlenW (lpString=".xls") returned 4
	[0058.600] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.600] lstrlenW (lpString=".xlsx") returned 5
	[0058.600] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.600] lstrlenW (lpString=".ppt") returned 4
	[0058.600] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.600] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.600] lstrlenW (lpString=".zip") returned 4
	[0058.600] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.601] lstrlenW (lpString=".rar") returned 4
	[0058.601] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.601] lstrlenW (lpString=".bz2") returned 4
	[0058.601] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.601] lstrlenW (lpString=".7z") returned 3
	[0058.601] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.601] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.601] lstrlenW (lpString=".dbf") returned 4
	[0058.601] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.601] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.601] lstrlenW (lpString=".1cd") returned 4
	[0058.601] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.601] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0058.601] lstrlenW (lpString=".jpg") returned 4
	[0058.601] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.601] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0058.601] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0058.601] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.602] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=86284) returned 1
	[0058.602] CloseHandle (hObject=0x2f0) returned 1
	[0058.602] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80
	[0058.602] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.602] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0058.602] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.602] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.602] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0058.602] GetLastError () returned 0x0
	[0058.602] ReadFile (in: hFile=0x2f0, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1510c, lpOverlapped=0x0) returned 1
	[0058.605] WriteFile (in: hFile=0x2f4, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x15110, lpOverlapped=0x0) returned 1
	[0058.608] ReadFile (in: hFile=0x2f0, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.608] WriteFile (in: hFile=0x2f4, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0058.608] SetEndOfFile (hFile=0x2f4) returned 1
	[0058.608] CloseHandle (hObject=0x2f4) returned 1
	[0058.610] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.610] SetEndOfFile (hFile=0x2f0) returned 1
	[0058.612] CloseHandle (hObject=0x2f0) returned 1
	[0058.612] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.612] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1
	[0058.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0058.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0058.612] lstrlenW (lpString=".doc") returned 4
	[0058.612] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.612] lstrlenW (lpString=".docx") returned 5
	[0058.612] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.612] lstrlenW (lpString=".pdf") returned 4
	[0058.613] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.613] lstrlenW (lpString=".xls") returned 4
	[0058.613] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.613] lstrlenW (lpString=".xlsx") returned 5
	[0058.613] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.613] lstrlenW (lpString=".ppt") returned 4
	[0058.613] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0058.613] lstrlenW (lpString=".zip") returned 4
	[0058.613] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.613] lstrlenW (lpString=".rar") returned 4
	[0058.613] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.613] lstrlenW (lpString=".bz2") returned 4
	[0058.613] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.613] lstrlenW (lpString=".7z") returned 3
	[0058.613] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0058.613] lstrlenW (lpString=".dbf") returned 4
	[0058.613] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0058.613] lstrlenW (lpString=".1cd") returned 4
	[0058.613] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0058.613] lstrlenW (lpString=".jpg") returned 4
	[0058.613] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0058.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0058.614] lstrlenW (lpString=".doc") returned 4
	[0058.614] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.614] lstrlenW (lpString=".docx") returned 5
	[0058.614] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.614] lstrlenW (lpString=".pdf") returned 4
	[0058.614] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.614] lstrlenW (lpString=".xls") returned 4
	[0058.614] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.614] lstrlenW (lpString=".xlsx") returned 5
	[0058.614] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.614] lstrlenW (lpString=".ppt") returned 4
	[0059.115] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.115] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0059.115] lstrlenW (lpString=".zip") returned 4
	[0059.116] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.116] lstrlenW (lpString=".rar") returned 4
	[0059.116] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.116] lstrlenW (lpString=".bz2") returned 4
	[0059.117] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.117] lstrlenW (lpString=".7z") returned 3
	[0059.117] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0059.117] lstrlenW (lpString=".dbf") returned 4
	[0059.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0059.117] lstrlenW (lpString=".1cd") returned 4
	[0059.117] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0059.117] lstrlenW (lpString=".jpg") returned 4
	[0059.117] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.117] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0059.118] lstrlenW (lpString="eula.rtf") returned 8
	[0059.118] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0059.118] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3702) returned 1
	[0059.118] CloseHandle (hObject=0x31c) returned 1
	[0059.118] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80
	[0059.118] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.118] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0059.118] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.119] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.120] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0059.121] GetLastError () returned 0x0
	[0059.122] ReadFile (in: hFile=0x31c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xe76, lpOverlapped=0x0) returned 1
	[0059.123] WriteFile (in: hFile=0x320, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe80, lpOverlapped=0x0) returned 1
	[0059.124] ReadFile (in: hFile=0x31c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.124] WriteFile (in: hFile=0x320, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0059.125] SetEndOfFile (hFile=0x320) returned 1
	[0059.125] CloseHandle (hObject=0x320) returned 1
	[0059.126] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.126] SetEndOfFile (hFile=0x31c) returned 1
	[0059.127] CloseHandle (hObject=0x31c) returned 1
	[0059.127] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.127] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1
	[0059.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.128] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.128] lstrlenW (lpString=".doc") returned 4
	[0059.128] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.128] lstrlenW (lpString=".docx") returned 5
	[0059.128] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.128] lstrlenW (lpString=".pdf") returned 4
	[0059.128] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.128] lstrlenW (lpString=".xls") returned 4
	[0059.128] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.128] lstrlenW (lpString=".xlsx") returned 5
	[0059.128] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.128] lstrlenW (lpString=".ppt") returned 4
	[0059.128] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.128] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.128] lstrlenW (lpString=".zip") returned 4
	[0059.128] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.128] lstrlenW (lpString=".rar") returned 4
	[0059.128] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.128] lstrlenW (lpString=".bz2") returned 4
	[0059.128] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.128] lstrlenW (lpString=".7z") returned 3
	[0059.129] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.129] lstrlenW (lpString=".dbf") returned 4
	[0059.129] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.129] lstrlenW (lpString=".1cd") returned 4
	[0059.129] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.129] lstrlenW (lpString=".jpg") returned 4
	[0059.129] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.129] lstrlenW (lpString=".doc") returned 4
	[0059.129] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.129] lstrlenW (lpString=".docx") returned 5
	[0059.129] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.129] lstrlenW (lpString=".pdf") returned 4
	[0059.129] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.130] lstrlenW (lpString=".xls") returned 4
	[0059.130] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.130] lstrlenW (lpString=".xlsx") returned 5
	[0059.130] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.130] lstrlenW (lpString=".ppt") returned 4
	[0059.130] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.130] lstrlenW (lpString=".zip") returned 4
	[0059.130] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.130] lstrlenW (lpString=".rar") returned 4
	[0059.130] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.130] lstrlenW (lpString=".bz2") returned 4
	[0059.130] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.130] lstrlenW (lpString=".7z") returned 3
	[0059.130] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.130] lstrlenW (lpString=".dbf") returned 4
	[0059.130] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.131] lstrlenW (lpString=".1cd") returned 4
	[0059.131] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0059.131] lstrlenW (lpString=".jpg") returned 4
	[0059.131] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.131] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0059.131] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0059.131] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0059.132] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=77022) returned 1
	[0059.132] CloseHandle (hObject=0x31c) returned 1
	[0059.132] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80
	[0059.132] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.132] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0059.132] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.132] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.132] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0059.132] GetLastError () returned 0x0
	[0059.132] ReadFile (in: hFile=0x31c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x12cde, lpOverlapped=0x0) returned 1
	[0059.135] WriteFile (in: hFile=0x320, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x12ce0, lpOverlapped=0x0) returned 1
	[0059.137] ReadFile (in: hFile=0x31c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.138] WriteFile (in: hFile=0x320, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0059.138] SetEndOfFile (hFile=0x320) returned 1
	[0059.138] CloseHandle (hObject=0x320) returned 1
	[0059.140] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.140] SetEndOfFile (hFile=0x31c) returned 1
	[0059.142] CloseHandle (hObject=0x31c) returned 1
	[0059.142] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.142] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1
	[0059.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.142] lstrlenW (lpString=".doc") returned 4
	[0059.143] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.143] lstrlenW (lpString=".docx") returned 5
	[0059.143] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.143] lstrlenW (lpString=".pdf") returned 4
	[0059.143] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.143] lstrlenW (lpString=".xls") returned 4
	[0059.143] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.143] lstrlenW (lpString=".xlsx") returned 5
	[0059.143] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.143] lstrlenW (lpString=".ppt") returned 4
	[0059.143] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.143] lstrlenW (lpString=".zip") returned 4
	[0059.143] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.143] lstrlenW (lpString=".rar") returned 4
	[0059.143] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.143] lstrlenW (lpString=".bz2") returned 4
	[0059.143] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.143] lstrlenW (lpString=".7z") returned 3
	[0059.143] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.143] lstrlenW (lpString=".dbf") returned 4
	[0059.143] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.143] lstrlenW (lpString=".1cd") returned 4
	[0059.143] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.144] lstrlenW (lpString=".jpg") returned 4
	[0059.144] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.144] lstrlenW (lpString=".doc") returned 4
	[0059.144] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.144] lstrlenW (lpString=".docx") returned 5
	[0059.144] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.144] lstrlenW (lpString=".pdf") returned 4
	[0059.144] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.144] lstrlenW (lpString=".xls") returned 4
	[0059.144] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.144] lstrlenW (lpString=".xlsx") returned 5
	[0059.144] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.144] lstrlenW (lpString=".ppt") returned 4
	[0059.144] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.144] lstrlenW (lpString=".zip") returned 4
	[0059.144] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.144] lstrlenW (lpString=".rar") returned 4
	[0059.144] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.144] lstrlenW (lpString=".bz2") returned 4
	[0059.145] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.145] lstrlenW (lpString=".7z") returned 3
	[0059.145] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.145] lstrlenW (lpString=".dbf") returned 4
	[0059.145] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.145] lstrlenW (lpString=".1cd") returned 4
	[0059.145] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0059.145] lstrlenW (lpString=".jpg") returned 4
	[0059.145] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.145] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0059.145] lstrlenW (lpString="eula.rtf") returned 8
	[0059.145] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0059.146] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3526) returned 1
	[0059.146] CloseHandle (hObject=0x31c) returned 1
	[0059.146] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80
	[0059.146] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.147] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0059.147] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.147] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.147] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0059.149] GetLastError () returned 0x0
	[0059.149] ReadFile (in: hFile=0x31c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xdc6, lpOverlapped=0x0) returned 1
	[0059.150] WriteFile (in: hFile=0x320, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xdd0, lpOverlapped=0x0) returned 1
	[0059.151] ReadFile (in: hFile=0x31c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.151] WriteFile (in: hFile=0x320, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0059.151] SetEndOfFile (hFile=0x320) returned 1
	[0059.151] CloseHandle (hObject=0x320) returned 1
	[0059.152] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.152] SetEndOfFile (hFile=0x31c) returned 1
	[0059.153] CloseHandle (hObject=0x31c) returned 1
	[0059.153] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.154] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1
	[0059.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.154] lstrlenW (lpString=".doc") returned 4
	[0059.154] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.154] lstrlenW (lpString=".docx") returned 5
	[0059.154] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.154] lstrlenW (lpString=".pdf") returned 4
	[0059.154] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.154] lstrlenW (lpString=".xls") returned 4
	[0059.154] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.154] lstrlenW (lpString=".xlsx") returned 5
	[0059.154] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.155] lstrlenW (lpString=".ppt") returned 4
	[0059.155] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.155] lstrlenW (lpString=".zip") returned 4
	[0059.155] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.155] lstrlenW (lpString=".rar") returned 4
	[0059.155] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.155] lstrlenW (lpString=".bz2") returned 4
	[0059.155] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.155] lstrlenW (lpString=".7z") returned 3
	[0059.155] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.155] lstrlenW (lpString=".dbf") returned 4
	[0059.155] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.155] lstrlenW (lpString=".1cd") returned 4
	[0059.155] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.155] lstrlenW (lpString=".jpg") returned 4
	[0059.156] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.156] lstrlenW (lpString=".doc") returned 4
	[0059.156] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.156] lstrlenW (lpString=".docx") returned 5
	[0059.156] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.156] lstrlenW (lpString=".pdf") returned 4
	[0059.156] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.156] lstrlenW (lpString=".xls") returned 4
	[0059.156] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.156] lstrlenW (lpString=".xlsx") returned 5
	[0059.156] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.156] lstrlenW (lpString=".ppt") returned 4
	[0059.156] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.156] lstrlenW (lpString=".zip") returned 4
	[0059.156] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.156] lstrlenW (lpString=".rar") returned 4
	[0059.156] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.157] lstrlenW (lpString=".bz2") returned 4
	[0059.157] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.157] lstrlenW (lpString=".7z") returned 3
	[0059.157] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.157] lstrlenW (lpString=".dbf") returned 4
	[0059.157] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.157] lstrlenW (lpString=".1cd") returned 4
	[0059.157] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0059.157] lstrlenW (lpString=".jpg") returned 4
	[0059.157] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.157] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0059.158] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0059.158] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0059.158] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=82962) returned 1
	[0059.158] CloseHandle (hObject=0x31c) returned 1
	[0059.158] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80
	[0059.158] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.158] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0059.158] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.158] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.159] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0059.159] GetLastError () returned 0x0
	[0059.159] ReadFile (in: hFile=0x31c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x14412, lpOverlapped=0x0) returned 1
	[0059.466] WriteFile (in: hFile=0x320, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x14420, lpOverlapped=0x0) returned 1
	[0059.469] ReadFile (in: hFile=0x31c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.469] WriteFile (in: hFile=0x320, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0059.469] SetEndOfFile (hFile=0x320) returned 1
	[0059.469] CloseHandle (hObject=0x320) returned 1
	[0059.472] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.472] SetEndOfFile (hFile=0x31c) returned 1
	[0059.473] CloseHandle (hObject=0x31c) returned 1
	[0059.474] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.474] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1
	[0059.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.474] lstrlenW (lpString=".doc") returned 4
	[0059.474] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.474] lstrlenW (lpString=".docx") returned 5
	[0059.474] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.474] lstrlenW (lpString=".pdf") returned 4
	[0059.474] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.475] lstrlenW (lpString=".xls") returned 4
	[0059.475] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.475] lstrlenW (lpString=".xlsx") returned 5
	[0059.475] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.475] lstrlenW (lpString=".ppt") returned 4
	[0059.475] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.475] lstrlenW (lpString=".zip") returned 4
	[0059.475] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.475] lstrlenW (lpString=".rar") returned 4
	[0059.475] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.475] lstrlenW (lpString=".bz2") returned 4
	[0059.475] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.475] lstrlenW (lpString=".7z") returned 3
	[0059.475] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.475] lstrlenW (lpString=".dbf") returned 4
	[0059.475] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.475] lstrlenW (lpString=".1cd") returned 4
	[0059.475] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.475] lstrlenW (lpString=".jpg") returned 4
	[0059.475] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.476] lstrlenW (lpString=".doc") returned 4
	[0059.476] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.476] lstrlenW (lpString=".docx") returned 5
	[0059.476] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.476] lstrlenW (lpString=".pdf") returned 4
	[0059.476] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.476] lstrlenW (lpString=".xls") returned 4
	[0059.476] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.476] lstrlenW (lpString=".xlsx") returned 5
	[0059.476] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.476] lstrlenW (lpString=".ppt") returned 4
	[0059.476] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.476] lstrlenW (lpString=".zip") returned 4
	[0059.476] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.476] lstrlenW (lpString=".rar") returned 4
	[0059.476] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.476] lstrlenW (lpString=".bz2") returned 4
	[0059.476] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.476] lstrlenW (lpString=".7z") returned 3
	[0059.476] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.476] lstrlenW (lpString=".dbf") returned 4
	[0059.476] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.477] lstrlenW (lpString=".1cd") returned 4
	[0059.477] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.477] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0059.477] lstrlenW (lpString=".jpg") returned 4
	[0059.477] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.477] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0059.477] lstrlenW (lpString="eula.rtf") returned 8
	[0059.477] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0059.557] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=6851) returned 1
	[0059.630] CloseHandle (hObject=0x31c) returned 1
	[0059.663] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80
	[0059.663] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.663] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.663] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.663] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.663] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.022] GetLastError () returned 0x0
	[0060.022] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1ac3, lpOverlapped=0x0) returned 1
	[0060.023] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1ad0, lpOverlapped=0x0) returned 1
	[0060.024] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.024] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.024] SetEndOfFile (hFile=0x33c) returned 1
	[0060.025] CloseHandle (hObject=0x33c) returned 1
	[0060.025] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.025] SetEndOfFile (hFile=0x314) returned 1
	[0060.026] CloseHandle (hObject=0x314) returned 1
	[0060.026] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.027] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1
	[0060.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.027] lstrlenW (lpString=".doc") returned 4
	[0060.027] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.027] lstrlenW (lpString=".docx") returned 5
	[0060.027] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.027] lstrlenW (lpString=".pdf") returned 4
	[0060.027] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.027] lstrlenW (lpString=".xls") returned 4
	[0060.027] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.027] lstrlenW (lpString=".xlsx") returned 5
	[0060.027] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.027] lstrlenW (lpString=".ppt") returned 4
	[0060.027] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.027] lstrlenW (lpString=".zip") returned 4
	[0060.027] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.027] lstrlenW (lpString=".rar") returned 4
	[0060.027] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.028] lstrlenW (lpString=".bz2") returned 4
	[0060.028] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.028] lstrlenW (lpString=".7z") returned 3
	[0060.028] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.028] lstrlenW (lpString=".dbf") returned 4
	[0060.028] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.028] lstrlenW (lpString=".1cd") returned 4
	[0060.028] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.028] lstrlenW (lpString=".jpg") returned 4
	[0060.028] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.028] lstrlenW (lpString=".doc") returned 4
	[0060.028] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.028] lstrlenW (lpString=".docx") returned 5
	[0060.028] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.028] lstrlenW (lpString=".pdf") returned 4
	[0060.028] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.028] lstrlenW (lpString=".xls") returned 4
	[0060.028] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.028] lstrlenW (lpString=".xlsx") returned 5
	[0060.028] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.028] lstrlenW (lpString=".ppt") returned 4
	[0060.028] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.029] lstrlenW (lpString=".zip") returned 4
	[0060.029] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.029] lstrlenW (lpString=".rar") returned 4
	[0060.029] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.029] lstrlenW (lpString=".bz2") returned 4
	[0060.029] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.029] lstrlenW (lpString=".7z") returned 3
	[0060.029] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.029] lstrlenW (lpString=".dbf") returned 4
	[0060.029] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.029] lstrlenW (lpString=".1cd") returned 4
	[0060.029] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0060.029] lstrlenW (lpString=".jpg") returned 4
	[0060.029] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.029] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.029] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.031] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=81482) returned 1
	[0060.031] CloseHandle (hObject=0x314) returned 1
	[0060.031] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80
	[0060.031] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.031] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.031] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.031] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.031] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.031] GetLastError () returned 0x0
	[0060.031] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x13e4a, lpOverlapped=0x0) returned 1
	[0060.034] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e50, lpOverlapped=0x0) returned 1
	[0060.036] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.036] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.037] SetEndOfFile (hFile=0x33c) returned 1
	[0060.037] CloseHandle (hObject=0x33c) returned 1
	[0060.039] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.039] SetEndOfFile (hFile=0x314) returned 1
	[0060.040] CloseHandle (hObject=0x314) returned 1
	[0060.040] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.040] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1
	[0060.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.041] lstrlenW (lpString=".doc") returned 4
	[0060.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.041] lstrlenW (lpString=".docx") returned 5
	[0060.041] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.041] lstrlenW (lpString=".pdf") returned 4
	[0060.041] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.041] lstrlenW (lpString=".xls") returned 4
	[0060.041] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.041] lstrlenW (lpString=".xlsx") returned 5
	[0060.041] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.041] lstrlenW (lpString=".ppt") returned 4
	[0060.041] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.041] lstrlenW (lpString=".zip") returned 4
	[0060.041] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.041] lstrlenW (lpString=".rar") returned 4
	[0060.041] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.041] lstrlenW (lpString=".bz2") returned 4
	[0060.041] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.041] lstrlenW (lpString=".7z") returned 3
	[0060.041] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.041] lstrlenW (lpString=".dbf") returned 4
	[0060.041] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.041] lstrlenW (lpString=".1cd") returned 4
	[0060.042] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.042] lstrlenW (lpString=".jpg") returned 4
	[0060.042] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.042] lstrlenW (lpString=".doc") returned 4
	[0060.042] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.042] lstrlenW (lpString=".docx") returned 5
	[0060.042] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.042] lstrlenW (lpString=".pdf") returned 4
	[0060.042] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.042] lstrlenW (lpString=".xls") returned 4
	[0060.042] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.042] lstrlenW (lpString=".xlsx") returned 5
	[0060.043] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.043] lstrlenW (lpString=".ppt") returned 4
	[0060.043] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.043] lstrlenW (lpString=".zip") returned 4
	[0060.043] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.043] lstrlenW (lpString=".rar") returned 4
	[0060.043] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.043] lstrlenW (lpString=".bz2") returned 4
	[0060.043] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.043] lstrlenW (lpString=".7z") returned 3
	[0060.043] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.043] lstrlenW (lpString=".dbf") returned 4
	[0060.043] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.043] lstrlenW (lpString=".1cd") returned 4
	[0060.043] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0060.043] lstrlenW (lpString=".jpg") returned 4
	[0060.043] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.043] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0060.043] lstrlenW (lpString="eula.rtf") returned 8
	[0060.044] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.044] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3865) returned 1
	[0060.044] CloseHandle (hObject=0x314) returned 1
	[0060.044] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80
	[0060.044] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.044] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.044] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.044] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.044] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.046] GetLastError () returned 0x0
	[0060.046] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xf19, lpOverlapped=0x0) returned 1
	[0060.047] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf20, lpOverlapped=0x0) returned 1
	[0060.049] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.049] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.049] SetEndOfFile (hFile=0x33c) returned 1
	[0060.049] CloseHandle (hObject=0x33c) returned 1
	[0060.050] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.050] SetEndOfFile (hFile=0x314) returned 1
	[0060.051] CloseHandle (hObject=0x314) returned 1
	[0060.051] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.051] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1
	[0060.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.051] lstrlenW (lpString=".doc") returned 4
	[0060.051] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.051] lstrlenW (lpString=".docx") returned 5
	[0060.051] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.051] lstrlenW (lpString=".pdf") returned 4
	[0060.051] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.051] lstrlenW (lpString=".xls") returned 4
	[0060.051] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.051] lstrlenW (lpString=".xlsx") returned 5
	[0060.051] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.051] lstrlenW (lpString=".ppt") returned 4
	[0060.052] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.052] lstrlenW (lpString=".zip") returned 4
	[0060.052] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.052] lstrlenW (lpString=".rar") returned 4
	[0060.052] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.052] lstrlenW (lpString=".bz2") returned 4
	[0060.052] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.052] lstrlenW (lpString=".7z") returned 3
	[0060.052] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.052] lstrlenW (lpString=".dbf") returned 4
	[0060.052] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.052] lstrlenW (lpString=".1cd") returned 4
	[0060.052] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.052] lstrlenW (lpString=".jpg") returned 4
	[0060.052] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.052] lstrlenW (lpString=".doc") returned 4
	[0060.052] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.052] lstrlenW (lpString=".docx") returned 5
	[0060.052] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.052] lstrlenW (lpString=".pdf") returned 4
	[0060.052] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.052] lstrlenW (lpString=".xls") returned 4
	[0060.053] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.053] lstrlenW (lpString=".xlsx") returned 5
	[0060.053] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.053] lstrlenW (lpString=".ppt") returned 4
	[0060.053] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.053] lstrlenW (lpString=".zip") returned 4
	[0060.053] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.053] lstrlenW (lpString=".rar") returned 4
	[0060.053] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.053] lstrlenW (lpString=".bz2") returned 4
	[0060.053] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.053] lstrlenW (lpString=".7z") returned 3
	[0060.053] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.053] lstrlenW (lpString=".dbf") returned 4
	[0060.053] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.053] lstrlenW (lpString=".1cd") returned 4
	[0060.053] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0060.053] lstrlenW (lpString=".jpg") returned 4
	[0060.053] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.054] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.054] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.054] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.054] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=77680) returned 1
	[0060.054] CloseHandle (hObject=0x314) returned 1
	[0060.054] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80
	[0060.054] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.054] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.054] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.054] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.054] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.054] GetLastError () returned 0x0
	[0060.054] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x12f70, lpOverlapped=0x0) returned 1
	[0060.450] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x12f80, lpOverlapped=0x0) returned 1
	[0060.452] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.452] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.452] SetEndOfFile (hFile=0x33c) returned 1
	[0060.453] CloseHandle (hObject=0x33c) returned 1
	[0060.455] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.455] SetEndOfFile (hFile=0x314) returned 1
	[0060.456] CloseHandle (hObject=0x314) returned 1
	[0060.456] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.457] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1
	[0060.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.458] lstrlenW (lpString=".doc") returned 4
	[0060.458] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.458] lstrlenW (lpString=".docx") returned 5
	[0060.458] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.458] lstrlenW (lpString=".pdf") returned 4
	[0060.458] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.458] lstrlenW (lpString=".xls") returned 4
	[0060.458] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.458] lstrlenW (lpString=".xlsx") returned 5
	[0060.458] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.458] lstrlenW (lpString=".ppt") returned 4
	[0060.458] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.458] lstrlenW (lpString=".zip") returned 4
	[0060.458] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.458] lstrlenW (lpString=".rar") returned 4
	[0060.458] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.458] lstrlenW (lpString=".bz2") returned 4
	[0060.458] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.459] lstrlenW (lpString=".7z") returned 3
	[0060.459] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.459] lstrlenW (lpString=".dbf") returned 4
	[0060.459] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.459] lstrlenW (lpString=".1cd") returned 4
	[0060.459] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.459] lstrlenW (lpString=".jpg") returned 4
	[0060.459] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.459] lstrlenW (lpString=".doc") returned 4
	[0060.459] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.459] lstrlenW (lpString=".docx") returned 5
	[0060.459] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.459] lstrlenW (lpString=".pdf") returned 4
	[0060.459] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.459] lstrlenW (lpString=".xls") returned 4
	[0060.459] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.459] lstrlenW (lpString=".xlsx") returned 5
	[0060.459] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.459] lstrlenW (lpString=".ppt") returned 4
	[0060.459] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.460] lstrlenW (lpString=".zip") returned 4
	[0060.460] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.460] lstrlenW (lpString=".rar") returned 4
	[0060.460] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.460] lstrlenW (lpString=".bz2") returned 4
	[0060.460] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.460] lstrlenW (lpString=".7z") returned 3
	[0060.460] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.460] lstrlenW (lpString=".dbf") returned 4
	[0060.460] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.460] lstrlenW (lpString=".1cd") returned 4
	[0060.460] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0060.460] lstrlenW (lpString=".jpg") returned 4
	[0060.460] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.460] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.461] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.461] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.461] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=60816) returned 1
	[0060.461] CloseHandle (hObject=0x314) returned 1
	[0060.461] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80
	[0060.461] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.461] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.461] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.461] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.461] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.462] GetLastError () returned 0x0
	[0060.462] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xed90, lpOverlapped=0x0) returned 1
	[0060.464] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xeda0, lpOverlapped=0x0) returned 1
	[0060.466] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.466] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.466] SetEndOfFile (hFile=0x33c) returned 1
	[0060.466] CloseHandle (hObject=0x33c) returned 1
	[0060.468] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.468] SetEndOfFile (hFile=0x314) returned 1
	[0060.469] CloseHandle (hObject=0x314) returned 1
	[0060.469] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.469] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1
	[0060.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.470] lstrlenW (lpString=".doc") returned 4
	[0060.470] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.470] lstrlenW (lpString=".docx") returned 5
	[0060.470] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.470] lstrlenW (lpString=".pdf") returned 4
	[0060.470] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.470] lstrlenW (lpString=".xls") returned 4
	[0060.470] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.470] lstrlenW (lpString=".xlsx") returned 5
	[0060.470] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.470] lstrlenW (lpString=".ppt") returned 4
	[0060.470] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.470] lstrlenW (lpString=".zip") returned 4
	[0060.470] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.470] lstrlenW (lpString=".rar") returned 4
	[0060.470] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.470] lstrlenW (lpString=".bz2") returned 4
	[0060.470] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.470] lstrlenW (lpString=".7z") returned 3
	[0060.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.471] lstrlenW (lpString=".dbf") returned 4
	[0060.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.471] lstrlenW (lpString=".1cd") returned 4
	[0060.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.471] lstrlenW (lpString=".jpg") returned 4
	[0060.471] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.471] lstrlenW (lpString=".doc") returned 4
	[0060.471] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.471] lstrlenW (lpString=".docx") returned 5
	[0060.471] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.471] lstrlenW (lpString=".pdf") returned 4
	[0060.471] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.471] lstrlenW (lpString=".xls") returned 4
	[0060.471] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.471] lstrlenW (lpString=".xlsx") returned 5
	[0060.471] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.471] lstrlenW (lpString=".ppt") returned 4
	[0060.471] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.472] lstrlenW (lpString=".zip") returned 4
	[0060.472] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.472] lstrlenW (lpString=".rar") returned 4
	[0060.472] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.472] lstrlenW (lpString=".bz2") returned 4
	[0060.472] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.472] lstrlenW (lpString=".7z") returned 3
	[0060.472] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.472] lstrlenW (lpString=".dbf") returned 4
	[0060.472] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.472] lstrlenW (lpString=".1cd") returned 4
	[0060.472] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0060.472] lstrlenW (lpString=".jpg") returned 4
	[0060.472] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.472] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0060.473] lstrlenW (lpString="eula.rtf") returned 8
	[0060.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.473] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3069) returned 1
	[0060.473] CloseHandle (hObject=0x314) returned 1
	[0060.473] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80
	[0060.473] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.473] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.473] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.475] GetLastError () returned 0x0
	[0060.475] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xbfd, lpOverlapped=0x0) returned 1
	[0060.477] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xc00, lpOverlapped=0x0) returned 1
	[0060.482] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.482] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.482] SetEndOfFile (hFile=0x33c) returned 1
	[0060.483] CloseHandle (hObject=0x33c) returned 1
	[0060.483] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.483] SetEndOfFile (hFile=0x314) returned 1
	[0060.484] CloseHandle (hObject=0x314) returned 1
	[0060.484] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.485] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1
	[0060.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.485] lstrlenW (lpString=".doc") returned 4
	[0060.485] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.485] lstrlenW (lpString=".docx") returned 5
	[0060.485] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.485] lstrlenW (lpString=".pdf") returned 4
	[0060.485] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.485] lstrlenW (lpString=".xls") returned 4
	[0060.485] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.485] lstrlenW (lpString=".xlsx") returned 5
	[0060.485] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.486] lstrlenW (lpString=".ppt") returned 4
	[0060.486] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.486] lstrlenW (lpString=".zip") returned 4
	[0060.486] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.486] lstrlenW (lpString=".rar") returned 4
	[0060.486] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.486] lstrlenW (lpString=".bz2") returned 4
	[0060.486] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.486] lstrlenW (lpString=".7z") returned 3
	[0060.486] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.486] lstrlenW (lpString=".dbf") returned 4
	[0060.486] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.486] lstrlenW (lpString=".1cd") returned 4
	[0060.486] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.486] lstrlenW (lpString=".jpg") returned 4
	[0060.486] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.487] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.487] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.487] lstrlenW (lpString=".doc") returned 4
	[0060.487] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.487] lstrlenW (lpString=".docx") returned 5
	[0060.487] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.487] lstrlenW (lpString=".pdf") returned 4
	[0060.487] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.487] lstrlenW (lpString=".xls") returned 4
	[0060.487] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.487] lstrlenW (lpString=".xlsx") returned 5
	[0060.487] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.487] lstrlenW (lpString=".ppt") returned 4
	[0060.487] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.487] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.487] lstrlenW (lpString=".zip") returned 4
	[0060.487] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.487] lstrlenW (lpString=".rar") returned 4
	[0060.487] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.487] lstrlenW (lpString=".bz2") returned 4
	[0060.488] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.488] lstrlenW (lpString=".7z") returned 3
	[0060.488] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.488] lstrlenW (lpString=".dbf") returned 4
	[0060.488] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.488] lstrlenW (lpString=".1cd") returned 4
	[0060.488] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0060.488] lstrlenW (lpString=".jpg") returned 4
	[0060.488] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.488] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.488] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.488] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0060.488] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=79996) returned 1
	[0060.488] CloseHandle (hObject=0x314) returned 1
	[0060.963] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80
	[0060.964] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.964] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0060.964] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.964] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.964] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0060.965] GetLastError () returned 0x0
	[0060.965] ReadFile (in: hFile=0x36c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1387c, lpOverlapped=0x0) returned 1
	[0060.967] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13880, lpOverlapped=0x0) returned 1
	[0060.969] ReadFile (in: hFile=0x36c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.969] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.969] SetEndOfFile (hFile=0x370) returned 1
	[0060.969] CloseHandle (hObject=0x370) returned 1
	[0060.974] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.974] SetEndOfFile (hFile=0x36c) returned 1
	[0060.976] CloseHandle (hObject=0x36c) returned 1
	[0060.976] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.977] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1
	[0060.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.977] lstrlenW (lpString=".doc") returned 4
	[0060.977] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.977] lstrlenW (lpString=".docx") returned 5
	[0060.977] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.977] lstrlenW (lpString=".pdf") returned 4
	[0060.977] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.977] lstrlenW (lpString=".xls") returned 4
	[0060.977] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.977] lstrlenW (lpString=".xlsx") returned 5
	[0060.977] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.977] lstrlenW (lpString=".ppt") returned 4
	[0060.977] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.977] lstrlenW (lpString=".zip") returned 4
	[0060.977] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.977] lstrlenW (lpString=".rar") returned 4
	[0060.977] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.978] lstrlenW (lpString=".bz2") returned 4
	[0060.978] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.978] lstrlenW (lpString=".7z") returned 3
	[0060.978] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.978] lstrlenW (lpString=".dbf") returned 4
	[0060.978] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.978] lstrlenW (lpString=".1cd") returned 4
	[0060.978] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.978] lstrlenW (lpString=".jpg") returned 4
	[0060.978] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.978] lstrlenW (lpString=".doc") returned 4
	[0060.978] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.978] lstrlenW (lpString=".docx") returned 5
	[0060.978] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.978] lstrlenW (lpString=".pdf") returned 4
	[0060.978] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.978] lstrlenW (lpString=".xls") returned 4
	[0060.978] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.978] lstrlenW (lpString=".xlsx") returned 5
	[0060.978] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.978] lstrlenW (lpString=".ppt") returned 4
	[0060.978] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.979] lstrlenW (lpString=".zip") returned 4
	[0060.979] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.979] lstrlenW (lpString=".rar") returned 4
	[0060.979] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.979] lstrlenW (lpString=".bz2") returned 4
	[0060.979] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.979] lstrlenW (lpString=".7z") returned 3
	[0060.979] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.979] lstrlenW (lpString=".dbf") returned 4
	[0060.979] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.979] lstrlenW (lpString=".1cd") returned 4
	[0060.979] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0060.979] lstrlenW (lpString=".jpg") returned 4
	[0060.979] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.979] lstrcmpiW (lpString1=".bmp", lpString2=".money") returned -1
	[0060.980] lstrlenW (lpString="SplashScreen.bmp") returned 16
	[0060.980] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0060.980] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=41080) returned 1
	[0060.980] CloseHandle (hObject=0x36c) returned 1
	[0060.980] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80
	[0060.980] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.980] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0060.980] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.981] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.981] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0060.981] GetLastError () returned 0x0
	[0060.981] ReadFile (in: hFile=0x36c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xa078, lpOverlapped=0x0) returned 1
	[0060.983] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xa080, lpOverlapped=0x0) returned 1
	[0060.984] ReadFile (in: hFile=0x36c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.984] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0060.984] SetEndOfFile (hFile=0x370) returned 1
	[0060.985] CloseHandle (hObject=0x370) returned 1
	[0060.986] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.986] SetEndOfFile (hFile=0x36c) returned 1
	[0060.987] CloseHandle (hObject=0x36c) returned 1
	[0060.988] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.988] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1
	[0060.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.988] lstrlenW (lpString=".doc") returned 4
	[0060.988] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0060.988] lstrlenW (lpString=".docx") returned 5
	[0060.988] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1
	[0060.989] lstrlenW (lpString=".pdf") returned 4
	[0060.989] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0060.989] lstrlenW (lpString=".xls") returned 4
	[0060.989] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0060.989] lstrlenW (lpString=".xlsx") returned 5
	[0060.989] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1
	[0060.989] lstrlenW (lpString=".ppt") returned 4
	[0060.989] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0060.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.989] lstrlenW (lpString=".zip") returned 4
	[0060.989] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0060.989] lstrlenW (lpString=".rar") returned 4
	[0060.989] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0060.989] lstrlenW (lpString=".bz2") returned 4
	[0060.989] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0060.989] lstrlenW (lpString=".7z") returned 3
	[0060.989] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0060.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.989] lstrlenW (lpString=".dbf") returned 4
	[0060.989] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0060.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.989] lstrlenW (lpString=".1cd") returned 4
	[0060.989] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0060.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.989] lstrlenW (lpString=".jpg") returned 4
	[0060.989] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0060.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.990] lstrlenW (lpString=".doc") returned 4
	[0060.990] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0060.990] lstrlenW (lpString=".docx") returned 5
	[0060.990] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1
	[0060.990] lstrlenW (lpString=".pdf") returned 4
	[0060.990] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0060.990] lstrlenW (lpString=".xls") returned 4
	[0060.990] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0060.990] lstrlenW (lpString=".xlsx") returned 5
	[0060.990] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1
	[0060.990] lstrlenW (lpString=".ppt") returned 4
	[0060.990] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0060.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.990] lstrlenW (lpString=".zip") returned 4
	[0060.990] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0060.990] lstrlenW (lpString=".rar") returned 4
	[0060.990] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0060.990] lstrlenW (lpString=".bz2") returned 4
	[0060.990] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0060.990] lstrlenW (lpString=".7z") returned 3
	[0060.990] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0060.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.990] lstrlenW (lpString=".dbf") returned 4
	[0060.990] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0060.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.990] lstrlenW (lpString=".1cd") returned 4
	[0060.990] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0060.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0060.990] lstrlenW (lpString=".jpg") returned 4
	[0060.990] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0060.991] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.991] lstrlenW (lpString="Strings.xml") returned 11
	[0060.991] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0060.991] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=14084) returned 1
	[0060.991] CloseHandle (hObject=0x36c) returned 1
	[0060.991] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80
	[0060.991] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.991] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0060.991] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.991] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.991] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0060.992] GetLastError () returned 0x0
	[0060.992] ReadFile (in: hFile=0x36c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x3704, lpOverlapped=0x0) returned 1
	[0060.993] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x3710, lpOverlapped=0x0) returned 1
	[0060.994] ReadFile (in: hFile=0x36c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.995] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xea, lpOverlapped=0x0) returned 1
	[0060.995] SetEndOfFile (hFile=0x370) returned 1
	[0060.995] CloseHandle (hObject=0x370) returned 1
	[0060.996] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.996] SetEndOfFile (hFile=0x36c) returned 1
	[0060.997] CloseHandle (hObject=0x36c) returned 1
	[0060.997] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.997] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1
	[0060.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0060.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0060.998] lstrlenW (lpString=".doc") returned 4
	[0060.998] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.998] lstrlenW (lpString=".docx") returned 5
	[0060.998] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0060.998] lstrlenW (lpString=".pdf") returned 4
	[0060.998] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.998] lstrlenW (lpString=".xls") returned 4
	[0060.998] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.998] lstrlenW (lpString=".xlsx") returned 5
	[0060.998] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0060.998] lstrlenW (lpString=".ppt") returned 4
	[0060.998] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0060.998] lstrlenW (lpString=".zip") returned 4
	[0060.998] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.998] lstrlenW (lpString=".rar") returned 4
	[0060.998] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.998] lstrlenW (lpString=".bz2") returned 4
	[0060.998] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.998] lstrlenW (lpString=".7z") returned 3
	[0060.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0060.998] lstrlenW (lpString=".dbf") returned 4
	[0060.999] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0060.999] lstrlenW (lpString=".1cd") returned 4
	[0060.999] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0060.999] lstrlenW (lpString=".jpg") returned 4
	[0060.999] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0060.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0060.999] lstrlenW (lpString=".doc") returned 4
	[0060.999] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString=".docx") returned 5
	[0060.999] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0060.999] lstrlenW (lpString=".pdf") returned 4
	[0060.999] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString=".xls") returned 4
	[0060.999] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString=".xlsx") returned 5
	[0060.999] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0060.999] lstrlenW (lpString=".ppt") returned 4
	[0060.999] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0060.999] lstrlenW (lpString=".zip") returned 4
	[0061.000] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.000] lstrlenW (lpString=".rar") returned 4
	[0061.000] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString=".bz2") returned 4
	[0061.000] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString=".7z") returned 3
	[0061.000] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0061.000] lstrlenW (lpString=".dbf") returned 4
	[0061.000] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0061.000] lstrlenW (lpString=".1cd") returned 4
	[0061.000] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0061.000] lstrlenW (lpString=".jpg") returned 4
	[0061.000] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.000] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.000] lstrlenW (lpString="UiInfo.xml") returned 10
	[0061.000] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0061.001] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=38898) returned 1
	[0061.001] CloseHandle (hObject=0x36c) returned 1
	[0061.362] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80
	[0061.362] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.362] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0061.362] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.362] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.362] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0061.362] GetLastError () returned 0x0
	[0061.362] ReadFile (in: hFile=0x360, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x97f2, lpOverlapped=0x0) returned 1
	[0061.365] WriteFile (in: hFile=0x364, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x9800, lpOverlapped=0x0) returned 1
	[0061.367] ReadFile (in: hFile=0x360, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.367] WriteFile (in: hFile=0x364, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0061.367] SetEndOfFile (hFile=0x364) returned 1
	[0061.367] CloseHandle (hObject=0x364) returned 1
	[0061.369] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.369] SetEndOfFile (hFile=0x360) returned 1
	[0061.370] CloseHandle (hObject=0x360) returned 1
	[0061.370] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.371] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1
	[0061.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.371] lstrlenW (lpString=".doc") returned 4
	[0061.371] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.371] lstrlenW (lpString=".docx") returned 5
	[0061.371] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0061.371] lstrlenW (lpString=".pdf") returned 4
	[0061.371] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.371] lstrlenW (lpString=".xls") returned 4
	[0061.371] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.371] lstrlenW (lpString=".xlsx") returned 5
	[0061.371] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0061.371] lstrlenW (lpString=".ppt") returned 4
	[0061.371] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.372] lstrlenW (lpString=".zip") returned 4
	[0061.372] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.372] lstrlenW (lpString=".rar") returned 4
	[0061.372] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.372] lstrlenW (lpString=".bz2") returned 4
	[0061.372] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.372] lstrlenW (lpString=".7z") returned 3
	[0061.372] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.372] lstrlenW (lpString=".dbf") returned 4
	[0061.372] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.372] lstrlenW (lpString=".1cd") returned 4
	[0061.372] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.372] lstrlenW (lpString=".jpg") returned 4
	[0061.372] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.372] lstrlenW (lpString=".doc") returned 4
	[0061.372] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.372] lstrlenW (lpString=".docx") returned 5
	[0061.372] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0061.373] lstrlenW (lpString=".pdf") returned 4
	[0061.373] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.373] lstrlenW (lpString=".xls") returned 4
	[0061.373] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.373] lstrlenW (lpString=".xlsx") returned 5
	[0061.373] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0061.373] lstrlenW (lpString=".ppt") returned 4
	[0061.373] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.373] lstrlenW (lpString=".zip") returned 4
	[0061.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.373] lstrlenW (lpString=".rar") returned 4
	[0061.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.373] lstrlenW (lpString=".bz2") returned 4
	[0061.373] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.373] lstrlenW (lpString=".7z") returned 3
	[0061.373] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.373] lstrlenW (lpString=".dbf") returned 4
	[0061.373] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.373] lstrlenW (lpString=".1cd") returned 4
	[0061.373] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0061.374] lstrlenW (lpString=".jpg") returned 4
	[0061.374] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.374] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.374] lstrlenW (lpString="Alphabet.xml") returned 12
	[0061.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0061.375] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=791421) returned 1
	[0061.375] CloseHandle (hObject=0x360) returned 1
	[0061.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0061.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.375] lstrlenW (lpString=".doc") returned 4
	[0061.375] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.375] lstrlenW (lpString=".docx") returned 5
	[0061.375] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0061.375] lstrlenW (lpString=".pdf") returned 4
	[0061.375] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.375] lstrlenW (lpString=".xls") returned 4
	[0061.375] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.375] lstrlenW (lpString=".xlsx") returned 5
	[0061.376] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0061.376] lstrlenW (lpString=".ppt") returned 4
	[0061.376] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.376] lstrlenW (lpString=".zip") returned 4
	[0061.376] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.376] lstrlenW (lpString=".rar") returned 4
	[0061.376] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString=".bz2") returned 4
	[0061.376] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString=".7z") returned 3
	[0061.376] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.376] lstrlenW (lpString=".dbf") returned 4
	[0061.376] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.376] lstrlenW (lpString=".1cd") returned 4
	[0061.376] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.376] lstrlenW (lpString=".jpg") returned 4
	[0061.376] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.377] lstrlenW (lpString=".doc") returned 4
	[0061.377] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.377] lstrlenW (lpString=".docx") returned 5
	[0061.377] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0061.377] lstrlenW (lpString=".pdf") returned 4
	[0061.377] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.377] lstrlenW (lpString=".xls") returned 4
	[0061.377] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.377] lstrlenW (lpString=".xlsx") returned 5
	[0061.377] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0061.377] lstrlenW (lpString=".ppt") returned 4
	[0061.377] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.377] lstrlenW (lpString=".zip") returned 4
	[0061.377] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.377] lstrlenW (lpString=".rar") returned 4
	[0061.377] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.377] lstrlenW (lpString=".bz2") returned 4
	[0061.377] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.377] lstrlenW (lpString=".7z") returned 3
	[0061.377] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.377] lstrlenW (lpString=".dbf") returned 4
	[0061.377] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.377] lstrlenW (lpString=".1cd") returned 4
	[0061.377] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0061.378] lstrlenW (lpString=".jpg") returned 4
	[0061.378] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.378] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.378] lstrlenW (lpString="Content.xml") returned 11
	[0061.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0061.378] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=27045) returned 1
	[0061.379] CloseHandle (hObject=0x360) returned 1
	[0061.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0061.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.379] lstrlenW (lpString=".doc") returned 4
	[0061.379] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.379] lstrlenW (lpString=".docx") returned 5
	[0061.379] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0061.379] lstrlenW (lpString=".pdf") returned 4
	[0061.379] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.379] lstrlenW (lpString=".xls") returned 4
	[0061.379] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.379] lstrlenW (lpString=".xlsx") returned 5
	[0061.379] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0061.379] lstrlenW (lpString=".ppt") returned 4
	[0061.379] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.379] lstrlenW (lpString=".zip") returned 4
	[0061.379] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.380] lstrlenW (lpString=".rar") returned 4
	[0061.380] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.380] lstrlenW (lpString=".bz2") returned 4
	[0061.380] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.380] lstrlenW (lpString=".7z") returned 3
	[0061.380] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.380] lstrlenW (lpString=".dbf") returned 4
	[0061.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.380] lstrlenW (lpString=".1cd") returned 4
	[0061.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.380] lstrlenW (lpString=".jpg") returned 4
	[0061.380] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.380] lstrlenW (lpString=".doc") returned 4
	[0061.380] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.380] lstrlenW (lpString=".docx") returned 5
	[0061.380] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0061.380] lstrlenW (lpString=".pdf") returned 4
	[0061.380] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.380] lstrlenW (lpString=".xls") returned 4
	[0061.380] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.381] lstrlenW (lpString=".xlsx") returned 5
	[0061.381] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0061.381] lstrlenW (lpString=".ppt") returned 4
	[0061.381] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.381] lstrlenW (lpString=".zip") returned 4
	[0061.381] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.381] lstrlenW (lpString=".rar") returned 4
	[0061.381] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.381] lstrlenW (lpString=".bz2") returned 4
	[0061.381] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.381] lstrlenW (lpString=".7z") returned 3
	[0061.381] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.381] lstrlenW (lpString=".dbf") returned 4
	[0061.381] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.381] lstrlenW (lpString=".1cd") returned 4
	[0061.381] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0061.381] lstrlenW (lpString=".jpg") returned 4
	[0061.381] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.382] lstrcmpiW (lpString1=".avi", lpString2=".money") returned -1
	[0061.382] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0061.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0061.383] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=111320) returned 1
	[0061.383] CloseHandle (hObject=0x360) returned 1
	[0061.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0061.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.384] lstrlenW (lpString=".doc") returned 4
	[0061.384] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0061.384] lstrlenW (lpString=".docx") returned 5
	[0061.384] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0061.384] lstrlenW (lpString=".pdf") returned 4
	[0061.384] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0061.384] lstrlenW (lpString=".xls") returned 4
	[0061.384] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0061.384] lstrlenW (lpString=".xlsx") returned 5
	[0061.384] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0061.384] lstrlenW (lpString=".ppt") returned 4
	[0061.384] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0061.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.384] lstrlenW (lpString=".zip") returned 4
	[0061.384] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0061.384] lstrlenW (lpString=".rar") returned 4
	[0061.384] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0061.384] lstrlenW (lpString=".bz2") returned 4
	[0061.384] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0061.384] lstrlenW (lpString=".7z") returned 3
	[0061.384] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0061.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.384] lstrlenW (lpString=".dbf") returned 4
	[0061.385] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0061.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.385] lstrlenW (lpString=".1cd") returned 4
	[0061.385] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0061.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.385] lstrlenW (lpString=".jpg") returned 4
	[0061.385] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0061.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.385] lstrlenW (lpString=".doc") returned 4
	[0061.385] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0061.385] lstrlenW (lpString=".docx") returned 5
	[0061.385] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0061.385] lstrlenW (lpString=".pdf") returned 4
	[0061.385] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0061.385] lstrlenW (lpString=".xls") returned 4
	[0061.385] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0061.385] lstrlenW (lpString=".xlsx") returned 5
	[0061.385] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0061.385] lstrlenW (lpString=".ppt") returned 4
	[0061.385] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0061.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.385] lstrlenW (lpString=".zip") returned 4
	[0061.385] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0061.385] lstrlenW (lpString=".rar") returned 4
	[0061.385] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0061.386] lstrlenW (lpString=".bz2") returned 4
	[0061.386] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0061.386] lstrlenW (lpString=".7z") returned 3
	[0061.386] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0061.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.386] lstrlenW (lpString=".dbf") returned 4
	[0061.386] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0061.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.386] lstrlenW (lpString=".1cd") returned 4
	[0061.386] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0061.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0061.386] lstrlenW (lpString=".jpg") returned 4
	[0061.386] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0061.386] lstrcmpiW (lpString1=".avi", lpString2=".money") returned -1
	[0061.387] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0061.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0061.387] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=48936) returned 1
	[0061.387] CloseHandle (hObject=0x360) returned 1
	[0061.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0061.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.387] lstrlenW (lpString=".doc") returned 4
	[0061.387] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0061.387] lstrlenW (lpString=".docx") returned 5
	[0061.387] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0061.387] lstrlenW (lpString=".pdf") returned 4
	[0061.388] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0061.388] lstrlenW (lpString=".xls") returned 4
	[0061.388] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0061.388] lstrlenW (lpString=".xlsx") returned 5
	[0061.388] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0061.388] lstrlenW (lpString=".ppt") returned 4
	[0061.388] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0061.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.388] lstrlenW (lpString=".zip") returned 4
	[0061.388] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0061.388] lstrlenW (lpString=".rar") returned 4
	[0061.388] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0061.388] lstrlenW (lpString=".bz2") returned 4
	[0061.388] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0061.388] lstrlenW (lpString=".7z") returned 3
	[0061.388] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0061.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.388] lstrlenW (lpString=".dbf") returned 4
	[0061.388] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0061.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.388] lstrlenW (lpString=".1cd") returned 4
	[0061.388] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0061.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.388] lstrlenW (lpString=".jpg") returned 4
	[0061.388] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0061.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.389] lstrlenW (lpString=".doc") returned 4
	[0061.389] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0061.389] lstrlenW (lpString=".docx") returned 5
	[0061.389] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0061.389] lstrlenW (lpString=".pdf") returned 4
	[0061.389] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0061.389] lstrlenW (lpString=".xls") returned 4
	[0061.389] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0061.389] lstrlenW (lpString=".xlsx") returned 5
	[0061.389] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0061.389] lstrlenW (lpString=".ppt") returned 4
	[0061.389] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0061.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.389] lstrlenW (lpString=".zip") returned 4
	[0061.389] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0061.389] lstrlenW (lpString=".rar") returned 4
	[0061.389] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0061.389] lstrlenW (lpString=".bz2") returned 4
	[0061.389] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0061.389] lstrlenW (lpString=".7z") returned 3
	[0061.389] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0061.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.389] lstrlenW (lpString=".dbf") returned 4
	[0061.389] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0061.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.390] lstrlenW (lpString=".1cd") returned 4
	[0061.390] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0061.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0061.390] lstrlenW (lpString=".jpg") returned 4
	[0061.390] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0061.390] lstrcmpiW (lpString1=".avi", lpString2=".money") returned -1
	[0061.390] lstrlenW (lpString="boxed-join.avi") returned 14
	[0061.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0061.391] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=46622) returned 1
	[0061.391] CloseHandle (hObject=0x360) returned 1
	[0061.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0061.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.391] lstrlenW (lpString=".doc") returned 4
	[0061.391] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0061.391] lstrlenW (lpString=".docx") returned 5
	[0061.391] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0061.391] lstrlenW (lpString=".pdf") returned 4
	[0061.391] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0061.391] lstrlenW (lpString=".xls") returned 4
	[0061.391] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0061.391] lstrlenW (lpString=".xlsx") returned 5
	[0061.391] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0061.391] lstrlenW (lpString=".ppt") returned 4
	[0061.391] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0061.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.391] lstrlenW (lpString=".zip") returned 4
	[0061.392] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0061.392] lstrlenW (lpString=".rar") returned 4
	[0061.392] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0061.392] lstrlenW (lpString=".bz2") returned 4
	[0061.392] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0061.392] lstrlenW (lpString=".7z") returned 3
	[0061.392] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0061.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.392] lstrlenW (lpString=".dbf") returned 4
	[0061.392] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0061.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.392] lstrlenW (lpString=".1cd") returned 4
	[0061.392] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0061.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.392] lstrlenW (lpString=".jpg") returned 4
	[0061.392] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0061.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.392] lstrlenW (lpString=".doc") returned 4
	[0061.392] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0061.392] lstrlenW (lpString=".docx") returned 5
	[0061.392] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0061.392] lstrlenW (lpString=".pdf") returned 4
	[0061.392] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0061.392] lstrlenW (lpString=".xls") returned 4
	[0061.392] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0061.392] lstrlenW (lpString=".xlsx") returned 5
	[0061.393] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0061.393] lstrlenW (lpString=".ppt") returned 4
	[0061.393] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0061.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.393] lstrlenW (lpString=".zip") returned 4
	[0061.393] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0061.393] lstrlenW (lpString=".rar") returned 4
	[0061.393] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0061.393] lstrlenW (lpString=".bz2") returned 4
	[0061.393] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0061.393] lstrlenW (lpString=".7z") returned 3
	[0061.393] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0061.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.393] lstrlenW (lpString=".dbf") returned 4
	[0061.393] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0061.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.393] lstrlenW (lpString=".1cd") returned 4
	[0061.393] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0061.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0061.393] lstrlenW (lpString=".jpg") returned 4
	[0061.393] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0061.393] lstrcmpiW (lpString1=".avi", lpString2=".money") returned -1
	[0061.394] lstrlenW (lpString="boxed-split.avi") returned 15
	[0061.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0061.394] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=84190) returned 1
	[0061.394] CloseHandle (hObject=0x360) returned 1
	[0061.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0061.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0061.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0061.394] lstrlenW (lpString=".doc") returned 4
	[0061.394] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0061.394] lstrlenW (lpString=".docx") returned 5
	[0061.394] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0061.394] lstrlenW (lpString=".pdf") returned 4
	[0061.394] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0061.394] lstrlenW (lpString=".xls") returned 4
	[0061.394] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0061.394] lstrlenW (lpString=".xlsx") returned 5
	[0061.394] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0061.395] lstrlenW (lpString=".ppt") returned 4
	[0061.395] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0061.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0061.395] lstrlenW (lpString=".zip") returned 4
	[0061.395] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0061.395] lstrlenW (lpString=".rar") returned 4
	[0061.395] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0061.395] lstrlenW (lpString=".bz2") returned 4
	[0061.395] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0061.395] lstrlenW (lpString=".7z") returned 3
	[0061.395] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0061.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0061.395] lstrlenW (lpString=".dbf") returned 4
	[0061.395] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0061.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[admin@stex777.com].money")) returned 0
	[0061.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[admin@stex777.com].money")) returned 0
	[0061.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[admin@stex777.com].money")) returned 0
	[0061.512] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.512] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0061.513] GetLastError () returned 0x0
	[0061.513] ReadFile (in: hFile=0x354, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x285, lpOverlapped=0x0) returned 1
	[0061.514] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x290, lpOverlapped=0x0) returned 1
	[0061.515] ReadFile (in: hFile=0x354, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.515] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.515] SetEndOfFile (hFile=0x368) returned 1
	[0061.515] CloseHandle (hObject=0x368) returned 1
	[0061.517] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.517] SetEndOfFile (hFile=0x354) returned 1
	[0061.518] CloseHandle (hObject=0x354) returned 1
	[0061.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x26) returned 1
	[0061.518] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1
	[0061.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.518] lstrlenW (lpString=".doc") returned 4
	[0061.518] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0061.518] lstrlenW (lpString=".docx") returned 5
	[0061.519] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0061.519] lstrlenW (lpString=".pdf") returned 4
	[0061.519] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0061.519] lstrlenW (lpString=".xls") returned 4
	[0061.519] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0061.519] lstrlenW (lpString=".xlsx") returned 5
	[0061.519] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0061.519] lstrlenW (lpString=".ppt") returned 4
	[0061.519] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0061.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.519] lstrlenW (lpString=".zip") returned 4
	[0061.519] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0061.519] lstrlenW (lpString=".rar") returned 4
	[0061.519] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0061.519] lstrlenW (lpString=".bz2") returned 4
	[0061.519] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0061.519] lstrlenW (lpString=".7z") returned 3
	[0061.519] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0061.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.519] lstrlenW (lpString=".dbf") returned 4
	[0061.519] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0061.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.519] lstrlenW (lpString=".1cd") returned 4
	[0061.519] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0061.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.519] lstrlenW (lpString=".jpg") returned 4
	[0061.519] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0061.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.520] lstrlenW (lpString=".doc") returned 4
	[0061.520] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0061.520] lstrlenW (lpString=".docx") returned 5
	[0061.520] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0061.520] lstrlenW (lpString=".pdf") returned 4
	[0061.520] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0061.520] lstrlenW (lpString=".xls") returned 4
	[0061.520] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0061.520] lstrlenW (lpString=".xlsx") returned 5
	[0061.520] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0061.520] lstrlenW (lpString=".ppt") returned 4
	[0061.520] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0061.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.520] lstrlenW (lpString=".zip") returned 4
	[0061.520] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0061.520] lstrlenW (lpString=".rar") returned 4
	[0061.520] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0061.520] lstrlenW (lpString=".bz2") returned 4
	[0061.520] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0061.520] lstrlenW (lpString=".7z") returned 3
	[0061.520] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0061.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.520] lstrlenW (lpString=".dbf") returned 4
	[0061.520] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0061.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.521] lstrlenW (lpString=".1cd") returned 4
	[0061.521] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0061.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0061.521] lstrlenW (lpString=".jpg") returned 4
	[0061.521] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0061.521] lstrcmpiW (lpString1=".htm", lpString2=".money") returned -1
	[0061.521] lstrlenW (lpString="Garden.htm") returned 10
	[0061.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0061.522] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=231) returned 1
	[0061.522] CloseHandle (hObject=0x354) returned 1
	[0061.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20
	[0061.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.522] lstrlenW (lpString=".doc") returned 4
	[0061.522] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.522] lstrlenW (lpString=".docx") returned 5
	[0061.522] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0061.522] lstrlenW (lpString=".pdf") returned 4
	[0061.522] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.522] lstrlenW (lpString=".xls") returned 4
	[0061.522] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.522] lstrlenW (lpString=".xlsx") returned 5
	[0061.522] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0061.523] lstrlenW (lpString=".ppt") returned 4
	[0061.523] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.523] lstrlenW (lpString=".zip") returned 4
	[0061.523] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.523] lstrlenW (lpString=".rar") returned 4
	[0061.523] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.523] lstrlenW (lpString=".bz2") returned 4
	[0061.523] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.523] lstrlenW (lpString=".7z") returned 3
	[0061.523] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.523] lstrlenW (lpString=".dbf") returned 4
	[0061.523] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.523] lstrlenW (lpString=".1cd") returned 4
	[0061.523] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.523] lstrlenW (lpString=".jpg") returned 4
	[0061.523] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.523] lstrlenW (lpString=".doc") returned 4
	[0061.523] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.523] lstrlenW (lpString=".docx") returned 5
	[0061.523] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0061.524] lstrlenW (lpString=".pdf") returned 4
	[0061.524] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.524] lstrlenW (lpString=".xls") returned 4
	[0061.524] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.524] lstrlenW (lpString=".xlsx") returned 5
	[0061.524] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0061.524] lstrlenW (lpString=".ppt") returned 4
	[0061.524] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.524] lstrlenW (lpString=".zip") returned 4
	[0061.524] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.524] lstrlenW (lpString=".rar") returned 4
	[0061.524] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.524] lstrlenW (lpString=".bz2") returned 4
	[0061.524] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.524] lstrlenW (lpString=".7z") returned 3
	[0061.524] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.524] lstrlenW (lpString=".dbf") returned 4
	[0061.524] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.524] lstrlenW (lpString=".1cd") returned 4
	[0061.524] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0061.524] lstrlenW (lpString=".jpg") returned 4
	[0061.524] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.525] lstrcmpiW (lpString1=".jpg", lpString2=".money") returned -1
	[0061.525] lstrlenW (lpString="Garden.jpg") returned 10
	[0061.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0061.525] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=23871) returned 1
	[0061.525] CloseHandle (hObject=0x350) returned 1
	[0061.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20
	[0061.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.526] lstrlenW (lpString=".doc") returned 4
	[0061.526] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.526] lstrlenW (lpString=".docx") returned 5
	[0061.526] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1
	[0061.526] lstrlenW (lpString=".pdf") returned 4
	[0061.526] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.527] lstrlenW (lpString=".xls") returned 4
	[0061.527] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.527] lstrlenW (lpString=".xlsx") returned 5
	[0061.527] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1
	[0061.527] lstrlenW (lpString=".ppt") returned 4
	[0061.528] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.528] lstrlenW (lpString=".zip") returned 4
	[0061.528] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.528] lstrlenW (lpString=".rar") returned 4
	[0061.528] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.528] lstrlenW (lpString=".bz2") returned 4
	[0061.528] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.528] lstrlenW (lpString=".7z") returned 3
	[0061.528] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.528] lstrlenW (lpString=".dbf") returned 4
	[0061.528] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.528] lstrlenW (lpString=".1cd") returned 4
	[0061.528] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.528] lstrlenW (lpString=".jpg") returned 4
	[0061.528] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.528] lstrlenW (lpString=".doc") returned 4
	[0061.528] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.528] lstrlenW (lpString=".docx") returned 5
	[0061.528] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1
	[0061.528] lstrlenW (lpString=".pdf") returned 4
	[0061.528] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.528] lstrlenW (lpString=".xls") returned 4
	[0061.528] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.529] lstrlenW (lpString=".xlsx") returned 5
	[0061.529] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1
	[0061.529] lstrlenW (lpString=".ppt") returned 4
	[0061.529] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.529] lstrlenW (lpString=".zip") returned 4
	[0061.529] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.529] lstrlenW (lpString=".rar") returned 4
	[0061.529] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.529] lstrlenW (lpString=".bz2") returned 4
	[0061.529] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.529] lstrlenW (lpString=".7z") returned 3
	[0061.529] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.529] lstrlenW (lpString=".dbf") returned 4
	[0061.529] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.529] lstrlenW (lpString=".1cd") returned 4
	[0061.529] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0061.529] lstrlenW (lpString=".jpg") returned 4
	[0061.529] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.529] lstrcmpiW (lpString1=".htm", lpString2=".money") returned -1
	[0061.529] lstrlenW (lpString="Green Bubbles.htm") returned 17
	[0061.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0061.530] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=237) returned 1
	[0061.530] CloseHandle (hObject=0x350) returned 1
	[0061.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20
	[0061.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.530] lstrlenW (lpString=".doc") returned 4
	[0061.530] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.530] lstrlenW (lpString=".docx") returned 5
	[0061.530] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0061.530] lstrlenW (lpString=".pdf") returned 4
	[0061.530] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.530] lstrlenW (lpString=".xls") returned 4
	[0061.530] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.530] lstrlenW (lpString=".xlsx") returned 5
	[0061.530] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0061.530] lstrlenW (lpString=".ppt") returned 4
	[0061.530] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.531] lstrlenW (lpString=".zip") returned 4
	[0061.531] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.531] lstrlenW (lpString=".rar") returned 4
	[0061.531] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.531] lstrlenW (lpString=".bz2") returned 4
	[0061.531] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.531] lstrlenW (lpString=".7z") returned 3
	[0061.531] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.531] lstrlenW (lpString=".dbf") returned 4
	[0061.531] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.531] lstrlenW (lpString=".1cd") returned 4
	[0061.531] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.531] lstrlenW (lpString=".jpg") returned 4
	[0061.531] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.531] lstrlenW (lpString=".doc") returned 4
	[0061.531] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.531] lstrlenW (lpString=".docx") returned 5
	[0061.531] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0061.531] lstrlenW (lpString=".pdf") returned 4
	[0061.531] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.531] lstrlenW (lpString=".xls") returned 4
	[0061.532] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.532] lstrlenW (lpString=".xlsx") returned 5
	[0061.532] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0061.532] lstrlenW (lpString=".ppt") returned 4
	[0061.532] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.532] lstrlenW (lpString=".zip") returned 4
	[0061.532] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.532] lstrlenW (lpString=".rar") returned 4
	[0061.532] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.532] lstrlenW (lpString=".bz2") returned 4
	[0061.532] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.532] lstrlenW (lpString=".7z") returned 3
	[0061.532] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.532] lstrlenW (lpString=".dbf") returned 4
	[0061.532] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.532] lstrlenW (lpString=".1cd") returned 4
	[0061.532] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75
	[0061.532] lstrlenW (lpString=".jpg") returned 4
	[0061.532] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.532] lstrcmpiW (lpString1=".jpg", lpString2=".money") returned -1
	[0061.532] lstrlenW (lpString="GreenBubbles.jpg") returned 16
	[0061.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.656] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=6406) returned 1
	[0061.657] CloseHandle (hObject=0x370) returned 1
	[0061.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20
	[0061.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.658] lstrlenW (lpString=".doc") returned 4
	[0061.658] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.658] lstrlenW (lpString=".docx") returned 5
	[0061.658] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0061.658] lstrlenW (lpString=".pdf") returned 4
	[0061.658] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.658] lstrlenW (lpString=".xls") returned 4
	[0061.658] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.658] lstrlenW (lpString=".xlsx") returned 5
	[0061.658] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0061.658] lstrlenW (lpString=".ppt") returned 4
	[0061.658] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.658] lstrlenW (lpString=".zip") returned 4
	[0061.658] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.658] lstrlenW (lpString=".rar") returned 4
	[0061.658] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.658] lstrlenW (lpString=".bz2") returned 4
	[0061.658] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.659] lstrlenW (lpString=".7z") returned 3
	[0061.659] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.659] lstrlenW (lpString=".dbf") returned 4
	[0061.659] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.659] lstrlenW (lpString=".1cd") returned 4
	[0061.659] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.659] lstrlenW (lpString=".jpg") returned 4
	[0061.659] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.659] lstrlenW (lpString=".doc") returned 4
	[0061.659] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.659] lstrlenW (lpString=".docx") returned 5
	[0061.659] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0061.659] lstrlenW (lpString=".pdf") returned 4
	[0061.659] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.659] lstrlenW (lpString=".xls") returned 4
	[0061.659] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.660] lstrlenW (lpString=".xlsx") returned 5
	[0061.660] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0061.660] lstrlenW (lpString=".ppt") returned 4
	[0061.660] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.660] lstrlenW (lpString=".zip") returned 4
	[0061.660] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.660] lstrlenW (lpString=".rar") returned 4
	[0061.660] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.660] lstrlenW (lpString=".bz2") returned 4
	[0061.660] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.660] lstrlenW (lpString=".7z") returned 3
	[0061.660] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.660] lstrlenW (lpString=".dbf") returned 4
	[0061.660] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.660] lstrlenW (lpString=".1cd") returned 4
	[0061.660] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0061.660] lstrlenW (lpString=".jpg") returned 4
	[0061.660] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.661] lstrcmpiW (lpString1=".inc", lpString2=".money") returned -1
	[0061.661] lstrlenW (lpString="adojavas.inc") returned 12
	[0061.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.662] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=14856) returned 1
	[0061.662] CloseHandle (hObject=0x370) returned 1
	[0061.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20
	[0061.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.662] lstrlenW (lpString=".doc") returned 4
	[0061.662] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0061.663] lstrlenW (lpString=".docx") returned 5
	[0061.663] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0061.663] lstrlenW (lpString=".pdf") returned 4
	[0061.663] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0061.663] lstrlenW (lpString=".xls") returned 4
	[0061.663] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0061.663] lstrlenW (lpString=".xlsx") returned 5
	[0061.663] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0061.663] lstrlenW (lpString=".ppt") returned 4
	[0061.663] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0061.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.663] lstrlenW (lpString=".zip") returned 4
	[0061.663] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0061.663] lstrlenW (lpString=".rar") returned 4
	[0061.663] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0061.663] lstrlenW (lpString=".bz2") returned 4
	[0061.663] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0061.663] lstrlenW (lpString=".7z") returned 3
	[0061.663] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0061.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.663] lstrlenW (lpString=".dbf") returned 4
	[0061.663] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0061.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.663] lstrlenW (lpString=".1cd") returned 4
	[0061.663] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0061.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.663] lstrlenW (lpString=".jpg") returned 4
	[0061.663] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0061.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.664] lstrlenW (lpString=".doc") returned 4
	[0061.664] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0061.664] lstrlenW (lpString=".docx") returned 5
	[0061.664] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0061.664] lstrlenW (lpString=".pdf") returned 4
	[0061.664] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0061.664] lstrlenW (lpString=".xls") returned 4
	[0061.664] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0061.664] lstrlenW (lpString=".xlsx") returned 5
	[0061.664] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0061.664] lstrlenW (lpString=".ppt") returned 4
	[0061.664] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0061.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.664] lstrlenW (lpString=".zip") returned 4
	[0061.664] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0061.664] lstrlenW (lpString=".rar") returned 4
	[0061.664] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0061.664] lstrlenW (lpString=".bz2") returned 4
	[0061.664] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0061.664] lstrlenW (lpString=".7z") returned 3
	[0061.664] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0061.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.664] lstrlenW (lpString=".dbf") returned 4
	[0061.664] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0061.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.665] lstrlenW (lpString=".1cd") returned 4
	[0061.665] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0061.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0061.665] lstrlenW (lpString=".jpg") returned 4
	[0061.665] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0061.665] lstrcmpiW (lpString1=".inc", lpString2=".money") returned -1
	[0061.665] lstrlenW (lpString="adovbs.inc") returned 10
	[0061.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.667] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=15195) returned 1
	[0061.667] CloseHandle (hObject=0x370) returned 1
	[0061.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20
	[0061.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0061.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0061.668] lstrlenW (lpString=".doc") returned 4
	[0061.668] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0061.668] lstrlenW (lpString=".docx") returned 5
	[0061.668] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0061.668] lstrlenW (lpString=".pdf") returned 4
	[0061.668] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0061.668] lstrlenW (lpString=".xls") returned 4
	[0061.668] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0061.668] lstrlenW (lpString=".xlsx") returned 5
	[0061.668] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0061.668] lstrlenW (lpString=".ppt") returned 4
	[0061.668] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0061.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0061.668] lstrlenW (lpString=".zip") returned 4
	[0061.668] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0061.668] lstrlenW (lpString=".rar") returned 4
	[0061.668] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0061.668] lstrlenW (lpString=".bz2") returned 4
	[0061.669] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0061.669] lstrlenW (lpString=".7z") returned 3
	[0061.669] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0061.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0061.669] lstrlenW (lpString=".dbf") returned 4
	[0061.669] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0061.670] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.671] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.671] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.671] GetLastError () returned 0x0
	[0061.671] ReadFile (in: hFile=0x370, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xae, lpOverlapped=0x0) returned 1
	[0061.671] WriteFile (in: hFile=0x374, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xb0, lpOverlapped=0x0) returned 1
	[0061.672] ReadFile (in: hFile=0x370, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.672] WriteFile (in: hFile=0x374, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.672] SetEndOfFile (hFile=0x374) returned 1
	[0061.672] CloseHandle (hObject=0x374) returned 1
	[0061.673] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.673] SetEndOfFile (hFile=0x370) returned 1
	[0061.674] CloseHandle (hObject=0x370) returned 1
	[0061.674] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x26) returned 1
	[0061.675] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1
	[0061.675] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.675] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.675] lstrlenW (lpString=".doc") returned 4
	[0061.675] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0061.675] lstrlenW (lpString=".docx") returned 5
	[0061.675] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0061.675] lstrlenW (lpString=".pdf") returned 4
	[0061.675] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0061.675] lstrlenW (lpString=".xls") returned 4
	[0061.675] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0061.675] lstrlenW (lpString=".xlsx") returned 5
	[0061.676] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0061.676] lstrlenW (lpString=".ppt") returned 4
	[0061.676] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0061.676] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.676] lstrlenW (lpString=".zip") returned 4
	[0061.676] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0061.676] lstrlenW (lpString=".rar") returned 4
	[0061.676] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0061.676] lstrlenW (lpString=".bz2") returned 4
	[0061.676] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0061.676] lstrlenW (lpString=".7z") returned 3
	[0061.676] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0061.676] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.676] lstrlenW (lpString=".dbf") returned 4
	[0061.676] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0061.676] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.676] lstrlenW (lpString=".1cd") returned 4
	[0061.676] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0061.676] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.676] lstrlenW (lpString=".jpg") returned 4
	[0061.676] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0061.677] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.677] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.677] lstrlenW (lpString=".doc") returned 4
	[0061.677] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0061.677] lstrlenW (lpString=".docx") returned 5
	[0061.677] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0061.677] lstrlenW (lpString=".pdf") returned 4
	[0061.677] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0061.677] lstrlenW (lpString=".xls") returned 4
	[0061.677] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0061.677] lstrlenW (lpString=".xlsx") returned 5
	[0061.677] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0061.677] lstrlenW (lpString=".ppt") returned 4
	[0061.677] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0061.677] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.677] lstrlenW (lpString=".zip") returned 4
	[0061.677] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0061.677] lstrlenW (lpString=".rar") returned 4
	[0061.677] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0061.677] lstrlenW (lpString=".bz2") returned 4
	[0061.677] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0061.677] lstrlenW (lpString=".7z") returned 3
	[0061.677] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0061.677] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.677] lstrlenW (lpString=".dbf") returned 4
	[0061.677] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0061.677] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.678] lstrlenW (lpString=".1cd") returned 4
	[0061.678] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0061.678] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0061.678] lstrlenW (lpString=".jpg") returned 4
	[0061.678] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0061.678] Sleep (dwMilliseconds=0x64) 
	[0062.172] lstrcmpiW (lpString1=".gif", lpString2=".money") returned -1
	[0062.208] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25
	[0062.208] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.208] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=153) returned 1
	[0062.208] CloseHandle (hObject=0x370) returned 1
	[0062.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20
	[0062.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.209] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.209] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.209] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.209] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0062.209] GetLastError () returned 0x0
	[0062.209] ReadFile (in: hFile=0x370, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x99, lpOverlapped=0x0) returned 1
	[0062.210] WriteFile (in: hFile=0x344, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0062.211] ReadFile (in: hFile=0x370, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.211] WriteFile (in: hFile=0x344, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x106, lpOverlapped=0x0) returned 1
	[0062.211] SetEndOfFile (hFile=0x344) returned 1
	[0062.212] CloseHandle (hObject=0x344) returned 1
	[0062.213] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.213] SetEndOfFile (hFile=0x370) returned 1
	[0062.214] CloseHandle (hObject=0x370) returned 1
	[0062.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.214] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1
	[0062.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.214] lstrlenW (lpString=".doc") returned 4
	[0062.214] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.214] lstrlenW (lpString=".docx") returned 5
	[0062.215] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.215] lstrlenW (lpString=".pdf") returned 4
	[0062.215] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.215] lstrlenW (lpString=".xls") returned 4
	[0062.215] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.215] lstrlenW (lpString=".xlsx") returned 5
	[0062.215] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.215] lstrlenW (lpString=".ppt") returned 4
	[0062.215] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.215] lstrlenW (lpString=".zip") returned 4
	[0062.215] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.215] lstrlenW (lpString=".rar") returned 4
	[0062.215] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.215] lstrlenW (lpString=".bz2") returned 4
	[0062.215] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.215] lstrlenW (lpString=".7z") returned 3
	[0062.215] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.215] lstrlenW (lpString=".dbf") returned 4
	[0062.216] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.216] lstrlenW (lpString=".1cd") returned 4
	[0062.216] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.216] lstrlenW (lpString=".jpg") returned 4
	[0062.216] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.216] lstrlenW (lpString=".doc") returned 4
	[0062.216] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.216] lstrlenW (lpString=".docx") returned 5
	[0062.216] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.216] lstrlenW (lpString=".pdf") returned 4
	[0062.216] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.216] lstrlenW (lpString=".xls") returned 4
	[0062.216] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.216] lstrlenW (lpString=".xlsx") returned 5
	[0062.217] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.217] lstrlenW (lpString=".ppt") returned 4
	[0062.217] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.217] lstrlenW (lpString=".zip") returned 4
	[0062.217] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.217] lstrlenW (lpString=".rar") returned 4
	[0062.217] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.217] lstrlenW (lpString=".bz2") returned 4
	[0062.217] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.217] lstrlenW (lpString=".7z") returned 3
	[0062.217] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.217] lstrlenW (lpString=".dbf") returned 4
	[0062.217] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.217] lstrlenW (lpString=".1cd") returned 4
	[0062.217] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0062.218] lstrlenW (lpString=".jpg") returned 4
	[0062.218] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.218] lstrcmpiW (lpString1=".gif", lpString2=".money") returned -1
	[0062.218] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23
	[0062.218] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.218] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=168) returned 1
	[0062.218] CloseHandle (hObject=0x370) returned 1
	[0062.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20
	[0062.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.221] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.221] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.221] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0062.221] GetLastError () returned 0x0
	[0062.221] ReadFile (in: hFile=0x370, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xa8, lpOverlapped=0x0) returned 1
	[0062.222] WriteFile (in: hFile=0x344, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xb0, lpOverlapped=0x0) returned 1
	[0062.223] ReadFile (in: hFile=0x370, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.223] WriteFile (in: hFile=0x344, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x102, lpOverlapped=0x0) returned 1
	[0062.224] SetEndOfFile (hFile=0x344) returned 1
	[0062.224] CloseHandle (hObject=0x344) returned 1
	[0062.224] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.225] SetEndOfFile (hFile=0x370) returned 1
	[0062.225] CloseHandle (hObject=0x370) returned 1
	[0062.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.226] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1
	[0062.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.226] lstrlenW (lpString=".doc") returned 4
	[0062.226] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.226] lstrlenW (lpString=".docx") returned 5
	[0062.226] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.226] lstrlenW (lpString=".pdf") returned 4
	[0062.226] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.227] lstrlenW (lpString=".xls") returned 4
	[0062.227] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.227] lstrlenW (lpString=".xlsx") returned 5
	[0062.227] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.227] lstrlenW (lpString=".ppt") returned 4
	[0062.227] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.227] lstrlenW (lpString=".zip") returned 4
	[0062.227] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.227] lstrlenW (lpString=".rar") returned 4
	[0062.227] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.227] lstrlenW (lpString=".bz2") returned 4
	[0062.227] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.227] lstrlenW (lpString=".7z") returned 3
	[0062.227] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.227] lstrlenW (lpString=".dbf") returned 4
	[0062.227] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.227] lstrlenW (lpString=".1cd") returned 4
	[0062.228] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.228] lstrlenW (lpString=".jpg") returned 4
	[0062.228] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.228] lstrlenW (lpString=".doc") returned 4
	[0062.228] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.228] lstrlenW (lpString=".docx") returned 5
	[0062.228] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.228] lstrlenW (lpString=".pdf") returned 4
	[0062.228] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.228] lstrlenW (lpString=".xls") returned 4
	[0062.228] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.228] lstrlenW (lpString=".xlsx") returned 5
	[0062.228] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.228] lstrlenW (lpString=".ppt") returned 4
	[0062.228] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.228] lstrlenW (lpString=".zip") returned 4
	[0062.228] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.229] lstrlenW (lpString=".rar") returned 4
	[0062.229] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.229] lstrlenW (lpString=".bz2") returned 4
	[0062.229] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.229] lstrlenW (lpString=".7z") returned 3
	[0062.229] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.229] lstrlenW (lpString=".dbf") returned 4
	[0062.229] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.229] lstrlenW (lpString=".1cd") returned 4
	[0062.229] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0062.229] lstrlenW (lpString=".jpg") returned 4
	[0062.229] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.229] lstrcmpiW (lpString1=".gif", lpString2=".money") returned -1
	[0062.229] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25
	[0062.229] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.230] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=153) returned 1
	[0062.230] CloseHandle (hObject=0x370) returned 1
	[0062.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20
	[0062.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.230] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.230] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.230] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.230] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0062.231] GetLastError () returned 0x0
	[0062.231] ReadFile (in: hFile=0x370, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x99, lpOverlapped=0x0) returned 1
	[0062.232] WriteFile (in: hFile=0x344, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0062.233] ReadFile (in: hFile=0x370, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.233] WriteFile (in: hFile=0x344, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x106, lpOverlapped=0x0) returned 1
	[0062.233] SetEndOfFile (hFile=0x344) returned 1
	[0062.233] CloseHandle (hObject=0x344) returned 1
	[0062.234] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.234] SetEndOfFile (hFile=0x370) returned 1
	[0062.234] CloseHandle (hObject=0x370) returned 1
	[0062.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.235] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1
	[0062.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.235] lstrlenW (lpString=".doc") returned 4
	[0062.235] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.235] lstrlenW (lpString=".docx") returned 5
	[0062.235] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.235] lstrlenW (lpString=".pdf") returned 4
	[0062.235] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.235] lstrlenW (lpString=".xls") returned 4
	[0062.236] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.236] lstrlenW (lpString=".xlsx") returned 5
	[0062.236] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.236] lstrlenW (lpString=".ppt") returned 4
	[0062.236] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.236] lstrlenW (lpString=".zip") returned 4
	[0062.236] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.236] lstrlenW (lpString=".rar") returned 4
	[0062.236] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.236] lstrlenW (lpString=".bz2") returned 4
	[0062.236] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.236] lstrlenW (lpString=".7z") returned 3
	[0062.236] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.236] lstrlenW (lpString=".dbf") returned 4
	[0062.236] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.236] lstrlenW (lpString=".1cd") returned 4
	[0062.236] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.237] lstrlenW (lpString=".jpg") returned 4
	[0062.237] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.237] lstrlenW (lpString=".doc") returned 4
	[0062.237] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.237] lstrlenW (lpString=".docx") returned 5
	[0062.237] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.237] lstrlenW (lpString=".pdf") returned 4
	[0062.237] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.237] lstrlenW (lpString=".xls") returned 4
	[0062.237] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.237] lstrlenW (lpString=".xlsx") returned 5
	[0062.237] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.237] lstrlenW (lpString=".ppt") returned 4
	[0062.237] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.237] lstrlenW (lpString=".zip") returned 4
	[0062.237] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.237] lstrlenW (lpString=".rar") returned 4
	[0062.237] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.238] lstrlenW (lpString=".bz2") returned 4
	[0062.238] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.238] lstrlenW (lpString=".7z") returned 3
	[0062.238] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.238] lstrlenW (lpString=".dbf") returned 4
	[0062.238] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.238] lstrlenW (lpString=".1cd") returned 4
	[0062.238] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0062.238] lstrlenW (lpString=".jpg") returned 4
	[0062.238] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.238] lstrcmpiW (lpString1=".gif", lpString2=".money") returned -1
	[0062.238] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23
	[0062.238] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.239] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=147) returned 1
	[0062.239] CloseHandle (hObject=0x370) returned 1
	[0062.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20
	[0062.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.240] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.240] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.240] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.240] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0062.240] GetLastError () returned 0x0
	[0062.240] ReadFile (in: hFile=0x370, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x93, lpOverlapped=0x0) returned 1
	[0062.551] WriteFile (in: hFile=0x344, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0062.725] ReadFile (in: hFile=0x370, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.725] WriteFile (in: hFile=0x344, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x102, lpOverlapped=0x0) returned 1
	[0062.725] SetEndOfFile (hFile=0x344) returned 1
	[0062.725] CloseHandle (hObject=0x344) returned 1
	[0062.726] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.726] SetEndOfFile (hFile=0x370) returned 1
	[0062.727] CloseHandle (hObject=0x370) returned 1
	[0062.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.727] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1
	[0062.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.727] lstrlenW (lpString=".doc") returned 4
	[0062.727] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.727] lstrlenW (lpString=".docx") returned 5
	[0062.728] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.728] lstrlenW (lpString=".pdf") returned 4
	[0062.728] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.728] lstrlenW (lpString=".xls") returned 4
	[0062.728] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.728] lstrlenW (lpString=".xlsx") returned 5
	[0062.728] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.728] lstrlenW (lpString=".ppt") returned 4
	[0062.728] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.728] lstrlenW (lpString=".zip") returned 4
	[0062.728] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.728] lstrlenW (lpString=".rar") returned 4
	[0062.728] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.728] lstrlenW (lpString=".bz2") returned 4
	[0062.728] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.728] lstrlenW (lpString=".7z") returned 3
	[0062.728] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.728] lstrlenW (lpString=".dbf") returned 4
	[0062.728] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.728] lstrlenW (lpString=".1cd") returned 4
	[0062.729] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.729] lstrlenW (lpString=".jpg") returned 4
	[0062.729] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.729] lstrlenW (lpString=".doc") returned 4
	[0062.729] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.729] lstrlenW (lpString=".docx") returned 5
	[0062.729] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.729] lstrlenW (lpString=".pdf") returned 4
	[0062.729] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.729] lstrlenW (lpString=".xls") returned 4
	[0062.729] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.729] lstrlenW (lpString=".xlsx") returned 5
	[0062.729] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.729] lstrlenW (lpString=".ppt") returned 4
	[0062.729] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.729] lstrlenW (lpString=".zip") returned 4
	[0062.729] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.729] lstrlenW (lpString=".rar") returned 4
	[0062.730] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.730] lstrlenW (lpString=".bz2") returned 4
	[0062.730] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.730] lstrlenW (lpString=".7z") returned 3
	[0062.730] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.730] lstrlenW (lpString=".dbf") returned 4
	[0062.730] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.730] lstrlenW (lpString=".1cd") returned 4
	[0062.730] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0062.730] lstrlenW (lpString=".jpg") returned 4
	[0062.730] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.730] Sleep (dwMilliseconds=0x64) 
	[0063.399] lstrcmpiW (lpString1=".XML", lpString2=".money") returned 1
	[0063.399] lstrlenW (lpString="SLERROR.XML") returned 11
	[0063.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0063.399] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=36336) returned 1
	[0063.399] CloseHandle (hObject=0x360) returned 1
	[0063.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20
	[0063.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0063.399] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.400] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0063.400] GetLastError () returned 0x0
	[0063.400] ReadFile (in: hFile=0x360, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x8df0, lpOverlapped=0x0) returned 1
	[0063.402] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x8e00, lpOverlapped=0x0) returned 1
	[0063.403] ReadFile (in: hFile=0x360, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.403] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xea, lpOverlapped=0x0) returned 1
	[0063.403] SetEndOfFile (hFile=0x378) returned 1
	[0063.404] CloseHandle (hObject=0x378) returned 1
	[0063.405] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.405] SetEndOfFile (hFile=0x360) returned 1
	[0063.406] CloseHandle (hObject=0x360) returned 1
	[0063.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0063.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1
	[0063.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.407] lstrlenW (lpString=".doc") returned 4
	[0063.407] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0063.407] lstrlenW (lpString=".docx") returned 5
	[0063.407] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1
	[0063.407] lstrlenW (lpString=".pdf") returned 4
	[0063.407] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0063.407] lstrlenW (lpString=".xls") returned 4
	[0063.407] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0063.407] lstrlenW (lpString=".xlsx") returned 5
	[0063.407] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1
	[0063.407] lstrlenW (lpString=".ppt") returned 4
	[0063.407] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0063.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.407] lstrlenW (lpString=".zip") returned 4
	[0063.407] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0063.407] lstrlenW (lpString=".rar") returned 4
	[0063.408] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0063.408] lstrlenW (lpString=".bz2") returned 4
	[0063.408] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0063.408] lstrlenW (lpString=".7z") returned 3
	[0063.408] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0063.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.408] lstrlenW (lpString=".dbf") returned 4
	[0063.408] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0063.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.408] lstrlenW (lpString=".1cd") returned 4
	[0063.408] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0063.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.408] lstrlenW (lpString=".jpg") returned 4
	[0063.408] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0063.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.408] lstrlenW (lpString=".doc") returned 4
	[0063.408] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0063.408] lstrlenW (lpString=".docx") returned 5
	[0063.408] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1
	[0063.408] lstrlenW (lpString=".pdf") returned 4
	[0063.408] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0063.408] lstrlenW (lpString=".xls") returned 4
	[0063.409] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0063.409] lstrlenW (lpString=".xlsx") returned 5
	[0063.409] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1
	[0063.409] lstrlenW (lpString=".ppt") returned 4
	[0063.409] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0063.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.409] lstrlenW (lpString=".zip") returned 4
	[0063.409] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0063.409] lstrlenW (lpString=".rar") returned 4
	[0063.409] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0063.409] lstrlenW (lpString=".bz2") returned 4
	[0063.409] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0063.409] lstrlenW (lpString=".7z") returned 3
	[0063.409] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0063.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.409] lstrlenW (lpString=".dbf") returned 4
	[0063.409] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0063.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.409] lstrlenW (lpString=".1cd") returned 4
	[0063.409] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0063.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0063.409] lstrlenW (lpString=".jpg") returned 4
	[0063.409] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0063.410] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0063.410] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53
	[0063.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0063.411] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=387356) returned 1
	[0063.411] CloseHandle (hObject=0x360) returned 1
	[0063.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0063.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0063.411] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.411] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0063.412] GetLastError () returned 0x0
	[0063.412] ReadFile (in: hFile=0x360, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x5e91c, lpOverlapped=0x0) returned 1
	[0063.420] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x5e920, lpOverlapped=0x0) returned 1
	[0063.427] ReadFile (in: hFile=0x360, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.427] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0063.427] SetEndOfFile (hFile=0x378) returned 1
	[0063.427] CloseHandle (hObject=0x378) returned 1
	[0063.436] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.436] SetEndOfFile (hFile=0x360) returned 1
	[0063.440] CloseHandle (hObject=0x360) returned 1
	[0063.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0063.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1
	[0063.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.440] lstrlenW (lpString=".doc") returned 4
	[0063.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.441] lstrlenW (lpString=".docx") returned 5
	[0063.441] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.441] lstrlenW (lpString=".pdf") returned 4
	[0063.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.441] lstrlenW (lpString=".xls") returned 4
	[0063.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.441] lstrlenW (lpString=".xlsx") returned 5
	[0063.441] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.441] lstrlenW (lpString=".ppt") returned 4
	[0063.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.441] lstrlenW (lpString=".zip") returned 4
	[0063.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.441] lstrlenW (lpString=".rar") returned 4
	[0063.441] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.441] lstrlenW (lpString=".bz2") returned 4
	[0063.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.441] lstrlenW (lpString=".7z") returned 3
	[0063.441] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.441] lstrlenW (lpString=".dbf") returned 4
	[0063.441] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.442] lstrlenW (lpString=".1cd") returned 4
	[0063.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.442] lstrlenW (lpString=".jpg") returned 4
	[0063.442] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.774] lstrlenW (lpString=".doc") returned 4
	[0063.780] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.780] lstrlenW (lpString=".docx") returned 5
	[0063.780] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.780] lstrlenW (lpString=".pdf") returned 4
	[0063.780] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.780] lstrlenW (lpString=".xls") returned 4
	[0063.780] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.781] lstrlenW (lpString=".xlsx") returned 5
	[0063.781] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.781] lstrlenW (lpString=".ppt") returned 4
	[0063.781] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.781] lstrlenW (lpString=".zip") returned 4
	[0063.781] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.781] lstrlenW (lpString=".rar") returned 4
	[0063.781] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.781] lstrlenW (lpString=".bz2") returned 4
	[0063.781] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.781] lstrlenW (lpString=".7z") returned 3
	[0063.781] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.781] lstrlenW (lpString=".dbf") returned 4
	[0063.781] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.781] lstrlenW (lpString=".1cd") returned 4
	[0063.781] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0063.781] lstrlenW (lpString=".jpg") returned 4
	[0063.781] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.782] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0063.782] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53
	[0063.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0063.782] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1261) returned 1
	[0063.782] CloseHandle (hObject=0x37c) returned 1
	[0063.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0063.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0063.783] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.783] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0063.787] GetLastError () returned 0x0
	[0063.787] ReadFile (in: hFile=0x37c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0063.789] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0063.790] ReadFile (in: hFile=0x37c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.790] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0063.790] SetEndOfFile (hFile=0x380) returned 1
	[0063.790] CloseHandle (hObject=0x380) returned 1
	[0063.791] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.791] SetEndOfFile (hFile=0x37c) returned 1
	[0063.792] CloseHandle (hObject=0x37c) returned 1
	[0063.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0063.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1
	[0063.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.793] lstrlenW (lpString=".doc") returned 4
	[0063.793] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.793] lstrlenW (lpString=".docx") returned 5
	[0063.793] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.793] lstrlenW (lpString=".pdf") returned 4
	[0063.793] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.793] lstrlenW (lpString=".xls") returned 4
	[0063.793] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.793] lstrlenW (lpString=".xlsx") returned 5
	[0063.793] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.793] lstrlenW (lpString=".ppt") returned 4
	[0063.793] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.793] lstrlenW (lpString=".zip") returned 4
	[0063.793] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.793] lstrlenW (lpString=".rar") returned 4
	[0063.793] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.793] lstrlenW (lpString=".bz2") returned 4
	[0063.793] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.793] lstrlenW (lpString=".7z") returned 3
	[0063.793] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.793] lstrlenW (lpString=".dbf") returned 4
	[0063.793] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.793] lstrlenW (lpString=".1cd") returned 4
	[0063.793] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.794] lstrlenW (lpString=".jpg") returned 4
	[0063.794] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.794] lstrlenW (lpString=".doc") returned 4
	[0063.794] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.794] lstrlenW (lpString=".docx") returned 5
	[0063.794] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.794] lstrlenW (lpString=".pdf") returned 4
	[0063.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.794] lstrlenW (lpString=".xls") returned 4
	[0063.794] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.794] lstrlenW (lpString=".xlsx") returned 5
	[0063.794] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.794] lstrlenW (lpString=".ppt") returned 4
	[0063.794] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.795] lstrlenW (lpString=".zip") returned 4
	[0063.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.795] lstrlenW (lpString=".rar") returned 4
	[0063.795] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.795] lstrlenW (lpString=".bz2") returned 4
	[0063.795] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.795] lstrlenW (lpString=".7z") returned 3
	[0063.795] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.795] lstrlenW (lpString=".dbf") returned 4
	[0063.795] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.795] lstrlenW (lpString=".1cd") returned 4
	[0063.795] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0063.795] lstrlenW (lpString=".jpg") returned 4
	[0063.795] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.796] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0063.796] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53
	[0063.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0063.796] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=253712) returned 1
	[0063.797] CloseHandle (hObject=0x37c) returned 1
	[0063.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0063.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0063.797] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.797] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0063.798] GetLastError () returned 0x0
	[0063.798] ReadFile (in: hFile=0x37c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x3df10, lpOverlapped=0x0) returned 1
	[0063.803] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x3df20, lpOverlapped=0x0) returned 1
	[0063.808] ReadFile (in: hFile=0x37c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.808] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0063.808] SetEndOfFile (hFile=0x380) returned 1
	[0063.808] CloseHandle (hObject=0x380) returned 1
	[0063.814] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.814] SetEndOfFile (hFile=0x37c) returned 1
	[0063.816] CloseHandle (hObject=0x37c) returned 1
	[0063.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0063.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1
	[0063.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0063.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0063.817] lstrlenW (lpString=".doc") returned 4
	[0063.817] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.817] lstrlenW (lpString=".docx") returned 5
	[0063.817] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.817] lstrlenW (lpString=".pdf") returned 4
	[0063.817] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.817] lstrlenW (lpString=".xls") returned 4
	[0064.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.339] lstrlenW (lpString=".xlsx") returned 5
	[0064.339] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.339] lstrlenW (lpString=".ppt") returned 4
	[0064.339] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0064.340] lstrlenW (lpString=".zip") returned 4
	[0064.340] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.340] lstrlenW (lpString=".rar") returned 4
	[0064.340] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.340] lstrlenW (lpString=".bz2") returned 4
	[0064.340] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.340] lstrlenW (lpString=".7z") returned 3
	[0064.340] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0064.340] lstrlenW (lpString=".dbf") returned 4
	[0064.340] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0064.340] lstrlenW (lpString=".1cd") returned 4
	[0064.341] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0064.341] lstrlenW (lpString=".jpg") returned 4
	[0064.341] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0064.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0064.341] lstrlenW (lpString=".doc") returned 4
	[0064.341] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.341] lstrlenW (lpString=".docx") returned 5
	[0064.341] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.341] lstrlenW (lpString=".pdf") returned 4
	[0064.341] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.341] lstrlenW (lpString=".xls") returned 4
	[0064.342] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.342] lstrlenW (lpString=".xlsx") returned 5
	[0064.342] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.342] lstrlenW (lpString=".ppt") returned 4
	[0064.342] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0064.342] lstrlenW (lpString=".zip") returned 4
	[0064.342] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.342] lstrlenW (lpString=".rar") returned 4
	[0064.342] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.342] lstrlenW (lpString=".bz2") returned 4
	[0064.342] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.342] lstrlenW (lpString=".7z") returned 3
	[0064.342] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0064.343] lstrlenW (lpString=".dbf") returned 4
	[0064.343] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0064.343] lstrlenW (lpString=".1cd") returned 4
	[0064.343] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0064.343] lstrlenW (lpString=".jpg") returned 4
	[0064.343] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.344] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0064.344] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53
	[0064.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0064.345] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=19451) returned 1
	[0064.345] CloseHandle (hObject=0x368) returned 1
	[0064.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0064.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0064.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0064.345] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.346] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0064.348] GetLastError () returned 0x0
	[0064.348] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x4bfb, lpOverlapped=0x0) returned 1
	[0064.350] WriteFile (in: hFile=0x340, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4c00, lpOverlapped=0x0) returned 1
	[0064.351] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.351] WriteFile (in: hFile=0x340, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0064.351] SetEndOfFile (hFile=0x340) returned 1
	[0064.352] CloseHandle (hObject=0x340) returned 1
	[0064.353] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.353] SetEndOfFile (hFile=0x368) returned 1
	[0064.355] CloseHandle (hObject=0x368) returned 1
	[0064.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0064.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1
	[0064.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.356] lstrlenW (lpString=".doc") returned 4
	[0064.356] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.356] lstrlenW (lpString=".docx") returned 5
	[0064.356] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.356] lstrlenW (lpString=".pdf") returned 4
	[0064.356] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.356] lstrlenW (lpString=".xls") returned 4
	[0064.356] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.356] lstrlenW (lpString=".xlsx") returned 5
	[0064.356] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.356] lstrlenW (lpString=".ppt") returned 4
	[0064.356] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.357] lstrlenW (lpString=".zip") returned 4
	[0064.357] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.357] lstrlenW (lpString=".rar") returned 4
	[0064.357] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.357] lstrlenW (lpString=".bz2") returned 4
	[0064.357] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.357] lstrlenW (lpString=".7z") returned 3
	[0064.357] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.357] lstrlenW (lpString=".dbf") returned 4
	[0064.357] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.357] lstrlenW (lpString=".1cd") returned 4
	[0064.357] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.358] lstrlenW (lpString=".jpg") returned 4
	[0064.358] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.358] lstrlenW (lpString=".doc") returned 4
	[0064.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.358] lstrlenW (lpString=".docx") returned 5
	[0064.358] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.358] lstrlenW (lpString=".pdf") returned 4
	[0064.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.358] lstrlenW (lpString=".xls") returned 4
	[0064.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.359] lstrlenW (lpString=".xlsx") returned 5
	[0064.359] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.359] lstrlenW (lpString=".ppt") returned 4
	[0064.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.359] lstrlenW (lpString=".zip") returned 4
	[0064.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.359] lstrlenW (lpString=".rar") returned 4
	[0064.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.359] lstrlenW (lpString=".bz2") returned 4
	[0064.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.359] lstrlenW (lpString=".7z") returned 3
	[0064.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.360] lstrlenW (lpString=".dbf") returned 4
	[0064.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.360] lstrlenW (lpString=".1cd") returned 4
	[0064.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0064.360] lstrlenW (lpString=".jpg") returned 4
	[0064.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.360] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0064.361] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53
	[0064.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0064.363] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=763363) returned 1
	[0064.363] CloseHandle (hObject=0x368) returned 1
	[0064.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0064.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0064.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0064.363] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.364] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0064.364] GetLastError () returned 0x0
	[0064.364] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xba5e3, lpOverlapped=0x0) returned 1
	[0064.784] WriteFile (in: hFile=0x340, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xba5f0, lpOverlapped=0x0) returned 1
	[0064.798] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.798] WriteFile (in: hFile=0x340, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0064.798] SetEndOfFile (hFile=0x340) returned 1
	[0064.798] CloseHandle (hObject=0x340) returned 1
	[0064.814] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.814] SetEndOfFile (hFile=0x368) returned 1
	[0066.483] CloseHandle (hObject=0x368) returned 1
	[0066.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0066.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1
	[0066.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.495] lstrlenW (lpString=".doc") returned 4
	[0066.495] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.495] lstrlenW (lpString=".docx") returned 5
	[0066.495] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.495] lstrlenW (lpString=".pdf") returned 4
	[0066.495] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.495] lstrlenW (lpString=".xls") returned 4
	[0066.495] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.495] lstrlenW (lpString=".xlsx") returned 5
	[0066.495] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.495] lstrlenW (lpString=".ppt") returned 4
	[0066.495] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.495] lstrlenW (lpString=".zip") returned 4
	[0066.495] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.495] lstrlenW (lpString=".rar") returned 4
	[0066.495] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.495] lstrlenW (lpString=".bz2") returned 4
	[0066.495] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.495] lstrlenW (lpString=".7z") returned 3
	[0066.496] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.496] lstrlenW (lpString=".dbf") returned 4
	[0066.496] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.496] lstrlenW (lpString=".1cd") returned 4
	[0066.496] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.496] lstrlenW (lpString=".jpg") returned 4
	[0066.496] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.496] lstrlenW (lpString=".doc") returned 4
	[0066.496] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.496] lstrlenW (lpString=".docx") returned 5
	[0066.496] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.496] lstrlenW (lpString=".pdf") returned 4
	[0066.496] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.496] lstrlenW (lpString=".xls") returned 4
	[0066.496] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.496] lstrlenW (lpString=".xlsx") returned 5
	[0066.496] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.496] lstrlenW (lpString=".ppt") returned 4
	[0066.496] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.497] lstrlenW (lpString=".zip") returned 4
	[0066.497] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.497] lstrlenW (lpString=".rar") returned 4
	[0066.497] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.497] lstrlenW (lpString=".bz2") returned 4
	[0066.497] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.497] lstrlenW (lpString=".7z") returned 3
	[0066.497] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.497] lstrlenW (lpString=".dbf") returned 4
	[0066.497] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.497] lstrlenW (lpString=".1cd") returned 4
	[0066.497] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0066.497] lstrlenW (lpString=".jpg") returned 4
	[0066.497] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.497] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0066.497] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53
	[0066.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0066.498] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1261) returned 1
	[0066.498] CloseHandle (hObject=0x368) returned 1
	[0066.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0066.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0066.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0066.498] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.498] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.498] GetLastError () returned 0x0
	[0066.498] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0066.500] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0066.501] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.501] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.501] SetEndOfFile (hFile=0x314) returned 1
	[0066.501] CloseHandle (hObject=0x314) returned 1
	[0066.502] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.502] SetEndOfFile (hFile=0x368) returned 1
	[0066.503] CloseHandle (hObject=0x368) returned 1
	[0066.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0066.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1
	[0066.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.503] lstrlenW (lpString=".doc") returned 4
	[0066.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.504] lstrlenW (lpString=".docx") returned 5
	[0066.504] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.504] lstrlenW (lpString=".pdf") returned 4
	[0066.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.504] lstrlenW (lpString=".xls") returned 4
	[0066.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.504] lstrlenW (lpString=".xlsx") returned 5
	[0066.504] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.504] lstrlenW (lpString=".ppt") returned 4
	[0066.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.504] lstrlenW (lpString=".zip") returned 4
	[0066.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.504] lstrlenW (lpString=".rar") returned 4
	[0066.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.504] lstrlenW (lpString=".bz2") returned 4
	[0066.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.504] lstrlenW (lpString=".7z") returned 3
	[0066.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.504] lstrlenW (lpString=".dbf") returned 4
	[0066.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.504] lstrlenW (lpString=".1cd") returned 4
	[0066.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.504] lstrlenW (lpString=".jpg") returned 4
	[0066.505] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.505] lstrlenW (lpString=".doc") returned 4
	[0066.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.505] lstrlenW (lpString=".docx") returned 5
	[0066.505] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.505] lstrlenW (lpString=".pdf") returned 4
	[0066.505] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.505] lstrlenW (lpString=".xls") returned 4
	[0066.505] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.505] lstrlenW (lpString=".xlsx") returned 5
	[0066.505] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.505] lstrlenW (lpString=".ppt") returned 4
	[0066.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.505] lstrlenW (lpString=".zip") returned 4
	[0066.505] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.505] lstrlenW (lpString=".rar") returned 4
	[0066.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.505] lstrlenW (lpString=".bz2") returned 4
	[0066.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.505] lstrlenW (lpString=".7z") returned 3
	[0066.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.505] lstrlenW (lpString=".dbf") returned 4
	[0066.506] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.506] lstrlenW (lpString=".1cd") returned 4
	[0066.506] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0066.506] lstrlenW (lpString=".jpg") returned 4
	[0066.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.506] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0066.506] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53
	[0066.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0066.506] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=65002) returned 1
	[0066.506] CloseHandle (hObject=0x368) returned 1
	[0066.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0066.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0066.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0066.507] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.507] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.507] GetLastError () returned 0x0
	[0066.507] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xfdea, lpOverlapped=0x0) returned 1
	[0066.538] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xfdf0, lpOverlapped=0x0) returned 1
	[0066.540] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.540] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.540] SetEndOfFile (hFile=0x314) returned 1
	[0066.540] CloseHandle (hObject=0x314) returned 1
	[0066.542] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.542] SetEndOfFile (hFile=0x368) returned 1
	[0066.543] CloseHandle (hObject=0x368) returned 1
	[0066.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0066.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1
	[0066.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.544] lstrlenW (lpString=".doc") returned 4
	[0066.544] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.544] lstrlenW (lpString=".docx") returned 5
	[0066.544] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.544] lstrlenW (lpString=".pdf") returned 4
	[0066.544] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.544] lstrlenW (lpString=".xls") returned 4
	[0066.544] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.544] lstrlenW (lpString=".xlsx") returned 5
	[0066.544] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.544] lstrlenW (lpString=".ppt") returned 4
	[0066.544] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.544] lstrlenW (lpString=".zip") returned 4
	[0066.544] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.544] lstrlenW (lpString=".rar") returned 4
	[0066.544] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.545] lstrlenW (lpString=".bz2") returned 4
	[0066.545] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.545] lstrlenW (lpString=".7z") returned 3
	[0066.545] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.545] lstrlenW (lpString=".dbf") returned 4
	[0066.545] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.545] lstrlenW (lpString=".1cd") returned 4
	[0066.545] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.545] lstrlenW (lpString=".jpg") returned 4
	[0066.545] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.545] lstrlenW (lpString=".doc") returned 4
	[0066.545] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.545] lstrlenW (lpString=".docx") returned 5
	[0066.545] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.545] lstrlenW (lpString=".pdf") returned 4
	[0066.545] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.545] lstrlenW (lpString=".xls") returned 4
	[0066.545] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.545] lstrlenW (lpString=".xlsx") returned 5
	[0066.545] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.545] lstrlenW (lpString=".ppt") returned 4
	[0066.545] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.545] lstrlenW (lpString=".zip") returned 4
	[0066.546] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.546] lstrlenW (lpString=".rar") returned 4
	[0066.546] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.546] lstrlenW (lpString=".bz2") returned 4
	[0066.546] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.546] lstrlenW (lpString=".7z") returned 3
	[0066.546] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.546] lstrlenW (lpString=".dbf") returned 4
	[0066.546] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.546] lstrlenW (lpString=".1cd") returned 4
	[0066.546] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0066.546] lstrlenW (lpString=".jpg") returned 4
	[0066.546] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.546] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0066.546] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53
	[0066.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0066.546] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1261) returned 1
	[0066.547] CloseHandle (hObject=0x368) returned 1
	[0066.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0066.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0066.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0066.547] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.547] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0066.547] GetLastError () returned 0x0
	[0066.547] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0066.549] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0066.550] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.550] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.550] SetEndOfFile (hFile=0x314) returned 1
	[0066.550] CloseHandle (hObject=0x314) returned 1
	[0066.551] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.551] SetEndOfFile (hFile=0x368) returned 1
	[0066.552] CloseHandle (hObject=0x368) returned 1
	[0066.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0066.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1
	[0066.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.553] lstrlenW (lpString=".doc") returned 4
	[0066.553] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.553] lstrlenW (lpString=".docx") returned 5
	[0066.553] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.553] lstrlenW (lpString=".pdf") returned 4
	[0066.553] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.553] lstrlenW (lpString=".xls") returned 4
	[0066.553] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.553] lstrlenW (lpString=".xlsx") returned 5
	[0066.553] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.553] lstrlenW (lpString=".ppt") returned 4
	[0066.553] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.553] lstrlenW (lpString=".zip") returned 4
	[0066.553] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.554] lstrlenW (lpString=".rar") returned 4
	[0066.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.554] lstrlenW (lpString=".bz2") returned 4
	[0066.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.554] lstrlenW (lpString=".7z") returned 3
	[0066.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.554] lstrlenW (lpString=".dbf") returned 4
	[0066.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.554] lstrlenW (lpString=".1cd") returned 4
	[0066.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.554] lstrlenW (lpString=".jpg") returned 4
	[0066.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.554] lstrlenW (lpString=".doc") returned 4
	[0066.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.554] lstrlenW (lpString=".docx") returned 5
	[0066.554] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.554] lstrlenW (lpString=".pdf") returned 4
	[0066.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.554] lstrlenW (lpString=".xls") returned 4
	[0066.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.555] lstrlenW (lpString=".xlsx") returned 5
	[0066.555] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.555] lstrlenW (lpString=".ppt") returned 4
	[0066.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.555] lstrlenW (lpString=".zip") returned 4
	[0066.555] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.555] lstrlenW (lpString=".rar") returned 4
	[0066.555] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.555] lstrlenW (lpString=".bz2") returned 4
	[0066.555] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.555] lstrlenW (lpString=".7z") returned 3
	[0066.555] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.555] lstrlenW (lpString=".dbf") returned 4
	[0066.555] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.555] lstrlenW (lpString=".1cd") returned 4
	[0066.555] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0066.555] lstrlenW (lpString=".jpg") returned 4
	[0066.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.556] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0066.556] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53
	[0066.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.341] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1261) returned 1
	[0067.341] CloseHandle (hObject=0x388) returned 1
	[0067.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.341] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.341] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0067.342] GetLastError () returned 0x0
	[0067.342] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.343] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.344] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.344] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.344] SetEndOfFile (hFile=0x368) returned 1
	[0067.344] CloseHandle (hObject=0x368) returned 1
	[0067.345] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.345] SetEndOfFile (hFile=0x388) returned 1
	[0067.346] CloseHandle (hObject=0x388) returned 1
	[0067.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.347] lstrlenW (lpString=".doc") returned 4
	[0067.347] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.347] lstrlenW (lpString=".docx") returned 5
	[0067.347] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.347] lstrlenW (lpString=".pdf") returned 4
	[0067.347] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.347] lstrlenW (lpString=".xls") returned 4
	[0067.347] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.347] lstrlenW (lpString=".xlsx") returned 5
	[0067.347] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.347] lstrlenW (lpString=".ppt") returned 4
	[0067.347] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.347] lstrlenW (lpString=".zip") returned 4
	[0067.347] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.348] lstrlenW (lpString=".rar") returned 4
	[0067.348] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.348] lstrlenW (lpString=".bz2") returned 4
	[0067.348] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.348] lstrlenW (lpString=".7z") returned 3
	[0067.348] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.348] lstrlenW (lpString=".dbf") returned 4
	[0067.348] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.348] lstrlenW (lpString=".1cd") returned 4
	[0067.348] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.348] lstrlenW (lpString=".jpg") returned 4
	[0067.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.348] lstrlenW (lpString=".doc") returned 4
	[0067.348] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.348] lstrlenW (lpString=".docx") returned 5
	[0067.348] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.349] lstrlenW (lpString=".pdf") returned 4
	[0067.349] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.349] lstrlenW (lpString=".xls") returned 4
	[0067.349] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.349] lstrlenW (lpString=".xlsx") returned 5
	[0067.349] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.349] lstrlenW (lpString=".ppt") returned 4
	[0067.349] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.349] lstrlenW (lpString=".zip") returned 4
	[0067.349] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.349] lstrlenW (lpString=".rar") returned 4
	[0067.349] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.349] lstrlenW (lpString=".bz2") returned 4
	[0067.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.349] lstrlenW (lpString=".7z") returned 3
	[0067.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.349] lstrlenW (lpString=".dbf") returned 4
	[0067.349] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.349] lstrlenW (lpString=".1cd") returned 4
	[0067.349] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0067.349] lstrlenW (lpString=".jpg") returned 4
	[0067.350] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.350] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.350] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53
	[0067.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.350] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1261) returned 1
	[0067.350] CloseHandle (hObject=0x388) returned 1
	[0067.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.351] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.351] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0067.351] GetLastError () returned 0x0
	[0067.351] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.352] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.353] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.353] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.353] SetEndOfFile (hFile=0x368) returned 1
	[0067.354] CloseHandle (hObject=0x368) returned 1
	[0067.354] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.354] SetEndOfFile (hFile=0x388) returned 1
	[0067.355] CloseHandle (hObject=0x388) returned 1
	[0067.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.356] lstrlenW (lpString=".doc") returned 4
	[0067.356] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.356] lstrlenW (lpString=".docx") returned 5
	[0067.356] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.356] lstrlenW (lpString=".pdf") returned 4
	[0067.356] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.356] lstrlenW (lpString=".xls") returned 4
	[0067.356] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.356] lstrlenW (lpString=".xlsx") returned 5
	[0067.356] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.356] lstrlenW (lpString=".ppt") returned 4
	[0067.356] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.356] lstrlenW (lpString=".zip") returned 4
	[0067.356] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.356] lstrlenW (lpString=".rar") returned 4
	[0067.357] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.357] lstrlenW (lpString=".bz2") returned 4
	[0067.357] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.357] lstrlenW (lpString=".7z") returned 3
	[0067.357] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.357] lstrlenW (lpString=".dbf") returned 4
	[0067.357] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.357] lstrlenW (lpString=".1cd") returned 4
	[0067.357] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.357] lstrlenW (lpString=".jpg") returned 4
	[0067.357] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.357] lstrlenW (lpString=".doc") returned 4
	[0067.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.357] lstrlenW (lpString=".docx") returned 5
	[0067.357] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.357] lstrlenW (lpString=".pdf") returned 4
	[0067.357] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.357] lstrlenW (lpString=".xls") returned 4
	[0067.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.357] lstrlenW (lpString=".xlsx") returned 5
	[0067.357] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.358] lstrlenW (lpString=".ppt") returned 4
	[0067.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.358] lstrlenW (lpString=".zip") returned 4
	[0067.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.358] lstrlenW (lpString=".rar") returned 4
	[0067.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.358] lstrlenW (lpString=".bz2") returned 4
	[0067.358] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.358] lstrlenW (lpString=".7z") returned 3
	[0067.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.358] lstrlenW (lpString=".dbf") returned 4
	[0067.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.358] lstrlenW (lpString=".1cd") returned 4
	[0067.358] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0067.358] lstrlenW (lpString=".jpg") returned 4
	[0067.358] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.359] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.359] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53
	[0067.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.359] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=399528) returned 1
	[0067.359] CloseHandle (hObject=0x388) returned 1
	[0067.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0067.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.359] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.359] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0067.360] GetLastError () returned 0x0
	[0067.360] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x618a8, lpOverlapped=0x0) returned 1
	[0067.368] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x618b0, lpOverlapped=0x0) returned 1
	[0067.375] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.375] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.375] SetEndOfFile (hFile=0x368) returned 1
	[0067.375] CloseHandle (hObject=0x368) returned 1
	[0067.560] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.560] SetEndOfFile (hFile=0x388) returned 1
	[0067.564] CloseHandle (hObject=0x388) returned 1
	[0067.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.565] lstrlenW (lpString=".doc") returned 4
	[0067.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.565] lstrlenW (lpString=".docx") returned 5
	[0067.565] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.565] lstrlenW (lpString=".pdf") returned 4
	[0067.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.565] lstrlenW (lpString=".xls") returned 4
	[0067.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.565] lstrlenW (lpString=".xlsx") returned 5
	[0067.565] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.565] lstrlenW (lpString=".ppt") returned 4
	[0067.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.565] lstrlenW (lpString=".zip") returned 4
	[0067.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.565] lstrlenW (lpString=".rar") returned 4
	[0067.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.565] lstrlenW (lpString=".bz2") returned 4
	[0067.565] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.565] lstrlenW (lpString=".7z") returned 3
	[0067.565] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.566] lstrlenW (lpString=".dbf") returned 4
	[0067.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.566] lstrlenW (lpString=".1cd") returned 4
	[0067.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.566] lstrlenW (lpString=".jpg") returned 4
	[0067.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.566] lstrlenW (lpString=".doc") returned 4
	[0067.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.566] lstrlenW (lpString=".docx") returned 5
	[0067.566] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.566] lstrlenW (lpString=".pdf") returned 4
	[0067.566] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.566] lstrlenW (lpString=".xls") returned 4
	[0067.566] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.566] lstrlenW (lpString=".xlsx") returned 5
	[0067.566] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.566] lstrlenW (lpString=".ppt") returned 4
	[0067.566] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.567] lstrlenW (lpString=".zip") returned 4
	[0067.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.567] lstrlenW (lpString=".rar") returned 4
	[0067.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.567] lstrlenW (lpString=".bz2") returned 4
	[0067.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.567] lstrlenW (lpString=".7z") returned 3
	[0067.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.567] lstrlenW (lpString=".dbf") returned 4
	[0067.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.567] lstrlenW (lpString=".1cd") returned 4
	[0067.567] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.567] lstrlenW (lpString=".jpg") returned 4
	[0067.567] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.567] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.567] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53
	[0067.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.568] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1261) returned 1
	[0067.568] CloseHandle (hObject=0x388) returned 1
	[0067.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.568] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.568] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0067.568] GetLastError () returned 0x0
	[0067.568] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.570] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.571] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.571] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.571] SetEndOfFile (hFile=0x368) returned 1
	[0067.571] CloseHandle (hObject=0x368) returned 1
	[0067.572] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.572] SetEndOfFile (hFile=0x388) returned 1
	[0067.573] CloseHandle (hObject=0x388) returned 1
	[0067.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.573] lstrlenW (lpString=".doc") returned 4
	[0067.573] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.574] lstrlenW (lpString=".docx") returned 5
	[0067.574] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.574] lstrlenW (lpString=".pdf") returned 4
	[0067.574] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.574] lstrlenW (lpString=".xls") returned 4
	[0067.574] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.574] lstrlenW (lpString=".xlsx") returned 5
	[0067.574] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.574] lstrlenW (lpString=".ppt") returned 4
	[0067.574] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.574] lstrlenW (lpString=".zip") returned 4
	[0067.574] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.574] lstrlenW (lpString=".rar") returned 4
	[0067.574] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.574] lstrlenW (lpString=".bz2") returned 4
	[0067.574] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.574] lstrlenW (lpString=".7z") returned 3
	[0067.574] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.574] lstrlenW (lpString=".dbf") returned 4
	[0067.574] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.574] lstrlenW (lpString=".1cd") returned 4
	[0067.574] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.574] lstrlenW (lpString=".jpg") returned 4
	[0067.575] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.575] lstrlenW (lpString=".doc") returned 4
	[0067.575] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.575] lstrlenW (lpString=".docx") returned 5
	[0067.575] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.575] lstrlenW (lpString=".pdf") returned 4
	[0067.575] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.575] lstrlenW (lpString=".xls") returned 4
	[0067.575] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.575] lstrlenW (lpString=".xlsx") returned 5
	[0067.575] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.575] lstrlenW (lpString=".ppt") returned 4
	[0067.575] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.575] lstrlenW (lpString=".zip") returned 4
	[0067.575] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.575] lstrlenW (lpString=".rar") returned 4
	[0067.575] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.575] lstrlenW (lpString=".bz2") returned 4
	[0067.575] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.575] lstrlenW (lpString=".7z") returned 3
	[0067.575] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.576] lstrlenW (lpString=".dbf") returned 4
	[0067.576] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.576] lstrlenW (lpString=".1cd") returned 4
	[0067.576] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.576] lstrlenW (lpString=".jpg") returned 4
	[0067.576] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.576] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.576] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53
	[0067.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.576] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3375) returned 1
	[0067.576] CloseHandle (hObject=0x388) returned 1
	[0067.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0067.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.577] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.577] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0067.580] GetLastError () returned 0x0
	[0067.580] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xd2f, lpOverlapped=0x0) returned 1
	[0067.582] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xd30, lpOverlapped=0x0) returned 1
	[0067.583] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.583] WriteFile (in: hFile=0x368, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.583] SetEndOfFile (hFile=0x368) returned 1
	[0067.583] CloseHandle (hObject=0x368) returned 1
	[0067.584] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.584] SetEndOfFile (hFile=0x388) returned 1
	[0067.585] CloseHandle (hObject=0x388) returned 1
	[0067.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.585] lstrlenW (lpString=".doc") returned 4
	[0067.585] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.585] lstrlenW (lpString=".docx") returned 5
	[0067.585] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.585] lstrlenW (lpString=".pdf") returned 4
	[0067.585] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.585] lstrlenW (lpString=".xls") returned 4
	[0067.586] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.586] lstrlenW (lpString=".xlsx") returned 5
	[0067.586] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.586] lstrlenW (lpString=".ppt") returned 4
	[0067.586] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.586] lstrlenW (lpString=".zip") returned 4
	[0067.586] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.586] lstrlenW (lpString=".rar") returned 4
	[0067.586] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.586] lstrlenW (lpString=".bz2") returned 4
	[0067.586] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.586] lstrlenW (lpString=".7z") returned 3
	[0067.586] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.586] lstrlenW (lpString=".dbf") returned 4
	[0067.586] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.586] lstrlenW (lpString=".1cd") returned 4
	[0067.586] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.586] lstrlenW (lpString=".jpg") returned 4
	[0067.586] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.587] lstrlenW (lpString=".doc") returned 4
	[0067.587] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.587] lstrlenW (lpString=".docx") returned 5
	[0067.587] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.587] lstrlenW (lpString=".pdf") returned 4
	[0067.587] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.587] lstrlenW (lpString=".xls") returned 4
	[0067.587] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.587] lstrlenW (lpString=".xlsx") returned 5
	[0067.587] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.587] lstrlenW (lpString=".ppt") returned 4
	[0067.587] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.587] lstrlenW (lpString=".zip") returned 4
	[0067.587] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.587] lstrlenW (lpString=".rar") returned 4
	[0067.587] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.587] lstrlenW (lpString=".bz2") returned 4
	[0067.587] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.587] lstrlenW (lpString=".7z") returned 3
	[0067.587] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.587] lstrlenW (lpString=".dbf") returned 4
	[0067.587] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.587] lstrlenW (lpString=".1cd") returned 4
	[0067.587] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0067.588] lstrlenW (lpString=".jpg") returned 4
	[0067.588] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.588] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.588] lstrlenW (lpString="AppXManifest.common.xml") returned 23
	[0067.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.588] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2173046) returned 1
	[0067.588] CloseHandle (hObject=0x388) returned 1
	[0067.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220
	[0067.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[admin@stex777.com].money")) returned 1
	[0067.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.589] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fc64 | out: lpNewFilePointer=0x0) returned 1
	[0067.589] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fc24 | out: lpNewFilePointer=0x0) returned 1
	[0067.589] ReadFile (in: hFile=0x388, lpBuffer=0x3339058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a2fc30, lpOverlapped=0x0 | out: lpBuffer=0x3339058*, lpNumberOfBytesRead=0x2a2fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0067.762] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fc24 | out: lpNewFilePointer=0x0) returned 1
	[0067.762] ReadFile (in: hFile=0x388, lpBuffer=0x3379058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a2fc30, lpOverlapped=0x0 | out: lpBuffer=0x3379058*, lpNumberOfBytesRead=0x2a2fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0067.765] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a2fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0067.765] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fc24 | out: lpNewFilePointer=0x0) returned 1
	[0067.765] ReadFile (in: hFile=0x388, lpBuffer=0x33b9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a2fc30, lpOverlapped=0x0 | out: lpBuffer=0x33b9058*, lpNumberOfBytesRead=0x2a2fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0067.789] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.790] WriteFile (in: hFile=0x388, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x2a2fca8, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fca8*=0xc011a, lpOverlapped=0x0) returned 1
	[0067.979] SetEndOfFile (hFile=0x388) returned 1
	[0067.979] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x42c45a0
	[0067.986] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fc74 | out: lpNewFilePointer=0x0) returned 1
	[0067.986] WriteFile (in: hFile=0x388, lpBuffer=0x42c45a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a2fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c45a0*, lpNumberOfBytesWritten=0x2a2fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0067.987] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fc74 | out: lpNewFilePointer=0x0) returned 1
	[0067.987] WriteFile (in: hFile=0x388, lpBuffer=0x42c45a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a2fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c45a0*, lpNumberOfBytesWritten=0x2a2fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0067.990] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fc74 | out: lpNewFilePointer=0x0) returned 1
	[0067.990] WriteFile (in: hFile=0x388, lpBuffer=0x42c45a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a2fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c45a0*, lpNumberOfBytesWritten=0x2a2fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0067.991] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c45a0 | out: hHeap=0x600000) returned 1
	[0067.993] CloseHandle (hObject=0x388) returned 1
	[0068.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.735] lstrlenW (lpString=".doc") returned 4
	[0068.735] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.735] lstrlenW (lpString=".docx") returned 5
	[0068.735] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0068.735] lstrlenW (lpString=".pdf") returned 4
	[0068.735] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.735] lstrlenW (lpString=".xls") returned 4
	[0068.735] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.735] lstrlenW (lpString=".xlsx") returned 5
	[0068.735] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0068.735] lstrlenW (lpString=".ppt") returned 4
	[0068.736] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.736] lstrlenW (lpString=".zip") returned 4
	[0068.736] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.736] lstrlenW (lpString=".rar") returned 4
	[0068.736] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.736] lstrlenW (lpString=".bz2") returned 4
	[0068.736] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.736] lstrlenW (lpString=".7z") returned 3
	[0068.736] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.736] lstrlenW (lpString=".dbf") returned 4
	[0068.736] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.736] lstrlenW (lpString=".1cd") returned 4
	[0068.736] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.736] lstrlenW (lpString=".jpg") returned 4
	[0068.736] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.736] lstrlenW (lpString=".doc") returned 4
	[0068.736] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.737] lstrlenW (lpString=".docx") returned 5
	[0068.737] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0068.737] lstrlenW (lpString=".pdf") returned 4
	[0068.737] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.737] lstrlenW (lpString=".xls") returned 4
	[0068.737] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.737] lstrlenW (lpString=".xlsx") returned 5
	[0068.737] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0068.737] lstrlenW (lpString=".ppt") returned 4
	[0068.737] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.737] lstrlenW (lpString=".zip") returned 4
	[0068.737] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.737] lstrlenW (lpString=".rar") returned 4
	[0068.737] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.737] lstrlenW (lpString=".bz2") returned 4
	[0068.737] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.737] lstrlenW (lpString=".7z") returned 3
	[0068.737] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.737] lstrlenW (lpString=".dbf") returned 4
	[0068.737] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.738] lstrlenW (lpString=".1cd") returned 4
	[0068.738] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0068.738] lstrlenW (lpString=".jpg") returned 4
	[0068.738] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.738] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.738] lstrlenW (lpString="AG00154_.GIF") returned 12
	[0068.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0068.743] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=5315) returned 1
	[0068.743] CloseHandle (hObject=0x388) returned 1
	[0068.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220
	[0068.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0068.744] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.744] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0069.005] GetLastError () returned 0x0
	[0069.005] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x14c3, lpOverlapped=0x0) returned 1
	[0069.008] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x14d0, lpOverlapped=0x0) returned 1
	[0069.009] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.009] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.010] SetEndOfFile (hFile=0x33c) returned 1
	[0069.010] CloseHandle (hObject=0x33c) returned 1
	[0069.012] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.012] SetEndOfFile (hFile=0x388) returned 1
	[0069.013] CloseHandle (hObject=0x388) returned 1
	[0069.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1
	[0069.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.014] lstrlenW (lpString=".doc") returned 4
	[0069.014] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.014] lstrlenW (lpString=".docx") returned 5
	[0069.014] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.014] lstrlenW (lpString=".pdf") returned 4
	[0069.014] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.014] lstrlenW (lpString=".xls") returned 4
	[0069.014] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.014] lstrlenW (lpString=".xlsx") returned 5
	[0069.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.014] lstrlenW (lpString=".ppt") returned 4
	[0069.014] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.014] lstrlenW (lpString=".zip") returned 4
	[0069.014] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.014] lstrlenW (lpString=".rar") returned 4
	[0069.014] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.014] lstrlenW (lpString=".bz2") returned 4
	[0069.014] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.014] lstrlenW (lpString=".7z") returned 3
	[0069.014] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.015] lstrlenW (lpString=".dbf") returned 4
	[0069.015] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.015] lstrlenW (lpString=".1cd") returned 4
	[0069.015] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.015] lstrlenW (lpString=".jpg") returned 4
	[0069.015] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.015] lstrlenW (lpString=".doc") returned 4
	[0069.015] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.015] lstrlenW (lpString=".docx") returned 5
	[0069.015] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.015] lstrlenW (lpString=".pdf") returned 4
	[0069.015] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.015] lstrlenW (lpString=".xls") returned 4
	[0069.015] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.015] lstrlenW (lpString=".xlsx") returned 5
	[0069.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.015] lstrlenW (lpString=".ppt") returned 4
	[0069.016] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.016] lstrlenW (lpString=".zip") returned 4
	[0069.016] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.016] lstrlenW (lpString=".rar") returned 4
	[0069.016] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.016] lstrlenW (lpString=".bz2") returned 4
	[0069.016] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.016] lstrlenW (lpString=".7z") returned 3
	[0069.016] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.016] lstrlenW (lpString=".dbf") returned 4
	[0069.016] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.016] lstrlenW (lpString=".1cd") returned 4
	[0069.016] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0069.016] lstrlenW (lpString=".jpg") returned 4
	[0069.016] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.017] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.017] lstrlenW (lpString="AG00163_.GIF") returned 12
	[0069.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0069.017] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=6984) returned 1
	[0069.017] CloseHandle (hObject=0x388) returned 1
	[0069.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220
	[0069.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0069.017] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.018] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0069.018] GetLastError () returned 0x0
	[0069.018] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1b48, lpOverlapped=0x0) returned 1
	[0069.034] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1b50, lpOverlapped=0x0) returned 1
	[0069.035] ReadFile (in: hFile=0x388, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.035] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.035] SetEndOfFile (hFile=0x33c) returned 1
	[0069.035] CloseHandle (hObject=0x33c) returned 1
	[0069.036] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.036] SetEndOfFile (hFile=0x388) returned 1
	[0069.037] CloseHandle (hObject=0x388) returned 1
	[0069.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1
	[0069.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.037] lstrlenW (lpString=".doc") returned 4
	[0069.037] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.038] lstrlenW (lpString=".docx") returned 5
	[0069.038] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.038] lstrlenW (lpString=".pdf") returned 4
	[0069.038] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.038] lstrlenW (lpString=".xls") returned 4
	[0069.038] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.038] lstrlenW (lpString=".xlsx") returned 5
	[0069.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.038] lstrlenW (lpString=".ppt") returned 4
	[0069.038] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.038] lstrlenW (lpString=".zip") returned 4
	[0069.038] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.038] lstrlenW (lpString=".rar") returned 4
	[0069.038] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.038] lstrlenW (lpString=".bz2") returned 4
	[0069.038] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.038] lstrlenW (lpString=".7z") returned 3
	[0069.038] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.038] lstrlenW (lpString=".dbf") returned 4
	[0069.038] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.038] lstrlenW (lpString=".1cd") returned 4
	[0069.038] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.038] lstrlenW (lpString=".jpg") returned 4
	[0069.038] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.039] lstrlenW (lpString=".doc") returned 4
	[0069.039] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.039] lstrlenW (lpString=".docx") returned 5
	[0069.039] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.039] lstrlenW (lpString=".pdf") returned 4
	[0069.039] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.039] lstrlenW (lpString=".xls") returned 4
	[0069.039] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.039] lstrlenW (lpString=".xlsx") returned 5
	[0069.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.039] lstrlenW (lpString=".ppt") returned 4
	[0069.039] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.039] lstrlenW (lpString=".zip") returned 4
	[0069.039] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.039] lstrlenW (lpString=".rar") returned 4
	[0069.039] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.039] lstrlenW (lpString=".bz2") returned 4
	[0069.039] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.039] lstrlenW (lpString=".7z") returned 3
	[0069.039] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.039] lstrlenW (lpString=".dbf") returned 4
	[0069.039] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.039] lstrlenW (lpString=".1cd") returned 4
	[0069.039] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0069.040] lstrlenW (lpString=".jpg") returned 4
	[0069.040] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.040] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.040] lstrlenW (lpString="AG00165_.GIF") returned 12
	[0069.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0069.049] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=8582) returned 1
	[0069.049] CloseHandle (hObject=0x34c) returned 1
	[0069.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220
	[0069.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0069.049] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.050] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0069.051] GetLastError () returned 0x0
	[0069.051] ReadFile (in: hFile=0x34c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x2186, lpOverlapped=0x0) returned 1
	[0069.054] WriteFile (in: hFile=0x390, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x2190, lpOverlapped=0x0) returned 1
	[0069.055] ReadFile (in: hFile=0x34c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.055] WriteFile (in: hFile=0x390, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.055] SetEndOfFile (hFile=0x390) returned 1
	[0069.055] CloseHandle (hObject=0x390) returned 1
	[0069.056] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.057] SetEndOfFile (hFile=0x34c) returned 1
	[0069.057] CloseHandle (hObject=0x34c) returned 1
	[0069.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1
	[0069.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.058] lstrlenW (lpString=".doc") returned 4
	[0069.058] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.058] lstrlenW (lpString=".docx") returned 5
	[0069.058] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.058] lstrlenW (lpString=".pdf") returned 4
	[0069.058] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.058] lstrlenW (lpString=".xls") returned 4
	[0069.058] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.059] lstrlenW (lpString=".xlsx") returned 5
	[0069.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.059] lstrlenW (lpString=".ppt") returned 4
	[0069.059] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.059] lstrlenW (lpString=".zip") returned 4
	[0069.059] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.059] lstrlenW (lpString=".rar") returned 4
	[0069.059] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.059] lstrlenW (lpString=".bz2") returned 4
	[0069.059] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.059] lstrlenW (lpString=".7z") returned 3
	[0069.059] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.059] lstrlenW (lpString=".dbf") returned 4
	[0069.059] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.059] lstrlenW (lpString=".1cd") returned 4
	[0069.059] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.059] lstrlenW (lpString=".jpg") returned 4
	[0069.059] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.060] lstrlenW (lpString=".doc") returned 4
	[0069.060] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.060] lstrlenW (lpString=".docx") returned 5
	[0069.060] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.060] lstrlenW (lpString=".pdf") returned 4
	[0069.060] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.060] lstrlenW (lpString=".xls") returned 4
	[0069.060] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.060] lstrlenW (lpString=".xlsx") returned 5
	[0069.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.060] lstrlenW (lpString=".ppt") returned 4
	[0069.060] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.060] lstrlenW (lpString=".zip") returned 4
	[0069.060] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.060] lstrlenW (lpString=".rar") returned 4
	[0069.060] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.060] lstrlenW (lpString=".bz2") returned 4
	[0069.061] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.061] lstrlenW (lpString=".7z") returned 3
	[0069.061] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.061] lstrlenW (lpString=".dbf") returned 4
	[0069.061] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.061] lstrlenW (lpString=".1cd") returned 4
	[0069.061] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0069.061] lstrlenW (lpString=".jpg") returned 4
	[0069.061] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.061] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.061] lstrlenW (lpString="AG00169_.GIF") returned 12
	[0069.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0069.423] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=5375) returned 1
	[0069.424] CloseHandle (hObject=0x37c) returned 1
	[0069.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220
	[0069.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0069.424] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.424] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0069.778] GetLastError () returned 0x0
	[0069.778] ReadFile (in: hFile=0x37c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x14ff, lpOverlapped=0x0) returned 1
	[0069.780] WriteFile (in: hFile=0x38c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1500, lpOverlapped=0x0) returned 1
	[0069.781] ReadFile (in: hFile=0x37c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.781] WriteFile (in: hFile=0x38c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.781] SetEndOfFile (hFile=0x38c) returned 1
	[0069.781] CloseHandle (hObject=0x38c) returned 1
	[0069.782] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.782] SetEndOfFile (hFile=0x37c) returned 1
	[0069.783] CloseHandle (hObject=0x37c) returned 1
	[0069.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1
	[0069.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.783] lstrlenW (lpString=".doc") returned 4
	[0069.783] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.783] lstrlenW (lpString=".docx") returned 5
	[0069.783] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.784] lstrlenW (lpString=".pdf") returned 4
	[0069.784] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.784] lstrlenW (lpString=".xls") returned 4
	[0069.784] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.784] lstrlenW (lpString=".xlsx") returned 5
	[0069.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.784] lstrlenW (lpString=".ppt") returned 4
	[0069.784] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.784] lstrlenW (lpString=".zip") returned 4
	[0069.784] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.784] lstrlenW (lpString=".rar") returned 4
	[0069.784] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.784] lstrlenW (lpString=".bz2") returned 4
	[0069.784] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.784] lstrlenW (lpString=".7z") returned 3
	[0069.784] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.784] lstrlenW (lpString=".dbf") returned 4
	[0069.784] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.784] lstrlenW (lpString=".1cd") returned 4
	[0069.784] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.784] lstrlenW (lpString=".jpg") returned 4
	[0069.784] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.785] lstrlenW (lpString=".doc") returned 4
	[0069.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.785] lstrlenW (lpString=".docx") returned 5
	[0069.785] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.785] lstrlenW (lpString=".pdf") returned 4
	[0069.785] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.785] lstrlenW (lpString=".xls") returned 4
	[0069.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.785] lstrlenW (lpString=".xlsx") returned 5
	[0069.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.785] lstrlenW (lpString=".ppt") returned 4
	[0069.785] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.785] lstrlenW (lpString=".zip") returned 4
	[0069.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.785] lstrlenW (lpString=".rar") returned 4
	[0069.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.785] lstrlenW (lpString=".bz2") returned 4
	[0069.785] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.785] lstrlenW (lpString=".7z") returned 3
	[0069.785] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.785] lstrlenW (lpString=".dbf") returned 4
	[0069.785] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.785] lstrlenW (lpString=".1cd") returned 4
	[0069.785] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0069.785] lstrlenW (lpString=".jpg") returned 4
	[0069.786] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.786] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.786] lstrlenW (lpString="AG00176_.GIF") returned 12
	[0069.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0069.787] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3120) returned 1
	[0069.787] CloseHandle (hObject=0x38c) returned 1
	[0069.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220
	[0069.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0069.787] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.787] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0069.787] GetLastError () returned 0x0
	[0069.788] ReadFile (in: hFile=0x38c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xc30, lpOverlapped=0x0) returned 1
	[0069.789] WriteFile (in: hFile=0x34c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xc40, lpOverlapped=0x0) returned 1
	[0069.790] ReadFile (in: hFile=0x38c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.790] WriteFile (in: hFile=0x34c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.790] SetEndOfFile (hFile=0x34c) returned 1
	[0069.790] CloseHandle (hObject=0x34c) returned 1
	[0069.791] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.791] SetEndOfFile (hFile=0x38c) returned 1
	[0069.792] CloseHandle (hObject=0x38c) returned 1
	[0069.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1
	[0069.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.792] lstrlenW (lpString=".doc") returned 4
	[0069.792] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.793] lstrlenW (lpString=".docx") returned 5
	[0069.793] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.793] lstrlenW (lpString=".pdf") returned 4
	[0069.793] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.793] lstrlenW (lpString=".xls") returned 4
	[0069.793] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.793] lstrlenW (lpString=".xlsx") returned 5
	[0069.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.793] lstrlenW (lpString=".ppt") returned 4
	[0069.793] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.793] lstrlenW (lpString=".zip") returned 4
	[0069.793] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.793] lstrlenW (lpString=".rar") returned 4
	[0069.793] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.793] lstrlenW (lpString=".bz2") returned 4
	[0069.793] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.793] lstrlenW (lpString=".7z") returned 3
	[0069.793] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.793] lstrlenW (lpString=".dbf") returned 4
	[0069.793] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.793] lstrlenW (lpString=".1cd") returned 4
	[0069.793] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.793] lstrlenW (lpString=".jpg") returned 4
	[0069.793] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.794] lstrlenW (lpString=".doc") returned 4
	[0069.794] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.794] lstrlenW (lpString=".docx") returned 5
	[0069.794] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.794] lstrlenW (lpString=".pdf") returned 4
	[0069.794] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.794] lstrlenW (lpString=".xls") returned 4
	[0069.794] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.794] lstrlenW (lpString=".xlsx") returned 5
	[0069.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.794] lstrlenW (lpString=".ppt") returned 4
	[0069.794] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.794] lstrlenW (lpString=".zip") returned 4
	[0069.794] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.794] lstrlenW (lpString=".rar") returned 4
	[0069.794] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.794] lstrlenW (lpString=".bz2") returned 4
	[0069.794] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.794] lstrlenW (lpString=".7z") returned 3
	[0069.794] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.794] lstrlenW (lpString=".dbf") returned 4
	[0069.794] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.794] lstrlenW (lpString=".1cd") returned 4
	[0069.794] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0069.795] lstrlenW (lpString=".jpg") returned 4
	[0069.795] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.795] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0069.795] lstrlenW (lpString="AN00010_.WMF") returned 12
	[0069.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0069.795] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3026) returned 1
	[0069.795] CloseHandle (hObject=0x38c) returned 1
	[0069.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220
	[0069.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0069.795] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.795] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0069.799] GetLastError () returned 0x0
	[0069.799] ReadFile (in: hFile=0x38c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xbd2, lpOverlapped=0x0) returned 1
	[0069.800] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xbe0, lpOverlapped=0x0) returned 1
	[0069.801] ReadFile (in: hFile=0x38c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.801] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.802] SetEndOfFile (hFile=0x37c) returned 1
	[0069.802] CloseHandle (hObject=0x37c) returned 1
	[0069.802] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.802] SetEndOfFile (hFile=0x38c) returned 1
	[0069.803] CloseHandle (hObject=0x38c) returned 1
	[0069.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1
	[0069.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.804] lstrlenW (lpString=".doc") returned 4
	[0069.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0069.804] lstrlenW (lpString=".docx") returned 5
	[0069.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0069.804] lstrlenW (lpString=".pdf") returned 4
	[0069.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0069.804] lstrlenW (lpString=".xls") returned 4
	[0069.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0069.804] lstrlenW (lpString=".xlsx") returned 5
	[0069.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0069.804] lstrlenW (lpString=".ppt") returned 4
	[0069.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0069.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.804] lstrlenW (lpString=".zip") returned 4
	[0069.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0069.804] lstrlenW (lpString=".rar") returned 4
	[0069.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0069.804] lstrlenW (lpString=".bz2") returned 4
	[0069.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0069.805] lstrlenW (lpString=".7z") returned 3
	[0069.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0069.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.805] lstrlenW (lpString=".dbf") returned 4
	[0069.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0069.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.805] lstrlenW (lpString=".1cd") returned 4
	[0069.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0069.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.805] lstrlenW (lpString=".jpg") returned 4
	[0069.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0069.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.805] lstrlenW (lpString=".doc") returned 4
	[0069.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0069.805] lstrlenW (lpString=".docx") returned 5
	[0069.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0069.805] lstrlenW (lpString=".pdf") returned 4
	[0069.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0069.805] lstrlenW (lpString=".xls") returned 4
	[0069.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0069.805] lstrlenW (lpString=".xlsx") returned 5
	[0069.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0069.806] lstrlenW (lpString=".ppt") returned 4
	[0069.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0069.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.806] lstrlenW (lpString=".zip") returned 4
	[0069.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0069.806] lstrlenW (lpString=".rar") returned 4
	[0069.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0069.806] lstrlenW (lpString=".bz2") returned 4
	[0069.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0069.806] lstrlenW (lpString=".7z") returned 3
	[0069.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0069.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.806] lstrlenW (lpString=".dbf") returned 4
	[0069.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0069.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.806] lstrlenW (lpString=".1cd") returned 4
	[0069.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0069.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0069.806] lstrlenW (lpString=".jpg") returned 4
	[0069.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0069.807] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0069.807] lstrlenW (lpString="AN00015_.WMF") returned 12
	[0069.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0069.807] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=4734) returned 1
	[0069.807] CloseHandle (hObject=0x38c) returned 1
	[0069.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220
	[0069.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0069.807] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.807] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0069.808] GetLastError () returned 0x0
	[0069.808] ReadFile (in: hFile=0x38c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x127e, lpOverlapped=0x0) returned 1
	[0069.809] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1280, lpOverlapped=0x0) returned 1
	[0069.810] ReadFile (in: hFile=0x38c, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.810] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.810] SetEndOfFile (hFile=0x37c) returned 1
	[0069.810] CloseHandle (hObject=0x37c) returned 1
	[0069.811] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.811] SetEndOfFile (hFile=0x38c) returned 1
	[0069.812] CloseHandle (hObject=0x38c) returned 1
	[0069.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1
	[0069.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.813] lstrlenW (lpString=".doc") returned 4
	[0069.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0069.813] lstrlenW (lpString=".docx") returned 5
	[0069.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0069.813] lstrlenW (lpString=".pdf") returned 4
	[0069.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0069.813] lstrlenW (lpString=".xls") returned 4
	[0069.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0069.813] lstrlenW (lpString=".xlsx") returned 5
	[0069.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0069.813] lstrlenW (lpString=".ppt") returned 4
	[0069.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0069.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.813] lstrlenW (lpString=".zip") returned 4
	[0069.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0069.813] lstrlenW (lpString=".rar") returned 4
	[0069.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0069.813] lstrlenW (lpString=".bz2") returned 4
	[0069.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0069.813] lstrlenW (lpString=".7z") returned 3
	[0069.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0069.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.813] lstrlenW (lpString=".dbf") returned 4
	[0069.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0069.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.813] lstrlenW (lpString=".1cd") returned 4
	[0069.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0069.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.814] lstrlenW (lpString=".jpg") returned 4
	[0069.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0069.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.814] lstrlenW (lpString=".doc") returned 4
	[0069.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0069.814] lstrlenW (lpString=".docx") returned 5
	[0069.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0069.814] lstrlenW (lpString=".pdf") returned 4
	[0069.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0069.814] lstrlenW (lpString=".xls") returned 4
	[0069.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0069.814] lstrlenW (lpString=".xlsx") returned 5
	[0069.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0069.814] lstrlenW (lpString=".ppt") returned 4
	[0069.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0069.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.814] lstrlenW (lpString=".zip") returned 4
	[0069.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0069.814] lstrlenW (lpString=".rar") returned 4
	[0069.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0069.814] lstrlenW (lpString=".bz2") returned 4
	[0069.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0069.814] lstrlenW (lpString=".7z") returned 3
	[0069.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0069.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.814] lstrlenW (lpString=".dbf") returned 4
	[0069.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0069.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.815] lstrlenW (lpString=".1cd") returned 4
	[0069.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0069.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0069.815] lstrlenW (lpString=".jpg") returned 4
	[0069.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0069.815] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0069.815] lstrlenW (lpString="AN00790_.WMF") returned 12
	[0069.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.176] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=5684) returned 1
	[0070.179] CloseHandle (hObject=0x380) returned 1
	[0070.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220
	[0070.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.201] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.201] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0070.202] GetLastError () returned 0x0
	[0070.202] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1634, lpOverlapped=0x0) returned 1
	[0070.203] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1640, lpOverlapped=0x0) returned 1
	[0070.204] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.204] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.204] SetEndOfFile (hFile=0x350) returned 1
	[0070.205] CloseHandle (hObject=0x350) returned 1
	[0070.205] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.205] SetEndOfFile (hFile=0x380) returned 1
	[0070.206] CloseHandle (hObject=0x380) returned 1
	[0070.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1
	[0070.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.207] lstrlenW (lpString=".doc") returned 4
	[0070.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.207] lstrlenW (lpString=".docx") returned 5
	[0070.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.207] lstrlenW (lpString=".pdf") returned 4
	[0070.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.207] lstrlenW (lpString=".xls") returned 4
	[0070.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.207] lstrlenW (lpString=".xlsx") returned 5
	[0070.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.207] lstrlenW (lpString=".ppt") returned 4
	[0070.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.207] lstrlenW (lpString=".zip") returned 4
	[0070.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.208] lstrlenW (lpString=".rar") returned 4
	[0070.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.208] lstrlenW (lpString=".bz2") returned 4
	[0070.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.208] lstrlenW (lpString=".7z") returned 3
	[0070.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.208] lstrlenW (lpString=".dbf") returned 4
	[0070.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.208] lstrlenW (lpString=".1cd") returned 4
	[0070.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.208] lstrlenW (lpString=".jpg") returned 4
	[0070.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.208] lstrlenW (lpString=".doc") returned 4
	[0070.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.209] lstrlenW (lpString=".docx") returned 5
	[0070.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.209] lstrlenW (lpString=".pdf") returned 4
	[0070.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.209] lstrlenW (lpString=".xls") returned 4
	[0070.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.209] lstrlenW (lpString=".xlsx") returned 5
	[0070.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.209] lstrlenW (lpString=".ppt") returned 4
	[0070.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.209] lstrlenW (lpString=".zip") returned 4
	[0070.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.209] lstrlenW (lpString=".rar") returned 4
	[0070.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.209] lstrlenW (lpString=".bz2") returned 4
	[0070.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.209] lstrlenW (lpString=".7z") returned 3
	[0070.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.209] lstrlenW (lpString=".dbf") returned 4
	[0070.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.210] lstrlenW (lpString=".1cd") returned 4
	[0070.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.210] lstrlenW (lpString=".jpg") returned 4
	[0070.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.210] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.210] lstrlenW (lpString="AN01216_.WMF") returned 12
	[0070.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.210] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=5836) returned 1
	[0070.210] CloseHandle (hObject=0x380) returned 1
	[0070.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220
	[0070.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.211] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.211] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0070.211] GetLastError () returned 0x0
	[0070.211] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x16cc, lpOverlapped=0x0) returned 1
	[0070.213] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x16d0, lpOverlapped=0x0) returned 1
	[0070.214] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.214] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.214] SetEndOfFile (hFile=0x350) returned 1
	[0070.214] CloseHandle (hObject=0x350) returned 1
	[0070.215] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.215] SetEndOfFile (hFile=0x380) returned 1
	[0070.216] CloseHandle (hObject=0x380) returned 1
	[0070.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1
	[0070.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.217] lstrlenW (lpString=".doc") returned 4
	[0070.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.217] lstrlenW (lpString=".docx") returned 5
	[0070.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.217] lstrlenW (lpString=".pdf") returned 4
	[0070.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.217] lstrlenW (lpString=".xls") returned 4
	[0070.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.217] lstrlenW (lpString=".xlsx") returned 5
	[0070.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.217] lstrlenW (lpString=".ppt") returned 4
	[0070.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.217] lstrlenW (lpString=".zip") returned 4
	[0070.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.217] lstrlenW (lpString=".rar") returned 4
	[0070.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.218] lstrlenW (lpString=".bz2") returned 4
	[0070.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.218] lstrlenW (lpString=".7z") returned 3
	[0070.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.218] lstrlenW (lpString=".dbf") returned 4
	[0070.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.218] lstrlenW (lpString=".1cd") returned 4
	[0070.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.218] lstrlenW (lpString=".jpg") returned 4
	[0070.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.218] lstrlenW (lpString=".doc") returned 4
	[0070.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.218] lstrlenW (lpString=".docx") returned 5
	[0070.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.218] lstrlenW (lpString=".pdf") returned 4
	[0070.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.218] lstrlenW (lpString=".xls") returned 4
	[0070.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.219] lstrlenW (lpString=".xlsx") returned 5
	[0070.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.219] lstrlenW (lpString=".ppt") returned 4
	[0070.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.219] lstrlenW (lpString=".zip") returned 4
	[0070.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.219] lstrlenW (lpString=".rar") returned 4
	[0070.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.219] lstrlenW (lpString=".bz2") returned 4
	[0070.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.219] lstrlenW (lpString=".7z") returned 3
	[0070.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.219] lstrlenW (lpString=".dbf") returned 4
	[0070.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.219] lstrlenW (lpString=".1cd") returned 4
	[0070.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0070.219] lstrlenW (lpString=".jpg") returned 4
	[0070.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.219] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.219] lstrlenW (lpString="AN01218_.WMF") returned 12
	[0070.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.220] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3012) returned 1
	[0070.220] CloseHandle (hObject=0x380) returned 1
	[0070.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220
	[0070.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.220] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.220] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0070.221] GetLastError () returned 0x0
	[0070.221] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xbc4, lpOverlapped=0x0) returned 1
	[0070.222] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0070.223] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.223] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.223] SetEndOfFile (hFile=0x350) returned 1
	[0070.224] CloseHandle (hObject=0x350) returned 1
	[0070.224] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.224] SetEndOfFile (hFile=0x380) returned 1
	[0070.225] CloseHandle (hObject=0x380) returned 1
	[0070.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1
	[0070.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.226] lstrlenW (lpString=".doc") returned 4
	[0070.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.226] lstrlenW (lpString=".docx") returned 5
	[0070.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.226] lstrlenW (lpString=".pdf") returned 4
	[0070.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.226] lstrlenW (lpString=".xls") returned 4
	[0070.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.226] lstrlenW (lpString=".xlsx") returned 5
	[0070.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.227] lstrlenW (lpString=".ppt") returned 4
	[0070.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.227] lstrlenW (lpString=".zip") returned 4
	[0070.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.227] lstrlenW (lpString=".rar") returned 4
	[0070.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.227] lstrlenW (lpString=".bz2") returned 4
	[0070.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.227] lstrlenW (lpString=".7z") returned 3
	[0070.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.227] lstrlenW (lpString=".dbf") returned 4
	[0070.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.227] lstrlenW (lpString=".1cd") returned 4
	[0070.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.227] lstrlenW (lpString=".jpg") returned 4
	[0070.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.227] lstrlenW (lpString=".doc") returned 4
	[0070.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.227] lstrlenW (lpString=".docx") returned 5
	[0070.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.228] lstrlenW (lpString=".pdf") returned 4
	[0070.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.228] lstrlenW (lpString=".xls") returned 4
	[0070.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.228] lstrlenW (lpString=".xlsx") returned 5
	[0070.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.228] lstrlenW (lpString=".ppt") returned 4
	[0070.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.228] lstrlenW (lpString=".zip") returned 4
	[0070.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.228] lstrlenW (lpString=".rar") returned 4
	[0070.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.229] lstrlenW (lpString=".bz2") returned 4
	[0070.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.229] lstrlenW (lpString=".7z") returned 3
	[0070.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.229] lstrlenW (lpString=".dbf") returned 4
	[0070.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.229] lstrlenW (lpString=".1cd") returned 4
	[0070.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0070.229] lstrlenW (lpString=".jpg") returned 4
	[0070.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.229] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.229] lstrlenW (lpString="AN01251_.WMF") returned 12
	[0070.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.229] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2756) returned 1
	[0070.230] CloseHandle (hObject=0x380) returned 1
	[0070.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220
	[0070.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.230] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.230] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0070.231] GetLastError () returned 0x0
	[0070.231] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xac4, lpOverlapped=0x0) returned 1
	[0070.232] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xad0, lpOverlapped=0x0) returned 1
	[0070.233] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.233] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.233] SetEndOfFile (hFile=0x350) returned 1
	[0070.233] CloseHandle (hObject=0x350) returned 1
	[0070.234] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.234] SetEndOfFile (hFile=0x380) returned 1
	[0070.235] CloseHandle (hObject=0x380) returned 1
	[0070.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1
	[0070.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.235] lstrlenW (lpString=".doc") returned 4
	[0070.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.236] lstrlenW (lpString=".docx") returned 5
	[0070.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.236] lstrlenW (lpString=".pdf") returned 4
	[0070.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.236] lstrlenW (lpString=".xls") returned 4
	[0070.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.236] lstrlenW (lpString=".xlsx") returned 5
	[0070.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.236] lstrlenW (lpString=".ppt") returned 4
	[0070.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.236] lstrlenW (lpString=".zip") returned 4
	[0070.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.236] lstrlenW (lpString=".rar") returned 4
	[0070.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.236] lstrlenW (lpString=".bz2") returned 4
	[0070.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.236] lstrlenW (lpString=".7z") returned 3
	[0070.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.236] lstrlenW (lpString=".dbf") returned 4
	[0070.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.236] lstrlenW (lpString=".1cd") returned 4
	[0070.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.237] lstrlenW (lpString=".jpg") returned 4
	[0070.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.237] lstrlenW (lpString=".doc") returned 4
	[0070.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.237] lstrlenW (lpString=".docx") returned 5
	[0070.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.237] lstrlenW (lpString=".pdf") returned 4
	[0070.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.237] lstrlenW (lpString=".xls") returned 4
	[0070.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.237] lstrlenW (lpString=".xlsx") returned 5
	[0070.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.237] lstrlenW (lpString=".ppt") returned 4
	[0070.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.237] lstrlenW (lpString=".zip") returned 4
	[0070.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.238] lstrlenW (lpString=".rar") returned 4
	[0070.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.238] lstrlenW (lpString=".bz2") returned 4
	[0070.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.238] lstrlenW (lpString=".7z") returned 3
	[0070.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.238] lstrlenW (lpString=".dbf") returned 4
	[0070.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.238] lstrlenW (lpString=".1cd") returned 4
	[0070.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0070.238] lstrlenW (lpString=".jpg") returned 4
	[0070.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.238] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.238] lstrlenW (lpString="AN01545_.WMF") returned 12
	[0070.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.238] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=7372) returned 1
	[0070.239] CloseHandle (hObject=0x380) returned 1
	[0070.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220
	[0070.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.239] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.239] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0070.239] GetLastError () returned 0x0
	[0070.239] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1ccc, lpOverlapped=0x0) returned 1
	[0070.928] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1cd0, lpOverlapped=0x0) returned 1
	[0070.929] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.929] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.929] SetEndOfFile (hFile=0x350) returned 1
	[0070.929] CloseHandle (hObject=0x350) returned 1
	[0070.930] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.930] SetEndOfFile (hFile=0x380) returned 1
	[0070.931] CloseHandle (hObject=0x380) returned 1
	[0070.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1
	[0071.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.181] lstrlenW (lpString=".doc") returned 4
	[0071.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.181] lstrlenW (lpString=".docx") returned 5
	[0071.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.181] lstrlenW (lpString=".pdf") returned 4
	[0071.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.181] lstrlenW (lpString=".xls") returned 4
	[0071.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.181] lstrlenW (lpString=".xlsx") returned 5
	[0071.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.181] lstrlenW (lpString=".ppt") returned 4
	[0071.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.181] lstrlenW (lpString=".zip") returned 4
	[0071.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.181] lstrlenW (lpString=".rar") returned 4
	[0071.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.181] lstrlenW (lpString=".bz2") returned 4
	[0071.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.181] lstrlenW (lpString=".7z") returned 3
	[0071.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.181] lstrlenW (lpString=".dbf") returned 4
	[0071.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.182] lstrlenW (lpString=".1cd") returned 4
	[0071.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.182] lstrlenW (lpString=".jpg") returned 4
	[0071.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.182] lstrlenW (lpString=".doc") returned 4
	[0071.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.182] lstrlenW (lpString=".docx") returned 5
	[0071.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.182] lstrlenW (lpString=".pdf") returned 4
	[0071.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.182] lstrlenW (lpString=".xls") returned 4
	[0071.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.182] lstrlenW (lpString=".xlsx") returned 5
	[0071.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.182] lstrlenW (lpString=".ppt") returned 4
	[0071.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.182] lstrlenW (lpString=".zip") returned 4
	[0071.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.182] lstrlenW (lpString=".rar") returned 4
	[0071.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.182] lstrlenW (lpString=".bz2") returned 4
	[0071.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.182] lstrlenW (lpString=".7z") returned 3
	[0071.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.183] lstrlenW (lpString=".dbf") returned 4
	[0071.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.183] lstrlenW (lpString=".1cd") returned 4
	[0071.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0071.183] lstrlenW (lpString=".jpg") returned 4
	[0071.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.183] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.183] lstrlenW (lpString="AN04269_.WMF") returned 12
	[0071.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0071.183] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2016) returned 1
	[0071.183] CloseHandle (hObject=0x378) returned 1
	[0071.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220
	[0071.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0071.184] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.184] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0071.184] GetLastError () returned 0x0
	[0071.184] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x7e0, lpOverlapped=0x0) returned 1
	[0071.186] WriteFile (in: hFile=0x38c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0071.187] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.187] WriteFile (in: hFile=0x38c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.187] SetEndOfFile (hFile=0x38c) returned 1
	[0071.187] CloseHandle (hObject=0x38c) returned 1
	[0071.188] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.188] SetEndOfFile (hFile=0x378) returned 1
	[0071.189] CloseHandle (hObject=0x378) returned 1
	[0071.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1
	[0071.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.190] lstrlenW (lpString=".doc") returned 4
	[0071.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.190] lstrlenW (lpString=".docx") returned 5
	[0071.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.190] lstrlenW (lpString=".pdf") returned 4
	[0071.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.190] lstrlenW (lpString=".xls") returned 4
	[0071.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.190] lstrlenW (lpString=".xlsx") returned 5
	[0071.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.190] lstrlenW (lpString=".ppt") returned 4
	[0071.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.190] lstrlenW (lpString=".zip") returned 4
	[0071.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.190] lstrlenW (lpString=".rar") returned 4
	[0071.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.190] lstrlenW (lpString=".bz2") returned 4
	[0071.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.190] lstrlenW (lpString=".7z") returned 3
	[0071.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.190] lstrlenW (lpString=".dbf") returned 4
	[0071.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.190] lstrlenW (lpString=".1cd") returned 4
	[0071.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.191] lstrlenW (lpString=".jpg") returned 4
	[0071.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.191] lstrlenW (lpString=".doc") returned 4
	[0071.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.191] lstrlenW (lpString=".docx") returned 5
	[0071.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.191] lstrlenW (lpString=".pdf") returned 4
	[0071.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.191] lstrlenW (lpString=".xls") returned 4
	[0071.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.191] lstrlenW (lpString=".xlsx") returned 5
	[0071.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.191] lstrlenW (lpString=".ppt") returned 4
	[0071.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.191] lstrlenW (lpString=".zip") returned 4
	[0071.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.191] lstrlenW (lpString=".rar") returned 4
	[0071.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.191] lstrlenW (lpString=".bz2") returned 4
	[0071.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.191] lstrlenW (lpString=".7z") returned 3
	[0071.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.192] lstrlenW (lpString=".dbf") returned 4
	[0071.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.192] lstrlenW (lpString=".1cd") returned 4
	[0071.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0071.192] lstrlenW (lpString=".jpg") returned 4
	[0071.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.192] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.192] lstrlenW (lpString="AN04323_.WMF") returned 12
	[0071.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0071.192] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2492) returned 1
	[0071.192] CloseHandle (hObject=0x378) returned 1
	[0071.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220
	[0071.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0071.193] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.193] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0071.193] GetLastError () returned 0x0
	[0071.193] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x9bc, lpOverlapped=0x0) returned 1
	[0071.195] WriteFile (in: hFile=0x38c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0071.195] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.196] WriteFile (in: hFile=0x38c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.196] SetEndOfFile (hFile=0x38c) returned 1
	[0071.196] CloseHandle (hObject=0x38c) returned 1
	[0071.197] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.197] SetEndOfFile (hFile=0x378) returned 1
	[0071.198] CloseHandle (hObject=0x378) returned 1
	[0071.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1
	[0071.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.199] lstrlenW (lpString=".doc") returned 4
	[0071.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString=".docx") returned 5
	[0071.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.199] lstrlenW (lpString=".pdf") returned 4
	[0071.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString=".xls") returned 4
	[0071.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.199] lstrlenW (lpString=".xlsx") returned 5
	[0071.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.199] lstrlenW (lpString=".ppt") returned 4
	[0071.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.199] lstrlenW (lpString=".zip") returned 4
	[0071.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.199] lstrlenW (lpString=".rar") returned 4
	[0071.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString=".bz2") returned 4
	[0071.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString=".7z") returned 3
	[0071.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.199] lstrlenW (lpString=".dbf") returned 4
	[0071.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.199] lstrlenW (lpString=".1cd") returned 4
	[0071.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.199] lstrlenW (lpString=".jpg") returned 4
	[0071.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.200] lstrlenW (lpString=".doc") returned 4
	[0071.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.200] lstrlenW (lpString=".docx") returned 5
	[0071.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.200] lstrlenW (lpString=".pdf") returned 4
	[0071.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.200] lstrlenW (lpString=".xls") returned 4
	[0071.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.200] lstrlenW (lpString=".xlsx") returned 5
	[0071.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.200] lstrlenW (lpString=".ppt") returned 4
	[0071.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.200] lstrlenW (lpString=".zip") returned 4
	[0071.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.200] lstrlenW (lpString=".rar") returned 4
	[0071.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.200] lstrlenW (lpString=".bz2") returned 4
	[0071.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.200] lstrlenW (lpString=".7z") returned 3
	[0071.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.200] lstrlenW (lpString=".dbf") returned 4
	[0071.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.201] lstrlenW (lpString=".1cd") returned 4
	[0071.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0071.201] lstrlenW (lpString=".jpg") returned 4
	[0071.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.201] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.201] lstrlenW (lpString="AN04326_.WMF") returned 12
	[0071.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0071.201] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3348) returned 1
	[0071.201] CloseHandle (hObject=0x378) returned 1
	[0071.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220
	[0071.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0071.202] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.202] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0071.202] GetLastError () returned 0x0
	[0071.202] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xd14, lpOverlapped=0x0) returned 1
	[0071.203] WriteFile (in: hFile=0x38c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xd20, lpOverlapped=0x0) returned 1
	[0071.204] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.205] WriteFile (in: hFile=0x38c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.205] SetEndOfFile (hFile=0x38c) returned 1
	[0071.205] CloseHandle (hObject=0x38c) returned 1
	[0071.206] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.206] SetEndOfFile (hFile=0x378) returned 1
	[0071.211] CloseHandle (hObject=0x378) returned 1
	[0071.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1
	[0071.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.211] lstrlenW (lpString=".doc") returned 4
	[0071.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.211] lstrlenW (lpString=".docx") returned 5
	[0071.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.211] lstrlenW (lpString=".pdf") returned 4
	[0071.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.211] lstrlenW (lpString=".xls") returned 4
	[0071.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.211] lstrlenW (lpString=".xlsx") returned 5
	[0071.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.212] lstrlenW (lpString=".ppt") returned 4
	[0071.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.212] lstrlenW (lpString=".zip") returned 4
	[0071.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.212] lstrlenW (lpString=".rar") returned 4
	[0071.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.212] lstrlenW (lpString=".bz2") returned 4
	[0071.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.212] lstrlenW (lpString=".7z") returned 3
	[0071.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.212] lstrlenW (lpString=".dbf") returned 4
	[0071.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.212] lstrlenW (lpString=".1cd") returned 4
	[0071.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.212] lstrlenW (lpString=".jpg") returned 4
	[0071.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.212] lstrlenW (lpString=".doc") returned 4
	[0071.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.213] lstrlenW (lpString=".docx") returned 5
	[0071.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.213] lstrlenW (lpString=".pdf") returned 4
	[0071.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.213] lstrlenW (lpString=".xls") returned 4
	[0071.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.213] lstrlenW (lpString=".xlsx") returned 5
	[0071.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.213] lstrlenW (lpString=".ppt") returned 4
	[0071.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.213] lstrlenW (lpString=".zip") returned 4
	[0071.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.213] lstrlenW (lpString=".rar") returned 4
	[0071.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.213] lstrlenW (lpString=".bz2") returned 4
	[0071.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.213] lstrlenW (lpString=".7z") returned 3
	[0071.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.213] lstrlenW (lpString=".dbf") returned 4
	[0071.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.213] lstrlenW (lpString=".1cd") returned 4
	[0071.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0071.213] lstrlenW (lpString=".jpg") returned 4
	[0071.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.214] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.214] lstrlenW (lpString="AN04332_.WMF") returned 12
	[0071.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0071.214] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=4296) returned 1
	[0071.214] CloseHandle (hObject=0x378) returned 1
	[0071.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220
	[0071.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0071.214] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.214] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0071.215] GetLastError () returned 0x0
	[0071.215] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x10c8, lpOverlapped=0x0) returned 1
	[0071.571] WriteFile (in: hFile=0x38c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x10d0, lpOverlapped=0x0) returned 1
	[0071.572] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.572] WriteFile (in: hFile=0x38c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.573] SetEndOfFile (hFile=0x38c) returned 1
	[0071.573] CloseHandle (hObject=0x38c) returned 1
	[0071.573] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.573] SetEndOfFile (hFile=0x378) returned 1
	[0071.574] CloseHandle (hObject=0x378) returned 1
	[0071.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1
	[0071.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.656] lstrlenW (lpString=".doc") returned 4
	[0071.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.656] lstrlenW (lpString=".docx") returned 5
	[0071.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.656] lstrlenW (lpString=".pdf") returned 4
	[0071.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.656] lstrlenW (lpString=".xls") returned 4
	[0071.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.656] lstrlenW (lpString=".xlsx") returned 5
	[0071.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.656] lstrlenW (lpString=".ppt") returned 4
	[0071.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.656] lstrlenW (lpString=".zip") returned 4
	[0071.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.656] lstrlenW (lpString=".rar") returned 4
	[0071.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.656] lstrlenW (lpString=".bz2") returned 4
	[0071.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.656] lstrlenW (lpString=".7z") returned 3
	[0071.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.656] lstrlenW (lpString=".dbf") returned 4
	[0071.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.657] lstrlenW (lpString=".1cd") returned 4
	[0071.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.657] lstrlenW (lpString=".jpg") returned 4
	[0071.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.657] lstrlenW (lpString=".doc") returned 4
	[0071.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.657] lstrlenW (lpString=".docx") returned 5
	[0071.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.657] lstrlenW (lpString=".pdf") returned 4
	[0071.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.657] lstrlenW (lpString=".xls") returned 4
	[0071.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.657] lstrlenW (lpString=".xlsx") returned 5
	[0071.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.657] lstrlenW (lpString=".ppt") returned 4
	[0071.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.657] lstrlenW (lpString=".zip") returned 4
	[0071.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.658] lstrlenW (lpString=".rar") returned 4
	[0071.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.658] lstrlenW (lpString=".bz2") returned 4
	[0071.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.658] lstrlenW (lpString=".7z") returned 3
	[0071.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.658] lstrlenW (lpString=".dbf") returned 4
	[0071.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.658] lstrlenW (lpString=".1cd") returned 4
	[0071.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0071.658] lstrlenW (lpString=".jpg") returned 4
	[0071.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.658] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.659] lstrlenW (lpString="BD06102_.WMF") returned 12
	[0071.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.182] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=16112) returned 1
	[0072.182] CloseHandle (hObject=0x380) returned 1
	[0072.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220
	[0072.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.183] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.183] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0072.183] GetLastError () returned 0x0
	[0072.183] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x3ef0, lpOverlapped=0x0) returned 1
	[0072.185] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x3f00, lpOverlapped=0x0) returned 1
	[0072.186] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.186] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.186] SetEndOfFile (hFile=0x378) returned 1
	[0072.186] CloseHandle (hObject=0x378) returned 1
	[0072.189] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.189] SetEndOfFile (hFile=0x380) returned 1
	[0072.190] CloseHandle (hObject=0x380) returned 1
	[0072.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1
	[0072.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.191] lstrlenW (lpString=".doc") returned 4
	[0072.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.191] lstrlenW (lpString=".docx") returned 5
	[0072.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.191] lstrlenW (lpString=".pdf") returned 4
	[0072.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.191] lstrlenW (lpString=".xls") returned 4
	[0072.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.191] lstrlenW (lpString=".xlsx") returned 5
	[0072.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.191] lstrlenW (lpString=".ppt") returned 4
	[0072.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.191] lstrlenW (lpString=".zip") returned 4
	[0072.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.191] lstrlenW (lpString=".rar") returned 4
	[0072.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.191] lstrlenW (lpString=".bz2") returned 4
	[0072.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.191] lstrlenW (lpString=".7z") returned 3
	[0072.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.191] lstrlenW (lpString=".dbf") returned 4
	[0072.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.192] lstrlenW (lpString=".1cd") returned 4
	[0072.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.192] lstrlenW (lpString=".jpg") returned 4
	[0072.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.192] lstrlenW (lpString=".doc") returned 4
	[0072.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.192] lstrlenW (lpString=".docx") returned 5
	[0072.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.192] lstrlenW (lpString=".pdf") returned 4
	[0072.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.192] lstrlenW (lpString=".xls") returned 4
	[0072.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.192] lstrlenW (lpString=".xlsx") returned 5
	[0072.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.192] lstrlenW (lpString=".ppt") returned 4
	[0072.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.192] lstrlenW (lpString=".zip") returned 4
	[0072.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.192] lstrlenW (lpString=".rar") returned 4
	[0072.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.192] lstrlenW (lpString=".bz2") returned 4
	[0072.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.193] lstrlenW (lpString=".7z") returned 3
	[0072.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.193] lstrlenW (lpString=".dbf") returned 4
	[0072.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.193] lstrlenW (lpString=".1cd") returned 4
	[0072.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0072.193] lstrlenW (lpString=".jpg") returned 4
	[0072.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.193] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.193] lstrlenW (lpString="BD07831_.WMF") returned 12
	[0072.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.193] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=4066) returned 1
	[0072.194] CloseHandle (hObject=0x380) returned 1
	[0072.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220
	[0072.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.194] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.194] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0072.194] GetLastError () returned 0x0
	[0072.194] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xfe2, lpOverlapped=0x0) returned 1
	[0072.196] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xff0, lpOverlapped=0x0) returned 1
	[0072.197] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.197] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.197] SetEndOfFile (hFile=0x378) returned 1
	[0072.197] CloseHandle (hObject=0x378) returned 1
	[0072.198] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.198] SetEndOfFile (hFile=0x380) returned 1
	[0072.199] CloseHandle (hObject=0x380) returned 1
	[0072.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1
	[0072.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.200] lstrlenW (lpString=".doc") returned 4
	[0072.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.200] lstrlenW (lpString=".docx") returned 5
	[0072.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.200] lstrlenW (lpString=".pdf") returned 4
	[0072.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.200] lstrlenW (lpString=".xls") returned 4
	[0072.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.200] lstrlenW (lpString=".xlsx") returned 5
	[0072.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.200] lstrlenW (lpString=".ppt") returned 4
	[0072.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.200] lstrlenW (lpString=".zip") returned 4
	[0072.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.201] lstrlenW (lpString=".rar") returned 4
	[0072.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.201] lstrlenW (lpString=".bz2") returned 4
	[0072.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.201] lstrlenW (lpString=".7z") returned 3
	[0072.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.201] lstrlenW (lpString=".dbf") returned 4
	[0072.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.201] lstrlenW (lpString=".1cd") returned 4
	[0072.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.201] lstrlenW (lpString=".jpg") returned 4
	[0072.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.201] lstrlenW (lpString=".doc") returned 4
	[0072.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.201] lstrlenW (lpString=".docx") returned 5
	[0072.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.201] lstrlenW (lpString=".pdf") returned 4
	[0072.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.201] lstrlenW (lpString=".xls") returned 4
	[0072.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.202] lstrlenW (lpString=".xlsx") returned 5
	[0072.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.202] lstrlenW (lpString=".ppt") returned 4
	[0072.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.202] lstrlenW (lpString=".zip") returned 4
	[0072.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.202] lstrlenW (lpString=".rar") returned 4
	[0072.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.202] lstrlenW (lpString=".bz2") returned 4
	[0072.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.202] lstrlenW (lpString=".7z") returned 3
	[0072.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.202] lstrlenW (lpString=".dbf") returned 4
	[0072.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.202] lstrlenW (lpString=".1cd") returned 4
	[0072.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.202] lstrlenW (lpString=".jpg") returned 4
	[0072.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.203] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.203] lstrlenW (lpString="BD08758_.WMF") returned 12
	[0072.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.203] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=24320) returned 1
	[0072.203] CloseHandle (hObject=0x380) returned 1
	[0072.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220
	[0072.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.203] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.203] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0072.204] GetLastError () returned 0x0
	[0072.204] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x5f00, lpOverlapped=0x0) returned 1
	[0072.205] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x5f10, lpOverlapped=0x0) returned 1
	[0072.207] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.207] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.207] SetEndOfFile (hFile=0x378) returned 1
	[0072.207] CloseHandle (hObject=0x378) returned 1
	[0072.209] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.209] SetEndOfFile (hFile=0x380) returned 1
	[0072.210] CloseHandle (hObject=0x380) returned 1
	[0072.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1
	[0072.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.211] lstrlenW (lpString=".doc") returned 4
	[0072.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.211] lstrlenW (lpString=".docx") returned 5
	[0072.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.211] lstrlenW (lpString=".pdf") returned 4
	[0072.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.211] lstrlenW (lpString=".xls") returned 4
	[0072.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.211] lstrlenW (lpString=".xlsx") returned 5
	[0072.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.211] lstrlenW (lpString=".ppt") returned 4
	[0072.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.211] lstrlenW (lpString=".zip") returned 4
	[0072.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.211] lstrlenW (lpString=".rar") returned 4
	[0072.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.211] lstrlenW (lpString=".bz2") returned 4
	[0072.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.211] lstrlenW (lpString=".7z") returned 3
	[0072.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.212] lstrlenW (lpString=".dbf") returned 4
	[0072.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.212] lstrlenW (lpString=".1cd") returned 4
	[0072.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.212] lstrlenW (lpString=".jpg") returned 4
	[0072.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.212] lstrlenW (lpString=".doc") returned 4
	[0072.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.212] lstrlenW (lpString=".docx") returned 5
	[0072.212] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.212] lstrlenW (lpString=".pdf") returned 4
	[0072.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.212] lstrlenW (lpString=".xls") returned 4
	[0072.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.213] lstrlenW (lpString=".xlsx") returned 5
	[0072.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.213] lstrlenW (lpString=".ppt") returned 4
	[0072.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.213] lstrlenW (lpString=".zip") returned 4
	[0072.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.213] lstrlenW (lpString=".rar") returned 4
	[0072.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.213] lstrlenW (lpString=".bz2") returned 4
	[0072.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.213] lstrlenW (lpString=".7z") returned 3
	[0072.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.213] lstrlenW (lpString=".dbf") returned 4
	[0072.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.213] lstrlenW (lpString=".1cd") returned 4
	[0072.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.213] lstrlenW (lpString=".jpg") returned 4
	[0072.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.214] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.214] lstrlenW (lpString="BD08773_.WMF") returned 12
	[0072.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.214] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=24778) returned 1
	[0072.214] CloseHandle (hObject=0x380) returned 1
	[0072.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220
	[0072.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.214] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.215] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0072.215] GetLastError () returned 0x0
	[0072.215] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x60ca, lpOverlapped=0x0) returned 1
	[0072.624] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x60d0, lpOverlapped=0x0) returned 1
	[0072.625] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.625] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.625] SetEndOfFile (hFile=0x378) returned 1
	[0072.625] CloseHandle (hObject=0x378) returned 1
	[0072.627] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.627] SetEndOfFile (hFile=0x380) returned 1
	[0072.628] CloseHandle (hObject=0x380) returned 1
	[0072.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1
	[0072.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.629] lstrlenW (lpString=".doc") returned 4
	[0072.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.629] lstrlenW (lpString=".docx") returned 5
	[0072.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.629] lstrlenW (lpString=".pdf") returned 4
	[0072.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.629] lstrlenW (lpString=".xls") returned 4
	[0072.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.629] lstrlenW (lpString=".xlsx") returned 5
	[0072.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.629] lstrlenW (lpString=".ppt") returned 4
	[0072.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.629] lstrlenW (lpString=".zip") returned 4
	[0072.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.629] lstrlenW (lpString=".rar") returned 4
	[0072.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.629] lstrlenW (lpString=".bz2") returned 4
	[0072.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.629] lstrlenW (lpString=".7z") returned 3
	[0072.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.629] lstrlenW (lpString=".dbf") returned 4
	[0072.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.629] lstrlenW (lpString=".1cd") returned 4
	[0072.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.630] lstrlenW (lpString=".jpg") returned 4
	[0072.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.630] lstrlenW (lpString=".doc") returned 4
	[0072.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.630] lstrlenW (lpString=".docx") returned 5
	[0072.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.630] lstrlenW (lpString=".pdf") returned 4
	[0072.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.630] lstrlenW (lpString=".xls") returned 4
	[0072.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.630] lstrlenW (lpString=".xlsx") returned 5
	[0072.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.630] lstrlenW (lpString=".ppt") returned 4
	[0072.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.630] lstrlenW (lpString=".zip") returned 4
	[0072.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.630] lstrlenW (lpString=".rar") returned 4
	[0072.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.631] lstrlenW (lpString=".bz2") returned 4
	[0072.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.631] lstrlenW (lpString=".7z") returned 3
	[0072.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.631] lstrlenW (lpString=".dbf") returned 4
	[0072.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.631] lstrlenW (lpString=".1cd") returned 4
	[0072.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0072.631] lstrlenW (lpString=".jpg") returned 4
	[0072.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.631] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0072.631] lstrlenW (lpString="BD19582_.GIF") returned 12
	[0072.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.632] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=15733) returned 1
	[0072.632] CloseHandle (hObject=0x380) returned 1
	[0072.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220
	[0072.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.632] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.632] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0072.632] GetLastError () returned 0x0
	[0072.633] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x3d75, lpOverlapped=0x0) returned 1
	[0072.634] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x3d80, lpOverlapped=0x0) returned 1
	[0072.635] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.635] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.635] SetEndOfFile (hFile=0x378) returned 1
	[0072.636] CloseHandle (hObject=0x378) returned 1
	[0072.637] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.637] SetEndOfFile (hFile=0x380) returned 1
	[0072.638] CloseHandle (hObject=0x380) returned 1
	[0072.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1
	[0072.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.638] lstrlenW (lpString=".doc") returned 4
	[0072.638] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0072.638] lstrlenW (lpString=".docx") returned 5
	[0072.639] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0072.639] lstrlenW (lpString=".pdf") returned 4
	[0072.639] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0072.639] lstrlenW (lpString=".xls") returned 4
	[0072.639] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0072.639] lstrlenW (lpString=".xlsx") returned 5
	[0072.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0072.639] lstrlenW (lpString=".ppt") returned 4
	[0072.639] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0072.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.639] lstrlenW (lpString=".zip") returned 4
	[0072.639] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0072.639] lstrlenW (lpString=".rar") returned 4
	[0072.639] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0072.639] lstrlenW (lpString=".bz2") returned 4
	[0072.639] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0072.639] lstrlenW (lpString=".7z") returned 3
	[0072.639] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0072.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.639] lstrlenW (lpString=".dbf") returned 4
	[0072.639] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0072.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.639] lstrlenW (lpString=".1cd") returned 4
	[0072.639] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0072.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.639] lstrlenW (lpString=".jpg") returned 4
	[0072.639] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.640] lstrlenW (lpString=".doc") returned 4
	[0072.640] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0072.640] lstrlenW (lpString=".docx") returned 5
	[0072.640] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0072.640] lstrlenW (lpString=".pdf") returned 4
	[0072.640] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0072.640] lstrlenW (lpString=".xls") returned 4
	[0072.640] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0072.640] lstrlenW (lpString=".xlsx") returned 5
	[0072.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0072.640] lstrlenW (lpString=".ppt") returned 4
	[0072.640] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.640] lstrlenW (lpString=".zip") returned 4
	[0072.640] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0072.640] lstrlenW (lpString=".rar") returned 4
	[0072.640] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0072.640] lstrlenW (lpString=".bz2") returned 4
	[0072.640] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0072.640] lstrlenW (lpString=".7z") returned 3
	[0072.641] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0072.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.641] lstrlenW (lpString=".dbf") returned 4
	[0072.641] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0072.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.641] lstrlenW (lpString=".1cd") returned 4
	[0072.641] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0072.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0072.641] lstrlenW (lpString=".jpg") returned 4
	[0072.641] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0072.641] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.641] lstrlenW (lpString="BD19695_.WMF") returned 12
	[0072.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.641] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=12982) returned 1
	[0072.642] CloseHandle (hObject=0x380) returned 1
	[0072.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220
	[0072.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.642] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.642] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0072.642] GetLastError () returned 0x0
	[0072.642] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x32b6, lpOverlapped=0x0) returned 1
	[0072.644] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x32c0, lpOverlapped=0x0) returned 1
	[0072.645] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.646] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.646] SetEndOfFile (hFile=0x378) returned 1
	[0072.646] CloseHandle (hObject=0x378) returned 1
	[0072.647] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.647] SetEndOfFile (hFile=0x380) returned 1
	[0072.652] CloseHandle (hObject=0x380) returned 1
	[0072.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1
	[0072.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.653] lstrlenW (lpString=".doc") returned 4
	[0072.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.653] lstrlenW (lpString=".docx") returned 5
	[0072.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.653] lstrlenW (lpString=".pdf") returned 4
	[0072.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.653] lstrlenW (lpString=".xls") returned 4
	[0072.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.653] lstrlenW (lpString=".xlsx") returned 5
	[0072.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.653] lstrlenW (lpString=".ppt") returned 4
	[0072.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.653] lstrlenW (lpString=".zip") returned 4
	[0072.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.653] lstrlenW (lpString=".rar") returned 4
	[0072.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.653] lstrlenW (lpString=".bz2") returned 4
	[0072.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.653] lstrlenW (lpString=".7z") returned 3
	[0072.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.654] lstrlenW (lpString=".dbf") returned 4
	[0072.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.654] lstrlenW (lpString=".1cd") returned 4
	[0072.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.654] lstrlenW (lpString=".jpg") returned 4
	[0072.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.654] lstrlenW (lpString=".doc") returned 4
	[0072.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.654] lstrlenW (lpString=".docx") returned 5
	[0072.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.654] lstrlenW (lpString=".pdf") returned 4
	[0072.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.654] lstrlenW (lpString=".xls") returned 4
	[0072.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.654] lstrlenW (lpString=".xlsx") returned 5
	[0072.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.654] lstrlenW (lpString=".ppt") returned 4
	[0072.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.655] lstrlenW (lpString=".zip") returned 4
	[0072.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.655] lstrlenW (lpString=".rar") returned 4
	[0072.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.655] lstrlenW (lpString=".bz2") returned 4
	[0072.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.655] lstrlenW (lpString=".7z") returned 3
	[0072.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.655] lstrlenW (lpString=".dbf") returned 4
	[0072.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.655] lstrlenW (lpString=".1cd") returned 4
	[0072.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0072.655] lstrlenW (lpString=".jpg") returned 4
	[0072.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.656] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.656] lstrlenW (lpString="BD19827_.WMF") returned 12
	[0072.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.656] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=9710) returned 1
	[0072.656] CloseHandle (hObject=0x380) returned 1
	[0072.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220
	[0072.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.656] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.656] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0072.657] GetLastError () returned 0x0
	[0072.657] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x25ee, lpOverlapped=0x0) returned 1
	[0072.658] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x25f0, lpOverlapped=0x0) returned 1
	[0072.659] ReadFile (in: hFile=0x380, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.659] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.660] SetEndOfFile (hFile=0x378) returned 1
	[0072.660] CloseHandle (hObject=0x378) returned 1
	[0073.131] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.140] SetEndOfFile (hFile=0x380) returned 1
	[0073.148] CloseHandle (hObject=0x380) returned 1
	[0073.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1
	[0073.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.430] lstrlenW (lpString=".doc") returned 4
	[0073.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.430] lstrlenW (lpString=".docx") returned 5
	[0073.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.430] lstrlenW (lpString=".pdf") returned 4
	[0073.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.430] lstrlenW (lpString=".xls") returned 4
	[0073.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.430] lstrlenW (lpString=".xlsx") returned 5
	[0073.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.431] lstrlenW (lpString=".ppt") returned 4
	[0073.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.431] lstrlenW (lpString=".zip") returned 4
	[0073.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.431] lstrlenW (lpString=".rar") returned 4
	[0073.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.431] lstrlenW (lpString=".bz2") returned 4
	[0073.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.431] lstrlenW (lpString=".7z") returned 3
	[0073.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.431] lstrlenW (lpString=".dbf") returned 4
	[0073.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.431] lstrlenW (lpString=".1cd") returned 4
	[0073.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.431] lstrlenW (lpString=".jpg") returned 4
	[0073.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.432] lstrlenW (lpString=".doc") returned 4
	[0073.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.432] lstrlenW (lpString=".docx") returned 5
	[0073.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.432] lstrlenW (lpString=".pdf") returned 4
	[0073.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.432] lstrlenW (lpString=".xls") returned 4
	[0073.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.432] lstrlenW (lpString=".xlsx") returned 5
	[0073.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.432] lstrlenW (lpString=".ppt") returned 4
	[0073.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.432] lstrlenW (lpString=".zip") returned 4
	[0073.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.432] lstrlenW (lpString=".rar") returned 4
	[0073.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.432] lstrlenW (lpString=".bz2") returned 4
	[0073.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.433] lstrlenW (lpString=".7z") returned 3
	[0073.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.433] lstrlenW (lpString=".dbf") returned 4
	[0073.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.433] lstrlenW (lpString=".1cd") returned 4
	[0073.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.433] lstrlenW (lpString=".jpg") returned 4
	[0073.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.433] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.433] lstrlenW (lpString="BL00234_.WMF") returned 12
	[0073.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0073.731] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=9304) returned 1
	[0073.751] CloseHandle (hObject=0x314) returned 1
	[0073.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220
	[0073.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0073.754] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.754] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.754] GetLastError () returned 0x0
	[0073.754] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x2458, lpOverlapped=0x0) returned 1
	[0073.756] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x2460, lpOverlapped=0x0) returned 1
	[0073.757] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.757] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.757] SetEndOfFile (hFile=0x350) returned 1
	[0073.757] CloseHandle (hObject=0x350) returned 1
	[0073.758] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.758] SetEndOfFile (hFile=0x314) returned 1
	[0073.759] CloseHandle (hObject=0x314) returned 1
	[0073.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1
	[0073.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.760] lstrlenW (lpString=".doc") returned 4
	[0073.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.760] lstrlenW (lpString=".docx") returned 5
	[0073.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.760] lstrlenW (lpString=".pdf") returned 4
	[0073.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.760] lstrlenW (lpString=".xls") returned 4
	[0073.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.760] lstrlenW (lpString=".xlsx") returned 5
	[0073.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.760] lstrlenW (lpString=".ppt") returned 4
	[0073.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.760] lstrlenW (lpString=".zip") returned 4
	[0073.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.760] lstrlenW (lpString=".rar") returned 4
	[0073.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.760] lstrlenW (lpString=".bz2") returned 4
	[0073.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.760] lstrlenW (lpString=".7z") returned 3
	[0073.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.761] lstrlenW (lpString=".dbf") returned 4
	[0073.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.761] lstrlenW (lpString=".1cd") returned 4
	[0073.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.761] lstrlenW (lpString=".jpg") returned 4
	[0073.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.761] lstrlenW (lpString=".doc") returned 4
	[0073.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.761] lstrlenW (lpString=".docx") returned 5
	[0073.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.761] lstrlenW (lpString=".pdf") returned 4
	[0073.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.761] lstrlenW (lpString=".xls") returned 4
	[0073.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.761] lstrlenW (lpString=".xlsx") returned 5
	[0073.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.762] lstrlenW (lpString=".ppt") returned 4
	[0073.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.762] lstrlenW (lpString=".zip") returned 4
	[0073.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.762] lstrlenW (lpString=".rar") returned 4
	[0073.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.762] lstrlenW (lpString=".bz2") returned 4
	[0073.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.762] lstrlenW (lpString=".7z") returned 3
	[0073.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.762] lstrlenW (lpString=".dbf") returned 4
	[0073.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.762] lstrlenW (lpString=".1cd") returned 4
	[0073.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0073.762] lstrlenW (lpString=".jpg") returned 4
	[0073.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.763] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.763] lstrlenW (lpString="BL00265_.WMF") returned 12
	[0073.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0073.763] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=5752) returned 1
	[0073.764] CloseHandle (hObject=0x314) returned 1
	[0073.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220
	[0073.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0073.764] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.764] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.765] GetLastError () returned 0x0
	[0073.765] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1678, lpOverlapped=0x0) returned 1
	[0073.766] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1680, lpOverlapped=0x0) returned 1
	[0073.767] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.768] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.768] SetEndOfFile (hFile=0x350) returned 1
	[0073.768] CloseHandle (hObject=0x350) returned 1
	[0073.769] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.769] SetEndOfFile (hFile=0x314) returned 1
	[0073.770] CloseHandle (hObject=0x314) returned 1
	[0073.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1
	[0073.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.771] lstrlenW (lpString=".doc") returned 4
	[0073.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.771] lstrlenW (lpString=".docx") returned 5
	[0073.771] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.771] lstrlenW (lpString=".pdf") returned 4
	[0073.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.771] lstrlenW (lpString=".xls") returned 4
	[0073.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.771] lstrlenW (lpString=".xlsx") returned 5
	[0073.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.771] lstrlenW (lpString=".ppt") returned 4
	[0073.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.771] lstrlenW (lpString=".zip") returned 4
	[0073.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.771] lstrlenW (lpString=".rar") returned 4
	[0073.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.771] lstrlenW (lpString=".bz2") returned 4
	[0073.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.771] lstrlenW (lpString=".7z") returned 3
	[0073.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.771] lstrlenW (lpString=".dbf") returned 4
	[0073.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.771] lstrlenW (lpString=".1cd") returned 4
	[0073.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.772] lstrlenW (lpString=".jpg") returned 4
	[0073.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.772] lstrlenW (lpString=".doc") returned 4
	[0073.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.772] lstrlenW (lpString=".docx") returned 5
	[0073.772] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.772] lstrlenW (lpString=".pdf") returned 4
	[0073.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.772] lstrlenW (lpString=".xls") returned 4
	[0073.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.772] lstrlenW (lpString=".xlsx") returned 5
	[0073.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.772] lstrlenW (lpString=".ppt") returned 4
	[0073.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.772] lstrlenW (lpString=".zip") returned 4
	[0073.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.772] lstrlenW (lpString=".rar") returned 4
	[0073.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.772] lstrlenW (lpString=".bz2") returned 4
	[0073.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.772] lstrlenW (lpString=".7z") returned 3
	[0073.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.773] lstrlenW (lpString=".dbf") returned 4
	[0073.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.773] lstrlenW (lpString=".1cd") returned 4
	[0073.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0073.773] lstrlenW (lpString=".jpg") returned 4
	[0073.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.773] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.773] lstrlenW (lpString="BL00267_.WMF") returned 12
	[0073.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0073.773] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2644) returned 1
	[0073.773] CloseHandle (hObject=0x314) returned 1
	[0073.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220
	[0073.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0073.774] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.774] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.774] GetLastError () returned 0x0
	[0073.774] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xa54, lpOverlapped=0x0) returned 1
	[0073.775] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xa60, lpOverlapped=0x0) returned 1
	[0073.776] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.776] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.776] SetEndOfFile (hFile=0x350) returned 1
	[0073.777] CloseHandle (hObject=0x350) returned 1
	[0073.778] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.778] SetEndOfFile (hFile=0x314) returned 1
	[0073.779] CloseHandle (hObject=0x314) returned 1
	[0073.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1
	[0073.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.780] lstrlenW (lpString=".doc") returned 4
	[0073.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.780] lstrlenW (lpString=".docx") returned 5
	[0073.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.780] lstrlenW (lpString=".pdf") returned 4
	[0073.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.780] lstrlenW (lpString=".xls") returned 4
	[0073.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.780] lstrlenW (lpString=".xlsx") returned 5
	[0073.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.780] lstrlenW (lpString=".ppt") returned 4
	[0073.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.780] lstrlenW (lpString=".zip") returned 4
	[0073.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.780] lstrlenW (lpString=".rar") returned 4
	[0073.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.781] lstrlenW (lpString=".bz2") returned 4
	[0073.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.781] lstrlenW (lpString=".7z") returned 3
	[0073.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.781] lstrlenW (lpString=".dbf") returned 4
	[0073.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.781] lstrlenW (lpString=".1cd") returned 4
	[0073.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.781] lstrlenW (lpString=".jpg") returned 4
	[0073.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.781] lstrlenW (lpString=".doc") returned 4
	[0073.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.781] lstrlenW (lpString=".docx") returned 5
	[0073.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.781] lstrlenW (lpString=".pdf") returned 4
	[0073.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.782] lstrlenW (lpString=".xls") returned 4
	[0073.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.782] lstrlenW (lpString=".xlsx") returned 5
	[0073.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.782] lstrlenW (lpString=".ppt") returned 4
	[0073.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.782] lstrlenW (lpString=".zip") returned 4
	[0073.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.782] lstrlenW (lpString=".rar") returned 4
	[0073.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.782] lstrlenW (lpString=".bz2") returned 4
	[0073.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.782] lstrlenW (lpString=".7z") returned 3
	[0073.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.782] lstrlenW (lpString=".dbf") returned 4
	[0073.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.782] lstrlenW (lpString=".1cd") returned 4
	[0073.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0073.782] lstrlenW (lpString=".jpg") returned 4
	[0073.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.783] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.783] lstrlenW (lpString="BL00269_.WMF") returned 12
	[0073.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0073.783] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=5272) returned 1
	[0073.783] CloseHandle (hObject=0x314) returned 1
	[0073.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220
	[0073.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0073.783] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.784] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.784] GetLastError () returned 0x0
	[0073.784] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1498, lpOverlapped=0x0) returned 1
	[0073.785] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x14a0, lpOverlapped=0x0) returned 1
	[0073.786] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.786] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.787] SetEndOfFile (hFile=0x350) returned 1
	[0073.787] CloseHandle (hObject=0x350) returned 1
	[0073.788] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.788] SetEndOfFile (hFile=0x314) returned 1
	[0073.789] CloseHandle (hObject=0x314) returned 1
	[0073.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1
	[0073.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.789] lstrlenW (lpString=".doc") returned 4
	[0073.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.789] lstrlenW (lpString=".docx") returned 5
	[0073.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.789] lstrlenW (lpString=".pdf") returned 4
	[0073.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.790] lstrlenW (lpString=".xls") returned 4
	[0073.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.790] lstrlenW (lpString=".xlsx") returned 5
	[0073.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.790] lstrlenW (lpString=".ppt") returned 4
	[0073.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.790] lstrlenW (lpString=".zip") returned 4
	[0073.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.790] lstrlenW (lpString=".rar") returned 4
	[0073.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.790] lstrlenW (lpString=".bz2") returned 4
	[0073.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.790] lstrlenW (lpString=".7z") returned 3
	[0073.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.790] lstrlenW (lpString=".dbf") returned 4
	[0073.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.790] lstrlenW (lpString=".1cd") returned 4
	[0073.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.791] lstrlenW (lpString=".jpg") returned 4
	[0073.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.791] lstrlenW (lpString=".doc") returned 4
	[0073.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.791] lstrlenW (lpString=".docx") returned 5
	[0073.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.791] lstrlenW (lpString=".pdf") returned 4
	[0073.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.791] lstrlenW (lpString=".xls") returned 4
	[0073.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.791] lstrlenW (lpString=".xlsx") returned 5
	[0073.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.791] lstrlenW (lpString=".ppt") returned 4
	[0073.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.791] lstrlenW (lpString=".zip") returned 4
	[0073.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.792] lstrlenW (lpString=".rar") returned 4
	[0073.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.792] lstrlenW (lpString=".bz2") returned 4
	[0073.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.792] lstrlenW (lpString=".7z") returned 3
	[0073.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.792] lstrlenW (lpString=".dbf") returned 4
	[0073.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.792] lstrlenW (lpString=".1cd") returned 4
	[0073.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0073.792] lstrlenW (lpString=".jpg") returned 4
	[0073.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.792] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.792] lstrlenW (lpString="BL00270_.WMF") returned 12
	[0073.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0073.793] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3016) returned 1
	[0073.793] CloseHandle (hObject=0x314) returned 1
	[0073.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220
	[0073.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0073.793] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.793] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.794] GetLastError () returned 0x0
	[0073.794] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xbc8, lpOverlapped=0x0) returned 1
	[0074.114] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0074.115] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.115] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.115] SetEndOfFile (hFile=0x350) returned 1
	[0074.189] CloseHandle (hObject=0x350) returned 1
	[0074.190] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.190] SetEndOfFile (hFile=0x314) returned 1
	[0074.191] CloseHandle (hObject=0x314) returned 1
	[0074.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1
	[0074.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.192] lstrlenW (lpString=".doc") returned 4
	[0074.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.192] lstrlenW (lpString=".docx") returned 5
	[0074.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.192] lstrlenW (lpString=".pdf") returned 4
	[0074.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.192] lstrlenW (lpString=".xls") returned 4
	[0074.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.192] lstrlenW (lpString=".xlsx") returned 5
	[0074.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.192] lstrlenW (lpString=".ppt") returned 4
	[0074.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.192] lstrlenW (lpString=".zip") returned 4
	[0074.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.192] lstrlenW (lpString=".rar") returned 4
	[0074.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.193] lstrlenW (lpString=".bz2") returned 4
	[0074.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.193] lstrlenW (lpString=".7z") returned 3
	[0074.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.193] lstrlenW (lpString=".dbf") returned 4
	[0074.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.193] lstrlenW (lpString=".1cd") returned 4
	[0074.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.193] lstrlenW (lpString=".jpg") returned 4
	[0074.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.194] lstrlenW (lpString=".doc") returned 4
	[0074.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.194] lstrlenW (lpString=".docx") returned 5
	[0074.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.194] lstrlenW (lpString=".pdf") returned 4
	[0074.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.194] lstrlenW (lpString=".xls") returned 4
	[0074.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.194] lstrlenW (lpString=".xlsx") returned 5
	[0074.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.194] lstrlenW (lpString=".ppt") returned 4
	[0074.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.194] lstrlenW (lpString=".zip") returned 4
	[0074.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.194] lstrlenW (lpString=".rar") returned 4
	[0074.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.194] lstrlenW (lpString=".bz2") returned 4
	[0074.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.194] lstrlenW (lpString=".7z") returned 3
	[0074.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.194] lstrlenW (lpString=".dbf") returned 4
	[0074.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.195] lstrlenW (lpString=".1cd") returned 4
	[0074.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.195] lstrlenW (lpString=".jpg") returned 4
	[0074.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.195] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.195] lstrlenW (lpString="BL00932_.WMF") returned 12
	[0074.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.195] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=19476) returned 1
	[0074.195] CloseHandle (hObject=0x314) returned 1
	[0074.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220
	[0074.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.196] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.196] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.196] GetLastError () returned 0x0
	[0074.196] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x4c14, lpOverlapped=0x0) returned 1
	[0074.198] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4c20, lpOverlapped=0x0) returned 1
	[0074.199] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.199] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.199] SetEndOfFile (hFile=0x350) returned 1
	[0074.199] CloseHandle (hObject=0x350) returned 1
	[0074.200] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.200] SetEndOfFile (hFile=0x314) returned 1
	[0074.201] CloseHandle (hObject=0x314) returned 1
	[0074.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1
	[0074.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.202] lstrlenW (lpString=".doc") returned 4
	[0074.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.202] lstrlenW (lpString=".docx") returned 5
	[0074.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.202] lstrlenW (lpString=".pdf") returned 4
	[0074.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.202] lstrlenW (lpString=".xls") returned 4
	[0074.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.202] lstrlenW (lpString=".xlsx") returned 5
	[0074.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.202] lstrlenW (lpString=".ppt") returned 4
	[0074.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.202] lstrlenW (lpString=".zip") returned 4
	[0074.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.203] lstrlenW (lpString=".rar") returned 4
	[0074.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.203] lstrlenW (lpString=".bz2") returned 4
	[0074.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.203] lstrlenW (lpString=".7z") returned 3
	[0074.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.203] lstrlenW (lpString=".dbf") returned 4
	[0074.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.203] lstrlenW (lpString=".1cd") returned 4
	[0074.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.203] lstrlenW (lpString=".jpg") returned 4
	[0074.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.203] lstrlenW (lpString=".doc") returned 4
	[0074.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.203] lstrlenW (lpString=".docx") returned 5
	[0074.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.203] lstrlenW (lpString=".pdf") returned 4
	[0074.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.203] lstrlenW (lpString=".xls") returned 4
	[0074.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.204] lstrlenW (lpString=".xlsx") returned 5
	[0074.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.204] lstrlenW (lpString=".ppt") returned 4
	[0074.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.204] lstrlenW (lpString=".zip") returned 4
	[0074.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.204] lstrlenW (lpString=".rar") returned 4
	[0074.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.204] lstrlenW (lpString=".bz2") returned 4
	[0074.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.204] lstrlenW (lpString=".7z") returned 3
	[0074.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.204] lstrlenW (lpString=".dbf") returned 4
	[0074.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.204] lstrlenW (lpString=".1cd") returned 4
	[0074.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0074.204] lstrlenW (lpString=".jpg") returned 4
	[0074.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.204] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.205] lstrlenW (lpString="BL00985_.WMF") returned 12
	[0074.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.205] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3768) returned 1
	[0074.205] CloseHandle (hObject=0x314) returned 1
	[0074.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220
	[0074.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.205] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.205] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.206] GetLastError () returned 0x0
	[0074.206] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xeb8, lpOverlapped=0x0) returned 1
	[0074.207] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec0, lpOverlapped=0x0) returned 1
	[0074.208] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.208] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.208] SetEndOfFile (hFile=0x350) returned 1
	[0074.208] CloseHandle (hObject=0x350) returned 1
	[0074.209] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.209] SetEndOfFile (hFile=0x314) returned 1
	[0074.210] CloseHandle (hObject=0x314) returned 1
	[0074.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1
	[0074.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.211] lstrlenW (lpString=".doc") returned 4
	[0074.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.211] lstrlenW (lpString=".docx") returned 5
	[0074.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.211] lstrlenW (lpString=".pdf") returned 4
	[0074.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.211] lstrlenW (lpString=".xls") returned 4
	[0074.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.211] lstrlenW (lpString=".xlsx") returned 5
	[0074.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.211] lstrlenW (lpString=".ppt") returned 4
	[0074.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.211] lstrlenW (lpString=".zip") returned 4
	[0074.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.211] lstrlenW (lpString=".rar") returned 4
	[0074.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.211] lstrlenW (lpString=".bz2") returned 4
	[0074.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.211] lstrlenW (lpString=".7z") returned 3
	[0074.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.211] lstrlenW (lpString=".dbf") returned 4
	[0074.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.211] lstrlenW (lpString=".1cd") returned 4
	[0074.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.212] lstrlenW (lpString=".jpg") returned 4
	[0074.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.212] lstrlenW (lpString=".doc") returned 4
	[0074.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.212] lstrlenW (lpString=".docx") returned 5
	[0074.212] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.212] lstrlenW (lpString=".pdf") returned 4
	[0074.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.212] lstrlenW (lpString=".xls") returned 4
	[0074.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.212] lstrlenW (lpString=".xlsx") returned 5
	[0074.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.212] lstrlenW (lpString=".ppt") returned 4
	[0074.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.212] lstrlenW (lpString=".zip") returned 4
	[0074.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.212] lstrlenW (lpString=".rar") returned 4
	[0074.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.212] lstrlenW (lpString=".bz2") returned 4
	[0074.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.212] lstrlenW (lpString=".7z") returned 3
	[0074.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.212] lstrlenW (lpString=".dbf") returned 4
	[0074.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.213] lstrlenW (lpString=".1cd") returned 4
	[0074.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0074.213] lstrlenW (lpString=".jpg") returned 4
	[0074.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.213] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.213] lstrlenW (lpString="BOAT.WMF") returned 8
	[0074.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.214] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3350) returned 1
	[0074.214] CloseHandle (hObject=0x314) returned 1
	[0074.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220
	[0074.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.214] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.214] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.215] GetLastError () returned 0x0
	[0074.215] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xd16, lpOverlapped=0x0) returned 1
	[0074.216] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xd20, lpOverlapped=0x0) returned 1
	[0074.217] ReadFile (in: hFile=0x314, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.217] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0074.217] SetEndOfFile (hFile=0x350) returned 1
	[0074.217] CloseHandle (hObject=0x350) returned 1
	[0074.218] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.218] SetEndOfFile (hFile=0x314) returned 1
	[0074.219] CloseHandle (hObject=0x314) returned 1
	[0074.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1
	[0074.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.220] lstrlenW (lpString=".doc") returned 4
	[0074.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.220] lstrlenW (lpString=".docx") returned 5
	[0074.220] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0074.220] lstrlenW (lpString=".pdf") returned 4
	[0074.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.220] lstrlenW (lpString=".xls") returned 4
	[0074.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.220] lstrlenW (lpString=".xlsx") returned 5
	[0074.220] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0074.220] lstrlenW (lpString=".ppt") returned 4
	[0074.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.220] lstrlenW (lpString=".zip") returned 4
	[0074.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.220] lstrlenW (lpString=".rar") returned 4
	[0074.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.220] lstrlenW (lpString=".bz2") returned 4
	[0074.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.220] lstrlenW (lpString=".7z") returned 3
	[0074.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.221] lstrlenW (lpString=".dbf") returned 4
	[0074.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.221] lstrlenW (lpString=".1cd") returned 4
	[0074.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.221] lstrlenW (lpString=".jpg") returned 4
	[0074.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.221] lstrlenW (lpString=".doc") returned 4
	[0074.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.221] lstrlenW (lpString=".docx") returned 5
	[0074.221] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0074.221] lstrlenW (lpString=".pdf") returned 4
	[0074.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.221] lstrlenW (lpString=".xls") returned 4
	[0074.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.221] lstrlenW (lpString=".xlsx") returned 5
	[0074.221] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0074.221] lstrlenW (lpString=".ppt") returned 4
	[0074.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.221] lstrlenW (lpString=".zip") returned 4
	[0074.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.221] lstrlenW (lpString=".rar") returned 4
	[0074.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.222] lstrlenW (lpString=".bz2") returned 4
	[0074.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.222] lstrlenW (lpString=".7z") returned 3
	[0074.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.222] lstrlenW (lpString=".dbf") returned 4
	[0074.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.222] lstrlenW (lpString=".1cd") returned 4
	[0074.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0074.222] lstrlenW (lpString=".jpg") returned 4
	[0074.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.222] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.222] lstrlenW (lpString="BOATINST.WMF") returned 12
	[0074.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0074.720] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=29004) returned 1
	[0074.720] CloseHandle (hObject=0x344) returned 1
	[0074.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220
	[0074.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0074.721] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.721] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.725] GetLastError () returned 0x0
	[0074.725] ReadFile (in: hFile=0x344, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x714c, lpOverlapped=0x0) returned 1
	[0074.727] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x7150, lpOverlapped=0x0) returned 1
	[0074.728] ReadFile (in: hFile=0x344, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.728] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.728] SetEndOfFile (hFile=0x33c) returned 1
	[0074.728] CloseHandle (hObject=0x33c) returned 1
	[0074.730] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.730] SetEndOfFile (hFile=0x344) returned 1
	[0074.731] CloseHandle (hObject=0x344) returned 1
	[0074.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1
	[0074.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.731] lstrlenW (lpString=".doc") returned 4
	[0074.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.732] lstrlenW (lpString=".docx") returned 5
	[0074.732] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0074.732] lstrlenW (lpString=".pdf") returned 4
	[0074.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.732] lstrlenW (lpString=".xls") returned 4
	[0074.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.732] lstrlenW (lpString=".xlsx") returned 5
	[0074.732] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0074.732] lstrlenW (lpString=".ppt") returned 4
	[0074.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.732] lstrlenW (lpString=".zip") returned 4
	[0074.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.732] lstrlenW (lpString=".rar") returned 4
	[0074.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.732] lstrlenW (lpString=".bz2") returned 4
	[0074.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.732] lstrlenW (lpString=".7z") returned 3
	[0074.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.732] lstrlenW (lpString=".dbf") returned 4
	[0074.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.733] lstrlenW (lpString=".1cd") returned 4
	[0074.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.733] lstrlenW (lpString=".jpg") returned 4
	[0074.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.733] lstrlenW (lpString=".doc") returned 4
	[0074.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.733] lstrlenW (lpString=".docx") returned 5
	[0074.733] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0074.733] lstrlenW (lpString=".pdf") returned 4
	[0074.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.733] lstrlenW (lpString=".xls") returned 4
	[0074.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.733] lstrlenW (lpString=".xlsx") returned 5
	[0074.733] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0074.733] lstrlenW (lpString=".ppt") returned 4
	[0074.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.734] lstrlenW (lpString=".zip") returned 4
	[0074.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.734] lstrlenW (lpString=".rar") returned 4
	[0074.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.734] lstrlenW (lpString=".bz2") returned 4
	[0074.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.734] lstrlenW (lpString=".7z") returned 3
	[0074.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.734] lstrlenW (lpString=".dbf") returned 4
	[0074.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.734] lstrlenW (lpString=".1cd") returned 4
	[0074.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0074.734] lstrlenW (lpString=".jpg") returned 4
	[0074.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.735] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.735] lstrlenW (lpString="BS00224_.WMF") returned 12
	[0074.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0074.735] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1588) returned 1
	[0074.735] CloseHandle (hObject=0x344) returned 1
	[0074.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220
	[0074.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0074.735] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.736] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.736] GetLastError () returned 0x0
	[0074.736] ReadFile (in: hFile=0x344, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x634, lpOverlapped=0x0) returned 1
	[0074.737] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x640, lpOverlapped=0x0) returned 1
	[0074.738] ReadFile (in: hFile=0x344, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.738] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.738] SetEndOfFile (hFile=0x33c) returned 1
	[0074.739] CloseHandle (hObject=0x33c) returned 1
	[0074.739] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.739] SetEndOfFile (hFile=0x344) returned 1
	[0074.740] CloseHandle (hObject=0x344) returned 1
	[0074.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1
	[0074.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.741] lstrlenW (lpString=".doc") returned 4
	[0074.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.741] lstrlenW (lpString=".docx") returned 5
	[0074.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.741] lstrlenW (lpString=".pdf") returned 4
	[0074.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.741] lstrlenW (lpString=".xls") returned 4
	[0074.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.741] lstrlenW (lpString=".xlsx") returned 5
	[0074.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.741] lstrlenW (lpString=".ppt") returned 4
	[0074.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.742] lstrlenW (lpString=".zip") returned 4
	[0074.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.742] lstrlenW (lpString=".rar") returned 4
	[0074.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.742] lstrlenW (lpString=".bz2") returned 4
	[0074.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.742] lstrlenW (lpString=".7z") returned 3
	[0074.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.742] lstrlenW (lpString=".dbf") returned 4
	[0074.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.742] lstrlenW (lpString=".1cd") returned 4
	[0074.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.742] lstrlenW (lpString=".jpg") returned 4
	[0074.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.742] lstrlenW (lpString=".doc") returned 4
	[0074.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.742] lstrlenW (lpString=".docx") returned 5
	[0074.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.743] lstrlenW (lpString=".pdf") returned 4
	[0074.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.743] lstrlenW (lpString=".xls") returned 4
	[0074.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.743] lstrlenW (lpString=".xlsx") returned 5
	[0074.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.743] lstrlenW (lpString=".ppt") returned 4
	[0074.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.743] lstrlenW (lpString=".zip") returned 4
	[0074.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.743] lstrlenW (lpString=".rar") returned 4
	[0074.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.743] lstrlenW (lpString=".bz2") returned 4
	[0074.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.743] lstrlenW (lpString=".7z") returned 3
	[0074.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.743] lstrlenW (lpString=".dbf") returned 4
	[0074.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.743] lstrlenW (lpString=".1cd") returned 4
	[0074.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0074.743] lstrlenW (lpString=".jpg") returned 4
	[0074.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.744] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.744] lstrlenW (lpString="BS00438_.WMF") returned 12
	[0074.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0074.745] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1212) returned 1
	[0074.745] CloseHandle (hObject=0x344) returned 1
	[0074.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220
	[0074.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0074.745] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.745] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.746] GetLastError () returned 0x0
	[0074.746] ReadFile (in: hFile=0x344, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x4bc, lpOverlapped=0x0) returned 1
	[0074.747] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4c0, lpOverlapped=0x0) returned 1
	[0074.748] ReadFile (in: hFile=0x344, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.748] WriteFile (in: hFile=0x33c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.748] SetEndOfFile (hFile=0x33c) returned 1
	[0074.749] CloseHandle (hObject=0x33c) returned 1
	[0074.749] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.749] SetEndOfFile (hFile=0x344) returned 1
	[0074.750] CloseHandle (hObject=0x344) returned 1
	[0074.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1
	[0074.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.751] lstrlenW (lpString=".doc") returned 4
	[0074.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.751] lstrlenW (lpString=".docx") returned 5
	[0074.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.751] lstrlenW (lpString=".pdf") returned 4
	[0074.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.751] lstrlenW (lpString=".xls") returned 4
	[0074.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.752] lstrlenW (lpString=".xlsx") returned 5
	[0074.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.752] lstrlenW (lpString=".ppt") returned 4
	[0074.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.752] lstrlenW (lpString=".zip") returned 4
	[0074.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.752] lstrlenW (lpString=".rar") returned 4
	[0074.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.752] lstrlenW (lpString=".bz2") returned 4
	[0074.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.752] lstrlenW (lpString=".7z") returned 3
	[0074.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.752] lstrlenW (lpString=".dbf") returned 4
	[0074.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.752] lstrlenW (lpString=".1cd") returned 4
	[0074.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.752] lstrlenW (lpString=".jpg") returned 4
	[0074.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.753] lstrlenW (lpString=".doc") returned 4
	[0074.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.753] lstrlenW (lpString=".docx") returned 5
	[0074.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.753] lstrlenW (lpString=".pdf") returned 4
	[0074.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.753] lstrlenW (lpString=".xls") returned 4
	[0074.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.753] lstrlenW (lpString=".xlsx") returned 5
	[0074.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.753] lstrlenW (lpString=".ppt") returned 4
	[0074.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.753] lstrlenW (lpString=".zip") returned 4
	[0074.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.753] lstrlenW (lpString=".rar") returned 4
	[0074.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.753] lstrlenW (lpString=".bz2") returned 4
	[0074.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.753] lstrlenW (lpString=".7z") returned 3
	[0074.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.753] lstrlenW (lpString=".dbf") returned 4
	[0074.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.754] lstrlenW (lpString=".1cd") returned 4
	[0074.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0074.754] lstrlenW (lpString=".jpg") returned 4
	[0075.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.084] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.084] lstrlenW (lpString="BS01080_.WMF") returned 12
	[0075.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.411] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2732) returned 1
	[0075.411] CloseHandle (hObject=0x37c) returned 1
	[0075.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220
	[0075.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.552] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.552] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0075.848] GetLastError () returned 0x0
	[0075.848] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xaac, lpOverlapped=0x0) returned 1
	[0075.849] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xab0, lpOverlapped=0x0) returned 1
	[0075.851] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.851] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.851] SetEndOfFile (hFile=0x314) returned 1
	[0075.851] CloseHandle (hObject=0x314) returned 1
	[0075.852] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.852] SetEndOfFile (hFile=0x340) returned 1
	[0075.853] CloseHandle (hObject=0x340) returned 1
	[0075.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1
	[0075.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.854] lstrlenW (lpString=".doc") returned 4
	[0075.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.854] lstrlenW (lpString=".docx") returned 5
	[0075.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.854] lstrlenW (lpString=".pdf") returned 4
	[0075.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.854] lstrlenW (lpString=".xls") returned 4
	[0075.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.854] lstrlenW (lpString=".xlsx") returned 5
	[0075.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.854] lstrlenW (lpString=".ppt") returned 4
	[0075.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.854] lstrlenW (lpString=".zip") returned 4
	[0075.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.854] lstrlenW (lpString=".rar") returned 4
	[0075.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.854] lstrlenW (lpString=".bz2") returned 4
	[0075.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.855] lstrlenW (lpString=".7z") returned 3
	[0075.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.855] lstrlenW (lpString=".dbf") returned 4
	[0075.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.855] lstrlenW (lpString=".1cd") returned 4
	[0075.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.855] lstrlenW (lpString=".jpg") returned 4
	[0075.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.855] lstrlenW (lpString=".doc") returned 4
	[0075.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.855] lstrlenW (lpString=".docx") returned 5
	[0075.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.855] lstrlenW (lpString=".pdf") returned 4
	[0075.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.856] lstrlenW (lpString=".xls") returned 4
	[0075.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.856] lstrlenW (lpString=".xlsx") returned 5
	[0075.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.856] lstrlenW (lpString=".ppt") returned 4
	[0075.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.856] lstrlenW (lpString=".zip") returned 4
	[0075.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.856] lstrlenW (lpString=".rar") returned 4
	[0075.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.856] lstrlenW (lpString=".bz2") returned 4
	[0075.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.856] lstrlenW (lpString=".7z") returned 3
	[0075.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.856] lstrlenW (lpString=".dbf") returned 4
	[0075.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.857] lstrlenW (lpString=".1cd") returned 4
	[0075.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0075.857] lstrlenW (lpString=".jpg") returned 4
	[0075.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.857] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.857] lstrlenW (lpString="CRANINST.WMF") returned 12
	[0075.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.857] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=49546) returned 1
	[0075.857] CloseHandle (hObject=0x340) returned 1
	[0075.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220
	[0075.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.858] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.858] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0075.858] GetLastError () returned 0x0
	[0075.858] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xc18a, lpOverlapped=0x0) returned 1
	[0075.861] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xc190, lpOverlapped=0x0) returned 1
	[0075.862] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.862] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.863] SetEndOfFile (hFile=0x314) returned 1
	[0075.863] CloseHandle (hObject=0x314) returned 1
	[0075.865] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.865] SetEndOfFile (hFile=0x340) returned 1
	[0075.866] CloseHandle (hObject=0x340) returned 1
	[0075.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1
	[0075.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.867] lstrlenW (lpString=".doc") returned 4
	[0075.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.867] lstrlenW (lpString=".docx") returned 5
	[0075.867] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0075.867] lstrlenW (lpString=".pdf") returned 4
	[0075.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.867] lstrlenW (lpString=".xls") returned 4
	[0075.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.867] lstrlenW (lpString=".xlsx") returned 5
	[0075.867] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0075.867] lstrlenW (lpString=".ppt") returned 4
	[0075.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.868] lstrlenW (lpString=".zip") returned 4
	[0075.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.868] lstrlenW (lpString=".rar") returned 4
	[0075.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.868] lstrlenW (lpString=".bz2") returned 4
	[0075.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.868] lstrlenW (lpString=".7z") returned 3
	[0075.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.868] lstrlenW (lpString=".dbf") returned 4
	[0075.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.868] lstrlenW (lpString=".1cd") returned 4
	[0075.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.868] lstrlenW (lpString=".jpg") returned 4
	[0075.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.869] lstrlenW (lpString=".doc") returned 4
	[0075.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.869] lstrlenW (lpString=".docx") returned 5
	[0075.869] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0075.869] lstrlenW (lpString=".pdf") returned 4
	[0075.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.869] lstrlenW (lpString=".xls") returned 4
	[0075.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.869] lstrlenW (lpString=".xlsx") returned 5
	[0075.869] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0075.869] lstrlenW (lpString=".ppt") returned 4
	[0075.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.870] lstrlenW (lpString=".zip") returned 4
	[0075.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.870] lstrlenW (lpString=".rar") returned 4
	[0075.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.870] lstrlenW (lpString=".bz2") returned 4
	[0075.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.870] lstrlenW (lpString=".7z") returned 3
	[0075.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.870] lstrlenW (lpString=".dbf") returned 4
	[0075.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.870] lstrlenW (lpString=".1cd") returned 4
	[0075.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0075.870] lstrlenW (lpString=".jpg") returned 4
	[0075.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.871] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.871] lstrlenW (lpString="CUP.WMF") returned 7
	[0075.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.871] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2966) returned 1
	[0075.871] CloseHandle (hObject=0x340) returned 1
	[0075.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220
	[0075.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.872] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.872] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0075.872] GetLastError () returned 0x0
	[0075.872] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xb96, lpOverlapped=0x0) returned 1
	[0075.874] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xba0, lpOverlapped=0x0) returned 1
	[0075.875] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.875] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0075.875] SetEndOfFile (hFile=0x314) returned 1
	[0075.875] CloseHandle (hObject=0x314) returned 1
	[0075.876] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.876] SetEndOfFile (hFile=0x340) returned 1
	[0075.877] CloseHandle (hObject=0x340) returned 1
	[0075.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1
	[0075.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.878] lstrlenW (lpString=".doc") returned 4
	[0075.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.878] lstrlenW (lpString=".docx") returned 5
	[0075.878] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0075.878] lstrlenW (lpString=".pdf") returned 4
	[0075.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.878] lstrlenW (lpString=".xls") returned 4
	[0075.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.878] lstrlenW (lpString=".xlsx") returned 5
	[0075.878] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0075.878] lstrlenW (lpString=".ppt") returned 4
	[0075.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.878] lstrlenW (lpString=".zip") returned 4
	[0075.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.878] lstrlenW (lpString=".rar") returned 4
	[0075.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.878] lstrlenW (lpString=".bz2") returned 4
	[0075.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.879] lstrlenW (lpString=".7z") returned 3
	[0075.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.879] lstrlenW (lpString=".dbf") returned 4
	[0075.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.879] lstrlenW (lpString=".1cd") returned 4
	[0075.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.879] lstrlenW (lpString=".jpg") returned 4
	[0075.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.880] lstrlenW (lpString=".doc") returned 4
	[0075.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.880] lstrlenW (lpString=".docx") returned 5
	[0075.880] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0075.880] lstrlenW (lpString=".pdf") returned 4
	[0075.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.880] lstrlenW (lpString=".xls") returned 4
	[0075.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.880] lstrlenW (lpString=".xlsx") returned 5
	[0075.880] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0075.880] lstrlenW (lpString=".ppt") returned 4
	[0075.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.880] lstrlenW (lpString=".zip") returned 4
	[0075.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.880] lstrlenW (lpString=".rar") returned 4
	[0075.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.880] lstrlenW (lpString=".bz2") returned 4
	[0075.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.880] lstrlenW (lpString=".7z") returned 3
	[0075.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.881] lstrlenW (lpString=".dbf") returned 4
	[0075.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.881] lstrlenW (lpString=".1cd") returned 4
	[0075.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0075.881] lstrlenW (lpString=".jpg") returned 4
	[0075.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.881] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.881] lstrlenW (lpString="CUPINST.WMF") returned 11
	[0075.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.881] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=10326) returned 1
	[0075.882] CloseHandle (hObject=0x340) returned 1
	[0075.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220
	[0075.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.882] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.882] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0075.886] GetLastError () returned 0x0
	[0075.886] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x2856, lpOverlapped=0x0) returned 1
	[0076.278] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x2860, lpOverlapped=0x0) returned 1
	[0076.280] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.280] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xea, lpOverlapped=0x0) returned 1
	[0076.280] SetEndOfFile (hFile=0x314) returned 1
	[0076.280] CloseHandle (hObject=0x314) returned 1
	[0076.281] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.281] SetEndOfFile (hFile=0x340) returned 1
	[0076.282] CloseHandle (hObject=0x340) returned 1
	[0076.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1
	[0076.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.283] lstrlenW (lpString=".doc") returned 4
	[0076.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.283] lstrlenW (lpString=".docx") returned 5
	[0076.283] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0076.283] lstrlenW (lpString=".pdf") returned 4
	[0076.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.283] lstrlenW (lpString=".xls") returned 4
	[0076.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.283] lstrlenW (lpString=".xlsx") returned 5
	[0076.283] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0076.283] lstrlenW (lpString=".ppt") returned 4
	[0076.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.283] lstrlenW (lpString=".zip") returned 4
	[0076.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.283] lstrlenW (lpString=".rar") returned 4
	[0076.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.283] lstrlenW (lpString=".bz2") returned 4
	[0076.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.283] lstrlenW (lpString=".7z") returned 3
	[0076.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.283] lstrlenW (lpString=".dbf") returned 4
	[0076.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.283] lstrlenW (lpString=".1cd") returned 4
	[0076.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.284] lstrlenW (lpString=".jpg") returned 4
	[0076.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.284] lstrlenW (lpString=".doc") returned 4
	[0076.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.284] lstrlenW (lpString=".docx") returned 5
	[0076.284] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0076.284] lstrlenW (lpString=".pdf") returned 4
	[0076.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.284] lstrlenW (lpString=".xls") returned 4
	[0076.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.284] lstrlenW (lpString=".xlsx") returned 5
	[0076.284] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0076.284] lstrlenW (lpString=".ppt") returned 4
	[0076.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.284] lstrlenW (lpString=".zip") returned 4
	[0076.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.284] lstrlenW (lpString=".rar") returned 4
	[0076.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.284] lstrlenW (lpString=".bz2") returned 4
	[0076.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.284] lstrlenW (lpString=".7z") returned 3
	[0076.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.285] lstrlenW (lpString=".dbf") returned 4
	[0076.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.285] lstrlenW (lpString=".1cd") returned 4
	[0076.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.285] lstrlenW (lpString=".jpg") returned 4
	[0076.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.285] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.285] lstrlenW (lpString="DD00448_.WMF") returned 12
	[0076.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.286] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2952) returned 1
	[0076.286] CloseHandle (hObject=0x340) returned 1
	[0076.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220
	[0076.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.286] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.286] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0076.287] GetLastError () returned 0x0
	[0076.287] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xb88, lpOverlapped=0x0) returned 1
	[0076.288] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xb90, lpOverlapped=0x0) returned 1
	[0076.289] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.289] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.289] SetEndOfFile (hFile=0x314) returned 1
	[0076.289] CloseHandle (hObject=0x314) returned 1
	[0076.290] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.290] SetEndOfFile (hFile=0x340) returned 1
	[0076.291] CloseHandle (hObject=0x340) returned 1
	[0076.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1
	[0076.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.291] lstrlenW (lpString=".doc") returned 4
	[0076.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.292] lstrlenW (lpString=".docx") returned 5
	[0076.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.292] lstrlenW (lpString=".pdf") returned 4
	[0076.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.292] lstrlenW (lpString=".xls") returned 4
	[0076.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.292] lstrlenW (lpString=".xlsx") returned 5
	[0076.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.292] lstrlenW (lpString=".ppt") returned 4
	[0076.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.292] lstrlenW (lpString=".zip") returned 4
	[0076.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.292] lstrlenW (lpString=".rar") returned 4
	[0076.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.292] lstrlenW (lpString=".bz2") returned 4
	[0076.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.292] lstrlenW (lpString=".7z") returned 3
	[0076.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.292] lstrlenW (lpString=".dbf") returned 4
	[0076.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.292] lstrlenW (lpString=".1cd") returned 4
	[0076.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.293] lstrlenW (lpString=".jpg") returned 4
	[0076.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.293] lstrlenW (lpString=".doc") returned 4
	[0076.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.293] lstrlenW (lpString=".docx") returned 5
	[0076.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.293] lstrlenW (lpString=".pdf") returned 4
	[0076.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.293] lstrlenW (lpString=".xls") returned 4
	[0076.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.293] lstrlenW (lpString=".xlsx") returned 5
	[0076.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.293] lstrlenW (lpString=".ppt") returned 4
	[0076.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.293] lstrlenW (lpString=".zip") returned 4
	[0076.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.293] lstrlenW (lpString=".rar") returned 4
	[0076.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.293] lstrlenW (lpString=".bz2") returned 4
	[0076.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.293] lstrlenW (lpString=".7z") returned 3
	[0076.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.293] lstrlenW (lpString=".dbf") returned 4
	[0076.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.294] lstrlenW (lpString=".1cd") returned 4
	[0076.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0076.294] lstrlenW (lpString=".jpg") returned 4
	[0076.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.294] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.294] lstrlenW (lpString="DD00449_.WMF") returned 12
	[0076.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.294] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=9992) returned 1
	[0076.294] CloseHandle (hObject=0x340) returned 1
	[0076.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220
	[0076.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.295] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.295] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0076.295] GetLastError () returned 0x0
	[0076.295] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x2708, lpOverlapped=0x0) returned 1
	[0076.297] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x2710, lpOverlapped=0x0) returned 1
	[0076.298] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.298] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.298] SetEndOfFile (hFile=0x314) returned 1
	[0076.298] CloseHandle (hObject=0x314) returned 1
	[0076.299] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.299] SetEndOfFile (hFile=0x340) returned 1
	[0076.300] CloseHandle (hObject=0x340) returned 1
	[0076.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1
	[0076.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.300] lstrlenW (lpString=".doc") returned 4
	[0076.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.301] lstrlenW (lpString=".docx") returned 5
	[0076.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.301] lstrlenW (lpString=".pdf") returned 4
	[0076.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.301] lstrlenW (lpString=".xls") returned 4
	[0076.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.301] lstrlenW (lpString=".xlsx") returned 5
	[0076.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.301] lstrlenW (lpString=".ppt") returned 4
	[0076.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.302] lstrlenW (lpString=".zip") returned 4
	[0076.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.302] lstrlenW (lpString=".rar") returned 4
	[0076.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.302] lstrlenW (lpString=".bz2") returned 4
	[0076.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.302] lstrlenW (lpString=".7z") returned 3
	[0076.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.302] lstrlenW (lpString=".dbf") returned 4
	[0076.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.302] lstrlenW (lpString=".1cd") returned 4
	[0076.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.302] lstrlenW (lpString=".jpg") returned 4
	[0076.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.302] lstrlenW (lpString=".doc") returned 4
	[0076.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.302] lstrlenW (lpString=".docx") returned 5
	[0076.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.302] lstrlenW (lpString=".pdf") returned 4
	[0076.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.303] lstrlenW (lpString=".xls") returned 4
	[0076.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.303] lstrlenW (lpString=".xlsx") returned 5
	[0076.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.303] lstrlenW (lpString=".ppt") returned 4
	[0076.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.303] lstrlenW (lpString=".zip") returned 4
	[0076.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.303] lstrlenW (lpString=".rar") returned 4
	[0076.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.303] lstrlenW (lpString=".bz2") returned 4
	[0076.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.303] lstrlenW (lpString=".7z") returned 3
	[0076.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.303] lstrlenW (lpString=".dbf") returned 4
	[0076.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.303] lstrlenW (lpString=".1cd") returned 4
	[0076.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0076.303] lstrlenW (lpString=".jpg") returned 4
	[0076.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.304] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.304] lstrlenW (lpString="DD00687_.WMF") returned 12
	[0076.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.304] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=20784) returned 1
	[0076.304] CloseHandle (hObject=0x340) returned 1
	[0076.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220
	[0076.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.305] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.305] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0076.305] GetLastError () returned 0x0
	[0076.305] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x5130, lpOverlapped=0x0) returned 1
	[0076.307] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x5140, lpOverlapped=0x0) returned 1
	[0076.308] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.308] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.308] SetEndOfFile (hFile=0x314) returned 1
	[0076.309] CloseHandle (hObject=0x314) returned 1
	[0076.310] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.310] SetEndOfFile (hFile=0x340) returned 1
	[0076.311] CloseHandle (hObject=0x340) returned 1
	[0076.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1
	[0076.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.311] lstrlenW (lpString=".doc") returned 4
	[0076.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.312] lstrlenW (lpString=".docx") returned 5
	[0076.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.312] lstrlenW (lpString=".pdf") returned 4
	[0076.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.312] lstrlenW (lpString=".xls") returned 4
	[0076.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.312] lstrlenW (lpString=".xlsx") returned 5
	[0076.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.312] lstrlenW (lpString=".ppt") returned 4
	[0076.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.312] lstrlenW (lpString=".zip") returned 4
	[0076.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.312] lstrlenW (lpString=".rar") returned 4
	[0076.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.312] lstrlenW (lpString=".bz2") returned 4
	[0076.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.312] lstrlenW (lpString=".7z") returned 3
	[0076.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.312] lstrlenW (lpString=".dbf") returned 4
	[0076.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.313] lstrlenW (lpString=".1cd") returned 4
	[0076.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.313] lstrlenW (lpString=".jpg") returned 4
	[0076.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.313] lstrlenW (lpString=".doc") returned 4
	[0076.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.313] lstrlenW (lpString=".docx") returned 5
	[0076.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.313] lstrlenW (lpString=".pdf") returned 4
	[0076.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.313] lstrlenW (lpString=".xls") returned 4
	[0076.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.313] lstrlenW (lpString=".xlsx") returned 5
	[0076.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.313] lstrlenW (lpString=".ppt") returned 4
	[0076.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.313] lstrlenW (lpString=".zip") returned 4
	[0076.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.313] lstrlenW (lpString=".rar") returned 4
	[0076.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.314] lstrlenW (lpString=".bz2") returned 4
	[0076.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.314] lstrlenW (lpString=".7z") returned 3
	[0076.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.314] lstrlenW (lpString=".dbf") returned 4
	[0076.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.314] lstrlenW (lpString=".1cd") returned 4
	[0076.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0076.314] lstrlenW (lpString=".jpg") returned 4
	[0076.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.314] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.314] lstrlenW (lpString="DD00705_.WMF") returned 12
	[0076.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.315] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=24588) returned 1
	[0076.315] CloseHandle (hObject=0x340) returned 1
	[0076.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220
	[0076.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.315] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.315] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0076.316] GetLastError () returned 0x0
	[0076.316] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x600c, lpOverlapped=0x0) returned 1
	[0076.985] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x6010, lpOverlapped=0x0) returned 1
	[0076.986] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.986] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.986] SetEndOfFile (hFile=0x314) returned 1
	[0076.986] CloseHandle (hObject=0x314) returned 1
	[0076.986] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.986] SetEndOfFile (hFile=0x340) returned 1
	[0076.987] CloseHandle (hObject=0x340) returned 1
	[0076.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1
	[0076.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.988] lstrlenW (lpString=".doc") returned 4
	[0076.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.988] lstrlenW (lpString=".docx") returned 5
	[0076.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.988] lstrlenW (lpString=".pdf") returned 4
	[0076.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.988] lstrlenW (lpString=".xls") returned 4
	[0076.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.988] lstrlenW (lpString=".xlsx") returned 5
	[0076.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.988] lstrlenW (lpString=".ppt") returned 4
	[0076.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.989] lstrlenW (lpString=".zip") returned 4
	[0076.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.989] lstrlenW (lpString=".rar") returned 4
	[0076.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.989] lstrlenW (lpString=".bz2") returned 4
	[0076.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.989] lstrlenW (lpString=".7z") returned 3
	[0076.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.989] lstrlenW (lpString=".dbf") returned 4
	[0076.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.989] lstrlenW (lpString=".1cd") returned 4
	[0076.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.989] lstrlenW (lpString=".jpg") returned 4
	[0076.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.989] lstrlenW (lpString=".doc") returned 4
	[0076.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.989] lstrlenW (lpString=".docx") returned 5
	[0076.989] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.989] lstrlenW (lpString=".pdf") returned 4
	[0076.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.989] lstrlenW (lpString=".xls") returned 4
	[0076.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.989] lstrlenW (lpString=".xlsx") returned 5
	[0076.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.990] lstrlenW (lpString=".ppt") returned 4
	[0076.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.990] lstrlenW (lpString=".zip") returned 4
	[0076.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.990] lstrlenW (lpString=".rar") returned 4
	[0076.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.990] lstrlenW (lpString=".bz2") returned 4
	[0076.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.990] lstrlenW (lpString=".7z") returned 3
	[0076.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.990] lstrlenW (lpString=".dbf") returned 4
	[0076.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.990] lstrlenW (lpString=".1cd") returned 4
	[0076.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0076.990] lstrlenW (lpString=".jpg") returned 4
	[0076.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.990] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.990] lstrlenW (lpString="DD01162_.WMF") returned 12
	[0076.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.991] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2300) returned 1
	[0076.991] CloseHandle (hObject=0x340) returned 1
	[0076.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220
	[0076.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.991] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.991] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0076.992] GetLastError () returned 0x0
	[0076.992] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0076.993] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x900, lpOverlapped=0x0) returned 1
	[0076.994] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.994] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.994] SetEndOfFile (hFile=0x314) returned 1
	[0076.994] CloseHandle (hObject=0x314) returned 1
	[0076.994] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.994] SetEndOfFile (hFile=0x340) returned 1
	[0076.995] CloseHandle (hObject=0x340) returned 1
	[0076.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1
	[0076.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.996] lstrlenW (lpString=".doc") returned 4
	[0076.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.996] lstrlenW (lpString=".docx") returned 5
	[0076.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.996] lstrlenW (lpString=".pdf") returned 4
	[0076.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.996] lstrlenW (lpString=".xls") returned 4
	[0076.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.996] lstrlenW (lpString=".xlsx") returned 5
	[0076.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.996] lstrlenW (lpString=".ppt") returned 4
	[0076.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.996] lstrlenW (lpString=".zip") returned 4
	[0076.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.996] lstrlenW (lpString=".rar") returned 4
	[0076.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.996] lstrlenW (lpString=".bz2") returned 4
	[0076.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.996] lstrlenW (lpString=".7z") returned 3
	[0076.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.996] lstrlenW (lpString=".dbf") returned 4
	[0076.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.997] lstrlenW (lpString=".1cd") returned 4
	[0076.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.997] lstrlenW (lpString=".jpg") returned 4
	[0076.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.997] lstrlenW (lpString=".doc") returned 4
	[0076.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.997] lstrlenW (lpString=".docx") returned 5
	[0076.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.997] lstrlenW (lpString=".pdf") returned 4
	[0076.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.997] lstrlenW (lpString=".xls") returned 4
	[0076.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.997] lstrlenW (lpString=".xlsx") returned 5
	[0076.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.997] lstrlenW (lpString=".ppt") returned 4
	[0076.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.997] lstrlenW (lpString=".zip") returned 4
	[0076.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.997] lstrlenW (lpString=".rar") returned 4
	[0076.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.997] lstrlenW (lpString=".bz2") returned 4
	[0076.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.997] lstrlenW (lpString=".7z") returned 3
	[0076.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.997] lstrlenW (lpString=".dbf") returned 4
	[0076.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.998] lstrlenW (lpString=".1cd") returned 4
	[0076.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0076.998] lstrlenW (lpString=".jpg") returned 4
	[0076.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.998] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.998] lstrlenW (lpString="DD01163_.WMF") returned 12
	[0076.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.998] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2300) returned 1
	[0076.998] CloseHandle (hObject=0x340) returned 1
	[0076.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220
	[0076.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0076.999] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.999] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0076.999] GetLastError () returned 0x0
	[0076.999] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0077.000] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x900, lpOverlapped=0x0) returned 1
	[0077.001] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.001] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.002] SetEndOfFile (hFile=0x314) returned 1
	[0077.002] CloseHandle (hObject=0x314) returned 1
	[0077.002] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.002] SetEndOfFile (hFile=0x340) returned 1
	[0077.003] CloseHandle (hObject=0x340) returned 1
	[0077.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1
	[0077.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.003] lstrlenW (lpString=".doc") returned 4
	[0077.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.003] lstrlenW (lpString=".docx") returned 5
	[0077.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.003] lstrlenW (lpString=".pdf") returned 4
	[0077.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.003] lstrlenW (lpString=".xls") returned 4
	[0077.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.003] lstrlenW (lpString=".xlsx") returned 5
	[0077.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.004] lstrlenW (lpString=".ppt") returned 4
	[0077.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.004] lstrlenW (lpString=".zip") returned 4
	[0077.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.004] lstrlenW (lpString=".rar") returned 4
	[0077.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.004] lstrlenW (lpString=".bz2") returned 4
	[0077.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.004] lstrlenW (lpString=".7z") returned 3
	[0077.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.004] lstrlenW (lpString=".dbf") returned 4
	[0077.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.004] lstrlenW (lpString=".1cd") returned 4
	[0077.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.004] lstrlenW (lpString=".jpg") returned 4
	[0077.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.004] lstrlenW (lpString=".doc") returned 4
	[0077.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.004] lstrlenW (lpString=".docx") returned 5
	[0077.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.004] lstrlenW (lpString=".pdf") returned 4
	[0077.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.005] lstrlenW (lpString=".xls") returned 4
	[0077.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.005] lstrlenW (lpString=".xlsx") returned 5
	[0077.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.005] lstrlenW (lpString=".ppt") returned 4
	[0077.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.005] lstrlenW (lpString=".zip") returned 4
	[0077.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.005] lstrlenW (lpString=".rar") returned 4
	[0077.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.005] lstrlenW (lpString=".bz2") returned 4
	[0077.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.005] lstrlenW (lpString=".7z") returned 3
	[0077.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.005] lstrlenW (lpString=".dbf") returned 4
	[0077.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.005] lstrlenW (lpString=".1cd") returned 4
	[0077.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0077.005] lstrlenW (lpString=".jpg") returned 4
	[0077.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.005] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.005] lstrlenW (lpString="DD01166_.WMF") returned 12
	[0077.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.006] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2080) returned 1
	[0077.006] CloseHandle (hObject=0x340) returned 1
	[0077.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220
	[0077.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0077.006] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.006] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0077.007] GetLastError () returned 0x0
	[0077.007] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x820, lpOverlapped=0x0) returned 1
	[0077.008] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x830, lpOverlapped=0x0) returned 1
	[0077.016] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.016] WriteFile (in: hFile=0x314, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.016] SetEndOfFile (hFile=0x314) returned 1
	[0077.016] CloseHandle (hObject=0x314) returned 1
	[0077.016] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.016] SetEndOfFile (hFile=0x340) returned 1
	[0077.017] CloseHandle (hObject=0x340) returned 1
	[0077.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1
	[0077.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.018] lstrlenW (lpString=".doc") returned 4
	[0077.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.018] lstrlenW (lpString=".docx") returned 5
	[0077.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.018] lstrlenW (lpString=".pdf") returned 4
	[0077.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.018] lstrlenW (lpString=".xls") returned 4
	[0077.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.018] lstrlenW (lpString=".xlsx") returned 5
	[0077.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.018] lstrlenW (lpString=".ppt") returned 4
	[0077.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.018] lstrlenW (lpString=".zip") returned 4
	[0077.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.018] lstrlenW (lpString=".rar") returned 4
	[0077.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.018] lstrlenW (lpString=".bz2") returned 4
	[0077.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.018] lstrlenW (lpString=".7z") returned 3
	[0077.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.019] lstrlenW (lpString=".dbf") returned 4
	[0077.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.019] lstrlenW (lpString=".1cd") returned 4
	[0077.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.019] lstrlenW (lpString=".jpg") returned 4
	[0077.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.019] lstrlenW (lpString=".doc") returned 4
	[0077.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.019] lstrlenW (lpString=".docx") returned 5
	[0077.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.019] lstrlenW (lpString=".pdf") returned 4
	[0077.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.019] lstrlenW (lpString=".xls") returned 4
	[0077.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.019] lstrlenW (lpString=".xlsx") returned 5
	[0077.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.243] lstrlenW (lpString=".ppt") returned 4
	[0077.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.243] lstrlenW (lpString=".zip") returned 4
	[0077.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.244] lstrlenW (lpString=".rar") returned 4
	[0077.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.244] lstrlenW (lpString=".bz2") returned 4
	[0077.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.244] lstrlenW (lpString=".7z") returned 3
	[0077.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.244] lstrlenW (lpString=".dbf") returned 4
	[0077.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.244] lstrlenW (lpString=".1cd") returned 4
	[0077.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0077.244] lstrlenW (lpString=".jpg") returned 4
	[0077.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.245] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.245] lstrlenW (lpString="DD01178_.WMF") returned 12
	[0077.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.307] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3796) returned 1
	[0077.307] CloseHandle (hObject=0x368) returned 1
	[0077.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220
	[0077.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.307] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.307] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.308] GetLastError () returned 0x0
	[0077.308] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xed4, lpOverlapped=0x0) returned 1
	[0077.309] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xee0, lpOverlapped=0x0) returned 1
	[0077.310] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.310] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.311] SetEndOfFile (hFile=0x370) returned 1
	[0077.311] CloseHandle (hObject=0x370) returned 1
	[0077.311] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.311] SetEndOfFile (hFile=0x368) returned 1
	[0077.312] CloseHandle (hObject=0x368) returned 1
	[0077.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1
	[0077.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.312] lstrlenW (lpString=".doc") returned 4
	[0077.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.312] lstrlenW (lpString=".docx") returned 5
	[0077.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.313] lstrlenW (lpString=".pdf") returned 4
	[0077.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.313] lstrlenW (lpString=".xls") returned 4
	[0077.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.313] lstrlenW (lpString=".xlsx") returned 5
	[0077.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.313] lstrlenW (lpString=".ppt") returned 4
	[0077.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.313] lstrlenW (lpString=".zip") returned 4
	[0077.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.313] lstrlenW (lpString=".rar") returned 4
	[0077.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.313] lstrlenW (lpString=".bz2") returned 4
	[0077.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.313] lstrlenW (lpString=".7z") returned 3
	[0077.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.313] lstrlenW (lpString=".dbf") returned 4
	[0077.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.314] lstrlenW (lpString=".1cd") returned 4
	[0077.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.314] lstrlenW (lpString=".jpg") returned 4
	[0077.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.314] lstrlenW (lpString=".doc") returned 4
	[0077.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.314] lstrlenW (lpString=".docx") returned 5
	[0077.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.314] lstrlenW (lpString=".pdf") returned 4
	[0077.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.314] lstrlenW (lpString=".xls") returned 4
	[0077.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.314] lstrlenW (lpString=".xlsx") returned 5
	[0077.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.314] lstrlenW (lpString=".ppt") returned 4
	[0077.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.314] lstrlenW (lpString=".zip") returned 4
	[0077.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.314] lstrlenW (lpString=".rar") returned 4
	[0077.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.315] lstrlenW (lpString=".bz2") returned 4
	[0077.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.315] lstrlenW (lpString=".7z") returned 3
	[0077.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.315] lstrlenW (lpString=".dbf") returned 4
	[0077.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.315] lstrlenW (lpString=".1cd") returned 4
	[0077.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0077.315] lstrlenW (lpString=".jpg") returned 4
	[0077.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.315] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.315] lstrlenW (lpString="DD01180_.WMF") returned 12
	[0077.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.317] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2084) returned 1
	[0077.317] CloseHandle (hObject=0x368) returned 1
	[0077.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220
	[0077.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.317] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.317] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.317] GetLastError () returned 0x0
	[0077.318] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x824, lpOverlapped=0x0) returned 1
	[0077.319] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x830, lpOverlapped=0x0) returned 1
	[0077.320] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.320] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.320] SetEndOfFile (hFile=0x370) returned 1
	[0077.320] CloseHandle (hObject=0x370) returned 1
	[0077.321] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.321] SetEndOfFile (hFile=0x368) returned 1
	[0077.321] CloseHandle (hObject=0x368) returned 1
	[0077.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1
	[0077.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.322] lstrlenW (lpString=".doc") returned 4
	[0077.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.322] lstrlenW (lpString=".docx") returned 5
	[0077.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.322] lstrlenW (lpString=".pdf") returned 4
	[0077.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.322] lstrlenW (lpString=".xls") returned 4
	[0077.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.322] lstrlenW (lpString=".xlsx") returned 5
	[0077.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.323] lstrlenW (lpString=".ppt") returned 4
	[0077.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.323] lstrlenW (lpString=".zip") returned 4
	[0077.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.323] lstrlenW (lpString=".rar") returned 4
	[0077.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.323] lstrlenW (lpString=".bz2") returned 4
	[0077.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.323] lstrlenW (lpString=".7z") returned 3
	[0077.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.323] lstrlenW (lpString=".dbf") returned 4
	[0077.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.323] lstrlenW (lpString=".1cd") returned 4
	[0077.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.323] lstrlenW (lpString=".jpg") returned 4
	[0077.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.324] lstrlenW (lpString=".doc") returned 4
	[0077.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.324] lstrlenW (lpString=".docx") returned 5
	[0077.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.324] lstrlenW (lpString=".pdf") returned 4
	[0077.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.324] lstrlenW (lpString=".xls") returned 4
	[0077.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.324] lstrlenW (lpString=".xlsx") returned 5
	[0077.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.324] lstrlenW (lpString=".ppt") returned 4
	[0077.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.324] lstrlenW (lpString=".zip") returned 4
	[0077.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.324] lstrlenW (lpString=".rar") returned 4
	[0077.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.324] lstrlenW (lpString=".bz2") returned 4
	[0077.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.324] lstrlenW (lpString=".7z") returned 3
	[0077.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.325] lstrlenW (lpString=".dbf") returned 4
	[0077.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.325] lstrlenW (lpString=".1cd") returned 4
	[0077.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0077.325] lstrlenW (lpString=".jpg") returned 4
	[0077.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.325] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.325] lstrlenW (lpString="DD01181_.WMF") returned 12
	[0077.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.326] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1448) returned 1
	[0077.326] CloseHandle (hObject=0x368) returned 1
	[0077.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220
	[0077.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.326] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.326] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.327] GetLastError () returned 0x0
	[0077.327] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x5a8, lpOverlapped=0x0) returned 1
	[0077.328] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x5b0, lpOverlapped=0x0) returned 1
	[0077.329] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.329] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.329] SetEndOfFile (hFile=0x370) returned 1
	[0077.329] CloseHandle (hObject=0x370) returned 1
	[0077.330] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.330] SetEndOfFile (hFile=0x368) returned 1
	[0077.330] CloseHandle (hObject=0x368) returned 1
	[0077.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1
	[0077.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.331] lstrlenW (lpString=".doc") returned 4
	[0077.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.331] lstrlenW (lpString=".docx") returned 5
	[0077.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.331] lstrlenW (lpString=".pdf") returned 4
	[0077.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.331] lstrlenW (lpString=".xls") returned 4
	[0077.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.332] lstrlenW (lpString=".xlsx") returned 5
	[0077.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.332] lstrlenW (lpString=".ppt") returned 4
	[0077.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.332] lstrlenW (lpString=".zip") returned 4
	[0077.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.332] lstrlenW (lpString=".rar") returned 4
	[0077.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.332] lstrlenW (lpString=".bz2") returned 4
	[0077.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.332] lstrlenW (lpString=".7z") returned 3
	[0077.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.332] lstrlenW (lpString=".dbf") returned 4
	[0077.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.332] lstrlenW (lpString=".1cd") returned 4
	[0077.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.333] lstrlenW (lpString=".jpg") returned 4
	[0077.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.333] lstrlenW (lpString=".doc") returned 4
	[0077.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.333] lstrlenW (lpString=".docx") returned 5
	[0077.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.333] lstrlenW (lpString=".pdf") returned 4
	[0077.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.333] lstrlenW (lpString=".xls") returned 4
	[0077.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.333] lstrlenW (lpString=".xlsx") returned 5
	[0077.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.333] lstrlenW (lpString=".ppt") returned 4
	[0077.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.333] lstrlenW (lpString=".zip") returned 4
	[0077.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.333] lstrlenW (lpString=".rar") returned 4
	[0077.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.333] lstrlenW (lpString=".bz2") returned 4
	[0077.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.334] lstrlenW (lpString=".7z") returned 3
	[0077.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.334] lstrlenW (lpString=".dbf") returned 4
	[0077.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.334] lstrlenW (lpString=".1cd") returned 4
	[0077.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0077.334] lstrlenW (lpString=".jpg") returned 4
	[0077.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.334] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.334] lstrlenW (lpString="DD01182_.WMF") returned 12
	[0077.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.335] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2996) returned 1
	[0077.335] CloseHandle (hObject=0x368) returned 1
	[0077.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220
	[0077.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.335] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.335] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.336] GetLastError () returned 0x0
	[0077.336] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xbb4, lpOverlapped=0x0) returned 1
	[0077.337] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xbc0, lpOverlapped=0x0) returned 1
	[0077.338] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.338] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.338] SetEndOfFile (hFile=0x370) returned 1
	[0077.338] CloseHandle (hObject=0x370) returned 1
	[0077.338] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.338] SetEndOfFile (hFile=0x368) returned 1
	[0077.339] CloseHandle (hObject=0x368) returned 1
	[0077.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1
	[0077.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.340] lstrlenW (lpString=".doc") returned 4
	[0077.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.340] lstrlenW (lpString=".docx") returned 5
	[0077.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.340] lstrlenW (lpString=".pdf") returned 4
	[0077.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.340] lstrlenW (lpString=".xls") returned 4
	[0077.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.340] lstrlenW (lpString=".xlsx") returned 5
	[0077.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.340] lstrlenW (lpString=".ppt") returned 4
	[0077.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.341] lstrlenW (lpString=".zip") returned 4
	[0077.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.341] lstrlenW (lpString=".rar") returned 4
	[0077.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.341] lstrlenW (lpString=".bz2") returned 4
	[0077.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.341] lstrlenW (lpString=".7z") returned 3
	[0077.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.341] lstrlenW (lpString=".dbf") returned 4
	[0077.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.341] lstrlenW (lpString=".1cd") returned 4
	[0077.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.341] lstrlenW (lpString=".jpg") returned 4
	[0077.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.341] lstrlenW (lpString=".doc") returned 4
	[0077.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.341] lstrlenW (lpString=".docx") returned 5
	[0077.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.341] lstrlenW (lpString=".pdf") returned 4
	[0077.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.341] lstrlenW (lpString=".xls") returned 4
	[0077.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.342] lstrlenW (lpString=".xlsx") returned 5
	[0077.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.342] lstrlenW (lpString=".ppt") returned 4
	[0077.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.342] lstrlenW (lpString=".zip") returned 4
	[0077.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.342] lstrlenW (lpString=".rar") returned 4
	[0077.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.342] lstrlenW (lpString=".bz2") returned 4
	[0077.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.342] lstrlenW (lpString=".7z") returned 3
	[0077.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.342] lstrlenW (lpString=".dbf") returned 4
	[0077.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.342] lstrlenW (lpString=".1cd") returned 4
	[0077.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0077.343] lstrlenW (lpString=".jpg") returned 4
	[0077.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.343] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.343] lstrlenW (lpString="DD01183_.WMF") returned 12
	[0077.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.343] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2296) returned 1
	[0077.343] CloseHandle (hObject=0x368) returned 1
	[0077.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220
	[0077.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.344] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.344] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.344] GetLastError () returned 0x0
	[0077.344] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x8f8, lpOverlapped=0x0) returned 1
	[0077.735] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x900, lpOverlapped=0x0) returned 1
	[0077.736] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.736] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.736] SetEndOfFile (hFile=0x370) returned 1
	[0077.736] CloseHandle (hObject=0x370) returned 1
	[0077.737] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.737] SetEndOfFile (hFile=0x368) returned 1
	[0077.738] CloseHandle (hObject=0x368) returned 1
	[0077.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1
	[0077.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.739] lstrlenW (lpString=".doc") returned 4
	[0077.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.739] lstrlenW (lpString=".docx") returned 5
	[0077.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.739] lstrlenW (lpString=".pdf") returned 4
	[0077.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.739] lstrlenW (lpString=".xls") returned 4
	[0077.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.739] lstrlenW (lpString=".xlsx") returned 5
	[0077.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.739] lstrlenW (lpString=".ppt") returned 4
	[0077.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.740] lstrlenW (lpString=".zip") returned 4
	[0077.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.740] lstrlenW (lpString=".rar") returned 4
	[0077.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.740] lstrlenW (lpString=".bz2") returned 4
	[0077.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.740] lstrlenW (lpString=".7z") returned 3
	[0077.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.740] lstrlenW (lpString=".dbf") returned 4
	[0077.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.740] lstrlenW (lpString=".1cd") returned 4
	[0077.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.741] lstrlenW (lpString=".jpg") returned 4
	[0077.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.741] lstrlenW (lpString=".doc") returned 4
	[0077.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.741] lstrlenW (lpString=".docx") returned 5
	[0077.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.741] lstrlenW (lpString=".pdf") returned 4
	[0077.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.741] lstrlenW (lpString=".xls") returned 4
	[0077.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.742] lstrlenW (lpString=".xlsx") returned 5
	[0077.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.742] lstrlenW (lpString=".ppt") returned 4
	[0077.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.742] lstrlenW (lpString=".zip") returned 4
	[0077.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.742] lstrlenW (lpString=".rar") returned 4
	[0077.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.742] lstrlenW (lpString=".bz2") returned 4
	[0077.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.742] lstrlenW (lpString=".7z") returned 3
	[0077.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.743] lstrlenW (lpString=".dbf") returned 4
	[0077.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.743] lstrlenW (lpString=".1cd") returned 4
	[0077.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0077.743] lstrlenW (lpString=".jpg") returned 4
	[0077.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.743] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.743] lstrlenW (lpString="DD01630_.WMF") returned 12
	[0077.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.744] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=296) returned 1
	[0077.744] CloseHandle (hObject=0x368) returned 1
	[0077.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220
	[0077.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.745] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.745] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.745] GetLastError () returned 0x0
	[0077.745] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x128, lpOverlapped=0x0) returned 1
	[0077.747] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x130, lpOverlapped=0x0) returned 1
	[0077.747] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.748] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.748] SetEndOfFile (hFile=0x370) returned 1
	[0077.749] CloseHandle (hObject=0x370) returned 1
	[0077.749] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.749] SetEndOfFile (hFile=0x368) returned 1
	[0077.750] CloseHandle (hObject=0x368) returned 1
	[0077.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1
	[0077.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.751] lstrlenW (lpString=".doc") returned 4
	[0077.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.751] lstrlenW (lpString=".docx") returned 5
	[0077.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.751] lstrlenW (lpString=".pdf") returned 4
	[0077.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.751] lstrlenW (lpString=".xls") returned 4
	[0077.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.751] lstrlenW (lpString=".xlsx") returned 5
	[0077.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.751] lstrlenW (lpString=".ppt") returned 4
	[0077.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.751] lstrlenW (lpString=".zip") returned 4
	[0077.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.751] lstrlenW (lpString=".rar") returned 4
	[0077.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.752] lstrlenW (lpString=".bz2") returned 4
	[0077.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.752] lstrlenW (lpString=".7z") returned 3
	[0077.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.752] lstrlenW (lpString=".dbf") returned 4
	[0077.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.752] lstrlenW (lpString=".1cd") returned 4
	[0077.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.752] lstrlenW (lpString=".jpg") returned 4
	[0077.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.753] lstrlenW (lpString=".doc") returned 4
	[0077.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.753] lstrlenW (lpString=".docx") returned 5
	[0077.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.753] lstrlenW (lpString=".pdf") returned 4
	[0077.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.753] lstrlenW (lpString=".xls") returned 4
	[0077.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.753] lstrlenW (lpString=".xlsx") returned 5
	[0077.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.753] lstrlenW (lpString=".ppt") returned 4
	[0077.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.754] lstrlenW (lpString=".zip") returned 4
	[0077.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.754] lstrlenW (lpString=".rar") returned 4
	[0077.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.754] lstrlenW (lpString=".bz2") returned 4
	[0077.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.754] lstrlenW (lpString=".7z") returned 3
	[0077.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.754] lstrlenW (lpString=".dbf") returned 4
	[0077.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.755] lstrlenW (lpString=".1cd") returned 4
	[0077.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0077.755] lstrlenW (lpString=".jpg") returned 4
	[0077.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.755] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.755] lstrlenW (lpString="DD01631_.WMF") returned 12
	[0077.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.756] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=552) returned 1
	[0077.756] CloseHandle (hObject=0x368) returned 1
	[0077.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220
	[0077.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.756] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.757] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.757] GetLastError () returned 0x0
	[0077.757] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x228, lpOverlapped=0x0) returned 1
	[0077.758] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x230, lpOverlapped=0x0) returned 1
	[0077.759] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.759] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.760] SetEndOfFile (hFile=0x370) returned 1
	[0077.760] CloseHandle (hObject=0x370) returned 1
	[0077.760] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.760] SetEndOfFile (hFile=0x368) returned 1
	[0077.761] CloseHandle (hObject=0x368) returned 1
	[0077.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1
	[0077.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.762] lstrlenW (lpString=".doc") returned 4
	[0077.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.762] lstrlenW (lpString=".docx") returned 5
	[0077.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.762] lstrlenW (lpString=".pdf") returned 4
	[0077.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.762] lstrlenW (lpString=".xls") returned 4
	[0077.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.762] lstrlenW (lpString=".xlsx") returned 5
	[0077.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.762] lstrlenW (lpString=".ppt") returned 4
	[0077.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.763] lstrlenW (lpString=".zip") returned 4
	[0077.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.763] lstrlenW (lpString=".rar") returned 4
	[0077.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.763] lstrlenW (lpString=".bz2") returned 4
	[0077.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.763] lstrlenW (lpString=".7z") returned 3
	[0077.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.763] lstrlenW (lpString=".dbf") returned 4
	[0077.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.763] lstrlenW (lpString=".1cd") returned 4
	[0077.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.764] lstrlenW (lpString=".jpg") returned 4
	[0077.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.764] lstrlenW (lpString=".doc") returned 4
	[0077.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.764] lstrlenW (lpString=".docx") returned 5
	[0077.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.764] lstrlenW (lpString=".pdf") returned 4
	[0077.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.764] lstrlenW (lpString=".xls") returned 4
	[0077.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.765] lstrlenW (lpString=".xlsx") returned 5
	[0077.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.765] lstrlenW (lpString=".ppt") returned 4
	[0077.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.765] lstrlenW (lpString=".zip") returned 4
	[0077.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.765] lstrlenW (lpString=".rar") returned 4
	[0077.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.765] lstrlenW (lpString=".bz2") returned 4
	[0077.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.765] lstrlenW (lpString=".7z") returned 3
	[0077.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.766] lstrlenW (lpString=".dbf") returned 4
	[0077.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.766] lstrlenW (lpString=".1cd") returned 4
	[0077.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0077.766] lstrlenW (lpString=".jpg") returned 4
	[0077.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.766] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.767] lstrlenW (lpString="DD01761_.WMF") returned 12
	[0077.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.767] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=4148) returned 1
	[0077.767] CloseHandle (hObject=0x368) returned 1
	[0077.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220
	[0077.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.767] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.768] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.768] GetLastError () returned 0x0
	[0077.768] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1034, lpOverlapped=0x0) returned 1
	[0078.086] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1040, lpOverlapped=0x0) returned 1
	[0078.087] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.088] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.088] SetEndOfFile (hFile=0x370) returned 1
	[0078.088] CloseHandle (hObject=0x370) returned 1
	[0078.088] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.088] SetEndOfFile (hFile=0x368) returned 1
	[0078.089] CloseHandle (hObject=0x368) returned 1
	[0078.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1
	[0078.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.089] lstrlenW (lpString=".doc") returned 4
	[0078.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.089] lstrlenW (lpString=".docx") returned 5
	[0078.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.090] lstrlenW (lpString=".pdf") returned 4
	[0078.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.090] lstrlenW (lpString=".xls") returned 4
	[0078.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.090] lstrlenW (lpString=".xlsx") returned 5
	[0078.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.090] lstrlenW (lpString=".ppt") returned 4
	[0078.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.090] lstrlenW (lpString=".zip") returned 4
	[0078.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.090] lstrlenW (lpString=".rar") returned 4
	[0078.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.090] lstrlenW (lpString=".bz2") returned 4
	[0078.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.090] lstrlenW (lpString=".7z") returned 3
	[0078.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.090] lstrlenW (lpString=".dbf") returned 4
	[0078.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.090] lstrlenW (lpString=".1cd") returned 4
	[0078.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.090] lstrlenW (lpString=".jpg") returned 4
	[0078.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.090] lstrlenW (lpString=".doc") returned 4
	[0078.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.091] lstrlenW (lpString=".docx") returned 5
	[0078.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.091] lstrlenW (lpString=".pdf") returned 4
	[0078.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.091] lstrlenW (lpString=".xls") returned 4
	[0078.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.091] lstrlenW (lpString=".xlsx") returned 5
	[0078.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.091] lstrlenW (lpString=".ppt") returned 4
	[0078.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.091] lstrlenW (lpString=".zip") returned 4
	[0078.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.091] lstrlenW (lpString=".rar") returned 4
	[0078.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.091] lstrlenW (lpString=".bz2") returned 4
	[0078.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.091] lstrlenW (lpString=".7z") returned 3
	[0078.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.091] lstrlenW (lpString=".dbf") returned 4
	[0078.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.091] lstrlenW (lpString=".1cd") returned 4
	[0078.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0078.091] lstrlenW (lpString=".jpg") returned 4
	[0078.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.092] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.092] lstrlenW (lpString="EN00902_.WMF") returned 12
	[0078.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.093] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=7944) returned 1
	[0078.093] CloseHandle (hObject=0x368) returned 1
	[0078.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220
	[0078.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.093] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.093] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0078.094] GetLastError () returned 0x0
	[0078.094] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1f08, lpOverlapped=0x0) returned 1
	[0078.095] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1f10, lpOverlapped=0x0) returned 1
	[0078.096] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.096] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.096] SetEndOfFile (hFile=0x370) returned 1
	[0078.096] CloseHandle (hObject=0x370) returned 1
	[0078.096] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.096] SetEndOfFile (hFile=0x368) returned 1
	[0078.097] CloseHandle (hObject=0x368) returned 1
	[0078.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1
	[0078.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.107] lstrlenW (lpString=".doc") returned 4
	[0078.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.107] lstrlenW (lpString=".docx") returned 5
	[0078.107] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.107] lstrlenW (lpString=".pdf") returned 4
	[0078.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.107] lstrlenW (lpString=".xls") returned 4
	[0078.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.107] lstrlenW (lpString=".xlsx") returned 5
	[0078.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.107] lstrlenW (lpString=".ppt") returned 4
	[0078.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.107] lstrlenW (lpString=".zip") returned 4
	[0078.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.108] lstrlenW (lpString=".rar") returned 4
	[0078.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.108] lstrlenW (lpString=".bz2") returned 4
	[0078.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.108] lstrlenW (lpString=".7z") returned 3
	[0078.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.108] lstrlenW (lpString=".dbf") returned 4
	[0078.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.108] lstrlenW (lpString=".1cd") returned 4
	[0078.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.108] lstrlenW (lpString=".jpg") returned 4
	[0078.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.108] lstrlenW (lpString=".doc") returned 4
	[0078.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.108] lstrlenW (lpString=".docx") returned 5
	[0078.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.108] lstrlenW (lpString=".pdf") returned 4
	[0078.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.108] lstrlenW (lpString=".xls") returned 4
	[0078.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.109] lstrlenW (lpString=".xlsx") returned 5
	[0078.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.109] lstrlenW (lpString=".ppt") returned 4
	[0078.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.109] lstrlenW (lpString=".zip") returned 4
	[0078.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.109] lstrlenW (lpString=".rar") returned 4
	[0078.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.109] lstrlenW (lpString=".bz2") returned 4
	[0078.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.109] lstrlenW (lpString=".7z") returned 3
	[0078.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.109] lstrlenW (lpString=".dbf") returned 4
	[0078.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.109] lstrlenW (lpString=".1cd") returned 4
	[0078.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0078.109] lstrlenW (lpString=".jpg") returned 4
	[0078.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.110] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.110] lstrlenW (lpString="FD00074_.WMF") returned 12
	[0078.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.111] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=17850) returned 1
	[0078.111] CloseHandle (hObject=0x368) returned 1
	[0078.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220
	[0078.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.111] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.111] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0078.112] GetLastError () returned 0x0
	[0078.112] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x45ba, lpOverlapped=0x0) returned 1
	[0078.114] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x45c0, lpOverlapped=0x0) returned 1
	[0078.115] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.115] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.115] SetEndOfFile (hFile=0x370) returned 1
	[0078.115] CloseHandle (hObject=0x370) returned 1
	[0078.115] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.115] SetEndOfFile (hFile=0x368) returned 1
	[0078.116] CloseHandle (hObject=0x368) returned 1
	[0078.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1
	[0078.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.117] lstrlenW (lpString=".doc") returned 4
	[0078.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.117] lstrlenW (lpString=".docx") returned 5
	[0078.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.117] lstrlenW (lpString=".pdf") returned 4
	[0078.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.117] lstrlenW (lpString=".xls") returned 4
	[0078.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.117] lstrlenW (lpString=".xlsx") returned 5
	[0078.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.117] lstrlenW (lpString=".ppt") returned 4
	[0078.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.117] lstrlenW (lpString=".zip") returned 4
	[0078.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.117] lstrlenW (lpString=".rar") returned 4
	[0078.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.118] lstrlenW (lpString=".bz2") returned 4
	[0078.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.118] lstrlenW (lpString=".7z") returned 3
	[0078.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.118] lstrlenW (lpString=".dbf") returned 4
	[0078.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.118] lstrlenW (lpString=".1cd") returned 4
	[0078.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.118] lstrlenW (lpString=".jpg") returned 4
	[0078.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.118] lstrlenW (lpString=".doc") returned 4
	[0078.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.118] lstrlenW (lpString=".docx") returned 5
	[0078.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.118] lstrlenW (lpString=".pdf") returned 4
	[0078.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.118] lstrlenW (lpString=".xls") returned 4
	[0078.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.118] lstrlenW (lpString=".xlsx") returned 5
	[0078.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.119] lstrlenW (lpString=".ppt") returned 4
	[0078.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.119] lstrlenW (lpString=".zip") returned 4
	[0078.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.119] lstrlenW (lpString=".rar") returned 4
	[0078.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.119] lstrlenW (lpString=".bz2") returned 4
	[0078.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.119] lstrlenW (lpString=".7z") returned 3
	[0078.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.119] lstrlenW (lpString=".dbf") returned 4
	[0078.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.119] lstrlenW (lpString=".1cd") returned 4
	[0078.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0078.119] lstrlenW (lpString=".jpg") returned 4
	[0078.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.119] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.119] lstrlenW (lpString="FD00076_.WMF") returned 12
	[0078.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.120] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=11994) returned 1
	[0078.120] CloseHandle (hObject=0x368) returned 1
	[0078.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220
	[0078.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.120] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.120] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0078.121] GetLastError () returned 0x0
	[0078.121] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x2eda, lpOverlapped=0x0) returned 1
	[0078.122] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x2ee0, lpOverlapped=0x0) returned 1
	[0078.123] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.123] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.124] SetEndOfFile (hFile=0x370) returned 1
	[0078.124] CloseHandle (hObject=0x370) returned 1
	[0078.124] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.124] SetEndOfFile (hFile=0x368) returned 1
	[0078.125] CloseHandle (hObject=0x368) returned 1
	[0078.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1
	[0078.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.125] lstrlenW (lpString=".doc") returned 4
	[0078.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.126] lstrlenW (lpString=".docx") returned 5
	[0078.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.126] lstrlenW (lpString=".pdf") returned 4
	[0078.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.126] lstrlenW (lpString=".xls") returned 4
	[0078.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.126] lstrlenW (lpString=".xlsx") returned 5
	[0078.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.126] lstrlenW (lpString=".ppt") returned 4
	[0078.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.126] lstrlenW (lpString=".zip") returned 4
	[0078.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.126] lstrlenW (lpString=".rar") returned 4
	[0078.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.126] lstrlenW (lpString=".bz2") returned 4
	[0078.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.126] lstrlenW (lpString=".7z") returned 3
	[0078.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.126] lstrlenW (lpString=".dbf") returned 4
	[0078.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.126] lstrlenW (lpString=".1cd") returned 4
	[0078.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.126] lstrlenW (lpString=".jpg") returned 4
	[0078.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.127] lstrlenW (lpString=".doc") returned 4
	[0078.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.127] lstrlenW (lpString=".docx") returned 5
	[0078.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.127] lstrlenW (lpString=".pdf") returned 4
	[0078.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.127] lstrlenW (lpString=".xls") returned 4
	[0078.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.127] lstrlenW (lpString=".xlsx") returned 5
	[0078.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.127] lstrlenW (lpString=".ppt") returned 4
	[0078.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.127] lstrlenW (lpString=".zip") returned 4
	[0078.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.127] lstrlenW (lpString=".rar") returned 4
	[0078.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.127] lstrlenW (lpString=".bz2") returned 4
	[0078.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.127] lstrlenW (lpString=".7z") returned 3
	[0078.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.128] lstrlenW (lpString=".dbf") returned 4
	[0078.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.128] lstrlenW (lpString=".1cd") returned 4
	[0078.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0078.128] lstrlenW (lpString=".jpg") returned 4
	[0078.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.128] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.128] lstrlenW (lpString="FD00077_.WMF") returned 12
	[0078.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.128] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=30240) returned 1
	[0078.128] CloseHandle (hObject=0x368) returned 1
	[0078.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220
	[0078.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0078.443] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.443] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0078.444] GetLastError () returned 0x0
	[0078.444] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x7620, lpOverlapped=0x0) returned 1
	[0078.446] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x7630, lpOverlapped=0x0) returned 1
	[0078.447] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.447] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.448] SetEndOfFile (hFile=0x350) returned 1
	[0078.448] CloseHandle (hObject=0x350) returned 1
	[0078.448] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.448] SetEndOfFile (hFile=0x378) returned 1
	[0078.449] CloseHandle (hObject=0x378) returned 1
	[0078.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1
	[0078.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.449] lstrlenW (lpString=".doc") returned 4
	[0078.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.450] lstrlenW (lpString=".docx") returned 5
	[0078.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.450] lstrlenW (lpString=".pdf") returned 4
	[0078.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.450] lstrlenW (lpString=".xls") returned 4
	[0078.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.450] lstrlenW (lpString=".xlsx") returned 5
	[0078.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.450] lstrlenW (lpString=".ppt") returned 4
	[0078.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.450] lstrlenW (lpString=".zip") returned 4
	[0078.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.450] lstrlenW (lpString=".rar") returned 4
	[0078.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.450] lstrlenW (lpString=".bz2") returned 4
	[0078.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.450] lstrlenW (lpString=".7z") returned 3
	[0078.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.451] lstrlenW (lpString=".dbf") returned 4
	[0078.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.451] lstrlenW (lpString=".1cd") returned 4
	[0078.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.451] lstrlenW (lpString=".jpg") returned 4
	[0078.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.451] lstrlenW (lpString=".doc") returned 4
	[0078.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.451] lstrlenW (lpString=".docx") returned 5
	[0078.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.451] lstrlenW (lpString=".pdf") returned 4
	[0078.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.451] lstrlenW (lpString=".xls") returned 4
	[0078.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.452] lstrlenW (lpString=".xlsx") returned 5
	[0078.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.452] lstrlenW (lpString=".ppt") returned 4
	[0078.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.452] lstrlenW (lpString=".zip") returned 4
	[0078.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.452] lstrlenW (lpString=".rar") returned 4
	[0078.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.452] lstrlenW (lpString=".bz2") returned 4
	[0078.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.452] lstrlenW (lpString=".7z") returned 3
	[0078.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.452] lstrlenW (lpString=".dbf") returned 4
	[0078.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.453] lstrlenW (lpString=".1cd") returned 4
	[0078.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0078.453] lstrlenW (lpString=".jpg") returned 4
	[0078.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.453] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.453] lstrlenW (lpString="FD00403_.WMF") returned 12
	[0078.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0078.454] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=7878) returned 1
	[0078.454] CloseHandle (hObject=0x378) returned 1
	[0078.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220
	[0078.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0078.454] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.454] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0078.455] GetLastError () returned 0x0
	[0078.455] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1ec6, lpOverlapped=0x0) returned 1
	[0078.456] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1ed0, lpOverlapped=0x0) returned 1
	[0078.458] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.458] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.458] SetEndOfFile (hFile=0x350) returned 1
	[0078.458] CloseHandle (hObject=0x350) returned 1
	[0078.458] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.459] SetEndOfFile (hFile=0x378) returned 1
	[0078.459] CloseHandle (hObject=0x378) returned 1
	[0078.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1
	[0078.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.460] lstrlenW (lpString=".doc") returned 4
	[0078.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.460] lstrlenW (lpString=".docx") returned 5
	[0078.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.460] lstrlenW (lpString=".pdf") returned 4
	[0078.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.461] lstrlenW (lpString=".xls") returned 4
	[0078.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.461] lstrlenW (lpString=".xlsx") returned 5
	[0078.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.461] lstrlenW (lpString=".ppt") returned 4
	[0078.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.461] lstrlenW (lpString=".zip") returned 4
	[0078.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.461] lstrlenW (lpString=".rar") returned 4
	[0078.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.461] lstrlenW (lpString=".bz2") returned 4
	[0078.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.461] lstrlenW (lpString=".7z") returned 3
	[0078.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.461] lstrlenW (lpString=".dbf") returned 4
	[0078.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.461] lstrlenW (lpString=".1cd") returned 4
	[0078.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.462] lstrlenW (lpString=".jpg") returned 4
	[0078.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.462] lstrlenW (lpString=".doc") returned 4
	[0078.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.462] lstrlenW (lpString=".docx") returned 5
	[0078.462] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.462] lstrlenW (lpString=".pdf") returned 4
	[0078.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.462] lstrlenW (lpString=".xls") returned 4
	[0078.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.462] lstrlenW (lpString=".xlsx") returned 5
	[0078.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.462] lstrlenW (lpString=".ppt") returned 4
	[0078.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.463] lstrlenW (lpString=".zip") returned 4
	[0078.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.463] lstrlenW (lpString=".rar") returned 4
	[0078.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.463] lstrlenW (lpString=".bz2") returned 4
	[0078.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.463] lstrlenW (lpString=".7z") returned 3
	[0078.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.463] lstrlenW (lpString=".dbf") returned 4
	[0078.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.463] lstrlenW (lpString=".1cd") returned 4
	[0078.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0078.463] lstrlenW (lpString=".jpg") returned 4
	[0078.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.464] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.464] lstrlenW (lpString="FD00414_.WMF") returned 12
	[0078.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0078.464] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=11002) returned 1
	[0078.464] CloseHandle (hObject=0x378) returned 1
	[0078.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220
	[0078.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0078.465] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.465] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0078.465] GetLastError () returned 0x0
	[0078.465] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x2afa, lpOverlapped=0x0) returned 1
	[0078.467] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x2b00, lpOverlapped=0x0) returned 1
	[0078.468] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.468] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.468] SetEndOfFile (hFile=0x350) returned 1
	[0078.468] CloseHandle (hObject=0x350) returned 1
	[0078.468] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.468] SetEndOfFile (hFile=0x378) returned 1
	[0078.469] CloseHandle (hObject=0x378) returned 1
	[0078.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1
	[0078.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.470] lstrlenW (lpString=".doc") returned 4
	[0078.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.470] lstrlenW (lpString=".docx") returned 5
	[0078.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.470] lstrlenW (lpString=".pdf") returned 4
	[0078.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.470] lstrlenW (lpString=".xls") returned 4
	[0078.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.470] lstrlenW (lpString=".xlsx") returned 5
	[0078.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.470] lstrlenW (lpString=".ppt") returned 4
	[0078.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.471] lstrlenW (lpString=".zip") returned 4
	[0078.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.471] lstrlenW (lpString=".rar") returned 4
	[0078.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.471] lstrlenW (lpString=".bz2") returned 4
	[0078.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.471] lstrlenW (lpString=".7z") returned 3
	[0078.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.471] lstrlenW (lpString=".dbf") returned 4
	[0078.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.471] lstrlenW (lpString=".1cd") returned 4
	[0078.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.471] lstrlenW (lpString=".jpg") returned 4
	[0078.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.471] lstrlenW (lpString=".doc") returned 4
	[0078.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.472] lstrlenW (lpString=".docx") returned 5
	[0078.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.472] lstrlenW (lpString=".pdf") returned 4
	[0078.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.472] lstrlenW (lpString=".xls") returned 4
	[0078.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.472] lstrlenW (lpString=".xlsx") returned 5
	[0078.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.472] lstrlenW (lpString=".ppt") returned 4
	[0078.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.472] lstrlenW (lpString=".zip") returned 4
	[0078.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.472] lstrlenW (lpString=".rar") returned 4
	[0078.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.472] lstrlenW (lpString=".bz2") returned 4
	[0078.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.472] lstrlenW (lpString=".7z") returned 3
	[0078.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.473] lstrlenW (lpString=".dbf") returned 4
	[0078.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.473] lstrlenW (lpString=".1cd") returned 4
	[0078.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0078.473] lstrlenW (lpString=".jpg") returned 4
	[0078.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.473] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.473] lstrlenW (lpString="FD00419_.WMF") returned 12
	[0078.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0078.474] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=16396) returned 1
	[0078.474] CloseHandle (hObject=0x378) returned 1
	[0078.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220
	[0078.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0078.474] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.474] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0078.474] GetLastError () returned 0x0
	[0078.475] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x400c, lpOverlapped=0x0) returned 1
	[0078.968] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4010, lpOverlapped=0x0) returned 1
	[0078.969] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.969] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.969] SetEndOfFile (hFile=0x350) returned 1
	[0080.079] CloseHandle (hObject=0x350) returned 1
	[0080.079] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.079] SetEndOfFile (hFile=0x378) returned 1
	[0080.128] CloseHandle (hObject=0x378) returned 1
	[0080.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1
	[0080.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.128] lstrlenW (lpString=".doc") returned 4
	[0080.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.128] lstrlenW (lpString=".docx") returned 5
	[0080.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.129] lstrlenW (lpString=".pdf") returned 4
	[0080.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.129] lstrlenW (lpString=".xls") returned 4
	[0080.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.129] lstrlenW (lpString=".xlsx") returned 5
	[0080.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.129] lstrlenW (lpString=".ppt") returned 4
	[0080.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.129] lstrlenW (lpString=".zip") returned 4
	[0080.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.131] lstrlenW (lpString=".rar") returned 4
	[0080.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.131] lstrlenW (lpString=".bz2") returned 4
	[0080.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.131] lstrlenW (lpString=".7z") returned 3
	[0080.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.132] lstrlenW (lpString=".dbf") returned 4
	[0080.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.132] lstrlenW (lpString=".1cd") returned 4
	[0080.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.132] lstrlenW (lpString=".jpg") returned 4
	[0080.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.132] lstrlenW (lpString=".doc") returned 4
	[0080.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.132] lstrlenW (lpString=".docx") returned 5
	[0080.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.132] lstrlenW (lpString=".pdf") returned 4
	[0080.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.132] lstrlenW (lpString=".xls") returned 4
	[0080.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.132] lstrlenW (lpString=".xlsx") returned 5
	[0080.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.132] lstrlenW (lpString=".ppt") returned 4
	[0080.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.133] lstrlenW (lpString=".zip") returned 4
	[0080.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.133] lstrlenW (lpString=".rar") returned 4
	[0080.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.133] lstrlenW (lpString=".bz2") returned 4
	[0080.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.133] lstrlenW (lpString=".7z") returned 3
	[0080.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.133] lstrlenW (lpString=".dbf") returned 4
	[0080.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.133] lstrlenW (lpString=".1cd") returned 4
	[0080.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0080.133] lstrlenW (lpString=".jpg") returned 4
	[0080.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.133] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.133] lstrlenW (lpString="FD01176_.WMF") returned 12
	[0080.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0080.134] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=4984) returned 1
	[0080.134] CloseHandle (hObject=0x378) returned 1
	[0080.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220
	[0080.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0080.134] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.134] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0080.135] GetLastError () returned 0x0
	[0080.135] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1378, lpOverlapped=0x0) returned 1
	[0080.136] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1380, lpOverlapped=0x0) returned 1
	[0080.137] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.137] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.137] SetEndOfFile (hFile=0x350) returned 1
	[0080.138] CloseHandle (hObject=0x350) returned 1
	[0080.138] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.138] SetEndOfFile (hFile=0x378) returned 1
	[0080.139] CloseHandle (hObject=0x378) returned 1
	[0080.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1
	[0080.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.139] lstrlenW (lpString=".doc") returned 4
	[0080.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.139] lstrlenW (lpString=".docx") returned 5
	[0080.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.139] lstrlenW (lpString=".pdf") returned 4
	[0080.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.139] lstrlenW (lpString=".xls") returned 4
	[0080.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.139] lstrlenW (lpString=".xlsx") returned 5
	[0080.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.140] lstrlenW (lpString=".ppt") returned 4
	[0080.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.140] lstrlenW (lpString=".zip") returned 4
	[0080.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.140] lstrlenW (lpString=".rar") returned 4
	[0080.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.140] lstrlenW (lpString=".bz2") returned 4
	[0080.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.140] lstrlenW (lpString=".7z") returned 3
	[0080.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.140] lstrlenW (lpString=".dbf") returned 4
	[0080.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.140] lstrlenW (lpString=".1cd") returned 4
	[0080.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.140] lstrlenW (lpString=".jpg") returned 4
	[0080.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.141] lstrlenW (lpString=".doc") returned 4
	[0080.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.141] lstrlenW (lpString=".docx") returned 5
	[0080.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.141] lstrlenW (lpString=".pdf") returned 4
	[0080.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.141] lstrlenW (lpString=".xls") returned 4
	[0080.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.141] lstrlenW (lpString=".xlsx") returned 5
	[0080.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.141] lstrlenW (lpString=".ppt") returned 4
	[0080.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.141] lstrlenW (lpString=".zip") returned 4
	[0080.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.141] lstrlenW (lpString=".rar") returned 4
	[0080.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.141] lstrlenW (lpString=".bz2") returned 4
	[0080.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.141] lstrlenW (lpString=".7z") returned 3
	[0080.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.141] lstrlenW (lpString=".dbf") returned 4
	[0080.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.142] lstrlenW (lpString=".1cd") returned 4
	[0080.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0080.142] lstrlenW (lpString=".jpg") returned 4
	[0080.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.142] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.142] lstrlenW (lpString="FD01191_.WMF") returned 12
	[0080.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0080.142] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3964) returned 1
	[0080.142] CloseHandle (hObject=0x378) returned 1
	[0080.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220
	[0080.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0080.143] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.143] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0080.143] GetLastError () returned 0x0
	[0080.143] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xf7c, lpOverlapped=0x0) returned 1
	[0080.144] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf80, lpOverlapped=0x0) returned 1
	[0080.146] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.146] WriteFile (in: hFile=0x350, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.146] SetEndOfFile (hFile=0x350) returned 1
	[0080.146] CloseHandle (hObject=0x350) returned 1
	[0080.146] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.146] SetEndOfFile (hFile=0x378) returned 1
	[0080.147] CloseHandle (hObject=0x378) returned 1
	[0080.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1
	[0080.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.148] lstrlenW (lpString=".doc") returned 4
	[0080.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.148] lstrlenW (lpString=".docx") returned 5
	[0080.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.148] lstrlenW (lpString=".pdf") returned 4
	[0080.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.148] lstrlenW (lpString=".xls") returned 4
	[0080.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.148] lstrlenW (lpString=".xlsx") returned 5
	[0080.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.148] lstrlenW (lpString=".ppt") returned 4
	[0080.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.148] lstrlenW (lpString=".zip") returned 4
	[0080.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.148] lstrlenW (lpString=".rar") returned 4
	[0080.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.148] lstrlenW (lpString=".bz2") returned 4
	[0080.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.148] lstrlenW (lpString=".7z") returned 3
	[0080.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.148] lstrlenW (lpString=".dbf") returned 4
	[0080.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.149] lstrlenW (lpString=".1cd") returned 4
	[0080.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.149] lstrlenW (lpString=".jpg") returned 4
	[0080.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.149] lstrlenW (lpString=".doc") returned 4
	[0080.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.149] lstrlenW (lpString=".docx") returned 5
	[0080.149] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.149] lstrlenW (lpString=".pdf") returned 4
	[0080.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.149] lstrlenW (lpString=".xls") returned 4
	[0080.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.149] lstrlenW (lpString=".xlsx") returned 5
	[0080.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.149] lstrlenW (lpString=".ppt") returned 4
	[0080.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.149] lstrlenW (lpString=".zip") returned 4
	[0080.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.149] lstrlenW (lpString=".rar") returned 4
	[0080.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.149] lstrlenW (lpString=".bz2") returned 4
	[0080.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.150] lstrlenW (lpString=".7z") returned 3
	[0080.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.150] lstrlenW (lpString=".dbf") returned 4
	[0080.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.150] lstrlenW (lpString=".1cd") returned 4
	[0080.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0080.150] lstrlenW (lpString=".jpg") returned 4
	[0080.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.150] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.150] lstrlenW (lpString="FD01193_.WMF") returned 12
	[0080.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0080.151] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1160) returned 1
	[0080.151] CloseHandle (hObject=0x368) returned 1
	[0080.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220
	[0080.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0080.151] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.151] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0080.152] GetLastError () returned 0x0
	[0080.152] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x488, lpOverlapped=0x0) returned 1
	[0080.153] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x490, lpOverlapped=0x0) returned 1
	[0080.154] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.154] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.154] SetEndOfFile (hFile=0x378) returned 1
	[0080.155] CloseHandle (hObject=0x378) returned 1
	[0080.155] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.155] SetEndOfFile (hFile=0x368) returned 1
	[0080.155] CloseHandle (hObject=0x368) returned 1
	[0080.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1
	[0080.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.156] lstrlenW (lpString=".doc") returned 4
	[0080.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.156] lstrlenW (lpString=".docx") returned 5
	[0080.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.156] lstrlenW (lpString=".pdf") returned 4
	[0080.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.156] lstrlenW (lpString=".xls") returned 4
	[0080.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.156] lstrlenW (lpString=".xlsx") returned 5
	[0080.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.156] lstrlenW (lpString=".ppt") returned 4
	[0080.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.156] lstrlenW (lpString=".zip") returned 4
	[0080.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.157] lstrlenW (lpString=".rar") returned 4
	[0080.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.157] lstrlenW (lpString=".bz2") returned 4
	[0080.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.157] lstrlenW (lpString=".7z") returned 3
	[0080.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.157] lstrlenW (lpString=".dbf") returned 4
	[0080.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.157] lstrlenW (lpString=".1cd") returned 4
	[0080.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.157] lstrlenW (lpString=".jpg") returned 4
	[0080.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.157] lstrlenW (lpString=".doc") returned 4
	[0080.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.157] lstrlenW (lpString=".docx") returned 5
	[0080.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.157] lstrlenW (lpString=".pdf") returned 4
	[0080.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.157] lstrlenW (lpString=".xls") returned 4
	[0080.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.158] lstrlenW (lpString=".xlsx") returned 5
	[0080.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.158] lstrlenW (lpString=".ppt") returned 4
	[0080.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.158] lstrlenW (lpString=".zip") returned 4
	[0080.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.158] lstrlenW (lpString=".rar") returned 4
	[0080.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.158] lstrlenW (lpString=".bz2") returned 4
	[0080.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.158] lstrlenW (lpString=".7z") returned 3
	[0080.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.158] lstrlenW (lpString=".dbf") returned 4
	[0080.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.158] lstrlenW (lpString=".1cd") returned 4
	[0080.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0080.158] lstrlenW (lpString=".jpg") returned 4
	[0080.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.159] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.159] lstrlenW (lpString="FD01196_.WMF") returned 12
	[0080.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0080.159] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2332) returned 1
	[0080.159] CloseHandle (hObject=0x368) returned 1
	[0080.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220
	[0080.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0080.159] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.159] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0080.160] GetLastError () returned 0x0
	[0080.160] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x91c, lpOverlapped=0x0) returned 1
	[0080.162] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x920, lpOverlapped=0x0) returned 1
	[0080.163] ReadFile (in: hFile=0x368, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.163] WriteFile (in: hFile=0x378, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.163] SetEndOfFile (hFile=0x378) returned 1
	[0080.163] CloseHandle (hObject=0x378) returned 1
	[0080.163] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.163] SetEndOfFile (hFile=0x368) returned 1
	[0080.164] CloseHandle (hObject=0x368) returned 1
	[0080.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1
	[0080.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.165] lstrlenW (lpString=".doc") returned 4
	[0080.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.165] lstrlenW (lpString=".docx") returned 5
	[0080.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.165] lstrlenW (lpString=".pdf") returned 4
	[0080.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.165] lstrlenW (lpString=".xls") returned 4
	[0080.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.165] lstrlenW (lpString=".xlsx") returned 5
	[0080.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.165] lstrlenW (lpString=".ppt") returned 4
	[0080.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.165] lstrlenW (lpString=".zip") returned 4
	[0080.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.165] lstrlenW (lpString=".rar") returned 4
	[0080.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.166] lstrlenW (lpString=".bz2") returned 4
	[0080.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.166] lstrlenW (lpString=".7z") returned 3
	[0080.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.166] lstrlenW (lpString=".dbf") returned 4
	[0080.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.166] lstrlenW (lpString=".1cd") returned 4
	[0080.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.166] lstrlenW (lpString=".jpg") returned 4
	[0080.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.166] lstrlenW (lpString=".doc") returned 4
	[0080.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.166] lstrlenW (lpString=".docx") returned 5
	[0080.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.166] lstrlenW (lpString=".pdf") returned 4
	[0080.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.166] lstrlenW (lpString=".xls") returned 4
	[0080.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.166] lstrlenW (lpString=".xlsx") returned 5
	[0080.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.166] lstrlenW (lpString=".ppt") returned 4
	[0080.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.167] lstrlenW (lpString=".zip") returned 4
	[0080.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.167] lstrlenW (lpString=".rar") returned 4
	[0080.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.167] lstrlenW (lpString=".bz2") returned 4
	[0080.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.167] lstrlenW (lpString=".7z") returned 3
	[0080.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.167] lstrlenW (lpString=".dbf") returned 4
	[0080.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.167] lstrlenW (lpString=".1cd") returned 4
	[0080.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0080.167] lstrlenW (lpString=".jpg") returned 4
	[0080.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.167] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.167] lstrlenW (lpString="FD01548_.WMF") returned 12
	[0080.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.350] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=10316) returned 1
	[0081.352] CloseHandle (hObject=0x374) returned 1
	[0081.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220
	[0081.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.378] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.379] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0081.379] GetLastError () returned 0x0
	[0081.379] ReadFile (in: hFile=0x374, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x284c, lpOverlapped=0x0) returned 1
	[0081.381] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x2850, lpOverlapped=0x0) returned 1
	[0081.382] ReadFile (in: hFile=0x374, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.382] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.382] SetEndOfFile (hFile=0x370) returned 1
	[0081.382] CloseHandle (hObject=0x370) returned 1
	[0081.382] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.382] SetEndOfFile (hFile=0x374) returned 1
	[0081.383] CloseHandle (hObject=0x374) returned 1
	[0081.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1
	[0081.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.384] lstrlenW (lpString=".doc") returned 4
	[0081.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.384] lstrlenW (lpString=".docx") returned 5
	[0081.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.384] lstrlenW (lpString=".pdf") returned 4
	[0081.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.384] lstrlenW (lpString=".xls") returned 4
	[0081.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.384] lstrlenW (lpString=".xlsx") returned 5
	[0081.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.384] lstrlenW (lpString=".ppt") returned 4
	[0081.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.384] lstrlenW (lpString=".zip") returned 4
	[0081.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.384] lstrlenW (lpString=".rar") returned 4
	[0081.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.385] lstrlenW (lpString=".bz2") returned 4
	[0081.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.385] lstrlenW (lpString=".7z") returned 3
	[0081.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.385] lstrlenW (lpString=".dbf") returned 4
	[0081.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.385] lstrlenW (lpString=".1cd") returned 4
	[0081.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.385] lstrlenW (lpString=".jpg") returned 4
	[0081.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.385] lstrlenW (lpString=".doc") returned 4
	[0081.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.385] lstrlenW (lpString=".docx") returned 5
	[0081.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.385] lstrlenW (lpString=".pdf") returned 4
	[0081.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.385] lstrlenW (lpString=".xls") returned 4
	[0081.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.386] lstrlenW (lpString=".xlsx") returned 5
	[0081.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.386] lstrlenW (lpString=".ppt") returned 4
	[0081.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.386] lstrlenW (lpString=".zip") returned 4
	[0081.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.386] lstrlenW (lpString=".rar") returned 4
	[0081.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.386] lstrlenW (lpString=".bz2") returned 4
	[0081.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.386] lstrlenW (lpString=".7z") returned 3
	[0081.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.386] lstrlenW (lpString=".dbf") returned 4
	[0081.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.386] lstrlenW (lpString=".1cd") returned 4
	[0081.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0081.386] lstrlenW (lpString=".jpg") returned 4
	[0081.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.387] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.387] lstrlenW (lpString="FD02075_.WMF") returned 12
	[0081.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.387] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=4396) returned 1
	[0081.387] CloseHandle (hObject=0x374) returned 1
	[0081.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220
	[0081.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.387] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.387] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0081.388] GetLastError () returned 0x0
	[0081.388] ReadFile (in: hFile=0x374, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x112c, lpOverlapped=0x0) returned 1
	[0081.389] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1130, lpOverlapped=0x0) returned 1
	[0081.390] ReadFile (in: hFile=0x374, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.391] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.391] SetEndOfFile (hFile=0x370) returned 1
	[0081.391] CloseHandle (hObject=0x370) returned 1
	[0081.391] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.391] SetEndOfFile (hFile=0x374) returned 1
	[0081.392] CloseHandle (hObject=0x374) returned 1
	[0081.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1
	[0081.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.392] lstrlenW (lpString=".doc") returned 4
	[0081.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.392] lstrlenW (lpString=".docx") returned 5
	[0081.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.393] lstrlenW (lpString=".pdf") returned 4
	[0081.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.393] lstrlenW (lpString=".xls") returned 4
	[0081.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.393] lstrlenW (lpString=".xlsx") returned 5
	[0081.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.393] lstrlenW (lpString=".ppt") returned 4
	[0081.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.393] lstrlenW (lpString=".zip") returned 4
	[0081.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.393] lstrlenW (lpString=".rar") returned 4
	[0081.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.393] lstrlenW (lpString=".bz2") returned 4
	[0081.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.393] lstrlenW (lpString=".7z") returned 3
	[0081.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.393] lstrlenW (lpString=".dbf") returned 4
	[0081.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.393] lstrlenW (lpString=".1cd") returned 4
	[0081.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.393] lstrlenW (lpString=".jpg") returned 4
	[0081.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.394] lstrlenW (lpString=".doc") returned 4
	[0081.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.394] lstrlenW (lpString=".docx") returned 5
	[0081.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.394] lstrlenW (lpString=".pdf") returned 4
	[0081.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.394] lstrlenW (lpString=".xls") returned 4
	[0081.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.394] lstrlenW (lpString=".xlsx") returned 5
	[0081.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.394] lstrlenW (lpString=".ppt") returned 4
	[0081.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.394] lstrlenW (lpString=".zip") returned 4
	[0081.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.394] lstrlenW (lpString=".rar") returned 4
	[0081.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.394] lstrlenW (lpString=".bz2") returned 4
	[0081.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.394] lstrlenW (lpString=".7z") returned 3
	[0081.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.394] lstrlenW (lpString=".dbf") returned 4
	[0081.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.395] lstrlenW (lpString=".1cd") returned 4
	[0081.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0081.395] lstrlenW (lpString=".jpg") returned 4
	[0081.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.395] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.395] lstrlenW (lpString="FD02088_.WMF") returned 12
	[0081.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.396] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3696) returned 1
	[0081.396] CloseHandle (hObject=0x374) returned 1
	[0081.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220
	[0081.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.396] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.396] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0081.397] GetLastError () returned 0x0
	[0081.397] ReadFile (in: hFile=0x374, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xe70, lpOverlapped=0x0) returned 1
	[0081.398] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe80, lpOverlapped=0x0) returned 1
	[0081.399] ReadFile (in: hFile=0x374, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.399] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.399] SetEndOfFile (hFile=0x370) returned 1
	[0081.399] CloseHandle (hObject=0x370) returned 1
	[0081.400] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.400] SetEndOfFile (hFile=0x374) returned 1
	[0081.401] CloseHandle (hObject=0x374) returned 1
	[0081.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1
	[0081.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.401] lstrlenW (lpString=".doc") returned 4
	[0081.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.401] lstrlenW (lpString=".docx") returned 5
	[0081.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.401] lstrlenW (lpString=".pdf") returned 4
	[0081.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.401] lstrlenW (lpString=".xls") returned 4
	[0081.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.401] lstrlenW (lpString=".xlsx") returned 5
	[0081.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.401] lstrlenW (lpString=".ppt") returned 4
	[0081.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.402] lstrlenW (lpString=".zip") returned 4
	[0081.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.402] lstrlenW (lpString=".rar") returned 4
	[0081.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.402] lstrlenW (lpString=".bz2") returned 4
	[0081.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.402] lstrlenW (lpString=".7z") returned 3
	[0081.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.402] lstrlenW (lpString=".dbf") returned 4
	[0081.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.402] lstrlenW (lpString=".1cd") returned 4
	[0081.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.402] lstrlenW (lpString=".jpg") returned 4
	[0081.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.402] lstrlenW (lpString=".doc") returned 4
	[0081.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.403] lstrlenW (lpString=".docx") returned 5
	[0081.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.403] lstrlenW (lpString=".pdf") returned 4
	[0081.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.403] lstrlenW (lpString=".xls") returned 4
	[0081.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.403] lstrlenW (lpString=".xlsx") returned 5
	[0081.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.403] lstrlenW (lpString=".ppt") returned 4
	[0081.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.403] lstrlenW (lpString=".zip") returned 4
	[0081.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.403] lstrlenW (lpString=".rar") returned 4
	[0081.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.403] lstrlenW (lpString=".bz2") returned 4
	[0081.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.403] lstrlenW (lpString=".7z") returned 3
	[0081.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.403] lstrlenW (lpString=".dbf") returned 4
	[0081.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.403] lstrlenW (lpString=".1cd") returned 4
	[0081.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0081.404] lstrlenW (lpString=".jpg") returned 4
	[0081.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.404] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.404] lstrlenW (lpString="FD02097_.WMF") returned 12
	[0081.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.404] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1564) returned 1
	[0081.404] CloseHandle (hObject=0x374) returned 1
	[0081.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220
	[0081.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.405] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.405] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0081.405] GetLastError () returned 0x0
	[0081.405] ReadFile (in: hFile=0x374, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x61c, lpOverlapped=0x0) returned 1
	[0081.406] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x620, lpOverlapped=0x0) returned 1
	[0081.407] ReadFile (in: hFile=0x374, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.407] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.407] SetEndOfFile (hFile=0x370) returned 1
	[0081.408] CloseHandle (hObject=0x370) returned 1
	[0081.408] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.408] SetEndOfFile (hFile=0x374) returned 1
	[0081.409] CloseHandle (hObject=0x374) returned 1
	[0081.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1
	[0081.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.409] lstrlenW (lpString=".doc") returned 4
	[0081.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.409] lstrlenW (lpString=".docx") returned 5
	[0081.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.409] lstrlenW (lpString=".pdf") returned 4
	[0081.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.409] lstrlenW (lpString=".xls") returned 4
	[0081.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.409] lstrlenW (lpString=".xlsx") returned 5
	[0081.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.410] lstrlenW (lpString=".ppt") returned 4
	[0081.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.410] lstrlenW (lpString=".zip") returned 4
	[0081.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.410] lstrlenW (lpString=".rar") returned 4
	[0081.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.410] lstrlenW (lpString=".bz2") returned 4
	[0081.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.410] lstrlenW (lpString=".7z") returned 3
	[0081.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.410] lstrlenW (lpString=".dbf") returned 4
	[0081.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.410] lstrlenW (lpString=".1cd") returned 4
	[0081.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.411] lstrlenW (lpString=".jpg") returned 4
	[0081.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.411] lstrlenW (lpString=".doc") returned 4
	[0081.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.411] lstrlenW (lpString=".docx") returned 5
	[0081.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.411] lstrlenW (lpString=".pdf") returned 4
	[0081.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.411] lstrlenW (lpString=".xls") returned 4
	[0081.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.411] lstrlenW (lpString=".xlsx") returned 5
	[0081.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.411] lstrlenW (lpString=".ppt") returned 4
	[0081.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.411] lstrlenW (lpString=".zip") returned 4
	[0081.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.411] lstrlenW (lpString=".rar") returned 4
	[0081.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.411] lstrlenW (lpString=".bz2") returned 4
	[0081.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.412] lstrlenW (lpString=".7z") returned 3
	[0081.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.412] lstrlenW (lpString=".dbf") returned 4
	[0081.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.412] lstrlenW (lpString=".1cd") returned 4
	[0081.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0081.412] lstrlenW (lpString=".jpg") returned 4
	[0081.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.412] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.412] lstrlenW (lpString="FD02115_.WMF") returned 12
	[0081.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.413] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=4660) returned 1
	[0081.413] CloseHandle (hObject=0x374) returned 1
	[0081.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220
	[0081.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.413] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.413] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0081.413] GetLastError () returned 0x0
	[0081.414] ReadFile (in: hFile=0x374, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1234, lpOverlapped=0x0) returned 1
	[0081.693] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1240, lpOverlapped=0x0) returned 1
	[0081.917] ReadFile (in: hFile=0x374, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.917] WriteFile (in: hFile=0x370, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.917] SetEndOfFile (hFile=0x370) returned 1
	[0081.918] CloseHandle (hObject=0x370) returned 1
	[0081.918] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.918] SetEndOfFile (hFile=0x374) returned 1
	[0081.919] CloseHandle (hObject=0x374) returned 1
	[0081.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1
	[0082.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.241] lstrlenW (lpString=".doc") returned 4
	[0082.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0082.241] lstrlenW (lpString=".docx") returned 5
	[0082.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0082.242] lstrlenW (lpString=".pdf") returned 4
	[0082.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0082.242] lstrlenW (lpString=".xls") returned 4
	[0082.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0082.242] lstrlenW (lpString=".xlsx") returned 5
	[0082.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0082.242] lstrlenW (lpString=".ppt") returned 4
	[0082.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0082.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.242] lstrlenW (lpString=".zip") returned 4
	[0082.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0082.242] lstrlenW (lpString=".rar") returned 4
	[0082.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0082.242] lstrlenW (lpString=".bz2") returned 4
	[0082.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0082.242] lstrlenW (lpString=".7z") returned 3
	[0082.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0082.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.242] lstrlenW (lpString=".dbf") returned 4
	[0082.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0082.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.242] lstrlenW (lpString=".1cd") returned 4
	[0082.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0082.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.242] lstrlenW (lpString=".jpg") returned 4
	[0082.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0082.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.243] lstrlenW (lpString=".doc") returned 4
	[0082.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0082.243] lstrlenW (lpString=".docx") returned 5
	[0082.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0082.243] lstrlenW (lpString=".pdf") returned 4
	[0082.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0082.243] lstrlenW (lpString=".xls") returned 4
	[0082.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0082.243] lstrlenW (lpString=".xlsx") returned 5
	[0082.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0082.243] lstrlenW (lpString=".ppt") returned 4
	[0082.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0082.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.243] lstrlenW (lpString=".zip") returned 4
	[0082.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0082.243] lstrlenW (lpString=".rar") returned 4
	[0082.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0082.243] lstrlenW (lpString=".bz2") returned 4
	[0082.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0082.243] lstrlenW (lpString=".7z") returned 3
	[0082.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0082.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.243] lstrlenW (lpString=".dbf") returned 4
	[0082.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0082.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.243] lstrlenW (lpString=".1cd") returned 4
	[0082.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0082.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0082.243] lstrlenW (lpString=".jpg") returned 4
	[0082.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0082.244] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0082.244] lstrlenW (lpString="HH00527_.WMF") returned 12
	[0082.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0082.674] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=5798) returned 1
	[0082.679] CloseHandle (hObject=0x390) returned 1
	[0082.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220
	[0082.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0082.680] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.680] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.307] GetLastError () returned 0x0
	[0083.315] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x16a6, lpOverlapped=0x0) returned 1
	[0083.324] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x16b0, lpOverlapped=0x0) returned 1
	[0083.325] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.325] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.325] SetEndOfFile (hFile=0x384) returned 1
	[0083.325] CloseHandle (hObject=0x384) returned 1
	[0083.325] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.325] SetEndOfFile (hFile=0x390) returned 1
	[0083.326] CloseHandle (hObject=0x390) returned 1
	[0083.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1
	[0083.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.327] lstrlenW (lpString=".doc") returned 4
	[0083.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.327] lstrlenW (lpString=".docx") returned 5
	[0083.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.327] lstrlenW (lpString=".pdf") returned 4
	[0083.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.327] lstrlenW (lpString=".xls") returned 4
	[0083.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.327] lstrlenW (lpString=".xlsx") returned 5
	[0083.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.327] lstrlenW (lpString=".ppt") returned 4
	[0083.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.327] lstrlenW (lpString=".zip") returned 4
	[0083.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.327] lstrlenW (lpString=".rar") returned 4
	[0083.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.328] lstrlenW (lpString=".bz2") returned 4
	[0083.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.328] lstrlenW (lpString=".7z") returned 3
	[0083.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.328] lstrlenW (lpString=".dbf") returned 4
	[0083.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.328] lstrlenW (lpString=".1cd") returned 4
	[0083.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.328] lstrlenW (lpString=".jpg") returned 4
	[0083.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.328] lstrlenW (lpString=".doc") returned 4
	[0083.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.328] lstrlenW (lpString=".docx") returned 5
	[0083.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.328] lstrlenW (lpString=".pdf") returned 4
	[0083.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.328] lstrlenW (lpString=".xls") returned 4
	[0083.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.328] lstrlenW (lpString=".xlsx") returned 5
	[0083.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.328] lstrlenW (lpString=".ppt") returned 4
	[0083.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.329] lstrlenW (lpString=".zip") returned 4
	[0083.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.329] lstrlenW (lpString=".rar") returned 4
	[0083.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.329] lstrlenW (lpString=".bz2") returned 4
	[0083.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.329] lstrlenW (lpString=".7z") returned 3
	[0083.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.329] lstrlenW (lpString=".dbf") returned 4
	[0083.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.329] lstrlenW (lpString=".1cd") returned 4
	[0083.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0083.329] lstrlenW (lpString=".jpg") returned 4
	[0083.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.329] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.329] lstrlenW (lpString="HH00681_.WMF") returned 12
	[0083.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.330] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=9300) returned 1
	[0083.330] CloseHandle (hObject=0x390) returned 1
	[0083.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220
	[0083.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.330] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.330] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.331] GetLastError () returned 0x0
	[0083.331] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x2454, lpOverlapped=0x0) returned 1
	[0083.332] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x2460, lpOverlapped=0x0) returned 1
	[0083.333] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.333] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.333] SetEndOfFile (hFile=0x384) returned 1
	[0083.333] CloseHandle (hObject=0x384) returned 1
	[0083.334] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.334] SetEndOfFile (hFile=0x390) returned 1
	[0083.334] CloseHandle (hObject=0x390) returned 1
	[0083.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1
	[0083.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.335] lstrlenW (lpString=".doc") returned 4
	[0083.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.335] lstrlenW (lpString=".docx") returned 5
	[0083.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.335] lstrlenW (lpString=".pdf") returned 4
	[0083.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.335] lstrlenW (lpString=".xls") returned 4
	[0083.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.335] lstrlenW (lpString=".xlsx") returned 5
	[0083.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.335] lstrlenW (lpString=".ppt") returned 4
	[0083.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.335] lstrlenW (lpString=".zip") returned 4
	[0083.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.336] lstrlenW (lpString=".rar") returned 4
	[0083.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.336] lstrlenW (lpString=".bz2") returned 4
	[0083.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.336] lstrlenW (lpString=".7z") returned 3
	[0083.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.336] lstrlenW (lpString=".dbf") returned 4
	[0083.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.336] lstrlenW (lpString=".1cd") returned 4
	[0083.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.336] lstrlenW (lpString=".jpg") returned 4
	[0083.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.336] lstrlenW (lpString=".doc") returned 4
	[0083.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.336] lstrlenW (lpString=".docx") returned 5
	[0083.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.336] lstrlenW (lpString=".pdf") returned 4
	[0083.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.336] lstrlenW (lpString=".xls") returned 4
	[0083.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.336] lstrlenW (lpString=".xlsx") returned 5
	[0083.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.337] lstrlenW (lpString=".ppt") returned 4
	[0083.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.337] lstrlenW (lpString=".zip") returned 4
	[0083.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.337] lstrlenW (lpString=".rar") returned 4
	[0083.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.337] lstrlenW (lpString=".bz2") returned 4
	[0083.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.337] lstrlenW (lpString=".7z") returned 3
	[0083.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.337] lstrlenW (lpString=".dbf") returned 4
	[0083.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.337] lstrlenW (lpString=".1cd") returned 4
	[0083.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0083.337] lstrlenW (lpString=".jpg") returned 4
	[0083.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.337] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.337] lstrlenW (lpString="HH00685_.WMF") returned 12
	[0083.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.338] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=4032) returned 1
	[0083.338] CloseHandle (hObject=0x390) returned 1
	[0083.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220
	[0083.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.338] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.338] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.339] GetLastError () returned 0x0
	[0083.339] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xfc0, lpOverlapped=0x0) returned 1
	[0083.340] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xfd0, lpOverlapped=0x0) returned 1
	[0083.341] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.341] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.341] SetEndOfFile (hFile=0x384) returned 1
	[0083.341] CloseHandle (hObject=0x384) returned 1
	[0083.341] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.341] SetEndOfFile (hFile=0x390) returned 1
	[0083.342] CloseHandle (hObject=0x390) returned 1
	[0083.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1
	[0083.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.343] lstrlenW (lpString=".doc") returned 4
	[0083.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.343] lstrlenW (lpString=".docx") returned 5
	[0083.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.343] lstrlenW (lpString=".pdf") returned 4
	[0083.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.343] lstrlenW (lpString=".xls") returned 4
	[0083.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.343] lstrlenW (lpString=".xlsx") returned 5
	[0083.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.343] lstrlenW (lpString=".ppt") returned 4
	[0083.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.343] lstrlenW (lpString=".zip") returned 4
	[0083.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.343] lstrlenW (lpString=".rar") returned 4
	[0083.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.343] lstrlenW (lpString=".bz2") returned 4
	[0083.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.343] lstrlenW (lpString=".7z") returned 3
	[0083.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.343] lstrlenW (lpString=".dbf") returned 4
	[0083.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.344] lstrlenW (lpString=".1cd") returned 4
	[0083.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.344] lstrlenW (lpString=".jpg") returned 4
	[0083.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.344] lstrlenW (lpString=".doc") returned 4
	[0083.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.344] lstrlenW (lpString=".docx") returned 5
	[0083.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.344] lstrlenW (lpString=".pdf") returned 4
	[0083.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.344] lstrlenW (lpString=".xls") returned 4
	[0083.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.344] lstrlenW (lpString=".xlsx") returned 5
	[0083.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.344] lstrlenW (lpString=".ppt") returned 4
	[0083.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.344] lstrlenW (lpString=".zip") returned 4
	[0083.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.344] lstrlenW (lpString=".rar") returned 4
	[0083.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.345] lstrlenW (lpString=".bz2") returned 4
	[0083.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.345] lstrlenW (lpString=".7z") returned 3
	[0083.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.345] lstrlenW (lpString=".dbf") returned 4
	[0083.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.345] lstrlenW (lpString=".1cd") returned 4
	[0083.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0083.345] lstrlenW (lpString=".jpg") returned 4
	[0083.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.345] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.345] lstrlenW (lpString="HH00687_.WMF") returned 12
	[0083.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.345] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=4340) returned 1
	[0083.345] CloseHandle (hObject=0x390) returned 1
	[0083.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220
	[0083.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.346] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.346] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.346] GetLastError () returned 0x0
	[0083.346] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x10f4, lpOverlapped=0x0) returned 1
	[0083.349] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1100, lpOverlapped=0x0) returned 1
	[0083.350] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.350] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.350] SetEndOfFile (hFile=0x384) returned 1
	[0083.350] CloseHandle (hObject=0x384) returned 1
	[0083.350] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.350] SetEndOfFile (hFile=0x390) returned 1
	[0083.351] CloseHandle (hObject=0x390) returned 1
	[0083.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1
	[0083.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.351] lstrlenW (lpString=".doc") returned 4
	[0083.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.352] lstrlenW (lpString=".docx") returned 5
	[0083.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.352] lstrlenW (lpString=".pdf") returned 4
	[0083.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.352] lstrlenW (lpString=".xls") returned 4
	[0083.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.352] lstrlenW (lpString=".xlsx") returned 5
	[0083.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.352] lstrlenW (lpString=".ppt") returned 4
	[0083.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.352] lstrlenW (lpString=".zip") returned 4
	[0083.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.352] lstrlenW (lpString=".rar") returned 4
	[0083.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.352] lstrlenW (lpString=".bz2") returned 4
	[0083.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.352] lstrlenW (lpString=".7z") returned 3
	[0083.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.352] lstrlenW (lpString=".dbf") returned 4
	[0083.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.352] lstrlenW (lpString=".1cd") returned 4
	[0083.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.352] lstrlenW (lpString=".jpg") returned 4
	[0083.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.353] lstrlenW (lpString=".doc") returned 4
	[0083.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.353] lstrlenW (lpString=".docx") returned 5
	[0083.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.353] lstrlenW (lpString=".pdf") returned 4
	[0083.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.353] lstrlenW (lpString=".xls") returned 4
	[0083.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.353] lstrlenW (lpString=".xlsx") returned 5
	[0083.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.353] lstrlenW (lpString=".ppt") returned 4
	[0083.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.353] lstrlenW (lpString=".zip") returned 4
	[0083.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.353] lstrlenW (lpString=".rar") returned 4
	[0083.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.353] lstrlenW (lpString=".bz2") returned 4
	[0083.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.353] lstrlenW (lpString=".7z") returned 3
	[0083.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.353] lstrlenW (lpString=".dbf") returned 4
	[0083.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.353] lstrlenW (lpString=".1cd") returned 4
	[0083.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0083.354] lstrlenW (lpString=".jpg") returned 4
	[0083.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.354] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.354] lstrlenW (lpString="HH00688_.WMF") returned 12
	[0083.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.354] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=7084) returned 1
	[0083.354] CloseHandle (hObject=0x390) returned 1
	[0083.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220
	[0083.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.355] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.355] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.355] GetLastError () returned 0x0
	[0083.355] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1bac, lpOverlapped=0x0) returned 1
	[0083.593] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1bb0, lpOverlapped=0x0) returned 1
	[0083.594] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.594] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.594] SetEndOfFile (hFile=0x384) returned 1
	[0083.594] CloseHandle (hObject=0x384) returned 1
	[0083.594] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.594] SetEndOfFile (hFile=0x390) returned 1
	[0083.595] CloseHandle (hObject=0x390) returned 1
	[0083.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1
	[0083.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.596] lstrlenW (lpString=".doc") returned 4
	[0083.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.596] lstrlenW (lpString=".docx") returned 5
	[0083.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.596] lstrlenW (lpString=".pdf") returned 4
	[0083.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.596] lstrlenW (lpString=".xls") returned 4
	[0083.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.596] lstrlenW (lpString=".xlsx") returned 5
	[0083.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.596] lstrlenW (lpString=".ppt") returned 4
	[0083.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.596] lstrlenW (lpString=".zip") returned 4
	[0083.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.596] lstrlenW (lpString=".rar") returned 4
	[0083.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.596] lstrlenW (lpString=".bz2") returned 4
	[0083.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.596] lstrlenW (lpString=".7z") returned 3
	[0083.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.596] lstrlenW (lpString=".dbf") returned 4
	[0083.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.597] lstrlenW (lpString=".1cd") returned 4
	[0083.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.597] lstrlenW (lpString=".jpg") returned 4
	[0083.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.597] lstrlenW (lpString=".doc") returned 4
	[0083.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.597] lstrlenW (lpString=".docx") returned 5
	[0083.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.597] lstrlenW (lpString=".pdf") returned 4
	[0083.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.597] lstrlenW (lpString=".xls") returned 4
	[0083.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.597] lstrlenW (lpString=".xlsx") returned 5
	[0083.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.597] lstrlenW (lpString=".ppt") returned 4
	[0083.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.597] lstrlenW (lpString=".zip") returned 4
	[0083.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.597] lstrlenW (lpString=".rar") returned 4
	[0083.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.598] lstrlenW (lpString=".bz2") returned 4
	[0083.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.598] lstrlenW (lpString=".7z") returned 3
	[0083.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.598] lstrlenW (lpString=".dbf") returned 4
	[0083.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.599] lstrlenW (lpString=".1cd") returned 4
	[0083.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0083.599] lstrlenW (lpString=".jpg") returned 4
	[0083.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.599] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.599] lstrlenW (lpString="HH01923_.WMF") returned 12
	[0083.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.599] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=26706) returned 1
	[0083.599] CloseHandle (hObject=0x390) returned 1
	[0083.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220
	[0083.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.600] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.600] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.600] GetLastError () returned 0x0
	[0083.600] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x6852, lpOverlapped=0x0) returned 1
	[0083.602] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x6860, lpOverlapped=0x0) returned 1
	[0083.604] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.604] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.604] SetEndOfFile (hFile=0x384) returned 1
	[0083.604] CloseHandle (hObject=0x384) returned 1
	[0083.604] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.604] SetEndOfFile (hFile=0x390) returned 1
	[0083.605] CloseHandle (hObject=0x390) returned 1
	[0083.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1
	[0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.606] lstrlenW (lpString=".doc") returned 4
	[0083.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString=".docx") returned 5
	[0083.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.606] lstrlenW (lpString=".pdf") returned 4
	[0083.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString=".xls") returned 4
	[0083.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.606] lstrlenW (lpString=".xlsx") returned 5
	[0083.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.606] lstrlenW (lpString=".ppt") returned 4
	[0083.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.606] lstrlenW (lpString=".zip") returned 4
	[0083.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.606] lstrlenW (lpString=".rar") returned 4
	[0083.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString=".bz2") returned 4
	[0083.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString=".7z") returned 3
	[0083.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.606] lstrlenW (lpString=".dbf") returned 4
	[0083.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.607] lstrlenW (lpString=".1cd") returned 4
	[0083.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.607] lstrlenW (lpString=".jpg") returned 4
	[0083.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.607] lstrlenW (lpString=".doc") returned 4
	[0083.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.607] lstrlenW (lpString=".docx") returned 5
	[0083.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.607] lstrlenW (lpString=".pdf") returned 4
	[0083.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.607] lstrlenW (lpString=".xls") returned 4
	[0083.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.607] lstrlenW (lpString=".xlsx") returned 5
	[0083.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.607] lstrlenW (lpString=".ppt") returned 4
	[0083.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.607] lstrlenW (lpString=".zip") returned 4
	[0083.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.607] lstrlenW (lpString=".rar") returned 4
	[0083.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.607] lstrlenW (lpString=".bz2") returned 4
	[0083.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.608] lstrlenW (lpString=".7z") returned 3
	[0083.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.608] lstrlenW (lpString=".dbf") returned 4
	[0083.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.608] lstrlenW (lpString=".1cd") returned 4
	[0083.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0083.608] lstrlenW (lpString=".jpg") returned 4
	[0083.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.608] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.608] lstrlenW (lpString="HH02155_.WMF") returned 12
	[0083.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.609] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=2704) returned 1
	[0083.609] CloseHandle (hObject=0x390) returned 1
	[0083.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220
	[0083.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.609] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.609] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.609] GetLastError () returned 0x0
	[0083.609] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xa90, lpOverlapped=0x0) returned 1
	[0083.611] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xaa0, lpOverlapped=0x0) returned 1
	[0083.612] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.612] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.613] SetEndOfFile (hFile=0x384) returned 1
	[0083.613] CloseHandle (hObject=0x384) returned 1
	[0083.613] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.613] SetEndOfFile (hFile=0x390) returned 1
	[0083.614] CloseHandle (hObject=0x390) returned 1
	[0083.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1
	[0083.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.615] lstrlenW (lpString=".doc") returned 4
	[0083.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.615] lstrlenW (lpString=".docx") returned 5
	[0083.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.615] lstrlenW (lpString=".pdf") returned 4
	[0083.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.615] lstrlenW (lpString=".xls") returned 4
	[0083.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.615] lstrlenW (lpString=".xlsx") returned 5
	[0083.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.615] lstrlenW (lpString=".ppt") returned 4
	[0083.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.615] lstrlenW (lpString=".zip") returned 4
	[0083.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.615] lstrlenW (lpString=".rar") returned 4
	[0083.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.615] lstrlenW (lpString=".bz2") returned 4
	[0083.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.615] lstrlenW (lpString=".7z") returned 3
	[0083.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.615] lstrlenW (lpString=".dbf") returned 4
	[0083.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.616] lstrlenW (lpString=".1cd") returned 4
	[0083.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.616] lstrlenW (lpString=".jpg") returned 4
	[0083.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.616] lstrlenW (lpString=".doc") returned 4
	[0083.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.616] lstrlenW (lpString=".docx") returned 5
	[0083.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.616] lstrlenW (lpString=".pdf") returned 4
	[0083.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.616] lstrlenW (lpString=".xls") returned 4
	[0083.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.616] lstrlenW (lpString=".xlsx") returned 5
	[0083.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.616] lstrlenW (lpString=".ppt") returned 4
	[0083.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.616] lstrlenW (lpString=".zip") returned 4
	[0083.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.616] lstrlenW (lpString=".rar") returned 4
	[0083.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.616] lstrlenW (lpString=".bz2") returned 4
	[0083.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.617] lstrlenW (lpString=".7z") returned 3
	[0083.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.617] lstrlenW (lpString=".dbf") returned 4
	[0083.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.617] lstrlenW (lpString=".1cd") returned 4
	[0083.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0083.617] lstrlenW (lpString=".jpg") returned 4
	[0083.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.617] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.617] lstrlenW (lpString="HH02166_.WMF") returned 12
	[0083.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.618] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1324) returned 1
	[0083.618] CloseHandle (hObject=0x390) returned 1
	[0083.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220
	[0083.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.618] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.618] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.619] GetLastError () returned 0x0
	[0083.619] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x52c, lpOverlapped=0x0) returned 1
	[0083.620] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x530, lpOverlapped=0x0) returned 1
	[0083.621] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.621] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.621] SetEndOfFile (hFile=0x384) returned 1
	[0083.622] CloseHandle (hObject=0x384) returned 1
	[0083.622] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.622] SetEndOfFile (hFile=0x390) returned 1
	[0083.623] CloseHandle (hObject=0x390) returned 1
	[0083.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1
	[0083.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.623] lstrlenW (lpString=".doc") returned 4
	[0083.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.623] lstrlenW (lpString=".docx") returned 5
	[0083.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.623] lstrlenW (lpString=".pdf") returned 4
	[0083.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.623] lstrlenW (lpString=".xls") returned 4
	[0083.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.623] lstrlenW (lpString=".xlsx") returned 5
	[0083.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.623] lstrlenW (lpString=".ppt") returned 4
	[0083.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.624] lstrlenW (lpString=".zip") returned 4
	[0083.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.624] lstrlenW (lpString=".rar") returned 4
	[0083.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.624] lstrlenW (lpString=".bz2") returned 4
	[0083.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.624] lstrlenW (lpString=".7z") returned 3
	[0083.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.624] lstrlenW (lpString=".dbf") returned 4
	[0083.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.624] lstrlenW (lpString=".1cd") returned 4
	[0083.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.624] lstrlenW (lpString=".jpg") returned 4
	[0083.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.624] lstrlenW (lpString=".doc") returned 4
	[0083.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.624] lstrlenW (lpString=".docx") returned 5
	[0083.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.624] lstrlenW (lpString=".pdf") returned 4
	[0083.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.625] lstrlenW (lpString=".xls") returned 4
	[0083.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.625] lstrlenW (lpString=".xlsx") returned 5
	[0083.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.625] lstrlenW (lpString=".ppt") returned 4
	[0083.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.625] lstrlenW (lpString=".zip") returned 4
	[0083.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.625] lstrlenW (lpString=".rar") returned 4
	[0083.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.625] lstrlenW (lpString=".bz2") returned 4
	[0083.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.625] lstrlenW (lpString=".7z") returned 3
	[0083.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.625] lstrlenW (lpString=".dbf") returned 4
	[0083.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.625] lstrlenW (lpString=".1cd") returned 4
	[0083.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0083.625] lstrlenW (lpString=".jpg") returned 4
	[0083.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.626] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.626] lstrlenW (lpString="HH02282_.WMF") returned 12
	[0083.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.626] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=7932) returned 1
	[0083.626] CloseHandle (hObject=0x390) returned 1
	[0083.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220
	[0083.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.626] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.626] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.627] GetLastError () returned 0x0
	[0083.627] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1efc, lpOverlapped=0x0) returned 1
	[0084.229] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1f00, lpOverlapped=0x0) returned 1
	[0084.230] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.230] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.230] SetEndOfFile (hFile=0x384) returned 1
	[0084.230] CloseHandle (hObject=0x384) returned 1
	[0084.230] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.231] SetEndOfFile (hFile=0x390) returned 1
	[0084.231] CloseHandle (hObject=0x390) returned 1
	[0084.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1
	[0084.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.232] lstrlenW (lpString=".doc") returned 4
	[0084.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.232] lstrlenW (lpString=".docx") returned 5
	[0084.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.232] lstrlenW (lpString=".pdf") returned 4
	[0084.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.232] lstrlenW (lpString=".xls") returned 4
	[0084.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.232] lstrlenW (lpString=".xlsx") returned 5
	[0084.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.232] lstrlenW (lpString=".ppt") returned 4
	[0084.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.232] lstrlenW (lpString=".zip") returned 4
	[0084.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.232] lstrlenW (lpString=".rar") returned 4
	[0084.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.232] lstrlenW (lpString=".bz2") returned 4
	[0084.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.232] lstrlenW (lpString=".7z") returned 3
	[0084.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.233] lstrlenW (lpString=".dbf") returned 4
	[0084.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.233] lstrlenW (lpString=".1cd") returned 4
	[0084.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.233] lstrlenW (lpString=".jpg") returned 4
	[0084.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.233] lstrlenW (lpString=".doc") returned 4
	[0084.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.233] lstrlenW (lpString=".docx") returned 5
	[0084.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.233] lstrlenW (lpString=".pdf") returned 4
	[0084.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.233] lstrlenW (lpString=".xls") returned 4
	[0084.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.233] lstrlenW (lpString=".xlsx") returned 5
	[0084.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.233] lstrlenW (lpString=".ppt") returned 4
	[0084.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.233] lstrlenW (lpString=".zip") returned 4
	[0084.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.233] lstrlenW (lpString=".rar") returned 4
	[0084.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.233] lstrlenW (lpString=".bz2") returned 4
	[0084.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.233] lstrlenW (lpString=".7z") returned 3
	[0084.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.234] lstrlenW (lpString=".dbf") returned 4
	[0084.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.234] lstrlenW (lpString=".1cd") returned 4
	[0084.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0084.234] lstrlenW (lpString=".jpg") returned 4
	[0084.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.234] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.234] lstrlenW (lpString="IN00233_.WMF") returned 12
	[0084.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0084.234] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=11190) returned 1
	[0084.234] CloseHandle (hObject=0x390) returned 1
	[0084.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220
	[0084.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0084.235] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.235] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.235] GetLastError () returned 0x0
	[0084.235] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x2bb6, lpOverlapped=0x0) returned 1
	[0084.237] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0084.238] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.238] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.238] SetEndOfFile (hFile=0x384) returned 1
	[0084.238] CloseHandle (hObject=0x384) returned 1
	[0084.238] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.238] SetEndOfFile (hFile=0x390) returned 1
	[0084.239] CloseHandle (hObject=0x390) returned 1
	[0084.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1
	[0084.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.240] lstrlenW (lpString=".doc") returned 4
	[0084.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.240] lstrlenW (lpString=".docx") returned 5
	[0084.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.240] lstrlenW (lpString=".pdf") returned 4
	[0084.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.240] lstrlenW (lpString=".xls") returned 4
	[0084.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.240] lstrlenW (lpString=".xlsx") returned 5
	[0084.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.240] lstrlenW (lpString=".ppt") returned 4
	[0084.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.240] lstrlenW (lpString=".zip") returned 4
	[0084.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.241] lstrlenW (lpString=".rar") returned 4
	[0084.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.241] lstrlenW (lpString=".bz2") returned 4
	[0084.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.241] lstrlenW (lpString=".7z") returned 3
	[0084.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.241] lstrlenW (lpString=".dbf") returned 4
	[0084.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.241] lstrlenW (lpString=".1cd") returned 4
	[0084.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.241] lstrlenW (lpString=".jpg") returned 4
	[0084.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.241] lstrlenW (lpString=".doc") returned 4
	[0084.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.241] lstrlenW (lpString=".docx") returned 5
	[0084.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.241] lstrlenW (lpString=".pdf") returned 4
	[0084.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.241] lstrlenW (lpString=".xls") returned 4
	[0084.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.242] lstrlenW (lpString=".xlsx") returned 5
	[0084.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.242] lstrlenW (lpString=".ppt") returned 4
	[0084.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.242] lstrlenW (lpString=".zip") returned 4
	[0084.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.242] lstrlenW (lpString=".rar") returned 4
	[0084.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.242] lstrlenW (lpString=".bz2") returned 4
	[0084.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.242] lstrlenW (lpString=".7z") returned 3
	[0084.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.242] lstrlenW (lpString=".dbf") returned 4
	[0084.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.242] lstrlenW (lpString=".1cd") returned 4
	[0084.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0084.242] lstrlenW (lpString=".jpg") returned 4
	[0084.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.242] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.242] lstrlenW (lpString="IN00343_.WMF") returned 12
	[0084.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0084.243] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1892) returned 1
	[0084.243] CloseHandle (hObject=0x390) returned 1
	[0084.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220
	[0084.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0084.244] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.244] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.244] GetLastError () returned 0x0
	[0084.244] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x764, lpOverlapped=0x0) returned 1
	[0084.245] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x770, lpOverlapped=0x0) returned 1
	[0084.246] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.246] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.247] SetEndOfFile (hFile=0x384) returned 1
	[0084.247] CloseHandle (hObject=0x384) returned 1
	[0084.247] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.247] SetEndOfFile (hFile=0x390) returned 1
	[0084.248] CloseHandle (hObject=0x390) returned 1
	[0084.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1
	[0084.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.249] lstrlenW (lpString=".doc") returned 4
	[0084.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.249] lstrlenW (lpString=".docx") returned 5
	[0084.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.249] lstrlenW (lpString=".pdf") returned 4
	[0084.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.249] lstrlenW (lpString=".xls") returned 4
	[0084.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.249] lstrlenW (lpString=".xlsx") returned 5
	[0084.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.249] lstrlenW (lpString=".ppt") returned 4
	[0084.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.249] lstrlenW (lpString=".zip") returned 4
	[0084.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.249] lstrlenW (lpString=".rar") returned 4
	[0084.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.249] lstrlenW (lpString=".bz2") returned 4
	[0084.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.250] lstrlenW (lpString=".7z") returned 3
	[0084.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.250] lstrlenW (lpString=".dbf") returned 4
	[0084.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.250] lstrlenW (lpString=".1cd") returned 4
	[0084.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.250] lstrlenW (lpString=".jpg") returned 4
	[0084.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.251] lstrlenW (lpString=".doc") returned 4
	[0084.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.251] lstrlenW (lpString=".docx") returned 5
	[0084.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.251] lstrlenW (lpString=".pdf") returned 4
	[0084.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.251] lstrlenW (lpString=".xls") returned 4
	[0084.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.251] lstrlenW (lpString=".xlsx") returned 5
	[0084.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.251] lstrlenW (lpString=".ppt") returned 4
	[0084.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.251] lstrlenW (lpString=".zip") returned 4
	[0084.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.252] lstrlenW (lpString=".rar") returned 4
	[0084.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.252] lstrlenW (lpString=".bz2") returned 4
	[0084.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.252] lstrlenW (lpString=".7z") returned 3
	[0084.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.252] lstrlenW (lpString=".dbf") returned 4
	[0084.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.252] lstrlenW (lpString=".1cd") returned 4
	[0084.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0084.252] lstrlenW (lpString=".jpg") returned 4
	[0084.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.253] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.253] lstrlenW (lpString="IN00346_.WMF") returned 12
	[0084.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0084.253] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=696) returned 1
	[0084.253] CloseHandle (hObject=0x390) returned 1
	[0084.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220
	[0084.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0084.254] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.254] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.294] GetLastError () returned 0x0
	[0084.294] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x2b8, lpOverlapped=0x0) returned 1
	[0084.296] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x2c0, lpOverlapped=0x0) returned 1
	[0084.297] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.297] WriteFile (in: hFile=0x384, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.297] SetEndOfFile (hFile=0x384) returned 1
	[0084.297] CloseHandle (hObject=0x384) returned 1
	[0084.297] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.297] SetEndOfFile (hFile=0x390) returned 1
	[0084.298] CloseHandle (hObject=0x390) returned 1
	[0084.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1
	[0084.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.299] lstrlenW (lpString=".doc") returned 4
	[0084.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.299] lstrlenW (lpString=".docx") returned 5
	[0084.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.299] lstrlenW (lpString=".pdf") returned 4
	[0084.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.299] lstrlenW (lpString=".xls") returned 4
	[0084.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.299] lstrlenW (lpString=".xlsx") returned 5
	[0084.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.299] lstrlenW (lpString=".ppt") returned 4
	[0084.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.299] lstrlenW (lpString=".zip") returned 4
	[0084.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.299] lstrlenW (lpString=".rar") returned 4
	[0084.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.300] lstrlenW (lpString=".bz2") returned 4
	[0084.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.300] lstrlenW (lpString=".7z") returned 3
	[0084.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.300] lstrlenW (lpString=".dbf") returned 4
	[0084.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.300] lstrlenW (lpString=".1cd") returned 4
	[0084.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.300] lstrlenW (lpString=".jpg") returned 4
	[0084.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.300] lstrlenW (lpString=".doc") returned 4
	[0084.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.300] lstrlenW (lpString=".docx") returned 5
	[0084.300] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.300] lstrlenW (lpString=".pdf") returned 4
	[0084.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.300] lstrlenW (lpString=".xls") returned 4
	[0084.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.300] lstrlenW (lpString=".xlsx") returned 5
	[0084.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.300] lstrlenW (lpString=".ppt") returned 4
	[0084.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.301] lstrlenW (lpString=".zip") returned 4
	[0084.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.301] lstrlenW (lpString=".rar") returned 4
	[0084.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.301] lstrlenW (lpString=".bz2") returned 4
	[0084.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.301] lstrlenW (lpString=".7z") returned 3
	[0084.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.786] lstrlenW (lpString=".dbf") returned 4
	[0084.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.786] lstrlenW (lpString=".1cd") returned 4
	[0084.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0084.786] lstrlenW (lpString=".jpg") returned 4
	[0084.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.786] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.786] lstrlenW (lpString="J0086426.WMF") returned 12
	[0084.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.787] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=21782) returned 1
	[0084.787] CloseHandle (hObject=0x378) returned 1
	[0084.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220
	[0084.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.787] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.787] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.788] GetLastError () returned 0x0
	[0084.788] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x5516, lpOverlapped=0x0) returned 1
	[0084.789] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x5520, lpOverlapped=0x0) returned 1
	[0084.791] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.791] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.791] SetEndOfFile (hFile=0x380) returned 1
	[0084.791] CloseHandle (hObject=0x380) returned 1
	[0084.791] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.791] SetEndOfFile (hFile=0x378) returned 1
	[0084.792] CloseHandle (hObject=0x378) returned 1
	[0084.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1
	[0084.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.793] lstrlenW (lpString=".doc") returned 4
	[0084.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.793] lstrlenW (lpString=".docx") returned 5
	[0084.793] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0084.793] lstrlenW (lpString=".pdf") returned 4
	[0084.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.793] lstrlenW (lpString=".xls") returned 4
	[0084.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.793] lstrlenW (lpString=".xlsx") returned 5
	[0084.793] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0084.793] lstrlenW (lpString=".ppt") returned 4
	[0084.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.793] lstrlenW (lpString=".zip") returned 4
	[0084.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.793] lstrlenW (lpString=".rar") returned 4
	[0084.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.793] lstrlenW (lpString=".bz2") returned 4
	[0084.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.793] lstrlenW (lpString=".7z") returned 3
	[0084.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.794] lstrlenW (lpString=".dbf") returned 4
	[0084.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.794] lstrlenW (lpString=".1cd") returned 4
	[0084.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.794] lstrlenW (lpString=".jpg") returned 4
	[0084.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.794] lstrlenW (lpString=".doc") returned 4
	[0084.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.794] lstrlenW (lpString=".docx") returned 5
	[0084.794] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0084.794] lstrlenW (lpString=".pdf") returned 4
	[0084.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.794] lstrlenW (lpString=".xls") returned 4
	[0084.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.794] lstrlenW (lpString=".xlsx") returned 5
	[0084.794] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0084.794] lstrlenW (lpString=".ppt") returned 4
	[0084.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.794] lstrlenW (lpString=".zip") returned 4
	[0084.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.794] lstrlenW (lpString=".rar") returned 4
	[0084.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.794] lstrlenW (lpString=".bz2") returned 4
	[0084.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.794] lstrlenW (lpString=".7z") returned 3
	[0084.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.795] lstrlenW (lpString=".dbf") returned 4
	[0084.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.795] lstrlenW (lpString=".1cd") returned 4
	[0084.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0084.795] lstrlenW (lpString=".jpg") returned 4
	[0084.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.795] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.795] lstrlenW (lpString="J0086428.WMF") returned 12
	[0084.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.795] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=35346) returned 1
	[0084.795] CloseHandle (hObject=0x378) returned 1
	[0084.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220
	[0084.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.796] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.796] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.796] GetLastError () returned 0x0
	[0084.796] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x8a12, lpOverlapped=0x0) returned 1
	[0084.798] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x8a20, lpOverlapped=0x0) returned 1
	[0084.799] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.799] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.799] SetEndOfFile (hFile=0x380) returned 1
	[0084.800] CloseHandle (hObject=0x380) returned 1
	[0084.800] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.800] SetEndOfFile (hFile=0x378) returned 1
	[0084.801] CloseHandle (hObject=0x378) returned 1
	[0084.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1
	[0084.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.801] lstrlenW (lpString=".doc") returned 4
	[0084.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.801] lstrlenW (lpString=".docx") returned 5
	[0084.801] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0084.801] lstrlenW (lpString=".pdf") returned 4
	[0084.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.801] lstrlenW (lpString=".xls") returned 4
	[0084.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.801] lstrlenW (lpString=".xlsx") returned 5
	[0084.801] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0084.802] lstrlenW (lpString=".ppt") returned 4
	[0084.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.802] lstrlenW (lpString=".zip") returned 4
	[0084.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.802] lstrlenW (lpString=".rar") returned 4
	[0084.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.802] lstrlenW (lpString=".bz2") returned 4
	[0084.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.802] lstrlenW (lpString=".7z") returned 3
	[0084.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.802] lstrlenW (lpString=".dbf") returned 4
	[0084.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.802] lstrlenW (lpString=".1cd") returned 4
	[0084.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.802] lstrlenW (lpString=".jpg") returned 4
	[0084.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.802] lstrlenW (lpString=".doc") returned 4
	[0084.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.802] lstrlenW (lpString=".docx") returned 5
	[0084.802] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0084.803] lstrlenW (lpString=".pdf") returned 4
	[0084.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.803] lstrlenW (lpString=".xls") returned 4
	[0084.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.803] lstrlenW (lpString=".xlsx") returned 5
	[0084.803] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0084.803] lstrlenW (lpString=".ppt") returned 4
	[0084.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.803] lstrlenW (lpString=".zip") returned 4
	[0084.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.803] lstrlenW (lpString=".rar") returned 4
	[0084.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.803] lstrlenW (lpString=".bz2") returned 4
	[0084.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.803] lstrlenW (lpString=".7z") returned 3
	[0084.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.803] lstrlenW (lpString=".dbf") returned 4
	[0084.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.803] lstrlenW (lpString=".1cd") returned 4
	[0084.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0084.803] lstrlenW (lpString=".jpg") returned 4
	[0084.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.804] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.804] lstrlenW (lpString="J0086432.WMF") returned 12
	[0084.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.805] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=33434) returned 1
	[0084.805] CloseHandle (hObject=0x378) returned 1
	[0084.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220
	[0084.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.805] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.805] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.806] GetLastError () returned 0x0
	[0084.806] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x829a, lpOverlapped=0x0) returned 1
	[0084.808] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x82a0, lpOverlapped=0x0) returned 1
	[0084.809] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.809] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.809] SetEndOfFile (hFile=0x380) returned 1
	[0084.809] CloseHandle (hObject=0x380) returned 1
	[0084.810] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.810] SetEndOfFile (hFile=0x378) returned 1
	[0084.811] CloseHandle (hObject=0x378) returned 1
	[0084.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1
	[0084.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.811] lstrlenW (lpString=".doc") returned 4
	[0084.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.811] lstrlenW (lpString=".docx") returned 5
	[0084.811] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0084.811] lstrlenW (lpString=".pdf") returned 4
	[0084.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.812] lstrlenW (lpString=".xls") returned 4
	[0084.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.812] lstrlenW (lpString=".xlsx") returned 5
	[0084.812] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0084.812] lstrlenW (lpString=".ppt") returned 4
	[0084.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.812] lstrlenW (lpString=".zip") returned 4
	[0084.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.812] lstrlenW (lpString=".rar") returned 4
	[0084.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.812] lstrlenW (lpString=".bz2") returned 4
	[0084.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.812] lstrlenW (lpString=".7z") returned 3
	[0084.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.812] lstrlenW (lpString=".dbf") returned 4
	[0084.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.812] lstrlenW (lpString=".1cd") returned 4
	[0084.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.812] lstrlenW (lpString=".jpg") returned 4
	[0084.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.813] lstrlenW (lpString=".doc") returned 4
	[0084.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.813] lstrlenW (lpString=".docx") returned 5
	[0084.813] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0084.813] lstrlenW (lpString=".pdf") returned 4
	[0084.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.813] lstrlenW (lpString=".xls") returned 4
	[0084.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.813] lstrlenW (lpString=".xlsx") returned 5
	[0084.813] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0084.813] lstrlenW (lpString=".ppt") returned 4
	[0084.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.813] lstrlenW (lpString=".zip") returned 4
	[0084.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.813] lstrlenW (lpString=".rar") returned 4
	[0084.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.813] lstrlenW (lpString=".bz2") returned 4
	[0084.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.814] lstrlenW (lpString=".7z") returned 3
	[0084.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.814] lstrlenW (lpString=".dbf") returned 4
	[0084.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.814] lstrlenW (lpString=".1cd") returned 4
	[0084.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0084.814] lstrlenW (lpString=".jpg") returned 4
	[0084.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.814] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.814] lstrlenW (lpString="J0086478.WMF") returned 12
	[0084.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.815] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=14174) returned 1
	[0084.815] CloseHandle (hObject=0x378) returned 1
	[0084.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220
	[0084.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.815] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.815] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.816] GetLastError () returned 0x0
	[0084.816] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x375e, lpOverlapped=0x0) returned 1
	[0084.817] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x3760, lpOverlapped=0x0) returned 1
	[0084.818] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.818] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.819] SetEndOfFile (hFile=0x380) returned 1
	[0084.819] CloseHandle (hObject=0x380) returned 1
	[0084.819] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.819] SetEndOfFile (hFile=0x378) returned 1
	[0085.303] CloseHandle (hObject=0x378) returned 1
	[0085.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1
	[0085.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.304] lstrlenW (lpString=".doc") returned 4
	[0085.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.304] lstrlenW (lpString=".docx") returned 5
	[0085.304] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0085.304] lstrlenW (lpString=".pdf") returned 4
	[0085.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.304] lstrlenW (lpString=".xls") returned 4
	[0085.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.304] lstrlenW (lpString=".xlsx") returned 5
	[0085.304] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0085.304] lstrlenW (lpString=".ppt") returned 4
	[0085.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.305] lstrlenW (lpString=".zip") returned 4
	[0085.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.305] lstrlenW (lpString=".rar") returned 4
	[0085.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.305] lstrlenW (lpString=".bz2") returned 4
	[0085.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.305] lstrlenW (lpString=".7z") returned 3
	[0085.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.305] lstrlenW (lpString=".dbf") returned 4
	[0085.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.305] lstrlenW (lpString=".1cd") returned 4
	[0085.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.305] lstrlenW (lpString=".jpg") returned 4
	[0085.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.305] lstrlenW (lpString=".doc") returned 4
	[0085.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.305] lstrlenW (lpString=".docx") returned 5
	[0085.305] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0085.306] lstrlenW (lpString=".pdf") returned 4
	[0085.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.306] lstrlenW (lpString=".xls") returned 4
	[0085.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.306] lstrlenW (lpString=".xlsx") returned 5
	[0085.306] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0085.306] lstrlenW (lpString=".ppt") returned 4
	[0085.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.306] lstrlenW (lpString=".zip") returned 4
	[0085.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.306] lstrlenW (lpString=".rar") returned 4
	[0085.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.306] lstrlenW (lpString=".bz2") returned 4
	[0085.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.306] lstrlenW (lpString=".7z") returned 3
	[0085.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.306] lstrlenW (lpString=".dbf") returned 4
	[0085.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.306] lstrlenW (lpString=".1cd") returned 4
	[0085.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0085.306] lstrlenW (lpString=".jpg") returned 4
	[0085.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.307] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.307] lstrlenW (lpString="J0099145.JPG") returned 12
	[0085.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.307] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=24759) returned 1
	[0085.307] CloseHandle (hObject=0x378) returned 1
	[0085.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220
	[0085.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.308] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.308] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.308] GetLastError () returned 0x0
	[0085.308] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x60b7, lpOverlapped=0x0) returned 1
	[0085.310] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x60c0, lpOverlapped=0x0) returned 1
	[0085.311] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.311] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.311] SetEndOfFile (hFile=0x37c) returned 1
	[0085.312] CloseHandle (hObject=0x37c) returned 1
	[0085.312] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.312] SetEndOfFile (hFile=0x378) returned 1
	[0085.313] CloseHandle (hObject=0x378) returned 1
	[0085.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1
	[0085.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.313] lstrlenW (lpString=".doc") returned 4
	[0085.313] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.313] lstrlenW (lpString=".docx") returned 5
	[0085.313] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0085.313] lstrlenW (lpString=".pdf") returned 4
	[0085.313] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.313] lstrlenW (lpString=".xls") returned 4
	[0085.313] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.313] lstrlenW (lpString=".xlsx") returned 5
	[0085.314] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0085.314] lstrlenW (lpString=".ppt") returned 4
	[0085.314] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.314] lstrlenW (lpString=".zip") returned 4
	[0085.314] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.314] lstrlenW (lpString=".rar") returned 4
	[0085.314] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.314] lstrlenW (lpString=".bz2") returned 4
	[0085.314] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.314] lstrlenW (lpString=".7z") returned 3
	[0085.314] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.314] lstrlenW (lpString=".dbf") returned 4
	[0085.314] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.314] lstrlenW (lpString=".1cd") returned 4
	[0085.314] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.314] lstrlenW (lpString=".jpg") returned 4
	[0085.314] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.314] lstrlenW (lpString=".doc") returned 4
	[0085.314] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.314] lstrlenW (lpString=".docx") returned 5
	[0085.314] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0085.314] lstrlenW (lpString=".pdf") returned 4
	[0085.314] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.314] lstrlenW (lpString=".xls") returned 4
	[0085.315] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.315] lstrlenW (lpString=".xlsx") returned 5
	[0085.315] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0085.315] lstrlenW (lpString=".ppt") returned 4
	[0085.315] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.315] lstrlenW (lpString=".zip") returned 4
	[0085.315] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.315] lstrlenW (lpString=".rar") returned 4
	[0085.315] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.315] lstrlenW (lpString=".bz2") returned 4
	[0085.315] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.315] lstrlenW (lpString=".7z") returned 3
	[0085.315] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.315] lstrlenW (lpString=".dbf") returned 4
	[0085.315] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.315] lstrlenW (lpString=".1cd") returned 4
	[0085.315] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0085.315] lstrlenW (lpString=".jpg") returned 4
	[0085.315] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.316] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.316] lstrlenW (lpString="J0099146.WMF") returned 12
	[0085.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.316] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=16596) returned 1
	[0085.316] CloseHandle (hObject=0x378) returned 1
	[0085.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220
	[0085.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.316] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.316] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.317] GetLastError () returned 0x0
	[0085.317] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x40d4, lpOverlapped=0x0) returned 1
	[0085.319] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x40e0, lpOverlapped=0x0) returned 1
	[0085.320] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.320] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.320] SetEndOfFile (hFile=0x37c) returned 1
	[0085.320] CloseHandle (hObject=0x37c) returned 1
	[0085.320] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.320] SetEndOfFile (hFile=0x378) returned 1
	[0085.321] CloseHandle (hObject=0x378) returned 1
	[0085.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1
	[0085.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.322] lstrlenW (lpString=".doc") returned 4
	[0085.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.322] lstrlenW (lpString=".docx") returned 5
	[0085.322] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0085.322] lstrlenW (lpString=".pdf") returned 4
	[0085.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.322] lstrlenW (lpString=".xls") returned 4
	[0085.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.322] lstrlenW (lpString=".xlsx") returned 5
	[0085.322] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0085.322] lstrlenW (lpString=".ppt") returned 4
	[0085.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.322] lstrlenW (lpString=".zip") returned 4
	[0085.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.322] lstrlenW (lpString=".rar") returned 4
	[0085.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.322] lstrlenW (lpString=".bz2") returned 4
	[0085.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.322] lstrlenW (lpString=".7z") returned 3
	[0085.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.323] lstrlenW (lpString=".dbf") returned 4
	[0085.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.323] lstrlenW (lpString=".1cd") returned 4
	[0085.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.323] lstrlenW (lpString=".jpg") returned 4
	[0085.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.323] lstrlenW (lpString=".doc") returned 4
	[0085.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.323] lstrlenW (lpString=".docx") returned 5
	[0085.323] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0085.323] lstrlenW (lpString=".pdf") returned 4
	[0085.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.323] lstrlenW (lpString=".xls") returned 4
	[0085.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.323] lstrlenW (lpString=".xlsx") returned 5
	[0085.323] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0085.323] lstrlenW (lpString=".ppt") returned 4
	[0085.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.324] lstrlenW (lpString=".zip") returned 4
	[0085.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.324] lstrlenW (lpString=".rar") returned 4
	[0085.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.324] lstrlenW (lpString=".bz2") returned 4
	[0085.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.324] lstrlenW (lpString=".7z") returned 3
	[0085.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.324] lstrlenW (lpString=".dbf") returned 4
	[0085.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.324] lstrlenW (lpString=".1cd") returned 4
	[0085.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0085.324] lstrlenW (lpString=".jpg") returned 4
	[0085.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.324] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.324] lstrlenW (lpString="J0099147.JPG") returned 12
	[0085.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.325] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=24377) returned 1
	[0085.325] CloseHandle (hObject=0x378) returned 1
	[0085.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220
	[0085.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.326] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.326] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.326] GetLastError () returned 0x0
	[0085.326] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x5f39, lpOverlapped=0x0) returned 1
	[0085.328] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0085.329] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.329] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.329] SetEndOfFile (hFile=0x37c) returned 1
	[0085.330] CloseHandle (hObject=0x37c) returned 1
	[0085.330] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.330] SetEndOfFile (hFile=0x378) returned 1
	[0085.331] CloseHandle (hObject=0x378) returned 1
	[0085.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1
	[0085.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.331] lstrlenW (lpString=".doc") returned 4
	[0085.331] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.331] lstrlenW (lpString=".docx") returned 5
	[0085.331] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0085.331] lstrlenW (lpString=".pdf") returned 4
	[0085.331] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.331] lstrlenW (lpString=".xls") returned 4
	[0085.331] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.331] lstrlenW (lpString=".xlsx") returned 5
	[0085.331] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0085.331] lstrlenW (lpString=".ppt") returned 4
	[0085.331] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.331] lstrlenW (lpString=".zip") returned 4
	[0085.331] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.331] lstrlenW (lpString=".rar") returned 4
	[0085.332] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.332] lstrlenW (lpString=".bz2") returned 4
	[0085.332] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.332] lstrlenW (lpString=".7z") returned 3
	[0085.332] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.332] lstrlenW (lpString=".dbf") returned 4
	[0085.332] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.332] lstrlenW (lpString=".1cd") returned 4
	[0085.332] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.332] lstrlenW (lpString=".jpg") returned 4
	[0085.332] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.332] lstrlenW (lpString=".doc") returned 4
	[0085.332] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.332] lstrlenW (lpString=".docx") returned 5
	[0085.332] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0085.332] lstrlenW (lpString=".pdf") returned 4
	[0085.332] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.332] lstrlenW (lpString=".xls") returned 4
	[0085.332] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.332] lstrlenW (lpString=".xlsx") returned 5
	[0085.332] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0085.332] lstrlenW (lpString=".ppt") returned 4
	[0085.332] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.333] lstrlenW (lpString=".zip") returned 4
	[0085.333] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.333] lstrlenW (lpString=".rar") returned 4
	[0085.333] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.333] lstrlenW (lpString=".bz2") returned 4
	[0085.333] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.333] lstrlenW (lpString=".7z") returned 3
	[0085.333] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.333] lstrlenW (lpString=".dbf") returned 4
	[0085.333] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.333] lstrlenW (lpString=".1cd") returned 4
	[0085.333] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0085.333] lstrlenW (lpString=".jpg") returned 4
	[0085.333] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.333] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.333] lstrlenW (lpString="J0099148.JPG") returned 12
	[0085.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.334] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=18258) returned 1
	[0085.334] CloseHandle (hObject=0x378) returned 1
	[0085.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220
	[0085.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.334] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.334] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.335] GetLastError () returned 0x0
	[0085.335] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x4752, lpOverlapped=0x0) returned 1
	[0085.336] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0085.339] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.339] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.340] SetEndOfFile (hFile=0x37c) returned 1
	[0085.340] CloseHandle (hObject=0x37c) returned 1
	[0085.340] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.340] SetEndOfFile (hFile=0x378) returned 1
	[0085.341] CloseHandle (hObject=0x378) returned 1
	[0085.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1
	[0085.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.341] lstrlenW (lpString=".doc") returned 4
	[0085.341] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.341] lstrlenW (lpString=".docx") returned 5
	[0085.341] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0085.341] lstrlenW (lpString=".pdf") returned 4
	[0085.341] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.342] lstrlenW (lpString=".xls") returned 4
	[0085.342] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.342] lstrlenW (lpString=".xlsx") returned 5
	[0085.342] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0085.342] lstrlenW (lpString=".ppt") returned 4
	[0085.342] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.342] lstrlenW (lpString=".zip") returned 4
	[0085.342] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.342] lstrlenW (lpString=".rar") returned 4
	[0085.342] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.342] lstrlenW (lpString=".bz2") returned 4
	[0085.342] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.342] lstrlenW (lpString=".7z") returned 3
	[0085.342] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.342] lstrlenW (lpString=".dbf") returned 4
	[0085.342] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.342] lstrlenW (lpString=".1cd") returned 4
	[0085.342] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.342] lstrlenW (lpString=".jpg") returned 4
	[0085.342] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.343] lstrlenW (lpString=".doc") returned 4
	[0085.343] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.343] lstrlenW (lpString=".docx") returned 5
	[0085.343] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0085.343] lstrlenW (lpString=".pdf") returned 4
	[0085.343] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.343] lstrlenW (lpString=".xls") returned 4
	[0085.343] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.343] lstrlenW (lpString=".xlsx") returned 5
	[0085.343] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0085.343] lstrlenW (lpString=".ppt") returned 4
	[0085.343] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.343] lstrlenW (lpString=".zip") returned 4
	[0085.343] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.343] lstrlenW (lpString=".rar") returned 4
	[0085.343] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.343] lstrlenW (lpString=".bz2") returned 4
	[0085.343] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.343] lstrlenW (lpString=".7z") returned 3
	[0085.343] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.343] lstrlenW (lpString=".dbf") returned 4
	[0085.343] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.344] lstrlenW (lpString=".1cd") returned 4
	[0085.344] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0085.344] lstrlenW (lpString=".jpg") returned 4
	[0085.344] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.344] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.344] lstrlenW (lpString="J0099149.WMF") returned 12
	[0085.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.344] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=73214) returned 1
	[0085.344] CloseHandle (hObject=0x378) returned 1
	[0085.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220
	[0085.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.345] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.345] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.345] GetLastError () returned 0x0
	[0085.345] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x11dfe, lpOverlapped=0x0) returned 1
	[0085.511] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x11e00, lpOverlapped=0x0) returned 1
	[0085.513] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.513] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.513] SetEndOfFile (hFile=0x37c) returned 1
	[0085.513] CloseHandle (hObject=0x37c) returned 1
	[0085.513] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.514] SetEndOfFile (hFile=0x378) returned 1
	[0085.515] CloseHandle (hObject=0x378) returned 1
	[0085.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1
	[0085.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.515] lstrlenW (lpString=".doc") returned 4
	[0085.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.515] lstrlenW (lpString=".docx") returned 5
	[0085.516] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0085.516] lstrlenW (lpString=".pdf") returned 4
	[0085.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.516] lstrlenW (lpString=".xls") returned 4
	[0085.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.516] lstrlenW (lpString=".xlsx") returned 5
	[0085.516] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0085.516] lstrlenW (lpString=".ppt") returned 4
	[0085.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.516] lstrlenW (lpString=".zip") returned 4
	[0085.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.516] lstrlenW (lpString=".rar") returned 4
	[0085.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.516] lstrlenW (lpString=".bz2") returned 4
	[0085.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.516] lstrlenW (lpString=".7z") returned 3
	[0085.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.516] lstrlenW (lpString=".dbf") returned 4
	[0085.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.516] lstrlenW (lpString=".1cd") returned 4
	[0085.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.516] lstrlenW (lpString=".jpg") returned 4
	[0085.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.517] lstrlenW (lpString=".doc") returned 4
	[0085.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.517] lstrlenW (lpString=".docx") returned 5
	[0085.517] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0085.517] lstrlenW (lpString=".pdf") returned 4
	[0085.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.517] lstrlenW (lpString=".xls") returned 4
	[0085.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.517] lstrlenW (lpString=".xlsx") returned 5
	[0085.517] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0085.517] lstrlenW (lpString=".ppt") returned 4
	[0085.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.517] lstrlenW (lpString=".zip") returned 4
	[0085.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.517] lstrlenW (lpString=".rar") returned 4
	[0085.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.517] lstrlenW (lpString=".bz2") returned 4
	[0085.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.517] lstrlenW (lpString=".7z") returned 3
	[0085.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.517] lstrlenW (lpString=".dbf") returned 4
	[0085.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.517] lstrlenW (lpString=".1cd") returned 4
	[0085.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0085.517] lstrlenW (lpString=".jpg") returned 4
	[0085.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.518] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.518] lstrlenW (lpString="J0099157.JPG") returned 12
	[0085.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.518] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=9671) returned 1
	[0085.518] CloseHandle (hObject=0x378) returned 1
	[0085.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220
	[0085.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.519] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.519] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.519] GetLastError () returned 0x0
	[0085.519] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x25c7, lpOverlapped=0x0) returned 1
	[0085.521] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x25d0, lpOverlapped=0x0) returned 1
	[0085.522] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.522] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.522] SetEndOfFile (hFile=0x37c) returned 1
	[0085.522] CloseHandle (hObject=0x37c) returned 1
	[0085.522] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.522] SetEndOfFile (hFile=0x378) returned 1
	[0085.524] CloseHandle (hObject=0x378) returned 1
	[0085.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1
	[0085.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.524] lstrlenW (lpString=".doc") returned 4
	[0085.524] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.524] lstrlenW (lpString=".docx") returned 5
	[0085.524] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0085.524] lstrlenW (lpString=".pdf") returned 4
	[0085.524] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.524] lstrlenW (lpString=".xls") returned 4
	[0085.524] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.524] lstrlenW (lpString=".xlsx") returned 5
	[0085.524] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0085.524] lstrlenW (lpString=".ppt") returned 4
	[0085.525] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.525] lstrlenW (lpString=".zip") returned 4
	[0085.525] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.525] lstrlenW (lpString=".rar") returned 4
	[0085.525] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.525] lstrlenW (lpString=".bz2") returned 4
	[0085.525] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.525] lstrlenW (lpString=".7z") returned 3
	[0085.525] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.525] lstrlenW (lpString=".dbf") returned 4
	[0085.525] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.525] lstrlenW (lpString=".1cd") returned 4
	[0085.525] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.525] lstrlenW (lpString=".jpg") returned 4
	[0085.525] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.525] lstrlenW (lpString=".doc") returned 4
	[0085.525] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.525] lstrlenW (lpString=".docx") returned 5
	[0085.525] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0085.525] lstrlenW (lpString=".pdf") returned 4
	[0085.526] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.526] lstrlenW (lpString=".xls") returned 4
	[0085.526] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.526] lstrlenW (lpString=".xlsx") returned 5
	[0085.526] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0085.526] lstrlenW (lpString=".ppt") returned 4
	[0085.526] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.526] lstrlenW (lpString=".zip") returned 4
	[0085.526] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.526] lstrlenW (lpString=".rar") returned 4
	[0085.526] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.526] lstrlenW (lpString=".bz2") returned 4
	[0085.526] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.526] lstrlenW (lpString=".7z") returned 3
	[0085.526] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.526] lstrlenW (lpString=".dbf") returned 4
	[0085.526] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.526] lstrlenW (lpString=".1cd") returned 4
	[0085.526] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0085.526] lstrlenW (lpString=".jpg") returned 4
	[0085.526] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.526] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.527] lstrlenW (lpString="J0099158.WMF") returned 12
	[0085.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.527] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=26160) returned 1
	[0085.527] CloseHandle (hObject=0x378) returned 1
	[0085.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220
	[0085.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.527] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.527] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.528] GetLastError () returned 0x0
	[0085.528] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x6630, lpOverlapped=0x0) returned 1
	[0085.529] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x6640, lpOverlapped=0x0) returned 1
	[0085.531] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.531] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.531] SetEndOfFile (hFile=0x37c) returned 1
	[0085.531] CloseHandle (hObject=0x37c) returned 1
	[0085.531] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.531] SetEndOfFile (hFile=0x378) returned 1
	[0085.532] CloseHandle (hObject=0x378) returned 1
	[0085.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1
	[0085.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.533] lstrlenW (lpString=".doc") returned 4
	[0085.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.533] lstrlenW (lpString=".docx") returned 5
	[0085.533] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0085.533] lstrlenW (lpString=".pdf") returned 4
	[0085.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.533] lstrlenW (lpString=".xls") returned 4
	[0085.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.533] lstrlenW (lpString=".xlsx") returned 5
	[0085.533] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0085.533] lstrlenW (lpString=".ppt") returned 4
	[0085.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.533] lstrlenW (lpString=".zip") returned 4
	[0085.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.533] lstrlenW (lpString=".rar") returned 4
	[0085.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.533] lstrlenW (lpString=".bz2") returned 4
	[0085.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.533] lstrlenW (lpString=".7z") returned 3
	[0085.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.533] lstrlenW (lpString=".dbf") returned 4
	[0085.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.534] lstrlenW (lpString=".1cd") returned 4
	[0085.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.534] lstrlenW (lpString=".jpg") returned 4
	[0085.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.534] lstrlenW (lpString=".doc") returned 4
	[0085.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.534] lstrlenW (lpString=".docx") returned 5
	[0085.534] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0085.534] lstrlenW (lpString=".pdf") returned 4
	[0085.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.534] lstrlenW (lpString=".xls") returned 4
	[0085.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.534] lstrlenW (lpString=".xlsx") returned 5
	[0085.534] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0085.535] lstrlenW (lpString=".ppt") returned 4
	[0085.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.535] lstrlenW (lpString=".zip") returned 4
	[0085.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.535] lstrlenW (lpString=".rar") returned 4
	[0085.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.535] lstrlenW (lpString=".bz2") returned 4
	[0085.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.535] lstrlenW (lpString=".7z") returned 3
	[0085.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.535] lstrlenW (lpString=".dbf") returned 4
	[0085.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.535] lstrlenW (lpString=".1cd") returned 4
	[0085.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0085.535] lstrlenW (lpString=".jpg") returned 4
	[0085.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.536] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.536] lstrlenW (lpString="J0099159.WMF") returned 12
	[0085.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.536] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=27546) returned 1
	[0085.536] CloseHandle (hObject=0x378) returned 1
	[0085.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220
	[0085.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.537] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.537] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.537] GetLastError () returned 0x0
	[0085.537] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x6b9a, lpOverlapped=0x0) returned 1
	[0085.539] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x6ba0, lpOverlapped=0x0) returned 1
	[0085.540] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.540] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.541] SetEndOfFile (hFile=0x37c) returned 1
	[0085.541] CloseHandle (hObject=0x37c) returned 1
	[0085.541] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.541] SetEndOfFile (hFile=0x378) returned 1
	[0085.542] CloseHandle (hObject=0x378) returned 1
	[0085.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1
	[0085.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.542] lstrlenW (lpString=".doc") returned 4
	[0085.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.543] lstrlenW (lpString=".docx") returned 5
	[0085.543] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0085.543] lstrlenW (lpString=".pdf") returned 4
	[0085.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.543] lstrlenW (lpString=".xls") returned 4
	[0085.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.543] lstrlenW (lpString=".xlsx") returned 5
	[0085.543] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0085.543] lstrlenW (lpString=".ppt") returned 4
	[0085.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.543] lstrlenW (lpString=".zip") returned 4
	[0085.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.543] lstrlenW (lpString=".rar") returned 4
	[0085.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.543] lstrlenW (lpString=".bz2") returned 4
	[0085.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.543] lstrlenW (lpString=".7z") returned 3
	[0085.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.543] lstrlenW (lpString=".dbf") returned 4
	[0085.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.544] lstrlenW (lpString=".1cd") returned 4
	[0085.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.544] lstrlenW (lpString=".jpg") returned 4
	[0085.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.544] lstrlenW (lpString=".doc") returned 4
	[0085.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.544] lstrlenW (lpString=".docx") returned 5
	[0085.544] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0085.544] lstrlenW (lpString=".pdf") returned 4
	[0085.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.544] lstrlenW (lpString=".xls") returned 4
	[0085.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.544] lstrlenW (lpString=".xlsx") returned 5
	[0085.544] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0085.544] lstrlenW (lpString=".ppt") returned 4
	[0085.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.545] lstrlenW (lpString=".zip") returned 4
	[0085.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.545] lstrlenW (lpString=".rar") returned 4
	[0085.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.545] lstrlenW (lpString=".bz2") returned 4
	[0085.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.545] lstrlenW (lpString=".7z") returned 3
	[0085.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.545] lstrlenW (lpString=".dbf") returned 4
	[0085.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.545] lstrlenW (lpString=".1cd") returned 4
	[0085.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0085.545] lstrlenW (lpString=".jpg") returned 4
	[0085.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.545] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.546] lstrlenW (lpString="J0099160.JPG") returned 12
	[0085.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.546] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=15145) returned 1
	[0085.546] CloseHandle (hObject=0x378) returned 1
	[0085.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220
	[0085.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.546] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.546] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.547] GetLastError () returned 0x0
	[0085.547] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x3b29, lpOverlapped=0x0) returned 1
	[0085.876] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x3b30, lpOverlapped=0x0) returned 1
	[0085.877] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.877] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.877] SetEndOfFile (hFile=0x37c) returned 1
	[0085.878] CloseHandle (hObject=0x37c) returned 1
	[0085.878] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.878] SetEndOfFile (hFile=0x378) returned 1
	[0085.879] CloseHandle (hObject=0x378) returned 1
	[0085.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1
	[0085.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.880] lstrlenW (lpString=".doc") returned 4
	[0085.880] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.880] lstrlenW (lpString=".docx") returned 5
	[0085.880] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0085.880] lstrlenW (lpString=".pdf") returned 4
	[0085.880] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.880] lstrlenW (lpString=".xls") returned 4
	[0085.880] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.880] lstrlenW (lpString=".xlsx") returned 5
	[0085.880] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0085.880] lstrlenW (lpString=".ppt") returned 4
	[0085.880] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.880] lstrlenW (lpString=".zip") returned 4
	[0085.880] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.880] lstrlenW (lpString=".rar") returned 4
	[0085.880] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.881] lstrlenW (lpString=".bz2") returned 4
	[0085.881] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.881] lstrlenW (lpString=".7z") returned 3
	[0085.881] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.881] lstrlenW (lpString=".dbf") returned 4
	[0085.881] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.881] lstrlenW (lpString=".1cd") returned 4
	[0085.881] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.881] lstrlenW (lpString=".jpg") returned 4
	[0085.881] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.881] lstrlenW (lpString=".doc") returned 4
	[0085.881] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.881] lstrlenW (lpString=".docx") returned 5
	[0085.881] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0085.881] lstrlenW (lpString=".pdf") returned 4
	[0085.881] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.882] lstrlenW (lpString=".xls") returned 4
	[0085.882] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.882] lstrlenW (lpString=".xlsx") returned 5
	[0085.882] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0085.882] lstrlenW (lpString=".ppt") returned 4
	[0085.882] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.882] lstrlenW (lpString=".zip") returned 4
	[0085.882] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.882] lstrlenW (lpString=".rar") returned 4
	[0085.882] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.882] lstrlenW (lpString=".bz2") returned 4
	[0085.882] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.882] lstrlenW (lpString=".7z") returned 3
	[0085.882] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.882] lstrlenW (lpString=".dbf") returned 4
	[0085.882] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.882] lstrlenW (lpString=".1cd") returned 4
	[0085.883] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0085.883] lstrlenW (lpString=".jpg") returned 4
	[0085.883] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.883] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.883] lstrlenW (lpString="J0099172.WMF") returned 12
	[0085.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.883] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=58258) returned 1
	[0085.884] CloseHandle (hObject=0x378) returned 1
	[0085.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220
	[0085.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.884] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.884] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.885] GetLastError () returned 0x0
	[0085.885] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xe392, lpOverlapped=0x0) returned 1
	[0085.887] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe3a0, lpOverlapped=0x0) returned 1
	[0085.889] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.889] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.889] SetEndOfFile (hFile=0x37c) returned 1
	[0085.889] CloseHandle (hObject=0x37c) returned 1
	[0085.889] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.889] SetEndOfFile (hFile=0x378) returned 1
	[0085.890] CloseHandle (hObject=0x378) returned 1
	[0085.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1
	[0085.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.891] lstrlenW (lpString=".doc") returned 4
	[0085.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.891] lstrlenW (lpString=".docx") returned 5
	[0085.891] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0085.891] lstrlenW (lpString=".pdf") returned 4
	[0085.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.891] lstrlenW (lpString=".xls") returned 4
	[0085.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.891] lstrlenW (lpString=".xlsx") returned 5
	[0085.891] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0085.891] lstrlenW (lpString=".ppt") returned 4
	[0085.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.891] lstrlenW (lpString=".zip") returned 4
	[0085.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.891] lstrlenW (lpString=".rar") returned 4
	[0085.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.891] lstrlenW (lpString=".bz2") returned 4
	[0085.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.892] lstrlenW (lpString=".7z") returned 3
	[0085.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.892] lstrlenW (lpString=".dbf") returned 4
	[0085.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.892] lstrlenW (lpString=".1cd") returned 4
	[0085.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.892] lstrlenW (lpString=".jpg") returned 4
	[0085.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.892] lstrlenW (lpString=".doc") returned 4
	[0085.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.892] lstrlenW (lpString=".docx") returned 5
	[0085.892] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0085.892] lstrlenW (lpString=".pdf") returned 4
	[0085.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.892] lstrlenW (lpString=".xls") returned 4
	[0085.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.892] lstrlenW (lpString=".xlsx") returned 5
	[0085.892] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0085.893] lstrlenW (lpString=".ppt") returned 4
	[0085.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.893] lstrlenW (lpString=".zip") returned 4
	[0085.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.893] lstrlenW (lpString=".rar") returned 4
	[0085.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.893] lstrlenW (lpString=".bz2") returned 4
	[0085.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.893] lstrlenW (lpString=".7z") returned 3
	[0085.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.893] lstrlenW (lpString=".dbf") returned 4
	[0085.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.893] lstrlenW (lpString=".1cd") returned 4
	[0085.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0085.893] lstrlenW (lpString=".jpg") returned 4
	[0085.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.893] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.894] lstrlenW (lpString="J0099173.WMF") returned 12
	[0085.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.915] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=37140) returned 1
	[0085.915] CloseHandle (hObject=0x378) returned 1
	[0085.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220
	[0085.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.915] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.915] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.916] GetLastError () returned 0x0
	[0085.916] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x9114, lpOverlapped=0x0) returned 1
	[0085.918] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x9120, lpOverlapped=0x0) returned 1
	[0085.920] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.920] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.920] SetEndOfFile (hFile=0x37c) returned 1
	[0085.920] CloseHandle (hObject=0x37c) returned 1
	[0085.920] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.920] SetEndOfFile (hFile=0x378) returned 1
	[0085.921] CloseHandle (hObject=0x378) returned 1
	[0085.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1
	[0085.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.922] lstrlenW (lpString=".doc") returned 4
	[0085.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.922] lstrlenW (lpString=".docx") returned 5
	[0085.922] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0085.922] lstrlenW (lpString=".pdf") returned 4
	[0085.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.922] lstrlenW (lpString=".xls") returned 4
	[0085.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.922] lstrlenW (lpString=".xlsx") returned 5
	[0085.922] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0085.922] lstrlenW (lpString=".ppt") returned 4
	[0085.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.922] lstrlenW (lpString=".zip") returned 4
	[0085.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.922] lstrlenW (lpString=".rar") returned 4
	[0085.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.922] lstrlenW (lpString=".bz2") returned 4
	[0085.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.923] lstrlenW (lpString=".7z") returned 3
	[0085.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.923] lstrlenW (lpString=".dbf") returned 4
	[0085.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.923] lstrlenW (lpString=".1cd") returned 4
	[0085.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.923] lstrlenW (lpString=".jpg") returned 4
	[0085.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.923] lstrlenW (lpString=".doc") returned 4
	[0085.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.923] lstrlenW (lpString=".docx") returned 5
	[0085.923] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0085.923] lstrlenW (lpString=".pdf") returned 4
	[0085.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.923] lstrlenW (lpString=".xls") returned 4
	[0085.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.924] lstrlenW (lpString=".xlsx") returned 5
	[0085.924] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0085.924] lstrlenW (lpString=".ppt") returned 4
	[0085.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.924] lstrlenW (lpString=".zip") returned 4
	[0085.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.924] lstrlenW (lpString=".rar") returned 4
	[0085.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.924] lstrlenW (lpString=".bz2") returned 4
	[0085.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.924] lstrlenW (lpString=".7z") returned 3
	[0085.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.924] lstrlenW (lpString=".dbf") returned 4
	[0085.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.924] lstrlenW (lpString=".1cd") returned 4
	[0085.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0085.924] lstrlenW (lpString=".jpg") returned 4
	[0085.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.925] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.925] lstrlenW (lpString="J0099174.WMF") returned 12
	[0085.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.925] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=6214) returned 1
	[0085.926] CloseHandle (hObject=0x378) returned 1
	[0085.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220
	[0085.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.926] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.926] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.927] GetLastError () returned 0x0
	[0085.927] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x1846, lpOverlapped=0x0) returned 1
	[0085.928] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x1850, lpOverlapped=0x0) returned 1
	[0085.929] ReadFile (in: hFile=0x378, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.929] WriteFile (in: hFile=0x37c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.929] SetEndOfFile (hFile=0x37c) returned 1
	[0085.929] CloseHandle (hObject=0x37c) returned 1
	[0085.929] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.929] SetEndOfFile (hFile=0x378) returned 1
	[0085.930] CloseHandle (hObject=0x378) returned 1
	[0085.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1
	[0085.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.931] lstrlenW (lpString=".doc") returned 4
	[0085.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.931] lstrlenW (lpString=".docx") returned 5
	[0085.931] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0085.931] lstrlenW (lpString=".pdf") returned 4
	[0085.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.931] lstrlenW (lpString=".xls") returned 4
	[0085.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.931] lstrlenW (lpString=".xlsx") returned 5
	[0085.931] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0085.932] lstrlenW (lpString=".ppt") returned 4
	[0085.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.932] lstrlenW (lpString=".zip") returned 4
	[0085.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.932] lstrlenW (lpString=".rar") returned 4
	[0085.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.932] lstrlenW (lpString=".bz2") returned 4
	[0085.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.932] lstrlenW (lpString=".7z") returned 3
	[0085.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.932] lstrlenW (lpString=".dbf") returned 4
	[0085.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.932] lstrlenW (lpString=".1cd") returned 4
	[0085.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.932] lstrlenW (lpString=".jpg") returned 4
	[0085.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.933] lstrlenW (lpString=".doc") returned 4
	[0085.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.933] lstrlenW (lpString=".docx") returned 5
	[0085.933] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0085.933] lstrlenW (lpString=".pdf") returned 4
	[0085.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.933] lstrlenW (lpString=".xls") returned 4
	[0085.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.933] lstrlenW (lpString=".xlsx") returned 5
	[0085.933] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0085.933] lstrlenW (lpString=".ppt") returned 4
	[0085.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.933] lstrlenW (lpString=".zip") returned 4
	[0085.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.933] lstrlenW (lpString=".rar") returned 4
	[0085.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.933] lstrlenW (lpString=".bz2") returned 4
	[0085.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.933] lstrlenW (lpString=".7z") returned 3
	[0085.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.934] lstrlenW (lpString=".dbf") returned 4
	[0085.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.934] lstrlenW (lpString=".1cd") returned 4
	[0085.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0085.934] lstrlenW (lpString=".jpg") returned 4
	[0085.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.934] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.934] lstrlenW (lpString="J0099175.WMF") returned 12
	[0085.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.319] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=9744) returned 1
	[0086.319] CloseHandle (hObject=0x340) returned 1
	[0086.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220
	[0086.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.320] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.320] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.320] GetLastError () returned 0x0
	[0086.320] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x2610, lpOverlapped=0x0) returned 1
	[0086.322] WriteFile (in: hFile=0x34c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x2620, lpOverlapped=0x0) returned 1
	[0086.323] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.323] WriteFile (in: hFile=0x34c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.324] SetEndOfFile (hFile=0x34c) returned 1
	[0086.324] CloseHandle (hObject=0x34c) returned 1
	[0086.324] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.324] SetEndOfFile (hFile=0x340) returned 1
	[0086.325] CloseHandle (hObject=0x340) returned 1
	[0086.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1
	[0086.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.325] lstrlenW (lpString=".doc") returned 4
	[0086.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.325] lstrlenW (lpString=".docx") returned 5
	[0086.326] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0086.326] lstrlenW (lpString=".pdf") returned 4
	[0086.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.326] lstrlenW (lpString=".xls") returned 4
	[0086.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.326] lstrlenW (lpString=".xlsx") returned 5
	[0086.326] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0086.326] lstrlenW (lpString=".ppt") returned 4
	[0086.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.326] lstrlenW (lpString=".zip") returned 4
	[0086.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.326] lstrlenW (lpString=".rar") returned 4
	[0086.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.326] lstrlenW (lpString=".bz2") returned 4
	[0086.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.326] lstrlenW (lpString=".7z") returned 3
	[0086.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.327] lstrlenW (lpString=".dbf") returned 4
	[0086.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.327] lstrlenW (lpString=".1cd") returned 4
	[0086.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.327] lstrlenW (lpString=".jpg") returned 4
	[0086.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.327] lstrlenW (lpString=".doc") returned 4
	[0086.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.327] lstrlenW (lpString=".docx") returned 5
	[0086.328] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0086.328] lstrlenW (lpString=".pdf") returned 4
	[0086.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.328] lstrlenW (lpString=".xls") returned 4
	[0086.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.328] lstrlenW (lpString=".xlsx") returned 5
	[0086.328] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0086.328] lstrlenW (lpString=".ppt") returned 4
	[0086.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.328] lstrlenW (lpString=".zip") returned 4
	[0086.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.328] lstrlenW (lpString=".rar") returned 4
	[0086.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.328] lstrlenW (lpString=".bz2") returned 4
	[0086.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.328] lstrlenW (lpString=".7z") returned 3
	[0086.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.328] lstrlenW (lpString=".dbf") returned 4
	[0086.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.328] lstrlenW (lpString=".1cd") returned 4
	[0086.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0086.328] lstrlenW (lpString=".jpg") returned 4
	[0086.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.329] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0086.329] lstrlenW (lpString="J0099178.WMF") returned 12
	[0086.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.329] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3606) returned 1
	[0086.329] CloseHandle (hObject=0x340) returned 1
	[0086.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220
	[0086.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.329] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.329] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.330] GetLastError () returned 0x0
	[0086.330] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xe16, lpOverlapped=0x0) returned 1
	[0086.331] WriteFile (in: hFile=0x34c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xe20, lpOverlapped=0x0) returned 1
	[0086.332] ReadFile (in: hFile=0x340, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.332] WriteFile (in: hFile=0x34c, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.332] SetEndOfFile (hFile=0x34c) returned 1
	[0086.333] CloseHandle (hObject=0x34c) returned 1
	[0086.333] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.333] SetEndOfFile (hFile=0x340) returned 1
	[0086.333] CloseHandle (hObject=0x340) returned 1
	[0086.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1
	[0086.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.334] lstrlenW (lpString=".doc") returned 4
	[0086.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.334] lstrlenW (lpString=".docx") returned 5
	[0086.334] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0086.334] lstrlenW (lpString=".pdf") returned 4
	[0086.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.334] lstrlenW (lpString=".xls") returned 4
	[0086.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.334] lstrlenW (lpString=".xlsx") returned 5
	[0086.334] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0086.334] lstrlenW (lpString=".ppt") returned 4
	[0086.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.334] lstrlenW (lpString=".zip") returned 4
	[0086.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.335] lstrlenW (lpString=".rar") returned 4
	[0086.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.335] lstrlenW (lpString=".bz2") returned 4
	[0086.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.335] lstrlenW (lpString=".7z") returned 3
	[0086.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.335] lstrlenW (lpString=".dbf") returned 4
	[0086.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.335] lstrlenW (lpString=".1cd") returned 4
	[0086.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.335] lstrlenW (lpString=".jpg") returned 4
	[0086.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.335] lstrlenW (lpString=".doc") returned 4
	[0086.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.335] lstrlenW (lpString=".docx") returned 5
	[0086.335] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0086.335] lstrlenW (lpString=".pdf") returned 4
	[0086.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.335] lstrlenW (lpString=".xls") returned 4
	[0086.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.335] lstrlenW (lpString=".xlsx") returned 5
	[0086.335] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0086.335] lstrlenW (lpString=".ppt") returned 4
	[0086.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.336] lstrlenW (lpString=".zip") returned 4
	[0086.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.336] lstrlenW (lpString=".rar") returned 4
	[0086.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.336] lstrlenW (lpString=".bz2") returned 4
	[0086.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.336] lstrlenW (lpString=".7z") returned 3
	[0086.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.336] lstrlenW (lpString=".dbf") returned 4
	[0086.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.336] lstrlenW (lpString=".1cd") returned 4
	[0086.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0086.336] lstrlenW (lpString=".jpg") returned 4
	[0086.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.336] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0086.336] lstrlenW (lpString="J0099179.WMF") returned 12
	[0086.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.337] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=9154) returned 1
	[0086.337] CloseHandle (hObject=0x390) returned 1
	[0086.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220
	[0086.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.338] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.338] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.338] GetLastError () returned 0x0
	[0086.338] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x23c2, lpOverlapped=0x0) returned 1
	[0086.340] WriteFile (in: hFile=0x340, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x23d0, lpOverlapped=0x0) returned 1
	[0086.341] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.341] WriteFile (in: hFile=0x340, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.341] SetEndOfFile (hFile=0x340) returned 1
	[0086.341] CloseHandle (hObject=0x340) returned 1
	[0086.341] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.341] SetEndOfFile (hFile=0x390) returned 1
	[0086.342] CloseHandle (hObject=0x390) returned 1
	[0086.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1
	[0086.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.343] lstrlenW (lpString=".doc") returned 4
	[0086.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.343] lstrlenW (lpString=".docx") returned 5
	[0086.343] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0086.343] lstrlenW (lpString=".pdf") returned 4
	[0086.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.343] lstrlenW (lpString=".xls") returned 4
	[0086.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.343] lstrlenW (lpString=".xlsx") returned 5
	[0086.343] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0086.343] lstrlenW (lpString=".ppt") returned 4
	[0086.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.343] lstrlenW (lpString=".zip") returned 4
	[0086.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.343] lstrlenW (lpString=".rar") returned 4
	[0086.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.343] lstrlenW (lpString=".bz2") returned 4
	[0086.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.343] lstrlenW (lpString=".7z") returned 3
	[0086.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.343] lstrlenW (lpString=".dbf") returned 4
	[0086.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.343] lstrlenW (lpString=".1cd") returned 4
	[0086.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.344] lstrlenW (lpString=".jpg") returned 4
	[0086.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.344] lstrlenW (lpString=".doc") returned 4
	[0086.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.344] lstrlenW (lpString=".docx") returned 5
	[0086.344] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0086.344] lstrlenW (lpString=".pdf") returned 4
	[0086.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.344] lstrlenW (lpString=".xls") returned 4
	[0086.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.344] lstrlenW (lpString=".xlsx") returned 5
	[0086.344] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0086.344] lstrlenW (lpString=".ppt") returned 4
	[0086.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.344] lstrlenW (lpString=".zip") returned 4
	[0086.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.344] lstrlenW (lpString=".rar") returned 4
	[0086.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.344] lstrlenW (lpString=".bz2") returned 4
	[0086.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.345] lstrlenW (lpString=".7z") returned 3
	[0086.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.345] lstrlenW (lpString=".dbf") returned 4
	[0086.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.345] lstrlenW (lpString=".1cd") returned 4
	[0086.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0086.345] lstrlenW (lpString=".jpg") returned 4
	[0086.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.345] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0086.345] lstrlenW (lpString="J0099180.WMF") returned 12
	[0086.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.345] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=3394) returned 1
	[0086.345] CloseHandle (hObject=0x390) returned 1
	[0086.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220
	[0086.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.346] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.346] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.346] GetLastError () returned 0x0
	[0086.346] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xd42, lpOverlapped=0x0) returned 1
	[0086.348] WriteFile (in: hFile=0x340, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xd50, lpOverlapped=0x0) returned 1
	[0086.349] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.349] WriteFile (in: hFile=0x340, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.349] SetEndOfFile (hFile=0x340) returned 1
	[0086.349] CloseHandle (hObject=0x340) returned 1
	[0086.349] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.349] SetEndOfFile (hFile=0x390) returned 1
	[0086.350] CloseHandle (hObject=0x390) returned 1
	[0086.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1
	[0086.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.350] lstrlenW (lpString=".doc") returned 4
	[0086.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.350] lstrlenW (lpString=".docx") returned 5
	[0086.351] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0086.351] lstrlenW (lpString=".pdf") returned 4
	[0086.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.351] lstrlenW (lpString=".xls") returned 4
	[0086.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.351] lstrlenW (lpString=".xlsx") returned 5
	[0086.351] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0086.351] lstrlenW (lpString=".ppt") returned 4
	[0086.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.351] lstrlenW (lpString=".zip") returned 4
	[0086.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.351] lstrlenW (lpString=".rar") returned 4
	[0086.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.351] lstrlenW (lpString=".bz2") returned 4
	[0086.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.351] lstrlenW (lpString=".7z") returned 3
	[0086.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.351] lstrlenW (lpString=".dbf") returned 4
	[0086.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.351] lstrlenW (lpString=".1cd") returned 4
	[0086.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.351] lstrlenW (lpString=".jpg") returned 4
	[0086.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.352] lstrlenW (lpString=".doc") returned 4
	[0086.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.352] lstrlenW (lpString=".docx") returned 5
	[0086.352] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0086.352] lstrlenW (lpString=".pdf") returned 4
	[0086.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.352] lstrlenW (lpString=".xls") returned 4
	[0086.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.352] lstrlenW (lpString=".xlsx") returned 5
	[0086.352] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0086.352] lstrlenW (lpString=".ppt") returned 4
	[0086.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.352] lstrlenW (lpString=".zip") returned 4
	[0086.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.352] lstrlenW (lpString=".rar") returned 4
	[0086.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.352] lstrlenW (lpString=".bz2") returned 4
	[0086.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.352] lstrlenW (lpString=".7z") returned 3
	[0086.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.352] lstrlenW (lpString=".dbf") returned 4
	[0086.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.352] lstrlenW (lpString=".1cd") returned 4
	[0086.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0086.352] lstrlenW (lpString=".jpg") returned 4
	[0086.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.353] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0086.353] lstrlenW (lpString="J0099181.WMF") returned 12
	[0086.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.353] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=1198) returned 1
	[0086.657] CloseHandle (hObject=0x390) returned 1
	[0086.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220
	[0086.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.697] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.697] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0086.697] GetLastError () returned 0x0
	[0086.697] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x4ae, lpOverlapped=0x0) returned 1
	[0086.699] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4b0, lpOverlapped=0x0) returned 1
	[0086.700] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.700] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.700] SetEndOfFile (hFile=0x380) returned 1
	[0086.700] CloseHandle (hObject=0x380) returned 1
	[0086.700] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.700] SetEndOfFile (hFile=0x390) returned 1
	[0086.704] CloseHandle (hObject=0x390) returned 1
	[0086.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1
	[0086.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.704] lstrlenW (lpString=".doc") returned 4
	[0086.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.704] lstrlenW (lpString=".docx") returned 5
	[0086.704] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0086.704] lstrlenW (lpString=".pdf") returned 4
	[0086.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.704] lstrlenW (lpString=".xls") returned 4
	[0086.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.704] lstrlenW (lpString=".xlsx") returned 5
	[0086.704] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0086.704] lstrlenW (lpString=".ppt") returned 4
	[0086.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.705] lstrlenW (lpString=".zip") returned 4
	[0086.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.705] lstrlenW (lpString=".rar") returned 4
	[0086.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.705] lstrlenW (lpString=".bz2") returned 4
	[0086.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.705] lstrlenW (lpString=".7z") returned 3
	[0086.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.705] lstrlenW (lpString=".dbf") returned 4
	[0086.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.705] lstrlenW (lpString=".1cd") returned 4
	[0086.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.705] lstrlenW (lpString=".jpg") returned 4
	[0086.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.705] lstrlenW (lpString=".doc") returned 4
	[0086.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.705] lstrlenW (lpString=".docx") returned 5
	[0086.705] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0086.705] lstrlenW (lpString=".pdf") returned 4
	[0086.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.705] lstrlenW (lpString=".xls") returned 4
	[0086.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.705] lstrlenW (lpString=".xlsx") returned 5
	[0086.706] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0086.706] lstrlenW (lpString=".ppt") returned 4
	[0086.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.706] lstrlenW (lpString=".zip") returned 4
	[0086.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.706] lstrlenW (lpString=".rar") returned 4
	[0086.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.706] lstrlenW (lpString=".bz2") returned 4
	[0086.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.706] lstrlenW (lpString=".7z") returned 3
	[0086.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.706] lstrlenW (lpString=".dbf") returned 4
	[0086.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.706] lstrlenW (lpString=".1cd") returned 4
	[0086.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0086.706] lstrlenW (lpString=".jpg") returned 4
	[0086.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.706] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0086.706] lstrlenW (lpString="J0099190.JPG") returned 12
	[0086.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.707] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=43892) returned 1
	[0086.707] CloseHandle (hObject=0x390) returned 1
	[0086.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220
	[0086.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.708] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.708] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0086.708] GetLastError () returned 0x0
	[0086.708] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xab74, lpOverlapped=0x0) returned 1
	[0086.710] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xab80, lpOverlapped=0x0) returned 1
	[0086.711] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.712] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.712] SetEndOfFile (hFile=0x380) returned 1
	[0086.712] CloseHandle (hObject=0x380) returned 1
	[0086.712] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.712] SetEndOfFile (hFile=0x390) returned 1
	[0086.713] CloseHandle (hObject=0x390) returned 1
	[0086.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1
	[0086.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.714] lstrlenW (lpString=".doc") returned 4
	[0086.714] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.714] lstrlenW (lpString=".docx") returned 5
	[0086.714] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0086.714] lstrlenW (lpString=".pdf") returned 4
	[0086.714] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.714] lstrlenW (lpString=".xls") returned 4
	[0086.714] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.714] lstrlenW (lpString=".xlsx") returned 5
	[0086.714] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0086.714] lstrlenW (lpString=".ppt") returned 4
	[0086.714] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.714] lstrlenW (lpString=".zip") returned 4
	[0086.714] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.714] lstrlenW (lpString=".rar") returned 4
	[0086.714] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.715] lstrlenW (lpString=".bz2") returned 4
	[0086.715] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.715] lstrlenW (lpString=".7z") returned 3
	[0086.715] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.715] lstrlenW (lpString=".dbf") returned 4
	[0086.715] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.715] lstrlenW (lpString=".1cd") returned 4
	[0086.715] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.715] lstrlenW (lpString=".jpg") returned 4
	[0086.715] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.715] lstrlenW (lpString=".doc") returned 4
	[0086.715] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.715] lstrlenW (lpString=".docx") returned 5
	[0086.715] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0086.715] lstrlenW (lpString=".pdf") returned 4
	[0086.715] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.715] lstrlenW (lpString=".xls") returned 4
	[0086.716] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.716] lstrlenW (lpString=".xlsx") returned 5
	[0086.716] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0086.716] lstrlenW (lpString=".ppt") returned 4
	[0086.716] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.716] lstrlenW (lpString=".zip") returned 4
	[0086.716] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.716] lstrlenW (lpString=".rar") returned 4
	[0086.716] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.716] lstrlenW (lpString=".bz2") returned 4
	[0086.716] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.716] lstrlenW (lpString=".7z") returned 3
	[0086.716] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.716] lstrlenW (lpString=".dbf") returned 4
	[0086.716] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.716] lstrlenW (lpString=".1cd") returned 4
	[0086.716] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0086.716] lstrlenW (lpString=".jpg") returned 4
	[0086.716] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.717] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0086.717] lstrlenW (lpString="J0099191.JPG") returned 12
	[0086.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.717] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=62367) returned 1
	[0086.717] CloseHandle (hObject=0x390) returned 1
	[0086.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220
	[0086.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.718] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.718] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0086.718] GetLastError () returned 0x0
	[0086.718] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0xf39f, lpOverlapped=0x0) returned 1
	[0086.720] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xf3a0, lpOverlapped=0x0) returned 1
	[0086.722] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.722] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.722] SetEndOfFile (hFile=0x380) returned 1
	[0086.723] CloseHandle (hObject=0x380) returned 1
	[0086.723] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.723] SetEndOfFile (hFile=0x390) returned 1
	[0086.724] CloseHandle (hObject=0x390) returned 1
	[0086.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1
	[0086.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.724] lstrlenW (lpString=".doc") returned 4
	[0086.724] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.724] lstrlenW (lpString=".docx") returned 5
	[0086.724] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0086.724] lstrlenW (lpString=".pdf") returned 4
	[0086.725] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.725] lstrlenW (lpString=".xls") returned 4
	[0086.725] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.725] lstrlenW (lpString=".xlsx") returned 5
	[0086.725] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0086.725] lstrlenW (lpString=".ppt") returned 4
	[0086.725] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.725] lstrlenW (lpString=".zip") returned 4
	[0086.725] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.725] lstrlenW (lpString=".rar") returned 4
	[0086.725] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.725] lstrlenW (lpString=".bz2") returned 4
	[0086.725] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.725] lstrlenW (lpString=".7z") returned 3
	[0086.725] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.725] lstrlenW (lpString=".dbf") returned 4
	[0086.725] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.725] lstrlenW (lpString=".1cd") returned 4
	[0086.725] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.725] lstrlenW (lpString=".jpg") returned 4
	[0086.725] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.725] lstrlenW (lpString=".doc") returned 4
	[0086.725] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.725] lstrlenW (lpString=".docx") returned 5
	[0086.725] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0086.725] lstrlenW (lpString=".pdf") returned 4
	[0086.726] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.726] lstrlenW (lpString=".xls") returned 4
	[0086.726] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.726] lstrlenW (lpString=".xlsx") returned 5
	[0086.726] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0086.726] lstrlenW (lpString=".ppt") returned 4
	[0086.726] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.726] lstrlenW (lpString=".zip") returned 4
	[0086.726] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.726] lstrlenW (lpString=".rar") returned 4
	[0086.726] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.726] lstrlenW (lpString=".bz2") returned 4
	[0086.726] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.726] lstrlenW (lpString=".7z") returned 3
	[0086.726] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.726] lstrlenW (lpString=".dbf") returned 4
	[0086.726] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.726] lstrlenW (lpString=".1cd") returned 4
	[0086.726] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0086.726] lstrlenW (lpString=".jpg") returned 4
	[0086.726] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.726] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0086.726] lstrlenW (lpString="J0099192.GIF") returned 12
	[0086.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.727] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=17964) returned 1
	[0086.727] CloseHandle (hObject=0x390) returned 1
	[0086.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220
	[0086.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.727] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.727] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0086.728] GetLastError () returned 0x0
	[0086.728] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x462c, lpOverlapped=0x0) returned 1
	[0086.729] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x4630, lpOverlapped=0x0) returned 1
	[0086.730] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.730] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.731] SetEndOfFile (hFile=0x380) returned 1
	[0086.731] CloseHandle (hObject=0x380) returned 1
	[0086.731] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.731] SetEndOfFile (hFile=0x390) returned 1
	[0086.732] CloseHandle (hObject=0x390) returned 1
	[0086.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1
	[0086.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.732] lstrlenW (lpString=".doc") returned 4
	[0086.732] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.732] lstrlenW (lpString=".docx") returned 5
	[0086.732] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0086.732] lstrlenW (lpString=".pdf") returned 4
	[0086.732] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.732] lstrlenW (lpString=".xls") returned 4
	[0086.733] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.733] lstrlenW (lpString=".xlsx") returned 5
	[0086.733] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0086.733] lstrlenW (lpString=".ppt") returned 4
	[0086.733] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.733] lstrlenW (lpString=".zip") returned 4
	[0086.733] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.733] lstrlenW (lpString=".rar") returned 4
	[0086.733] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.733] lstrlenW (lpString=".bz2") returned 4
	[0086.733] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.733] lstrlenW (lpString=".7z") returned 3
	[0086.733] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.733] lstrlenW (lpString=".dbf") returned 4
	[0086.733] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.733] lstrlenW (lpString=".1cd") returned 4
	[0086.733] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.733] lstrlenW (lpString=".jpg") returned 4
	[0086.733] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.733] lstrlenW (lpString=".doc") returned 4
	[0086.733] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.733] lstrlenW (lpString=".docx") returned 5
	[0086.733] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0086.733] lstrlenW (lpString=".pdf") returned 4
	[0086.734] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.734] lstrlenW (lpString=".xls") returned 4
	[0086.734] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.734] lstrlenW (lpString=".xlsx") returned 5
	[0086.734] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0086.734] lstrlenW (lpString=".ppt") returned 4
	[0086.734] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.734] lstrlenW (lpString=".zip") returned 4
	[0086.734] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.734] lstrlenW (lpString=".rar") returned 4
	[0086.734] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.734] lstrlenW (lpString=".bz2") returned 4
	[0086.734] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.734] lstrlenW (lpString=".7z") returned 3
	[0086.734] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.734] lstrlenW (lpString=".dbf") returned 4
	[0086.734] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.734] lstrlenW (lpString=".1cd") returned 4
	[0086.734] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0086.734] lstrlenW (lpString=".jpg") returned 4
	[0086.734] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.734] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0086.734] lstrlenW (lpString="J0099193.GIF") returned 12
	[0086.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.735] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=35546) returned 1
	[0086.735] CloseHandle (hObject=0x390) returned 1
	[0086.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220
	[0086.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.735] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.735] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0086.736] GetLastError () returned 0x0
	[0086.736] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x8ada, lpOverlapped=0x0) returned 1
	[0087.099] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x8ae0, lpOverlapped=0x0) returned 1
	[0087.101] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.101] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.101] SetEndOfFile (hFile=0x380) returned 1
	[0087.101] CloseHandle (hObject=0x380) returned 1
	[0087.101] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.101] SetEndOfFile (hFile=0x390) returned 1
	[0087.102] CloseHandle (hObject=0x390) returned 1
	[0087.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1
	[0087.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.103] lstrlenW (lpString=".doc") returned 4
	[0087.103] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.103] lstrlenW (lpString=".docx") returned 5
	[0087.103] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0087.103] lstrlenW (lpString=".pdf") returned 4
	[0087.103] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.103] lstrlenW (lpString=".xls") returned 4
	[0087.103] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.103] lstrlenW (lpString=".xlsx") returned 5
	[0087.103] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0087.103] lstrlenW (lpString=".ppt") returned 4
	[0087.112] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.112] lstrlenW (lpString=".zip") returned 4
	[0087.112] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.112] lstrlenW (lpString=".rar") returned 4
	[0087.112] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.112] lstrlenW (lpString=".bz2") returned 4
	[0087.112] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.113] lstrlenW (lpString=".7z") returned 3
	[0087.113] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.113] lstrlenW (lpString=".dbf") returned 4
	[0087.113] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.113] lstrlenW (lpString=".1cd") returned 4
	[0087.113] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.113] lstrlenW (lpString=".jpg") returned 4
	[0087.113] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.113] lstrlenW (lpString=".doc") returned 4
	[0087.113] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.113] lstrlenW (lpString=".docx") returned 5
	[0087.113] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0087.114] lstrlenW (lpString=".pdf") returned 4
	[0087.114] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.114] lstrlenW (lpString=".xls") returned 4
	[0087.114] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.114] lstrlenW (lpString=".xlsx") returned 5
	[0087.114] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0087.114] lstrlenW (lpString=".ppt") returned 4
	[0087.114] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.114] lstrlenW (lpString=".zip") returned 4
	[0087.114] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.114] lstrlenW (lpString=".rar") returned 4
	[0087.114] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.114] lstrlenW (lpString=".bz2") returned 4
	[0087.114] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.114] lstrlenW (lpString=".7z") returned 3
	[0087.114] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.114] lstrlenW (lpString=".dbf") returned 4
	[0087.114] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.114] lstrlenW (lpString=".1cd") returned 4
	[0087.114] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0087.115] lstrlenW (lpString=".jpg") returned 4
	[0087.115] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.115] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0087.115] lstrlenW (lpString="J0099205.WMF") returned 12
	[0087.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.116] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=17854) returned 1
	[0087.116] CloseHandle (hObject=0x390) returned 1
	[0087.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220
	[0087.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.116] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.117] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0087.117] GetLastError () returned 0x0
	[0087.117] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x45be, lpOverlapped=0x0) returned 1
	[0087.119] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x45c0, lpOverlapped=0x0) returned 1
	[0087.121] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.121] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.121] SetEndOfFile (hFile=0x380) returned 1
	[0087.121] CloseHandle (hObject=0x380) returned 1
	[0087.121] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.121] SetEndOfFile (hFile=0x390) returned 1
	[0087.122] CloseHandle (hObject=0x390) returned 1
	[0087.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1
	[0087.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.123] lstrlenW (lpString=".doc") returned 4
	[0087.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.123] lstrlenW (lpString=".docx") returned 5
	[0087.123] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0087.123] lstrlenW (lpString=".pdf") returned 4
	[0087.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.123] lstrlenW (lpString=".xls") returned 4
	[0087.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.123] lstrlenW (lpString=".xlsx") returned 5
	[0087.123] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0087.123] lstrlenW (lpString=".ppt") returned 4
	[0087.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.123] lstrlenW (lpString=".zip") returned 4
	[0087.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.123] lstrlenW (lpString=".rar") returned 4
	[0087.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.123] lstrlenW (lpString=".bz2") returned 4
	[0087.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.123] lstrlenW (lpString=".7z") returned 3
	[0087.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.123] lstrlenW (lpString=".dbf") returned 4
	[0087.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.124] lstrlenW (lpString=".1cd") returned 4
	[0087.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.124] lstrlenW (lpString=".jpg") returned 4
	[0087.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.124] lstrlenW (lpString=".doc") returned 4
	[0087.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.124] lstrlenW (lpString=".docx") returned 5
	[0087.124] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0087.124] lstrlenW (lpString=".pdf") returned 4
	[0087.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.124] lstrlenW (lpString=".xls") returned 4
	[0087.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.124] lstrlenW (lpString=".xlsx") returned 5
	[0087.124] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0087.124] lstrlenW (lpString=".ppt") returned 4
	[0087.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.124] lstrlenW (lpString=".zip") returned 4
	[0087.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.124] lstrlenW (lpString=".rar") returned 4
	[0087.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.125] lstrlenW (lpString=".bz2") returned 4
	[0087.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.125] lstrlenW (lpString=".7z") returned 3
	[0087.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.125] lstrlenW (lpString=".dbf") returned 4
	[0087.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.125] lstrlenW (lpString=".1cd") returned 4
	[0087.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0087.125] lstrlenW (lpString=".jpg") returned 4
	[0087.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.125] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0087.125] lstrlenW (lpString="J0101856.BMP") returned 12
	[0087.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.126] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=78840) returned 1
	[0087.126] CloseHandle (hObject=0x390) returned 1
	[0087.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220
	[0087.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.126] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.126] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0087.127] GetLastError () returned 0x0
	[0087.127] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x133f8, lpOverlapped=0x0) returned 1
	[0087.129] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x13400, lpOverlapped=0x0) returned 1
	[0087.131] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.131] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.131] SetEndOfFile (hFile=0x380) returned 1
	[0087.131] CloseHandle (hObject=0x380) returned 1
	[0087.131] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.132] SetEndOfFile (hFile=0x390) returned 1
	[0087.133] CloseHandle (hObject=0x390) returned 1
	[0087.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1
	[0087.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.133] lstrlenW (lpString=".doc") returned 4
	[0087.133] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.134] lstrlenW (lpString=".docx") returned 5
	[0087.134] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0087.134] lstrlenW (lpString=".pdf") returned 4
	[0087.134] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.134] lstrlenW (lpString=".xls") returned 4
	[0087.134] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.134] lstrlenW (lpString=".xlsx") returned 5
	[0087.134] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0087.134] lstrlenW (lpString=".ppt") returned 4
	[0087.134] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.134] lstrlenW (lpString=".zip") returned 4
	[0087.134] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.134] lstrlenW (lpString=".rar") returned 4
	[0087.134] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.134] lstrlenW (lpString=".bz2") returned 4
	[0087.134] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.134] lstrlenW (lpString=".7z") returned 3
	[0087.135] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.135] lstrlenW (lpString=".dbf") returned 4
	[0087.135] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.135] lstrlenW (lpString=".1cd") returned 4
	[0087.135] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.135] lstrlenW (lpString=".jpg") returned 4
	[0087.135] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.135] lstrlenW (lpString=".doc") returned 4
	[0087.135] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.135] lstrlenW (lpString=".docx") returned 5
	[0087.135] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0087.135] lstrlenW (lpString=".pdf") returned 4
	[0087.135] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.136] lstrlenW (lpString=".xls") returned 4
	[0087.136] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.136] lstrlenW (lpString=".xlsx") returned 5
	[0087.136] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0087.136] lstrlenW (lpString=".ppt") returned 4
	[0087.136] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.136] lstrlenW (lpString=".zip") returned 4
	[0087.136] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.136] lstrlenW (lpString=".rar") returned 4
	[0087.136] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.136] lstrlenW (lpString=".bz2") returned 4
	[0087.136] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.136] lstrlenW (lpString=".7z") returned 3
	[0087.136] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.136] lstrlenW (lpString=".dbf") returned 4
	[0087.136] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.136] lstrlenW (lpString=".1cd") returned 4
	[0087.136] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0087.136] lstrlenW (lpString=".jpg") returned 4
	[0087.136] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.137] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0087.137] lstrlenW (lpString="J0101857.BMP") returned 12
	[0087.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.137] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=32184) returned 1
	[0087.137] CloseHandle (hObject=0x390) returned 1
	[0087.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220
	[0087.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.138] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.138] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0087.138] GetLastError () returned 0x0
	[0087.138] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0087.140] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0087.142] ReadFile (in: hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesRead=0x2a2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.142] WriteFile (in: hFile=0x380, lpBuffer=0x3339020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3339020*, lpNumberOfBytesWritten=0x2a2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.142] SetEndOfFile (hFile=0x380) returned 1
	[0087.142] CloseHandle (hObject=0x380) returned 1
	[0087.142] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.142] SetEndOfFile (hFile=0x390) returned 1
	[0087.143] CloseHandle (hObject=0x390) returned 1
	[0087.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1
	[0087.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.144] lstrlenW (lpString=".doc") returned 4
	[0087.144] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.144] lstrlenW (lpString=".docx") returned 5
	[0087.144] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0087.144] lstrlenW (lpString=".pdf") returned 4
	[0087.144] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.144] lstrlenW (lpString=".xls") returned 4
	[0087.144] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.144] lstrlenW (lpString=".xlsx") returned 5
	[0087.144] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0087.144] lstrlenW (lpString=".ppt") returned 4
	[0087.144] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.144] lstrlenW (lpString=".zip") returned 4
	[0087.144] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.144] lstrlenW (lpString=".rar") returned 4
	[0087.144] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.144] lstrlenW (lpString=".bz2") returned 4
	[0087.144] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.144] lstrlenW (lpString=".7z") returned 3
	[0087.144] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.144] lstrlenW (lpString=".dbf") returned 4
	[0087.144] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.144] lstrlenW (lpString=".1cd") returned 4
	[0087.144] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.145] lstrlenW (lpString=".jpg") returned 4
	[0087.145] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.145] lstrlenW (lpString=".doc") returned 4
	[0087.145] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.145] lstrlenW (lpString=".docx") returned 5
	[0087.145] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0087.145] lstrlenW (lpString=".pdf") returned 4
	[0087.145] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.145] lstrlenW (lpString=".xls") returned 4
	[0087.145] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.145] lstrlenW (lpString=".xlsx") returned 5
	[0087.145] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0087.145] lstrlenW (lpString=".ppt") returned 4
	[0087.145] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.145] lstrlenW (lpString=".zip") returned 4
	[0087.145] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.145] lstrlenW (lpString=".rar") returned 4
	[0087.145] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.145] lstrlenW (lpString=".bz2") returned 4
	[0087.145] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.145] lstrlenW (lpString=".7z") returned 3
	[0087.145] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.146] lstrlenW (lpString=".dbf") returned 4
	[0087.146] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.146] lstrlenW (lpString=".1cd") returned 4
	[0087.146] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0087.146] lstrlenW (lpString=".jpg") returned 4
	[0087.146] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.146] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0087.146] lstrlenW (lpString="J0101858.BMP") returned 12
	[0087.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.146] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2a2ff14 | out: lpFileSize=0x2a2ff14*=32184) returned 1
	[0087.146] CloseHandle (hObject=0x390) returned 1
	[0087.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220
	[0087.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.147] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.147] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0087.147] GetLastError () returned 0x0
	[0087.147] ReadFile (hFile=0x390, lpBuffer=0x3339020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a2fecc, lpOverlapped=0x0) 

Thread:
	id = 10
	os_tid = 0xe64

	[0055.897] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x6c2980
	[0055.897] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x6d2988
	[0055.898] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f140
	[0055.898] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x6) returned 0x69f178
	[0055.898] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f200
	[0055.898] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x100000) returned 0x3444020
	[0055.901] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f230
	[0055.901] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f230, Size=0x20) returned 0x631178
	[0055.901] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f158
	[0055.901] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f158, Size=0x20) returned 0x631128
	[0055.901] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0055.901] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0055.901] Wow64DisableWow64FsRedirection (in: OldValue=0x2b6ff50 | out: OldValue=0x2b6ff50*=0x0) returned 1
	[0055.901] lstrlenW (lpString="kernel32.dll") returned 12
	[0055.901] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631178 | out: hHeap=0x600000) returned 1
	[0055.901] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0055.901] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631128 | out: hHeap=0x600000) returned 1
	[0055.902] Sleep (dwMilliseconds=0x64) 
	[0057.284] Sleep (dwMilliseconds=0x64) 
	[0057.631] Sleep (dwMilliseconds=0x64) 
	[0058.008] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0058.008] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0058.008] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0058.073] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=74214) returned 1
	[0058.084] CloseHandle (hObject=0x300) returned 1
	[0058.084] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80
	[0058.084] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.084] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0058.085] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.085] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.085] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0058.085] GetLastError () returned 0x0
	[0058.085] ReadFile (in: hFile=0x300, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x121e6, lpOverlapped=0x0) returned 1
	[0058.100] WriteFile (in: hFile=0x2fc, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x121f0, lpOverlapped=0x0) returned 1
	[0058.102] ReadFile (in: hFile=0x300, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.102] WriteFile (in: hFile=0x2fc, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0058.102] SetEndOfFile (hFile=0x2fc) returned 1
	[0058.102] CloseHandle (hObject=0x2fc) returned 1
	[0058.104] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.104] SetEndOfFile (hFile=0x300) returned 1
	[0058.106] CloseHandle (hObject=0x300) returned 1
	[0058.106] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.108] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1
	[0058.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.109] lstrlenW (lpString=".doc") returned 4
	[0058.109] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.109] lstrlenW (lpString=".docx") returned 5
	[0058.109] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.109] lstrlenW (lpString=".pdf") returned 4
	[0058.109] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.109] lstrlenW (lpString=".xls") returned 4
	[0058.109] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.109] lstrlenW (lpString=".xlsx") returned 5
	[0058.109] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.109] lstrlenW (lpString=".ppt") returned 4
	[0058.109] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.109] lstrlenW (lpString=".zip") returned 4
	[0058.109] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.109] lstrlenW (lpString=".rar") returned 4
	[0058.109] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.110] lstrlenW (lpString=".bz2") returned 4
	[0058.110] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.110] lstrlenW (lpString=".7z") returned 3
	[0058.110] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.110] lstrlenW (lpString=".dbf") returned 4
	[0058.110] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.110] lstrlenW (lpString=".1cd") returned 4
	[0058.110] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.110] lstrlenW (lpString=".jpg") returned 4
	[0058.110] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.110] lstrlenW (lpString=".doc") returned 4
	[0058.110] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.110] lstrlenW (lpString=".docx") returned 5
	[0058.110] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.110] lstrlenW (lpString=".pdf") returned 4
	[0058.110] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.110] lstrlenW (lpString=".xls") returned 4
	[0058.111] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.111] lstrlenW (lpString=".xlsx") returned 5
	[0058.111] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.111] lstrlenW (lpString=".ppt") returned 4
	[0058.111] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.111] lstrlenW (lpString=".zip") returned 4
	[0058.111] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.111] lstrlenW (lpString=".rar") returned 4
	[0058.111] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.111] lstrlenW (lpString=".bz2") returned 4
	[0058.111] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.111] lstrlenW (lpString=".7z") returned 3
	[0058.111] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.111] lstrlenW (lpString=".dbf") returned 4
	[0058.111] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.111] lstrlenW (lpString=".1cd") returned 4
	[0058.111] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0058.111] lstrlenW (lpString=".jpg") returned 4
	[0058.111] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.112] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0058.112] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0058.112] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0058.112] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=77748) returned 1
	[0058.112] CloseHandle (hObject=0x300) returned 1
	[0058.112] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80
	[0058.112] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.112] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0058.112] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.112] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.112] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0058.114] GetLastError () returned 0x0
	[0058.114] ReadFile (in: hFile=0x300, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x12fb4, lpOverlapped=0x0) returned 1
	[0058.650] WriteFile (in: hFile=0x2fc, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x12fc0, lpOverlapped=0x0) returned 1
	[0058.652] ReadFile (in: hFile=0x300, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.654] WriteFile (in: hFile=0x2fc, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0058.654] SetEndOfFile (hFile=0x2fc) returned 1
	[0058.655] CloseHandle (hObject=0x2fc) returned 1
	[0058.656] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.657] SetEndOfFile (hFile=0x300) returned 1
	[0058.658] CloseHandle (hObject=0x300) returned 1
	[0058.658] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.659] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1
	[0058.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.659] lstrlenW (lpString=".doc") returned 4
	[0058.659] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.659] lstrlenW (lpString=".docx") returned 5
	[0058.659] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.659] lstrlenW (lpString=".pdf") returned 4
	[0058.659] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.659] lstrlenW (lpString=".xls") returned 4
	[0058.659] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.659] lstrlenW (lpString=".xlsx") returned 5
	[0058.659] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.659] lstrlenW (lpString=".ppt") returned 4
	[0058.659] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.660] lstrlenW (lpString=".zip") returned 4
	[0058.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.660] lstrlenW (lpString=".rar") returned 4
	[0058.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.660] lstrlenW (lpString=".bz2") returned 4
	[0058.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.660] lstrlenW (lpString=".7z") returned 3
	[0058.660] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.660] lstrlenW (lpString=".dbf") returned 4
	[0058.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.660] lstrlenW (lpString=".1cd") returned 4
	[0058.660] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.660] lstrlenW (lpString=".jpg") returned 4
	[0058.660] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.660] lstrlenW (lpString=".doc") returned 4
	[0058.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.660] lstrlenW (lpString=".docx") returned 5
	[0058.660] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.660] lstrlenW (lpString=".pdf") returned 4
	[0058.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.661] lstrlenW (lpString=".xls") returned 4
	[0058.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.661] lstrlenW (lpString=".xlsx") returned 5
	[0058.661] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.661] lstrlenW (lpString=".ppt") returned 4
	[0058.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.661] lstrlenW (lpString=".zip") returned 4
	[0058.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.661] lstrlenW (lpString=".rar") returned 4
	[0058.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.661] lstrlenW (lpString=".bz2") returned 4
	[0058.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.661] lstrlenW (lpString=".7z") returned 3
	[0058.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.662] lstrlenW (lpString=".dbf") returned 4
	[0058.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.662] lstrlenW (lpString=".1cd") returned 4
	[0058.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0058.662] lstrlenW (lpString=".jpg") returned 4
	[0058.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.662] Sleep (dwMilliseconds=0x64) 
	[0059.210] Sleep (dwMilliseconds=0x64) 
	[0059.540] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0059.540] lstrlenW (lpString="eula.rtf") returned 8
	[0059.540] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0059.556] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=4254) returned 1
	[0059.556] CloseHandle (hObject=0x324) returned 1
	[0059.556] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80
	[0059.556] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.556] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0059.556] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.556] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.556] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0059.573] GetLastError () returned 0x0
	[0059.573] ReadFile (in: hFile=0x324, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x109e, lpOverlapped=0x0) returned 1
	[0059.579] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x10a0, lpOverlapped=0x0) returned 1
	[0059.580] ReadFile (in: hFile=0x324, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.580] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0059.580] SetEndOfFile (hFile=0x320) returned 1
	[0059.580] CloseHandle (hObject=0x320) returned 1
	[0059.581] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.581] SetEndOfFile (hFile=0x324) returned 1
	[0059.582] CloseHandle (hObject=0x324) returned 1
	[0059.582] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.582] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1
	[0059.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.582] lstrlenW (lpString=".doc") returned 4
	[0059.583] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.583] lstrlenW (lpString=".docx") returned 5
	[0059.583] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.583] lstrlenW (lpString=".pdf") returned 4
	[0059.583] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.583] lstrlenW (lpString=".xls") returned 4
	[0059.583] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.583] lstrlenW (lpString=".xlsx") returned 5
	[0059.583] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.583] lstrlenW (lpString=".ppt") returned 4
	[0059.583] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.583] lstrlenW (lpString=".zip") returned 4
	[0059.583] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.583] lstrlenW (lpString=".rar") returned 4
	[0059.583] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.583] lstrlenW (lpString=".bz2") returned 4
	[0059.583] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.583] lstrlenW (lpString=".7z") returned 3
	[0059.583] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.583] lstrlenW (lpString=".dbf") returned 4
	[0059.583] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.583] lstrlenW (lpString=".1cd") returned 4
	[0059.583] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.583] lstrlenW (lpString=".jpg") returned 4
	[0059.584] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.584] lstrlenW (lpString=".doc") returned 4
	[0059.584] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.584] lstrlenW (lpString=".docx") returned 5
	[0059.584] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.584] lstrlenW (lpString=".pdf") returned 4
	[0059.584] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.584] lstrlenW (lpString=".xls") returned 4
	[0059.584] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.584] lstrlenW (lpString=".xlsx") returned 5
	[0059.584] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.584] lstrlenW (lpString=".ppt") returned 4
	[0059.584] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.584] lstrlenW (lpString=".zip") returned 4
	[0059.584] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.584] lstrlenW (lpString=".rar") returned 4
	[0059.584] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.584] lstrlenW (lpString=".bz2") returned 4
	[0059.584] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.584] lstrlenW (lpString=".7z") returned 3
	[0059.584] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.584] lstrlenW (lpString=".dbf") returned 4
	[0059.584] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.585] lstrlenW (lpString=".1cd") returned 4
	[0059.585] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0059.585] lstrlenW (lpString=".jpg") returned 4
	[0059.585] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.585] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0059.585] lstrlenW (lpString="eula.rtf") returned 8
	[0059.585] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.599] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3643) returned 1
	[0059.599] CloseHandle (hObject=0x314) returned 1
	[0059.599] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80
	[0059.599] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.599] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.599] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.599] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.599] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0059.601] GetLastError () returned 0x0
	[0059.601] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xe3b, lpOverlapped=0x0) returned 1
	[0059.604] WriteFile (in: hFile=0x324, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe40, lpOverlapped=0x0) returned 1
	[0059.607] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.607] WriteFile (in: hFile=0x324, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0059.607] SetEndOfFile (hFile=0x324) returned 1
	[0059.607] CloseHandle (hObject=0x324) returned 1
	[0059.608] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.608] SetEndOfFile (hFile=0x314) returned 1
	[0059.609] CloseHandle (hObject=0x314) returned 1
	[0059.609] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.610] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1
	[0059.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.610] lstrlenW (lpString=".doc") returned 4
	[0059.610] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.610] lstrlenW (lpString=".docx") returned 5
	[0059.610] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.610] lstrlenW (lpString=".pdf") returned 4
	[0059.610] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.610] lstrlenW (lpString=".xls") returned 4
	[0059.610] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.610] lstrlenW (lpString=".xlsx") returned 5
	[0059.610] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.610] lstrlenW (lpString=".ppt") returned 4
	[0059.610] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.611] lstrlenW (lpString=".zip") returned 4
	[0059.611] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.611] lstrlenW (lpString=".rar") returned 4
	[0059.611] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.611] lstrlenW (lpString=".bz2") returned 4
	[0059.611] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.611] lstrlenW (lpString=".7z") returned 3
	[0059.611] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.611] lstrlenW (lpString=".dbf") returned 4
	[0059.611] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.611] lstrlenW (lpString=".1cd") returned 4
	[0059.611] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.611] lstrlenW (lpString=".jpg") returned 4
	[0059.611] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.611] lstrlenW (lpString=".doc") returned 4
	[0059.611] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.611] lstrlenW (lpString=".docx") returned 5
	[0059.611] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.611] lstrlenW (lpString=".pdf") returned 4
	[0059.612] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.612] lstrlenW (lpString=".xls") returned 4
	[0059.612] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.612] lstrlenW (lpString=".xlsx") returned 5
	[0059.612] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.612] lstrlenW (lpString=".ppt") returned 4
	[0059.612] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.612] lstrlenW (lpString=".zip") returned 4
	[0059.612] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.612] lstrlenW (lpString=".rar") returned 4
	[0059.612] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.612] lstrlenW (lpString=".bz2") returned 4
	[0059.612] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.612] lstrlenW (lpString=".7z") returned 3
	[0059.612] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.612] lstrlenW (lpString=".dbf") returned 4
	[0059.612] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.612] lstrlenW (lpString=".1cd") returned 4
	[0059.612] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0059.612] lstrlenW (lpString=".jpg") returned 4
	[0059.612] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.613] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0059.613] lstrlenW (lpString="eula.rtf") returned 8
	[0059.613] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.613] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=10125) returned 1
	[0059.613] CloseHandle (hObject=0x314) returned 1
	[0059.613] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80
	[0059.613] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.613] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.613] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.613] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.613] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0059.629] GetLastError () returned 0x0
	[0059.629] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x278d, lpOverlapped=0x0) returned 1
	[0059.631] WriteFile (in: hFile=0x324, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2790, lpOverlapped=0x0) returned 1
	[0059.632] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.632] WriteFile (in: hFile=0x324, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0059.632] SetEndOfFile (hFile=0x324) returned 1
	[0059.633] CloseHandle (hObject=0x324) returned 1
	[0059.633] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.633] SetEndOfFile (hFile=0x314) returned 1
	[0059.634] CloseHandle (hObject=0x314) returned 1
	[0059.634] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.635] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1
	[0059.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.635] lstrlenW (lpString=".doc") returned 4
	[0059.635] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.635] lstrlenW (lpString=".docx") returned 5
	[0059.635] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.635] lstrlenW (lpString=".pdf") returned 4
	[0059.635] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.635] lstrlenW (lpString=".xls") returned 4
	[0059.635] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.635] lstrlenW (lpString=".xlsx") returned 5
	[0059.635] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.635] lstrlenW (lpString=".ppt") returned 4
	[0059.635] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.635] lstrlenW (lpString=".zip") returned 4
	[0059.635] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.635] lstrlenW (lpString=".rar") returned 4
	[0059.636] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.636] lstrlenW (lpString=".bz2") returned 4
	[0059.636] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.636] lstrlenW (lpString=".7z") returned 3
	[0059.636] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.636] lstrlenW (lpString=".dbf") returned 4
	[0059.636] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.636] lstrlenW (lpString=".1cd") returned 4
	[0059.636] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.636] lstrlenW (lpString=".jpg") returned 4
	[0059.636] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.636] lstrlenW (lpString=".doc") returned 4
	[0059.636] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.636] lstrlenW (lpString=".docx") returned 5
	[0059.636] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.636] lstrlenW (lpString=".pdf") returned 4
	[0059.636] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.637] lstrlenW (lpString=".xls") returned 4
	[0059.637] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.637] lstrlenW (lpString=".xlsx") returned 5
	[0059.637] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.637] lstrlenW (lpString=".ppt") returned 4
	[0059.637] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.637] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.637] lstrlenW (lpString=".zip") returned 4
	[0059.637] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.637] lstrlenW (lpString=".rar") returned 4
	[0059.637] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.637] lstrlenW (lpString=".bz2") returned 4
	[0059.637] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.637] lstrlenW (lpString=".7z") returned 3
	[0059.637] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.637] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.637] lstrlenW (lpString=".dbf") returned 4
	[0059.637] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.637] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.637] lstrlenW (lpString=".1cd") returned 4
	[0059.637] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.637] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0059.637] lstrlenW (lpString=".jpg") returned 4
	[0059.637] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.638] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0059.638] lstrlenW (lpString="eula.rtf") returned 8
	[0059.638] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.638] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=12687) returned 1
	[0059.638] CloseHandle (hObject=0x314) returned 1
	[0059.638] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80
	[0059.638] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.638] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.638] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.639] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.639] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0059.640] GetLastError () returned 0x0
	[0059.640] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x318f, lpOverlapped=0x0) returned 1
	[0059.642] WriteFile (in: hFile=0x324, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x3190, lpOverlapped=0x0) returned 1
	[0059.643] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.643] WriteFile (in: hFile=0x324, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0059.643] SetEndOfFile (hFile=0x324) returned 1
	[0059.644] CloseHandle (hObject=0x324) returned 1
	[0059.645] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.645] SetEndOfFile (hFile=0x314) returned 1
	[0059.646] CloseHandle (hObject=0x314) returned 1
	[0059.646] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.646] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1
	[0059.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.646] lstrlenW (lpString=".doc") returned 4
	[0059.646] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.647] lstrlenW (lpString=".docx") returned 5
	[0059.647] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.647] lstrlenW (lpString=".pdf") returned 4
	[0059.647] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.647] lstrlenW (lpString=".xls") returned 4
	[0059.647] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.647] lstrlenW (lpString=".xlsx") returned 5
	[0059.647] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.647] lstrlenW (lpString=".ppt") returned 4
	[0059.647] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.647] lstrlenW (lpString=".zip") returned 4
	[0059.647] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.647] lstrlenW (lpString=".rar") returned 4
	[0059.647] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.647] lstrlenW (lpString=".bz2") returned 4
	[0059.647] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.647] lstrlenW (lpString=".7z") returned 3
	[0059.647] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.647] lstrlenW (lpString=".dbf") returned 4
	[0059.647] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.647] lstrlenW (lpString=".1cd") returned 4
	[0059.647] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.648] lstrlenW (lpString=".jpg") returned 4
	[0059.648] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.648] lstrlenW (lpString=".doc") returned 4
	[0059.648] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.648] lstrlenW (lpString=".docx") returned 5
	[0059.648] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.648] lstrlenW (lpString=".pdf") returned 4
	[0059.648] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.648] lstrlenW (lpString=".xls") returned 4
	[0059.648] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.648] lstrlenW (lpString=".xlsx") returned 5
	[0059.648] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.648] lstrlenW (lpString=".ppt") returned 4
	[0059.648] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.648] lstrlenW (lpString=".zip") returned 4
	[0059.648] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.648] lstrlenW (lpString=".rar") returned 4
	[0059.648] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.648] lstrlenW (lpString=".bz2") returned 4
	[0059.649] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.649] lstrlenW (lpString=".7z") returned 3
	[0059.649] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.649] lstrlenW (lpString=".dbf") returned 4
	[0059.649] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.649] lstrlenW (lpString=".1cd") returned 4
	[0059.649] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0059.649] lstrlenW (lpString=".jpg") returned 4
	[0059.649] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.649] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0059.649] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0059.649] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.649] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=65238) returned 1
	[0059.650] CloseHandle (hObject=0x314) returned 1
	[0059.650] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80
	[0059.650] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.650] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.650] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.650] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.650] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0059.650] GetLastError () returned 0x0
	[0059.650] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xfed6, lpOverlapped=0x0) returned 1
	[0059.653] WriteFile (in: hFile=0x324, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xfee0, lpOverlapped=0x0) returned 1
	[0059.655] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.656] WriteFile (in: hFile=0x324, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0059.656] SetEndOfFile (hFile=0x324) returned 1
	[0059.656] CloseHandle (hObject=0x324) returned 1
	[0059.658] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.658] SetEndOfFile (hFile=0x314) returned 1
	[0059.659] CloseHandle (hObject=0x314) returned 1
	[0059.659] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.660] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1
	[0059.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.660] lstrlenW (lpString=".doc") returned 4
	[0059.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.660] lstrlenW (lpString=".docx") returned 5
	[0059.660] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.660] lstrlenW (lpString=".pdf") returned 4
	[0059.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.660] lstrlenW (lpString=".xls") returned 4
	[0059.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.660] lstrlenW (lpString=".xlsx") returned 5
	[0059.660] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.660] lstrlenW (lpString=".ppt") returned 4
	[0059.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.660] lstrlenW (lpString=".zip") returned 4
	[0059.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.661] lstrlenW (lpString=".rar") returned 4
	[0059.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.661] lstrlenW (lpString=".bz2") returned 4
	[0059.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.661] lstrlenW (lpString=".7z") returned 3
	[0059.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.661] lstrlenW (lpString=".dbf") returned 4
	[0059.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.661] lstrlenW (lpString=".1cd") returned 4
	[0059.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.661] lstrlenW (lpString=".jpg") returned 4
	[0059.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.661] lstrlenW (lpString=".doc") returned 4
	[0059.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.661] lstrlenW (lpString=".docx") returned 5
	[0059.661] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.661] lstrlenW (lpString=".pdf") returned 4
	[0059.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.661] lstrlenW (lpString=".xls") returned 4
	[0059.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.661] lstrlenW (lpString=".xlsx") returned 5
	[0059.661] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.661] lstrlenW (lpString=".ppt") returned 4
	[0059.662] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.662] lstrlenW (lpString=".zip") returned 4
	[0059.662] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.662] lstrlenW (lpString=".rar") returned 4
	[0059.662] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.662] lstrlenW (lpString=".bz2") returned 4
	[0059.662] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.662] lstrlenW (lpString=".7z") returned 3
	[0059.662] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.662] lstrlenW (lpString=".dbf") returned 4
	[0059.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.662] lstrlenW (lpString=".1cd") returned 4
	[0059.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0059.662] lstrlenW (lpString=".jpg") returned 4
	[0059.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.662] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0059.662] lstrlenW (lpString="eula.rtf") returned 8
	[0059.663] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0059.918] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3546) returned 1
	[0059.918] CloseHandle (hObject=0x340) returned 1
	[0059.918] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80
	[0059.918] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.920] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0059.920] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.920] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.921] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0059.925] GetLastError () returned 0x0
	[0059.925] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xdda, lpOverlapped=0x0) returned 1
	[0059.937] WriteFile (in: hFile=0x348, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xde0, lpOverlapped=0x0) returned 1
	[0059.937] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.938] WriteFile (in: hFile=0x348, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0059.938] SetEndOfFile (hFile=0x348) returned 1
	[0059.938] CloseHandle (hObject=0x348) returned 1
	[0059.938] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.938] SetEndOfFile (hFile=0x344) returned 1
	[0059.939] CloseHandle (hObject=0x344) returned 1
	[0059.939] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.943] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1
	[0059.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.943] lstrlenW (lpString=".doc") returned 4
	[0059.943] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.944] lstrlenW (lpString=".docx") returned 5
	[0059.944] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.944] lstrlenW (lpString=".pdf") returned 4
	[0059.944] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.944] lstrlenW (lpString=".xls") returned 4
	[0059.944] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.944] lstrlenW (lpString=".xlsx") returned 5
	[0059.944] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.944] lstrlenW (lpString=".ppt") returned 4
	[0059.944] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.944] lstrlenW (lpString=".zip") returned 4
	[0059.944] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.944] lstrlenW (lpString=".rar") returned 4
	[0059.944] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.944] lstrlenW (lpString=".bz2") returned 4
	[0059.944] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.944] lstrlenW (lpString=".7z") returned 3
	[0059.944] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.944] lstrlenW (lpString=".dbf") returned 4
	[0059.944] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.944] lstrlenW (lpString=".1cd") returned 4
	[0059.944] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.944] lstrlenW (lpString=".jpg") returned 4
	[0059.944] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.945] lstrlenW (lpString=".doc") returned 4
	[0059.945] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.945] lstrlenW (lpString=".docx") returned 5
	[0059.945] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.945] lstrlenW (lpString=".pdf") returned 4
	[0059.945] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.945] lstrlenW (lpString=".xls") returned 4
	[0059.945] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0059.945] lstrlenW (lpString=".xlsx") returned 5
	[0059.945] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0059.945] lstrlenW (lpString=".ppt") returned 4
	[0059.945] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.945] lstrlenW (lpString=".zip") returned 4
	[0059.945] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0059.945] lstrlenW (lpString=".rar") returned 4
	[0059.945] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.945] lstrlenW (lpString=".bz2") returned 4
	[0059.945] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.945] lstrlenW (lpString=".7z") returned 3
	[0059.945] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.945] lstrlenW (lpString=".dbf") returned 4
	[0059.945] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.945] lstrlenW (lpString=".1cd") returned 4
	[0059.945] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0059.946] lstrlenW (lpString=".jpg") returned 4
	[0059.946] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.946] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0059.946] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0059.946] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0059.946] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=79296) returned 1
	[0059.946] CloseHandle (hObject=0x344) returned 1
	[0059.946] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80
	[0059.946] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.946] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0059.946] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.947] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.947] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0059.947] GetLastError () returned 0x0
	[0059.947] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x135c0, lpOverlapped=0x0) returned 1
	[0059.958] WriteFile (in: hFile=0x348, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x135d0, lpOverlapped=0x0) returned 1
	[0059.960] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.960] WriteFile (in: hFile=0x348, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0059.960] SetEndOfFile (hFile=0x348) returned 1
	[0059.960] CloseHandle (hObject=0x348) returned 1
	[0059.962] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.962] SetEndOfFile (hFile=0x344) returned 1
	[0059.963] CloseHandle (hObject=0x344) returned 1
	[0059.963] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.964] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1
	[0059.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.964] lstrlenW (lpString=".doc") returned 4
	[0059.964] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.964] lstrlenW (lpString=".docx") returned 5
	[0059.964] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.964] lstrlenW (lpString=".pdf") returned 4
	[0059.964] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.964] lstrlenW (lpString=".xls") returned 4
	[0059.964] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.964] lstrlenW (lpString=".xlsx") returned 5
	[0059.964] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.964] lstrlenW (lpString=".ppt") returned 4
	[0059.964] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.965] lstrlenW (lpString=".zip") returned 4
	[0059.965] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.965] lstrlenW (lpString=".rar") returned 4
	[0059.965] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.965] lstrlenW (lpString=".bz2") returned 4
	[0059.965] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.965] lstrlenW (lpString=".7z") returned 3
	[0059.965] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.965] lstrlenW (lpString=".dbf") returned 4
	[0059.965] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.965] lstrlenW (lpString=".1cd") returned 4
	[0059.965] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.965] lstrlenW (lpString=".jpg") returned 4
	[0059.965] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.965] lstrlenW (lpString=".doc") returned 4
	[0059.965] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.965] lstrlenW (lpString=".docx") returned 5
	[0059.965] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.965] lstrlenW (lpString=".pdf") returned 4
	[0059.965] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.965] lstrlenW (lpString=".xls") returned 4
	[0059.966] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.966] lstrlenW (lpString=".xlsx") returned 5
	[0059.966] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.966] lstrlenW (lpString=".ppt") returned 4
	[0059.966] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.966] lstrlenW (lpString=".zip") returned 4
	[0059.966] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.966] lstrlenW (lpString=".rar") returned 4
	[0059.966] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.966] lstrlenW (lpString=".bz2") returned 4
	[0059.966] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.966] lstrlenW (lpString=".7z") returned 3
	[0059.966] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.966] lstrlenW (lpString=".dbf") returned 4
	[0059.966] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.966] lstrlenW (lpString=".1cd") returned 4
	[0059.966] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0059.966] lstrlenW (lpString=".jpg") returned 4
	[0059.966] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.967] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0059.967] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0059.967] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0059.968] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=82374) returned 1
	[0059.968] CloseHandle (hObject=0x344) returned 1
	[0059.968] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80
	[0059.968] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.968] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0059.968] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.968] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.968] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0059.969] GetLastError () returned 0x0
	[0059.969] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x141c6, lpOverlapped=0x0) returned 1
	[0059.971] WriteFile (in: hFile=0x348, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x141d0, lpOverlapped=0x0) returned 1
	[0059.974] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.975] WriteFile (in: hFile=0x348, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0059.975] SetEndOfFile (hFile=0x348) returned 1
	[0059.975] CloseHandle (hObject=0x348) returned 1
	[0059.977] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.977] SetEndOfFile (hFile=0x344) returned 1
	[0059.978] CloseHandle (hObject=0x344) returned 1
	[0059.978] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.979] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1
	[0059.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0059.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0059.979] lstrlenW (lpString=".doc") returned 4
	[0059.979] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.979] lstrlenW (lpString=".docx") returned 5
	[0059.979] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.979] lstrlenW (lpString=".pdf") returned 4
	[0059.979] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.979] lstrlenW (lpString=".xls") returned 4
	[0059.979] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.979] lstrlenW (lpString=".xlsx") returned 5
	[0059.979] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.979] lstrlenW (lpString=".ppt") returned 4
	[0060.393] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0060.393] lstrlenW (lpString=".zip") returned 4
	[0060.393] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.393] lstrlenW (lpString=".rar") returned 4
	[0060.393] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.393] lstrlenW (lpString=".bz2") returned 4
	[0060.393] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.393] lstrlenW (lpString=".7z") returned 3
	[0060.393] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0060.393] lstrlenW (lpString=".dbf") returned 4
	[0060.393] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0060.393] lstrlenW (lpString=".1cd") returned 4
	[0060.394] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0060.394] lstrlenW (lpString=".jpg") returned 4
	[0060.394] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0060.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0060.394] lstrlenW (lpString=".doc") returned 4
	[0060.394] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.394] lstrlenW (lpString=".docx") returned 5
	[0060.394] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.394] lstrlenW (lpString=".pdf") returned 4
	[0060.394] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.394] lstrlenW (lpString=".xls") returned 4
	[0060.394] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.394] lstrlenW (lpString=".xlsx") returned 5
	[0060.394] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.394] lstrlenW (lpString=".ppt") returned 4
	[0060.394] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0060.394] lstrlenW (lpString=".zip") returned 4
	[0060.395] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.395] lstrlenW (lpString=".rar") returned 4
	[0060.395] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.395] lstrlenW (lpString=".bz2") returned 4
	[0060.395] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.395] lstrlenW (lpString=".7z") returned 3
	[0060.395] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0060.395] lstrlenW (lpString=".dbf") returned 4
	[0060.395] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0060.395] lstrlenW (lpString=".1cd") returned 4
	[0060.395] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0060.395] lstrlenW (lpString=".jpg") returned 4
	[0060.395] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.395] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0060.396] lstrlenW (lpString="eula.rtf") returned 8
	[0060.396] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.397] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=4015) returned 1
	[0060.397] CloseHandle (hObject=0x318) returned 1
	[0060.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80
	[0060.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.397] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.397] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.400] GetLastError () returned 0x0
	[0060.400] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xfaf, lpOverlapped=0x0) returned 1
	[0060.402] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xfb0, lpOverlapped=0x0) returned 1
	[0060.403] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.403] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.403] SetEndOfFile (hFile=0x320) returned 1
	[0060.403] CloseHandle (hObject=0x320) returned 1
	[0060.404] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.404] SetEndOfFile (hFile=0x318) returned 1
	[0060.405] CloseHandle (hObject=0x318) returned 1
	[0060.405] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.406] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1
	[0060.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.406] lstrlenW (lpString=".doc") returned 4
	[0060.406] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.406] lstrlenW (lpString=".docx") returned 5
	[0060.406] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.406] lstrlenW (lpString=".pdf") returned 4
	[0060.406] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.407] lstrlenW (lpString=".xls") returned 4
	[0060.407] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.407] lstrlenW (lpString=".xlsx") returned 5
	[0060.407] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.407] lstrlenW (lpString=".ppt") returned 4
	[0060.407] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.407] lstrlenW (lpString=".zip") returned 4
	[0060.407] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.407] lstrlenW (lpString=".rar") returned 4
	[0060.407] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.407] lstrlenW (lpString=".bz2") returned 4
	[0060.407] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.407] lstrlenW (lpString=".7z") returned 3
	[0060.407] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.407] lstrlenW (lpString=".dbf") returned 4
	[0060.407] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.407] lstrlenW (lpString=".1cd") returned 4
	[0060.407] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.407] lstrlenW (lpString=".jpg") returned 4
	[0060.407] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.408] lstrlenW (lpString=".doc") returned 4
	[0060.408] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.408] lstrlenW (lpString=".docx") returned 5
	[0060.408] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.408] lstrlenW (lpString=".pdf") returned 4
	[0060.408] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.408] lstrlenW (lpString=".xls") returned 4
	[0060.408] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.408] lstrlenW (lpString=".xlsx") returned 5
	[0060.408] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.408] lstrlenW (lpString=".ppt") returned 4
	[0060.408] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.408] lstrlenW (lpString=".zip") returned 4
	[0060.408] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.408] lstrlenW (lpString=".rar") returned 4
	[0060.408] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.408] lstrlenW (lpString=".bz2") returned 4
	[0060.409] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.409] lstrlenW (lpString=".7z") returned 3
	[0060.409] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.409] lstrlenW (lpString=".dbf") returned 4
	[0060.409] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.409] lstrlenW (lpString=".1cd") returned 4
	[0060.409] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0060.409] lstrlenW (lpString=".jpg") returned 4
	[0060.409] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.409] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.409] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.409] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.409] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=80254) returned 1
	[0060.409] CloseHandle (hObject=0x318) returned 1
	[0060.410] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80
	[0060.410] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.410] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.410] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.410] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.410] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.410] GetLastError () returned 0x0
	[0060.410] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1397e, lpOverlapped=0x0) returned 1
	[0060.413] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13980, lpOverlapped=0x0) returned 1
	[0060.415] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.415] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.415] SetEndOfFile (hFile=0x320) returned 1
	[0060.415] CloseHandle (hObject=0x320) returned 1
	[0060.418] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.418] SetEndOfFile (hFile=0x318) returned 1
	[0060.419] CloseHandle (hObject=0x318) returned 1
	[0060.419] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.420] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1
	[0060.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.420] lstrlenW (lpString=".doc") returned 4
	[0060.420] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.420] lstrlenW (lpString=".docx") returned 5
	[0060.420] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.420] lstrlenW (lpString=".pdf") returned 4
	[0060.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.420] lstrlenW (lpString=".xls") returned 4
	[0060.420] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.420] lstrlenW (lpString=".xlsx") returned 5
	[0060.420] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.420] lstrlenW (lpString=".ppt") returned 4
	[0060.420] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.421] lstrlenW (lpString=".zip") returned 4
	[0060.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.421] lstrlenW (lpString=".rar") returned 4
	[0060.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.421] lstrlenW (lpString=".bz2") returned 4
	[0060.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.421] lstrlenW (lpString=".7z") returned 3
	[0060.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.421] lstrlenW (lpString=".dbf") returned 4
	[0060.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.421] lstrlenW (lpString=".1cd") returned 4
	[0060.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.421] lstrlenW (lpString=".jpg") returned 4
	[0060.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.421] lstrlenW (lpString=".doc") returned 4
	[0060.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.421] lstrlenW (lpString=".docx") returned 5
	[0060.421] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.421] lstrlenW (lpString=".pdf") returned 4
	[0060.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.421] lstrlenW (lpString=".xls") returned 4
	[0060.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.422] lstrlenW (lpString=".xlsx") returned 5
	[0060.422] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.422] lstrlenW (lpString=".ppt") returned 4
	[0060.422] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.422] lstrlenW (lpString=".zip") returned 4
	[0060.422] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.422] lstrlenW (lpString=".rar") returned 4
	[0060.422] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.422] lstrlenW (lpString=".bz2") returned 4
	[0060.422] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.422] lstrlenW (lpString=".7z") returned 3
	[0060.422] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.422] lstrlenW (lpString=".dbf") returned 4
	[0060.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.422] lstrlenW (lpString=".1cd") returned 4
	[0060.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0060.422] lstrlenW (lpString=".jpg") returned 4
	[0060.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.422] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0060.422] lstrlenW (lpString="eula.rtf") returned 8
	[0060.422] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.423] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=6309) returned 1
	[0060.423] CloseHandle (hObject=0x318) returned 1
	[0060.423] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80
	[0060.423] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.423] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.423] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.423] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.423] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.425] GetLastError () returned 0x0
	[0060.425] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x18a5, lpOverlapped=0x0) returned 1
	[0060.426] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x18b0, lpOverlapped=0x0) returned 1
	[0060.427] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.427] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.427] SetEndOfFile (hFile=0x320) returned 1
	[0060.428] CloseHandle (hObject=0x320) returned 1
	[0060.428] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.428] SetEndOfFile (hFile=0x318) returned 1
	[0060.429] CloseHandle (hObject=0x318) returned 1
	[0060.430] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.430] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1
	[0060.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.430] lstrlenW (lpString=".doc") returned 4
	[0060.430] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.430] lstrlenW (lpString=".docx") returned 5
	[0060.430] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.430] lstrlenW (lpString=".pdf") returned 4
	[0060.430] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.430] lstrlenW (lpString=".xls") returned 4
	[0060.430] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.431] lstrlenW (lpString=".xlsx") returned 5
	[0060.431] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.431] lstrlenW (lpString=".ppt") returned 4
	[0060.431] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.431] lstrlenW (lpString=".zip") returned 4
	[0060.431] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.431] lstrlenW (lpString=".rar") returned 4
	[0060.431] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.431] lstrlenW (lpString=".bz2") returned 4
	[0060.431] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.431] lstrlenW (lpString=".7z") returned 3
	[0060.431] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.431] lstrlenW (lpString=".dbf") returned 4
	[0060.431] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.431] lstrlenW (lpString=".1cd") returned 4
	[0060.431] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.431] lstrlenW (lpString=".jpg") returned 4
	[0060.431] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.432] lstrlenW (lpString=".doc") returned 4
	[0060.432] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.432] lstrlenW (lpString=".docx") returned 5
	[0060.432] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.432] lstrlenW (lpString=".pdf") returned 4
	[0060.432] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.432] lstrlenW (lpString=".xls") returned 4
	[0060.432] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.432] lstrlenW (lpString=".xlsx") returned 5
	[0060.432] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.432] lstrlenW (lpString=".ppt") returned 4
	[0060.432] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.432] lstrlenW (lpString=".zip") returned 4
	[0060.432] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.432] lstrlenW (lpString=".rar") returned 4
	[0060.432] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.432] lstrlenW (lpString=".bz2") returned 4
	[0060.432] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.432] lstrlenW (lpString=".7z") returned 3
	[0060.882] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.882] lstrlenW (lpString=".dbf") returned 4
	[0060.882] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.882] lstrlenW (lpString=".1cd") returned 4
	[0060.882] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0060.882] lstrlenW (lpString=".jpg") returned 4
	[0060.882] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.883] lstrcmpiW (lpString1=".bmp", lpString2=".money") returned -1
	[0060.883] lstrlenW (lpString="header.bmp") returned 10
	[0060.883] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0060.884] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3628) returned 1
	[0060.884] CloseHandle (hObject=0x360) returned 1
	[0060.884] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80
	[0060.884] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.884] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0060.884] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.884] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.884] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0060.885] GetLastError () returned 0x0
	[0060.885] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xe2c, lpOverlapped=0x0) returned 1
	[0060.892] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe30, lpOverlapped=0x0) returned 1
	[0060.893] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.893] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0060.894] SetEndOfFile (hFile=0x364) returned 1
	[0060.894] CloseHandle (hObject=0x364) returned 1
	[0060.895] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.895] SetEndOfFile (hFile=0x360) returned 1
	[0060.896] CloseHandle (hObject=0x360) returned 1
	[0060.896] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.896] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1
	[0060.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.896] lstrlenW (lpString=".doc") returned 4
	[0060.896] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0060.896] lstrlenW (lpString=".docx") returned 5
	[0060.896] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1
	[0060.896] lstrlenW (lpString=".pdf") returned 4
	[0060.896] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0060.896] lstrlenW (lpString=".xls") returned 4
	[0060.897] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0060.897] lstrlenW (lpString=".xlsx") returned 5
	[0060.897] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1
	[0060.897] lstrlenW (lpString=".ppt") returned 4
	[0060.897] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0060.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.897] lstrlenW (lpString=".zip") returned 4
	[0060.897] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0060.897] lstrlenW (lpString=".rar") returned 4
	[0060.897] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0060.897] lstrlenW (lpString=".bz2") returned 4
	[0060.897] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0060.897] lstrlenW (lpString=".7z") returned 3
	[0060.897] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0060.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.897] lstrlenW (lpString=".dbf") returned 4
	[0060.897] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0060.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.897] lstrlenW (lpString=".1cd") returned 4
	[0060.897] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0060.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.897] lstrlenW (lpString=".jpg") returned 4
	[0060.897] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0060.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.898] lstrlenW (lpString=".doc") returned 4
	[0060.898] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0060.898] lstrlenW (lpString=".docx") returned 5
	[0060.898] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1
	[0060.898] lstrlenW (lpString=".pdf") returned 4
	[0060.898] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0060.898] lstrlenW (lpString=".xls") returned 4
	[0060.898] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0060.898] lstrlenW (lpString=".xlsx") returned 5
	[0060.898] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1
	[0060.898] lstrlenW (lpString=".ppt") returned 4
	[0060.898] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0060.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.898] lstrlenW (lpString=".zip") returned 4
	[0060.898] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0060.898] lstrlenW (lpString=".rar") returned 4
	[0060.898] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0060.898] lstrlenW (lpString=".bz2") returned 4
	[0060.898] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0060.898] lstrlenW (lpString=".7z") returned 3
	[0060.898] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0060.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.898] lstrlenW (lpString=".dbf") returned 4
	[0060.898] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0060.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.898] lstrlenW (lpString=".1cd") returned 4
	[0060.899] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0060.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0060.899] lstrlenW (lpString=".jpg") returned 4
	[0060.899] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0060.899] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.899] lstrlenW (lpString="ParameterInfo.xml") returned 17
	[0060.899] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0060.900] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=272046) returned 1
	[0060.900] CloseHandle (hObject=0x360) returned 1
	[0060.900] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80
	[0060.900] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.900] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0060.900] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.900] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.900] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0060.900] GetLastError () returned 0x0
	[0060.900] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x426ae, lpOverlapped=0x0) returned 1
	[0060.907] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x426b0, lpOverlapped=0x0) returned 1
	[0060.913] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.913] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.913] SetEndOfFile (hFile=0x364) returned 1
	[0060.913] CloseHandle (hObject=0x364) returned 1
	[0060.919] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.919] SetEndOfFile (hFile=0x360) returned 1
	[0060.922] CloseHandle (hObject=0x360) returned 1
	[0060.922] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.922] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1
	[0060.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.923] lstrlenW (lpString=".doc") returned 4
	[0060.923] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.923] lstrlenW (lpString=".docx") returned 5
	[0060.923] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0060.923] lstrlenW (lpString=".pdf") returned 4
	[0060.923] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.923] lstrlenW (lpString=".xls") returned 4
	[0060.923] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.923] lstrlenW (lpString=".xlsx") returned 5
	[0060.923] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0060.923] lstrlenW (lpString=".ppt") returned 4
	[0060.923] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.923] lstrlenW (lpString=".zip") returned 4
	[0060.923] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.923] lstrlenW (lpString=".rar") returned 4
	[0060.923] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.923] lstrlenW (lpString=".bz2") returned 4
	[0060.923] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.924] lstrlenW (lpString=".7z") returned 3
	[0060.924] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.924] lstrlenW (lpString=".dbf") returned 4
	[0060.924] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.924] lstrlenW (lpString=".1cd") returned 4
	[0060.924] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.924] lstrlenW (lpString=".jpg") returned 4
	[0060.924] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.924] lstrlenW (lpString=".doc") returned 4
	[0060.924] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.924] lstrlenW (lpString=".docx") returned 5
	[0060.924] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0060.924] lstrlenW (lpString=".pdf") returned 4
	[0060.924] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.924] lstrlenW (lpString=".xls") returned 4
	[0060.924] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.924] lstrlenW (lpString=".xlsx") returned 5
	[0060.925] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0060.925] lstrlenW (lpString=".ppt") returned 4
	[0060.925] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.925] lstrlenW (lpString=".zip") returned 4
	[0060.925] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.925] lstrlenW (lpString=".rar") returned 4
	[0060.925] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.925] lstrlenW (lpString=".bz2") returned 4
	[0060.925] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.925] lstrlenW (lpString=".7z") returned 3
	[0060.925] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.925] lstrlenW (lpString=".dbf") returned 4
	[0060.925] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.925] lstrlenW (lpString=".1cd") returned 4
	[0060.925] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0060.925] lstrlenW (lpString=".jpg") returned 4
	[0060.925] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.926] lstrcmpiW (lpString1=".xsd", lpString2=".money") returned 1
	[0060.926] lstrlenW (lpString="SetupUi.xsd") returned 11
	[0060.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0060.926] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=30120) returned 1
	[0060.926] CloseHandle (hObject=0x360) returned 1
	[0060.926] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80
	[0060.926] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0060.926] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.927] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.927] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0060.927] GetLastError () returned 0x0
	[0060.927] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x75a8, lpOverlapped=0x0) returned 1
	[0061.349] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x75b0, lpOverlapped=0x0) returned 1
	[0061.353] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.353] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.353] SetEndOfFile (hFile=0x364) returned 1
	[0061.354] CloseHandle (hObject=0x364) returned 1
	[0061.356] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.356] SetEndOfFile (hFile=0x360) returned 1
	[0061.357] CloseHandle (hObject=0x360) returned 1
	[0061.357] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.357] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1
	[0061.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.358] lstrlenW (lpString=".doc") returned 4
	[0061.358] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1
	[0061.358] lstrlenW (lpString=".docx") returned 5
	[0061.358] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1
	[0061.358] lstrlenW (lpString=".pdf") returned 4
	[0061.358] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1
	[0061.358] lstrlenW (lpString=".xls") returned 4
	[0061.358] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1
	[0061.359] lstrlenW (lpString=".xlsx") returned 5
	[0061.359] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1
	[0061.359] lstrlenW (lpString=".ppt") returned 4
	[0061.359] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1
	[0061.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.359] lstrlenW (lpString=".zip") returned 4
	[0061.359] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1
	[0061.359] lstrlenW (lpString=".rar") returned 4
	[0061.359] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1
	[0061.359] lstrlenW (lpString=".bz2") returned 4
	[0061.359] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1
	[0061.359] lstrlenW (lpString=".7z") returned 3
	[0061.359] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1
	[0061.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.359] lstrlenW (lpString=".dbf") returned 4
	[0061.360] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1
	[0061.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.360] lstrlenW (lpString=".1cd") returned 4
	[0061.360] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1
	[0061.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.360] lstrlenW (lpString=".jpg") returned 4
	[0061.360] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1
	[0061.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.360] lstrlenW (lpString=".doc") returned 4
	[0061.360] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1
	[0061.360] lstrlenW (lpString=".docx") returned 5
	[0061.360] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1
	[0061.360] lstrlenW (lpString=".pdf") returned 4
	[0061.360] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1
	[0061.360] lstrlenW (lpString=".xls") returned 4
	[0061.360] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1
	[0061.360] lstrlenW (lpString=".xlsx") returned 5
	[0061.360] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1
	[0061.360] lstrlenW (lpString=".ppt") returned 4
	[0061.360] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1
	[0061.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.360] lstrlenW (lpString=".zip") returned 4
	[0061.360] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1
	[0061.360] lstrlenW (lpString=".rar") returned 4
	[0061.360] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1
	[0061.361] lstrlenW (lpString=".bz2") returned 4
	[0061.361] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1
	[0061.361] lstrlenW (lpString=".7z") returned 3
	[0061.361] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1
	[0061.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.361] lstrlenW (lpString=".dbf") returned 4
	[0061.361] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1
	[0061.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.361] lstrlenW (lpString=".1cd") returned 4
	[0061.361] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1
	[0061.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0061.361] lstrlenW (lpString=".jpg") returned 4
	[0061.361] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1
	[0061.361] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.361] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26
	[0061.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.575] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=4450) returned 1
	[0061.575] CloseHandle (hObject=0x374) returned 1
	[0061.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20
	[0061.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.575] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.575] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0061.576] GetLastError () returned 0x0
	[0061.576] ReadFile (in: hFile=0x374, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1162, lpOverlapped=0x0) returned 1
	[0061.577] WriteFile (in: hFile=0x34c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1170, lpOverlapped=0x0) returned 1
	[0061.578] ReadFile (in: hFile=0x374, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.578] WriteFile (in: hFile=0x34c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x108, lpOverlapped=0x0) returned 1
	[0061.578] SetEndOfFile (hFile=0x34c) returned 1
	[0061.578] CloseHandle (hObject=0x34c) returned 1
	[0061.579] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.579] SetEndOfFile (hFile=0x374) returned 1
	[0061.580] CloseHandle (hObject=0x374) returned 1
	[0061.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0061.581] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1
	[0061.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.584] lstrlenW (lpString=".doc") returned 4
	[0061.584] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.584] lstrlenW (lpString=".docx") returned 5
	[0061.584] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0061.585] lstrlenW (lpString=".pdf") returned 4
	[0061.585] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.585] lstrlenW (lpString=".xls") returned 4
	[0061.585] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.585] lstrlenW (lpString=".xlsx") returned 5
	[0061.585] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0061.585] lstrlenW (lpString=".ppt") returned 4
	[0061.585] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.585] lstrlenW (lpString=".zip") returned 4
	[0061.585] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.585] lstrlenW (lpString=".rar") returned 4
	[0061.585] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.585] lstrlenW (lpString=".bz2") returned 4
	[0061.585] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.585] lstrlenW (lpString=".7z") returned 3
	[0061.585] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.585] lstrlenW (lpString=".dbf") returned 4
	[0061.585] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.585] lstrlenW (lpString=".1cd") returned 4
	[0061.585] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.585] lstrlenW (lpString=".jpg") returned 4
	[0061.585] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.586] lstrlenW (lpString=".doc") returned 4
	[0061.586] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.586] lstrlenW (lpString=".docx") returned 5
	[0061.586] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0061.586] lstrlenW (lpString=".pdf") returned 4
	[0061.586] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.586] lstrlenW (lpString=".xls") returned 4
	[0061.586] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.586] lstrlenW (lpString=".xlsx") returned 5
	[0061.586] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0061.586] lstrlenW (lpString=".ppt") returned 4
	[0061.586] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.586] lstrlenW (lpString=".zip") returned 4
	[0061.586] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.586] lstrlenW (lpString=".rar") returned 4
	[0061.586] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.586] lstrlenW (lpString=".bz2") returned 4
	[0061.586] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.586] lstrlenW (lpString=".7z") returned 3
	[0061.586] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.586] lstrlenW (lpString=".dbf") returned 4
	[0061.586] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.587] lstrlenW (lpString=".1cd") returned 4
	[0061.587] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0061.587] lstrlenW (lpString=".jpg") returned 4
	[0061.587] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.587] lstrcmpiW (lpString1=".htm", lpString2=".money") returned -1
	[0061.587] lstrlenW (lpString="Hand Prints.htm") returned 15
	[0061.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.588] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=235) returned 1
	[0061.588] CloseHandle (hObject=0x374) returned 1
	[0061.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20
	[0061.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.588] lstrlenW (lpString=".doc") returned 4
	[0061.588] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.588] lstrlenW (lpString=".docx") returned 5
	[0061.588] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0061.588] lstrlenW (lpString=".pdf") returned 4
	[0061.588] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.588] lstrlenW (lpString=".xls") returned 4
	[0061.588] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.589] lstrlenW (lpString=".xlsx") returned 5
	[0061.589] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0061.589] lstrlenW (lpString=".ppt") returned 4
	[0061.589] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.589] lstrlenW (lpString=".zip") returned 4
	[0061.589] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.589] lstrlenW (lpString=".rar") returned 4
	[0061.589] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.589] lstrlenW (lpString=".bz2") returned 4
	[0061.589] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.589] lstrlenW (lpString=".7z") returned 3
	[0061.589] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.589] lstrlenW (lpString=".dbf") returned 4
	[0061.589] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.589] lstrlenW (lpString=".1cd") returned 4
	[0061.589] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.590] lstrlenW (lpString=".jpg") returned 4
	[0061.590] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.590] lstrlenW (lpString=".doc") returned 4
	[0061.590] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.590] lstrlenW (lpString=".docx") returned 5
	[0061.590] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0061.590] lstrlenW (lpString=".pdf") returned 4
	[0061.590] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.590] lstrlenW (lpString=".xls") returned 4
	[0061.590] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.590] lstrlenW (lpString=".xlsx") returned 5
	[0061.590] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0061.590] lstrlenW (lpString=".ppt") returned 4
	[0061.590] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.590] lstrlenW (lpString=".zip") returned 4
	[0061.590] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.590] lstrlenW (lpString=".rar") returned 4
	[0061.590] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.590] lstrlenW (lpString=".bz2") returned 4
	[0061.590] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.591] lstrlenW (lpString=".7z") returned 3
	[0061.591] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.591] lstrlenW (lpString=".dbf") returned 4
	[0061.591] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.591] lstrlenW (lpString=".1cd") returned 4
	[0061.591] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0061.591] lstrlenW (lpString=".jpg") returned 4
	[0061.591] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.591] lstrcmpiW (lpString1=".jpg", lpString2=".money") returned -1
	[0061.591] lstrlenW (lpString="HandPrints.jpg") returned 14
	[0061.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.592] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=4222) returned 1
	[0061.592] CloseHandle (hObject=0x374) returned 1
	[0061.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20
	[0061.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.593] lstrlenW (lpString=".doc") returned 4
	[0061.593] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.593] lstrlenW (lpString=".docx") returned 5
	[0061.593] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0061.593] lstrlenW (lpString=".pdf") returned 4
	[0061.593] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.593] lstrlenW (lpString=".xls") returned 4
	[0061.593] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.593] lstrlenW (lpString=".xlsx") returned 5
	[0061.593] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0061.593] lstrlenW (lpString=".ppt") returned 4
	[0061.593] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.593] lstrlenW (lpString=".zip") returned 4
	[0061.593] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.593] lstrlenW (lpString=".rar") returned 4
	[0061.593] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.593] lstrlenW (lpString=".bz2") returned 4
	[0061.593] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.593] lstrlenW (lpString=".7z") returned 3
	[0061.593] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.594] lstrlenW (lpString=".dbf") returned 4
	[0061.594] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.594] lstrlenW (lpString=".1cd") returned 4
	[0061.594] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.594] lstrlenW (lpString=".jpg") returned 4
	[0061.594] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.594] lstrlenW (lpString=".doc") returned 4
	[0061.594] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.594] lstrlenW (lpString=".docx") returned 5
	[0061.594] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0061.594] lstrlenW (lpString=".pdf") returned 4
	[0061.594] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.594] lstrlenW (lpString=".xls") returned 4
	[0061.594] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.594] lstrlenW (lpString=".xlsx") returned 5
	[0061.594] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0061.594] lstrlenW (lpString=".ppt") returned 4
	[0061.594] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.594] lstrlenW (lpString=".zip") returned 4
	[0061.595] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.595] lstrlenW (lpString=".rar") returned 4
	[0061.595] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.595] lstrlenW (lpString=".bz2") returned 4
	[0061.595] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.595] lstrlenW (lpString=".7z") returned 3
	[0061.595] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.595] lstrlenW (lpString=".dbf") returned 4
	[0061.595] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.595] lstrlenW (lpString=".1cd") returned 4
	[0061.595] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0061.595] lstrlenW (lpString=".jpg") returned 4
	[0061.595] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.595] lstrcmpiW (lpString1=".htm", lpString2=".money") returned -1
	[0061.595] lstrlenW (lpString="Orange Circles.htm") returned 18
	[0061.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.596] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=237) returned 1
	[0061.596] CloseHandle (hObject=0x374) returned 1
	[0061.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20
	[0061.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.596] lstrlenW (lpString=".doc") returned 4
	[0061.596] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.596] lstrlenW (lpString=".docx") returned 5
	[0061.597] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0061.597] lstrlenW (lpString=".pdf") returned 4
	[0061.597] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.597] lstrlenW (lpString=".xls") returned 4
	[0061.597] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.597] lstrlenW (lpString=".xlsx") returned 5
	[0061.597] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0061.597] lstrlenW (lpString=".ppt") returned 4
	[0061.597] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.597] lstrlenW (lpString=".zip") returned 4
	[0061.597] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.597] lstrlenW (lpString=".rar") returned 4
	[0061.597] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.597] lstrlenW (lpString=".bz2") returned 4
	[0061.597] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.597] lstrlenW (lpString=".7z") returned 3
	[0061.597] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.597] lstrlenW (lpString=".dbf") returned 4
	[0061.597] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.597] lstrlenW (lpString=".1cd") returned 4
	[0061.597] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.597] lstrlenW (lpString=".jpg") returned 4
	[0061.597] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.598] lstrlenW (lpString=".doc") returned 4
	[0061.598] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.598] lstrlenW (lpString=".docx") returned 5
	[0061.598] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0061.598] lstrlenW (lpString=".pdf") returned 4
	[0061.598] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.598] lstrlenW (lpString=".xls") returned 4
	[0061.598] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.598] lstrlenW (lpString=".xlsx") returned 5
	[0061.598] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0061.598] lstrlenW (lpString=".ppt") returned 4
	[0061.598] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.598] lstrlenW (lpString=".zip") returned 4
	[0061.598] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.598] lstrlenW (lpString=".rar") returned 4
	[0061.598] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.598] lstrlenW (lpString=".bz2") returned 4
	[0061.598] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.598] lstrlenW (lpString=".7z") returned 3
	[0061.598] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.598] lstrlenW (lpString=".dbf") returned 4
	[0061.598] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.599] lstrlenW (lpString=".1cd") returned 4
	[0061.599] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0061.599] lstrlenW (lpString=".jpg") returned 4
	[0061.599] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.599] lstrcmpiW (lpString1=".jpg", lpString2=".money") returned -1
	[0061.599] lstrlenW (lpString="OrangeCircles.jpg") returned 17
	[0061.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.600] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=6381) returned 1
	[0061.600] CloseHandle (hObject=0x374) returned 1
	[0061.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20
	[0061.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.600] lstrlenW (lpString=".doc") returned 4
	[0061.600] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.600] lstrlenW (lpString=".docx") returned 5
	[0061.600] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0061.600] lstrlenW (lpString=".pdf") returned 4
	[0061.600] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.600] lstrlenW (lpString=".xls") returned 4
	[0061.600] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.600] lstrlenW (lpString=".xlsx") returned 5
	[0061.600] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0061.600] lstrlenW (lpString=".ppt") returned 4
	[0061.600] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.601] lstrlenW (lpString=".zip") returned 4
	[0061.601] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.601] lstrlenW (lpString=".rar") returned 4
	[0061.601] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.601] lstrlenW (lpString=".bz2") returned 4
	[0061.601] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.601] lstrlenW (lpString=".7z") returned 3
	[0061.601] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.601] lstrlenW (lpString=".dbf") returned 4
	[0061.601] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.601] lstrlenW (lpString=".1cd") returned 4
	[0061.601] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.601] lstrlenW (lpString=".jpg") returned 4
	[0061.601] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.601] lstrlenW (lpString=".doc") returned 4
	[0061.601] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.601] lstrlenW (lpString=".docx") returned 5
	[0061.602] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0061.602] lstrlenW (lpString=".pdf") returned 4
	[0061.602] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.602] lstrlenW (lpString=".xls") returned 4
	[0061.602] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.602] lstrlenW (lpString=".xlsx") returned 5
	[0061.602] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0061.602] lstrlenW (lpString=".ppt") returned 4
	[0061.602] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.602] lstrlenW (lpString=".zip") returned 4
	[0061.602] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.602] lstrlenW (lpString=".rar") returned 4
	[0061.602] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.602] lstrlenW (lpString=".bz2") returned 4
	[0061.602] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.602] lstrlenW (lpString=".7z") returned 3
	[0061.602] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.602] lstrlenW (lpString=".dbf") returned 4
	[0061.602] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.602] lstrlenW (lpString=".1cd") returned 4
	[0061.602] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0061.602] lstrlenW (lpString=".jpg") returned 4
	[0061.602] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.603] lstrcmpiW (lpString1=".htm", lpString2=".money") returned -1
	[0061.603] lstrlenW (lpString="Peacock.htm") returned 11
	[0061.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.603] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=232) returned 1
	[0061.603] CloseHandle (hObject=0x374) returned 1
	[0061.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20
	[0061.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.604] lstrlenW (lpString=".doc") returned 4
	[0061.604] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.604] lstrlenW (lpString=".docx") returned 5
	[0061.604] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1
	[0061.604] lstrlenW (lpString=".pdf") returned 4
	[0061.604] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.604] lstrlenW (lpString=".xls") returned 4
	[0061.604] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.604] lstrlenW (lpString=".xlsx") returned 5
	[0061.604] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1
	[0061.604] lstrlenW (lpString=".ppt") returned 4
	[0061.604] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.604] lstrlenW (lpString=".zip") returned 4
	[0061.604] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.604] lstrlenW (lpString=".rar") returned 4
	[0061.604] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.604] lstrlenW (lpString=".bz2") returned 4
	[0061.604] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.604] lstrlenW (lpString=".7z") returned 3
	[0061.605] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.605] lstrlenW (lpString=".dbf") returned 4
	[0061.605] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.605] lstrlenW (lpString=".1cd") returned 4
	[0061.605] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.605] lstrlenW (lpString=".jpg") returned 4
	[0061.605] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.605] lstrlenW (lpString=".doc") returned 4
	[0061.605] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.605] lstrlenW (lpString=".docx") returned 5
	[0061.605] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1
	[0061.605] lstrlenW (lpString=".pdf") returned 4
	[0061.605] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.605] lstrlenW (lpString=".xls") returned 4
	[0061.605] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.605] lstrlenW (lpString=".xlsx") returned 5
	[0061.605] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1
	[0061.605] lstrlenW (lpString=".ppt") returned 4
	[0061.606] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.606] lstrlenW (lpString=".zip") returned 4
	[0061.606] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.606] lstrlenW (lpString=".rar") returned 4
	[0061.606] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.606] lstrlenW (lpString=".bz2") returned 4
	[0061.606] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.606] lstrlenW (lpString=".7z") returned 3
	[0061.606] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.606] lstrlenW (lpString=".dbf") returned 4
	[0061.606] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.606] lstrlenW (lpString=".1cd") returned 4
	[0061.606] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0061.606] lstrlenW (lpString=".jpg") returned 4
	[0061.606] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.606] lstrcmpiW (lpString1=".jpg", lpString2=".money") returned -1
	[0061.606] lstrlenW (lpString="Peacock.jpg") returned 11
	[0061.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.607] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=5115) returned 1
	[0061.607] CloseHandle (hObject=0x374) returned 1
	[0061.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20
	[0061.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0061.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0061.608] lstrlenW (lpString=".doc") returned 4
	[0061.608] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.608] lstrlenW (lpString=".docx") returned 5
	[0061.608] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1
	[0061.608] lstrlenW (lpString=".pdf") returned 4
	[0061.608] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.608] lstrlenW (lpString=".xls") returned 4
	[0061.608] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.608] lstrlenW (lpString=".xlsx") returned 5
	[0061.608] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1
	[0061.608] lstrlenW (lpString=".ppt") returned 4
	[0061.608] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0061.608] lstrlenW (lpString=".zip") returned 4
	[0061.608] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.608] lstrlenW (lpString=".rar") returned 4
	[0061.608] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.608] lstrlenW (lpString=".bz2") returned 4
	[0061.608] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.608] lstrlenW (lpString=".7z") returned 3
	[0061.608] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0061.608] lstrlenW (lpString=".dbf") returned 4
	[0061.608] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.993] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.993] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.993] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0061.997] GetLastError () returned 0x0
	[0061.997] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x218e, lpOverlapped=0x0) returned 1
	[0062.008] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2190, lpOverlapped=0x0) returned 1
	[0062.010] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.010] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0062.010] SetEndOfFile (hFile=0x364) returned 1
	[0062.010] CloseHandle (hObject=0x364) returned 1
	[0062.011] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.012] SetEndOfFile (hFile=0x360) returned 1
	[0062.012] CloseHandle (hObject=0x360) returned 1
	[0062.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.013] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1
	[0062.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.013] lstrlenW (lpString=".doc") returned 4
	[0062.013] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.013] lstrlenW (lpString=".docx") returned 5
	[0062.013] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1
	[0062.013] lstrlenW (lpString=".pdf") returned 4
	[0062.013] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.013] lstrlenW (lpString=".xls") returned 4
	[0062.013] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.014] lstrlenW (lpString=".xlsx") returned 5
	[0062.014] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1
	[0062.014] lstrlenW (lpString=".ppt") returned 4
	[0062.014] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.014] lstrlenW (lpString=".zip") returned 4
	[0062.014] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.014] lstrlenW (lpString=".rar") returned 4
	[0062.014] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.014] lstrlenW (lpString=".bz2") returned 4
	[0062.014] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.014] lstrlenW (lpString=".7z") returned 3
	[0062.014] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.014] lstrlenW (lpString=".dbf") returned 4
	[0062.014] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.014] lstrlenW (lpString=".1cd") returned 4
	[0062.014] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.014] lstrlenW (lpString=".jpg") returned 4
	[0062.014] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.014] lstrlenW (lpString=".doc") returned 4
	[0062.014] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.014] lstrlenW (lpString=".docx") returned 5
	[0062.015] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1
	[0062.015] lstrlenW (lpString=".pdf") returned 4
	[0062.015] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.015] lstrlenW (lpString=".xls") returned 4
	[0062.015] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.015] lstrlenW (lpString=".xlsx") returned 5
	[0062.015] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1
	[0062.015] lstrlenW (lpString=".ppt") returned 4
	[0062.015] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.015] lstrlenW (lpString=".zip") returned 4
	[0062.015] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.015] lstrlenW (lpString=".rar") returned 4
	[0062.015] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.015] lstrlenW (lpString=".bz2") returned 4
	[0062.015] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.015] lstrlenW (lpString=".7z") returned 3
	[0062.015] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.015] lstrlenW (lpString=".dbf") returned 4
	[0062.015] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.015] lstrlenW (lpString=".1cd") returned 4
	[0062.015] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0062.015] lstrlenW (lpString=".jpg") returned 4
	[0062.015] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.016] lstrcmpiW (lpString1=".gif", lpString2=".money") returned -1
	[0062.016] lstrlenW (lpString="splash_11@2x-lic.gif") returned 20
	[0062.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0062.016] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=12250) returned 1
	[0062.016] CloseHandle (hObject=0x360) returned 1
	[0062.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20
	[0062.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0062.016] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.016] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.017] GetLastError () returned 0x0
	[0062.017] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x2fda, lpOverlapped=0x0) returned 1
	[0062.021] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2fe0, lpOverlapped=0x0) returned 1
	[0062.022] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.022] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0062.022] SetEndOfFile (hFile=0x364) returned 1
	[0062.023] CloseHandle (hObject=0x364) returned 1
	[0062.024] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.024] SetEndOfFile (hFile=0x360) returned 1
	[0062.024] CloseHandle (hObject=0x360) returned 1
	[0062.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.025] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1
	[0062.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.025] lstrlenW (lpString=".doc") returned 4
	[0062.025] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.025] lstrlenW (lpString=".docx") returned 5
	[0062.025] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0062.025] lstrlenW (lpString=".pdf") returned 4
	[0062.025] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.025] lstrlenW (lpString=".xls") returned 4
	[0062.025] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.026] lstrlenW (lpString=".xlsx") returned 5
	[0062.026] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0062.026] lstrlenW (lpString=".ppt") returned 4
	[0062.026] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.026] lstrlenW (lpString=".zip") returned 4
	[0062.026] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.026] lstrlenW (lpString=".rar") returned 4
	[0062.026] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.026] lstrlenW (lpString=".bz2") returned 4
	[0062.026] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.026] lstrlenW (lpString=".7z") returned 3
	[0062.026] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.026] lstrlenW (lpString=".dbf") returned 4
	[0062.026] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.026] lstrlenW (lpString=".1cd") returned 4
	[0062.026] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.027] lstrlenW (lpString=".jpg") returned 4
	[0062.027] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.027] lstrlenW (lpString=".doc") returned 4
	[0062.027] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.027] lstrlenW (lpString=".docx") returned 5
	[0062.027] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0062.027] lstrlenW (lpString=".pdf") returned 4
	[0062.027] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.027] lstrlenW (lpString=".xls") returned 4
	[0062.027] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.027] lstrlenW (lpString=".xlsx") returned 5
	[0062.027] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0062.027] lstrlenW (lpString=".ppt") returned 4
	[0062.027] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.027] lstrlenW (lpString=".zip") returned 4
	[0062.027] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.027] lstrlenW (lpString=".rar") returned 4
	[0062.027] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.027] lstrlenW (lpString=".bz2") returned 4
	[0062.027] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.027] lstrlenW (lpString=".7z") returned 3
	[0062.027] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.027] lstrlenW (lpString=".dbf") returned 4
	[0062.028] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.028] lstrlenW (lpString=".1cd") returned 4
	[0062.028] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0062.028] lstrlenW (lpString=".jpg") returned 4
	[0062.028] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.028] lstrcmpiW (lpString1=".gif", lpString2=".money") returned -1
	[0062.028] lstrlenW (lpString="invalid32x32.gif") returned 16
	[0062.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0062.029] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=153) returned 1
	[0062.029] CloseHandle (hObject=0x360) returned 1
	[0062.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20
	[0062.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.029] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0062.029] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.029] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.029] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.030] GetLastError () returned 0x0
	[0062.030] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x99, lpOverlapped=0x0) returned 1
	[0062.031] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0062.032] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.032] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0062.032] SetEndOfFile (hFile=0x364) returned 1
	[0062.032] CloseHandle (hObject=0x364) returned 1
	[0062.033] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.033] SetEndOfFile (hFile=0x360) returned 1
	[0062.034] CloseHandle (hObject=0x360) returned 1
	[0062.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.034] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1
	[0062.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.034] lstrlenW (lpString=".doc") returned 4
	[0062.034] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.034] lstrlenW (lpString=".docx") returned 5
	[0062.034] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.034] lstrlenW (lpString=".pdf") returned 4
	[0062.034] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.034] lstrlenW (lpString=".xls") returned 4
	[0062.034] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.035] lstrlenW (lpString=".xlsx") returned 5
	[0062.035] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.035] lstrlenW (lpString=".ppt") returned 4
	[0062.035] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.035] lstrlenW (lpString=".zip") returned 4
	[0062.035] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.035] lstrlenW (lpString=".rar") returned 4
	[0062.035] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.035] lstrlenW (lpString=".bz2") returned 4
	[0062.035] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.035] lstrlenW (lpString=".7z") returned 3
	[0062.035] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.035] lstrlenW (lpString=".dbf") returned 4
	[0062.035] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.035] lstrlenW (lpString=".1cd") returned 4
	[0062.035] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.035] lstrlenW (lpString=".jpg") returned 4
	[0062.035] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.035] lstrlenW (lpString=".doc") returned 4
	[0062.035] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.036] lstrlenW (lpString=".docx") returned 5
	[0062.036] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.036] lstrlenW (lpString=".pdf") returned 4
	[0062.036] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.036] lstrlenW (lpString=".xls") returned 4
	[0062.036] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.036] lstrlenW (lpString=".xlsx") returned 5
	[0062.036] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.036] lstrlenW (lpString=".ppt") returned 4
	[0062.036] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.036] lstrlenW (lpString=".zip") returned 4
	[0062.036] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.036] lstrlenW (lpString=".rar") returned 4
	[0062.036] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.036] lstrlenW (lpString=".bz2") returned 4
	[0062.036] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.036] lstrlenW (lpString=".7z") returned 3
	[0062.036] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.036] lstrlenW (lpString=".dbf") returned 4
	[0062.036] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.036] lstrlenW (lpString=".1cd") returned 4
	[0062.036] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0062.036] lstrlenW (lpString=".jpg") returned 4
	[0062.036] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.037] lstrcmpiW (lpString1=".gif", lpString2=".money") returned -1
	[0062.037] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23
	[0062.037] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0062.037] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=165) returned 1
	[0062.038] CloseHandle (hObject=0x360) returned 1
	[0062.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20
	[0062.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.038] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0062.038] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.038] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.038] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.038] GetLastError () returned 0x0
	[0062.038] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xa5, lpOverlapped=0x0) returned 1
	[0062.039] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xb0, lpOverlapped=0x0) returned 1
	[0062.040] ReadFile (in: hFile=0x360, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.040] WriteFile (in: hFile=0x364, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x102, lpOverlapped=0x0) returned 1
	[0062.041] SetEndOfFile (hFile=0x364) returned 1
	[0062.041] CloseHandle (hObject=0x364) returned 1
	[0062.041] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.041] SetEndOfFile (hFile=0x360) returned 1
	[0062.412] CloseHandle (hObject=0x360) returned 1
	[0062.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.412] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1
	[0062.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.413] lstrlenW (lpString=".doc") returned 4
	[0062.413] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.413] lstrlenW (lpString=".docx") returned 5
	[0062.413] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.413] lstrlenW (lpString=".pdf") returned 4
	[0062.413] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.413] lstrlenW (lpString=".xls") returned 4
	[0062.413] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.413] lstrlenW (lpString=".xlsx") returned 5
	[0062.413] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.413] lstrlenW (lpString=".ppt") returned 4
	[0062.413] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.414] lstrlenW (lpString=".zip") returned 4
	[0062.414] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.414] lstrlenW (lpString=".rar") returned 4
	[0062.414] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.414] lstrlenW (lpString=".bz2") returned 4
	[0062.414] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.414] lstrlenW (lpString=".7z") returned 3
	[0062.414] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.414] lstrlenW (lpString=".dbf") returned 4
	[0062.414] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.414] lstrlenW (lpString=".1cd") returned 4
	[0062.414] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.414] lstrlenW (lpString=".jpg") returned 4
	[0062.414] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.415] lstrlenW (lpString=".doc") returned 4
	[0062.415] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.415] lstrlenW (lpString=".docx") returned 5
	[0062.415] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.415] lstrlenW (lpString=".pdf") returned 4
	[0062.415] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.415] lstrlenW (lpString=".xls") returned 4
	[0062.415] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.415] lstrlenW (lpString=".xlsx") returned 5
	[0062.415] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.415] lstrlenW (lpString=".ppt") returned 4
	[0062.415] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.415] lstrlenW (lpString=".zip") returned 4
	[0062.415] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.415] lstrlenW (lpString=".rar") returned 4
	[0062.415] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.415] lstrlenW (lpString=".bz2") returned 4
	[0062.415] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.416] lstrlenW (lpString=".7z") returned 3
	[0062.416] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.416] lstrlenW (lpString=".dbf") returned 4
	[0062.416] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.416] lstrlenW (lpString=".1cd") returned 4
	[0062.416] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0062.416] lstrlenW (lpString=".jpg") returned 4
	[0062.416] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.416] Sleep (dwMilliseconds=0x64) 
	[0062.826] lstrcmpiW (lpString1=".dat", lpString2=".money") returned -1
	[0062.826] lstrlenW (lpString="tzdb.dat") returned 8
	[0062.826] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.827] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=105500) returned 1
	[0062.827] CloseHandle (hObject=0x320) returned 1
	[0062.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20
	[0062.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.827] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.827] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.827] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.827] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.828] GetLastError () returned 0x0
	[0062.828] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x19c1c, lpOverlapped=0x0) returned 1
	[0062.831] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x19c20, lpOverlapped=0x0) returned 1
	[0062.833] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.833] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.833] SetEndOfFile (hFile=0x370) returned 1
	[0062.833] CloseHandle (hObject=0x370) returned 1
	[0062.836] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.836] SetEndOfFile (hFile=0x320) returned 1
	[0062.837] CloseHandle (hObject=0x320) returned 1
	[0062.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.838] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1
	[0062.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.838] lstrlenW (lpString=".doc") returned 4
	[0062.838] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0062.838] lstrlenW (lpString=".docx") returned 5
	[0062.838] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1
	[0062.838] lstrlenW (lpString=".pdf") returned 4
	[0062.838] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0062.838] lstrlenW (lpString=".xls") returned 4
	[0062.838] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0062.838] lstrlenW (lpString=".xlsx") returned 5
	[0062.838] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1
	[0062.838] lstrlenW (lpString=".ppt") returned 4
	[0062.838] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0062.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.838] lstrlenW (lpString=".zip") returned 4
	[0062.838] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0062.838] lstrlenW (lpString=".rar") returned 4
	[0062.838] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0062.839] lstrlenW (lpString=".bz2") returned 4
	[0062.839] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0062.839] lstrlenW (lpString=".7z") returned 3
	[0062.839] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0062.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.839] lstrlenW (lpString=".dbf") returned 4
	[0062.839] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0062.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.839] lstrlenW (lpString=".1cd") returned 4
	[0062.839] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0062.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.839] lstrlenW (lpString=".jpg") returned 4
	[0062.839] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0062.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.839] lstrlenW (lpString=".doc") returned 4
	[0062.839] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0062.839] lstrlenW (lpString=".docx") returned 5
	[0062.839] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1
	[0062.839] lstrlenW (lpString=".pdf") returned 4
	[0062.839] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0062.839] lstrlenW (lpString=".xls") returned 4
	[0062.839] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0062.839] lstrlenW (lpString=".xlsx") returned 5
	[0062.839] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1
	[0062.839] lstrlenW (lpString=".ppt") returned 4
	[0062.839] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0062.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.840] lstrlenW (lpString=".zip") returned 4
	[0062.840] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0062.840] lstrlenW (lpString=".rar") returned 4
	[0062.840] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0062.840] lstrlenW (lpString=".bz2") returned 4
	[0062.840] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0062.840] lstrlenW (lpString=".7z") returned 3
	[0062.840] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0062.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.840] lstrlenW (lpString=".dbf") returned 4
	[0062.840] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0062.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.840] lstrlenW (lpString=".1cd") returned 4
	[0062.840] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0062.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0062.840] lstrlenW (lpString=".jpg") returned 4
	[0062.840] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0062.840] lstrcmpiW (lpString1=".txt", lpString2=".money") returned 1
	[0062.840] lstrlenW (lpString="README.txt") returned 10
	[0062.840] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.841] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=46) returned 1
	[0062.841] CloseHandle (hObject=0x320) returned 1
	[0062.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20
	[0062.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.841] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.841] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.841] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.842] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.842] GetLastError () returned 0x0
	[0062.842] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x2e, lpOverlapped=0x0) returned 1
	[0062.843] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x30, lpOverlapped=0x0) returned 1
	[0062.844] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.844] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0062.844] SetEndOfFile (hFile=0x370) returned 1
	[0062.844] CloseHandle (hObject=0x370) returned 1
	[0062.846] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.846] SetEndOfFile (hFile=0x320) returned 1
	[0062.847] CloseHandle (hObject=0x320) returned 1
	[0062.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.847] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1
	[0062.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.848] lstrlenW (lpString=".doc") returned 4
	[0062.848] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0062.848] lstrlenW (lpString=".docx") returned 5
	[0062.848] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0062.848] lstrlenW (lpString=".pdf") returned 4
	[0062.848] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0062.848] lstrlenW (lpString=".xls") returned 4
	[0062.848] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0062.848] lstrlenW (lpString=".xlsx") returned 5
	[0062.848] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0062.848] lstrlenW (lpString=".ppt") returned 4
	[0062.848] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0062.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.850] lstrlenW (lpString=".zip") returned 4
	[0062.850] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0062.850] lstrlenW (lpString=".rar") returned 4
	[0062.850] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0062.850] lstrlenW (lpString=".bz2") returned 4
	[0062.850] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0062.850] lstrlenW (lpString=".7z") returned 3
	[0062.850] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0062.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.850] lstrlenW (lpString=".dbf") returned 4
	[0062.850] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0062.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.850] lstrlenW (lpString=".1cd") returned 4
	[0062.850] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0062.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.850] lstrlenW (lpString=".jpg") returned 4
	[0062.850] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0062.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.850] lstrlenW (lpString=".doc") returned 4
	[0062.850] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0062.850] lstrlenW (lpString=".docx") returned 5
	[0062.850] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0062.850] lstrlenW (lpString=".pdf") returned 4
	[0062.851] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0062.851] lstrlenW (lpString=".xls") returned 4
	[0062.851] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0062.851] lstrlenW (lpString=".xlsx") returned 5
	[0062.851] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0062.851] lstrlenW (lpString=".ppt") returned 4
	[0062.851] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0062.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.851] lstrlenW (lpString=".zip") returned 4
	[0062.851] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0062.851] lstrlenW (lpString=".rar") returned 4
	[0062.851] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0062.851] lstrlenW (lpString=".bz2") returned 4
	[0062.851] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0062.851] lstrlenW (lpString=".7z") returned 3
	[0062.851] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0062.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.851] lstrlenW (lpString=".dbf") returned 4
	[0062.851] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0062.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.851] lstrlenW (lpString=".1cd") returned 4
	[0062.851] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0062.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0062.851] lstrlenW (lpString=".jpg") returned 4
	[0062.851] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0062.852] lstrcmpiW (lpString1=".txt", lpString2=".money") returned 1
	[0062.852] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34
	[0062.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.852] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=63933) returned 1
	[0062.852] CloseHandle (hObject=0x320) returned 1
	[0062.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20
	[0062.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.852] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.852] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.853] GetLastError () returned 0x0
	[0062.853] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xf9bd, lpOverlapped=0x0) returned 1
	[0062.855] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xf9c0, lpOverlapped=0x0) returned 1
	[0062.857] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.857] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x118, lpOverlapped=0x0) returned 1
	[0062.857] SetEndOfFile (hFile=0x370) returned 1
	[0062.857] CloseHandle (hObject=0x370) returned 1
	[0062.859] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.859] SetEndOfFile (hFile=0x320) returned 1
	[0062.860] CloseHandle (hObject=0x320) returned 1
	[0062.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.860] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1
	[0062.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.861] lstrlenW (lpString=".doc") returned 4
	[0062.861] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0062.861] lstrlenW (lpString=".docx") returned 5
	[0062.861] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1
	[0062.861] lstrlenW (lpString=".pdf") returned 4
	[0062.861] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0062.861] lstrlenW (lpString=".xls") returned 4
	[0062.861] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0062.861] lstrlenW (lpString=".xlsx") returned 5
	[0062.861] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1
	[0062.861] lstrlenW (lpString=".ppt") returned 4
	[0062.861] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0062.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.861] lstrlenW (lpString=".zip") returned 4
	[0062.861] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0062.861] lstrlenW (lpString=".rar") returned 4
	[0062.861] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0062.861] lstrlenW (lpString=".bz2") returned 4
	[0062.861] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0062.861] lstrlenW (lpString=".7z") returned 3
	[0062.861] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0062.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.861] lstrlenW (lpString=".dbf") returned 4
	[0062.861] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0062.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.861] lstrlenW (lpString=".1cd") returned 4
	[0062.861] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0062.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.862] lstrlenW (lpString=".jpg") returned 4
	[0062.862] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0062.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.862] lstrlenW (lpString=".doc") returned 4
	[0062.862] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0062.862] lstrlenW (lpString=".docx") returned 5
	[0062.862] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1
	[0062.862] lstrlenW (lpString=".pdf") returned 4
	[0062.862] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0062.862] lstrlenW (lpString=".xls") returned 4
	[0062.862] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0062.862] lstrlenW (lpString=".xlsx") returned 5
	[0062.862] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1
	[0062.862] lstrlenW (lpString=".ppt") returned 4
	[0062.862] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0062.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.862] lstrlenW (lpString=".zip") returned 4
	[0062.862] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0062.862] lstrlenW (lpString=".rar") returned 4
	[0062.862] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0062.862] lstrlenW (lpString=".bz2") returned 4
	[0062.862] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0062.862] lstrlenW (lpString=".7z") returned 3
	[0062.862] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0062.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.862] lstrlenW (lpString=".dbf") returned 4
	[0062.862] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0062.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.863] lstrlenW (lpString=".1cd") returned 4
	[0062.863] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0062.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0062.863] lstrlenW (lpString=".jpg") returned 4
	[0062.863] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0062.863] lstrcmpiW (lpString1=".txt", lpString2=".money") returned 1
	[0062.863] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27
	[0062.863] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.863] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=145180) returned 1
	[0062.863] CloseHandle (hObject=0x320) returned 1
	[0062.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20
	[0062.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.863] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.864] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.864] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.864] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0063.442] GetLastError () returned 0x0
	[0063.442] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x2371c, lpOverlapped=0x0) returned 1
	[0063.446] WriteFile (in: hFile=0x360, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x23720, lpOverlapped=0x0) returned 1
	[0063.449] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.449] WriteFile (in: hFile=0x360, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0063.449] SetEndOfFile (hFile=0x360) returned 1
	[0063.449] CloseHandle (hObject=0x360) returned 1
	[0063.453] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.453] SetEndOfFile (hFile=0x320) returned 1
	[0063.455] CloseHandle (hObject=0x320) returned 1
	[0063.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0063.455] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1
	[0063.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.455] lstrlenW (lpString=".doc") returned 4
	[0063.455] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0063.455] lstrlenW (lpString=".docx") returned 5
	[0063.455] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0063.455] lstrlenW (lpString=".pdf") returned 4
	[0063.456] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0063.456] lstrlenW (lpString=".xls") returned 4
	[0063.456] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0063.456] lstrlenW (lpString=".xlsx") returned 5
	[0063.456] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0063.456] lstrlenW (lpString=".ppt") returned 4
	[0063.456] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0063.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.456] lstrlenW (lpString=".zip") returned 4
	[0063.456] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0063.456] lstrlenW (lpString=".rar") returned 4
	[0063.456] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0063.456] lstrlenW (lpString=".bz2") returned 4
	[0063.456] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0063.456] lstrlenW (lpString=".7z") returned 3
	[0063.456] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0063.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.456] lstrlenW (lpString=".dbf") returned 4
	[0063.456] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0063.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.456] lstrlenW (lpString=".1cd") returned 4
	[0063.456] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0063.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.456] lstrlenW (lpString=".jpg") returned 4
	[0063.457] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0063.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.457] lstrlenW (lpString=".doc") returned 4
	[0063.457] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0063.457] lstrlenW (lpString=".docx") returned 5
	[0063.457] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0063.457] lstrlenW (lpString=".pdf") returned 4
	[0063.457] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0063.457] lstrlenW (lpString=".xls") returned 4
	[0063.457] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0063.457] lstrlenW (lpString=".xlsx") returned 5
	[0063.457] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0063.457] lstrlenW (lpString=".ppt") returned 4
	[0063.457] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0063.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.457] lstrlenW (lpString=".zip") returned 4
	[0063.457] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0063.457] lstrlenW (lpString=".rar") returned 4
	[0063.457] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0063.457] lstrlenW (lpString=".bz2") returned 4
	[0063.457] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0063.457] lstrlenW (lpString=".7z") returned 3
	[0063.457] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0063.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.458] lstrlenW (lpString=".dbf") returned 4
	[0063.458] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0063.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.458] lstrlenW (lpString=".1cd") returned 4
	[0063.458] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0063.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0063.458] lstrlenW (lpString=".jpg") returned 4
	[0063.458] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0063.458] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0063.458] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53
	[0063.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.458] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1533) returned 1
	[0063.458] CloseHandle (hObject=0x320) returned 1
	[0063.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0063.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.459] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.459] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0063.461] GetLastError () returned 0x0
	[0063.461] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x5fd, lpOverlapped=0x0) returned 1
	[0063.462] WriteFile (in: hFile=0x360, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x600, lpOverlapped=0x0) returned 1
	[0063.463] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.463] WriteFile (in: hFile=0x360, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0063.463] SetEndOfFile (hFile=0x360) returned 1
	[0063.464] CloseHandle (hObject=0x360) returned 1
	[0063.464] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.465] SetEndOfFile (hFile=0x320) returned 1
	[0063.465] CloseHandle (hObject=0x320) returned 1
	[0063.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0063.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1
	[0063.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.466] lstrlenW (lpString=".doc") returned 4
	[0063.466] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.466] lstrlenW (lpString=".docx") returned 5
	[0063.467] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.467] lstrlenW (lpString=".pdf") returned 4
	[0063.467] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.467] lstrlenW (lpString=".xls") returned 4
	[0063.467] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.467] lstrlenW (lpString=".xlsx") returned 5
	[0063.467] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.467] lstrlenW (lpString=".ppt") returned 4
	[0063.467] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.467] lstrlenW (lpString=".zip") returned 4
	[0063.467] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.467] lstrlenW (lpString=".rar") returned 4
	[0063.467] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.467] lstrlenW (lpString=".bz2") returned 4
	[0063.468] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.468] lstrlenW (lpString=".7z") returned 3
	[0063.468] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.468] lstrlenW (lpString=".dbf") returned 4
	[0063.468] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.468] lstrlenW (lpString=".1cd") returned 4
	[0063.468] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.468] lstrlenW (lpString=".jpg") returned 4
	[0063.468] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.469] lstrlenW (lpString=".doc") returned 4
	[0063.469] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.469] lstrlenW (lpString=".docx") returned 5
	[0063.469] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.469] lstrlenW (lpString=".pdf") returned 4
	[0063.469] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.469] lstrlenW (lpString=".xls") returned 4
	[0063.469] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.469] lstrlenW (lpString=".xlsx") returned 5
	[0063.469] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.469] lstrlenW (lpString=".ppt") returned 4
	[0063.469] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.470] lstrlenW (lpString=".zip") returned 4
	[0063.470] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.470] lstrlenW (lpString=".rar") returned 4
	[0063.470] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.470] lstrlenW (lpString=".bz2") returned 4
	[0063.470] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.470] lstrlenW (lpString=".7z") returned 3
	[0063.470] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.470] lstrlenW (lpString=".dbf") returned 4
	[0063.470] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.470] lstrlenW (lpString=".1cd") returned 4
	[0063.470] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0063.471] lstrlenW (lpString=".jpg") returned 4
	[0063.471] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.471] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0063.471] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53
	[0063.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.472] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=800867) returned 1
	[0063.472] CloseHandle (hObject=0x320) returned 1
	[0063.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0063.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0063.473] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.473] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0063.474] GetLastError () returned 0x0
	[0063.474] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xc3863, lpOverlapped=0x0) returned 1
	[0063.831] WriteFile (in: hFile=0x360, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xc3870, lpOverlapped=0x0) returned 1
	[0063.846] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.846] WriteFile (in: hFile=0x360, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0063.846] SetEndOfFile (hFile=0x360) returned 1
	[0063.846] CloseHandle (hObject=0x360) returned 1
	[0063.862] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.862] SetEndOfFile (hFile=0x320) returned 1
	[0064.383] CloseHandle (hObject=0x320) returned 1
	[0064.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0064.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1
	[0064.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.384] lstrlenW (lpString=".doc") returned 4
	[0064.384] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.384] lstrlenW (lpString=".docx") returned 5
	[0064.384] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.384] lstrlenW (lpString=".pdf") returned 4
	[0064.384] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.384] lstrlenW (lpString=".xls") returned 4
	[0064.384] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.384] lstrlenW (lpString=".xlsx") returned 5
	[0064.384] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.384] lstrlenW (lpString=".ppt") returned 4
	[0064.384] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.384] lstrlenW (lpString=".zip") returned 4
	[0064.384] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.384] lstrlenW (lpString=".rar") returned 4
	[0064.384] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.384] lstrlenW (lpString=".bz2") returned 4
	[0064.384] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.384] lstrlenW (lpString=".7z") returned 3
	[0064.384] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.384] lstrlenW (lpString=".dbf") returned 4
	[0064.385] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.385] lstrlenW (lpString=".1cd") returned 4
	[0064.385] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.385] lstrlenW (lpString=".jpg") returned 4
	[0064.385] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.385] lstrlenW (lpString=".doc") returned 4
	[0064.385] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.385] lstrlenW (lpString=".docx") returned 5
	[0064.385] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.385] lstrlenW (lpString=".pdf") returned 4
	[0064.385] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.385] lstrlenW (lpString=".xls") returned 4
	[0064.385] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.385] lstrlenW (lpString=".xlsx") returned 5
	[0064.385] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.385] lstrlenW (lpString=".ppt") returned 4
	[0064.385] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.385] lstrlenW (lpString=".zip") returned 4
	[0064.385] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.386] lstrlenW (lpString=".rar") returned 4
	[0064.386] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.386] lstrlenW (lpString=".bz2") returned 4
	[0064.386] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.386] lstrlenW (lpString=".7z") returned 3
	[0064.386] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.386] lstrlenW (lpString=".dbf") returned 4
	[0064.386] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.386] lstrlenW (lpString=".1cd") returned 4
	[0064.386] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0064.386] lstrlenW (lpString=".jpg") returned 4
	[0064.386] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.386] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0064.386] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53
	[0064.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.387] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1261) returned 1
	[0064.387] CloseHandle (hObject=0x320) returned 1
	[0064.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0064.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0064.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.387] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.387] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0064.387] GetLastError () returned 0x0
	[0064.387] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0064.389] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0064.390] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.390] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0064.390] SetEndOfFile (hFile=0x378) returned 1
	[0064.390] CloseHandle (hObject=0x378) returned 1
	[0064.393] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.393] SetEndOfFile (hFile=0x320) returned 1
	[0064.394] CloseHandle (hObject=0x320) returned 1
	[0064.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0064.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1
	[0064.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.395] lstrlenW (lpString=".doc") returned 4
	[0064.395] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.395] lstrlenW (lpString=".docx") returned 5
	[0064.395] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.395] lstrlenW (lpString=".pdf") returned 4
	[0064.395] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.395] lstrlenW (lpString=".xls") returned 4
	[0064.395] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.396] lstrlenW (lpString=".xlsx") returned 5
	[0064.396] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.396] lstrlenW (lpString=".ppt") returned 4
	[0064.396] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.396] lstrlenW (lpString=".zip") returned 4
	[0064.396] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.396] lstrlenW (lpString=".rar") returned 4
	[0064.396] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.396] lstrlenW (lpString=".bz2") returned 4
	[0064.396] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.396] lstrlenW (lpString=".7z") returned 3
	[0064.396] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.396] lstrlenW (lpString=".dbf") returned 4
	[0064.397] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.397] lstrlenW (lpString=".1cd") returned 4
	[0064.397] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.397] lstrlenW (lpString=".jpg") returned 4
	[0064.397] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.397] lstrlenW (lpString=".doc") returned 4
	[0064.397] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString=".docx") returned 5
	[0064.397] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.398] lstrlenW (lpString=".pdf") returned 4
	[0064.398] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.398] lstrlenW (lpString=".xls") returned 4
	[0064.398] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.398] lstrlenW (lpString=".xlsx") returned 5
	[0064.398] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.398] lstrlenW (lpString=".ppt") returned 4
	[0064.398] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.398] lstrlenW (lpString=".zip") returned 4
	[0064.398] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.398] lstrlenW (lpString=".rar") returned 4
	[0064.398] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.398] lstrlenW (lpString=".bz2") returned 4
	[0064.399] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.399] lstrlenW (lpString=".7z") returned 3
	[0064.399] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.399] lstrlenW (lpString=".dbf") returned 4
	[0064.399] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.399] lstrlenW (lpString=".1cd") returned 4
	[0064.399] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0064.399] lstrlenW (lpString=".jpg") returned 4
	[0064.399] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.400] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0064.400] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53
	[0064.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.400] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1261) returned 1
	[0064.400] CloseHandle (hObject=0x320) returned 1
	[0064.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0064.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0064.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.401] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.401] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0064.401] GetLastError () returned 0x0
	[0064.401] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0064.403] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0064.403] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.404] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0064.404] SetEndOfFile (hFile=0x378) returned 1
	[0064.404] CloseHandle (hObject=0x378) returned 1
	[0064.405] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.405] SetEndOfFile (hFile=0x320) returned 1
	[0064.406] CloseHandle (hObject=0x320) returned 1
	[0064.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0064.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1
	[0064.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.406] lstrlenW (lpString=".doc") returned 4
	[0064.407] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.407] lstrlenW (lpString=".docx") returned 5
	[0064.407] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.407] lstrlenW (lpString=".pdf") returned 4
	[0064.407] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.407] lstrlenW (lpString=".xls") returned 4
	[0064.407] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.407] lstrlenW (lpString=".xlsx") returned 5
	[0064.407] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.407] lstrlenW (lpString=".ppt") returned 4
	[0064.407] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.407] lstrlenW (lpString=".zip") returned 4
	[0064.407] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.407] lstrlenW (lpString=".rar") returned 4
	[0064.407] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.407] lstrlenW (lpString=".bz2") returned 4
	[0064.407] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.407] lstrlenW (lpString=".7z") returned 3
	[0064.407] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.408] lstrlenW (lpString=".dbf") returned 4
	[0064.408] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.408] lstrlenW (lpString=".1cd") returned 4
	[0064.408] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.408] lstrlenW (lpString=".jpg") returned 4
	[0064.408] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.408] lstrlenW (lpString=".doc") returned 4
	[0064.408] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.408] lstrlenW (lpString=".docx") returned 5
	[0064.408] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.408] lstrlenW (lpString=".pdf") returned 4
	[0064.408] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.408] lstrlenW (lpString=".xls") returned 4
	[0064.408] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.409] lstrlenW (lpString=".xlsx") returned 5
	[0064.409] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.409] lstrlenW (lpString=".ppt") returned 4
	[0064.409] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.409] lstrlenW (lpString=".zip") returned 4
	[0064.409] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.409] lstrlenW (lpString=".rar") returned 4
	[0064.409] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.409] lstrlenW (lpString=".bz2") returned 4
	[0064.409] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.409] lstrlenW (lpString=".7z") returned 3
	[0064.409] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.409] lstrlenW (lpString=".dbf") returned 4
	[0064.409] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.409] lstrlenW (lpString=".1cd") returned 4
	[0064.409] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0064.409] lstrlenW (lpString=".jpg") returned 4
	[0064.409] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.409] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0064.410] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53
	[0064.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.410] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2147) returned 1
	[0064.410] CloseHandle (hObject=0x320) returned 1
	[0064.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220
	[0064.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0064.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.410] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.410] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0064.411] GetLastError () returned 0x0
	[0064.818] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x863, lpOverlapped=0x0) returned 1
	[0064.820] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x870, lpOverlapped=0x0) returned 1
	[0064.821] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.821] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0064.821] SetEndOfFile (hFile=0x378) returned 1
	[0064.821] CloseHandle (hObject=0x378) returned 1
	[0064.822] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.822] SetEndOfFile (hFile=0x320) returned 1
	[0064.823] CloseHandle (hObject=0x320) returned 1
	[0064.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0064.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1
	[0064.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.823] lstrlenW (lpString=".doc") returned 4
	[0064.823] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.823] lstrlenW (lpString=".docx") returned 5
	[0064.824] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.824] lstrlenW (lpString=".pdf") returned 4
	[0064.824] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.824] lstrlenW (lpString=".xls") returned 4
	[0064.824] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.824] lstrlenW (lpString=".xlsx") returned 5
	[0064.824] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.824] lstrlenW (lpString=".ppt") returned 4
	[0064.824] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.824] lstrlenW (lpString=".zip") returned 4
	[0064.824] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.824] lstrlenW (lpString=".rar") returned 4
	[0064.824] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.824] lstrlenW (lpString=".bz2") returned 4
	[0064.824] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.824] lstrlenW (lpString=".7z") returned 3
	[0064.824] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.824] lstrlenW (lpString=".dbf") returned 4
	[0064.824] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.824] lstrlenW (lpString=".1cd") returned 4
	[0064.824] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.825] lstrlenW (lpString=".jpg") returned 4
	[0064.825] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.825] lstrlenW (lpString=".doc") returned 4
	[0064.825] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.825] lstrlenW (lpString=".docx") returned 5
	[0064.825] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.825] lstrlenW (lpString=".pdf") returned 4
	[0064.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.825] lstrlenW (lpString=".xls") returned 4
	[0064.825] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.825] lstrlenW (lpString=".xlsx") returned 5
	[0064.825] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.825] lstrlenW (lpString=".ppt") returned 4
	[0064.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.825] lstrlenW (lpString=".zip") returned 4
	[0064.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.825] lstrlenW (lpString=".rar") returned 4
	[0064.825] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.825] lstrlenW (lpString=".bz2") returned 4
	[0064.825] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.825] lstrlenW (lpString=".7z") returned 3
	[0064.825] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.826] lstrlenW (lpString=".dbf") returned 4
	[0064.826] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.826] lstrlenW (lpString=".1cd") returned 4
	[0064.826] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0064.826] lstrlenW (lpString=".jpg") returned 4
	[0064.826] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.826] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0064.826] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53
	[0064.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.826] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2147) returned 1
	[0064.826] CloseHandle (hObject=0x320) returned 1
	[0064.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220
	[0064.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0064.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.827] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.827] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0064.827] GetLastError () returned 0x0
	[0064.827] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x863, lpOverlapped=0x0) returned 1
	[0064.829] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x870, lpOverlapped=0x0) returned 1
	[0064.829] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.830] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0064.830] SetEndOfFile (hFile=0x378) returned 1
	[0064.830] CloseHandle (hObject=0x378) returned 1
	[0064.830] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.831] SetEndOfFile (hFile=0x320) returned 1
	[0064.831] CloseHandle (hObject=0x320) returned 1
	[0064.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0064.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1
	[0064.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.832] lstrlenW (lpString=".doc") returned 4
	[0064.832] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.832] lstrlenW (lpString=".docx") returned 5
	[0064.832] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.832] lstrlenW (lpString=".pdf") returned 4
	[0064.832] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.832] lstrlenW (lpString=".xls") returned 4
	[0064.832] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.832] lstrlenW (lpString=".xlsx") returned 5
	[0064.832] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.832] lstrlenW (lpString=".ppt") returned 4
	[0064.833] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.833] lstrlenW (lpString=".zip") returned 4
	[0064.833] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.833] lstrlenW (lpString=".rar") returned 4
	[0064.833] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.833] lstrlenW (lpString=".bz2") returned 4
	[0064.833] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.833] lstrlenW (lpString=".7z") returned 3
	[0064.833] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.833] lstrlenW (lpString=".dbf") returned 4
	[0064.833] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.833] lstrlenW (lpString=".1cd") returned 4
	[0064.833] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.833] lstrlenW (lpString=".jpg") returned 4
	[0064.833] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.833] lstrlenW (lpString=".doc") returned 4
	[0064.833] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.833] lstrlenW (lpString=".docx") returned 5
	[0064.834] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0064.834] lstrlenW (lpString=".pdf") returned 4
	[0064.834] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.834] lstrlenW (lpString=".xls") returned 4
	[0064.834] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.834] lstrlenW (lpString=".xlsx") returned 5
	[0064.834] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0064.834] lstrlenW (lpString=".ppt") returned 4
	[0064.834] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.834] lstrlenW (lpString=".zip") returned 4
	[0064.834] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.834] lstrlenW (lpString=".rar") returned 4
	[0064.834] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.834] lstrlenW (lpString=".bz2") returned 4
	[0064.834] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.834] lstrlenW (lpString=".7z") returned 3
	[0064.834] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.834] lstrlenW (lpString=".dbf") returned 4
	[0064.834] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.834] lstrlenW (lpString=".1cd") returned 4
	[0064.834] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0064.834] lstrlenW (lpString=".jpg") returned 4
	[0064.834] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.835] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0064.835] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53
	[0064.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.835] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=215883) returned 1
	[0064.835] CloseHandle (hObject=0x320) returned 1
	[0064.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0064.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0064.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0064.836] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.836] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0066.417] GetLastError () returned 0x0
	[0066.443] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x34b4b, lpOverlapped=0x0) returned 1
	[0066.447] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x34b50, lpOverlapped=0x0) returned 1
	[0066.451] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.451] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.451] SetEndOfFile (hFile=0x33c) returned 1
	[0066.451] CloseHandle (hObject=0x33c) returned 1
	[0066.456] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.457] SetEndOfFile (hFile=0x320) returned 1
	[0066.459] CloseHandle (hObject=0x320) returned 1
	[0066.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0066.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1
	[0066.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.460] lstrlenW (lpString=".doc") returned 4
	[0066.460] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.460] lstrlenW (lpString=".docx") returned 5
	[0066.460] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.460] lstrlenW (lpString=".pdf") returned 4
	[0066.460] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.460] lstrlenW (lpString=".xls") returned 4
	[0066.460] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.460] lstrlenW (lpString=".xlsx") returned 5
	[0066.460] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.460] lstrlenW (lpString=".ppt") returned 4
	[0066.460] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.460] lstrlenW (lpString=".zip") returned 4
	[0066.460] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.460] lstrlenW (lpString=".rar") returned 4
	[0066.460] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.460] lstrlenW (lpString=".bz2") returned 4
	[0066.460] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.460] lstrlenW (lpString=".7z") returned 3
	[0066.460] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.460] lstrlenW (lpString=".dbf") returned 4
	[0066.461] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.461] lstrlenW (lpString=".1cd") returned 4
	[0066.461] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.461] lstrlenW (lpString=".jpg") returned 4
	[0066.461] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.461] lstrlenW (lpString=".doc") returned 4
	[0066.461] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.461] lstrlenW (lpString=".docx") returned 5
	[0066.461] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.461] lstrlenW (lpString=".pdf") returned 4
	[0066.461] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.461] lstrlenW (lpString=".xls") returned 4
	[0066.461] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.461] lstrlenW (lpString=".xlsx") returned 5
	[0066.461] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.461] lstrlenW (lpString=".ppt") returned 4
	[0066.461] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.462] lstrlenW (lpString=".zip") returned 4
	[0066.462] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.462] lstrlenW (lpString=".rar") returned 4
	[0066.462] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.462] lstrlenW (lpString=".bz2") returned 4
	[0066.462] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.462] lstrlenW (lpString=".7z") returned 3
	[0066.462] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.462] lstrlenW (lpString=".dbf") returned 4
	[0066.462] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.462] lstrlenW (lpString=".1cd") returned 4
	[0066.462] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0066.462] lstrlenW (lpString=".jpg") returned 4
	[0066.462] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.462] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0066.463] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53
	[0066.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.463] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=343329) returned 1
	[0066.463] CloseHandle (hObject=0x320) returned 1
	[0066.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0066.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0066.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0066.463] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.463] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0066.464] GetLastError () returned 0x0
	[0066.464] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x53d21, lpOverlapped=0x0) returned 1
	[0066.471] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x53d30, lpOverlapped=0x0) returned 1
	[0066.994] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.994] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.994] SetEndOfFile (hFile=0x33c) returned 1
	[0067.361] CloseHandle (hObject=0x33c) returned 1
	[0067.394] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.394] SetEndOfFile (hFile=0x320) returned 1
	[0067.398] CloseHandle (hObject=0x320) returned 1
	[0067.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.399] lstrlenW (lpString=".doc") returned 4
	[0067.399] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.399] lstrlenW (lpString=".docx") returned 5
	[0067.399] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.399] lstrlenW (lpString=".pdf") returned 4
	[0067.399] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.399] lstrlenW (lpString=".xls") returned 4
	[0067.399] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.399] lstrlenW (lpString=".xlsx") returned 5
	[0067.399] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.399] lstrlenW (lpString=".ppt") returned 4
	[0067.399] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.399] lstrlenW (lpString=".zip") returned 4
	[0067.399] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.399] lstrlenW (lpString=".rar") returned 4
	[0067.399] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.399] lstrlenW (lpString=".bz2") returned 4
	[0067.399] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.399] lstrlenW (lpString=".7z") returned 3
	[0067.399] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.399] lstrlenW (lpString=".dbf") returned 4
	[0067.399] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.399] lstrlenW (lpString=".1cd") returned 4
	[0067.399] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.400] lstrlenW (lpString=".jpg") returned 4
	[0067.400] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.400] lstrlenW (lpString=".doc") returned 4
	[0067.400] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.400] lstrlenW (lpString=".docx") returned 5
	[0067.400] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.400] lstrlenW (lpString=".pdf") returned 4
	[0067.400] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.400] lstrlenW (lpString=".xls") returned 4
	[0067.400] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.400] lstrlenW (lpString=".xlsx") returned 5
	[0067.400] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.400] lstrlenW (lpString=".ppt") returned 4
	[0067.400] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.400] lstrlenW (lpString=".zip") returned 4
	[0067.400] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.400] lstrlenW (lpString=".rar") returned 4
	[0067.400] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.400] lstrlenW (lpString=".bz2") returned 4
	[0067.400] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.401] lstrlenW (lpString=".7z") returned 3
	[0067.401] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.401] lstrlenW (lpString=".dbf") returned 4
	[0067.401] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.401] lstrlenW (lpString=".1cd") returned 4
	[0067.401] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.401] lstrlenW (lpString=".jpg") returned 4
	[0067.401] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.401] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.401] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53
	[0067.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.401] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1261) returned 1
	[0067.402] CloseHandle (hObject=0x320) returned 1
	[0067.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.402] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.402] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0067.402] GetLastError () returned 0x0
	[0067.402] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.404] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.405] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.405] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.405] SetEndOfFile (hFile=0x33c) returned 1
	[0067.405] CloseHandle (hObject=0x33c) returned 1
	[0067.406] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.406] SetEndOfFile (hFile=0x320) returned 1
	[0067.407] CloseHandle (hObject=0x320) returned 1
	[0067.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.408] lstrlenW (lpString=".doc") returned 4
	[0067.408] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.408] lstrlenW (lpString=".docx") returned 5
	[0067.408] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.408] lstrlenW (lpString=".pdf") returned 4
	[0067.408] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.408] lstrlenW (lpString=".xls") returned 4
	[0067.408] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.408] lstrlenW (lpString=".xlsx") returned 5
	[0067.408] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.408] lstrlenW (lpString=".ppt") returned 4
	[0067.408] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.408] lstrlenW (lpString=".zip") returned 4
	[0067.408] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.408] lstrlenW (lpString=".rar") returned 4
	[0067.408] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.408] lstrlenW (lpString=".bz2") returned 4
	[0067.408] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.408] lstrlenW (lpString=".7z") returned 3
	[0067.408] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.408] lstrlenW (lpString=".dbf") returned 4
	[0067.408] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.408] lstrlenW (lpString=".1cd") returned 4
	[0067.409] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.409] lstrlenW (lpString=".jpg") returned 4
	[0067.409] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.409] lstrlenW (lpString=".doc") returned 4
	[0067.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.409] lstrlenW (lpString=".docx") returned 5
	[0067.409] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.409] lstrlenW (lpString=".pdf") returned 4
	[0067.409] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.409] lstrlenW (lpString=".xls") returned 4
	[0067.409] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.409] lstrlenW (lpString=".xlsx") returned 5
	[0067.409] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.409] lstrlenW (lpString=".ppt") returned 4
	[0067.409] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.409] lstrlenW (lpString=".zip") returned 4
	[0067.409] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.409] lstrlenW (lpString=".rar") returned 4
	[0067.409] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.410] lstrlenW (lpString=".bz2") returned 4
	[0067.410] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.410] lstrlenW (lpString=".7z") returned 3
	[0067.410] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.410] lstrlenW (lpString=".dbf") returned 4
	[0067.410] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.410] lstrlenW (lpString=".1cd") returned 4
	[0067.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.410] lstrlenW (lpString=".jpg") returned 4
	[0067.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.410] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.410] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53
	[0067.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.411] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1450) returned 1
	[0067.411] CloseHandle (hObject=0x320) returned 1
	[0067.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0067.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.411] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.412] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0067.412] GetLastError () returned 0x0
	[0067.412] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x5aa, lpOverlapped=0x0) returned 1
	[0067.413] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x5b0, lpOverlapped=0x0) returned 1
	[0067.414] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.414] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.414] SetEndOfFile (hFile=0x33c) returned 1
	[0067.414] CloseHandle (hObject=0x33c) returned 1
	[0067.415] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.415] SetEndOfFile (hFile=0x320) returned 1
	[0067.416] CloseHandle (hObject=0x320) returned 1
	[0067.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.417] lstrlenW (lpString=".doc") returned 4
	[0067.417] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.417] lstrlenW (lpString=".docx") returned 5
	[0067.417] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.417] lstrlenW (lpString=".pdf") returned 4
	[0067.417] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.417] lstrlenW (lpString=".xls") returned 4
	[0067.417] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.417] lstrlenW (lpString=".xlsx") returned 5
	[0067.417] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.417] lstrlenW (lpString=".ppt") returned 4
	[0067.417] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.417] lstrlenW (lpString=".zip") returned 4
	[0067.417] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.417] lstrlenW (lpString=".rar") returned 4
	[0067.417] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.417] lstrlenW (lpString=".bz2") returned 4
	[0067.417] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.417] lstrlenW (lpString=".7z") returned 3
	[0067.417] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.417] lstrlenW (lpString=".dbf") returned 4
	[0067.417] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.418] lstrlenW (lpString=".1cd") returned 4
	[0067.418] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.418] lstrlenW (lpString=".jpg") returned 4
	[0067.418] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.418] lstrlenW (lpString=".doc") returned 4
	[0067.418] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.418] lstrlenW (lpString=".docx") returned 5
	[0067.418] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.418] lstrlenW (lpString=".pdf") returned 4
	[0067.418] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.418] lstrlenW (lpString=".xls") returned 4
	[0067.418] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.418] lstrlenW (lpString=".xlsx") returned 5
	[0067.418] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.418] lstrlenW (lpString=".ppt") returned 4
	[0067.418] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.418] lstrlenW (lpString=".zip") returned 4
	[0067.418] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.418] lstrlenW (lpString=".rar") returned 4
	[0067.418] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.418] lstrlenW (lpString=".bz2") returned 4
	[0067.418] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.418] lstrlenW (lpString=".7z") returned 3
	[0067.419] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.419] lstrlenW (lpString=".dbf") returned 4
	[0067.419] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.419] lstrlenW (lpString=".1cd") returned 4
	[0067.419] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0067.419] lstrlenW (lpString=".jpg") returned 4
	[0067.419] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.419] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.419] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53
	[0067.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.419] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1261) returned 1
	[0067.419] CloseHandle (hObject=0x320) returned 1
	[0067.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.420] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.420] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0067.420] GetLastError () returned 0x0
	[0067.420] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.591] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.592] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.592] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.592] SetEndOfFile (hFile=0x33c) returned 1
	[0067.593] CloseHandle (hObject=0x33c) returned 1
	[0067.593] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.593] SetEndOfFile (hFile=0x320) returned 1
	[0067.594] CloseHandle (hObject=0x320) returned 1
	[0067.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.595] lstrlenW (lpString=".doc") returned 4
	[0067.595] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.595] lstrlenW (lpString=".docx") returned 5
	[0067.595] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.595] lstrlenW (lpString=".pdf") returned 4
	[0067.595] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.595] lstrlenW (lpString=".xls") returned 4
	[0067.595] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.595] lstrlenW (lpString=".xlsx") returned 5
	[0067.595] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.595] lstrlenW (lpString=".ppt") returned 4
	[0067.595] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.595] lstrlenW (lpString=".zip") returned 4
	[0067.595] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.595] lstrlenW (lpString=".rar") returned 4
	[0067.595] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.595] lstrlenW (lpString=".bz2") returned 4
	[0067.596] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.596] lstrlenW (lpString=".7z") returned 3
	[0067.596] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.596] lstrlenW (lpString=".dbf") returned 4
	[0067.596] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.596] lstrlenW (lpString=".1cd") returned 4
	[0067.596] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.596] lstrlenW (lpString=".jpg") returned 4
	[0067.596] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.596] lstrlenW (lpString=".doc") returned 4
	[0067.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.596] lstrlenW (lpString=".docx") returned 5
	[0067.596] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.596] lstrlenW (lpString=".pdf") returned 4
	[0067.596] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.596] lstrlenW (lpString=".xls") returned 4
	[0067.596] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.596] lstrlenW (lpString=".xlsx") returned 5
	[0067.596] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.596] lstrlenW (lpString=".ppt") returned 4
	[0067.596] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.597] lstrlenW (lpString=".zip") returned 4
	[0067.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.597] lstrlenW (lpString=".rar") returned 4
	[0067.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.597] lstrlenW (lpString=".bz2") returned 4
	[0067.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.597] lstrlenW (lpString=".7z") returned 3
	[0067.597] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.597] lstrlenW (lpString=".dbf") returned 4
	[0067.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.597] lstrlenW (lpString=".1cd") returned 4
	[0067.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0067.597] lstrlenW (lpString=".jpg") returned 4
	[0067.597] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.597] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.597] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25
	[0067.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.598] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=9831) returned 1
	[0067.598] CloseHandle (hObject=0x320) returned 1
	[0067.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220
	[0067.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.598] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.600] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0067.600] GetLastError () returned 0x0
	[0067.600] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x2667, lpOverlapped=0x0) returned 1
	[0067.601] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2670, lpOverlapped=0x0) returned 1
	[0067.603] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.603] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x106, lpOverlapped=0x0) returned 1
	[0067.603] SetEndOfFile (hFile=0x33c) returned 1
	[0067.603] CloseHandle (hObject=0x33c) returned 1
	[0067.604] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.604] SetEndOfFile (hFile=0x320) returned 1
	[0067.605] CloseHandle (hObject=0x320) returned 1
	[0067.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1
	[0067.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.606] lstrlenW (lpString=".doc") returned 4
	[0067.606] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.606] lstrlenW (lpString=".docx") returned 5
	[0067.606] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0067.606] lstrlenW (lpString=".pdf") returned 4
	[0067.606] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.606] lstrlenW (lpString=".xls") returned 4
	[0067.606] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.606] lstrlenW (lpString=".xlsx") returned 5
	[0067.606] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0067.606] lstrlenW (lpString=".ppt") returned 4
	[0067.606] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.606] lstrlenW (lpString=".zip") returned 4
	[0067.606] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.606] lstrlenW (lpString=".rar") returned 4
	[0067.606] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.606] lstrlenW (lpString=".bz2") returned 4
	[0067.606] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.606] lstrlenW (lpString=".7z") returned 3
	[0067.606] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.607] lstrlenW (lpString=".dbf") returned 4
	[0067.607] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.607] lstrlenW (lpString=".1cd") returned 4
	[0067.607] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.607] lstrlenW (lpString=".jpg") returned 4
	[0067.607] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.607] lstrlenW (lpString=".doc") returned 4
	[0067.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.607] lstrlenW (lpString=".docx") returned 5
	[0067.607] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0067.607] lstrlenW (lpString=".pdf") returned 4
	[0067.607] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.607] lstrlenW (lpString=".xls") returned 4
	[0067.607] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.607] lstrlenW (lpString=".xlsx") returned 5
	[0067.607] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0067.607] lstrlenW (lpString=".ppt") returned 4
	[0067.607] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.607] lstrlenW (lpString=".zip") returned 4
	[0067.607] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.607] lstrlenW (lpString=".rar") returned 4
	[0067.607] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.607] lstrlenW (lpString=".bz2") returned 4
	[0067.608] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.608] lstrlenW (lpString=".7z") returned 3
	[0067.608] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.608] lstrlenW (lpString=".dbf") returned 4
	[0067.608] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.608] lstrlenW (lpString=".1cd") returned 4
	[0067.608] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0067.608] lstrlenW (lpString=".jpg") returned 4
	[0067.608] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.608] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.608] lstrlenW (lpString="AuthoredExtensions.xml") returned 22
	[0067.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.608] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=373) returned 1
	[0067.609] CloseHandle (hObject=0x320) returned 1
	[0067.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220
	[0067.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.609] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.609] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0067.609] GetLastError () returned 0x0
	[0067.609] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x175, lpOverlapped=0x0) returned 1
	[0067.610] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x180, lpOverlapped=0x0) returned 1
	[0067.611] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.611] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x100, lpOverlapped=0x0) returned 1
	[0067.612] SetEndOfFile (hFile=0x33c) returned 1
	[0067.612] CloseHandle (hObject=0x33c) returned 1
	[0067.613] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.613] SetEndOfFile (hFile=0x320) returned 1
	[0067.614] CloseHandle (hObject=0x320) returned 1
	[0067.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1
	[0067.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.614] lstrlenW (lpString=".doc") returned 4
	[0067.614] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.614] lstrlenW (lpString=".docx") returned 5
	[0067.614] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0067.615] lstrlenW (lpString=".pdf") returned 4
	[0067.615] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.615] lstrlenW (lpString=".xls") returned 4
	[0067.615] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.615] lstrlenW (lpString=".xlsx") returned 5
	[0067.615] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0067.615] lstrlenW (lpString=".ppt") returned 4
	[0067.615] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.615] lstrlenW (lpString=".zip") returned 4
	[0067.615] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.615] lstrlenW (lpString=".rar") returned 4
	[0067.615] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.615] lstrlenW (lpString=".bz2") returned 4
	[0067.615] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.615] lstrlenW (lpString=".7z") returned 3
	[0067.615] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.615] lstrlenW (lpString=".dbf") returned 4
	[0067.615] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.615] lstrlenW (lpString=".1cd") returned 4
	[0067.615] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.615] lstrlenW (lpString=".jpg") returned 4
	[0067.615] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.615] lstrlenW (lpString=".doc") returned 4
	[0067.616] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.616] lstrlenW (lpString=".docx") returned 5
	[0067.616] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0067.616] lstrlenW (lpString=".pdf") returned 4
	[0067.616] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.616] lstrlenW (lpString=".xls") returned 4
	[0067.616] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.616] lstrlenW (lpString=".xlsx") returned 5
	[0067.616] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0067.616] lstrlenW (lpString=".ppt") returned 4
	[0067.616] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.616] lstrlenW (lpString=".zip") returned 4
	[0067.616] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.616] lstrlenW (lpString=".rar") returned 4
	[0067.616] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.616] lstrlenW (lpString=".bz2") returned 4
	[0067.616] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.616] lstrlenW (lpString=".7z") returned 3
	[0067.616] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.616] lstrlenW (lpString=".dbf") returned 4
	[0067.616] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.616] lstrlenW (lpString=".1cd") returned 4
	[0067.616] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0067.617] lstrlenW (lpString=".jpg") returned 4
	[0067.617] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.617] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0067.617] lstrlenW (lpString="AG00004_.GIF") returned 12
	[0067.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.620] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=9024) returned 1
	[0067.620] CloseHandle (hObject=0x320) returned 1
	[0067.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220
	[0067.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0067.620] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.620] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0067.621] GetLastError () returned 0x0
	[0067.621] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x2340, lpOverlapped=0x0) returned 1
	[0067.622] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2350, lpOverlapped=0x0) returned 1
	[0067.623] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.623] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0067.623] SetEndOfFile (hFile=0x33c) returned 1
	[0067.623] CloseHandle (hObject=0x33c) returned 1
	[0067.624] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.624] SetEndOfFile (hFile=0x320) returned 1
	[0067.625] CloseHandle (hObject=0x320) returned 1
	[0067.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1
	[0067.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.626] lstrlenW (lpString=".doc") returned 4
	[0067.626] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0067.626] lstrlenW (lpString=".docx") returned 5
	[0067.626] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0067.626] lstrlenW (lpString=".pdf") returned 4
	[0067.626] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0067.626] lstrlenW (lpString=".xls") returned 4
	[0067.626] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0067.626] lstrlenW (lpString=".xlsx") returned 5
	[0067.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0067.626] lstrlenW (lpString=".ppt") returned 4
	[0067.626] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0067.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.626] lstrlenW (lpString=".zip") returned 4
	[0067.626] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0067.626] lstrlenW (lpString=".rar") returned 4
	[0067.626] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0067.627] lstrlenW (lpString=".bz2") returned 4
	[0067.627] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0067.627] lstrlenW (lpString=".7z") returned 3
	[0067.627] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0067.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.627] lstrlenW (lpString=".dbf") returned 4
	[0067.627] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0067.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.627] lstrlenW (lpString=".1cd") returned 4
	[0067.627] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0067.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.627] lstrlenW (lpString=".jpg") returned 4
	[0067.627] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0067.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.627] lstrlenW (lpString=".doc") returned 4
	[0067.627] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0067.627] lstrlenW (lpString=".docx") returned 5
	[0067.627] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0067.627] lstrlenW (lpString=".pdf") returned 4
	[0067.627] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0067.628] lstrlenW (lpString=".xls") returned 4
	[0067.628] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0067.628] lstrlenW (lpString=".xlsx") returned 5
	[0067.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0067.628] lstrlenW (lpString=".ppt") returned 4
	[0067.628] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0067.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.628] lstrlenW (lpString=".zip") returned 4
	[0067.628] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0067.628] lstrlenW (lpString=".rar") returned 4
	[0067.628] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0067.628] lstrlenW (lpString=".bz2") returned 4
	[0067.628] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0067.628] lstrlenW (lpString=".7z") returned 3
	[0067.628] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0067.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.628] lstrlenW (lpString=".dbf") returned 4
	[0067.628] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0067.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.628] lstrlenW (lpString=".1cd") returned 4
	[0067.628] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0067.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0067.628] lstrlenW (lpString=".jpg") returned 4
	[0067.628] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0067.629] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0067.629] lstrlenW (lpString="AG00011_.GIF") returned 12
	[0067.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0067.804] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=7216) returned 1
	[0067.804] CloseHandle (hObject=0x384) returned 1
	[0067.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220
	[0067.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0067.838] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.838] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0068.451] GetLastError () returned 0x0
	[0068.451] ReadFile (in: hFile=0x378, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1c30, lpOverlapped=0x0) returned 1
	[0068.453] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1c40, lpOverlapped=0x0) returned 1
	[0068.454] ReadFile (in: hFile=0x378, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.454] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.454] SetEndOfFile (hFile=0x38c) returned 1
	[0068.454] CloseHandle (hObject=0x38c) returned 1
	[0068.456] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.456] SetEndOfFile (hFile=0x378) returned 1
	[0068.457] CloseHandle (hObject=0x378) returned 1
	[0068.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1
	[0068.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.457] lstrlenW (lpString=".doc") returned 4
	[0068.457] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.457] lstrlenW (lpString=".docx") returned 5
	[0068.457] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.457] lstrlenW (lpString=".pdf") returned 4
	[0068.457] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.457] lstrlenW (lpString=".xls") returned 4
	[0068.457] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.457] lstrlenW (lpString=".xlsx") returned 5
	[0068.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.458] lstrlenW (lpString=".ppt") returned 4
	[0068.458] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.458] lstrlenW (lpString=".zip") returned 4
	[0068.458] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.458] lstrlenW (lpString=".rar") returned 4
	[0068.458] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.458] lstrlenW (lpString=".bz2") returned 4
	[0068.458] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.458] lstrlenW (lpString=".7z") returned 3
	[0068.458] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.458] lstrlenW (lpString=".dbf") returned 4
	[0068.458] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.458] lstrlenW (lpString=".1cd") returned 4
	[0068.458] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.458] lstrlenW (lpString=".jpg") returned 4
	[0068.458] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.458] lstrlenW (lpString=".doc") returned 4
	[0068.458] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.458] lstrlenW (lpString=".docx") returned 5
	[0068.458] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.458] lstrlenW (lpString=".pdf") returned 4
	[0068.459] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.459] lstrlenW (lpString=".xls") returned 4
	[0068.459] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.459] lstrlenW (lpString=".xlsx") returned 5
	[0068.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.459] lstrlenW (lpString=".ppt") returned 4
	[0068.459] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.459] lstrlenW (lpString=".zip") returned 4
	[0068.459] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.459] lstrlenW (lpString=".rar") returned 4
	[0068.459] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.459] lstrlenW (lpString=".bz2") returned 4
	[0068.459] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.459] lstrlenW (lpString=".7z") returned 3
	[0068.459] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.459] lstrlenW (lpString=".dbf") returned 4
	[0068.459] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.459] lstrlenW (lpString=".1cd") returned 4
	[0068.459] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0068.459] lstrlenW (lpString=".jpg") returned 4
	[0068.459] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.460] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.460] lstrlenW (lpString="AG00130_.GIF") returned 12
	[0068.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0068.460] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=5253) returned 1
	[0068.460] CloseHandle (hObject=0x378) returned 1
	[0068.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220
	[0068.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0068.461] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.461] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0068.461] GetLastError () returned 0x0
	[0068.461] ReadFile (in: hFile=0x378, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1485, lpOverlapped=0x0) returned 1
	[0068.463] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1490, lpOverlapped=0x0) returned 1
	[0068.464] ReadFile (in: hFile=0x378, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.464] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.465] SetEndOfFile (hFile=0x38c) returned 1
	[0068.465] CloseHandle (hObject=0x38c) returned 1
	[0068.465] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.466] SetEndOfFile (hFile=0x378) returned 1
	[0068.466] CloseHandle (hObject=0x378) returned 1
	[0068.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1
	[0068.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.467] lstrlenW (lpString=".doc") returned 4
	[0068.467] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.467] lstrlenW (lpString=".docx") returned 5
	[0068.467] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.467] lstrlenW (lpString=".pdf") returned 4
	[0068.467] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.467] lstrlenW (lpString=".xls") returned 4
	[0068.467] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.467] lstrlenW (lpString=".xlsx") returned 5
	[0068.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.467] lstrlenW (lpString=".ppt") returned 4
	[0068.467] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.468] lstrlenW (lpString=".zip") returned 4
	[0068.468] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.468] lstrlenW (lpString=".rar") returned 4
	[0068.468] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.468] lstrlenW (lpString=".bz2") returned 4
	[0068.468] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.468] lstrlenW (lpString=".7z") returned 3
	[0068.468] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.468] lstrlenW (lpString=".dbf") returned 4
	[0068.468] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.468] lstrlenW (lpString=".1cd") returned 4
	[0068.468] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.468] lstrlenW (lpString=".jpg") returned 4
	[0068.468] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.468] lstrlenW (lpString=".doc") returned 4
	[0068.468] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.468] lstrlenW (lpString=".docx") returned 5
	[0068.468] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.468] lstrlenW (lpString=".pdf") returned 4
	[0068.469] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.469] lstrlenW (lpString=".xls") returned 4
	[0068.469] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.469] lstrlenW (lpString=".xlsx") returned 5
	[0068.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.469] lstrlenW (lpString=".ppt") returned 4
	[0068.469] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.469] lstrlenW (lpString=".zip") returned 4
	[0068.469] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.469] lstrlenW (lpString=".rar") returned 4
	[0068.469] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.469] lstrlenW (lpString=".bz2") returned 4
	[0068.469] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.469] lstrlenW (lpString=".7z") returned 3
	[0068.469] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.469] lstrlenW (lpString=".dbf") returned 4
	[0068.469] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.469] lstrlenW (lpString=".1cd") returned 4
	[0068.469] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0068.469] lstrlenW (lpString=".jpg") returned 4
	[0068.469] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.470] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.470] lstrlenW (lpString="AG00135_.GIF") returned 12
	[0068.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0068.470] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2596) returned 1
	[0068.470] CloseHandle (hObject=0x378) returned 1
	[0068.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220
	[0068.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0068.471] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.471] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0068.471] GetLastError () returned 0x0
	[0068.471] ReadFile (in: hFile=0x378, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xa24, lpOverlapped=0x0) returned 1
	[0068.473] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xa30, lpOverlapped=0x0) returned 1
	[0068.474] ReadFile (in: hFile=0x378, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.474] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.474] SetEndOfFile (hFile=0x38c) returned 1
	[0068.474] CloseHandle (hObject=0x38c) returned 1
	[0068.475] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.475] SetEndOfFile (hFile=0x378) returned 1
	[0068.476] CloseHandle (hObject=0x378) returned 1
	[0068.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1
	[0068.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.477] lstrlenW (lpString=".doc") returned 4
	[0068.477] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.477] lstrlenW (lpString=".docx") returned 5
	[0068.477] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.477] lstrlenW (lpString=".pdf") returned 4
	[0068.477] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.477] lstrlenW (lpString=".xls") returned 4
	[0068.477] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.477] lstrlenW (lpString=".xlsx") returned 5
	[0068.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.477] lstrlenW (lpString=".ppt") returned 4
	[0068.477] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.477] lstrlenW (lpString=".zip") returned 4
	[0068.477] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.477] lstrlenW (lpString=".rar") returned 4
	[0068.477] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.477] lstrlenW (lpString=".bz2") returned 4
	[0068.477] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.477] lstrlenW (lpString=".7z") returned 3
	[0068.477] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.477] lstrlenW (lpString=".dbf") returned 4
	[0068.477] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.478] lstrlenW (lpString=".1cd") returned 4
	[0068.478] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.478] lstrlenW (lpString=".jpg") returned 4
	[0068.478] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.478] lstrlenW (lpString=".doc") returned 4
	[0068.478] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.478] lstrlenW (lpString=".docx") returned 5
	[0068.478] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.478] lstrlenW (lpString=".pdf") returned 4
	[0068.478] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.478] lstrlenW (lpString=".xls") returned 4
	[0068.479] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.479] lstrlenW (lpString=".xlsx") returned 5
	[0068.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.479] lstrlenW (lpString=".ppt") returned 4
	[0068.479] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.479] lstrlenW (lpString=".zip") returned 4
	[0068.479] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.479] lstrlenW (lpString=".rar") returned 4
	[0068.479] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.479] lstrlenW (lpString=".bz2") returned 4
	[0068.479] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.479] lstrlenW (lpString=".7z") returned 3
	[0068.479] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.479] lstrlenW (lpString=".dbf") returned 4
	[0068.479] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.479] lstrlenW (lpString=".1cd") returned 4
	[0068.479] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0068.479] lstrlenW (lpString=".jpg") returned 4
	[0068.479] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.479] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.479] lstrlenW (lpString="AG00139_.GIF") returned 12
	[0068.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0068.480] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=10607) returned 1
	[0068.480] CloseHandle (hObject=0x378) returned 1
	[0068.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220
	[0068.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0068.480] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.480] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0068.481] GetLastError () returned 0x0
	[0068.481] ReadFile (in: hFile=0x378, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x296f, lpOverlapped=0x0) returned 1
	[0068.482] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2970, lpOverlapped=0x0) returned 1
	[0068.483] ReadFile (in: hFile=0x378, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.483] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.483] SetEndOfFile (hFile=0x38c) returned 1
	[0068.483] CloseHandle (hObject=0x38c) returned 1
	[0068.484] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.484] SetEndOfFile (hFile=0x378) returned 1
	[0068.485] CloseHandle (hObject=0x378) returned 1
	[0068.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1
	[0068.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.486] lstrlenW (lpString=".doc") returned 4
	[0068.486] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.486] lstrlenW (lpString=".docx") returned 5
	[0068.486] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.486] lstrlenW (lpString=".pdf") returned 4
	[0068.486] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.486] lstrlenW (lpString=".xls") returned 4
	[0068.486] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.486] lstrlenW (lpString=".xlsx") returned 5
	[0068.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.486] lstrlenW (lpString=".ppt") returned 4
	[0068.486] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.486] lstrlenW (lpString=".zip") returned 4
	[0068.486] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.486] lstrlenW (lpString=".rar") returned 4
	[0068.486] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.486] lstrlenW (lpString=".bz2") returned 4
	[0068.486] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.486] lstrlenW (lpString=".7z") returned 3
	[0068.486] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.486] lstrlenW (lpString=".dbf") returned 4
	[0068.487] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.487] lstrlenW (lpString=".1cd") returned 4
	[0068.487] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.487] lstrlenW (lpString=".jpg") returned 4
	[0068.487] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.487] lstrlenW (lpString=".doc") returned 4
	[0068.487] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.487] lstrlenW (lpString=".docx") returned 5
	[0068.487] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.487] lstrlenW (lpString=".pdf") returned 4
	[0068.487] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.487] lstrlenW (lpString=".xls") returned 4
	[0068.487] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.487] lstrlenW (lpString=".xlsx") returned 5
	[0068.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.487] lstrlenW (lpString=".ppt") returned 4
	[0068.487] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.487] lstrlenW (lpString=".zip") returned 4
	[0068.487] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.487] lstrlenW (lpString=".rar") returned 4
	[0068.487] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.487] lstrlenW (lpString=".bz2") returned 4
	[0068.488] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.488] lstrlenW (lpString=".7z") returned 3
	[0068.488] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.488] lstrlenW (lpString=".dbf") returned 4
	[0068.488] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.488] lstrlenW (lpString=".1cd") returned 4
	[0068.488] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0068.488] lstrlenW (lpString=".jpg") returned 4
	[0068.488] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.488] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.488] lstrlenW (lpString="AG00142_.GIF") returned 12
	[0068.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.965] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=15308) returned 1
	[0068.965] CloseHandle (hObject=0x320) returned 1
	[0068.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220
	[0068.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.965] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.965] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0068.966] GetLastError () returned 0x0
	[0068.966] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x3bcc, lpOverlapped=0x0) returned 1
	[0068.968] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x3bd0, lpOverlapped=0x0) returned 1
	[0068.969] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.969] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.969] SetEndOfFile (hFile=0x38c) returned 1
	[0068.969] CloseHandle (hObject=0x38c) returned 1
	[0068.971] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.971] SetEndOfFile (hFile=0x320) returned 1
	[0068.972] CloseHandle (hObject=0x320) returned 1
	[0068.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1
	[0068.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.973] lstrlenW (lpString=".doc") returned 4
	[0068.973] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.973] lstrlenW (lpString=".docx") returned 5
	[0068.973] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.973] lstrlenW (lpString=".pdf") returned 4
	[0068.973] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.973] lstrlenW (lpString=".xls") returned 4
	[0068.973] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.973] lstrlenW (lpString=".xlsx") returned 5
	[0068.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.973] lstrlenW (lpString=".ppt") returned 4
	[0068.973] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.973] lstrlenW (lpString=".zip") returned 4
	[0068.973] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.974] lstrlenW (lpString=".rar") returned 4
	[0068.974] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.974] lstrlenW (lpString=".bz2") returned 4
	[0068.974] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.974] lstrlenW (lpString=".7z") returned 3
	[0068.974] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.974] lstrlenW (lpString=".dbf") returned 4
	[0068.974] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.974] lstrlenW (lpString=".1cd") returned 4
	[0068.974] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.974] lstrlenW (lpString=".jpg") returned 4
	[0068.975] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.975] lstrlenW (lpString=".doc") returned 4
	[0068.975] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.975] lstrlenW (lpString=".docx") returned 5
	[0068.975] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.975] lstrlenW (lpString=".pdf") returned 4
	[0068.975] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.975] lstrlenW (lpString=".xls") returned 4
	[0068.975] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.975] lstrlenW (lpString=".xlsx") returned 5
	[0068.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.975] lstrlenW (lpString=".ppt") returned 4
	[0068.975] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.976] lstrlenW (lpString=".zip") returned 4
	[0068.976] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.976] lstrlenW (lpString=".rar") returned 4
	[0068.976] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.976] lstrlenW (lpString=".bz2") returned 4
	[0068.976] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.976] lstrlenW (lpString=".7z") returned 3
	[0068.976] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.976] lstrlenW (lpString=".dbf") returned 4
	[0068.976] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.976] lstrlenW (lpString=".1cd") returned 4
	[0068.976] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0068.977] lstrlenW (lpString=".jpg") returned 4
	[0068.977] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.977] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.977] lstrlenW (lpString="AG00157_.GIF") returned 12
	[0068.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.978] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=4955) returned 1
	[0068.978] CloseHandle (hObject=0x320) returned 1
	[0068.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220
	[0068.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.979] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.979] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0068.979] GetLastError () returned 0x0
	[0068.979] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x135b, lpOverlapped=0x0) returned 1
	[0068.981] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1360, lpOverlapped=0x0) returned 1
	[0068.982] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.982] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.982] SetEndOfFile (hFile=0x38c) returned 1
	[0068.983] CloseHandle (hObject=0x38c) returned 1
	[0068.983] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.983] SetEndOfFile (hFile=0x320) returned 1
	[0068.984] CloseHandle (hObject=0x320) returned 1
	[0068.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1
	[0068.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.985] lstrlenW (lpString=".doc") returned 4
	[0068.985] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.985] lstrlenW (lpString=".docx") returned 5
	[0068.985] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.985] lstrlenW (lpString=".pdf") returned 4
	[0068.985] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.985] lstrlenW (lpString=".xls") returned 4
	[0068.985] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.985] lstrlenW (lpString=".xlsx") returned 5
	[0068.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.986] lstrlenW (lpString=".ppt") returned 4
	[0068.986] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.986] lstrlenW (lpString=".zip") returned 4
	[0068.986] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.986] lstrlenW (lpString=".rar") returned 4
	[0068.986] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.986] lstrlenW (lpString=".bz2") returned 4
	[0068.986] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.986] lstrlenW (lpString=".7z") returned 3
	[0068.986] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.986] lstrlenW (lpString=".dbf") returned 4
	[0068.986] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.986] lstrlenW (lpString=".1cd") returned 4
	[0068.986] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.986] lstrlenW (lpString=".jpg") returned 4
	[0068.986] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.987] lstrlenW (lpString=".doc") returned 4
	[0068.987] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.987] lstrlenW (lpString=".docx") returned 5
	[0068.987] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.987] lstrlenW (lpString=".pdf") returned 4
	[0068.987] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.987] lstrlenW (lpString=".xls") returned 4
	[0068.987] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.987] lstrlenW (lpString=".xlsx") returned 5
	[0068.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.987] lstrlenW (lpString=".ppt") returned 4
	[0068.987] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.987] lstrlenW (lpString=".zip") returned 4
	[0068.987] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.987] lstrlenW (lpString=".rar") returned 4
	[0068.988] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.988] lstrlenW (lpString=".bz2") returned 4
	[0068.988] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.988] lstrlenW (lpString=".7z") returned 3
	[0068.988] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.988] lstrlenW (lpString=".dbf") returned 4
	[0068.988] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.988] lstrlenW (lpString=".1cd") returned 4
	[0068.988] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0068.988] lstrlenW (lpString=".jpg") returned 4
	[0068.988] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.989] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.989] lstrlenW (lpString="AG00158_.GIF") returned 12
	[0068.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.989] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=5030) returned 1
	[0068.989] CloseHandle (hObject=0x320) returned 1
	[0068.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220
	[0068.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.989] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.990] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0068.990] GetLastError () returned 0x0
	[0068.990] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x13a6, lpOverlapped=0x0) returned 1
	[0068.991] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x13b0, lpOverlapped=0x0) returned 1
	[0068.992] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.992] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.993] SetEndOfFile (hFile=0x38c) returned 1
	[0068.993] CloseHandle (hObject=0x38c) returned 1
	[0068.994] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.994] SetEndOfFile (hFile=0x320) returned 1
	[0068.995] CloseHandle (hObject=0x320) returned 1
	[0068.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1
	[0068.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.995] lstrlenW (lpString=".doc") returned 4
	[0068.995] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.995] lstrlenW (lpString=".docx") returned 5
	[0068.995] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.996] lstrlenW (lpString=".pdf") returned 4
	[0068.996] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.996] lstrlenW (lpString=".xls") returned 4
	[0068.996] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.996] lstrlenW (lpString=".xlsx") returned 5
	[0068.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.996] lstrlenW (lpString=".ppt") returned 4
	[0068.996] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.996] lstrlenW (lpString=".zip") returned 4
	[0068.996] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.996] lstrlenW (lpString=".rar") returned 4
	[0068.996] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.996] lstrlenW (lpString=".bz2") returned 4
	[0068.996] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.996] lstrlenW (lpString=".7z") returned 3
	[0068.996] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.996] lstrlenW (lpString=".dbf") returned 4
	[0068.996] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.996] lstrlenW (lpString=".1cd") returned 4
	[0068.996] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.996] lstrlenW (lpString=".jpg") returned 4
	[0068.996] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.997] lstrlenW (lpString=".doc") returned 4
	[0068.997] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.997] lstrlenW (lpString=".docx") returned 5
	[0068.997] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.997] lstrlenW (lpString=".pdf") returned 4
	[0068.997] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.997] lstrlenW (lpString=".xls") returned 4
	[0068.997] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.997] lstrlenW (lpString=".xlsx") returned 5
	[0068.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.997] lstrlenW (lpString=".ppt") returned 4
	[0068.997] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.997] lstrlenW (lpString=".zip") returned 4
	[0068.997] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.997] lstrlenW (lpString=".rar") returned 4
	[0068.997] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.997] lstrlenW (lpString=".bz2") returned 4
	[0068.997] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.997] lstrlenW (lpString=".7z") returned 3
	[0068.997] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.997] lstrlenW (lpString=".dbf") returned 4
	[0068.997] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.997] lstrlenW (lpString=".1cd") returned 4
	[0068.997] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0068.998] lstrlenW (lpString=".jpg") returned 4
	[0068.998] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.998] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.998] lstrlenW (lpString="AG00160_.GIF") returned 12
	[0068.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.998] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1146) returned 1
	[0068.998] CloseHandle (hObject=0x320) returned 1
	[0068.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220
	[0068.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.998] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.999] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0068.999] GetLastError () returned 0x0
	[0068.999] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x47a, lpOverlapped=0x0) returned 1
	[0069.373] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x480, lpOverlapped=0x0) returned 1
	[0069.374] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.374] WriteFile (in: hFile=0x38c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.374] SetEndOfFile (hFile=0x38c) returned 1
	[0069.776] CloseHandle (hObject=0x38c) returned 1
	[0069.816] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.816] SetEndOfFile (hFile=0x320) returned 1
	[0070.135] CloseHandle (hObject=0x320) returned 1
	[0070.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1
	[0070.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.135] lstrlenW (lpString=".doc") returned 4
	[0070.135] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.135] lstrlenW (lpString=".docx") returned 5
	[0070.135] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.135] lstrlenW (lpString=".pdf") returned 4
	[0070.135] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.135] lstrlenW (lpString=".xls") returned 4
	[0070.136] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.136] lstrlenW (lpString=".xlsx") returned 5
	[0070.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.136] lstrlenW (lpString=".ppt") returned 4
	[0070.136] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.136] lstrlenW (lpString=".zip") returned 4
	[0070.136] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.136] lstrlenW (lpString=".rar") returned 4
	[0070.136] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.136] lstrlenW (lpString=".bz2") returned 4
	[0070.136] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.136] lstrlenW (lpString=".7z") returned 3
	[0070.136] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.136] lstrlenW (lpString=".dbf") returned 4
	[0070.136] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.136] lstrlenW (lpString=".1cd") returned 4
	[0070.136] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.136] lstrlenW (lpString=".jpg") returned 4
	[0070.136] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.136] lstrlenW (lpString=".doc") returned 4
	[0070.137] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.137] lstrlenW (lpString=".docx") returned 5
	[0070.137] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.137] lstrlenW (lpString=".pdf") returned 4
	[0070.137] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.137] lstrlenW (lpString=".xls") returned 4
	[0070.137] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.137] lstrlenW (lpString=".xlsx") returned 5
	[0070.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.137] lstrlenW (lpString=".ppt") returned 4
	[0070.137] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.137] lstrlenW (lpString=".zip") returned 4
	[0070.137] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.137] lstrlenW (lpString=".rar") returned 4
	[0070.137] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.137] lstrlenW (lpString=".bz2") returned 4
	[0070.137] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.137] lstrlenW (lpString=".7z") returned 3
	[0070.137] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.137] lstrlenW (lpString=".dbf") returned 4
	[0070.137] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.137] lstrlenW (lpString=".1cd") returned 4
	[0070.137] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.138] lstrlenW (lpString=".jpg") returned 4
	[0070.138] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.138] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.138] lstrlenW (lpString="AN01039_.WMF") returned 12
	[0070.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.138] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3344) returned 1
	[0070.138] CloseHandle (hObject=0x320) returned 1
	[0070.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220
	[0070.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.139] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.139] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.139] GetLastError () returned 0x0
	[0070.139] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xd10, lpOverlapped=0x0) returned 1
	[0070.140] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xd20, lpOverlapped=0x0) returned 1
	[0070.141] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.142] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.142] SetEndOfFile (hFile=0x314) returned 1
	[0070.142] CloseHandle (hObject=0x314) returned 1
	[0070.143] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.143] SetEndOfFile (hFile=0x320) returned 1
	[0070.144] CloseHandle (hObject=0x320) returned 1
	[0070.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1
	[0070.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.144] lstrlenW (lpString=".doc") returned 4
	[0070.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.144] lstrlenW (lpString=".docx") returned 5
	[0070.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.144] lstrlenW (lpString=".pdf") returned 4
	[0070.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.144] lstrlenW (lpString=".xls") returned 4
	[0070.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.145] lstrlenW (lpString=".xlsx") returned 5
	[0070.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.145] lstrlenW (lpString=".ppt") returned 4
	[0070.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.145] lstrlenW (lpString=".zip") returned 4
	[0070.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.145] lstrlenW (lpString=".rar") returned 4
	[0070.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.145] lstrlenW (lpString=".bz2") returned 4
	[0070.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.145] lstrlenW (lpString=".7z") returned 3
	[0070.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.145] lstrlenW (lpString=".dbf") returned 4
	[0070.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.145] lstrlenW (lpString=".1cd") returned 4
	[0070.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.145] lstrlenW (lpString=".jpg") returned 4
	[0070.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.145] lstrlenW (lpString=".doc") returned 4
	[0070.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.145] lstrlenW (lpString=".docx") returned 5
	[0070.146] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.146] lstrlenW (lpString=".pdf") returned 4
	[0070.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.146] lstrlenW (lpString=".xls") returned 4
	[0070.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.146] lstrlenW (lpString=".xlsx") returned 5
	[0070.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.146] lstrlenW (lpString=".ppt") returned 4
	[0070.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.146] lstrlenW (lpString=".zip") returned 4
	[0070.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.146] lstrlenW (lpString=".rar") returned 4
	[0070.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.146] lstrlenW (lpString=".bz2") returned 4
	[0070.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.146] lstrlenW (lpString=".7z") returned 3
	[0070.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.146] lstrlenW (lpString=".dbf") returned 4
	[0070.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.146] lstrlenW (lpString=".1cd") returned 4
	[0070.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0070.146] lstrlenW (lpString=".jpg") returned 4
	[0070.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.147] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.147] lstrlenW (lpString="AN01044_.WMF") returned 12
	[0070.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.148] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1596) returned 1
	[0070.148] CloseHandle (hObject=0x320) returned 1
	[0070.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220
	[0070.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.148] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.148] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.148] GetLastError () returned 0x0
	[0070.148] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x63c, lpOverlapped=0x0) returned 1
	[0070.150] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x640, lpOverlapped=0x0) returned 1
	[0070.150] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.151] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.151] SetEndOfFile (hFile=0x314) returned 1
	[0070.151] CloseHandle (hObject=0x314) returned 1
	[0070.152] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.152] SetEndOfFile (hFile=0x320) returned 1
	[0070.152] CloseHandle (hObject=0x320) returned 1
	[0070.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1
	[0070.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.153] lstrlenW (lpString=".doc") returned 4
	[0070.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.153] lstrlenW (lpString=".docx") returned 5
	[0070.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.153] lstrlenW (lpString=".pdf") returned 4
	[0070.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.153] lstrlenW (lpString=".xls") returned 4
	[0070.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.153] lstrlenW (lpString=".xlsx") returned 5
	[0070.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.153] lstrlenW (lpString=".ppt") returned 4
	[0070.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.154] lstrlenW (lpString=".zip") returned 4
	[0070.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.154] lstrlenW (lpString=".rar") returned 4
	[0070.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.154] lstrlenW (lpString=".bz2") returned 4
	[0070.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.154] lstrlenW (lpString=".7z") returned 3
	[0070.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.154] lstrlenW (lpString=".dbf") returned 4
	[0070.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.154] lstrlenW (lpString=".1cd") returned 4
	[0070.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.154] lstrlenW (lpString=".jpg") returned 4
	[0070.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.154] lstrlenW (lpString=".doc") returned 4
	[0070.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.154] lstrlenW (lpString=".docx") returned 5
	[0070.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.154] lstrlenW (lpString=".pdf") returned 4
	[0070.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.155] lstrlenW (lpString=".xls") returned 4
	[0070.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.155] lstrlenW (lpString=".xlsx") returned 5
	[0070.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.155] lstrlenW (lpString=".ppt") returned 4
	[0070.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.155] lstrlenW (lpString=".zip") returned 4
	[0070.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.155] lstrlenW (lpString=".rar") returned 4
	[0070.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.155] lstrlenW (lpString=".bz2") returned 4
	[0070.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.155] lstrlenW (lpString=".7z") returned 3
	[0070.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.155] lstrlenW (lpString=".dbf") returned 4
	[0070.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.155] lstrlenW (lpString=".1cd") returned 4
	[0070.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0070.155] lstrlenW (lpString=".jpg") returned 4
	[0070.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.156] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.156] lstrlenW (lpString="AN01060_.WMF") returned 12
	[0070.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.156] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=7968) returned 1
	[0070.156] CloseHandle (hObject=0x320) returned 1
	[0070.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220
	[0070.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.156] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.156] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.157] GetLastError () returned 0x0
	[0070.157] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1f20, lpOverlapped=0x0) returned 1
	[0070.158] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1f30, lpOverlapped=0x0) returned 1
	[0070.159] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.159] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.160] SetEndOfFile (hFile=0x314) returned 1
	[0070.160] CloseHandle (hObject=0x314) returned 1
	[0070.161] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.161] SetEndOfFile (hFile=0x320) returned 1
	[0070.161] CloseHandle (hObject=0x320) returned 1
	[0070.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1
	[0070.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.162] lstrlenW (lpString=".doc") returned 4
	[0070.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.162] lstrlenW (lpString=".docx") returned 5
	[0070.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.162] lstrlenW (lpString=".pdf") returned 4
	[0070.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.162] lstrlenW (lpString=".xls") returned 4
	[0070.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.162] lstrlenW (lpString=".xlsx") returned 5
	[0070.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.163] lstrlenW (lpString=".ppt") returned 4
	[0070.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.163] lstrlenW (lpString=".zip") returned 4
	[0070.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.163] lstrlenW (lpString=".rar") returned 4
	[0070.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.163] lstrlenW (lpString=".bz2") returned 4
	[0070.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.163] lstrlenW (lpString=".7z") returned 3
	[0070.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.163] lstrlenW (lpString=".dbf") returned 4
	[0070.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.163] lstrlenW (lpString=".1cd") returned 4
	[0070.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.163] lstrlenW (lpString=".jpg") returned 4
	[0070.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.163] lstrlenW (lpString=".doc") returned 4
	[0070.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.163] lstrlenW (lpString=".docx") returned 5
	[0070.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.164] lstrlenW (lpString=".pdf") returned 4
	[0070.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.164] lstrlenW (lpString=".xls") returned 4
	[0070.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.164] lstrlenW (lpString=".xlsx") returned 5
	[0070.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.164] lstrlenW (lpString=".ppt") returned 4
	[0070.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.164] lstrlenW (lpString=".zip") returned 4
	[0070.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.164] lstrlenW (lpString=".rar") returned 4
	[0070.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.164] lstrlenW (lpString=".bz2") returned 4
	[0070.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.164] lstrlenW (lpString=".7z") returned 3
	[0070.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.164] lstrlenW (lpString=".dbf") returned 4
	[0070.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.164] lstrlenW (lpString=".1cd") returned 4
	[0070.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0070.165] lstrlenW (lpString=".jpg") returned 4
	[0070.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.165] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.165] lstrlenW (lpString="AN01084_.WMF") returned 12
	[0070.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.165] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1832) returned 1
	[0070.165] CloseHandle (hObject=0x320) returned 1
	[0070.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220
	[0070.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.166] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.166] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.166] GetLastError () returned 0x0
	[0070.166] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x728, lpOverlapped=0x0) returned 1
	[0070.853] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x730, lpOverlapped=0x0) returned 1
	[0070.854] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.854] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.854] SetEndOfFile (hFile=0x314) returned 1
	[0070.855] CloseHandle (hObject=0x314) returned 1
	[0070.855] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.855] SetEndOfFile (hFile=0x320) returned 1
	[0070.856] CloseHandle (hObject=0x320) returned 1
	[0070.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1
	[0070.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.857] lstrlenW (lpString=".doc") returned 4
	[0070.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.857] lstrlenW (lpString=".docx") returned 5
	[0070.857] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.857] lstrlenW (lpString=".pdf") returned 4
	[0070.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.857] lstrlenW (lpString=".xls") returned 4
	[0070.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.857] lstrlenW (lpString=".xlsx") returned 5
	[0070.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.857] lstrlenW (lpString=".ppt") returned 4
	[0070.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.857] lstrlenW (lpString=".zip") returned 4
	[0070.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.857] lstrlenW (lpString=".rar") returned 4
	[0070.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.857] lstrlenW (lpString=".bz2") returned 4
	[0070.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.858] lstrlenW (lpString=".7z") returned 3
	[0070.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.858] lstrlenW (lpString=".dbf") returned 4
	[0070.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.858] lstrlenW (lpString=".1cd") returned 4
	[0070.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.858] lstrlenW (lpString=".jpg") returned 4
	[0070.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.858] lstrlenW (lpString=".doc") returned 4
	[0070.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.858] lstrlenW (lpString=".docx") returned 5
	[0070.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.858] lstrlenW (lpString=".pdf") returned 4
	[0070.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.858] lstrlenW (lpString=".xls") returned 4
	[0070.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.858] lstrlenW (lpString=".xlsx") returned 5
	[0070.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.858] lstrlenW (lpString=".ppt") returned 4
	[0070.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.858] lstrlenW (lpString=".zip") returned 4
	[0070.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.858] lstrlenW (lpString=".rar") returned 4
	[0070.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.859] lstrlenW (lpString=".bz2") returned 4
	[0070.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.859] lstrlenW (lpString=".7z") returned 3
	[0070.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.859] lstrlenW (lpString=".dbf") returned 4
	[0070.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.859] lstrlenW (lpString=".1cd") returned 4
	[0070.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0070.859] lstrlenW (lpString=".jpg") returned 4
	[0070.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.859] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.859] lstrlenW (lpString="AN03500_.WMF") returned 12
	[0070.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.859] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=9240) returned 1
	[0070.859] CloseHandle (hObject=0x320) returned 1
	[0070.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220
	[0070.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.860] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.860] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.860] GetLastError () returned 0x0
	[0070.860] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x2418, lpOverlapped=0x0) returned 1
	[0070.862] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2420, lpOverlapped=0x0) returned 1
	[0070.863] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.863] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.863] SetEndOfFile (hFile=0x314) returned 1
	[0070.863] CloseHandle (hObject=0x314) returned 1
	[0070.864] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.864] SetEndOfFile (hFile=0x320) returned 1
	[0070.865] CloseHandle (hObject=0x320) returned 1
	[0070.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1
	[0070.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.865] lstrlenW (lpString=".doc") returned 4
	[0070.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.866] lstrlenW (lpString=".docx") returned 5
	[0070.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.866] lstrlenW (lpString=".pdf") returned 4
	[0070.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.866] lstrlenW (lpString=".xls") returned 4
	[0070.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.866] lstrlenW (lpString=".xlsx") returned 5
	[0070.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.866] lstrlenW (lpString=".ppt") returned 4
	[0070.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.866] lstrlenW (lpString=".zip") returned 4
	[0070.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.866] lstrlenW (lpString=".rar") returned 4
	[0070.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.866] lstrlenW (lpString=".bz2") returned 4
	[0070.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.866] lstrlenW (lpString=".7z") returned 3
	[0070.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.866] lstrlenW (lpString=".dbf") returned 4
	[0070.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.866] lstrlenW (lpString=".1cd") returned 4
	[0070.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.866] lstrlenW (lpString=".jpg") returned 4
	[0070.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.867] lstrlenW (lpString=".doc") returned 4
	[0070.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.867] lstrlenW (lpString=".docx") returned 5
	[0070.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.867] lstrlenW (lpString=".pdf") returned 4
	[0070.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.867] lstrlenW (lpString=".xls") returned 4
	[0070.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.867] lstrlenW (lpString=".xlsx") returned 5
	[0070.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.867] lstrlenW (lpString=".ppt") returned 4
	[0070.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.867] lstrlenW (lpString=".zip") returned 4
	[0070.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.867] lstrlenW (lpString=".rar") returned 4
	[0070.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.867] lstrlenW (lpString=".bz2") returned 4
	[0070.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.867] lstrlenW (lpString=".7z") returned 3
	[0070.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.867] lstrlenW (lpString=".dbf") returned 4
	[0070.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.867] lstrlenW (lpString=".1cd") returned 4
	[0070.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0070.867] lstrlenW (lpString=".jpg") returned 4
	[0070.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.868] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.868] lstrlenW (lpString="AN04108_.WMF") returned 12
	[0070.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.869] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2344) returned 1
	[0070.869] CloseHandle (hObject=0x320) returned 1
	[0070.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220
	[0070.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.869] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.869] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.869] GetLastError () returned 0x0
	[0070.869] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x928, lpOverlapped=0x0) returned 1
	[0070.871] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x930, lpOverlapped=0x0) returned 1
	[0070.872] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.872] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.872] SetEndOfFile (hFile=0x314) returned 1
	[0070.872] CloseHandle (hObject=0x314) returned 1
	[0070.873] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.873] SetEndOfFile (hFile=0x320) returned 1
	[0070.874] CloseHandle (hObject=0x320) returned 1
	[0070.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1
	[0070.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.874] lstrlenW (lpString=".doc") returned 4
	[0070.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.874] lstrlenW (lpString=".docx") returned 5
	[0070.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.874] lstrlenW (lpString=".pdf") returned 4
	[0070.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.875] lstrlenW (lpString=".xls") returned 4
	[0070.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.875] lstrlenW (lpString=".xlsx") returned 5
	[0070.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.875] lstrlenW (lpString=".ppt") returned 4
	[0070.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.875] lstrlenW (lpString=".zip") returned 4
	[0070.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.875] lstrlenW (lpString=".rar") returned 4
	[0070.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.875] lstrlenW (lpString=".bz2") returned 4
	[0070.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.875] lstrlenW (lpString=".7z") returned 3
	[0070.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.875] lstrlenW (lpString=".dbf") returned 4
	[0070.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.875] lstrlenW (lpString=".1cd") returned 4
	[0070.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.875] lstrlenW (lpString=".jpg") returned 4
	[0070.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.875] lstrlenW (lpString=".doc") returned 4
	[0070.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.876] lstrlenW (lpString=".docx") returned 5
	[0070.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.876] lstrlenW (lpString=".pdf") returned 4
	[0070.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.876] lstrlenW (lpString=".xls") returned 4
	[0070.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.876] lstrlenW (lpString=".xlsx") returned 5
	[0070.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.876] lstrlenW (lpString=".ppt") returned 4
	[0070.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.876] lstrlenW (lpString=".zip") returned 4
	[0070.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.876] lstrlenW (lpString=".rar") returned 4
	[0070.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.876] lstrlenW (lpString=".bz2") returned 4
	[0070.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.876] lstrlenW (lpString=".7z") returned 3
	[0070.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.876] lstrlenW (lpString=".dbf") returned 4
	[0070.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.876] lstrlenW (lpString=".1cd") returned 4
	[0070.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0070.876] lstrlenW (lpString=".jpg") returned 4
	[0070.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.877] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.877] lstrlenW (lpString="AN04117_.WMF") returned 12
	[0070.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.877] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=6060) returned 1
	[0070.877] CloseHandle (hObject=0x320) returned 1
	[0070.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220
	[0070.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.877] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.878] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.878] GetLastError () returned 0x0
	[0070.878] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x17ac, lpOverlapped=0x0) returned 1
	[0070.879] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x17b0, lpOverlapped=0x0) returned 1
	[0070.880] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.880] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.881] SetEndOfFile (hFile=0x314) returned 1
	[0070.881] CloseHandle (hObject=0x314) returned 1
	[0070.882] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.882] SetEndOfFile (hFile=0x320) returned 1
	[0070.882] CloseHandle (hObject=0x320) returned 1
	[0070.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1
	[0070.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.883] lstrlenW (lpString=".doc") returned 4
	[0070.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.883] lstrlenW (lpString=".docx") returned 5
	[0070.883] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.883] lstrlenW (lpString=".pdf") returned 4
	[0070.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.883] lstrlenW (lpString=".xls") returned 4
	[0070.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.883] lstrlenW (lpString=".xlsx") returned 5
	[0070.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.884] lstrlenW (lpString=".ppt") returned 4
	[0070.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.884] lstrlenW (lpString=".zip") returned 4
	[0070.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.884] lstrlenW (lpString=".rar") returned 4
	[0070.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.884] lstrlenW (lpString=".bz2") returned 4
	[0070.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.884] lstrlenW (lpString=".7z") returned 3
	[0070.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.884] lstrlenW (lpString=".dbf") returned 4
	[0070.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.885] lstrlenW (lpString=".1cd") returned 4
	[0070.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.885] lstrlenW (lpString=".jpg") returned 4
	[0070.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.885] lstrlenW (lpString=".doc") returned 4
	[0070.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.885] lstrlenW (lpString=".docx") returned 5
	[0070.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.885] lstrlenW (lpString=".pdf") returned 4
	[0070.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.885] lstrlenW (lpString=".xls") returned 4
	[0070.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.885] lstrlenW (lpString=".xlsx") returned 5
	[0070.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.885] lstrlenW (lpString=".ppt") returned 4
	[0070.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.885] lstrlenW (lpString=".zip") returned 4
	[0070.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.885] lstrlenW (lpString=".rar") returned 4
	[0070.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.886] lstrlenW (lpString=".bz2") returned 4
	[0070.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.886] lstrlenW (lpString=".7z") returned 3
	[0070.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.886] lstrlenW (lpString=".dbf") returned 4
	[0070.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.886] lstrlenW (lpString=".1cd") returned 4
	[0070.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0070.886] lstrlenW (lpString=".jpg") returned 4
	[0070.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.886] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.886] lstrlenW (lpString="AN04134_.WMF") returned 12
	[0070.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.887] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3416) returned 1
	[0070.887] CloseHandle (hObject=0x320) returned 1
	[0070.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220
	[0070.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.887] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.887] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0070.888] GetLastError () returned 0x0
	[0070.888] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xd58, lpOverlapped=0x0) returned 1
	[0071.254] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xd60, lpOverlapped=0x0) returned 1
	[0071.255] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.255] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.255] SetEndOfFile (hFile=0x314) returned 1
	[0071.255] CloseHandle (hObject=0x314) returned 1
	[0071.260] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.260] SetEndOfFile (hFile=0x320) returned 1
	[0071.261] CloseHandle (hObject=0x320) returned 1
	[0071.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1
	[0071.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.261] lstrlenW (lpString=".doc") returned 4
	[0071.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.261] lstrlenW (lpString=".docx") returned 5
	[0071.261] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.261] lstrlenW (lpString=".pdf") returned 4
	[0071.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.261] lstrlenW (lpString=".xls") returned 4
	[0071.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.262] lstrlenW (lpString=".xlsx") returned 5
	[0071.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.262] lstrlenW (lpString=".ppt") returned 4
	[0071.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.262] lstrlenW (lpString=".zip") returned 4
	[0071.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.262] lstrlenW (lpString=".rar") returned 4
	[0071.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.262] lstrlenW (lpString=".bz2") returned 4
	[0071.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.262] lstrlenW (lpString=".7z") returned 3
	[0071.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.262] lstrlenW (lpString=".dbf") returned 4
	[0071.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.262] lstrlenW (lpString=".1cd") returned 4
	[0071.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.262] lstrlenW (lpString=".jpg") returned 4
	[0071.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.262] lstrlenW (lpString=".doc") returned 4
	[0071.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.263] lstrlenW (lpString=".docx") returned 5
	[0071.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.263] lstrlenW (lpString=".pdf") returned 4
	[0071.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.263] lstrlenW (lpString=".xls") returned 4
	[0071.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.263] lstrlenW (lpString=".xlsx") returned 5
	[0071.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.263] lstrlenW (lpString=".ppt") returned 4
	[0071.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.263] lstrlenW (lpString=".zip") returned 4
	[0071.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.263] lstrlenW (lpString=".rar") returned 4
	[0071.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.263] lstrlenW (lpString=".bz2") returned 4
	[0071.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.263] lstrlenW (lpString=".7z") returned 3
	[0071.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.263] lstrlenW (lpString=".dbf") returned 4
	[0071.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.263] lstrlenW (lpString=".1cd") returned 4
	[0071.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0071.263] lstrlenW (lpString=".jpg") returned 4
	[0071.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.264] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.264] lstrlenW (lpString="BD00116_.WMF") returned 12
	[0071.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0071.264] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=4870) returned 1
	[0071.264] CloseHandle (hObject=0x320) returned 1
	[0071.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220
	[0071.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0071.265] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.265] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0071.265] GetLastError () returned 0x0
	[0071.265] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1306, lpOverlapped=0x0) returned 1
	[0071.267] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1310, lpOverlapped=0x0) returned 1
	[0071.268] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.268] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.268] SetEndOfFile (hFile=0x314) returned 1
	[0071.268] CloseHandle (hObject=0x314) returned 1
	[0071.268] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.269] SetEndOfFile (hFile=0x320) returned 1
	[0071.269] CloseHandle (hObject=0x320) returned 1
	[0071.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1
	[0071.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.270] lstrlenW (lpString=".doc") returned 4
	[0071.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.270] lstrlenW (lpString=".docx") returned 5
	[0071.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.270] lstrlenW (lpString=".pdf") returned 4
	[0071.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.270] lstrlenW (lpString=".xls") returned 4
	[0071.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.270] lstrlenW (lpString=".xlsx") returned 5
	[0071.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.271] lstrlenW (lpString=".ppt") returned 4
	[0071.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.271] lstrlenW (lpString=".zip") returned 4
	[0071.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.271] lstrlenW (lpString=".rar") returned 4
	[0071.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.271] lstrlenW (lpString=".bz2") returned 4
	[0071.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.271] lstrlenW (lpString=".7z") returned 3
	[0071.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.271] lstrlenW (lpString=".dbf") returned 4
	[0071.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.271] lstrlenW (lpString=".1cd") returned 4
	[0071.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.271] lstrlenW (lpString=".jpg") returned 4
	[0071.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.271] lstrlenW (lpString=".doc") returned 4
	[0071.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.271] lstrlenW (lpString=".docx") returned 5
	[0071.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.272] lstrlenW (lpString=".pdf") returned 4
	[0071.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.272] lstrlenW (lpString=".xls") returned 4
	[0071.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.272] lstrlenW (lpString=".xlsx") returned 5
	[0071.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.272] lstrlenW (lpString=".ppt") returned 4
	[0071.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.272] lstrlenW (lpString=".zip") returned 4
	[0071.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.272] lstrlenW (lpString=".rar") returned 4
	[0071.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.272] lstrlenW (lpString=".bz2") returned 4
	[0071.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.272] lstrlenW (lpString=".7z") returned 3
	[0071.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.272] lstrlenW (lpString=".dbf") returned 4
	[0071.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.272] lstrlenW (lpString=".1cd") returned 4
	[0071.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0071.273] lstrlenW (lpString=".jpg") returned 4
	[0071.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.273] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.273] lstrlenW (lpString="BD00141_.WMF") returned 12
	[0071.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0071.273] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=26886) returned 1
	[0071.273] CloseHandle (hObject=0x320) returned 1
	[0071.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220
	[0071.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0071.274] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.274] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0071.274] GetLastError () returned 0x0
	[0071.274] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x6906, lpOverlapped=0x0) returned 1
	[0071.276] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x6910, lpOverlapped=0x0) returned 1
	[0071.277] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.277] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.277] SetEndOfFile (hFile=0x314) returned 1
	[0071.278] CloseHandle (hObject=0x314) returned 1
	[0071.279] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.279] SetEndOfFile (hFile=0x320) returned 1
	[0071.280] CloseHandle (hObject=0x320) returned 1
	[0071.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1
	[0071.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.281] lstrlenW (lpString=".doc") returned 4
	[0071.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.281] lstrlenW (lpString=".docx") returned 5
	[0071.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.281] lstrlenW (lpString=".pdf") returned 4
	[0071.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.281] lstrlenW (lpString=".xls") returned 4
	[0071.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.281] lstrlenW (lpString=".xlsx") returned 5
	[0071.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.281] lstrlenW (lpString=".ppt") returned 4
	[0071.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.281] lstrlenW (lpString=".zip") returned 4
	[0071.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.281] lstrlenW (lpString=".rar") returned 4
	[0071.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.281] lstrlenW (lpString=".bz2") returned 4
	[0071.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.282] lstrlenW (lpString=".7z") returned 3
	[0071.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.282] lstrlenW (lpString=".dbf") returned 4
	[0071.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.282] lstrlenW (lpString=".1cd") returned 4
	[0071.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.282] lstrlenW (lpString=".jpg") returned 4
	[0071.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.282] lstrlenW (lpString=".doc") returned 4
	[0071.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.282] lstrlenW (lpString=".docx") returned 5
	[0071.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.282] lstrlenW (lpString=".pdf") returned 4
	[0071.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.282] lstrlenW (lpString=".xls") returned 4
	[0071.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.283] lstrlenW (lpString=".xlsx") returned 5
	[0071.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.283] lstrlenW (lpString=".ppt") returned 4
	[0071.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.283] lstrlenW (lpString=".zip") returned 4
	[0071.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.283] lstrlenW (lpString=".rar") returned 4
	[0071.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.283] lstrlenW (lpString=".bz2") returned 4
	[0071.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.283] lstrlenW (lpString=".7z") returned 3
	[0071.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.283] lstrlenW (lpString=".dbf") returned 4
	[0071.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.283] lstrlenW (lpString=".1cd") returned 4
	[0071.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0071.283] lstrlenW (lpString=".jpg") returned 4
	[0071.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.284] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.284] lstrlenW (lpString="BD00146_.WMF") returned 12
	[0071.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0071.284] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=28948) returned 1
	[0071.284] CloseHandle (hObject=0x320) returned 1
	[0071.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220
	[0071.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0071.284] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.285] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0071.285] GetLastError () returned 0x0
	[0071.285] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x7114, lpOverlapped=0x0) returned 1
	[0071.581] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x7120, lpOverlapped=0x0) returned 1
	[0071.582] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.582] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.582] SetEndOfFile (hFile=0x314) returned 1
	[0072.235] CloseHandle (hObject=0x314) returned 1
	[0072.260] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.260] SetEndOfFile (hFile=0x320) returned 1
	[0072.261] CloseHandle (hObject=0x320) returned 1
	[0072.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1
	[0072.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.262] lstrlenW (lpString=".doc") returned 4
	[0072.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.262] lstrlenW (lpString=".docx") returned 5
	[0072.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.262] lstrlenW (lpString=".pdf") returned 4
	[0072.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.262] lstrlenW (lpString=".xls") returned 4
	[0072.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.262] lstrlenW (lpString=".xlsx") returned 5
	[0072.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.262] lstrlenW (lpString=".ppt") returned 4
	[0072.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.262] lstrlenW (lpString=".zip") returned 4
	[0072.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.262] lstrlenW (lpString=".rar") returned 4
	[0072.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.263] lstrlenW (lpString=".bz2") returned 4
	[0072.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.263] lstrlenW (lpString=".7z") returned 3
	[0072.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.263] lstrlenW (lpString=".dbf") returned 4
	[0072.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.263] lstrlenW (lpString=".1cd") returned 4
	[0072.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.263] lstrlenW (lpString=".jpg") returned 4
	[0072.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.263] lstrlenW (lpString=".doc") returned 4
	[0072.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.263] lstrlenW (lpString=".docx") returned 5
	[0072.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.263] lstrlenW (lpString=".pdf") returned 4
	[0072.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.263] lstrlenW (lpString=".xls") returned 4
	[0072.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.263] lstrlenW (lpString=".xlsx") returned 5
	[0072.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.264] lstrlenW (lpString=".ppt") returned 4
	[0072.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.264] lstrlenW (lpString=".zip") returned 4
	[0072.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.264] lstrlenW (lpString=".rar") returned 4
	[0072.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.264] lstrlenW (lpString=".bz2") returned 4
	[0072.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.264] lstrlenW (lpString=".7z") returned 3
	[0072.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.264] lstrlenW (lpString=".dbf") returned 4
	[0072.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.264] lstrlenW (lpString=".1cd") returned 4
	[0072.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.264] lstrlenW (lpString=".jpg") returned 4
	[0072.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.264] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.264] lstrlenW (lpString="BD09194_.WMF") returned 12
	[0072.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.265] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=14540) returned 1
	[0072.265] CloseHandle (hObject=0x320) returned 1
	[0072.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220
	[0072.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.266] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.266] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0072.266] GetLastError () returned 0x0
	[0072.266] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x38cc, lpOverlapped=0x0) returned 1
	[0072.268] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x38d0, lpOverlapped=0x0) returned 1
	[0072.269] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.269] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.269] SetEndOfFile (hFile=0x314) returned 1
	[0072.269] CloseHandle (hObject=0x314) returned 1
	[0072.270] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.271] SetEndOfFile (hFile=0x320) returned 1
	[0072.271] CloseHandle (hObject=0x320) returned 1
	[0072.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1
	[0072.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.272] lstrlenW (lpString=".doc") returned 4
	[0072.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.272] lstrlenW (lpString=".docx") returned 5
	[0072.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.272] lstrlenW (lpString=".pdf") returned 4
	[0072.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.272] lstrlenW (lpString=".xls") returned 4
	[0072.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.273] lstrlenW (lpString=".xlsx") returned 5
	[0072.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.273] lstrlenW (lpString=".ppt") returned 4
	[0072.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.273] lstrlenW (lpString=".zip") returned 4
	[0072.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.273] lstrlenW (lpString=".rar") returned 4
	[0072.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.273] lstrlenW (lpString=".bz2") returned 4
	[0072.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.273] lstrlenW (lpString=".7z") returned 3
	[0072.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.273] lstrlenW (lpString=".dbf") returned 4
	[0072.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.273] lstrlenW (lpString=".1cd") returned 4
	[0072.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.273] lstrlenW (lpString=".jpg") returned 4
	[0072.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.274] lstrlenW (lpString=".doc") returned 4
	[0072.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.274] lstrlenW (lpString=".docx") returned 5
	[0072.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.274] lstrlenW (lpString=".pdf") returned 4
	[0072.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.274] lstrlenW (lpString=".xls") returned 4
	[0072.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.274] lstrlenW (lpString=".xlsx") returned 5
	[0072.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.274] lstrlenW (lpString=".ppt") returned 4
	[0072.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.274] lstrlenW (lpString=".zip") returned 4
	[0072.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.274] lstrlenW (lpString=".rar") returned 4
	[0072.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.274] lstrlenW (lpString=".bz2") returned 4
	[0072.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.274] lstrlenW (lpString=".7z") returned 3
	[0072.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.274] lstrlenW (lpString=".dbf") returned 4
	[0072.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.275] lstrlenW (lpString=".1cd") returned 4
	[0072.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0072.275] lstrlenW (lpString=".jpg") returned 4
	[0072.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.275] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.275] lstrlenW (lpString="BD09662_.WMF") returned 12
	[0072.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.275] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=20554) returned 1
	[0072.275] CloseHandle (hObject=0x320) returned 1
	[0072.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220
	[0072.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.276] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.276] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0072.276] GetLastError () returned 0x0
	[0072.276] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x504a, lpOverlapped=0x0) returned 1
	[0072.278] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x5050, lpOverlapped=0x0) returned 1
	[0072.279] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.279] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.279] SetEndOfFile (hFile=0x314) returned 1
	[0072.280] CloseHandle (hObject=0x314) returned 1
	[0072.281] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.281] SetEndOfFile (hFile=0x320) returned 1
	[0072.282] CloseHandle (hObject=0x320) returned 1
	[0072.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1
	[0072.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.282] lstrlenW (lpString=".doc") returned 4
	[0072.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.283] lstrlenW (lpString=".docx") returned 5
	[0072.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.283] lstrlenW (lpString=".pdf") returned 4
	[0072.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.283] lstrlenW (lpString=".xls") returned 4
	[0072.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.283] lstrlenW (lpString=".xlsx") returned 5
	[0072.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.283] lstrlenW (lpString=".ppt") returned 4
	[0072.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.283] lstrlenW (lpString=".zip") returned 4
	[0072.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.283] lstrlenW (lpString=".rar") returned 4
	[0072.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.283] lstrlenW (lpString=".bz2") returned 4
	[0072.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.283] lstrlenW (lpString=".7z") returned 3
	[0072.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.283] lstrlenW (lpString=".dbf") returned 4
	[0072.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.283] lstrlenW (lpString=".1cd") returned 4
	[0072.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.284] lstrlenW (lpString=".jpg") returned 4
	[0072.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.284] lstrlenW (lpString=".doc") returned 4
	[0072.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.284] lstrlenW (lpString=".docx") returned 5
	[0072.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.284] lstrlenW (lpString=".pdf") returned 4
	[0072.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.284] lstrlenW (lpString=".xls") returned 4
	[0072.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.284] lstrlenW (lpString=".xlsx") returned 5
	[0072.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.284] lstrlenW (lpString=".ppt") returned 4
	[0072.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.284] lstrlenW (lpString=".zip") returned 4
	[0072.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.284] lstrlenW (lpString=".rar") returned 4
	[0072.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.285] lstrlenW (lpString=".bz2") returned 4
	[0072.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.285] lstrlenW (lpString=".7z") returned 3
	[0072.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.285] lstrlenW (lpString=".dbf") returned 4
	[0072.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.285] lstrlenW (lpString=".1cd") returned 4
	[0072.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0072.285] lstrlenW (lpString=".jpg") returned 4
	[0072.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.285] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.285] lstrlenW (lpString="BD09664_.WMF") returned 12
	[0072.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.286] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=7966) returned 1
	[0072.286] CloseHandle (hObject=0x320) returned 1
	[0072.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220
	[0072.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.286] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.286] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0072.287] GetLastError () returned 0x0
	[0072.287] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1f1e, lpOverlapped=0x0) returned 1
	[0072.697] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1f20, lpOverlapped=0x0) returned 1
	[0072.698] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.698] WriteFile (in: hFile=0x314, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.698] SetEndOfFile (hFile=0x314) returned 1
	[0072.698] CloseHandle (hObject=0x314) returned 1
	[0072.699] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.699] SetEndOfFile (hFile=0x320) returned 1
	[0072.700] CloseHandle (hObject=0x320) returned 1
	[0072.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1
	[0072.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.939] lstrlenW (lpString=".doc") returned 4
	[0072.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.940] lstrlenW (lpString=".docx") returned 5
	[0072.940] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.940] lstrlenW (lpString=".pdf") returned 4
	[0072.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.940] lstrlenW (lpString=".xls") returned 4
	[0072.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.940] lstrlenW (lpString=".xlsx") returned 5
	[0072.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.940] lstrlenW (lpString=".ppt") returned 4
	[0072.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.940] lstrlenW (lpString=".zip") returned 4
	[0072.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.940] lstrlenW (lpString=".rar") returned 4
	[0072.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.940] lstrlenW (lpString=".bz2") returned 4
	[0072.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.940] lstrlenW (lpString=".7z") returned 3
	[0072.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.940] lstrlenW (lpString=".dbf") returned 4
	[0072.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.940] lstrlenW (lpString=".1cd") returned 4
	[0072.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.940] lstrlenW (lpString=".jpg") returned 4
	[0072.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.941] lstrlenW (lpString=".doc") returned 4
	[0072.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.941] lstrlenW (lpString=".docx") returned 5
	[0072.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.941] lstrlenW (lpString=".pdf") returned 4
	[0072.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.941] lstrlenW (lpString=".xls") returned 4
	[0072.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.941] lstrlenW (lpString=".xlsx") returned 5
	[0072.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.941] lstrlenW (lpString=".ppt") returned 4
	[0072.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.941] lstrlenW (lpString=".zip") returned 4
	[0072.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.941] lstrlenW (lpString=".rar") returned 4
	[0072.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.941] lstrlenW (lpString=".bz2") returned 4
	[0072.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.941] lstrlenW (lpString=".7z") returned 3
	[0072.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.941] lstrlenW (lpString=".dbf") returned 4
	[0072.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.941] lstrlenW (lpString=".1cd") returned 4
	[0072.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0072.942] lstrlenW (lpString=".jpg") returned 4
	[0072.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.942] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.942] lstrlenW (lpString="BL00008_.WMF") returned 12
	[0072.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.081] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=12520) returned 1
	[0073.082] CloseHandle (hObject=0x318) returned 1
	[0073.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220
	[0073.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.082] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.082] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.083] GetLastError () returned 0x0
	[0073.083] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x30e8, lpOverlapped=0x0) returned 1
	[0073.085] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x30f0, lpOverlapped=0x0) returned 1
	[0073.087] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.087] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.087] SetEndOfFile (hFile=0x374) returned 1
	[0073.087] CloseHandle (hObject=0x374) returned 1
	[0073.088] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.088] SetEndOfFile (hFile=0x318) returned 1
	[0073.089] CloseHandle (hObject=0x318) returned 1
	[0073.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1
	[0073.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.089] lstrlenW (lpString=".doc") returned 4
	[0073.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.090] lstrlenW (lpString=".docx") returned 5
	[0073.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.090] lstrlenW (lpString=".pdf") returned 4
	[0073.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.090] lstrlenW (lpString=".xls") returned 4
	[0073.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.090] lstrlenW (lpString=".xlsx") returned 5
	[0073.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.090] lstrlenW (lpString=".ppt") returned 4
	[0073.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.090] lstrlenW (lpString=".zip") returned 4
	[0073.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.090] lstrlenW (lpString=".rar") returned 4
	[0073.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.090] lstrlenW (lpString=".bz2") returned 4
	[0073.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.090] lstrlenW (lpString=".7z") returned 3
	[0073.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.090] lstrlenW (lpString=".dbf") returned 4
	[0073.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.090] lstrlenW (lpString=".1cd") returned 4
	[0073.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.090] lstrlenW (lpString=".jpg") returned 4
	[0073.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.091] lstrlenW (lpString=".doc") returned 4
	[0073.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.091] lstrlenW (lpString=".docx") returned 5
	[0073.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.091] lstrlenW (lpString=".pdf") returned 4
	[0073.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.091] lstrlenW (lpString=".xls") returned 4
	[0073.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.091] lstrlenW (lpString=".xlsx") returned 5
	[0073.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.091] lstrlenW (lpString=".ppt") returned 4
	[0073.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.091] lstrlenW (lpString=".zip") returned 4
	[0073.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.091] lstrlenW (lpString=".rar") returned 4
	[0073.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.091] lstrlenW (lpString=".bz2") returned 4
	[0073.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.091] lstrlenW (lpString=".7z") returned 3
	[0073.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.091] lstrlenW (lpString=".dbf") returned 4
	[0073.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.091] lstrlenW (lpString=".1cd") returned 4
	[0073.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0073.092] lstrlenW (lpString=".jpg") returned 4
	[0073.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.092] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.092] lstrlenW (lpString="BL00122_.WMF") returned 12
	[0073.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.092] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=10146) returned 1
	[0073.092] CloseHandle (hObject=0x318) returned 1
	[0073.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220
	[0073.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.092] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.093] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.093] GetLastError () returned 0x0
	[0073.093] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x27a2, lpOverlapped=0x0) returned 1
	[0073.104] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x27b0, lpOverlapped=0x0) returned 1
	[0073.105] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.105] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.105] SetEndOfFile (hFile=0x374) returned 1
	[0073.105] CloseHandle (hObject=0x374) returned 1
	[0073.107] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.107] SetEndOfFile (hFile=0x318) returned 1
	[0073.108] CloseHandle (hObject=0x318) returned 1
	[0073.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1
	[0073.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.109] lstrlenW (lpString=".doc") returned 4
	[0073.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.109] lstrlenW (lpString=".docx") returned 5
	[0073.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.109] lstrlenW (lpString=".pdf") returned 4
	[0073.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.109] lstrlenW (lpString=".xls") returned 4
	[0073.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.109] lstrlenW (lpString=".xlsx") returned 5
	[0073.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.109] lstrlenW (lpString=".ppt") returned 4
	[0073.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.109] lstrlenW (lpString=".zip") returned 4
	[0073.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.109] lstrlenW (lpString=".rar") returned 4
	[0073.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.109] lstrlenW (lpString=".bz2") returned 4
	[0073.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.109] lstrlenW (lpString=".7z") returned 3
	[0073.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.109] lstrlenW (lpString=".dbf") returned 4
	[0073.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.110] lstrlenW (lpString=".1cd") returned 4
	[0073.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.110] lstrlenW (lpString=".jpg") returned 4
	[0073.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.110] lstrlenW (lpString=".doc") returned 4
	[0073.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.110] lstrlenW (lpString=".docx") returned 5
	[0073.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.110] lstrlenW (lpString=".pdf") returned 4
	[0073.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.110] lstrlenW (lpString=".xls") returned 4
	[0073.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.110] lstrlenW (lpString=".xlsx") returned 5
	[0073.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.110] lstrlenW (lpString=".ppt") returned 4
	[0073.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.111] lstrlenW (lpString=".zip") returned 4
	[0073.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.111] lstrlenW (lpString=".rar") returned 4
	[0073.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.111] lstrlenW (lpString=".bz2") returned 4
	[0073.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.111] lstrlenW (lpString=".7z") returned 3
	[0073.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.111] lstrlenW (lpString=".dbf") returned 4
	[0073.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.111] lstrlenW (lpString=".1cd") returned 4
	[0073.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.111] lstrlenW (lpString=".jpg") returned 4
	[0073.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.112] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.112] lstrlenW (lpString="BL00130_.WMF") returned 12
	[0073.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.112] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1464) returned 1
	[0073.112] CloseHandle (hObject=0x318) returned 1
	[0073.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220
	[0073.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.113] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.113] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.114] GetLastError () returned 0x0
	[0073.114] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x5b8, lpOverlapped=0x0) returned 1
	[0073.429] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0073.430] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.430] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.430] SetEndOfFile (hFile=0x374) returned 1
	[0073.795] CloseHandle (hObject=0x374) returned 1
	[0073.796] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.796] SetEndOfFile (hFile=0x318) returned 1
	[0073.797] CloseHandle (hObject=0x318) returned 1
	[0073.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1
	[0073.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.797] lstrlenW (lpString=".doc") returned 4
	[0073.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.797] lstrlenW (lpString=".docx") returned 5
	[0073.797] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.797] lstrlenW (lpString=".pdf") returned 4
	[0073.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.798] lstrlenW (lpString=".xls") returned 4
	[0073.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.798] lstrlenW (lpString=".xlsx") returned 5
	[0073.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.798] lstrlenW (lpString=".ppt") returned 4
	[0073.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.798] lstrlenW (lpString=".zip") returned 4
	[0073.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.798] lstrlenW (lpString=".rar") returned 4
	[0073.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.798] lstrlenW (lpString=".bz2") returned 4
	[0073.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.798] lstrlenW (lpString=".7z") returned 3
	[0073.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.798] lstrlenW (lpString=".dbf") returned 4
	[0073.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.798] lstrlenW (lpString=".1cd") returned 4
	[0073.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.799] lstrlenW (lpString=".jpg") returned 4
	[0073.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.799] lstrlenW (lpString=".doc") returned 4
	[0073.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.799] lstrlenW (lpString=".docx") returned 5
	[0073.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.799] lstrlenW (lpString=".pdf") returned 4
	[0073.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.799] lstrlenW (lpString=".xls") returned 4
	[0073.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.799] lstrlenW (lpString=".xlsx") returned 5
	[0073.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.799] lstrlenW (lpString=".ppt") returned 4
	[0073.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.799] lstrlenW (lpString=".zip") returned 4
	[0073.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.799] lstrlenW (lpString=".rar") returned 4
	[0073.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.800] lstrlenW (lpString=".bz2") returned 4
	[0073.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.800] lstrlenW (lpString=".7z") returned 3
	[0073.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.800] lstrlenW (lpString=".dbf") returned 4
	[0073.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.800] lstrlenW (lpString=".1cd") returned 4
	[0073.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0073.800] lstrlenW (lpString=".jpg") returned 4
	[0073.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.800] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.800] lstrlenW (lpString="BL00273_.WMF") returned 12
	[0073.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.801] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3780) returned 1
	[0073.802] CloseHandle (hObject=0x318) returned 1
	[0073.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220
	[0073.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.802] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.802] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.803] GetLastError () returned 0x0
	[0073.803] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xec4, lpOverlapped=0x0) returned 1
	[0073.804] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xed0, lpOverlapped=0x0) returned 1
	[0073.805] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.805] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.805] SetEndOfFile (hFile=0x374) returned 1
	[0073.805] CloseHandle (hObject=0x374) returned 1
	[0073.806] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.806] SetEndOfFile (hFile=0x318) returned 1
	[0073.807] CloseHandle (hObject=0x318) returned 1
	[0073.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1
	[0073.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.808] lstrlenW (lpString=".doc") returned 4
	[0073.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.808] lstrlenW (lpString=".docx") returned 5
	[0073.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.808] lstrlenW (lpString=".pdf") returned 4
	[0073.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.808] lstrlenW (lpString=".xls") returned 4
	[0073.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.808] lstrlenW (lpString=".xlsx") returned 5
	[0073.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.809] lstrlenW (lpString=".ppt") returned 4
	[0073.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.809] lstrlenW (lpString=".zip") returned 4
	[0073.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.809] lstrlenW (lpString=".rar") returned 4
	[0073.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.809] lstrlenW (lpString=".bz2") returned 4
	[0073.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.809] lstrlenW (lpString=".7z") returned 3
	[0073.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.809] lstrlenW (lpString=".dbf") returned 4
	[0073.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.809] lstrlenW (lpString=".1cd") returned 4
	[0073.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.810] lstrlenW (lpString=".jpg") returned 4
	[0073.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.810] lstrlenW (lpString=".doc") returned 4
	[0073.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.810] lstrlenW (lpString=".docx") returned 5
	[0073.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.810] lstrlenW (lpString=".pdf") returned 4
	[0073.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.810] lstrlenW (lpString=".xls") returned 4
	[0073.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.810] lstrlenW (lpString=".xlsx") returned 5
	[0073.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.811] lstrlenW (lpString=".ppt") returned 4
	[0073.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.811] lstrlenW (lpString=".zip") returned 4
	[0073.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.811] lstrlenW (lpString=".rar") returned 4
	[0073.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.811] lstrlenW (lpString=".bz2") returned 4
	[0073.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.811] lstrlenW (lpString=".7z") returned 3
	[0073.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.811] lstrlenW (lpString=".dbf") returned 4
	[0073.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.811] lstrlenW (lpString=".1cd") returned 4
	[0073.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0073.812] lstrlenW (lpString=".jpg") returned 4
	[0073.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.812] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.812] lstrlenW (lpString="BL00274_.WMF") returned 12
	[0073.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.812] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=4164) returned 1
	[0073.812] CloseHandle (hObject=0x318) returned 1
	[0073.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220
	[0073.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.813] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.813] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.814] GetLastError () returned 0x0
	[0073.814] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1044, lpOverlapped=0x0) returned 1
	[0073.816] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1050, lpOverlapped=0x0) returned 1
	[0073.817] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.817] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.817] SetEndOfFile (hFile=0x374) returned 1
	[0073.817] CloseHandle (hObject=0x374) returned 1
	[0073.818] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.818] SetEndOfFile (hFile=0x318) returned 1
	[0073.819] CloseHandle (hObject=0x318) returned 1
	[0073.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1
	[0073.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.819] lstrlenW (lpString=".doc") returned 4
	[0073.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.820] lstrlenW (lpString=".docx") returned 5
	[0073.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.820] lstrlenW (lpString=".pdf") returned 4
	[0073.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.820] lstrlenW (lpString=".xls") returned 4
	[0073.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.820] lstrlenW (lpString=".xlsx") returned 5
	[0073.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.820] lstrlenW (lpString=".ppt") returned 4
	[0073.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.820] lstrlenW (lpString=".zip") returned 4
	[0073.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.820] lstrlenW (lpString=".rar") returned 4
	[0073.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.820] lstrlenW (lpString=".bz2") returned 4
	[0073.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.820] lstrlenW (lpString=".7z") returned 3
	[0073.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.820] lstrlenW (lpString=".dbf") returned 4
	[0073.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.820] lstrlenW (lpString=".1cd") returned 4
	[0073.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.821] lstrlenW (lpString=".jpg") returned 4
	[0073.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.821] lstrlenW (lpString=".doc") returned 4
	[0073.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.821] lstrlenW (lpString=".docx") returned 5
	[0073.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.821] lstrlenW (lpString=".pdf") returned 4
	[0073.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.821] lstrlenW (lpString=".xls") returned 4
	[0073.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.821] lstrlenW (lpString=".xlsx") returned 5
	[0073.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.821] lstrlenW (lpString=".ppt") returned 4
	[0073.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.821] lstrlenW (lpString=".zip") returned 4
	[0073.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.821] lstrlenW (lpString=".rar") returned 4
	[0073.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.821] lstrlenW (lpString=".bz2") returned 4
	[0073.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.822] lstrlenW (lpString=".7z") returned 3
	[0073.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.822] lstrlenW (lpString=".dbf") returned 4
	[0073.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.822] lstrlenW (lpString=".1cd") returned 4
	[0073.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0073.822] lstrlenW (lpString=".jpg") returned 4
	[0073.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.822] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.822] lstrlenW (lpString="BL00296_.WMF") returned 12
	[0073.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.822] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=812) returned 1
	[0073.823] CloseHandle (hObject=0x318) returned 1
	[0073.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220
	[0073.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.823] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.823] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.824] GetLastError () returned 0x0
	[0073.824] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x32c, lpOverlapped=0x0) returned 1
	[0073.825] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x330, lpOverlapped=0x0) returned 1
	[0073.826] ReadFile (in: hFile=0x318, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.826] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.826] SetEndOfFile (hFile=0x374) returned 1
	[0073.826] CloseHandle (hObject=0x374) returned 1
	[0073.827] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.827] SetEndOfFile (hFile=0x318) returned 1
	[0073.828] CloseHandle (hObject=0x318) returned 1
	[0073.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1
	[0073.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.829] lstrlenW (lpString=".doc") returned 4
	[0073.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.829] lstrlenW (lpString=".docx") returned 5
	[0073.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.829] lstrlenW (lpString=".pdf") returned 4
	[0073.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.829] lstrlenW (lpString=".xls") returned 4
	[0073.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.829] lstrlenW (lpString=".xlsx") returned 5
	[0073.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.829] lstrlenW (lpString=".ppt") returned 4
	[0073.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.829] lstrlenW (lpString=".zip") returned 4
	[0073.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.829] lstrlenW (lpString=".rar") returned 4
	[0073.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.829] lstrlenW (lpString=".bz2") returned 4
	[0073.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.829] lstrlenW (lpString=".7z") returned 3
	[0073.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.829] lstrlenW (lpString=".dbf") returned 4
	[0073.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.830] lstrlenW (lpString=".1cd") returned 4
	[0073.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.830] lstrlenW (lpString=".jpg") returned 4
	[0073.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.830] lstrlenW (lpString=".doc") returned 4
	[0073.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.830] lstrlenW (lpString=".docx") returned 5
	[0073.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.830] lstrlenW (lpString=".pdf") returned 4
	[0073.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.830] lstrlenW (lpString=".xls") returned 4
	[0073.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.830] lstrlenW (lpString=".xlsx") returned 5
	[0073.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.830] lstrlenW (lpString=".ppt") returned 4
	[0073.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.830] lstrlenW (lpString=".zip") returned 4
	[0073.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.830] lstrlenW (lpString=".rar") returned 4
	[0073.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.831] lstrlenW (lpString=".bz2") returned 4
	[0073.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.831] lstrlenW (lpString=".7z") returned 3
	[0073.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.831] lstrlenW (lpString=".dbf") returned 4
	[0073.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.831] lstrlenW (lpString=".1cd") returned 4
	[0073.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0073.831] lstrlenW (lpString=".jpg") returned 4
	[0073.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.831] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.831] lstrlenW (lpString="BL00390_.WMF") returned 12
	[0073.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.223] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=13102) returned 1
	[0074.223] CloseHandle (hObject=0x314) returned 1
	[0074.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220
	[0074.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.223] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.224] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.224] GetLastError () returned 0x0
	[0074.224] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x332e, lpOverlapped=0x0) returned 1
	[0074.226] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x3330, lpOverlapped=0x0) returned 1
	[0074.227] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.227] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.227] SetEndOfFile (hFile=0x350) returned 1
	[0074.227] CloseHandle (hObject=0x350) returned 1
	[0074.228] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.228] SetEndOfFile (hFile=0x314) returned 1
	[0074.229] CloseHandle (hObject=0x314) returned 1
	[0074.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1
	[0074.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.230] lstrlenW (lpString=".doc") returned 4
	[0074.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.230] lstrlenW (lpString=".docx") returned 5
	[0074.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.230] lstrlenW (lpString=".pdf") returned 4
	[0074.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.230] lstrlenW (lpString=".xls") returned 4
	[0074.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.230] lstrlenW (lpString=".xlsx") returned 5
	[0074.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.231] lstrlenW (lpString=".ppt") returned 4
	[0074.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.231] lstrlenW (lpString=".zip") returned 4
	[0074.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.231] lstrlenW (lpString=".rar") returned 4
	[0074.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.231] lstrlenW (lpString=".bz2") returned 4
	[0074.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.231] lstrlenW (lpString=".7z") returned 3
	[0074.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.231] lstrlenW (lpString=".dbf") returned 4
	[0074.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.231] lstrlenW (lpString=".1cd") returned 4
	[0074.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.232] lstrlenW (lpString=".jpg") returned 4
	[0074.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.232] lstrlenW (lpString=".doc") returned 4
	[0074.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.232] lstrlenW (lpString=".docx") returned 5
	[0074.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.232] lstrlenW (lpString=".pdf") returned 4
	[0074.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.232] lstrlenW (lpString=".xls") returned 4
	[0074.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.232] lstrlenW (lpString=".xlsx") returned 5
	[0074.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.232] lstrlenW (lpString=".ppt") returned 4
	[0074.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.232] lstrlenW (lpString=".zip") returned 4
	[0074.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.232] lstrlenW (lpString=".rar") returned 4
	[0074.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.232] lstrlenW (lpString=".bz2") returned 4
	[0074.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.232] lstrlenW (lpString=".7z") returned 3
	[0074.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.233] lstrlenW (lpString=".dbf") returned 4
	[0074.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.233] lstrlenW (lpString=".1cd") returned 4
	[0074.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.233] lstrlenW (lpString=".jpg") returned 4
	[0074.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.233] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.233] lstrlenW (lpString="BS00076_.WMF") returned 12
	[0074.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.234] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1330) returned 1
	[0074.234] CloseHandle (hObject=0x314) returned 1
	[0074.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220
	[0074.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.234] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.234] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.235] GetLastError () returned 0x0
	[0074.235] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x532, lpOverlapped=0x0) returned 1
	[0074.236] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x540, lpOverlapped=0x0) returned 1
	[0074.237] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.237] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.237] SetEndOfFile (hFile=0x350) returned 1
	[0074.237] CloseHandle (hObject=0x350) returned 1
	[0074.238] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.238] SetEndOfFile (hFile=0x314) returned 1
	[0074.239] CloseHandle (hObject=0x314) returned 1
	[0074.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1
	[0074.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.239] lstrlenW (lpString=".doc") returned 4
	[0074.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.239] lstrlenW (lpString=".docx") returned 5
	[0074.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.239] lstrlenW (lpString=".pdf") returned 4
	[0074.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.239] lstrlenW (lpString=".xls") returned 4
	[0074.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.240] lstrlenW (lpString=".xlsx") returned 5
	[0074.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.240] lstrlenW (lpString=".ppt") returned 4
	[0074.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.240] lstrlenW (lpString=".zip") returned 4
	[0074.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.240] lstrlenW (lpString=".rar") returned 4
	[0074.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.240] lstrlenW (lpString=".bz2") returned 4
	[0074.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.240] lstrlenW (lpString=".7z") returned 3
	[0074.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.240] lstrlenW (lpString=".dbf") returned 4
	[0074.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.240] lstrlenW (lpString=".1cd") returned 4
	[0074.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.240] lstrlenW (lpString=".jpg") returned 4
	[0074.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.240] lstrlenW (lpString=".doc") returned 4
	[0074.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.241] lstrlenW (lpString=".docx") returned 5
	[0074.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.241] lstrlenW (lpString=".pdf") returned 4
	[0074.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.241] lstrlenW (lpString=".xls") returned 4
	[0074.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.241] lstrlenW (lpString=".xlsx") returned 5
	[0074.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.241] lstrlenW (lpString=".ppt") returned 4
	[0074.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.241] lstrlenW (lpString=".zip") returned 4
	[0074.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.241] lstrlenW (lpString=".rar") returned 4
	[0074.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.241] lstrlenW (lpString=".bz2") returned 4
	[0074.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.241] lstrlenW (lpString=".7z") returned 3
	[0074.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.241] lstrlenW (lpString=".dbf") returned 4
	[0074.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.241] lstrlenW (lpString=".1cd") returned 4
	[0074.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0074.241] lstrlenW (lpString=".jpg") returned 4
	[0074.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.242] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.242] lstrlenW (lpString="BS00078_.WMF") returned 12
	[0074.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.242] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1444) returned 1
	[0074.242] CloseHandle (hObject=0x314) returned 1
	[0074.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220
	[0074.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.243] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.243] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.243] GetLastError () returned 0x0
	[0074.243] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x5a4, lpOverlapped=0x0) returned 1
	[0074.245] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x5b0, lpOverlapped=0x0) returned 1
	[0074.246] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.246] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.246] SetEndOfFile (hFile=0x350) returned 1
	[0074.246] CloseHandle (hObject=0x350) returned 1
	[0074.248] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.248] SetEndOfFile (hFile=0x314) returned 1
	[0074.249] CloseHandle (hObject=0x314) returned 1
	[0074.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1
	[0074.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.250] lstrlenW (lpString=".doc") returned 4
	[0074.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.250] lstrlenW (lpString=".docx") returned 5
	[0074.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.250] lstrlenW (lpString=".pdf") returned 4
	[0074.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.250] lstrlenW (lpString=".xls") returned 4
	[0074.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.250] lstrlenW (lpString=".xlsx") returned 5
	[0074.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.250] lstrlenW (lpString=".ppt") returned 4
	[0074.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.250] lstrlenW (lpString=".zip") returned 4
	[0074.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.250] lstrlenW (lpString=".rar") returned 4
	[0074.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.250] lstrlenW (lpString=".bz2") returned 4
	[0074.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.250] lstrlenW (lpString=".7z") returned 3
	[0074.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.250] lstrlenW (lpString=".dbf") returned 4
	[0074.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.250] lstrlenW (lpString=".1cd") returned 4
	[0074.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.251] lstrlenW (lpString=".jpg") returned 4
	[0074.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.251] lstrlenW (lpString=".doc") returned 4
	[0074.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.251] lstrlenW (lpString=".docx") returned 5
	[0074.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.251] lstrlenW (lpString=".pdf") returned 4
	[0074.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.251] lstrlenW (lpString=".xls") returned 4
	[0074.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.251] lstrlenW (lpString=".xlsx") returned 5
	[0074.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.251] lstrlenW (lpString=".ppt") returned 4
	[0074.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.251] lstrlenW (lpString=".zip") returned 4
	[0074.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.251] lstrlenW (lpString=".rar") returned 4
	[0074.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.251] lstrlenW (lpString=".bz2") returned 4
	[0074.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.251] lstrlenW (lpString=".7z") returned 3
	[0074.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.252] lstrlenW (lpString=".dbf") returned 4
	[0074.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.252] lstrlenW (lpString=".1cd") returned 4
	[0074.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0074.252] lstrlenW (lpString=".jpg") returned 4
	[0074.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.252] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.252] lstrlenW (lpString="BS00092_.WMF") returned 12
	[0074.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.252] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=7974) returned 1
	[0074.252] CloseHandle (hObject=0x314) returned 1
	[0074.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220
	[0074.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.253] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.253] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.253] GetLastError () returned 0x0
	[0074.253] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1f26, lpOverlapped=0x0) returned 1
	[0074.255] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1f30, lpOverlapped=0x0) returned 1
	[0074.256] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.256] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.256] SetEndOfFile (hFile=0x350) returned 1
	[0074.256] CloseHandle (hObject=0x350) returned 1
	[0074.257] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.257] SetEndOfFile (hFile=0x314) returned 1
	[0074.258] CloseHandle (hObject=0x314) returned 1
	[0074.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1
	[0074.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.258] lstrlenW (lpString=".doc") returned 4
	[0074.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.259] lstrlenW (lpString=".docx") returned 5
	[0074.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.259] lstrlenW (lpString=".pdf") returned 4
	[0074.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.259] lstrlenW (lpString=".xls") returned 4
	[0074.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.259] lstrlenW (lpString=".xlsx") returned 5
	[0074.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.259] lstrlenW (lpString=".ppt") returned 4
	[0074.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.259] lstrlenW (lpString=".zip") returned 4
	[0074.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.259] lstrlenW (lpString=".rar") returned 4
	[0074.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.259] lstrlenW (lpString=".bz2") returned 4
	[0074.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.259] lstrlenW (lpString=".7z") returned 3
	[0074.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.259] lstrlenW (lpString=".dbf") returned 4
	[0074.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.259] lstrlenW (lpString=".1cd") returned 4
	[0074.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.259] lstrlenW (lpString=".jpg") returned 4
	[0074.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.260] lstrlenW (lpString=".doc") returned 4
	[0074.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.260] lstrlenW (lpString=".docx") returned 5
	[0074.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.260] lstrlenW (lpString=".pdf") returned 4
	[0074.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.260] lstrlenW (lpString=".xls") returned 4
	[0074.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.260] lstrlenW (lpString=".xlsx") returned 5
	[0074.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.260] lstrlenW (lpString=".ppt") returned 4
	[0074.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.260] lstrlenW (lpString=".zip") returned 4
	[0074.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.260] lstrlenW (lpString=".rar") returned 4
	[0074.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.260] lstrlenW (lpString=".bz2") returned 4
	[0074.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.260] lstrlenW (lpString=".7z") returned 3
	[0074.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.260] lstrlenW (lpString=".dbf") returned 4
	[0074.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.261] lstrlenW (lpString=".1cd") returned 4
	[0074.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0074.261] lstrlenW (lpString=".jpg") returned 4
	[0074.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.261] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.261] lstrlenW (lpString="BS00100_.WMF") returned 12
	[0074.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.261] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2378) returned 1
	[0074.261] CloseHandle (hObject=0x314) returned 1
	[0074.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220
	[0074.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.262] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.262] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.262] GetLastError () returned 0x0
	[0074.262] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x94a, lpOverlapped=0x0) returned 1
	[0074.754] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x950, lpOverlapped=0x0) returned 1
	[0074.755] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.755] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.755] SetEndOfFile (hFile=0x350) returned 1
	[0074.755] CloseHandle (hObject=0x350) returned 1
	[0074.756] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.756] SetEndOfFile (hFile=0x314) returned 1
	[0074.757] CloseHandle (hObject=0x314) returned 1
	[0074.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1
	[0074.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.758] lstrlenW (lpString=".doc") returned 4
	[0074.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.758] lstrlenW (lpString=".docx") returned 5
	[0074.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.758] lstrlenW (lpString=".pdf") returned 4
	[0074.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.758] lstrlenW (lpString=".xls") returned 4
	[0074.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.758] lstrlenW (lpString=".xlsx") returned 5
	[0074.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.758] lstrlenW (lpString=".ppt") returned 4
	[0074.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.759] lstrlenW (lpString=".zip") returned 4
	[0074.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.759] lstrlenW (lpString=".rar") returned 4
	[0074.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.759] lstrlenW (lpString=".bz2") returned 4
	[0074.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.759] lstrlenW (lpString=".7z") returned 3
	[0074.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.759] lstrlenW (lpString=".dbf") returned 4
	[0074.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.759] lstrlenW (lpString=".1cd") returned 4
	[0074.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.759] lstrlenW (lpString=".jpg") returned 4
	[0074.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.760] lstrlenW (lpString=".doc") returned 4
	[0074.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.760] lstrlenW (lpString=".docx") returned 5
	[0074.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.760] lstrlenW (lpString=".pdf") returned 4
	[0074.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.760] lstrlenW (lpString=".xls") returned 4
	[0074.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.760] lstrlenW (lpString=".xlsx") returned 5
	[0074.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.760] lstrlenW (lpString=".ppt") returned 4
	[0074.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.760] lstrlenW (lpString=".zip") returned 4
	[0074.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.760] lstrlenW (lpString=".rar") returned 4
	[0074.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.760] lstrlenW (lpString=".bz2") returned 4
	[0074.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.760] lstrlenW (lpString=".7z") returned 3
	[0074.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.761] lstrlenW (lpString=".dbf") returned 4
	[0074.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.761] lstrlenW (lpString=".1cd") returned 4
	[0074.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0074.761] lstrlenW (lpString=".jpg") returned 4
	[0074.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.761] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.761] lstrlenW (lpString="BS00439_.WMF") returned 12
	[0074.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.762] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2052) returned 1
	[0074.762] CloseHandle (hObject=0x314) returned 1
	[0074.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220
	[0074.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.762] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.762] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.763] GetLastError () returned 0x0
	[0074.763] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x804, lpOverlapped=0x0) returned 1
	[0074.764] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x810, lpOverlapped=0x0) returned 1
	[0074.765] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.765] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.765] SetEndOfFile (hFile=0x350) returned 1
	[0074.765] CloseHandle (hObject=0x350) returned 1
	[0074.766] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.766] SetEndOfFile (hFile=0x314) returned 1
	[0074.767] CloseHandle (hObject=0x314) returned 1
	[0074.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1
	[0074.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.767] lstrlenW (lpString=".doc") returned 4
	[0074.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.768] lstrlenW (lpString=".docx") returned 5
	[0074.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.768] lstrlenW (lpString=".pdf") returned 4
	[0074.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.768] lstrlenW (lpString=".xls") returned 4
	[0074.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.768] lstrlenW (lpString=".xlsx") returned 5
	[0074.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.768] lstrlenW (lpString=".ppt") returned 4
	[0074.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.768] lstrlenW (lpString=".zip") returned 4
	[0074.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.768] lstrlenW (lpString=".rar") returned 4
	[0074.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.768] lstrlenW (lpString=".bz2") returned 4
	[0074.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.768] lstrlenW (lpString=".7z") returned 3
	[0074.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.769] lstrlenW (lpString=".dbf") returned 4
	[0074.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.769] lstrlenW (lpString=".1cd") returned 4
	[0074.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.769] lstrlenW (lpString=".jpg") returned 4
	[0074.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.769] lstrlenW (lpString=".doc") returned 4
	[0074.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.769] lstrlenW (lpString=".docx") returned 5
	[0074.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.769] lstrlenW (lpString=".pdf") returned 4
	[0074.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.770] lstrlenW (lpString=".xls") returned 4
	[0074.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.770] lstrlenW (lpString=".xlsx") returned 5
	[0074.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.770] lstrlenW (lpString=".ppt") returned 4
	[0074.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.770] lstrlenW (lpString=".zip") returned 4
	[0074.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.770] lstrlenW (lpString=".rar") returned 4
	[0074.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.770] lstrlenW (lpString=".bz2") returned 4
	[0074.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.770] lstrlenW (lpString=".7z") returned 3
	[0074.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.771] lstrlenW (lpString=".dbf") returned 4
	[0074.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.771] lstrlenW (lpString=".1cd") returned 4
	[0074.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0074.771] lstrlenW (lpString=".jpg") returned 4
	[0074.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.771] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.771] lstrlenW (lpString="BS00440_.WMF") returned 12
	[0074.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.772] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=5580) returned 1
	[0074.772] CloseHandle (hObject=0x314) returned 1
	[0074.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220
	[0074.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.772] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.772] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.773] GetLastError () returned 0x0
	[0074.773] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x15cc, lpOverlapped=0x0) returned 1
	[0074.774] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x15d0, lpOverlapped=0x0) returned 1
	[0074.776] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.776] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.776] SetEndOfFile (hFile=0x350) returned 1
	[0074.776] CloseHandle (hObject=0x350) returned 1
	[0074.778] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.778] SetEndOfFile (hFile=0x314) returned 1
	[0074.779] CloseHandle (hObject=0x314) returned 1
	[0074.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1
	[0074.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.780] lstrlenW (lpString=".doc") returned 4
	[0074.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.780] lstrlenW (lpString=".docx") returned 5
	[0074.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.780] lstrlenW (lpString=".pdf") returned 4
	[0074.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.780] lstrlenW (lpString=".xls") returned 4
	[0074.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.780] lstrlenW (lpString=".xlsx") returned 5
	[0074.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.780] lstrlenW (lpString=".ppt") returned 4
	[0074.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.780] lstrlenW (lpString=".zip") returned 4
	[0074.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.780] lstrlenW (lpString=".rar") returned 4
	[0074.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.781] lstrlenW (lpString=".bz2") returned 4
	[0074.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.781] lstrlenW (lpString=".7z") returned 3
	[0074.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.781] lstrlenW (lpString=".dbf") returned 4
	[0074.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.781] lstrlenW (lpString=".1cd") returned 4
	[0074.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.781] lstrlenW (lpString=".jpg") returned 4
	[0074.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.781] lstrlenW (lpString=".doc") returned 4
	[0074.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.782] lstrlenW (lpString=".docx") returned 5
	[0074.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.782] lstrlenW (lpString=".pdf") returned 4
	[0074.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.782] lstrlenW (lpString=".xls") returned 4
	[0074.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.782] lstrlenW (lpString=".xlsx") returned 5
	[0074.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.782] lstrlenW (lpString=".ppt") returned 4
	[0074.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.782] lstrlenW (lpString=".zip") returned 4
	[0074.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.782] lstrlenW (lpString=".rar") returned 4
	[0074.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.782] lstrlenW (lpString=".bz2") returned 4
	[0074.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.782] lstrlenW (lpString=".7z") returned 3
	[0074.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.782] lstrlenW (lpString=".dbf") returned 4
	[0074.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.782] lstrlenW (lpString=".1cd") returned 4
	[0074.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0074.783] lstrlenW (lpString=".jpg") returned 4
	[0074.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.783] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.783] lstrlenW (lpString="BS00441_.WMF") returned 12
	[0074.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.783] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3524) returned 1
	[0074.783] CloseHandle (hObject=0x314) returned 1
	[0074.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220
	[0074.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.784] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.784] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.784] GetLastError () returned 0x0
	[0074.784] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xdc4, lpOverlapped=0x0) returned 1
	[0074.786] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xdd0, lpOverlapped=0x0) returned 1
	[0074.787] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.787] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.787] SetEndOfFile (hFile=0x350) returned 1
	[0074.787] CloseHandle (hObject=0x350) returned 1
	[0074.788] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.788] SetEndOfFile (hFile=0x314) returned 1
	[0074.789] CloseHandle (hObject=0x314) returned 1
	[0074.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1
	[0074.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.790] lstrlenW (lpString=".doc") returned 4
	[0074.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.790] lstrlenW (lpString=".docx") returned 5
	[0074.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.790] lstrlenW (lpString=".pdf") returned 4
	[0074.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.790] lstrlenW (lpString=".xls") returned 4
	[0074.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.790] lstrlenW (lpString=".xlsx") returned 5
	[0074.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.790] lstrlenW (lpString=".ppt") returned 4
	[0074.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.791] lstrlenW (lpString=".zip") returned 4
	[0074.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.791] lstrlenW (lpString=".rar") returned 4
	[0074.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString=".bz2") returned 4
	[0074.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString=".7z") returned 3
	[0074.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.791] lstrlenW (lpString=".dbf") returned 4
	[0074.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.791] lstrlenW (lpString=".1cd") returned 4
	[0074.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.791] lstrlenW (lpString=".jpg") returned 4
	[0074.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.791] lstrlenW (lpString=".doc") returned 4
	[0074.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString=".docx") returned 5
	[0074.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.792] lstrlenW (lpString=".pdf") returned 4
	[0074.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString=".xls") returned 4
	[0074.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.792] lstrlenW (lpString=".xlsx") returned 5
	[0074.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.792] lstrlenW (lpString=".ppt") returned 4
	[0074.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.792] lstrlenW (lpString=".zip") returned 4
	[0074.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.792] lstrlenW (lpString=".rar") returned 4
	[0074.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString=".bz2") returned 4
	[0074.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString=".7z") returned 3
	[0074.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.792] lstrlenW (lpString=".dbf") returned 4
	[0074.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.792] lstrlenW (lpString=".1cd") returned 4
	[0074.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0074.793] lstrlenW (lpString=".jpg") returned 4
	[0074.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.793] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.793] lstrlenW (lpString="BS00442_.WMF") returned 12
	[0074.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.793] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2488) returned 1
	[0074.793] CloseHandle (hObject=0x314) returned 1
	[0074.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220
	[0074.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0074.794] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.794] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0074.794] GetLastError () returned 0x0
	[0074.794] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x9b8, lpOverlapped=0x0) returned 1
	[0075.119] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0075.126] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.126] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.126] SetEndOfFile (hFile=0x350) returned 1
	[0075.813] CloseHandle (hObject=0x350) returned 1
	[0075.814] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.814] SetEndOfFile (hFile=0x314) returned 1
	[0075.815] CloseHandle (hObject=0x314) returned 1
	[0075.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1
	[0075.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.816] lstrlenW (lpString=".doc") returned 4
	[0075.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.817] lstrlenW (lpString=".docx") returned 5
	[0075.817] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.817] lstrlenW (lpString=".pdf") returned 4
	[0075.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.817] lstrlenW (lpString=".xls") returned 4
	[0075.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.817] lstrlenW (lpString=".xlsx") returned 5
	[0075.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.817] lstrlenW (lpString=".ppt") returned 4
	[0075.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.817] lstrlenW (lpString=".zip") returned 4
	[0075.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.817] lstrlenW (lpString=".rar") returned 4
	[0075.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.817] lstrlenW (lpString=".bz2") returned 4
	[0075.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.817] lstrlenW (lpString=".7z") returned 3
	[0075.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.817] lstrlenW (lpString=".dbf") returned 4
	[0075.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.817] lstrlenW (lpString=".1cd") returned 4
	[0075.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.818] lstrlenW (lpString=".jpg") returned 4
	[0075.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.818] lstrlenW (lpString=".doc") returned 4
	[0075.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.818] lstrlenW (lpString=".docx") returned 5
	[0075.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.818] lstrlenW (lpString=".pdf") returned 4
	[0075.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.818] lstrlenW (lpString=".xls") returned 4
	[0075.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.818] lstrlenW (lpString=".xlsx") returned 5
	[0075.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.818] lstrlenW (lpString=".ppt") returned 4
	[0075.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.818] lstrlenW (lpString=".zip") returned 4
	[0075.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.818] lstrlenW (lpString=".rar") returned 4
	[0075.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.818] lstrlenW (lpString=".bz2") returned 4
	[0075.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.818] lstrlenW (lpString=".7z") returned 3
	[0075.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.819] lstrlenW (lpString=".dbf") returned 4
	[0075.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.819] lstrlenW (lpString=".1cd") returned 4
	[0075.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0075.819] lstrlenW (lpString=".jpg") returned 4
	[0075.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.819] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.819] lstrlenW (lpString="CLASSIC2.WMF") returned 12
	[0075.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0075.820] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2262) returned 1
	[0075.820] CloseHandle (hObject=0x314) returned 1
	[0075.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220
	[0075.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0075.820] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.820] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.821] GetLastError () returned 0x0
	[0075.821] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x8d6, lpOverlapped=0x0) returned 1
	[0075.822] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x8e0, lpOverlapped=0x0) returned 1
	[0075.823] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.823] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.824] SetEndOfFile (hFile=0x350) returned 1
	[0075.824] CloseHandle (hObject=0x350) returned 1
	[0075.825] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.825] SetEndOfFile (hFile=0x314) returned 1
	[0075.826] CloseHandle (hObject=0x314) returned 1
	[0075.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1
	[0075.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.826] lstrlenW (lpString=".doc") returned 4
	[0075.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.826] lstrlenW (lpString=".docx") returned 5
	[0075.826] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0075.826] lstrlenW (lpString=".pdf") returned 4
	[0075.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.827] lstrlenW (lpString=".xls") returned 4
	[0075.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.827] lstrlenW (lpString=".xlsx") returned 5
	[0075.827] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0075.827] lstrlenW (lpString=".ppt") returned 4
	[0075.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.827] lstrlenW (lpString=".zip") returned 4
	[0075.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.827] lstrlenW (lpString=".rar") returned 4
	[0075.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.827] lstrlenW (lpString=".bz2") returned 4
	[0075.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.827] lstrlenW (lpString=".7z") returned 3
	[0075.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.827] lstrlenW (lpString=".dbf") returned 4
	[0075.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.827] lstrlenW (lpString=".1cd") returned 4
	[0075.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.827] lstrlenW (lpString=".jpg") returned 4
	[0075.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.828] lstrlenW (lpString=".doc") returned 4
	[0075.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.828] lstrlenW (lpString=".docx") returned 5
	[0075.828] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0075.828] lstrlenW (lpString=".pdf") returned 4
	[0075.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.828] lstrlenW (lpString=".xls") returned 4
	[0075.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.828] lstrlenW (lpString=".xlsx") returned 5
	[0075.828] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0075.828] lstrlenW (lpString=".ppt") returned 4
	[0075.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.828] lstrlenW (lpString=".zip") returned 4
	[0075.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.828] lstrlenW (lpString=".rar") returned 4
	[0075.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.828] lstrlenW (lpString=".bz2") returned 4
	[0075.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.829] lstrlenW (lpString=".7z") returned 3
	[0075.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.829] lstrlenW (lpString=".dbf") returned 4
	[0075.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.829] lstrlenW (lpString=".1cd") returned 4
	[0075.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0075.829] lstrlenW (lpString=".jpg") returned 4
	[0075.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.829] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.829] lstrlenW (lpString="CLIP.WMF") returned 8
	[0075.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0075.830] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2262) returned 1
	[0075.830] CloseHandle (hObject=0x314) returned 1
	[0075.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220
	[0075.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0075.830] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.830] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.831] GetLastError () returned 0x0
	[0075.831] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x8d6, lpOverlapped=0x0) returned 1
	[0075.832] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x8e0, lpOverlapped=0x0) returned 1
	[0075.833] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.833] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0075.833] SetEndOfFile (hFile=0x350) returned 1
	[0075.833] CloseHandle (hObject=0x350) returned 1
	[0075.834] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.834] SetEndOfFile (hFile=0x314) returned 1
	[0075.835] CloseHandle (hObject=0x314) returned 1
	[0075.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1
	[0075.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.836] lstrlenW (lpString=".doc") returned 4
	[0075.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.836] lstrlenW (lpString=".docx") returned 5
	[0075.836] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0075.836] lstrlenW (lpString=".pdf") returned 4
	[0075.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.836] lstrlenW (lpString=".xls") returned 4
	[0075.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.836] lstrlenW (lpString=".xlsx") returned 5
	[0075.836] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0075.836] lstrlenW (lpString=".ppt") returned 4
	[0075.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.836] lstrlenW (lpString=".zip") returned 4
	[0075.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.836] lstrlenW (lpString=".rar") returned 4
	[0075.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.837] lstrlenW (lpString=".bz2") returned 4
	[0075.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.837] lstrlenW (lpString=".7z") returned 3
	[0075.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.837] lstrlenW (lpString=".dbf") returned 4
	[0075.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.837] lstrlenW (lpString=".1cd") returned 4
	[0075.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.837] lstrlenW (lpString=".jpg") returned 4
	[0075.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.837] lstrlenW (lpString=".doc") returned 4
	[0075.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.837] lstrlenW (lpString=".docx") returned 5
	[0075.837] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0075.837] lstrlenW (lpString=".pdf") returned 4
	[0075.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.837] lstrlenW (lpString=".xls") returned 4
	[0075.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.838] lstrlenW (lpString=".xlsx") returned 5
	[0075.838] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0075.838] lstrlenW (lpString=".ppt") returned 4
	[0075.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.838] lstrlenW (lpString=".zip") returned 4
	[0075.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.838] lstrlenW (lpString=".rar") returned 4
	[0075.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.838] lstrlenW (lpString=".bz2") returned 4
	[0075.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.838] lstrlenW (lpString=".7z") returned 3
	[0075.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.838] lstrlenW (lpString=".dbf") returned 4
	[0075.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.838] lstrlenW (lpString=".1cd") returned 4
	[0075.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0075.838] lstrlenW (lpString=".jpg") returned 4
	[0075.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.839] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.839] lstrlenW (lpString="CRANE.WMF") returned 9
	[0075.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0075.839] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=5270) returned 1
	[0075.839] CloseHandle (hObject=0x314) returned 1
	[0075.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220
	[0075.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0075.840] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.840] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.840] GetLastError () returned 0x0
	[0075.840] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1496, lpOverlapped=0x0) returned 1
	[0075.842] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x14a0, lpOverlapped=0x0) returned 1
	[0075.844] ReadFile (in: hFile=0x314, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.844] WriteFile (in: hFile=0x350, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0075.844] SetEndOfFile (hFile=0x350) returned 1
	[0075.844] CloseHandle (hObject=0x350) returned 1
	[0075.845] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.845] SetEndOfFile (hFile=0x314) returned 1
	[0075.846] CloseHandle (hObject=0x314) returned 1
	[0075.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1
	[0075.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0075.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0075.847] lstrlenW (lpString=".doc") returned 4
	[0075.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.847] lstrlenW (lpString=".docx") returned 5
	[0075.847] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1
	[0075.847] lstrlenW (lpString=".pdf") returned 4
	[0075.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.847] lstrlenW (lpString=".xls") returned 4
	[0075.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.847] lstrlenW (lpString=".xlsx") returned 5
	[0075.847] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1
	[0075.847] lstrlenW (lpString=".ppt") returned 4
	[0075.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0075.847] lstrlenW (lpString=".zip") returned 4
	[0075.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.847] lstrlenW (lpString=".rar") returned 4
	[0075.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.847] lstrlenW (lpString=".bz2") returned 4
	[0075.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.847] lstrlenW (lpString=".7z") returned 3
	[0076.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0076.205] lstrlenW (lpString=".dbf") returned 4
	[0076.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0076.205] lstrlenW (lpString=".1cd") returned 4
	[0076.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0076.205] lstrlenW (lpString=".jpg") returned 4
	[0076.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0076.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0076.205] lstrlenW (lpString=".doc") returned 4
	[0076.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.205] lstrlenW (lpString=".docx") returned 5
	[0076.205] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1
	[0076.205] lstrlenW (lpString=".pdf") returned 4
	[0076.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.205] lstrlenW (lpString=".xls") returned 4
	[0076.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.205] lstrlenW (lpString=".xlsx") returned 5
	[0076.205] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1
	[0076.205] lstrlenW (lpString=".ppt") returned 4
	[0076.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0076.205] lstrlenW (lpString=".zip") returned 4
	[0076.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.206] lstrlenW (lpString=".rar") returned 4
	[0076.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.206] lstrlenW (lpString=".bz2") returned 4
	[0076.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.206] lstrlenW (lpString=".7z") returned 3
	[0076.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0076.206] lstrlenW (lpString=".dbf") returned 4
	[0076.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0076.206] lstrlenW (lpString=".1cd") returned 4
	[0076.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0076.206] lstrlenW (lpString=".jpg") returned 4
	[0076.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.206] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.206] lstrlenW (lpString="DD00372_.WMF") returned 12
	[0076.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.208] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=792) returned 1
	[0076.208] CloseHandle (hObject=0x35c) returned 1
	[0076.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220
	[0076.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.208] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.208] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.209] GetLastError () returned 0x0
	[0076.209] ReadFile (in: hFile=0x35c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x318, lpOverlapped=0x0) returned 1
	[0076.210] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x320, lpOverlapped=0x0) returned 1
	[0076.211] ReadFile (in: hFile=0x35c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.211] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.212] SetEndOfFile (hFile=0x33c) returned 1
	[0076.212] CloseHandle (hObject=0x33c) returned 1
	[0076.213] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.213] SetEndOfFile (hFile=0x35c) returned 1
	[0076.213] CloseHandle (hObject=0x35c) returned 1
	[0076.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1
	[0076.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.214] lstrlenW (lpString=".doc") returned 4
	[0076.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.214] lstrlenW (lpString=".docx") returned 5
	[0076.214] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.214] lstrlenW (lpString=".pdf") returned 4
	[0076.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.214] lstrlenW (lpString=".xls") returned 4
	[0076.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.214] lstrlenW (lpString=".xlsx") returned 5
	[0076.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.214] lstrlenW (lpString=".ppt") returned 4
	[0076.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.214] lstrlenW (lpString=".zip") returned 4
	[0076.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.214] lstrlenW (lpString=".rar") returned 4
	[0076.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.215] lstrlenW (lpString=".bz2") returned 4
	[0076.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.215] lstrlenW (lpString=".7z") returned 3
	[0076.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.215] lstrlenW (lpString=".dbf") returned 4
	[0076.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.215] lstrlenW (lpString=".1cd") returned 4
	[0076.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.215] lstrlenW (lpString=".jpg") returned 4
	[0076.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.215] lstrlenW (lpString=".doc") returned 4
	[0076.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.215] lstrlenW (lpString=".docx") returned 5
	[0076.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.215] lstrlenW (lpString=".pdf") returned 4
	[0076.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.215] lstrlenW (lpString=".xls") returned 4
	[0076.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.215] lstrlenW (lpString=".xlsx") returned 5
	[0076.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.215] lstrlenW (lpString=".ppt") returned 4
	[0076.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.215] lstrlenW (lpString=".zip") returned 4
	[0076.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.216] lstrlenW (lpString=".rar") returned 4
	[0076.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.216] lstrlenW (lpString=".bz2") returned 4
	[0076.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.216] lstrlenW (lpString=".7z") returned 3
	[0076.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.216] lstrlenW (lpString=".dbf") returned 4
	[0076.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.216] lstrlenW (lpString=".1cd") returned 4
	[0076.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0076.216] lstrlenW (lpString=".jpg") returned 4
	[0076.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.216] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.216] lstrlenW (lpString="DD00405_.WMF") returned 12
	[0076.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.217] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=17584) returned 1
	[0076.217] CloseHandle (hObject=0x35c) returned 1
	[0076.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220
	[0076.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.217] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.217] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.217] GetLastError () returned 0x0
	[0076.217] ReadFile (in: hFile=0x35c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x44b0, lpOverlapped=0x0) returned 1
	[0076.219] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x44c0, lpOverlapped=0x0) returned 1
	[0076.220] ReadFile (in: hFile=0x35c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.220] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.220] SetEndOfFile (hFile=0x33c) returned 1
	[0076.220] CloseHandle (hObject=0x33c) returned 1
	[0076.221] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.221] SetEndOfFile (hFile=0x35c) returned 1
	[0076.222] CloseHandle (hObject=0x35c) returned 1
	[0076.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1
	[0076.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.223] lstrlenW (lpString=".doc") returned 4
	[0076.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.223] lstrlenW (lpString=".docx") returned 5
	[0076.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.223] lstrlenW (lpString=".pdf") returned 4
	[0076.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.223] lstrlenW (lpString=".xls") returned 4
	[0076.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.223] lstrlenW (lpString=".xlsx") returned 5
	[0076.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.223] lstrlenW (lpString=".ppt") returned 4
	[0076.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.224] lstrlenW (lpString=".zip") returned 4
	[0076.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.224] lstrlenW (lpString=".rar") returned 4
	[0076.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.224] lstrlenW (lpString=".bz2") returned 4
	[0076.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.224] lstrlenW (lpString=".7z") returned 3
	[0076.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.224] lstrlenW (lpString=".dbf") returned 4
	[0076.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.224] lstrlenW (lpString=".1cd") returned 4
	[0076.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.224] lstrlenW (lpString=".jpg") returned 4
	[0076.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.224] lstrlenW (lpString=".doc") returned 4
	[0076.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.225] lstrlenW (lpString=".docx") returned 5
	[0076.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.225] lstrlenW (lpString=".pdf") returned 4
	[0076.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.225] lstrlenW (lpString=".xls") returned 4
	[0076.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.225] lstrlenW (lpString=".xlsx") returned 5
	[0076.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.225] lstrlenW (lpString=".ppt") returned 4
	[0076.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.225] lstrlenW (lpString=".zip") returned 4
	[0076.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.225] lstrlenW (lpString=".rar") returned 4
	[0076.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.225] lstrlenW (lpString=".bz2") returned 4
	[0076.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.225] lstrlenW (lpString=".7z") returned 3
	[0076.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.225] lstrlenW (lpString=".dbf") returned 4
	[0076.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.225] lstrlenW (lpString=".1cd") returned 4
	[0076.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0076.226] lstrlenW (lpString=".jpg") returned 4
	[0076.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.226] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.226] lstrlenW (lpString="DD00407_.WMF") returned 12
	[0076.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.227] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=7828) returned 1
	[0076.227] CloseHandle (hObject=0x35c) returned 1
	[0076.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220
	[0076.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.227] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.227] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.228] GetLastError () returned 0x0
	[0076.228] ReadFile (in: hFile=0x35c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1e94, lpOverlapped=0x0) returned 1
	[0076.229] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1ea0, lpOverlapped=0x0) returned 1
	[0076.232] ReadFile (in: hFile=0x35c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.232] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.232] SetEndOfFile (hFile=0x33c) returned 1
	[0076.233] CloseHandle (hObject=0x33c) returned 1
	[0076.233] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.233] SetEndOfFile (hFile=0x35c) returned 1
	[0076.234] CloseHandle (hObject=0x35c) returned 1
	[0076.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1
	[0076.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.235] lstrlenW (lpString=".doc") returned 4
	[0076.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.235] lstrlenW (lpString=".docx") returned 5
	[0076.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.235] lstrlenW (lpString=".pdf") returned 4
	[0076.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.235] lstrlenW (lpString=".xls") returned 4
	[0076.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.235] lstrlenW (lpString=".xlsx") returned 5
	[0076.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.235] lstrlenW (lpString=".ppt") returned 4
	[0076.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.235] lstrlenW (lpString=".zip") returned 4
	[0076.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.235] lstrlenW (lpString=".rar") returned 4
	[0076.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.235] lstrlenW (lpString=".bz2") returned 4
	[0076.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.236] lstrlenW (lpString=".7z") returned 3
	[0076.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.236] lstrlenW (lpString=".dbf") returned 4
	[0076.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.236] lstrlenW (lpString=".1cd") returned 4
	[0076.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.236] lstrlenW (lpString=".jpg") returned 4
	[0076.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.236] lstrlenW (lpString=".doc") returned 4
	[0076.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.236] lstrlenW (lpString=".docx") returned 5
	[0076.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.236] lstrlenW (lpString=".pdf") returned 4
	[0076.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.236] lstrlenW (lpString=".xls") returned 4
	[0076.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.236] lstrlenW (lpString=".xlsx") returned 5
	[0076.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.236] lstrlenW (lpString=".ppt") returned 4
	[0076.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.237] lstrlenW (lpString=".zip") returned 4
	[0076.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.237] lstrlenW (lpString=".rar") returned 4
	[0076.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.237] lstrlenW (lpString=".bz2") returned 4
	[0076.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.237] lstrlenW (lpString=".7z") returned 3
	[0076.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.237] lstrlenW (lpString=".dbf") returned 4
	[0076.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.237] lstrlenW (lpString=".1cd") returned 4
	[0076.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0076.237] lstrlenW (lpString=".jpg") returned 4
	[0076.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.238] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.238] lstrlenW (lpString="DD00413_.WMF") returned 12
	[0076.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.238] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=42992) returned 1
	[0076.238] CloseHandle (hObject=0x35c) returned 1
	[0076.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220
	[0076.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0076.709] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.709] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0076.709] GetLastError () returned 0x0
	[0076.710] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xa7f0, lpOverlapped=0x0) returned 1
	[0076.712] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xa800, lpOverlapped=0x0) returned 1
	[0076.713] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.713] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.714] SetEndOfFile (hFile=0x320) returned 1
	[0076.714] CloseHandle (hObject=0x320) returned 1
	[0076.714] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.714] SetEndOfFile (hFile=0x344) returned 1
	[0076.715] CloseHandle (hObject=0x344) returned 1
	[0076.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1
	[0076.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.716] lstrlenW (lpString=".doc") returned 4
	[0076.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.716] lstrlenW (lpString=".docx") returned 5
	[0076.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.716] lstrlenW (lpString=".pdf") returned 4
	[0076.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.716] lstrlenW (lpString=".xls") returned 4
	[0076.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.716] lstrlenW (lpString=".xlsx") returned 5
	[0076.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.716] lstrlenW (lpString=".ppt") returned 4
	[0076.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.716] lstrlenW (lpString=".zip") returned 4
	[0076.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.716] lstrlenW (lpString=".rar") returned 4
	[0076.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.716] lstrlenW (lpString=".bz2") returned 4
	[0076.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.716] lstrlenW (lpString=".7z") returned 3
	[0076.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.716] lstrlenW (lpString=".dbf") returned 4
	[0076.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.717] lstrlenW (lpString=".1cd") returned 4
	[0076.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.717] lstrlenW (lpString=".jpg") returned 4
	[0076.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.717] lstrlenW (lpString=".doc") returned 4
	[0076.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.717] lstrlenW (lpString=".docx") returned 5
	[0076.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.717] lstrlenW (lpString=".pdf") returned 4
	[0076.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.717] lstrlenW (lpString=".xls") returned 4
	[0076.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.717] lstrlenW (lpString=".xlsx") returned 5
	[0076.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.717] lstrlenW (lpString=".ppt") returned 4
	[0076.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.717] lstrlenW (lpString=".zip") returned 4
	[0076.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.717] lstrlenW (lpString=".rar") returned 4
	[0076.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.717] lstrlenW (lpString=".bz2") returned 4
	[0076.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.717] lstrlenW (lpString=".7z") returned 3
	[0076.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.718] lstrlenW (lpString=".dbf") returned 4
	[0076.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.718] lstrlenW (lpString=".1cd") returned 4
	[0076.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0076.718] lstrlenW (lpString=".jpg") returned 4
	[0076.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.718] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.718] lstrlenW (lpString="DD01140_.WMF") returned 12
	[0076.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0076.719] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3616) returned 1
	[0076.719] CloseHandle (hObject=0x344) returned 1
	[0076.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220
	[0076.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0076.719] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.719] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0076.719] GetLastError () returned 0x0
	[0076.720] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xe20, lpOverlapped=0x0) returned 1
	[0076.721] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe30, lpOverlapped=0x0) returned 1
	[0076.722] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.722] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.722] SetEndOfFile (hFile=0x320) returned 1
	[0076.722] CloseHandle (hObject=0x320) returned 1
	[0076.722] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.722] SetEndOfFile (hFile=0x344) returned 1
	[0076.920] CloseHandle (hObject=0x344) returned 1
	[0076.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1
	[0076.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.920] lstrlenW (lpString=".doc") returned 4
	[0076.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.921] lstrlenW (lpString=".docx") returned 5
	[0076.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.921] lstrlenW (lpString=".pdf") returned 4
	[0076.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.921] lstrlenW (lpString=".xls") returned 4
	[0076.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.921] lstrlenW (lpString=".xlsx") returned 5
	[0076.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.921] lstrlenW (lpString=".ppt") returned 4
	[0076.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.921] lstrlenW (lpString=".zip") returned 4
	[0076.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.921] lstrlenW (lpString=".rar") returned 4
	[0076.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.921] lstrlenW (lpString=".bz2") returned 4
	[0076.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.921] lstrlenW (lpString=".7z") returned 3
	[0076.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.921] lstrlenW (lpString=".dbf") returned 4
	[0076.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.921] lstrlenW (lpString=".1cd") returned 4
	[0076.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.921] lstrlenW (lpString=".jpg") returned 4
	[0076.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.922] lstrlenW (lpString=".doc") returned 4
	[0076.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.922] lstrlenW (lpString=".docx") returned 5
	[0076.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.922] lstrlenW (lpString=".pdf") returned 4
	[0076.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.922] lstrlenW (lpString=".xls") returned 4
	[0076.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.922] lstrlenW (lpString=".xlsx") returned 5
	[0076.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.922] lstrlenW (lpString=".ppt") returned 4
	[0076.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.922] lstrlenW (lpString=".zip") returned 4
	[0076.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.922] lstrlenW (lpString=".rar") returned 4
	[0076.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.922] lstrlenW (lpString=".bz2") returned 4
	[0076.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.922] lstrlenW (lpString=".7z") returned 3
	[0076.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.922] lstrlenW (lpString=".dbf") returned 4
	[0076.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.922] lstrlenW (lpString=".1cd") returned 4
	[0076.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0076.922] lstrlenW (lpString=".jpg") returned 4
	[0076.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.923] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.923] lstrlenW (lpString="DD01143_.WMF") returned 12
	[0076.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0076.923] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2140) returned 1
	[0076.923] CloseHandle (hObject=0x344) returned 1
	[0076.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220
	[0076.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0076.924] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.924] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0076.924] GetLastError () returned 0x0
	[0076.924] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x85c, lpOverlapped=0x0) returned 1
	[0076.931] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x860, lpOverlapped=0x0) returned 1
	[0076.932] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.932] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.932] SetEndOfFile (hFile=0x320) returned 1
	[0076.933] CloseHandle (hObject=0x320) returned 1
	[0076.933] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.933] SetEndOfFile (hFile=0x344) returned 1
	[0076.933] CloseHandle (hObject=0x344) returned 1
	[0076.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1
	[0076.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.934] lstrlenW (lpString=".doc") returned 4
	[0076.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.934] lstrlenW (lpString=".docx") returned 5
	[0076.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.934] lstrlenW (lpString=".pdf") returned 4
	[0076.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.934] lstrlenW (lpString=".xls") returned 4
	[0076.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.934] lstrlenW (lpString=".xlsx") returned 5
	[0076.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.934] lstrlenW (lpString=".ppt") returned 4
	[0076.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.935] lstrlenW (lpString=".zip") returned 4
	[0076.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.935] lstrlenW (lpString=".rar") returned 4
	[0076.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.935] lstrlenW (lpString=".bz2") returned 4
	[0076.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.935] lstrlenW (lpString=".7z") returned 3
	[0076.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.935] lstrlenW (lpString=".dbf") returned 4
	[0076.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.935] lstrlenW (lpString=".1cd") returned 4
	[0076.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.935] lstrlenW (lpString=".jpg") returned 4
	[0076.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.935] lstrlenW (lpString=".doc") returned 4
	[0076.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.935] lstrlenW (lpString=".docx") returned 5
	[0076.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.935] lstrlenW (lpString=".pdf") returned 4
	[0076.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.935] lstrlenW (lpString=".xls") returned 4
	[0076.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.936] lstrlenW (lpString=".xlsx") returned 5
	[0076.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.936] lstrlenW (lpString=".ppt") returned 4
	[0076.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.936] lstrlenW (lpString=".zip") returned 4
	[0076.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.936] lstrlenW (lpString=".rar") returned 4
	[0076.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.936] lstrlenW (lpString=".bz2") returned 4
	[0076.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.936] lstrlenW (lpString=".7z") returned 3
	[0076.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.936] lstrlenW (lpString=".dbf") returned 4
	[0076.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.936] lstrlenW (lpString=".1cd") returned 4
	[0076.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0076.936] lstrlenW (lpString=".jpg") returned 4
	[0076.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.936] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.937] lstrlenW (lpString="DD01145_.WMF") returned 12
	[0076.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0076.941] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2780) returned 1
	[0076.941] CloseHandle (hObject=0x344) returned 1
	[0076.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220
	[0076.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0076.941] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.941] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0076.942] GetLastError () returned 0x0
	[0076.942] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xadc, lpOverlapped=0x0) returned 1
	[0076.943] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xae0, lpOverlapped=0x0) returned 1
	[0076.944] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.944] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.944] SetEndOfFile (hFile=0x320) returned 1
	[0076.944] CloseHandle (hObject=0x320) returned 1
	[0076.944] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.945] SetEndOfFile (hFile=0x344) returned 1
	[0076.945] CloseHandle (hObject=0x344) returned 1
	[0076.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1
	[0076.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.946] lstrlenW (lpString=".doc") returned 4
	[0076.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.946] lstrlenW (lpString=".docx") returned 5
	[0076.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.946] lstrlenW (lpString=".pdf") returned 4
	[0076.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.946] lstrlenW (lpString=".xls") returned 4
	[0076.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.946] lstrlenW (lpString=".xlsx") returned 5
	[0076.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.946] lstrlenW (lpString=".ppt") returned 4
	[0076.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.946] lstrlenW (lpString=".zip") returned 4
	[0076.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.946] lstrlenW (lpString=".rar") returned 4
	[0076.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.946] lstrlenW (lpString=".bz2") returned 4
	[0076.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.947] lstrlenW (lpString=".7z") returned 3
	[0076.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.947] lstrlenW (lpString=".dbf") returned 4
	[0076.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.947] lstrlenW (lpString=".1cd") returned 4
	[0076.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.947] lstrlenW (lpString=".jpg") returned 4
	[0076.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.947] lstrlenW (lpString=".doc") returned 4
	[0076.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.947] lstrlenW (lpString=".docx") returned 5
	[0076.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.947] lstrlenW (lpString=".pdf") returned 4
	[0076.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.947] lstrlenW (lpString=".xls") returned 4
	[0076.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.947] lstrlenW (lpString=".xlsx") returned 5
	[0076.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.947] lstrlenW (lpString=".ppt") returned 4
	[0076.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.947] lstrlenW (lpString=".zip") returned 4
	[0076.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.948] lstrlenW (lpString=".rar") returned 4
	[0076.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.948] lstrlenW (lpString=".bz2") returned 4
	[0076.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.948] lstrlenW (lpString=".7z") returned 3
	[0076.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.948] lstrlenW (lpString=".dbf") returned 4
	[0076.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.948] lstrlenW (lpString=".1cd") returned 4
	[0076.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0076.948] lstrlenW (lpString=".jpg") returned 4
	[0076.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.948] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.948] lstrlenW (lpString="DD01146_.WMF") returned 12
	[0076.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0076.949] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2796) returned 1
	[0076.949] CloseHandle (hObject=0x344) returned 1
	[0076.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220
	[0076.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0076.949] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.949] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0076.950] GetLastError () returned 0x0
	[0076.950] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xaec, lpOverlapped=0x0) returned 1
	[0077.241] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xaf0, lpOverlapped=0x0) returned 1
	[0077.242] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.242] WriteFile (in: hFile=0x320, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.242] SetEndOfFile (hFile=0x320) returned 1
	[0077.242] CloseHandle (hObject=0x320) returned 1
	[0077.242] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.242] SetEndOfFile (hFile=0x344) returned 1
	[0077.243] CloseHandle (hObject=0x344) returned 1
	[0077.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1
	[0077.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.247] lstrlenW (lpString=".doc") returned 4
	[0077.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.247] lstrlenW (lpString=".docx") returned 5
	[0077.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.247] lstrlenW (lpString=".pdf") returned 4
	[0077.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.247] lstrlenW (lpString=".xls") returned 4
	[0077.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.247] lstrlenW (lpString=".xlsx") returned 5
	[0077.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.247] lstrlenW (lpString=".ppt") returned 4
	[0077.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.247] lstrlenW (lpString=".zip") returned 4
	[0077.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.247] lstrlenW (lpString=".rar") returned 4
	[0077.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.247] lstrlenW (lpString=".bz2") returned 4
	[0077.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.248] lstrlenW (lpString=".7z") returned 3
	[0077.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.248] lstrlenW (lpString=".dbf") returned 4
	[0077.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.248] lstrlenW (lpString=".1cd") returned 4
	[0077.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.248] lstrlenW (lpString=".jpg") returned 4
	[0077.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.248] lstrlenW (lpString=".doc") returned 4
	[0077.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.248] lstrlenW (lpString=".docx") returned 5
	[0077.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.248] lstrlenW (lpString=".pdf") returned 4
	[0077.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.248] lstrlenW (lpString=".xls") returned 4
	[0077.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.248] lstrlenW (lpString=".xlsx") returned 5
	[0077.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.248] lstrlenW (lpString=".ppt") returned 4
	[0077.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.248] lstrlenW (lpString=".zip") returned 4
	[0077.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.248] lstrlenW (lpString=".rar") returned 4
	[0077.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.248] lstrlenW (lpString=".bz2") returned 4
	[0077.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.249] lstrlenW (lpString=".7z") returned 3
	[0077.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.249] lstrlenW (lpString=".dbf") returned 4
	[0077.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.249] lstrlenW (lpString=".1cd") returned 4
	[0077.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0077.249] lstrlenW (lpString=".jpg") returned 4
	[0077.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.249] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.249] lstrlenW (lpString="DD01179_.WMF") returned 12
	[0077.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.327] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2024) returned 1
	[0077.328] CloseHandle (hObject=0x320) returned 1
	[0077.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220
	[0077.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.346] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.346] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0077.346] GetLastError () returned 0x0
	[0077.346] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x7e8, lpOverlapped=0x0) returned 1
	[0077.348] WriteFile (in: hFile=0x2d4, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0077.349] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.349] WriteFile (in: hFile=0x2d4, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.349] SetEndOfFile (hFile=0x2d4) returned 1
	[0077.349] CloseHandle (hObject=0x2d4) returned 1
	[0077.349] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.350] SetEndOfFile (hFile=0x320) returned 1
	[0077.350] CloseHandle (hObject=0x320) returned 1
	[0077.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1
	[0077.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.351] lstrlenW (lpString=".doc") returned 4
	[0077.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.351] lstrlenW (lpString=".docx") returned 5
	[0077.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.351] lstrlenW (lpString=".pdf") returned 4
	[0077.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.351] lstrlenW (lpString=".xls") returned 4
	[0077.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.351] lstrlenW (lpString=".xlsx") returned 5
	[0077.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.351] lstrlenW (lpString=".ppt") returned 4
	[0077.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.352] lstrlenW (lpString=".zip") returned 4
	[0077.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.352] lstrlenW (lpString=".rar") returned 4
	[0077.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.352] lstrlenW (lpString=".bz2") returned 4
	[0077.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.352] lstrlenW (lpString=".7z") returned 3
	[0077.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.352] lstrlenW (lpString=".dbf") returned 4
	[0077.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.352] lstrlenW (lpString=".1cd") returned 4
	[0077.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.352] lstrlenW (lpString=".jpg") returned 4
	[0077.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.352] lstrlenW (lpString=".doc") returned 4
	[0077.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.352] lstrlenW (lpString=".docx") returned 5
	[0077.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.353] lstrlenW (lpString=".pdf") returned 4
	[0077.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.353] lstrlenW (lpString=".xls") returned 4
	[0077.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.353] lstrlenW (lpString=".xlsx") returned 5
	[0077.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.353] lstrlenW (lpString=".ppt") returned 4
	[0077.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.353] lstrlenW (lpString=".zip") returned 4
	[0077.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.353] lstrlenW (lpString=".rar") returned 4
	[0077.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.353] lstrlenW (lpString=".bz2") returned 4
	[0077.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.353] lstrlenW (lpString=".7z") returned 3
	[0077.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.353] lstrlenW (lpString=".dbf") returned 4
	[0077.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.353] lstrlenW (lpString=".1cd") returned 4
	[0077.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0077.353] lstrlenW (lpString=".jpg") returned 4
	[0077.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.354] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.354] lstrlenW (lpString="DD01186_.WMF") returned 12
	[0077.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.354] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=8564) returned 1
	[0077.354] CloseHandle (hObject=0x320) returned 1
	[0077.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220
	[0077.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.355] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.355] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0077.355] GetLastError () returned 0x0
	[0077.355] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x2174, lpOverlapped=0x0) returned 1
	[0077.357] WriteFile (in: hFile=0x2d4, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2180, lpOverlapped=0x0) returned 1
	[0077.358] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.358] WriteFile (in: hFile=0x2d4, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.358] SetEndOfFile (hFile=0x2d4) returned 1
	[0077.358] CloseHandle (hObject=0x2d4) returned 1
	[0077.358] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.358] SetEndOfFile (hFile=0x320) returned 1
	[0077.359] CloseHandle (hObject=0x320) returned 1
	[0077.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1
	[0077.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.360] lstrlenW (lpString=".doc") returned 4
	[0077.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.360] lstrlenW (lpString=".docx") returned 5
	[0077.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.360] lstrlenW (lpString=".pdf") returned 4
	[0077.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.360] lstrlenW (lpString=".xls") returned 4
	[0077.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.360] lstrlenW (lpString=".xlsx") returned 5
	[0077.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.360] lstrlenW (lpString=".ppt") returned 4
	[0077.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.360] lstrlenW (lpString=".zip") returned 4
	[0077.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.360] lstrlenW (lpString=".rar") returned 4
	[0077.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.360] lstrlenW (lpString=".bz2") returned 4
	[0077.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.360] lstrlenW (lpString=".7z") returned 3
	[0077.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.360] lstrlenW (lpString=".dbf") returned 4
	[0077.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.360] lstrlenW (lpString=".1cd") returned 4
	[0077.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.361] lstrlenW (lpString=".jpg") returned 4
	[0077.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.361] lstrlenW (lpString=".doc") returned 4
	[0077.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.361] lstrlenW (lpString=".docx") returned 5
	[0077.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.361] lstrlenW (lpString=".pdf") returned 4
	[0077.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.361] lstrlenW (lpString=".xls") returned 4
	[0077.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.361] lstrlenW (lpString=".xlsx") returned 5
	[0077.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.361] lstrlenW (lpString=".ppt") returned 4
	[0077.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.361] lstrlenW (lpString=".zip") returned 4
	[0077.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.361] lstrlenW (lpString=".rar") returned 4
	[0077.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.361] lstrlenW (lpString=".bz2") returned 4
	[0077.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.361] lstrlenW (lpString=".7z") returned 3
	[0077.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.362] lstrlenW (lpString=".dbf") returned 4
	[0077.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.362] lstrlenW (lpString=".1cd") returned 4
	[0077.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0077.362] lstrlenW (lpString=".jpg") returned 4
	[0077.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.362] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.362] lstrlenW (lpString="DD01366_.WMF") returned 12
	[0077.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.362] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1768) returned 1
	[0077.362] CloseHandle (hObject=0x320) returned 1
	[0077.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220
	[0077.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.363] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.363] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0077.363] GetLastError () returned 0x0
	[0077.363] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x6e8, lpOverlapped=0x0) returned 1
	[0077.365] WriteFile (in: hFile=0x2d4, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x6f0, lpOverlapped=0x0) returned 1
	[0077.366] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.366] WriteFile (in: hFile=0x2d4, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.366] SetEndOfFile (hFile=0x2d4) returned 1
	[0077.366] CloseHandle (hObject=0x2d4) returned 1
	[0077.366] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.366] SetEndOfFile (hFile=0x320) returned 1
	[0077.367] CloseHandle (hObject=0x320) returned 1
	[0077.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1
	[0077.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.368] lstrlenW (lpString=".doc") returned 4
	[0077.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.368] lstrlenW (lpString=".docx") returned 5
	[0077.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.368] lstrlenW (lpString=".pdf") returned 4
	[0077.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.368] lstrlenW (lpString=".xls") returned 4
	[0077.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.368] lstrlenW (lpString=".xlsx") returned 5
	[0077.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.368] lstrlenW (lpString=".ppt") returned 4
	[0077.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.368] lstrlenW (lpString=".zip") returned 4
	[0077.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.368] lstrlenW (lpString=".rar") returned 4
	[0077.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.368] lstrlenW (lpString=".bz2") returned 4
	[0077.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.368] lstrlenW (lpString=".7z") returned 3
	[0077.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.368] lstrlenW (lpString=".dbf") returned 4
	[0077.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.369] lstrlenW (lpString=".1cd") returned 4
	[0077.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.369] lstrlenW (lpString=".jpg") returned 4
	[0077.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.369] lstrlenW (lpString=".doc") returned 4
	[0077.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.369] lstrlenW (lpString=".docx") returned 5
	[0077.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.369] lstrlenW (lpString=".pdf") returned 4
	[0077.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.369] lstrlenW (lpString=".xls") returned 4
	[0077.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.369] lstrlenW (lpString=".xlsx") returned 5
	[0077.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.369] lstrlenW (lpString=".ppt") returned 4
	[0077.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.369] lstrlenW (lpString=".zip") returned 4
	[0077.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.369] lstrlenW (lpString=".rar") returned 4
	[0077.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.369] lstrlenW (lpString=".bz2") returned 4
	[0077.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.370] lstrlenW (lpString=".7z") returned 3
	[0077.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.370] lstrlenW (lpString=".dbf") returned 4
	[0077.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.370] lstrlenW (lpString=".1cd") returned 4
	[0077.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0077.370] lstrlenW (lpString=".jpg") returned 4
	[0077.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.370] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.370] lstrlenW (lpString="DD01434_.WMF") returned 12
	[0077.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.371] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=900) returned 1
	[0077.371] CloseHandle (hObject=0x320) returned 1
	[0077.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220
	[0077.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.371] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.371] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0077.372] GetLastError () returned 0x0
	[0077.372] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x384, lpOverlapped=0x0) returned 1
	[0077.374] WriteFile (in: hFile=0x2d4, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x390, lpOverlapped=0x0) returned 1
	[0077.375] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.375] WriteFile (in: hFile=0x2d4, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.375] SetEndOfFile (hFile=0x2d4) returned 1
	[0077.375] CloseHandle (hObject=0x2d4) returned 1
	[0077.375] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.375] SetEndOfFile (hFile=0x320) returned 1
	[0077.376] CloseHandle (hObject=0x320) returned 1
	[0077.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1
	[0077.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.377] lstrlenW (lpString=".doc") returned 4
	[0077.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.377] lstrlenW (lpString=".docx") returned 5
	[0077.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.377] lstrlenW (lpString=".pdf") returned 4
	[0077.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.377] lstrlenW (lpString=".xls") returned 4
	[0077.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.377] lstrlenW (lpString=".xlsx") returned 5
	[0077.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.377] lstrlenW (lpString=".ppt") returned 4
	[0077.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.377] lstrlenW (lpString=".zip") returned 4
	[0077.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.377] lstrlenW (lpString=".rar") returned 4
	[0077.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.377] lstrlenW (lpString=".bz2") returned 4
	[0077.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.377] lstrlenW (lpString=".7z") returned 3
	[0077.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.377] lstrlenW (lpString=".dbf") returned 4
	[0077.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.378] lstrlenW (lpString=".1cd") returned 4
	[0077.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.378] lstrlenW (lpString=".jpg") returned 4
	[0077.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.378] lstrlenW (lpString=".doc") returned 4
	[0077.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.378] lstrlenW (lpString=".docx") returned 5
	[0077.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.378] lstrlenW (lpString=".pdf") returned 4
	[0077.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.378] lstrlenW (lpString=".xls") returned 4
	[0077.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.378] lstrlenW (lpString=".xlsx") returned 5
	[0077.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.378] lstrlenW (lpString=".ppt") returned 4
	[0077.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.378] lstrlenW (lpString=".zip") returned 4
	[0077.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.378] lstrlenW (lpString=".rar") returned 4
	[0077.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.378] lstrlenW (lpString=".bz2") returned 4
	[0077.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.379] lstrlenW (lpString=".7z") returned 3
	[0077.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.379] lstrlenW (lpString=".dbf") returned 4
	[0077.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.796] lstrlenW (lpString=".1cd") returned 4
	[0077.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0077.805] lstrlenW (lpString=".jpg") returned 4
	[0077.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.805] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.806] lstrlenW (lpString="ED00172_.WMF") returned 12
	[0077.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0077.806] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2700) returned 1
	[0077.806] CloseHandle (hObject=0x33c) returned 1
	[0077.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220
	[0077.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0077.806] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.806] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0077.808] GetLastError () returned 0x0
	[0077.808] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xa8c, lpOverlapped=0x0) returned 1
	[0077.809] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xa90, lpOverlapped=0x0) returned 1
	[0077.810] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.811] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.811] SetEndOfFile (hFile=0x380) returned 1
	[0077.811] CloseHandle (hObject=0x380) returned 1
	[0077.811] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.811] SetEndOfFile (hFile=0x33c) returned 1
	[0077.812] CloseHandle (hObject=0x33c) returned 1
	[0077.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1
	[0077.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.813] lstrlenW (lpString=".doc") returned 4
	[0077.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.813] lstrlenW (lpString=".docx") returned 5
	[0077.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.813] lstrlenW (lpString=".pdf") returned 4
	[0077.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.813] lstrlenW (lpString=".xls") returned 4
	[0077.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.813] lstrlenW (lpString=".xlsx") returned 5
	[0077.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.813] lstrlenW (lpString=".ppt") returned 4
	[0077.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.813] lstrlenW (lpString=".zip") returned 4
	[0077.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.813] lstrlenW (lpString=".rar") returned 4
	[0077.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.814] lstrlenW (lpString=".bz2") returned 4
	[0077.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.814] lstrlenW (lpString=".7z") returned 3
	[0077.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.814] lstrlenW (lpString=".dbf") returned 4
	[0077.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.814] lstrlenW (lpString=".1cd") returned 4
	[0077.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.814] lstrlenW (lpString=".jpg") returned 4
	[0077.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.815] lstrlenW (lpString=".doc") returned 4
	[0077.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.815] lstrlenW (lpString=".docx") returned 5
	[0077.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.815] lstrlenW (lpString=".pdf") returned 4
	[0077.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.815] lstrlenW (lpString=".xls") returned 4
	[0077.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.815] lstrlenW (lpString=".xlsx") returned 5
	[0077.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.815] lstrlenW (lpString=".ppt") returned 4
	[0077.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.815] lstrlenW (lpString=".zip") returned 4
	[0077.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.815] lstrlenW (lpString=".rar") returned 4
	[0077.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.816] lstrlenW (lpString=".bz2") returned 4
	[0077.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.816] lstrlenW (lpString=".7z") returned 3
	[0077.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.816] lstrlenW (lpString=".dbf") returned 4
	[0077.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.816] lstrlenW (lpString=".1cd") returned 4
	[0077.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0077.817] lstrlenW (lpString=".jpg") returned 4
	[0077.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.817] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.817] lstrlenW (lpString="ED00184_.WMF") returned 12
	[0077.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0077.817] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=6958) returned 1
	[0077.817] CloseHandle (hObject=0x33c) returned 1
	[0077.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220
	[0077.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0077.818] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.818] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0077.818] GetLastError () returned 0x0
	[0077.819] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1b2e, lpOverlapped=0x0) returned 1
	[0077.820] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1b30, lpOverlapped=0x0) returned 1
	[0077.821] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.821] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.821] SetEndOfFile (hFile=0x380) returned 1
	[0077.821] CloseHandle (hObject=0x380) returned 1
	[0077.822] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.822] SetEndOfFile (hFile=0x33c) returned 1
	[0077.822] CloseHandle (hObject=0x33c) returned 1
	[0077.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1
	[0077.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.823] lstrlenW (lpString=".doc") returned 4
	[0077.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.823] lstrlenW (lpString=".docx") returned 5
	[0077.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.823] lstrlenW (lpString=".pdf") returned 4
	[0077.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.823] lstrlenW (lpString=".xls") returned 4
	[0077.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.823] lstrlenW (lpString=".xlsx") returned 5
	[0077.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.823] lstrlenW (lpString=".ppt") returned 4
	[0077.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.823] lstrlenW (lpString=".zip") returned 4
	[0077.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.823] lstrlenW (lpString=".rar") returned 4
	[0077.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.824] lstrlenW (lpString=".bz2") returned 4
	[0077.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.824] lstrlenW (lpString=".7z") returned 3
	[0077.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.824] lstrlenW (lpString=".dbf") returned 4
	[0077.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.824] lstrlenW (lpString=".1cd") returned 4
	[0077.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.824] lstrlenW (lpString=".jpg") returned 4
	[0077.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.824] lstrlenW (lpString=".doc") returned 4
	[0077.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.824] lstrlenW (lpString=".docx") returned 5
	[0077.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.824] lstrlenW (lpString=".pdf") returned 4
	[0077.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.824] lstrlenW (lpString=".xls") returned 4
	[0077.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.824] lstrlenW (lpString=".xlsx") returned 5
	[0077.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.824] lstrlenW (lpString=".ppt") returned 4
	[0077.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.825] lstrlenW (lpString=".zip") returned 4
	[0077.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.825] lstrlenW (lpString=".rar") returned 4
	[0077.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.825] lstrlenW (lpString=".bz2") returned 4
	[0077.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.825] lstrlenW (lpString=".7z") returned 3
	[0077.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.825] lstrlenW (lpString=".dbf") returned 4
	[0077.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.825] lstrlenW (lpString=".1cd") returned 4
	[0077.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0077.825] lstrlenW (lpString=".jpg") returned 4
	[0077.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.825] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.825] lstrlenW (lpString="EN00006_.WMF") returned 12
	[0077.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0077.826] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=13936) returned 1
	[0077.826] CloseHandle (hObject=0x33c) returned 1
	[0077.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220
	[0077.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0077.826] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.827] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0077.827] GetLastError () returned 0x0
	[0077.827] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x3670, lpOverlapped=0x0) returned 1
	[0077.829] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x3680, lpOverlapped=0x0) returned 1
	[0077.831] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.831] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.831] SetEndOfFile (hFile=0x380) returned 1
	[0077.831] CloseHandle (hObject=0x380) returned 1
	[0077.831] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.831] SetEndOfFile (hFile=0x33c) returned 1
	[0077.832] CloseHandle (hObject=0x33c) returned 1
	[0077.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1
	[0077.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.833] lstrlenW (lpString=".doc") returned 4
	[0077.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.833] lstrlenW (lpString=".docx") returned 5
	[0077.833] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.833] lstrlenW (lpString=".pdf") returned 4
	[0077.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.833] lstrlenW (lpString=".xls") returned 4
	[0077.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.833] lstrlenW (lpString=".xlsx") returned 5
	[0077.833] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.833] lstrlenW (lpString=".ppt") returned 4
	[0077.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.833] lstrlenW (lpString=".zip") returned 4
	[0077.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.834] lstrlenW (lpString=".rar") returned 4
	[0077.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.834] lstrlenW (lpString=".bz2") returned 4
	[0077.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.834] lstrlenW (lpString=".7z") returned 3
	[0077.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.834] lstrlenW (lpString=".dbf") returned 4
	[0077.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.834] lstrlenW (lpString=".1cd") returned 4
	[0077.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.834] lstrlenW (lpString=".jpg") returned 4
	[0077.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.834] lstrlenW (lpString=".doc") returned 4
	[0077.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.834] lstrlenW (lpString=".docx") returned 5
	[0077.834] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.834] lstrlenW (lpString=".pdf") returned 4
	[0077.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.834] lstrlenW (lpString=".xls") returned 4
	[0077.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.834] lstrlenW (lpString=".xlsx") returned 5
	[0077.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.834] lstrlenW (lpString=".ppt") returned 4
	[0077.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.835] lstrlenW (lpString=".zip") returned 4
	[0077.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.835] lstrlenW (lpString=".rar") returned 4
	[0077.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.835] lstrlenW (lpString=".bz2") returned 4
	[0077.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.835] lstrlenW (lpString=".7z") returned 3
	[0077.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.835] lstrlenW (lpString=".dbf") returned 4
	[0077.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.835] lstrlenW (lpString=".1cd") returned 4
	[0077.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0077.835] lstrlenW (lpString=".jpg") returned 4
	[0077.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.835] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.835] lstrlenW (lpString="EN00202_.WMF") returned 12
	[0077.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0077.836] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=6938) returned 1
	[0077.836] CloseHandle (hObject=0x33c) returned 1
	[0077.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220
	[0077.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0077.836] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.836] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0077.837] GetLastError () returned 0x0
	[0077.837] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1b1a, lpOverlapped=0x0) returned 1
	[0078.192] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0078.194] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.194] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.195] SetEndOfFile (hFile=0x380) returned 1
	[0078.195] CloseHandle (hObject=0x380) returned 1
	[0078.195] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.195] SetEndOfFile (hFile=0x33c) returned 1
	[0078.196] CloseHandle (hObject=0x33c) returned 1
	[0078.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1
	[0078.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.196] lstrlenW (lpString=".doc") returned 4
	[0078.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.196] lstrlenW (lpString=".docx") returned 5
	[0078.196] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.196] lstrlenW (lpString=".pdf") returned 4
	[0078.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.197] lstrlenW (lpString=".xls") returned 4
	[0078.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.197] lstrlenW (lpString=".xlsx") returned 5
	[0078.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.197] lstrlenW (lpString=".ppt") returned 4
	[0078.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.197] lstrlenW (lpString=".zip") returned 4
	[0078.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.197] lstrlenW (lpString=".rar") returned 4
	[0078.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.197] lstrlenW (lpString=".bz2") returned 4
	[0078.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.197] lstrlenW (lpString=".7z") returned 3
	[0078.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.197] lstrlenW (lpString=".dbf") returned 4
	[0078.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.197] lstrlenW (lpString=".1cd") returned 4
	[0078.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.197] lstrlenW (lpString=".jpg") returned 4
	[0078.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.198] lstrlenW (lpString=".doc") returned 4
	[0078.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.198] lstrlenW (lpString=".docx") returned 5
	[0078.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.198] lstrlenW (lpString=".pdf") returned 4
	[0078.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.198] lstrlenW (lpString=".xls") returned 4
	[0078.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.198] lstrlenW (lpString=".xlsx") returned 5
	[0078.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.198] lstrlenW (lpString=".ppt") returned 4
	[0078.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.198] lstrlenW (lpString=".zip") returned 4
	[0078.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.198] lstrlenW (lpString=".rar") returned 4
	[0078.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.198] lstrlenW (lpString=".bz2") returned 4
	[0078.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.198] lstrlenW (lpString=".7z") returned 3
	[0078.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.199] lstrlenW (lpString=".dbf") returned 4
	[0078.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.199] lstrlenW (lpString=".1cd") returned 4
	[0078.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0078.199] lstrlenW (lpString=".jpg") returned 4
	[0078.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.199] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.199] lstrlenW (lpString="FD00297_.WMF") returned 12
	[0078.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.200] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=18194) returned 1
	[0078.200] CloseHandle (hObject=0x33c) returned 1
	[0078.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220
	[0078.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.200] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.200] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.201] GetLastError () returned 0x0
	[0078.201] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x4712, lpOverlapped=0x0) returned 1
	[0078.202] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x4720, lpOverlapped=0x0) returned 1
	[0078.204] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.204] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.204] SetEndOfFile (hFile=0x380) returned 1
	[0078.204] CloseHandle (hObject=0x380) returned 1
	[0078.204] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.204] SetEndOfFile (hFile=0x33c) returned 1
	[0078.205] CloseHandle (hObject=0x33c) returned 1
	[0078.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1
	[0078.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.206] lstrlenW (lpString=".doc") returned 4
	[0078.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.206] lstrlenW (lpString=".docx") returned 5
	[0078.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.206] lstrlenW (lpString=".pdf") returned 4
	[0078.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.206] lstrlenW (lpString=".xls") returned 4
	[0078.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.207] lstrlenW (lpString=".xlsx") returned 5
	[0078.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.207] lstrlenW (lpString=".ppt") returned 4
	[0078.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.207] lstrlenW (lpString=".zip") returned 4
	[0078.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.208] lstrlenW (lpString=".rar") returned 4
	[0078.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.208] lstrlenW (lpString=".bz2") returned 4
	[0078.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.208] lstrlenW (lpString=".7z") returned 3
	[0078.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.208] lstrlenW (lpString=".dbf") returned 4
	[0078.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.208] lstrlenW (lpString=".1cd") returned 4
	[0078.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.208] lstrlenW (lpString=".jpg") returned 4
	[0078.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.209] lstrlenW (lpString=".doc") returned 4
	[0078.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.209] lstrlenW (lpString=".docx") returned 5
	[0078.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.209] lstrlenW (lpString=".pdf") returned 4
	[0078.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.209] lstrlenW (lpString=".xls") returned 4
	[0078.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.209] lstrlenW (lpString=".xlsx") returned 5
	[0078.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.209] lstrlenW (lpString=".ppt") returned 4
	[0078.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.209] lstrlenW (lpString=".zip") returned 4
	[0078.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.209] lstrlenW (lpString=".rar") returned 4
	[0078.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.210] lstrlenW (lpString=".bz2") returned 4
	[0078.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.210] lstrlenW (lpString=".7z") returned 3
	[0078.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.210] lstrlenW (lpString=".dbf") returned 4
	[0078.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.210] lstrlenW (lpString=".1cd") returned 4
	[0078.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0078.210] lstrlenW (lpString=".jpg") returned 4
	[0078.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.211] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.211] lstrlenW (lpString="FD00306_.WMF") returned 12
	[0078.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.211] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=46814) returned 1
	[0078.211] CloseHandle (hObject=0x33c) returned 1
	[0078.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220
	[0078.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.212] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.212] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.212] GetLastError () returned 0x0
	[0078.212] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xb6de, lpOverlapped=0x0) returned 1
	[0078.214] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xb6e0, lpOverlapped=0x0) returned 1
	[0078.217] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.217] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.217] SetEndOfFile (hFile=0x380) returned 1
	[0078.217] CloseHandle (hObject=0x380) returned 1
	[0078.217] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.217] SetEndOfFile (hFile=0x33c) returned 1
	[0078.218] CloseHandle (hObject=0x33c) returned 1
	[0078.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1
	[0078.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.219] lstrlenW (lpString=".doc") returned 4
	[0078.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.219] lstrlenW (lpString=".docx") returned 5
	[0078.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.219] lstrlenW (lpString=".pdf") returned 4
	[0078.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.219] lstrlenW (lpString=".xls") returned 4
	[0078.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.219] lstrlenW (lpString=".xlsx") returned 5
	[0078.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.219] lstrlenW (lpString=".ppt") returned 4
	[0078.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.219] lstrlenW (lpString=".zip") returned 4
	[0078.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.220] lstrlenW (lpString=".rar") returned 4
	[0078.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.220] lstrlenW (lpString=".bz2") returned 4
	[0078.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.220] lstrlenW (lpString=".7z") returned 3
	[0078.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.220] lstrlenW (lpString=".dbf") returned 4
	[0078.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.220] lstrlenW (lpString=".1cd") returned 4
	[0078.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.220] lstrlenW (lpString=".jpg") returned 4
	[0078.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.220] lstrlenW (lpString=".doc") returned 4
	[0078.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.220] lstrlenW (lpString=".docx") returned 5
	[0078.220] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.221] lstrlenW (lpString=".pdf") returned 4
	[0078.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.221] lstrlenW (lpString=".xls") returned 4
	[0078.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.221] lstrlenW (lpString=".xlsx") returned 5
	[0078.221] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.221] lstrlenW (lpString=".ppt") returned 4
	[0078.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.221] lstrlenW (lpString=".zip") returned 4
	[0078.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.221] lstrlenW (lpString=".rar") returned 4
	[0078.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.221] lstrlenW (lpString=".bz2") returned 4
	[0078.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.221] lstrlenW (lpString=".7z") returned 3
	[0078.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.221] lstrlenW (lpString=".dbf") returned 4
	[0078.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.221] lstrlenW (lpString=".1cd") returned 4
	[0078.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0078.222] lstrlenW (lpString=".jpg") returned 4
	[0078.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.222] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.222] lstrlenW (lpString="FD00336_.WMF") returned 12
	[0078.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.223] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=6068) returned 1
	[0078.223] CloseHandle (hObject=0x33c) returned 1
	[0078.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220
	[0078.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.224] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.224] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.224] GetLastError () returned 0x0
	[0078.224] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x17b4, lpOverlapped=0x0) returned 1
	[0078.552] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x17c0, lpOverlapped=0x0) returned 1
	[0078.553] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.553] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.554] SetEndOfFile (hFile=0x380) returned 1
	[0078.554] CloseHandle (hObject=0x380) returned 1
	[0078.554] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.554] SetEndOfFile (hFile=0x33c) returned 1
	[0078.555] CloseHandle (hObject=0x33c) returned 1
	[0078.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1
	[0078.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.555] lstrlenW (lpString=".doc") returned 4
	[0078.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.555] lstrlenW (lpString=".docx") returned 5
	[0078.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.555] lstrlenW (lpString=".pdf") returned 4
	[0078.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.555] lstrlenW (lpString=".xls") returned 4
	[0078.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.556] lstrlenW (lpString=".xlsx") returned 5
	[0078.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.556] lstrlenW (lpString=".ppt") returned 4
	[0078.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.556] lstrlenW (lpString=".zip") returned 4
	[0078.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.556] lstrlenW (lpString=".rar") returned 4
	[0078.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.556] lstrlenW (lpString=".bz2") returned 4
	[0078.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.556] lstrlenW (lpString=".7z") returned 3
	[0078.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.556] lstrlenW (lpString=".dbf") returned 4
	[0078.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.556] lstrlenW (lpString=".1cd") returned 4
	[0078.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.556] lstrlenW (lpString=".jpg") returned 4
	[0078.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.556] lstrlenW (lpString=".doc") returned 4
	[0078.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.557] lstrlenW (lpString=".docx") returned 5
	[0078.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.557] lstrlenW (lpString=".pdf") returned 4
	[0078.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.557] lstrlenW (lpString=".xls") returned 4
	[0078.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.557] lstrlenW (lpString=".xlsx") returned 5
	[0078.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.557] lstrlenW (lpString=".ppt") returned 4
	[0078.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.557] lstrlenW (lpString=".zip") returned 4
	[0078.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.557] lstrlenW (lpString=".rar") returned 4
	[0078.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.557] lstrlenW (lpString=".bz2") returned 4
	[0078.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.557] lstrlenW (lpString=".7z") returned 3
	[0078.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.557] lstrlenW (lpString=".dbf") returned 4
	[0078.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.557] lstrlenW (lpString=".1cd") returned 4
	[0078.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0078.557] lstrlenW (lpString=".jpg") returned 4
	[0078.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.558] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.558] lstrlenW (lpString="FD00459_.WMF") returned 12
	[0078.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.558] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=17406) returned 1
	[0078.558] CloseHandle (hObject=0x33c) returned 1
	[0078.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220
	[0078.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.558] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.559] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.559] GetLastError () returned 0x0
	[0078.559] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x43fe, lpOverlapped=0x0) returned 1
	[0078.561] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x4400, lpOverlapped=0x0) returned 1
	[0078.562] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.562] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.562] SetEndOfFile (hFile=0x380) returned 1
	[0078.562] CloseHandle (hObject=0x380) returned 1
	[0078.562] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.562] SetEndOfFile (hFile=0x33c) returned 1
	[0078.563] CloseHandle (hObject=0x33c) returned 1
	[0078.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1
	[0078.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.564] lstrlenW (lpString=".doc") returned 4
	[0078.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.564] lstrlenW (lpString=".docx") returned 5
	[0078.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.564] lstrlenW (lpString=".pdf") returned 4
	[0078.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.564] lstrlenW (lpString=".xls") returned 4
	[0078.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.564] lstrlenW (lpString=".xlsx") returned 5
	[0078.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.564] lstrlenW (lpString=".ppt") returned 4
	[0078.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.564] lstrlenW (lpString=".zip") returned 4
	[0078.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.564] lstrlenW (lpString=".rar") returned 4
	[0078.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.564] lstrlenW (lpString=".bz2") returned 4
	[0078.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.564] lstrlenW (lpString=".7z") returned 3
	[0078.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.565] lstrlenW (lpString=".dbf") returned 4
	[0078.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.565] lstrlenW (lpString=".1cd") returned 4
	[0078.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.565] lstrlenW (lpString=".jpg") returned 4
	[0078.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.565] lstrlenW (lpString=".doc") returned 4
	[0078.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.565] lstrlenW (lpString=".docx") returned 5
	[0078.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.565] lstrlenW (lpString=".pdf") returned 4
	[0078.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.565] lstrlenW (lpString=".xls") returned 4
	[0078.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.565] lstrlenW (lpString=".xlsx") returned 5
	[0078.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.565] lstrlenW (lpString=".ppt") returned 4
	[0078.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.566] lstrlenW (lpString=".zip") returned 4
	[0078.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.566] lstrlenW (lpString=".rar") returned 4
	[0078.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.566] lstrlenW (lpString=".bz2") returned 4
	[0078.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.566] lstrlenW (lpString=".7z") returned 3
	[0078.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.566] lstrlenW (lpString=".dbf") returned 4
	[0078.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.566] lstrlenW (lpString=".1cd") returned 4
	[0078.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0078.566] lstrlenW (lpString=".jpg") returned 4
	[0078.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.567] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.568] lstrlenW (lpString="FD00543_.WMF") returned 12
	[0078.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.568] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1472) returned 1
	[0078.568] CloseHandle (hObject=0x33c) returned 1
	[0078.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220
	[0078.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.568] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.569] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.569] GetLastError () returned 0x0
	[0078.569] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x5c0, lpOverlapped=0x0) returned 1
	[0078.572] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x5d0, lpOverlapped=0x0) returned 1
	[0078.574] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.574] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.574] SetEndOfFile (hFile=0x380) returned 1
	[0078.574] CloseHandle (hObject=0x380) returned 1
	[0078.574] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.574] SetEndOfFile (hFile=0x33c) returned 1
	[0078.575] CloseHandle (hObject=0x33c) returned 1
	[0078.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1
	[0078.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.576] lstrlenW (lpString=".doc") returned 4
	[0078.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.576] lstrlenW (lpString=".docx") returned 5
	[0078.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.576] lstrlenW (lpString=".pdf") returned 4
	[0078.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.576] lstrlenW (lpString=".xls") returned 4
	[0078.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.576] lstrlenW (lpString=".xlsx") returned 5
	[0078.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.576] lstrlenW (lpString=".ppt") returned 4
	[0078.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.576] lstrlenW (lpString=".zip") returned 4
	[0078.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.577] lstrlenW (lpString=".rar") returned 4
	[0078.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.577] lstrlenW (lpString=".bz2") returned 4
	[0078.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.577] lstrlenW (lpString=".7z") returned 3
	[0078.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.577] lstrlenW (lpString=".dbf") returned 4
	[0078.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.577] lstrlenW (lpString=".1cd") returned 4
	[0078.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.577] lstrlenW (lpString=".jpg") returned 4
	[0078.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.577] lstrlenW (lpString=".doc") returned 4
	[0078.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.578] lstrlenW (lpString=".docx") returned 5
	[0078.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.578] lstrlenW (lpString=".pdf") returned 4
	[0078.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.578] lstrlenW (lpString=".xls") returned 4
	[0078.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.578] lstrlenW (lpString=".xlsx") returned 5
	[0078.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.578] lstrlenW (lpString=".ppt") returned 4
	[0078.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.578] lstrlenW (lpString=".zip") returned 4
	[0078.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.578] lstrlenW (lpString=".rar") returned 4
	[0078.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.578] lstrlenW (lpString=".bz2") returned 4
	[0078.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.578] lstrlenW (lpString=".7z") returned 3
	[0078.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.578] lstrlenW (lpString=".dbf") returned 4
	[0078.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.579] lstrlenW (lpString=".1cd") returned 4
	[0078.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0078.579] lstrlenW (lpString=".jpg") returned 4
	[0078.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.579] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.579] lstrlenW (lpString="FD00544_.WMF") returned 12
	[0078.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.579] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=5260) returned 1
	[0078.579] CloseHandle (hObject=0x33c) returned 1
	[0078.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220
	[0078.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.580] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.580] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.581] GetLastError () returned 0x0
	[0078.581] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x148c, lpOverlapped=0x0) returned 1
	[0078.582] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1490, lpOverlapped=0x0) returned 1
	[0078.584] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.584] WriteFile (in: hFile=0x380, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.584] SetEndOfFile (hFile=0x380) returned 1
	[0078.584] CloseHandle (hObject=0x380) returned 1
	[0078.585] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.585] SetEndOfFile (hFile=0x33c) returned 1
	[0078.586] CloseHandle (hObject=0x33c) returned 1
	[0078.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1
	[0078.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.587] lstrlenW (lpString=".doc") returned 4
	[0078.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.587] lstrlenW (lpString=".docx") returned 5
	[0078.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.587] lstrlenW (lpString=".pdf") returned 4
	[0078.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.587] lstrlenW (lpString=".xls") returned 4
	[0078.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.587] lstrlenW (lpString=".xlsx") returned 5
	[0078.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.587] lstrlenW (lpString=".ppt") returned 4
	[0078.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.587] lstrlenW (lpString=".zip") returned 4
	[0078.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.588] lstrlenW (lpString=".rar") returned 4
	[0078.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.588] lstrlenW (lpString=".bz2") returned 4
	[0078.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.588] lstrlenW (lpString=".7z") returned 3
	[0078.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.588] lstrlenW (lpString=".dbf") returned 4
	[0078.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.588] lstrlenW (lpString=".1cd") returned 4
	[0078.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.588] lstrlenW (lpString=".jpg") returned 4
	[0078.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.588] lstrlenW (lpString=".doc") returned 4
	[0078.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.588] lstrlenW (lpString=".docx") returned 5
	[0078.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.589] lstrlenW (lpString=".pdf") returned 4
	[0078.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.589] lstrlenW (lpString=".xls") returned 4
	[0078.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.589] lstrlenW (lpString=".xlsx") returned 5
	[0078.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.589] lstrlenW (lpString=".ppt") returned 4
	[0078.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.589] lstrlenW (lpString=".zip") returned 4
	[0078.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.589] lstrlenW (lpString=".rar") returned 4
	[0078.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.589] lstrlenW (lpString=".bz2") returned 4
	[0078.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.589] lstrlenW (lpString=".7z") returned 3
	[0078.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.589] lstrlenW (lpString=".dbf") returned 4
	[0078.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.589] lstrlenW (lpString=".1cd") returned 4
	[0078.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0078.589] lstrlenW (lpString=".jpg") returned 4
	[0078.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.590] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.590] lstrlenW (lpString="FD00564_.WMF") returned 12
	[0078.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.590] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=896) returned 1
	[0078.590] CloseHandle (hObject=0x33c) returned 1
	[0078.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220
	[0078.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0078.591] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.591] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0080.030] GetLastError () returned 0x0
	[0080.030] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x380, lpOverlapped=0x0) returned 1
	[0080.032] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x390, lpOverlapped=0x0) returned 1
	[0080.032] ReadFile (in: hFile=0x33c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.033] WriteFile (in: hFile=0x374, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.033] SetEndOfFile (hFile=0x374) returned 1
	[0080.033] CloseHandle (hObject=0x374) returned 1
	[0080.033] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.033] SetEndOfFile (hFile=0x33c) returned 1
	[0080.034] CloseHandle (hObject=0x33c) returned 1
	[0080.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1
	[0080.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.035] lstrlenW (lpString=".doc") returned 4
	[0080.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.035] lstrlenW (lpString=".docx") returned 5
	[0080.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.035] lstrlenW (lpString=".pdf") returned 4
	[0080.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.035] lstrlenW (lpString=".xls") returned 4
	[0080.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.035] lstrlenW (lpString=".xlsx") returned 5
	[0080.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.035] lstrlenW (lpString=".ppt") returned 4
	[0080.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.035] lstrlenW (lpString=".zip") returned 4
	[0080.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.035] lstrlenW (lpString=".rar") returned 4
	[0080.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.035] lstrlenW (lpString=".bz2") returned 4
	[0080.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.039] lstrlenW (lpString=".7z") returned 3
	[0080.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.039] lstrlenW (lpString=".dbf") returned 4
	[0080.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.039] lstrlenW (lpString=".1cd") returned 4
	[0080.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.039] lstrlenW (lpString=".jpg") returned 4
	[0080.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.040] lstrlenW (lpString=".doc") returned 4
	[0080.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.040] lstrlenW (lpString=".docx") returned 5
	[0080.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.040] lstrlenW (lpString=".pdf") returned 4
	[0080.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.040] lstrlenW (lpString=".xls") returned 4
	[0080.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.040] lstrlenW (lpString=".xlsx") returned 5
	[0080.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.040] lstrlenW (lpString=".ppt") returned 4
	[0080.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.040] lstrlenW (lpString=".zip") returned 4
	[0080.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.040] lstrlenW (lpString=".rar") returned 4
	[0080.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.040] lstrlenW (lpString=".bz2") returned 4
	[0080.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.040] lstrlenW (lpString=".7z") returned 3
	[0080.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.040] lstrlenW (lpString=".dbf") returned 4
	[0080.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.041] lstrlenW (lpString=".1cd") returned 4
	[0080.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0080.041] lstrlenW (lpString=".jpg") returned 4
	[0080.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.041] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.041] lstrlenW (lpString="FD00586_.WMF") returned 12
	[0080.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0080.043] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=752) returned 1
	[0080.043] CloseHandle (hObject=0x344) returned 1
	[0080.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220
	[0080.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0080.044] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.044] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0080.044] GetLastError () returned 0x0
	[0080.044] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x2f0, lpOverlapped=0x0) returned 1
	[0080.046] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x300, lpOverlapped=0x0) returned 1
	[0080.046] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.046] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.047] SetEndOfFile (hFile=0x370) returned 1
	[0080.047] CloseHandle (hObject=0x370) returned 1
	[0080.047] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.047] SetEndOfFile (hFile=0x344) returned 1
	[0080.048] CloseHandle (hObject=0x344) returned 1
	[0080.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1
	[0080.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.048] lstrlenW (lpString=".doc") returned 4
	[0080.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.048] lstrlenW (lpString=".docx") returned 5
	[0080.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.048] lstrlenW (lpString=".pdf") returned 4
	[0080.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.048] lstrlenW (lpString=".xls") returned 4
	[0080.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.049] lstrlenW (lpString=".xlsx") returned 5
	[0080.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.049] lstrlenW (lpString=".ppt") returned 4
	[0080.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.049] lstrlenW (lpString=".zip") returned 4
	[0080.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.049] lstrlenW (lpString=".rar") returned 4
	[0080.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.049] lstrlenW (lpString=".bz2") returned 4
	[0080.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.049] lstrlenW (lpString=".7z") returned 3
	[0080.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.049] lstrlenW (lpString=".dbf") returned 4
	[0080.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.049] lstrlenW (lpString=".1cd") returned 4
	[0080.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.049] lstrlenW (lpString=".jpg") returned 4
	[0080.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.049] lstrlenW (lpString=".doc") returned 4
	[0080.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.050] lstrlenW (lpString=".docx") returned 5
	[0080.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.050] lstrlenW (lpString=".pdf") returned 4
	[0080.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.050] lstrlenW (lpString=".xls") returned 4
	[0080.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.050] lstrlenW (lpString=".xlsx") returned 5
	[0080.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.050] lstrlenW (lpString=".ppt") returned 4
	[0080.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.050] lstrlenW (lpString=".zip") returned 4
	[0080.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.050] lstrlenW (lpString=".rar") returned 4
	[0080.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.050] lstrlenW (lpString=".bz2") returned 4
	[0080.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.050] lstrlenW (lpString=".7z") returned 3
	[0080.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.050] lstrlenW (lpString=".dbf") returned 4
	[0080.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.050] lstrlenW (lpString=".1cd") returned 4
	[0080.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0080.050] lstrlenW (lpString=".jpg") returned 4
	[0080.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.051] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.051] lstrlenW (lpString="FD00775_.WMF") returned 12
	[0080.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0080.051] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=11152) returned 1
	[0080.051] CloseHandle (hObject=0x344) returned 1
	[0080.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220
	[0080.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0080.052] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.052] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0080.052] GetLastError () returned 0x0
	[0080.052] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x2b90, lpOverlapped=0x0) returned 1
	[0080.053] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0080.054] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.055] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.055] SetEndOfFile (hFile=0x370) returned 1
	[0080.055] CloseHandle (hObject=0x370) returned 1
	[0080.055] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.055] SetEndOfFile (hFile=0x344) returned 1
	[0080.056] CloseHandle (hObject=0x344) returned 1
	[0080.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1
	[0080.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.056] lstrlenW (lpString=".doc") returned 4
	[0080.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.056] lstrlenW (lpString=".docx") returned 5
	[0080.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.056] lstrlenW (lpString=".pdf") returned 4
	[0080.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.056] lstrlenW (lpString=".xls") returned 4
	[0080.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.057] lstrlenW (lpString=".xlsx") returned 5
	[0080.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.057] lstrlenW (lpString=".ppt") returned 4
	[0080.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.057] lstrlenW (lpString=".zip") returned 4
	[0080.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.057] lstrlenW (lpString=".rar") returned 4
	[0080.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.057] lstrlenW (lpString=".bz2") returned 4
	[0080.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.057] lstrlenW (lpString=".7z") returned 3
	[0080.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.057] lstrlenW (lpString=".dbf") returned 4
	[0080.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.057] lstrlenW (lpString=".1cd") returned 4
	[0080.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.057] lstrlenW (lpString=".jpg") returned 4
	[0080.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.057] lstrlenW (lpString=".doc") returned 4
	[0080.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.057] lstrlenW (lpString=".docx") returned 5
	[0080.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.057] lstrlenW (lpString=".pdf") returned 4
	[0080.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.058] lstrlenW (lpString=".xls") returned 4
	[0080.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.058] lstrlenW (lpString=".xlsx") returned 5
	[0080.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.058] lstrlenW (lpString=".ppt") returned 4
	[0080.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.058] lstrlenW (lpString=".zip") returned 4
	[0080.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.058] lstrlenW (lpString=".rar") returned 4
	[0080.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.058] lstrlenW (lpString=".bz2") returned 4
	[0080.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.058] lstrlenW (lpString=".7z") returned 3
	[0080.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.058] lstrlenW (lpString=".dbf") returned 4
	[0080.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.058] lstrlenW (lpString=".1cd") returned 4
	[0080.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0080.058] lstrlenW (lpString=".jpg") returned 4
	[0080.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.059] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.059] lstrlenW (lpString="FD00779_.WMF") returned 12
	[0080.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0080.059] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=9010) returned 1
	[0080.059] CloseHandle (hObject=0x344) returned 1
	[0080.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220
	[0080.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0080.059] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.059] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0080.060] GetLastError () returned 0x0
	[0080.060] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x2332, lpOverlapped=0x0) returned 1
	[0080.061] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2340, lpOverlapped=0x0) returned 1
	[0080.062] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.062] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.062] SetEndOfFile (hFile=0x370) returned 1
	[0080.063] CloseHandle (hObject=0x370) returned 1
	[0080.063] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.063] SetEndOfFile (hFile=0x344) returned 1
	[0080.064] CloseHandle (hObject=0x344) returned 1
	[0080.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1
	[0080.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.064] lstrlenW (lpString=".doc") returned 4
	[0080.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.064] lstrlenW (lpString=".docx") returned 5
	[0080.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.064] lstrlenW (lpString=".pdf") returned 4
	[0080.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.064] lstrlenW (lpString=".xls") returned 4
	[0080.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.065] lstrlenW (lpString=".xlsx") returned 5
	[0080.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.065] lstrlenW (lpString=".ppt") returned 4
	[0080.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.065] lstrlenW (lpString=".zip") returned 4
	[0080.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.065] lstrlenW (lpString=".rar") returned 4
	[0080.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.065] lstrlenW (lpString=".bz2") returned 4
	[0080.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.065] lstrlenW (lpString=".7z") returned 3
	[0080.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.065] lstrlenW (lpString=".dbf") returned 4
	[0080.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.065] lstrlenW (lpString=".1cd") returned 4
	[0080.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.065] lstrlenW (lpString=".jpg") returned 4
	[0080.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.065] lstrlenW (lpString=".doc") returned 4
	[0080.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.066] lstrlenW (lpString=".docx") returned 5
	[0080.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.066] lstrlenW (lpString=".pdf") returned 4
	[0080.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.066] lstrlenW (lpString=".xls") returned 4
	[0080.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.066] lstrlenW (lpString=".xlsx") returned 5
	[0080.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.066] lstrlenW (lpString=".ppt") returned 4
	[0080.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.066] lstrlenW (lpString=".zip") returned 4
	[0080.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.066] lstrlenW (lpString=".rar") returned 4
	[0080.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.066] lstrlenW (lpString=".bz2") returned 4
	[0080.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.066] lstrlenW (lpString=".7z") returned 3
	[0080.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.066] lstrlenW (lpString=".dbf") returned 4
	[0080.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.071] lstrlenW (lpString=".1cd") returned 4
	[0080.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0080.071] lstrlenW (lpString=".jpg") returned 4
	[0080.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.072] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.072] lstrlenW (lpString="FD00799_.WMF") returned 12
	[0080.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0080.072] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=13968) returned 1
	[0080.072] CloseHandle (hObject=0x344) returned 1
	[0080.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220
	[0080.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0080.072] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.073] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0080.073] GetLastError () returned 0x0
	[0080.073] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x3690, lpOverlapped=0x0) returned 1
	[0080.592] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x36a0, lpOverlapped=0x0) returned 1
	[0080.593] ReadFile (in: hFile=0x344, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.593] WriteFile (in: hFile=0x370, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.593] SetEndOfFile (hFile=0x370) returned 1
	[0081.304] CloseHandle (hObject=0x370) returned 1
	[0081.335] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.335] SetEndOfFile (hFile=0x344) returned 1
	[0081.336] CloseHandle (hObject=0x344) returned 1
	[0081.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1
	[0081.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.415] lstrlenW (lpString=".doc") returned 4
	[0081.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.415] lstrlenW (lpString=".docx") returned 5
	[0081.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.415] lstrlenW (lpString=".pdf") returned 4
	[0081.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.415] lstrlenW (lpString=".xls") returned 4
	[0081.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.415] lstrlenW (lpString=".xlsx") returned 5
	[0081.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.415] lstrlenW (lpString=".ppt") returned 4
	[0081.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.415] lstrlenW (lpString=".zip") returned 4
	[0081.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.415] lstrlenW (lpString=".rar") returned 4
	[0081.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.415] lstrlenW (lpString=".bz2") returned 4
	[0081.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.415] lstrlenW (lpString=".7z") returned 3
	[0081.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.415] lstrlenW (lpString=".dbf") returned 4
	[0081.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.416] lstrlenW (lpString=".1cd") returned 4
	[0081.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.416] lstrlenW (lpString=".jpg") returned 4
	[0081.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.416] lstrlenW (lpString=".doc") returned 4
	[0081.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.416] lstrlenW (lpString=".docx") returned 5
	[0081.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.416] lstrlenW (lpString=".pdf") returned 4
	[0081.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.416] lstrlenW (lpString=".xls") returned 4
	[0081.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.416] lstrlenW (lpString=".xlsx") returned 5
	[0081.416] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.416] lstrlenW (lpString=".ppt") returned 4
	[0081.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.416] lstrlenW (lpString=".zip") returned 4
	[0081.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.417] lstrlenW (lpString=".rar") returned 4
	[0081.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.417] lstrlenW (lpString=".bz2") returned 4
	[0081.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.417] lstrlenW (lpString=".7z") returned 3
	[0081.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.417] lstrlenW (lpString=".dbf") returned 4
	[0081.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.417] lstrlenW (lpString=".1cd") returned 4
	[0081.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0081.417] lstrlenW (lpString=".jpg") returned 4
	[0081.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.417] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.417] lstrlenW (lpString="FD02116_.WMF") returned 12
	[0081.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.418] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3988) returned 1
	[0081.418] CloseHandle (hObject=0x398) returned 1
	[0081.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220
	[0081.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.418] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.418] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0081.419] GetLastError () returned 0x0
	[0081.419] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xf94, lpOverlapped=0x0) returned 1
	[0081.420] WriteFile (in: hFile=0x340, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xfa0, lpOverlapped=0x0) returned 1
	[0081.421] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.421] WriteFile (in: hFile=0x340, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.421] SetEndOfFile (hFile=0x340) returned 1
	[0081.422] CloseHandle (hObject=0x340) returned 1
	[0081.422] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.422] SetEndOfFile (hFile=0x398) returned 1
	[0081.423] CloseHandle (hObject=0x398) returned 1
	[0081.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1
	[0081.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.423] lstrlenW (lpString=".doc") returned 4
	[0081.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.423] lstrlenW (lpString=".docx") returned 5
	[0081.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.423] lstrlenW (lpString=".pdf") returned 4
	[0081.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.424] lstrlenW (lpString=".xls") returned 4
	[0081.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.424] lstrlenW (lpString=".xlsx") returned 5
	[0081.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.424] lstrlenW (lpString=".ppt") returned 4
	[0081.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.424] lstrlenW (lpString=".zip") returned 4
	[0081.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.424] lstrlenW (lpString=".rar") returned 4
	[0081.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.424] lstrlenW (lpString=".bz2") returned 4
	[0081.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.424] lstrlenW (lpString=".7z") returned 3
	[0081.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.424] lstrlenW (lpString=".dbf") returned 4
	[0081.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.424] lstrlenW (lpString=".1cd") returned 4
	[0081.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.425] lstrlenW (lpString=".jpg") returned 4
	[0081.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.425] lstrlenW (lpString=".doc") returned 4
	[0081.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.425] lstrlenW (lpString=".docx") returned 5
	[0081.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.425] lstrlenW (lpString=".pdf") returned 4
	[0081.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.425] lstrlenW (lpString=".xls") returned 4
	[0081.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.425] lstrlenW (lpString=".xlsx") returned 5
	[0081.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.425] lstrlenW (lpString=".ppt") returned 4
	[0081.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.425] lstrlenW (lpString=".zip") returned 4
	[0081.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.425] lstrlenW (lpString=".rar") returned 4
	[0081.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.425] lstrlenW (lpString=".bz2") returned 4
	[0081.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.426] lstrlenW (lpString=".7z") returned 3
	[0081.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.426] lstrlenW (lpString=".dbf") returned 4
	[0081.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.426] lstrlenW (lpString=".1cd") returned 4
	[0081.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0081.426] lstrlenW (lpString=".jpg") returned 4
	[0081.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.426] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.426] lstrlenW (lpString="FD02141_.WMF") returned 12
	[0081.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.427] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2636) returned 1
	[0081.427] CloseHandle (hObject=0x398) returned 1
	[0081.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220
	[0081.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.428] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.428] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0081.428] GetLastError () returned 0x0
	[0081.428] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xa4c, lpOverlapped=0x0) returned 1
	[0081.430] WriteFile (in: hFile=0x340, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xa50, lpOverlapped=0x0) returned 1
	[0081.430] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.430] WriteFile (in: hFile=0x340, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.431] SetEndOfFile (hFile=0x340) returned 1
	[0081.431] CloseHandle (hObject=0x340) returned 1
	[0081.431] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.431] SetEndOfFile (hFile=0x398) returned 1
	[0081.432] CloseHandle (hObject=0x398) returned 1
	[0081.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1
	[0081.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.432] lstrlenW (lpString=".doc") returned 4
	[0081.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.433] lstrlenW (lpString=".docx") returned 5
	[0081.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.433] lstrlenW (lpString=".pdf") returned 4
	[0081.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.433] lstrlenW (lpString=".xls") returned 4
	[0081.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.433] lstrlenW (lpString=".xlsx") returned 5
	[0081.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.433] lstrlenW (lpString=".ppt") returned 4
	[0081.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.433] lstrlenW (lpString=".zip") returned 4
	[0081.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.433] lstrlenW (lpString=".rar") returned 4
	[0081.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.433] lstrlenW (lpString=".bz2") returned 4
	[0081.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.433] lstrlenW (lpString=".7z") returned 3
	[0081.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.433] lstrlenW (lpString=".dbf") returned 4
	[0081.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.433] lstrlenW (lpString=".1cd") returned 4
	[0081.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.434] lstrlenW (lpString=".jpg") returned 4
	[0081.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.434] lstrlenW (lpString=".doc") returned 4
	[0081.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.434] lstrlenW (lpString=".docx") returned 5
	[0081.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.434] lstrlenW (lpString=".pdf") returned 4
	[0081.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.434] lstrlenW (lpString=".xls") returned 4
	[0081.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.434] lstrlenW (lpString=".xlsx") returned 5
	[0081.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.434] lstrlenW (lpString=".ppt") returned 4
	[0081.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.434] lstrlenW (lpString=".zip") returned 4
	[0081.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.434] lstrlenW (lpString=".rar") returned 4
	[0081.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.434] lstrlenW (lpString=".bz2") returned 4
	[0081.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.435] lstrlenW (lpString=".7z") returned 3
	[0081.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.435] lstrlenW (lpString=".dbf") returned 4
	[0081.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.435] lstrlenW (lpString=".1cd") returned 4
	[0081.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0081.435] lstrlenW (lpString=".jpg") returned 4
	[0081.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.435] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.435] lstrlenW (lpString="FD02153_.WMF") returned 12
	[0081.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.435] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=5392) returned 1
	[0081.436] CloseHandle (hObject=0x398) returned 1
	[0081.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220
	[0081.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.436] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.436] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0081.437] GetLastError () returned 0x0
	[0081.437] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1510, lpOverlapped=0x0) returned 1
	[0081.438] WriteFile (in: hFile=0x340, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1520, lpOverlapped=0x0) returned 1
	[0081.439] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.439] WriteFile (in: hFile=0x340, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.439] SetEndOfFile (hFile=0x340) returned 1
	[0081.439] CloseHandle (hObject=0x340) returned 1
	[0081.439] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.439] SetEndOfFile (hFile=0x398) returned 1
	[0081.440] CloseHandle (hObject=0x398) returned 1
	[0081.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1
	[0081.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.710] lstrlenW (lpString=".doc") returned 4
	[0081.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.710] lstrlenW (lpString=".docx") returned 5
	[0081.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.710] lstrlenW (lpString=".pdf") returned 4
	[0081.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.710] lstrlenW (lpString=".xls") returned 4
	[0081.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.710] lstrlenW (lpString=".xlsx") returned 5
	[0081.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.710] lstrlenW (lpString=".ppt") returned 4
	[0081.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.711] lstrlenW (lpString=".zip") returned 4
	[0081.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.711] lstrlenW (lpString=".rar") returned 4
	[0081.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.711] lstrlenW (lpString=".bz2") returned 4
	[0081.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.711] lstrlenW (lpString=".7z") returned 3
	[0081.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.711] lstrlenW (lpString=".dbf") returned 4
	[0081.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.711] lstrlenW (lpString=".1cd") returned 4
	[0081.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.711] lstrlenW (lpString=".jpg") returned 4
	[0081.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.711] lstrlenW (lpString=".doc") returned 4
	[0081.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.711] lstrlenW (lpString=".docx") returned 5
	[0081.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.711] lstrlenW (lpString=".pdf") returned 4
	[0081.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.711] lstrlenW (lpString=".xls") returned 4
	[0081.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.712] lstrlenW (lpString=".xlsx") returned 5
	[0081.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.712] lstrlenW (lpString=".ppt") returned 4
	[0081.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.712] lstrlenW (lpString=".zip") returned 4
	[0081.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.712] lstrlenW (lpString=".rar") returned 4
	[0081.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.712] lstrlenW (lpString=".bz2") returned 4
	[0081.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.712] lstrlenW (lpString=".7z") returned 3
	[0081.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.712] lstrlenW (lpString=".dbf") returned 4
	[0081.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.712] lstrlenW (lpString=".1cd") returned 4
	[0081.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0081.712] lstrlenW (lpString=".jpg") returned 4
	[0081.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.712] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.713] lstrlenW (lpString="FD02158_.WMF") returned 12
	[0081.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.713] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1648) returned 1
	[0081.713] CloseHandle (hObject=0x37c) returned 1
	[0081.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220
	[0081.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.713] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.713] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0081.714] GetLastError () returned 0x0
	[0081.714] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x670, lpOverlapped=0x0) returned 1
	[0081.802] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x680, lpOverlapped=0x0) returned 1
	[0081.802] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.803] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.803] SetEndOfFile (hFile=0x354) returned 1
	[0081.803] CloseHandle (hObject=0x354) returned 1
	[0081.803] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.803] SetEndOfFile (hFile=0x37c) returned 1
	[0081.804] CloseHandle (hObject=0x37c) returned 1
	[0081.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1
	[0081.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.804] lstrlenW (lpString=".doc") returned 4
	[0081.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.804] lstrlenW (lpString=".docx") returned 5
	[0081.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.804] lstrlenW (lpString=".pdf") returned 4
	[0081.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.804] lstrlenW (lpString=".xls") returned 4
	[0081.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.805] lstrlenW (lpString=".xlsx") returned 5
	[0081.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.805] lstrlenW (lpString=".ppt") returned 4
	[0081.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.805] lstrlenW (lpString=".zip") returned 4
	[0081.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.805] lstrlenW (lpString=".rar") returned 4
	[0081.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.805] lstrlenW (lpString=".bz2") returned 4
	[0081.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.805] lstrlenW (lpString=".7z") returned 3
	[0081.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.805] lstrlenW (lpString=".dbf") returned 4
	[0081.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.805] lstrlenW (lpString=".1cd") returned 4
	[0081.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.805] lstrlenW (lpString=".jpg") returned 4
	[0081.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.805] lstrlenW (lpString=".doc") returned 4
	[0081.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.805] lstrlenW (lpString=".docx") returned 5
	[0081.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.805] lstrlenW (lpString=".pdf") returned 4
	[0081.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.806] lstrlenW (lpString=".xls") returned 4
	[0081.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.806] lstrlenW (lpString=".xlsx") returned 5
	[0081.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.806] lstrlenW (lpString=".ppt") returned 4
	[0081.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.806] lstrlenW (lpString=".zip") returned 4
	[0081.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.806] lstrlenW (lpString=".rar") returned 4
	[0081.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.806] lstrlenW (lpString=".bz2") returned 4
	[0081.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.806] lstrlenW (lpString=".7z") returned 3
	[0081.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.806] lstrlenW (lpString=".dbf") returned 4
	[0081.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.806] lstrlenW (lpString=".1cd") returned 4
	[0081.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0081.806] lstrlenW (lpString=".jpg") returned 4
	[0081.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.806] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.806] lstrlenW (lpString="FLAP.WMF") returned 8
	[0081.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.813] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2070) returned 1
	[0081.813] CloseHandle (hObject=0x398) returned 1
	[0081.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220
	[0081.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.813] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.813] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0081.814] GetLastError () returned 0x0
	[0081.815] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x816, lpOverlapped=0x0) returned 1
	[0081.817] WriteFile (in: hFile=0x384, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x820, lpOverlapped=0x0) returned 1
	[0081.818] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.818] WriteFile (in: hFile=0x384, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0081.819] SetEndOfFile (hFile=0x384) returned 1
	[0081.819] CloseHandle (hObject=0x384) returned 1
	[0081.819] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.819] SetEndOfFile (hFile=0x398) returned 1
	[0081.820] CloseHandle (hObject=0x398) returned 1
	[0081.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1
	[0081.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.820] lstrlenW (lpString=".doc") returned 4
	[0081.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.820] lstrlenW (lpString=".docx") returned 5
	[0081.820] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0081.820] lstrlenW (lpString=".pdf") returned 4
	[0081.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.820] lstrlenW (lpString=".xls") returned 4
	[0081.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.820] lstrlenW (lpString=".xlsx") returned 5
	[0081.821] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0081.821] lstrlenW (lpString=".ppt") returned 4
	[0081.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.821] lstrlenW (lpString=".zip") returned 4
	[0081.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.821] lstrlenW (lpString=".rar") returned 4
	[0081.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.821] lstrlenW (lpString=".bz2") returned 4
	[0081.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.821] lstrlenW (lpString=".7z") returned 3
	[0081.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.821] lstrlenW (lpString=".dbf") returned 4
	[0081.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.821] lstrlenW (lpString=".1cd") returned 4
	[0081.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.821] lstrlenW (lpString=".jpg") returned 4
	[0081.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.821] lstrlenW (lpString=".doc") returned 4
	[0081.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.821] lstrlenW (lpString=".docx") returned 5
	[0081.821] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0081.821] lstrlenW (lpString=".pdf") returned 4
	[0081.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.822] lstrlenW (lpString=".xls") returned 4
	[0081.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.822] lstrlenW (lpString=".xlsx") returned 5
	[0081.822] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0081.822] lstrlenW (lpString=".ppt") returned 4
	[0081.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.822] lstrlenW (lpString=".zip") returned 4
	[0081.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.822] lstrlenW (lpString=".rar") returned 4
	[0081.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.822] lstrlenW (lpString=".bz2") returned 4
	[0081.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.822] lstrlenW (lpString=".7z") returned 3
	[0081.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.822] lstrlenW (lpString=".dbf") returned 4
	[0081.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.822] lstrlenW (lpString=".1cd") returned 4
	[0081.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0081.822] lstrlenW (lpString=".jpg") returned 4
	[0081.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.822] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.823] lstrlenW (lpString="HH00084_.WMF") returned 12
	[0081.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.823] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2472) returned 1
	[0081.823] CloseHandle (hObject=0x398) returned 1
	[0081.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220
	[0081.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.823] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.823] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0081.824] GetLastError () returned 0x0
	[0081.824] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x9a8, lpOverlapped=0x0) returned 1
	[0081.831] WriteFile (in: hFile=0x384, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x9b0, lpOverlapped=0x0) returned 1
	[0081.832] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.832] WriteFile (in: hFile=0x384, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.832] SetEndOfFile (hFile=0x384) returned 1
	[0081.832] CloseHandle (hObject=0x384) returned 1
	[0081.833] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.833] SetEndOfFile (hFile=0x398) returned 1
	[0081.833] CloseHandle (hObject=0x398) returned 1
	[0081.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1
	[0081.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.834] lstrlenW (lpString=".doc") returned 4
	[0081.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.834] lstrlenW (lpString=".docx") returned 5
	[0081.834] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.834] lstrlenW (lpString=".pdf") returned 4
	[0081.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.834] lstrlenW (lpString=".xls") returned 4
	[0081.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.834] lstrlenW (lpString=".xlsx") returned 5
	[0081.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.834] lstrlenW (lpString=".ppt") returned 4
	[0081.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.835] lstrlenW (lpString=".zip") returned 4
	[0081.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.835] lstrlenW (lpString=".rar") returned 4
	[0081.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.835] lstrlenW (lpString=".bz2") returned 4
	[0081.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.835] lstrlenW (lpString=".7z") returned 3
	[0081.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.835] lstrlenW (lpString=".dbf") returned 4
	[0081.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.835] lstrlenW (lpString=".1cd") returned 4
	[0081.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.835] lstrlenW (lpString=".jpg") returned 4
	[0081.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.835] lstrlenW (lpString=".doc") returned 4
	[0081.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.835] lstrlenW (lpString=".docx") returned 5
	[0081.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.835] lstrlenW (lpString=".pdf") returned 4
	[0081.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.835] lstrlenW (lpString=".xls") returned 4
	[0081.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.835] lstrlenW (lpString=".xlsx") returned 5
	[0081.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.836] lstrlenW (lpString=".ppt") returned 4
	[0081.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.836] lstrlenW (lpString=".zip") returned 4
	[0081.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.836] lstrlenW (lpString=".rar") returned 4
	[0081.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.836] lstrlenW (lpString=".bz2") returned 4
	[0081.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.836] lstrlenW (lpString=".7z") returned 3
	[0081.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.836] lstrlenW (lpString=".dbf") returned 4
	[0081.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.836] lstrlenW (lpString=".1cd") returned 4
	[0081.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0081.836] lstrlenW (lpString=".jpg") returned 4
	[0081.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.836] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.837] lstrlenW (lpString="HH00235_.WMF") returned 12
	[0081.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0081.838] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1026) returned 1
	[0081.838] CloseHandle (hObject=0x384) returned 1
	[0081.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220
	[0081.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.847] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.847] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0081.848] GetLastError () returned 0x0
	[0081.848] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x402, lpOverlapped=0x0) returned 1
	[0081.849] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x410, lpOverlapped=0x0) returned 1
	[0081.850] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.850] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.850] SetEndOfFile (hFile=0x354) returned 1
	[0081.851] CloseHandle (hObject=0x354) returned 1
	[0081.851] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.851] SetEndOfFile (hFile=0x37c) returned 1
	[0081.852] CloseHandle (hObject=0x37c) returned 1
	[0081.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1
	[0081.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.852] lstrlenW (lpString=".doc") returned 4
	[0081.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.852] lstrlenW (lpString=".docx") returned 5
	[0081.852] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.852] lstrlenW (lpString=".pdf") returned 4
	[0081.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.853] lstrlenW (lpString=".xls") returned 4
	[0081.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.853] lstrlenW (lpString=".xlsx") returned 5
	[0081.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.853] lstrlenW (lpString=".ppt") returned 4
	[0081.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.853] lstrlenW (lpString=".zip") returned 4
	[0081.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.853] lstrlenW (lpString=".rar") returned 4
	[0081.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.853] lstrlenW (lpString=".bz2") returned 4
	[0081.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.853] lstrlenW (lpString=".7z") returned 3
	[0081.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.853] lstrlenW (lpString=".dbf") returned 4
	[0081.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.853] lstrlenW (lpString=".1cd") returned 4
	[0081.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.853] lstrlenW (lpString=".jpg") returned 4
	[0081.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.854] lstrlenW (lpString=".doc") returned 4
	[0081.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.854] lstrlenW (lpString=".docx") returned 5
	[0081.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.854] lstrlenW (lpString=".pdf") returned 4
	[0081.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.854] lstrlenW (lpString=".xls") returned 4
	[0081.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.854] lstrlenW (lpString=".xlsx") returned 5
	[0081.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.854] lstrlenW (lpString=".ppt") returned 4
	[0081.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.854] lstrlenW (lpString=".zip") returned 4
	[0081.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.854] lstrlenW (lpString=".rar") returned 4
	[0081.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.854] lstrlenW (lpString=".bz2") returned 4
	[0081.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.854] lstrlenW (lpString=".7z") returned 3
	[0081.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.855] lstrlenW (lpString=".dbf") returned 4
	[0081.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.855] lstrlenW (lpString=".1cd") returned 4
	[0081.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0081.855] lstrlenW (lpString=".jpg") returned 4
	[0081.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.855] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.855] lstrlenW (lpString="HH00241_.WMF") returned 12
	[0081.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.855] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1960) returned 1
	[0081.855] CloseHandle (hObject=0x37c) returned 1
	[0081.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220
	[0081.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.856] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.856] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0081.856] GetLastError () returned 0x0
	[0081.856] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x7a8, lpOverlapped=0x0) returned 1
	[0081.858] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x7b0, lpOverlapped=0x0) returned 1
	[0081.859] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.859] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.859] SetEndOfFile (hFile=0x354) returned 1
	[0081.859] CloseHandle (hObject=0x354) returned 1
	[0081.859] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.859] SetEndOfFile (hFile=0x37c) returned 1
	[0081.860] CloseHandle (hObject=0x37c) returned 1
	[0081.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1
	[0081.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.861] lstrlenW (lpString=".doc") returned 4
	[0081.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.861] lstrlenW (lpString=".docx") returned 5
	[0081.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.861] lstrlenW (lpString=".pdf") returned 4
	[0081.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.861] lstrlenW (lpString=".xls") returned 4
	[0081.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.861] lstrlenW (lpString=".xlsx") returned 5
	[0081.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.861] lstrlenW (lpString=".ppt") returned 4
	[0081.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.861] lstrlenW (lpString=".zip") returned 4
	[0081.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.861] lstrlenW (lpString=".rar") returned 4
	[0081.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.861] lstrlenW (lpString=".bz2") returned 4
	[0081.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.861] lstrlenW (lpString=".7z") returned 3
	[0081.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.862] lstrlenW (lpString=".dbf") returned 4
	[0081.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.862] lstrlenW (lpString=".1cd") returned 4
	[0081.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.862] lstrlenW (lpString=".jpg") returned 4
	[0081.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.862] lstrlenW (lpString=".doc") returned 4
	[0081.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.862] lstrlenW (lpString=".docx") returned 5
	[0081.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.862] lstrlenW (lpString=".pdf") returned 4
	[0081.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.862] lstrlenW (lpString=".xls") returned 4
	[0081.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.862] lstrlenW (lpString=".xlsx") returned 5
	[0081.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.862] lstrlenW (lpString=".ppt") returned 4
	[0081.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.862] lstrlenW (lpString=".zip") returned 4
	[0081.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.862] lstrlenW (lpString=".rar") returned 4
	[0081.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.862] lstrlenW (lpString=".bz2") returned 4
	[0081.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.863] lstrlenW (lpString=".7z") returned 3
	[0081.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.863] lstrlenW (lpString=".dbf") returned 4
	[0081.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.863] lstrlenW (lpString=".1cd") returned 4
	[0081.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0081.863] lstrlenW (lpString=".jpg") returned 4
	[0081.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.863] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.863] lstrlenW (lpString="HH00260_.WMF") returned 12
	[0081.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.864] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3662) returned 1
	[0081.864] CloseHandle (hObject=0x37c) returned 1
	[0081.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220
	[0081.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.864] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.864] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0081.865] GetLastError () returned 0x0
	[0081.865] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xe4e, lpOverlapped=0x0) returned 1
	[0081.866] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xe50, lpOverlapped=0x0) returned 1
	[0081.867] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.867] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.867] SetEndOfFile (hFile=0x354) returned 1
	[0081.868] CloseHandle (hObject=0x354) returned 1
	[0081.868] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.868] SetEndOfFile (hFile=0x37c) returned 1
	[0081.869] CloseHandle (hObject=0x37c) returned 1
	[0081.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1
	[0081.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.869] lstrlenW (lpString=".doc") returned 4
	[0081.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.869] lstrlenW (lpString=".docx") returned 5
	[0081.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.869] lstrlenW (lpString=".pdf") returned 4
	[0081.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.870] lstrlenW (lpString=".xls") returned 4
	[0081.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.870] lstrlenW (lpString=".xlsx") returned 5
	[0081.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.870] lstrlenW (lpString=".ppt") returned 4
	[0081.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.870] lstrlenW (lpString=".zip") returned 4
	[0081.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.870] lstrlenW (lpString=".rar") returned 4
	[0081.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.870] lstrlenW (lpString=".bz2") returned 4
	[0081.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.870] lstrlenW (lpString=".7z") returned 3
	[0081.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.870] lstrlenW (lpString=".dbf") returned 4
	[0081.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.870] lstrlenW (lpString=".1cd") returned 4
	[0081.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.870] lstrlenW (lpString=".jpg") returned 4
	[0081.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.871] lstrlenW (lpString=".doc") returned 4
	[0081.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.871] lstrlenW (lpString=".docx") returned 5
	[0081.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.871] lstrlenW (lpString=".pdf") returned 4
	[0081.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.871] lstrlenW (lpString=".xls") returned 4
	[0081.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.871] lstrlenW (lpString=".xlsx") returned 5
	[0081.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.871] lstrlenW (lpString=".ppt") returned 4
	[0081.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.871] lstrlenW (lpString=".zip") returned 4
	[0081.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.871] lstrlenW (lpString=".rar") returned 4
	[0081.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.871] lstrlenW (lpString=".bz2") returned 4
	[0081.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.871] lstrlenW (lpString=".7z") returned 3
	[0081.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.872] lstrlenW (lpString=".dbf") returned 4
	[0081.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.872] lstrlenW (lpString=".1cd") returned 4
	[0081.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0081.872] lstrlenW (lpString=".jpg") returned 4
	[0081.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.872] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.872] lstrlenW (lpString="HH00276_.WMF") returned 12
	[0081.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.873] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3016) returned 1
	[0081.873] CloseHandle (hObject=0x37c) returned 1
	[0081.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220
	[0081.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.873] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.873] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0081.874] GetLastError () returned 0x0
	[0081.874] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xbc8, lpOverlapped=0x0) returned 1
	[0081.875] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0081.876] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.876] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.876] SetEndOfFile (hFile=0x354) returned 1
	[0081.877] CloseHandle (hObject=0x354) returned 1
	[0081.877] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.877] SetEndOfFile (hFile=0x37c) returned 1
	[0081.878] CloseHandle (hObject=0x37c) returned 1
	[0081.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1
	[0081.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.878] lstrlenW (lpString=".doc") returned 4
	[0081.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.878] lstrlenW (lpString=".docx") returned 5
	[0081.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.878] lstrlenW (lpString=".pdf") returned 4
	[0081.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.878] lstrlenW (lpString=".xls") returned 4
	[0081.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.878] lstrlenW (lpString=".xlsx") returned 5
	[0081.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.879] lstrlenW (lpString=".ppt") returned 4
	[0081.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.879] lstrlenW (lpString=".zip") returned 4
	[0081.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.879] lstrlenW (lpString=".rar") returned 4
	[0081.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.879] lstrlenW (lpString=".bz2") returned 4
	[0081.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.879] lstrlenW (lpString=".7z") returned 3
	[0081.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.879] lstrlenW (lpString=".dbf") returned 4
	[0081.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.879] lstrlenW (lpString=".1cd") returned 4
	[0081.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.879] lstrlenW (lpString=".jpg") returned 4
	[0081.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.880] lstrlenW (lpString=".doc") returned 4
	[0081.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.880] lstrlenW (lpString=".docx") returned 5
	[0081.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.880] lstrlenW (lpString=".pdf") returned 4
	[0081.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.880] lstrlenW (lpString=".xls") returned 4
	[0081.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.880] lstrlenW (lpString=".xlsx") returned 5
	[0081.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.880] lstrlenW (lpString=".ppt") returned 4
	[0081.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.880] lstrlenW (lpString=".zip") returned 4
	[0081.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.880] lstrlenW (lpString=".rar") returned 4
	[0081.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.880] lstrlenW (lpString=".bz2") returned 4
	[0081.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.880] lstrlenW (lpString=".7z") returned 3
	[0081.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.880] lstrlenW (lpString=".dbf") returned 4
	[0081.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.881] lstrlenW (lpString=".1cd") returned 4
	[0081.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0081.881] lstrlenW (lpString=".jpg") returned 4
	[0081.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.881] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.881] lstrlenW (lpString="HH00334_.WMF") returned 12
	[0081.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.881] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1528) returned 1
	[0081.881] CloseHandle (hObject=0x37c) returned 1
	[0081.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220
	[0081.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.882] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.882] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0081.882] GetLastError () returned 0x0
	[0081.882] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x5f8, lpOverlapped=0x0) returned 1
	[0082.240] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x600, lpOverlapped=0x0) returned 1
	[0082.241] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.241] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0082.241] SetEndOfFile (hFile=0x354) returned 1
	[0083.368] CloseHandle (hObject=0x354) returned 1
	[0083.384] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.394] SetEndOfFile (hFile=0x37c) returned 1
	[0083.396] CloseHandle (hObject=0x37c) returned 1
	[0083.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1
	[0083.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.396] lstrlenW (lpString=".doc") returned 4
	[0083.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.396] lstrlenW (lpString=".docx") returned 5
	[0083.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.396] lstrlenW (lpString=".pdf") returned 4
	[0083.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.396] lstrlenW (lpString=".xls") returned 4
	[0083.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.396] lstrlenW (lpString=".xlsx") returned 5
	[0083.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.397] lstrlenW (lpString=".ppt") returned 4
	[0083.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.397] lstrlenW (lpString=".zip") returned 4
	[0083.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.397] lstrlenW (lpString=".rar") returned 4
	[0083.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.397] lstrlenW (lpString=".bz2") returned 4
	[0083.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.397] lstrlenW (lpString=".7z") returned 3
	[0083.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.397] lstrlenW (lpString=".dbf") returned 4
	[0083.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.397] lstrlenW (lpString=".1cd") returned 4
	[0083.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.397] lstrlenW (lpString=".jpg") returned 4
	[0083.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.397] lstrlenW (lpString=".doc") returned 4
	[0083.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.397] lstrlenW (lpString=".docx") returned 5
	[0083.397] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.398] lstrlenW (lpString=".pdf") returned 4
	[0083.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.398] lstrlenW (lpString=".xls") returned 4
	[0083.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.398] lstrlenW (lpString=".xlsx") returned 5
	[0083.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.398] lstrlenW (lpString=".ppt") returned 4
	[0083.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.398] lstrlenW (lpString=".zip") returned 4
	[0083.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.398] lstrlenW (lpString=".rar") returned 4
	[0083.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.398] lstrlenW (lpString=".bz2") returned 4
	[0083.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.398] lstrlenW (lpString=".7z") returned 3
	[0083.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.398] lstrlenW (lpString=".dbf") returned 4
	[0083.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.398] lstrlenW (lpString=".1cd") returned 4
	[0083.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0083.398] lstrlenW (lpString=".jpg") returned 4
	[0083.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.398] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.399] lstrlenW (lpString="HH01080_.WMF") returned 12
	[0083.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.399] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=5000) returned 1
	[0083.399] CloseHandle (hObject=0x37c) returned 1
	[0083.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220
	[0083.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.399] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.399] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0083.400] GetLastError () returned 0x0
	[0083.400] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1388, lpOverlapped=0x0) returned 1
	[0083.401] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1390, lpOverlapped=0x0) returned 1
	[0083.402] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.402] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.403] SetEndOfFile (hFile=0x354) returned 1
	[0083.403] CloseHandle (hObject=0x354) returned 1
	[0083.403] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.403] SetEndOfFile (hFile=0x37c) returned 1
	[0083.404] CloseHandle (hObject=0x37c) returned 1
	[0083.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1
	[0083.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.404] lstrlenW (lpString=".doc") returned 4
	[0083.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.404] lstrlenW (lpString=".docx") returned 5
	[0083.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.404] lstrlenW (lpString=".pdf") returned 4
	[0083.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.405] lstrlenW (lpString=".xls") returned 4
	[0083.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.405] lstrlenW (lpString=".xlsx") returned 5
	[0083.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.405] lstrlenW (lpString=".ppt") returned 4
	[0083.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.405] lstrlenW (lpString=".zip") returned 4
	[0083.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.405] lstrlenW (lpString=".rar") returned 4
	[0083.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.405] lstrlenW (lpString=".bz2") returned 4
	[0083.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.405] lstrlenW (lpString=".7z") returned 3
	[0083.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.405] lstrlenW (lpString=".dbf") returned 4
	[0083.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.405] lstrlenW (lpString=".1cd") returned 4
	[0083.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.405] lstrlenW (lpString=".jpg") returned 4
	[0083.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.406] lstrlenW (lpString=".doc") returned 4
	[0083.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.406] lstrlenW (lpString=".docx") returned 5
	[0083.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.406] lstrlenW (lpString=".pdf") returned 4
	[0083.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.406] lstrlenW (lpString=".xls") returned 4
	[0083.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.406] lstrlenW (lpString=".xlsx") returned 5
	[0083.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.406] lstrlenW (lpString=".ppt") returned 4
	[0083.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.406] lstrlenW (lpString=".zip") returned 4
	[0083.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.406] lstrlenW (lpString=".rar") returned 4
	[0083.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.406] lstrlenW (lpString=".bz2") returned 4
	[0083.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.406] lstrlenW (lpString=".7z") returned 3
	[0083.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.407] lstrlenW (lpString=".dbf") returned 4
	[0083.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.407] lstrlenW (lpString=".1cd") returned 4
	[0083.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0083.407] lstrlenW (lpString=".jpg") returned 4
	[0083.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.407] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.407] lstrlenW (lpString="HH01242_.WMF") returned 12
	[0083.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.408] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=7340) returned 1
	[0083.408] CloseHandle (hObject=0x37c) returned 1
	[0083.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220
	[0083.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.409] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.409] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0083.409] GetLastError () returned 0x0
	[0083.409] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1cac, lpOverlapped=0x0) returned 1
	[0083.414] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1cb0, lpOverlapped=0x0) returned 1
	[0083.415] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.415] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.415] SetEndOfFile (hFile=0x354) returned 1
	[0083.415] CloseHandle (hObject=0x354) returned 1
	[0083.415] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.415] SetEndOfFile (hFile=0x37c) returned 1
	[0083.416] CloseHandle (hObject=0x37c) returned 1
	[0083.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1
	[0083.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.417] lstrlenW (lpString=".doc") returned 4
	[0083.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.417] lstrlenW (lpString=".docx") returned 5
	[0083.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.417] lstrlenW (lpString=".pdf") returned 4
	[0083.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.417] lstrlenW (lpString=".xls") returned 4
	[0083.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.417] lstrlenW (lpString=".xlsx") returned 5
	[0083.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.417] lstrlenW (lpString=".ppt") returned 4
	[0083.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.417] lstrlenW (lpString=".zip") returned 4
	[0083.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.417] lstrlenW (lpString=".rar") returned 4
	[0083.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.417] lstrlenW (lpString=".bz2") returned 4
	[0083.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.417] lstrlenW (lpString=".7z") returned 3
	[0083.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.417] lstrlenW (lpString=".dbf") returned 4
	[0083.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.417] lstrlenW (lpString=".1cd") returned 4
	[0083.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.418] lstrlenW (lpString=".jpg") returned 4
	[0083.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.418] lstrlenW (lpString=".doc") returned 4
	[0083.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.418] lstrlenW (lpString=".docx") returned 5
	[0083.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.418] lstrlenW (lpString=".pdf") returned 4
	[0083.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.418] lstrlenW (lpString=".xls") returned 4
	[0083.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.418] lstrlenW (lpString=".xlsx") returned 5
	[0083.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.418] lstrlenW (lpString=".ppt") returned 4
	[0083.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.418] lstrlenW (lpString=".zip") returned 4
	[0083.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.418] lstrlenW (lpString=".rar") returned 4
	[0083.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.419] lstrlenW (lpString=".bz2") returned 4
	[0083.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.419] lstrlenW (lpString=".7z") returned 3
	[0083.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.419] lstrlenW (lpString=".dbf") returned 4
	[0083.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.419] lstrlenW (lpString=".1cd") returned 4
	[0083.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0083.419] lstrlenW (lpString=".jpg") returned 4
	[0083.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.419] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.419] lstrlenW (lpString="HH01291_.WMF") returned 12
	[0083.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.420] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=15806) returned 1
	[0083.420] CloseHandle (hObject=0x37c) returned 1
	[0083.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220
	[0083.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.420] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.420] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0083.420] GetLastError () returned 0x0
	[0083.420] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x3dbe, lpOverlapped=0x0) returned 1
	[0083.422] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x3dc0, lpOverlapped=0x0) returned 1
	[0083.423] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.423] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.423] SetEndOfFile (hFile=0x354) returned 1
	[0083.423] CloseHandle (hObject=0x354) returned 1
	[0083.424] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.424] SetEndOfFile (hFile=0x37c) returned 1
	[0083.425] CloseHandle (hObject=0x37c) returned 1
	[0083.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1
	[0083.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.425] lstrlenW (lpString=".doc") returned 4
	[0083.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.425] lstrlenW (lpString=".docx") returned 5
	[0083.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.425] lstrlenW (lpString=".pdf") returned 4
	[0083.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.425] lstrlenW (lpString=".xls") returned 4
	[0083.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.425] lstrlenW (lpString=".xlsx") returned 5
	[0083.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.426] lstrlenW (lpString=".ppt") returned 4
	[0083.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.426] lstrlenW (lpString=".zip") returned 4
	[0083.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.426] lstrlenW (lpString=".rar") returned 4
	[0083.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.426] lstrlenW (lpString=".bz2") returned 4
	[0083.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.426] lstrlenW (lpString=".7z") returned 3
	[0083.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.426] lstrlenW (lpString=".dbf") returned 4
	[0083.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.427] lstrlenW (lpString=".1cd") returned 4
	[0083.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.427] lstrlenW (lpString=".jpg") returned 4
	[0083.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.427] lstrlenW (lpString=".doc") returned 4
	[0083.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.427] lstrlenW (lpString=".docx") returned 5
	[0083.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.427] lstrlenW (lpString=".pdf") returned 4
	[0083.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.427] lstrlenW (lpString=".xls") returned 4
	[0083.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.427] lstrlenW (lpString=".xlsx") returned 5
	[0083.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.427] lstrlenW (lpString=".ppt") returned 4
	[0083.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.427] lstrlenW (lpString=".zip") returned 4
	[0083.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.428] lstrlenW (lpString=".rar") returned 4
	[0083.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.428] lstrlenW (lpString=".bz2") returned 4
	[0083.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.428] lstrlenW (lpString=".7z") returned 3
	[0083.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.428] lstrlenW (lpString=".dbf") returned 4
	[0083.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.428] lstrlenW (lpString=".1cd") returned 4
	[0083.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0083.428] lstrlenW (lpString=".jpg") returned 4
	[0083.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.428] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.428] lstrlenW (lpString="HH01329_.WMF") returned 12
	[0083.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.429] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=6016) returned 1
	[0083.429] CloseHandle (hObject=0x37c) returned 1
	[0083.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220
	[0083.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.429] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.429] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0083.430] GetLastError () returned 0x0
	[0083.430] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1780, lpOverlapped=0x0) returned 1
	[0083.664] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1790, lpOverlapped=0x0) returned 1
	[0083.665] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.665] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.667] SetEndOfFile (hFile=0x354) returned 1
	[0083.667] CloseHandle (hObject=0x354) returned 1
	[0083.667] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.667] SetEndOfFile (hFile=0x37c) returned 1
	[0083.668] CloseHandle (hObject=0x37c) returned 1
	[0083.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1
	[0083.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.669] lstrlenW (lpString=".doc") returned 4
	[0083.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.669] lstrlenW (lpString=".docx") returned 5
	[0083.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.669] lstrlenW (lpString=".pdf") returned 4
	[0083.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.669] lstrlenW (lpString=".xls") returned 4
	[0083.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.669] lstrlenW (lpString=".xlsx") returned 5
	[0083.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.669] lstrlenW (lpString=".ppt") returned 4
	[0083.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.669] lstrlenW (lpString=".zip") returned 4
	[0083.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.669] lstrlenW (lpString=".rar") returned 4
	[0083.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.670] lstrlenW (lpString=".bz2") returned 4
	[0083.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.670] lstrlenW (lpString=".7z") returned 3
	[0083.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.670] lstrlenW (lpString=".dbf") returned 4
	[0083.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.670] lstrlenW (lpString=".1cd") returned 4
	[0083.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.670] lstrlenW (lpString=".jpg") returned 4
	[0083.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.670] lstrlenW (lpString=".doc") returned 4
	[0083.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.670] lstrlenW (lpString=".docx") returned 5
	[0083.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.670] lstrlenW (lpString=".pdf") returned 4
	[0083.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.671] lstrlenW (lpString=".xls") returned 4
	[0083.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.671] lstrlenW (lpString=".xlsx") returned 5
	[0083.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.671] lstrlenW (lpString=".ppt") returned 4
	[0083.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.671] lstrlenW (lpString=".zip") returned 4
	[0083.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.671] lstrlenW (lpString=".rar") returned 4
	[0083.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.671] lstrlenW (lpString=".bz2") returned 4
	[0083.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.671] lstrlenW (lpString=".7z") returned 3
	[0083.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.671] lstrlenW (lpString=".dbf") returned 4
	[0083.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.671] lstrlenW (lpString=".1cd") returned 4
	[0083.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0083.671] lstrlenW (lpString=".jpg") returned 4
	[0083.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.672] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.672] lstrlenW (lpString="HM00114_.WMF") returned 12
	[0083.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.673] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=22116) returned 1
	[0083.673] CloseHandle (hObject=0x37c) returned 1
	[0083.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220
	[0083.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.673] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.673] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0083.673] GetLastError () returned 0x0
	[0083.673] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x5664, lpOverlapped=0x0) returned 1
	[0083.677] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x5670, lpOverlapped=0x0) returned 1
	[0083.678] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.678] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.678] SetEndOfFile (hFile=0x354) returned 1
	[0083.678] CloseHandle (hObject=0x354) returned 1
	[0083.678] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.678] SetEndOfFile (hFile=0x37c) returned 1
	[0083.679] CloseHandle (hObject=0x37c) returned 1
	[0083.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1
	[0083.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.680] lstrlenW (lpString=".doc") returned 4
	[0083.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.680] lstrlenW (lpString=".docx") returned 5
	[0083.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.680] lstrlenW (lpString=".pdf") returned 4
	[0083.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.680] lstrlenW (lpString=".xls") returned 4
	[0083.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.680] lstrlenW (lpString=".xlsx") returned 5
	[0083.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.680] lstrlenW (lpString=".ppt") returned 4
	[0083.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.680] lstrlenW (lpString=".zip") returned 4
	[0083.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.681] lstrlenW (lpString=".rar") returned 4
	[0083.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.681] lstrlenW (lpString=".bz2") returned 4
	[0083.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.681] lstrlenW (lpString=".7z") returned 3
	[0083.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.681] lstrlenW (lpString=".dbf") returned 4
	[0083.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.681] lstrlenW (lpString=".1cd") returned 4
	[0083.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.681] lstrlenW (lpString=".jpg") returned 4
	[0083.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.681] lstrlenW (lpString=".doc") returned 4
	[0083.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.681] lstrlenW (lpString=".docx") returned 5
	[0083.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.681] lstrlenW (lpString=".pdf") returned 4
	[0083.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.681] lstrlenW (lpString=".xls") returned 4
	[0083.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.682] lstrlenW (lpString=".xlsx") returned 5
	[0083.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.682] lstrlenW (lpString=".ppt") returned 4
	[0083.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.682] lstrlenW (lpString=".zip") returned 4
	[0083.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.682] lstrlenW (lpString=".rar") returned 4
	[0083.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.682] lstrlenW (lpString=".bz2") returned 4
	[0083.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.682] lstrlenW (lpString=".7z") returned 3
	[0083.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.682] lstrlenW (lpString=".dbf") returned 4
	[0083.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.682] lstrlenW (lpString=".1cd") returned 4
	[0083.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0083.683] lstrlenW (lpString=".jpg") returned 4
	[0083.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.683] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.683] lstrlenW (lpString="HM00116_.WMF") returned 12
	[0083.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.683] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=15852) returned 1
	[0083.683] CloseHandle (hObject=0x37c) returned 1
	[0083.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220
	[0083.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.684] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.684] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0083.684] GetLastError () returned 0x0
	[0083.684] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x3dec, lpOverlapped=0x0) returned 1
	[0083.686] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x3df0, lpOverlapped=0x0) returned 1
	[0083.687] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.687] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.687] SetEndOfFile (hFile=0x354) returned 1
	[0083.687] CloseHandle (hObject=0x354) returned 1
	[0083.687] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.687] SetEndOfFile (hFile=0x37c) returned 1
	[0083.688] CloseHandle (hObject=0x37c) returned 1
	[0083.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1
	[0083.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.689] lstrlenW (lpString=".doc") returned 4
	[0083.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.689] lstrlenW (lpString=".docx") returned 5
	[0083.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.689] lstrlenW (lpString=".pdf") returned 4
	[0083.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.689] lstrlenW (lpString=".xls") returned 4
	[0083.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.689] lstrlenW (lpString=".xlsx") returned 5
	[0083.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.689] lstrlenW (lpString=".ppt") returned 4
	[0083.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.689] lstrlenW (lpString=".zip") returned 4
	[0083.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.690] lstrlenW (lpString=".rar") returned 4
	[0083.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.690] lstrlenW (lpString=".bz2") returned 4
	[0083.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.690] lstrlenW (lpString=".7z") returned 3
	[0083.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.690] lstrlenW (lpString=".dbf") returned 4
	[0083.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.690] lstrlenW (lpString=".1cd") returned 4
	[0083.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.690] lstrlenW (lpString=".jpg") returned 4
	[0083.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.690] lstrlenW (lpString=".doc") returned 4
	[0083.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.690] lstrlenW (lpString=".docx") returned 5
	[0083.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.690] lstrlenW (lpString=".pdf") returned 4
	[0083.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.691] lstrlenW (lpString=".xls") returned 4
	[0083.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.691] lstrlenW (lpString=".xlsx") returned 5
	[0083.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.691] lstrlenW (lpString=".ppt") returned 4
	[0083.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.691] lstrlenW (lpString=".zip") returned 4
	[0083.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.691] lstrlenW (lpString=".rar") returned 4
	[0083.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.691] lstrlenW (lpString=".bz2") returned 4
	[0083.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.691] lstrlenW (lpString=".7z") returned 3
	[0083.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.691] lstrlenW (lpString=".dbf") returned 4
	[0083.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.691] lstrlenW (lpString=".1cd") returned 4
	[0083.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0083.691] lstrlenW (lpString=".jpg") returned 4
	[0083.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.692] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.692] lstrlenW (lpString="HM00172_.WMF") returned 12
	[0083.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.696] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2832) returned 1
	[0083.696] CloseHandle (hObject=0x37c) returned 1
	[0083.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220
	[0083.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.697] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.697] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0083.697] GetLastError () returned 0x0
	[0083.697] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xb10, lpOverlapped=0x0) returned 1
	[0083.699] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xb20, lpOverlapped=0x0) returned 1
	[0083.700] ReadFile (in: hFile=0x37c, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.700] WriteFile (in: hFile=0x354, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.700] SetEndOfFile (hFile=0x354) returned 1
	[0083.700] CloseHandle (hObject=0x354) returned 1
	[0083.700] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.700] SetEndOfFile (hFile=0x37c) returned 1
	[0083.701] CloseHandle (hObject=0x37c) returned 1
	[0083.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1
	[0083.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.702] lstrlenW (lpString=".doc") returned 4
	[0083.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.702] lstrlenW (lpString=".docx") returned 5
	[0083.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.702] lstrlenW (lpString=".pdf") returned 4
	[0083.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.702] lstrlenW (lpString=".xls") returned 4
	[0083.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.702] lstrlenW (lpString=".xlsx") returned 5
	[0083.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.702] lstrlenW (lpString=".ppt") returned 4
	[0083.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.702] lstrlenW (lpString=".zip") returned 4
	[0083.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.702] lstrlenW (lpString=".rar") returned 4
	[0083.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.702] lstrlenW (lpString=".bz2") returned 4
	[0083.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.703] lstrlenW (lpString=".7z") returned 3
	[0083.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.703] lstrlenW (lpString=".dbf") returned 4
	[0083.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.703] lstrlenW (lpString=".1cd") returned 4
	[0083.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.703] lstrlenW (lpString=".jpg") returned 4
	[0083.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.703] lstrlenW (lpString=".doc") returned 4
	[0083.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.703] lstrlenW (lpString=".docx") returned 5
	[0083.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.703] lstrlenW (lpString=".pdf") returned 4
	[0083.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.703] lstrlenW (lpString=".xls") returned 4
	[0083.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.704] lstrlenW (lpString=".xlsx") returned 5
	[0083.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.704] lstrlenW (lpString=".ppt") returned 4
	[0083.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.704] lstrlenW (lpString=".zip") returned 4
	[0083.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.704] lstrlenW (lpString=".rar") returned 4
	[0083.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.704] lstrlenW (lpString=".bz2") returned 4
	[0083.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.704] lstrlenW (lpString=".7z") returned 3
	[0083.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.704] lstrlenW (lpString=".dbf") returned 4
	[0083.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.704] lstrlenW (lpString=".1cd") returned 4
	[0083.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0083.704] lstrlenW (lpString=".jpg") returned 4
	[0083.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.705] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.705] lstrlenW (lpString="HM00426_.WMF") returned 12
	[0083.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0083.705] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=68776) returned 1
	[0083.705] CloseHandle (hObject=0x37c) returned 1
	[0084.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220
	[0084.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.475] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.475] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0084.476] GetLastError () returned 0x0
	[0084.476] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x10ca8, lpOverlapped=0x0) returned 1
	[0084.478] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x10cb0, lpOverlapped=0x0) returned 1
	[0084.480] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.480] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.480] SetEndOfFile (hFile=0x33c) returned 1
	[0084.480] CloseHandle (hObject=0x33c) returned 1
	[0084.481] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.481] SetEndOfFile (hFile=0x398) returned 1
	[0084.482] CloseHandle (hObject=0x398) returned 1
	[0084.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1
	[0084.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.483] lstrlenW (lpString=".doc") returned 4
	[0084.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.483] lstrlenW (lpString=".docx") returned 5
	[0084.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.483] lstrlenW (lpString=".pdf") returned 4
	[0084.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.483] lstrlenW (lpString=".xls") returned 4
	[0084.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.483] lstrlenW (lpString=".xlsx") returned 5
	[0084.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.483] lstrlenW (lpString=".ppt") returned 4
	[0084.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.483] lstrlenW (lpString=".zip") returned 4
	[0084.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.483] lstrlenW (lpString=".rar") returned 4
	[0084.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.483] lstrlenW (lpString=".bz2") returned 4
	[0084.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.483] lstrlenW (lpString=".7z") returned 3
	[0084.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.483] lstrlenW (lpString=".dbf") returned 4
	[0084.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.483] lstrlenW (lpString=".1cd") returned 4
	[0084.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.484] lstrlenW (lpString=".jpg") returned 4
	[0084.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.484] lstrlenW (lpString=".doc") returned 4
	[0084.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.484] lstrlenW (lpString=".docx") returned 5
	[0084.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.484] lstrlenW (lpString=".pdf") returned 4
	[0084.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.484] lstrlenW (lpString=".xls") returned 4
	[0084.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.484] lstrlenW (lpString=".xlsx") returned 5
	[0084.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.484] lstrlenW (lpString=".ppt") returned 4
	[0084.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.484] lstrlenW (lpString=".zip") returned 4
	[0084.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.484] lstrlenW (lpString=".rar") returned 4
	[0084.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.485] lstrlenW (lpString=".bz2") returned 4
	[0084.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.485] lstrlenW (lpString=".7z") returned 3
	[0084.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.485] lstrlenW (lpString=".dbf") returned 4
	[0084.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.485] lstrlenW (lpString=".1cd") returned 4
	[0084.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0084.485] lstrlenW (lpString=".jpg") returned 4
	[0084.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.485] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.485] lstrlenW (lpString="IN00919_.WMF") returned 12
	[0084.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.486] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=6920) returned 1
	[0084.486] CloseHandle (hObject=0x398) returned 1
	[0084.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220
	[0084.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.486] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.486] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0084.487] GetLastError () returned 0x0
	[0084.487] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1b08, lpOverlapped=0x0) returned 1
	[0084.488] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1b10, lpOverlapped=0x0) returned 1
	[0084.489] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.489] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.489] SetEndOfFile (hFile=0x33c) returned 1
	[0084.490] CloseHandle (hObject=0x33c) returned 1
	[0084.490] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.490] SetEndOfFile (hFile=0x398) returned 1
	[0084.491] CloseHandle (hObject=0x398) returned 1
	[0084.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1
	[0084.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.491] lstrlenW (lpString=".doc") returned 4
	[0084.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.491] lstrlenW (lpString=".docx") returned 5
	[0084.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.492] lstrlenW (lpString=".pdf") returned 4
	[0084.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.492] lstrlenW (lpString=".xls") returned 4
	[0084.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.492] lstrlenW (lpString=".xlsx") returned 5
	[0084.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.492] lstrlenW (lpString=".ppt") returned 4
	[0084.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.492] lstrlenW (lpString=".zip") returned 4
	[0084.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.492] lstrlenW (lpString=".rar") returned 4
	[0084.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.492] lstrlenW (lpString=".bz2") returned 4
	[0084.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.492] lstrlenW (lpString=".7z") returned 3
	[0084.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.492] lstrlenW (lpString=".dbf") returned 4
	[0084.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.493] lstrlenW (lpString=".1cd") returned 4
	[0084.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.493] lstrlenW (lpString=".jpg") returned 4
	[0084.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.493] lstrlenW (lpString=".doc") returned 4
	[0084.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.493] lstrlenW (lpString=".docx") returned 5
	[0084.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.493] lstrlenW (lpString=".pdf") returned 4
	[0084.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.493] lstrlenW (lpString=".xls") returned 4
	[0084.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.493] lstrlenW (lpString=".xlsx") returned 5
	[0084.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.493] lstrlenW (lpString=".ppt") returned 4
	[0084.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.493] lstrlenW (lpString=".zip") returned 4
	[0084.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.493] lstrlenW (lpString=".rar") returned 4
	[0084.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.493] lstrlenW (lpString=".bz2") returned 4
	[0084.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.494] lstrlenW (lpString=".7z") returned 3
	[0084.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.494] lstrlenW (lpString=".dbf") returned 4
	[0084.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.494] lstrlenW (lpString=".1cd") returned 4
	[0084.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0084.494] lstrlenW (lpString=".jpg") returned 4
	[0084.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.494] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.494] lstrlenW (lpString="IN00956_.WMF") returned 12
	[0084.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.495] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1256) returned 1
	[0084.495] CloseHandle (hObject=0x398) returned 1
	[0084.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220
	[0084.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.495] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.495] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0084.495] GetLastError () returned 0x0
	[0084.495] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x4e8, lpOverlapped=0x0) returned 1
	[0084.497] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0084.498] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.498] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.498] SetEndOfFile (hFile=0x33c) returned 1
	[0084.498] CloseHandle (hObject=0x33c) returned 1
	[0084.498] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.498] SetEndOfFile (hFile=0x398) returned 1
	[0084.499] CloseHandle (hObject=0x398) returned 1
	[0084.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1
	[0084.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.500] lstrlenW (lpString=".doc") returned 4
	[0084.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.500] lstrlenW (lpString=".docx") returned 5
	[0084.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.500] lstrlenW (lpString=".pdf") returned 4
	[0084.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.500] lstrlenW (lpString=".xls") returned 4
	[0084.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.500] lstrlenW (lpString=".xlsx") returned 5
	[0084.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.500] lstrlenW (lpString=".ppt") returned 4
	[0084.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.500] lstrlenW (lpString=".zip") returned 4
	[0084.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.500] lstrlenW (lpString=".rar") returned 4
	[0084.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.500] lstrlenW (lpString=".bz2") returned 4
	[0084.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.500] lstrlenW (lpString=".7z") returned 3
	[0084.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.501] lstrlenW (lpString=".dbf") returned 4
	[0084.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.501] lstrlenW (lpString=".1cd") returned 4
	[0084.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.501] lstrlenW (lpString=".jpg") returned 4
	[0084.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.501] lstrlenW (lpString=".doc") returned 4
	[0084.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.501] lstrlenW (lpString=".docx") returned 5
	[0084.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.501] lstrlenW (lpString=".pdf") returned 4
	[0084.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.501] lstrlenW (lpString=".xls") returned 4
	[0084.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.501] lstrlenW (lpString=".xlsx") returned 5
	[0084.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.501] lstrlenW (lpString=".ppt") returned 4
	[0084.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.502] lstrlenW (lpString=".zip") returned 4
	[0084.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.502] lstrlenW (lpString=".rar") returned 4
	[0084.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.502] lstrlenW (lpString=".bz2") returned 4
	[0084.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.502] lstrlenW (lpString=".7z") returned 3
	[0084.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.502] lstrlenW (lpString=".dbf") returned 4
	[0084.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.502] lstrlenW (lpString=".1cd") returned 4
	[0084.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0084.502] lstrlenW (lpString=".jpg") returned 4
	[0084.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.503] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.503] lstrlenW (lpString="IN00957_.WMF") returned 12
	[0084.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.503] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=2944) returned 1
	[0084.503] CloseHandle (hObject=0x398) returned 1
	[0084.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220
	[0084.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.503] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.504] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0084.504] GetLastError () returned 0x0
	[0084.504] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xb80, lpOverlapped=0x0) returned 1
	[0084.505] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xb90, lpOverlapped=0x0) returned 1
	[0084.506] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.506] WriteFile (in: hFile=0x33c, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.506] SetEndOfFile (hFile=0x33c) returned 1
	[0084.507] CloseHandle (hObject=0x33c) returned 1
	[0084.507] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.507] SetEndOfFile (hFile=0x398) returned 1
	[0084.864] CloseHandle (hObject=0x398) returned 1
	[0084.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1
	[0084.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.864] lstrlenW (lpString=".doc") returned 4
	[0084.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.865] lstrlenW (lpString=".docx") returned 5
	[0084.865] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.865] lstrlenW (lpString=".pdf") returned 4
	[0084.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.865] lstrlenW (lpString=".xls") returned 4
	[0084.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.865] lstrlenW (lpString=".xlsx") returned 5
	[0084.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.865] lstrlenW (lpString=".ppt") returned 4
	[0084.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.865] lstrlenW (lpString=".zip") returned 4
	[0084.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.865] lstrlenW (lpString=".rar") returned 4
	[0084.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.865] lstrlenW (lpString=".bz2") returned 4
	[0084.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.865] lstrlenW (lpString=".7z") returned 3
	[0084.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.865] lstrlenW (lpString=".dbf") returned 4
	[0084.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.865] lstrlenW (lpString=".1cd") returned 4
	[0084.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.866] lstrlenW (lpString=".jpg") returned 4
	[0084.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.866] lstrlenW (lpString=".doc") returned 4
	[0084.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString=".docx") returned 5
	[0084.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.866] lstrlenW (lpString=".pdf") returned 4
	[0084.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString=".xls") returned 4
	[0084.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.866] lstrlenW (lpString=".xlsx") returned 5
	[0084.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.866] lstrlenW (lpString=".ppt") returned 4
	[0084.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.866] lstrlenW (lpString=".zip") returned 4
	[0084.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.866] lstrlenW (lpString=".rar") returned 4
	[0084.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString=".bz2") returned 4
	[0084.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString=".7z") returned 3
	[0084.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.867] lstrlenW (lpString=".dbf") returned 4
	[0084.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.867] lstrlenW (lpString=".1cd") returned 4
	[0084.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0084.867] lstrlenW (lpString=".jpg") returned 4
	[0084.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.867] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.867] lstrlenW (lpString="J0090149.WMF") returned 12
	[0084.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.868] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=28212) returned 1
	[0084.868] CloseHandle (hObject=0x398) returned 1
	[0084.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220
	[0084.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.868] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.868] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0084.868] GetLastError () returned 0x0
	[0084.869] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x6e34, lpOverlapped=0x0) returned 1
	[0084.870] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x6e40, lpOverlapped=0x0) returned 1
	[0084.872] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.872] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.872] SetEndOfFile (hFile=0x368) returned 1
	[0084.872] CloseHandle (hObject=0x368) returned 1
	[0084.872] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.872] SetEndOfFile (hFile=0x398) returned 1
	[0084.873] CloseHandle (hObject=0x398) returned 1
	[0084.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1
	[0084.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.874] lstrlenW (lpString=".doc") returned 4
	[0084.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString=".docx") returned 5
	[0084.874] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0084.874] lstrlenW (lpString=".pdf") returned 4
	[0084.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString=".xls") returned 4
	[0084.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.874] lstrlenW (lpString=".xlsx") returned 5
	[0084.874] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0084.874] lstrlenW (lpString=".ppt") returned 4
	[0084.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.874] lstrlenW (lpString=".zip") returned 4
	[0084.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.874] lstrlenW (lpString=".rar") returned 4
	[0084.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString=".bz2") returned 4
	[0084.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString=".7z") returned 3
	[0084.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.875] lstrlenW (lpString=".dbf") returned 4
	[0084.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.875] lstrlenW (lpString=".1cd") returned 4
	[0084.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.875] lstrlenW (lpString=".jpg") returned 4
	[0084.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.875] lstrlenW (lpString=".doc") returned 4
	[0084.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.875] lstrlenW (lpString=".docx") returned 5
	[0084.875] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0084.875] lstrlenW (lpString=".pdf") returned 4
	[0084.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.875] lstrlenW (lpString=".xls") returned 4
	[0084.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.875] lstrlenW (lpString=".xlsx") returned 5
	[0084.875] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0084.875] lstrlenW (lpString=".ppt") returned 4
	[0084.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.876] lstrlenW (lpString=".zip") returned 4
	[0084.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.876] lstrlenW (lpString=".rar") returned 4
	[0084.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.876] lstrlenW (lpString=".bz2") returned 4
	[0084.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.876] lstrlenW (lpString=".7z") returned 3
	[0084.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.876] lstrlenW (lpString=".dbf") returned 4
	[0084.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.876] lstrlenW (lpString=".1cd") returned 4
	[0084.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0084.876] lstrlenW (lpString=".jpg") returned 4
	[0084.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.876] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.877] lstrlenW (lpString="J0090390.WMF") returned 12
	[0084.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.877] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=17638) returned 1
	[0084.877] CloseHandle (hObject=0x398) returned 1
	[0084.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220
	[0084.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.877] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.878] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0084.878] GetLastError () returned 0x0
	[0084.878] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x44e6, lpOverlapped=0x0) returned 1
	[0084.880] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x44f0, lpOverlapped=0x0) returned 1
	[0084.881] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.881] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.881] SetEndOfFile (hFile=0x368) returned 1
	[0084.881] CloseHandle (hObject=0x368) returned 1
	[0084.881] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.881] SetEndOfFile (hFile=0x398) returned 1
	[0084.922] CloseHandle (hObject=0x398) returned 1
	[0084.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1
	[0084.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.923] lstrlenW (lpString=".doc") returned 4
	[0084.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.923] lstrlenW (lpString=".docx") returned 5
	[0084.923] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0084.923] lstrlenW (lpString=".pdf") returned 4
	[0084.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.923] lstrlenW (lpString=".xls") returned 4
	[0084.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.923] lstrlenW (lpString=".xlsx") returned 5
	[0084.923] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0084.923] lstrlenW (lpString=".ppt") returned 4
	[0084.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.923] lstrlenW (lpString=".zip") returned 4
	[0084.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.923] lstrlenW (lpString=".rar") returned 4
	[0084.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.923] lstrlenW (lpString=".bz2") returned 4
	[0084.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.923] lstrlenW (lpString=".7z") returned 3
	[0084.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.923] lstrlenW (lpString=".dbf") returned 4
	[0084.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.924] lstrlenW (lpString=".1cd") returned 4
	[0084.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.924] lstrlenW (lpString=".jpg") returned 4
	[0084.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.924] lstrlenW (lpString=".doc") returned 4
	[0084.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString=".docx") returned 5
	[0084.924] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0084.924] lstrlenW (lpString=".pdf") returned 4
	[0084.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString=".xls") returned 4
	[0084.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.924] lstrlenW (lpString=".xlsx") returned 5
	[0084.924] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0084.924] lstrlenW (lpString=".ppt") returned 4
	[0084.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.924] lstrlenW (lpString=".zip") returned 4
	[0084.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.924] lstrlenW (lpString=".rar") returned 4
	[0084.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.925] lstrlenW (lpString=".bz2") returned 4
	[0084.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.925] lstrlenW (lpString=".7z") returned 3
	[0084.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.925] lstrlenW (lpString=".dbf") returned 4
	[0084.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.925] lstrlenW (lpString=".1cd") returned 4
	[0084.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0084.925] lstrlenW (lpString=".jpg") returned 4
	[0084.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.925] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.925] lstrlenW (lpString="J0090777.WMF") returned 12
	[0084.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.926] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=3332) returned 1
	[0084.926] CloseHandle (hObject=0x398) returned 1
	[0084.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220
	[0084.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.927] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.927] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0084.927] GetLastError () returned 0x0
	[0084.927] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xd04, lpOverlapped=0x0) returned 1
	[0084.929] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xd10, lpOverlapped=0x0) returned 1
	[0084.930] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.930] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.930] SetEndOfFile (hFile=0x368) returned 1
	[0084.930] CloseHandle (hObject=0x368) returned 1
	[0084.930] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.930] SetEndOfFile (hFile=0x398) returned 1
	[0084.931] CloseHandle (hObject=0x398) returned 1
	[0084.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1
	[0084.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.932] lstrlenW (lpString=".doc") returned 4
	[0084.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString=".docx") returned 5
	[0084.932] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0084.932] lstrlenW (lpString=".pdf") returned 4
	[0084.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString=".xls") returned 4
	[0084.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.932] lstrlenW (lpString=".xlsx") returned 5
	[0084.932] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0084.932] lstrlenW (lpString=".ppt") returned 4
	[0084.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.932] lstrlenW (lpString=".zip") returned 4
	[0084.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.932] lstrlenW (lpString=".rar") returned 4
	[0084.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString=".bz2") returned 4
	[0084.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString=".7z") returned 3
	[0084.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.932] lstrlenW (lpString=".dbf") returned 4
	[0084.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.933] lstrlenW (lpString=".1cd") returned 4
	[0084.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.933] lstrlenW (lpString=".jpg") returned 4
	[0084.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.933] lstrlenW (lpString=".doc") returned 4
	[0084.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.933] lstrlenW (lpString=".docx") returned 5
	[0084.933] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0084.933] lstrlenW (lpString=".pdf") returned 4
	[0084.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.933] lstrlenW (lpString=".xls") returned 4
	[0084.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.933] lstrlenW (lpString=".xlsx") returned 5
	[0084.933] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0084.933] lstrlenW (lpString=".ppt") returned 4
	[0084.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.933] lstrlenW (lpString=".zip") returned 4
	[0084.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.933] lstrlenW (lpString=".rar") returned 4
	[0084.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.933] lstrlenW (lpString=".bz2") returned 4
	[0084.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.933] lstrlenW (lpString=".7z") returned 3
	[0084.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.934] lstrlenW (lpString=".dbf") returned 4
	[0084.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.934] lstrlenW (lpString=".1cd") returned 4
	[0084.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0084.934] lstrlenW (lpString=".jpg") returned 4
	[0084.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.934] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.934] lstrlenW (lpString="J0090779.WMF") returned 12
	[0084.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.934] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=1456) returned 1
	[0084.935] CloseHandle (hObject=0x398) returned 1
	[0084.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220
	[0084.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.935] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.935] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0084.935] GetLastError () returned 0x0
	[0084.935] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x5b0, lpOverlapped=0x0) returned 1
	[0085.383] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0085.384] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.384] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.384] SetEndOfFile (hFile=0x368) returned 1
	[0085.384] CloseHandle (hObject=0x368) returned 1
	[0085.384] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.384] SetEndOfFile (hFile=0x398) returned 1
	[0085.385] CloseHandle (hObject=0x398) returned 1
	[0085.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1
	[0085.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.386] lstrlenW (lpString=".doc") returned 4
	[0085.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.386] lstrlenW (lpString=".docx") returned 5
	[0085.386] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0085.386] lstrlenW (lpString=".pdf") returned 4
	[0085.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.386] lstrlenW (lpString=".xls") returned 4
	[0085.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.386] lstrlenW (lpString=".xlsx") returned 5
	[0085.386] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0085.386] lstrlenW (lpString=".ppt") returned 4
	[0085.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.386] lstrlenW (lpString=".zip") returned 4
	[0085.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.386] lstrlenW (lpString=".rar") returned 4
	[0085.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.386] lstrlenW (lpString=".bz2") returned 4
	[0085.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.386] lstrlenW (lpString=".7z") returned 3
	[0085.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.386] lstrlenW (lpString=".dbf") returned 4
	[0085.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.386] lstrlenW (lpString=".1cd") returned 4
	[0085.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.387] lstrlenW (lpString=".jpg") returned 4
	[0085.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.387] lstrlenW (lpString=".doc") returned 4
	[0085.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.387] lstrlenW (lpString=".docx") returned 5
	[0085.387] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0085.387] lstrlenW (lpString=".pdf") returned 4
	[0085.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.387] lstrlenW (lpString=".xls") returned 4
	[0085.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.387] lstrlenW (lpString=".xlsx") returned 5
	[0085.387] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0085.387] lstrlenW (lpString=".ppt") returned 4
	[0085.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.387] lstrlenW (lpString=".zip") returned 4
	[0085.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.387] lstrlenW (lpString=".rar") returned 4
	[0085.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.387] lstrlenW (lpString=".bz2") returned 4
	[0085.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.387] lstrlenW (lpString=".7z") returned 3
	[0085.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.388] lstrlenW (lpString=".dbf") returned 4
	[0085.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.388] lstrlenW (lpString=".1cd") returned 4
	[0085.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0085.388] lstrlenW (lpString=".jpg") returned 4
	[0085.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.388] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.388] lstrlenW (lpString="J0099154.JPG") returned 12
	[0085.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.388] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=6929) returned 1
	[0085.388] CloseHandle (hObject=0x398) returned 1
	[0085.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220
	[0085.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.389] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.389] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0085.390] GetLastError () returned 0x0
	[0085.390] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x1b11, lpOverlapped=0x0) returned 1
	[0085.391] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0085.392] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.392] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.392] SetEndOfFile (hFile=0x368) returned 1
	[0085.392] CloseHandle (hObject=0x368) returned 1
	[0085.392] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.392] SetEndOfFile (hFile=0x398) returned 1
	[0085.393] CloseHandle (hObject=0x398) returned 1
	[0085.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1
	[0085.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.394] lstrlenW (lpString=".doc") returned 4
	[0085.394] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.394] lstrlenW (lpString=".docx") returned 5
	[0085.394] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0085.394] lstrlenW (lpString=".pdf") returned 4
	[0085.394] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.394] lstrlenW (lpString=".xls") returned 4
	[0085.394] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.394] lstrlenW (lpString=".xlsx") returned 5
	[0085.394] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0085.394] lstrlenW (lpString=".ppt") returned 4
	[0085.394] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.394] lstrlenW (lpString=".zip") returned 4
	[0085.394] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.394] lstrlenW (lpString=".rar") returned 4
	[0085.394] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.394] lstrlenW (lpString=".bz2") returned 4
	[0085.394] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.394] lstrlenW (lpString=".7z") returned 3
	[0085.394] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.395] lstrlenW (lpString=".dbf") returned 4
	[0085.395] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.395] lstrlenW (lpString=".1cd") returned 4
	[0085.395] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.395] lstrlenW (lpString=".jpg") returned 4
	[0085.395] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.395] lstrlenW (lpString=".doc") returned 4
	[0085.395] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.395] lstrlenW (lpString=".docx") returned 5
	[0085.395] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0085.395] lstrlenW (lpString=".pdf") returned 4
	[0085.395] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.395] lstrlenW (lpString=".xls") returned 4
	[0085.395] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.395] lstrlenW (lpString=".xlsx") returned 5
	[0085.395] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0085.395] lstrlenW (lpString=".ppt") returned 4
	[0085.395] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.395] lstrlenW (lpString=".zip") returned 4
	[0085.395] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.396] lstrlenW (lpString=".rar") returned 4
	[0085.396] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.396] lstrlenW (lpString=".bz2") returned 4
	[0085.396] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.396] lstrlenW (lpString=".7z") returned 3
	[0085.396] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.396] lstrlenW (lpString=".dbf") returned 4
	[0085.396] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.396] lstrlenW (lpString=".1cd") returned 4
	[0085.396] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0085.396] lstrlenW (lpString=".jpg") returned 4
	[0085.396] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.396] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.396] lstrlenW (lpString="J0099155.JPG") returned 12
	[0085.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.397] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=8826) returned 1
	[0085.397] CloseHandle (hObject=0x398) returned 1
	[0085.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220
	[0085.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.398] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.398] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0085.399] GetLastError () returned 0x0
	[0085.399] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x227a, lpOverlapped=0x0) returned 1
	[0085.400] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2280, lpOverlapped=0x0) returned 1
	[0085.408] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.408] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.408] SetEndOfFile (hFile=0x368) returned 1
	[0085.408] CloseHandle (hObject=0x368) returned 1
	[0085.408] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.408] SetEndOfFile (hFile=0x398) returned 1
	[0085.409] CloseHandle (hObject=0x398) returned 1
	[0085.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1
	[0085.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.410] lstrlenW (lpString=".doc") returned 4
	[0085.410] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.410] lstrlenW (lpString=".docx") returned 5
	[0085.410] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0085.410] lstrlenW (lpString=".pdf") returned 4
	[0085.410] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.410] lstrlenW (lpString=".xls") returned 4
	[0085.410] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.410] lstrlenW (lpString=".xlsx") returned 5
	[0085.410] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0085.410] lstrlenW (lpString=".ppt") returned 4
	[0085.410] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.410] lstrlenW (lpString=".zip") returned 4
	[0085.410] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.410] lstrlenW (lpString=".rar") returned 4
	[0085.410] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.410] lstrlenW (lpString=".bz2") returned 4
	[0085.410] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.410] lstrlenW (lpString=".7z") returned 3
	[0085.410] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.411] lstrlenW (lpString=".dbf") returned 4
	[0085.411] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.411] lstrlenW (lpString=".1cd") returned 4
	[0085.411] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.411] lstrlenW (lpString=".jpg") returned 4
	[0085.411] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.411] lstrlenW (lpString=".doc") returned 4
	[0085.411] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.411] lstrlenW (lpString=".docx") returned 5
	[0085.411] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0085.411] lstrlenW (lpString=".pdf") returned 4
	[0085.411] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.411] lstrlenW (lpString=".xls") returned 4
	[0085.411] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.411] lstrlenW (lpString=".xlsx") returned 5
	[0085.411] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0085.411] lstrlenW (lpString=".ppt") returned 4
	[0085.411] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.411] lstrlenW (lpString=".zip") returned 4
	[0085.411] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.411] lstrlenW (lpString=".rar") returned 4
	[0085.412] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.412] lstrlenW (lpString=".bz2") returned 4
	[0085.412] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.412] lstrlenW (lpString=".7z") returned 3
	[0085.412] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.412] lstrlenW (lpString=".dbf") returned 4
	[0085.412] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.412] lstrlenW (lpString=".1cd") returned 4
	[0085.412] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0085.412] lstrlenW (lpString=".jpg") returned 4
	[0085.412] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.412] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.412] lstrlenW (lpString="J0099156.JPG") returned 12
	[0085.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.413] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=13954) returned 1
	[0085.413] CloseHandle (hObject=0x398) returned 1
	[0085.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220
	[0085.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.413] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.413] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0085.417] GetLastError () returned 0x0
	[0085.417] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x3682, lpOverlapped=0x0) returned 1
	[0085.584] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x3690, lpOverlapped=0x0) returned 1
	[0085.586] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.586] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.586] SetEndOfFile (hFile=0x368) returned 1
	[0085.586] CloseHandle (hObject=0x368) returned 1
	[0085.586] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.586] SetEndOfFile (hFile=0x398) returned 1
	[0085.587] CloseHandle (hObject=0x398) returned 1
	[0085.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1
	[0085.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.587] lstrlenW (lpString=".doc") returned 4
	[0085.587] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.587] lstrlenW (lpString=".docx") returned 5
	[0085.588] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0085.588] lstrlenW (lpString=".pdf") returned 4
	[0085.588] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.588] lstrlenW (lpString=".xls") returned 4
	[0085.588] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.588] lstrlenW (lpString=".xlsx") returned 5
	[0085.588] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0085.588] lstrlenW (lpString=".ppt") returned 4
	[0085.588] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.588] lstrlenW (lpString=".zip") returned 4
	[0085.588] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.588] lstrlenW (lpString=".rar") returned 4
	[0085.588] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.588] lstrlenW (lpString=".bz2") returned 4
	[0085.588] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.588] lstrlenW (lpString=".7z") returned 3
	[0085.588] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.588] lstrlenW (lpString=".dbf") returned 4
	[0085.588] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.588] lstrlenW (lpString=".1cd") returned 4
	[0085.588] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.588] lstrlenW (lpString=".jpg") returned 4
	[0085.588] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.589] lstrlenW (lpString=".doc") returned 4
	[0085.589] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.589] lstrlenW (lpString=".docx") returned 5
	[0085.589] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0085.589] lstrlenW (lpString=".pdf") returned 4
	[0085.589] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.589] lstrlenW (lpString=".xls") returned 4
	[0085.589] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.589] lstrlenW (lpString=".xlsx") returned 5
	[0085.589] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0085.589] lstrlenW (lpString=".ppt") returned 4
	[0085.589] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.589] lstrlenW (lpString=".zip") returned 4
	[0085.589] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.589] lstrlenW (lpString=".rar") returned 4
	[0085.589] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.589] lstrlenW (lpString=".bz2") returned 4
	[0085.589] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.589] lstrlenW (lpString=".7z") returned 3
	[0085.589] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.589] lstrlenW (lpString=".dbf") returned 4
	[0085.589] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.589] lstrlenW (lpString=".1cd") returned 4
	[0085.589] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0085.589] lstrlenW (lpString=".jpg") returned 4
	[0085.589] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.590] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.590] lstrlenW (lpString="J0099165.JPG") returned 12
	[0085.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.590] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=50490) returned 1
	[0085.591] CloseHandle (hObject=0x398) returned 1
	[0085.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220
	[0085.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.591] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.591] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0085.591] GetLastError () returned 0x0
	[0085.591] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xc53a, lpOverlapped=0x0) returned 1
	[0085.594] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xc540, lpOverlapped=0x0) returned 1
	[0085.595] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.595] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.596] SetEndOfFile (hFile=0x368) returned 1
	[0085.596] CloseHandle (hObject=0x368) returned 1
	[0085.596] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.596] SetEndOfFile (hFile=0x398) returned 1
	[0085.597] CloseHandle (hObject=0x398) returned 1
	[0085.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1
	[0085.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.598] lstrlenW (lpString=".doc") returned 4
	[0085.598] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.598] lstrlenW (lpString=".docx") returned 5
	[0085.598] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0085.598] lstrlenW (lpString=".pdf") returned 4
	[0085.598] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.598] lstrlenW (lpString=".xls") returned 4
	[0085.598] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.598] lstrlenW (lpString=".xlsx") returned 5
	[0085.598] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0085.598] lstrlenW (lpString=".ppt") returned 4
	[0085.598] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.598] lstrlenW (lpString=".zip") returned 4
	[0085.598] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.598] lstrlenW (lpString=".rar") returned 4
	[0085.598] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.598] lstrlenW (lpString=".bz2") returned 4
	[0085.598] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.598] lstrlenW (lpString=".7z") returned 3
	[0085.598] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.598] lstrlenW (lpString=".dbf") returned 4
	[0085.598] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.599] lstrlenW (lpString=".1cd") returned 4
	[0085.599] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.599] lstrlenW (lpString=".jpg") returned 4
	[0085.599] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.599] lstrlenW (lpString=".doc") returned 4
	[0085.599] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.599] lstrlenW (lpString=".docx") returned 5
	[0085.599] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0085.599] lstrlenW (lpString=".pdf") returned 4
	[0085.599] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.599] lstrlenW (lpString=".xls") returned 4
	[0085.599] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.599] lstrlenW (lpString=".xlsx") returned 5
	[0085.599] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0085.599] lstrlenW (lpString=".ppt") returned 4
	[0085.599] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.599] lstrlenW (lpString=".zip") returned 4
	[0085.599] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.599] lstrlenW (lpString=".rar") returned 4
	[0085.599] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.599] lstrlenW (lpString=".bz2") returned 4
	[0085.599] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.599] lstrlenW (lpString=".7z") returned 3
	[0085.600] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.600] lstrlenW (lpString=".dbf") returned 4
	[0085.600] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.600] lstrlenW (lpString=".1cd") returned 4
	[0085.600] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0085.600] lstrlenW (lpString=".jpg") returned 4
	[0085.600] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.600] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.600] lstrlenW (lpString="J0099166.JPG") returned 12
	[0085.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.600] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=64767) returned 1
	[0085.600] CloseHandle (hObject=0x398) returned 1
	[0085.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220
	[0085.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.601] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.601] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0085.601] GetLastError () returned 0x0
	[0085.602] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xfcff, lpOverlapped=0x0) returned 1
	[0085.604] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xfd00, lpOverlapped=0x0) returned 1
	[0085.606] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.606] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.607] SetEndOfFile (hFile=0x368) returned 1
	[0085.607] CloseHandle (hObject=0x368) returned 1
	[0085.607] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.607] SetEndOfFile (hFile=0x398) returned 1
	[0085.608] CloseHandle (hObject=0x398) returned 1
	[0085.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1
	[0085.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.609] lstrlenW (lpString=".doc") returned 4
	[0085.609] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.609] lstrlenW (lpString=".docx") returned 5
	[0085.609] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0085.609] lstrlenW (lpString=".pdf") returned 4
	[0085.609] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.609] lstrlenW (lpString=".xls") returned 4
	[0085.609] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.609] lstrlenW (lpString=".xlsx") returned 5
	[0085.609] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0085.609] lstrlenW (lpString=".ppt") returned 4
	[0085.609] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.609] lstrlenW (lpString=".zip") returned 4
	[0085.609] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.609] lstrlenW (lpString=".rar") returned 4
	[0085.609] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.609] lstrlenW (lpString=".bz2") returned 4
	[0085.609] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.609] lstrlenW (lpString=".7z") returned 3
	[0085.609] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.609] lstrlenW (lpString=".dbf") returned 4
	[0085.609] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.609] lstrlenW (lpString=".1cd") returned 4
	[0085.609] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.610] lstrlenW (lpString=".jpg") returned 4
	[0085.610] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.610] lstrlenW (lpString=".doc") returned 4
	[0085.610] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.610] lstrlenW (lpString=".docx") returned 5
	[0085.610] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0085.610] lstrlenW (lpString=".pdf") returned 4
	[0085.610] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.610] lstrlenW (lpString=".xls") returned 4
	[0085.610] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.610] lstrlenW (lpString=".xlsx") returned 5
	[0085.610] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0085.610] lstrlenW (lpString=".ppt") returned 4
	[0085.610] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.610] lstrlenW (lpString=".zip") returned 4
	[0085.610] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.610] lstrlenW (lpString=".rar") returned 4
	[0085.610] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.610] lstrlenW (lpString=".bz2") returned 4
	[0085.610] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.610] lstrlenW (lpString=".7z") returned 3
	[0085.610] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.610] lstrlenW (lpString=".dbf") returned 4
	[0085.611] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.611] lstrlenW (lpString=".1cd") returned 4
	[0085.611] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0085.611] lstrlenW (lpString=".jpg") returned 4
	[0085.611] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.611] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.611] lstrlenW (lpString="J0099167.JPG") returned 12
	[0085.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.612] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=43949) returned 1
	[0085.612] CloseHandle (hObject=0x398) returned 1
	[0085.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220
	[0085.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.612] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.612] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0085.613] GetLastError () returned 0x0
	[0085.613] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0xabad, lpOverlapped=0x0) returned 1
	[0085.615] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xabb0, lpOverlapped=0x0) returned 1
	[0085.617] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.617] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.617] SetEndOfFile (hFile=0x368) returned 1
	[0085.617] CloseHandle (hObject=0x368) returned 1
	[0085.618] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.618] SetEndOfFile (hFile=0x398) returned 1
	[0085.619] CloseHandle (hObject=0x398) returned 1
	[0085.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1
	[0085.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.619] lstrlenW (lpString=".doc") returned 4
	[0085.619] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.619] lstrlenW (lpString=".docx") returned 5
	[0085.619] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0085.619] lstrlenW (lpString=".pdf") returned 4
	[0085.619] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.619] lstrlenW (lpString=".xls") returned 4
	[0085.619] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.619] lstrlenW (lpString=".xlsx") returned 5
	[0085.619] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0085.620] lstrlenW (lpString=".ppt") returned 4
	[0085.620] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.620] lstrlenW (lpString=".zip") returned 4
	[0085.620] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.620] lstrlenW (lpString=".rar") returned 4
	[0085.620] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.620] lstrlenW (lpString=".bz2") returned 4
	[0085.620] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.620] lstrlenW (lpString=".7z") returned 3
	[0085.620] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.620] lstrlenW (lpString=".dbf") returned 4
	[0085.620] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.620] lstrlenW (lpString=".1cd") returned 4
	[0085.620] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.620] lstrlenW (lpString=".jpg") returned 4
	[0085.620] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.620] lstrlenW (lpString=".doc") returned 4
	[0085.620] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.620] lstrlenW (lpString=".docx") returned 5
	[0085.620] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0085.620] lstrlenW (lpString=".pdf") returned 4
	[0085.620] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.620] lstrlenW (lpString=".xls") returned 4
	[0085.621] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.621] lstrlenW (lpString=".xlsx") returned 5
	[0085.621] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0085.621] lstrlenW (lpString=".ppt") returned 4
	[0085.621] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.621] lstrlenW (lpString=".zip") returned 4
	[0085.621] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.621] lstrlenW (lpString=".rar") returned 4
	[0085.621] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.621] lstrlenW (lpString=".bz2") returned 4
	[0085.621] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.621] lstrlenW (lpString=".7z") returned 3
	[0085.621] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.621] lstrlenW (lpString=".dbf") returned 4
	[0085.621] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.621] lstrlenW (lpString=".1cd") returned 4
	[0085.621] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0085.621] lstrlenW (lpString=".jpg") returned 4
	[0085.621] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.621] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.621] lstrlenW (lpString="J0099168.JPG") returned 12
	[0085.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.622] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=20179) returned 1
	[0085.622] CloseHandle (hObject=0x398) returned 1
	[0085.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220
	[0085.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0085.622] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.622] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0085.623] GetLastError () returned 0x0
	[0085.623] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x4ed3, lpOverlapped=0x0) returned 1
	[0085.944] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x4ee0, lpOverlapped=0x0) returned 1
	[0085.945] ReadFile (in: hFile=0x398, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.945] WriteFile (in: hFile=0x368, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.946] SetEndOfFile (hFile=0x368) returned 1
	[0086.380] CloseHandle (hObject=0x368) returned 1
	[0086.387] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.387] SetEndOfFile (hFile=0x398) returned 1
	[0086.388] CloseHandle (hObject=0x398) returned 1
	[0086.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1
	[0086.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.737] lstrlenW (lpString=".doc") returned 4
	[0086.737] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.737] lstrlenW (lpString=".docx") returned 5
	[0086.737] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0086.737] lstrlenW (lpString=".pdf") returned 4
	[0086.737] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.737] lstrlenW (lpString=".xls") returned 4
	[0086.737] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.737] lstrlenW (lpString=".xlsx") returned 5
	[0086.737] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0086.737] lstrlenW (lpString=".ppt") returned 4
	[0086.737] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.737] lstrlenW (lpString=".zip") returned 4
	[0086.737] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.738] lstrlenW (lpString=".rar") returned 4
	[0086.738] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.738] lstrlenW (lpString=".bz2") returned 4
	[0086.738] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.738] lstrlenW (lpString=".7z") returned 3
	[0086.738] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.738] lstrlenW (lpString=".dbf") returned 4
	[0086.738] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.738] lstrlenW (lpString=".1cd") returned 4
	[0086.738] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.738] lstrlenW (lpString=".jpg") returned 4
	[0086.738] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.738] lstrlenW (lpString=".doc") returned 4
	[0086.738] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.738] lstrlenW (lpString=".docx") returned 5
	[0086.738] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0086.739] lstrlenW (lpString=".pdf") returned 4
	[0086.739] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.739] lstrlenW (lpString=".xls") returned 4
	[0086.739] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.739] lstrlenW (lpString=".xlsx") returned 5
	[0086.739] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0086.739] lstrlenW (lpString=".ppt") returned 4
	[0086.739] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.739] lstrlenW (lpString=".zip") returned 4
	[0086.739] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.739] lstrlenW (lpString=".rar") returned 4
	[0086.739] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.739] lstrlenW (lpString=".bz2") returned 4
	[0086.739] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.739] lstrlenW (lpString=".7z") returned 3
	[0086.739] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.739] lstrlenW (lpString=".dbf") returned 4
	[0086.739] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.739] lstrlenW (lpString=".1cd") returned 4
	[0086.739] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0086.740] lstrlenW (lpString=".jpg") returned 4
	[0086.740] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.740] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0086.740] lstrlenW (lpString="J0099194.GIF") returned 12
	[0086.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.740] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=25265) returned 1
	[0086.740] CloseHandle (hObject=0x320) returned 1
	[0086.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220
	[0086.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.741] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.741] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.741] GetLastError () returned 0x0
	[0086.741] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x62b1, lpOverlapped=0x0) returned 1
	[0086.743] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x62c0, lpOverlapped=0x0) returned 1
	[0086.745] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.745] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.745] SetEndOfFile (hFile=0x378) returned 1
	[0086.745] CloseHandle (hObject=0x378) returned 1
	[0086.745] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.745] SetEndOfFile (hFile=0x320) returned 1
	[0086.746] CloseHandle (hObject=0x320) returned 1
	[0086.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1
	[0086.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.747] lstrlenW (lpString=".doc") returned 4
	[0086.747] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.747] lstrlenW (lpString=".docx") returned 5
	[0086.747] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1
	[0086.747] lstrlenW (lpString=".pdf") returned 4
	[0086.747] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.747] lstrlenW (lpString=".xls") returned 4
	[0086.747] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.748] lstrlenW (lpString=".xlsx") returned 5
	[0086.748] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1
	[0086.748] lstrlenW (lpString=".ppt") returned 4
	[0086.748] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.748] lstrlenW (lpString=".zip") returned 4
	[0086.748] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.748] lstrlenW (lpString=".rar") returned 4
	[0086.748] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.748] lstrlenW (lpString=".bz2") returned 4
	[0086.748] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.748] lstrlenW (lpString=".7z") returned 3
	[0086.748] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.748] lstrlenW (lpString=".dbf") returned 4
	[0086.748] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.748] lstrlenW (lpString=".1cd") returned 4
	[0086.748] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.748] lstrlenW (lpString=".jpg") returned 4
	[0086.748] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.749] lstrlenW (lpString=".doc") returned 4
	[0086.749] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.749] lstrlenW (lpString=".docx") returned 5
	[0086.749] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1
	[0086.749] lstrlenW (lpString=".pdf") returned 4
	[0086.749] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.749] lstrlenW (lpString=".xls") returned 4
	[0086.749] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.749] lstrlenW (lpString=".xlsx") returned 5
	[0086.749] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1
	[0086.749] lstrlenW (lpString=".ppt") returned 4
	[0086.749] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.749] lstrlenW (lpString=".zip") returned 4
	[0086.749] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.749] lstrlenW (lpString=".rar") returned 4
	[0086.749] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.749] lstrlenW (lpString=".bz2") returned 4
	[0086.749] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.750] lstrlenW (lpString=".7z") returned 3
	[0086.750] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.750] lstrlenW (lpString=".dbf") returned 4
	[0086.750] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.750] lstrlenW (lpString=".1cd") returned 4
	[0086.750] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0086.750] lstrlenW (lpString=".jpg") returned 4
	[0086.750] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.750] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0086.750] lstrlenW (lpString="J0099195.GIF") returned 12
	[0086.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.751] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=19923) returned 1
	[0086.751] CloseHandle (hObject=0x320) returned 1
	[0086.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220
	[0086.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.752] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.752] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.752] GetLastError () returned 0x0
	[0086.752] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x4dd3, lpOverlapped=0x0) returned 1
	[0086.754] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0086.755] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.755] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.755] SetEndOfFile (hFile=0x378) returned 1
	[0086.755] CloseHandle (hObject=0x378) returned 1
	[0086.755] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.756] SetEndOfFile (hFile=0x320) returned 1
	[0086.756] CloseHandle (hObject=0x320) returned 1
	[0086.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1
	[0086.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.757] lstrlenW (lpString=".doc") returned 4
	[0086.757] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.757] lstrlenW (lpString=".docx") returned 5
	[0086.757] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1
	[0086.757] lstrlenW (lpString=".pdf") returned 4
	[0086.757] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.757] lstrlenW (lpString=".xls") returned 4
	[0086.757] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.757] lstrlenW (lpString=".xlsx") returned 5
	[0086.757] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1
	[0086.758] lstrlenW (lpString=".ppt") returned 4
	[0086.758] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.758] lstrlenW (lpString=".zip") returned 4
	[0086.758] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.758] lstrlenW (lpString=".rar") returned 4
	[0086.758] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.758] lstrlenW (lpString=".bz2") returned 4
	[0086.758] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.758] lstrlenW (lpString=".7z") returned 3
	[0086.758] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.758] lstrlenW (lpString=".dbf") returned 4
	[0086.758] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.758] lstrlenW (lpString=".1cd") returned 4
	[0086.758] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.758] lstrlenW (lpString=".jpg") returned 4
	[0086.758] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.759] lstrlenW (lpString=".doc") returned 4
	[0086.759] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.759] lstrlenW (lpString=".docx") returned 5
	[0086.759] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1
	[0086.759] lstrlenW (lpString=".pdf") returned 4
	[0086.759] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.759] lstrlenW (lpString=".xls") returned 4
	[0086.759] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.759] lstrlenW (lpString=".xlsx") returned 5
	[0086.759] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1
	[0086.759] lstrlenW (lpString=".ppt") returned 4
	[0086.759] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.759] lstrlenW (lpString=".zip") returned 4
	[0086.759] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.759] lstrlenW (lpString=".rar") returned 4
	[0086.760] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.760] lstrlenW (lpString=".bz2") returned 4
	[0086.760] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.760] lstrlenW (lpString=".7z") returned 3
	[0086.760] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.760] lstrlenW (lpString=".dbf") returned 4
	[0086.760] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.760] lstrlenW (lpString=".1cd") returned 4
	[0086.760] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0086.760] lstrlenW (lpString=".jpg") returned 4
	[0086.760] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.760] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0086.760] lstrlenW (lpString="J0099196.GIF") returned 12
	[0086.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.761] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=14337) returned 1
	[0086.761] CloseHandle (hObject=0x320) returned 1
	[0086.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220
	[0086.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.761] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.762] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.762] GetLastError () returned 0x0
	[0086.762] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x3801, lpOverlapped=0x0) returned 1
	[0086.764] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x3810, lpOverlapped=0x0) returned 1
	[0086.765] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.765] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.765] SetEndOfFile (hFile=0x378) returned 1
	[0086.765] CloseHandle (hObject=0x378) returned 1
	[0086.765] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.765] SetEndOfFile (hFile=0x320) returned 1
	[0086.766] CloseHandle (hObject=0x320) returned 1
	[0086.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1
	[0086.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.767] lstrlenW (lpString=".doc") returned 4
	[0086.767] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.767] lstrlenW (lpString=".docx") returned 5
	[0086.767] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1
	[0086.767] lstrlenW (lpString=".pdf") returned 4
	[0086.767] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.767] lstrlenW (lpString=".xls") returned 4
	[0086.767] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.767] lstrlenW (lpString=".xlsx") returned 5
	[0086.767] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1
	[0086.767] lstrlenW (lpString=".ppt") returned 4
	[0086.767] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.767] lstrlenW (lpString=".zip") returned 4
	[0086.767] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.768] lstrlenW (lpString=".rar") returned 4
	[0086.768] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.768] lstrlenW (lpString=".bz2") returned 4
	[0086.768] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.768] lstrlenW (lpString=".7z") returned 3
	[0086.768] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.768] lstrlenW (lpString=".dbf") returned 4
	[0086.768] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.768] lstrlenW (lpString=".1cd") returned 4
	[0086.768] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.768] lstrlenW (lpString=".jpg") returned 4
	[0086.768] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.769] lstrlenW (lpString=".doc") returned 4
	[0086.769] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.769] lstrlenW (lpString=".docx") returned 5
	[0086.769] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1
	[0086.769] lstrlenW (lpString=".pdf") returned 4
	[0086.769] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.769] lstrlenW (lpString=".xls") returned 4
	[0086.769] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.769] lstrlenW (lpString=".xlsx") returned 5
	[0086.769] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1
	[0086.769] lstrlenW (lpString=".ppt") returned 4
	[0086.769] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.769] lstrlenW (lpString=".zip") returned 4
	[0086.769] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.769] lstrlenW (lpString=".rar") returned 4
	[0086.769] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.769] lstrlenW (lpString=".bz2") returned 4
	[0086.769] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.769] lstrlenW (lpString=".7z") returned 3
	[0086.769] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.770] lstrlenW (lpString=".dbf") returned 4
	[0086.770] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.770] lstrlenW (lpString=".1cd") returned 4
	[0086.770] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0086.770] lstrlenW (lpString=".jpg") returned 4
	[0086.770] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.770] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0086.770] lstrlenW (lpString="J0099197.GIF") returned 12
	[0086.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.771] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=10898) returned 1
	[0086.771] CloseHandle (hObject=0x320) returned 1
	[0086.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220
	[0086.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.771] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.771] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.772] GetLastError () returned 0x0
	[0086.772] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x2a92, lpOverlapped=0x0) returned 1
	[0087.149] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x2aa0, lpOverlapped=0x0) returned 1
	[0087.150] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.150] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.151] SetEndOfFile (hFile=0x378) returned 1
	[0087.153] CloseHandle (hObject=0x378) returned 1
	[0087.154] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.154] SetEndOfFile (hFile=0x320) returned 1
	[0087.154] CloseHandle (hObject=0x320) returned 1
	[0087.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1
	[0087.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.155] lstrlenW (lpString=".doc") returned 4
	[0087.155] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.155] lstrlenW (lpString=".docx") returned 5
	[0087.155] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1
	[0087.155] lstrlenW (lpString=".pdf") returned 4
	[0087.155] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.155] lstrlenW (lpString=".xls") returned 4
	[0087.155] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.155] lstrlenW (lpString=".xlsx") returned 5
	[0087.155] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1
	[0087.155] lstrlenW (lpString=".ppt") returned 4
	[0087.155] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.156] lstrlenW (lpString=".zip") returned 4
	[0087.156] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.156] lstrlenW (lpString=".rar") returned 4
	[0087.156] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.156] lstrlenW (lpString=".bz2") returned 4
	[0087.156] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.156] lstrlenW (lpString=".7z") returned 3
	[0087.156] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.156] lstrlenW (lpString=".dbf") returned 4
	[0087.156] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.156] lstrlenW (lpString=".1cd") returned 4
	[0087.156] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.156] lstrlenW (lpString=".jpg") returned 4
	[0087.156] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.156] lstrlenW (lpString=".doc") returned 4
	[0087.156] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.156] lstrlenW (lpString=".docx") returned 5
	[0087.157] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1
	[0087.157] lstrlenW (lpString=".pdf") returned 4
	[0087.157] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.157] lstrlenW (lpString=".xls") returned 4
	[0087.157] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.157] lstrlenW (lpString=".xlsx") returned 5
	[0087.157] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1
	[0087.157] lstrlenW (lpString=".ppt") returned 4
	[0087.157] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.157] lstrlenW (lpString=".zip") returned 4
	[0087.157] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.157] lstrlenW (lpString=".rar") returned 4
	[0087.157] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.157] lstrlenW (lpString=".bz2") returned 4
	[0087.157] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.157] lstrlenW (lpString=".7z") returned 3
	[0087.157] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.157] lstrlenW (lpString=".dbf") returned 4
	[0087.157] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.158] lstrlenW (lpString=".1cd") returned 4
	[0087.158] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0087.158] lstrlenW (lpString=".jpg") returned 4
	[0087.158] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.158] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0087.158] lstrlenW (lpString="J0101859.BMP") returned 12
	[0087.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0087.158] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=31968) returned 1
	[0087.158] CloseHandle (hObject=0x320) returned 1
	[0087.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220
	[0087.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0087.159] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.159] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.159] GetLastError () returned 0x0
	[0087.159] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x7ce0, lpOverlapped=0x0) returned 1
	[0087.161] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x7cf0, lpOverlapped=0x0) returned 1
	[0087.163] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.163] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.163] SetEndOfFile (hFile=0x378) returned 1
	[0087.163] CloseHandle (hObject=0x378) returned 1
	[0087.163] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.163] SetEndOfFile (hFile=0x320) returned 1
	[0087.164] CloseHandle (hObject=0x320) returned 1
	[0087.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1
	[0087.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.165] lstrlenW (lpString=".doc") returned 4
	[0087.165] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.165] lstrlenW (lpString=".docx") returned 5
	[0087.165] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1
	[0087.165] lstrlenW (lpString=".pdf") returned 4
	[0087.165] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.165] lstrlenW (lpString=".xls") returned 4
	[0087.165] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.165] lstrlenW (lpString=".xlsx") returned 5
	[0087.165] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1
	[0087.165] lstrlenW (lpString=".ppt") returned 4
	[0087.165] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.165] lstrlenW (lpString=".zip") returned 4
	[0087.165] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.165] lstrlenW (lpString=".rar") returned 4
	[0087.165] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.165] lstrlenW (lpString=".bz2") returned 4
	[0087.165] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.165] lstrlenW (lpString=".7z") returned 3
	[0087.166] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.167] lstrlenW (lpString=".dbf") returned 4
	[0087.167] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.167] lstrlenW (lpString=".1cd") returned 4
	[0087.167] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.167] lstrlenW (lpString=".jpg") returned 4
	[0087.167] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.167] lstrlenW (lpString=".doc") returned 4
	[0087.167] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.167] lstrlenW (lpString=".docx") returned 5
	[0087.167] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1
	[0087.167] lstrlenW (lpString=".pdf") returned 4
	[0087.167] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.168] lstrlenW (lpString=".xls") returned 4
	[0087.168] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.168] lstrlenW (lpString=".xlsx") returned 5
	[0087.168] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1
	[0087.168] lstrlenW (lpString=".ppt") returned 4
	[0087.168] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.168] lstrlenW (lpString=".zip") returned 4
	[0087.168] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.168] lstrlenW (lpString=".rar") returned 4
	[0087.168] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.168] lstrlenW (lpString=".bz2") returned 4
	[0087.168] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.168] lstrlenW (lpString=".7z") returned 3
	[0087.168] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.168] lstrlenW (lpString=".dbf") returned 4
	[0087.168] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.168] lstrlenW (lpString=".1cd") returned 4
	[0087.168] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0087.169] lstrlenW (lpString=".jpg") returned 4
	[0087.169] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.169] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0087.169] lstrlenW (lpString="J0101860.BMP") returned 12
	[0087.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0087.170] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=32184) returned 1
	[0087.170] CloseHandle (hObject=0x320) returned 1
	[0087.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220
	[0087.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0087.170] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.170] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.171] GetLastError () returned 0x0
	[0087.171] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0087.173] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0087.174] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.174] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.174] SetEndOfFile (hFile=0x378) returned 1
	[0087.174] CloseHandle (hObject=0x378) returned 1
	[0087.175] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.175] SetEndOfFile (hFile=0x320) returned 1
	[0087.176] CloseHandle (hObject=0x320) returned 1
	[0087.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1
	[0087.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.176] lstrlenW (lpString=".doc") returned 4
	[0087.176] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.176] lstrlenW (lpString=".docx") returned 5
	[0087.176] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1
	[0087.176] lstrlenW (lpString=".pdf") returned 4
	[0087.176] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.176] lstrlenW (lpString=".xls") returned 4
	[0087.176] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.177] lstrlenW (lpString=".xlsx") returned 5
	[0087.177] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1
	[0087.177] lstrlenW (lpString=".ppt") returned 4
	[0087.177] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.177] lstrlenW (lpString=".zip") returned 4
	[0087.177] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.177] lstrlenW (lpString=".rar") returned 4
	[0087.177] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.177] lstrlenW (lpString=".bz2") returned 4
	[0087.177] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.177] lstrlenW (lpString=".7z") returned 3
	[0087.177] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.177] lstrlenW (lpString=".dbf") returned 4
	[0087.177] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.177] lstrlenW (lpString=".1cd") returned 4
	[0087.177] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.177] lstrlenW (lpString=".jpg") returned 4
	[0087.177] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.178] lstrlenW (lpString=".doc") returned 4
	[0087.178] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.178] lstrlenW (lpString=".docx") returned 5
	[0087.178] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1
	[0087.178] lstrlenW (lpString=".pdf") returned 4
	[0087.178] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.178] lstrlenW (lpString=".xls") returned 4
	[0087.178] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.178] lstrlenW (lpString=".xlsx") returned 5
	[0087.178] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1
	[0087.178] lstrlenW (lpString=".ppt") returned 4
	[0087.178] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.178] lstrlenW (lpString=".zip") returned 4
	[0087.178] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.178] lstrlenW (lpString=".rar") returned 4
	[0087.178] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.178] lstrlenW (lpString=".bz2") returned 4
	[0087.178] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.178] lstrlenW (lpString=".7z") returned 3
	[0087.178] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.178] lstrlenW (lpString=".dbf") returned 4
	[0087.179] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.179] lstrlenW (lpString=".1cd") returned 4
	[0087.179] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0087.179] lstrlenW (lpString=".jpg") returned 4
	[0087.179] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.179] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0087.179] lstrlenW (lpString="J0101861.BMP") returned 12
	[0087.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0087.179] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=32184) returned 1
	[0087.179] CloseHandle (hObject=0x320) returned 1
	[0087.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220
	[0087.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0087.180] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.180] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.180] GetLastError () returned 0x0
	[0087.180] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0087.183] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0087.184] ReadFile (in: hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesRead=0x2b6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.184] WriteFile (in: hFile=0x378, lpBuffer=0x3444020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3444020*, lpNumberOfBytesWritten=0x2b6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.184] SetEndOfFile (hFile=0x378) returned 1
	[0087.184] CloseHandle (hObject=0x378) returned 1
	[0087.184] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.184] SetEndOfFile (hFile=0x320) returned 1
	[0087.185] CloseHandle (hObject=0x320) returned 1
	[0087.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1
	[0087.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.186] lstrlenW (lpString=".doc") returned 4
	[0087.186] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.186] lstrlenW (lpString=".docx") returned 5
	[0087.186] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1
	[0087.186] lstrlenW (lpString=".pdf") returned 4
	[0087.186] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.186] lstrlenW (lpString=".xls") returned 4
	[0087.186] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.186] lstrlenW (lpString=".xlsx") returned 5
	[0087.186] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1
	[0087.186] lstrlenW (lpString=".ppt") returned 4
	[0087.187] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.187] lstrlenW (lpString=".zip") returned 4
	[0087.187] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.187] lstrlenW (lpString=".rar") returned 4
	[0087.187] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.187] lstrlenW (lpString=".bz2") returned 4
	[0087.187] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.187] lstrlenW (lpString=".7z") returned 3
	[0087.187] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.187] lstrlenW (lpString=".dbf") returned 4
	[0087.187] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.187] lstrlenW (lpString=".1cd") returned 4
	[0087.187] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.187] lstrlenW (lpString=".jpg") returned 4
	[0087.188] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.188] lstrlenW (lpString=".doc") returned 4
	[0087.188] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.188] lstrlenW (lpString=".docx") returned 5
	[0087.188] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1
	[0087.188] lstrlenW (lpString=".pdf") returned 4
	[0087.188] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.188] lstrlenW (lpString=".xls") returned 4
	[0087.188] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.188] lstrlenW (lpString=".xlsx") returned 5
	[0087.188] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1
	[0087.188] lstrlenW (lpString=".ppt") returned 4
	[0087.188] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.189] lstrlenW (lpString=".zip") returned 4
	[0087.189] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.189] lstrlenW (lpString=".rar") returned 4
	[0087.189] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.189] lstrlenW (lpString=".bz2") returned 4
	[0087.189] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.189] lstrlenW (lpString=".7z") returned 3
	[0087.189] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.189] lstrlenW (lpString=".dbf") returned 4
	[0087.189] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.189] lstrlenW (lpString=".1cd") returned 4
	[0087.189] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0087.189] lstrlenW (lpString=".jpg") returned 4
	[0087.189] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.190] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0087.190] lstrlenW (lpString="J0101862.BMP") returned 12
	[0087.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0087.190] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2b6ff14 | out: lpFileSize=0x2b6ff14*=32184) returned 1
	[0087.190] CloseHandle (hObject=0x320) returned 1
	[0087.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220
	[0087.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0087.191] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.191] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.192] GetLastError () returned 0x0
	[0087.192] ReadFile (hFile=0x320, lpBuffer=0x3444020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fecc, lpOverlapped=0x0) 

Thread:
	id = 11
	os_tid = 0xe0

	[0055.905] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x6e3060
	[0055.905] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x3550048
	[0055.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66eff0
	[0055.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x6) returned 0x69f188
	[0055.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f158
	[0055.906] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x100000) returned 0x3652020
	[0055.909] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f218
	[0055.909] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f218, Size=0x20) returned 0x6311f0
	[0055.909] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f230
	[0055.909] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f230, Size=0x20) returned 0x631178
	[0055.909] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0055.910] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0055.910] Wow64DisableWow64FsRedirection (in: OldValue=0x2caff50 | out: OldValue=0x2caff50*=0x0) returned 1
	[0055.910] lstrlenW (lpString="kernel32.dll") returned 12
	[0055.910] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6311f0 | out: hHeap=0x600000) returned 1
	[0055.910] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0055.910] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631178 | out: hHeap=0x600000) returned 1
	[0055.910] Sleep (dwMilliseconds=0x64) 
	[0057.242] lstrcmpiW (lpString1=".log", lpString2=".money") returned -1
	[0057.242] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30
	[0057.242] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0057.243] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=40) returned 1
	[0057.243] CloseHandle (hObject=0x2c8) returned 1
	[0057.243] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20
	[0057.243] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0057.243] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0057.243] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.243] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.243] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0057.243] GetLastError () returned 0x0
	[0057.243] ReadFile (in: hFile=0x2c8, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x28, lpOverlapped=0x0) returned 1
	[0057.257] WriteFile (in: hFile=0x2cc, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x30, lpOverlapped=0x0) returned 1
	[0057.258] ReadFile (in: hFile=0x2c8, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.258] WriteFile (in: hFile=0x2cc, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x110, lpOverlapped=0x0) returned 1
	[0057.258] SetEndOfFile (hFile=0x2cc) returned 1
	[0057.258] CloseHandle (hObject=0x2cc) returned 1
	[0057.259] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.259] SetEndOfFile (hFile=0x2c8) returned 1
	[0057.259] CloseHandle (hObject=0x2c8) returned 1
	[0057.260] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0057.260] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1
	[0057.260] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.260] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.260] lstrlenW (lpString=".doc") returned 4
	[0057.260] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0057.260] lstrlenW (lpString=".docx") returned 5
	[0057.260] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1
	[0057.260] lstrlenW (lpString=".pdf") returned 4
	[0057.260] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0057.260] lstrlenW (lpString=".xls") returned 4
	[0057.260] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0057.260] lstrlenW (lpString=".xlsx") returned 5
	[0057.260] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1
	[0057.261] lstrlenW (lpString=".ppt") returned 4
	[0057.261] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0057.261] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.261] lstrlenW (lpString=".zip") returned 4
	[0057.261] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0057.261] lstrlenW (lpString=".rar") returned 4
	[0057.261] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0057.261] lstrlenW (lpString=".bz2") returned 4
	[0057.261] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0057.261] lstrlenW (lpString=".7z") returned 3
	[0057.261] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0057.261] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.261] lstrlenW (lpString=".dbf") returned 4
	[0057.261] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0057.261] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.261] lstrlenW (lpString=".1cd") returned 4
	[0057.261] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0057.261] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.261] lstrlenW (lpString=".jpg") returned 4
	[0057.261] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0057.261] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.261] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.261] lstrlenW (lpString=".doc") returned 4
	[0057.261] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0057.261] lstrlenW (lpString=".docx") returned 5
	[0057.261] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1
	[0057.261] lstrlenW (lpString=".pdf") returned 4
	[0057.261] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0057.261] lstrlenW (lpString=".xls") returned 4
	[0057.262] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0057.262] lstrlenW (lpString=".xlsx") returned 5
	[0057.262] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1
	[0057.262] lstrlenW (lpString=".ppt") returned 4
	[0057.262] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0057.262] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.262] lstrlenW (lpString=".zip") returned 4
	[0057.262] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0057.262] lstrlenW (lpString=".rar") returned 4
	[0057.262] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0057.262] lstrlenW (lpString=".bz2") returned 4
	[0057.262] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0057.262] lstrlenW (lpString=".7z") returned 3
	[0057.262] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0057.262] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.262] lstrlenW (lpString=".dbf") returned 4
	[0057.262] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0057.262] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.262] lstrlenW (lpString=".1cd") returned 4
	[0057.262] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0057.262] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0057.262] lstrlenW (lpString=".jpg") returned 4
	[0057.262] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0057.262] lstrcmpiW (lpString1=".ini", lpString2=".money") returned -1
	[0057.263] lstrlenW (lpString="GetCurrentRollback.ini") returned 22
	[0057.263] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0057.265] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=156) returned 1
	[0057.265] CloseHandle (hObject=0x2c8) returned 1
	[0057.265] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20
	[0057.265] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0057.265] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0057.265] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.265] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.265] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0057.265] GetLastError () returned 0x0
	[0057.266] ReadFile (in: hFile=0x2c8, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x9c, lpOverlapped=0x0) returned 1
	[0057.266] WriteFile (in: hFile=0x2cc, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xa0, lpOverlapped=0x0) returned 1
	[0057.268] ReadFile (in: hFile=0x2c8, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.268] WriteFile (in: hFile=0x2cc, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x100, lpOverlapped=0x0) returned 1
	[0057.268] SetEndOfFile (hFile=0x2cc) returned 1
	[0057.268] CloseHandle (hObject=0x2cc) returned 1
	[0057.269] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.269] SetEndOfFile (hFile=0x2c8) returned 1
	[0057.270] CloseHandle (hObject=0x2c8) returned 1
	[0057.270] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0057.270] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1
	[0057.271] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.271] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.271] lstrlenW (lpString=".doc") returned 4
	[0057.271] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0057.271] lstrlenW (lpString=".docx") returned 5
	[0057.271] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1
	[0057.271] lstrlenW (lpString=".pdf") returned 4
	[0057.271] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0057.271] lstrlenW (lpString=".xls") returned 4
	[0057.271] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0057.271] lstrlenW (lpString=".xlsx") returned 5
	[0057.271] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1
	[0057.271] lstrlenW (lpString=".ppt") returned 4
	[0057.271] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0057.271] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.271] lstrlenW (lpString=".zip") returned 4
	[0057.271] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0057.272] lstrlenW (lpString=".rar") returned 4
	[0057.272] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0057.272] lstrlenW (lpString=".bz2") returned 4
	[0057.272] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0057.272] lstrlenW (lpString=".7z") returned 3
	[0057.272] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0057.272] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.272] lstrlenW (lpString=".dbf") returned 4
	[0057.272] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0057.272] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.272] lstrlenW (lpString=".1cd") returned 4
	[0057.272] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0057.272] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.272] lstrlenW (lpString=".jpg") returned 4
	[0057.272] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0057.272] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.272] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.272] lstrlenW (lpString=".doc") returned 4
	[0057.272] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0057.272] lstrlenW (lpString=".docx") returned 5
	[0057.272] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1
	[0057.272] lstrlenW (lpString=".pdf") returned 4
	[0057.272] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0057.272] lstrlenW (lpString=".xls") returned 4
	[0057.273] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0057.273] lstrlenW (lpString=".xlsx") returned 5
	[0057.273] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1
	[0057.273] lstrlenW (lpString=".ppt") returned 4
	[0057.273] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0057.273] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.273] lstrlenW (lpString=".zip") returned 4
	[0057.273] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0057.273] lstrlenW (lpString=".rar") returned 4
	[0057.273] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0057.273] lstrlenW (lpString=".bz2") returned 4
	[0057.273] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0057.273] lstrlenW (lpString=".7z") returned 3
	[0057.273] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0057.273] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.273] lstrlenW (lpString=".dbf") returned 4
	[0057.273] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0057.273] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.273] lstrlenW (lpString=".1cd") returned 4
	[0057.273] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0057.273] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0057.273] lstrlenW (lpString=".jpg") returned 4
	[0057.274] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0057.274] Sleep (dwMilliseconds=0x64) 
	[0057.613] lstrcmpiW (lpString1=".ini", lpString2=".money") returned -1
	[0057.613] lstrlenW (lpString="desktop.ini") returned 11
	[0057.613] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.613] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=129) returned 1
	[0057.613] CloseHandle (hObject=0x2f4) returned 1
	[0057.613] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26
	[0057.614] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0057.614] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.614] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.614] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.614] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0057.615] GetLastError () returned 0x0
	[0057.615] ReadFile (in: hFile=0x2f4, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x81, lpOverlapped=0x0) returned 1
	[0057.617] WriteFile (in: hFile=0x2f8, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x90, lpOverlapped=0x0) returned 1
	[0057.617] ReadFile (in: hFile=0x2f4, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.617] WriteFile (in: hFile=0x2f8, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xea, lpOverlapped=0x0) returned 1
	[0057.618] SetEndOfFile (hFile=0x2f8) returned 1
	[0057.618] CloseHandle (hObject=0x2f8) returned 1
	[0057.619] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.619] SetEndOfFile (hFile=0x2f4) returned 1
	[0057.619] CloseHandle (hObject=0x2f4) returned 1
	[0057.620] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x26) returned 1
	[0057.620] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1
	[0057.620] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.620] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.620] lstrlenW (lpString=".doc") returned 4
	[0057.620] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0057.620] lstrlenW (lpString=".docx") returned 5
	[0057.620] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0057.620] lstrlenW (lpString=".pdf") returned 4
	[0057.620] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0057.620] lstrlenW (lpString=".xls") returned 4
	[0057.620] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0057.620] lstrlenW (lpString=".xlsx") returned 5
	[0057.620] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0057.620] lstrlenW (lpString=".ppt") returned 4
	[0057.621] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0057.621] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.621] lstrlenW (lpString=".zip") returned 4
	[0057.621] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0057.621] lstrlenW (lpString=".rar") returned 4
	[0057.621] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0057.621] lstrlenW (lpString=".bz2") returned 4
	[0057.621] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0057.621] lstrlenW (lpString=".7z") returned 3
	[0057.621] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0057.621] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.621] lstrlenW (lpString=".dbf") returned 4
	[0057.621] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0057.621] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.621] lstrlenW (lpString=".1cd") returned 4
	[0057.621] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0057.621] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.621] lstrlenW (lpString=".jpg") returned 4
	[0057.621] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0057.621] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.621] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.621] lstrlenW (lpString=".doc") returned 4
	[0057.621] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0057.621] lstrlenW (lpString=".docx") returned 5
	[0057.621] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0057.621] lstrlenW (lpString=".pdf") returned 4
	[0057.622] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0057.622] lstrlenW (lpString=".xls") returned 4
	[0057.622] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0057.622] lstrlenW (lpString=".xlsx") returned 5
	[0057.622] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0057.622] lstrlenW (lpString=".ppt") returned 4
	[0057.622] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0057.622] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.622] lstrlenW (lpString=".zip") returned 4
	[0057.622] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0057.622] lstrlenW (lpString=".rar") returned 4
	[0057.622] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0057.622] lstrlenW (lpString=".bz2") returned 4
	[0057.622] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0057.622] lstrlenW (lpString=".7z") returned 3
	[0057.622] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0057.622] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.622] lstrlenW (lpString=".dbf") returned 4
	[0057.622] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0057.622] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.622] lstrlenW (lpString=".1cd") returned 4
	[0057.622] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0057.622] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.622] lstrlenW (lpString=".jpg") returned 4
	[0057.622] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0057.623] lstrcmpiW (lpString1=".ini", lpString2=".money") returned -1
	[0057.623] lstrlenW (lpString="desktop.ini") returned 11
	[0057.623] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.623] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=129) returned 1
	[0057.623] CloseHandle (hObject=0x2f4) returned 1
	[0057.623] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26
	[0057.623] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0057.623] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.623] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.623] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.624] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0057.624] GetLastError () returned 0x0
	[0057.624] ReadFile (in: hFile=0x2f4, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x81, lpOverlapped=0x0) returned 1
	[0057.624] WriteFile (in: hFile=0x2f8, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x90, lpOverlapped=0x0) returned 1
	[0057.625] ReadFile (in: hFile=0x2f4, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.625] WriteFile (in: hFile=0x2f8, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xea, lpOverlapped=0x0) returned 1
	[0057.625] SetEndOfFile (hFile=0x2f8) returned 1
	[0057.625] CloseHandle (hObject=0x2f8) returned 1
	[0057.626] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.626] SetEndOfFile (hFile=0x2f4) returned 1
	[0057.627] CloseHandle (hObject=0x2f4) returned 1
	[0057.627] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x26) returned 1
	[0057.627] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1
	[0057.627] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.627] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.627] lstrlenW (lpString=".doc") returned 4
	[0057.628] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0057.628] lstrlenW (lpString=".docx") returned 5
	[0057.628] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0057.628] lstrlenW (lpString=".pdf") returned 4
	[0057.628] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0057.628] lstrlenW (lpString=".xls") returned 4
	[0057.628] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0057.628] lstrlenW (lpString=".xlsx") returned 5
	[0057.628] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0057.628] lstrlenW (lpString=".ppt") returned 4
	[0057.628] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0057.628] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.628] lstrlenW (lpString=".zip") returned 4
	[0057.628] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0057.628] lstrlenW (lpString=".rar") returned 4
	[0057.628] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0057.628] lstrlenW (lpString=".bz2") returned 4
	[0057.628] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0057.628] lstrlenW (lpString=".7z") returned 3
	[0057.628] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0057.628] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.628] lstrlenW (lpString=".dbf") returned 4
	[0057.628] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0057.628] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.628] lstrlenW (lpString=".1cd") returned 4
	[0057.628] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0057.629] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.629] lstrlenW (lpString=".jpg") returned 4
	[0057.629] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0057.629] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.629] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.629] lstrlenW (lpString=".doc") returned 4
	[0057.629] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0057.629] lstrlenW (lpString=".docx") returned 5
	[0057.629] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0057.629] lstrlenW (lpString=".pdf") returned 4
	[0057.629] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0057.629] lstrlenW (lpString=".xls") returned 4
	[0057.629] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0057.629] lstrlenW (lpString=".xlsx") returned 5
	[0057.629] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0057.629] lstrlenW (lpString=".ppt") returned 4
	[0057.629] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0057.629] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.629] lstrlenW (lpString=".zip") returned 4
	[0057.629] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0057.629] lstrlenW (lpString=".rar") returned 4
	[0057.629] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0057.629] lstrlenW (lpString=".bz2") returned 4
	[0057.629] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0057.629] lstrlenW (lpString=".7z") returned 3
	[0057.629] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0057.630] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.630] lstrlenW (lpString=".dbf") returned 4
	[0057.630] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0057.630] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.630] lstrlenW (lpString=".1cd") returned 4
	[0057.630] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0057.630] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0057.630] lstrlenW (lpString=".jpg") returned 4
	[0057.630] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0057.630] Sleep (dwMilliseconds=0x64) 
	[0058.098] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0058.098] lstrlenW (lpString="eula.rtf") returned 8
	[0058.116] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0058.116] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3314) returned 1
	[0058.116] CloseHandle (hObject=0x304) returned 1
	[0058.116] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80
	[0058.116] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.117] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0058.117] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.117] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.117] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0058.117] GetLastError () returned 0x0
	[0058.117] ReadFile (in: hFile=0x304, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xcf2, lpOverlapped=0x0) returned 1
	[0058.119] WriteFile (in: hFile=0x308, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xd00, lpOverlapped=0x0) returned 1
	[0058.120] ReadFile (in: hFile=0x304, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.120] WriteFile (in: hFile=0x308, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xe4, lpOverlapped=0x0) returned 1
	[0058.120] SetEndOfFile (hFile=0x308) returned 1
	[0058.120] CloseHandle (hObject=0x308) returned 1
	[0058.121] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.121] SetEndOfFile (hFile=0x304) returned 1
	[0058.122] CloseHandle (hObject=0x304) returned 1
	[0058.122] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.122] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1
	[0058.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.123] lstrlenW (lpString=".doc") returned 4
	[0058.123] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.123] lstrlenW (lpString=".docx") returned 5
	[0058.123] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.123] lstrlenW (lpString=".pdf") returned 4
	[0058.123] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.123] lstrlenW (lpString=".xls") returned 4
	[0058.123] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.123] lstrlenW (lpString=".xlsx") returned 5
	[0058.123] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.123] lstrlenW (lpString=".ppt") returned 4
	[0058.123] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.123] lstrlenW (lpString=".zip") returned 4
	[0058.123] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.123] lstrlenW (lpString=".rar") returned 4
	[0058.123] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.123] lstrlenW (lpString=".bz2") returned 4
	[0058.124] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.124] lstrlenW (lpString=".7z") returned 3
	[0058.124] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.124] lstrlenW (lpString=".dbf") returned 4
	[0058.124] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.124] lstrlenW (lpString=".1cd") returned 4
	[0058.124] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.124] lstrlenW (lpString=".jpg") returned 4
	[0058.124] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.124] lstrlenW (lpString=".doc") returned 4
	[0058.124] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.125] lstrlenW (lpString=".docx") returned 5
	[0058.125] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.125] lstrlenW (lpString=".pdf") returned 4
	[0058.125] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.125] lstrlenW (lpString=".xls") returned 4
	[0058.125] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.125] lstrlenW (lpString=".xlsx") returned 5
	[0058.125] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.125] lstrlenW (lpString=".ppt") returned 4
	[0058.125] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.125] lstrlenW (lpString=".zip") returned 4
	[0058.125] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.125] lstrlenW (lpString=".rar") returned 4
	[0058.125] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.125] lstrlenW (lpString=".bz2") returned 4
	[0058.125] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.126] lstrlenW (lpString=".7z") returned 3
	[0058.126] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.126] lstrlenW (lpString=".dbf") returned 4
	[0058.126] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.126] lstrlenW (lpString=".1cd") returned 4
	[0058.126] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0058.126] lstrlenW (lpString=".jpg") returned 4
	[0058.126] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.126] lstrcmpiW (lpString1=".rtf", lpString2=".money") returned 1
	[0058.126] lstrlenW (lpString="eula.rtf") returned 8
	[0058.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0058.127] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3419) returned 1
	[0058.127] CloseHandle (hObject=0x304) returned 1
	[0058.127] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80
	[0058.127] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.127] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0058.127] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.127] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.127] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0058.129] GetLastError () returned 0x0
	[0058.129] ReadFile (in: hFile=0x304, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xd5b, lpOverlapped=0x0) returned 1
	[0058.130] WriteFile (in: hFile=0x308, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xd60, lpOverlapped=0x0) returned 1
	[0058.131] ReadFile (in: hFile=0x304, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.131] WriteFile (in: hFile=0x308, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xe4, lpOverlapped=0x0) returned 1
	[0058.132] SetEndOfFile (hFile=0x308) returned 1
	[0058.132] CloseHandle (hObject=0x308) returned 1
	[0058.132] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.132] SetEndOfFile (hFile=0x304) returned 1
	[0058.133] CloseHandle (hObject=0x304) returned 1
	[0058.133] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.134] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1
	[0058.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.134] lstrlenW (lpString=".doc") returned 4
	[0058.134] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.134] lstrlenW (lpString=".docx") returned 5
	[0058.134] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.134] lstrlenW (lpString=".pdf") returned 4
	[0058.134] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.134] lstrlenW (lpString=".xls") returned 4
	[0058.134] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.134] lstrlenW (lpString=".xlsx") returned 5
	[0058.134] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.134] lstrlenW (lpString=".ppt") returned 4
	[0058.134] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.134] lstrlenW (lpString=".zip") returned 4
	[0058.134] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.134] lstrlenW (lpString=".rar") returned 4
	[0058.135] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.135] lstrlenW (lpString=".bz2") returned 4
	[0058.135] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.135] lstrlenW (lpString=".7z") returned 3
	[0058.135] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.135] lstrlenW (lpString=".dbf") returned 4
	[0058.135] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.135] lstrlenW (lpString=".1cd") returned 4
	[0058.135] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.135] lstrlenW (lpString=".jpg") returned 4
	[0058.135] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.135] lstrlenW (lpString=".doc") returned 4
	[0058.135] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.135] lstrlenW (lpString=".docx") returned 5
	[0058.135] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.135] lstrlenW (lpString=".pdf") returned 4
	[0058.135] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.135] lstrlenW (lpString=".xls") returned 4
	[0058.135] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0058.135] lstrlenW (lpString=".xlsx") returned 5
	[0058.136] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0058.136] lstrlenW (lpString=".ppt") returned 4
	[0058.136] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.136] lstrlenW (lpString=".zip") returned 4
	[0058.136] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0058.136] lstrlenW (lpString=".rar") returned 4
	[0058.136] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.136] lstrlenW (lpString=".bz2") returned 4
	[0058.136] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.136] lstrlenW (lpString=".7z") returned 3
	[0058.136] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.136] lstrlenW (lpString=".dbf") returned 4
	[0058.136] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.136] lstrlenW (lpString=".1cd") returned 4
	[0058.136] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0058.136] lstrlenW (lpString=".jpg") returned 4
	[0058.136] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.136] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0058.137] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0058.137] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0058.137] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=82346) returned 1
	[0058.137] CloseHandle (hObject=0x304) returned 1
	[0058.137] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80
	[0058.137] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.137] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0058.137] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.137] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.137] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0058.138] GetLastError () returned 0x0
	[0058.138] ReadFile (in: hFile=0x304, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x141aa, lpOverlapped=0x0) returned 1
	[0058.141] WriteFile (in: hFile=0x308, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x141b0, lpOverlapped=0x0) returned 1
	[0058.143] ReadFile (in: hFile=0x304, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.143] WriteFile (in: hFile=0x308, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf6, lpOverlapped=0x0) returned 1
	[0058.143] SetEndOfFile (hFile=0x308) returned 1
	[0058.143] CloseHandle (hObject=0x308) returned 1
	[0058.146] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.146] SetEndOfFile (hFile=0x304) returned 1
	[0058.147] CloseHandle (hObject=0x304) returned 1
	[0058.147] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.148] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1
	[0058.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.148] lstrlenW (lpString=".doc") returned 4
	[0058.148] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.148] lstrlenW (lpString=".docx") returned 5
	[0058.148] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.148] lstrlenW (lpString=".pdf") returned 4
	[0058.148] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.148] lstrlenW (lpString=".xls") returned 4
	[0058.148] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.148] lstrlenW (lpString=".xlsx") returned 5
	[0058.148] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.148] lstrlenW (lpString=".ppt") returned 4
	[0058.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.148] lstrlenW (lpString=".zip") returned 4
	[0058.148] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.148] lstrlenW (lpString=".rar") returned 4
	[0058.148] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.148] lstrlenW (lpString=".bz2") returned 4
	[0058.148] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.148] lstrlenW (lpString=".7z") returned 3
	[0058.149] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.149] lstrlenW (lpString=".dbf") returned 4
	[0058.149] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.149] lstrlenW (lpString=".1cd") returned 4
	[0058.149] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.149] lstrlenW (lpString=".jpg") returned 4
	[0058.149] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.149] lstrlenW (lpString=".doc") returned 4
	[0058.149] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0058.149] lstrlenW (lpString=".docx") returned 5
	[0058.149] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0058.149] lstrlenW (lpString=".pdf") returned 4
	[0058.149] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0058.149] lstrlenW (lpString=".xls") returned 4
	[0058.149] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0058.149] lstrlenW (lpString=".xlsx") returned 5
	[0058.149] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0058.149] lstrlenW (lpString=".ppt") returned 4
	[0058.149] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0058.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.149] lstrlenW (lpString=".zip") returned 4
	[0058.149] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0058.149] lstrlenW (lpString=".rar") returned 4
	[0058.150] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0058.150] lstrlenW (lpString=".bz2") returned 4
	[0058.150] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0058.150] lstrlenW (lpString=".7z") returned 3
	[0058.150] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0058.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.150] lstrlenW (lpString=".dbf") returned 4
	[0058.150] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0058.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.150] lstrlenW (lpString=".1cd") returned 4
	[0058.150] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0058.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0058.150] lstrlenW (lpString=".jpg") returned 4
	[0058.150] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0058.150] Sleep (dwMilliseconds=0x64) 
	[0058.755] Sleep (dwMilliseconds=0x64) 
	[0059.250] Sleep (dwMilliseconds=0x64) 
	[0059.541] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0059.541] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0059.541] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0059.572] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=86442) returned 1
	[0059.572] CloseHandle (hObject=0x320) returned 1
	[0059.572] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80
	[0059.572] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.574] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.575] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.575] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.575] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0059.575] GetLastError () returned 0x0
	[0059.575] ReadFile (in: hFile=0x314, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x151aa, lpOverlapped=0x0) returned 1
	[0059.587] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x151b0, lpOverlapped=0x0) returned 1
	[0059.590] ReadFile (in: hFile=0x314, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.590] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf6, lpOverlapped=0x0) returned 1
	[0059.590] SetEndOfFile (hFile=0x318) returned 1
	[0059.590] CloseHandle (hObject=0x318) returned 1
	[0059.593] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.593] SetEndOfFile (hFile=0x314) returned 1
	[0059.594] CloseHandle (hObject=0x314) returned 1
	[0059.594] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.595] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1
	[0059.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.595] lstrlenW (lpString=".doc") returned 4
	[0059.595] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.595] lstrlenW (lpString=".docx") returned 5
	[0059.595] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.595] lstrlenW (lpString=".pdf") returned 4
	[0059.595] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.595] lstrlenW (lpString=".xls") returned 4
	[0059.595] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.595] lstrlenW (lpString=".xlsx") returned 5
	[0059.595] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.595] lstrlenW (lpString=".ppt") returned 4
	[0059.595] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.595] lstrlenW (lpString=".zip") returned 4
	[0059.595] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.596] lstrlenW (lpString=".rar") returned 4
	[0059.596] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.596] lstrlenW (lpString=".bz2") returned 4
	[0059.596] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.596] lstrlenW (lpString=".7z") returned 3
	[0059.596] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.596] lstrlenW (lpString=".dbf") returned 4
	[0059.596] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.596] lstrlenW (lpString=".1cd") returned 4
	[0059.596] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.596] lstrlenW (lpString=".jpg") returned 4
	[0059.596] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.596] lstrlenW (lpString=".doc") returned 4
	[0059.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.596] lstrlenW (lpString=".docx") returned 5
	[0059.596] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.597] lstrlenW (lpString=".pdf") returned 4
	[0059.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.597] lstrlenW (lpString=".xls") returned 4
	[0059.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.597] lstrlenW (lpString=".xlsx") returned 5
	[0059.597] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.597] lstrlenW (lpString=".ppt") returned 4
	[0059.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.597] lstrlenW (lpString=".zip") returned 4
	[0059.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.597] lstrlenW (lpString=".rar") returned 4
	[0059.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.597] lstrlenW (lpString=".bz2") returned 4
	[0059.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.597] lstrlenW (lpString=".7z") returned 3
	[0059.597] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.597] lstrlenW (lpString=".dbf") returned 4
	[0059.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.597] lstrlenW (lpString=".1cd") returned 4
	[0059.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0059.597] lstrlenW (lpString=".jpg") returned 4
	[0059.598] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.598] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0059.598] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0059.598] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.598] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=80060) returned 1
	[0059.598] CloseHandle (hObject=0x314) returned 1
	[0059.598] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80
	[0059.598] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.599] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0059.599] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.600] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.600] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0059.603] GetLastError () returned 0x0
	[0059.603] ReadFile (in: hFile=0x318, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x138bc, lpOverlapped=0x0) returned 1
	[0059.615] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x138c0, lpOverlapped=0x0) returned 1
	[0059.618] ReadFile (in: hFile=0x318, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.618] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf6, lpOverlapped=0x0) returned 1
	[0059.618] SetEndOfFile (hFile=0x320) returned 1
	[0059.618] CloseHandle (hObject=0x320) returned 1
	[0059.620] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.621] SetEndOfFile (hFile=0x318) returned 1
	[0059.622] CloseHandle (hObject=0x318) returned 1
	[0059.622] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.622] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1
	[0059.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.623] lstrlenW (lpString=".doc") returned 4
	[0059.623] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.623] lstrlenW (lpString=".docx") returned 5
	[0059.623] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.623] lstrlenW (lpString=".pdf") returned 4
	[0059.623] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.623] lstrlenW (lpString=".xls") returned 4
	[0059.623] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.623] lstrlenW (lpString=".xlsx") returned 5
	[0059.623] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.623] lstrlenW (lpString=".ppt") returned 4
	[0059.623] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.623] lstrlenW (lpString=".zip") returned 4
	[0059.623] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.623] lstrlenW (lpString=".rar") returned 4
	[0059.623] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.623] lstrlenW (lpString=".bz2") returned 4
	[0059.623] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.623] lstrlenW (lpString=".7z") returned 3
	[0059.623] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.623] lstrlenW (lpString=".dbf") returned 4
	[0059.623] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.624] lstrlenW (lpString=".1cd") returned 4
	[0059.624] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.624] lstrlenW (lpString=".jpg") returned 4
	[0059.624] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.624] lstrlenW (lpString=".doc") returned 4
	[0059.624] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0059.624] lstrlenW (lpString=".docx") returned 5
	[0059.624] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0059.624] lstrlenW (lpString=".pdf") returned 4
	[0059.624] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0059.624] lstrlenW (lpString=".xls") returned 4
	[0059.624] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0059.624] lstrlenW (lpString=".xlsx") returned 5
	[0059.624] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0059.624] lstrlenW (lpString=".ppt") returned 4
	[0059.624] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0059.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.624] lstrlenW (lpString=".zip") returned 4
	[0059.624] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0059.624] lstrlenW (lpString=".rar") returned 4
	[0059.625] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0059.625] lstrlenW (lpString=".bz2") returned 4
	[0059.625] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0059.625] lstrlenW (lpString=".7z") returned 3
	[0059.625] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0059.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.625] lstrlenW (lpString=".dbf") returned 4
	[0059.625] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0059.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.625] lstrlenW (lpString=".1cd") returned 4
	[0059.625] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0059.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0059.625] lstrlenW (lpString=".jpg") returned 4
	[0059.625] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0059.625] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0059.625] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0059.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0059.627] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=68226) returned 1
	[0059.627] CloseHandle (hObject=0x318) returned 1
	[0059.627] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80
	[0059.627] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.627] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0059.627] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.627] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.628] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0059.628] GetLastError () returned 0x0
	[0059.628] ReadFile (in: hFile=0x318, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x10a82, lpOverlapped=0x0) returned 1
	[0060.182] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x10a90, lpOverlapped=0x0) returned 1
	[0060.184] ReadFile (in: hFile=0x318, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.185] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.185] SetEndOfFile (hFile=0x320) returned 1
	[0060.185] CloseHandle (hObject=0x320) returned 1
	[0060.187] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.187] SetEndOfFile (hFile=0x318) returned 1
	[0060.188] CloseHandle (hObject=0x318) returned 1
	[0060.188] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.188] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1
	[0060.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.189] lstrlenW (lpString=".doc") returned 4
	[0060.189] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.189] lstrlenW (lpString=".docx") returned 5
	[0060.189] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.189] lstrlenW (lpString=".pdf") returned 4
	[0060.189] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.189] lstrlenW (lpString=".xls") returned 4
	[0060.189] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.189] lstrlenW (lpString=".xlsx") returned 5
	[0060.189] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.189] lstrlenW (lpString=".ppt") returned 4
	[0060.189] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.189] lstrlenW (lpString=".zip") returned 4
	[0060.189] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.189] lstrlenW (lpString=".rar") returned 4
	[0060.189] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.189] lstrlenW (lpString=".bz2") returned 4
	[0060.190] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.190] lstrlenW (lpString=".7z") returned 3
	[0060.190] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.190] lstrlenW (lpString=".dbf") returned 4
	[0060.190] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.190] lstrlenW (lpString=".1cd") returned 4
	[0060.190] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.190] lstrlenW (lpString=".jpg") returned 4
	[0060.190] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.190] lstrlenW (lpString=".doc") returned 4
	[0060.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.190] lstrlenW (lpString=".docx") returned 5
	[0060.190] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.190] lstrlenW (lpString=".pdf") returned 4
	[0060.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.190] lstrlenW (lpString=".xls") returned 4
	[0060.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.190] lstrlenW (lpString=".xlsx") returned 5
	[0060.190] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.190] lstrlenW (lpString=".ppt") returned 4
	[0060.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.191] lstrlenW (lpString=".zip") returned 4
	[0060.191] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.191] lstrlenW (lpString=".rar") returned 4
	[0060.191] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.191] lstrlenW (lpString=".bz2") returned 4
	[0060.191] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.191] lstrlenW (lpString=".7z") returned 3
	[0060.191] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.191] lstrlenW (lpString=".dbf") returned 4
	[0060.191] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.191] lstrlenW (lpString=".1cd") returned 4
	[0060.191] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0060.191] lstrlenW (lpString=".jpg") returned 4
	[0060.191] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.191] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.191] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.191] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.523] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=60684) returned 1
	[0060.523] CloseHandle (hObject=0x340) returned 1
	[0060.525] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80
	[0060.526] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.526] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.526] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.526] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.526] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.526] GetLastError () returned 0x0
	[0060.526] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xed0c, lpOverlapped=0x0) returned 1
	[0060.529] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xed10, lpOverlapped=0x0) returned 1
	[0060.531] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.531] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.531] SetEndOfFile (hFile=0x318) returned 1
	[0060.531] CloseHandle (hObject=0x318) returned 1
	[0060.533] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.533] SetEndOfFile (hFile=0x33c) returned 1
	[0060.534] CloseHandle (hObject=0x33c) returned 1
	[0060.534] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.535] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1
	[0060.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.535] lstrlenW (lpString=".doc") returned 4
	[0060.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.535] lstrlenW (lpString=".docx") returned 5
	[0060.535] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.535] lstrlenW (lpString=".pdf") returned 4
	[0060.535] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.535] lstrlenW (lpString=".xls") returned 4
	[0060.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.535] lstrlenW (lpString=".xlsx") returned 5
	[0060.535] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.535] lstrlenW (lpString=".ppt") returned 4
	[0060.535] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.535] lstrlenW (lpString=".zip") returned 4
	[0060.535] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.535] lstrlenW (lpString=".rar") returned 4
	[0060.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.535] lstrlenW (lpString=".bz2") returned 4
	[0060.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.536] lstrlenW (lpString=".7z") returned 3
	[0060.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.536] lstrlenW (lpString=".dbf") returned 4
	[0060.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.536] lstrlenW (lpString=".1cd") returned 4
	[0060.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.536] lstrlenW (lpString=".jpg") returned 4
	[0060.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.536] lstrlenW (lpString=".doc") returned 4
	[0060.536] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.536] lstrlenW (lpString=".docx") returned 5
	[0060.536] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.536] lstrlenW (lpString=".pdf") returned 4
	[0060.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.536] lstrlenW (lpString=".xls") returned 4
	[0060.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.536] lstrlenW (lpString=".xlsx") returned 5
	[0060.537] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.537] lstrlenW (lpString=".ppt") returned 4
	[0060.537] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.537] lstrlenW (lpString=".zip") returned 4
	[0060.537] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.537] lstrlenW (lpString=".rar") returned 4
	[0060.537] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.537] lstrlenW (lpString=".bz2") returned 4
	[0060.537] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.537] lstrlenW (lpString=".7z") returned 3
	[0060.537] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.537] lstrlenW (lpString=".dbf") returned 4
	[0060.537] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.537] lstrlenW (lpString=".1cd") returned 4
	[0060.537] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0060.537] lstrlenW (lpString=".jpg") returned 4
	[0060.537] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.537] lstrcmpiW (lpString1=".html", lpString2=".money") returned -1
	[0060.537] lstrlenW (lpString="DHtmlHeader.html") returned 16
	[0060.537] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.538] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=16118) returned 1
	[0060.538] CloseHandle (hObject=0x33c) returned 1
	[0060.538] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80
	[0060.538] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.538] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.538] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.538] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.538] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.538] GetLastError () returned 0x0
	[0060.538] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x3ef6, lpOverlapped=0x0) returned 1
	[0060.540] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3f00, lpOverlapped=0x0) returned 1
	[0060.541] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.541] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf4, lpOverlapped=0x0) returned 1
	[0060.541] SetEndOfFile (hFile=0x318) returned 1
	[0060.541] CloseHandle (hObject=0x318) returned 1
	[0060.543] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.543] SetEndOfFile (hFile=0x33c) returned 1
	[0060.544] CloseHandle (hObject=0x33c) returned 1
	[0060.544] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.544] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1
	[0060.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.544] lstrlenW (lpString=".doc") returned 4
	[0060.544] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0060.544] lstrlenW (lpString=".docx") returned 5
	[0060.544] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0060.544] lstrlenW (lpString=".pdf") returned 4
	[0060.544] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1
	[0060.544] lstrlenW (lpString=".xls") returned 4
	[0060.544] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1
	[0060.544] lstrlenW (lpString=".xlsx") returned 5
	[0060.544] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1
	[0060.545] lstrlenW (lpString=".ppt") returned 4
	[0060.545] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1
	[0060.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.545] lstrlenW (lpString=".zip") returned 4
	[0060.545] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1
	[0060.545] lstrlenW (lpString=".rar") returned 4
	[0060.545] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1
	[0060.545] lstrlenW (lpString=".bz2") returned 4
	[0060.545] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0060.545] lstrlenW (lpString=".7z") returned 3
	[0060.545] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0060.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.545] lstrlenW (lpString=".dbf") returned 4
	[0060.545] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0060.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.545] lstrlenW (lpString=".1cd") returned 4
	[0060.545] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0060.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.545] lstrlenW (lpString=".jpg") returned 4
	[0060.545] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1
	[0060.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.545] lstrlenW (lpString=".doc") returned 4
	[0060.545] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0060.545] lstrlenW (lpString=".docx") returned 5
	[0060.546] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0060.546] lstrlenW (lpString=".pdf") returned 4
	[0060.546] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1
	[0060.546] lstrlenW (lpString=".xls") returned 4
	[0060.546] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1
	[0060.546] lstrlenW (lpString=".xlsx") returned 5
	[0060.546] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1
	[0060.546] lstrlenW (lpString=".ppt") returned 4
	[0060.546] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1
	[0060.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.546] lstrlenW (lpString=".zip") returned 4
	[0060.546] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1
	[0060.546] lstrlenW (lpString=".rar") returned 4
	[0060.546] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1
	[0060.546] lstrlenW (lpString=".bz2") returned 4
	[0060.546] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0060.546] lstrlenW (lpString=".7z") returned 3
	[0060.546] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0060.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.546] lstrlenW (lpString=".dbf") returned 4
	[0060.546] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0060.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.546] lstrlenW (lpString=".1cd") returned 4
	[0060.547] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0060.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0060.547] lstrlenW (lpString=".jpg") returned 4
	[0060.547] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1
	[0060.547] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.547] lstrlenW (lpString="Parameterinfo.xml") returned 17
	[0060.547] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.547] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=93314) returned 1
	[0060.547] CloseHandle (hObject=0x33c) returned 1
	[0060.547] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80
	[0060.547] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.547] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.548] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.548] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.548] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.548] GetLastError () returned 0x0
	[0060.548] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x16c82, lpOverlapped=0x0) returned 1
	[0060.551] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x16c90, lpOverlapped=0x0) returned 1
	[0060.554] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.554] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.554] SetEndOfFile (hFile=0x318) returned 1
	[0060.554] CloseHandle (hObject=0x318) returned 1
	[0060.556] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.556] SetEndOfFile (hFile=0x33c) returned 1
	[0060.558] CloseHandle (hObject=0x33c) returned 1
	[0060.558] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.558] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1
	[0060.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.558] lstrlenW (lpString=".doc") returned 4
	[0060.558] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.558] lstrlenW (lpString=".docx") returned 5
	[0060.558] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0060.559] lstrlenW (lpString=".pdf") returned 4
	[0060.559] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.559] lstrlenW (lpString=".xls") returned 4
	[0060.559] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.559] lstrlenW (lpString=".xlsx") returned 5
	[0060.559] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0060.559] lstrlenW (lpString=".ppt") returned 4
	[0060.559] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.559] lstrlenW (lpString=".zip") returned 4
	[0060.559] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.559] lstrlenW (lpString=".rar") returned 4
	[0060.559] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.559] lstrlenW (lpString=".bz2") returned 4
	[0060.559] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.559] lstrlenW (lpString=".7z") returned 3
	[0060.559] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.559] lstrlenW (lpString=".dbf") returned 4
	[0060.559] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.559] lstrlenW (lpString=".1cd") returned 4
	[0060.559] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.559] lstrlenW (lpString=".jpg") returned 4
	[0060.559] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.560] lstrlenW (lpString=".doc") returned 4
	[0060.560] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.560] lstrlenW (lpString=".docx") returned 5
	[0060.560] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0060.560] lstrlenW (lpString=".pdf") returned 4
	[0060.560] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.560] lstrlenW (lpString=".xls") returned 4
	[0060.560] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.560] lstrlenW (lpString=".xlsx") returned 5
	[0060.560] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0060.560] lstrlenW (lpString=".ppt") returned 4
	[0060.560] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.560] lstrlenW (lpString=".zip") returned 4
	[0060.560] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.560] lstrlenW (lpString=".rar") returned 4
	[0060.560] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.560] lstrlenW (lpString=".bz2") returned 4
	[0060.560] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.560] lstrlenW (lpString=".7z") returned 3
	[0060.560] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.560] lstrlenW (lpString=".dbf") returned 4
	[0060.560] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.561] lstrlenW (lpString=".1cd") returned 4
	[0060.561] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0060.561] lstrlenW (lpString=".jpg") returned 4
	[0060.561] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.561] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0060.561] lstrlenW (lpString="UiInfo.xml") returned 10
	[0060.561] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.561] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=39050) returned 1
	[0060.561] CloseHandle (hObject=0x33c) returned 1
	[0060.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80
	[0060.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.561] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.561] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.562] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.562] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0061.090] GetLastError () returned 0x0
	[0061.090] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x988a, lpOverlapped=0x0) returned 1
	[0061.092] WriteFile (in: hFile=0x378, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x9890, lpOverlapped=0x0) returned 1
	[0061.093] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.093] WriteFile (in: hFile=0x378, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xe8, lpOverlapped=0x0) returned 1
	[0061.093] SetEndOfFile (hFile=0x378) returned 1
	[0061.093] CloseHandle (hObject=0x378) returned 1
	[0061.095] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.095] SetEndOfFile (hFile=0x33c) returned 1
	[0061.096] CloseHandle (hObject=0x33c) returned 1
	[0061.096] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.096] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1
	[0061.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.097] lstrlenW (lpString=".doc") returned 4
	[0061.097] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.097] lstrlenW (lpString=".docx") returned 5
	[0061.097] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0061.097] lstrlenW (lpString=".pdf") returned 4
	[0061.097] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.097] lstrlenW (lpString=".xls") returned 4
	[0061.097] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.097] lstrlenW (lpString=".xlsx") returned 5
	[0061.097] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0061.097] lstrlenW (lpString=".ppt") returned 4
	[0061.097] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.097] lstrlenW (lpString=".zip") returned 4
	[0061.097] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.097] lstrlenW (lpString=".rar") returned 4
	[0061.097] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.097] lstrlenW (lpString=".bz2") returned 4
	[0061.097] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.097] lstrlenW (lpString=".7z") returned 3
	[0061.097] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.097] lstrlenW (lpString=".dbf") returned 4
	[0061.097] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.098] lstrlenW (lpString=".1cd") returned 4
	[0061.098] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.098] lstrlenW (lpString=".jpg") returned 4
	[0061.098] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.098] lstrlenW (lpString=".doc") returned 4
	[0061.098] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.098] lstrlenW (lpString=".docx") returned 5
	[0061.098] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0061.098] lstrlenW (lpString=".pdf") returned 4
	[0061.098] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.098] lstrlenW (lpString=".xls") returned 4
	[0061.098] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.098] lstrlenW (lpString=".xlsx") returned 5
	[0061.098] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0061.098] lstrlenW (lpString=".ppt") returned 4
	[0061.098] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.098] lstrlenW (lpString=".zip") returned 4
	[0061.098] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.098] lstrlenW (lpString=".rar") returned 4
	[0061.098] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.098] lstrlenW (lpString=".bz2") returned 4
	[0061.098] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.099] lstrlenW (lpString=".7z") returned 3
	[0061.099] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.099] lstrlenW (lpString=".dbf") returned 4
	[0061.099] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.099] lstrlenW (lpString=".1cd") returned 4
	[0061.099] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0061.099] lstrlenW (lpString=".jpg") returned 4
	[0061.099] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.099] lstrcmpiW (lpString1=".p7b", lpString2=".money") returned 1
	[0061.099] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24
	[0061.099] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.102] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4662) returned 1
	[0061.102] CloseHandle (hObject=0x33c) returned 1
	[0061.102] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20
	[0061.102] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.102] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.102] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.102] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.102] lstrlenW (lpString=".doc") returned 4
	[0061.102] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0061.102] lstrlenW (lpString=".docx") returned 5
	[0061.102] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0061.102] lstrlenW (lpString=".pdf") returned 4
	[0061.102] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0061.102] lstrlenW (lpString=".xls") returned 4
	[0061.102] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0061.102] lstrlenW (lpString=".xlsx") returned 5
	[0061.102] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0061.102] lstrlenW (lpString=".ppt") returned 4
	[0061.102] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0061.102] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.103] lstrlenW (lpString=".zip") returned 4
	[0061.103] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0061.103] lstrlenW (lpString=".rar") returned 4
	[0061.103] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0061.103] lstrlenW (lpString=".bz2") returned 4
	[0061.103] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0061.103] lstrlenW (lpString=".7z") returned 3
	[0061.103] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0061.103] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.103] lstrlenW (lpString=".dbf") returned 4
	[0061.103] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0061.103] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.103] lstrlenW (lpString=".1cd") returned 4
	[0061.103] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0061.103] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.103] lstrlenW (lpString=".jpg") returned 4
	[0061.103] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0061.103] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.103] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.103] lstrlenW (lpString=".doc") returned 4
	[0061.103] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0061.103] lstrlenW (lpString=".docx") returned 5
	[0061.103] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0061.103] lstrlenW (lpString=".pdf") returned 4
	[0061.103] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0061.104] lstrlenW (lpString=".xls") returned 4
	[0061.104] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0061.104] lstrlenW (lpString=".xlsx") returned 5
	[0061.104] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0061.104] lstrlenW (lpString=".ppt") returned 4
	[0061.104] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0061.104] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.104] lstrlenW (lpString=".zip") returned 4
	[0061.104] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0061.104] lstrlenW (lpString=".rar") returned 4
	[0061.104] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0061.104] lstrlenW (lpString=".bz2") returned 4
	[0061.104] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0061.104] lstrlenW (lpString=".7z") returned 3
	[0061.104] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0061.104] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.104] lstrlenW (lpString=".dbf") returned 4
	[0061.104] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0061.104] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.104] lstrlenW (lpString=".1cd") returned 4
	[0061.104] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0061.104] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0061.104] lstrlenW (lpString=".jpg") returned 4
	[0061.104] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0061.105] lstrcmpiW (lpString1=".BAK", lpString2=".money") returned -1
	[0061.105] lstrlenW (lpString="BOOTSECT.BAK") returned 12
	[0061.105] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.105] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=8192) returned 1
	[0061.105] CloseHandle (hObject=0x33c) returned 1
	[0061.105] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27
	[0061.105] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\bootsect.bak.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.105] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1
	[0061.106] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.106] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.106] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.106] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\bootsect.bak.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0061.107] GetLastError () returned 0x0
	[0061.107] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x2000, lpOverlapped=0x0) returned 1
	[0061.108] WriteFile (in: hFile=0x378, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x2010, lpOverlapped=0x0) returned 1
	[0061.109] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.109] WriteFile (in: hFile=0x378, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0061.110] SetEndOfFile (hFile=0x378) returned 1
	[0061.110] CloseHandle (hObject=0x378) returned 1
	[0061.110] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.110] SetEndOfFile (hFile=0x33c) returned 1
	[0061.111] CloseHandle (hObject=0x33c) returned 1
	[0061.111] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x27) returned 1
	[0061.112] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1
	[0061.112] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.112] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.112] lstrlenW (lpString=".doc") returned 4
	[0061.112] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0061.112] lstrlenW (lpString=".docx") returned 5
	[0061.112] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0061.112] lstrlenW (lpString=".pdf") returned 4
	[0061.112] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0061.112] lstrlenW (lpString=".xls") returned 4
	[0061.112] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0061.112] lstrlenW (lpString=".xlsx") returned 5
	[0061.112] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0061.112] lstrlenW (lpString=".ppt") returned 4
	[0061.112] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0061.112] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.112] lstrlenW (lpString=".zip") returned 4
	[0061.112] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0061.112] lstrlenW (lpString=".rar") returned 4
	[0061.112] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0061.112] lstrlenW (lpString=".bz2") returned 4
	[0061.112] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0061.113] lstrlenW (lpString=".7z") returned 3
	[0061.113] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0061.113] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.113] lstrlenW (lpString=".dbf") returned 4
	[0061.113] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0061.113] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.113] lstrlenW (lpString=".1cd") returned 4
	[0061.113] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0061.113] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.113] lstrlenW (lpString=".jpg") returned 4
	[0061.113] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0061.113] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.113] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.113] lstrlenW (lpString=".doc") returned 4
	[0061.113] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0061.113] lstrlenW (lpString=".docx") returned 5
	[0061.113] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0061.113] lstrlenW (lpString=".pdf") returned 4
	[0061.113] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0061.113] lstrlenW (lpString=".xls") returned 4
	[0061.113] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0061.113] lstrlenW (lpString=".xlsx") returned 5
	[0061.113] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0061.113] lstrlenW (lpString=".ppt") returned 4
	[0061.113] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0061.113] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.114] lstrlenW (lpString=".zip") returned 4
	[0061.114] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0061.114] lstrlenW (lpString=".rar") returned 4
	[0061.114] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0061.114] lstrlenW (lpString=".bz2") returned 4
	[0061.114] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0061.114] lstrlenW (lpString=".7z") returned 3
	[0061.114] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0061.114] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.114] lstrlenW (lpString=".dbf") returned 4
	[0061.114] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0061.114] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.114] lstrlenW (lpString=".1cd") returned 4
	[0061.114] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0061.114] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0061.114] lstrlenW (lpString=".jpg") returned 4
	[0061.114] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0061.114] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.114] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22
	[0061.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.115] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4136) returned 1
	[0061.115] CloseHandle (hObject=0x33c) returned 1
	[0061.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20
	[0061.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.115] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.115] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0061.116] GetLastError () returned 0x0
	[0061.116] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1028, lpOverlapped=0x0) returned 1
	[0061.117] WriteFile (in: hFile=0x378, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1030, lpOverlapped=0x0) returned 1
	[0061.118] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.118] WriteFile (in: hFile=0x378, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x100, lpOverlapped=0x0) returned 1
	[0061.119] SetEndOfFile (hFile=0x378) returned 1
	[0061.119] CloseHandle (hObject=0x378) returned 1
	[0061.120] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.120] SetEndOfFile (hFile=0x33c) returned 1
	[0061.154] CloseHandle (hObject=0x33c) returned 1
	[0061.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0061.155] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1
	[0061.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.155] lstrlenW (lpString=".doc") returned 4
	[0061.155] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.155] lstrlenW (lpString=".docx") returned 5
	[0061.155] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0061.155] lstrlenW (lpString=".pdf") returned 4
	[0061.155] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.155] lstrlenW (lpString=".xls") returned 4
	[0061.155] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.156] lstrlenW (lpString=".xlsx") returned 5
	[0061.156] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0061.156] lstrlenW (lpString=".ppt") returned 4
	[0061.156] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.156] lstrlenW (lpString=".zip") returned 4
	[0061.156] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.156] lstrlenW (lpString=".rar") returned 4
	[0061.156] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.156] lstrlenW (lpString=".bz2") returned 4
	[0061.156] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.156] lstrlenW (lpString=".7z") returned 3
	[0061.156] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.156] lstrlenW (lpString=".dbf") returned 4
	[0061.156] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.156] lstrlenW (lpString=".1cd") returned 4
	[0061.156] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.156] lstrlenW (lpString=".jpg") returned 4
	[0061.156] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.156] lstrlenW (lpString=".doc") returned 4
	[0061.156] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.156] lstrlenW (lpString=".docx") returned 5
	[0061.156] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0061.156] lstrlenW (lpString=".pdf") returned 4
	[0061.157] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.157] lstrlenW (lpString=".xls") returned 4
	[0061.157] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.157] lstrlenW (lpString=".xlsx") returned 5
	[0061.157] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0061.157] lstrlenW (lpString=".ppt") returned 4
	[0061.157] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.157] lstrlenW (lpString=".zip") returned 4
	[0061.157] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.157] lstrlenW (lpString=".rar") returned 4
	[0061.157] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.157] lstrlenW (lpString=".bz2") returned 4
	[0061.157] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.157] lstrlenW (lpString=".7z") returned 3
	[0061.157] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.157] lstrlenW (lpString=".dbf") returned 4
	[0061.157] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.157] lstrlenW (lpString=".1cd") returned 4
	[0061.157] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0061.157] lstrlenW (lpString=".jpg") returned 4
	[0061.157] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.158] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0061.158] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24
	[0061.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.609] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4782) returned 1
	[0061.609] CloseHandle (hObject=0x374) returned 1
	[0061.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20
	[0061.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.610] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.610] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0061.610] GetLastError () returned 0x0
	[0061.610] ReadFile (in: hFile=0x374, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x12ae, lpOverlapped=0x0) returned 1
	[0061.612] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x12b0, lpOverlapped=0x0) returned 1
	[0061.613] ReadFile (in: hFile=0x374, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.613] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x104, lpOverlapped=0x0) returned 1
	[0061.613] SetEndOfFile (hFile=0x34c) returned 1
	[0061.613] CloseHandle (hObject=0x34c) returned 1
	[0061.614] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.614] SetEndOfFile (hFile=0x374) returned 1
	[0061.615] CloseHandle (hObject=0x374) returned 1
	[0061.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0061.615] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1
	[0061.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.616] lstrlenW (lpString=".doc") returned 4
	[0061.616] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.616] lstrlenW (lpString=".docx") returned 5
	[0061.616] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0061.616] lstrlenW (lpString=".pdf") returned 4
	[0061.616] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.616] lstrlenW (lpString=".xls") returned 4
	[0061.616] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.616] lstrlenW (lpString=".xlsx") returned 5
	[0061.616] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0061.616] lstrlenW (lpString=".ppt") returned 4
	[0061.616] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.616] lstrlenW (lpString=".zip") returned 4
	[0061.616] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.616] lstrlenW (lpString=".rar") returned 4
	[0061.616] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.616] lstrlenW (lpString=".bz2") returned 4
	[0061.616] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.616] lstrlenW (lpString=".7z") returned 3
	[0061.616] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.616] lstrlenW (lpString=".dbf") returned 4
	[0061.617] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.617] lstrlenW (lpString=".1cd") returned 4
	[0061.617] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.617] lstrlenW (lpString=".jpg") returned 4
	[0061.617] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.617] lstrlenW (lpString=".doc") returned 4
	[0061.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.617] lstrlenW (lpString=".docx") returned 5
	[0061.617] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0061.617] lstrlenW (lpString=".pdf") returned 4
	[0061.617] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.617] lstrlenW (lpString=".xls") returned 4
	[0061.617] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.617] lstrlenW (lpString=".xlsx") returned 5
	[0061.617] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0061.617] lstrlenW (lpString=".ppt") returned 4
	[0061.617] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.617] lstrlenW (lpString=".zip") returned 4
	[0061.617] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.617] lstrlenW (lpString=".rar") returned 4
	[0061.618] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.618] lstrlenW (lpString=".bz2") returned 4
	[0061.618] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.618] lstrlenW (lpString=".7z") returned 3
	[0061.618] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.618] lstrlenW (lpString=".dbf") returned 4
	[0061.618] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.618] lstrlenW (lpString=".1cd") returned 4
	[0061.618] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0061.618] lstrlenW (lpString=".jpg") returned 4
	[0061.618] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.618] lstrcmpiW (lpString1=".jpg", lpString2=".money") returned -1
	[0061.618] lstrlenW (lpString="Roses.jpg") returned 9
	[0061.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.631] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1920) returned 1
	[0061.631] CloseHandle (hObject=0x370) returned 1
	[0061.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20
	[0061.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.631] lstrlenW (lpString=".doc") returned 4
	[0061.631] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.631] lstrlenW (lpString=".docx") returned 5
	[0061.631] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0061.631] lstrlenW (lpString=".pdf") returned 4
	[0061.631] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.631] lstrlenW (lpString=".xls") returned 4
	[0061.631] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.631] lstrlenW (lpString=".xlsx") returned 5
	[0061.631] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0061.631] lstrlenW (lpString=".ppt") returned 4
	[0061.631] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.632] lstrlenW (lpString=".zip") returned 4
	[0061.632] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.632] lstrlenW (lpString=".rar") returned 4
	[0061.632] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.632] lstrlenW (lpString=".bz2") returned 4
	[0061.632] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.632] lstrlenW (lpString=".7z") returned 3
	[0061.632] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.632] lstrlenW (lpString=".dbf") returned 4
	[0061.632] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.632] lstrlenW (lpString=".1cd") returned 4
	[0061.632] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.632] lstrlenW (lpString=".jpg") returned 4
	[0061.632] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.632] lstrlenW (lpString=".doc") returned 4
	[0061.632] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.632] lstrlenW (lpString=".docx") returned 5
	[0061.632] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0061.633] lstrlenW (lpString=".pdf") returned 4
	[0061.633] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.633] lstrlenW (lpString=".xls") returned 4
	[0061.633] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.633] lstrlenW (lpString=".xlsx") returned 5
	[0061.633] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0061.633] lstrlenW (lpString=".ppt") returned 4
	[0061.633] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.633] lstrlenW (lpString=".zip") returned 4
	[0061.633] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.633] lstrlenW (lpString=".rar") returned 4
	[0061.633] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.633] lstrlenW (lpString=".bz2") returned 4
	[0061.633] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.633] lstrlenW (lpString=".7z") returned 3
	[0061.633] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.633] lstrlenW (lpString=".dbf") returned 4
	[0061.633] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.633] lstrlenW (lpString=".1cd") returned 4
	[0061.633] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0061.633] lstrlenW (lpString=".jpg") returned 4
	[0061.634] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.634] lstrcmpiW (lpString1=".htm", lpString2=".money") returned -1
	[0061.634] lstrlenW (lpString="Shades of Blue.htm") returned 18
	[0061.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.637] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=237) returned 1
	[0061.637] CloseHandle (hObject=0x370) returned 1
	[0061.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20
	[0061.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.637] lstrlenW (lpString=".doc") returned 4
	[0061.637] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.637] lstrlenW (lpString=".docx") returned 5
	[0061.637] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0061.637] lstrlenW (lpString=".pdf") returned 4
	[0061.637] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.637] lstrlenW (lpString=".xls") returned 4
	[0061.638] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.638] lstrlenW (lpString=".xlsx") returned 5
	[0061.638] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0061.638] lstrlenW (lpString=".ppt") returned 4
	[0061.638] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.638] lstrlenW (lpString=".zip") returned 4
	[0061.638] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.638] lstrlenW (lpString=".rar") returned 4
	[0061.638] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.638] lstrlenW (lpString=".bz2") returned 4
	[0061.638] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.638] lstrlenW (lpString=".7z") returned 3
	[0061.638] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.638] lstrlenW (lpString=".dbf") returned 4
	[0061.638] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.638] lstrlenW (lpString=".1cd") returned 4
	[0061.638] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.638] lstrlenW (lpString=".jpg") returned 4
	[0061.638] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.638] lstrlenW (lpString=".doc") returned 4
	[0061.639] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.639] lstrlenW (lpString=".docx") returned 5
	[0061.639] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0061.639] lstrlenW (lpString=".pdf") returned 4
	[0061.639] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.639] lstrlenW (lpString=".xls") returned 4
	[0061.639] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.639] lstrlenW (lpString=".xlsx") returned 5
	[0061.639] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0061.639] lstrlenW (lpString=".ppt") returned 4
	[0061.639] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.639] lstrlenW (lpString=".zip") returned 4
	[0061.639] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.639] lstrlenW (lpString=".rar") returned 4
	[0061.639] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.639] lstrlenW (lpString=".bz2") returned 4
	[0061.639] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.639] lstrlenW (lpString=".7z") returned 3
	[0061.639] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.639] lstrlenW (lpString=".dbf") returned 4
	[0061.639] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.639] lstrlenW (lpString=".1cd") returned 4
	[0061.640] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0061.640] lstrlenW (lpString=".jpg") returned 4
	[0061.640] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.640] lstrcmpiW (lpString1=".jpg", lpString2=".money") returned -1
	[0061.640] lstrlenW (lpString="ShadesOfBlue.jpg") returned 16
	[0061.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.641] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4734) returned 1
	[0061.641] CloseHandle (hObject=0x370) returned 1
	[0061.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20
	[0061.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.641] lstrlenW (lpString=".doc") returned 4
	[0061.641] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.641] lstrlenW (lpString=".docx") returned 5
	[0061.641] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1
	[0061.641] lstrlenW (lpString=".pdf") returned 4
	[0061.642] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.642] lstrlenW (lpString=".xls") returned 4
	[0061.642] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.642] lstrlenW (lpString=".xlsx") returned 5
	[0061.642] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1
	[0061.642] lstrlenW (lpString=".ppt") returned 4
	[0061.642] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.642] lstrlenW (lpString=".zip") returned 4
	[0061.642] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.642] lstrlenW (lpString=".rar") returned 4
	[0061.642] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.642] lstrlenW (lpString=".bz2") returned 4
	[0061.642] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.642] lstrlenW (lpString=".7z") returned 3
	[0061.642] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.642] lstrlenW (lpString=".dbf") returned 4
	[0061.642] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.642] lstrlenW (lpString=".1cd") returned 4
	[0061.643] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.643] lstrlenW (lpString=".jpg") returned 4
	[0061.643] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.643] lstrlenW (lpString=".doc") returned 4
	[0061.643] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.643] lstrlenW (lpString=".docx") returned 5
	[0061.643] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1
	[0061.643] lstrlenW (lpString=".pdf") returned 4
	[0061.643] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.643] lstrlenW (lpString=".xls") returned 4
	[0061.643] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.643] lstrlenW (lpString=".xlsx") returned 5
	[0061.643] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1
	[0061.643] lstrlenW (lpString=".ppt") returned 4
	[0061.643] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.643] lstrlenW (lpString=".zip") returned 4
	[0061.643] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.643] lstrlenW (lpString=".rar") returned 4
	[0061.643] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.644] lstrlenW (lpString=".bz2") returned 4
	[0061.644] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.644] lstrlenW (lpString=".7z") returned 3
	[0061.644] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.644] lstrlenW (lpString=".dbf") returned 4
	[0061.644] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.644] lstrlenW (lpString=".1cd") returned 4
	[0061.644] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74
	[0061.644] lstrlenW (lpString=".jpg") returned 4
	[0061.644] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.644] lstrcmpiW (lpString1=".htm", lpString2=".money") returned -1
	[0061.644] lstrlenW (lpString="Soft Blue.htm") returned 13
	[0061.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.645] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=232) returned 1
	[0061.645] CloseHandle (hObject=0x370) returned 1
	[0061.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20
	[0061.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.645] lstrlenW (lpString=".doc") returned 4
	[0061.645] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.645] lstrlenW (lpString=".docx") returned 5
	[0061.645] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0061.645] lstrlenW (lpString=".pdf") returned 4
	[0061.645] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.645] lstrlenW (lpString=".xls") returned 4
	[0061.645] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.646] lstrlenW (lpString=".xlsx") returned 5
	[0061.646] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0061.646] lstrlenW (lpString=".ppt") returned 4
	[0061.646] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.646] lstrlenW (lpString=".zip") returned 4
	[0061.646] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.646] lstrlenW (lpString=".rar") returned 4
	[0061.646] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.646] lstrlenW (lpString=".bz2") returned 4
	[0061.646] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.646] lstrlenW (lpString=".7z") returned 3
	[0061.646] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.646] lstrlenW (lpString=".dbf") returned 4
	[0061.646] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.646] lstrlenW (lpString=".1cd") returned 4
	[0061.646] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.646] lstrlenW (lpString=".jpg") returned 4
	[0061.646] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.647] lstrlenW (lpString=".doc") returned 4
	[0061.647] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.647] lstrlenW (lpString=".docx") returned 5
	[0061.647] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0061.647] lstrlenW (lpString=".pdf") returned 4
	[0061.647] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.647] lstrlenW (lpString=".xls") returned 4
	[0061.647] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.647] lstrlenW (lpString=".xlsx") returned 5
	[0061.647] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0061.647] lstrlenW (lpString=".ppt") returned 4
	[0061.647] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.647] lstrlenW (lpString=".zip") returned 4
	[0061.647] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.647] lstrlenW (lpString=".rar") returned 4
	[0061.647] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.647] lstrlenW (lpString=".bz2") returned 4
	[0061.647] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.647] lstrlenW (lpString=".7z") returned 3
	[0061.647] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.647] lstrlenW (lpString=".dbf") returned 4
	[0061.647] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.648] lstrlenW (lpString=".1cd") returned 4
	[0061.648] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0061.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71
	[0061.648] lstrlenW (lpString=".jpg") returned 4
	[0061.648] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0061.648] lstrcmpiW (lpString1=".jpg", lpString2=".money") returned -1
	[0061.648] lstrlenW (lpString="SoftBlue.jpg") returned 12
	[0061.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.649] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=10569) returned 1
	[0061.649] CloseHandle (hObject=0x374) returned 1
	[0061.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20
	[0061.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.649] lstrlenW (lpString=".doc") returned 4
	[0061.649] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.649] lstrlenW (lpString=".docx") returned 5
	[0061.649] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1
	[0061.649] lstrlenW (lpString=".pdf") returned 4
	[0061.649] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.650] lstrlenW (lpString=".xls") returned 4
	[0061.650] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.650] lstrlenW (lpString=".xlsx") returned 5
	[0061.650] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1
	[0061.650] lstrlenW (lpString=".ppt") returned 4
	[0061.650] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.650] lstrlenW (lpString=".zip") returned 4
	[0061.650] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.650] lstrlenW (lpString=".rar") returned 4
	[0061.650] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.650] lstrlenW (lpString=".bz2") returned 4
	[0061.650] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.650] lstrlenW (lpString=".7z") returned 3
	[0061.650] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.650] lstrlenW (lpString=".dbf") returned 4
	[0061.650] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.651] lstrlenW (lpString=".1cd") returned 4
	[0061.651] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.651] lstrlenW (lpString=".jpg") returned 4
	[0061.651] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.651] lstrlenW (lpString=".doc") returned 4
	[0061.651] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0061.651] lstrlenW (lpString=".docx") returned 5
	[0061.651] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1
	[0061.651] lstrlenW (lpString=".pdf") returned 4
	[0061.652] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0061.652] lstrlenW (lpString=".xls") returned 4
	[0061.652] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0061.653] lstrlenW (lpString=".xlsx") returned 5
	[0061.653] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1
	[0061.653] lstrlenW (lpString=".ppt") returned 4
	[0061.653] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0061.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.653] lstrlenW (lpString=".zip") returned 4
	[0061.653] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0061.653] lstrlenW (lpString=".rar") returned 4
	[0061.653] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0061.653] lstrlenW (lpString=".bz2") returned 4
	[0061.653] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0061.653] lstrlenW (lpString=".7z") returned 3
	[0061.653] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0061.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.653] lstrlenW (lpString=".dbf") returned 4
	[0061.653] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0061.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.653] lstrlenW (lpString=".1cd") returned 4
	[0061.653] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0061.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70
	[0061.653] lstrlenW (lpString=".jpg") returned 4
	[0061.654] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0061.654] lstrcmpiW (lpString1=".htm", lpString2=".money") returned -1
	[0061.654] lstrlenW (lpString="Stars.htm") returned 9
	[0061.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.655] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=230) returned 1
	[0061.655] CloseHandle (hObject=0x374) returned 1
	[0061.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20
	[0061.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0061.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67
	[0061.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67
	[0061.655] lstrlenW (lpString=".doc") returned 4
	[0061.655] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0061.655] lstrlenW (lpString=".docx") returned 5
	[0061.655] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0061.655] lstrlenW (lpString=".pdf") returned 4
	[0061.655] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0061.655] lstrlenW (lpString=".xls") returned 4
	[0061.656] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0061.656] lstrlenW (lpString=".xlsx") returned 5
	[0061.656] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0061.656] lstrlenW (lpString=".ppt") returned 4
	[0061.656] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0061.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67
	[0061.656] lstrlenW (lpString=".zip") returned 4
	[0061.656] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0061.656] lstrlenW (lpString=".rar") returned 4
	[0061.656] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0061.656] lstrlenW (lpString=".bz2") returned 4
	[0061.656] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0061.656] lstrlenW (lpString=".7z") returned 3
	[0061.656] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0061.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67
	[0061.656] lstrlenW (lpString=".dbf") returned 4
	[0061.656] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0061.971] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.972] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.972] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0061.972] GetLastError () returned 0x0
	[0061.972] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x58f, lpOverlapped=0x0) returned 1
	[0061.973] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x590, lpOverlapped=0x0) returned 1
	[0061.974] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.974] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xe8, lpOverlapped=0x0) returned 1
	[0061.974] SetEndOfFile (hFile=0x360) returned 1
	[0061.975] CloseHandle (hObject=0x360) returned 1
	[0061.975] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.975] SetEndOfFile (hFile=0x340) returned 1
	[0061.976] CloseHandle (hObject=0x340) returned 1
	[0061.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0061.977] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1
	[0061.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.977] lstrlenW (lpString=".doc") returned 4
	[0061.977] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0061.977] lstrlenW (lpString=".docx") returned 5
	[0061.977] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1
	[0061.977] lstrlenW (lpString=".pdf") returned 4
	[0061.977] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0061.977] lstrlenW (lpString=".xls") returned 4
	[0061.977] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0061.977] lstrlenW (lpString=".xlsx") returned 5
	[0061.977] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1
	[0061.977] lstrlenW (lpString=".ppt") returned 4
	[0061.977] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0061.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.978] lstrlenW (lpString=".zip") returned 4
	[0061.978] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0061.978] lstrlenW (lpString=".rar") returned 4
	[0061.978] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0061.978] lstrlenW (lpString=".bz2") returned 4
	[0061.978] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0061.978] lstrlenW (lpString=".7z") returned 3
	[0061.978] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0061.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.978] lstrlenW (lpString=".dbf") returned 4
	[0061.978] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0061.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.978] lstrlenW (lpString=".1cd") returned 4
	[0061.978] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0061.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.978] lstrlenW (lpString=".jpg") returned 4
	[0061.978] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0061.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.978] lstrlenW (lpString=".doc") returned 4
	[0061.978] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0061.978] lstrlenW (lpString=".docx") returned 5
	[0061.978] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1
	[0061.978] lstrlenW (lpString=".pdf") returned 4
	[0061.978] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0061.979] lstrlenW (lpString=".xls") returned 4
	[0061.979] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0061.979] lstrlenW (lpString=".xlsx") returned 5
	[0061.979] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1
	[0061.979] lstrlenW (lpString=".ppt") returned 4
	[0061.979] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0061.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.979] lstrlenW (lpString=".zip") returned 4
	[0061.979] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0061.979] lstrlenW (lpString=".rar") returned 4
	[0061.979] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0061.979] lstrlenW (lpString=".bz2") returned 4
	[0061.979] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0061.979] lstrlenW (lpString=".7z") returned 3
	[0061.979] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0061.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.979] lstrlenW (lpString=".dbf") returned 4
	[0061.979] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0061.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.979] lstrlenW (lpString=".1cd") returned 4
	[0061.979] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0061.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0061.980] lstrlenW (lpString=".jpg") returned 4
	[0061.980] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0061.980] lstrcmpiW (lpString1=".zip", lpString2=".money") returned 1
	[0061.980] lstrlenW (lpString="ffjcext.zip") returned 11
	[0061.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0061.981] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=14156) returned 1
	[0061.981] CloseHandle (hObject=0x340) returned 1
	[0061.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20
	[0061.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.982] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0061.982] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.982] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.982] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0061.983] GetLastError () returned 0x0
	[0061.983] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x374c, lpOverlapped=0x0) returned 1
	[0061.985] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3750, lpOverlapped=0x0) returned 1
	[0061.986] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.986] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.987] SetEndOfFile (hFile=0x360) returned 1
	[0061.987] CloseHandle (hObject=0x360) returned 1
	[0061.988] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.988] SetEndOfFile (hFile=0x340) returned 1
	[0061.989] CloseHandle (hObject=0x340) returned 1
	[0061.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0061.990] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1
	[0061.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0061.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0061.990] lstrlenW (lpString=".doc") returned 4
	[0061.990] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1
	[0061.990] lstrlenW (lpString=".docx") returned 5
	[0061.990] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1
	[0061.990] lstrlenW (lpString=".pdf") returned 4
	[0061.990] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1
	[0061.990] lstrlenW (lpString=".xls") returned 4
	[0061.990] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1
	[0061.990] lstrlenW (lpString=".xlsx") returned 5
	[0061.990] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1
	[0061.990] lstrlenW (lpString=".ppt") returned 4
	[0061.990] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1
	[0061.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0061.990] lstrlenW (lpString=".zip") returned 4
	[0061.990] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0
	[0061.991] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0061.991] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0061.991] lstrlenW (lpString=".doc") returned 4
	[0061.991] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1
	[0061.991] lstrlenW (lpString=".docx") returned 5
	[0061.991] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1
	[0061.991] lstrlenW (lpString=".pdf") returned 4
	[0061.991] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1
	[0061.991] lstrlenW (lpString=".xls") returned 4
	[0061.991] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1
	[0061.991] lstrlenW (lpString=".xlsx") returned 5
	[0061.991] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1
	[0061.991] lstrlenW (lpString=".ppt") returned 4
	[0061.991] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1
	[0061.991] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0061.991] lstrlenW (lpString=".zip") returned 4
	[0061.991] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0
	[0061.991] lstrcmpiW (lpString1=".gif", lpString2=".money") returned -1
	[0061.991] lstrlenW (lpString="splash@2x.gif") returned 13
	[0061.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0061.992] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=15276) returned 1
	[0061.992] CloseHandle (hObject=0x340) returned 1
	[0061.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20
	[0061.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.993] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0061.993] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.993] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.993] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0061.994] GetLastError () returned 0x0
	[0061.994] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x3bac, lpOverlapped=0x0) returned 1
	[0061.998] WriteFile (in: hFile=0x350, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3bb0, lpOverlapped=0x0) returned 1
	[0061.999] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.999] WriteFile (in: hFile=0x350, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xee, lpOverlapped=0x0) returned 1
	[0061.999] SetEndOfFile (hFile=0x350) returned 1
	[0062.000] CloseHandle (hObject=0x350) returned 1
	[0062.001] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.001] SetEndOfFile (hFile=0x340) returned 1
	[0062.002] CloseHandle (hObject=0x340) returned 1
	[0062.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.003] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1
	[0062.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.003] lstrlenW (lpString=".doc") returned 4
	[0062.003] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.003] lstrlenW (lpString=".docx") returned 5
	[0062.003] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1
	[0062.003] lstrlenW (lpString=".pdf") returned 4
	[0062.003] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.003] lstrlenW (lpString=".xls") returned 4
	[0062.003] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.003] lstrlenW (lpString=".xlsx") returned 5
	[0062.003] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1
	[0062.003] lstrlenW (lpString=".ppt") returned 4
	[0062.003] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.004] lstrlenW (lpString=".zip") returned 4
	[0062.004] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.004] lstrlenW (lpString=".rar") returned 4
	[0062.004] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.004] lstrlenW (lpString=".bz2") returned 4
	[0062.004] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.004] lstrlenW (lpString=".7z") returned 3
	[0062.004] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.004] lstrlenW (lpString=".dbf") returned 4
	[0062.004] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.004] lstrlenW (lpString=".1cd") returned 4
	[0062.004] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.004] lstrlenW (lpString=".jpg") returned 4
	[0062.004] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.004] lstrlenW (lpString=".doc") returned 4
	[0062.004] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.005] lstrlenW (lpString=".docx") returned 5
	[0062.005] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1
	[0062.005] lstrlenW (lpString=".pdf") returned 4
	[0062.005] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.005] lstrlenW (lpString=".xls") returned 4
	[0062.005] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.005] lstrlenW (lpString=".xlsx") returned 5
	[0062.005] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1
	[0062.005] lstrlenW (lpString=".ppt") returned 4
	[0062.005] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.005] lstrlenW (lpString=".zip") returned 4
	[0062.005] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.005] lstrlenW (lpString=".rar") returned 4
	[0062.005] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.005] lstrlenW (lpString=".bz2") returned 4
	[0062.005] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.005] lstrlenW (lpString=".7z") returned 3
	[0062.005] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.005] lstrlenW (lpString=".dbf") returned 4
	[0062.005] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.005] lstrlenW (lpString=".1cd") returned 4
	[0062.005] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0062.006] lstrlenW (lpString=".jpg") returned 4
	[0062.006] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.006] lstrcmpiW (lpString1=".gif", lpString2=".money") returned -1
	[0062.006] lstrlenW (lpString="splash_11-lic.gif") returned 17
	[0062.006] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.006] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=7805) returned 1
	[0062.006] CloseHandle (hObject=0x340) returned 1
	[0062.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20
	[0062.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.007] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.007] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.007] GetLastError () returned 0x0
	[0062.007] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1e7d, lpOverlapped=0x0) returned 1
	[0062.378] WriteFile (in: hFile=0x350, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1e80, lpOverlapped=0x0) returned 1
	[0062.380] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.380] WriteFile (in: hFile=0x350, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.380] SetEndOfFile (hFile=0x350) returned 1
	[0062.384] CloseHandle (hObject=0x350) returned 1
	[0062.385] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.385] SetEndOfFile (hFile=0x340) returned 1
	[0062.386] CloseHandle (hObject=0x340) returned 1
	[0062.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.386] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1
	[0062.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.387] lstrlenW (lpString=".doc") returned 4
	[0062.387] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.387] lstrlenW (lpString=".docx") returned 5
	[0062.387] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0062.387] lstrlenW (lpString=".pdf") returned 4
	[0062.387] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.387] lstrlenW (lpString=".xls") returned 4
	[0062.387] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.387] lstrlenW (lpString=".xlsx") returned 5
	[0062.387] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0062.387] lstrlenW (lpString=".ppt") returned 4
	[0062.387] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.387] lstrlenW (lpString=".zip") returned 4
	[0062.387] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.387] lstrlenW (lpString=".rar") returned 4
	[0062.388] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.388] lstrlenW (lpString=".bz2") returned 4
	[0062.388] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.388] lstrlenW (lpString=".7z") returned 3
	[0062.388] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.388] lstrlenW (lpString=".dbf") returned 4
	[0062.388] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.388] lstrlenW (lpString=".1cd") returned 4
	[0062.388] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.388] lstrlenW (lpString=".jpg") returned 4
	[0062.388] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.388] lstrlenW (lpString=".doc") returned 4
	[0062.388] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.389] lstrlenW (lpString=".docx") returned 5
	[0062.389] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0062.389] lstrlenW (lpString=".pdf") returned 4
	[0062.389] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.389] lstrlenW (lpString=".xls") returned 4
	[0062.389] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.389] lstrlenW (lpString=".xlsx") returned 5
	[0062.389] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0062.389] lstrlenW (lpString=".ppt") returned 4
	[0062.389] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.389] lstrlenW (lpString=".zip") returned 4
	[0062.389] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.389] lstrlenW (lpString=".rar") returned 4
	[0062.389] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.389] lstrlenW (lpString=".bz2") returned 4
	[0062.389] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.390] lstrlenW (lpString=".7z") returned 3
	[0062.390] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.390] lstrlenW (lpString=".dbf") returned 4
	[0062.390] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.390] lstrlenW (lpString=".1cd") returned 4
	[0062.390] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0062.390] lstrlenW (lpString=".jpg") returned 4
	[0062.390] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.390] lstrcmpiW (lpString1=".gif", lpString2=".money") returned -1
	[0062.390] lstrlenW (lpString="win32_MoveNoDrop32x32.gif") returned 25
	[0062.390] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.391] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=153) returned 1
	[0062.391] CloseHandle (hObject=0x340) returned 1
	[0062.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20
	[0062.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.391] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.391] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.391] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.392] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.392] GetLastError () returned 0x0
	[0062.392] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x99, lpOverlapped=0x0) returned 1
	[0062.393] WriteFile (in: hFile=0x350, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xa0, lpOverlapped=0x0) returned 1
	[0062.394] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.394] WriteFile (in: hFile=0x350, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x106, lpOverlapped=0x0) returned 1
	[0062.394] SetEndOfFile (hFile=0x350) returned 1
	[0062.394] CloseHandle (hObject=0x350) returned 1
	[0062.396] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.396] SetEndOfFile (hFile=0x340) returned 1
	[0062.397] CloseHandle (hObject=0x340) returned 1
	[0062.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.398] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1
	[0062.398] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.398] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.398] lstrlenW (lpString=".doc") returned 4
	[0062.398] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.398] lstrlenW (lpString=".docx") returned 5
	[0062.398] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.398] lstrlenW (lpString=".pdf") returned 4
	[0062.398] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.398] lstrlenW (lpString=".xls") returned 4
	[0062.398] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.398] lstrlenW (lpString=".xlsx") returned 5
	[0062.398] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.398] lstrlenW (lpString=".ppt") returned 4
	[0062.398] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.399] lstrlenW (lpString=".zip") returned 4
	[0062.399] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.399] lstrlenW (lpString=".rar") returned 4
	[0062.399] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.399] lstrlenW (lpString=".bz2") returned 4
	[0062.399] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.399] lstrlenW (lpString=".7z") returned 3
	[0062.399] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.399] lstrlenW (lpString=".dbf") returned 4
	[0062.399] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.399] lstrlenW (lpString=".1cd") returned 4
	[0062.399] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.399] lstrlenW (lpString=".jpg") returned 4
	[0062.399] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.400] lstrlenW (lpString=".doc") returned 4
	[0062.400] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0062.400] lstrlenW (lpString=".docx") returned 5
	[0062.400] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0062.400] lstrlenW (lpString=".pdf") returned 4
	[0062.400] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0062.400] lstrlenW (lpString=".xls") returned 4
	[0062.400] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0062.400] lstrlenW (lpString=".xlsx") returned 5
	[0062.400] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0062.400] lstrlenW (lpString=".ppt") returned 4
	[0062.400] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0062.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.400] lstrlenW (lpString=".zip") returned 4
	[0062.400] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0062.400] lstrlenW (lpString=".rar") returned 4
	[0062.400] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0062.400] lstrlenW (lpString=".bz2") returned 4
	[0062.400] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0062.400] lstrlenW (lpString=".7z") returned 3
	[0062.400] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0062.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.401] lstrlenW (lpString=".dbf") returned 4
	[0062.401] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0062.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.401] lstrlenW (lpString=".1cd") returned 4
	[0062.401] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0062.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0062.401] lstrlenW (lpString=".jpg") returned 4
	[0062.401] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0062.401] lstrcmpiW (lpString1=".txt", lpString2=".money") returned 1
	[0062.401] lstrlenW (lpString="jvm.hprof.txt") returned 13
	[0062.401] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.402] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4226) returned 1
	[0062.402] CloseHandle (hObject=0x340) returned 1
	[0062.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20
	[0062.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.402] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.402] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.402] GetLastError () returned 0x0
	[0062.403] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1082, lpOverlapped=0x0) returned 1
	[0062.404] WriteFile (in: hFile=0x350, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1090, lpOverlapped=0x0) returned 1
	[0062.405] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.405] WriteFile (in: hFile=0x350, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xee, lpOverlapped=0x0) returned 1
	[0062.405] SetEndOfFile (hFile=0x350) returned 1
	[0062.406] CloseHandle (hObject=0x350) returned 1
	[0062.406] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.406] SetEndOfFile (hFile=0x340) returned 1
	[0062.407] CloseHandle (hObject=0x340) returned 1
	[0062.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0062.408] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1
	[0062.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.408] lstrlenW (lpString=".doc") returned 4
	[0062.408] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0062.408] lstrlenW (lpString=".docx") returned 5
	[0062.408] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1
	[0062.408] lstrlenW (lpString=".pdf") returned 4
	[0062.408] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0062.408] lstrlenW (lpString=".xls") returned 4
	[0062.408] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0062.408] lstrlenW (lpString=".xlsx") returned 5
	[0062.409] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1
	[0062.409] lstrlenW (lpString=".ppt") returned 4
	[0062.409] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0062.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.409] lstrlenW (lpString=".zip") returned 4
	[0062.409] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0062.409] lstrlenW (lpString=".rar") returned 4
	[0062.409] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0062.409] lstrlenW (lpString=".bz2") returned 4
	[0062.409] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0062.409] lstrlenW (lpString=".7z") returned 3
	[0062.409] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0062.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.409] lstrlenW (lpString=".dbf") returned 4
	[0062.409] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0062.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.409] lstrlenW (lpString=".1cd") returned 4
	[0062.409] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0062.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.409] lstrlenW (lpString=".jpg") returned 4
	[0062.409] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0062.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.409] lstrlenW (lpString=".doc") returned 4
	[0062.410] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0062.410] lstrlenW (lpString=".docx") returned 5
	[0062.410] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1
	[0062.410] lstrlenW (lpString=".pdf") returned 4
	[0062.410] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0062.410] lstrlenW (lpString=".xls") returned 4
	[0062.410] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0062.410] lstrlenW (lpString=".xlsx") returned 5
	[0062.410] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1
	[0062.410] lstrlenW (lpString=".ppt") returned 4
	[0062.410] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0062.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.410] lstrlenW (lpString=".zip") returned 4
	[0062.410] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0062.410] lstrlenW (lpString=".rar") returned 4
	[0062.410] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0062.410] lstrlenW (lpString=".bz2") returned 4
	[0062.410] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0062.410] lstrlenW (lpString=".7z") returned 3
	[0062.410] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0062.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.410] lstrlenW (lpString=".dbf") returned 4
	[0062.410] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0062.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.410] lstrlenW (lpString=".1cd") returned 4
	[0062.410] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0062.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0062.411] lstrlenW (lpString=".jpg") returned 4
	[0062.411] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0062.411] Sleep (dwMilliseconds=0x64) 
	[0062.990] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0062.990] lstrlenW (lpString="FileSystemMetadata.xml") returned 22
	[0062.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.990] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=281) returned 1
	[0062.991] CloseHandle (hObject=0x350) returned 1
	[0062.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220
	[0062.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.991] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.991] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.992] GetLastError () returned 0x0
	[0062.992] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x119, lpOverlapped=0x0) returned 1
	[0062.992] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x120, lpOverlapped=0x0) returned 1
	[0062.993] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.993] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x100, lpOverlapped=0x0) returned 1
	[0062.994] SetEndOfFile (hFile=0x33c) returned 1
	[0062.994] CloseHandle (hObject=0x33c) returned 1
	[0062.995] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.995] SetEndOfFile (hFile=0x350) returned 1
	[0062.996] CloseHandle (hObject=0x350) returned 1
	[0062.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0062.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1
	[0062.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0062.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0062.997] lstrlenW (lpString=".doc") returned 4
	[0062.997] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.997] lstrlenW (lpString=".docx") returned 5
	[0062.997] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.997] lstrlenW (lpString=".pdf") returned 4
	[0062.997] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.997] lstrlenW (lpString=".xls") returned 4
	[0062.997] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.997] lstrlenW (lpString=".xlsx") returned 5
	[0062.997] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.997] lstrlenW (lpString=".ppt") returned 4
	[0062.998] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0062.998] lstrlenW (lpString=".zip") returned 4
	[0062.998] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.998] lstrlenW (lpString=".rar") returned 4
	[0062.998] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.998] lstrlenW (lpString=".bz2") returned 4
	[0062.998] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.998] lstrlenW (lpString=".7z") returned 3
	[0062.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0062.998] lstrlenW (lpString=".dbf") returned 4
	[0062.998] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0062.998] lstrlenW (lpString=".1cd") returned 4
	[0062.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0062.998] lstrlenW (lpString=".jpg") returned 4
	[0062.998] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0062.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0062.999] lstrlenW (lpString=".doc") returned 4
	[0062.999] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.999] lstrlenW (lpString=".docx") returned 5
	[0062.999] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.999] lstrlenW (lpString=".pdf") returned 4
	[0062.999] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.999] lstrlenW (lpString=".xls") returned 4
	[0062.999] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.999] lstrlenW (lpString=".xlsx") returned 5
	[0062.999] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.999] lstrlenW (lpString=".ppt") returned 4
	[0062.999] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0062.999] lstrlenW (lpString=".zip") returned 4
	[0062.999] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.999] lstrlenW (lpString=".rar") returned 4
	[0062.999] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.000] lstrlenW (lpString=".bz2") returned 4
	[0063.000] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.000] lstrlenW (lpString=".7z") returned 3
	[0063.000] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0063.000] lstrlenW (lpString=".dbf") returned 4
	[0063.000] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0063.000] lstrlenW (lpString=".1cd") returned 4
	[0063.000] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0063.000] lstrlenW (lpString=".jpg") returned 4
	[0063.000] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.000] lstrcmpiW (lpString1=".HTM", lpString2=".money") returned -1
	[0063.000] lstrlenW (lpString="OSPP.HTM") returned 8
	[0063.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.001] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=174528) returned 1
	[0063.001] CloseHandle (hObject=0x350) returned 1
	[0063.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20
	[0063.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.002] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.002] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0063.006] GetLastError () returned 0x0
	[0063.006] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x2a9c0, lpOverlapped=0x0) returned 1
	[0063.010] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x2a9d0, lpOverlapped=0x0) returned 1
	[0063.014] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.014] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xe4, lpOverlapped=0x0) returned 1
	[0063.014] SetEndOfFile (hFile=0x33c) returned 1
	[0063.014] CloseHandle (hObject=0x33c) returned 1
	[0063.018] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.018] SetEndOfFile (hFile=0x350) returned 1
	[0063.020] CloseHandle (hObject=0x350) returned 1
	[0063.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0063.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1
	[0063.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.021] lstrlenW (lpString=".doc") returned 4
	[0063.021] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0063.021] lstrlenW (lpString=".docx") returned 5
	[0063.021] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1
	[0063.021] lstrlenW (lpString=".pdf") returned 4
	[0063.021] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0063.021] lstrlenW (lpString=".xls") returned 4
	[0063.021] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0063.021] lstrlenW (lpString=".xlsx") returned 5
	[0063.021] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1
	[0063.021] lstrlenW (lpString=".ppt") returned 4
	[0063.021] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0063.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.021] lstrlenW (lpString=".zip") returned 4
	[0063.022] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0063.022] lstrlenW (lpString=".rar") returned 4
	[0063.022] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0063.022] lstrlenW (lpString=".bz2") returned 4
	[0063.022] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0063.022] lstrlenW (lpString=".7z") returned 3
	[0063.022] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0063.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.022] lstrlenW (lpString=".dbf") returned 4
	[0063.022] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0063.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.022] lstrlenW (lpString=".1cd") returned 4
	[0063.022] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0063.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.022] lstrlenW (lpString=".jpg") returned 4
	[0063.022] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0063.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.023] lstrlenW (lpString=".doc") returned 4
	[0063.023] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0063.023] lstrlenW (lpString=".docx") returned 5
	[0063.023] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1
	[0063.023] lstrlenW (lpString=".pdf") returned 4
	[0063.023] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0063.023] lstrlenW (lpString=".xls") returned 4
	[0063.023] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0063.023] lstrlenW (lpString=".xlsx") returned 5
	[0063.023] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1
	[0063.023] lstrlenW (lpString=".ppt") returned 4
	[0063.023] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0063.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.023] lstrlenW (lpString=".zip") returned 4
	[0063.023] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0063.023] lstrlenW (lpString=".rar") returned 4
	[0063.023] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0063.023] lstrlenW (lpString=".bz2") returned 4
	[0063.023] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0063.023] lstrlenW (lpString=".7z") returned 3
	[0063.023] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0063.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.024] lstrlenW (lpString=".dbf") returned 4
	[0063.024] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0063.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.024] lstrlenW (lpString=".1cd") returned 4
	[0063.024] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0063.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0063.024] lstrlenW (lpString=".jpg") returned 4
	[0063.024] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0063.024] lstrcmpiW (lpString1=".VBS", lpString2=".money") returned 1
	[0063.024] lstrlenW (lpString="OSPP.VBS") returned 8
	[0063.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.024] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=94467) returned 1
	[0063.025] CloseHandle (hObject=0x350) returned 1
	[0063.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20
	[0063.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.025] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.025] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0063.025] GetLastError () returned 0x0
	[0063.025] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x17103, lpOverlapped=0x0) returned 1
	[0063.601] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x17110, lpOverlapped=0x0) returned 1
	[0063.604] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.604] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xe4, lpOverlapped=0x0) returned 1
	[0063.604] SetEndOfFile (hFile=0x33c) returned 1
	[0063.604] CloseHandle (hObject=0x33c) returned 1
	[0063.607] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.607] SetEndOfFile (hFile=0x350) returned 1
	[0063.608] CloseHandle (hObject=0x350) returned 1
	[0063.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0063.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1
	[0063.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.609] lstrlenW (lpString=".doc") returned 4
	[0063.609] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1
	[0063.609] lstrlenW (lpString=".docx") returned 5
	[0063.609] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1
	[0063.609] lstrlenW (lpString=".pdf") returned 4
	[0063.609] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1
	[0063.609] lstrlenW (lpString=".xls") returned 4
	[0063.609] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1
	[0063.609] lstrlenW (lpString=".xlsx") returned 5
	[0063.609] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1
	[0063.609] lstrlenW (lpString=".ppt") returned 4
	[0063.609] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1
	[0063.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.609] lstrlenW (lpString=".zip") returned 4
	[0063.609] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1
	[0063.609] lstrlenW (lpString=".rar") returned 4
	[0063.610] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1
	[0063.610] lstrlenW (lpString=".bz2") returned 4
	[0063.610] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1
	[0063.610] lstrlenW (lpString=".7z") returned 3
	[0063.610] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1
	[0063.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.610] lstrlenW (lpString=".dbf") returned 4
	[0063.610] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1
	[0063.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.610] lstrlenW (lpString=".1cd") returned 4
	[0063.610] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1
	[0063.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.610] lstrlenW (lpString=".jpg") returned 4
	[0063.610] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1
	[0063.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.610] lstrlenW (lpString=".doc") returned 4
	[0063.610] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1
	[0063.610] lstrlenW (lpString=".docx") returned 5
	[0063.610] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1
	[0063.610] lstrlenW (lpString=".pdf") returned 4
	[0063.610] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1
	[0063.610] lstrlenW (lpString=".xls") returned 4
	[0063.610] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1
	[0063.610] lstrlenW (lpString=".xlsx") returned 5
	[0063.610] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1
	[0063.611] lstrlenW (lpString=".ppt") returned 4
	[0063.611] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1
	[0063.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.611] lstrlenW (lpString=".zip") returned 4
	[0063.611] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1
	[0063.611] lstrlenW (lpString=".rar") returned 4
	[0063.611] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1
	[0063.611] lstrlenW (lpString=".bz2") returned 4
	[0063.611] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1
	[0063.611] lstrlenW (lpString=".7z") returned 3
	[0063.611] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1
	[0063.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.611] lstrlenW (lpString=".dbf") returned 4
	[0063.611] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1
	[0063.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.611] lstrlenW (lpString=".1cd") returned 4
	[0063.611] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1
	[0063.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0063.611] lstrlenW (lpString=".jpg") returned 4
	[0063.611] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1
	[0063.611] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0063.611] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53
	[0063.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.612] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1261) returned 1
	[0063.612] CloseHandle (hObject=0x350) returned 1
	[0063.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0063.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.612] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.612] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0063.613] GetLastError () returned 0x0
	[0063.613] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0063.614] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0063.615] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.615] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x13e, lpOverlapped=0x0) returned 1
	[0063.615] SetEndOfFile (hFile=0x33c) returned 1
	[0063.615] CloseHandle (hObject=0x33c) returned 1
	[0063.616] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.616] SetEndOfFile (hFile=0x350) returned 1
	[0063.617] CloseHandle (hObject=0x350) returned 1
	[0063.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0063.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1
	[0063.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.618] lstrlenW (lpString=".doc") returned 4
	[0063.618] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.618] lstrlenW (lpString=".docx") returned 5
	[0063.618] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.618] lstrlenW (lpString=".pdf") returned 4
	[0063.618] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.618] lstrlenW (lpString=".xls") returned 4
	[0063.618] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.618] lstrlenW (lpString=".xlsx") returned 5
	[0063.618] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.618] lstrlenW (lpString=".ppt") returned 4
	[0063.618] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.618] lstrlenW (lpString=".zip") returned 4
	[0063.618] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.618] lstrlenW (lpString=".rar") returned 4
	[0063.618] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.618] lstrlenW (lpString=".bz2") returned 4
	[0063.618] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.619] lstrlenW (lpString=".7z") returned 3
	[0063.619] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.619] lstrlenW (lpString=".dbf") returned 4
	[0063.619] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.619] lstrlenW (lpString=".1cd") returned 4
	[0063.619] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.619] lstrlenW (lpString=".jpg") returned 4
	[0063.619] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.619] lstrlenW (lpString=".doc") returned 4
	[0063.619] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.619] lstrlenW (lpString=".docx") returned 5
	[0063.619] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.619] lstrlenW (lpString=".pdf") returned 4
	[0063.619] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.619] lstrlenW (lpString=".xls") returned 4
	[0063.619] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.619] lstrlenW (lpString=".xlsx") returned 5
	[0063.619] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.619] lstrlenW (lpString=".ppt") returned 4
	[0063.619] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.620] lstrlenW (lpString=".zip") returned 4
	[0063.620] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.620] lstrlenW (lpString=".rar") returned 4
	[0063.620] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.620] lstrlenW (lpString=".bz2") returned 4
	[0063.620] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.620] lstrlenW (lpString=".7z") returned 3
	[0063.620] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.620] lstrlenW (lpString=".dbf") returned 4
	[0063.620] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.620] lstrlenW (lpString=".1cd") returned 4
	[0063.620] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0063.620] lstrlenW (lpString=".jpg") returned 4
	[0063.620] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.620] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0063.620] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53
	[0063.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.621] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=496513) returned 1
	[0063.621] CloseHandle (hObject=0x350) returned 1
	[0063.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0063.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.622] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.622] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0063.622] GetLastError () returned 0x0
	[0063.622] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x79381, lpOverlapped=0x0) returned 1
	[0063.633] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x79390, lpOverlapped=0x0) returned 1
	[0063.642] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.642] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x13e, lpOverlapped=0x0) returned 1
	[0063.642] SetEndOfFile (hFile=0x33c) returned 1
	[0063.642] CloseHandle (hObject=0x33c) returned 1
	[0063.965] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.965] SetEndOfFile (hFile=0x350) returned 1
	[0063.970] CloseHandle (hObject=0x350) returned 1
	[0063.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0063.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1
	[0063.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.971] lstrlenW (lpString=".doc") returned 4
	[0063.971] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.971] lstrlenW (lpString=".docx") returned 5
	[0063.971] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.971] lstrlenW (lpString=".pdf") returned 4
	[0063.971] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.971] lstrlenW (lpString=".xls") returned 4
	[0063.971] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.971] lstrlenW (lpString=".xlsx") returned 5
	[0063.971] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.971] lstrlenW (lpString=".ppt") returned 4
	[0063.971] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.971] lstrlenW (lpString=".zip") returned 4
	[0063.971] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.971] lstrlenW (lpString=".rar") returned 4
	[0063.971] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.971] lstrlenW (lpString=".bz2") returned 4
	[0063.971] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.972] lstrlenW (lpString=".7z") returned 3
	[0063.972] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.972] lstrlenW (lpString=".dbf") returned 4
	[0063.972] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.972] lstrlenW (lpString=".1cd") returned 4
	[0063.972] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.972] lstrlenW (lpString=".jpg") returned 4
	[0063.972] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.972] lstrlenW (lpString=".doc") returned 4
	[0063.972] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.972] lstrlenW (lpString=".docx") returned 5
	[0063.972] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.972] lstrlenW (lpString=".pdf") returned 4
	[0063.972] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.972] lstrlenW (lpString=".xls") returned 4
	[0063.972] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.972] lstrlenW (lpString=".xlsx") returned 5
	[0063.972] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.973] lstrlenW (lpString=".ppt") returned 4
	[0063.973] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.973] lstrlenW (lpString=".zip") returned 4
	[0063.973] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.973] lstrlenW (lpString=".rar") returned 4
	[0063.973] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.973] lstrlenW (lpString=".bz2") returned 4
	[0063.973] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.973] lstrlenW (lpString=".7z") returned 3
	[0063.973] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.973] lstrlenW (lpString=".dbf") returned 4
	[0063.973] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.973] lstrlenW (lpString=".1cd") returned 4
	[0063.973] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0063.974] lstrlenW (lpString=".jpg") returned 4
	[0063.974] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.974] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0063.974] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53
	[0063.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.975] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1261) returned 1
	[0063.975] CloseHandle (hObject=0x350) returned 1
	[0063.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0063.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.975] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.975] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0063.975] GetLastError () returned 0x0
	[0063.976] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0063.978] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0063.979] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.979] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x13e, lpOverlapped=0x0) returned 1
	[0063.979] SetEndOfFile (hFile=0x33c) returned 1
	[0063.979] CloseHandle (hObject=0x33c) returned 1
	[0063.980] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.980] SetEndOfFile (hFile=0x350) returned 1
	[0063.981] CloseHandle (hObject=0x350) returned 1
	[0063.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0063.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1
	[0063.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.982] lstrlenW (lpString=".doc") returned 4
	[0063.982] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.982] lstrlenW (lpString=".docx") returned 5
	[0063.982] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.982] lstrlenW (lpString=".pdf") returned 4
	[0063.982] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.982] lstrlenW (lpString=".xls") returned 4
	[0063.982] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.982] lstrlenW (lpString=".xlsx") returned 5
	[0063.982] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.982] lstrlenW (lpString=".ppt") returned 4
	[0063.982] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.982] lstrlenW (lpString=".zip") returned 4
	[0063.982] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.982] lstrlenW (lpString=".rar") returned 4
	[0063.982] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.982] lstrlenW (lpString=".bz2") returned 4
	[0063.982] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.982] lstrlenW (lpString=".7z") returned 3
	[0063.982] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.982] lstrlenW (lpString=".dbf") returned 4
	[0063.982] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.982] lstrlenW (lpString=".1cd") returned 4
	[0063.982] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.983] lstrlenW (lpString=".jpg") returned 4
	[0063.983] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.983] lstrlenW (lpString=".doc") returned 4
	[0063.983] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.983] lstrlenW (lpString=".docx") returned 5
	[0063.983] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0063.983] lstrlenW (lpString=".pdf") returned 4
	[0063.983] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.983] lstrlenW (lpString=".xls") returned 4
	[0063.983] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.983] lstrlenW (lpString=".xlsx") returned 5
	[0063.983] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0063.983] lstrlenW (lpString=".ppt") returned 4
	[0063.983] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.983] lstrlenW (lpString=".zip") returned 4
	[0063.983] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.983] lstrlenW (lpString=".rar") returned 4
	[0063.983] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.983] lstrlenW (lpString=".bz2") returned 4
	[0063.983] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.983] lstrlenW (lpString=".7z") returned 3
	[0063.983] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.983] lstrlenW (lpString=".dbf") returned 4
	[0063.983] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.984] lstrlenW (lpString=".1cd") returned 4
	[0063.984] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0063.984] lstrlenW (lpString=".jpg") returned 4
	[0063.984] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.984] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0063.984] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53
	[0063.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.984] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1124942) returned 1
	[0063.984] CloseHandle (hObject=0x350) returned 1
	[0063.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0063.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.984] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.985] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0063.985] GetLastError () returned 0x0
	[0063.985] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0064.533] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0064.553] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x12a5e, lpOverlapped=0x0) returned 1
	[0064.563] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x12a60, lpOverlapped=0x0) returned 1
	[0065.114] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.114] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x13e, lpOverlapped=0x0) returned 1
	[0065.115] SetEndOfFile (hFile=0x33c) returned 1
	[0066.381] CloseHandle (hObject=0x33c) returned 1
	[0066.444] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.475] SetEndOfFile (hFile=0x350) returned 1
	[0066.477] CloseHandle (hObject=0x350) returned 1
	[0066.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0066.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1
	[0066.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.478] lstrlenW (lpString=".doc") returned 4
	[0066.478] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.478] lstrlenW (lpString=".docx") returned 5
	[0066.478] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.478] lstrlenW (lpString=".pdf") returned 4
	[0066.478] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.478] lstrlenW (lpString=".xls") returned 4
	[0066.478] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.478] lstrlenW (lpString=".xlsx") returned 5
	[0066.478] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.478] lstrlenW (lpString=".ppt") returned 4
	[0066.478] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.478] lstrlenW (lpString=".zip") returned 4
	[0066.478] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.478] lstrlenW (lpString=".rar") returned 4
	[0066.478] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.479] lstrlenW (lpString=".bz2") returned 4
	[0066.479] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.479] lstrlenW (lpString=".7z") returned 3
	[0066.479] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.479] lstrlenW (lpString=".dbf") returned 4
	[0066.479] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.479] lstrlenW (lpString=".1cd") returned 4
	[0066.479] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.479] lstrlenW (lpString=".jpg") returned 4
	[0066.479] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.479] lstrlenW (lpString=".doc") returned 4
	[0066.479] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.479] lstrlenW (lpString=".docx") returned 5
	[0066.479] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.480] lstrlenW (lpString=".pdf") returned 4
	[0066.480] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.480] lstrlenW (lpString=".xls") returned 4
	[0066.480] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.480] lstrlenW (lpString=".xlsx") returned 5
	[0066.480] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.480] lstrlenW (lpString=".ppt") returned 4
	[0066.480] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.480] lstrlenW (lpString=".zip") returned 4
	[0066.480] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.480] lstrlenW (lpString=".rar") returned 4
	[0066.480] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.480] lstrlenW (lpString=".bz2") returned 4
	[0066.480] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.480] lstrlenW (lpString=".7z") returned 3
	[0066.480] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.480] lstrlenW (lpString=".dbf") returned 4
	[0066.480] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.480] lstrlenW (lpString=".1cd") returned 4
	[0066.480] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0066.481] lstrlenW (lpString=".jpg") returned 4
	[0066.481] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.481] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0066.481] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53
	[0066.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.481] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=14913) returned 1
	[0066.481] CloseHandle (hObject=0x350) returned 1
	[0066.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0066.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0066.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.482] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.482] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0066.482] GetLastError () returned 0x0
	[0066.482] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x3a41, lpOverlapped=0x0) returned 1
	[0066.484] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3a50, lpOverlapped=0x0) returned 1
	[0066.485] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.485] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.485] SetEndOfFile (hFile=0x318) returned 1
	[0066.485] CloseHandle (hObject=0x318) returned 1
	[0066.487] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.487] SetEndOfFile (hFile=0x350) returned 1
	[0066.488] CloseHandle (hObject=0x350) returned 1
	[0066.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0066.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1
	[0066.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.489] lstrlenW (lpString=".doc") returned 4
	[0066.489] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.489] lstrlenW (lpString=".docx") returned 5
	[0066.489] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.489] lstrlenW (lpString=".pdf") returned 4
	[0066.489] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.489] lstrlenW (lpString=".xls") returned 4
	[0066.489] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.489] lstrlenW (lpString=".xlsx") returned 5
	[0066.489] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.489] lstrlenW (lpString=".ppt") returned 4
	[0066.489] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.489] lstrlenW (lpString=".zip") returned 4
	[0066.489] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.489] lstrlenW (lpString=".rar") returned 4
	[0066.489] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.489] lstrlenW (lpString=".bz2") returned 4
	[0066.490] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.490] lstrlenW (lpString=".7z") returned 3
	[0066.490] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.490] lstrlenW (lpString=".dbf") returned 4
	[0066.490] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.490] lstrlenW (lpString=".1cd") returned 4
	[0066.490] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.490] lstrlenW (lpString=".jpg") returned 4
	[0066.490] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.490] lstrlenW (lpString=".doc") returned 4
	[0066.490] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.490] lstrlenW (lpString=".docx") returned 5
	[0066.490] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.490] lstrlenW (lpString=".pdf") returned 4
	[0066.490] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.490] lstrlenW (lpString=".xls") returned 4
	[0066.490] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.490] lstrlenW (lpString=".xlsx") returned 5
	[0066.490] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.491] lstrlenW (lpString=".ppt") returned 4
	[0066.491] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.491] lstrlenW (lpString=".zip") returned 4
	[0066.491] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.491] lstrlenW (lpString=".rar") returned 4
	[0066.491] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.491] lstrlenW (lpString=".bz2") returned 4
	[0066.491] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.491] lstrlenW (lpString=".7z") returned 3
	[0066.491] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.491] lstrlenW (lpString=".dbf") returned 4
	[0066.491] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.491] lstrlenW (lpString=".1cd") returned 4
	[0066.491] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0066.491] lstrlenW (lpString=".jpg") returned 4
	[0066.491] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.492] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0066.492] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53
	[0066.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.492] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=357349) returned 1
	[0066.492] CloseHandle (hObject=0x350) returned 1
	[0066.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0066.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0066.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.492] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.492] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0066.493] GetLastError () returned 0x0
	[0066.493] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x573e5, lpOverlapped=0x0) returned 1
	[0067.001] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x573f0, lpOverlapped=0x0) returned 1
	[0067.007] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.007] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.007] SetEndOfFile (hFile=0x318) returned 1
	[0067.440] CloseHandle (hObject=0x318) returned 1
	[0067.464] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.464] SetEndOfFile (hFile=0x350) returned 1
	[0067.468] CloseHandle (hObject=0x350) returned 1
	[0067.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.470] lstrlenW (lpString=".doc") returned 4
	[0067.470] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.470] lstrlenW (lpString=".docx") returned 5
	[0067.470] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.470] lstrlenW (lpString=".pdf") returned 4
	[0067.470] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.470] lstrlenW (lpString=".xls") returned 4
	[0067.470] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.470] lstrlenW (lpString=".xlsx") returned 5
	[0067.470] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.470] lstrlenW (lpString=".ppt") returned 4
	[0067.470] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.470] lstrlenW (lpString=".zip") returned 4
	[0067.470] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.470] lstrlenW (lpString=".rar") returned 4
	[0067.470] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.470] lstrlenW (lpString=".bz2") returned 4
	[0067.470] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.470] lstrlenW (lpString=".7z") returned 3
	[0067.470] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.470] lstrlenW (lpString=".dbf") returned 4
	[0067.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.471] lstrlenW (lpString=".1cd") returned 4
	[0067.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.471] lstrlenW (lpString=".jpg") returned 4
	[0067.471] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.471] lstrlenW (lpString=".doc") returned 4
	[0067.471] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.471] lstrlenW (lpString=".docx") returned 5
	[0067.471] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.471] lstrlenW (lpString=".pdf") returned 4
	[0067.471] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.471] lstrlenW (lpString=".xls") returned 4
	[0067.471] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.471] lstrlenW (lpString=".xlsx") returned 5
	[0067.471] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.471] lstrlenW (lpString=".ppt") returned 4
	[0067.471] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.472] lstrlenW (lpString=".zip") returned 4
	[0067.472] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.472] lstrlenW (lpString=".rar") returned 4
	[0067.472] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.472] lstrlenW (lpString=".bz2") returned 4
	[0067.472] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.472] lstrlenW (lpString=".7z") returned 3
	[0067.472] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.472] lstrlenW (lpString=".dbf") returned 4
	[0067.472] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.472] lstrlenW (lpString=".1cd") returned 4
	[0067.472] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0067.472] lstrlenW (lpString=".jpg") returned 4
	[0067.472] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.472] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.472] lstrlenW (lpString="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 53
	[0067.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0067.473] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1261) returned 1
	[0067.473] CloseHandle (hObject=0x350) returned 1
	[0067.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0067.473] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.474] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.474] GetLastError () returned 0x0
	[0067.474] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.475] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.476] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.476] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.476] SetEndOfFile (hFile=0x318) returned 1
	[0067.477] CloseHandle (hObject=0x318) returned 1
	[0067.477] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.477] SetEndOfFile (hFile=0x350) returned 1
	[0067.478] CloseHandle (hObject=0x350) returned 1
	[0067.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.479] lstrlenW (lpString=".doc") returned 4
	[0067.479] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.479] lstrlenW (lpString=".docx") returned 5
	[0067.479] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.479] lstrlenW (lpString=".pdf") returned 4
	[0067.479] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.479] lstrlenW (lpString=".xls") returned 4
	[0067.479] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.479] lstrlenW (lpString=".xlsx") returned 5
	[0067.479] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.479] lstrlenW (lpString=".ppt") returned 4
	[0067.479] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.480] lstrlenW (lpString=".zip") returned 4
	[0067.480] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.480] lstrlenW (lpString=".rar") returned 4
	[0067.480] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.480] lstrlenW (lpString=".bz2") returned 4
	[0067.480] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.480] lstrlenW (lpString=".7z") returned 3
	[0067.480] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.480] lstrlenW (lpString=".dbf") returned 4
	[0067.480] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.480] lstrlenW (lpString=".1cd") returned 4
	[0067.480] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.480] lstrlenW (lpString=".jpg") returned 4
	[0067.480] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.480] lstrlenW (lpString=".doc") returned 4
	[0067.480] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.480] lstrlenW (lpString=".docx") returned 5
	[0067.480] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.480] lstrlenW (lpString=".pdf") returned 4
	[0067.480] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.480] lstrlenW (lpString=".xls") returned 4
	[0067.481] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.481] lstrlenW (lpString=".xlsx") returned 5
	[0067.481] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.481] lstrlenW (lpString=".ppt") returned 4
	[0067.481] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.481] lstrlenW (lpString=".zip") returned 4
	[0067.481] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.481] lstrlenW (lpString=".rar") returned 4
	[0067.481] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.481] lstrlenW (lpString=".bz2") returned 4
	[0067.481] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.481] lstrlenW (lpString=".7z") returned 3
	[0067.481] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.481] lstrlenW (lpString=".dbf") returned 4
	[0067.481] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.481] lstrlenW (lpString=".1cd") returned 4
	[0067.481] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0067.481] lstrlenW (lpString=".jpg") returned 4
	[0067.481] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.481] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0067.482] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53
	[0067.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0067.482] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=527958) returned 1
	[0067.482] CloseHandle (hObject=0x350) returned 1
	[0067.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0067.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0067.482] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.482] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.483] GetLastError () returned 0x0
	[0067.483] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x80e56, lpOverlapped=0x0) returned 1
	[0067.647] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x80e60, lpOverlapped=0x0) returned 1
	[0067.656] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.657] WriteFile (in: hFile=0x318, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.657] SetEndOfFile (hFile=0x318) returned 1
	[0067.657] CloseHandle (hObject=0x318) returned 1
	[0067.668] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.668] SetEndOfFile (hFile=0x350) returned 1
	[0067.673] CloseHandle (hObject=0x350) returned 1
	[0067.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0067.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.674] lstrlenW (lpString=".doc") returned 4
	[0067.674] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.674] lstrlenW (lpString=".docx") returned 5
	[0067.674] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.674] lstrlenW (lpString=".pdf") returned 4
	[0067.674] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.674] lstrlenW (lpString=".xls") returned 4
	[0067.674] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.675] lstrlenW (lpString=".xlsx") returned 5
	[0067.675] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.675] lstrlenW (lpString=".ppt") returned 4
	[0067.675] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.675] lstrlenW (lpString=".zip") returned 4
	[0067.675] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.675] lstrlenW (lpString=".rar") returned 4
	[0067.675] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.675] lstrlenW (lpString=".bz2") returned 4
	[0067.675] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.675] lstrlenW (lpString=".7z") returned 3
	[0067.675] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.675] lstrlenW (lpString=".dbf") returned 4
	[0067.675] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.675] lstrlenW (lpString=".1cd") returned 4
	[0067.675] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.675] lstrlenW (lpString=".jpg") returned 4
	[0067.676] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.676] lstrlenW (lpString=".doc") returned 4
	[0067.676] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.676] lstrlenW (lpString=".docx") returned 5
	[0067.676] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.676] lstrlenW (lpString=".pdf") returned 4
	[0067.676] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.676] lstrlenW (lpString=".xls") returned 4
	[0067.676] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.850] lstrlenW (lpString=".xlsx") returned 5
	[0067.850] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.850] lstrlenW (lpString=".ppt") returned 4
	[0067.850] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.850] lstrlenW (lpString=".zip") returned 4
	[0067.850] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.850] lstrlenW (lpString=".rar") returned 4
	[0067.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.850] lstrlenW (lpString=".bz2") returned 4
	[0067.850] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.850] lstrlenW (lpString=".7z") returned 3
	[0067.850] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.850] lstrlenW (lpString=".dbf") returned 4
	[0067.850] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.850] lstrlenW (lpString=".1cd") returned 4
	[0067.850] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0067.850] lstrlenW (lpString=".jpg") returned 4
	[0067.850] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.850] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0067.850] lstrlenW (lpString="AG00057_.GIF") returned 12
	[0067.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0068.381] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=11891) returned 1
	[0068.381] CloseHandle (hObject=0x33c) returned 1
	[0068.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220
	[0068.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0068.381] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.382] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0068.383] GetLastError () returned 0x0
	[0068.383] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x2e73, lpOverlapped=0x0) returned 1
	[0068.393] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x2e80, lpOverlapped=0x0) returned 1
	[0068.395] ReadFile (in: hFile=0x33c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.395] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.396] SetEndOfFile (hFile=0x34c) returned 1
	[0068.396] CloseHandle (hObject=0x34c) returned 1
	[0068.397] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.397] SetEndOfFile (hFile=0x33c) returned 1
	[0068.398] CloseHandle (hObject=0x33c) returned 1
	[0068.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1
	[0068.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.399] lstrlenW (lpString=".doc") returned 4
	[0068.399] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.399] lstrlenW (lpString=".docx") returned 5
	[0068.400] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.400] lstrlenW (lpString=".pdf") returned 4
	[0068.400] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.400] lstrlenW (lpString=".xls") returned 4
	[0068.400] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.400] lstrlenW (lpString=".xlsx") returned 5
	[0068.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.400] lstrlenW (lpString=".ppt") returned 4
	[0068.400] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.400] lstrlenW (lpString=".zip") returned 4
	[0068.400] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.400] lstrlenW (lpString=".rar") returned 4
	[0068.400] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.400] lstrlenW (lpString=".bz2") returned 4
	[0068.400] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.400] lstrlenW (lpString=".7z") returned 3
	[0068.400] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.400] lstrlenW (lpString=".dbf") returned 4
	[0068.400] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.401] lstrlenW (lpString=".1cd") returned 4
	[0068.401] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.401] lstrlenW (lpString=".jpg") returned 4
	[0068.401] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.401] lstrlenW (lpString=".doc") returned 4
	[0068.401] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.401] lstrlenW (lpString=".docx") returned 5
	[0068.401] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.401] lstrlenW (lpString=".pdf") returned 4
	[0068.401] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.401] lstrlenW (lpString=".xls") returned 4
	[0068.401] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.401] lstrlenW (lpString=".xlsx") returned 5
	[0068.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.401] lstrlenW (lpString=".ppt") returned 4
	[0068.401] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.402] lstrlenW (lpString=".zip") returned 4
	[0068.402] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.402] lstrlenW (lpString=".rar") returned 4
	[0068.402] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.402] lstrlenW (lpString=".bz2") returned 4
	[0068.402] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.402] lstrlenW (lpString=".7z") returned 3
	[0068.402] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.402] lstrlenW (lpString=".dbf") returned 4
	[0068.402] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.402] lstrlenW (lpString=".1cd") returned 4
	[0068.403] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0068.403] lstrlenW (lpString=".jpg") returned 4
	[0068.403] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.403] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.403] lstrlenW (lpString="AG00092_.GIF") returned 12
	[0068.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0068.405] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=502) returned 1
	[0068.405] CloseHandle (hObject=0x34c) returned 1
	[0068.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220
	[0068.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0068.408] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.409] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.414] GetLastError () returned 0x0
	[0068.414] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1f6, lpOverlapped=0x0) returned 1
	[0068.416] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x200, lpOverlapped=0x0) returned 1
	[0068.417] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.417] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.424] SetEndOfFile (hFile=0x364) returned 1
	[0068.425] CloseHandle (hObject=0x364) returned 1
	[0068.425] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.425] SetEndOfFile (hFile=0x368) returned 1
	[0068.426] CloseHandle (hObject=0x368) returned 1
	[0068.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1
	[0068.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.427] lstrlenW (lpString=".doc") returned 4
	[0068.427] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.427] lstrlenW (lpString=".docx") returned 5
	[0068.427] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.427] lstrlenW (lpString=".pdf") returned 4
	[0068.427] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.427] lstrlenW (lpString=".xls") returned 4
	[0068.427] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.427] lstrlenW (lpString=".xlsx") returned 5
	[0068.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.427] lstrlenW (lpString=".ppt") returned 4
	[0068.427] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.427] lstrlenW (lpString=".zip") returned 4
	[0068.427] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.427] lstrlenW (lpString=".rar") returned 4
	[0068.427] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.427] lstrlenW (lpString=".bz2") returned 4
	[0068.427] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.427] lstrlenW (lpString=".7z") returned 3
	[0068.427] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.427] lstrlenW (lpString=".dbf") returned 4
	[0068.427] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.427] lstrlenW (lpString=".1cd") returned 4
	[0068.428] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.428] lstrlenW (lpString=".jpg") returned 4
	[0068.428] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.428] lstrlenW (lpString=".doc") returned 4
	[0068.428] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.428] lstrlenW (lpString=".docx") returned 5
	[0068.428] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.428] lstrlenW (lpString=".pdf") returned 4
	[0068.428] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.428] lstrlenW (lpString=".xls") returned 4
	[0068.428] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.428] lstrlenW (lpString=".xlsx") returned 5
	[0068.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.428] lstrlenW (lpString=".ppt") returned 4
	[0068.428] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.428] lstrlenW (lpString=".zip") returned 4
	[0068.428] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.428] lstrlenW (lpString=".rar") returned 4
	[0068.428] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.428] lstrlenW (lpString=".bz2") returned 4
	[0068.428] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.428] lstrlenW (lpString=".7z") returned 3
	[0068.428] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.429] lstrlenW (lpString=".dbf") returned 4
	[0068.429] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.429] lstrlenW (lpString=".1cd") returned 4
	[0068.429] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0068.429] lstrlenW (lpString=".jpg") returned 4
	[0068.429] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.429] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.429] lstrlenW (lpString="AG00120_.GIF") returned 12
	[0068.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0068.429] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3484) returned 1
	[0068.429] CloseHandle (hObject=0x368) returned 1
	[0068.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220
	[0068.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0068.430] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.430] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.430] GetLastError () returned 0x0
	[0068.430] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xd9c, lpOverlapped=0x0) returned 1
	[0068.443] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xda0, lpOverlapped=0x0) returned 1
	[0068.444] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.444] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.444] SetEndOfFile (hFile=0x364) returned 1
	[0068.444] CloseHandle (hObject=0x364) returned 1
	[0068.445] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.445] SetEndOfFile (hFile=0x368) returned 1
	[0068.446] CloseHandle (hObject=0x368) returned 1
	[0068.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0068.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1
	[0068.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.447] lstrlenW (lpString=".doc") returned 4
	[0068.447] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.447] lstrlenW (lpString=".docx") returned 5
	[0068.447] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.447] lstrlenW (lpString=".pdf") returned 4
	[0068.447] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.447] lstrlenW (lpString=".xls") returned 4
	[0068.447] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.447] lstrlenW (lpString=".xlsx") returned 5
	[0068.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.447] lstrlenW (lpString=".ppt") returned 4
	[0068.447] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.447] lstrlenW (lpString=".zip") returned 4
	[0068.447] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.447] lstrlenW (lpString=".rar") returned 4
	[0068.447] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.447] lstrlenW (lpString=".bz2") returned 4
	[0068.447] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.447] lstrlenW (lpString=".7z") returned 3
	[0068.448] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.448] lstrlenW (lpString=".dbf") returned 4
	[0068.448] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.448] lstrlenW (lpString=".1cd") returned 4
	[0068.448] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.448] lstrlenW (lpString=".jpg") returned 4
	[0068.448] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.448] lstrlenW (lpString=".doc") returned 4
	[0068.448] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0068.448] lstrlenW (lpString=".docx") returned 5
	[0068.448] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0068.448] lstrlenW (lpString=".pdf") returned 4
	[0068.448] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0068.448] lstrlenW (lpString=".xls") returned 4
	[0068.448] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0068.448] lstrlenW (lpString=".xlsx") returned 5
	[0068.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0068.448] lstrlenW (lpString=".ppt") returned 4
	[0068.448] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0068.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.448] lstrlenW (lpString=".zip") returned 4
	[0068.448] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0068.449] lstrlenW (lpString=".rar") returned 4
	[0068.449] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0068.449] lstrlenW (lpString=".bz2") returned 4
	[0068.449] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0068.449] lstrlenW (lpString=".7z") returned 3
	[0068.449] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0068.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.449] lstrlenW (lpString=".dbf") returned 4
	[0068.449] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0068.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.449] lstrlenW (lpString=".1cd") returned 4
	[0068.449] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0068.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0068.449] lstrlenW (lpString=".jpg") returned 4
	[0068.449] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0068.449] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0068.449] lstrlenW (lpString="AG00129_.GIF") returned 12
	[0068.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0068.449] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=12482) returned 1
	[0068.450] CloseHandle (hObject=0x368) returned 1
	[0068.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220
	[0068.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0068.450] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.450] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.450] GetLastError () returned 0x0
	[0068.450] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x30c2, lpOverlapped=0x0) returned 1
	[0068.741] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x30d0, lpOverlapped=0x0) returned 1
	[0068.743] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.743] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0068.743] SetEndOfFile (hFile=0x364) returned 1
	[0069.387] CloseHandle (hObject=0x364) returned 1
	[0069.388] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.388] SetEndOfFile (hFile=0x368) returned 1
	[0069.389] CloseHandle (hObject=0x368) returned 1
	[0069.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1
	[0069.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.390] lstrlenW (lpString=".doc") returned 4
	[0069.390] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.390] lstrlenW (lpString=".docx") returned 5
	[0069.390] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.390] lstrlenW (lpString=".pdf") returned 4
	[0069.390] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.390] lstrlenW (lpString=".xls") returned 4
	[0069.390] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.390] lstrlenW (lpString=".xlsx") returned 5
	[0069.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.390] lstrlenW (lpString=".ppt") returned 4
	[0069.390] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.391] lstrlenW (lpString=".zip") returned 4
	[0069.391] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.391] lstrlenW (lpString=".rar") returned 4
	[0069.391] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.391] lstrlenW (lpString=".bz2") returned 4
	[0069.391] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.391] lstrlenW (lpString=".7z") returned 3
	[0069.391] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.391] lstrlenW (lpString=".dbf") returned 4
	[0069.391] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.391] lstrlenW (lpString=".1cd") returned 4
	[0069.391] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.391] lstrlenW (lpString=".jpg") returned 4
	[0069.391] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.392] lstrlenW (lpString=".doc") returned 4
	[0069.392] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.392] lstrlenW (lpString=".docx") returned 5
	[0069.392] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.392] lstrlenW (lpString=".pdf") returned 4
	[0069.392] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.392] lstrlenW (lpString=".xls") returned 4
	[0069.392] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.392] lstrlenW (lpString=".xlsx") returned 5
	[0069.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.392] lstrlenW (lpString=".ppt") returned 4
	[0069.392] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.392] lstrlenW (lpString=".zip") returned 4
	[0069.392] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.392] lstrlenW (lpString=".rar") returned 4
	[0069.392] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.393] lstrlenW (lpString=".bz2") returned 4
	[0069.393] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.393] lstrlenW (lpString=".7z") returned 3
	[0069.393] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.393] lstrlenW (lpString=".dbf") returned 4
	[0069.393] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.393] lstrlenW (lpString=".1cd") returned 4
	[0069.393] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.393] lstrlenW (lpString=".jpg") returned 4
	[0069.393] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.393] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.393] lstrlenW (lpString="AG00170_.GIF") returned 12
	[0069.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.394] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=9248) returned 1
	[0069.394] CloseHandle (hObject=0x368) returned 1
	[0069.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220
	[0069.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.395] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.395] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.395] GetLastError () returned 0x0
	[0069.395] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x2420, lpOverlapped=0x0) returned 1
	[0069.396] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x2430, lpOverlapped=0x0) returned 1
	[0069.398] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.398] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.398] SetEndOfFile (hFile=0x364) returned 1
	[0069.398] CloseHandle (hObject=0x364) returned 1
	[0069.399] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.399] SetEndOfFile (hFile=0x368) returned 1
	[0069.400] CloseHandle (hObject=0x368) returned 1
	[0069.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1
	[0069.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.401] lstrlenW (lpString=".doc") returned 4
	[0069.401] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.401] lstrlenW (lpString=".docx") returned 5
	[0069.401] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.401] lstrlenW (lpString=".pdf") returned 4
	[0069.401] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.401] lstrlenW (lpString=".xls") returned 4
	[0069.401] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.401] lstrlenW (lpString=".xlsx") returned 5
	[0069.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.401] lstrlenW (lpString=".ppt") returned 4
	[0069.401] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.402] lstrlenW (lpString=".zip") returned 4
	[0069.402] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.402] lstrlenW (lpString=".rar") returned 4
	[0069.402] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.402] lstrlenW (lpString=".bz2") returned 4
	[0069.402] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.402] lstrlenW (lpString=".7z") returned 3
	[0069.402] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.402] lstrlenW (lpString=".dbf") returned 4
	[0069.402] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.402] lstrlenW (lpString=".1cd") returned 4
	[0069.402] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.402] lstrlenW (lpString=".jpg") returned 4
	[0069.402] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.402] lstrlenW (lpString=".doc") returned 4
	[0069.403] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.403] lstrlenW (lpString=".docx") returned 5
	[0069.403] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.403] lstrlenW (lpString=".pdf") returned 4
	[0069.403] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.403] lstrlenW (lpString=".xls") returned 4
	[0069.403] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.403] lstrlenW (lpString=".xlsx") returned 5
	[0069.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.403] lstrlenW (lpString=".ppt") returned 4
	[0069.403] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.403] lstrlenW (lpString=".zip") returned 4
	[0069.403] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.403] lstrlenW (lpString=".rar") returned 4
	[0069.403] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.403] lstrlenW (lpString=".bz2") returned 4
	[0069.403] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.403] lstrlenW (lpString=".7z") returned 3
	[0069.403] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.404] lstrlenW (lpString=".dbf") returned 4
	[0069.404] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.404] lstrlenW (lpString=".1cd") returned 4
	[0069.404] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0069.404] lstrlenW (lpString=".jpg") returned 4
	[0069.404] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.404] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.404] lstrlenW (lpString="AG00171_.GIF") returned 12
	[0069.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.405] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=5016) returned 1
	[0069.405] CloseHandle (hObject=0x368) returned 1
	[0069.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220
	[0069.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.405] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.405] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.405] GetLastError () returned 0x0
	[0069.405] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1398, lpOverlapped=0x0) returned 1
	[0069.407] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x13a0, lpOverlapped=0x0) returned 1
	[0069.408] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.408] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.408] SetEndOfFile (hFile=0x364) returned 1
	[0069.408] CloseHandle (hObject=0x364) returned 1
	[0069.409] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.409] SetEndOfFile (hFile=0x368) returned 1
	[0069.410] CloseHandle (hObject=0x368) returned 1
	[0069.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1
	[0069.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.411] lstrlenW (lpString=".doc") returned 4
	[0069.411] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.411] lstrlenW (lpString=".docx") returned 5
	[0069.411] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.411] lstrlenW (lpString=".pdf") returned 4
	[0069.411] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.411] lstrlenW (lpString=".xls") returned 4
	[0069.411] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.411] lstrlenW (lpString=".xlsx") returned 5
	[0069.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.411] lstrlenW (lpString=".ppt") returned 4
	[0069.411] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.411] lstrlenW (lpString=".zip") returned 4
	[0069.411] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.411] lstrlenW (lpString=".rar") returned 4
	[0069.411] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.411] lstrlenW (lpString=".bz2") returned 4
	[0069.411] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.412] lstrlenW (lpString=".7z") returned 3
	[0069.412] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.412] lstrlenW (lpString=".dbf") returned 4
	[0069.412] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.412] lstrlenW (lpString=".1cd") returned 4
	[0069.412] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.412] lstrlenW (lpString=".jpg") returned 4
	[0069.412] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.412] lstrlenW (lpString=".doc") returned 4
	[0069.412] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.412] lstrlenW (lpString=".docx") returned 5
	[0069.412] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.412] lstrlenW (lpString=".pdf") returned 4
	[0069.412] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.412] lstrlenW (lpString=".xls") returned 4
	[0069.412] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.412] lstrlenW (lpString=".xlsx") returned 5
	[0069.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.412] lstrlenW (lpString=".ppt") returned 4
	[0069.413] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.413] lstrlenW (lpString=".zip") returned 4
	[0069.413] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.413] lstrlenW (lpString=".rar") returned 4
	[0069.413] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.413] lstrlenW (lpString=".bz2") returned 4
	[0069.413] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.413] lstrlenW (lpString=".7z") returned 3
	[0069.413] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.413] lstrlenW (lpString=".dbf") returned 4
	[0069.413] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.413] lstrlenW (lpString=".1cd") returned 4
	[0069.413] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0069.413] lstrlenW (lpString=".jpg") returned 4
	[0069.413] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.413] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.413] lstrlenW (lpString="AG00172_.GIF") returned 12
	[0069.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.414] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4390) returned 1
	[0069.414] CloseHandle (hObject=0x368) returned 1
	[0069.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220
	[0069.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.414] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.414] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.415] GetLastError () returned 0x0
	[0069.415] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1126, lpOverlapped=0x0) returned 1
	[0069.416] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1130, lpOverlapped=0x0) returned 1
	[0069.417] ReadFile (in: hFile=0x368, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.417] WriteFile (in: hFile=0x364, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.418] SetEndOfFile (hFile=0x364) returned 1
	[0069.418] CloseHandle (hObject=0x364) returned 1
	[0069.419] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.419] SetEndOfFile (hFile=0x368) returned 1
	[0069.419] CloseHandle (hObject=0x368) returned 1
	[0069.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0069.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1
	[0069.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.420] lstrlenW (lpString=".doc") returned 4
	[0069.420] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.420] lstrlenW (lpString=".docx") returned 5
	[0069.420] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.420] lstrlenW (lpString=".pdf") returned 4
	[0069.421] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.421] lstrlenW (lpString=".xls") returned 4
	[0069.421] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.421] lstrlenW (lpString=".xlsx") returned 5
	[0069.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.421] lstrlenW (lpString=".ppt") returned 4
	[0069.421] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.421] lstrlenW (lpString=".zip") returned 4
	[0069.421] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.421] lstrlenW (lpString=".rar") returned 4
	[0069.421] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.421] lstrlenW (lpString=".bz2") returned 4
	[0069.421] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.421] lstrlenW (lpString=".7z") returned 3
	[0069.421] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.421] lstrlenW (lpString=".dbf") returned 4
	[0069.421] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.421] lstrlenW (lpString=".1cd") returned 4
	[0069.421] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.421] lstrlenW (lpString=".jpg") returned 4
	[0069.422] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.422] lstrlenW (lpString=".doc") returned 4
	[0069.422] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.422] lstrlenW (lpString=".docx") returned 5
	[0069.422] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.422] lstrlenW (lpString=".pdf") returned 4
	[0069.422] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.422] lstrlenW (lpString=".xls") returned 4
	[0069.422] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.422] lstrlenW (lpString=".xlsx") returned 5
	[0069.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.422] lstrlenW (lpString=".ppt") returned 4
	[0069.422] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.422] lstrlenW (lpString=".zip") returned 4
	[0069.422] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.422] lstrlenW (lpString=".rar") returned 4
	[0069.422] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.422] lstrlenW (lpString=".bz2") returned 4
	[0069.422] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.422] lstrlenW (lpString=".7z") returned 3
	[0069.422] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.423] lstrlenW (lpString=".dbf") returned 4
	[0069.423] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.423] lstrlenW (lpString=".1cd") returned 4
	[0069.423] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0069.423] lstrlenW (lpString=".jpg") returned 4
	[0069.423] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.423] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0069.423] lstrlenW (lpString="AG00174_.GIF") returned 12
	[0069.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0069.797] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3966) returned 1
	[0069.797] CloseHandle (hObject=0x37c) returned 1
	[0069.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220
	[0069.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0069.816] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.816] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0070.147] GetLastError () returned 0x0
	[0070.149] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xf7e, lpOverlapped=0x0) returned 1
	[0070.169] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf80, lpOverlapped=0x0) returned 1
	[0070.170] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.170] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.170] SetEndOfFile (hFile=0x340) returned 1
	[0070.170] CloseHandle (hObject=0x340) returned 1
	[0070.171] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.171] SetEndOfFile (hFile=0x38c) returned 1
	[0070.172] CloseHandle (hObject=0x38c) returned 1
	[0070.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1
	[0070.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.173] lstrlenW (lpString=".doc") returned 4
	[0070.173] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.173] lstrlenW (lpString=".docx") returned 5
	[0070.173] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.173] lstrlenW (lpString=".pdf") returned 4
	[0070.173] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.173] lstrlenW (lpString=".xls") returned 4
	[0070.173] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.173] lstrlenW (lpString=".xlsx") returned 5
	[0070.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.173] lstrlenW (lpString=".ppt") returned 4
	[0070.173] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.173] lstrlenW (lpString=".zip") returned 4
	[0070.173] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.173] lstrlenW (lpString=".rar") returned 4
	[0070.174] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.174] lstrlenW (lpString=".bz2") returned 4
	[0070.174] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.174] lstrlenW (lpString=".7z") returned 3
	[0070.174] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.174] lstrlenW (lpString=".dbf") returned 4
	[0070.174] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.174] lstrlenW (lpString=".1cd") returned 4
	[0070.174] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.174] lstrlenW (lpString=".jpg") returned 4
	[0070.174] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.174] lstrlenW (lpString=".doc") returned 4
	[0070.174] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.174] lstrlenW (lpString=".docx") returned 5
	[0070.174] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.174] lstrlenW (lpString=".pdf") returned 4
	[0070.175] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.175] lstrlenW (lpString=".xls") returned 4
	[0070.175] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.175] lstrlenW (lpString=".xlsx") returned 5
	[0070.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.175] lstrlenW (lpString=".ppt") returned 4
	[0070.175] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.175] lstrlenW (lpString=".zip") returned 4
	[0070.175] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.175] lstrlenW (lpString=".rar") returned 4
	[0070.175] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.175] lstrlenW (lpString=".bz2") returned 4
	[0070.175] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.175] lstrlenW (lpString=".7z") returned 3
	[0070.175] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.175] lstrlenW (lpString=".dbf") returned 4
	[0070.175] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.176] lstrlenW (lpString=".1cd") returned 4
	[0070.176] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.176] lstrlenW (lpString=".jpg") returned 4
	[0070.176] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.176] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.176] lstrlenW (lpString="AN01173_.WMF") returned 12
	[0070.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.177] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=26332) returned 1
	[0070.177] CloseHandle (hObject=0x38c) returned 1
	[0070.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220
	[0070.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.177] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.177] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0070.178] GetLastError () returned 0x0
	[0070.178] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x66dc, lpOverlapped=0x0) returned 1
	[0070.179] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x66e0, lpOverlapped=0x0) returned 1
	[0070.181] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.181] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.181] SetEndOfFile (hFile=0x340) returned 1
	[0070.181] CloseHandle (hObject=0x340) returned 1
	[0070.183] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.183] SetEndOfFile (hFile=0x38c) returned 1
	[0070.184] CloseHandle (hObject=0x38c) returned 1
	[0070.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1
	[0070.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.184] lstrlenW (lpString=".doc") returned 4
	[0070.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.184] lstrlenW (lpString=".docx") returned 5
	[0070.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.184] lstrlenW (lpString=".pdf") returned 4
	[0070.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.185] lstrlenW (lpString=".xls") returned 4
	[0070.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.185] lstrlenW (lpString=".xlsx") returned 5
	[0070.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.185] lstrlenW (lpString=".ppt") returned 4
	[0070.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.185] lstrlenW (lpString=".zip") returned 4
	[0070.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.185] lstrlenW (lpString=".rar") returned 4
	[0070.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.185] lstrlenW (lpString=".bz2") returned 4
	[0070.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.185] lstrlenW (lpString=".7z") returned 3
	[0070.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.185] lstrlenW (lpString=".dbf") returned 4
	[0070.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.185] lstrlenW (lpString=".1cd") returned 4
	[0070.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.185] lstrlenW (lpString=".jpg") returned 4
	[0070.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.186] lstrlenW (lpString=".doc") returned 4
	[0070.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.186] lstrlenW (lpString=".docx") returned 5
	[0070.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.186] lstrlenW (lpString=".pdf") returned 4
	[0070.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.186] lstrlenW (lpString=".xls") returned 4
	[0070.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.186] lstrlenW (lpString=".xlsx") returned 5
	[0070.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.186] lstrlenW (lpString=".ppt") returned 4
	[0070.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.186] lstrlenW (lpString=".zip") returned 4
	[0070.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.186] lstrlenW (lpString=".rar") returned 4
	[0070.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.187] lstrlenW (lpString=".bz2") returned 4
	[0070.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.187] lstrlenW (lpString=".7z") returned 3
	[0070.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.187] lstrlenW (lpString=".dbf") returned 4
	[0070.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.187] lstrlenW (lpString=".1cd") returned 4
	[0070.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0070.187] lstrlenW (lpString=".jpg") returned 4
	[0070.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.187] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.187] lstrlenW (lpString="AN01174_.WMF") returned 12
	[0070.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.188] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=27858) returned 1
	[0070.188] CloseHandle (hObject=0x38c) returned 1
	[0070.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220
	[0070.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.188] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.188] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0070.189] GetLastError () returned 0x0
	[0070.189] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x6cd2, lpOverlapped=0x0) returned 1
	[0070.191] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x6ce0, lpOverlapped=0x0) returned 1
	[0070.192] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.192] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.192] SetEndOfFile (hFile=0x340) returned 1
	[0070.192] CloseHandle (hObject=0x340) returned 1
	[0070.194] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.194] SetEndOfFile (hFile=0x38c) returned 1
	[0070.195] CloseHandle (hObject=0x38c) returned 1
	[0070.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1
	[0070.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.195] lstrlenW (lpString=".doc") returned 4
	[0070.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.195] lstrlenW (lpString=".docx") returned 5
	[0070.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.195] lstrlenW (lpString=".pdf") returned 4
	[0070.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.195] lstrlenW (lpString=".xls") returned 4
	[0070.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.195] lstrlenW (lpString=".xlsx") returned 5
	[0070.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.196] lstrlenW (lpString=".ppt") returned 4
	[0070.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.196] lstrlenW (lpString=".zip") returned 4
	[0070.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.196] lstrlenW (lpString=".rar") returned 4
	[0070.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.196] lstrlenW (lpString=".bz2") returned 4
	[0070.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.196] lstrlenW (lpString=".7z") returned 3
	[0070.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.196] lstrlenW (lpString=".dbf") returned 4
	[0070.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.196] lstrlenW (lpString=".1cd") returned 4
	[0070.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.196] lstrlenW (lpString=".jpg") returned 4
	[0070.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.197] lstrlenW (lpString=".doc") returned 4
	[0070.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.197] lstrlenW (lpString=".docx") returned 5
	[0070.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.197] lstrlenW (lpString=".pdf") returned 4
	[0070.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.197] lstrlenW (lpString=".xls") returned 4
	[0070.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.197] lstrlenW (lpString=".xlsx") returned 5
	[0070.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.198] lstrlenW (lpString=".ppt") returned 4
	[0070.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.198] lstrlenW (lpString=".zip") returned 4
	[0070.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.198] lstrlenW (lpString=".rar") returned 4
	[0070.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.198] lstrlenW (lpString=".bz2") returned 4
	[0070.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.198] lstrlenW (lpString=".7z") returned 3
	[0070.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.198] lstrlenW (lpString=".dbf") returned 4
	[0070.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.198] lstrlenW (lpString=".1cd") returned 4
	[0070.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0070.198] lstrlenW (lpString=".jpg") returned 4
	[0070.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.198] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.199] lstrlenW (lpString="AN01184_.WMF") returned 12
	[0070.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.199] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3746) returned 1
	[0070.199] CloseHandle (hObject=0x38c) returned 1
	[0070.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220
	[0070.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.199] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.199] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0070.200] GetLastError () returned 0x0
	[0070.200] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xea2, lpOverlapped=0x0) returned 1
	[0070.890] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0070.891] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.891] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.891] SetEndOfFile (hFile=0x340) returned 1
	[0070.892] CloseHandle (hObject=0x340) returned 1
	[0070.892] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.893] SetEndOfFile (hFile=0x38c) returned 1
	[0070.893] CloseHandle (hObject=0x38c) returned 1
	[0070.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1
	[0070.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.894] lstrlenW (lpString=".doc") returned 4
	[0070.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.894] lstrlenW (lpString=".docx") returned 5
	[0070.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.894] lstrlenW (lpString=".pdf") returned 4
	[0070.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.894] lstrlenW (lpString=".xls") returned 4
	[0070.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.894] lstrlenW (lpString=".xlsx") returned 5
	[0070.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.895] lstrlenW (lpString=".ppt") returned 4
	[0070.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.895] lstrlenW (lpString=".zip") returned 4
	[0070.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.895] lstrlenW (lpString=".rar") returned 4
	[0070.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.895] lstrlenW (lpString=".bz2") returned 4
	[0070.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.895] lstrlenW (lpString=".7z") returned 3
	[0070.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.895] lstrlenW (lpString=".dbf") returned 4
	[0070.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.895] lstrlenW (lpString=".1cd") returned 4
	[0070.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.895] lstrlenW (lpString=".jpg") returned 4
	[0070.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.896] lstrlenW (lpString=".doc") returned 4
	[0070.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.896] lstrlenW (lpString=".docx") returned 5
	[0070.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.896] lstrlenW (lpString=".pdf") returned 4
	[0070.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.896] lstrlenW (lpString=".xls") returned 4
	[0070.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.896] lstrlenW (lpString=".xlsx") returned 5
	[0070.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.896] lstrlenW (lpString=".ppt") returned 4
	[0070.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.896] lstrlenW (lpString=".zip") returned 4
	[0070.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.896] lstrlenW (lpString=".rar") returned 4
	[0070.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.896] lstrlenW (lpString=".bz2") returned 4
	[0070.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.896] lstrlenW (lpString=".7z") returned 3
	[0070.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.896] lstrlenW (lpString=".dbf") returned 4
	[0070.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.897] lstrlenW (lpString=".1cd") returned 4
	[0070.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0070.897] lstrlenW (lpString=".jpg") returned 4
	[0070.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.897] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.897] lstrlenW (lpString="AN04174_.WMF") returned 12
	[0070.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.897] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=2636) returned 1
	[0070.897] CloseHandle (hObject=0x38c) returned 1
	[0070.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220
	[0070.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.898] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.898] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0070.898] GetLastError () returned 0x0
	[0070.898] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xa4c, lpOverlapped=0x0) returned 1
	[0070.900] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xa50, lpOverlapped=0x0) returned 1
	[0070.901] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.901] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.901] SetEndOfFile (hFile=0x340) returned 1
	[0070.901] CloseHandle (hObject=0x340) returned 1
	[0070.902] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.902] SetEndOfFile (hFile=0x38c) returned 1
	[0070.903] CloseHandle (hObject=0x38c) returned 1
	[0070.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1
	[0070.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.903] lstrlenW (lpString=".doc") returned 4
	[0070.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.903] lstrlenW (lpString=".docx") returned 5
	[0070.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.904] lstrlenW (lpString=".pdf") returned 4
	[0070.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.904] lstrlenW (lpString=".xls") returned 4
	[0070.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.904] lstrlenW (lpString=".xlsx") returned 5
	[0070.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.904] lstrlenW (lpString=".ppt") returned 4
	[0070.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.904] lstrlenW (lpString=".zip") returned 4
	[0070.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.904] lstrlenW (lpString=".rar") returned 4
	[0070.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.904] lstrlenW (lpString=".bz2") returned 4
	[0070.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.904] lstrlenW (lpString=".7z") returned 3
	[0070.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.904] lstrlenW (lpString=".dbf") returned 4
	[0070.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.905] lstrlenW (lpString=".1cd") returned 4
	[0070.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.905] lstrlenW (lpString=".jpg") returned 4
	[0070.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.905] lstrlenW (lpString=".doc") returned 4
	[0070.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.905] lstrlenW (lpString=".docx") returned 5
	[0070.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.905] lstrlenW (lpString=".pdf") returned 4
	[0070.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.905] lstrlenW (lpString=".xls") returned 4
	[0070.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.905] lstrlenW (lpString=".xlsx") returned 5
	[0070.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.906] lstrlenW (lpString=".ppt") returned 4
	[0070.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.906] lstrlenW (lpString=".zip") returned 4
	[0070.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.906] lstrlenW (lpString=".rar") returned 4
	[0070.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.906] lstrlenW (lpString=".bz2") returned 4
	[0070.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.906] lstrlenW (lpString=".7z") returned 3
	[0070.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.906] lstrlenW (lpString=".dbf") returned 4
	[0070.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.906] lstrlenW (lpString=".1cd") returned 4
	[0070.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0070.906] lstrlenW (lpString=".jpg") returned 4
	[0070.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.907] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.907] lstrlenW (lpString="AN04191_.WMF") returned 12
	[0070.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.907] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=6636) returned 1
	[0070.907] CloseHandle (hObject=0x38c) returned 1
	[0070.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220
	[0070.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.908] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.908] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0070.908] GetLastError () returned 0x0
	[0070.908] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x19ec, lpOverlapped=0x0) returned 1
	[0070.910] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x19f0, lpOverlapped=0x0) returned 1
	[0070.911] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.911] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.911] SetEndOfFile (hFile=0x340) returned 1
	[0070.911] CloseHandle (hObject=0x340) returned 1
	[0070.912] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.912] SetEndOfFile (hFile=0x38c) returned 1
	[0070.913] CloseHandle (hObject=0x38c) returned 1
	[0070.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1
	[0070.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.913] lstrlenW (lpString=".doc") returned 4
	[0070.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.913] lstrlenW (lpString=".docx") returned 5
	[0070.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.913] lstrlenW (lpString=".pdf") returned 4
	[0070.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.913] lstrlenW (lpString=".xls") returned 4
	[0070.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.913] lstrlenW (lpString=".xlsx") returned 5
	[0070.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.914] lstrlenW (lpString=".ppt") returned 4
	[0070.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.914] lstrlenW (lpString=".zip") returned 4
	[0070.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.914] lstrlenW (lpString=".rar") returned 4
	[0070.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.914] lstrlenW (lpString=".bz2") returned 4
	[0070.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.914] lstrlenW (lpString=".7z") returned 3
	[0070.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.914] lstrlenW (lpString=".dbf") returned 4
	[0070.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.914] lstrlenW (lpString=".1cd") returned 4
	[0070.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.914] lstrlenW (lpString=".jpg") returned 4
	[0070.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.914] lstrlenW (lpString=".doc") returned 4
	[0070.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.914] lstrlenW (lpString=".docx") returned 5
	[0070.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.915] lstrlenW (lpString=".pdf") returned 4
	[0070.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.915] lstrlenW (lpString=".xls") returned 4
	[0070.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.915] lstrlenW (lpString=".xlsx") returned 5
	[0070.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.915] lstrlenW (lpString=".ppt") returned 4
	[0070.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.915] lstrlenW (lpString=".zip") returned 4
	[0070.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.915] lstrlenW (lpString=".rar") returned 4
	[0070.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.915] lstrlenW (lpString=".bz2") returned 4
	[0070.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.916] lstrlenW (lpString=".7z") returned 3
	[0070.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.916] lstrlenW (lpString=".dbf") returned 4
	[0070.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.917] lstrlenW (lpString=".1cd") returned 4
	[0070.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0070.917] lstrlenW (lpString=".jpg") returned 4
	[0070.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.917] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.917] lstrlenW (lpString="AN04195_.WMF") returned 12
	[0070.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.917] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4612) returned 1
	[0070.917] CloseHandle (hObject=0x38c) returned 1
	[0070.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220
	[0070.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0070.918] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.918] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0070.918] GetLastError () returned 0x0
	[0070.918] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1204, lpOverlapped=0x0) returned 1
	[0070.920] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1210, lpOverlapped=0x0) returned 1
	[0070.921] ReadFile (in: hFile=0x38c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.921] WriteFile (in: hFile=0x340, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.921] SetEndOfFile (hFile=0x340) returned 1
	[0070.921] CloseHandle (hObject=0x340) returned 1
	[0070.922] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.922] SetEndOfFile (hFile=0x38c) returned 1
	[0070.923] CloseHandle (hObject=0x38c) returned 1
	[0070.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0070.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1
	[0070.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.924] lstrlenW (lpString=".doc") returned 4
	[0070.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.924] lstrlenW (lpString=".docx") returned 5
	[0070.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.924] lstrlenW (lpString=".pdf") returned 4
	[0070.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.924] lstrlenW (lpString=".xls") returned 4
	[0070.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.924] lstrlenW (lpString=".xlsx") returned 5
	[0070.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.924] lstrlenW (lpString=".ppt") returned 4
	[0070.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.924] lstrlenW (lpString=".zip") returned 4
	[0070.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.924] lstrlenW (lpString=".rar") returned 4
	[0070.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.924] lstrlenW (lpString=".bz2") returned 4
	[0070.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.924] lstrlenW (lpString=".7z") returned 3
	[0070.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.925] lstrlenW (lpString=".dbf") returned 4
	[0070.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.925] lstrlenW (lpString=".1cd") returned 4
	[0070.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.925] lstrlenW (lpString=".jpg") returned 4
	[0070.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.925] lstrlenW (lpString=".doc") returned 4
	[0070.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.925] lstrlenW (lpString=".docx") returned 5
	[0070.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.925] lstrlenW (lpString=".pdf") returned 4
	[0070.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.925] lstrlenW (lpString=".xls") returned 4
	[0070.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.925] lstrlenW (lpString=".xlsx") returned 5
	[0070.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.925] lstrlenW (lpString=".ppt") returned 4
	[0070.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.926] lstrlenW (lpString=".zip") returned 4
	[0070.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.926] lstrlenW (lpString=".rar") returned 4
	[0070.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.926] lstrlenW (lpString=".bz2") returned 4
	[0070.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.926] lstrlenW (lpString=".7z") returned 3
	[0070.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.926] lstrlenW (lpString=".dbf") returned 4
	[0070.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.926] lstrlenW (lpString=".1cd") returned 4
	[0070.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0070.926] lstrlenW (lpString=".jpg") returned 4
	[0070.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.926] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0070.926] lstrlenW (lpString="AN04196_.WMF") returned 12
	[0070.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0071.203] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3144) returned 1
	[0071.216] CloseHandle (hObject=0x340) returned 1
	[0071.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220
	[0071.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0071.216] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.216] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0071.217] GetLastError () returned 0x0
	[0071.217] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xc48, lpOverlapped=0x0) returned 1
	[0071.218] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xc50, lpOverlapped=0x0) returned 1
	[0071.219] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.219] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.219] SetEndOfFile (hFile=0x37c) returned 1
	[0071.219] CloseHandle (hObject=0x37c) returned 1
	[0071.220] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.220] SetEndOfFile (hFile=0x340) returned 1
	[0071.221] CloseHandle (hObject=0x340) returned 1
	[0071.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1
	[0071.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.222] lstrlenW (lpString=".doc") returned 4
	[0071.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.222] lstrlenW (lpString=".docx") returned 5
	[0071.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.222] lstrlenW (lpString=".pdf") returned 4
	[0071.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.222] lstrlenW (lpString=".xls") returned 4
	[0071.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.222] lstrlenW (lpString=".xlsx") returned 5
	[0071.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.222] lstrlenW (lpString=".ppt") returned 4
	[0071.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.222] lstrlenW (lpString=".zip") returned 4
	[0071.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.222] lstrlenW (lpString=".rar") returned 4
	[0071.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.223] lstrlenW (lpString=".bz2") returned 4
	[0071.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.223] lstrlenW (lpString=".7z") returned 3
	[0071.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.223] lstrlenW (lpString=".dbf") returned 4
	[0071.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.223] lstrlenW (lpString=".1cd") returned 4
	[0071.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.223] lstrlenW (lpString=".jpg") returned 4
	[0071.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.223] lstrlenW (lpString=".doc") returned 4
	[0071.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.223] lstrlenW (lpString=".docx") returned 5
	[0071.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.223] lstrlenW (lpString=".pdf") returned 4
	[0071.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.223] lstrlenW (lpString=".xls") returned 4
	[0071.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.223] lstrlenW (lpString=".xlsx") returned 5
	[0071.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.223] lstrlenW (lpString=".ppt") returned 4
	[0071.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.224] lstrlenW (lpString=".zip") returned 4
	[0071.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.224] lstrlenW (lpString=".rar") returned 4
	[0071.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.224] lstrlenW (lpString=".bz2") returned 4
	[0071.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.224] lstrlenW (lpString=".7z") returned 3
	[0071.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.224] lstrlenW (lpString=".dbf") returned 4
	[0071.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.224] lstrlenW (lpString=".1cd") returned 4
	[0071.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0071.224] lstrlenW (lpString=".jpg") returned 4
	[0071.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.224] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.224] lstrlenW (lpString="AN04355_.WMF") returned 12
	[0071.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0071.225] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3228) returned 1
	[0071.225] CloseHandle (hObject=0x340) returned 1
	[0071.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220
	[0071.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0071.225] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.225] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0071.226] GetLastError () returned 0x0
	[0071.226] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xc9c, lpOverlapped=0x0) returned 1
	[0071.227] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xca0, lpOverlapped=0x0) returned 1
	[0071.228] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.228] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.228] SetEndOfFile (hFile=0x37c) returned 1
	[0071.229] CloseHandle (hObject=0x37c) returned 1
	[0071.229] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.229] SetEndOfFile (hFile=0x340) returned 1
	[0071.230] CloseHandle (hObject=0x340) returned 1
	[0071.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1
	[0071.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.231] lstrlenW (lpString=".doc") returned 4
	[0071.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.231] lstrlenW (lpString=".docx") returned 5
	[0071.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.231] lstrlenW (lpString=".pdf") returned 4
	[0071.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.231] lstrlenW (lpString=".xls") returned 4
	[0071.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.231] lstrlenW (lpString=".xlsx") returned 5
	[0071.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.231] lstrlenW (lpString=".ppt") returned 4
	[0071.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.231] lstrlenW (lpString=".zip") returned 4
	[0071.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.231] lstrlenW (lpString=".rar") returned 4
	[0071.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.231] lstrlenW (lpString=".bz2") returned 4
	[0071.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.231] lstrlenW (lpString=".7z") returned 3
	[0071.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.232] lstrlenW (lpString=".dbf") returned 4
	[0071.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.232] lstrlenW (lpString=".1cd") returned 4
	[0071.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.232] lstrlenW (lpString=".jpg") returned 4
	[0071.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.232] lstrlenW (lpString=".doc") returned 4
	[0071.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.232] lstrlenW (lpString=".docx") returned 5
	[0071.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.232] lstrlenW (lpString=".pdf") returned 4
	[0071.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.232] lstrlenW (lpString=".xls") returned 4
	[0071.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.232] lstrlenW (lpString=".xlsx") returned 5
	[0071.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.232] lstrlenW (lpString=".ppt") returned 4
	[0071.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.232] lstrlenW (lpString=".zip") returned 4
	[0071.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.233] lstrlenW (lpString=".rar") returned 4
	[0071.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.233] lstrlenW (lpString=".bz2") returned 4
	[0071.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.233] lstrlenW (lpString=".7z") returned 3
	[0071.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.233] lstrlenW (lpString=".dbf") returned 4
	[0071.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.233] lstrlenW (lpString=".1cd") returned 4
	[0071.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0071.233] lstrlenW (lpString=".jpg") returned 4
	[0071.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.233] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.233] lstrlenW (lpString="AN04369_.WMF") returned 12
	[0071.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0071.234] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4808) returned 1
	[0071.234] CloseHandle (hObject=0x340) returned 1
	[0071.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220
	[0071.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0071.234] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.235] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0071.235] GetLastError () returned 0x0
	[0071.235] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x12c8, lpOverlapped=0x0) returned 1
	[0071.236] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x12d0, lpOverlapped=0x0) returned 1
	[0071.237] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.237] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.237] SetEndOfFile (hFile=0x37c) returned 1
	[0071.238] CloseHandle (hObject=0x37c) returned 1
	[0071.238] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.238] SetEndOfFile (hFile=0x340) returned 1
	[0071.239] CloseHandle (hObject=0x340) returned 1
	[0071.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1
	[0071.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.240] lstrlenW (lpString=".doc") returned 4
	[0071.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString=".docx") returned 5
	[0071.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.240] lstrlenW (lpString=".pdf") returned 4
	[0071.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString=".xls") returned 4
	[0071.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.240] lstrlenW (lpString=".xlsx") returned 5
	[0071.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.240] lstrlenW (lpString=".ppt") returned 4
	[0071.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.240] lstrlenW (lpString=".zip") returned 4
	[0071.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.240] lstrlenW (lpString=".rar") returned 4
	[0071.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString=".bz2") returned 4
	[0071.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString=".7z") returned 3
	[0071.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.240] lstrlenW (lpString=".dbf") returned 4
	[0071.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.241] lstrlenW (lpString=".1cd") returned 4
	[0071.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.241] lstrlenW (lpString=".jpg") returned 4
	[0071.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.241] lstrlenW (lpString=".doc") returned 4
	[0071.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString=".docx") returned 5
	[0071.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.241] lstrlenW (lpString=".pdf") returned 4
	[0071.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString=".xls") returned 4
	[0071.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.241] lstrlenW (lpString=".xlsx") returned 5
	[0071.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.241] lstrlenW (lpString=".ppt") returned 4
	[0071.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.241] lstrlenW (lpString=".zip") returned 4
	[0071.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.241] lstrlenW (lpString=".rar") returned 4
	[0071.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString=".bz2") returned 4
	[0071.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString=".7z") returned 3
	[0071.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.242] lstrlenW (lpString=".dbf") returned 4
	[0071.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.242] lstrlenW (lpString=".1cd") returned 4
	[0071.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0071.242] lstrlenW (lpString=".jpg") returned 4
	[0071.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.242] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.242] lstrlenW (lpString="AN04384_.WMF") returned 12
	[0071.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0071.243] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4996) returned 1
	[0071.243] CloseHandle (hObject=0x340) returned 1
	[0071.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220
	[0071.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0071.244] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.244] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0071.244] GetLastError () returned 0x0
	[0071.244] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1384, lpOverlapped=0x0) returned 1
	[0071.246] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1390, lpOverlapped=0x0) returned 1
	[0071.247] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.247] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.247] SetEndOfFile (hFile=0x37c) returned 1
	[0071.247] CloseHandle (hObject=0x37c) returned 1
	[0071.248] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.248] SetEndOfFile (hFile=0x340) returned 1
	[0071.249] CloseHandle (hObject=0x340) returned 1
	[0071.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0071.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1
	[0071.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.249] lstrlenW (lpString=".doc") returned 4
	[0071.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.249] lstrlenW (lpString=".docx") returned 5
	[0071.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.249] lstrlenW (lpString=".pdf") returned 4
	[0071.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.249] lstrlenW (lpString=".xls") returned 4
	[0071.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.249] lstrlenW (lpString=".xlsx") returned 5
	[0071.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.250] lstrlenW (lpString=".ppt") returned 4
	[0071.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.250] lstrlenW (lpString=".zip") returned 4
	[0071.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.250] lstrlenW (lpString=".rar") returned 4
	[0071.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString=".bz2") returned 4
	[0071.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString=".7z") returned 3
	[0071.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.250] lstrlenW (lpString=".dbf") returned 4
	[0071.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.250] lstrlenW (lpString=".1cd") returned 4
	[0071.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.250] lstrlenW (lpString=".jpg") returned 4
	[0071.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.250] lstrlenW (lpString=".doc") returned 4
	[0071.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString=".docx") returned 5
	[0071.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.250] lstrlenW (lpString=".pdf") returned 4
	[0071.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.251] lstrlenW (lpString=".xls") returned 4
	[0071.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.251] lstrlenW (lpString=".xlsx") returned 5
	[0071.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.251] lstrlenW (lpString=".ppt") returned 4
	[0071.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.251] lstrlenW (lpString=".zip") returned 4
	[0071.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.251] lstrlenW (lpString=".rar") returned 4
	[0071.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.251] lstrlenW (lpString=".bz2") returned 4
	[0071.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.251] lstrlenW (lpString=".7z") returned 3
	[0071.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.251] lstrlenW (lpString=".dbf") returned 4
	[0071.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.251] lstrlenW (lpString=".1cd") returned 4
	[0071.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0071.251] lstrlenW (lpString=".jpg") returned 4
	[0071.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.251] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0071.251] lstrlenW (lpString="AN04385_.WMF") returned 12
	[0071.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0071.252] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=5004) returned 1
	[0071.252] CloseHandle (hObject=0x340) returned 1
	[0071.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220
	[0071.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0071.252] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.252] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0071.253] GetLastError () returned 0x0
	[0071.253] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x138c, lpOverlapped=0x0) returned 1
	[0071.578] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1390, lpOverlapped=0x0) returned 1
	[0071.579] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.579] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.579] SetEndOfFile (hFile=0x37c) returned 1
	[0072.216] CloseHandle (hObject=0x37c) returned 1
	[0072.217] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.217] SetEndOfFile (hFile=0x340) returned 1
	[0072.218] CloseHandle (hObject=0x340) returned 1
	[0072.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1
	[0072.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.219] lstrlenW (lpString=".doc") returned 4
	[0072.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.219] lstrlenW (lpString=".docx") returned 5
	[0072.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.219] lstrlenW (lpString=".pdf") returned 4
	[0072.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.219] lstrlenW (lpString=".xls") returned 4
	[0072.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.219] lstrlenW (lpString=".xlsx") returned 5
	[0072.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.219] lstrlenW (lpString=".ppt") returned 4
	[0072.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.219] lstrlenW (lpString=".zip") returned 4
	[0072.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.219] lstrlenW (lpString=".rar") returned 4
	[0072.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.219] lstrlenW (lpString=".bz2") returned 4
	[0072.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.219] lstrlenW (lpString=".7z") returned 3
	[0072.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.220] lstrlenW (lpString=".dbf") returned 4
	[0072.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.220] lstrlenW (lpString=".1cd") returned 4
	[0072.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.220] lstrlenW (lpString=".jpg") returned 4
	[0072.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.220] lstrlenW (lpString=".doc") returned 4
	[0072.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.220] lstrlenW (lpString=".docx") returned 5
	[0072.220] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.220] lstrlenW (lpString=".pdf") returned 4
	[0072.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.220] lstrlenW (lpString=".xls") returned 4
	[0072.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.220] lstrlenW (lpString=".xlsx") returned 5
	[0072.220] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.220] lstrlenW (lpString=".ppt") returned 4
	[0072.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.221] lstrlenW (lpString=".zip") returned 4
	[0072.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.221] lstrlenW (lpString=".rar") returned 4
	[0072.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.221] lstrlenW (lpString=".bz2") returned 4
	[0072.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.221] lstrlenW (lpString=".7z") returned 3
	[0072.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.221] lstrlenW (lpString=".dbf") returned 4
	[0072.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.221] lstrlenW (lpString=".1cd") returned 4
	[0072.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.221] lstrlenW (lpString=".jpg") returned 4
	[0072.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.221] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.221] lstrlenW (lpString="BD08808_.WMF") returned 12
	[0072.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.222] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=47996) returned 1
	[0072.222] CloseHandle (hObject=0x340) returned 1
	[0072.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220
	[0072.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.222] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.222] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.223] GetLastError () returned 0x0
	[0072.223] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xbb7c, lpOverlapped=0x0) returned 1
	[0072.225] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xbb80, lpOverlapped=0x0) returned 1
	[0072.227] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.227] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.227] SetEndOfFile (hFile=0x37c) returned 1
	[0072.227] CloseHandle (hObject=0x37c) returned 1
	[0072.228] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.229] SetEndOfFile (hFile=0x340) returned 1
	[0072.230] CloseHandle (hObject=0x340) returned 1
	[0072.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1
	[0072.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.230] lstrlenW (lpString=".doc") returned 4
	[0072.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.231] lstrlenW (lpString=".docx") returned 5
	[0072.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.231] lstrlenW (lpString=".pdf") returned 4
	[0072.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.231] lstrlenW (lpString=".xls") returned 4
	[0072.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.231] lstrlenW (lpString=".xlsx") returned 5
	[0072.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.231] lstrlenW (lpString=".ppt") returned 4
	[0072.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.231] lstrlenW (lpString=".zip") returned 4
	[0072.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.231] lstrlenW (lpString=".rar") returned 4
	[0072.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.231] lstrlenW (lpString=".bz2") returned 4
	[0072.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.231] lstrlenW (lpString=".7z") returned 3
	[0072.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.231] lstrlenW (lpString=".dbf") returned 4
	[0072.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.231] lstrlenW (lpString=".1cd") returned 4
	[0072.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.232] lstrlenW (lpString=".jpg") returned 4
	[0072.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.232] lstrlenW (lpString=".doc") returned 4
	[0072.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.232] lstrlenW (lpString=".docx") returned 5
	[0072.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.232] lstrlenW (lpString=".pdf") returned 4
	[0072.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.232] lstrlenW (lpString=".xls") returned 4
	[0072.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.232] lstrlenW (lpString=".xlsx") returned 5
	[0072.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.232] lstrlenW (lpString=".ppt") returned 4
	[0072.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.232] lstrlenW (lpString=".zip") returned 4
	[0072.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.232] lstrlenW (lpString=".rar") returned 4
	[0072.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.232] lstrlenW (lpString=".bz2") returned 4
	[0072.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.233] lstrlenW (lpString=".7z") returned 3
	[0072.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.233] lstrlenW (lpString=".dbf") returned 4
	[0072.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.233] lstrlenW (lpString=".1cd") returned 4
	[0072.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.233] lstrlenW (lpString=".jpg") returned 4
	[0072.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.233] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.233] lstrlenW (lpString="BD08868_.WMF") returned 12
	[0072.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.233] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=40206) returned 1
	[0072.233] CloseHandle (hObject=0x340) returned 1
	[0072.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220
	[0072.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.234] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.234] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.234] GetLastError () returned 0x0
	[0072.234] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x9d0e, lpOverlapped=0x0) returned 1
	[0072.236] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x9d10, lpOverlapped=0x0) returned 1
	[0072.238] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.238] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.238] SetEndOfFile (hFile=0x37c) returned 1
	[0072.238] CloseHandle (hObject=0x37c) returned 1
	[0072.240] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.240] SetEndOfFile (hFile=0x340) returned 1
	[0072.241] CloseHandle (hObject=0x340) returned 1
	[0072.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1
	[0072.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.241] lstrlenW (lpString=".doc") returned 4
	[0072.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.241] lstrlenW (lpString=".docx") returned 5
	[0072.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.242] lstrlenW (lpString=".pdf") returned 4
	[0072.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.242] lstrlenW (lpString=".xls") returned 4
	[0072.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.242] lstrlenW (lpString=".xlsx") returned 5
	[0072.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.242] lstrlenW (lpString=".ppt") returned 4
	[0072.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.242] lstrlenW (lpString=".zip") returned 4
	[0072.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.242] lstrlenW (lpString=".rar") returned 4
	[0072.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.242] lstrlenW (lpString=".bz2") returned 4
	[0072.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.242] lstrlenW (lpString=".7z") returned 3
	[0072.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.242] lstrlenW (lpString=".dbf") returned 4
	[0072.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.242] lstrlenW (lpString=".1cd") returned 4
	[0072.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.242] lstrlenW (lpString=".jpg") returned 4
	[0072.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.243] lstrlenW (lpString=".doc") returned 4
	[0072.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.243] lstrlenW (lpString=".docx") returned 5
	[0072.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.243] lstrlenW (lpString=".pdf") returned 4
	[0072.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.243] lstrlenW (lpString=".xls") returned 4
	[0072.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.243] lstrlenW (lpString=".xlsx") returned 5
	[0072.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.243] lstrlenW (lpString=".ppt") returned 4
	[0072.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.243] lstrlenW (lpString=".zip") returned 4
	[0072.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.243] lstrlenW (lpString=".rar") returned 4
	[0072.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.243] lstrlenW (lpString=".bz2") returned 4
	[0072.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.243] lstrlenW (lpString=".7z") returned 3
	[0072.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.243] lstrlenW (lpString=".dbf") returned 4
	[0072.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.243] lstrlenW (lpString=".1cd") returned 4
	[0072.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.243] lstrlenW (lpString=".jpg") returned 4
	[0072.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.244] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.244] lstrlenW (lpString="BD09031_.WMF") returned 12
	[0072.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.245] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=47786) returned 1
	[0072.245] CloseHandle (hObject=0x340) returned 1
	[0072.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220
	[0072.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.245] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.245] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.246] GetLastError () returned 0x0
	[0072.246] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xbaaa, lpOverlapped=0x0) returned 1
	[0072.248] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xbab0, lpOverlapped=0x0) returned 1
	[0072.249] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.249] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.249] SetEndOfFile (hFile=0x37c) returned 1
	[0072.250] CloseHandle (hObject=0x37c) returned 1
	[0072.251] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.251] SetEndOfFile (hFile=0x340) returned 1
	[0072.252] CloseHandle (hObject=0x340) returned 1
	[0072.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1
	[0072.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.253] lstrlenW (lpString=".doc") returned 4
	[0072.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.253] lstrlenW (lpString=".docx") returned 5
	[0072.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.253] lstrlenW (lpString=".pdf") returned 4
	[0072.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.253] lstrlenW (lpString=".xls") returned 4
	[0072.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.254] lstrlenW (lpString=".xlsx") returned 5
	[0072.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.254] lstrlenW (lpString=".ppt") returned 4
	[0072.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.661] lstrlenW (lpString=".zip") returned 4
	[0072.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.661] lstrlenW (lpString=".rar") returned 4
	[0072.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.661] lstrlenW (lpString=".bz2") returned 4
	[0072.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.661] lstrlenW (lpString=".7z") returned 3
	[0072.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.661] lstrlenW (lpString=".dbf") returned 4
	[0072.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.661] lstrlenW (lpString=".1cd") returned 4
	[0072.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.661] lstrlenW (lpString=".jpg") returned 4
	[0072.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.661] lstrlenW (lpString=".doc") returned 4
	[0072.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.662] lstrlenW (lpString=".docx") returned 5
	[0072.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.662] lstrlenW (lpString=".pdf") returned 4
	[0072.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.662] lstrlenW (lpString=".xls") returned 4
	[0072.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.662] lstrlenW (lpString=".xlsx") returned 5
	[0072.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.662] lstrlenW (lpString=".ppt") returned 4
	[0072.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.662] lstrlenW (lpString=".zip") returned 4
	[0072.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.662] lstrlenW (lpString=".rar") returned 4
	[0072.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.662] lstrlenW (lpString=".bz2") returned 4
	[0072.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.662] lstrlenW (lpString=".7z") returned 3
	[0072.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.662] lstrlenW (lpString=".dbf") returned 4
	[0072.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.662] lstrlenW (lpString=".1cd") returned 4
	[0072.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0072.663] lstrlenW (lpString=".jpg") returned 4
	[0072.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.663] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.663] lstrlenW (lpString="BD19828_.WMF") returned 12
	[0072.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0072.664] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=8772) returned 1
	[0072.664] CloseHandle (hObject=0x370) returned 1
	[0072.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220
	[0072.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0072.664] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.664] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0072.665] GetLastError () returned 0x0
	[0072.665] ReadFile (in: hFile=0x370, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x2244, lpOverlapped=0x0) returned 1
	[0072.667] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x2250, lpOverlapped=0x0) returned 1
	[0072.668] ReadFile (in: hFile=0x370, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.668] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.668] SetEndOfFile (hFile=0x360) returned 1
	[0072.669] CloseHandle (hObject=0x360) returned 1
	[0072.669] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.669] SetEndOfFile (hFile=0x370) returned 1
	[0072.670] CloseHandle (hObject=0x370) returned 1
	[0072.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1
	[0072.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.671] lstrlenW (lpString=".doc") returned 4
	[0072.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.671] lstrlenW (lpString=".docx") returned 5
	[0072.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.671] lstrlenW (lpString=".pdf") returned 4
	[0072.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.671] lstrlenW (lpString=".xls") returned 4
	[0072.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.672] lstrlenW (lpString=".xlsx") returned 5
	[0072.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.672] lstrlenW (lpString=".ppt") returned 4
	[0072.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.672] lstrlenW (lpString=".zip") returned 4
	[0072.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.672] lstrlenW (lpString=".rar") returned 4
	[0072.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.672] lstrlenW (lpString=".bz2") returned 4
	[0072.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.672] lstrlenW (lpString=".7z") returned 3
	[0072.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.672] lstrlenW (lpString=".dbf") returned 4
	[0072.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.672] lstrlenW (lpString=".1cd") returned 4
	[0072.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.672] lstrlenW (lpString=".jpg") returned 4
	[0072.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.673] lstrlenW (lpString=".doc") returned 4
	[0072.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.673] lstrlenW (lpString=".docx") returned 5
	[0072.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.673] lstrlenW (lpString=".pdf") returned 4
	[0072.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.673] lstrlenW (lpString=".xls") returned 4
	[0072.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.673] lstrlenW (lpString=".xlsx") returned 5
	[0072.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.673] lstrlenW (lpString=".ppt") returned 4
	[0072.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.673] lstrlenW (lpString=".zip") returned 4
	[0072.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.673] lstrlenW (lpString=".rar") returned 4
	[0072.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.673] lstrlenW (lpString=".bz2") returned 4
	[0072.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.673] lstrlenW (lpString=".7z") returned 3
	[0072.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.673] lstrlenW (lpString=".dbf") returned 4
	[0072.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.674] lstrlenW (lpString=".1cd") returned 4
	[0072.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0072.674] lstrlenW (lpString=".jpg") returned 4
	[0072.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.674] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.674] lstrlenW (lpString="BD19986_.WMF") returned 12
	[0072.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0072.674] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=14486) returned 1
	[0072.674] CloseHandle (hObject=0x370) returned 1
	[0072.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220
	[0072.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0072.675] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.675] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0072.675] GetLastError () returned 0x0
	[0072.675] ReadFile (in: hFile=0x370, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x3896, lpOverlapped=0x0) returned 1
	[0072.677] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x38a0, lpOverlapped=0x0) returned 1
	[0072.678] ReadFile (in: hFile=0x370, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.678] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.678] SetEndOfFile (hFile=0x360) returned 1
	[0072.678] CloseHandle (hObject=0x360) returned 1
	[0072.680] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.680] SetEndOfFile (hFile=0x370) returned 1
	[0072.681] CloseHandle (hObject=0x370) returned 1
	[0072.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1
	[0072.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.681] lstrlenW (lpString=".doc") returned 4
	[0072.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.682] lstrlenW (lpString=".docx") returned 5
	[0072.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.682] lstrlenW (lpString=".pdf") returned 4
	[0072.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.682] lstrlenW (lpString=".xls") returned 4
	[0072.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.682] lstrlenW (lpString=".xlsx") returned 5
	[0072.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.682] lstrlenW (lpString=".ppt") returned 4
	[0072.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.682] lstrlenW (lpString=".zip") returned 4
	[0072.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.682] lstrlenW (lpString=".rar") returned 4
	[0072.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.682] lstrlenW (lpString=".bz2") returned 4
	[0072.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.682] lstrlenW (lpString=".7z") returned 3
	[0072.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.683] lstrlenW (lpString=".dbf") returned 4
	[0072.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.683] lstrlenW (lpString=".1cd") returned 4
	[0072.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.683] lstrlenW (lpString=".jpg") returned 4
	[0072.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.683] lstrlenW (lpString=".doc") returned 4
	[0072.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.683] lstrlenW (lpString=".docx") returned 5
	[0072.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.683] lstrlenW (lpString=".pdf") returned 4
	[0072.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.684] lstrlenW (lpString=".xls") returned 4
	[0072.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.684] lstrlenW (lpString=".xlsx") returned 5
	[0072.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.684] lstrlenW (lpString=".ppt") returned 4
	[0072.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.684] lstrlenW (lpString=".zip") returned 4
	[0072.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.684] lstrlenW (lpString=".rar") returned 4
	[0072.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.684] lstrlenW (lpString=".bz2") returned 4
	[0072.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.684] lstrlenW (lpString=".7z") returned 3
	[0072.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.684] lstrlenW (lpString=".dbf") returned 4
	[0072.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.685] lstrlenW (lpString=".1cd") returned 4
	[0072.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0072.685] lstrlenW (lpString=".jpg") returned 4
	[0072.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.685] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.685] lstrlenW (lpString="BD19988_.WMF") returned 12
	[0072.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0072.686] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=18304) returned 1
	[0072.686] CloseHandle (hObject=0x370) returned 1
	[0072.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220
	[0072.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0072.686] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.686] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0072.687] GetLastError () returned 0x0
	[0072.687] ReadFile (in: hFile=0x370, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x4780, lpOverlapped=0x0) returned 1
	[0072.688] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x4790, lpOverlapped=0x0) returned 1
	[0072.690] ReadFile (in: hFile=0x370, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.690] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.690] SetEndOfFile (hFile=0x360) returned 1
	[0072.690] CloseHandle (hObject=0x360) returned 1
	[0072.691] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.691] SetEndOfFile (hFile=0x370) returned 1
	[0072.692] CloseHandle (hObject=0x370) returned 1
	[0072.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0072.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1
	[0072.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.693] lstrlenW (lpString=".doc") returned 4
	[0072.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.693] lstrlenW (lpString=".docx") returned 5
	[0072.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.693] lstrlenW (lpString=".pdf") returned 4
	[0072.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.693] lstrlenW (lpString=".xls") returned 4
	[0072.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.693] lstrlenW (lpString=".xlsx") returned 5
	[0072.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.693] lstrlenW (lpString=".ppt") returned 4
	[0072.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.693] lstrlenW (lpString=".zip") returned 4
	[0072.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.693] lstrlenW (lpString=".rar") returned 4
	[0072.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.693] lstrlenW (lpString=".bz2") returned 4
	[0072.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.694] lstrlenW (lpString=".7z") returned 3
	[0072.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.694] lstrlenW (lpString=".dbf") returned 4
	[0072.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.694] lstrlenW (lpString=".1cd") returned 4
	[0072.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.694] lstrlenW (lpString=".jpg") returned 4
	[0072.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.694] lstrlenW (lpString=".doc") returned 4
	[0072.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.694] lstrlenW (lpString=".docx") returned 5
	[0072.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.694] lstrlenW (lpString=".pdf") returned 4
	[0072.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.694] lstrlenW (lpString=".xls") returned 4
	[0072.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.694] lstrlenW (lpString=".xlsx") returned 5
	[0072.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.695] lstrlenW (lpString=".ppt") returned 4
	[0072.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.695] lstrlenW (lpString=".zip") returned 4
	[0072.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.695] lstrlenW (lpString=".rar") returned 4
	[0072.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.695] lstrlenW (lpString=".bz2") returned 4
	[0072.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.695] lstrlenW (lpString=".7z") returned 3
	[0072.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.695] lstrlenW (lpString=".dbf") returned 4
	[0072.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.695] lstrlenW (lpString=".1cd") returned 4
	[0072.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0072.695] lstrlenW (lpString=".jpg") returned 4
	[0072.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.696] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0072.696] lstrlenW (lpString="BD20013_.WMF") returned 12
	[0072.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.043] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=11058) returned 1
	[0073.043] CloseHandle (hObject=0x374) returned 1
	[0073.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220
	[0073.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.044] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.044] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0073.044] GetLastError () returned 0x0
	[0073.044] ReadFile (in: hFile=0x374, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x2b32, lpOverlapped=0x0) returned 1
	[0073.046] WriteFile (in: hFile=0x370, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x2b40, lpOverlapped=0x0) returned 1
	[0073.047] ReadFile (in: hFile=0x374, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.047] WriteFile (in: hFile=0x370, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.047] SetEndOfFile (hFile=0x370) returned 1
	[0073.047] CloseHandle (hObject=0x370) returned 1
	[0073.048] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.048] SetEndOfFile (hFile=0x374) returned 1
	[0073.049] CloseHandle (hObject=0x374) returned 1
	[0073.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1
	[0073.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.050] lstrlenW (lpString=".doc") returned 4
	[0073.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.050] lstrlenW (lpString=".docx") returned 5
	[0073.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.050] lstrlenW (lpString=".pdf") returned 4
	[0073.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.050] lstrlenW (lpString=".xls") returned 4
	[0073.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.050] lstrlenW (lpString=".xlsx") returned 5
	[0073.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.050] lstrlenW (lpString=".ppt") returned 4
	[0073.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.050] lstrlenW (lpString=".zip") returned 4
	[0073.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.050] lstrlenW (lpString=".rar") returned 4
	[0073.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.050] lstrlenW (lpString=".bz2") returned 4
	[0073.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.050] lstrlenW (lpString=".7z") returned 3
	[0073.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.050] lstrlenW (lpString=".dbf") returned 4
	[0073.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.051] lstrlenW (lpString=".1cd") returned 4
	[0073.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.051] lstrlenW (lpString=".jpg") returned 4
	[0073.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.051] lstrlenW (lpString=".doc") returned 4
	[0073.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.051] lstrlenW (lpString=".docx") returned 5
	[0073.051] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.051] lstrlenW (lpString=".pdf") returned 4
	[0073.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.052] lstrlenW (lpString=".xls") returned 4
	[0073.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.052] lstrlenW (lpString=".xlsx") returned 5
	[0073.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.052] lstrlenW (lpString=".ppt") returned 4
	[0073.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.052] lstrlenW (lpString=".zip") returned 4
	[0073.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.052] lstrlenW (lpString=".rar") returned 4
	[0073.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.052] lstrlenW (lpString=".bz2") returned 4
	[0073.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.052] lstrlenW (lpString=".7z") returned 3
	[0073.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.052] lstrlenW (lpString=".dbf") returned 4
	[0073.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.052] lstrlenW (lpString=".1cd") returned 4
	[0073.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.052] lstrlenW (lpString=".jpg") returned 4
	[0073.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.053] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.053] lstrlenW (lpString="BL00012_.WMF") returned 12
	[0073.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.053] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=9818) returned 1
	[0073.053] CloseHandle (hObject=0x374) returned 1
	[0073.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220
	[0073.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.053] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.054] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0073.054] GetLastError () returned 0x0
	[0073.054] ReadFile (in: hFile=0x374, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x265a, lpOverlapped=0x0) returned 1
	[0073.055] WriteFile (in: hFile=0x370, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x2660, lpOverlapped=0x0) returned 1
	[0073.056] ReadFile (in: hFile=0x374, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.056] WriteFile (in: hFile=0x370, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.057] SetEndOfFile (hFile=0x370) returned 1
	[0073.057] CloseHandle (hObject=0x370) returned 1
	[0073.058] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.058] SetEndOfFile (hFile=0x374) returned 1
	[0073.058] CloseHandle (hObject=0x374) returned 1
	[0073.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1
	[0073.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.059] lstrlenW (lpString=".doc") returned 4
	[0073.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.059] lstrlenW (lpString=".docx") returned 5
	[0073.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.059] lstrlenW (lpString=".pdf") returned 4
	[0073.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.059] lstrlenW (lpString=".xls") returned 4
	[0073.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.059] lstrlenW (lpString=".xlsx") returned 5
	[0073.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.059] lstrlenW (lpString=".ppt") returned 4
	[0073.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.060] lstrlenW (lpString=".zip") returned 4
	[0073.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.060] lstrlenW (lpString=".rar") returned 4
	[0073.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.060] lstrlenW (lpString=".bz2") returned 4
	[0073.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.060] lstrlenW (lpString=".7z") returned 3
	[0073.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.060] lstrlenW (lpString=".dbf") returned 4
	[0073.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.060] lstrlenW (lpString=".1cd") returned 4
	[0073.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.060] lstrlenW (lpString=".jpg") returned 4
	[0073.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.060] lstrlenW (lpString=".doc") returned 4
	[0073.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.061] lstrlenW (lpString=".docx") returned 5
	[0073.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.061] lstrlenW (lpString=".pdf") returned 4
	[0073.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.061] lstrlenW (lpString=".xls") returned 4
	[0073.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.061] lstrlenW (lpString=".xlsx") returned 5
	[0073.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.061] lstrlenW (lpString=".ppt") returned 4
	[0073.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.061] lstrlenW (lpString=".zip") returned 4
	[0073.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.061] lstrlenW (lpString=".rar") returned 4
	[0073.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.061] lstrlenW (lpString=".bz2") returned 4
	[0073.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.061] lstrlenW (lpString=".7z") returned 3
	[0073.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.061] lstrlenW (lpString=".dbf") returned 4
	[0073.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.061] lstrlenW (lpString=".1cd") returned 4
	[0073.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.062] lstrlenW (lpString=".jpg") returned 4
	[0073.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.062] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.062] lstrlenW (lpString="BL00045_.WMF") returned 12
	[0073.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.062] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=7862) returned 1
	[0073.062] CloseHandle (hObject=0x374) returned 1
	[0073.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220
	[0073.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.063] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.063] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0073.063] GetLastError () returned 0x0
	[0073.063] ReadFile (in: hFile=0x374, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1eb6, lpOverlapped=0x0) returned 1
	[0073.065] WriteFile (in: hFile=0x370, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1ec0, lpOverlapped=0x0) returned 1
	[0073.066] ReadFile (in: hFile=0x374, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.066] WriteFile (in: hFile=0x370, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.066] SetEndOfFile (hFile=0x370) returned 1
	[0073.066] CloseHandle (hObject=0x370) returned 1
	[0073.067] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.067] SetEndOfFile (hFile=0x374) returned 1
	[0073.068] CloseHandle (hObject=0x374) returned 1
	[0073.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1
	[0073.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.069] lstrlenW (lpString=".doc") returned 4
	[0073.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.069] lstrlenW (lpString=".docx") returned 5
	[0073.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.069] lstrlenW (lpString=".pdf") returned 4
	[0073.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.069] lstrlenW (lpString=".xls") returned 4
	[0073.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.069] lstrlenW (lpString=".xlsx") returned 5
	[0073.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.069] lstrlenW (lpString=".ppt") returned 4
	[0073.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.069] lstrlenW (lpString=".zip") returned 4
	[0073.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.069] lstrlenW (lpString=".rar") returned 4
	[0073.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.070] lstrlenW (lpString=".bz2") returned 4
	[0073.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.070] lstrlenW (lpString=".7z") returned 3
	[0073.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.070] lstrlenW (lpString=".dbf") returned 4
	[0073.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.070] lstrlenW (lpString=".1cd") returned 4
	[0073.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.070] lstrlenW (lpString=".jpg") returned 4
	[0073.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.070] lstrlenW (lpString=".doc") returned 4
	[0073.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.070] lstrlenW (lpString=".docx") returned 5
	[0073.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.070] lstrlenW (lpString=".pdf") returned 4
	[0073.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.070] lstrlenW (lpString=".xls") returned 4
	[0073.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.071] lstrlenW (lpString=".xlsx") returned 5
	[0073.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.071] lstrlenW (lpString=".ppt") returned 4
	[0073.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.071] lstrlenW (lpString=".zip") returned 4
	[0073.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.071] lstrlenW (lpString=".rar") returned 4
	[0073.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.071] lstrlenW (lpString=".bz2") returned 4
	[0073.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.071] lstrlenW (lpString=".7z") returned 3
	[0073.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.071] lstrlenW (lpString=".dbf") returned 4
	[0073.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.071] lstrlenW (lpString=".1cd") returned 4
	[0073.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.071] lstrlenW (lpString=".jpg") returned 4
	[0073.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.072] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.072] lstrlenW (lpString="BL00098_.WMF") returned 12
	[0073.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.072] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1012) returned 1
	[0073.072] CloseHandle (hObject=0x374) returned 1
	[0073.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220
	[0073.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.073] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.073] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0073.073] GetLastError () returned 0x0
	[0073.073] ReadFile (in: hFile=0x374, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x3f4, lpOverlapped=0x0) returned 1
	[0073.075] WriteFile (in: hFile=0x370, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x400, lpOverlapped=0x0) returned 1
	[0073.075] ReadFile (in: hFile=0x374, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.075] WriteFile (in: hFile=0x370, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.076] SetEndOfFile (hFile=0x370) returned 1
	[0073.076] CloseHandle (hObject=0x370) returned 1
	[0073.076] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.076] SetEndOfFile (hFile=0x374) returned 1
	[0073.077] CloseHandle (hObject=0x374) returned 1
	[0073.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1
	[0073.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.078] lstrlenW (lpString=".doc") returned 4
	[0073.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.078] lstrlenW (lpString=".docx") returned 5
	[0073.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.078] lstrlenW (lpString=".pdf") returned 4
	[0073.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.078] lstrlenW (lpString=".xls") returned 4
	[0073.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.078] lstrlenW (lpString=".xlsx") returned 5
	[0073.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.078] lstrlenW (lpString=".ppt") returned 4
	[0073.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.079] lstrlenW (lpString=".zip") returned 4
	[0073.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.079] lstrlenW (lpString=".rar") returned 4
	[0073.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.079] lstrlenW (lpString=".bz2") returned 4
	[0073.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.079] lstrlenW (lpString=".7z") returned 3
	[0073.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.079] lstrlenW (lpString=".dbf") returned 4
	[0073.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.079] lstrlenW (lpString=".1cd") returned 4
	[0073.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.079] lstrlenW (lpString=".jpg") returned 4
	[0073.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.079] lstrlenW (lpString=".doc") returned 4
	[0073.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.079] lstrlenW (lpString=".docx") returned 5
	[0073.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.080] lstrlenW (lpString=".pdf") returned 4
	[0073.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.080] lstrlenW (lpString=".xls") returned 4
	[0073.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.080] lstrlenW (lpString=".xlsx") returned 5
	[0073.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.080] lstrlenW (lpString=".ppt") returned 4
	[0073.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.080] lstrlenW (lpString=".zip") returned 4
	[0073.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.080] lstrlenW (lpString=".rar") returned 4
	[0073.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.080] lstrlenW (lpString=".bz2") returned 4
	[0073.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.080] lstrlenW (lpString=".7z") returned 3
	[0073.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.080] lstrlenW (lpString=".dbf") returned 4
	[0073.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.080] lstrlenW (lpString=".1cd") returned 4
	[0073.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0073.080] lstrlenW (lpString=".jpg") returned 4
	[0073.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.080] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.081] lstrlenW (lpString="BL00105_.WMF") returned 12
	[0073.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.081] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=880) returned 1
	[0073.081] CloseHandle (hObject=0x374) returned 1
	[0073.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220
	[0073.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.678] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.678] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0073.679] GetLastError () returned 0x0
	[0073.679] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x370, lpOverlapped=0x0) returned 1
	[0073.681] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x380, lpOverlapped=0x0) returned 1
	[0073.682] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.682] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.682] SetEndOfFile (hFile=0x320) returned 1
	[0073.682] CloseHandle (hObject=0x320) returned 1
	[0073.683] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.683] SetEndOfFile (hFile=0x390) returned 1
	[0073.684] CloseHandle (hObject=0x390) returned 1
	[0073.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1
	[0073.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.685] lstrlenW (lpString=".doc") returned 4
	[0073.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.685] lstrlenW (lpString=".docx") returned 5
	[0073.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.685] lstrlenW (lpString=".pdf") returned 4
	[0073.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.685] lstrlenW (lpString=".xls") returned 4
	[0073.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.685] lstrlenW (lpString=".xlsx") returned 5
	[0073.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.685] lstrlenW (lpString=".ppt") returned 4
	[0073.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.685] lstrlenW (lpString=".zip") returned 4
	[0073.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.685] lstrlenW (lpString=".rar") returned 4
	[0073.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.685] lstrlenW (lpString=".bz2") returned 4
	[0073.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.685] lstrlenW (lpString=".7z") returned 3
	[0073.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.686] lstrlenW (lpString=".dbf") returned 4
	[0073.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.686] lstrlenW (lpString=".1cd") returned 4
	[0073.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.686] lstrlenW (lpString=".jpg") returned 4
	[0073.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.686] lstrlenW (lpString=".doc") returned 4
	[0073.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.686] lstrlenW (lpString=".docx") returned 5
	[0073.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.686] lstrlenW (lpString=".pdf") returned 4
	[0073.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.686] lstrlenW (lpString=".xls") returned 4
	[0073.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.686] lstrlenW (lpString=".xlsx") returned 5
	[0073.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.686] lstrlenW (lpString=".ppt") returned 4
	[0073.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.686] lstrlenW (lpString=".zip") returned 4
	[0073.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.686] lstrlenW (lpString=".rar") returned 4
	[0073.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.687] lstrlenW (lpString=".bz2") returned 4
	[0073.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.687] lstrlenW (lpString=".7z") returned 3
	[0073.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.687] lstrlenW (lpString=".dbf") returned 4
	[0073.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.687] lstrlenW (lpString=".1cd") returned 4
	[0073.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.687] lstrlenW (lpString=".jpg") returned 4
	[0073.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.687] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.687] lstrlenW (lpString="BL00242_.WMF") returned 12
	[0073.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.688] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4024) returned 1
	[0073.688] CloseHandle (hObject=0x390) returned 1
	[0073.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220
	[0073.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.688] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.688] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0073.689] GetLastError () returned 0x0
	[0073.689] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xfb8, lpOverlapped=0x0) returned 1
	[0073.690] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xfc0, lpOverlapped=0x0) returned 1
	[0073.691] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.691] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.691] SetEndOfFile (hFile=0x320) returned 1
	[0073.692] CloseHandle (hObject=0x320) returned 1
	[0073.692] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.692] SetEndOfFile (hFile=0x390) returned 1
	[0073.693] CloseHandle (hObject=0x390) returned 1
	[0073.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1
	[0073.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.694] lstrlenW (lpString=".doc") returned 4
	[0073.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.694] lstrlenW (lpString=".docx") returned 5
	[0073.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.694] lstrlenW (lpString=".pdf") returned 4
	[0073.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString=".xls") returned 4
	[0073.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.695] lstrlenW (lpString=".xlsx") returned 5
	[0073.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.695] lstrlenW (lpString=".ppt") returned 4
	[0073.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.695] lstrlenW (lpString=".zip") returned 4
	[0073.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.695] lstrlenW (lpString=".rar") returned 4
	[0073.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString=".bz2") returned 4
	[0073.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString=".7z") returned 3
	[0073.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.695] lstrlenW (lpString=".dbf") returned 4
	[0073.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.695] lstrlenW (lpString=".1cd") returned 4
	[0073.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.695] lstrlenW (lpString=".jpg") returned 4
	[0073.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.696] lstrlenW (lpString=".doc") returned 4
	[0073.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString=".docx") returned 5
	[0073.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.696] lstrlenW (lpString=".pdf") returned 4
	[0073.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString=".xls") returned 4
	[0073.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.696] lstrlenW (lpString=".xlsx") returned 5
	[0073.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.696] lstrlenW (lpString=".ppt") returned 4
	[0073.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.696] lstrlenW (lpString=".zip") returned 4
	[0073.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.696] lstrlenW (lpString=".rar") returned 4
	[0073.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString=".bz2") returned 4
	[0073.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString=".7z") returned 3
	[0073.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.697] lstrlenW (lpString=".dbf") returned 4
	[0073.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.697] lstrlenW (lpString=".1cd") returned 4
	[0073.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0073.697] lstrlenW (lpString=".jpg") returned 4
	[0073.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.697] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.697] lstrlenW (lpString="BL00247_.WMF") returned 12
	[0073.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.698] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=14444) returned 1
	[0073.698] CloseHandle (hObject=0x390) returned 1
	[0073.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220
	[0073.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.698] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.698] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0073.698] GetLastError () returned 0x0
	[0073.699] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x386c, lpOverlapped=0x0) returned 1
	[0073.700] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3870, lpOverlapped=0x0) returned 1
	[0073.701] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.701] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.702] SetEndOfFile (hFile=0x320) returned 1
	[0073.702] CloseHandle (hObject=0x320) returned 1
	[0073.704] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.704] SetEndOfFile (hFile=0x390) returned 1
	[0073.705] CloseHandle (hObject=0x390) returned 1
	[0073.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1
	[0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.706] lstrlenW (lpString=".doc") returned 4
	[0073.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString=".docx") returned 5
	[0073.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.706] lstrlenW (lpString=".pdf") returned 4
	[0073.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString=".xls") returned 4
	[0073.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.706] lstrlenW (lpString=".xlsx") returned 5
	[0073.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.706] lstrlenW (lpString=".ppt") returned 4
	[0073.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.706] lstrlenW (lpString=".zip") returned 4
	[0073.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.706] lstrlenW (lpString=".rar") returned 4
	[0073.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString=".bz2") returned 4
	[0073.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString=".7z") returned 3
	[0073.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.706] lstrlenW (lpString=".dbf") returned 4
	[0073.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.707] lstrlenW (lpString=".1cd") returned 4
	[0073.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.707] lstrlenW (lpString=".jpg") returned 4
	[0073.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.707] lstrlenW (lpString=".doc") returned 4
	[0073.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.707] lstrlenW (lpString=".docx") returned 5
	[0073.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.707] lstrlenW (lpString=".pdf") returned 4
	[0073.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.707] lstrlenW (lpString=".xls") returned 4
	[0073.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.707] lstrlenW (lpString=".xlsx") returned 5
	[0073.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.708] lstrlenW (lpString=".ppt") returned 4
	[0073.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.708] lstrlenW (lpString=".zip") returned 4
	[0073.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.708] lstrlenW (lpString=".rar") returned 4
	[0073.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.708] lstrlenW (lpString=".bz2") returned 4
	[0073.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.708] lstrlenW (lpString=".7z") returned 3
	[0073.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.708] lstrlenW (lpString=".dbf") returned 4
	[0073.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.708] lstrlenW (lpString=".1cd") returned 4
	[0073.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0073.708] lstrlenW (lpString=".jpg") returned 4
	[0073.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.708] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.708] lstrlenW (lpString="BL00248_.WMF") returned 12
	[0073.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.709] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1536) returned 1
	[0073.709] CloseHandle (hObject=0x390) returned 1
	[0073.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220
	[0073.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.709] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.709] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0073.709] GetLastError () returned 0x0
	[0073.709] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x600, lpOverlapped=0x0) returned 1
	[0073.711] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x610, lpOverlapped=0x0) returned 1
	[0073.712] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.712] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.712] SetEndOfFile (hFile=0x320) returned 1
	[0073.712] CloseHandle (hObject=0x320) returned 1
	[0073.713] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.713] SetEndOfFile (hFile=0x390) returned 1
	[0073.714] CloseHandle (hObject=0x390) returned 1
	[0073.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0073.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1
	[0073.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.714] lstrlenW (lpString=".doc") returned 4
	[0073.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.714] lstrlenW (lpString=".docx") returned 5
	[0073.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.714] lstrlenW (lpString=".pdf") returned 4
	[0073.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.714] lstrlenW (lpString=".xls") returned 4
	[0073.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.714] lstrlenW (lpString=".xlsx") returned 5
	[0073.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.715] lstrlenW (lpString=".ppt") returned 4
	[0073.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.715] lstrlenW (lpString=".zip") returned 4
	[0073.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.715] lstrlenW (lpString=".rar") returned 4
	[0073.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.715] lstrlenW (lpString=".bz2") returned 4
	[0073.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.715] lstrlenW (lpString=".7z") returned 3
	[0073.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.715] lstrlenW (lpString=".dbf") returned 4
	[0073.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.715] lstrlenW (lpString=".1cd") returned 4
	[0073.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.715] lstrlenW (lpString=".jpg") returned 4
	[0073.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.715] lstrlenW (lpString=".doc") returned 4
	[0073.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.715] lstrlenW (lpString=".docx") returned 5
	[0073.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.715] lstrlenW (lpString=".pdf") returned 4
	[0073.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.716] lstrlenW (lpString=".xls") returned 4
	[0073.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.716] lstrlenW (lpString=".xlsx") returned 5
	[0073.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.716] lstrlenW (lpString=".ppt") returned 4
	[0073.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.716] lstrlenW (lpString=".zip") returned 4
	[0073.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.716] lstrlenW (lpString=".rar") returned 4
	[0073.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.716] lstrlenW (lpString=".bz2") returned 4
	[0073.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.716] lstrlenW (lpString=".7z") returned 3
	[0073.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.716] lstrlenW (lpString=".dbf") returned 4
	[0073.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.716] lstrlenW (lpString=".1cd") returned 4
	[0073.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0073.716] lstrlenW (lpString=".jpg") returned 4
	[0073.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.716] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0073.717] lstrlenW (lpString="BL00252_.WMF") returned 12
	[0073.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.717] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4708) returned 1
	[0073.717] CloseHandle (hObject=0x390) returned 1
	[0073.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220
	[0073.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.717] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.717] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0073.718] GetLastError () returned 0x0
	[0073.718] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1264, lpOverlapped=0x0) returned 1
	[0074.107] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1270, lpOverlapped=0x0) returned 1
	[0074.108] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.108] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.108] SetEndOfFile (hFile=0x320) returned 1
	[0074.108] CloseHandle (hObject=0x320) returned 1
	[0074.110] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.111] SetEndOfFile (hFile=0x390) returned 1
	[0074.111] CloseHandle (hObject=0x390) returned 1
	[0074.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1
	[0074.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.116] lstrlenW (lpString=".doc") returned 4
	[0074.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.116] lstrlenW (lpString=".docx") returned 5
	[0074.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.116] lstrlenW (lpString=".pdf") returned 4
	[0074.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.116] lstrlenW (lpString=".xls") returned 4
	[0074.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.116] lstrlenW (lpString=".xlsx") returned 5
	[0074.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.116] lstrlenW (lpString=".ppt") returned 4
	[0074.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.117] lstrlenW (lpString=".zip") returned 4
	[0074.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.117] lstrlenW (lpString=".rar") returned 4
	[0074.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.117] lstrlenW (lpString=".bz2") returned 4
	[0074.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.117] lstrlenW (lpString=".7z") returned 3
	[0074.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.117] lstrlenW (lpString=".dbf") returned 4
	[0074.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.117] lstrlenW (lpString=".1cd") returned 4
	[0074.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.117] lstrlenW (lpString=".jpg") returned 4
	[0074.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.117] lstrlenW (lpString=".doc") returned 4
	[0074.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.117] lstrlenW (lpString=".docx") returned 5
	[0074.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.117] lstrlenW (lpString=".pdf") returned 4
	[0074.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.118] lstrlenW (lpString=".xls") returned 4
	[0074.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.118] lstrlenW (lpString=".xlsx") returned 5
	[0074.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.118] lstrlenW (lpString=".ppt") returned 4
	[0074.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.118] lstrlenW (lpString=".zip") returned 4
	[0074.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.118] lstrlenW (lpString=".rar") returned 4
	[0074.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.118] lstrlenW (lpString=".bz2") returned 4
	[0074.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.118] lstrlenW (lpString=".7z") returned 3
	[0074.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.118] lstrlenW (lpString=".dbf") returned 4
	[0074.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.118] lstrlenW (lpString=".1cd") returned 4
	[0074.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.118] lstrlenW (lpString=".jpg") returned 4
	[0074.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.119] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.119] lstrlenW (lpString="BL00392_.WMF") returned 12
	[0074.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.120] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=27050) returned 1
	[0074.120] CloseHandle (hObject=0x390) returned 1
	[0074.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220
	[0074.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.120] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.120] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0074.121] GetLastError () returned 0x0
	[0074.121] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x69aa, lpOverlapped=0x0) returned 1
	[0074.123] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x69b0, lpOverlapped=0x0) returned 1
	[0074.124] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.124] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.124] SetEndOfFile (hFile=0x320) returned 1
	[0074.124] CloseHandle (hObject=0x320) returned 1
	[0074.126] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.126] SetEndOfFile (hFile=0x390) returned 1
	[0074.127] CloseHandle (hObject=0x390) returned 1
	[0074.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1
	[0074.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.127] lstrlenW (lpString=".doc") returned 4
	[0074.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.128] lstrlenW (lpString=".docx") returned 5
	[0074.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.128] lstrlenW (lpString=".pdf") returned 4
	[0074.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.128] lstrlenW (lpString=".xls") returned 4
	[0074.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.128] lstrlenW (lpString=".xlsx") returned 5
	[0074.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.128] lstrlenW (lpString=".ppt") returned 4
	[0074.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.128] lstrlenW (lpString=".zip") returned 4
	[0074.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.128] lstrlenW (lpString=".rar") returned 4
	[0074.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.128] lstrlenW (lpString=".bz2") returned 4
	[0074.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.128] lstrlenW (lpString=".7z") returned 3
	[0074.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.128] lstrlenW (lpString=".dbf") returned 4
	[0074.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.129] lstrlenW (lpString=".1cd") returned 4
	[0074.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.129] lstrlenW (lpString=".jpg") returned 4
	[0074.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.129] lstrlenW (lpString=".doc") returned 4
	[0074.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.129] lstrlenW (lpString=".docx") returned 5
	[0074.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.129] lstrlenW (lpString=".pdf") returned 4
	[0074.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.129] lstrlenW (lpString=".xls") returned 4
	[0074.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.130] lstrlenW (lpString=".xlsx") returned 5
	[0074.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.130] lstrlenW (lpString=".ppt") returned 4
	[0074.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.130] lstrlenW (lpString=".zip") returned 4
	[0074.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.130] lstrlenW (lpString=".rar") returned 4
	[0074.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.130] lstrlenW (lpString=".bz2") returned 4
	[0074.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.130] lstrlenW (lpString=".7z") returned 3
	[0074.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.130] lstrlenW (lpString=".dbf") returned 4
	[0074.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.130] lstrlenW (lpString=".1cd") returned 4
	[0074.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0074.130] lstrlenW (lpString=".jpg") returned 4
	[0074.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.131] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.131] lstrlenW (lpString="BL00524_.WMF") returned 12
	[0074.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.131] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=6996) returned 1
	[0074.131] CloseHandle (hObject=0x390) returned 1
	[0074.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220
	[0074.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.132] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.132] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0074.132] GetLastError () returned 0x0
	[0074.132] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1b54, lpOverlapped=0x0) returned 1
	[0074.133] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1b60, lpOverlapped=0x0) returned 1
	[0074.134] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.134] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.135] SetEndOfFile (hFile=0x320) returned 1
	[0074.135] CloseHandle (hObject=0x320) returned 1
	[0074.135] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.135] SetEndOfFile (hFile=0x390) returned 1
	[0074.136] CloseHandle (hObject=0x390) returned 1
	[0074.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1
	[0074.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.137] lstrlenW (lpString=".doc") returned 4
	[0074.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.137] lstrlenW (lpString=".docx") returned 5
	[0074.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.137] lstrlenW (lpString=".pdf") returned 4
	[0074.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.137] lstrlenW (lpString=".xls") returned 4
	[0074.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.137] lstrlenW (lpString=".xlsx") returned 5
	[0074.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.138] lstrlenW (lpString=".ppt") returned 4
	[0074.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.138] lstrlenW (lpString=".zip") returned 4
	[0074.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.138] lstrlenW (lpString=".rar") returned 4
	[0074.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.138] lstrlenW (lpString=".bz2") returned 4
	[0074.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.138] lstrlenW (lpString=".7z") returned 3
	[0074.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.138] lstrlenW (lpString=".dbf") returned 4
	[0074.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.138] lstrlenW (lpString=".1cd") returned 4
	[0074.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.138] lstrlenW (lpString=".jpg") returned 4
	[0074.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.138] lstrlenW (lpString=".doc") returned 4
	[0074.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.138] lstrlenW (lpString=".docx") returned 5
	[0074.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.139] lstrlenW (lpString=".pdf") returned 4
	[0074.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.139] lstrlenW (lpString=".xls") returned 4
	[0074.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.139] lstrlenW (lpString=".xlsx") returned 5
	[0074.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.139] lstrlenW (lpString=".ppt") returned 4
	[0074.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.139] lstrlenW (lpString=".zip") returned 4
	[0074.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.139] lstrlenW (lpString=".rar") returned 4
	[0074.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.139] lstrlenW (lpString=".bz2") returned 4
	[0074.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.139] lstrlenW (lpString=".7z") returned 3
	[0074.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.139] lstrlenW (lpString=".dbf") returned 4
	[0074.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.139] lstrlenW (lpString=".1cd") returned 4
	[0074.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0074.139] lstrlenW (lpString=".jpg") returned 4
	[0074.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.140] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.140] lstrlenW (lpString="BL00525_.WMF") returned 12
	[0074.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.140] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=9590) returned 1
	[0074.140] CloseHandle (hObject=0x390) returned 1
	[0074.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220
	[0074.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.140] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.141] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0074.141] GetLastError () returned 0x0
	[0074.141] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x2576, lpOverlapped=0x0) returned 1
	[0074.142] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x2580, lpOverlapped=0x0) returned 1
	[0074.143] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.144] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.144] SetEndOfFile (hFile=0x320) returned 1
	[0074.144] CloseHandle (hObject=0x320) returned 1
	[0074.649] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.649] SetEndOfFile (hFile=0x390) returned 1
	[0074.649] CloseHandle (hObject=0x390) returned 1
	[0074.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1
	[0074.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.650] lstrlenW (lpString=".doc") returned 4
	[0074.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.650] lstrlenW (lpString=".docx") returned 5
	[0074.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.651] lstrlenW (lpString=".pdf") returned 4
	[0074.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.651] lstrlenW (lpString=".xls") returned 4
	[0074.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.651] lstrlenW (lpString=".xlsx") returned 5
	[0074.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.651] lstrlenW (lpString=".ppt") returned 4
	[0074.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.651] lstrlenW (lpString=".zip") returned 4
	[0074.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.651] lstrlenW (lpString=".rar") returned 4
	[0074.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.651] lstrlenW (lpString=".bz2") returned 4
	[0074.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.651] lstrlenW (lpString=".7z") returned 3
	[0074.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.651] lstrlenW (lpString=".dbf") returned 4
	[0074.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.651] lstrlenW (lpString=".1cd") returned 4
	[0074.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.652] lstrlenW (lpString=".jpg") returned 4
	[0074.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.652] lstrlenW (lpString=".doc") returned 4
	[0074.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.652] lstrlenW (lpString=".docx") returned 5
	[0074.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.652] lstrlenW (lpString=".pdf") returned 4
	[0074.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.652] lstrlenW (lpString=".xls") returned 4
	[0074.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.652] lstrlenW (lpString=".xlsx") returned 5
	[0074.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.652] lstrlenW (lpString=".ppt") returned 4
	[0074.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.652] lstrlenW (lpString=".zip") returned 4
	[0074.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.652] lstrlenW (lpString=".rar") returned 4
	[0074.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.652] lstrlenW (lpString=".bz2") returned 4
	[0074.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.652] lstrlenW (lpString=".7z") returned 3
	[0074.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.653] lstrlenW (lpString=".dbf") returned 4
	[0074.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.653] lstrlenW (lpString=".1cd") returned 4
	[0074.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0074.653] lstrlenW (lpString=".jpg") returned 4
	[0074.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.653] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.653] lstrlenW (lpString="BS00135_.WMF") returned 12
	[0074.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.653] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1044) returned 1
	[0074.653] CloseHandle (hObject=0x390) returned 1
	[0074.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220
	[0074.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.654] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.654] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0074.655] GetLastError () returned 0x0
	[0074.655] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x414, lpOverlapped=0x0) returned 1
	[0074.656] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x420, lpOverlapped=0x0) returned 1
	[0074.657] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.657] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.657] SetEndOfFile (hFile=0x320) returned 1
	[0074.657] CloseHandle (hObject=0x320) returned 1
	[0074.659] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.659] SetEndOfFile (hFile=0x390) returned 1
	[0074.660] CloseHandle (hObject=0x390) returned 1
	[0074.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1
	[0074.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.661] lstrlenW (lpString=".doc") returned 4
	[0074.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.661] lstrlenW (lpString=".docx") returned 5
	[0074.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.661] lstrlenW (lpString=".pdf") returned 4
	[0074.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.661] lstrlenW (lpString=".xls") returned 4
	[0074.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.661] lstrlenW (lpString=".xlsx") returned 5
	[0074.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.661] lstrlenW (lpString=".ppt") returned 4
	[0074.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.662] lstrlenW (lpString=".zip") returned 4
	[0074.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.662] lstrlenW (lpString=".rar") returned 4
	[0074.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.662] lstrlenW (lpString=".bz2") returned 4
	[0074.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.662] lstrlenW (lpString=".7z") returned 3
	[0074.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.662] lstrlenW (lpString=".dbf") returned 4
	[0074.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.662] lstrlenW (lpString=".1cd") returned 4
	[0074.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.662] lstrlenW (lpString=".jpg") returned 4
	[0074.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.662] lstrlenW (lpString=".doc") returned 4
	[0074.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.662] lstrlenW (lpString=".docx") returned 5
	[0074.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.662] lstrlenW (lpString=".pdf") returned 4
	[0074.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.662] lstrlenW (lpString=".xls") returned 4
	[0074.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.663] lstrlenW (lpString=".xlsx") returned 5
	[0074.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.663] lstrlenW (lpString=".ppt") returned 4
	[0074.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.663] lstrlenW (lpString=".zip") returned 4
	[0074.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.663] lstrlenW (lpString=".rar") returned 4
	[0074.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.663] lstrlenW (lpString=".bz2") returned 4
	[0074.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.663] lstrlenW (lpString=".7z") returned 3
	[0074.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.663] lstrlenW (lpString=".dbf") returned 4
	[0074.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.663] lstrlenW (lpString=".1cd") returned 4
	[0074.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0074.663] lstrlenW (lpString=".jpg") returned 4
	[0074.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.663] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.664] lstrlenW (lpString="BS00136_.WMF") returned 12
	[0074.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.664] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=2166) returned 1
	[0074.664] CloseHandle (hObject=0x390) returned 1
	[0074.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220
	[0074.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.664] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.664] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0074.665] GetLastError () returned 0x0
	[0074.665] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x876, lpOverlapped=0x0) returned 1
	[0074.667] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x880, lpOverlapped=0x0) returned 1
	[0074.668] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.668] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.668] SetEndOfFile (hFile=0x320) returned 1
	[0074.668] CloseHandle (hObject=0x320) returned 1
	[0074.669] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.670] SetEndOfFile (hFile=0x390) returned 1
	[0074.670] CloseHandle (hObject=0x390) returned 1
	[0074.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1
	[0074.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.671] lstrlenW (lpString=".doc") returned 4
	[0074.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.671] lstrlenW (lpString=".docx") returned 5
	[0074.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.671] lstrlenW (lpString=".pdf") returned 4
	[0074.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.671] lstrlenW (lpString=".xls") returned 4
	[0074.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.671] lstrlenW (lpString=".xlsx") returned 5
	[0074.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.671] lstrlenW (lpString=".ppt") returned 4
	[0074.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.672] lstrlenW (lpString=".zip") returned 4
	[0074.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.672] lstrlenW (lpString=".rar") returned 4
	[0074.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.672] lstrlenW (lpString=".bz2") returned 4
	[0074.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.672] lstrlenW (lpString=".7z") returned 3
	[0074.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.672] lstrlenW (lpString=".dbf") returned 4
	[0074.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.672] lstrlenW (lpString=".1cd") returned 4
	[0074.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.672] lstrlenW (lpString=".jpg") returned 4
	[0074.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.672] lstrlenW (lpString=".doc") returned 4
	[0074.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.673] lstrlenW (lpString=".docx") returned 5
	[0074.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.673] lstrlenW (lpString=".pdf") returned 4
	[0074.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.673] lstrlenW (lpString=".xls") returned 4
	[0074.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.673] lstrlenW (lpString=".xlsx") returned 5
	[0074.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.673] lstrlenW (lpString=".ppt") returned 4
	[0074.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.673] lstrlenW (lpString=".zip") returned 4
	[0074.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.673] lstrlenW (lpString=".rar") returned 4
	[0074.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.673] lstrlenW (lpString=".bz2") returned 4
	[0074.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.673] lstrlenW (lpString=".7z") returned 3
	[0074.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.673] lstrlenW (lpString=".dbf") returned 4
	[0074.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.674] lstrlenW (lpString=".1cd") returned 4
	[0074.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0074.674] lstrlenW (lpString=".jpg") returned 4
	[0074.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.674] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.674] lstrlenW (lpString="BS00145_.WMF") returned 12
	[0074.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.674] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1712) returned 1
	[0074.674] CloseHandle (hObject=0x390) returned 1
	[0074.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220
	[0074.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.675] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.675] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0074.675] GetLastError () returned 0x0
	[0074.675] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x6b0, lpOverlapped=0x0) returned 1
	[0074.677] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x6c0, lpOverlapped=0x0) returned 1
	[0074.678] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.678] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.678] SetEndOfFile (hFile=0x320) returned 1
	[0074.678] CloseHandle (hObject=0x320) returned 1
	[0074.679] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.679] SetEndOfFile (hFile=0x390) returned 1
	[0074.680] CloseHandle (hObject=0x390) returned 1
	[0074.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0074.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1
	[0074.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.681] lstrlenW (lpString=".doc") returned 4
	[0074.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.681] lstrlenW (lpString=".docx") returned 5
	[0074.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.681] lstrlenW (lpString=".pdf") returned 4
	[0074.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.681] lstrlenW (lpString=".xls") returned 4
	[0074.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.681] lstrlenW (lpString=".xlsx") returned 5
	[0074.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.681] lstrlenW (lpString=".ppt") returned 4
	[0074.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.681] lstrlenW (lpString=".zip") returned 4
	[0074.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.681] lstrlenW (lpString=".rar") returned 4
	[0074.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.681] lstrlenW (lpString=".bz2") returned 4
	[0074.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.682] lstrlenW (lpString=".7z") returned 3
	[0074.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.682] lstrlenW (lpString=".dbf") returned 4
	[0074.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.682] lstrlenW (lpString=".1cd") returned 4
	[0074.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.682] lstrlenW (lpString=".jpg") returned 4
	[0074.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.682] lstrlenW (lpString=".doc") returned 4
	[0074.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.682] lstrlenW (lpString=".docx") returned 5
	[0074.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.682] lstrlenW (lpString=".pdf") returned 4
	[0074.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.682] lstrlenW (lpString=".xls") returned 4
	[0074.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.682] lstrlenW (lpString=".xlsx") returned 5
	[0074.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.683] lstrlenW (lpString=".ppt") returned 4
	[0074.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.683] lstrlenW (lpString=".zip") returned 4
	[0074.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.683] lstrlenW (lpString=".rar") returned 4
	[0074.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.683] lstrlenW (lpString=".bz2") returned 4
	[0074.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.683] lstrlenW (lpString=".7z") returned 3
	[0074.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.683] lstrlenW (lpString=".dbf") returned 4
	[0074.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.683] lstrlenW (lpString=".1cd") returned 4
	[0074.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0074.683] lstrlenW (lpString=".jpg") returned 4
	[0074.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.684] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0074.684] lstrlenW (lpString="BS00174_.WMF") returned 12
	[0074.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.684] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=8366) returned 1
	[0074.684] CloseHandle (hObject=0x390) returned 1
	[0074.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220
	[0074.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.684] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.685] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0074.685] GetLastError () returned 0x0
	[0074.685] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x20ae, lpOverlapped=0x0) returned 1
	[0075.044] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x20b0, lpOverlapped=0x0) returned 1
	[0075.046] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.046] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.046] SetEndOfFile (hFile=0x320) returned 1
	[0075.046] CloseHandle (hObject=0x320) returned 1
	[0075.048] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.048] SetEndOfFile (hFile=0x390) returned 1
	[0075.049] CloseHandle (hObject=0x390) returned 1
	[0075.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1
	[0075.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.049] lstrlenW (lpString=".doc") returned 4
	[0075.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.049] lstrlenW (lpString=".docx") returned 5
	[0075.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.049] lstrlenW (lpString=".pdf") returned 4
	[0075.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.050] lstrlenW (lpString=".xls") returned 4
	[0075.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.050] lstrlenW (lpString=".xlsx") returned 5
	[0075.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.050] lstrlenW (lpString=".ppt") returned 4
	[0075.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.050] lstrlenW (lpString=".zip") returned 4
	[0075.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.050] lstrlenW (lpString=".rar") returned 4
	[0075.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.050] lstrlenW (lpString=".bz2") returned 4
	[0075.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.050] lstrlenW (lpString=".7z") returned 3
	[0075.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.050] lstrlenW (lpString=".dbf") returned 4
	[0075.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.050] lstrlenW (lpString=".1cd") returned 4
	[0075.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.050] lstrlenW (lpString=".jpg") returned 4
	[0075.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.051] lstrlenW (lpString=".doc") returned 4
	[0075.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.051] lstrlenW (lpString=".docx") returned 5
	[0075.051] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.051] lstrlenW (lpString=".pdf") returned 4
	[0075.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.051] lstrlenW (lpString=".xls") returned 4
	[0075.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.051] lstrlenW (lpString=".xlsx") returned 5
	[0075.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.051] lstrlenW (lpString=".ppt") returned 4
	[0075.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.052] lstrlenW (lpString=".zip") returned 4
	[0075.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.052] lstrlenW (lpString=".rar") returned 4
	[0075.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.052] lstrlenW (lpString=".bz2") returned 4
	[0075.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.052] lstrlenW (lpString=".7z") returned 3
	[0075.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.052] lstrlenW (lpString=".dbf") returned 4
	[0075.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.052] lstrlenW (lpString=".1cd") returned 4
	[0075.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.052] lstrlenW (lpString=".jpg") returned 4
	[0075.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.052] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.053] lstrlenW (lpString="BS00443_.WMF") returned 12
	[0075.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0075.053] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1676) returned 1
	[0075.053] CloseHandle (hObject=0x390) returned 1
	[0075.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220
	[0075.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0075.053] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.054] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0075.054] GetLastError () returned 0x0
	[0075.054] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x68c, lpOverlapped=0x0) returned 1
	[0075.056] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x690, lpOverlapped=0x0) returned 1
	[0075.056] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.057] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.057] SetEndOfFile (hFile=0x320) returned 1
	[0075.057] CloseHandle (hObject=0x320) returned 1
	[0075.058] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.058] SetEndOfFile (hFile=0x390) returned 1
	[0075.058] CloseHandle (hObject=0x390) returned 1
	[0075.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1
	[0075.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.059] lstrlenW (lpString=".doc") returned 4
	[0075.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.059] lstrlenW (lpString=".docx") returned 5
	[0075.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.059] lstrlenW (lpString=".pdf") returned 4
	[0075.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.059] lstrlenW (lpString=".xls") returned 4
	[0075.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.059] lstrlenW (lpString=".xlsx") returned 5
	[0075.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.059] lstrlenW (lpString=".ppt") returned 4
	[0075.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.059] lstrlenW (lpString=".zip") returned 4
	[0075.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.060] lstrlenW (lpString=".rar") returned 4
	[0075.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.060] lstrlenW (lpString=".bz2") returned 4
	[0075.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.060] lstrlenW (lpString=".7z") returned 3
	[0075.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.060] lstrlenW (lpString=".dbf") returned 4
	[0075.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.060] lstrlenW (lpString=".1cd") returned 4
	[0075.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.060] lstrlenW (lpString=".jpg") returned 4
	[0075.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.060] lstrlenW (lpString=".doc") returned 4
	[0075.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.060] lstrlenW (lpString=".docx") returned 5
	[0075.060] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.060] lstrlenW (lpString=".pdf") returned 4
	[0075.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.060] lstrlenW (lpString=".xls") returned 4
	[0075.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.061] lstrlenW (lpString=".xlsx") returned 5
	[0075.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.061] lstrlenW (lpString=".ppt") returned 4
	[0075.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.061] lstrlenW (lpString=".zip") returned 4
	[0075.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.061] lstrlenW (lpString=".rar") returned 4
	[0075.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.061] lstrlenW (lpString=".bz2") returned 4
	[0075.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.061] lstrlenW (lpString=".7z") returned 3
	[0075.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.061] lstrlenW (lpString=".dbf") returned 4
	[0075.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.061] lstrlenW (lpString=".1cd") returned 4
	[0075.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0075.061] lstrlenW (lpString=".jpg") returned 4
	[0075.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.061] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.061] lstrlenW (lpString="BS00444_.WMF") returned 12
	[0075.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0075.062] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3896) returned 1
	[0075.062] CloseHandle (hObject=0x390) returned 1
	[0075.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220
	[0075.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0075.062] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.062] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0075.063] GetLastError () returned 0x0
	[0075.063] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xf38, lpOverlapped=0x0) returned 1
	[0075.064] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf40, lpOverlapped=0x0) returned 1
	[0075.065] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.065] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.065] SetEndOfFile (hFile=0x320) returned 1
	[0075.065] CloseHandle (hObject=0x320) returned 1
	[0075.067] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.067] SetEndOfFile (hFile=0x390) returned 1
	[0075.067] CloseHandle (hObject=0x390) returned 1
	[0075.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1
	[0075.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.068] lstrlenW (lpString=".doc") returned 4
	[0075.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.068] lstrlenW (lpString=".docx") returned 5
	[0075.068] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.068] lstrlenW (lpString=".pdf") returned 4
	[0075.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.068] lstrlenW (lpString=".xls") returned 4
	[0075.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.068] lstrlenW (lpString=".xlsx") returned 5
	[0075.068] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.068] lstrlenW (lpString=".ppt") returned 4
	[0075.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.069] lstrlenW (lpString=".zip") returned 4
	[0075.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.069] lstrlenW (lpString=".rar") returned 4
	[0075.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.069] lstrlenW (lpString=".bz2") returned 4
	[0075.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.069] lstrlenW (lpString=".7z") returned 3
	[0075.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.069] lstrlenW (lpString=".dbf") returned 4
	[0075.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.069] lstrlenW (lpString=".1cd") returned 4
	[0075.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.069] lstrlenW (lpString=".jpg") returned 4
	[0075.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.069] lstrlenW (lpString=".doc") returned 4
	[0075.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.069] lstrlenW (lpString=".docx") returned 5
	[0075.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.070] lstrlenW (lpString=".pdf") returned 4
	[0075.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.070] lstrlenW (lpString=".xls") returned 4
	[0075.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.070] lstrlenW (lpString=".xlsx") returned 5
	[0075.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.070] lstrlenW (lpString=".ppt") returned 4
	[0075.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.070] lstrlenW (lpString=".zip") returned 4
	[0075.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.070] lstrlenW (lpString=".rar") returned 4
	[0075.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.070] lstrlenW (lpString=".bz2") returned 4
	[0075.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.070] lstrlenW (lpString=".7z") returned 3
	[0075.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.070] lstrlenW (lpString=".dbf") returned 4
	[0075.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.070] lstrlenW (lpString=".1cd") returned 4
	[0075.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0075.070] lstrlenW (lpString=".jpg") returned 4
	[0075.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.071] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.071] lstrlenW (lpString="BS00445_.WMF") returned 12
	[0075.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0075.072] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3796) returned 1
	[0075.072] CloseHandle (hObject=0x390) returned 1
	[0075.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220
	[0075.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0075.072] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.072] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0075.072] GetLastError () returned 0x0
	[0075.073] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xed4, lpOverlapped=0x0) returned 1
	[0075.074] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xee0, lpOverlapped=0x0) returned 1
	[0075.075] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.075] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.075] SetEndOfFile (hFile=0x320) returned 1
	[0075.075] CloseHandle (hObject=0x320) returned 1
	[0075.076] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.076] SetEndOfFile (hFile=0x390) returned 1
	[0075.077] CloseHandle (hObject=0x390) returned 1
	[0075.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1
	[0075.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.077] lstrlenW (lpString=".doc") returned 4
	[0075.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.077] lstrlenW (lpString=".docx") returned 5
	[0075.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.077] lstrlenW (lpString=".pdf") returned 4
	[0075.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.077] lstrlenW (lpString=".xls") returned 4
	[0075.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.078] lstrlenW (lpString=".xlsx") returned 5
	[0075.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.078] lstrlenW (lpString=".ppt") returned 4
	[0075.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.078] lstrlenW (lpString=".zip") returned 4
	[0075.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.078] lstrlenW (lpString=".rar") returned 4
	[0075.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.078] lstrlenW (lpString=".bz2") returned 4
	[0075.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.078] lstrlenW (lpString=".7z") returned 3
	[0075.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.078] lstrlenW (lpString=".dbf") returned 4
	[0075.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.078] lstrlenW (lpString=".1cd") returned 4
	[0075.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.078] lstrlenW (lpString=".jpg") returned 4
	[0075.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.078] lstrlenW (lpString=".doc") returned 4
	[0075.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.078] lstrlenW (lpString=".docx") returned 5
	[0075.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.079] lstrlenW (lpString=".pdf") returned 4
	[0075.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.079] lstrlenW (lpString=".xls") returned 4
	[0075.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.079] lstrlenW (lpString=".xlsx") returned 5
	[0075.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.079] lstrlenW (lpString=".ppt") returned 4
	[0075.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.079] lstrlenW (lpString=".zip") returned 4
	[0075.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.079] lstrlenW (lpString=".rar") returned 4
	[0075.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.079] lstrlenW (lpString=".bz2") returned 4
	[0075.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.079] lstrlenW (lpString=".7z") returned 3
	[0075.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.079] lstrlenW (lpString=".dbf") returned 4
	[0075.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.079] lstrlenW (lpString=".1cd") returned 4
	[0075.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0075.079] lstrlenW (lpString=".jpg") returned 4
	[0075.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.080] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.080] lstrlenW (lpString="BS00453_.WMF") returned 12
	[0075.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.517] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=2436) returned 1
	[0075.517] CloseHandle (hObject=0x340) returned 1
	[0075.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220
	[0075.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.517] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.517] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.518] GetLastError () returned 0x0
	[0075.518] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x984, lpOverlapped=0x0) returned 1
	[0075.522] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x990, lpOverlapped=0x0) returned 1
	[0075.523] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.523] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.523] SetEndOfFile (hFile=0x37c) returned 1
	[0075.523] CloseHandle (hObject=0x37c) returned 1
	[0075.525] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.525] SetEndOfFile (hFile=0x340) returned 1
	[0075.526] CloseHandle (hObject=0x340) returned 1
	[0075.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1
	[0075.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.527] lstrlenW (lpString=".doc") returned 4
	[0075.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.527] lstrlenW (lpString=".docx") returned 5
	[0075.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.527] lstrlenW (lpString=".pdf") returned 4
	[0075.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.527] lstrlenW (lpString=".xls") returned 4
	[0075.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.527] lstrlenW (lpString=".xlsx") returned 5
	[0075.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.527] lstrlenW (lpString=".ppt") returned 4
	[0075.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.527] lstrlenW (lpString=".zip") returned 4
	[0075.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.527] lstrlenW (lpString=".rar") returned 4
	[0075.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.527] lstrlenW (lpString=".bz2") returned 4
	[0075.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.527] lstrlenW (lpString=".7z") returned 3
	[0075.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.528] lstrlenW (lpString=".dbf") returned 4
	[0075.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.528] lstrlenW (lpString=".1cd") returned 4
	[0075.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.528] lstrlenW (lpString=".jpg") returned 4
	[0075.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.528] lstrlenW (lpString=".doc") returned 4
	[0075.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.528] lstrlenW (lpString=".docx") returned 5
	[0075.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.528] lstrlenW (lpString=".pdf") returned 4
	[0075.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.528] lstrlenW (lpString=".xls") returned 4
	[0075.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.528] lstrlenW (lpString=".xlsx") returned 5
	[0075.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.529] lstrlenW (lpString=".ppt") returned 4
	[0075.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.529] lstrlenW (lpString=".zip") returned 4
	[0075.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.529] lstrlenW (lpString=".rar") returned 4
	[0075.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.529] lstrlenW (lpString=".bz2") returned 4
	[0075.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.529] lstrlenW (lpString=".7z") returned 3
	[0075.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.529] lstrlenW (lpString=".dbf") returned 4
	[0075.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.529] lstrlenW (lpString=".1cd") returned 4
	[0075.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0075.529] lstrlenW (lpString=".jpg") returned 4
	[0075.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.530] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.530] lstrlenW (lpString="BS01635_.WMF") returned 12
	[0075.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.533] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=14996) returned 1
	[0075.533] CloseHandle (hObject=0x340) returned 1
	[0075.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220
	[0075.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.533] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.533] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.534] GetLastError () returned 0x0
	[0075.534] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x3a94, lpOverlapped=0x0) returned 1
	[0075.535] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3aa0, lpOverlapped=0x0) returned 1
	[0075.537] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.537] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.537] SetEndOfFile (hFile=0x37c) returned 1
	[0075.537] CloseHandle (hObject=0x37c) returned 1
	[0075.538] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.538] SetEndOfFile (hFile=0x340) returned 1
	[0075.539] CloseHandle (hObject=0x340) returned 1
	[0075.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1
	[0075.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.540] lstrlenW (lpString=".doc") returned 4
	[0075.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.540] lstrlenW (lpString=".docx") returned 5
	[0075.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.540] lstrlenW (lpString=".pdf") returned 4
	[0075.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.540] lstrlenW (lpString=".xls") returned 4
	[0075.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.540] lstrlenW (lpString=".xlsx") returned 5
	[0075.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.540] lstrlenW (lpString=".ppt") returned 4
	[0075.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.540] lstrlenW (lpString=".zip") returned 4
	[0075.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.540] lstrlenW (lpString=".rar") returned 4
	[0075.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.540] lstrlenW (lpString=".bz2") returned 4
	[0075.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.540] lstrlenW (lpString=".7z") returned 3
	[0075.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.541] lstrlenW (lpString=".dbf") returned 4
	[0075.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.541] lstrlenW (lpString=".1cd") returned 4
	[0075.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.541] lstrlenW (lpString=".jpg") returned 4
	[0075.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.541] lstrlenW (lpString=".doc") returned 4
	[0075.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.541] lstrlenW (lpString=".docx") returned 5
	[0075.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.541] lstrlenW (lpString=".pdf") returned 4
	[0075.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.541] lstrlenW (lpString=".xls") returned 4
	[0075.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.541] lstrlenW (lpString=".xlsx") returned 5
	[0075.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.541] lstrlenW (lpString=".ppt") returned 4
	[0075.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.541] lstrlenW (lpString=".zip") returned 4
	[0075.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.542] lstrlenW (lpString=".rar") returned 4
	[0075.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.542] lstrlenW (lpString=".bz2") returned 4
	[0075.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.542] lstrlenW (lpString=".7z") returned 3
	[0075.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.542] lstrlenW (lpString=".dbf") returned 4
	[0075.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.542] lstrlenW (lpString=".1cd") returned 4
	[0075.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0075.542] lstrlenW (lpString=".jpg") returned 4
	[0075.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.542] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.542] lstrlenW (lpString="BS01636_.WMF") returned 12
	[0075.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.543] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1874) returned 1
	[0075.543] CloseHandle (hObject=0x340) returned 1
	[0075.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220
	[0075.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0075.543] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.543] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.544] GetLastError () returned 0x0
	[0075.544] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x752, lpOverlapped=0x0) returned 1
	[0075.545] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x760, lpOverlapped=0x0) returned 1
	[0075.546] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.546] WriteFile (in: hFile=0x37c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.546] SetEndOfFile (hFile=0x37c) returned 1
	[0075.546] CloseHandle (hObject=0x37c) returned 1
	[0075.547] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.547] SetEndOfFile (hFile=0x340) returned 1
	[0075.548] CloseHandle (hObject=0x340) returned 1
	[0075.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1
	[0075.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.549] lstrlenW (lpString=".doc") returned 4
	[0075.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.549] lstrlenW (lpString=".docx") returned 5
	[0075.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.549] lstrlenW (lpString=".pdf") returned 4
	[0075.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.549] lstrlenW (lpString=".xls") returned 4
	[0075.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.549] lstrlenW (lpString=".xlsx") returned 5
	[0075.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.549] lstrlenW (lpString=".ppt") returned 4
	[0075.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.549] lstrlenW (lpString=".zip") returned 4
	[0075.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.549] lstrlenW (lpString=".rar") returned 4
	[0075.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.549] lstrlenW (lpString=".bz2") returned 4
	[0075.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.549] lstrlenW (lpString=".7z") returned 3
	[0075.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.550] lstrlenW (lpString=".dbf") returned 4
	[0075.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.550] lstrlenW (lpString=".1cd") returned 4
	[0075.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.550] lstrlenW (lpString=".jpg") returned 4
	[0075.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.550] lstrlenW (lpString=".doc") returned 4
	[0075.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.550] lstrlenW (lpString=".docx") returned 5
	[0075.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.550] lstrlenW (lpString=".pdf") returned 4
	[0075.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.550] lstrlenW (lpString=".xls") returned 4
	[0075.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.550] lstrlenW (lpString=".xlsx") returned 5
	[0075.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.550] lstrlenW (lpString=".ppt") returned 4
	[0075.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.550] lstrlenW (lpString=".zip") returned 4
	[0075.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.551] lstrlenW (lpString=".rar") returned 4
	[0075.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.551] lstrlenW (lpString=".bz2") returned 4
	[0075.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.551] lstrlenW (lpString=".7z") returned 3
	[0075.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.551] lstrlenW (lpString=".dbf") returned 4
	[0075.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.551] lstrlenW (lpString=".1cd") returned 4
	[0075.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0075.551] lstrlenW (lpString=".jpg") returned 4
	[0075.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.552] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.552] lstrlenW (lpString="BS01637_.WMF") returned 12
	[0075.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.887] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3948) returned 1
	[0075.887] CloseHandle (hObject=0x350) returned 1
	[0075.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220
	[0075.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.888] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.888] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0075.888] GetLastError () returned 0x0
	[0075.888] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xf6c, lpOverlapped=0x0) returned 1
	[0075.890] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf70, lpOverlapped=0x0) returned 1
	[0075.891] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.891] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.891] SetEndOfFile (hFile=0x360) returned 1
	[0075.891] CloseHandle (hObject=0x360) returned 1
	[0075.892] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.892] SetEndOfFile (hFile=0x350) returned 1
	[0075.893] CloseHandle (hObject=0x350) returned 1
	[0075.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1
	[0075.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.894] lstrlenW (lpString=".doc") returned 4
	[0075.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.894] lstrlenW (lpString=".docx") returned 5
	[0075.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.894] lstrlenW (lpString=".pdf") returned 4
	[0075.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.894] lstrlenW (lpString=".xls") returned 4
	[0075.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.894] lstrlenW (lpString=".xlsx") returned 5
	[0075.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.894] lstrlenW (lpString=".ppt") returned 4
	[0075.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.894] lstrlenW (lpString=".zip") returned 4
	[0075.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.895] lstrlenW (lpString=".rar") returned 4
	[0075.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.895] lstrlenW (lpString=".bz2") returned 4
	[0075.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.895] lstrlenW (lpString=".7z") returned 3
	[0075.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.895] lstrlenW (lpString=".dbf") returned 4
	[0075.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.895] lstrlenW (lpString=".1cd") returned 4
	[0075.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.895] lstrlenW (lpString=".jpg") returned 4
	[0075.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.895] lstrlenW (lpString=".doc") returned 4
	[0075.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.895] lstrlenW (lpString=".docx") returned 5
	[0075.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.896] lstrlenW (lpString=".pdf") returned 4
	[0075.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.896] lstrlenW (lpString=".xls") returned 4
	[0075.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.896] lstrlenW (lpString=".xlsx") returned 5
	[0075.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.896] lstrlenW (lpString=".ppt") returned 4
	[0075.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.896] lstrlenW (lpString=".zip") returned 4
	[0075.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.896] lstrlenW (lpString=".rar") returned 4
	[0075.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.896] lstrlenW (lpString=".bz2") returned 4
	[0075.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.896] lstrlenW (lpString=".7z") returned 3
	[0075.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.896] lstrlenW (lpString=".dbf") returned 4
	[0075.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.896] lstrlenW (lpString=".1cd") returned 4
	[0075.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0075.897] lstrlenW (lpString=".jpg") returned 4
	[0075.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.897] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.897] lstrlenW (lpString="DD00117_.WMF") returned 12
	[0075.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.897] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=31122) returned 1
	[0075.897] CloseHandle (hObject=0x350) returned 1
	[0075.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220
	[0075.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.898] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.898] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0075.898] GetLastError () returned 0x0
	[0075.898] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x7992, lpOverlapped=0x0) returned 1
	[0075.900] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x79a0, lpOverlapped=0x0) returned 1
	[0075.901] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.901] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.902] SetEndOfFile (hFile=0x360) returned 1
	[0075.902] CloseHandle (hObject=0x360) returned 1
	[0075.903] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.903] SetEndOfFile (hFile=0x350) returned 1
	[0075.904] CloseHandle (hObject=0x350) returned 1
	[0075.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1
	[0075.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.905] lstrlenW (lpString=".doc") returned 4
	[0075.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.905] lstrlenW (lpString=".docx") returned 5
	[0075.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.905] lstrlenW (lpString=".pdf") returned 4
	[0075.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.905] lstrlenW (lpString=".xls") returned 4
	[0075.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.905] lstrlenW (lpString=".xlsx") returned 5
	[0075.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.905] lstrlenW (lpString=".ppt") returned 4
	[0075.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.905] lstrlenW (lpString=".zip") returned 4
	[0075.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.905] lstrlenW (lpString=".rar") returned 4
	[0075.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.905] lstrlenW (lpString=".bz2") returned 4
	[0075.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.905] lstrlenW (lpString=".7z") returned 3
	[0075.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.906] lstrlenW (lpString=".dbf") returned 4
	[0075.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.906] lstrlenW (lpString=".1cd") returned 4
	[0075.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.906] lstrlenW (lpString=".jpg") returned 4
	[0075.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.906] lstrlenW (lpString=".doc") returned 4
	[0075.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.906] lstrlenW (lpString=".docx") returned 5
	[0075.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.906] lstrlenW (lpString=".pdf") returned 4
	[0075.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.906] lstrlenW (lpString=".xls") returned 4
	[0075.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.906] lstrlenW (lpString=".xlsx") returned 5
	[0075.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.906] lstrlenW (lpString=".ppt") returned 4
	[0075.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.906] lstrlenW (lpString=".zip") returned 4
	[0075.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.906] lstrlenW (lpString=".rar") returned 4
	[0075.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.906] lstrlenW (lpString=".bz2") returned 4
	[0075.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.907] lstrlenW (lpString=".7z") returned 3
	[0075.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.907] lstrlenW (lpString=".dbf") returned 4
	[0075.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.907] lstrlenW (lpString=".1cd") returned 4
	[0075.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0075.907] lstrlenW (lpString=".jpg") returned 4
	[0075.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.907] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.907] lstrlenW (lpString="DD00121_.WMF") returned 12
	[0075.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.908] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=8256) returned 1
	[0075.908] CloseHandle (hObject=0x350) returned 1
	[0075.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220
	[0075.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.908] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.908] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0075.909] GetLastError () returned 0x0
	[0075.909] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x2040, lpOverlapped=0x0) returned 1
	[0075.910] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x2050, lpOverlapped=0x0) returned 1
	[0075.912] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.912] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.912] SetEndOfFile (hFile=0x360) returned 1
	[0075.912] CloseHandle (hObject=0x360) returned 1
	[0075.913] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.914] SetEndOfFile (hFile=0x350) returned 1
	[0075.914] CloseHandle (hObject=0x350) returned 1
	[0075.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0075.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1
	[0075.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.915] lstrlenW (lpString=".doc") returned 4
	[0075.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.915] lstrlenW (lpString=".docx") returned 5
	[0075.915] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.915] lstrlenW (lpString=".pdf") returned 4
	[0075.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.915] lstrlenW (lpString=".xls") returned 4
	[0075.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.915] lstrlenW (lpString=".xlsx") returned 5
	[0075.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.915] lstrlenW (lpString=".ppt") returned 4
	[0075.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.916] lstrlenW (lpString=".zip") returned 4
	[0075.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.916] lstrlenW (lpString=".rar") returned 4
	[0075.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.916] lstrlenW (lpString=".bz2") returned 4
	[0075.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.916] lstrlenW (lpString=".7z") returned 3
	[0075.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.916] lstrlenW (lpString=".dbf") returned 4
	[0075.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.916] lstrlenW (lpString=".1cd") returned 4
	[0075.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.916] lstrlenW (lpString=".jpg") returned 4
	[0075.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.916] lstrlenW (lpString=".doc") returned 4
	[0075.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.917] lstrlenW (lpString=".docx") returned 5
	[0075.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.917] lstrlenW (lpString=".pdf") returned 4
	[0075.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.917] lstrlenW (lpString=".xls") returned 4
	[0075.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.917] lstrlenW (lpString=".xlsx") returned 5
	[0075.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.917] lstrlenW (lpString=".ppt") returned 4
	[0075.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.917] lstrlenW (lpString=".zip") returned 4
	[0075.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.917] lstrlenW (lpString=".rar") returned 4
	[0075.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.917] lstrlenW (lpString=".bz2") returned 4
	[0075.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.917] lstrlenW (lpString=".7z") returned 3
	[0075.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.917] lstrlenW (lpString=".dbf") returned 4
	[0075.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.917] lstrlenW (lpString=".1cd") returned 4
	[0075.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0075.918] lstrlenW (lpString=".jpg") returned 4
	[0075.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.918] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0075.918] lstrlenW (lpString="DD00234_.WMF") returned 12
	[0075.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.919] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=29628) returned 1
	[0075.919] CloseHandle (hObject=0x350) returned 1
	[0075.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220
	[0075.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.919] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.919] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0075.920] GetLastError () returned 0x0
	[0075.920] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x73bc, lpOverlapped=0x0) returned 1
	[0076.317] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x73c0, lpOverlapped=0x0) returned 1
	[0076.319] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.319] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.319] SetEndOfFile (hFile=0x360) returned 1
	[0076.319] CloseHandle (hObject=0x360) returned 1
	[0076.319] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.320] SetEndOfFile (hFile=0x350) returned 1
	[0076.321] CloseHandle (hObject=0x350) returned 1
	[0076.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1
	[0076.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.321] lstrlenW (lpString=".doc") returned 4
	[0076.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.321] lstrlenW (lpString=".docx") returned 5
	[0076.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.321] lstrlenW (lpString=".pdf") returned 4
	[0076.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.322] lstrlenW (lpString=".xls") returned 4
	[0076.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.322] lstrlenW (lpString=".xlsx") returned 5
	[0076.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.322] lstrlenW (lpString=".ppt") returned 4
	[0076.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.322] lstrlenW (lpString=".zip") returned 4
	[0076.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.322] lstrlenW (lpString=".rar") returned 4
	[0076.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.322] lstrlenW (lpString=".bz2") returned 4
	[0076.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.322] lstrlenW (lpString=".7z") returned 3
	[0076.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.322] lstrlenW (lpString=".dbf") returned 4
	[0076.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.322] lstrlenW (lpString=".1cd") returned 4
	[0076.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.322] lstrlenW (lpString=".jpg") returned 4
	[0076.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.323] lstrlenW (lpString=".doc") returned 4
	[0076.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.323] lstrlenW (lpString=".docx") returned 5
	[0076.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.323] lstrlenW (lpString=".pdf") returned 4
	[0076.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.323] lstrlenW (lpString=".xls") returned 4
	[0076.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.323] lstrlenW (lpString=".xlsx") returned 5
	[0076.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.323] lstrlenW (lpString=".ppt") returned 4
	[0076.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.323] lstrlenW (lpString=".zip") returned 4
	[0076.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.323] lstrlenW (lpString=".rar") returned 4
	[0076.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.323] lstrlenW (lpString=".bz2") returned 4
	[0076.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.323] lstrlenW (lpString=".7z") returned 3
	[0076.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.323] lstrlenW (lpString=".dbf") returned 4
	[0076.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.324] lstrlenW (lpString=".1cd") returned 4
	[0076.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.324] lstrlenW (lpString=".jpg") returned 4
	[0076.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.324] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.324] lstrlenW (lpString="DD01015_.WMF") returned 12
	[0076.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.324] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=2226) returned 1
	[0076.324] CloseHandle (hObject=0x350) returned 1
	[0076.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220
	[0076.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.325] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.325] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0076.325] GetLastError () returned 0x0
	[0076.325] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x8b2, lpOverlapped=0x0) returned 1
	[0076.327] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0076.328] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.328] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.328] SetEndOfFile (hFile=0x360) returned 1
	[0076.328] CloseHandle (hObject=0x360) returned 1
	[0076.328] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.328] SetEndOfFile (hFile=0x350) returned 1
	[0076.333] CloseHandle (hObject=0x350) returned 1
	[0076.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1
	[0076.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.333] lstrlenW (lpString=".doc") returned 4
	[0076.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.333] lstrlenW (lpString=".docx") returned 5
	[0076.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.333] lstrlenW (lpString=".pdf") returned 4
	[0076.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.334] lstrlenW (lpString=".xls") returned 4
	[0076.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.334] lstrlenW (lpString=".xlsx") returned 5
	[0076.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.334] lstrlenW (lpString=".ppt") returned 4
	[0076.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.334] lstrlenW (lpString=".zip") returned 4
	[0076.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.334] lstrlenW (lpString=".rar") returned 4
	[0076.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.334] lstrlenW (lpString=".bz2") returned 4
	[0076.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.334] lstrlenW (lpString=".7z") returned 3
	[0076.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.334] lstrlenW (lpString=".dbf") returned 4
	[0076.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.334] lstrlenW (lpString=".1cd") returned 4
	[0076.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.334] lstrlenW (lpString=".jpg") returned 4
	[0076.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.335] lstrlenW (lpString=".doc") returned 4
	[0076.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.335] lstrlenW (lpString=".docx") returned 5
	[0076.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.335] lstrlenW (lpString=".pdf") returned 4
	[0076.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.335] lstrlenW (lpString=".xls") returned 4
	[0076.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.335] lstrlenW (lpString=".xlsx") returned 5
	[0076.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.335] lstrlenW (lpString=".ppt") returned 4
	[0076.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.335] lstrlenW (lpString=".zip") returned 4
	[0076.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.335] lstrlenW (lpString=".rar") returned 4
	[0076.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.335] lstrlenW (lpString=".bz2") returned 4
	[0076.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.335] lstrlenW (lpString=".7z") returned 3
	[0076.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.335] lstrlenW (lpString=".dbf") returned 4
	[0076.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.335] lstrlenW (lpString=".1cd") returned 4
	[0076.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0076.336] lstrlenW (lpString=".jpg") returned 4
	[0076.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.336] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.336] lstrlenW (lpString="DD01039_.WMF") returned 12
	[0076.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.336] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=14820) returned 1
	[0076.336] CloseHandle (hObject=0x350) returned 1
	[0076.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220
	[0076.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.337] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.337] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0076.337] GetLastError () returned 0x0
	[0076.337] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x39e4, lpOverlapped=0x0) returned 1
	[0076.339] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x39f0, lpOverlapped=0x0) returned 1
	[0076.340] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.340] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.340] SetEndOfFile (hFile=0x360) returned 1
	[0076.341] CloseHandle (hObject=0x360) returned 1
	[0076.341] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.341] SetEndOfFile (hFile=0x350) returned 1
	[0076.342] CloseHandle (hObject=0x350) returned 1
	[0076.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1
	[0076.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.342] lstrlenW (lpString=".doc") returned 4
	[0076.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.343] lstrlenW (lpString=".docx") returned 5
	[0076.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.343] lstrlenW (lpString=".pdf") returned 4
	[0076.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.343] lstrlenW (lpString=".xls") returned 4
	[0076.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.343] lstrlenW (lpString=".xlsx") returned 5
	[0076.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.343] lstrlenW (lpString=".ppt") returned 4
	[0076.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.343] lstrlenW (lpString=".zip") returned 4
	[0076.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.343] lstrlenW (lpString=".rar") returned 4
	[0076.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.343] lstrlenW (lpString=".bz2") returned 4
	[0076.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.343] lstrlenW (lpString=".7z") returned 3
	[0076.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.343] lstrlenW (lpString=".dbf") returned 4
	[0076.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.344] lstrlenW (lpString=".1cd") returned 4
	[0076.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.344] lstrlenW (lpString=".jpg") returned 4
	[0076.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.344] lstrlenW (lpString=".doc") returned 4
	[0076.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.344] lstrlenW (lpString=".docx") returned 5
	[0076.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.344] lstrlenW (lpString=".pdf") returned 4
	[0076.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.344] lstrlenW (lpString=".xls") returned 4
	[0076.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.344] lstrlenW (lpString=".xlsx") returned 5
	[0076.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.345] lstrlenW (lpString=".ppt") returned 4
	[0076.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.345] lstrlenW (lpString=".zip") returned 4
	[0076.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.345] lstrlenW (lpString=".rar") returned 4
	[0076.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.345] lstrlenW (lpString=".bz2") returned 4
	[0076.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.345] lstrlenW (lpString=".7z") returned 3
	[0076.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.345] lstrlenW (lpString=".dbf") returned 4
	[0076.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.345] lstrlenW (lpString=".1cd") returned 4
	[0076.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0076.345] lstrlenW (lpString=".jpg") returned 4
	[0076.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.346] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.346] lstrlenW (lpString="DD01138_.WMF") returned 12
	[0076.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.346] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3692) returned 1
	[0076.346] CloseHandle (hObject=0x350) returned 1
	[0076.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220
	[0076.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.347] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.347] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0076.347] GetLastError () returned 0x0
	[0076.347] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xe6c, lpOverlapped=0x0) returned 1
	[0076.349] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xe70, lpOverlapped=0x0) returned 1
	[0076.350] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.350] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.350] SetEndOfFile (hFile=0x360) returned 1
	[0076.350] CloseHandle (hObject=0x360) returned 1
	[0076.351] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.351] SetEndOfFile (hFile=0x350) returned 1
	[0076.351] CloseHandle (hObject=0x350) returned 1
	[0076.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0076.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1
	[0076.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.352] lstrlenW (lpString=".doc") returned 4
	[0076.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.352] lstrlenW (lpString=".docx") returned 5
	[0076.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.352] lstrlenW (lpString=".pdf") returned 4
	[0076.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.352] lstrlenW (lpString=".xls") returned 4
	[0076.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.352] lstrlenW (lpString=".xlsx") returned 5
	[0076.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.352] lstrlenW (lpString=".ppt") returned 4
	[0076.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.353] lstrlenW (lpString=".zip") returned 4
	[0076.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.353] lstrlenW (lpString=".rar") returned 4
	[0076.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.353] lstrlenW (lpString=".bz2") returned 4
	[0076.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.353] lstrlenW (lpString=".7z") returned 3
	[0076.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.353] lstrlenW (lpString=".dbf") returned 4
	[0076.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.353] lstrlenW (lpString=".1cd") returned 4
	[0076.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.353] lstrlenW (lpString=".jpg") returned 4
	[0076.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.354] lstrlenW (lpString=".doc") returned 4
	[0076.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.354] lstrlenW (lpString=".docx") returned 5
	[0076.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.354] lstrlenW (lpString=".pdf") returned 4
	[0076.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.354] lstrlenW (lpString=".xls") returned 4
	[0076.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.354] lstrlenW (lpString=".xlsx") returned 5
	[0076.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.354] lstrlenW (lpString=".ppt") returned 4
	[0076.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.354] lstrlenW (lpString=".zip") returned 4
	[0076.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.354] lstrlenW (lpString=".rar") returned 4
	[0076.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.354] lstrlenW (lpString=".bz2") returned 4
	[0076.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.354] lstrlenW (lpString=".7z") returned 3
	[0076.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.355] lstrlenW (lpString=".dbf") returned 4
	[0076.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.355] lstrlenW (lpString=".1cd") returned 4
	[0076.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0076.355] lstrlenW (lpString=".jpg") returned 4
	[0076.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.355] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0076.355] lstrlenW (lpString="DD01139_.WMF") returned 12
	[0076.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.356] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3632) returned 1
	[0076.356] CloseHandle (hObject=0x350) returned 1
	[0076.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220
	[0076.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.356] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.356] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0076.357] GetLastError () returned 0x0
	[0076.357] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xe30, lpOverlapped=0x0) returned 1
	[0077.041] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xe40, lpOverlapped=0x0) returned 1
	[0077.062] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.062] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.062] SetEndOfFile (hFile=0x360) returned 1
	[0077.063] CloseHandle (hObject=0x360) returned 1
	[0077.063] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.063] SetEndOfFile (hFile=0x350) returned 1
	[0077.064] CloseHandle (hObject=0x350) returned 1
	[0077.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1
	[0077.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.064] lstrlenW (lpString=".doc") returned 4
	[0077.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.064] lstrlenW (lpString=".docx") returned 5
	[0077.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.064] lstrlenW (lpString=".pdf") returned 4
	[0077.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.064] lstrlenW (lpString=".xls") returned 4
	[0077.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.064] lstrlenW (lpString=".xlsx") returned 5
	[0077.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.065] lstrlenW (lpString=".ppt") returned 4
	[0077.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.065] lstrlenW (lpString=".zip") returned 4
	[0077.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.065] lstrlenW (lpString=".rar") returned 4
	[0077.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.065] lstrlenW (lpString=".bz2") returned 4
	[0077.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.065] lstrlenW (lpString=".7z") returned 3
	[0077.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.065] lstrlenW (lpString=".dbf") returned 4
	[0077.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.065] lstrlenW (lpString=".1cd") returned 4
	[0077.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.065] lstrlenW (lpString=".jpg") returned 4
	[0077.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.065] lstrlenW (lpString=".doc") returned 4
	[0077.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.065] lstrlenW (lpString=".docx") returned 5
	[0077.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.066] lstrlenW (lpString=".pdf") returned 4
	[0077.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.066] lstrlenW (lpString=".xls") returned 4
	[0077.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.066] lstrlenW (lpString=".xlsx") returned 5
	[0077.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.066] lstrlenW (lpString=".ppt") returned 4
	[0077.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.066] lstrlenW (lpString=".zip") returned 4
	[0077.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.066] lstrlenW (lpString=".rar") returned 4
	[0077.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.066] lstrlenW (lpString=".bz2") returned 4
	[0077.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.066] lstrlenW (lpString=".7z") returned 3
	[0077.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.066] lstrlenW (lpString=".dbf") returned 4
	[0077.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.066] lstrlenW (lpString=".1cd") returned 4
	[0077.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0077.066] lstrlenW (lpString=".jpg") returned 4
	[0077.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.067] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.067] lstrlenW (lpString="DD01171_.WMF") returned 12
	[0077.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0077.067] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=2052) returned 1
	[0077.067] CloseHandle (hObject=0x350) returned 1
	[0077.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220
	[0077.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0077.067] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.068] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0077.072] GetLastError () returned 0x0
	[0077.072] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x804, lpOverlapped=0x0) returned 1
	[0077.074] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x810, lpOverlapped=0x0) returned 1
	[0077.075] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.075] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.075] SetEndOfFile (hFile=0x360) returned 1
	[0077.075] CloseHandle (hObject=0x360) returned 1
	[0077.075] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.075] SetEndOfFile (hFile=0x350) returned 1
	[0077.076] CloseHandle (hObject=0x350) returned 1
	[0077.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1
	[0077.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.076] lstrlenW (lpString=".doc") returned 4
	[0077.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.077] lstrlenW (lpString=".docx") returned 5
	[0077.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.077] lstrlenW (lpString=".pdf") returned 4
	[0077.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.077] lstrlenW (lpString=".xls") returned 4
	[0077.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.077] lstrlenW (lpString=".xlsx") returned 5
	[0077.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.077] lstrlenW (lpString=".ppt") returned 4
	[0077.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.077] lstrlenW (lpString=".zip") returned 4
	[0077.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.077] lstrlenW (lpString=".rar") returned 4
	[0077.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.077] lstrlenW (lpString=".bz2") returned 4
	[0077.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.077] lstrlenW (lpString=".7z") returned 3
	[0077.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.077] lstrlenW (lpString=".dbf") returned 4
	[0077.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.077] lstrlenW (lpString=".1cd") returned 4
	[0077.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.077] lstrlenW (lpString=".jpg") returned 4
	[0077.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.078] lstrlenW (lpString=".doc") returned 4
	[0077.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.078] lstrlenW (lpString=".docx") returned 5
	[0077.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.078] lstrlenW (lpString=".pdf") returned 4
	[0077.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.078] lstrlenW (lpString=".xls") returned 4
	[0077.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.078] lstrlenW (lpString=".xlsx") returned 5
	[0077.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.078] lstrlenW (lpString=".ppt") returned 4
	[0077.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.078] lstrlenW (lpString=".zip") returned 4
	[0077.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.078] lstrlenW (lpString=".rar") returned 4
	[0077.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.078] lstrlenW (lpString=".bz2") returned 4
	[0077.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.078] lstrlenW (lpString=".7z") returned 3
	[0077.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.078] lstrlenW (lpString=".dbf") returned 4
	[0077.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.079] lstrlenW (lpString=".1cd") returned 4
	[0077.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0077.079] lstrlenW (lpString=".jpg") returned 4
	[0077.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.079] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.079] lstrlenW (lpString="DD01172_.WMF") returned 12
	[0077.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0077.079] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=2232) returned 1
	[0077.079] CloseHandle (hObject=0x350) returned 1
	[0077.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220
	[0077.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0077.080] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.080] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0077.080] GetLastError () returned 0x0
	[0077.080] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x8b8, lpOverlapped=0x0) returned 1
	[0077.082] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0077.083] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.083] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.083] SetEndOfFile (hFile=0x360) returned 1
	[0077.083] CloseHandle (hObject=0x360) returned 1
	[0077.084] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.084] SetEndOfFile (hFile=0x350) returned 1
	[0077.084] CloseHandle (hObject=0x350) returned 1
	[0077.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1
	[0077.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.085] lstrlenW (lpString=".doc") returned 4
	[0077.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.085] lstrlenW (lpString=".docx") returned 5
	[0077.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.085] lstrlenW (lpString=".pdf") returned 4
	[0077.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.085] lstrlenW (lpString=".xls") returned 4
	[0077.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.085] lstrlenW (lpString=".xlsx") returned 5
	[0077.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.085] lstrlenW (lpString=".ppt") returned 4
	[0077.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.085] lstrlenW (lpString=".zip") returned 4
	[0077.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.085] lstrlenW (lpString=".rar") returned 4
	[0077.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.086] lstrlenW (lpString=".bz2") returned 4
	[0077.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.086] lstrlenW (lpString=".7z") returned 3
	[0077.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.086] lstrlenW (lpString=".dbf") returned 4
	[0077.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.086] lstrlenW (lpString=".1cd") returned 4
	[0077.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.086] lstrlenW (lpString=".jpg") returned 4
	[0077.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.086] lstrlenW (lpString=".doc") returned 4
	[0077.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.086] lstrlenW (lpString=".docx") returned 5
	[0077.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.086] lstrlenW (lpString=".pdf") returned 4
	[0077.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.086] lstrlenW (lpString=".xls") returned 4
	[0077.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.086] lstrlenW (lpString=".xlsx") returned 5
	[0077.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.087] lstrlenW (lpString=".ppt") returned 4
	[0077.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.087] lstrlenW (lpString=".zip") returned 4
	[0077.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.087] lstrlenW (lpString=".rar") returned 4
	[0077.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.087] lstrlenW (lpString=".bz2") returned 4
	[0077.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.087] lstrlenW (lpString=".7z") returned 3
	[0077.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.087] lstrlenW (lpString=".dbf") returned 4
	[0077.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.087] lstrlenW (lpString=".1cd") returned 4
	[0077.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0077.087] lstrlenW (lpString=".jpg") returned 4
	[0077.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.087] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.087] lstrlenW (lpString="DD01173_.WMF") returned 12
	[0077.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0077.089] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1804) returned 1
	[0077.089] CloseHandle (hObject=0x350) returned 1
	[0077.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220
	[0077.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0077.089] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.089] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0077.090] GetLastError () returned 0x0
	[0077.090] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x70c, lpOverlapped=0x0) returned 1
	[0077.091] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x710, lpOverlapped=0x0) returned 1
	[0077.092] ReadFile (in: hFile=0x350, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.092] WriteFile (in: hFile=0x360, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.092] SetEndOfFile (hFile=0x360) returned 1
	[0077.092] CloseHandle (hObject=0x360) returned 1
	[0077.092] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.093] SetEndOfFile (hFile=0x350) returned 1
	[0077.093] CloseHandle (hObject=0x350) returned 1
	[0077.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1
	[0077.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.094] lstrlenW (lpString=".doc") returned 4
	[0077.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.094] lstrlenW (lpString=".docx") returned 5
	[0077.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.094] lstrlenW (lpString=".pdf") returned 4
	[0077.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.094] lstrlenW (lpString=".xls") returned 4
	[0077.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.094] lstrlenW (lpString=".xlsx") returned 5
	[0077.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.094] lstrlenW (lpString=".ppt") returned 4
	[0077.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.095] lstrlenW (lpString=".zip") returned 4
	[0077.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.095] lstrlenW (lpString=".rar") returned 4
	[0077.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.095] lstrlenW (lpString=".bz2") returned 4
	[0077.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.095] lstrlenW (lpString=".7z") returned 3
	[0077.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.095] lstrlenW (lpString=".dbf") returned 4
	[0077.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.095] lstrlenW (lpString=".1cd") returned 4
	[0077.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.095] lstrlenW (lpString=".jpg") returned 4
	[0077.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.095] lstrlenW (lpString=".doc") returned 4
	[0077.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.095] lstrlenW (lpString=".docx") returned 5
	[0077.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.096] lstrlenW (lpString=".pdf") returned 4
	[0077.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.096] lstrlenW (lpString=".xls") returned 4
	[0077.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.096] lstrlenW (lpString=".xlsx") returned 5
	[0077.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.096] lstrlenW (lpString=".ppt") returned 4
	[0077.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.096] lstrlenW (lpString=".zip") returned 4
	[0077.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.096] lstrlenW (lpString=".rar") returned 4
	[0077.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.096] lstrlenW (lpString=".bz2") returned 4
	[0077.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.096] lstrlenW (lpString=".7z") returned 3
	[0077.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.096] lstrlenW (lpString=".dbf") returned 4
	[0077.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.096] lstrlenW (lpString=".1cd") returned 4
	[0077.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0077.097] lstrlenW (lpString=".jpg") returned 4
	[0077.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.097] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.097] lstrlenW (lpString="DD01176_.WMF") returned 12
	[0077.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0077.097] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1888) returned 1
	[0077.097] CloseHandle (hObject=0x350) returned 1
	[0077.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220
	[0077.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.249] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.249] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0077.770] GetLastError () returned 0x0
	[0077.770] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x760, lpOverlapped=0x0) returned 1
	[0077.772] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x770, lpOverlapped=0x0) returned 1
	[0077.773] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.773] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.773] SetEndOfFile (hFile=0x390) returned 1
	[0077.773] CloseHandle (hObject=0x390) returned 1
	[0077.774] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.774] SetEndOfFile (hFile=0x344) returned 1
	[0077.774] CloseHandle (hObject=0x344) returned 1
	[0077.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1
	[0077.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.775] lstrlenW (lpString=".doc") returned 4
	[0077.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.775] lstrlenW (lpString=".docx") returned 5
	[0077.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.775] lstrlenW (lpString=".pdf") returned 4
	[0077.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.775] lstrlenW (lpString=".xls") returned 4
	[0077.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.775] lstrlenW (lpString=".xlsx") returned 5
	[0077.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.775] lstrlenW (lpString=".ppt") returned 4
	[0077.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.776] lstrlenW (lpString=".zip") returned 4
	[0077.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.776] lstrlenW (lpString=".rar") returned 4
	[0077.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.776] lstrlenW (lpString=".bz2") returned 4
	[0077.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.776] lstrlenW (lpString=".7z") returned 3
	[0077.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.776] lstrlenW (lpString=".dbf") returned 4
	[0077.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.776] lstrlenW (lpString=".1cd") returned 4
	[0077.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.776] lstrlenW (lpString=".jpg") returned 4
	[0077.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.777] lstrlenW (lpString=".doc") returned 4
	[0077.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.777] lstrlenW (lpString=".docx") returned 5
	[0077.777] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.777] lstrlenW (lpString=".pdf") returned 4
	[0077.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.777] lstrlenW (lpString=".xls") returned 4
	[0077.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.777] lstrlenW (lpString=".xlsx") returned 5
	[0077.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.777] lstrlenW (lpString=".ppt") returned 4
	[0077.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.777] lstrlenW (lpString=".zip") returned 4
	[0077.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.777] lstrlenW (lpString=".rar") returned 4
	[0077.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.777] lstrlenW (lpString=".bz2") returned 4
	[0077.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.777] lstrlenW (lpString=".7z") returned 3
	[0077.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.778] lstrlenW (lpString=".dbf") returned 4
	[0077.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.778] lstrlenW (lpString=".1cd") returned 4
	[0077.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0077.778] lstrlenW (lpString=".jpg") returned 4
	[0077.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.778] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.778] lstrlenW (lpString="DD01772_.WMF") returned 12
	[0077.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.779] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=2300) returned 1
	[0077.779] CloseHandle (hObject=0x344) returned 1
	[0077.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220
	[0077.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.779] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.779] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0077.780] GetLastError () returned 0x0
	[0077.780] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0077.781] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x900, lpOverlapped=0x0) returned 1
	[0077.782] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.782] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.782] SetEndOfFile (hFile=0x390) returned 1
	[0077.782] CloseHandle (hObject=0x390) returned 1
	[0077.782] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.782] SetEndOfFile (hFile=0x344) returned 1
	[0077.783] CloseHandle (hObject=0x344) returned 1
	[0077.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1
	[0077.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.784] lstrlenW (lpString=".doc") returned 4
	[0077.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.784] lstrlenW (lpString=".docx") returned 5
	[0077.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.784] lstrlenW (lpString=".pdf") returned 4
	[0077.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.784] lstrlenW (lpString=".xls") returned 4
	[0077.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.784] lstrlenW (lpString=".xlsx") returned 5
	[0077.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.784] lstrlenW (lpString=".ppt") returned 4
	[0077.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.784] lstrlenW (lpString=".zip") returned 4
	[0077.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.784] lstrlenW (lpString=".rar") returned 4
	[0077.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.784] lstrlenW (lpString=".bz2") returned 4
	[0077.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.784] lstrlenW (lpString=".7z") returned 3
	[0077.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.785] lstrlenW (lpString=".dbf") returned 4
	[0077.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.785] lstrlenW (lpString=".1cd") returned 4
	[0077.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.785] lstrlenW (lpString=".jpg") returned 4
	[0077.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.785] lstrlenW (lpString=".doc") returned 4
	[0077.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.785] lstrlenW (lpString=".docx") returned 5
	[0077.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.785] lstrlenW (lpString=".pdf") returned 4
	[0077.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.785] lstrlenW (lpString=".xls") returned 4
	[0077.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.785] lstrlenW (lpString=".xlsx") returned 5
	[0077.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.785] lstrlenW (lpString=".ppt") returned 4
	[0077.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.786] lstrlenW (lpString=".zip") returned 4
	[0077.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.786] lstrlenW (lpString=".rar") returned 4
	[0077.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.786] lstrlenW (lpString=".bz2") returned 4
	[0077.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.786] lstrlenW (lpString=".7z") returned 3
	[0077.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.786] lstrlenW (lpString=".dbf") returned 4
	[0077.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.786] lstrlenW (lpString=".1cd") returned 4
	[0077.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0077.786] lstrlenW (lpString=".jpg") returned 4
	[0077.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.786] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.786] lstrlenW (lpString="DD01793_.WMF") returned 12
	[0077.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.787] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3252) returned 1
	[0077.787] CloseHandle (hObject=0x344) returned 1
	[0077.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220
	[0077.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.787] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.787] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0077.787] GetLastError () returned 0x0
	[0077.787] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xcb4, lpOverlapped=0x0) returned 1
	[0077.789] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xcc0, lpOverlapped=0x0) returned 1
	[0077.790] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.790] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.790] SetEndOfFile (hFile=0x390) returned 1
	[0077.790] CloseHandle (hObject=0x390) returned 1
	[0077.790] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.790] SetEndOfFile (hFile=0x344) returned 1
	[0077.791] CloseHandle (hObject=0x344) returned 1
	[0077.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1
	[0077.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.791] lstrlenW (lpString=".doc") returned 4
	[0077.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.792] lstrlenW (lpString=".docx") returned 5
	[0077.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.792] lstrlenW (lpString=".pdf") returned 4
	[0077.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.792] lstrlenW (lpString=".xls") returned 4
	[0077.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.792] lstrlenW (lpString=".xlsx") returned 5
	[0077.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.792] lstrlenW (lpString=".ppt") returned 4
	[0077.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.792] lstrlenW (lpString=".zip") returned 4
	[0077.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.792] lstrlenW (lpString=".rar") returned 4
	[0077.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.792] lstrlenW (lpString=".bz2") returned 4
	[0077.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.792] lstrlenW (lpString=".7z") returned 3
	[0077.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.792] lstrlenW (lpString=".dbf") returned 4
	[0077.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.792] lstrlenW (lpString=".1cd") returned 4
	[0077.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.792] lstrlenW (lpString=".jpg") returned 4
	[0077.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.793] lstrlenW (lpString=".doc") returned 4
	[0077.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.793] lstrlenW (lpString=".docx") returned 5
	[0077.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.793] lstrlenW (lpString=".pdf") returned 4
	[0077.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.793] lstrlenW (lpString=".xls") returned 4
	[0077.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.793] lstrlenW (lpString=".xlsx") returned 5
	[0077.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.793] lstrlenW (lpString=".ppt") returned 4
	[0077.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.793] lstrlenW (lpString=".zip") returned 4
	[0077.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.793] lstrlenW (lpString=".rar") returned 4
	[0077.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.793] lstrlenW (lpString=".bz2") returned 4
	[0077.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.793] lstrlenW (lpString=".7z") returned 3
	[0077.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.793] lstrlenW (lpString=".dbf") returned 4
	[0077.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.793] lstrlenW (lpString=".1cd") returned 4
	[0077.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0077.793] lstrlenW (lpString=".jpg") returned 4
	[0077.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.794] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.794] lstrlenW (lpString="ED00010_.WMF") returned 12
	[0077.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.794] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1382) returned 1
	[0077.794] CloseHandle (hObject=0x344) returned 1
	[0077.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220
	[0077.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.795] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.795] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0077.795] GetLastError () returned 0x0
	[0077.795] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x566, lpOverlapped=0x0) returned 1
	[0077.797] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x570, lpOverlapped=0x0) returned 1
	[0077.798] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.798] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.798] SetEndOfFile (hFile=0x390) returned 1
	[0077.798] CloseHandle (hObject=0x390) returned 1
	[0077.798] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.798] SetEndOfFile (hFile=0x344) returned 1
	[0077.799] CloseHandle (hObject=0x344) returned 1
	[0077.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0077.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1
	[0077.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.799] lstrlenW (lpString=".doc") returned 4
	[0077.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.799] lstrlenW (lpString=".docx") returned 5
	[0077.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.800] lstrlenW (lpString=".pdf") returned 4
	[0077.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.800] lstrlenW (lpString=".xls") returned 4
	[0077.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.800] lstrlenW (lpString=".xlsx") returned 5
	[0077.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.800] lstrlenW (lpString=".ppt") returned 4
	[0077.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.800] lstrlenW (lpString=".zip") returned 4
	[0077.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.800] lstrlenW (lpString=".rar") returned 4
	[0077.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.800] lstrlenW (lpString=".bz2") returned 4
	[0077.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.800] lstrlenW (lpString=".7z") returned 3
	[0077.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.800] lstrlenW (lpString=".dbf") returned 4
	[0077.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.800] lstrlenW (lpString=".1cd") returned 4
	[0077.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.801] lstrlenW (lpString=".jpg") returned 4
	[0077.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.801] lstrlenW (lpString=".doc") returned 4
	[0077.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.801] lstrlenW (lpString=".docx") returned 5
	[0077.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0077.801] lstrlenW (lpString=".pdf") returned 4
	[0077.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.801] lstrlenW (lpString=".xls") returned 4
	[0077.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.801] lstrlenW (lpString=".xlsx") returned 5
	[0077.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0077.801] lstrlenW (lpString=".ppt") returned 4
	[0077.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.802] lstrlenW (lpString=".zip") returned 4
	[0077.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.802] lstrlenW (lpString=".rar") returned 4
	[0077.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.802] lstrlenW (lpString=".bz2") returned 4
	[0077.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.802] lstrlenW (lpString=".7z") returned 3
	[0077.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.802] lstrlenW (lpString=".dbf") returned 4
	[0077.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.802] lstrlenW (lpString=".1cd") returned 4
	[0077.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0077.802] lstrlenW (lpString=".jpg") returned 4
	[0077.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.803] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0077.803] lstrlenW (lpString="ED00019_.WMF") returned 12
	[0077.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.803] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=13042) returned 1
	[0077.803] CloseHandle (hObject=0x344) returned 1
	[0077.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220
	[0077.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0077.803] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.803] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0077.804] GetLastError () returned 0x0
	[0077.804] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x32f2, lpOverlapped=0x0) returned 1
	[0078.129] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3300, lpOverlapped=0x0) returned 1
	[0078.130] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.130] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.130] SetEndOfFile (hFile=0x390) returned 1
	[0078.131] CloseHandle (hObject=0x390) returned 1
	[0078.131] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.131] SetEndOfFile (hFile=0x344) returned 1
	[0078.132] CloseHandle (hObject=0x344) returned 1
	[0078.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1
	[0078.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.132] lstrlenW (lpString=".doc") returned 4
	[0078.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.132] lstrlenW (lpString=".docx") returned 5
	[0078.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.132] lstrlenW (lpString=".pdf") returned 4
	[0078.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.132] lstrlenW (lpString=".xls") returned 4
	[0078.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.132] lstrlenW (lpString=".xlsx") returned 5
	[0078.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.132] lstrlenW (lpString=".ppt") returned 4
	[0078.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.133] lstrlenW (lpString=".zip") returned 4
	[0078.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.133] lstrlenW (lpString=".rar") returned 4
	[0078.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.133] lstrlenW (lpString=".bz2") returned 4
	[0078.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.133] lstrlenW (lpString=".7z") returned 3
	[0078.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.133] lstrlenW (lpString=".dbf") returned 4
	[0078.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.133] lstrlenW (lpString=".1cd") returned 4
	[0078.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.133] lstrlenW (lpString=".jpg") returned 4
	[0078.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.133] lstrlenW (lpString=".doc") returned 4
	[0078.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.133] lstrlenW (lpString=".docx") returned 5
	[0078.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.134] lstrlenW (lpString=".pdf") returned 4
	[0078.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.134] lstrlenW (lpString=".xls") returned 4
	[0078.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.134] lstrlenW (lpString=".xlsx") returned 5
	[0078.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.134] lstrlenW (lpString=".ppt") returned 4
	[0078.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.134] lstrlenW (lpString=".zip") returned 4
	[0078.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.134] lstrlenW (lpString=".rar") returned 4
	[0078.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.134] lstrlenW (lpString=".bz2") returned 4
	[0078.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.134] lstrlenW (lpString=".7z") returned 3
	[0078.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.134] lstrlenW (lpString=".dbf") returned 4
	[0078.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.134] lstrlenW (lpString=".1cd") returned 4
	[0078.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0078.135] lstrlenW (lpString=".jpg") returned 4
	[0078.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.135] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.135] lstrlenW (lpString="FD00086_.WMF") returned 12
	[0078.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.135] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=29212) returned 1
	[0078.135] CloseHandle (hObject=0x344) returned 1
	[0078.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220
	[0078.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.136] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.136] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.136] GetLastError () returned 0x0
	[0078.136] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x721c, lpOverlapped=0x0) returned 1
	[0078.138] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x7220, lpOverlapped=0x0) returned 1
	[0078.139] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.139] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.140] SetEndOfFile (hFile=0x390) returned 1
	[0078.140] CloseHandle (hObject=0x390) returned 1
	[0078.140] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.140] SetEndOfFile (hFile=0x344) returned 1
	[0078.141] CloseHandle (hObject=0x344) returned 1
	[0078.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1
	[0078.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.142] lstrlenW (lpString=".doc") returned 4
	[0078.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.142] lstrlenW (lpString=".docx") returned 5
	[0078.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.142] lstrlenW (lpString=".pdf") returned 4
	[0078.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.142] lstrlenW (lpString=".xls") returned 4
	[0078.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.142] lstrlenW (lpString=".xlsx") returned 5
	[0078.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.143] lstrlenW (lpString=".ppt") returned 4
	[0078.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.143] lstrlenW (lpString=".zip") returned 4
	[0078.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.143] lstrlenW (lpString=".rar") returned 4
	[0078.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.143] lstrlenW (lpString=".bz2") returned 4
	[0078.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.143] lstrlenW (lpString=".7z") returned 3
	[0078.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.143] lstrlenW (lpString=".dbf") returned 4
	[0078.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.143] lstrlenW (lpString=".1cd") returned 4
	[0078.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.144] lstrlenW (lpString=".jpg") returned 4
	[0078.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.144] lstrlenW (lpString=".doc") returned 4
	[0078.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.144] lstrlenW (lpString=".docx") returned 5
	[0078.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.144] lstrlenW (lpString=".pdf") returned 4
	[0078.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.145] lstrlenW (lpString=".xls") returned 4
	[0078.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.145] lstrlenW (lpString=".xlsx") returned 5
	[0078.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.145] lstrlenW (lpString=".ppt") returned 4
	[0078.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.145] lstrlenW (lpString=".zip") returned 4
	[0078.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.145] lstrlenW (lpString=".rar") returned 4
	[0078.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.145] lstrlenW (lpString=".bz2") returned 4
	[0078.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.145] lstrlenW (lpString=".7z") returned 3
	[0078.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.145] lstrlenW (lpString=".dbf") returned 4
	[0078.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.146] lstrlenW (lpString=".1cd") returned 4
	[0078.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0078.146] lstrlenW (lpString=".jpg") returned 4
	[0078.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.146] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.146] lstrlenW (lpString="FD00090_.WMF") returned 12
	[0078.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.147] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=14194) returned 1
	[0078.147] CloseHandle (hObject=0x344) returned 1
	[0078.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220
	[0078.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0078.147] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.147] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.148] GetLastError () returned 0x0
	[0078.148] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x3772, lpOverlapped=0x0) returned 1
	[0078.149] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3780, lpOverlapped=0x0) returned 1
	[0078.153] ReadFile (in: hFile=0x344, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.153] WriteFile (in: hFile=0x390, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.153] SetEndOfFile (hFile=0x390) returned 1
	[0078.153] CloseHandle (hObject=0x390) returned 1
	[0078.153] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.153] SetEndOfFile (hFile=0x344) returned 1
	[0078.154] CloseHandle (hObject=0x344) returned 1
	[0078.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1
	[0078.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.155] lstrlenW (lpString=".doc") returned 4
	[0078.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.155] lstrlenW (lpString=".docx") returned 5
	[0078.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.155] lstrlenW (lpString=".pdf") returned 4
	[0078.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.155] lstrlenW (lpString=".xls") returned 4
	[0078.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.155] lstrlenW (lpString=".xlsx") returned 5
	[0078.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.155] lstrlenW (lpString=".ppt") returned 4
	[0078.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.155] lstrlenW (lpString=".zip") returned 4
	[0078.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.155] lstrlenW (lpString=".rar") returned 4
	[0078.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.155] lstrlenW (lpString=".bz2") returned 4
	[0078.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.155] lstrlenW (lpString=".7z") returned 3
	[0078.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.156] lstrlenW (lpString=".dbf") returned 4
	[0078.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.156] lstrlenW (lpString=".1cd") returned 4
	[0078.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.156] lstrlenW (lpString=".jpg") returned 4
	[0078.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.156] lstrlenW (lpString=".doc") returned 4
	[0078.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.156] lstrlenW (lpString=".docx") returned 5
	[0078.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.156] lstrlenW (lpString=".pdf") returned 4
	[0078.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.156] lstrlenW (lpString=".xls") returned 4
	[0078.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.156] lstrlenW (lpString=".xlsx") returned 5
	[0078.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.157] lstrlenW (lpString=".ppt") returned 4
	[0078.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.157] lstrlenW (lpString=".zip") returned 4
	[0078.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.157] lstrlenW (lpString=".rar") returned 4
	[0078.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.157] lstrlenW (lpString=".bz2") returned 4
	[0078.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.157] lstrlenW (lpString=".7z") returned 3
	[0078.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.157] lstrlenW (lpString=".dbf") returned 4
	[0078.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.157] lstrlenW (lpString=".1cd") returned 4
	[0078.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0078.157] lstrlenW (lpString=".jpg") returned 4
	[0078.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.158] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.158] lstrlenW (lpString="FD00096_.WMF") returned 12
	[0078.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.159] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=37390) returned 1
	[0078.159] CloseHandle (hObject=0x390) returned 1
	[0078.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220
	[0078.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.159] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.159] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.160] GetLastError () returned 0x0
	[0078.160] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x920e, lpOverlapped=0x0) returned 1
	[0078.162] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x9210, lpOverlapped=0x0) returned 1
	[0078.166] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.166] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.167] SetEndOfFile (hFile=0x368) returned 1
	[0078.167] CloseHandle (hObject=0x368) returned 1
	[0078.167] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.167] SetEndOfFile (hFile=0x390) returned 1
	[0078.168] CloseHandle (hObject=0x390) returned 1
	[0078.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1
	[0078.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.168] lstrlenW (lpString=".doc") returned 4
	[0078.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.169] lstrlenW (lpString=".docx") returned 5
	[0078.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.169] lstrlenW (lpString=".pdf") returned 4
	[0078.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.169] lstrlenW (lpString=".xls") returned 4
	[0078.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.169] lstrlenW (lpString=".xlsx") returned 5
	[0078.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.169] lstrlenW (lpString=".ppt") returned 4
	[0078.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.169] lstrlenW (lpString=".zip") returned 4
	[0078.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.169] lstrlenW (lpString=".rar") returned 4
	[0078.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.169] lstrlenW (lpString=".bz2") returned 4
	[0078.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.169] lstrlenW (lpString=".7z") returned 3
	[0078.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.169] lstrlenW (lpString=".dbf") returned 4
	[0078.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.169] lstrlenW (lpString=".1cd") returned 4
	[0078.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.170] lstrlenW (lpString=".jpg") returned 4
	[0078.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.170] lstrlenW (lpString=".doc") returned 4
	[0078.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.170] lstrlenW (lpString=".docx") returned 5
	[0078.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.170] lstrlenW (lpString=".pdf") returned 4
	[0078.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.170] lstrlenW (lpString=".xls") returned 4
	[0078.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.170] lstrlenW (lpString=".xlsx") returned 5
	[0078.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.170] lstrlenW (lpString=".ppt") returned 4
	[0078.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.170] lstrlenW (lpString=".zip") returned 4
	[0078.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.170] lstrlenW (lpString=".rar") returned 4
	[0078.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.170] lstrlenW (lpString=".bz2") returned 4
	[0078.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.171] lstrlenW (lpString=".7z") returned 3
	[0078.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.171] lstrlenW (lpString=".dbf") returned 4
	[0078.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.171] lstrlenW (lpString=".1cd") returned 4
	[0078.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0078.171] lstrlenW (lpString=".jpg") returned 4
	[0078.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.171] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.171] lstrlenW (lpString="FD00296_.WMF") returned 12
	[0078.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.172] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=15856) returned 1
	[0078.172] CloseHandle (hObject=0x390) returned 1
	[0078.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220
	[0078.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.172] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.172] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.173] GetLastError () returned 0x0
	[0078.173] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x3df0, lpOverlapped=0x0) returned 1
	[0078.476] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3e00, lpOverlapped=0x0) returned 1
	[0078.477] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.477] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.477] SetEndOfFile (hFile=0x368) returned 1
	[0078.477] CloseHandle (hObject=0x368) returned 1
	[0078.477] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.477] SetEndOfFile (hFile=0x390) returned 1
	[0078.478] CloseHandle (hObject=0x390) returned 1
	[0078.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1
	[0078.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.479] lstrlenW (lpString=".doc") returned 4
	[0078.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.479] lstrlenW (lpString=".docx") returned 5
	[0078.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.479] lstrlenW (lpString=".pdf") returned 4
	[0078.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.479] lstrlenW (lpString=".xls") returned 4
	[0078.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.479] lstrlenW (lpString=".xlsx") returned 5
	[0078.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.479] lstrlenW (lpString=".ppt") returned 4
	[0078.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.479] lstrlenW (lpString=".zip") returned 4
	[0078.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.479] lstrlenW (lpString=".rar") returned 4
	[0078.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.479] lstrlenW (lpString=".bz2") returned 4
	[0078.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.480] lstrlenW (lpString=".7z") returned 3
	[0078.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.480] lstrlenW (lpString=".dbf") returned 4
	[0078.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.480] lstrlenW (lpString=".1cd") returned 4
	[0078.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.480] lstrlenW (lpString=".jpg") returned 4
	[0078.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.480] lstrlenW (lpString=".doc") returned 4
	[0078.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.480] lstrlenW (lpString=".docx") returned 5
	[0078.480] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.480] lstrlenW (lpString=".pdf") returned 4
	[0078.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.480] lstrlenW (lpString=".xls") returned 4
	[0078.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.480] lstrlenW (lpString=".xlsx") returned 5
	[0078.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.480] lstrlenW (lpString=".ppt") returned 4
	[0078.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.480] lstrlenW (lpString=".zip") returned 4
	[0078.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.480] lstrlenW (lpString=".rar") returned 4
	[0078.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.481] lstrlenW (lpString=".bz2") returned 4
	[0078.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.481] lstrlenW (lpString=".7z") returned 3
	[0078.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.481] lstrlenW (lpString=".dbf") returned 4
	[0078.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.481] lstrlenW (lpString=".1cd") returned 4
	[0078.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0078.481] lstrlenW (lpString=".jpg") returned 4
	[0078.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.481] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.481] lstrlenW (lpString="FD00428_.WMF") returned 12
	[0078.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.482] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4796) returned 1
	[0078.482] CloseHandle (hObject=0x390) returned 1
	[0078.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220
	[0078.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.482] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.482] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.483] GetLastError () returned 0x0
	[0078.483] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x12bc, lpOverlapped=0x0) returned 1
	[0078.484] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0078.485] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.485] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.485] SetEndOfFile (hFile=0x368) returned 1
	[0078.486] CloseHandle (hObject=0x368) returned 1
	[0078.486] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.486] SetEndOfFile (hFile=0x390) returned 1
	[0078.486] CloseHandle (hObject=0x390) returned 1
	[0078.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1
	[0078.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.487] lstrlenW (lpString=".doc") returned 4
	[0078.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.487] lstrlenW (lpString=".docx") returned 5
	[0078.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.487] lstrlenW (lpString=".pdf") returned 4
	[0078.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.487] lstrlenW (lpString=".xls") returned 4
	[0078.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.487] lstrlenW (lpString=".xlsx") returned 5
	[0078.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.487] lstrlenW (lpString=".ppt") returned 4
	[0078.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.487] lstrlenW (lpString=".zip") returned 4
	[0078.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.487] lstrlenW (lpString=".rar") returned 4
	[0078.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.488] lstrlenW (lpString=".bz2") returned 4
	[0078.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.488] lstrlenW (lpString=".7z") returned 3
	[0078.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.488] lstrlenW (lpString=".dbf") returned 4
	[0078.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.488] lstrlenW (lpString=".1cd") returned 4
	[0078.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.488] lstrlenW (lpString=".jpg") returned 4
	[0078.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.488] lstrlenW (lpString=".doc") returned 4
	[0078.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.488] lstrlenW (lpString=".docx") returned 5
	[0078.488] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.488] lstrlenW (lpString=".pdf") returned 4
	[0078.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.489] lstrlenW (lpString=".xls") returned 4
	[0078.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.489] lstrlenW (lpString=".xlsx") returned 5
	[0078.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.489] lstrlenW (lpString=".ppt") returned 4
	[0078.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.489] lstrlenW (lpString=".zip") returned 4
	[0078.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.489] lstrlenW (lpString=".rar") returned 4
	[0078.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.489] lstrlenW (lpString=".bz2") returned 4
	[0078.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.489] lstrlenW (lpString=".7z") returned 3
	[0078.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.489] lstrlenW (lpString=".dbf") returned 4
	[0078.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.489] lstrlenW (lpString=".1cd") returned 4
	[0078.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0078.490] lstrlenW (lpString=".jpg") returned 4
	[0078.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.490] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.490] lstrlenW (lpString="FD00435_.WMF") returned 12
	[0078.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.490] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=2108) returned 1
	[0078.490] CloseHandle (hObject=0x390) returned 1
	[0078.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220
	[0078.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.491] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.491] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.491] GetLastError () returned 0x0
	[0078.491] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x83c, lpOverlapped=0x0) returned 1
	[0078.493] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x840, lpOverlapped=0x0) returned 1
	[0078.494] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.494] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.494] SetEndOfFile (hFile=0x368) returned 1
	[0078.494] CloseHandle (hObject=0x368) returned 1
	[0078.494] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.494] SetEndOfFile (hFile=0x390) returned 1
	[0078.495] CloseHandle (hObject=0x390) returned 1
	[0078.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1
	[0078.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.495] lstrlenW (lpString=".doc") returned 4
	[0078.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.496] lstrlenW (lpString=".docx") returned 5
	[0078.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.496] lstrlenW (lpString=".pdf") returned 4
	[0078.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.496] lstrlenW (lpString=".xls") returned 4
	[0078.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.496] lstrlenW (lpString=".xlsx") returned 5
	[0078.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.496] lstrlenW (lpString=".ppt") returned 4
	[0078.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.496] lstrlenW (lpString=".zip") returned 4
	[0078.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.496] lstrlenW (lpString=".rar") returned 4
	[0078.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.496] lstrlenW (lpString=".bz2") returned 4
	[0078.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.496] lstrlenW (lpString=".7z") returned 3
	[0078.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.496] lstrlenW (lpString=".dbf") returned 4
	[0078.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.496] lstrlenW (lpString=".1cd") returned 4
	[0078.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.496] lstrlenW (lpString=".jpg") returned 4
	[0078.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.497] lstrlenW (lpString=".doc") returned 4
	[0078.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.497] lstrlenW (lpString=".docx") returned 5
	[0078.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.497] lstrlenW (lpString=".pdf") returned 4
	[0078.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.497] lstrlenW (lpString=".xls") returned 4
	[0078.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.497] lstrlenW (lpString=".xlsx") returned 5
	[0078.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.497] lstrlenW (lpString=".ppt") returned 4
	[0078.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.497] lstrlenW (lpString=".zip") returned 4
	[0078.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.497] lstrlenW (lpString=".rar") returned 4
	[0078.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.497] lstrlenW (lpString=".bz2") returned 4
	[0078.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.497] lstrlenW (lpString=".7z") returned 3
	[0078.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.497] lstrlenW (lpString=".dbf") returned 4
	[0078.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.497] lstrlenW (lpString=".1cd") returned 4
	[0078.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0078.498] lstrlenW (lpString=".jpg") returned 4
	[0078.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.498] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.498] lstrlenW (lpString="FD00438_.WMF") returned 12
	[0078.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.498] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=5098) returned 1
	[0078.498] CloseHandle (hObject=0x390) returned 1
	[0078.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220
	[0078.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.499] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.499] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.499] GetLastError () returned 0x0
	[0078.499] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x13ea, lpOverlapped=0x0) returned 1
	[0078.500] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x13f0, lpOverlapped=0x0) returned 1
	[0078.501] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.502] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.502] SetEndOfFile (hFile=0x368) returned 1
	[0078.502] CloseHandle (hObject=0x368) returned 1
	[0078.502] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.502] SetEndOfFile (hFile=0x390) returned 1
	[0078.503] CloseHandle (hObject=0x390) returned 1
	[0078.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0078.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1
	[0078.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.503] lstrlenW (lpString=".doc") returned 4
	[0078.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.503] lstrlenW (lpString=".docx") returned 5
	[0078.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.503] lstrlenW (lpString=".pdf") returned 4
	[0078.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.504] lstrlenW (lpString=".xls") returned 4
	[0078.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.504] lstrlenW (lpString=".xlsx") returned 5
	[0078.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.504] lstrlenW (lpString=".ppt") returned 4
	[0078.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.504] lstrlenW (lpString=".zip") returned 4
	[0078.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.504] lstrlenW (lpString=".rar") returned 4
	[0078.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.504] lstrlenW (lpString=".bz2") returned 4
	[0078.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.504] lstrlenW (lpString=".7z") returned 3
	[0078.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.504] lstrlenW (lpString=".dbf") returned 4
	[0078.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.504] lstrlenW (lpString=".1cd") returned 4
	[0078.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.504] lstrlenW (lpString=".jpg") returned 4
	[0078.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.505] lstrlenW (lpString=".doc") returned 4
	[0078.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0078.505] lstrlenW (lpString=".docx") returned 5
	[0078.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0078.505] lstrlenW (lpString=".pdf") returned 4
	[0078.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0078.505] lstrlenW (lpString=".xls") returned 4
	[0078.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0078.505] lstrlenW (lpString=".xlsx") returned 5
	[0078.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0078.505] lstrlenW (lpString=".ppt") returned 4
	[0078.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0078.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.505] lstrlenW (lpString=".zip") returned 4
	[0078.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0078.505] lstrlenW (lpString=".rar") returned 4
	[0078.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0078.505] lstrlenW (lpString=".bz2") returned 4
	[0078.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0078.505] lstrlenW (lpString=".7z") returned 3
	[0078.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0078.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.505] lstrlenW (lpString=".dbf") returned 4
	[0078.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0078.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.505] lstrlenW (lpString=".1cd") returned 4
	[0078.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0078.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0078.506] lstrlenW (lpString=".jpg") returned 4
	[0078.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0078.506] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0078.506] lstrlenW (lpString="FD00455_.WMF") returned 12
	[0078.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.507] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=8926) returned 1
	[0078.507] CloseHandle (hObject=0x390) returned 1
	[0078.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220
	[0078.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.507] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.507] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0078.507] GetLastError () returned 0x0
	[0078.508] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x22de, lpOverlapped=0x0) returned 1
	[0078.970] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x22e0, lpOverlapped=0x0) returned 1
	[0078.974] ReadFile (in: hFile=0x390, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.974] WriteFile (in: hFile=0x368, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.974] SetEndOfFile (hFile=0x368) returned 1
	[0080.144] CloseHandle (hObject=0x368) returned 1
	[0080.153] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.168] SetEndOfFile (hFile=0x390) returned 1
	[0080.169] CloseHandle (hObject=0x390) returned 1
	[0080.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0080.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1
	[0080.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.596] lstrlenW (lpString=".doc") returned 4
	[0080.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.596] lstrlenW (lpString=".docx") returned 5
	[0080.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.596] lstrlenW (lpString=".pdf") returned 4
	[0080.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.596] lstrlenW (lpString=".xls") returned 4
	[0080.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.596] lstrlenW (lpString=".xlsx") returned 5
	[0080.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.596] lstrlenW (lpString=".ppt") returned 4
	[0080.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.596] lstrlenW (lpString=".zip") returned 4
	[0080.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.596] lstrlenW (lpString=".rar") returned 4
	[0080.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.596] lstrlenW (lpString=".bz2") returned 4
	[0080.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.597] lstrlenW (lpString=".7z") returned 3
	[0080.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.597] lstrlenW (lpString=".dbf") returned 4
	[0080.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.597] lstrlenW (lpString=".1cd") returned 4
	[0080.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.597] lstrlenW (lpString=".jpg") returned 4
	[0080.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.597] lstrlenW (lpString=".doc") returned 4
	[0080.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0080.597] lstrlenW (lpString=".docx") returned 5
	[0080.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0080.597] lstrlenW (lpString=".pdf") returned 4
	[0080.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0080.597] lstrlenW (lpString=".xls") returned 4
	[0080.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0080.597] lstrlenW (lpString=".xlsx") returned 5
	[0080.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0080.597] lstrlenW (lpString=".ppt") returned 4
	[0080.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0080.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.598] lstrlenW (lpString=".zip") returned 4
	[0080.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0080.603] lstrlenW (lpString=".rar") returned 4
	[0080.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0080.603] lstrlenW (lpString=".bz2") returned 4
	[0080.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0080.603] lstrlenW (lpString=".7z") returned 3
	[0080.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0080.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.603] lstrlenW (lpString=".dbf") returned 4
	[0080.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0080.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.603] lstrlenW (lpString=".1cd") returned 4
	[0080.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0080.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0080.603] lstrlenW (lpString=".jpg") returned 4
	[0080.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0080.603] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0080.604] lstrlenW (lpString="FD01657_.WMF") returned 12
	[0080.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.335] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=30414) returned 1
	[0081.335] CloseHandle (hObject=0x374) returned 1
	[0081.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220
	[0081.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.459] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.459] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0081.708] GetLastError () returned 0x0
	[0081.708] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x76ce, lpOverlapped=0x0) returned 1
	[0081.709] WriteFile (in: hFile=0x384, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x76d0, lpOverlapped=0x0) returned 1
	[0081.717] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.717] WriteFile (in: hFile=0x384, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.717] SetEndOfFile (hFile=0x384) returned 1
	[0081.717] CloseHandle (hObject=0x384) returned 1
	[0081.717] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.717] SetEndOfFile (hFile=0x398) returned 1
	[0081.718] CloseHandle (hObject=0x398) returned 1
	[0081.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1
	[0081.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.719] lstrlenW (lpString=".doc") returned 4
	[0081.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.719] lstrlenW (lpString=".docx") returned 5
	[0081.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.719] lstrlenW (lpString=".pdf") returned 4
	[0081.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.719] lstrlenW (lpString=".xls") returned 4
	[0081.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.719] lstrlenW (lpString=".xlsx") returned 5
	[0081.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.719] lstrlenW (lpString=".ppt") returned 4
	[0081.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.719] lstrlenW (lpString=".zip") returned 4
	[0081.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.719] lstrlenW (lpString=".rar") returned 4
	[0081.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.719] lstrlenW (lpString=".bz2") returned 4
	[0081.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.719] lstrlenW (lpString=".7z") returned 3
	[0081.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.720] lstrlenW (lpString=".dbf") returned 4
	[0081.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.720] lstrlenW (lpString=".1cd") returned 4
	[0081.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.720] lstrlenW (lpString=".jpg") returned 4
	[0081.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.720] lstrlenW (lpString=".doc") returned 4
	[0081.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.720] lstrlenW (lpString=".docx") returned 5
	[0081.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.720] lstrlenW (lpString=".pdf") returned 4
	[0081.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.720] lstrlenW (lpString=".xls") returned 4
	[0081.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.720] lstrlenW (lpString=".xlsx") returned 5
	[0081.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.720] lstrlenW (lpString=".ppt") returned 4
	[0081.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.720] lstrlenW (lpString=".zip") returned 4
	[0081.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.721] lstrlenW (lpString=".rar") returned 4
	[0081.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.721] lstrlenW (lpString=".bz2") returned 4
	[0081.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.721] lstrlenW (lpString=".7z") returned 3
	[0081.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.721] lstrlenW (lpString=".dbf") returned 4
	[0081.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.721] lstrlenW (lpString=".1cd") returned 4
	[0081.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0081.721] lstrlenW (lpString=".jpg") returned 4
	[0081.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.721] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.721] lstrlenW (lpString="FD02161_.WMF") returned 12
	[0081.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.722] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3128) returned 1
	[0081.722] CloseHandle (hObject=0x398) returned 1
	[0081.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220
	[0081.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.722] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.722] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0081.722] GetLastError () returned 0x0
	[0081.722] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xc38, lpOverlapped=0x0) returned 1
	[0081.807] WriteFile (in: hFile=0x384, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xc40, lpOverlapped=0x0) returned 1
	[0081.808] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.808] WriteFile (in: hFile=0x384, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.808] SetEndOfFile (hFile=0x384) returned 1
	[0081.808] CloseHandle (hObject=0x384) returned 1
	[0081.809] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.809] SetEndOfFile (hFile=0x398) returned 1
	[0081.809] CloseHandle (hObject=0x398) returned 1
	[0081.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1
	[0081.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.810] lstrlenW (lpString=".doc") returned 4
	[0081.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.810] lstrlenW (lpString=".docx") returned 5
	[0081.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.810] lstrlenW (lpString=".pdf") returned 4
	[0081.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.810] lstrlenW (lpString=".xls") returned 4
	[0081.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.810] lstrlenW (lpString=".xlsx") returned 5
	[0081.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.810] lstrlenW (lpString=".ppt") returned 4
	[0081.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.811] lstrlenW (lpString=".zip") returned 4
	[0081.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.811] lstrlenW (lpString=".rar") returned 4
	[0081.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.811] lstrlenW (lpString=".bz2") returned 4
	[0081.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.811] lstrlenW (lpString=".7z") returned 3
	[0081.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.811] lstrlenW (lpString=".dbf") returned 4
	[0081.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.811] lstrlenW (lpString=".1cd") returned 4
	[0081.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.811] lstrlenW (lpString=".jpg") returned 4
	[0081.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.811] lstrlenW (lpString=".doc") returned 4
	[0081.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.811] lstrlenW (lpString=".docx") returned 5
	[0081.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.811] lstrlenW (lpString=".pdf") returned 4
	[0081.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.811] lstrlenW (lpString=".xls") returned 4
	[0081.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.811] lstrlenW (lpString=".xlsx") returned 5
	[0081.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.812] lstrlenW (lpString=".ppt") returned 4
	[0081.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.812] lstrlenW (lpString=".zip") returned 4
	[0081.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.812] lstrlenW (lpString=".rar") returned 4
	[0081.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.812] lstrlenW (lpString=".bz2") returned 4
	[0081.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.812] lstrlenW (lpString=".7z") returned 3
	[0081.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.812] lstrlenW (lpString=".dbf") returned 4
	[0081.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.812] lstrlenW (lpString=".1cd") returned 4
	[0081.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0081.812] lstrlenW (lpString=".jpg") returned 4
	[0081.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.812] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.812] lstrlenW (lpString="HH00057_.WMF") returned 12
	[0081.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0081.814] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3764) returned 1
	[0081.814] CloseHandle (hObject=0x384) returned 1
	[0081.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220
	[0081.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0081.816] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.816] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0081.816] GetLastError () returned 0x0
	[0081.816] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xeb4, lpOverlapped=0x0) returned 1
	[0081.825] WriteFile (in: hFile=0x354, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec0, lpOverlapped=0x0) returned 1
	[0081.826] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.826] WriteFile (in: hFile=0x354, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.826] SetEndOfFile (hFile=0x354) returned 1
	[0081.826] CloseHandle (hObject=0x354) returned 1
	[0081.826] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.827] SetEndOfFile (hFile=0x37c) returned 1
	[0081.827] CloseHandle (hObject=0x37c) returned 1
	[0081.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1
	[0081.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.828] lstrlenW (lpString=".doc") returned 4
	[0081.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.828] lstrlenW (lpString=".docx") returned 5
	[0081.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.828] lstrlenW (lpString=".pdf") returned 4
	[0081.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.828] lstrlenW (lpString=".xls") returned 4
	[0081.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.828] lstrlenW (lpString=".xlsx") returned 5
	[0081.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.828] lstrlenW (lpString=".ppt") returned 4
	[0081.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.828] lstrlenW (lpString=".zip") returned 4
	[0081.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.828] lstrlenW (lpString=".rar") returned 4
	[0081.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.828] lstrlenW (lpString=".bz2") returned 4
	[0081.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.829] lstrlenW (lpString=".7z") returned 3
	[0081.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.829] lstrlenW (lpString=".dbf") returned 4
	[0081.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.829] lstrlenW (lpString=".1cd") returned 4
	[0081.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.829] lstrlenW (lpString=".jpg") returned 4
	[0081.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.829] lstrlenW (lpString=".doc") returned 4
	[0081.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.829] lstrlenW (lpString=".docx") returned 5
	[0081.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.829] lstrlenW (lpString=".pdf") returned 4
	[0081.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.829] lstrlenW (lpString=".xls") returned 4
	[0081.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.829] lstrlenW (lpString=".xlsx") returned 5
	[0081.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.829] lstrlenW (lpString=".ppt") returned 4
	[0081.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.830] lstrlenW (lpString=".zip") returned 4
	[0081.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.830] lstrlenW (lpString=".rar") returned 4
	[0081.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.830] lstrlenW (lpString=".bz2") returned 4
	[0081.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.830] lstrlenW (lpString=".7z") returned 3
	[0081.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.830] lstrlenW (lpString=".dbf") returned 4
	[0081.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.830] lstrlenW (lpString=".1cd") returned 4
	[0081.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0081.830] lstrlenW (lpString=".jpg") returned 4
	[0081.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.830] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.830] lstrlenW (lpString="HH00231_.WMF") returned 12
	[0081.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.837] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=2232) returned 1
	[0081.837] CloseHandle (hObject=0x398) returned 1
	[0081.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220
	[0081.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.837] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.837] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0081.838] GetLastError () returned 0x0
	[0081.838] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x8b8, lpOverlapped=0x0) returned 1
	[0081.840] WriteFile (in: hFile=0x384, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0081.840] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.841] WriteFile (in: hFile=0x384, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.841] SetEndOfFile (hFile=0x384) returned 1
	[0081.841] CloseHandle (hObject=0x384) returned 1
	[0081.841] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.841] SetEndOfFile (hFile=0x398) returned 1
	[0081.842] CloseHandle (hObject=0x398) returned 1
	[0081.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0081.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1
	[0081.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.842] lstrlenW (lpString=".doc") returned 4
	[0081.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.842] lstrlenW (lpString=".docx") returned 5
	[0081.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.842] lstrlenW (lpString=".pdf") returned 4
	[0081.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.843] lstrlenW (lpString=".xls") returned 4
	[0081.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.843] lstrlenW (lpString=".xlsx") returned 5
	[0081.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.843] lstrlenW (lpString=".ppt") returned 4
	[0081.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.843] lstrlenW (lpString=".zip") returned 4
	[0081.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.843] lstrlenW (lpString=".rar") returned 4
	[0081.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.843] lstrlenW (lpString=".bz2") returned 4
	[0081.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.843] lstrlenW (lpString=".7z") returned 3
	[0081.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.843] lstrlenW (lpString=".dbf") returned 4
	[0081.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.843] lstrlenW (lpString=".1cd") returned 4
	[0081.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.843] lstrlenW (lpString=".jpg") returned 4
	[0081.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.843] lstrlenW (lpString=".doc") returned 4
	[0081.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0081.844] lstrlenW (lpString=".docx") returned 5
	[0081.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0081.844] lstrlenW (lpString=".pdf") returned 4
	[0081.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0081.844] lstrlenW (lpString=".xls") returned 4
	[0081.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0081.844] lstrlenW (lpString=".xlsx") returned 5
	[0081.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0081.844] lstrlenW (lpString=".ppt") returned 4
	[0081.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0081.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.844] lstrlenW (lpString=".zip") returned 4
	[0081.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0081.844] lstrlenW (lpString=".rar") returned 4
	[0081.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0081.844] lstrlenW (lpString=".bz2") returned 4
	[0081.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0081.844] lstrlenW (lpString=".7z") returned 3
	[0081.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0081.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.844] lstrlenW (lpString=".dbf") returned 4
	[0081.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0081.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.844] lstrlenW (lpString=".1cd") returned 4
	[0081.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0081.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0081.844] lstrlenW (lpString=".jpg") returned 4
	[0081.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0081.845] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0081.845] lstrlenW (lpString="HH00236_.WMF") returned 12
	[0081.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.845] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3286) returned 1
	[0081.845] CloseHandle (hObject=0x398) returned 1
	[0081.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220
	[0081.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0081.845] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.845] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0081.846] GetLastError () returned 0x0
	[0081.846] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xcd6, lpOverlapped=0x0) returned 1
	[0082.239] WriteFile (in: hFile=0x384, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xce0, lpOverlapped=0x0) returned 1
	[0082.240] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.240] WriteFile (in: hFile=0x384, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0082.240] SetEndOfFile (hFile=0x384) returned 1
	[0082.680] CloseHandle (hObject=0x384) returned 1
	[0083.285] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.285] SetEndOfFile (hFile=0x398) returned 1
	[0083.348] CloseHandle (hObject=0x398) returned 1
	[0083.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1
	[0083.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.357] lstrlenW (lpString=".doc") returned 4
	[0083.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.357] lstrlenW (lpString=".docx") returned 5
	[0083.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.357] lstrlenW (lpString=".pdf") returned 4
	[0083.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.357] lstrlenW (lpString=".xls") returned 4
	[0083.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.357] lstrlenW (lpString=".xlsx") returned 5
	[0083.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.357] lstrlenW (lpString=".ppt") returned 4
	[0083.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.357] lstrlenW (lpString=".zip") returned 4
	[0083.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.357] lstrlenW (lpString=".rar") returned 4
	[0083.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.357] lstrlenW (lpString=".bz2") returned 4
	[0083.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.357] lstrlenW (lpString=".7z") returned 3
	[0083.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.358] lstrlenW (lpString=".dbf") returned 4
	[0083.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.358] lstrlenW (lpString=".1cd") returned 4
	[0083.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.358] lstrlenW (lpString=".jpg") returned 4
	[0083.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.358] lstrlenW (lpString=".doc") returned 4
	[0083.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.358] lstrlenW (lpString=".docx") returned 5
	[0083.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.358] lstrlenW (lpString=".pdf") returned 4
	[0083.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.358] lstrlenW (lpString=".xls") returned 4
	[0083.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.358] lstrlenW (lpString=".xlsx") returned 5
	[0083.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.358] lstrlenW (lpString=".ppt") returned 4
	[0083.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.358] lstrlenW (lpString=".zip") returned 4
	[0083.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.358] lstrlenW (lpString=".rar") returned 4
	[0083.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.358] lstrlenW (lpString=".bz2") returned 4
	[0083.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.359] lstrlenW (lpString=".7z") returned 3
	[0083.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.359] lstrlenW (lpString=".dbf") returned 4
	[0083.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.359] lstrlenW (lpString=".1cd") returned 4
	[0083.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0083.359] lstrlenW (lpString=".jpg") returned 4
	[0083.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.359] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.359] lstrlenW (lpString="HH00693_.WMF") returned 12
	[0083.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.359] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=7098) returned 1
	[0083.359] CloseHandle (hObject=0x398) returned 1
	[0083.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220
	[0083.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.360] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.360] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0083.360] GetLastError () returned 0x0
	[0083.360] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1bba, lpOverlapped=0x0) returned 1
	[0083.362] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1bc0, lpOverlapped=0x0) returned 1
	[0083.363] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.363] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.363] SetEndOfFile (hFile=0x33c) returned 1
	[0083.363] CloseHandle (hObject=0x33c) returned 1
	[0083.363] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.363] SetEndOfFile (hFile=0x398) returned 1
	[0083.365] CloseHandle (hObject=0x398) returned 1
	[0083.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1
	[0083.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.365] lstrlenW (lpString=".doc") returned 4
	[0083.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.365] lstrlenW (lpString=".docx") returned 5
	[0083.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.365] lstrlenW (lpString=".pdf") returned 4
	[0083.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.365] lstrlenW (lpString=".xls") returned 4
	[0083.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.365] lstrlenW (lpString=".xlsx") returned 5
	[0083.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.366] lstrlenW (lpString=".ppt") returned 4
	[0083.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.366] lstrlenW (lpString=".zip") returned 4
	[0083.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.366] lstrlenW (lpString=".rar") returned 4
	[0083.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.366] lstrlenW (lpString=".bz2") returned 4
	[0083.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.366] lstrlenW (lpString=".7z") returned 3
	[0083.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.366] lstrlenW (lpString=".dbf") returned 4
	[0083.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.366] lstrlenW (lpString=".1cd") returned 4
	[0083.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.366] lstrlenW (lpString=".jpg") returned 4
	[0083.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.366] lstrlenW (lpString=".doc") returned 4
	[0083.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.366] lstrlenW (lpString=".docx") returned 5
	[0083.366] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.367] lstrlenW (lpString=".pdf") returned 4
	[0083.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.367] lstrlenW (lpString=".xls") returned 4
	[0083.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.367] lstrlenW (lpString=".xlsx") returned 5
	[0083.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.367] lstrlenW (lpString=".ppt") returned 4
	[0083.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.367] lstrlenW (lpString=".zip") returned 4
	[0083.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.367] lstrlenW (lpString=".rar") returned 4
	[0083.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.367] lstrlenW (lpString=".bz2") returned 4
	[0083.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.367] lstrlenW (lpString=".7z") returned 3
	[0083.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.367] lstrlenW (lpString=".dbf") returned 4
	[0083.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.367] lstrlenW (lpString=".1cd") returned 4
	[0083.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0083.367] lstrlenW (lpString=".jpg") returned 4
	[0083.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.368] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.368] lstrlenW (lpString="HH01013_.WMF") returned 12
	[0083.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.369] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=2848) returned 1
	[0083.369] CloseHandle (hObject=0x398) returned 1
	[0083.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220
	[0083.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.369] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.369] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0083.369] GetLastError () returned 0x0
	[0083.369] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xb20, lpOverlapped=0x0) returned 1
	[0083.371] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xb30, lpOverlapped=0x0) returned 1
	[0083.372] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.372] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.372] SetEndOfFile (hFile=0x33c) returned 1
	[0083.372] CloseHandle (hObject=0x33c) returned 1
	[0083.372] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.372] SetEndOfFile (hFile=0x398) returned 1
	[0083.373] CloseHandle (hObject=0x398) returned 1
	[0083.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1
	[0083.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.374] lstrlenW (lpString=".doc") returned 4
	[0083.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.374] lstrlenW (lpString=".docx") returned 5
	[0083.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.374] lstrlenW (lpString=".pdf") returned 4
	[0083.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.374] lstrlenW (lpString=".xls") returned 4
	[0083.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.374] lstrlenW (lpString=".xlsx") returned 5
	[0083.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.374] lstrlenW (lpString=".ppt") returned 4
	[0083.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.374] lstrlenW (lpString=".zip") returned 4
	[0083.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.374] lstrlenW (lpString=".rar") returned 4
	[0083.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.374] lstrlenW (lpString=".bz2") returned 4
	[0083.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.374] lstrlenW (lpString=".7z") returned 3
	[0083.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.375] lstrlenW (lpString=".dbf") returned 4
	[0083.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.375] lstrlenW (lpString=".1cd") returned 4
	[0083.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.375] lstrlenW (lpString=".jpg") returned 4
	[0083.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.375] lstrlenW (lpString=".doc") returned 4
	[0083.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.375] lstrlenW (lpString=".docx") returned 5
	[0083.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.375] lstrlenW (lpString=".pdf") returned 4
	[0083.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.375] lstrlenW (lpString=".xls") returned 4
	[0083.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.375] lstrlenW (lpString=".xlsx") returned 5
	[0083.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.375] lstrlenW (lpString=".ppt") returned 4
	[0083.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.375] lstrlenW (lpString=".zip") returned 4
	[0083.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.375] lstrlenW (lpString=".rar") returned 4
	[0083.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.376] lstrlenW (lpString=".bz2") returned 4
	[0083.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.376] lstrlenW (lpString=".7z") returned 3
	[0083.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.376] lstrlenW (lpString=".dbf") returned 4
	[0083.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.376] lstrlenW (lpString=".1cd") returned 4
	[0083.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0083.376] lstrlenW (lpString=".jpg") returned 4
	[0083.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.376] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.376] lstrlenW (lpString="HH01015_.WMF") returned 12
	[0083.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.376] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1148) returned 1
	[0083.377] CloseHandle (hObject=0x398) returned 1
	[0083.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220
	[0083.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.377] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.377] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0083.377] GetLastError () returned 0x0
	[0083.377] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x47c, lpOverlapped=0x0) returned 1
	[0083.379] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x480, lpOverlapped=0x0) returned 1
	[0083.380] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.380] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.380] SetEndOfFile (hFile=0x33c) returned 1
	[0083.380] CloseHandle (hObject=0x33c) returned 1
	[0083.380] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.380] SetEndOfFile (hFile=0x398) returned 1
	[0083.381] CloseHandle (hObject=0x398) returned 1
	[0083.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1
	[0083.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.381] lstrlenW (lpString=".doc") returned 4
	[0083.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.381] lstrlenW (lpString=".docx") returned 5
	[0083.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.382] lstrlenW (lpString=".pdf") returned 4
	[0083.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.382] lstrlenW (lpString=".xls") returned 4
	[0083.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.382] lstrlenW (lpString=".xlsx") returned 5
	[0083.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.382] lstrlenW (lpString=".ppt") returned 4
	[0083.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.382] lstrlenW (lpString=".zip") returned 4
	[0083.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.382] lstrlenW (lpString=".rar") returned 4
	[0083.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.382] lstrlenW (lpString=".bz2") returned 4
	[0083.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.382] lstrlenW (lpString=".7z") returned 3
	[0083.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.382] lstrlenW (lpString=".dbf") returned 4
	[0083.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.382] lstrlenW (lpString=".1cd") returned 4
	[0083.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.382] lstrlenW (lpString=".jpg") returned 4
	[0083.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.383] lstrlenW (lpString=".doc") returned 4
	[0083.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.383] lstrlenW (lpString=".docx") returned 5
	[0083.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.383] lstrlenW (lpString=".pdf") returned 4
	[0083.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.383] lstrlenW (lpString=".xls") returned 4
	[0083.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.383] lstrlenW (lpString=".xlsx") returned 5
	[0083.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.383] lstrlenW (lpString=".ppt") returned 4
	[0083.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.383] lstrlenW (lpString=".zip") returned 4
	[0083.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.383] lstrlenW (lpString=".rar") returned 4
	[0083.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.383] lstrlenW (lpString=".bz2") returned 4
	[0083.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.383] lstrlenW (lpString=".7z") returned 3
	[0083.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.383] lstrlenW (lpString=".dbf") returned 4
	[0083.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.383] lstrlenW (lpString=".1cd") returned 4
	[0083.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0083.384] lstrlenW (lpString=".jpg") returned 4
	[0083.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.384] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.384] lstrlenW (lpString="HH01058_.WMF") returned 12
	[0083.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.385] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=2756) returned 1
	[0083.385] CloseHandle (hObject=0x398) returned 1
	[0083.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220
	[0083.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.385] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.385] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0083.386] GetLastError () returned 0x0
	[0083.386] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xac4, lpOverlapped=0x0) returned 1
	[0083.387] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xad0, lpOverlapped=0x0) returned 1
	[0083.388] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.388] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.388] SetEndOfFile (hFile=0x33c) returned 1
	[0083.388] CloseHandle (hObject=0x33c) returned 1
	[0083.388] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.388] SetEndOfFile (hFile=0x398) returned 1
	[0083.389] CloseHandle (hObject=0x398) returned 1
	[0083.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1
	[0083.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.390] lstrlenW (lpString=".doc") returned 4
	[0083.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.390] lstrlenW (lpString=".docx") returned 5
	[0083.390] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.390] lstrlenW (lpString=".pdf") returned 4
	[0083.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.390] lstrlenW (lpString=".xls") returned 4
	[0083.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.390] lstrlenW (lpString=".xlsx") returned 5
	[0083.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.390] lstrlenW (lpString=".ppt") returned 4
	[0083.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.390] lstrlenW (lpString=".zip") returned 4
	[0083.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.390] lstrlenW (lpString=".rar") returned 4
	[0083.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.390] lstrlenW (lpString=".bz2") returned 4
	[0083.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.390] lstrlenW (lpString=".7z") returned 3
	[0083.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.390] lstrlenW (lpString=".dbf") returned 4
	[0083.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.390] lstrlenW (lpString=".1cd") returned 4
	[0083.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.390] lstrlenW (lpString=".jpg") returned 4
	[0083.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.391] lstrlenW (lpString=".doc") returned 4
	[0083.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.391] lstrlenW (lpString=".docx") returned 5
	[0083.391] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.391] lstrlenW (lpString=".pdf") returned 4
	[0083.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.391] lstrlenW (lpString=".xls") returned 4
	[0083.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.391] lstrlenW (lpString=".xlsx") returned 5
	[0083.391] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.391] lstrlenW (lpString=".ppt") returned 4
	[0083.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.391] lstrlenW (lpString=".zip") returned 4
	[0083.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.391] lstrlenW (lpString=".rar") returned 4
	[0083.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.391] lstrlenW (lpString=".bz2") returned 4
	[0083.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.391] lstrlenW (lpString=".7z") returned 3
	[0083.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.391] lstrlenW (lpString=".dbf") returned 4
	[0083.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.391] lstrlenW (lpString=".1cd") returned 4
	[0083.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0083.392] lstrlenW (lpString=".jpg") returned 4
	[0083.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.392] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.392] lstrlenW (lpString="HH01065_.WMF") returned 12
	[0083.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.392] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1268) returned 1
	[0083.392] CloseHandle (hObject=0x398) returned 1
	[0083.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220
	[0083.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.393] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.393] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0083.393] GetLastError () returned 0x0
	[0083.393] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x4f4, lpOverlapped=0x0) returned 1
	[0083.628] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x500, lpOverlapped=0x0) returned 1
	[0083.630] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.630] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.630] SetEndOfFile (hFile=0x33c) returned 1
	[0083.630] CloseHandle (hObject=0x33c) returned 1
	[0083.630] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.631] SetEndOfFile (hFile=0x398) returned 1
	[0083.631] CloseHandle (hObject=0x398) returned 1
	[0083.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1
	[0083.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.632] lstrlenW (lpString=".doc") returned 4
	[0083.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.632] lstrlenW (lpString=".docx") returned 5
	[0083.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.632] lstrlenW (lpString=".pdf") returned 4
	[0083.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.632] lstrlenW (lpString=".xls") returned 4
	[0083.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.632] lstrlenW (lpString=".xlsx") returned 5
	[0083.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.632] lstrlenW (lpString=".ppt") returned 4
	[0083.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.632] lstrlenW (lpString=".zip") returned 4
	[0083.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.632] lstrlenW (lpString=".rar") returned 4
	[0083.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString=".bz2") returned 4
	[0083.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString=".7z") returned 3
	[0083.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.633] lstrlenW (lpString=".dbf") returned 4
	[0083.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.633] lstrlenW (lpString=".1cd") returned 4
	[0083.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.633] lstrlenW (lpString=".jpg") returned 4
	[0083.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.633] lstrlenW (lpString=".doc") returned 4
	[0083.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString=".docx") returned 5
	[0083.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.633] lstrlenW (lpString=".pdf") returned 4
	[0083.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString=".xls") returned 4
	[0083.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.633] lstrlenW (lpString=".xlsx") returned 5
	[0083.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.634] lstrlenW (lpString=".ppt") returned 4
	[0083.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.634] lstrlenW (lpString=".zip") returned 4
	[0083.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.634] lstrlenW (lpString=".rar") returned 4
	[0083.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString=".bz2") returned 4
	[0083.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString=".7z") returned 3
	[0083.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.634] lstrlenW (lpString=".dbf") returned 4
	[0083.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.634] lstrlenW (lpString=".1cd") returned 4
	[0083.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0083.634] lstrlenW (lpString=".jpg") returned 4
	[0083.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.634] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.634] lstrlenW (lpString="HH02298_.WMF") returned 12
	[0083.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.635] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=5552) returned 1
	[0083.635] CloseHandle (hObject=0x398) returned 1
	[0083.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220
	[0083.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.635] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.635] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0083.636] GetLastError () returned 0x0
	[0083.636] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x15b0, lpOverlapped=0x0) returned 1
	[0083.637] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x15c0, lpOverlapped=0x0) returned 1
	[0083.638] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.638] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.638] SetEndOfFile (hFile=0x33c) returned 1
	[0083.638] CloseHandle (hObject=0x33c) returned 1
	[0083.639] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.639] SetEndOfFile (hFile=0x398) returned 1
	[0083.639] CloseHandle (hObject=0x398) returned 1
	[0083.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1
	[0083.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.640] lstrlenW (lpString=".doc") returned 4
	[0083.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.640] lstrlenW (lpString=".docx") returned 5
	[0083.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.640] lstrlenW (lpString=".pdf") returned 4
	[0083.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.640] lstrlenW (lpString=".xls") returned 4
	[0083.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.640] lstrlenW (lpString=".xlsx") returned 5
	[0083.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.640] lstrlenW (lpString=".ppt") returned 4
	[0083.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.641] lstrlenW (lpString=".zip") returned 4
	[0083.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.641] lstrlenW (lpString=".rar") returned 4
	[0083.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString=".bz2") returned 4
	[0083.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString=".7z") returned 3
	[0083.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.641] lstrlenW (lpString=".dbf") returned 4
	[0083.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.641] lstrlenW (lpString=".1cd") returned 4
	[0083.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.641] lstrlenW (lpString=".jpg") returned 4
	[0083.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.641] lstrlenW (lpString=".doc") returned 4
	[0083.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString=".docx") returned 5
	[0083.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.641] lstrlenW (lpString=".pdf") returned 4
	[0083.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.642] lstrlenW (lpString=".xls") returned 4
	[0083.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.642] lstrlenW (lpString=".xlsx") returned 5
	[0083.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.642] lstrlenW (lpString=".ppt") returned 4
	[0083.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.642] lstrlenW (lpString=".zip") returned 4
	[0083.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.642] lstrlenW (lpString=".rar") returned 4
	[0083.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.642] lstrlenW (lpString=".bz2") returned 4
	[0083.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.642] lstrlenW (lpString=".7z") returned 3
	[0083.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.642] lstrlenW (lpString=".dbf") returned 4
	[0083.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.642] lstrlenW (lpString=".1cd") returned 4
	[0083.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0083.643] lstrlenW (lpString=".jpg") returned 4
	[0083.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.643] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.643] lstrlenW (lpString="HH02312_.WMF") returned 12
	[0083.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.643] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4970) returned 1
	[0083.643] CloseHandle (hObject=0x398) returned 1
	[0083.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220
	[0083.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.644] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.644] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0083.644] GetLastError () returned 0x0
	[0083.644] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x136a, lpOverlapped=0x0) returned 1
	[0083.646] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1370, lpOverlapped=0x0) returned 1
	[0083.647] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.647] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.647] SetEndOfFile (hFile=0x33c) returned 1
	[0083.647] CloseHandle (hObject=0x33c) returned 1
	[0083.648] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.648] SetEndOfFile (hFile=0x398) returned 1
	[0083.648] CloseHandle (hObject=0x398) returned 1
	[0083.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1
	[0083.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.649] lstrlenW (lpString=".doc") returned 4
	[0083.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.649] lstrlenW (lpString=".docx") returned 5
	[0083.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.649] lstrlenW (lpString=".pdf") returned 4
	[0083.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.649] lstrlenW (lpString=".xls") returned 4
	[0083.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.649] lstrlenW (lpString=".xlsx") returned 5
	[0083.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.650] lstrlenW (lpString=".ppt") returned 4
	[0083.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.650] lstrlenW (lpString=".zip") returned 4
	[0083.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.650] lstrlenW (lpString=".rar") returned 4
	[0083.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.650] lstrlenW (lpString=".bz2") returned 4
	[0083.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.650] lstrlenW (lpString=".7z") returned 3
	[0083.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.650] lstrlenW (lpString=".dbf") returned 4
	[0083.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.650] lstrlenW (lpString=".1cd") returned 4
	[0083.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.650] lstrlenW (lpString=".jpg") returned 4
	[0083.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.651] lstrlenW (lpString=".doc") returned 4
	[0083.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString=".docx") returned 5
	[0083.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.651] lstrlenW (lpString=".pdf") returned 4
	[0083.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString=".xls") returned 4
	[0083.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.651] lstrlenW (lpString=".xlsx") returned 5
	[0083.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.651] lstrlenW (lpString=".ppt") returned 4
	[0083.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.651] lstrlenW (lpString=".zip") returned 4
	[0083.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.651] lstrlenW (lpString=".rar") returned 4
	[0083.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString=".bz2") returned 4
	[0083.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString=".7z") returned 3
	[0083.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.652] lstrlenW (lpString=".dbf") returned 4
	[0083.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.652] lstrlenW (lpString=".1cd") returned 4
	[0083.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0083.652] lstrlenW (lpString=".jpg") returned 4
	[0083.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.652] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.652] lstrlenW (lpString="HH02313_.WMF") returned 12
	[0083.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.652] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3082) returned 1
	[0083.653] CloseHandle (hObject=0x398) returned 1
	[0083.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220
	[0083.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.653] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.653] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0083.654] GetLastError () returned 0x0
	[0083.654] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xc0a, lpOverlapped=0x0) returned 1
	[0083.655] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xc10, lpOverlapped=0x0) returned 1
	[0083.656] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.656] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.656] SetEndOfFile (hFile=0x33c) returned 1
	[0083.656] CloseHandle (hObject=0x33c) returned 1
	[0083.656] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.656] SetEndOfFile (hFile=0x398) returned 1
	[0083.657] CloseHandle (hObject=0x398) returned 1
	[0083.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0083.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1
	[0083.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.658] lstrlenW (lpString=".doc") returned 4
	[0083.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.658] lstrlenW (lpString=".docx") returned 5
	[0083.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.658] lstrlenW (lpString=".pdf") returned 4
	[0083.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.658] lstrlenW (lpString=".xls") returned 4
	[0083.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.658] lstrlenW (lpString=".xlsx") returned 5
	[0083.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.658] lstrlenW (lpString=".ppt") returned 4
	[0083.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.659] lstrlenW (lpString=".zip") returned 4
	[0083.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.659] lstrlenW (lpString=".rar") returned 4
	[0083.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString=".bz2") returned 4
	[0083.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString=".7z") returned 3
	[0083.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.659] lstrlenW (lpString=".dbf") returned 4
	[0083.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.659] lstrlenW (lpString=".1cd") returned 4
	[0083.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.659] lstrlenW (lpString=".jpg") returned 4
	[0083.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.659] lstrlenW (lpString=".doc") returned 4
	[0083.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.660] lstrlenW (lpString=".docx") returned 5
	[0083.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.660] lstrlenW (lpString=".pdf") returned 4
	[0083.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.660] lstrlenW (lpString=".xls") returned 4
	[0083.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.660] lstrlenW (lpString=".xlsx") returned 5
	[0083.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.660] lstrlenW (lpString=".ppt") returned 4
	[0083.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.660] lstrlenW (lpString=".zip") returned 4
	[0083.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.660] lstrlenW (lpString=".rar") returned 4
	[0083.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.660] lstrlenW (lpString=".bz2") returned 4
	[0083.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.661] lstrlenW (lpString=".7z") returned 3
	[0083.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.661] lstrlenW (lpString=".dbf") returned 4
	[0083.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.661] lstrlenW (lpString=".1cd") returned 4
	[0083.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0083.661] lstrlenW (lpString=".jpg") returned 4
	[0083.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.661] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0083.661] lstrlenW (lpString="HM00005_.WMF") returned 12
	[0083.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.662] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=23300) returned 1
	[0083.662] CloseHandle (hObject=0x398) returned 1
	[0083.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220
	[0083.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0083.662] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.662] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0083.663] GetLastError () returned 0x0
	[0083.663] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x5b04, lpOverlapped=0x0) returned 1
	[0084.276] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x5b10, lpOverlapped=0x0) returned 1
	[0084.302] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.302] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.302] SetEndOfFile (hFile=0x33c) returned 1
	[0084.302] CloseHandle (hObject=0x33c) returned 1
	[0084.302] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.302] SetEndOfFile (hFile=0x398) returned 1
	[0084.303] CloseHandle (hObject=0x398) returned 1
	[0084.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1
	[0084.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.304] lstrlenW (lpString=".doc") returned 4
	[0084.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.304] lstrlenW (lpString=".docx") returned 5
	[0084.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.304] lstrlenW (lpString=".pdf") returned 4
	[0084.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.304] lstrlenW (lpString=".xls") returned 4
	[0084.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.304] lstrlenW (lpString=".xlsx") returned 5
	[0084.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.304] lstrlenW (lpString=".ppt") returned 4
	[0084.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.305] lstrlenW (lpString=".zip") returned 4
	[0084.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.305] lstrlenW (lpString=".rar") returned 4
	[0084.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.305] lstrlenW (lpString=".bz2") returned 4
	[0084.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.305] lstrlenW (lpString=".7z") returned 3
	[0084.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.305] lstrlenW (lpString=".dbf") returned 4
	[0084.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.305] lstrlenW (lpString=".1cd") returned 4
	[0084.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.305] lstrlenW (lpString=".jpg") returned 4
	[0084.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.305] lstrlenW (lpString=".doc") returned 4
	[0084.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.305] lstrlenW (lpString=".docx") returned 5
	[0084.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.306] lstrlenW (lpString=".pdf") returned 4
	[0084.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.306] lstrlenW (lpString=".xls") returned 4
	[0084.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.306] lstrlenW (lpString=".xlsx") returned 5
	[0084.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.306] lstrlenW (lpString=".ppt") returned 4
	[0084.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.306] lstrlenW (lpString=".zip") returned 4
	[0084.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.306] lstrlenW (lpString=".rar") returned 4
	[0084.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.306] lstrlenW (lpString=".bz2") returned 4
	[0084.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.306] lstrlenW (lpString=".7z") returned 3
	[0084.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.306] lstrlenW (lpString=".dbf") returned 4
	[0084.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.306] lstrlenW (lpString=".1cd") returned 4
	[0084.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0084.306] lstrlenW (lpString=".jpg") returned 4
	[0084.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.307] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.307] lstrlenW (lpString="IN00351_.WMF") returned 12
	[0084.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.307] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=1928) returned 1
	[0084.307] CloseHandle (hObject=0x398) returned 1
	[0084.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220
	[0084.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.308] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.308] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0084.308] GetLastError () returned 0x0
	[0084.308] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x788, lpOverlapped=0x0) returned 1
	[0084.310] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x790, lpOverlapped=0x0) returned 1
	[0084.310] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.310] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.311] SetEndOfFile (hFile=0x33c) returned 1
	[0084.311] CloseHandle (hObject=0x33c) returned 1
	[0084.311] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.311] SetEndOfFile (hFile=0x398) returned 1
	[0084.312] CloseHandle (hObject=0x398) returned 1
	[0084.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1
	[0084.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.312] lstrlenW (lpString=".doc") returned 4
	[0084.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.312] lstrlenW (lpString=".docx") returned 5
	[0084.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.312] lstrlenW (lpString=".pdf") returned 4
	[0084.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.312] lstrlenW (lpString=".xls") returned 4
	[0084.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.313] lstrlenW (lpString=".xlsx") returned 5
	[0084.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.313] lstrlenW (lpString=".ppt") returned 4
	[0084.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.313] lstrlenW (lpString=".zip") returned 4
	[0084.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.313] lstrlenW (lpString=".rar") returned 4
	[0084.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.313] lstrlenW (lpString=".bz2") returned 4
	[0084.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.313] lstrlenW (lpString=".7z") returned 3
	[0084.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.313] lstrlenW (lpString=".dbf") returned 4
	[0084.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.313] lstrlenW (lpString=".1cd") returned 4
	[0084.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.313] lstrlenW (lpString=".jpg") returned 4
	[0084.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.314] lstrlenW (lpString=".doc") returned 4
	[0084.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.314] lstrlenW (lpString=".docx") returned 5
	[0084.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.314] lstrlenW (lpString=".pdf") returned 4
	[0084.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.314] lstrlenW (lpString=".xls") returned 4
	[0084.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.314] lstrlenW (lpString=".xlsx") returned 5
	[0084.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.314] lstrlenW (lpString=".ppt") returned 4
	[0084.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.314] lstrlenW (lpString=".zip") returned 4
	[0084.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.314] lstrlenW (lpString=".rar") returned 4
	[0084.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.314] lstrlenW (lpString=".bz2") returned 4
	[0084.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.314] lstrlenW (lpString=".7z") returned 3
	[0084.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.314] lstrlenW (lpString=".dbf") returned 4
	[0084.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.314] lstrlenW (lpString=".1cd") returned 4
	[0084.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0084.315] lstrlenW (lpString=".jpg") returned 4
	[0084.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.315] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.315] lstrlenW (lpString="IN00557_.WMF") returned 12
	[0084.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.315] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=9172) returned 1
	[0084.315] CloseHandle (hObject=0x398) returned 1
	[0084.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220
	[0084.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.316] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.316] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0084.316] GetLastError () returned 0x0
	[0084.316] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x23d4, lpOverlapped=0x0) returned 1
	[0084.318] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x23e0, lpOverlapped=0x0) returned 1
	[0084.319] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.319] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.319] SetEndOfFile (hFile=0x33c) returned 1
	[0084.319] CloseHandle (hObject=0x33c) returned 1
	[0084.319] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.319] SetEndOfFile (hFile=0x398) returned 1
	[0084.320] CloseHandle (hObject=0x398) returned 1
	[0084.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1
	[0084.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.321] lstrlenW (lpString=".doc") returned 4
	[0084.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.321] lstrlenW (lpString=".docx") returned 5
	[0084.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.321] lstrlenW (lpString=".pdf") returned 4
	[0084.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.321] lstrlenW (lpString=".xls") returned 4
	[0084.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.321] lstrlenW (lpString=".xlsx") returned 5
	[0084.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.321] lstrlenW (lpString=".ppt") returned 4
	[0084.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.321] lstrlenW (lpString=".zip") returned 4
	[0084.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.322] lstrlenW (lpString=".rar") returned 4
	[0084.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.322] lstrlenW (lpString=".bz2") returned 4
	[0084.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.322] lstrlenW (lpString=".7z") returned 3
	[0084.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.322] lstrlenW (lpString=".dbf") returned 4
	[0084.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.322] lstrlenW (lpString=".1cd") returned 4
	[0084.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.322] lstrlenW (lpString=".jpg") returned 4
	[0084.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.322] lstrlenW (lpString=".doc") returned 4
	[0084.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.322] lstrlenW (lpString=".docx") returned 5
	[0084.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.322] lstrlenW (lpString=".pdf") returned 4
	[0084.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.322] lstrlenW (lpString=".xls") returned 4
	[0084.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.323] lstrlenW (lpString=".xlsx") returned 5
	[0084.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.323] lstrlenW (lpString=".ppt") returned 4
	[0084.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.323] lstrlenW (lpString=".zip") returned 4
	[0084.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.323] lstrlenW (lpString=".rar") returned 4
	[0084.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.323] lstrlenW (lpString=".bz2") returned 4
	[0084.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.323] lstrlenW (lpString=".7z") returned 3
	[0084.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.323] lstrlenW (lpString=".dbf") returned 4
	[0084.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.323] lstrlenW (lpString=".1cd") returned 4
	[0084.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0084.323] lstrlenW (lpString=".jpg") returned 4
	[0084.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.323] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.323] lstrlenW (lpString="IN00915_.WMF") returned 12
	[0084.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.327] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=12748) returned 1
	[0084.327] CloseHandle (hObject=0x398) returned 1
	[0084.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220
	[0084.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0084.327] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.327] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0084.327] GetLastError () returned 0x0
	[0084.327] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x31cc, lpOverlapped=0x0) returned 1
	[0084.329] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x31d0, lpOverlapped=0x0) returned 1
	[0084.330] ReadFile (in: hFile=0x398, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.330] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.330] SetEndOfFile (hFile=0x33c) returned 1
	[0084.330] CloseHandle (hObject=0x33c) returned 1
	[0084.331] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.331] SetEndOfFile (hFile=0x398) returned 1
	[0084.332] CloseHandle (hObject=0x398) returned 1
	[0084.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1
	[0084.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.333] lstrlenW (lpString=".doc") returned 4
	[0084.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.333] lstrlenW (lpString=".docx") returned 5
	[0084.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.333] lstrlenW (lpString=".pdf") returned 4
	[0084.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.333] lstrlenW (lpString=".xls") returned 4
	[0084.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.333] lstrlenW (lpString=".xlsx") returned 5
	[0084.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.334] lstrlenW (lpString=".ppt") returned 4
	[0084.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.334] lstrlenW (lpString=".zip") returned 4
	[0084.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.334] lstrlenW (lpString=".rar") returned 4
	[0084.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.334] lstrlenW (lpString=".bz2") returned 4
	[0084.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.804] lstrlenW (lpString=".7z") returned 3
	[0084.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.820] lstrlenW (lpString=".dbf") returned 4
	[0084.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.820] lstrlenW (lpString=".1cd") returned 4
	[0084.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.820] lstrlenW (lpString=".jpg") returned 4
	[0084.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.820] lstrlenW (lpString=".doc") returned 4
	[0084.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.820] lstrlenW (lpString=".docx") returned 5
	[0084.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.820] lstrlenW (lpString=".pdf") returned 4
	[0084.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.821] lstrlenW (lpString=".xls") returned 4
	[0084.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.821] lstrlenW (lpString=".xlsx") returned 5
	[0084.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.821] lstrlenW (lpString=".ppt") returned 4
	[0084.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.821] lstrlenW (lpString=".zip") returned 4
	[0084.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.821] lstrlenW (lpString=".rar") returned 4
	[0084.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.821] lstrlenW (lpString=".bz2") returned 4
	[0084.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.821] lstrlenW (lpString=".7z") returned 3
	[0084.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.821] lstrlenW (lpString=".dbf") returned 4
	[0084.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.821] lstrlenW (lpString=".1cd") returned 4
	[0084.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0084.821] lstrlenW (lpString=".jpg") returned 4
	[0084.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.822] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.822] lstrlenW (lpString="J0089945.WMF") returned 12
	[0084.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.822] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=19898) returned 1
	[0084.822] CloseHandle (hObject=0x380) returned 1
	[0084.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220
	[0084.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.822] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.822] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.823] GetLastError () returned 0x0
	[0084.823] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x4dba, lpOverlapped=0x0) returned 1
	[0084.825] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x4dc0, lpOverlapped=0x0) returned 1
	[0084.826] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.826] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.826] SetEndOfFile (hFile=0x320) returned 1
	[0084.826] CloseHandle (hObject=0x320) returned 1
	[0084.826] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.826] SetEndOfFile (hFile=0x380) returned 1
	[0084.827] CloseHandle (hObject=0x380) returned 1
	[0084.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1
	[0084.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.828] lstrlenW (lpString=".doc") returned 4
	[0084.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.828] lstrlenW (lpString=".docx") returned 5
	[0084.828] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0084.828] lstrlenW (lpString=".pdf") returned 4
	[0084.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.828] lstrlenW (lpString=".xls") returned 4
	[0084.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.828] lstrlenW (lpString=".xlsx") returned 5
	[0084.828] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0084.828] lstrlenW (lpString=".ppt") returned 4
	[0084.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.828] lstrlenW (lpString=".zip") returned 4
	[0084.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.828] lstrlenW (lpString=".rar") returned 4
	[0084.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.828] lstrlenW (lpString=".bz2") returned 4
	[0084.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.828] lstrlenW (lpString=".7z") returned 3
	[0084.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.828] lstrlenW (lpString=".dbf") returned 4
	[0084.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.829] lstrlenW (lpString=".1cd") returned 4
	[0084.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.829] lstrlenW (lpString=".jpg") returned 4
	[0084.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.829] lstrlenW (lpString=".doc") returned 4
	[0084.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.829] lstrlenW (lpString=".docx") returned 5
	[0084.829] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0084.829] lstrlenW (lpString=".pdf") returned 4
	[0084.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.829] lstrlenW (lpString=".xls") returned 4
	[0084.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.829] lstrlenW (lpString=".xlsx") returned 5
	[0084.829] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0084.829] lstrlenW (lpString=".ppt") returned 4
	[0084.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.829] lstrlenW (lpString=".zip") returned 4
	[0084.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.829] lstrlenW (lpString=".rar") returned 4
	[0084.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.829] lstrlenW (lpString=".bz2") returned 4
	[0084.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.829] lstrlenW (lpString=".7z") returned 3
	[0084.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.830] lstrlenW (lpString=".dbf") returned 4
	[0084.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.830] lstrlenW (lpString=".1cd") returned 4
	[0084.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0084.830] lstrlenW (lpString=".jpg") returned 4
	[0084.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.830] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.830] lstrlenW (lpString="J0089992.WMF") returned 12
	[0084.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.830] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=15680) returned 1
	[0084.830] CloseHandle (hObject=0x380) returned 1
	[0084.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220
	[0084.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.831] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.831] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.831] GetLastError () returned 0x0
	[0084.831] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x3d40, lpOverlapped=0x0) returned 1
	[0084.833] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3d50, lpOverlapped=0x0) returned 1
	[0084.834] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.834] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.834] SetEndOfFile (hFile=0x320) returned 1
	[0084.834] CloseHandle (hObject=0x320) returned 1
	[0084.834] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.834] SetEndOfFile (hFile=0x380) returned 1
	[0084.835] CloseHandle (hObject=0x380) returned 1
	[0084.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1
	[0084.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.836] lstrlenW (lpString=".doc") returned 4
	[0084.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.836] lstrlenW (lpString=".docx") returned 5
	[0084.836] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0084.836] lstrlenW (lpString=".pdf") returned 4
	[0084.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.836] lstrlenW (lpString=".xls") returned 4
	[0084.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.836] lstrlenW (lpString=".xlsx") returned 5
	[0084.836] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0084.836] lstrlenW (lpString=".ppt") returned 4
	[0084.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.836] lstrlenW (lpString=".zip") returned 4
	[0084.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.836] lstrlenW (lpString=".rar") returned 4
	[0084.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.837] lstrlenW (lpString=".bz2") returned 4
	[0084.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.837] lstrlenW (lpString=".7z") returned 3
	[0084.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.837] lstrlenW (lpString=".dbf") returned 4
	[0084.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.837] lstrlenW (lpString=".1cd") returned 4
	[0084.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.837] lstrlenW (lpString=".jpg") returned 4
	[0084.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.837] lstrlenW (lpString=".doc") returned 4
	[0084.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.837] lstrlenW (lpString=".docx") returned 5
	[0084.837] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0084.837] lstrlenW (lpString=".pdf") returned 4
	[0084.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.837] lstrlenW (lpString=".xls") returned 4
	[0084.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.837] lstrlenW (lpString=".xlsx") returned 5
	[0084.837] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0084.837] lstrlenW (lpString=".ppt") returned 4
	[0084.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.837] lstrlenW (lpString=".zip") returned 4
	[0084.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.838] lstrlenW (lpString=".rar") returned 4
	[0084.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.838] lstrlenW (lpString=".bz2") returned 4
	[0084.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.838] lstrlenW (lpString=".7z") returned 3
	[0084.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.838] lstrlenW (lpString=".dbf") returned 4
	[0084.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.838] lstrlenW (lpString=".1cd") returned 4
	[0084.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0084.838] lstrlenW (lpString=".jpg") returned 4
	[0084.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.838] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.838] lstrlenW (lpString="J0090027.WMF") returned 12
	[0084.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.838] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=21268) returned 1
	[0084.839] CloseHandle (hObject=0x380) returned 1
	[0084.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220
	[0084.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.839] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.839] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.839] GetLastError () returned 0x0
	[0084.839] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x5314, lpOverlapped=0x0) returned 1
	[0084.841] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x5320, lpOverlapped=0x0) returned 1
	[0084.842] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.842] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.842] SetEndOfFile (hFile=0x320) returned 1
	[0084.843] CloseHandle (hObject=0x320) returned 1
	[0084.843] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.843] SetEndOfFile (hFile=0x380) returned 1
	[0084.844] CloseHandle (hObject=0x380) returned 1
	[0084.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1
	[0084.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.844] lstrlenW (lpString=".doc") returned 4
	[0084.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.844] lstrlenW (lpString=".docx") returned 5
	[0084.844] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0084.844] lstrlenW (lpString=".pdf") returned 4
	[0084.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.844] lstrlenW (lpString=".xls") returned 4
	[0084.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.844] lstrlenW (lpString=".xlsx") returned 5
	[0084.844] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0084.845] lstrlenW (lpString=".ppt") returned 4
	[0084.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.845] lstrlenW (lpString=".zip") returned 4
	[0084.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.845] lstrlenW (lpString=".rar") returned 4
	[0084.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.845] lstrlenW (lpString=".bz2") returned 4
	[0084.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.845] lstrlenW (lpString=".7z") returned 3
	[0084.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.845] lstrlenW (lpString=".dbf") returned 4
	[0084.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.845] lstrlenW (lpString=".1cd") returned 4
	[0084.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.845] lstrlenW (lpString=".jpg") returned 4
	[0084.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.845] lstrlenW (lpString=".doc") returned 4
	[0084.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.845] lstrlenW (lpString=".docx") returned 5
	[0084.846] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0084.846] lstrlenW (lpString=".pdf") returned 4
	[0084.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.846] lstrlenW (lpString=".xls") returned 4
	[0084.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.846] lstrlenW (lpString=".xlsx") returned 5
	[0084.846] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0084.846] lstrlenW (lpString=".ppt") returned 4
	[0084.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.846] lstrlenW (lpString=".zip") returned 4
	[0084.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.846] lstrlenW (lpString=".rar") returned 4
	[0084.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.846] lstrlenW (lpString=".bz2") returned 4
	[0084.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.846] lstrlenW (lpString=".7z") returned 3
	[0084.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.846] lstrlenW (lpString=".dbf") returned 4
	[0084.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.846] lstrlenW (lpString=".1cd") returned 4
	[0084.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0084.846] lstrlenW (lpString=".jpg") returned 4
	[0084.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.847] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.847] lstrlenW (lpString="J0090087.WMF") returned 12
	[0084.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.848] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=46936) returned 1
	[0084.848] CloseHandle (hObject=0x380) returned 1
	[0084.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220
	[0084.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.849] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.849] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.849] GetLastError () returned 0x0
	[0084.849] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xb758, lpOverlapped=0x0) returned 1
	[0084.851] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xb760, lpOverlapped=0x0) returned 1
	[0084.853] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.853] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.853] SetEndOfFile (hFile=0x320) returned 1
	[0084.853] CloseHandle (hObject=0x320) returned 1
	[0084.853] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.853] SetEndOfFile (hFile=0x380) returned 1
	[0084.854] CloseHandle (hObject=0x380) returned 1
	[0084.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0084.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1
	[0084.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.855] lstrlenW (lpString=".doc") returned 4
	[0084.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.855] lstrlenW (lpString=".docx") returned 5
	[0084.855] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0084.855] lstrlenW (lpString=".pdf") returned 4
	[0084.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.855] lstrlenW (lpString=".xls") returned 4
	[0084.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.855] lstrlenW (lpString=".xlsx") returned 5
	[0084.855] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0084.855] lstrlenW (lpString=".ppt") returned 4
	[0084.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.855] lstrlenW (lpString=".zip") returned 4
	[0084.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.855] lstrlenW (lpString=".rar") returned 4
	[0084.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.855] lstrlenW (lpString=".bz2") returned 4
	[0084.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.856] lstrlenW (lpString=".7z") returned 3
	[0084.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.856] lstrlenW (lpString=".dbf") returned 4
	[0084.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.856] lstrlenW (lpString=".1cd") returned 4
	[0084.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.856] lstrlenW (lpString=".jpg") returned 4
	[0084.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.856] lstrlenW (lpString=".doc") returned 4
	[0084.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.856] lstrlenW (lpString=".docx") returned 5
	[0084.856] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0084.856] lstrlenW (lpString=".pdf") returned 4
	[0084.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.856] lstrlenW (lpString=".xls") returned 4
	[0084.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.856] lstrlenW (lpString=".xlsx") returned 5
	[0084.856] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0084.856] lstrlenW (lpString=".ppt") returned 4
	[0084.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.856] lstrlenW (lpString=".zip") returned 4
	[0084.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.857] lstrlenW (lpString=".rar") returned 4
	[0084.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.857] lstrlenW (lpString=".bz2") returned 4
	[0084.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.857] lstrlenW (lpString=".7z") returned 3
	[0084.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.857] lstrlenW (lpString=".dbf") returned 4
	[0084.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.857] lstrlenW (lpString=".1cd") returned 4
	[0084.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0084.857] lstrlenW (lpString=".jpg") returned 4
	[0084.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.857] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0084.857] lstrlenW (lpString="J0090089.WMF") returned 12
	[0084.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.858] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=15760) returned 1
	[0084.858] CloseHandle (hObject=0x380) returned 1
	[0084.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220
	[0084.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.858] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.858] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.861] GetLastError () returned 0x0
	[0084.861] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x3d90, lpOverlapped=0x0) returned 1
	[0085.347] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3da0, lpOverlapped=0x0) returned 1
	[0085.348] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.348] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.348] SetEndOfFile (hFile=0x320) returned 1
	[0085.348] CloseHandle (hObject=0x320) returned 1
	[0085.348] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.348] SetEndOfFile (hFile=0x380) returned 1
	[0085.349] CloseHandle (hObject=0x380) returned 1
	[0085.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1
	[0085.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.350] lstrlenW (lpString=".doc") returned 4
	[0085.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.350] lstrlenW (lpString=".docx") returned 5
	[0085.350] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0085.350] lstrlenW (lpString=".pdf") returned 4
	[0085.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.350] lstrlenW (lpString=".xls") returned 4
	[0085.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.350] lstrlenW (lpString=".xlsx") returned 5
	[0085.350] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0085.350] lstrlenW (lpString=".ppt") returned 4
	[0085.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.350] lstrlenW (lpString=".zip") returned 4
	[0085.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.350] lstrlenW (lpString=".rar") returned 4
	[0085.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.350] lstrlenW (lpString=".bz2") returned 4
	[0085.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.350] lstrlenW (lpString=".7z") returned 3
	[0085.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.350] lstrlenW (lpString=".dbf") returned 4
	[0085.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.351] lstrlenW (lpString=".1cd") returned 4
	[0085.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.351] lstrlenW (lpString=".jpg") returned 4
	[0085.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.351] lstrlenW (lpString=".doc") returned 4
	[0085.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.351] lstrlenW (lpString=".docx") returned 5
	[0085.351] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0085.351] lstrlenW (lpString=".pdf") returned 4
	[0085.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.351] lstrlenW (lpString=".xls") returned 4
	[0085.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.351] lstrlenW (lpString=".xlsx") returned 5
	[0085.351] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0085.351] lstrlenW (lpString=".ppt") returned 4
	[0085.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.351] lstrlenW (lpString=".zip") returned 4
	[0085.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.351] lstrlenW (lpString=".rar") returned 4
	[0085.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.352] lstrlenW (lpString=".bz2") returned 4
	[0085.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.352] lstrlenW (lpString=".7z") returned 3
	[0085.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.352] lstrlenW (lpString=".dbf") returned 4
	[0085.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.352] lstrlenW (lpString=".1cd") returned 4
	[0085.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0085.352] lstrlenW (lpString=".jpg") returned 4
	[0085.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.352] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.352] lstrlenW (lpString="J0099150.JPG") returned 12
	[0085.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.353] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=21914) returned 1
	[0085.353] CloseHandle (hObject=0x380) returned 1
	[0085.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220
	[0085.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.353] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.353] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0085.354] GetLastError () returned 0x0
	[0085.354] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x559a, lpOverlapped=0x0) returned 1
	[0085.355] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x55a0, lpOverlapped=0x0) returned 1
	[0085.357] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.357] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.357] SetEndOfFile (hFile=0x320) returned 1
	[0085.357] CloseHandle (hObject=0x320) returned 1
	[0085.357] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.357] SetEndOfFile (hFile=0x380) returned 1
	[0085.358] CloseHandle (hObject=0x380) returned 1
	[0085.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1
	[0085.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.359] lstrlenW (lpString=".doc") returned 4
	[0085.359] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.359] lstrlenW (lpString=".docx") returned 5
	[0085.359] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0085.359] lstrlenW (lpString=".pdf") returned 4
	[0085.359] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.359] lstrlenW (lpString=".xls") returned 4
	[0085.359] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.359] lstrlenW (lpString=".xlsx") returned 5
	[0085.359] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0085.359] lstrlenW (lpString=".ppt") returned 4
	[0085.359] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.359] lstrlenW (lpString=".zip") returned 4
	[0085.359] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.359] lstrlenW (lpString=".rar") returned 4
	[0085.359] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.359] lstrlenW (lpString=".bz2") returned 4
	[0085.359] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.359] lstrlenW (lpString=".7z") returned 3
	[0085.359] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.359] lstrlenW (lpString=".dbf") returned 4
	[0085.359] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.359] lstrlenW (lpString=".1cd") returned 4
	[0085.360] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.360] lstrlenW (lpString=".jpg") returned 4
	[0085.360] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.360] lstrlenW (lpString=".doc") returned 4
	[0085.360] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.360] lstrlenW (lpString=".docx") returned 5
	[0085.360] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0085.360] lstrlenW (lpString=".pdf") returned 4
	[0085.360] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.360] lstrlenW (lpString=".xls") returned 4
	[0085.360] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.360] lstrlenW (lpString=".xlsx") returned 5
	[0085.360] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0085.360] lstrlenW (lpString=".ppt") returned 4
	[0085.360] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.360] lstrlenW (lpString=".zip") returned 4
	[0085.360] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.360] lstrlenW (lpString=".rar") returned 4
	[0085.360] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.360] lstrlenW (lpString=".bz2") returned 4
	[0085.360] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.360] lstrlenW (lpString=".7z") returned 3
	[0085.360] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.361] lstrlenW (lpString=".dbf") returned 4
	[0085.361] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.361] lstrlenW (lpString=".1cd") returned 4
	[0085.361] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0085.361] lstrlenW (lpString=".jpg") returned 4
	[0085.361] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.361] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.361] lstrlenW (lpString="J0099151.WMF") returned 12
	[0085.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.361] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=26086) returned 1
	[0085.361] CloseHandle (hObject=0x380) returned 1
	[0085.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220
	[0085.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.363] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.364] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0085.364] GetLastError () returned 0x0
	[0085.364] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x65e6, lpOverlapped=0x0) returned 1
	[0085.366] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x65f0, lpOverlapped=0x0) returned 1
	[0085.368] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.368] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.368] SetEndOfFile (hFile=0x320) returned 1
	[0085.368] CloseHandle (hObject=0x320) returned 1
	[0085.368] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.368] SetEndOfFile (hFile=0x380) returned 1
	[0085.369] CloseHandle (hObject=0x380) returned 1
	[0085.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1
	[0085.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.369] lstrlenW (lpString=".doc") returned 4
	[0085.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.370] lstrlenW (lpString=".docx") returned 5
	[0085.370] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0085.370] lstrlenW (lpString=".pdf") returned 4
	[0085.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.370] lstrlenW (lpString=".xls") returned 4
	[0085.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.370] lstrlenW (lpString=".xlsx") returned 5
	[0085.370] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0085.370] lstrlenW (lpString=".ppt") returned 4
	[0085.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.370] lstrlenW (lpString=".zip") returned 4
	[0085.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.370] lstrlenW (lpString=".rar") returned 4
	[0085.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.370] lstrlenW (lpString=".bz2") returned 4
	[0085.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.370] lstrlenW (lpString=".7z") returned 3
	[0085.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.370] lstrlenW (lpString=".dbf") returned 4
	[0085.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.370] lstrlenW (lpString=".1cd") returned 4
	[0085.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.370] lstrlenW (lpString=".jpg") returned 4
	[0085.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.371] lstrlenW (lpString=".doc") returned 4
	[0085.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.371] lstrlenW (lpString=".docx") returned 5
	[0085.371] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0085.371] lstrlenW (lpString=".pdf") returned 4
	[0085.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.371] lstrlenW (lpString=".xls") returned 4
	[0085.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.371] lstrlenW (lpString=".xlsx") returned 5
	[0085.371] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0085.371] lstrlenW (lpString=".ppt") returned 4
	[0085.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.371] lstrlenW (lpString=".zip") returned 4
	[0085.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.371] lstrlenW (lpString=".rar") returned 4
	[0085.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.371] lstrlenW (lpString=".bz2") returned 4
	[0085.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.371] lstrlenW (lpString=".7z") returned 3
	[0085.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.371] lstrlenW (lpString=".dbf") returned 4
	[0085.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.371] lstrlenW (lpString=".1cd") returned 4
	[0085.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0085.372] lstrlenW (lpString=".jpg") returned 4
	[0085.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.372] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.372] lstrlenW (lpString="J0099152.JPG") returned 12
	[0085.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.372] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=11694) returned 1
	[0085.372] CloseHandle (hObject=0x380) returned 1
	[0085.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220
	[0085.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.373] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.373] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0085.373] GetLastError () returned 0x0
	[0085.373] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x2dae, lpOverlapped=0x0) returned 1
	[0085.375] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x2db0, lpOverlapped=0x0) returned 1
	[0085.376] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.376] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.376] SetEndOfFile (hFile=0x320) returned 1
	[0085.376] CloseHandle (hObject=0x320) returned 1
	[0085.376] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.376] SetEndOfFile (hFile=0x380) returned 1
	[0085.377] CloseHandle (hObject=0x380) returned 1
	[0085.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1
	[0085.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.378] lstrlenW (lpString=".doc") returned 4
	[0085.378] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.378] lstrlenW (lpString=".docx") returned 5
	[0085.378] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0085.378] lstrlenW (lpString=".pdf") returned 4
	[0085.378] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.378] lstrlenW (lpString=".xls") returned 4
	[0085.378] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.378] lstrlenW (lpString=".xlsx") returned 5
	[0085.378] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0085.378] lstrlenW (lpString=".ppt") returned 4
	[0085.378] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.378] lstrlenW (lpString=".zip") returned 4
	[0085.378] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.378] lstrlenW (lpString=".rar") returned 4
	[0085.378] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.378] lstrlenW (lpString=".bz2") returned 4
	[0085.378] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.378] lstrlenW (lpString=".7z") returned 3
	[0085.378] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.378] lstrlenW (lpString=".dbf") returned 4
	[0085.378] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.378] lstrlenW (lpString=".1cd") returned 4
	[0085.378] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.379] lstrlenW (lpString=".jpg") returned 4
	[0085.379] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.379] lstrlenW (lpString=".doc") returned 4
	[0085.379] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.379] lstrlenW (lpString=".docx") returned 5
	[0085.379] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0085.379] lstrlenW (lpString=".pdf") returned 4
	[0085.379] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.379] lstrlenW (lpString=".xls") returned 4
	[0085.379] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.379] lstrlenW (lpString=".xlsx") returned 5
	[0085.379] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0085.379] lstrlenW (lpString=".ppt") returned 4
	[0085.379] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.379] lstrlenW (lpString=".zip") returned 4
	[0085.379] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.379] lstrlenW (lpString=".rar") returned 4
	[0085.379] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.379] lstrlenW (lpString=".bz2") returned 4
	[0085.379] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.379] lstrlenW (lpString=".7z") returned 3
	[0085.380] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.380] lstrlenW (lpString=".dbf") returned 4
	[0085.380] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.380] lstrlenW (lpString=".1cd") returned 4
	[0085.380] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0085.380] lstrlenW (lpString=".jpg") returned 4
	[0085.380] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.380] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.380] lstrlenW (lpString="J0099153.WMF") returned 12
	[0085.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.380] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=13874) returned 1
	[0085.380] CloseHandle (hObject=0x380) returned 1
	[0085.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220
	[0085.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.381] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.381] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0085.381] GetLastError () returned 0x0
	[0085.382] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x3632, lpOverlapped=0x0) returned 1
	[0085.549] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x3640, lpOverlapped=0x0) returned 1
	[0085.550] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.550] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.550] SetEndOfFile (hFile=0x320) returned 1
	[0085.550] CloseHandle (hObject=0x320) returned 1
	[0085.551] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.551] SetEndOfFile (hFile=0x380) returned 1
	[0085.552] CloseHandle (hObject=0x380) returned 1
	[0085.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1
	[0085.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.552] lstrlenW (lpString=".doc") returned 4
	[0085.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.553] lstrlenW (lpString=".docx") returned 5
	[0085.553] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0085.553] lstrlenW (lpString=".pdf") returned 4
	[0085.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.553] lstrlenW (lpString=".xls") returned 4
	[0085.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.553] lstrlenW (lpString=".xlsx") returned 5
	[0085.553] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0085.553] lstrlenW (lpString=".ppt") returned 4
	[0085.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.553] lstrlenW (lpString=".zip") returned 4
	[0085.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.553] lstrlenW (lpString=".rar") returned 4
	[0085.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.554] lstrlenW (lpString=".bz2") returned 4
	[0085.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.554] lstrlenW (lpString=".7z") returned 3
	[0085.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.554] lstrlenW (lpString=".dbf") returned 4
	[0085.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.554] lstrlenW (lpString=".1cd") returned 4
	[0085.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.554] lstrlenW (lpString=".jpg") returned 4
	[0085.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.555] lstrlenW (lpString=".doc") returned 4
	[0085.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.555] lstrlenW (lpString=".docx") returned 5
	[0085.555] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0085.555] lstrlenW (lpString=".pdf") returned 4
	[0085.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.555] lstrlenW (lpString=".xls") returned 4
	[0085.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.555] lstrlenW (lpString=".xlsx") returned 5
	[0085.555] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0085.555] lstrlenW (lpString=".ppt") returned 4
	[0085.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.555] lstrlenW (lpString=".zip") returned 4
	[0085.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.555] lstrlenW (lpString=".rar") returned 4
	[0085.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.556] lstrlenW (lpString=".bz2") returned 4
	[0085.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.556] lstrlenW (lpString=".7z") returned 3
	[0085.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.556] lstrlenW (lpString=".dbf") returned 4
	[0085.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.556] lstrlenW (lpString=".1cd") returned 4
	[0085.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0085.556] lstrlenW (lpString=".jpg") returned 4
	[0085.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.556] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.556] lstrlenW (lpString="J0099161.JPG") returned 12
	[0085.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.557] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=7154) returned 1
	[0085.557] CloseHandle (hObject=0x380) returned 1
	[0085.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220
	[0085.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.557] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.558] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0085.558] GetLastError () returned 0x0
	[0085.558] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1bf2, lpOverlapped=0x0) returned 1
	[0085.560] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1c00, lpOverlapped=0x0) returned 1
	[0085.561] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.561] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.561] SetEndOfFile (hFile=0x320) returned 1
	[0085.561] CloseHandle (hObject=0x320) returned 1
	[0085.561] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.561] SetEndOfFile (hFile=0x380) returned 1
	[0085.562] CloseHandle (hObject=0x380) returned 1
	[0085.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1
	[0085.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.563] lstrlenW (lpString=".doc") returned 4
	[0085.563] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.563] lstrlenW (lpString=".docx") returned 5
	[0085.563] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0085.563] lstrlenW (lpString=".pdf") returned 4
	[0085.563] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.563] lstrlenW (lpString=".xls") returned 4
	[0085.563] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.563] lstrlenW (lpString=".xlsx") returned 5
	[0085.563] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0085.563] lstrlenW (lpString=".ppt") returned 4
	[0085.563] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.563] lstrlenW (lpString=".zip") returned 4
	[0085.563] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.563] lstrlenW (lpString=".rar") returned 4
	[0085.563] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.563] lstrlenW (lpString=".bz2") returned 4
	[0085.563] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.563] lstrlenW (lpString=".7z") returned 3
	[0085.563] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.563] lstrlenW (lpString=".dbf") returned 4
	[0085.563] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.563] lstrlenW (lpString=".1cd") returned 4
	[0085.564] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.564] lstrlenW (lpString=".jpg") returned 4
	[0085.564] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.564] lstrlenW (lpString=".doc") returned 4
	[0085.564] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.564] lstrlenW (lpString=".docx") returned 5
	[0085.564] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0085.564] lstrlenW (lpString=".pdf") returned 4
	[0085.564] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.564] lstrlenW (lpString=".xls") returned 4
	[0085.564] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.564] lstrlenW (lpString=".xlsx") returned 5
	[0085.564] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0085.564] lstrlenW (lpString=".ppt") returned 4
	[0085.564] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.564] lstrlenW (lpString=".zip") returned 4
	[0085.564] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.564] lstrlenW (lpString=".rar") returned 4
	[0085.564] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.564] lstrlenW (lpString=".bz2") returned 4
	[0085.564] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.564] lstrlenW (lpString=".7z") returned 3
	[0085.564] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.565] lstrlenW (lpString=".dbf") returned 4
	[0085.565] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.565] lstrlenW (lpString=".1cd") returned 4
	[0085.565] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0085.565] lstrlenW (lpString=".jpg") returned 4
	[0085.565] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.565] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0085.565] lstrlenW (lpString="J0099162.JPG") returned 12
	[0085.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.565] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=19656) returned 1
	[0085.565] CloseHandle (hObject=0x380) returned 1
	[0085.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220
	[0085.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.566] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.566] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0085.566] GetLastError () returned 0x0
	[0085.566] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x4cc8, lpOverlapped=0x0) returned 1
	[0085.568] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0085.569] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.569] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.569] SetEndOfFile (hFile=0x320) returned 1
	[0085.570] CloseHandle (hObject=0x320) returned 1
	[0085.570] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.570] SetEndOfFile (hFile=0x380) returned 1
	[0085.571] CloseHandle (hObject=0x380) returned 1
	[0085.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1
	[0085.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.571] lstrlenW (lpString=".doc") returned 4
	[0085.571] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.571] lstrlenW (lpString=".docx") returned 5
	[0085.571] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0085.571] lstrlenW (lpString=".pdf") returned 4
	[0085.571] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.571] lstrlenW (lpString=".xls") returned 4
	[0085.571] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.572] lstrlenW (lpString=".xlsx") returned 5
	[0085.572] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0085.572] lstrlenW (lpString=".ppt") returned 4
	[0085.572] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.572] lstrlenW (lpString=".zip") returned 4
	[0085.572] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.572] lstrlenW (lpString=".rar") returned 4
	[0085.572] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.572] lstrlenW (lpString=".bz2") returned 4
	[0085.572] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.572] lstrlenW (lpString=".7z") returned 3
	[0085.572] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.572] lstrlenW (lpString=".dbf") returned 4
	[0085.572] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.572] lstrlenW (lpString=".1cd") returned 4
	[0085.572] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.572] lstrlenW (lpString=".jpg") returned 4
	[0085.572] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.572] lstrlenW (lpString=".doc") returned 4
	[0085.572] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0085.572] lstrlenW (lpString=".docx") returned 5
	[0085.572] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0085.573] lstrlenW (lpString=".pdf") returned 4
	[0085.573] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0085.573] lstrlenW (lpString=".xls") returned 4
	[0085.573] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0085.573] lstrlenW (lpString=".xlsx") returned 5
	[0085.573] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0085.573] lstrlenW (lpString=".ppt") returned 4
	[0085.573] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0085.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.573] lstrlenW (lpString=".zip") returned 4
	[0085.573] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0085.573] lstrlenW (lpString=".rar") returned 4
	[0085.573] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0085.573] lstrlenW (lpString=".bz2") returned 4
	[0085.573] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0085.573] lstrlenW (lpString=".7z") returned 3
	[0085.573] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0085.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.573] lstrlenW (lpString=".dbf") returned 4
	[0085.573] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0085.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.573] lstrlenW (lpString=".1cd") returned 4
	[0085.573] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0085.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0085.573] lstrlenW (lpString=".jpg") returned 4
	[0085.573] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0085.574] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.574] lstrlenW (lpString="J0099163.WMF") returned 12
	[0085.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.574] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=22356) returned 1
	[0085.574] CloseHandle (hObject=0x380) returned 1
	[0085.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220
	[0085.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.574] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.574] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0085.575] GetLastError () returned 0x0
	[0085.575] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x5754, lpOverlapped=0x0) returned 1
	[0085.576] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x5760, lpOverlapped=0x0) returned 1
	[0085.578] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.578] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.578] SetEndOfFile (hFile=0x320) returned 1
	[0085.578] CloseHandle (hObject=0x320) returned 1
	[0085.578] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.578] SetEndOfFile (hFile=0x380) returned 1
	[0085.579] CloseHandle (hObject=0x380) returned 1
	[0085.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1
	[0085.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.579] lstrlenW (lpString=".doc") returned 4
	[0085.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.579] lstrlenW (lpString=".docx") returned 5
	[0085.579] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0085.579] lstrlenW (lpString=".pdf") returned 4
	[0085.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.580] lstrlenW (lpString=".xls") returned 4
	[0085.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.580] lstrlenW (lpString=".xlsx") returned 5
	[0085.580] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0085.580] lstrlenW (lpString=".ppt") returned 4
	[0085.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.580] lstrlenW (lpString=".zip") returned 4
	[0085.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.580] lstrlenW (lpString=".rar") returned 4
	[0085.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.580] lstrlenW (lpString=".bz2") returned 4
	[0085.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.580] lstrlenW (lpString=".7z") returned 3
	[0085.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.580] lstrlenW (lpString=".dbf") returned 4
	[0085.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.580] lstrlenW (lpString=".1cd") returned 4
	[0085.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.580] lstrlenW (lpString=".jpg") returned 4
	[0085.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.580] lstrlenW (lpString=".doc") returned 4
	[0085.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.581] lstrlenW (lpString=".docx") returned 5
	[0085.581] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0085.581] lstrlenW (lpString=".pdf") returned 4
	[0085.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.581] lstrlenW (lpString=".xls") returned 4
	[0085.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.581] lstrlenW (lpString=".xlsx") returned 5
	[0085.581] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0085.581] lstrlenW (lpString=".ppt") returned 4
	[0085.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.581] lstrlenW (lpString=".zip") returned 4
	[0085.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.581] lstrlenW (lpString=".rar") returned 4
	[0085.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.581] lstrlenW (lpString=".bz2") returned 4
	[0085.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.581] lstrlenW (lpString=".7z") returned 3
	[0085.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.581] lstrlenW (lpString=".dbf") returned 4
	[0085.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.581] lstrlenW (lpString=".1cd") returned 4
	[0085.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0085.581] lstrlenW (lpString=".jpg") returned 4
	[0085.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.582] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0085.582] lstrlenW (lpString="J0099164.WMF") returned 12
	[0085.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.582] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=21946) returned 1
	[0085.582] CloseHandle (hObject=0x380) returned 1
	[0085.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220
	[0085.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.582] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.582] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0085.583] GetLastError () returned 0x0
	[0085.583] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x55ba, lpOverlapped=0x0) returned 1
	[0085.935] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x55c0, lpOverlapped=0x0) returned 1
	[0085.939] ReadFile (in: hFile=0x380, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.939] WriteFile (in: hFile=0x320, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.939] SetEndOfFile (hFile=0x320) returned 1
	[0085.939] CloseHandle (hObject=0x320) returned 1
	[0085.939] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.940] SetEndOfFile (hFile=0x380) returned 1
	[0085.941] CloseHandle (hObject=0x380) returned 1
	[0085.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0085.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1
	[0086.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.171] lstrlenW (lpString=".doc") returned 4
	[0086.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.171] lstrlenW (lpString=".docx") returned 5
	[0086.171] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0086.171] lstrlenW (lpString=".pdf") returned 4
	[0086.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.172] lstrlenW (lpString=".xls") returned 4
	[0086.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.172] lstrlenW (lpString=".xlsx") returned 5
	[0086.172] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0086.172] lstrlenW (lpString=".ppt") returned 4
	[0086.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.172] lstrlenW (lpString=".zip") returned 4
	[0086.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.172] lstrlenW (lpString=".rar") returned 4
	[0086.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.172] lstrlenW (lpString=".bz2") returned 4
	[0086.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.172] lstrlenW (lpString=".7z") returned 3
	[0086.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.172] lstrlenW (lpString=".dbf") returned 4
	[0086.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.172] lstrlenW (lpString=".1cd") returned 4
	[0086.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.173] lstrlenW (lpString=".jpg") returned 4
	[0086.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.173] lstrlenW (lpString=".doc") returned 4
	[0086.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.173] lstrlenW (lpString=".docx") returned 5
	[0086.173] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0086.173] lstrlenW (lpString=".pdf") returned 4
	[0086.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.173] lstrlenW (lpString=".xls") returned 4
	[0086.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.173] lstrlenW (lpString=".xlsx") returned 5
	[0086.173] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0086.173] lstrlenW (lpString=".ppt") returned 4
	[0086.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.173] lstrlenW (lpString=".zip") returned 4
	[0086.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.173] lstrlenW (lpString=".rar") returned 4
	[0086.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.173] lstrlenW (lpString=".bz2") returned 4
	[0086.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.174] lstrlenW (lpString=".7z") returned 3
	[0086.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.174] lstrlenW (lpString=".dbf") returned 4
	[0086.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.174] lstrlenW (lpString=".1cd") returned 4
	[0086.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0086.174] lstrlenW (lpString=".jpg") returned 4
	[0086.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.174] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0086.174] lstrlenW (lpString="J0099177.WMF") returned 12
	[0086.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.322] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=5386) returned 1
	[0086.331] CloseHandle (hObject=0x390) returned 1
	[0086.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220
	[0086.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.354] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.354] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.354] GetLastError () returned 0x0
	[0086.354] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x150a, lpOverlapped=0x0) returned 1
	[0086.355] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1510, lpOverlapped=0x0) returned 1
	[0086.356] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.357] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.357] SetEndOfFile (hFile=0x34c) returned 1
	[0086.357] CloseHandle (hObject=0x34c) returned 1
	[0086.357] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.357] SetEndOfFile (hFile=0x340) returned 1
	[0086.358] CloseHandle (hObject=0x340) returned 1
	[0086.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1
	[0086.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.358] lstrlenW (lpString=".doc") returned 4
	[0086.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.358] lstrlenW (lpString=".docx") returned 5
	[0086.358] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0086.358] lstrlenW (lpString=".pdf") returned 4
	[0086.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.358] lstrlenW (lpString=".xls") returned 4
	[0086.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.359] lstrlenW (lpString=".xlsx") returned 5
	[0086.359] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0086.359] lstrlenW (lpString=".ppt") returned 4
	[0086.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.359] lstrlenW (lpString=".zip") returned 4
	[0086.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.359] lstrlenW (lpString=".rar") returned 4
	[0086.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.359] lstrlenW (lpString=".bz2") returned 4
	[0086.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.359] lstrlenW (lpString=".7z") returned 3
	[0086.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.359] lstrlenW (lpString=".dbf") returned 4
	[0086.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.359] lstrlenW (lpString=".1cd") returned 4
	[0086.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.359] lstrlenW (lpString=".jpg") returned 4
	[0086.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.359] lstrlenW (lpString=".doc") returned 4
	[0086.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.359] lstrlenW (lpString=".docx") returned 5
	[0086.360] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0086.360] lstrlenW (lpString=".pdf") returned 4
	[0086.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.360] lstrlenW (lpString=".xls") returned 4
	[0086.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.360] lstrlenW (lpString=".xlsx") returned 5
	[0086.360] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0086.360] lstrlenW (lpString=".ppt") returned 4
	[0086.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.360] lstrlenW (lpString=".zip") returned 4
	[0086.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.360] lstrlenW (lpString=".rar") returned 4
	[0086.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.360] lstrlenW (lpString=".bz2") returned 4
	[0086.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.360] lstrlenW (lpString=".7z") returned 3
	[0086.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.360] lstrlenW (lpString=".dbf") returned 4
	[0086.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.360] lstrlenW (lpString=".1cd") returned 4
	[0086.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0086.360] lstrlenW (lpString=".jpg") returned 4
	[0086.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.361] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0086.361] lstrlenW (lpString="J0099182.WMF") returned 12
	[0086.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.361] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3840) returned 1
	[0086.361] CloseHandle (hObject=0x340) returned 1
	[0086.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220
	[0086.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.361] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.361] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.362] GetLastError () returned 0x0
	[0086.362] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xf00, lpOverlapped=0x0) returned 1
	[0086.363] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xf10, lpOverlapped=0x0) returned 1
	[0086.365] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.365] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.365] SetEndOfFile (hFile=0x34c) returned 1
	[0086.365] CloseHandle (hObject=0x34c) returned 1
	[0086.365] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.365] SetEndOfFile (hFile=0x340) returned 1
	[0086.366] CloseHandle (hObject=0x340) returned 1
	[0086.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1
	[0086.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.366] lstrlenW (lpString=".doc") returned 4
	[0086.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.366] lstrlenW (lpString=".docx") returned 5
	[0086.366] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0086.367] lstrlenW (lpString=".pdf") returned 4
	[0086.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.367] lstrlenW (lpString=".xls") returned 4
	[0086.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.367] lstrlenW (lpString=".xlsx") returned 5
	[0086.367] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0086.367] lstrlenW (lpString=".ppt") returned 4
	[0086.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.367] lstrlenW (lpString=".zip") returned 4
	[0086.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.367] lstrlenW (lpString=".rar") returned 4
	[0086.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.367] lstrlenW (lpString=".bz2") returned 4
	[0086.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.367] lstrlenW (lpString=".7z") returned 3
	[0086.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.367] lstrlenW (lpString=".dbf") returned 4
	[0086.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.367] lstrlenW (lpString=".1cd") returned 4
	[0086.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.367] lstrlenW (lpString=".jpg") returned 4
	[0086.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.368] lstrlenW (lpString=".doc") returned 4
	[0086.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.368] lstrlenW (lpString=".docx") returned 5
	[0086.368] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0086.368] lstrlenW (lpString=".pdf") returned 4
	[0086.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.368] lstrlenW (lpString=".xls") returned 4
	[0086.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.368] lstrlenW (lpString=".xlsx") returned 5
	[0086.368] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0086.368] lstrlenW (lpString=".ppt") returned 4
	[0086.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.368] lstrlenW (lpString=".zip") returned 4
	[0086.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.368] lstrlenW (lpString=".rar") returned 4
	[0086.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.368] lstrlenW (lpString=".bz2") returned 4
	[0086.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.368] lstrlenW (lpString=".7z") returned 3
	[0086.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.368] lstrlenW (lpString=".dbf") returned 4
	[0086.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.368] lstrlenW (lpString=".1cd") returned 4
	[0086.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0086.368] lstrlenW (lpString=".jpg") returned 4
	[0086.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.369] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0086.369] lstrlenW (lpString="J0099183.WMF") returned 12
	[0086.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.370] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4946) returned 1
	[0086.370] CloseHandle (hObject=0x340) returned 1
	[0086.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220
	[0086.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.370] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.370] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.371] GetLastError () returned 0x0
	[0086.371] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1352, lpOverlapped=0x0) returned 1
	[0086.372] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1360, lpOverlapped=0x0) returned 1
	[0086.373] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.373] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.373] SetEndOfFile (hFile=0x34c) returned 1
	[0086.374] CloseHandle (hObject=0x34c) returned 1
	[0086.374] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.374] SetEndOfFile (hFile=0x340) returned 1
	[0086.374] CloseHandle (hObject=0x340) returned 1
	[0086.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1
	[0086.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.375] lstrlenW (lpString=".doc") returned 4
	[0086.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.375] lstrlenW (lpString=".docx") returned 5
	[0086.375] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0086.375] lstrlenW (lpString=".pdf") returned 4
	[0086.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.375] lstrlenW (lpString=".xls") returned 4
	[0086.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.375] lstrlenW (lpString=".xlsx") returned 5
	[0086.375] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0086.375] lstrlenW (lpString=".ppt") returned 4
	[0086.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.375] lstrlenW (lpString=".zip") returned 4
	[0086.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.376] lstrlenW (lpString=".rar") returned 4
	[0086.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.376] lstrlenW (lpString=".bz2") returned 4
	[0086.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.376] lstrlenW (lpString=".7z") returned 3
	[0086.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.376] lstrlenW (lpString=".dbf") returned 4
	[0086.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.376] lstrlenW (lpString=".1cd") returned 4
	[0086.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.376] lstrlenW (lpString=".jpg") returned 4
	[0086.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.376] lstrlenW (lpString=".doc") returned 4
	[0086.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.376] lstrlenW (lpString=".docx") returned 5
	[0086.376] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0086.376] lstrlenW (lpString=".pdf") returned 4
	[0086.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.377] lstrlenW (lpString=".xls") returned 4
	[0086.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.377] lstrlenW (lpString=".xlsx") returned 5
	[0086.377] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0086.377] lstrlenW (lpString=".ppt") returned 4
	[0086.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.377] lstrlenW (lpString=".zip") returned 4
	[0086.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.377] lstrlenW (lpString=".rar") returned 4
	[0086.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.377] lstrlenW (lpString=".bz2") returned 4
	[0086.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.377] lstrlenW (lpString=".7z") returned 3
	[0086.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.377] lstrlenW (lpString=".dbf") returned 4
	[0086.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.377] lstrlenW (lpString=".1cd") returned 4
	[0086.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0086.377] lstrlenW (lpString=".jpg") returned 4
	[0086.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.378] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0086.378] lstrlenW (lpString="J0099184.WMF") returned 12
	[0086.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.378] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=4118) returned 1
	[0086.378] CloseHandle (hObject=0x340) returned 1
	[0086.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220
	[0086.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.379] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.379] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.379] GetLastError () returned 0x0
	[0086.379] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x1016, lpOverlapped=0x0) returned 1
	[0086.381] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1020, lpOverlapped=0x0) returned 1
	[0086.382] ReadFile (in: hFile=0x340, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.382] WriteFile (in: hFile=0x34c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.382] SetEndOfFile (hFile=0x34c) returned 1
	[0086.382] CloseHandle (hObject=0x34c) returned 1
	[0086.382] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.382] SetEndOfFile (hFile=0x340) returned 1
	[0086.383] CloseHandle (hObject=0x340) returned 1
	[0086.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1
	[0086.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.383] lstrlenW (lpString=".doc") returned 4
	[0086.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.383] lstrlenW (lpString=".docx") returned 5
	[0086.383] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0086.383] lstrlenW (lpString=".pdf") returned 4
	[0086.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.384] lstrlenW (lpString=".xls") returned 4
	[0086.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.384] lstrlenW (lpString=".xlsx") returned 5
	[0086.384] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0086.384] lstrlenW (lpString=".ppt") returned 4
	[0086.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.384] lstrlenW (lpString=".zip") returned 4
	[0086.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.384] lstrlenW (lpString=".rar") returned 4
	[0086.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.384] lstrlenW (lpString=".bz2") returned 4
	[0086.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.384] lstrlenW (lpString=".7z") returned 3
	[0086.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.384] lstrlenW (lpString=".dbf") returned 4
	[0086.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.384] lstrlenW (lpString=".1cd") returned 4
	[0086.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.385] lstrlenW (lpString=".jpg") returned 4
	[0086.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.385] lstrlenW (lpString=".doc") returned 4
	[0086.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.385] lstrlenW (lpString=".docx") returned 5
	[0086.385] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0086.385] lstrlenW (lpString=".pdf") returned 4
	[0086.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.385] lstrlenW (lpString=".xls") returned 4
	[0086.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.385] lstrlenW (lpString=".xlsx") returned 5
	[0086.385] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0086.385] lstrlenW (lpString=".ppt") returned 4
	[0086.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.385] lstrlenW (lpString=".zip") returned 4
	[0086.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.385] lstrlenW (lpString=".rar") returned 4
	[0086.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.385] lstrlenW (lpString=".bz2") returned 4
	[0086.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.386] lstrlenW (lpString=".7z") returned 3
	[0086.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.386] lstrlenW (lpString=".dbf") returned 4
	[0086.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.386] lstrlenW (lpString=".1cd") returned 4
	[0086.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0086.386] lstrlenW (lpString=".jpg") returned 4
	[0086.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.386] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0086.386] lstrlenW (lpString="J0099185.JPG") returned 12
	[0086.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.773] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=3282) returned 1
	[0086.773] CloseHandle (hObject=0x37c) returned 1
	[0086.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220
	[0086.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.773] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.773] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0086.774] GetLastError () returned 0x0
	[0086.774] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0xcd2, lpOverlapped=0x0) returned 1
	[0086.775] WriteFile (in: hFile=0x354, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xce0, lpOverlapped=0x0) returned 1
	[0086.776] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.776] WriteFile (in: hFile=0x354, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.777] SetEndOfFile (hFile=0x354) returned 1
	[0086.777] CloseHandle (hObject=0x354) returned 1
	[0086.777] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.777] SetEndOfFile (hFile=0x37c) returned 1
	[0086.778] CloseHandle (hObject=0x37c) returned 1
	[0086.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1
	[0086.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.778] lstrlenW (lpString=".doc") returned 4
	[0086.778] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.779] lstrlenW (lpString=".docx") returned 5
	[0086.779] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0086.779] lstrlenW (lpString=".pdf") returned 4
	[0086.779] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.779] lstrlenW (lpString=".xls") returned 4
	[0086.779] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.779] lstrlenW (lpString=".xlsx") returned 5
	[0086.779] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0086.779] lstrlenW (lpString=".ppt") returned 4
	[0086.779] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.779] lstrlenW (lpString=".zip") returned 4
	[0086.779] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.779] lstrlenW (lpString=".rar") returned 4
	[0086.779] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.779] lstrlenW (lpString=".bz2") returned 4
	[0086.779] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.779] lstrlenW (lpString=".7z") returned 3
	[0086.779] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.780] lstrlenW (lpString=".dbf") returned 4
	[0086.780] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.780] lstrlenW (lpString=".1cd") returned 4
	[0086.780] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.780] lstrlenW (lpString=".jpg") returned 4
	[0086.780] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.780] lstrlenW (lpString=".doc") returned 4
	[0086.780] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0086.780] lstrlenW (lpString=".docx") returned 5
	[0086.780] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0086.780] lstrlenW (lpString=".pdf") returned 4
	[0086.780] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0086.780] lstrlenW (lpString=".xls") returned 4
	[0086.780] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0086.781] lstrlenW (lpString=".xlsx") returned 5
	[0086.781] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0086.781] lstrlenW (lpString=".ppt") returned 4
	[0086.781] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0086.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.781] lstrlenW (lpString=".zip") returned 4
	[0086.781] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0086.781] lstrlenW (lpString=".rar") returned 4
	[0086.781] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0086.781] lstrlenW (lpString=".bz2") returned 4
	[0086.781] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0086.781] lstrlenW (lpString=".7z") returned 3
	[0086.781] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0086.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.781] lstrlenW (lpString=".dbf") returned 4
	[0086.781] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0086.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.781] lstrlenW (lpString=".1cd") returned 4
	[0086.781] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0086.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0086.782] lstrlenW (lpString=".jpg") returned 4
	[0086.782] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0086.782] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0086.782] lstrlenW (lpString="J0099198.GIF") returned 12
	[0086.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.782] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=5259) returned 1
	[0086.782] CloseHandle (hObject=0x37c) returned 1
	[0086.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220
	[0086.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.783] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.783] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0086.783] GetLastError () returned 0x0
	[0086.783] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x148b, lpOverlapped=0x0) returned 1
	[0086.785] WriteFile (in: hFile=0x354, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x1490, lpOverlapped=0x0) returned 1
	[0086.786] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.786] WriteFile (in: hFile=0x354, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.786] SetEndOfFile (hFile=0x354) returned 1
	[0086.786] CloseHandle (hObject=0x354) returned 1
	[0086.786] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.786] SetEndOfFile (hFile=0x37c) returned 1
	[0086.787] CloseHandle (hObject=0x37c) returned 1
	[0086.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1
	[0086.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.788] lstrlenW (lpString=".doc") returned 4
	[0086.788] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.788] lstrlenW (lpString=".docx") returned 5
	[0086.788] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0086.788] lstrlenW (lpString=".pdf") returned 4
	[0086.788] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.788] lstrlenW (lpString=".xls") returned 4
	[0086.788] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.788] lstrlenW (lpString=".xlsx") returned 5
	[0086.788] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0086.788] lstrlenW (lpString=".ppt") returned 4
	[0086.788] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.789] lstrlenW (lpString=".zip") returned 4
	[0086.789] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.789] lstrlenW (lpString=".rar") returned 4
	[0086.789] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.789] lstrlenW (lpString=".bz2") returned 4
	[0086.789] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.789] lstrlenW (lpString=".7z") returned 3
	[0086.789] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.789] lstrlenW (lpString=".dbf") returned 4
	[0086.789] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.789] lstrlenW (lpString=".1cd") returned 4
	[0086.789] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.789] lstrlenW (lpString=".jpg") returned 4
	[0086.789] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.789] lstrlenW (lpString=".doc") returned 4
	[0086.790] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.790] lstrlenW (lpString=".docx") returned 5
	[0086.790] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0086.790] lstrlenW (lpString=".pdf") returned 4
	[0086.790] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.790] lstrlenW (lpString=".xls") returned 4
	[0086.790] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.790] lstrlenW (lpString=".xlsx") returned 5
	[0086.790] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0086.790] lstrlenW (lpString=".ppt") returned 4
	[0086.790] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.790] lstrlenW (lpString=".zip") returned 4
	[0086.790] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.790] lstrlenW (lpString=".rar") returned 4
	[0086.790] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.790] lstrlenW (lpString=".bz2") returned 4
	[0086.790] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.790] lstrlenW (lpString=".7z") returned 3
	[0086.790] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.790] lstrlenW (lpString=".dbf") returned 4
	[0086.791] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.791] lstrlenW (lpString=".1cd") returned 4
	[0086.791] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0086.791] lstrlenW (lpString=".jpg") returned 4
	[0086.791] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.791] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0086.791] lstrlenW (lpString="J0099199.GIF") returned 12
	[0086.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.792] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=33975) returned 1
	[0086.792] CloseHandle (hObject=0x37c) returned 1
	[0086.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220
	[0086.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.793] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.793] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0086.793] GetLastError () returned 0x0
	[0086.793] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x84b7, lpOverlapped=0x0) returned 1
	[0086.795] WriteFile (in: hFile=0x354, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x84c0, lpOverlapped=0x0) returned 1
	[0086.796] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.797] WriteFile (in: hFile=0x354, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.797] SetEndOfFile (hFile=0x354) returned 1
	[0086.797] CloseHandle (hObject=0x354) returned 1
	[0086.797] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.797] SetEndOfFile (hFile=0x37c) returned 1
	[0086.798] CloseHandle (hObject=0x37c) returned 1
	[0086.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0086.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1
	[0086.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.799] lstrlenW (lpString=".doc") returned 4
	[0086.799] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.799] lstrlenW (lpString=".docx") returned 5
	[0086.799] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1
	[0086.799] lstrlenW (lpString=".pdf") returned 4
	[0086.799] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.799] lstrlenW (lpString=".xls") returned 4
	[0086.799] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.799] lstrlenW (lpString=".xlsx") returned 5
	[0086.799] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1
	[0086.799] lstrlenW (lpString=".ppt") returned 4
	[0086.799] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.799] lstrlenW (lpString=".zip") returned 4
	[0086.799] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.799] lstrlenW (lpString=".rar") returned 4
	[0086.799] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.799] lstrlenW (lpString=".bz2") returned 4
	[0086.800] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.800] lstrlenW (lpString=".7z") returned 3
	[0086.800] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.800] lstrlenW (lpString=".dbf") returned 4
	[0086.800] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.800] lstrlenW (lpString=".1cd") returned 4
	[0086.800] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.800] lstrlenW (lpString=".jpg") returned 4
	[0086.800] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.800] lstrlenW (lpString=".doc") returned 4
	[0086.800] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0086.800] lstrlenW (lpString=".docx") returned 5
	[0086.800] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1
	[0086.800] lstrlenW (lpString=".pdf") returned 4
	[0086.801] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0086.801] lstrlenW (lpString=".xls") returned 4
	[0086.801] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0086.801] lstrlenW (lpString=".xlsx") returned 5
	[0086.801] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1
	[0086.801] lstrlenW (lpString=".ppt") returned 4
	[0086.801] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0086.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.801] lstrlenW (lpString=".zip") returned 4
	[0086.801] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0086.801] lstrlenW (lpString=".rar") returned 4
	[0086.801] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0086.801] lstrlenW (lpString=".bz2") returned 4
	[0086.801] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0086.801] lstrlenW (lpString=".7z") returned 3
	[0086.801] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0086.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.801] lstrlenW (lpString=".dbf") returned 4
	[0086.801] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0086.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.801] lstrlenW (lpString=".1cd") returned 4
	[0086.801] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0086.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0086.801] lstrlenW (lpString=".jpg") returned 4
	[0086.802] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0086.802] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0086.802] lstrlenW (lpString="J0099200.GIF") returned 12
	[0086.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.802] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=16543) returned 1
	[0086.802] CloseHandle (hObject=0x37c) returned 1
	[0086.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220
	[0086.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.802] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.803] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0086.803] GetLastError () returned 0x0
	[0086.803] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x409f, lpOverlapped=0x0) returned 1
	[0086.804] WriteFile (in: hFile=0x354, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x40a0, lpOverlapped=0x0) returned 1
	[0086.806] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.806] WriteFile (in: hFile=0x354, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.806] SetEndOfFile (hFile=0x354) returned 1
	[0086.806] CloseHandle (hObject=0x354) returned 1
	[0086.806] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.806] SetEndOfFile (hFile=0x37c) returned 1
	[0087.193] CloseHandle (hObject=0x37c) returned 1
	[0087.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1
	[0087.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.194] lstrlenW (lpString=".doc") returned 4
	[0087.194] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.194] lstrlenW (lpString=".docx") returned 5
	[0087.194] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1
	[0087.194] lstrlenW (lpString=".pdf") returned 4
	[0087.194] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.194] lstrlenW (lpString=".xls") returned 4
	[0087.195] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.195] lstrlenW (lpString=".xlsx") returned 5
	[0087.195] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1
	[0087.195] lstrlenW (lpString=".ppt") returned 4
	[0087.195] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.195] lstrlenW (lpString=".zip") returned 4
	[0087.195] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.195] lstrlenW (lpString=".rar") returned 4
	[0087.195] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.195] lstrlenW (lpString=".bz2") returned 4
	[0087.195] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.195] lstrlenW (lpString=".7z") returned 3
	[0087.195] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.195] lstrlenW (lpString=".dbf") returned 4
	[0087.196] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.196] lstrlenW (lpString=".1cd") returned 4
	[0087.196] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.196] lstrlenW (lpString=".jpg") returned 4
	[0087.196] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.196] lstrlenW (lpString=".doc") returned 4
	[0087.196] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.196] lstrlenW (lpString=".docx") returned 5
	[0087.196] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1
	[0087.196] lstrlenW (lpString=".pdf") returned 4
	[0087.196] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.196] lstrlenW (lpString=".xls") returned 4
	[0087.196] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.197] lstrlenW (lpString=".xlsx") returned 5
	[0087.197] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1
	[0087.197] lstrlenW (lpString=".ppt") returned 4
	[0087.197] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.197] lstrlenW (lpString=".zip") returned 4
	[0087.197] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.197] lstrlenW (lpString=".rar") returned 4
	[0087.197] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.197] lstrlenW (lpString=".bz2") returned 4
	[0087.197] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.197] lstrlenW (lpString=".7z") returned 3
	[0087.198] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.198] lstrlenW (lpString=".dbf") returned 4
	[0087.198] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.198] lstrlenW (lpString=".1cd") returned 4
	[0087.198] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0087.198] lstrlenW (lpString=".jpg") returned 4
	[0087.198] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.198] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0087.198] lstrlenW (lpString="J0101863.BMP") returned 12
	[0087.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0087.199] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=32184) returned 1
	[0087.199] CloseHandle (hObject=0x37c) returned 1
	[0087.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220
	[0087.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0087.199] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.199] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0087.200] GetLastError () returned 0x0
	[0087.200] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0087.202] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0087.203] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.203] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.203] SetEndOfFile (hFile=0x33c) returned 1
	[0087.204] CloseHandle (hObject=0x33c) returned 1
	[0087.204] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.204] SetEndOfFile (hFile=0x37c) returned 1
	[0087.205] CloseHandle (hObject=0x37c) returned 1
	[0087.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1
	[0087.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.205] lstrlenW (lpString=".doc") returned 4
	[0087.205] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.205] lstrlenW (lpString=".docx") returned 5
	[0087.205] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1
	[0087.205] lstrlenW (lpString=".pdf") returned 4
	[0087.205] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.206] lstrlenW (lpString=".xls") returned 4
	[0087.206] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.206] lstrlenW (lpString=".xlsx") returned 5
	[0087.206] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1
	[0087.206] lstrlenW (lpString=".ppt") returned 4
	[0087.206] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.206] lstrlenW (lpString=".zip") returned 4
	[0087.206] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.206] lstrlenW (lpString=".rar") returned 4
	[0087.206] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.206] lstrlenW (lpString=".bz2") returned 4
	[0087.206] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.206] lstrlenW (lpString=".7z") returned 3
	[0087.206] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.206] lstrlenW (lpString=".dbf") returned 4
	[0087.206] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.206] lstrlenW (lpString=".1cd") returned 4
	[0087.206] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.207] lstrlenW (lpString=".jpg") returned 4
	[0087.207] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.207] lstrlenW (lpString=".doc") returned 4
	[0087.207] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.207] lstrlenW (lpString=".docx") returned 5
	[0087.207] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1
	[0087.207] lstrlenW (lpString=".pdf") returned 4
	[0087.207] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.207] lstrlenW (lpString=".xls") returned 4
	[0087.207] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.207] lstrlenW (lpString=".xlsx") returned 5
	[0087.207] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1
	[0087.207] lstrlenW (lpString=".ppt") returned 4
	[0087.207] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.207] lstrlenW (lpString=".zip") returned 4
	[0087.207] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.207] lstrlenW (lpString=".rar") returned 4
	[0087.207] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.207] lstrlenW (lpString=".bz2") returned 4
	[0087.207] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.207] lstrlenW (lpString=".7z") returned 3
	[0087.207] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.207] lstrlenW (lpString=".dbf") returned 4
	[0087.207] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.208] lstrlenW (lpString=".1cd") returned 4
	[0087.208] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0087.208] lstrlenW (lpString=".jpg") returned 4
	[0087.208] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.208] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0087.208] lstrlenW (lpString="J0101864.BMP") returned 12
	[0087.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0087.208] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=31968) returned 1
	[0087.208] CloseHandle (hObject=0x37c) returned 1
	[0087.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220
	[0087.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0087.209] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.209] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0087.209] GetLastError () returned 0x0
	[0087.209] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x7ce0, lpOverlapped=0x0) returned 1
	[0087.211] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x7cf0, lpOverlapped=0x0) returned 1
	[0087.212] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.212] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.213] SetEndOfFile (hFile=0x33c) returned 1
	[0087.213] CloseHandle (hObject=0x33c) returned 1
	[0087.213] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.213] SetEndOfFile (hFile=0x37c) returned 1
	[0087.214] CloseHandle (hObject=0x37c) returned 1
	[0087.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1
	[0087.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.215] lstrlenW (lpString=".doc") returned 4
	[0087.215] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.215] lstrlenW (lpString=".docx") returned 5
	[0087.215] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1
	[0087.215] lstrlenW (lpString=".pdf") returned 4
	[0087.215] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.215] lstrlenW (lpString=".xls") returned 4
	[0087.215] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.215] lstrlenW (lpString=".xlsx") returned 5
	[0087.215] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1
	[0087.215] lstrlenW (lpString=".ppt") returned 4
	[0087.215] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.215] lstrlenW (lpString=".zip") returned 4
	[0087.215] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.215] lstrlenW (lpString=".rar") returned 4
	[0087.215] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.215] lstrlenW (lpString=".bz2") returned 4
	[0087.215] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.215] lstrlenW (lpString=".7z") returned 3
	[0087.215] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.215] lstrlenW (lpString=".dbf") returned 4
	[0087.216] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.216] lstrlenW (lpString=".1cd") returned 4
	[0087.216] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.216] lstrlenW (lpString=".jpg") returned 4
	[0087.216] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.216] lstrlenW (lpString=".doc") returned 4
	[0087.216] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.216] lstrlenW (lpString=".docx") returned 5
	[0087.216] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1
	[0087.216] lstrlenW (lpString=".pdf") returned 4
	[0087.216] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.216] lstrlenW (lpString=".xls") returned 4
	[0087.216] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.216] lstrlenW (lpString=".xlsx") returned 5
	[0087.216] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1
	[0087.216] lstrlenW (lpString=".ppt") returned 4
	[0087.216] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.216] lstrlenW (lpString=".zip") returned 4
	[0087.216] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.216] lstrlenW (lpString=".rar") returned 4
	[0087.216] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.216] lstrlenW (lpString=".bz2") returned 4
	[0087.217] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.217] lstrlenW (lpString=".7z") returned 3
	[0087.217] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.217] lstrlenW (lpString=".dbf") returned 4
	[0087.217] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.217] lstrlenW (lpString=".1cd") returned 4
	[0087.217] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0087.217] lstrlenW (lpString=".jpg") returned 4
	[0087.217] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.217] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0087.217] lstrlenW (lpString="J0101865.BMP") returned 12
	[0087.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0087.218] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=32184) returned 1
	[0087.218] CloseHandle (hObject=0x37c) returned 1
	[0087.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220
	[0087.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0087.218] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.218] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0087.219] GetLastError () returned 0x0
	[0087.219] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0087.221] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0087.222] ReadFile (in: hFile=0x37c, lpBuffer=0x3652020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafecc, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesRead=0x2cafecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.222] WriteFile (in: hFile=0x33c, lpBuffer=0x3652020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc94, lpOverlapped=0x0 | out: lpBuffer=0x3652020*, lpNumberOfBytesWritten=0x2cafc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.222] SetEndOfFile (hFile=0x33c) returned 1
	[0087.222] CloseHandle (hObject=0x33c) returned 1
	[0087.222] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.222] SetEndOfFile (hFile=0x37c) returned 1
	[0087.223] CloseHandle (hObject=0x37c) returned 1
	[0087.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0087.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1
	[0087.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.224] lstrlenW (lpString=".doc") returned 4
	[0087.224] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.224] lstrlenW (lpString=".docx") returned 5
	[0087.224] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1
	[0087.224] lstrlenW (lpString=".pdf") returned 4
	[0087.224] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.224] lstrlenW (lpString=".xls") returned 4
	[0087.224] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.224] lstrlenW (lpString=".xlsx") returned 5
	[0087.224] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1
	[0087.224] lstrlenW (lpString=".ppt") returned 4
	[0087.224] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.225] lstrlenW (lpString=".zip") returned 4
	[0087.225] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.225] lstrlenW (lpString=".rar") returned 4
	[0087.225] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.225] lstrlenW (lpString=".bz2") returned 4
	[0087.225] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.225] lstrlenW (lpString=".7z") returned 3
	[0087.225] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.225] lstrlenW (lpString=".dbf") returned 4
	[0087.225] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.225] lstrlenW (lpString=".1cd") returned 4
	[0087.225] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.225] lstrlenW (lpString=".jpg") returned 4
	[0087.225] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.225] lstrlenW (lpString=".doc") returned 4
	[0087.225] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0087.225] lstrlenW (lpString=".docx") returned 5
	[0087.225] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1
	[0087.225] lstrlenW (lpString=".pdf") returned 4
	[0087.225] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0087.225] lstrlenW (lpString=".xls") returned 4
	[0087.225] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0087.226] lstrlenW (lpString=".xlsx") returned 5
	[0087.226] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1
	[0087.226] lstrlenW (lpString=".ppt") returned 4
	[0087.226] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0087.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.226] lstrlenW (lpString=".zip") returned 4
	[0087.226] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0087.226] lstrlenW (lpString=".rar") returned 4
	[0087.226] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0087.226] lstrlenW (lpString=".bz2") returned 4
	[0087.226] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0087.226] lstrlenW (lpString=".7z") returned 3
	[0087.226] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0087.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.226] lstrlenW (lpString=".dbf") returned 4
	[0087.226] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0087.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.226] lstrlenW (lpString=".1cd") returned 4
	[0087.226] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0087.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0087.226] lstrlenW (lpString=".jpg") returned 4
	[0087.226] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0087.226] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0087.227] lstrlenW (lpString="J0101866.BMP") returned 12
	[0087.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0087.227] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2caff14 | out: lpFileSize=0x2caff14*=32184) returned 1
	[0087.227] CloseHandle (hObject=0x37c) 

Thread:
	id = 12
	os_tid = 0x8f4

	[0055.910] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3560720
	[0055.911] lstrlenW (lpString="C:") returned 2
	[0055.911] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2defcf8 | out: lpFindFileData=0x2defcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x62c9f8
	[0055.911] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0055.911] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0055.911] lstrlenW (lpString="$GetCurrent") returned 11
	[0055.911] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0055.911] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3570728
	[0055.912] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0055.912] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x62cb38
	[0055.930] FindNextFileW (in: hFindFile=0x62cb38, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0055.931] FindNextFileW (in: hFindFile=0x62cb38, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0055.932] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0055.932] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0055.932] lstrlenW (lpString="Logs") returned 4
	[0055.932] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0055.932] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0055.932] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0055.932] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f3d28
	[0055.941] FindNextFileW (in: hFindFile=0x6f3d28, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0055.941] FindNextFileW (in: hFindFile=0x6f3d28, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1
	[0055.941] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0055.941] lstrlenW (lpString=".1cd") returned 4
	[0055.941] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0055.941] lstrlenW (lpString=".3ds") returned 4
	[0055.941] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1
	[0055.941] lstrlenW (lpString=".3fr") returned 4
	[0055.941] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1
	[0055.941] lstrlenW (lpString=".3g2") returned 4
	[0055.941] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1
	[0055.942] lstrlenW (lpString=".3gp") returned 4
	[0055.942] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1
	[0055.942] lstrlenW (lpString=".7z") returned 3
	[0055.942] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0055.942] lstrlenW (lpString=".accda") returned 6
	[0055.942] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1
	[0055.942] lstrlenW (lpString=".accdb") returned 6
	[0055.942] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1
	[0055.942] lstrlenW (lpString=".accdc") returned 6
	[0055.942] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1
	[0055.942] lstrlenW (lpString=".accde") returned 6
	[0055.942] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1
	[0055.942] lstrlenW (lpString=".accdt") returned 6
	[0055.942] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1
	[0055.942] lstrlenW (lpString=".accdw") returned 6
	[0055.942] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1
	[0055.942] lstrlenW (lpString=".adb") returned 4
	[0055.942] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1
	[0055.942] lstrlenW (lpString=".adp") returned 4
	[0055.942] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1
	[0055.942] lstrlenW (lpString=".ai") returned 3
	[0055.942] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1
	[0055.942] lstrlenW (lpString=".ai3") returned 4
	[0055.942] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1
	[0055.943] lstrlenW (lpString=".ai4") returned 4
	[0055.943] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1
	[0055.943] lstrlenW (lpString=".ai5") returned 4
	[0055.943] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1
	[0055.943] lstrlenW (lpString=".ai6") returned 4
	[0055.943] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1
	[0055.943] lstrlenW (lpString=".ai7") returned 4
	[0055.943] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1
	[0055.943] lstrlenW (lpString=".ai8") returned 4
	[0055.943] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1
	[0055.943] lstrlenW (lpString=".anim") returned 5
	[0055.943] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1
	[0055.943] lstrlenW (lpString=".arw") returned 4
	[0055.943] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1
	[0055.943] lstrlenW (lpString=".as") returned 3
	[0055.944] lstrcmpiW (lpString1=".as", lpString2="log") returned -1
	[0055.944] lstrlenW (lpString=".asa") returned 4
	[0055.944] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1
	[0055.944] lstrlenW (lpString=".asc") returned 4
	[0055.944] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1
	[0055.944] lstrlenW (lpString=".ascx") returned 5
	[0055.944] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1
	[0055.944] lstrlenW (lpString=".asm") returned 4
	[0055.944] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1
	[0055.944] lstrlenW (lpString=".asmx") returned 5
	[0055.944] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1
	[0055.944] lstrlenW (lpString=".asp") returned 4
	[0055.944] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1
	[0055.944] lstrlenW (lpString=".aspx") returned 5
	[0055.944] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1
	[0055.944] lstrlenW (lpString=".asr") returned 4
	[0055.944] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1
	[0055.944] lstrlenW (lpString=".asx") returned 4
	[0055.944] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1
	[0055.944] lstrlenW (lpString=".avi") returned 4
	[0055.945] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1
	[0055.945] lstrlenW (lpString=".avs") returned 4
	[0055.945] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1
	[0055.945] lstrlenW (lpString=".backup") returned 7
	[0055.945] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1
	[0055.945] lstrlenW (lpString=".bak") returned 4
	[0055.945] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1
	[0055.945] lstrlenW (lpString=".bay") returned 4
	[0055.945] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1
	[0055.945] lstrlenW (lpString=".bd") returned 3
	[0055.945] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1
	[0055.945] lstrlenW (lpString=".bin") returned 4
	[0055.945] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1
	[0055.945] lstrlenW (lpString=".bmp") returned 4
	[0055.945] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1
	[0055.945] lstrlenW (lpString=".bz2") returned 4
	[0055.945] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0055.945] lstrlenW (lpString=".c") returned 2
	[0055.945] lstrcmpiW (lpString1=".c", lpString2="og") returned -1
	[0055.945] lstrlenW (lpString=".cdr") returned 4
	[0055.945] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1
	[0055.945] lstrlenW (lpString=".cer") returned 4
	[0055.945] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1
	[0055.945] lstrlenW (lpString=".cf") returned 3
	[0055.945] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1
	[0055.946] lstrlenW (lpString=".cfc") returned 4
	[0055.946] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1
	[0055.946] lstrlenW (lpString=".cfm") returned 4
	[0055.946] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1
	[0055.946] lstrlenW (lpString=".cfml") returned 5
	[0055.946] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1
	[0055.946] lstrlenW (lpString=".cfu") returned 4
	[0055.946] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1
	[0055.946] lstrlenW (lpString=".chm") returned 4
	[0055.946] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1
	[0055.946] lstrlenW (lpString=".cin") returned 4
	[0055.946] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1
	[0055.946] lstrlenW (lpString=".class") returned 6
	[0055.946] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1
	[0055.947] lstrlenW (lpString=".clx") returned 4
	[0055.947] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1
	[0055.947] lstrlenW (lpString=".config") returned 7
	[0055.947] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1
	[0055.947] lstrlenW (lpString=".cpp") returned 4
	[0055.947] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1
	[0055.947] lstrlenW (lpString=".cr2") returned 4
	[0055.947] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1
	[0055.947] lstrlenW (lpString=".crt") returned 4
	[0055.947] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1
	[0055.947] lstrlenW (lpString=".crw") returned 4
	[0055.947] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1
	[0055.947] lstrlenW (lpString=".cs") returned 3
	[0055.947] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1
	[0055.947] lstrlenW (lpString=".css") returned 4
	[0055.948] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1
	[0055.948] lstrlenW (lpString=".csv") returned 4
	[0055.948] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1
	[0055.948] lstrlenW (lpString=".cub") returned 4
	[0055.948] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1
	[0055.948] lstrlenW (lpString=".dae") returned 4
	[0055.948] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1
	[0055.948] lstrlenW (lpString=".dat") returned 4
	[0055.948] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1
	[0055.948] lstrlenW (lpString=".db") returned 3
	[0055.948] lstrcmpiW (lpString1=".db", lpString2="log") returned -1
	[0055.948] lstrlenW (lpString=".dbf") returned 4
	[0055.948] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0055.948] lstrlenW (lpString=".dbx") returned 4
	[0055.948] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1
	[0055.948] lstrlenW (lpString=".dc3") returned 4
	[0055.948] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1
	[0055.948] lstrlenW (lpString=".dcm") returned 4
	[0055.948] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1
	[0055.949] lstrlenW (lpString=".dcr") returned 4
	[0055.949] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1
	[0055.949] lstrlenW (lpString=".der") returned 4
	[0055.949] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1
	[0055.949] lstrlenW (lpString=".dib") returned 4
	[0055.949] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1
	[0055.949] lstrlenW (lpString=".dic") returned 4
	[0055.949] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1
	[0055.949] lstrlenW (lpString=".dif") returned 4
	[0055.949] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1
	[0055.949] lstrlenW (lpString=".divx") returned 5
	[0055.949] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1
	[0055.949] lstrlenW (lpString=".djvu") returned 5
	[0055.949] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1
	[0055.949] lstrlenW (lpString=".dng") returned 4
	[0055.949] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1
	[0055.949] lstrlenW (lpString=".doc") returned 4
	[0055.949] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0055.949] lstrlenW (lpString=".docm") returned 5
	[0055.949] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1
	[0055.949] lstrlenW (lpString=".docx") returned 5
	[0055.949] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1
	[0055.949] lstrlenW (lpString=".dot") returned 4
	[0055.949] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1
	[0055.949] lstrlenW (lpString=".dotm") returned 5
	[0055.949] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1
	[0055.950] lstrlenW (lpString=".dotx") returned 5
	[0055.950] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1
	[0055.950] lstrlenW (lpString=".dpx") returned 4
	[0055.950] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1
	[0055.950] lstrlenW (lpString=".dqy") returned 4
	[0055.950] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1
	[0055.950] lstrlenW (lpString=".dsn") returned 4
	[0055.950] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1
	[0055.950] lstrlenW (lpString=".dt") returned 3
	[0055.950] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1
	[0055.950] lstrlenW (lpString=".dtd") returned 4
	[0055.950] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1
	[0055.950] lstrlenW (lpString=".dwg") returned 4
	[0055.950] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1
	[0055.950] lstrlenW (lpString=".dwt") returned 4
	[0055.950] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1
	[0055.950] lstrlenW (lpString=".dx") returned 3
	[0055.950] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1
	[0055.950] lstrlenW (lpString=".dxf") returned 4
	[0055.950] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1
	[0055.950] lstrlenW (lpString=".edml") returned 5
	[0055.950] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1
	[0055.950] lstrlenW (lpString=".efd") returned 4
	[0055.950] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1
	[0055.951] lstrlenW (lpString=".elf") returned 4
	[0055.951] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1
	[0055.951] lstrlenW (lpString=".emf") returned 4
	[0055.951] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1
	[0055.951] lstrlenW (lpString=".emz") returned 4
	[0055.951] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1
	[0055.951] lstrlenW (lpString=".epf") returned 4
	[0055.951] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1
	[0055.951] lstrlenW (lpString=".eps") returned 4
	[0055.951] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1
	[0055.951] lstrlenW (lpString=".epsf") returned 5
	[0055.951] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1
	[0055.951] lstrlenW (lpString=".epsp") returned 5
	[0055.951] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1
	[0055.951] lstrlenW (lpString=".erf") returned 4
	[0055.951] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1
	[0055.951] lstrlenW (lpString=".exr") returned 4
	[0055.951] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1
	[0055.951] lstrlenW (lpString=".f4v") returned 4
	[0055.951] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1
	[0055.951] lstrlenW (lpString=".fido") returned 5
	[0055.951] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1
	[0055.951] lstrlenW (lpString=".flm") returned 4
	[0055.951] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1
	[0055.952] lstrlenW (lpString=".flv") returned 4
	[0055.952] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1
	[0055.952] lstrlenW (lpString=".frm") returned 4
	[0055.952] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1
	[0055.952] lstrlenW (lpString=".fxg") returned 4
	[0055.952] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1
	[0055.952] lstrlenW (lpString=".geo") returned 4
	[0055.952] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1
	[0055.952] lstrlenW (lpString=".gif") returned 4
	[0055.952] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1
	[0055.952] lstrlenW (lpString=".grs") returned 4
	[0055.952] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1
	[0055.952] lstrlenW (lpString=".gz") returned 3
	[0055.952] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1
	[0055.952] lstrlenW (lpString=".h") returned 2
	[0055.952] lstrcmpiW (lpString1=".h", lpString2="og") returned -1
	[0055.952] lstrlenW (lpString=".hdr") returned 4
	[0055.952] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1
	[0055.952] lstrlenW (lpString=".hpp") returned 4
	[0055.952] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1
	[0055.952] lstrlenW (lpString=".hta") returned 4
	[0055.952] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1
	[0055.952] lstrlenW (lpString=".htc") returned 4
	[0055.952] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1
	[0055.952] lstrlenW (lpString=".htm") returned 4
	[0055.952] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1
	[0055.953] lstrlenW (lpString=".html") returned 5
	[0055.953] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1
	[0055.953] lstrlenW (lpString=".icb") returned 4
	[0055.953] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1
	[0055.953] lstrlenW (lpString=".ics") returned 4
	[0055.953] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1
	[0055.953] lstrlenW (lpString=".iff") returned 4
	[0055.953] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1
	[0055.953] lstrlenW (lpString=".inc") returned 4
	[0055.953] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1
	[0055.953] lstrlenW (lpString=".indd") returned 5
	[0055.953] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1
	[0055.953] lstrlenW (lpString=".ini") returned 4
	[0055.953] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1
	[0055.953] lstrlenW (lpString=".iqy") returned 4
	[0055.953] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1
	[0055.953] lstrlenW (lpString=".j2c") returned 4
	[0055.953] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1
	[0055.953] lstrlenW (lpString=".j2k") returned 4
	[0055.953] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1
	[0055.953] lstrlenW (lpString=".java") returned 5
	[0055.953] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1
	[0055.954] lstrlenW (lpString=".jp2") returned 4
	[0055.954] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1
	[0055.954] lstrlenW (lpString=".jpc") returned 4
	[0055.954] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1
	[0055.954] lstrlenW (lpString=".jpe") returned 4
	[0055.954] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1
	[0055.954] lstrlenW (lpString=".jpeg") returned 5
	[0055.954] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1
	[0055.954] lstrlenW (lpString=".jpf") returned 4
	[0055.954] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1
	[0055.954] lstrlenW (lpString=".jpg") returned 4
	[0055.954] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0055.954] lstrlenW (lpString=".jpx") returned 4
	[0055.954] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1
	[0055.954] lstrlenW (lpString=".js") returned 3
	[0055.954] lstrcmpiW (lpString1=".js", lpString2="log") returned -1
	[0055.954] lstrlenW (lpString=".jsf") returned 4
	[0055.954] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1
	[0055.954] lstrlenW (lpString=".json") returned 5
	[0055.954] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1
	[0055.954] lstrlenW (lpString=".jsp") returned 4
	[0055.955] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1
	[0055.955] lstrlenW (lpString=".kdc") returned 4
	[0055.955] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1
	[0055.955] lstrlenW (lpString=".kmz") returned 4
	[0055.955] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1
	[0055.955] lstrlenW (lpString=".kwm") returned 4
	[0055.955] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1
	[0055.955] lstrlenW (lpString=".lasso") returned 6
	[0055.955] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1
	[0055.955] lstrlenW (lpString=".lbi") returned 4
	[0055.955] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1
	[0055.955] lstrlenW (lpString=".lgf") returned 4
	[0055.955] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1
	[0055.955] lstrlenW (lpString=".lgp") returned 4
	[0055.955] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1
	[0055.955] lstrlenW (lpString=".log") returned 4
	[0055.955] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0
	[0055.955] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0055.955] lstrlenW (lpString=".money") returned 6
	[0055.955] lstrcmpiW (lpString1=".money", lpString2="66.log") returned -1
	[0055.955] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0055.955] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1
	[0055.955] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1
	[0055.955] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0055.955] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0055.956] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0055.956] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0055.956] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0055.956] lstrcmpiW (lpString1="d2.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1
	[0055.956] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0055.956] FindNextFileW (in: hFindFile=0x6f3d28, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1
	[0055.956] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32
	[0055.956] lstrlenW (lpString=".1cd") returned 4
	[0055.956] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0055.956] lstrlenW (lpString=".3ds") returned 4
	[0055.956] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1
	[0055.956] lstrlenW (lpString=".3fr") returned 4
	[0055.956] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1
	[0055.956] lstrlenW (lpString=".3g2") returned 4
	[0055.956] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1
	[0055.956] lstrlenW (lpString=".3gp") returned 4
	[0055.956] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1
	[0055.956] lstrlenW (lpString=".7z") returned 3
	[0055.956] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0055.956] lstrlenW (lpString=".accda") returned 6
	[0055.957] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1
	[0055.957] lstrlenW (lpString=".accdb") returned 6
	[0055.957] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1
	[0055.957] lstrlenW (lpString=".accdc") returned 6
	[0055.957] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1
	[0055.957] lstrlenW (lpString=".accde") returned 6
	[0055.957] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1
	[0055.957] lstrlenW (lpString=".accdt") returned 6
	[0055.957] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1
	[0055.957] lstrlenW (lpString=".accdw") returned 6
	[0055.957] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1
	[0055.957] lstrlenW (lpString=".adb") returned 4
	[0055.957] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1
	[0055.957] lstrlenW (lpString=".adp") returned 4
	[0055.957] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1
	[0055.957] lstrlenW (lpString=".ai") returned 3
	[0055.957] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1
	[0055.957] lstrlenW (lpString=".ai3") returned 4
	[0055.957] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1
	[0055.957] lstrlenW (lpString=".ai4") returned 4
	[0055.957] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1
	[0055.958] lstrlenW (lpString=".ai5") returned 4
	[0055.958] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1
	[0055.958] lstrlenW (lpString=".ai6") returned 4
	[0055.958] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1
	[0055.958] lstrlenW (lpString=".ai7") returned 4
	[0055.958] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1
	[0055.958] lstrlenW (lpString=".ai8") returned 4
	[0055.958] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1
	[0055.958] lstrlenW (lpString=".anim") returned 5
	[0055.958] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1
	[0055.958] lstrlenW (lpString=".arw") returned 4
	[0055.958] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1
	[0055.958] lstrlenW (lpString=".as") returned 3
	[0055.958] lstrcmpiW (lpString1=".as", lpString2="log") returned -1
	[0055.958] lstrlenW (lpString=".asa") returned 4
	[0055.958] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1
	[0055.958] lstrlenW (lpString=".asc") returned 4
	[0055.958] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1
	[0055.958] lstrlenW (lpString=".ascx") returned 5
	[0055.958] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1
	[0055.958] lstrlenW (lpString=".asm") returned 4
	[0055.958] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1
	[0055.958] lstrlenW (lpString=".asmx") returned 5
	[0055.958] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1
	[0055.959] lstrlenW (lpString=".asp") returned 4
	[0055.959] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1
	[0055.959] lstrlenW (lpString=".aspx") returned 5
	[0055.959] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1
	[0055.959] lstrlenW (lpString=".asr") returned 4
	[0055.959] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1
	[0055.959] lstrlenW (lpString=".asx") returned 4
	[0055.959] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1
	[0055.959] lstrlenW (lpString=".avi") returned 4
	[0055.959] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1
	[0055.959] lstrlenW (lpString=".avs") returned 4
	[0055.959] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1
	[0055.959] lstrlenW (lpString=".backup") returned 7
	[0055.959] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1
	[0055.959] lstrlenW (lpString=".bak") returned 4
	[0055.959] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1
	[0055.959] lstrlenW (lpString=".bay") returned 4
	[0055.959] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1
	[0055.959] lstrlenW (lpString=".bd") returned 3
	[0055.959] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1
	[0055.959] lstrlenW (lpString=".bin") returned 4
	[0055.959] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1
	[0055.959] lstrlenW (lpString=".bmp") returned 4
	[0055.959] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1
	[0055.960] lstrlenW (lpString=".bz2") returned 4
	[0055.960] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0055.960] lstrlenW (lpString=".c") returned 2
	[0055.960] lstrcmpiW (lpString1=".c", lpString2="og") returned -1
	[0055.960] lstrlenW (lpString=".cdr") returned 4
	[0055.960] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1
	[0055.960] lstrlenW (lpString=".cer") returned 4
	[0055.960] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1
	[0055.960] lstrlenW (lpString=".cf") returned 3
	[0055.960] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1
	[0055.960] lstrlenW (lpString=".cfc") returned 4
	[0055.960] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1
	[0055.960] lstrlenW (lpString=".cfm") returned 4
	[0055.960] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1
	[0055.960] lstrlenW (lpString=".cfml") returned 5
	[0055.960] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1
	[0055.960] lstrlenW (lpString=".cfu") returned 4
	[0055.961] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1
	[0055.961] lstrlenW (lpString=".chm") returned 4
	[0055.961] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1
	[0055.961] lstrlenW (lpString=".cin") returned 4
	[0055.961] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1
	[0055.961] lstrlenW (lpString=".class") returned 6
	[0055.961] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1
	[0055.961] lstrlenW (lpString=".clx") returned 4
	[0055.961] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1
	[0055.961] lstrlenW (lpString=".config") returned 7
	[0055.961] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1
	[0055.961] lstrlenW (lpString=".cpp") returned 4
	[0055.961] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1
	[0055.961] lstrlenW (lpString=".cr2") returned 4
	[0055.961] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1
	[0055.961] lstrlenW (lpString=".crt") returned 4
	[0055.962] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1
	[0055.962] lstrlenW (lpString=".crw") returned 4
	[0055.962] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1
	[0055.962] lstrlenW (lpString=".cs") returned 3
	[0055.962] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1
	[0055.962] lstrlenW (lpString=".css") returned 4
	[0055.962] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1
	[0055.962] lstrlenW (lpString=".csv") returned 4
	[0055.962] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1
	[0055.962] lstrlenW (lpString=".cub") returned 4
	[0055.962] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1
	[0055.962] lstrlenW (lpString=".dae") returned 4
	[0055.962] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1
	[0055.962] lstrlenW (lpString=".dat") returned 4
	[0055.962] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1
	[0055.962] lstrlenW (lpString=".db") returned 3
	[0055.962] lstrcmpiW (lpString1=".db", lpString2="log") returned -1
	[0055.962] lstrlenW (lpString=".dbf") returned 4
	[0055.962] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0055.962] lstrlenW (lpString=".dbx") returned 4
	[0055.962] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1
	[0055.962] lstrlenW (lpString=".dc3") returned 4
	[0055.962] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1
	[0055.963] lstrlenW (lpString=".dcm") returned 4
	[0055.963] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1
	[0055.963] lstrlenW (lpString=".dcr") returned 4
	[0055.963] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1
	[0055.963] lstrlenW (lpString=".der") returned 4
	[0055.963] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1
	[0055.963] lstrlenW (lpString=".dib") returned 4
	[0055.963] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1
	[0055.963] lstrlenW (lpString=".dic") returned 4
	[0055.963] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1
	[0055.963] lstrlenW (lpString=".dif") returned 4
	[0055.963] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1
	[0055.963] lstrlenW (lpString=".divx") returned 5
	[0055.963] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1
	[0055.963] lstrlenW (lpString=".djvu") returned 5
	[0055.963] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1
	[0055.963] lstrlenW (lpString=".dng") returned 4
	[0055.963] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1
	[0055.963] lstrlenW (lpString=".doc") returned 4
	[0055.963] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0055.963] lstrlenW (lpString=".docm") returned 5
	[0055.963] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1
	[0055.963] lstrlenW (lpString=".docx") returned 5
	[0055.963] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1
	[0055.963] lstrlenW (lpString=".dot") returned 4
	[0055.963] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1
	[0055.964] lstrlenW (lpString=".dotm") returned 5
	[0055.964] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1
	[0055.964] lstrlenW (lpString=".dotx") returned 5
	[0055.964] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1
	[0055.964] lstrlenW (lpString=".dpx") returned 4
	[0055.964] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1
	[0055.964] lstrlenW (lpString=".dqy") returned 4
	[0055.964] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1
	[0055.964] FindNextFileW (in: hFindFile=0x6f3d28, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1
	[0055.964] FindNextFileW (in: hFindFile=0x6f3d28, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0
	[0055.964] FindClose (in: hFindFile=0x6f3d28 | out: hFindFile=0x6f3d28) returned 1
	[0055.965] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0055.965] FindNextFileW (in: hFindFile=0x62cb38, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0055.965] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0055.965] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21
	[0055.965] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f3768
	[0057.178] FindNextFileW (in: hFindFile=0x6f3768, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.178] FindNextFileW (in: hFindFile=0x6f3768, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0057.178] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18
	[0057.178] lstrlenW (lpString=".1cd") returned 4
	[0057.178] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0057.178] lstrlenW (lpString=".3ds") returned 4
	[0057.178] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0057.178] lstrlenW (lpString=".3fr") returned 4
	[0057.178] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0057.178] lstrlenW (lpString=".3g2") returned 4
	[0057.178] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0057.178] lstrlenW (lpString=".3gp") returned 4
	[0057.178] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0057.178] lstrlenW (lpString=".7z") returned 3
	[0057.178] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0057.178] lstrlenW (lpString=".accda") returned 6
	[0057.178] lstrcmpiW (lpString1=".accda", lpString2="BE.dll") returned -1
	[0057.178] lstrlenW (lpString=".accdb") returned 6
	[0057.178] lstrcmpiW (lpString1=".accdb", lpString2="BE.dll") returned -1
	[0057.178] lstrlenW (lpString=".accdc") returned 6
	[0057.178] lstrcmpiW (lpString1=".accdc", lpString2="BE.dll") returned -1
	[0057.178] lstrlenW (lpString=".accde") returned 6
	[0057.178] lstrcmpiW (lpString1=".accde", lpString2="BE.dll") returned -1
	[0057.178] lstrlenW (lpString=".accdt") returned 6
	[0057.179] lstrcmpiW (lpString1=".accdt", lpString2="BE.dll") returned -1
	[0057.179] lstrlenW (lpString=".accdw") returned 6
	[0057.179] lstrcmpiW (lpString1=".accdw", lpString2="BE.dll") returned -1
	[0057.179] lstrlenW (lpString=".adb") returned 4
	[0057.179] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0057.179] lstrlenW (lpString=".adp") returned 4
	[0057.179] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0057.179] lstrlenW (lpString=".ai") returned 3
	[0057.179] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0057.179] lstrlenW (lpString=".ai3") returned 4
	[0057.179] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0057.179] lstrlenW (lpString=".ai4") returned 4
	[0057.179] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0057.179] lstrlenW (lpString=".ai5") returned 4
	[0057.179] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0057.179] lstrlenW (lpString=".ai6") returned 4
	[0057.179] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0057.179] lstrlenW (lpString=".ai7") returned 4
	[0057.179] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0057.179] lstrlenW (lpString=".ai8") returned 4
	[0057.179] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0057.179] lstrlenW (lpString=".anim") returned 5
	[0057.179] lstrcmpiW (lpString1=".anim", lpString2="E.dll") returned -1
	[0057.179] lstrlenW (lpString=".arw") returned 4
	[0057.179] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0057.179] lstrlenW (lpString=".as") returned 3
	[0057.179] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0057.179] lstrlenW (lpString=".asa") returned 4
	[0057.180] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0057.180] lstrlenW (lpString=".asc") returned 4
	[0057.180] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0057.180] lstrlenW (lpString=".ascx") returned 5
	[0057.180] lstrcmpiW (lpString1=".ascx", lpString2="E.dll") returned -1
	[0057.180] lstrlenW (lpString=".asm") returned 4
	[0057.180] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0057.180] lstrlenW (lpString=".asmx") returned 5
	[0057.180] lstrcmpiW (lpString1=".asmx", lpString2="E.dll") returned -1
	[0057.180] lstrlenW (lpString=".asp") returned 4
	[0057.180] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0057.180] lstrlenW (lpString=".aspx") returned 5
	[0057.180] lstrcmpiW (lpString1=".aspx", lpString2="E.dll") returned -1
	[0057.180] lstrlenW (lpString=".asr") returned 4
	[0057.180] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0057.180] lstrlenW (lpString=".asx") returned 4
	[0057.180] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0057.180] lstrlenW (lpString=".avi") returned 4
	[0057.180] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0057.180] lstrlenW (lpString=".avs") returned 4
	[0057.180] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0057.180] lstrlenW (lpString=".backup") returned 7
	[0057.180] lstrcmpiW (lpString1=".backup", lpString2="OBE.dll") returned -1
	[0057.180] lstrlenW (lpString=".bak") returned 4
	[0057.180] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0057.180] lstrlenW (lpString=".bay") returned 4
	[0057.180] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0057.180] lstrlenW (lpString=".bd") returned 3
	[0057.180] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0057.181] lstrlenW (lpString=".bin") returned 4
	[0057.181] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0057.181] lstrlenW (lpString=".bmp") returned 4
	[0057.181] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0057.181] lstrlenW (lpString=".bz2") returned 4
	[0057.181] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0057.181] lstrlenW (lpString=".c") returned 2
	[0057.181] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0057.181] lstrlenW (lpString=".cdr") returned 4
	[0057.181] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0057.181] lstrlenW (lpString=".cer") returned 4
	[0057.181] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0057.181] lstrlenW (lpString=".cf") returned 3
	[0057.181] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0057.181] lstrlenW (lpString=".cfc") returned 4
	[0057.181] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0057.181] lstrlenW (lpString=".cfm") returned 4
	[0057.181] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0057.181] lstrlenW (lpString=".cfml") returned 5
	[0057.181] lstrcmpiW (lpString1=".cfml", lpString2="E.dll") returned -1
	[0057.181] lstrlenW (lpString=".cfu") returned 4
	[0057.181] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0057.181] lstrlenW (lpString=".chm") returned 4
	[0057.181] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0057.181] lstrlenW (lpString=".cin") returned 4
	[0057.181] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0057.181] lstrlenW (lpString=".class") returned 6
	[0057.181] lstrcmpiW (lpString1=".class", lpString2="BE.dll") returned -1
	[0057.182] lstrlenW (lpString=".clx") returned 4
	[0057.182] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".config") returned 7
	[0057.182] lstrcmpiW (lpString1=".config", lpString2="OBE.dll") returned -1
	[0057.182] lstrlenW (lpString=".cpp") returned 4
	[0057.182] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".cr2") returned 4
	[0057.182] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".crt") returned 4
	[0057.182] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".crw") returned 4
	[0057.182] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".cs") returned 3
	[0057.182] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0057.182] lstrlenW (lpString=".css") returned 4
	[0057.182] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".csv") returned 4
	[0057.182] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".cub") returned 4
	[0057.182] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".dae") returned 4
	[0057.182] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".dat") returned 4
	[0057.182] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".db") returned 3
	[0057.182] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0057.182] lstrlenW (lpString=".dbf") returned 4
	[0057.182] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".dbx") returned 4
	[0057.182] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0057.182] lstrlenW (lpString=".dc3") returned 4
	[0057.183] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0057.183] lstrlenW (lpString=".dcm") returned 4
	[0057.183] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0057.183] lstrlenW (lpString=".dcr") returned 4
	[0057.183] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0057.183] lstrlenW (lpString=".der") returned 4
	[0057.183] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0057.183] lstrlenW (lpString=".dib") returned 4
	[0057.183] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0057.183] lstrlenW (lpString=".dic") returned 4
	[0057.183] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0057.183] lstrlenW (lpString=".dif") returned 4
	[0057.183] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0057.183] lstrlenW (lpString=".divx") returned 5
	[0057.183] lstrcmpiW (lpString1=".divx", lpString2="E.dll") returned -1
	[0057.183] lstrlenW (lpString=".djvu") returned 5
	[0057.183] lstrcmpiW (lpString1=".djvu", lpString2="E.dll") returned -1
	[0057.183] lstrlenW (lpString=".dng") returned 4
	[0057.183] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0057.183] lstrlenW (lpString=".doc") returned 4
	[0057.183] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0057.183] lstrlenW (lpString=".docm") returned 5
	[0057.183] lstrcmpiW (lpString1=".docm", lpString2="E.dll") returned -1
	[0057.183] lstrlenW (lpString=".docx") returned 5
	[0057.183] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1
	[0057.183] lstrlenW (lpString=".dot") returned 4
	[0057.183] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0057.183] lstrlenW (lpString=".dotm") returned 5
	[0057.183] lstrcmpiW (lpString1=".dotm", lpString2="E.dll") returned -1
	[0057.183] lstrlenW (lpString=".dotx") returned 5
	[0057.184] lstrcmpiW (lpString1=".dotx", lpString2="E.dll") returned -1
	[0057.184] lstrlenW (lpString=".dpx") returned 4
	[0057.184] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0057.184] lstrlenW (lpString=".dqy") returned 4
	[0057.184] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0057.184] lstrlenW (lpString=".dsn") returned 4
	[0057.184] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0057.184] lstrlenW (lpString=".dt") returned 3
	[0057.184] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0057.184] lstrlenW (lpString=".dtd") returned 4
	[0057.184] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0057.184] lstrlenW (lpString=".dwg") returned 4
	[0057.184] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0057.184] lstrlenW (lpString=".dwt") returned 4
	[0057.184] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0057.184] lstrlenW (lpString=".dx") returned 3
	[0057.184] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0057.184] lstrlenW (lpString=".dxf") returned 4
	[0057.184] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0057.184] lstrlenW (lpString=".edml") returned 5
	[0057.184] lstrcmpiW (lpString1=".edml", lpString2="E.dll") returned -1
	[0057.184] lstrlenW (lpString=".efd") returned 4
	[0057.184] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0057.184] lstrlenW (lpString=".elf") returned 4
	[0057.184] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0057.184] lstrlenW (lpString=".emf") returned 4
	[0057.184] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".emz") returned 4
	[0057.185] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".epf") returned 4
	[0057.185] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".eps") returned 4
	[0057.185] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".epsf") returned 5
	[0057.185] lstrcmpiW (lpString1=".epsf", lpString2="E.dll") returned -1
	[0057.185] lstrlenW (lpString=".epsp") returned 5
	[0057.185] lstrcmpiW (lpString1=".epsp", lpString2="E.dll") returned -1
	[0057.185] lstrlenW (lpString=".erf") returned 4
	[0057.185] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".exr") returned 4
	[0057.185] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".f4v") returned 4
	[0057.185] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".fido") returned 5
	[0057.185] lstrcmpiW (lpString1=".fido", lpString2="E.dll") returned -1
	[0057.185] lstrlenW (lpString=".flm") returned 4
	[0057.185] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".flv") returned 4
	[0057.185] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".frm") returned 4
	[0057.185] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".fxg") returned 4
	[0057.185] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".geo") returned 4
	[0057.185] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0057.185] lstrlenW (lpString=".gif") returned 4
	[0057.185] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0057.186] lstrlenW (lpString=".grs") returned 4
	[0057.186] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0057.186] lstrlenW (lpString=".gz") returned 3
	[0057.186] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0057.186] lstrlenW (lpString=".h") returned 2
	[0057.186] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0057.186] lstrlenW (lpString=".hdr") returned 4
	[0057.186] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0057.186] lstrlenW (lpString=".hpp") returned 4
	[0057.186] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0057.186] lstrlenW (lpString=".hta") returned 4
	[0057.186] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0057.186] lstrlenW (lpString=".htc") returned 4
	[0057.186] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0057.186] lstrlenW (lpString=".htm") returned 4
	[0057.186] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0057.186] lstrlenW (lpString=".html") returned 5
	[0057.186] lstrcmpiW (lpString1=".html", lpString2="E.dll") returned -1
	[0057.186] lstrlenW (lpString=".icb") returned 4
	[0057.186] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0057.186] lstrlenW (lpString=".ics") returned 4
	[0057.186] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0057.186] lstrlenW (lpString=".iff") returned 4
	[0057.186] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0057.186] lstrlenW (lpString=".inc") returned 4
	[0057.186] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0057.186] lstrlenW (lpString=".indd") returned 5
	[0057.186] lstrcmpiW (lpString1=".indd", lpString2="E.dll") returned -1
	[0057.187] lstrlenW (lpString=".ini") returned 4
	[0057.187] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0057.187] lstrlenW (lpString=".iqy") returned 4
	[0057.187] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0057.187] lstrlenW (lpString=".j2c") returned 4
	[0057.187] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0057.187] lstrlenW (lpString=".j2k") returned 4
	[0057.187] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0057.187] lstrlenW (lpString=".java") returned 5
	[0057.187] lstrcmpiW (lpString1=".java", lpString2="E.dll") returned -1
	[0057.187] lstrlenW (lpString=".jp2") returned 4
	[0057.187] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0057.187] lstrlenW (lpString=".jpc") returned 4
	[0057.187] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0057.187] lstrlenW (lpString=".jpe") returned 4
	[0057.187] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0057.187] lstrlenW (lpString=".jpeg") returned 5
	[0057.187] lstrcmpiW (lpString1=".jpeg", lpString2="E.dll") returned -1
	[0057.187] lstrlenW (lpString=".jpf") returned 4
	[0057.187] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0057.187] lstrlenW (lpString=".jpg") returned 4
	[0057.187] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0057.187] lstrlenW (lpString=".jpx") returned 4
	[0057.187] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0057.187] lstrlenW (lpString=".js") returned 3
	[0057.187] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0057.187] lstrlenW (lpString=".jsf") returned 4
	[0057.187] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0057.187] lstrlenW (lpString=".json") returned 5
	[0057.187] lstrcmpiW (lpString1=".json", lpString2="E.dll") returned -1
	[0057.187] lstrlenW (lpString=".jsp") returned 4
	[0057.188] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0057.188] lstrlenW (lpString=".kdc") returned 4
	[0057.188] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0057.188] lstrlenW (lpString=".kmz") returned 4
	[0057.188] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0057.188] lstrlenW (lpString=".kwm") returned 4
	[0057.188] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0057.188] lstrlenW (lpString=".lasso") returned 6
	[0057.188] lstrcmpiW (lpString1=".lasso", lpString2="BE.dll") returned -1
	[0057.188] lstrlenW (lpString=".lbi") returned 4
	[0057.188] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0057.188] lstrlenW (lpString=".lgf") returned 4
	[0057.188] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0057.188] lstrlenW (lpString=".lgp") returned 4
	[0057.188] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0057.188] lstrlenW (lpString=".log") returned 4
	[0057.188] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0057.188] lstrlenW (lpString=".m1v") returned 4
	[0057.188] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0057.188] lstrlenW (lpString=".m4a") returned 4
	[0057.188] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0057.188] lstrlenW (lpString=".m4v") returned 4
	[0057.188] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".max") returned 4
	[0057.189] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".md") returned 3
	[0057.189] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0057.189] lstrlenW (lpString=".mda") returned 4
	[0057.189] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mdb") returned 4
	[0057.189] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mde") returned 4
	[0057.189] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mdf") returned 4
	[0057.189] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mdw") returned 4
	[0057.189] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mef") returned 4
	[0057.189] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mft") returned 4
	[0057.189] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mfw") returned 4
	[0057.189] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mht") returned 4
	[0057.189] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mhtml") returned 6
	[0057.189] lstrcmpiW (lpString1=".mhtml", lpString2="BE.dll") returned -1
	[0057.189] lstrlenW (lpString=".mka") returned 4
	[0057.189] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mkidx") returned 6
	[0057.189] lstrcmpiW (lpString1=".mkidx", lpString2="BE.dll") returned -1
	[0057.189] lstrlenW (lpString=".mkv") returned 4
	[0057.189] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mos") returned 4
	[0057.189] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0057.189] lstrlenW (lpString=".mov") returned 4
	[0057.190] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".mp3") returned 4
	[0057.190] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".mp4") returned 4
	[0057.190] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".mpeg") returned 5
	[0057.190] lstrcmpiW (lpString1=".mpeg", lpString2="E.dll") returned -1
	[0057.190] lstrlenW (lpString=".mpg") returned 4
	[0057.190] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".mpv") returned 4
	[0057.190] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".mrw") returned 4
	[0057.190] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".msg") returned 4
	[0057.190] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".mxl") returned 4
	[0057.190] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".myd") returned 4
	[0057.190] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".myi") returned 4
	[0057.190] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".nef") returned 4
	[0057.190] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".nrw") returned 4
	[0057.190] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".obj") returned 4
	[0057.190] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".odb") returned 4
	[0057.190] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".odc") returned 4
	[0057.190] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0057.190] lstrlenW (lpString=".odm") returned 4
	[0057.191] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0057.191] lstrlenW (lpString=".odp") returned 4
	[0057.191] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0057.191] lstrlenW (lpString=".ods") returned 4
	[0057.191] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0057.191] lstrlenW (lpString=".oft") returned 4
	[0057.191] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0057.191] lstrlenW (lpString=".one") returned 4
	[0057.191] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0057.191] lstrlenW (lpString=".onepkg") returned 7
	[0057.191] lstrcmpiW (lpString1=".onepkg", lpString2="OBE.dll") returned -1
	[0057.191] lstrlenW (lpString=".onetoc2") returned 8
	[0057.191] lstrcmpiW (lpString1=".onetoc2", lpString2="OOBE.dll") returned -1
	[0057.191] lstrlenW (lpString=".opt") returned 4
	[0057.191] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0057.191] lstrlenW (lpString=".oqy") returned 4
	[0057.191] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0057.191] lstrlenW (lpString=".orf") returned 4
	[0057.191] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0057.191] lstrlenW (lpString=".p12") returned 4
	[0057.191] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0057.191] lstrlenW (lpString=".p7b") returned 4
	[0057.191] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0057.191] lstrlenW (lpString=".p7c") returned 4
	[0057.192] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pam") returned 4
	[0057.192] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pbm") returned 4
	[0057.192] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pct") returned 4
	[0057.192] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pcx") returned 4
	[0057.192] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pdd") returned 4
	[0057.192] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pdf") returned 4
	[0057.192] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pdp") returned 4
	[0057.192] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pef") returned 4
	[0057.192] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pem") returned 4
	[0057.192] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pff") returned 4
	[0057.192] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pfm") returned 4
	[0057.192] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pfx") returned 4
	[0057.192] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0057.192] lstrlenW (lpString=".pgm") returned 4
	[0057.193] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0057.193] lstrlenW (lpString=".php") returned 4
	[0057.193] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0057.193] lstrlenW (lpString=".php3") returned 5
	[0057.193] lstrcmpiW (lpString1=".php3", lpString2="E.dll") returned -1
	[0057.193] lstrlenW (lpString=".php4") returned 5
	[0057.193] lstrcmpiW (lpString1=".php4", lpString2="E.dll") returned -1
	[0057.193] lstrlenW (lpString=".php5") returned 5
	[0057.193] lstrcmpiW (lpString1=".php5", lpString2="E.dll") returned -1
	[0057.193] lstrlenW (lpString=".phtml") returned 6
	[0057.193] lstrcmpiW (lpString1=".phtml", lpString2="BE.dll") returned -1
	[0057.193] lstrlenW (lpString=".pict") returned 5
	[0057.193] lstrcmpiW (lpString1=".pict", lpString2="E.dll") returned -1
	[0057.193] lstrlenW (lpString=".pl") returned 3
	[0057.193] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0057.193] lstrlenW (lpString=".pls") returned 4
	[0057.193] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0057.193] lstrlenW (lpString=".pm") returned 3
	[0057.193] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0057.193] lstrlenW (lpString=".png") returned 4
	[0057.193] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0057.193] lstrlenW (lpString=".pnm") returned 4
	[0057.193] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0057.193] lstrlenW (lpString=".pot") returned 4
	[0057.193] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0057.193] lstrlenW (lpString=".potm") returned 5
	[0057.193] lstrcmpiW (lpString1=".potm", lpString2="E.dll") returned -1
	[0057.193] lstrlenW (lpString=".potx") returned 5
	[0057.193] lstrcmpiW (lpString1=".potx", lpString2="E.dll") returned -1
	[0057.194] lstrlenW (lpString=".ppa") returned 4
	[0057.194] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0057.194] lstrlenW (lpString=".ppam") returned 5
	[0057.194] lstrcmpiW (lpString1=".ppam", lpString2="E.dll") returned -1
	[0057.194] lstrlenW (lpString=".ppm") returned 4
	[0057.194] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0057.194] lstrlenW (lpString=".pps") returned 4
	[0057.194] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0057.194] lstrlenW (lpString=".ppsm") returned 5
	[0057.194] lstrcmpiW (lpString1=".ppsm", lpString2="E.dll") returned -1
	[0057.194] lstrlenW (lpString=".ppt") returned 4
	[0057.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0057.194] lstrlenW (lpString=".pptm") returned 5
	[0057.194] lstrcmpiW (lpString1=".pptm", lpString2="E.dll") returned -1
	[0057.194] lstrlenW (lpString=".pptx") returned 5
	[0057.194] lstrcmpiW (lpString1=".pptx", lpString2="E.dll") returned -1
	[0057.194] lstrlenW (lpString=".prn") returned 4
	[0057.194] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0057.194] lstrlenW (lpString=".ps") returned 3
	[0057.194] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0057.194] lstrlenW (lpString=".psb") returned 4
	[0057.194] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0057.194] lstrlenW (lpString=".psd") returned 4
	[0057.194] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0057.194] lstrlenW (lpString=".pst") returned 4
	[0057.194] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0057.194] lstrlenW (lpString=".ptx") returned 4
	[0057.195] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0057.195] lstrlenW (lpString=".pub") returned 4
	[0057.195] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0057.195] lstrlenW (lpString=".pwm") returned 4
	[0057.195] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0057.195] lstrlenW (lpString=".pxr") returned 4
	[0057.195] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0057.195] lstrlenW (lpString=".py") returned 3
	[0057.195] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0057.195] lstrlenW (lpString=".qt") returned 3
	[0057.195] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0057.195] lstrlenW (lpString=".r3d") returned 4
	[0057.195] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0057.195] lstrlenW (lpString=".raf") returned 4
	[0057.195] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0057.195] lstrlenW (lpString=".rar") returned 4
	[0057.195] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0057.195] lstrlenW (lpString=".raw") returned 4
	[0057.195] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0057.195] FindNextFileW (in: hFindFile=0x6f3768, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1
	[0057.195] FindNextFileW (in: hFindFile=0x6f3768, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1
	[0057.196] FindNextFileW (in: hFindFile=0x6f3768, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1
	[0057.196] FindNextFileW (in: hFindFile=0x6f3768, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1
	[0057.196] FindNextFileW (in: hFindFile=0x6f3768, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0
	[0057.196] FindClose (in: hFindFile=0x6f3768 | out: hFindFile=0x6f3768) returned 1
	[0057.197] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0057.197] FindNextFileW (in: hFindFile=0x62cb38, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0057.197] FindClose (in: hFindFile=0x62cb38 | out: hFindFile=0x62cb38) returned 1
	[0057.197] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3570728 | out: hHeap=0x600000) returned 1
	[0057.199] FindNextFileW (in: hFindFile=0x62c9f8, lpFindFileData=0x2defcf8 | out: lpFindFileData=0x2defcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0057.199] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3570728
	[0057.199] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0057.199] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x62cb38
	[0057.199] FindNextFileW (in: hFindFile=0x62cb38, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0057.199] FindNextFileW (in: hFindFile=0x62cb38, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0057.200] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24
	[0057.200] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-18") returned 1
	[0057.200] lstrlenW (lpString="S-1-5-18") returned 8
	[0057.200] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-18") returned -1
	[0057.200] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0057.200] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24
	[0057.200] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f44a8
	[0057.200] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.201] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0057.201] lstrlenW (lpString="desktop.ini") returned 11
	[0057.201] lstrlenW (lpString=".1cd") returned 4
	[0057.201] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0057.201] lstrlenW (lpString=".3ds") returned 4
	[0057.201] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0057.201] lstrlenW (lpString=".3fr") returned 4
	[0057.201] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0057.201] lstrlenW (lpString=".3g2") returned 4
	[0057.201] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0057.201] lstrlenW (lpString=".3gp") returned 4
	[0057.201] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0057.201] lstrlenW (lpString=".7z") returned 3
	[0057.201] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0057.201] lstrlenW (lpString=".accda") returned 6
	[0057.201] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0057.201] lstrlenW (lpString=".accdb") returned 6
	[0057.201] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0057.201] lstrlenW (lpString=".accdc") returned 6
	[0057.201] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0057.201] lstrlenW (lpString=".accde") returned 6
	[0057.202] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0057.202] lstrlenW (lpString=".accdt") returned 6
	[0057.202] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0057.202] lstrlenW (lpString=".accdw") returned 6
	[0057.202] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0057.202] lstrlenW (lpString=".adb") returned 4
	[0057.202] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0057.202] lstrlenW (lpString=".adp") returned 4
	[0057.202] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0057.202] lstrlenW (lpString=".ai") returned 3
	[0057.202] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0057.202] lstrlenW (lpString=".ai3") returned 4
	[0057.202] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0057.202] lstrlenW (lpString=".ai4") returned 4
	[0057.202] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0057.202] lstrlenW (lpString=".ai5") returned 4
	[0057.202] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0057.202] lstrlenW (lpString=".ai6") returned 4
	[0057.202] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0057.202] lstrlenW (lpString=".ai7") returned 4
	[0057.202] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0057.202] lstrlenW (lpString=".ai8") returned 4
	[0057.202] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0057.203] lstrlenW (lpString=".anim") returned 5
	[0057.203] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0057.203] lstrlenW (lpString=".arw") returned 4
	[0057.203] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0057.203] lstrlenW (lpString=".as") returned 3
	[0057.203] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0057.203] lstrlenW (lpString=".asa") returned 4
	[0057.203] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0057.203] lstrlenW (lpString=".asc") returned 4
	[0057.203] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0057.203] lstrlenW (lpString=".ascx") returned 5
	[0057.203] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0057.203] lstrlenW (lpString=".asm") returned 4
	[0057.203] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0057.203] lstrlenW (lpString=".asmx") returned 5
	[0057.203] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0057.203] lstrlenW (lpString=".asp") returned 4
	[0057.203] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0057.203] lstrlenW (lpString=".aspx") returned 5
	[0057.203] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0057.203] lstrlenW (lpString=".asr") returned 4
	[0057.203] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0057.203] lstrlenW (lpString=".asx") returned 4
	[0057.203] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0057.203] lstrlenW (lpString=".avi") returned 4
	[0057.203] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0057.203] lstrlenW (lpString=".avs") returned 4
	[0057.203] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0057.203] lstrlenW (lpString=".backup") returned 7
	[0057.204] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0057.204] lstrlenW (lpString=".bak") returned 4
	[0057.204] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0057.204] lstrlenW (lpString=".bay") returned 4
	[0057.204] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0057.204] lstrlenW (lpString=".bd") returned 3
	[0057.204] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0057.204] lstrlenW (lpString=".bin") returned 4
	[0057.204] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0057.204] lstrlenW (lpString=".bmp") returned 4
	[0057.204] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0057.204] lstrlenW (lpString=".bz2") returned 4
	[0057.204] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0057.204] lstrlenW (lpString=".c") returned 2
	[0057.204] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0057.204] lstrlenW (lpString=".cdr") returned 4
	[0057.204] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0057.204] lstrlenW (lpString=".cer") returned 4
	[0057.204] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0057.204] lstrlenW (lpString=".cf") returned 3
	[0057.204] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0057.204] lstrlenW (lpString=".cfc") returned 4
	[0057.204] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0057.204] lstrlenW (lpString=".cfm") returned 4
	[0057.204] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0057.204] lstrlenW (lpString=".cfml") returned 5
	[0057.204] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0057.205] lstrlenW (lpString=".cfu") returned 4
	[0057.205] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0057.205] lstrlenW (lpString=".chm") returned 4
	[0057.205] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0057.205] lstrlenW (lpString=".cin") returned 4
	[0057.205] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0057.205] lstrlenW (lpString=".class") returned 6
	[0057.205] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0057.205] lstrlenW (lpString=".clx") returned 4
	[0057.205] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0057.205] lstrlenW (lpString=".config") returned 7
	[0057.205] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0057.205] lstrlenW (lpString=".cpp") returned 4
	[0057.205] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0057.205] lstrlenW (lpString=".cr2") returned 4
	[0057.205] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0057.205] lstrlenW (lpString=".crt") returned 4
	[0057.205] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0057.205] lstrlenW (lpString=".crw") returned 4
	[0057.205] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0057.205] lstrlenW (lpString=".cs") returned 3
	[0057.205] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0057.205] lstrlenW (lpString=".css") returned 4
	[0057.205] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0057.205] lstrlenW (lpString=".csv") returned 4
	[0057.205] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".cub") returned 4
	[0057.206] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".dae") returned 4
	[0057.206] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".dat") returned 4
	[0057.206] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".db") returned 3
	[0057.206] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0057.206] lstrlenW (lpString=".dbf") returned 4
	[0057.206] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".dbx") returned 4
	[0057.206] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".dc3") returned 4
	[0057.206] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".dcm") returned 4
	[0057.206] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".dcr") returned 4
	[0057.206] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".der") returned 4
	[0057.206] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".dib") returned 4
	[0057.206] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".dic") returned 4
	[0057.206] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0057.206] lstrlenW (lpString=".dif") returned 4
	[0057.207] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0057.207] lstrlenW (lpString=".divx") returned 5
	[0057.207] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0057.207] lstrlenW (lpString=".djvu") returned 5
	[0057.207] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0057.207] lstrlenW (lpString=".dng") returned 4
	[0057.207] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0057.207] lstrlenW (lpString=".doc") returned 4
	[0057.207] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0057.207] lstrlenW (lpString=".docm") returned 5
	[0057.207] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0057.207] lstrlenW (lpString=".docx") returned 5
	[0057.207] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0057.207] lstrlenW (lpString=".dot") returned 4
	[0057.207] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0057.207] lstrlenW (lpString=".dotm") returned 5
	[0057.207] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0057.207] lstrlenW (lpString=".dotx") returned 5
	[0057.207] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0057.207] lstrlenW (lpString=".dpx") returned 4
	[0057.207] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0057.207] lstrlenW (lpString=".dqy") returned 4
	[0057.207] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0057.207] lstrlenW (lpString=".dsn") returned 4
	[0057.207] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0057.207] lstrlenW (lpString=".dt") returned 3
	[0057.208] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0057.208] lstrlenW (lpString=".dtd") returned 4
	[0057.208] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0057.208] lstrlenW (lpString=".dwg") returned 4
	[0057.394] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0057.394] lstrlenW (lpString=".dwt") returned 4
	[0057.394] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0057.394] lstrlenW (lpString=".dx") returned 3
	[0057.394] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0057.394] lstrlenW (lpString=".dxf") returned 4
	[0057.394] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0057.394] lstrlenW (lpString=".edml") returned 5
	[0057.394] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0057.394] lstrlenW (lpString=".efd") returned 4
	[0057.394] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0057.394] lstrlenW (lpString=".elf") returned 4
	[0057.394] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0057.394] lstrlenW (lpString=".emf") returned 4
	[0057.394] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0057.394] lstrlenW (lpString=".emz") returned 4
	[0057.394] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0057.394] lstrlenW (lpString=".epf") returned 4
	[0057.394] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0057.394] lstrlenW (lpString=".eps") returned 4
	[0057.394] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0057.394] lstrlenW (lpString=".epsf") returned 5
	[0057.394] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0057.394] lstrlenW (lpString=".epsp") returned 5
	[0057.394] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0057.394] lstrlenW (lpString=".erf") returned 4
	[0057.395] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0057.395] lstrlenW (lpString=".exr") returned 4
	[0057.395] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0057.395] lstrlenW (lpString=".f4v") returned 4
	[0057.395] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0057.395] lstrlenW (lpString=".fido") returned 5
	[0057.395] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0057.395] lstrlenW (lpString=".flm") returned 4
	[0057.395] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0057.395] lstrlenW (lpString=".flv") returned 4
	[0057.395] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0057.395] lstrlenW (lpString=".frm") returned 4
	[0057.395] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0057.395] lstrlenW (lpString=".fxg") returned 4
	[0057.395] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0057.395] lstrlenW (lpString=".geo") returned 4
	[0057.395] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0057.395] lstrlenW (lpString=".gif") returned 4
	[0057.395] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0057.396] lstrlenW (lpString=".grs") returned 4
	[0057.396] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0057.396] lstrlenW (lpString=".gz") returned 3
	[0057.396] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0057.396] lstrlenW (lpString=".h") returned 2
	[0057.396] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0057.396] lstrlenW (lpString=".hdr") returned 4
	[0057.396] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0057.396] lstrlenW (lpString=".hpp") returned 4
	[0057.396] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0057.396] lstrlenW (lpString=".hta") returned 4
	[0057.396] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0057.396] lstrlenW (lpString=".htc") returned 4
	[0057.396] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0057.396] lstrlenW (lpString=".htm") returned 4
	[0057.396] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0057.396] lstrlenW (lpString=".html") returned 5
	[0057.396] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0057.396] lstrlenW (lpString=".icb") returned 4
	[0057.396] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0057.396] lstrlenW (lpString=".ics") returned 4
	[0057.396] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0057.396] lstrlenW (lpString=".iff") returned 4
	[0057.397] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0057.397] lstrlenW (lpString=".inc") returned 4
	[0057.397] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0057.397] lstrlenW (lpString=".indd") returned 5
	[0057.397] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0057.397] lstrlenW (lpString=".ini") returned 4
	[0057.397] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0057.397] lstrlenW (lpString="desktop.ini") returned 11
	[0057.397] lstrlenW (lpString=".money") returned 6
	[0057.397] lstrcmpiW (lpString1=".money", lpString2="op.ini") returned -1
	[0057.397] lstrlenW (lpString="desktop.ini") returned 11
	[0057.397] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1
	[0057.397] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1
	[0057.397] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1
	[0057.397] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1
	[0057.397] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1
	[0057.397] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1
	[0057.397] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1
	[0057.397] lstrcmpiW (lpString1="d2.exe", lpString2="desktop.ini") returned -1
	[0057.397] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0057.397] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0057.397] FindClose (in: hFindFile=0x6f44a8 | out: hFindFile=0x6f44a8) returned 1
	[0057.398] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0057.398] FindNextFileW (in: hFindFile=0x62cb38, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0057.398] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61
	[0057.398] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1
	[0057.398] lstrlenW (lpString="S-1-5-21-1051304884-625712362-2192934891-1000") returned 45
	[0057.398] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000") returned -1
	[0057.398] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0057.398] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61
	[0057.398] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4528
	[0057.398] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.399] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0057.399] lstrlenW (lpString="desktop.ini") returned 11
	[0057.399] lstrlenW (lpString=".1cd") returned 4
	[0057.399] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0057.399] lstrlenW (lpString=".3ds") returned 4
	[0057.399] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0057.399] lstrlenW (lpString=".3fr") returned 4
	[0057.399] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0057.399] lstrlenW (lpString=".3g2") returned 4
	[0057.399] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0057.399] lstrlenW (lpString=".3gp") returned 4
	[0057.399] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0057.399] lstrlenW (lpString=".7z") returned 3
	[0057.399] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0057.399] lstrlenW (lpString=".accda") returned 6
	[0057.399] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0057.400] lstrlenW (lpString=".accdb") returned 6
	[0057.400] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0057.400] lstrlenW (lpString=".accdc") returned 6
	[0057.400] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0057.400] lstrlenW (lpString=".accde") returned 6
	[0057.400] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0057.400] lstrlenW (lpString=".accdt") returned 6
	[0057.400] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0057.400] lstrlenW (lpString=".accdw") returned 6
	[0057.400] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0057.400] lstrlenW (lpString=".adb") returned 4
	[0057.400] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0057.400] lstrlenW (lpString=".adp") returned 4
	[0057.400] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0057.400] lstrlenW (lpString=".ai") returned 3
	[0057.400] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0057.400] lstrlenW (lpString=".ai3") returned 4
	[0057.400] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0057.400] lstrlenW (lpString=".ai4") returned 4
	[0057.400] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0057.400] lstrlenW (lpString=".ai5") returned 4
	[0057.400] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0057.401] lstrlenW (lpString=".ai6") returned 4
	[0057.401] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0057.401] lstrlenW (lpString=".ai7") returned 4
	[0057.401] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0057.401] lstrlenW (lpString=".ai8") returned 4
	[0057.401] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0057.401] lstrlenW (lpString=".anim") returned 5
	[0057.401] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0057.401] lstrlenW (lpString=".arw") returned 4
	[0057.401] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0057.401] lstrlenW (lpString=".as") returned 3
	[0057.401] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0057.401] lstrlenW (lpString=".asa") returned 4
	[0057.401] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0057.401] lstrlenW (lpString=".asc") returned 4
	[0057.401] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0057.401] lstrlenW (lpString=".ascx") returned 5
	[0057.401] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0057.401] lstrlenW (lpString=".asm") returned 4
	[0057.402] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0057.402] lstrlenW (lpString=".asmx") returned 5
	[0057.402] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0057.402] lstrlenW (lpString=".asp") returned 4
	[0057.402] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0057.402] lstrlenW (lpString=".aspx") returned 5
	[0057.402] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0057.402] lstrlenW (lpString=".asr") returned 4
	[0057.402] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0057.402] lstrlenW (lpString=".asx") returned 4
	[0057.402] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0057.402] lstrlenW (lpString=".avi") returned 4
	[0057.402] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0057.402] lstrlenW (lpString=".avs") returned 4
	[0057.402] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0057.402] lstrlenW (lpString=".backup") returned 7
	[0057.402] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0057.402] lstrlenW (lpString=".bak") returned 4
	[0057.402] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0057.402] lstrlenW (lpString=".bay") returned 4
	[0057.402] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0057.402] lstrlenW (lpString=".bd") returned 3
	[0057.403] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0057.403] lstrlenW (lpString=".bin") returned 4
	[0057.403] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0057.403] lstrlenW (lpString=".bmp") returned 4
	[0057.403] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0057.403] lstrlenW (lpString=".bz2") returned 4
	[0057.403] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0057.403] lstrlenW (lpString=".c") returned 2
	[0057.403] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0057.403] lstrlenW (lpString=".cdr") returned 4
	[0057.403] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0057.403] lstrlenW (lpString=".cer") returned 4
	[0057.403] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0057.403] lstrlenW (lpString=".cf") returned 3
	[0057.403] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0057.403] lstrlenW (lpString=".cfc") returned 4
	[0057.403] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0057.403] lstrlenW (lpString=".cfm") returned 4
	[0057.403] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0057.403] lstrlenW (lpString=".cfml") returned 5
	[0057.403] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0057.403] lstrlenW (lpString=".cfu") returned 4
	[0057.403] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0057.404] lstrlenW (lpString=".chm") returned 4
	[0057.404] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0057.404] lstrlenW (lpString=".cin") returned 4
	[0057.404] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0057.404] lstrlenW (lpString=".class") returned 6
	[0057.404] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0057.404] lstrlenW (lpString=".clx") returned 4
	[0057.404] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0057.404] lstrlenW (lpString=".config") returned 7
	[0057.404] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0057.404] lstrlenW (lpString=".cpp") returned 4
	[0057.404] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0057.404] lstrlenW (lpString=".cr2") returned 4
	[0057.404] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0057.404] lstrlenW (lpString=".crt") returned 4
	[0057.404] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0057.404] lstrlenW (lpString=".crw") returned 4
	[0057.404] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0057.404] lstrlenW (lpString=".cs") returned 3
	[0057.404] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0057.404] lstrlenW (lpString=".css") returned 4
	[0057.404] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0057.404] lstrlenW (lpString=".csv") returned 4
	[0057.404] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0057.404] lstrlenW (lpString=".cub") returned 4
	[0057.405] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0057.405] lstrlenW (lpString=".dae") returned 4
	[0057.405] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0057.405] lstrlenW (lpString=".dat") returned 4
	[0057.405] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0057.405] lstrlenW (lpString=".db") returned 3
	[0057.405] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0057.405] lstrlenW (lpString=".dbf") returned 4
	[0057.405] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0057.405] lstrlenW (lpString=".dbx") returned 4
	[0057.405] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0057.405] lstrlenW (lpString=".dc3") returned 4
	[0057.405] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0057.405] lstrlenW (lpString=".dcm") returned 4
	[0057.405] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0057.405] lstrlenW (lpString=".dcr") returned 4
	[0057.405] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0057.405] lstrlenW (lpString=".der") returned 4
	[0057.405] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0057.405] lstrlenW (lpString=".dib") returned 4
	[0057.405] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0057.406] lstrlenW (lpString=".dic") returned 4
	[0057.406] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0057.406] lstrlenW (lpString=".dif") returned 4
	[0057.406] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0057.406] lstrlenW (lpString=".divx") returned 5
	[0057.406] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0057.406] lstrlenW (lpString=".djvu") returned 5
	[0057.406] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0057.406] lstrlenW (lpString=".dng") returned 4
	[0057.406] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0057.406] lstrlenW (lpString=".doc") returned 4
	[0057.406] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0057.406] lstrlenW (lpString=".docm") returned 5
	[0057.406] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0057.406] lstrlenW (lpString=".docx") returned 5
	[0057.406] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0057.406] lstrlenW (lpString=".dot") returned 4
	[0057.406] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0057.406] lstrlenW (lpString=".dotm") returned 5
	[0057.406] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0057.406] lstrlenW (lpString=".dotx") returned 5
	[0057.406] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0057.406] lstrlenW (lpString=".dpx") returned 4
	[0057.406] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0057.406] lstrlenW (lpString=".dqy") returned 4
	[0057.406] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0057.407] lstrlenW (lpString=".dsn") returned 4
	[0057.407] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0057.407] lstrlenW (lpString=".dt") returned 3
	[0057.407] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0057.407] lstrlenW (lpString=".dtd") returned 4
	[0057.407] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0057.407] lstrlenW (lpString=".dwg") returned 4
	[0057.407] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0057.407] lstrlenW (lpString=".dwt") returned 4
	[0057.407] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0057.407] lstrlenW (lpString=".dx") returned 3
	[0057.407] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0057.407] lstrlenW (lpString=".dxf") returned 4
	[0057.407] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0057.407] lstrlenW (lpString=".edml") returned 5
	[0057.407] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0057.407] lstrlenW (lpString=".efd") returned 4
	[0057.407] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0057.407] lstrlenW (lpString=".elf") returned 4
	[0057.407] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0057.407] lstrlenW (lpString=".emf") returned 4
	[0057.407] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0057.408] lstrlenW (lpString=".emz") returned 4
	[0057.408] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0057.408] lstrlenW (lpString=".epf") returned 4
	[0057.408] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0057.408] lstrlenW (lpString=".eps") returned 4
	[0057.408] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0057.408] lstrlenW (lpString=".epsf") returned 5
	[0057.408] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0057.408] lstrlenW (lpString=".epsp") returned 5
	[0057.408] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0057.408] lstrlenW (lpString=".erf") returned 4
	[0057.408] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0057.408] lstrlenW (lpString=".exr") returned 4
	[0057.408] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0057.408] lstrlenW (lpString=".f4v") returned 4
	[0057.408] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0057.408] lstrlenW (lpString=".fido") returned 5
	[0057.408] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0057.409] lstrlenW (lpString=".flm") returned 4
	[0057.409] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0057.409] lstrlenW (lpString=".flv") returned 4
	[0057.409] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0057.409] lstrlenW (lpString=".frm") returned 4
	[0057.409] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0057.409] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0057.409] FindClose (in: hFindFile=0x6f4528 | out: hFindFile=0x6f4528) returned 1
	[0057.409] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0057.409] FindNextFileW (in: hFindFile=0x62cb38, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0057.409] FindClose (in: hFindFile=0x62cb38 | out: hFindFile=0x62cb38) returned 1
	[0057.409] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3570728 | out: hHeap=0x600000) returned 1
	[0057.411] FindNextFileW (in: hFindFile=0x62c9f8, lpFindFileData=0x2defcf8 | out: lpFindFileData=0x2defcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0057.411] FindNextFileW (in: hFindFile=0x62c9f8, lpFindFileData=0x2defcf8 | out: lpFindFileData=0x2defcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0057.411] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3570728
	[0057.412] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0057.412] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6f42e8
	[0057.413] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0057.414] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1
	[0057.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0057.414] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1
	[0057.414] lstrlenW (lpString="1025") returned 4
	[0057.414] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1
	[0057.414] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0057.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0057.415] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f3fe8
	[0057.415] FindNextFileW (in: hFindFile=0x6f3fe8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.416] FindNextFileW (in: hFindFile=0x6f3fe8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0057.416] lstrlenW (lpString="eula.rtf") returned 8
	[0057.416] lstrlenW (lpString=".1cd") returned 4
	[0057.416] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0057.416] lstrlenW (lpString=".3ds") returned 4
	[0057.416] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0057.416] lstrlenW (lpString=".3fr") returned 4
	[0057.416] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0057.416] lstrlenW (lpString=".3g2") returned 4
	[0057.416] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0057.416] lstrlenW (lpString=".3gp") returned 4
	[0057.416] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0057.416] lstrlenW (lpString=".7z") returned 3
	[0057.416] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0057.416] lstrlenW (lpString=".accda") returned 6
	[0057.416] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0057.416] lstrlenW (lpString=".accdb") returned 6
	[0057.416] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0057.416] lstrlenW (lpString=".accdc") returned 6
	[0057.417] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0057.417] lstrlenW (lpString=".accde") returned 6
	[0057.417] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0057.417] lstrlenW (lpString=".accdt") returned 6
	[0057.417] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0057.417] lstrlenW (lpString=".accdw") returned 6
	[0057.417] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0057.417] lstrlenW (lpString=".adb") returned 4
	[0057.417] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0057.417] lstrlenW (lpString=".adp") returned 4
	[0057.417] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0057.417] lstrlenW (lpString=".ai") returned 3
	[0057.417] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0057.417] lstrlenW (lpString=".ai3") returned 4
	[0057.417] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0057.417] lstrlenW (lpString=".ai4") returned 4
	[0057.417] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0057.417] lstrlenW (lpString=".ai5") returned 4
	[0057.417] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0057.417] lstrlenW (lpString=".ai6") returned 4
	[0057.417] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0057.417] lstrlenW (lpString=".ai7") returned 4
	[0057.417] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0057.417] lstrlenW (lpString=".ai8") returned 4
	[0057.417] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0057.418] lstrlenW (lpString=".anim") returned 5
	[0057.418] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0057.418] lstrlenW (lpString=".arw") returned 4
	[0057.418] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0057.418] lstrlenW (lpString=".as") returned 3
	[0057.418] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0057.418] lstrlenW (lpString=".asa") returned 4
	[0057.418] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0057.418] lstrlenW (lpString=".asc") returned 4
	[0057.418] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0057.418] lstrlenW (lpString=".ascx") returned 5
	[0057.418] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0057.418] lstrlenW (lpString=".asm") returned 4
	[0057.418] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0057.418] lstrlenW (lpString=".asmx") returned 5
	[0057.418] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0057.418] lstrlenW (lpString=".asp") returned 4
	[0057.418] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0057.418] lstrlenW (lpString=".aspx") returned 5
	[0057.418] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0057.418] lstrlenW (lpString=".asr") returned 4
	[0057.418] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0057.418] lstrlenW (lpString=".asx") returned 4
	[0057.418] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0057.418] lstrlenW (lpString=".avi") returned 4
	[0057.418] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0057.419] lstrlenW (lpString=".avs") returned 4
	[0057.419] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0057.419] lstrlenW (lpString=".backup") returned 7
	[0057.419] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0057.419] lstrlenW (lpString=".bak") returned 4
	[0057.419] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0057.419] lstrlenW (lpString=".bay") returned 4
	[0057.419] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0057.419] lstrlenW (lpString=".bd") returned 3
	[0057.419] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0057.419] lstrlenW (lpString=".bin") returned 4
	[0057.419] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0057.419] lstrlenW (lpString=".bmp") returned 4
	[0057.419] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0057.419] lstrlenW (lpString=".bz2") returned 4
	[0057.419] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0057.419] lstrlenW (lpString=".c") returned 2
	[0057.419] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0057.419] lstrlenW (lpString=".cdr") returned 4
	[0057.419] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0057.419] lstrlenW (lpString=".cer") returned 4
	[0057.419] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0057.419] lstrlenW (lpString=".cf") returned 3
	[0057.419] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0057.419] lstrlenW (lpString=".cfc") returned 4
	[0057.419] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0057.420] lstrlenW (lpString=".cfm") returned 4
	[0057.420] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0057.420] lstrlenW (lpString=".cfml") returned 5
	[0057.420] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0057.420] lstrlenW (lpString=".cfu") returned 4
	[0057.420] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0057.420] lstrlenW (lpString=".chm") returned 4
	[0057.420] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0057.420] lstrlenW (lpString=".cin") returned 4
	[0057.420] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0057.420] lstrlenW (lpString=".class") returned 6
	[0057.420] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0057.420] lstrlenW (lpString=".clx") returned 4
	[0057.420] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0057.420] lstrlenW (lpString=".config") returned 7
	[0057.420] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0057.420] lstrlenW (lpString=".cpp") returned 4
	[0057.420] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0057.420] lstrlenW (lpString=".cr2") returned 4
	[0057.420] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0057.420] lstrlenW (lpString=".crt") returned 4
	[0057.420] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0057.420] lstrlenW (lpString=".crw") returned 4
	[0057.420] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0057.420] lstrlenW (lpString=".cs") returned 3
	[0057.420] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0057.421] lstrlenW (lpString=".css") returned 4
	[0057.421] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".csv") returned 4
	[0057.421] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".cub") returned 4
	[0057.421] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".dae") returned 4
	[0057.421] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".dat") returned 4
	[0057.421] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".db") returned 3
	[0057.421] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0057.421] lstrlenW (lpString=".dbf") returned 4
	[0057.421] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".dbx") returned 4
	[0057.421] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".dc3") returned 4
	[0057.421] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".dcm") returned 4
	[0057.421] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".dcr") returned 4
	[0057.421] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".der") returned 4
	[0057.421] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".dib") returned 4
	[0057.421] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0057.421] lstrlenW (lpString=".dic") returned 4
	[0057.422] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0057.422] lstrlenW (lpString=".dif") returned 4
	[0057.422] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0057.422] lstrlenW (lpString=".divx") returned 5
	[0057.422] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0057.422] lstrlenW (lpString=".djvu") returned 5
	[0057.422] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0057.422] lstrlenW (lpString=".dng") returned 4
	[0057.422] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0057.422] lstrlenW (lpString=".doc") returned 4
	[0057.422] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0057.422] lstrlenW (lpString=".docm") returned 5
	[0057.422] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0057.422] lstrlenW (lpString=".docx") returned 5
	[0057.422] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0057.422] lstrlenW (lpString=".dot") returned 4
	[0057.422] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0057.422] lstrlenW (lpString=".dotm") returned 5
	[0057.422] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0057.422] lstrlenW (lpString=".dotx") returned 5
	[0057.422] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0057.422] lstrlenW (lpString=".dpx") returned 4
	[0057.422] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0057.422] lstrlenW (lpString=".dqy") returned 4
	[0057.422] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0057.422] lstrlenW (lpString=".dsn") returned 4
	[0057.423] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0057.423] lstrlenW (lpString=".dt") returned 3
	[0057.423] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0057.423] lstrlenW (lpString=".dtd") returned 4
	[0057.423] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0057.423] lstrlenW (lpString=".dwg") returned 4
	[0057.423] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0057.423] lstrlenW (lpString=".dwt") returned 4
	[0057.423] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0057.423] lstrlenW (lpString=".dx") returned 3
	[0057.423] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0057.423] lstrlenW (lpString=".dxf") returned 4
	[0057.423] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0057.423] lstrlenW (lpString=".edml") returned 5
	[0057.423] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0057.423] lstrlenW (lpString=".efd") returned 4
	[0057.423] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0057.423] lstrlenW (lpString=".elf") returned 4
	[0057.423] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0057.423] lstrlenW (lpString=".emf") returned 4
	[0057.423] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0057.423] lstrlenW (lpString=".emz") returned 4
	[0057.423] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0057.423] lstrlenW (lpString=".epf") returned 4
	[0057.423] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0057.423] lstrlenW (lpString=".eps") returned 4
	[0057.424] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0057.424] lstrlenW (lpString=".epsf") returned 5
	[0057.424] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0057.424] lstrlenW (lpString=".epsp") returned 5
	[0057.424] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0057.424] lstrlenW (lpString=".erf") returned 4
	[0057.424] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0057.424] lstrlenW (lpString=".exr") returned 4
	[0057.424] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0057.424] lstrlenW (lpString=".f4v") returned 4
	[0057.424] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0057.424] lstrlenW (lpString=".fido") returned 5
	[0057.424] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0057.424] lstrlenW (lpString=".flm") returned 4
	[0057.424] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0057.424] lstrlenW (lpString=".flv") returned 4
	[0057.424] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0057.424] lstrlenW (lpString=".frm") returned 4
	[0057.424] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0057.424] lstrlenW (lpString=".fxg") returned 4
	[0057.424] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0057.424] lstrlenW (lpString=".geo") returned 4
	[0057.424] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0057.424] lstrlenW (lpString=".gif") returned 4
	[0057.424] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0057.424] lstrlenW (lpString=".grs") returned 4
	[0057.424] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0057.425] lstrlenW (lpString=".gz") returned 3
	[0057.425] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0057.425] lstrlenW (lpString=".h") returned 2
	[0057.425] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0057.425] lstrlenW (lpString=".hdr") returned 4
	[0057.425] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0057.425] lstrlenW (lpString=".hpp") returned 4
	[0057.425] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0057.425] lstrlenW (lpString=".hta") returned 4
	[0057.425] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0057.425] lstrlenW (lpString=".htc") returned 4
	[0057.425] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0057.425] lstrlenW (lpString=".htm") returned 4
	[0057.425] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0057.425] lstrlenW (lpString=".html") returned 5
	[0057.425] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0057.425] lstrlenW (lpString=".icb") returned 4
	[0057.425] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0057.425] lstrlenW (lpString=".ics") returned 4
	[0057.425] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0057.425] lstrlenW (lpString=".iff") returned 4
	[0057.425] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0057.425] lstrlenW (lpString=".inc") returned 4
	[0057.425] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0057.425] lstrlenW (lpString=".indd") returned 5
	[0057.425] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0057.425] lstrlenW (lpString=".ini") returned 4
	[0057.425] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0057.425] lstrlenW (lpString=".iqy") returned 4
	[0057.425] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0057.426] lstrlenW (lpString=".j2c") returned 4
	[0057.426] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0057.426] lstrlenW (lpString=".j2k") returned 4
	[0057.426] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0057.426] lstrlenW (lpString=".java") returned 5
	[0057.426] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0057.426] lstrlenW (lpString=".jp2") returned 4
	[0057.426] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0057.426] lstrlenW (lpString=".jpc") returned 4
	[0057.426] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0057.426] lstrlenW (lpString=".jpe") returned 4
	[0057.426] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0057.426] lstrlenW (lpString=".jpeg") returned 5
	[0057.426] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0057.426] lstrlenW (lpString=".jpf") returned 4
	[0057.426] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0057.426] lstrlenW (lpString=".jpg") returned 4
	[0057.426] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0057.426] lstrlenW (lpString=".jpx") returned 4
	[0057.426] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0057.426] lstrlenW (lpString=".js") returned 3
	[0057.426] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0057.426] lstrlenW (lpString=".jsf") returned 4
	[0057.426] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0057.426] lstrlenW (lpString=".json") returned 5
	[0057.426] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0057.631] lstrlenW (lpString=".jsp") returned 4
	[0057.631] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0057.631] lstrlenW (lpString=".kdc") returned 4
	[0057.631] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0057.631] lstrlenW (lpString=".kmz") returned 4
	[0057.631] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0057.631] lstrlenW (lpString=".kwm") returned 4
	[0057.631] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0057.631] lstrlenW (lpString=".lasso") returned 6
	[0057.631] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0057.631] lstrlenW (lpString=".lbi") returned 4
	[0057.631] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0057.631] lstrlenW (lpString=".lgf") returned 4
	[0057.632] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0057.632] lstrlenW (lpString=".lgp") returned 4
	[0057.632] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0057.632] lstrlenW (lpString=".log") returned 4
	[0057.632] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0057.632] lstrlenW (lpString=".m1v") returned 4
	[0057.632] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0057.632] lstrlenW (lpString=".m4a") returned 4
	[0057.632] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0057.632] lstrlenW (lpString=".m4v") returned 4
	[0057.632] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0057.632] lstrlenW (lpString=".max") returned 4
	[0057.632] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0057.632] lstrlenW (lpString=".md") returned 3
	[0057.632] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0057.632] lstrlenW (lpString=".mda") returned 4
	[0057.632] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0057.632] lstrlenW (lpString=".mdb") returned 4
	[0057.632] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0057.632] lstrlenW (lpString=".mde") returned 4
	[0057.632] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0057.632] lstrlenW (lpString=".mdf") returned 4
	[0057.632] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0057.632] lstrlenW (lpString=".mdw") returned 4
	[0057.633] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0057.633] lstrlenW (lpString=".mef") returned 4
	[0057.633] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0057.633] lstrlenW (lpString=".mft") returned 4
	[0057.633] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0057.633] lstrlenW (lpString=".mfw") returned 4
	[0057.633] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0057.633] lstrlenW (lpString=".mht") returned 4
	[0057.633] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0057.633] lstrlenW (lpString=".mhtml") returned 6
	[0057.633] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0057.633] lstrlenW (lpString=".mka") returned 4
	[0057.633] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0057.633] lstrlenW (lpString=".mkidx") returned 6
	[0057.633] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0057.633] lstrlenW (lpString=".mkv") returned 4
	[0057.633] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0057.633] lstrlenW (lpString=".mos") returned 4
	[0057.633] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0057.633] lstrlenW (lpString=".mov") returned 4
	[0057.633] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0057.633] lstrlenW (lpString=".mp3") returned 4
	[0057.633] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0057.633] lstrlenW (lpString=".mp4") returned 4
	[0057.634] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0057.634] lstrlenW (lpString=".mpeg") returned 5
	[0057.634] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0057.634] lstrlenW (lpString=".mpg") returned 4
	[0057.634] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0057.634] lstrlenW (lpString=".mpv") returned 4
	[0057.634] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0057.634] lstrlenW (lpString=".mrw") returned 4
	[0057.634] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0057.634] lstrlenW (lpString=".msg") returned 4
	[0057.634] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0057.634] lstrlenW (lpString=".mxl") returned 4
	[0057.634] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0057.634] lstrlenW (lpString=".myd") returned 4
	[0057.634] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0057.634] lstrlenW (lpString=".myi") returned 4
	[0057.634] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0057.634] lstrlenW (lpString=".nef") returned 4
	[0057.634] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0057.634] lstrlenW (lpString=".nrw") returned 4
	[0057.634] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0057.634] lstrlenW (lpString=".obj") returned 4
	[0057.634] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0057.634] lstrlenW (lpString=".odb") returned 4
	[0057.635] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0057.635] lstrlenW (lpString=".odc") returned 4
	[0057.635] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0057.635] lstrlenW (lpString=".odm") returned 4
	[0057.635] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0057.635] lstrlenW (lpString=".odp") returned 4
	[0057.635] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0057.635] lstrlenW (lpString=".ods") returned 4
	[0057.635] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0057.635] lstrlenW (lpString=".oft") returned 4
	[0057.635] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0057.635] lstrlenW (lpString=".one") returned 4
	[0057.635] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0057.635] lstrlenW (lpString=".onepkg") returned 7
	[0057.635] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0057.635] lstrlenW (lpString=".onetoc2") returned 8
	[0057.635] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0057.635] lstrlenW (lpString=".opt") returned 4
	[0057.635] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0057.635] lstrlenW (lpString=".oqy") returned 4
	[0057.635] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0057.635] lstrlenW (lpString=".orf") returned 4
	[0057.635] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".p12") returned 4
	[0057.636] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".p7b") returned 4
	[0057.636] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".p7c") returned 4
	[0057.636] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".pam") returned 4
	[0057.636] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".pbm") returned 4
	[0057.636] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".pct") returned 4
	[0057.636] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".pcx") returned 4
	[0057.636] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".pdd") returned 4
	[0057.636] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".pdf") returned 4
	[0057.636] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".pdp") returned 4
	[0057.636] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".pef") returned 4
	[0057.636] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0057.636] lstrlenW (lpString=".pem") returned 4
	[0057.636] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0057.637] lstrlenW (lpString=".pff") returned 4
	[0057.637] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0057.637] lstrlenW (lpString=".pfm") returned 4
	[0057.637] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0057.637] lstrlenW (lpString=".pfx") returned 4
	[0057.637] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0057.637] lstrlenW (lpString=".pgm") returned 4
	[0057.637] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0057.637] lstrlenW (lpString=".php") returned 4
	[0057.637] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0057.637] lstrlenW (lpString=".php3") returned 5
	[0057.637] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0057.637] lstrlenW (lpString=".php4") returned 5
	[0057.637] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0057.637] lstrlenW (lpString=".php5") returned 5
	[0057.637] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0057.637] lstrlenW (lpString=".phtml") returned 6
	[0057.637] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0057.637] lstrlenW (lpString=".pict") returned 5
	[0057.637] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0057.637] lstrlenW (lpString=".pl") returned 3
	[0057.637] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0057.637] lstrlenW (lpString=".pls") returned 4
	[0057.637] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0057.637] lstrlenW (lpString=".pm") returned 3
	[0057.637] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0057.637] lstrlenW (lpString=".png") returned 4
	[0057.637] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0057.638] lstrlenW (lpString=".pnm") returned 4
	[0057.638] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0057.638] lstrlenW (lpString=".pot") returned 4
	[0057.638] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0057.638] lstrlenW (lpString=".potm") returned 5
	[0057.638] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0057.638] lstrlenW (lpString=".potx") returned 5
	[0057.638] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0057.638] lstrlenW (lpString=".ppa") returned 4
	[0057.638] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0057.638] lstrlenW (lpString=".ppam") returned 5
	[0057.638] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0057.638] lstrlenW (lpString=".ppm") returned 4
	[0057.638] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0057.638] lstrlenW (lpString=".pps") returned 4
	[0057.638] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0057.638] lstrlenW (lpString=".ppsm") returned 5
	[0057.638] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0057.638] lstrlenW (lpString=".ppt") returned 4
	[0057.638] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0057.638] lstrlenW (lpString=".pptm") returned 5
	[0057.638] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0057.638] lstrlenW (lpString=".pptx") returned 5
	[0057.638] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0057.638] lstrlenW (lpString=".prn") returned 4
	[0057.638] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0057.638] lstrlenW (lpString=".ps") returned 3
	[0057.638] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0057.638] lstrlenW (lpString=".psb") returned 4
	[0057.638] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0057.638] lstrlenW (lpString=".psd") returned 4
	[0057.638] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0057.638] lstrlenW (lpString=".pst") returned 4
	[0057.639] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0057.639] lstrlenW (lpString=".ptx") returned 4
	[0057.639] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0057.639] lstrlenW (lpString=".pub") returned 4
	[0057.639] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0057.639] lstrlenW (lpString=".pwm") returned 4
	[0057.639] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0057.639] lstrlenW (lpString=".pxr") returned 4
	[0057.639] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0057.639] lstrlenW (lpString=".py") returned 3
	[0057.639] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0057.639] lstrlenW (lpString=".qt") returned 3
	[0057.639] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0057.639] FindNextFileW (in: hFindFile=0x6f3fe8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0057.639] FindNextFileW (in: hFindFile=0x6f3fe8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0057.640] FindNextFileW (in: hFindFile=0x6f3fe8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0057.640] FindClose (in: hFindFile=0x6f3fe8 | out: hFindFile=0x6f3fe8) returned 1
	[0057.640] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0057.640] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1
	[0057.640] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0057.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26
	[0057.640] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f45a8
	[0057.641] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.641] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0057.641] lstrlenW (lpString="eula.rtf") returned 8
	[0057.641] lstrlenW (lpString=".1cd") returned 4
	[0057.641] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0057.641] lstrlenW (lpString=".3ds") returned 4
	[0057.641] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0057.641] lstrlenW (lpString=".3fr") returned 4
	[0057.641] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0057.641] lstrlenW (lpString=".3g2") returned 4
	[0057.641] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0057.641] lstrlenW (lpString=".3gp") returned 4
	[0057.641] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0057.641] lstrlenW (lpString=".7z") returned 3
	[0057.641] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0057.642] lstrlenW (lpString=".accda") returned 6
	[0057.642] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0057.642] lstrlenW (lpString=".accdb") returned 6
	[0057.642] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0057.642] lstrlenW (lpString=".accdc") returned 6
	[0057.642] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0057.642] lstrlenW (lpString=".accde") returned 6
	[0057.642] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0057.642] lstrlenW (lpString=".accdt") returned 6
	[0057.642] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0057.642] lstrlenW (lpString=".accdw") returned 6
	[0057.642] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0057.642] lstrlenW (lpString=".adb") returned 4
	[0057.642] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0057.642] lstrlenW (lpString=".adp") returned 4
	[0057.642] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0057.642] lstrlenW (lpString=".ai") returned 3
	[0057.642] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0057.642] lstrlenW (lpString=".ai3") returned 4
	[0057.642] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0057.642] lstrlenW (lpString=".ai4") returned 4
	[0057.642] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0057.642] lstrlenW (lpString=".ai5") returned 4
	[0057.642] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0057.642] lstrlenW (lpString=".ai6") returned 4
	[0057.642] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0057.642] lstrlenW (lpString=".ai7") returned 4
	[0057.642] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0057.642] lstrlenW (lpString=".ai8") returned 4
	[0057.642] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0057.643] lstrlenW (lpString=".anim") returned 5
	[0057.643] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0057.643] lstrlenW (lpString=".arw") returned 4
	[0057.643] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0057.643] lstrlenW (lpString=".as") returned 3
	[0057.643] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0057.643] lstrlenW (lpString=".asa") returned 4
	[0057.643] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0057.643] lstrlenW (lpString=".asc") returned 4
	[0057.643] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0057.643] lstrlenW (lpString=".ascx") returned 5
	[0057.643] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0057.643] lstrlenW (lpString=".asm") returned 4
	[0057.643] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0057.643] lstrlenW (lpString=".asmx") returned 5
	[0057.643] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0057.643] lstrlenW (lpString=".asp") returned 4
	[0057.643] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0057.643] lstrlenW (lpString=".aspx") returned 5
	[0057.643] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0057.643] lstrlenW (lpString=".asr") returned 4
	[0057.643] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0057.643] lstrlenW (lpString=".asx") returned 4
	[0057.643] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0057.643] lstrlenW (lpString=".avi") returned 4
	[0057.643] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0057.643] lstrlenW (lpString=".avs") returned 4
	[0057.644] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0057.644] lstrlenW (lpString=".backup") returned 7
	[0057.644] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0057.644] lstrlenW (lpString=".bak") returned 4
	[0057.644] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0057.644] lstrlenW (lpString=".bay") returned 4
	[0057.644] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0057.644] lstrlenW (lpString=".bd") returned 3
	[0057.644] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0057.644] lstrlenW (lpString=".bin") returned 4
	[0057.644] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0057.644] lstrlenW (lpString=".bmp") returned 4
	[0057.644] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0057.644] lstrlenW (lpString=".bz2") returned 4
	[0057.644] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0057.644] lstrlenW (lpString=".c") returned 2
	[0057.644] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0057.644] lstrlenW (lpString=".cdr") returned 4
	[0057.644] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0057.644] lstrlenW (lpString=".cer") returned 4
	[0057.644] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0057.644] lstrlenW (lpString=".cf") returned 3
	[0057.644] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0057.644] lstrlenW (lpString=".cfc") returned 4
	[0057.644] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0057.644] lstrlenW (lpString=".cfm") returned 4
	[0057.645] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0057.645] lstrlenW (lpString=".cfml") returned 5
	[0057.645] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0057.645] lstrlenW (lpString=".cfu") returned 4
	[0057.645] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0057.645] lstrlenW (lpString=".chm") returned 4
	[0057.645] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0057.645] lstrlenW (lpString=".cin") returned 4
	[0057.645] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0057.645] lstrlenW (lpString=".class") returned 6
	[0057.645] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0057.645] lstrlenW (lpString=".clx") returned 4
	[0057.645] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0057.645] lstrlenW (lpString=".config") returned 7
	[0057.645] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0057.645] lstrlenW (lpString=".cpp") returned 4
	[0057.645] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0057.645] lstrlenW (lpString=".cr2") returned 4
	[0057.645] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0057.645] lstrlenW (lpString=".crt") returned 4
	[0057.646] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0057.646] lstrlenW (lpString=".crw") returned 4
	[0057.646] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0057.646] lstrlenW (lpString=".cs") returned 3
	[0057.646] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0057.646] lstrlenW (lpString=".css") returned 4
	[0057.646] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0057.646] lstrlenW (lpString=".csv") returned 4
	[0057.646] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0057.646] lstrlenW (lpString=".cub") returned 4
	[0057.646] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0057.646] lstrlenW (lpString=".dae") returned 4
	[0057.646] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0057.646] lstrlenW (lpString=".dat") returned 4
	[0057.646] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0057.646] lstrlenW (lpString=".db") returned 3
	[0057.646] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0057.646] lstrlenW (lpString=".dbf") returned 4
	[0057.646] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0057.646] lstrlenW (lpString=".dbx") returned 4
	[0057.646] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0057.647] lstrlenW (lpString=".dc3") returned 4
	[0057.647] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0057.647] lstrlenW (lpString=".dcm") returned 4
	[0057.647] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0057.647] lstrlenW (lpString=".dcr") returned 4
	[0057.647] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0057.647] lstrlenW (lpString=".der") returned 4
	[0057.647] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0057.647] lstrlenW (lpString=".dib") returned 4
	[0057.647] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0057.647] lstrlenW (lpString=".dic") returned 4
	[0057.647] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0057.647] lstrlenW (lpString=".dif") returned 4
	[0057.647] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0057.647] lstrlenW (lpString=".divx") returned 5
	[0057.647] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0057.647] lstrlenW (lpString=".djvu") returned 5
	[0057.647] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0057.647] lstrlenW (lpString=".dng") returned 4
	[0057.647] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0057.647] lstrlenW (lpString=".doc") returned 4
	[0057.647] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0057.647] lstrlenW (lpString=".docm") returned 5
	[0057.648] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0057.648] lstrlenW (lpString=".docx") returned 5
	[0057.648] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0057.648] lstrlenW (lpString=".dot") returned 4
	[0057.648] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0057.648] lstrlenW (lpString=".dotm") returned 5
	[0057.648] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0057.648] lstrlenW (lpString=".dotx") returned 5
	[0057.648] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0057.648] lstrlenW (lpString=".dpx") returned 4
	[0057.648] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0057.648] lstrlenW (lpString=".dqy") returned 4
	[0057.648] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0057.648] lstrlenW (lpString=".dsn") returned 4
	[0057.648] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0057.648] lstrlenW (lpString=".dt") returned 3
	[0057.648] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0057.648] lstrlenW (lpString=".dtd") returned 4
	[0057.648] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0057.648] lstrlenW (lpString=".dwg") returned 4
	[0057.648] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0057.648] lstrlenW (lpString=".dwt") returned 4
	[0057.648] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0057.648] lstrlenW (lpString=".dx") returned 3
	[0057.649] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0057.649] lstrlenW (lpString=".dxf") returned 4
	[0057.649] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0057.649] lstrlenW (lpString=".edml") returned 5
	[0057.649] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0057.649] lstrlenW (lpString=".efd") returned 4
	[0057.649] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0057.649] lstrlenW (lpString=".elf") returned 4
	[0057.649] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0057.649] lstrlenW (lpString=".emf") returned 4
	[0057.649] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0057.649] lstrlenW (lpString=".emz") returned 4
	[0057.649] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0057.649] lstrlenW (lpString=".epf") returned 4
	[0057.649] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0057.649] lstrlenW (lpString=".eps") returned 4
	[0057.649] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0057.649] lstrlenW (lpString=".epsf") returned 5
	[0057.649] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0057.649] lstrlenW (lpString=".epsp") returned 5
	[0057.649] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0057.649] lstrlenW (lpString=".erf") returned 4
	[0057.649] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0057.649] lstrlenW (lpString=".exr") returned 4
	[0057.649] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0057.649] lstrlenW (lpString=".f4v") returned 4
	[0057.649] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0057.649] lstrlenW (lpString=".fido") returned 5
	[0057.650] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0057.650] lstrlenW (lpString=".flm") returned 4
	[0057.650] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0057.650] lstrlenW (lpString=".flv") returned 4
	[0057.650] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0057.650] lstrlenW (lpString=".frm") returned 4
	[0057.650] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0057.650] lstrlenW (lpString=".fxg") returned 4
	[0057.650] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0057.650] lstrlenW (lpString=".geo") returned 4
	[0057.650] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0057.650] lstrlenW (lpString=".gif") returned 4
	[0057.650] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0057.650] lstrlenW (lpString=".grs") returned 4
	[0057.650] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0057.650] lstrlenW (lpString=".gz") returned 3
	[0057.650] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0057.650] lstrlenW (lpString=".h") returned 2
	[0057.650] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0057.650] lstrlenW (lpString=".hdr") returned 4
	[0057.650] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0057.650] lstrlenW (lpString=".hpp") returned 4
	[0057.650] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0057.650] lstrlenW (lpString=".hta") returned 4
	[0057.650] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0057.650] lstrlenW (lpString=".htc") returned 4
	[0057.651] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0057.651] lstrlenW (lpString=".htm") returned 4
	[0057.651] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0057.651] lstrlenW (lpString=".html") returned 5
	[0057.651] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0057.651] lstrlenW (lpString=".icb") returned 4
	[0057.651] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0057.651] lstrlenW (lpString=".ics") returned 4
	[0057.651] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0057.651] lstrlenW (lpString=".iff") returned 4
	[0057.651] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0057.651] lstrlenW (lpString=".inc") returned 4
	[0057.651] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0057.651] lstrlenW (lpString=".indd") returned 5
	[0057.651] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0057.651] lstrlenW (lpString=".ini") returned 4
	[0057.651] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0057.651] lstrlenW (lpString=".iqy") returned 4
	[0057.651] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0057.651] lstrlenW (lpString=".j2c") returned 4
	[0057.651] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0057.651] lstrlenW (lpString=".j2k") returned 4
	[0057.651] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0057.651] lstrlenW (lpString=".java") returned 5
	[0057.652] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0057.652] lstrlenW (lpString=".jp2") returned 4
	[0057.652] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0057.652] lstrlenW (lpString=".jpc") returned 4
	[0057.652] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0057.652] lstrlenW (lpString=".jpe") returned 4
	[0057.652] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0057.652] lstrlenW (lpString=".jpeg") returned 5
	[0057.652] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0057.652] lstrlenW (lpString=".jpf") returned 4
	[0057.652] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0057.652] lstrlenW (lpString=".jpg") returned 4
	[0057.652] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0057.652] lstrlenW (lpString=".jpx") returned 4
	[0057.652] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0057.652] lstrlenW (lpString=".js") returned 3
	[0057.652] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0057.652] lstrlenW (lpString=".jsf") returned 4
	[0057.652] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0057.652] lstrlenW (lpString=".json") returned 5
	[0057.652] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0057.652] lstrlenW (lpString=".jsp") returned 4
	[0057.652] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0057.652] lstrlenW (lpString=".kdc") returned 4
	[0057.653] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0057.653] lstrlenW (lpString=".kmz") returned 4
	[0057.653] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0057.653] lstrlenW (lpString=".kwm") returned 4
	[0057.653] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0057.653] lstrlenW (lpString=".lasso") returned 6
	[0057.653] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0057.653] lstrlenW (lpString=".lbi") returned 4
	[0057.653] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0057.653] lstrlenW (lpString=".lgf") returned 4
	[0057.653] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0057.653] lstrlenW (lpString=".lgp") returned 4
	[0057.653] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0057.653] lstrlenW (lpString=".log") returned 4
	[0057.653] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0057.653] lstrlenW (lpString=".m1v") returned 4
	[0057.653] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0057.653] lstrlenW (lpString=".m4a") returned 4
	[0057.653] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0057.653] lstrlenW (lpString=".m4v") returned 4
	[0057.653] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0057.653] lstrlenW (lpString=".max") returned 4
	[0057.653] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0057.653] lstrlenW (lpString=".md") returned 3
	[0057.653] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0057.654] lstrlenW (lpString=".mda") returned 4
	[0057.654] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0057.654] lstrlenW (lpString=".mdb") returned 4
	[0057.654] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0057.654] lstrlenW (lpString=".mde") returned 4
	[0057.654] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0057.654] lstrlenW (lpString=".mdf") returned 4
	[0057.654] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0057.654] lstrlenW (lpString=".mdw") returned 4
	[0057.654] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0057.654] lstrlenW (lpString=".mef") returned 4
	[0057.654] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0057.654] lstrlenW (lpString=".mft") returned 4
	[0057.654] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0057.654] lstrlenW (lpString=".mfw") returned 4
	[0057.654] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0057.654] lstrlenW (lpString=".mht") returned 4
	[0057.654] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0057.654] lstrlenW (lpString=".mhtml") returned 6
	[0057.654] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0057.654] lstrlenW (lpString=".mka") returned 4
	[0057.654] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0057.654] lstrlenW (lpString=".mkidx") returned 6
	[0057.654] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0057.654] lstrlenW (lpString=".mkv") returned 4
	[0057.655] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".mos") returned 4
	[0057.655] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".mov") returned 4
	[0057.655] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".mp3") returned 4
	[0057.655] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".mp4") returned 4
	[0057.655] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".mpeg") returned 5
	[0057.655] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0057.655] lstrlenW (lpString=".mpg") returned 4
	[0057.655] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".mpv") returned 4
	[0057.655] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".mrw") returned 4
	[0057.655] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".msg") returned 4
	[0057.655] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".mxl") returned 4
	[0057.655] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".myd") returned 4
	[0057.655] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".myi") returned 4
	[0057.655] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0057.655] lstrlenW (lpString=".nef") returned 4
	[0057.655] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0057.656] lstrlenW (lpString=".nrw") returned 4
	[0057.656] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0057.656] lstrlenW (lpString=".obj") returned 4
	[0057.656] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0057.656] lstrlenW (lpString=".odb") returned 4
	[0057.656] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0057.656] lstrlenW (lpString=".odc") returned 4
	[0057.656] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0057.656] lstrlenW (lpString=".odm") returned 4
	[0057.656] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0057.656] lstrlenW (lpString=".odp") returned 4
	[0057.656] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0057.656] lstrlenW (lpString=".ods") returned 4
	[0057.656] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0057.656] lstrlenW (lpString=".oft") returned 4
	[0057.656] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0057.656] lstrlenW (lpString=".one") returned 4
	[0057.656] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0057.656] lstrlenW (lpString=".onepkg") returned 7
	[0057.656] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0057.656] lstrlenW (lpString=".onetoc2") returned 8
	[0057.656] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0057.656] lstrlenW (lpString=".opt") returned 4
	[0057.656] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0057.656] lstrlenW (lpString=".oqy") returned 4
	[0057.656] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".orf") returned 4
	[0057.657] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".p12") returned 4
	[0057.657] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".p7b") returned 4
	[0057.657] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".p7c") returned 4
	[0057.657] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".pam") returned 4
	[0057.657] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".pbm") returned 4
	[0057.657] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".pct") returned 4
	[0057.657] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".pcx") returned 4
	[0057.657] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".pdd") returned 4
	[0057.657] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".pdf") returned 4
	[0057.657] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".pdp") returned 4
	[0057.657] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".pef") returned 4
	[0057.657] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".pem") returned 4
	[0057.657] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0057.657] lstrlenW (lpString=".pff") returned 4
	[0057.658] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0057.658] lstrlenW (lpString=".pfm") returned 4
	[0057.658] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0057.658] lstrlenW (lpString=".pfx") returned 4
	[0057.658] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0057.658] lstrlenW (lpString=".pgm") returned 4
	[0057.658] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0057.658] lstrlenW (lpString=".php") returned 4
	[0057.658] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0057.658] lstrlenW (lpString=".php3") returned 5
	[0057.658] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0057.658] lstrlenW (lpString=".php4") returned 5
	[0057.658] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0057.658] lstrlenW (lpString=".php5") returned 5
	[0057.658] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0057.658] lstrlenW (lpString=".phtml") returned 6
	[0057.658] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0057.658] lstrlenW (lpString=".pict") returned 5
	[0057.658] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0057.658] lstrlenW (lpString=".pl") returned 3
	[0057.658] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0057.658] lstrlenW (lpString=".pls") returned 4
	[0057.658] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0057.658] lstrlenW (lpString=".pm") returned 3
	[0057.658] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0057.658] lstrlenW (lpString=".png") returned 4
	[0057.659] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0057.659] lstrlenW (lpString=".pnm") returned 4
	[0057.659] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0057.659] lstrlenW (lpString=".pot") returned 4
	[0057.659] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0057.659] lstrlenW (lpString=".potm") returned 5
	[0057.659] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0057.659] lstrlenW (lpString=".potx") returned 5
	[0057.659] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0057.659] lstrlenW (lpString=".ppa") returned 4
	[0057.659] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0057.659] lstrlenW (lpString=".ppam") returned 5
	[0057.659] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0057.659] lstrlenW (lpString=".ppm") returned 4
	[0057.659] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0057.659] lstrlenW (lpString=".pps") returned 4
	[0057.659] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0057.659] lstrlenW (lpString=".ppsm") returned 5
	[0057.659] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0057.659] lstrlenW (lpString=".ppt") returned 4
	[0057.659] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0057.659] lstrlenW (lpString=".pptm") returned 5
	[0057.659] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0057.659] lstrlenW (lpString=".pptx") returned 5
	[0057.659] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0057.659] lstrlenW (lpString=".prn") returned 4
	[0057.660] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0057.660] lstrlenW (lpString=".ps") returned 3
	[0057.660] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0057.660] lstrlenW (lpString=".psb") returned 4
	[0057.660] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0057.660] lstrlenW (lpString=".psd") returned 4
	[0057.660] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0057.660] lstrlenW (lpString=".pst") returned 4
	[0057.660] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0057.660] lstrlenW (lpString=".ptx") returned 4
	[0057.660] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0057.660] lstrlenW (lpString=".pub") returned 4
	[0057.660] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0057.660] lstrlenW (lpString=".pwm") returned 4
	[0057.660] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0057.660] lstrlenW (lpString=".pxr") returned 4
	[0057.660] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0057.660] lstrlenW (lpString=".py") returned 3
	[0057.660] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0057.660] lstrlenW (lpString=".qt") returned 3
	[0057.660] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0057.660] lstrlenW (lpString=".r3d") returned 4
	[0057.660] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0057.660] lstrlenW (lpString=".raf") returned 4
	[0057.660] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0057.660] lstrlenW (lpString=".rar") returned 4
	[0057.660] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0057.661] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0057.661] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0057.661] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0057.661] FindClose (in: hFindFile=0x6f45a8 | out: hFindFile=0x6f45a8) returned 1
	[0057.661] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0057.661] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1
	[0057.661] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0057.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26
	[0057.661] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4628
	[0057.662] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.662] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0057.662] lstrlenW (lpString="eula.rtf") returned 8
	[0057.662] lstrlenW (lpString=".1cd") returned 4
	[0057.662] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0057.662] lstrlenW (lpString=".3ds") returned 4
	[0057.662] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0057.662] lstrlenW (lpString=".3fr") returned 4
	[0057.662] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0057.662] lstrlenW (lpString=".3g2") returned 4
	[0057.662] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0057.662] lstrlenW (lpString=".3gp") returned 4
	[0057.662] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0057.662] lstrlenW (lpString=".7z") returned 3
	[0057.663] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0057.663] lstrlenW (lpString=".accda") returned 6
	[0057.663] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0057.663] lstrlenW (lpString=".accdb") returned 6
	[0057.663] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0057.663] lstrlenW (lpString=".accdc") returned 6
	[0057.663] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0057.663] lstrlenW (lpString=".accde") returned 6
	[0057.663] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0057.663] lstrlenW (lpString=".accdt") returned 6
	[0057.663] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0057.663] lstrlenW (lpString=".accdw") returned 6
	[0057.663] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0057.663] lstrlenW (lpString=".adb") returned 4
	[0057.663] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0057.663] lstrlenW (lpString=".adp") returned 4
	[0057.663] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0057.663] lstrlenW (lpString=".ai") returned 3
	[0057.663] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0057.663] lstrlenW (lpString=".ai3") returned 4
	[0057.663] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0057.663] lstrlenW (lpString=".ai4") returned 4
	[0057.663] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0057.663] lstrlenW (lpString=".ai5") returned 4
	[0057.663] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0057.663] lstrlenW (lpString=".ai6") returned 4
	[0057.663] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0057.664] lstrlenW (lpString=".ai7") returned 4
	[0057.664] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0057.664] lstrlenW (lpString=".ai8") returned 4
	[0057.664] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0057.664] lstrlenW (lpString=".anim") returned 5
	[0057.664] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0057.664] lstrlenW (lpString=".arw") returned 4
	[0057.664] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0057.664] lstrlenW (lpString=".as") returned 3
	[0057.664] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0057.664] lstrlenW (lpString=".asa") returned 4
	[0057.664] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0057.664] lstrlenW (lpString=".asc") returned 4
	[0057.664] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0057.664] lstrlenW (lpString=".ascx") returned 5
	[0057.664] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0057.664] lstrlenW (lpString=".asm") returned 4
	[0057.664] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0057.664] lstrlenW (lpString=".asmx") returned 5
	[0057.664] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0057.664] lstrlenW (lpString=".asp") returned 4
	[0057.664] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0057.664] lstrlenW (lpString=".aspx") returned 5
	[0057.664] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0057.664] lstrlenW (lpString=".asr") returned 4
	[0057.665] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0057.665] lstrlenW (lpString=".asx") returned 4
	[0057.665] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0057.665] lstrlenW (lpString=".avi") returned 4
	[0057.665] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0057.665] lstrlenW (lpString=".avs") returned 4
	[0057.665] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0057.665] lstrlenW (lpString=".backup") returned 7
	[0057.665] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0057.665] lstrlenW (lpString=".bak") returned 4
	[0057.665] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0057.665] lstrlenW (lpString=".bay") returned 4
	[0057.665] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0057.665] lstrlenW (lpString=".bd") returned 3
	[0057.665] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0057.665] lstrlenW (lpString=".bin") returned 4
	[0057.665] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0057.665] lstrlenW (lpString=".bmp") returned 4
	[0057.665] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0057.665] lstrlenW (lpString=".bz2") returned 4
	[0057.665] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0057.665] lstrlenW (lpString=".c") returned 2
	[0057.665] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0057.665] lstrlenW (lpString=".cdr") returned 4
	[0057.667] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0057.667] lstrlenW (lpString=".cer") returned 4
	[0057.667] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0057.667] lstrlenW (lpString=".cf") returned 3
	[0057.667] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0057.667] lstrlenW (lpString=".cfc") returned 4
	[0057.667] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0057.667] lstrlenW (lpString=".cfm") returned 4
	[0057.667] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0057.667] lstrlenW (lpString=".cfml") returned 5
	[0057.667] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0057.667] lstrlenW (lpString=".cfu") returned 4
	[0057.667] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0057.667] lstrlenW (lpString=".chm") returned 4
	[0057.667] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0057.667] lstrlenW (lpString=".cin") returned 4
	[0057.667] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0057.667] lstrlenW (lpString=".class") returned 6
	[0057.667] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0057.667] lstrlenW (lpString=".clx") returned 4
	[0057.667] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0057.667] lstrlenW (lpString=".config") returned 7
	[0057.667] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0057.667] lstrlenW (lpString=".cpp") returned 4
	[0057.668] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0057.668] lstrlenW (lpString=".cr2") returned 4
	[0057.668] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0057.668] lstrlenW (lpString=".crt") returned 4
	[0057.668] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0057.668] lstrlenW (lpString=".crw") returned 4
	[0057.668] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0057.668] lstrlenW (lpString=".cs") returned 3
	[0057.668] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0057.668] lstrlenW (lpString=".css") returned 4
	[0057.668] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0057.668] lstrlenW (lpString=".csv") returned 4
	[0057.668] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0057.668] lstrlenW (lpString=".cub") returned 4
	[0057.668] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0057.668] lstrlenW (lpString=".dae") returned 4
	[0057.668] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0057.668] lstrlenW (lpString=".dat") returned 4
	[0057.668] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0057.668] lstrlenW (lpString=".db") returned 3
	[0057.668] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0057.668] lstrlenW (lpString=".dbf") returned 4
	[0057.668] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0057.668] lstrlenW (lpString=".dbx") returned 4
	[0057.669] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0057.669] lstrlenW (lpString=".dc3") returned 4
	[0057.669] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0057.669] lstrlenW (lpString=".dcm") returned 4
	[0057.669] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0057.669] lstrlenW (lpString=".dcr") returned 4
	[0057.669] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0057.669] lstrlenW (lpString=".der") returned 4
	[0057.669] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0057.669] lstrlenW (lpString=".dib") returned 4
	[0057.669] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0057.669] lstrlenW (lpString=".dic") returned 4
	[0057.669] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0057.669] lstrlenW (lpString=".dif") returned 4
	[0057.669] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0057.669] lstrlenW (lpString=".divx") returned 5
	[0057.669] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0057.669] lstrlenW (lpString=".djvu") returned 5
	[0057.669] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0057.669] lstrlenW (lpString=".dng") returned 4
	[0057.669] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0057.669] lstrlenW (lpString=".doc") returned 4
	[0057.669] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0057.669] lstrlenW (lpString=".docm") returned 5
	[0057.670] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0057.670] lstrlenW (lpString=".docx") returned 5
	[0057.670] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0057.670] lstrlenW (lpString=".dot") returned 4
	[0057.670] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0057.670] lstrlenW (lpString=".dotm") returned 5
	[0057.670] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0057.670] lstrlenW (lpString=".dotx") returned 5
	[0057.670] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0057.670] lstrlenW (lpString=".dpx") returned 4
	[0057.670] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0057.670] lstrlenW (lpString=".dqy") returned 4
	[0057.670] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0057.670] lstrlenW (lpString=".dsn") returned 4
	[0057.670] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0057.670] lstrlenW (lpString=".dt") returned 3
	[0057.670] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0057.670] lstrlenW (lpString=".dtd") returned 4
	[0057.670] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0057.670] lstrlenW (lpString=".dwg") returned 4
	[0057.670] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0057.670] lstrlenW (lpString=".dwt") returned 4
	[0057.670] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0057.671] lstrlenW (lpString=".dx") returned 3
	[0057.671] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0057.671] lstrlenW (lpString=".dxf") returned 4
	[0057.671] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0057.671] lstrlenW (lpString=".edml") returned 5
	[0057.671] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0057.671] lstrlenW (lpString=".efd") returned 4
	[0057.671] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0057.671] lstrlenW (lpString=".elf") returned 4
	[0057.671] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0057.671] lstrlenW (lpString=".emf") returned 4
	[0057.671] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0057.671] lstrlenW (lpString=".emz") returned 4
	[0057.671] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0057.671] lstrlenW (lpString=".epf") returned 4
	[0057.671] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0057.671] lstrlenW (lpString=".eps") returned 4
	[0057.671] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0057.671] lstrlenW (lpString=".epsf") returned 5
	[0057.671] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0057.671] lstrlenW (lpString=".epsp") returned 5
	[0057.671] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0057.671] lstrlenW (lpString=".erf") returned 4
	[0057.671] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0057.672] lstrlenW (lpString=".exr") returned 4
	[0057.672] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0057.672] lstrlenW (lpString=".f4v") returned 4
	[0057.672] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0057.672] lstrlenW (lpString=".fido") returned 5
	[0057.672] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0057.672] lstrlenW (lpString=".flm") returned 4
	[0057.672] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0057.672] lstrlenW (lpString=".flv") returned 4
	[0057.672] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0057.672] lstrlenW (lpString=".frm") returned 4
	[0057.672] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0057.672] lstrlenW (lpString=".fxg") returned 4
	[0057.672] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0057.672] lstrlenW (lpString=".geo") returned 4
	[0057.672] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0057.672] lstrlenW (lpString=".gif") returned 4
	[0057.672] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0057.672] lstrlenW (lpString=".grs") returned 4
	[0057.672] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0057.672] lstrlenW (lpString=".gz") returned 3
	[0057.672] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0057.672] lstrlenW (lpString=".h") returned 2
	[0057.672] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0057.673] lstrlenW (lpString=".hdr") returned 4
	[0057.673] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0057.673] lstrlenW (lpString=".hpp") returned 4
	[0057.673] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0057.673] lstrlenW (lpString=".hta") returned 4
	[0057.673] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0057.673] lstrlenW (lpString=".htc") returned 4
	[0057.673] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0057.673] lstrlenW (lpString=".htm") returned 4
	[0057.673] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0057.673] lstrlenW (lpString=".html") returned 5
	[0057.673] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0057.673] lstrlenW (lpString=".icb") returned 4
	[0057.673] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0057.673] lstrlenW (lpString=".ics") returned 4
	[0057.673] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0057.673] lstrlenW (lpString=".iff") returned 4
	[0057.673] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0057.673] lstrlenW (lpString=".inc") returned 4
	[0057.673] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0057.673] lstrlenW (lpString=".indd") returned 5
	[0057.673] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0057.673] lstrlenW (lpString=".ini") returned 4
	[0057.673] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0057.673] lstrlenW (lpString=".iqy") returned 4
	[0057.674] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0057.674] lstrlenW (lpString=".j2c") returned 4
	[0057.674] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0057.674] lstrlenW (lpString=".j2k") returned 4
	[0057.674] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0057.674] lstrlenW (lpString=".java") returned 5
	[0057.674] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0057.674] lstrlenW (lpString=".jp2") returned 4
	[0057.674] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0057.674] lstrlenW (lpString=".jpc") returned 4
	[0057.674] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0057.674] lstrlenW (lpString=".jpe") returned 4
	[0057.674] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0057.674] lstrlenW (lpString=".jpeg") returned 5
	[0057.674] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0057.674] lstrlenW (lpString=".jpf") returned 4
	[0057.674] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0057.674] lstrlenW (lpString=".jpg") returned 4
	[0057.674] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0057.674] lstrlenW (lpString=".jpx") returned 4
	[0057.674] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0057.674] lstrlenW (lpString=".js") returned 3
	[0057.674] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0057.675] lstrlenW (lpString=".jsf") returned 4
	[0057.675] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0057.675] lstrlenW (lpString=".json") returned 5
	[0057.675] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0057.675] lstrlenW (lpString=".jsp") returned 4
	[0057.675] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0057.675] lstrlenW (lpString=".kdc") returned 4
	[0057.675] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0057.675] lstrlenW (lpString=".kmz") returned 4
	[0057.675] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0057.675] lstrlenW (lpString=".kwm") returned 4
	[0057.675] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0057.675] lstrlenW (lpString=".lasso") returned 6
	[0057.675] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0057.675] lstrlenW (lpString=".lbi") returned 4
	[0057.675] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0057.675] lstrlenW (lpString=".lgf") returned 4
	[0057.675] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0057.675] lstrlenW (lpString=".lgp") returned 4
	[0057.675] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0057.676] lstrlenW (lpString=".log") returned 4
	[0057.676] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0057.676] lstrlenW (lpString=".m1v") returned 4
	[0057.676] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0057.676] lstrlenW (lpString=".m4a") returned 4
	[0057.676] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0057.676] lstrlenW (lpString=".m4v") returned 4
	[0057.676] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0057.676] lstrlenW (lpString=".max") returned 4
	[0057.676] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0057.676] lstrlenW (lpString=".md") returned 3
	[0057.676] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0057.676] lstrlenW (lpString=".mda") returned 4
	[0057.676] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0057.676] lstrlenW (lpString=".mdb") returned 4
	[0057.676] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0057.676] lstrlenW (lpString=".mde") returned 4
	[0057.676] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0057.676] lstrlenW (lpString=".mdf") returned 4
	[0057.676] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0057.676] lstrlenW (lpString=".mdw") returned 4
	[0057.868] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0057.868] lstrlenW (lpString=".mef") returned 4
	[0057.868] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0057.868] lstrlenW (lpString=".mft") returned 4
	[0057.868] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0057.868] lstrlenW (lpString=".mfw") returned 4
	[0057.868] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0057.868] lstrlenW (lpString=".mht") returned 4
	[0057.869] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".mhtml") returned 6
	[0057.869] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0057.869] lstrlenW (lpString=".mka") returned 4
	[0057.869] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".mkidx") returned 6
	[0057.869] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0057.869] lstrlenW (lpString=".mkv") returned 4
	[0057.869] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".mos") returned 4
	[0057.869] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".mov") returned 4
	[0057.869] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".mp3") returned 4
	[0057.869] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".mp4") returned 4
	[0057.869] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".mpeg") returned 5
	[0057.869] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0057.869] lstrlenW (lpString=".mpg") returned 4
	[0057.869] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".mpv") returned 4
	[0057.869] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".mrw") returned 4
	[0057.869] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".msg") returned 4
	[0057.869] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".mxl") returned 4
	[0057.869] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0057.869] lstrlenW (lpString=".myd") returned 4
	[0057.869] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".myi") returned 4
	[0057.870] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".nef") returned 4
	[0057.870] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".nrw") returned 4
	[0057.870] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".obj") returned 4
	[0057.870] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".odb") returned 4
	[0057.870] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".odc") returned 4
	[0057.870] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".odm") returned 4
	[0057.870] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".odp") returned 4
	[0057.870] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".ods") returned 4
	[0057.870] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".oft") returned 4
	[0057.870] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".one") returned 4
	[0057.870] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0057.870] lstrlenW (lpString=".onepkg") returned 7
	[0057.870] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0057.870] lstrlenW (lpString=".onetoc2") returned 8
	[0057.870] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0057.870] lstrlenW (lpString=".opt") returned 4
	[0057.870] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".oqy") returned 4
	[0057.871] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".orf") returned 4
	[0057.871] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".p12") returned 4
	[0057.871] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".p7b") returned 4
	[0057.871] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".p7c") returned 4
	[0057.871] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".pam") returned 4
	[0057.871] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".pbm") returned 4
	[0057.871] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".pct") returned 4
	[0057.871] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".pcx") returned 4
	[0057.871] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".pdd") returned 4
	[0057.871] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".pdf") returned 4
	[0057.871] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".pdp") returned 4
	[0057.871] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0057.871] lstrlenW (lpString=".pef") returned 4
	[0057.872] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0057.872] lstrlenW (lpString=".pem") returned 4
	[0057.872] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0057.872] lstrlenW (lpString=".pff") returned 4
	[0057.872] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0057.872] lstrlenW (lpString=".pfm") returned 4
	[0057.872] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0057.872] lstrlenW (lpString=".pfx") returned 4
	[0057.872] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0057.872] lstrlenW (lpString=".pgm") returned 4
	[0057.872] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0057.872] lstrlenW (lpString=".php") returned 4
	[0057.872] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0057.872] lstrlenW (lpString=".php3") returned 5
	[0057.872] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0057.872] lstrlenW (lpString=".php4") returned 5
	[0057.872] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0057.872] lstrlenW (lpString=".php5") returned 5
	[0057.872] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0057.872] lstrlenW (lpString=".phtml") returned 6
	[0057.872] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0057.872] lstrlenW (lpString=".pict") returned 5
	[0057.872] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0057.872] lstrlenW (lpString=".pl") returned 3
	[0057.872] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0057.872] lstrlenW (lpString=".pls") returned 4
	[0057.873] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0057.873] lstrlenW (lpString=".pm") returned 3
	[0057.873] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0057.873] lstrlenW (lpString=".png") returned 4
	[0057.873] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0057.873] lstrlenW (lpString=".pnm") returned 4
	[0057.873] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0057.873] lstrlenW (lpString=".pot") returned 4
	[0057.873] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0057.873] lstrlenW (lpString=".potm") returned 5
	[0057.873] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0057.873] lstrlenW (lpString=".potx") returned 5
	[0057.873] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0057.873] lstrlenW (lpString=".ppa") returned 4
	[0057.873] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0057.873] lstrlenW (lpString=".ppam") returned 5
	[0057.873] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0057.873] lstrlenW (lpString=".ppm") returned 4
	[0057.873] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0057.873] lstrlenW (lpString=".pps") returned 4
	[0057.873] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0057.873] lstrlenW (lpString=".ppsm") returned 5
	[0057.873] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0057.873] lstrlenW (lpString=".ppt") returned 4
	[0057.873] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0057.873] lstrlenW (lpString=".pptm") returned 5
	[0057.873] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0057.874] lstrlenW (lpString=".pptx") returned 5
	[0057.874] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0057.874] lstrlenW (lpString=".prn") returned 4
	[0057.874] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0057.874] lstrlenW (lpString=".ps") returned 3
	[0057.874] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0057.874] lstrlenW (lpString=".psb") returned 4
	[0057.874] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0057.874] lstrlenW (lpString=".psd") returned 4
	[0057.874] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0057.874] lstrlenW (lpString=".pst") returned 4
	[0057.874] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0057.874] lstrlenW (lpString=".ptx") returned 4
	[0057.874] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0057.874] lstrlenW (lpString=".pub") returned 4
	[0057.874] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0057.874] lstrlenW (lpString=".pwm") returned 4
	[0057.874] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0057.874] lstrlenW (lpString=".pxr") returned 4
	[0057.874] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0057.874] lstrlenW (lpString=".py") returned 3
	[0057.874] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0057.874] lstrlenW (lpString=".qt") returned 3
	[0057.874] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0057.874] lstrlenW (lpString=".r3d") returned 4
	[0057.874] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0057.874] lstrlenW (lpString=".raf") returned 4
	[0057.874] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0057.875] lstrlenW (lpString=".rar") returned 4
	[0057.875] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0057.875] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0057.875] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0057.875] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0057.875] FindClose (in: hFindFile=0x6f4628 | out: hFindFile=0x6f4628) returned 1
	[0057.875] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0057.875] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1
	[0057.875] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0057.875] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26
	[0057.876] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4668
	[0057.876] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.876] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0057.876] lstrlenW (lpString="eula.rtf") returned 8
	[0057.876] lstrlenW (lpString=".1cd") returned 4
	[0057.876] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0057.876] lstrlenW (lpString=".3ds") returned 4
	[0057.877] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0057.877] lstrlenW (lpString=".3fr") returned 4
	[0057.877] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0057.877] lstrlenW (lpString=".3g2") returned 4
	[0057.877] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0057.877] lstrlenW (lpString=".3gp") returned 4
	[0057.877] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0057.877] lstrlenW (lpString=".7z") returned 3
	[0057.877] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0057.877] lstrlenW (lpString=".accda") returned 6
	[0057.877] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0057.877] lstrlenW (lpString=".accdb") returned 6
	[0057.877] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0057.877] lstrlenW (lpString=".accdc") returned 6
	[0057.877] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0057.877] lstrlenW (lpString=".accde") returned 6
	[0057.877] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0057.877] lstrlenW (lpString=".accdt") returned 6
	[0057.877] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0057.877] lstrlenW (lpString=".accdw") returned 6
	[0057.877] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0057.877] lstrlenW (lpString=".adb") returned 4
	[0057.877] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0057.877] lstrlenW (lpString=".adp") returned 4
	[0057.877] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0057.878] lstrlenW (lpString=".ai") returned 3
	[0057.878] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0057.878] lstrlenW (lpString=".ai3") returned 4
	[0057.878] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0057.878] lstrlenW (lpString=".ai4") returned 4
	[0057.878] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0057.878] lstrlenW (lpString=".ai5") returned 4
	[0057.878] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0057.878] lstrlenW (lpString=".ai6") returned 4
	[0057.878] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0057.878] lstrlenW (lpString=".ai7") returned 4
	[0057.878] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0057.878] lstrlenW (lpString=".ai8") returned 4
	[0057.878] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0057.878] lstrlenW (lpString=".anim") returned 5
	[0057.878] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0057.878] lstrlenW (lpString=".arw") returned 4
	[0057.878] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0057.878] lstrlenW (lpString=".as") returned 3
	[0057.878] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0057.878] lstrlenW (lpString=".asa") returned 4
	[0057.878] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0057.878] lstrlenW (lpString=".asc") returned 4
	[0057.878] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0057.878] lstrlenW (lpString=".ascx") returned 5
	[0057.878] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0057.878] lstrlenW (lpString=".asm") returned 4
	[0057.878] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0057.878] lstrlenW (lpString=".asmx") returned 5
	[0057.878] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0057.879] lstrlenW (lpString=".asp") returned 4
	[0057.879] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0057.879] lstrlenW (lpString=".aspx") returned 5
	[0057.879] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0057.879] lstrlenW (lpString=".asr") returned 4
	[0057.879] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0057.879] lstrlenW (lpString=".asx") returned 4
	[0057.879] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0057.879] lstrlenW (lpString=".avi") returned 4
	[0057.879] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0057.879] lstrlenW (lpString=".avs") returned 4
	[0057.879] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0057.879] lstrlenW (lpString=".backup") returned 7
	[0057.879] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0057.879] lstrlenW (lpString=".bak") returned 4
	[0057.879] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0057.879] lstrlenW (lpString=".bay") returned 4
	[0057.879] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0057.879] lstrlenW (lpString=".bd") returned 3
	[0057.879] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0057.879] lstrlenW (lpString=".bin") returned 4
	[0057.879] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0057.879] lstrlenW (lpString=".bmp") returned 4
	[0057.879] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0057.879] lstrlenW (lpString=".bz2") returned 4
	[0057.879] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0057.879] lstrlenW (lpString=".c") returned 2
	[0057.879] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0057.879] lstrlenW (lpString=".cdr") returned 4
	[0057.880] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0057.880] lstrlenW (lpString=".cer") returned 4
	[0057.880] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0057.880] lstrlenW (lpString=".cf") returned 3
	[0057.880] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0057.880] lstrlenW (lpString=".cfc") returned 4
	[0057.880] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0057.880] lstrlenW (lpString=".cfm") returned 4
	[0057.880] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0057.880] lstrlenW (lpString=".cfml") returned 5
	[0057.880] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0057.880] lstrlenW (lpString=".cfu") returned 4
	[0057.880] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0057.880] lstrlenW (lpString=".chm") returned 4
	[0057.880] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0057.880] lstrlenW (lpString=".cin") returned 4
	[0057.880] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0057.881] lstrlenW (lpString=".class") returned 6
	[0057.881] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0057.881] lstrlenW (lpString=".clx") returned 4
	[0057.881] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0057.881] lstrlenW (lpString=".config") returned 7
	[0057.881] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0057.881] lstrlenW (lpString=".cpp") returned 4
	[0057.881] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0057.881] lstrlenW (lpString=".cr2") returned 4
	[0057.881] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0057.881] lstrlenW (lpString=".crt") returned 4
	[0057.881] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0057.881] lstrlenW (lpString=".crw") returned 4
	[0057.881] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0057.881] lstrlenW (lpString=".cs") returned 3
	[0057.881] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0057.881] lstrlenW (lpString=".css") returned 4
	[0057.881] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0057.881] lstrlenW (lpString=".csv") returned 4
	[0057.881] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0057.881] lstrlenW (lpString=".cub") returned 4
	[0057.881] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0057.881] lstrlenW (lpString=".dae") returned 4
	[0057.881] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0057.881] lstrlenW (lpString=".dat") returned 4
	[0057.882] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".db") returned 3
	[0057.882] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0057.882] lstrlenW (lpString=".dbf") returned 4
	[0057.882] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".dbx") returned 4
	[0057.882] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".dc3") returned 4
	[0057.882] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".dcm") returned 4
	[0057.882] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".dcr") returned 4
	[0057.882] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".der") returned 4
	[0057.882] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".dib") returned 4
	[0057.882] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".dic") returned 4
	[0057.882] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".dif") returned 4
	[0057.882] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".divx") returned 5
	[0057.882] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0057.882] lstrlenW (lpString=".djvu") returned 5
	[0057.882] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0057.882] lstrlenW (lpString=".dng") returned 4
	[0057.882] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".doc") returned 4
	[0057.882] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0057.882] lstrlenW (lpString=".docm") returned 5
	[0057.883] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0057.883] lstrlenW (lpString=".docx") returned 5
	[0057.883] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0057.883] lstrlenW (lpString=".dot") returned 4
	[0057.883] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0057.883] lstrlenW (lpString=".dotm") returned 5
	[0057.883] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0057.883] lstrlenW (lpString=".dotx") returned 5
	[0057.883] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0057.883] lstrlenW (lpString=".dpx") returned 4
	[0057.883] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0057.883] lstrlenW (lpString=".dqy") returned 4
	[0057.883] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0057.883] lstrlenW (lpString=".dsn") returned 4
	[0057.883] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0057.883] lstrlenW (lpString=".dt") returned 3
	[0057.883] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0057.883] lstrlenW (lpString=".dtd") returned 4
	[0057.883] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0057.883] lstrlenW (lpString=".dwg") returned 4
	[0057.883] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0057.883] lstrlenW (lpString=".dwt") returned 4
	[0057.883] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0057.883] lstrlenW (lpString=".dx") returned 3
	[0057.883] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0057.883] lstrlenW (lpString=".dxf") returned 4
	[0057.883] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0057.883] lstrlenW (lpString=".edml") returned 5
	[0057.883] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0057.883] lstrlenW (lpString=".efd") returned 4
	[0057.883] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0057.884] lstrlenW (lpString=".elf") returned 4
	[0057.884] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0057.884] lstrlenW (lpString=".emf") returned 4
	[0057.884] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0057.884] lstrlenW (lpString=".emz") returned 4
	[0057.884] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0057.884] lstrlenW (lpString=".epf") returned 4
	[0057.884] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0057.884] lstrlenW (lpString=".eps") returned 4
	[0057.884] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0057.884] lstrlenW (lpString=".epsf") returned 5
	[0057.884] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0057.884] lstrlenW (lpString=".epsp") returned 5
	[0057.884] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0057.884] lstrlenW (lpString=".erf") returned 4
	[0057.884] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0057.884] lstrlenW (lpString=".exr") returned 4
	[0057.884] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0057.884] lstrlenW (lpString=".f4v") returned 4
	[0057.884] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0057.884] lstrlenW (lpString=".fido") returned 5
	[0057.884] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0057.884] lstrlenW (lpString=".flm") returned 4
	[0057.884] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0057.884] lstrlenW (lpString=".flv") returned 4
	[0057.884] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0057.884] lstrlenW (lpString=".frm") returned 4
	[0057.884] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0057.885] lstrlenW (lpString=".fxg") returned 4
	[0057.885] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0057.885] lstrlenW (lpString=".geo") returned 4
	[0057.885] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0057.885] lstrlenW (lpString=".gif") returned 4
	[0057.885] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0057.885] lstrlenW (lpString=".grs") returned 4
	[0057.885] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0057.885] lstrlenW (lpString=".gz") returned 3
	[0057.885] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0057.885] lstrlenW (lpString=".h") returned 2
	[0057.885] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0057.885] lstrlenW (lpString=".hdr") returned 4
	[0057.885] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0057.885] lstrlenW (lpString=".hpp") returned 4
	[0057.885] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0057.885] lstrlenW (lpString=".hta") returned 4
	[0057.885] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0057.885] lstrlenW (lpString=".htc") returned 4
	[0057.885] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0057.885] lstrlenW (lpString=".htm") returned 4
	[0057.885] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0057.885] lstrlenW (lpString=".html") returned 5
	[0057.885] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0057.885] lstrlenW (lpString=".icb") returned 4
	[0057.885] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0057.885] lstrlenW (lpString=".ics") returned 4
	[0057.886] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0057.886] lstrlenW (lpString=".iff") returned 4
	[0057.886] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0057.886] lstrlenW (lpString=".inc") returned 4
	[0057.886] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0057.886] lstrlenW (lpString=".indd") returned 5
	[0057.886] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0057.886] lstrlenW (lpString=".ini") returned 4
	[0057.886] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0057.886] lstrlenW (lpString=".iqy") returned 4
	[0057.886] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0057.886] lstrlenW (lpString=".j2c") returned 4
	[0057.886] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0057.886] lstrlenW (lpString=".j2k") returned 4
	[0057.886] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0057.886] lstrlenW (lpString=".java") returned 5
	[0057.886] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0057.886] lstrlenW (lpString=".jp2") returned 4
	[0057.886] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0057.886] lstrlenW (lpString=".jpc") returned 4
	[0057.886] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0057.886] lstrlenW (lpString=".jpe") returned 4
	[0057.886] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0057.886] lstrlenW (lpString=".jpeg") returned 5
	[0057.886] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0057.886] lstrlenW (lpString=".jpf") returned 4
	[0057.886] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0057.887] lstrlenW (lpString=".jpg") returned 4
	[0057.887] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0057.887] lstrlenW (lpString=".jpx") returned 4
	[0057.887] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0057.887] lstrlenW (lpString=".js") returned 3
	[0057.887] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0057.887] lstrlenW (lpString=".jsf") returned 4
	[0057.887] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0057.887] lstrlenW (lpString=".json") returned 5
	[0057.887] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0057.887] lstrlenW (lpString=".jsp") returned 4
	[0057.887] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0057.887] lstrlenW (lpString=".kdc") returned 4
	[0057.887] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0057.887] lstrlenW (lpString=".kmz") returned 4
	[0057.887] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0057.887] lstrlenW (lpString=".kwm") returned 4
	[0057.887] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0057.887] lstrlenW (lpString=".lasso") returned 6
	[0057.887] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0057.887] lstrlenW (lpString=".lbi") returned 4
	[0057.887] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0057.887] lstrlenW (lpString=".lgf") returned 4
	[0057.887] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0057.887] lstrlenW (lpString=".lgp") returned 4
	[0057.887] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0057.887] lstrlenW (lpString=".log") returned 4
	[0057.887] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".m1v") returned 4
	[0057.888] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".m4a") returned 4
	[0057.888] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".m4v") returned 4
	[0057.888] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".max") returned 4
	[0057.888] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".md") returned 3
	[0057.888] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0057.888] lstrlenW (lpString=".mda") returned 4
	[0057.888] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".mdb") returned 4
	[0057.888] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".mde") returned 4
	[0057.888] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".mdf") returned 4
	[0057.888] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".mdw") returned 4
	[0057.888] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".mef") returned 4
	[0057.888] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".mft") returned 4
	[0057.888] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".mfw") returned 4
	[0057.888] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".mht") returned 4
	[0057.888] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0057.888] lstrlenW (lpString=".mhtml") returned 6
	[0057.889] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0057.889] lstrlenW (lpString=".mka") returned 4
	[0057.889] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0057.889] lstrlenW (lpString=".mkidx") returned 6
	[0057.889] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0057.889] lstrlenW (lpString=".mkv") returned 4
	[0057.889] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0057.889] lstrlenW (lpString=".mos") returned 4
	[0057.889] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0057.889] lstrlenW (lpString=".mov") returned 4
	[0057.889] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0057.889] lstrlenW (lpString=".mp3") returned 4
	[0057.889] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0057.889] lstrlenW (lpString=".mp4") returned 4
	[0057.889] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0057.889] lstrlenW (lpString=".mpeg") returned 5
	[0057.889] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0057.889] lstrlenW (lpString=".mpg") returned 4
	[0057.889] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0057.889] lstrlenW (lpString=".mpv") returned 4
	[0057.889] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0057.889] lstrlenW (lpString=".mrw") returned 4
	[0057.889] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0057.889] lstrlenW (lpString=".msg") returned 4
	[0057.889] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0057.889] lstrlenW (lpString=".mxl") returned 4
	[0057.889] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0057.889] lstrlenW (lpString=".myd") returned 4
	[0057.890] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".myi") returned 4
	[0057.890] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".nef") returned 4
	[0057.890] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".nrw") returned 4
	[0057.890] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".obj") returned 4
	[0057.890] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".odb") returned 4
	[0057.890] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".odc") returned 4
	[0057.890] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".odm") returned 4
	[0057.890] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".odp") returned 4
	[0057.890] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".ods") returned 4
	[0057.890] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".oft") returned 4
	[0057.890] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".one") returned 4
	[0057.890] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0057.890] lstrlenW (lpString=".onepkg") returned 7
	[0057.890] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0057.890] lstrlenW (lpString=".onetoc2") returned 8
	[0057.890] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0057.890] lstrlenW (lpString=".opt") returned 4
	[0057.890] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".oqy") returned 4
	[0057.891] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".orf") returned 4
	[0057.891] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".p12") returned 4
	[0057.891] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".p7b") returned 4
	[0057.891] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".p7c") returned 4
	[0057.891] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".pam") returned 4
	[0057.891] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".pbm") returned 4
	[0057.891] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".pct") returned 4
	[0057.891] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".pcx") returned 4
	[0057.891] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".pdd") returned 4
	[0057.891] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".pdf") returned 4
	[0057.891] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".pdp") returned 4
	[0057.891] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".pef") returned 4
	[0057.891] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0057.891] lstrlenW (lpString=".pem") returned 4
	[0057.892] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0057.892] lstrlenW (lpString=".pff") returned 4
	[0057.892] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0057.892] lstrlenW (lpString=".pfm") returned 4
	[0057.892] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0057.892] lstrlenW (lpString=".pfx") returned 4
	[0057.892] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0057.892] lstrlenW (lpString=".pgm") returned 4
	[0057.892] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0057.892] lstrlenW (lpString=".php") returned 4
	[0057.892] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0057.892] lstrlenW (lpString=".php3") returned 5
	[0057.892] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0057.892] lstrlenW (lpString=".php4") returned 5
	[0057.892] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0057.892] lstrlenW (lpString=".php5") returned 5
	[0057.892] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0057.892] lstrlenW (lpString=".phtml") returned 6
	[0057.892] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0057.892] lstrlenW (lpString=".pict") returned 5
	[0057.892] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0057.892] lstrlenW (lpString=".pl") returned 3
	[0057.892] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0057.892] lstrlenW (lpString=".pls") returned 4
	[0057.892] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0057.892] lstrlenW (lpString=".pm") returned 3
	[0057.892] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0057.893] lstrlenW (lpString=".png") returned 4
	[0057.893] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0057.893] lstrlenW (lpString=".pnm") returned 4
	[0057.893] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0057.893] lstrlenW (lpString=".pot") returned 4
	[0057.893] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0057.893] lstrlenW (lpString=".potm") returned 5
	[0057.893] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0057.893] lstrlenW (lpString=".potx") returned 5
	[0057.893] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0057.893] lstrlenW (lpString=".ppa") returned 4
	[0057.893] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0057.893] lstrlenW (lpString=".ppam") returned 5
	[0057.893] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0057.893] lstrlenW (lpString=".ppm") returned 4
	[0057.893] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0057.893] lstrlenW (lpString=".pps") returned 4
	[0057.893] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0057.893] lstrlenW (lpString=".ppsm") returned 5
	[0057.893] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0057.893] lstrlenW (lpString=".ppt") returned 4
	[0057.893] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0057.893] lstrlenW (lpString=".pptm") returned 5
	[0057.893] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0057.893] lstrlenW (lpString=".pptx") returned 5
	[0057.893] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0057.893] lstrlenW (lpString=".prn") returned 4
	[0057.893] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0057.894] lstrlenW (lpString=".ps") returned 3
	[0057.894] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0057.894] lstrlenW (lpString=".psb") returned 4
	[0057.894] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0057.894] lstrlenW (lpString=".psd") returned 4
	[0057.894] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0057.894] lstrlenW (lpString=".pst") returned 4
	[0057.894] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0057.894] lstrlenW (lpString=".ptx") returned 4
	[0057.894] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0057.894] lstrlenW (lpString=".pub") returned 4
	[0057.894] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0057.894] lstrlenW (lpString=".pwm") returned 4
	[0057.894] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0057.894] lstrlenW (lpString=".pxr") returned 4
	[0057.894] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0057.894] lstrlenW (lpString=".py") returned 3
	[0057.894] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0057.894] lstrlenW (lpString=".qt") returned 3
	[0057.894] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0057.894] lstrlenW (lpString=".r3d") returned 4
	[0057.894] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0057.894] lstrlenW (lpString=".raf") returned 4
	[0057.894] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0057.894] lstrlenW (lpString=".rar") returned 4
	[0057.894] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0057.895] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0057.895] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0057.895] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0057.895] FindClose (in: hFindFile=0x6f4668 | out: hFindFile=0x6f4668) returned 1
	[0057.895] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0057.938] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1
	[0057.939] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26
	[0057.939] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1031") returned 1
	[0057.939] lstrlenW (lpString="1031") returned 4
	[0057.939] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1031") returned 1
	[0057.939] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0057.939] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26
	[0057.939] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f46e8
	[0057.940] FindNextFileW (in: hFindFile=0x6f46e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.940] FindNextFileW (in: hFindFile=0x6f46e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0057.940] lstrlenW (lpString="eula.rtf") returned 8
	[0057.940] lstrlenW (lpString=".1cd") returned 4
	[0057.940] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0057.940] lstrlenW (lpString=".3ds") returned 4
	[0057.940] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0057.940] lstrlenW (lpString=".3fr") returned 4
	[0057.940] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0057.940] lstrlenW (lpString=".3g2") returned 4
	[0057.940] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0057.940] lstrlenW (lpString=".3gp") returned 4
	[0057.940] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0057.940] lstrlenW (lpString=".7z") returned 3
	[0057.940] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0057.940] lstrlenW (lpString=".accda") returned 6
	[0057.940] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0057.940] lstrlenW (lpString=".accdb") returned 6
	[0057.940] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0057.940] lstrlenW (lpString=".accdc") returned 6
	[0057.940] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0057.940] lstrlenW (lpString=".accde") returned 6
	[0057.940] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0057.940] lstrlenW (lpString=".accdt") returned 6
	[0057.941] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0057.941] lstrlenW (lpString=".accdw") returned 6
	[0057.941] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0057.941] lstrlenW (lpString=".adb") returned 4
	[0057.941] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0057.941] lstrlenW (lpString=".adp") returned 4
	[0057.941] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0057.941] lstrlenW (lpString=".ai") returned 3
	[0057.941] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0057.941] lstrlenW (lpString=".ai3") returned 4
	[0057.941] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0057.941] lstrlenW (lpString=".ai4") returned 4
	[0057.941] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0057.941] lstrlenW (lpString=".ai5") returned 4
	[0057.941] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0057.941] lstrlenW (lpString=".ai6") returned 4
	[0057.941] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0057.941] lstrlenW (lpString=".ai7") returned 4
	[0057.941] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0057.941] lstrlenW (lpString=".ai8") returned 4
	[0057.941] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0057.941] lstrlenW (lpString=".anim") returned 5
	[0057.941] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0057.941] lstrlenW (lpString=".arw") returned 4
	[0057.941] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0057.941] lstrlenW (lpString=".as") returned 3
	[0057.941] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0057.941] lstrlenW (lpString=".asa") returned 4
	[0057.941] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0057.942] lstrlenW (lpString=".asc") returned 4
	[0057.942] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0057.942] lstrlenW (lpString=".ascx") returned 5
	[0057.942] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0057.942] lstrlenW (lpString=".asm") returned 4
	[0057.942] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0057.942] lstrlenW (lpString=".asmx") returned 5
	[0057.942] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0057.942] lstrlenW (lpString=".asp") returned 4
	[0057.942] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0057.942] lstrlenW (lpString=".aspx") returned 5
	[0057.942] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0057.942] lstrlenW (lpString=".asr") returned 4
	[0057.942] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0057.942] lstrlenW (lpString=".asx") returned 4
	[0057.942] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0057.942] lstrlenW (lpString=".avi") returned 4
	[0057.942] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0057.942] lstrlenW (lpString=".avs") returned 4
	[0057.942] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0057.942] lstrlenW (lpString=".backup") returned 7
	[0057.943] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0057.943] lstrlenW (lpString=".bak") returned 4
	[0057.943] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0057.943] lstrlenW (lpString=".bay") returned 4
	[0057.943] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0057.943] lstrlenW (lpString=".bd") returned 3
	[0057.943] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0057.943] lstrlenW (lpString=".bin") returned 4
	[0057.943] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0057.943] lstrlenW (lpString=".bmp") returned 4
	[0057.943] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0057.943] lstrlenW (lpString=".bz2") returned 4
	[0057.943] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0057.943] lstrlenW (lpString=".c") returned 2
	[0057.943] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0057.943] lstrlenW (lpString=".cdr") returned 4
	[0057.943] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0057.943] lstrlenW (lpString=".cer") returned 4
	[0057.943] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0057.943] lstrlenW (lpString=".cf") returned 3
	[0057.943] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0057.943] lstrlenW (lpString=".cfc") returned 4
	[0057.943] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0057.943] lstrlenW (lpString=".cfm") returned 4
	[0057.943] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0057.943] lstrlenW (lpString=".cfml") returned 5
	[0057.943] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0057.944] lstrlenW (lpString=".cfu") returned 4
	[0057.944] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0057.944] lstrlenW (lpString=".chm") returned 4
	[0057.944] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0057.944] lstrlenW (lpString=".cin") returned 4
	[0057.944] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0057.944] lstrlenW (lpString=".class") returned 6
	[0057.944] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0057.944] lstrlenW (lpString=".clx") returned 4
	[0057.944] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0057.944] lstrlenW (lpString=".config") returned 7
	[0057.944] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0057.944] lstrlenW (lpString=".cpp") returned 4
	[0057.944] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0057.944] lstrlenW (lpString=".cr2") returned 4
	[0057.944] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0057.944] lstrlenW (lpString=".crt") returned 4
	[0057.944] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0057.944] lstrlenW (lpString=".crw") returned 4
	[0057.944] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0057.944] lstrlenW (lpString=".cs") returned 3
	[0057.944] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0057.944] lstrlenW (lpString=".css") returned 4
	[0057.944] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0057.944] lstrlenW (lpString=".csv") returned 4
	[0057.944] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0057.944] lstrlenW (lpString=".cub") returned 4
	[0057.944] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0057.944] lstrlenW (lpString=".dae") returned 4
	[0057.944] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".dat") returned 4
	[0057.945] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".db") returned 3
	[0057.945] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0057.945] lstrlenW (lpString=".dbf") returned 4
	[0057.945] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".dbx") returned 4
	[0057.945] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".dc3") returned 4
	[0057.945] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".dcm") returned 4
	[0057.945] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".dcr") returned 4
	[0057.945] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".der") returned 4
	[0057.945] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".dib") returned 4
	[0057.945] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".dic") returned 4
	[0057.945] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".dif") returned 4
	[0057.945] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".divx") returned 5
	[0057.945] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0057.945] lstrlenW (lpString=".djvu") returned 5
	[0057.945] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0057.945] lstrlenW (lpString=".dng") returned 4
	[0057.945] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0057.945] lstrlenW (lpString=".doc") returned 4
	[0057.946] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0057.946] lstrlenW (lpString=".docm") returned 5
	[0057.946] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0057.946] lstrlenW (lpString=".docx") returned 5
	[0057.946] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0057.946] lstrlenW (lpString=".dot") returned 4
	[0057.946] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0057.946] lstrlenW (lpString=".dotm") returned 5
	[0057.946] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0057.946] lstrlenW (lpString=".dotx") returned 5
	[0057.946] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0057.946] lstrlenW (lpString=".dpx") returned 4
	[0057.946] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0057.946] lstrlenW (lpString=".dqy") returned 4
	[0057.946] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0057.946] lstrlenW (lpString=".dsn") returned 4
	[0057.946] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0057.946] lstrlenW (lpString=".dt") returned 3
	[0057.946] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0057.946] lstrlenW (lpString=".dtd") returned 4
	[0057.946] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0057.946] lstrlenW (lpString=".dwg") returned 4
	[0057.946] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0057.946] lstrlenW (lpString=".dwt") returned 4
	[0057.946] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0057.946] lstrlenW (lpString=".dx") returned 3
	[0057.946] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0057.946] lstrlenW (lpString=".dxf") returned 4
	[0057.946] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0057.947] lstrlenW (lpString=".edml") returned 5
	[0057.947] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0057.947] lstrlenW (lpString=".efd") returned 4
	[0057.947] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0057.947] lstrlenW (lpString=".elf") returned 4
	[0057.947] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0057.947] lstrlenW (lpString=".emf") returned 4
	[0057.947] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0057.947] lstrlenW (lpString=".emz") returned 4
	[0057.947] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0057.947] lstrlenW (lpString=".epf") returned 4
	[0057.947] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0057.947] lstrlenW (lpString=".eps") returned 4
	[0057.947] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0057.947] lstrlenW (lpString=".epsf") returned 5
	[0057.947] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0057.947] lstrlenW (lpString=".epsp") returned 5
	[0057.947] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0057.947] lstrlenW (lpString=".erf") returned 4
	[0057.947] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0057.947] lstrlenW (lpString=".exr") returned 4
	[0057.947] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0057.947] lstrlenW (lpString=".f4v") returned 4
	[0057.947] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0057.947] lstrlenW (lpString=".fido") returned 5
	[0057.947] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0057.947] lstrlenW (lpString=".flm") returned 4
	[0057.947] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".flv") returned 4
	[0057.948] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".frm") returned 4
	[0057.948] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".fxg") returned 4
	[0057.948] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".geo") returned 4
	[0057.948] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".gif") returned 4
	[0057.948] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".grs") returned 4
	[0057.948] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".gz") returned 3
	[0057.948] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0057.948] lstrlenW (lpString=".h") returned 2
	[0057.948] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0057.948] lstrlenW (lpString=".hdr") returned 4
	[0057.948] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".hpp") returned 4
	[0057.948] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".hta") returned 4
	[0057.948] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".htc") returned 4
	[0057.948] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".htm") returned 4
	[0057.948] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".html") returned 5
	[0057.948] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0057.948] lstrlenW (lpString=".icb") returned 4
	[0057.948] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0057.948] lstrlenW (lpString=".ics") returned 4
	[0057.949] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".iff") returned 4
	[0057.949] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".inc") returned 4
	[0057.949] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".indd") returned 5
	[0057.949] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0057.949] lstrlenW (lpString=".ini") returned 4
	[0057.949] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".iqy") returned 4
	[0057.949] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".j2c") returned 4
	[0057.949] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".j2k") returned 4
	[0057.949] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".java") returned 5
	[0057.949] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0057.949] lstrlenW (lpString=".jp2") returned 4
	[0057.949] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".jpc") returned 4
	[0057.949] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".jpe") returned 4
	[0057.949] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".jpeg") returned 5
	[0057.949] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0057.949] lstrlenW (lpString=".jpf") returned 4
	[0057.949] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".jpg") returned 4
	[0057.949] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0057.949] lstrlenW (lpString=".jpx") returned 4
	[0057.950] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0057.950] lstrlenW (lpString=".js") returned 3
	[0057.950] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0057.950] lstrlenW (lpString=".jsf") returned 4
	[0057.950] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0057.950] lstrlenW (lpString=".json") returned 5
	[0057.950] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0057.950] lstrlenW (lpString=".jsp") returned 4
	[0057.950] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0057.950] lstrlenW (lpString=".kdc") returned 4
	[0057.950] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0057.950] lstrlenW (lpString=".kmz") returned 4
	[0057.950] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0057.950] lstrlenW (lpString=".kwm") returned 4
	[0057.950] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0057.950] lstrlenW (lpString=".lasso") returned 6
	[0057.950] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0057.950] lstrlenW (lpString=".lbi") returned 4
	[0057.950] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0057.950] lstrlenW (lpString=".lgf") returned 4
	[0057.950] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0057.950] lstrlenW (lpString=".lgp") returned 4
	[0057.950] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0057.950] lstrlenW (lpString=".log") returned 4
	[0057.950] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0057.950] lstrlenW (lpString=".m1v") returned 4
	[0057.950] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0057.950] lstrlenW (lpString=".m4a") returned 4
	[0057.950] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".m4v") returned 4
	[0057.951] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".max") returned 4
	[0057.951] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".md") returned 3
	[0057.951] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0057.951] lstrlenW (lpString=".mda") returned 4
	[0057.951] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".mdb") returned 4
	[0057.951] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".mde") returned 4
	[0057.951] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".mdf") returned 4
	[0057.951] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".mdw") returned 4
	[0057.951] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".mef") returned 4
	[0057.951] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".mft") returned 4
	[0057.951] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".mfw") returned 4
	[0057.951] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".mht") returned 4
	[0057.951] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".mhtml") returned 6
	[0057.951] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0057.951] lstrlenW (lpString=".mka") returned 4
	[0057.951] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0057.951] lstrlenW (lpString=".mkidx") returned 6
	[0057.951] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0057.952] lstrlenW (lpString=".mkv") returned 4
	[0057.952] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".mos") returned 4
	[0057.952] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".mov") returned 4
	[0057.952] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".mp3") returned 4
	[0057.952] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".mp4") returned 4
	[0057.952] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".mpeg") returned 5
	[0057.952] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0057.952] lstrlenW (lpString=".mpg") returned 4
	[0057.952] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".mpv") returned 4
	[0057.952] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".mrw") returned 4
	[0057.952] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".msg") returned 4
	[0057.952] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".mxl") returned 4
	[0057.952] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".myd") returned 4
	[0057.952] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".myi") returned 4
	[0057.952] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0057.952] lstrlenW (lpString=".nef") returned 4
	[0057.952] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".nrw") returned 4
	[0057.953] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".obj") returned 4
	[0057.953] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".odb") returned 4
	[0057.953] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".odc") returned 4
	[0057.953] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".odm") returned 4
	[0057.953] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".odp") returned 4
	[0057.953] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".ods") returned 4
	[0057.953] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".oft") returned 4
	[0057.953] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".one") returned 4
	[0057.953] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".onepkg") returned 7
	[0057.953] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0057.953] lstrlenW (lpString=".onetoc2") returned 8
	[0057.953] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0057.953] lstrlenW (lpString=".opt") returned 4
	[0057.953] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".oqy") returned 4
	[0057.953] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0057.953] lstrlenW (lpString=".orf") returned 4
	[0057.953] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".p12") returned 4
	[0057.954] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".p7b") returned 4
	[0057.954] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".p7c") returned 4
	[0057.954] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pam") returned 4
	[0057.954] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pbm") returned 4
	[0057.954] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pct") returned 4
	[0057.954] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pcx") returned 4
	[0057.954] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pdd") returned 4
	[0057.954] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pdf") returned 4
	[0057.954] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pdp") returned 4
	[0057.954] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pef") returned 4
	[0057.954] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pem") returned 4
	[0057.954] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pff") returned 4
	[0057.954] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pfm") returned 4
	[0057.954] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0057.954] lstrlenW (lpString=".pfx") returned 4
	[0057.954] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0057.955] lstrlenW (lpString=".pgm") returned 4
	[0057.955] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0057.955] lstrlenW (lpString=".php") returned 4
	[0057.955] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0057.955] lstrlenW (lpString=".php3") returned 5
	[0057.955] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0057.955] lstrlenW (lpString=".php4") returned 5
	[0057.955] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0057.955] lstrlenW (lpString=".php5") returned 5
	[0057.955] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0057.955] lstrlenW (lpString=".phtml") returned 6
	[0057.955] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0057.955] lstrlenW (lpString=".pict") returned 5
	[0057.955] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0057.955] lstrlenW (lpString=".pl") returned 3
	[0057.955] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0057.955] lstrlenW (lpString=".pls") returned 4
	[0057.955] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0057.955] lstrlenW (lpString=".pm") returned 3
	[0057.955] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0057.955] lstrlenW (lpString=".png") returned 4
	[0057.955] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0057.955] lstrlenW (lpString=".pnm") returned 4
	[0057.955] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0057.955] lstrlenW (lpString=".pot") returned 4
	[0057.955] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0057.955] lstrlenW (lpString=".potm") returned 5
	[0057.955] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0057.955] lstrlenW (lpString=".potx") returned 5
	[0057.956] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0057.956] lstrlenW (lpString=".ppa") returned 4
	[0057.956] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0057.956] lstrlenW (lpString=".ppam") returned 5
	[0057.956] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0057.956] lstrlenW (lpString=".ppm") returned 4
	[0057.956] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0057.956] lstrlenW (lpString=".pps") returned 4
	[0057.956] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0057.956] lstrlenW (lpString=".ppsm") returned 5
	[0057.956] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0057.956] lstrlenW (lpString=".ppt") returned 4
	[0057.956] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0057.956] lstrlenW (lpString=".pptm") returned 5
	[0057.956] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0057.956] lstrlenW (lpString=".pptx") returned 5
	[0057.956] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0057.956] lstrlenW (lpString=".prn") returned 4
	[0057.956] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0057.956] lstrlenW (lpString=".ps") returned 3
	[0057.956] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0057.956] lstrlenW (lpString=".psb") returned 4
	[0057.957] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0057.957] lstrlenW (lpString=".psd") returned 4
	[0057.957] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0057.957] lstrlenW (lpString=".pst") returned 4
	[0057.957] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0057.957] lstrlenW (lpString=".ptx") returned 4
	[0057.957] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0057.957] lstrlenW (lpString=".pub") returned 4
	[0057.957] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0057.957] lstrlenW (lpString=".pwm") returned 4
	[0057.957] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0057.957] lstrlenW (lpString=".pxr") returned 4
	[0057.957] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0057.957] lstrlenW (lpString=".py") returned 3
	[0057.957] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0057.957] lstrlenW (lpString=".qt") returned 3
	[0057.957] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0057.957] lstrlenW (lpString=".r3d") returned 4
	[0057.957] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0057.957] FindNextFileW (in: hFindFile=0x6f46e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0057.957] FindNextFileW (in: hFindFile=0x6f46e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0057.958] FindNextFileW (in: hFindFile=0x6f46e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0057.958] FindClose (in: hFindFile=0x6f46e8 | out: hFindFile=0x6f46e8) returned 1
	[0058.443] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0058.443] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1
	[0058.444] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0058.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26
	[0058.444] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f41e8
	[0058.445] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.445] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0058.445] lstrlenW (lpString="eula.rtf") returned 8
	[0058.445] lstrlenW (lpString=".1cd") returned 4
	[0058.445] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.445] lstrlenW (lpString=".3ds") returned 4
	[0058.445] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0058.445] lstrlenW (lpString=".3fr") returned 4
	[0058.445] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0058.445] lstrlenW (lpString=".3g2") returned 4
	[0058.445] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0058.445] lstrlenW (lpString=".3gp") returned 4
	[0058.445] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0058.446] lstrlenW (lpString=".7z") returned 3
	[0058.446] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.446] lstrlenW (lpString=".accda") returned 6
	[0058.446] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0058.446] lstrlenW (lpString=".accdb") returned 6
	[0058.446] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0058.446] lstrlenW (lpString=".accdc") returned 6
	[0058.446] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0058.446] lstrlenW (lpString=".accde") returned 6
	[0058.446] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0058.446] lstrlenW (lpString=".accdt") returned 6
	[0058.446] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0058.446] lstrlenW (lpString=".accdw") returned 6
	[0058.446] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0058.446] lstrlenW (lpString=".adb") returned 4
	[0058.446] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0058.446] lstrlenW (lpString=".adp") returned 4
	[0058.446] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0058.446] lstrlenW (lpString=".ai") returned 3
	[0058.446] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0058.446] lstrlenW (lpString=".ai3") returned 4
	[0058.446] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0058.446] lstrlenW (lpString=".ai4") returned 4
	[0058.446] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0058.446] lstrlenW (lpString=".ai5") returned 4
	[0058.446] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0058.446] lstrlenW (lpString=".ai6") returned 4
	[0058.446] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0058.447] lstrlenW (lpString=".ai7") returned 4
	[0058.447] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0058.447] lstrlenW (lpString=".ai8") returned 4
	[0058.447] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0058.447] lstrlenW (lpString=".anim") returned 5
	[0058.447] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0058.447] lstrlenW (lpString=".arw") returned 4
	[0058.447] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0058.447] lstrlenW (lpString=".as") returned 3
	[0058.447] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0058.447] lstrlenW (lpString=".asa") returned 4
	[0058.447] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0058.447] lstrlenW (lpString=".asc") returned 4
	[0058.447] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0058.447] lstrlenW (lpString=".ascx") returned 5
	[0058.447] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0058.447] lstrlenW (lpString=".asm") returned 4
	[0058.447] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0058.447] lstrlenW (lpString=".asmx") returned 5
	[0058.447] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0058.447] lstrlenW (lpString=".asp") returned 4
	[0058.447] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0058.447] lstrlenW (lpString=".aspx") returned 5
	[0058.447] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0058.447] lstrlenW (lpString=".asr") returned 4
	[0058.447] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0058.447] lstrlenW (lpString=".asx") returned 4
	[0058.448] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0058.448] lstrlenW (lpString=".avi") returned 4
	[0058.448] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0058.448] lstrlenW (lpString=".avs") returned 4
	[0058.448] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0058.448] lstrlenW (lpString=".backup") returned 7
	[0058.448] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0058.448] lstrlenW (lpString=".bak") returned 4
	[0058.448] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0058.448] lstrlenW (lpString=".bay") returned 4
	[0058.448] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0058.448] lstrlenW (lpString=".bd") returned 3
	[0058.448] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0058.448] lstrlenW (lpString=".bin") returned 4
	[0058.448] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0058.448] lstrlenW (lpString=".bmp") returned 4
	[0058.448] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0058.448] lstrlenW (lpString=".bz2") returned 4
	[0058.448] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.448] lstrlenW (lpString=".c") returned 2
	[0058.448] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0058.448] lstrlenW (lpString=".cdr") returned 4
	[0058.448] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0058.448] lstrlenW (lpString=".cer") returned 4
	[0058.448] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0058.448] lstrlenW (lpString=".cf") returned 3
	[0058.448] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0058.449] lstrlenW (lpString=".cfc") returned 4
	[0058.449] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0058.449] lstrlenW (lpString=".cfm") returned 4
	[0058.449] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0058.449] lstrlenW (lpString=".cfml") returned 5
	[0058.449] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0058.449] lstrlenW (lpString=".cfu") returned 4
	[0058.449] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0058.449] lstrlenW (lpString=".chm") returned 4
	[0058.449] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0058.449] lstrlenW (lpString=".cin") returned 4
	[0058.449] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0058.449] lstrlenW (lpString=".class") returned 6
	[0058.449] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0058.449] lstrlenW (lpString=".clx") returned 4
	[0058.449] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0058.449] lstrlenW (lpString=".config") returned 7
	[0058.449] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0058.449] lstrlenW (lpString=".cpp") returned 4
	[0058.449] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0058.449] lstrlenW (lpString=".cr2") returned 4
	[0058.449] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0058.449] lstrlenW (lpString=".crt") returned 4
	[0058.449] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0058.449] lstrlenW (lpString=".crw") returned 4
	[0058.449] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0058.449] lstrlenW (lpString=".cs") returned 3
	[0058.450] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0058.450] lstrlenW (lpString=".css") returned 4
	[0058.450] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".csv") returned 4
	[0058.450] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".cub") returned 4
	[0058.450] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".dae") returned 4
	[0058.450] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".dat") returned 4
	[0058.450] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".db") returned 3
	[0058.450] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0058.450] lstrlenW (lpString=".dbf") returned 4
	[0058.450] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".dbx") returned 4
	[0058.450] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".dc3") returned 4
	[0058.450] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".dcm") returned 4
	[0058.450] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".dcr") returned 4
	[0058.450] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".der") returned 4
	[0058.450] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".dib") returned 4
	[0058.450] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0058.450] lstrlenW (lpString=".dic") returned 4
	[0058.450] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0058.451] lstrlenW (lpString=".dif") returned 4
	[0058.451] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0058.451] lstrlenW (lpString=".divx") returned 5
	[0058.451] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0058.451] lstrlenW (lpString=".djvu") returned 5
	[0058.451] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0058.451] lstrlenW (lpString=".dng") returned 4
	[0058.451] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0058.451] lstrlenW (lpString=".doc") returned 4
	[0058.451] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.451] lstrlenW (lpString=".docm") returned 5
	[0058.451] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0058.451] lstrlenW (lpString=".docx") returned 5
	[0058.451] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.451] lstrlenW (lpString=".dot") returned 4
	[0058.451] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0058.451] lstrlenW (lpString=".dotm") returned 5
	[0058.451] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0058.451] lstrlenW (lpString=".dotx") returned 5
	[0058.451] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0058.451] lstrlenW (lpString=".dpx") returned 4
	[0058.451] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0058.451] lstrlenW (lpString=".dqy") returned 4
	[0058.451] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0058.451] lstrlenW (lpString=".dsn") returned 4
	[0058.451] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0058.451] lstrlenW (lpString=".dt") returned 3
	[0058.451] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0058.452] lstrlenW (lpString=".dtd") returned 4
	[0058.452] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0058.452] lstrlenW (lpString=".dwg") returned 4
	[0058.452] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0058.452] lstrlenW (lpString=".dwt") returned 4
	[0058.452] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0058.452] lstrlenW (lpString=".dx") returned 3
	[0058.452] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0058.452] lstrlenW (lpString=".dxf") returned 4
	[0058.452] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0058.452] lstrlenW (lpString=".edml") returned 5
	[0058.452] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0058.452] lstrlenW (lpString=".efd") returned 4
	[0058.452] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0058.452] lstrlenW (lpString=".elf") returned 4
	[0058.452] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0058.452] lstrlenW (lpString=".emf") returned 4
	[0058.452] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0058.452] lstrlenW (lpString=".emz") returned 4
	[0058.452] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0058.452] lstrlenW (lpString=".epf") returned 4
	[0058.452] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0058.452] lstrlenW (lpString=".eps") returned 4
	[0058.452] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0058.452] lstrlenW (lpString=".epsf") returned 5
	[0058.452] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0058.452] lstrlenW (lpString=".epsp") returned 5
	[0058.453] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0058.453] lstrlenW (lpString=".erf") returned 4
	[0058.453] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0058.453] lstrlenW (lpString=".exr") returned 4
	[0058.453] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0058.453] lstrlenW (lpString=".f4v") returned 4
	[0058.453] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0058.453] lstrlenW (lpString=".fido") returned 5
	[0058.453] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0058.453] lstrlenW (lpString=".flm") returned 4
	[0058.453] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0058.453] lstrlenW (lpString=".flv") returned 4
	[0058.453] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0058.453] lstrlenW (lpString=".frm") returned 4
	[0058.453] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0058.453] lstrlenW (lpString=".fxg") returned 4
	[0058.453] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0058.453] lstrlenW (lpString=".geo") returned 4
	[0058.453] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0058.453] lstrlenW (lpString=".gif") returned 4
	[0058.453] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0058.453] lstrlenW (lpString=".grs") returned 4
	[0058.453] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0058.453] lstrlenW (lpString=".gz") returned 3
	[0058.453] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0058.453] lstrlenW (lpString=".h") returned 2
	[0058.453] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0058.453] lstrlenW (lpString=".hdr") returned 4
	[0058.453] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".hpp") returned 4
	[0058.454] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".hta") returned 4
	[0058.454] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".htc") returned 4
	[0058.454] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".htm") returned 4
	[0058.454] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".html") returned 5
	[0058.454] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0058.454] lstrlenW (lpString=".icb") returned 4
	[0058.454] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".ics") returned 4
	[0058.454] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".iff") returned 4
	[0058.454] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".inc") returned 4
	[0058.454] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".indd") returned 5
	[0058.454] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0058.454] lstrlenW (lpString=".ini") returned 4
	[0058.454] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".iqy") returned 4
	[0058.454] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".j2c") returned 4
	[0058.454] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0058.454] lstrlenW (lpString=".j2k") returned 4
	[0058.454] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0058.455] lstrlenW (lpString=".java") returned 5
	[0058.455] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0058.455] lstrlenW (lpString=".jp2") returned 4
	[0058.455] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0058.455] lstrlenW (lpString=".jpc") returned 4
	[0058.455] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0058.455] lstrlenW (lpString=".jpe") returned 4
	[0058.455] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0058.455] lstrlenW (lpString=".jpeg") returned 5
	[0058.455] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0058.455] lstrlenW (lpString=".jpf") returned 4
	[0058.455] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0058.455] lstrlenW (lpString=".jpg") returned 4
	[0058.455] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.455] lstrlenW (lpString=".jpx") returned 4
	[0058.455] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0058.455] lstrlenW (lpString=".js") returned 3
	[0058.455] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0058.455] lstrlenW (lpString=".jsf") returned 4
	[0058.455] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0058.455] lstrlenW (lpString=".json") returned 5
	[0058.455] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0058.455] lstrlenW (lpString=".jsp") returned 4
	[0058.455] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0058.455] lstrlenW (lpString=".kdc") returned 4
	[0058.455] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0058.455] lstrlenW (lpString=".kmz") returned 4
	[0058.455] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0058.456] lstrlenW (lpString=".kwm") returned 4
	[0058.456] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0058.456] lstrlenW (lpString=".lasso") returned 6
	[0058.456] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0058.456] lstrlenW (lpString=".lbi") returned 4
	[0058.456] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0058.456] lstrlenW (lpString=".lgf") returned 4
	[0058.456] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0058.456] lstrlenW (lpString=".lgp") returned 4
	[0058.456] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0058.456] lstrlenW (lpString=".log") returned 4
	[0058.456] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0058.456] lstrlenW (lpString=".m1v") returned 4
	[0058.456] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0058.456] lstrlenW (lpString=".m4a") returned 4
	[0058.456] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0058.456] lstrlenW (lpString=".m4v") returned 4
	[0058.456] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0058.456] lstrlenW (lpString=".max") returned 4
	[0058.456] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0058.456] lstrlenW (lpString=".md") returned 3
	[0058.456] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0058.456] lstrlenW (lpString=".mda") returned 4
	[0058.456] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0058.456] lstrlenW (lpString=".mdb") returned 4
	[0058.456] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mde") returned 4
	[0058.457] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mdf") returned 4
	[0058.457] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mdw") returned 4
	[0058.457] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mef") returned 4
	[0058.457] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mft") returned 4
	[0058.457] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mfw") returned 4
	[0058.457] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mht") returned 4
	[0058.457] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mhtml") returned 6
	[0058.457] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0058.457] lstrlenW (lpString=".mka") returned 4
	[0058.457] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mkidx") returned 6
	[0058.457] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0058.457] lstrlenW (lpString=".mkv") returned 4
	[0058.457] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mos") returned 4
	[0058.457] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mov") returned 4
	[0058.457] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mp3") returned 4
	[0058.457] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0058.457] lstrlenW (lpString=".mp4") returned 4
	[0058.458] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0058.458] lstrlenW (lpString=".mpeg") returned 5
	[0058.458] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0058.458] lstrlenW (lpString=".mpg") returned 4
	[0058.458] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0058.458] lstrlenW (lpString=".mpv") returned 4
	[0058.458] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0058.458] lstrlenW (lpString=".mrw") returned 4
	[0058.458] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0058.458] lstrlenW (lpString=".msg") returned 4
	[0058.458] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0058.458] lstrlenW (lpString=".mxl") returned 4
	[0058.458] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0058.458] lstrlenW (lpString=".myd") returned 4
	[0058.458] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0058.458] lstrlenW (lpString=".myi") returned 4
	[0058.458] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0058.458] lstrlenW (lpString=".nef") returned 4
	[0058.458] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0058.458] lstrlenW (lpString=".nrw") returned 4
	[0058.459] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".obj") returned 4
	[0058.459] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".odb") returned 4
	[0058.459] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".odc") returned 4
	[0058.459] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".odm") returned 4
	[0058.459] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".odp") returned 4
	[0058.459] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".ods") returned 4
	[0058.459] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".oft") returned 4
	[0058.459] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".one") returned 4
	[0058.459] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".onepkg") returned 7
	[0058.459] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0058.459] lstrlenW (lpString=".onetoc2") returned 8
	[0058.459] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0058.459] lstrlenW (lpString=".opt") returned 4
	[0058.459] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".oqy") returned 4
	[0058.459] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".orf") returned 4
	[0058.459] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0058.459] lstrlenW (lpString=".p12") returned 4
	[0058.460] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".p7b") returned 4
	[0058.460] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".p7c") returned 4
	[0058.460] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".pam") returned 4
	[0058.460] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".pbm") returned 4
	[0058.460] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".pct") returned 4
	[0058.460] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".pcx") returned 4
	[0058.460] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".pdd") returned 4
	[0058.460] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".pdf") returned 4
	[0058.460] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".pdp") returned 4
	[0058.460] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".pef") returned 4
	[0058.460] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".pem") returned 4
	[0058.460] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".pff") returned 4
	[0058.460] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0058.460] lstrlenW (lpString=".pfm") returned 4
	[0058.460] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0058.461] lstrlenW (lpString=".pfx") returned 4
	[0058.461] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0058.461] lstrlenW (lpString=".pgm") returned 4
	[0058.461] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0058.461] lstrlenW (lpString=".php") returned 4
	[0058.461] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0058.461] lstrlenW (lpString=".php3") returned 5
	[0058.461] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0058.461] lstrlenW (lpString=".php4") returned 5
	[0058.461] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0058.461] lstrlenW (lpString=".php5") returned 5
	[0058.461] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0058.461] lstrlenW (lpString=".phtml") returned 6
	[0058.461] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0058.461] lstrlenW (lpString=".pict") returned 5
	[0058.461] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0058.461] lstrlenW (lpString=".pl") returned 3
	[0058.461] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0058.461] lstrlenW (lpString=".pls") returned 4
	[0058.461] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0058.461] lstrlenW (lpString=".pm") returned 3
	[0058.461] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0058.461] lstrlenW (lpString=".png") returned 4
	[0058.461] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0058.461] lstrlenW (lpString=".pnm") returned 4
	[0058.461] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0058.461] lstrlenW (lpString=".pot") returned 4
	[0058.461] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0058.461] lstrlenW (lpString=".potm") returned 5
	[0058.462] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0058.462] lstrlenW (lpString=".potx") returned 5
	[0058.462] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0058.462] lstrlenW (lpString=".ppa") returned 4
	[0058.462] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0058.462] lstrlenW (lpString=".ppam") returned 5
	[0058.462] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0058.462] lstrlenW (lpString=".ppm") returned 4
	[0058.462] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0058.462] lstrlenW (lpString=".pps") returned 4
	[0058.462] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0058.462] lstrlenW (lpString=".ppsm") returned 5
	[0058.462] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0058.462] lstrlenW (lpString=".ppt") returned 4
	[0058.462] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.462] lstrlenW (lpString=".pptm") returned 5
	[0058.462] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0058.462] lstrlenW (lpString=".pptx") returned 5
	[0058.462] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0058.462] lstrlenW (lpString=".prn") returned 4
	[0058.462] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0058.462] lstrlenW (lpString=".ps") returned 3
	[0058.462] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0058.462] lstrlenW (lpString=".psb") returned 4
	[0058.462] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0058.462] lstrlenW (lpString=".psd") returned 4
	[0058.462] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0058.463] lstrlenW (lpString=".pst") returned 4
	[0058.463] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0058.463] lstrlenW (lpString=".ptx") returned 4
	[0058.463] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0058.463] lstrlenW (lpString=".pub") returned 4
	[0058.463] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0058.463] lstrlenW (lpString=".pwm") returned 4
	[0058.463] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0058.463] lstrlenW (lpString=".pxr") returned 4
	[0058.463] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0058.463] lstrlenW (lpString=".py") returned 3
	[0058.463] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0058.463] lstrlenW (lpString=".qt") returned 3
	[0058.463] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0058.463] lstrlenW (lpString=".r3d") returned 4
	[0058.463] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0058.463] lstrlenW (lpString=".raf") returned 4
	[0058.463] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0058.463] lstrlenW (lpString=".rar") returned 4
	[0058.463] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.463] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0058.464] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0058.464] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0058.464] FindClose (in: hFindFile=0x6f41e8 | out: hFindFile=0x6f41e8) returned 1
	[0058.464] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0058.464] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1
	[0058.464] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0058.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033") returned 26
	[0058.464] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4428
	[0058.465] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.465] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0058.465] lstrlenW (lpString="eula.rtf") returned 8
	[0058.465] lstrlenW (lpString=".1cd") returned 4
	[0058.465] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.465] lstrlenW (lpString=".3ds") returned 4
	[0058.465] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0058.465] lstrlenW (lpString=".3fr") returned 4
	[0058.465] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0058.465] lstrlenW (lpString=".3g2") returned 4
	[0058.466] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0058.466] lstrlenW (lpString=".3gp") returned 4
	[0058.466] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0058.466] lstrlenW (lpString=".7z") returned 3
	[0058.466] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.466] lstrlenW (lpString=".accda") returned 6
	[0058.466] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0058.466] lstrlenW (lpString=".accdb") returned 6
	[0058.466] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0058.466] lstrlenW (lpString=".accdc") returned 6
	[0058.466] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0058.466] lstrlenW (lpString=".accde") returned 6
	[0058.466] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0058.466] lstrlenW (lpString=".accdt") returned 6
	[0058.466] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0058.466] lstrlenW (lpString=".accdw") returned 6
	[0058.466] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0058.466] lstrlenW (lpString=".adb") returned 4
	[0058.466] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0058.466] lstrlenW (lpString=".adp") returned 4
	[0058.466] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0058.466] lstrlenW (lpString=".ai") returned 3
	[0058.466] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0058.466] lstrlenW (lpString=".ai3") returned 4
	[0058.466] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0058.466] lstrlenW (lpString=".ai4") returned 4
	[0058.466] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0058.466] lstrlenW (lpString=".ai5") returned 4
	[0058.466] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0058.467] lstrlenW (lpString=".ai6") returned 4
	[0058.467] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0058.467] lstrlenW (lpString=".ai7") returned 4
	[0058.467] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0058.467] lstrlenW (lpString=".ai8") returned 4
	[0058.467] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0058.467] lstrlenW (lpString=".anim") returned 5
	[0058.467] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0058.467] lstrlenW (lpString=".arw") returned 4
	[0058.467] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0058.467] lstrlenW (lpString=".as") returned 3
	[0058.467] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0058.467] lstrlenW (lpString=".asa") returned 4
	[0058.467] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0058.467] lstrlenW (lpString=".asc") returned 4
	[0058.467] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0058.467] lstrlenW (lpString=".ascx") returned 5
	[0058.467] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0058.467] lstrlenW (lpString=".asm") returned 4
	[0058.467] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0058.467] lstrlenW (lpString=".asmx") returned 5
	[0058.467] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0058.467] lstrlenW (lpString=".asp") returned 4
	[0058.467] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0058.467] lstrlenW (lpString=".aspx") returned 5
	[0058.467] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0058.467] lstrlenW (lpString=".asr") returned 4
	[0058.467] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0058.467] lstrlenW (lpString=".asx") returned 4
	[0058.468] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0058.468] lstrlenW (lpString=".avi") returned 4
	[0058.468] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0058.468] lstrlenW (lpString=".avs") returned 4
	[0058.468] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0058.468] lstrlenW (lpString=".backup") returned 7
	[0058.468] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0058.468] lstrlenW (lpString=".bak") returned 4
	[0058.468] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0058.468] lstrlenW (lpString=".bay") returned 4
	[0058.468] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0058.468] lstrlenW (lpString=".bd") returned 3
	[0058.468] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0058.468] lstrlenW (lpString=".bin") returned 4
	[0058.468] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0058.468] lstrlenW (lpString=".bmp") returned 4
	[0058.468] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0058.468] lstrlenW (lpString=".bz2") returned 4
	[0058.468] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.468] lstrlenW (lpString=".c") returned 2
	[0058.468] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0058.468] lstrlenW (lpString=".cdr") returned 4
	[0058.468] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0058.468] lstrlenW (lpString=".cer") returned 4
	[0058.468] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0058.468] lstrlenW (lpString=".cf") returned 3
	[0058.468] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0058.469] lstrlenW (lpString=".cfc") returned 4
	[0058.469] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0058.469] lstrlenW (lpString=".cfm") returned 4
	[0058.469] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0058.469] lstrlenW (lpString=".cfml") returned 5
	[0058.469] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0058.469] lstrlenW (lpString=".cfu") returned 4
	[0058.469] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0058.469] lstrlenW (lpString=".chm") returned 4
	[0058.469] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0058.469] lstrlenW (lpString=".cin") returned 4
	[0058.469] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0058.469] lstrlenW (lpString=".class") returned 6
	[0058.469] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0058.469] lstrlenW (lpString=".clx") returned 4
	[0058.469] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0058.469] lstrlenW (lpString=".config") returned 7
	[0058.469] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0058.469] lstrlenW (lpString=".cpp") returned 4
	[0058.469] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0058.469] lstrlenW (lpString=".cr2") returned 4
	[0058.469] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0058.469] lstrlenW (lpString=".crt") returned 4
	[0058.469] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0058.469] lstrlenW (lpString=".crw") returned 4
	[0058.469] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0058.469] lstrlenW (lpString=".cs") returned 3
	[0058.469] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0058.469] lstrlenW (lpString=".css") returned 4
	[0058.470] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".csv") returned 4
	[0058.470] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".cub") returned 4
	[0058.470] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".dae") returned 4
	[0058.470] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".dat") returned 4
	[0058.470] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".db") returned 3
	[0058.470] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0058.470] lstrlenW (lpString=".dbf") returned 4
	[0058.470] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".dbx") returned 4
	[0058.470] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".dc3") returned 4
	[0058.470] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".dcm") returned 4
	[0058.470] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".dcr") returned 4
	[0058.470] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".der") returned 4
	[0058.470] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".dib") returned 4
	[0058.470] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".dic") returned 4
	[0058.470] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0058.470] lstrlenW (lpString=".dif") returned 4
	[0058.470] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0058.471] lstrlenW (lpString=".divx") returned 5
	[0058.471] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0058.471] lstrlenW (lpString=".djvu") returned 5
	[0058.471] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0058.471] lstrlenW (lpString=".dng") returned 4
	[0058.471] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0058.471] lstrlenW (lpString=".doc") returned 4
	[0058.471] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.471] lstrlenW (lpString=".docm") returned 5
	[0058.471] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0058.471] lstrlenW (lpString=".docx") returned 5
	[0058.471] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.471] lstrlenW (lpString=".dot") returned 4
	[0058.471] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0058.471] lstrlenW (lpString=".dotm") returned 5
	[0058.471] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0058.471] lstrlenW (lpString=".dotx") returned 5
	[0058.471] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0058.471] lstrlenW (lpString=".dpx") returned 4
	[0058.471] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0058.471] lstrlenW (lpString=".dqy") returned 4
	[0058.471] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0058.471] lstrlenW (lpString=".dsn") returned 4
	[0058.471] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0058.471] lstrlenW (lpString=".dt") returned 3
	[0058.471] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0058.471] lstrlenW (lpString=".dtd") returned 4
	[0058.471] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0058.472] lstrlenW (lpString=".dwg") returned 4
	[0058.472] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0058.472] lstrlenW (lpString=".dwt") returned 4
	[0058.472] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0058.472] lstrlenW (lpString=".dx") returned 3
	[0058.472] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0058.472] lstrlenW (lpString=".dxf") returned 4
	[0058.472] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0058.472] lstrlenW (lpString=".edml") returned 5
	[0058.472] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0058.472] lstrlenW (lpString=".efd") returned 4
	[0058.472] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0058.472] lstrlenW (lpString=".elf") returned 4
	[0058.472] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0058.472] lstrlenW (lpString=".emf") returned 4
	[0058.472] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0058.472] lstrlenW (lpString=".emz") returned 4
	[0058.472] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0058.472] lstrlenW (lpString=".epf") returned 4
	[0058.472] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0058.472] lstrlenW (lpString=".eps") returned 4
	[0058.472] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0058.472] lstrlenW (lpString=".epsf") returned 5
	[0058.472] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0058.472] lstrlenW (lpString=".epsp") returned 5
	[0058.472] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0058.472] lstrlenW (lpString=".erf") returned 4
	[0058.472] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0058.473] lstrlenW (lpString=".exr") returned 4
	[0058.473] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0058.473] lstrlenW (lpString=".f4v") returned 4
	[0058.473] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0058.473] lstrlenW (lpString=".fido") returned 5
	[0058.473] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0058.473] lstrlenW (lpString=".flm") returned 4
	[0058.473] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0058.473] lstrlenW (lpString=".flv") returned 4
	[0058.473] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0058.473] lstrlenW (lpString=".frm") returned 4
	[0058.473] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0058.473] lstrlenW (lpString=".fxg") returned 4
	[0058.473] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0058.473] lstrlenW (lpString=".geo") returned 4
	[0058.473] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0058.473] lstrlenW (lpString=".gif") returned 4
	[0058.473] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0058.473] lstrlenW (lpString=".grs") returned 4
	[0058.474] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0058.474] lstrlenW (lpString=".gz") returned 3
	[0058.474] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0058.474] lstrlenW (lpString=".h") returned 2
	[0058.474] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0058.474] lstrlenW (lpString=".hdr") returned 4
	[0058.474] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0058.474] lstrlenW (lpString=".hpp") returned 4
	[0058.474] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0058.474] lstrlenW (lpString=".hta") returned 4
	[0058.474] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0058.474] lstrlenW (lpString=".htc") returned 4
	[0058.474] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0058.474] lstrlenW (lpString=".htm") returned 4
	[0058.474] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0058.474] lstrlenW (lpString=".html") returned 5
	[0058.474] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0058.474] lstrlenW (lpString=".icb") returned 4
	[0058.475] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0058.475] lstrlenW (lpString=".ics") returned 4
	[0058.475] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0058.475] lstrlenW (lpString=".iff") returned 4
	[0058.475] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0058.475] lstrlenW (lpString=".inc") returned 4
	[0058.475] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0058.475] lstrlenW (lpString=".indd") returned 5
	[0058.475] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0058.475] lstrlenW (lpString=".ini") returned 4
	[0058.475] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0058.475] lstrlenW (lpString=".iqy") returned 4
	[0058.475] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0058.475] lstrlenW (lpString=".j2c") returned 4
	[0058.475] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0058.475] lstrlenW (lpString=".j2k") returned 4
	[0058.475] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0058.475] lstrlenW (lpString=".java") returned 5
	[0058.475] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0058.475] lstrlenW (lpString=".jp2") returned 4
	[0058.475] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0058.475] lstrlenW (lpString=".jpc") returned 4
	[0058.475] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0058.475] lstrlenW (lpString=".jpe") returned 4
	[0058.475] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0058.475] lstrlenW (lpString=".jpeg") returned 5
	[0058.475] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0058.475] lstrlenW (lpString=".jpf") returned 4
	[0058.476] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0058.476] lstrlenW (lpString=".jpg") returned 4
	[0058.476] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.476] lstrlenW (lpString=".jpx") returned 4
	[0058.476] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0058.476] lstrlenW (lpString=".js") returned 3
	[0058.476] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0058.476] lstrlenW (lpString=".jsf") returned 4
	[0058.476] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0058.476] lstrlenW (lpString=".json") returned 5
	[0058.476] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0058.476] lstrlenW (lpString=".jsp") returned 4
	[0058.476] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0058.476] lstrlenW (lpString=".kdc") returned 4
	[0058.476] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0058.476] lstrlenW (lpString=".kmz") returned 4
	[0058.476] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0058.476] lstrlenW (lpString=".kwm") returned 4
	[0058.476] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0058.476] lstrlenW (lpString=".lasso") returned 6
	[0058.476] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0058.476] lstrlenW (lpString=".lbi") returned 4
	[0058.476] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0058.476] lstrlenW (lpString=".lgf") returned 4
	[0058.476] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0058.476] lstrlenW (lpString=".lgp") returned 4
	[0058.476] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0058.476] lstrlenW (lpString=".log") returned 4
	[0058.476] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".m1v") returned 4
	[0058.477] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".m4a") returned 4
	[0058.477] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".m4v") returned 4
	[0058.477] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".max") returned 4
	[0058.477] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".md") returned 3
	[0058.477] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0058.477] lstrlenW (lpString=".mda") returned 4
	[0058.477] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".mdb") returned 4
	[0058.477] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".mde") returned 4
	[0058.477] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".mdf") returned 4
	[0058.477] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".mdw") returned 4
	[0058.477] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".mef") returned 4
	[0058.477] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".mft") returned 4
	[0058.477] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".mfw") returned 4
	[0058.477] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0058.477] lstrlenW (lpString=".mht") returned 4
	[0058.478] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0058.478] lstrlenW (lpString=".mhtml") returned 6
	[0058.478] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0058.478] lstrlenW (lpString=".mka") returned 4
	[0058.478] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0058.478] lstrlenW (lpString=".mkidx") returned 6
	[0058.478] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0058.478] lstrlenW (lpString=".mkv") returned 4
	[0058.478] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0058.478] lstrlenW (lpString=".mos") returned 4
	[0058.478] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0058.478] lstrlenW (lpString=".mov") returned 4
	[0058.478] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0058.478] lstrlenW (lpString=".mp3") returned 4
	[0058.478] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0058.478] lstrlenW (lpString=".mp4") returned 4
	[0058.478] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0058.478] lstrlenW (lpString=".mpeg") returned 5
	[0058.478] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0058.478] lstrlenW (lpString=".mpg") returned 4
	[0058.478] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0058.478] lstrlenW (lpString=".mpv") returned 4
	[0058.478] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0058.478] lstrlenW (lpString=".mrw") returned 4
	[0058.478] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0058.478] lstrlenW (lpString=".msg") returned 4
	[0058.479] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".mxl") returned 4
	[0058.479] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".myd") returned 4
	[0058.479] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".myi") returned 4
	[0058.479] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".nef") returned 4
	[0058.479] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".nrw") returned 4
	[0058.479] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".obj") returned 4
	[0058.479] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".odb") returned 4
	[0058.479] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".odc") returned 4
	[0058.479] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".odm") returned 4
	[0058.479] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".odp") returned 4
	[0058.479] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".ods") returned 4
	[0058.479] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".oft") returned 4
	[0058.479] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".one") returned 4
	[0058.479] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0058.479] lstrlenW (lpString=".onepkg") returned 7
	[0058.479] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0058.480] lstrlenW (lpString=".onetoc2") returned 8
	[0058.480] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0058.480] lstrlenW (lpString=".opt") returned 4
	[0058.480] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".oqy") returned 4
	[0058.480] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".orf") returned 4
	[0058.480] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".p12") returned 4
	[0058.480] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".p7b") returned 4
	[0058.480] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".p7c") returned 4
	[0058.480] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".pam") returned 4
	[0058.480] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".pbm") returned 4
	[0058.480] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".pct") returned 4
	[0058.480] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".pcx") returned 4
	[0058.480] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".pdd") returned 4
	[0058.480] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".pdf") returned 4
	[0058.480] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.480] lstrlenW (lpString=".pdp") returned 4
	[0058.480] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0058.481] lstrlenW (lpString=".pef") returned 4
	[0058.481] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0058.481] lstrlenW (lpString=".pem") returned 4
	[0058.481] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0058.481] lstrlenW (lpString=".pff") returned 4
	[0058.481] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0058.481] lstrlenW (lpString=".pfm") returned 4
	[0058.481] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0058.481] lstrlenW (lpString=".pfx") returned 4
	[0058.481] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0058.481] lstrlenW (lpString=".pgm") returned 4
	[0058.481] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0058.481] lstrlenW (lpString=".php") returned 4
	[0058.481] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0058.481] lstrlenW (lpString=".php3") returned 5
	[0058.481] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0058.481] lstrlenW (lpString=".php4") returned 5
	[0058.481] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0058.481] lstrlenW (lpString=".php5") returned 5
	[0058.481] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0058.481] lstrlenW (lpString=".phtml") returned 6
	[0058.481] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0058.481] lstrlenW (lpString=".pict") returned 5
	[0058.481] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0058.481] lstrlenW (lpString=".pl") returned 3
	[0058.481] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0058.481] lstrlenW (lpString=".pls") returned 4
	[0058.482] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0058.482] lstrlenW (lpString=".pm") returned 3
	[0058.482] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0058.482] lstrlenW (lpString=".png") returned 4
	[0058.482] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0058.482] lstrlenW (lpString=".pnm") returned 4
	[0058.482] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0058.482] lstrlenW (lpString=".pot") returned 4
	[0058.482] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0058.482] lstrlenW (lpString=".potm") returned 5
	[0058.482] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0058.482] lstrlenW (lpString=".potx") returned 5
	[0058.482] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0058.482] lstrlenW (lpString=".ppa") returned 4
	[0058.482] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0058.482] lstrlenW (lpString=".ppam") returned 5
	[0058.482] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0058.482] lstrlenW (lpString=".ppm") returned 4
	[0058.482] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0058.482] lstrlenW (lpString=".pps") returned 4
	[0058.482] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0058.482] lstrlenW (lpString=".ppsm") returned 5
	[0058.482] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0058.482] lstrlenW (lpString=".ppt") returned 4
	[0058.482] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.482] lstrlenW (lpString=".pptm") returned 5
	[0058.482] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0058.482] lstrlenW (lpString=".pptx") returned 5
	[0058.482] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0058.483] lstrlenW (lpString=".prn") returned 4
	[0058.483] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0058.483] lstrlenW (lpString=".ps") returned 3
	[0058.483] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0058.483] lstrlenW (lpString=".psb") returned 4
	[0058.483] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0058.483] lstrlenW (lpString=".psd") returned 4
	[0058.483] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0058.483] lstrlenW (lpString=".pst") returned 4
	[0058.483] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0058.483] lstrlenW (lpString=".ptx") returned 4
	[0058.483] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0058.483] lstrlenW (lpString=".pub") returned 4
	[0058.483] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0058.483] lstrlenW (lpString=".pwm") returned 4
	[0058.483] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0058.483] lstrlenW (lpString=".pxr") returned 4
	[0058.483] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0058.483] lstrlenW (lpString=".py") returned 3
	[0058.483] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0058.483] lstrlenW (lpString=".qt") returned 3
	[0058.483] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0058.483] lstrlenW (lpString=".r3d") returned 4
	[0058.483] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0058.483] lstrlenW (lpString=".raf") returned 4
	[0058.483] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0058.483] lstrlenW (lpString=".rar") returned 4
	[0058.484] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.484] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0058.484] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0058.484] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0058.484] FindClose (in: hFindFile=0x6f4428 | out: hFindFile=0x6f4428) returned 1
	[0058.484] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0058.484] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1
	[0058.484] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0058.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035") returned 26
	[0058.484] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f45a8
	[0058.485] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.485] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0058.485] lstrlenW (lpString="eula.rtf") returned 8
	[0058.485] lstrlenW (lpString=".1cd") returned 4
	[0058.485] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.485] lstrlenW (lpString=".3ds") returned 4
	[0058.485] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0058.485] lstrlenW (lpString=".3fr") returned 4
	[0058.485] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0058.485] lstrlenW (lpString=".3g2") returned 4
	[0058.485] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0058.485] lstrlenW (lpString=".3gp") returned 4
	[0058.485] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0058.485] lstrlenW (lpString=".7z") returned 3
	[0058.485] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.485] lstrlenW (lpString=".accda") returned 6
	[0058.485] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0058.485] lstrlenW (lpString=".accdb") returned 6
	[0058.485] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0058.485] lstrlenW (lpString=".accdc") returned 6
	[0058.485] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0058.485] lstrlenW (lpString=".accde") returned 6
	[0058.486] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0058.486] lstrlenW (lpString=".accdt") returned 6
	[0058.486] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0058.486] lstrlenW (lpString=".accdw") returned 6
	[0058.486] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0058.486] lstrlenW (lpString=".adb") returned 4
	[0058.486] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0058.486] lstrlenW (lpString=".adp") returned 4
	[0058.486] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0058.486] lstrlenW (lpString=".ai") returned 3
	[0058.486] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0058.486] lstrlenW (lpString=".ai3") returned 4
	[0058.486] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0058.486] lstrlenW (lpString=".ai4") returned 4
	[0058.486] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0058.486] lstrlenW (lpString=".ai5") returned 4
	[0058.486] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0058.486] lstrlenW (lpString=".ai6") returned 4
	[0058.486] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0058.486] lstrlenW (lpString=".ai7") returned 4
	[0058.486] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0058.486] lstrlenW (lpString=".ai8") returned 4
	[0058.486] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0058.486] lstrlenW (lpString=".anim") returned 5
	[0058.486] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0058.486] lstrlenW (lpString=".arw") returned 4
	[0058.486] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0058.486] lstrlenW (lpString=".as") returned 3
	[0058.487] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0058.487] lstrlenW (lpString=".asa") returned 4
	[0058.487] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0058.487] lstrlenW (lpString=".asc") returned 4
	[0058.487] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0058.487] lstrlenW (lpString=".ascx") returned 5
	[0058.487] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0058.487] lstrlenW (lpString=".asm") returned 4
	[0058.487] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0058.487] lstrlenW (lpString=".asmx") returned 5
	[0058.487] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0058.487] lstrlenW (lpString=".asp") returned 4
	[0058.487] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0058.487] lstrlenW (lpString=".aspx") returned 5
	[0058.487] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0058.487] lstrlenW (lpString=".asr") returned 4
	[0058.487] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0058.487] lstrlenW (lpString=".asx") returned 4
	[0058.487] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0058.487] lstrlenW (lpString=".avi") returned 4
	[0058.487] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0058.487] lstrlenW (lpString=".avs") returned 4
	[0058.487] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0058.487] lstrlenW (lpString=".backup") returned 7
	[0058.487] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0058.487] lstrlenW (lpString=".bak") returned 4
	[0058.487] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0058.488] lstrlenW (lpString=".bay") returned 4
	[0058.488] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0058.488] lstrlenW (lpString=".bd") returned 3
	[0058.488] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0058.488] lstrlenW (lpString=".bin") returned 4
	[0058.488] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0058.488] lstrlenW (lpString=".bmp") returned 4
	[0058.488] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0058.488] lstrlenW (lpString=".bz2") returned 4
	[0058.488] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.488] lstrlenW (lpString=".c") returned 2
	[0058.488] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0058.488] lstrlenW (lpString=".cdr") returned 4
	[0058.488] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0058.488] lstrlenW (lpString=".cer") returned 4
	[0058.488] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0058.488] lstrlenW (lpString=".cf") returned 3
	[0058.488] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0058.488] lstrlenW (lpString=".cfc") returned 4
	[0058.488] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0058.488] lstrlenW (lpString=".cfm") returned 4
	[0058.488] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0058.488] lstrlenW (lpString=".cfml") returned 5
	[0058.488] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0058.488] lstrlenW (lpString=".cfu") returned 4
	[0058.488] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0058.488] lstrlenW (lpString=".chm") returned 4
	[0058.489] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0058.489] lstrlenW (lpString=".cin") returned 4
	[0058.489] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0058.489] lstrlenW (lpString=".class") returned 6
	[0058.489] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0058.489] lstrlenW (lpString=".clx") returned 4
	[0058.489] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0058.489] lstrlenW (lpString=".config") returned 7
	[0058.489] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0058.489] lstrlenW (lpString=".cpp") returned 4
	[0058.900] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0058.900] lstrlenW (lpString=".cr2") returned 4
	[0058.900] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0058.900] lstrlenW (lpString=".crt") returned 4
	[0058.900] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0058.900] lstrlenW (lpString=".crw") returned 4
	[0058.900] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0058.900] lstrlenW (lpString=".cs") returned 3
	[0058.900] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0058.900] lstrlenW (lpString=".css") returned 4
	[0058.900] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0058.900] lstrlenW (lpString=".csv") returned 4
	[0058.900] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0058.900] lstrlenW (lpString=".cub") returned 4
	[0058.900] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0058.900] lstrlenW (lpString=".dae") returned 4
	[0058.900] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0058.901] lstrlenW (lpString=".dat") returned 4
	[0058.901] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0058.901] lstrlenW (lpString=".db") returned 3
	[0058.901] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0058.901] lstrlenW (lpString=".dbf") returned 4
	[0058.901] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.901] lstrlenW (lpString=".dbx") returned 4
	[0058.901] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0058.901] lstrlenW (lpString=".dc3") returned 4
	[0058.901] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0058.901] lstrlenW (lpString=".dcm") returned 4
	[0058.901] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0058.901] lstrlenW (lpString=".dcr") returned 4
	[0058.901] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0058.901] lstrlenW (lpString=".der") returned 4
	[0058.901] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0058.901] lstrlenW (lpString=".dib") returned 4
	[0058.901] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0058.901] lstrlenW (lpString=".dic") returned 4
	[0058.901] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0058.901] lstrlenW (lpString=".dif") returned 4
	[0058.901] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0058.901] lstrlenW (lpString=".divx") returned 5
	[0058.901] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0058.902] lstrlenW (lpString=".djvu") returned 5
	[0058.902] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0058.902] lstrlenW (lpString=".dng") returned 4
	[0058.902] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0058.902] lstrlenW (lpString=".doc") returned 4
	[0058.902] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.902] lstrlenW (lpString=".docm") returned 5
	[0058.902] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0058.902] lstrlenW (lpString=".docx") returned 5
	[0058.902] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.902] lstrlenW (lpString=".dot") returned 4
	[0058.902] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0058.902] lstrlenW (lpString=".dotm") returned 5
	[0058.902] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0058.902] lstrlenW (lpString=".dotx") returned 5
	[0058.902] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0058.902] lstrlenW (lpString=".dpx") returned 4
	[0058.903] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0058.903] lstrlenW (lpString=".dqy") returned 4
	[0058.903] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0058.903] lstrlenW (lpString=".dsn") returned 4
	[0058.903] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0058.903] lstrlenW (lpString=".dt") returned 3
	[0058.903] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0058.903] lstrlenW (lpString=".dtd") returned 4
	[0058.903] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0058.903] lstrlenW (lpString=".dwg") returned 4
	[0058.903] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0058.903] lstrlenW (lpString=".dwt") returned 4
	[0058.903] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0058.903] lstrlenW (lpString=".dx") returned 3
	[0058.903] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0058.903] lstrlenW (lpString=".dxf") returned 4
	[0058.903] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0058.904] lstrlenW (lpString=".edml") returned 5
	[0058.904] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0058.904] lstrlenW (lpString=".efd") returned 4
	[0058.904] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0058.904] lstrlenW (lpString=".elf") returned 4
	[0058.904] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0058.904] lstrlenW (lpString=".emf") returned 4
	[0058.904] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0058.904] lstrlenW (lpString=".emz") returned 4
	[0058.904] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0058.904] lstrlenW (lpString=".epf") returned 4
	[0058.904] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0058.904] lstrlenW (lpString=".eps") returned 4
	[0058.904] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0058.904] lstrlenW (lpString=".epsf") returned 5
	[0058.904] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0058.904] lstrlenW (lpString=".epsp") returned 5
	[0058.904] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0058.904] lstrlenW (lpString=".erf") returned 4
	[0058.904] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0058.905] lstrlenW (lpString=".exr") returned 4
	[0058.905] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0058.905] lstrlenW (lpString=".f4v") returned 4
	[0058.905] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0058.905] lstrlenW (lpString=".fido") returned 5
	[0058.905] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0058.905] lstrlenW (lpString=".flm") returned 4
	[0058.905] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0058.905] lstrlenW (lpString=".flv") returned 4
	[0058.905] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0058.905] lstrlenW (lpString=".frm") returned 4
	[0058.905] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0058.905] lstrlenW (lpString=".fxg") returned 4
	[0058.905] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0058.905] lstrlenW (lpString=".geo") returned 4
	[0058.905] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0058.905] lstrlenW (lpString=".gif") returned 4
	[0058.905] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0058.906] lstrlenW (lpString=".grs") returned 4
	[0058.906] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0058.906] lstrlenW (lpString=".gz") returned 3
	[0058.906] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0058.906] lstrlenW (lpString=".h") returned 2
	[0058.906] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0058.906] lstrlenW (lpString=".hdr") returned 4
	[0058.906] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0058.906] lstrlenW (lpString=".hpp") returned 4
	[0058.906] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0058.906] lstrlenW (lpString=".hta") returned 4
	[0058.906] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0058.906] lstrlenW (lpString=".htc") returned 4
	[0058.906] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0058.906] lstrlenW (lpString=".htm") returned 4
	[0058.906] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0058.906] lstrlenW (lpString=".html") returned 5
	[0058.907] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0058.907] lstrlenW (lpString=".icb") returned 4
	[0058.907] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0058.907] lstrlenW (lpString=".ics") returned 4
	[0058.907] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0058.907] lstrlenW (lpString=".iff") returned 4
	[0058.907] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0058.907] lstrlenW (lpString=".inc") returned 4
	[0058.907] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0058.907] lstrlenW (lpString=".indd") returned 5
	[0058.907] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0058.907] lstrlenW (lpString=".ini") returned 4
	[0058.907] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0058.907] lstrlenW (lpString=".iqy") returned 4
	[0058.907] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0058.907] lstrlenW (lpString=".j2c") returned 4
	[0058.907] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0058.907] lstrlenW (lpString=".j2k") returned 4
	[0058.907] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0058.907] lstrlenW (lpString=".java") returned 5
	[0058.908] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0058.908] lstrlenW (lpString=".jp2") returned 4
	[0058.908] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0058.908] lstrlenW (lpString=".jpc") returned 4
	[0058.908] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0058.908] lstrlenW (lpString=".jpe") returned 4
	[0058.908] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0058.908] lstrlenW (lpString=".jpeg") returned 5
	[0058.908] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0058.908] lstrlenW (lpString=".jpf") returned 4
	[0058.908] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0058.908] lstrlenW (lpString=".jpg") returned 4
	[0058.908] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.908] lstrlenW (lpString=".jpx") returned 4
	[0058.908] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0058.908] lstrlenW (lpString=".js") returned 3
	[0058.908] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0058.908] lstrlenW (lpString=".jsf") returned 4
	[0058.908] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0058.908] lstrlenW (lpString=".json") returned 5
	[0058.908] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0058.908] lstrlenW (lpString=".jsp") returned 4
	[0058.908] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0058.908] lstrlenW (lpString=".kdc") returned 4
	[0058.908] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0058.909] lstrlenW (lpString=".kmz") returned 4
	[0058.909] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0058.909] lstrlenW (lpString=".kwm") returned 4
	[0058.909] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0058.909] lstrlenW (lpString=".lasso") returned 6
	[0058.909] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0058.909] lstrlenW (lpString=".lbi") returned 4
	[0058.909] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0058.909] lstrlenW (lpString=".lgf") returned 4
	[0058.909] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0058.909] lstrlenW (lpString=".lgp") returned 4
	[0058.909] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0058.909] lstrlenW (lpString=".log") returned 4
	[0058.909] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0058.909] lstrlenW (lpString=".m1v") returned 4
	[0058.909] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0058.909] lstrlenW (lpString=".m4a") returned 4
	[0058.909] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0058.909] lstrlenW (lpString=".m4v") returned 4
	[0058.909] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0058.910] lstrlenW (lpString=".max") returned 4
	[0058.910] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0058.910] lstrlenW (lpString=".md") returned 3
	[0058.910] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0058.910] lstrlenW (lpString=".mda") returned 4
	[0058.910] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0058.910] lstrlenW (lpString=".mdb") returned 4
	[0058.910] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0058.910] lstrlenW (lpString=".mde") returned 4
	[0058.910] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0058.910] lstrlenW (lpString=".mdf") returned 4
	[0058.910] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0058.910] lstrlenW (lpString=".mdw") returned 4
	[0058.910] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0058.910] lstrlenW (lpString=".mef") returned 4
	[0058.910] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0058.910] lstrlenW (lpString=".mft") returned 4
	[0058.910] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0058.910] lstrlenW (lpString=".mfw") returned 4
	[0058.910] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0058.910] lstrlenW (lpString=".mht") returned 4
	[0058.911] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0058.911] lstrlenW (lpString=".mhtml") returned 6
	[0058.911] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0058.911] lstrlenW (lpString=".mka") returned 4
	[0058.911] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0058.911] lstrlenW (lpString=".mkidx") returned 6
	[0058.911] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0058.911] lstrlenW (lpString=".mkv") returned 4
	[0058.911] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".mos") returned 4
	[0058.912] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".mov") returned 4
	[0058.912] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".mp3") returned 4
	[0058.912] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".mp4") returned 4
	[0058.912] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".mpeg") returned 5
	[0058.912] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0058.912] lstrlenW (lpString=".mpg") returned 4
	[0058.912] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".mpv") returned 4
	[0058.912] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".mrw") returned 4
	[0058.912] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".msg") returned 4
	[0058.912] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".mxl") returned 4
	[0058.912] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".myd") returned 4
	[0058.912] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".myi") returned 4
	[0058.912] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0058.912] lstrlenW (lpString=".nef") returned 4
	[0058.912] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0058.913] lstrlenW (lpString=".nrw") returned 4
	[0058.913] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0058.913] lstrlenW (lpString=".obj") returned 4
	[0058.913] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0058.913] lstrlenW (lpString=".odb") returned 4
	[0058.913] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0058.913] lstrlenW (lpString=".odc") returned 4
	[0058.913] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0058.913] lstrlenW (lpString=".odm") returned 4
	[0058.913] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0058.913] lstrlenW (lpString=".odp") returned 4
	[0058.913] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0058.913] lstrlenW (lpString=".ods") returned 4
	[0058.913] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0058.913] lstrlenW (lpString=".oft") returned 4
	[0058.913] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0058.913] lstrlenW (lpString=".one") returned 4
	[0058.913] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0058.913] lstrlenW (lpString=".onepkg") returned 7
	[0058.913] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0058.913] lstrlenW (lpString=".onetoc2") returned 8
	[0058.913] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0058.913] lstrlenW (lpString=".opt") returned 4
	[0058.913] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".oqy") returned 4
	[0058.914] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".orf") returned 4
	[0058.914] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".p12") returned 4
	[0058.914] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".p7b") returned 4
	[0058.914] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".p7c") returned 4
	[0058.914] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".pam") returned 4
	[0058.914] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".pbm") returned 4
	[0058.914] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".pct") returned 4
	[0058.914] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".pcx") returned 4
	[0058.914] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".pdd") returned 4
	[0058.914] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".pdf") returned 4
	[0058.914] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".pdp") returned 4
	[0058.914] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0058.914] lstrlenW (lpString=".pef") returned 4
	[0058.915] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0058.915] lstrlenW (lpString=".pem") returned 4
	[0058.915] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0058.915] lstrlenW (lpString=".pff") returned 4
	[0058.915] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0058.915] lstrlenW (lpString=".pfm") returned 4
	[0058.915] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0058.915] lstrlenW (lpString=".pfx") returned 4
	[0058.915] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0058.915] lstrlenW (lpString=".pgm") returned 4
	[0058.915] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0058.915] lstrlenW (lpString=".php") returned 4
	[0058.915] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0058.915] lstrlenW (lpString=".php3") returned 5
	[0058.915] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0058.915] lstrlenW (lpString=".php4") returned 5
	[0058.915] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0058.915] lstrlenW (lpString=".php5") returned 5
	[0058.915] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0058.915] lstrlenW (lpString=".phtml") returned 6
	[0058.915] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0058.915] lstrlenW (lpString=".pict") returned 5
	[0058.915] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0058.915] lstrlenW (lpString=".pl") returned 3
	[0058.915] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0058.915] lstrlenW (lpString=".pls") returned 4
	[0058.916] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0058.916] lstrlenW (lpString=".pm") returned 3
	[0058.916] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0058.916] lstrlenW (lpString=".png") returned 4
	[0058.916] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0058.916] lstrlenW (lpString=".pnm") returned 4
	[0058.916] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0058.916] lstrlenW (lpString=".pot") returned 4
	[0058.916] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0058.916] lstrlenW (lpString=".potm") returned 5
	[0058.916] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0058.916] lstrlenW (lpString=".potx") returned 5
	[0058.916] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0058.916] lstrlenW (lpString=".ppa") returned 4
	[0058.916] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0058.916] lstrlenW (lpString=".ppam") returned 5
	[0058.916] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0058.916] lstrlenW (lpString=".ppm") returned 4
	[0058.916] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0058.916] lstrlenW (lpString=".pps") returned 4
	[0058.916] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0058.916] lstrlenW (lpString=".ppsm") returned 5
	[0058.916] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0058.916] lstrlenW (lpString=".ppt") returned 4
	[0058.916] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.916] lstrlenW (lpString=".pptm") returned 5
	[0058.916] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0058.917] lstrlenW (lpString=".pptx") returned 5
	[0058.917] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0058.917] lstrlenW (lpString=".prn") returned 4
	[0058.917] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0058.917] lstrlenW (lpString=".ps") returned 3
	[0058.917] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0058.917] lstrlenW (lpString=".psb") returned 4
	[0058.917] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0058.917] lstrlenW (lpString=".psd") returned 4
	[0058.917] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0058.917] lstrlenW (lpString=".pst") returned 4
	[0058.917] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0058.917] lstrlenW (lpString=".ptx") returned 4
	[0058.917] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0058.917] lstrlenW (lpString=".pub") returned 4
	[0058.917] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0058.917] lstrlenW (lpString=".pwm") returned 4
	[0058.917] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0058.917] lstrlenW (lpString=".pxr") returned 4
	[0058.917] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0058.917] lstrlenW (lpString=".py") returned 3
	[0058.917] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0058.917] lstrlenW (lpString=".qt") returned 3
	[0058.917] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0058.917] lstrlenW (lpString=".r3d") returned 4
	[0058.917] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0058.917] lstrlenW (lpString=".raf") returned 4
	[0058.917] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0058.917] lstrlenW (lpString=".rar") returned 4
	[0058.917] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.918] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0058.918] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0058.918] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0058.918] FindClose (in: hFindFile=0x6f45a8 | out: hFindFile=0x6f45a8) returned 1
	[0058.918] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0058.918] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1
	[0058.918] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0058.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036") returned 26
	[0058.918] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4268
	[0058.919] FindNextFileW (in: hFindFile=0x6f4268, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.919] FindNextFileW (in: hFindFile=0x6f4268, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0058.919] lstrlenW (lpString="eula.rtf") returned 8
	[0058.919] lstrlenW (lpString=".1cd") returned 4
	[0058.919] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.919] lstrlenW (lpString=".3ds") returned 4
	[0058.919] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0058.919] lstrlenW (lpString=".3fr") returned 4
	[0058.920] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0058.920] lstrlenW (lpString=".3g2") returned 4
	[0058.920] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0058.920] lstrlenW (lpString=".3gp") returned 4
	[0058.920] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0058.920] lstrlenW (lpString=".7z") returned 3
	[0058.920] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.920] lstrlenW (lpString=".accda") returned 6
	[0058.920] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0058.920] lstrlenW (lpString=".accdb") returned 6
	[0058.920] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0058.920] lstrlenW (lpString=".accdc") returned 6
	[0058.920] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0058.920] lstrlenW (lpString=".accde") returned 6
	[0058.920] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0058.920] lstrlenW (lpString=".accdt") returned 6
	[0058.920] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0058.920] lstrlenW (lpString=".accdw") returned 6
	[0058.920] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0058.920] lstrlenW (lpString=".adb") returned 4
	[0058.920] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0058.920] lstrlenW (lpString=".adp") returned 4
	[0058.920] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0058.920] lstrlenW (lpString=".ai") returned 3
	[0058.920] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0058.920] lstrlenW (lpString=".ai3") returned 4
	[0058.920] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0058.920] lstrlenW (lpString=".ai4") returned 4
	[0058.921] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0058.921] lstrlenW (lpString=".ai5") returned 4
	[0058.921] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0058.921] lstrlenW (lpString=".ai6") returned 4
	[0058.921] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0058.921] lstrlenW (lpString=".ai7") returned 4
	[0058.921] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0058.921] lstrlenW (lpString=".ai8") returned 4
	[0058.921] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0058.921] lstrlenW (lpString=".anim") returned 5
	[0058.921] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0058.921] lstrlenW (lpString=".arw") returned 4
	[0058.921] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0058.921] lstrlenW (lpString=".as") returned 3
	[0058.921] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0058.921] lstrlenW (lpString=".asa") returned 4
	[0058.921] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0058.921] lstrlenW (lpString=".asc") returned 4
	[0058.921] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0058.921] lstrlenW (lpString=".ascx") returned 5
	[0058.921] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0058.921] lstrlenW (lpString=".asm") returned 4
	[0058.921] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0058.921] lstrlenW (lpString=".asmx") returned 5
	[0058.921] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0058.921] lstrlenW (lpString=".asp") returned 4
	[0058.921] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0058.921] lstrlenW (lpString=".aspx") returned 5
	[0058.922] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0058.922] lstrlenW (lpString=".asr") returned 4
	[0058.922] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0058.922] lstrlenW (lpString=".asx") returned 4
	[0058.922] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0058.922] lstrlenW (lpString=".avi") returned 4
	[0058.922] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0058.922] lstrlenW (lpString=".avs") returned 4
	[0058.922] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0058.922] lstrlenW (lpString=".backup") returned 7
	[0058.922] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0058.922] lstrlenW (lpString=".bak") returned 4
	[0058.922] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0058.922] lstrlenW (lpString=".bay") returned 4
	[0058.922] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0058.922] lstrlenW (lpString=".bd") returned 3
	[0058.922] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0058.922] lstrlenW (lpString=".bin") returned 4
	[0058.922] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0058.922] lstrlenW (lpString=".bmp") returned 4
	[0058.922] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0058.922] lstrlenW (lpString=".bz2") returned 4
	[0058.922] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.922] lstrlenW (lpString=".c") returned 2
	[0058.922] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0058.922] lstrlenW (lpString=".cdr") returned 4
	[0058.922] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0058.923] lstrlenW (lpString=".cer") returned 4
	[0058.923] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0058.923] lstrlenW (lpString=".cf") returned 3
	[0058.923] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0058.923] lstrlenW (lpString=".cfc") returned 4
	[0058.923] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0058.923] lstrlenW (lpString=".cfm") returned 4
	[0058.923] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0058.923] lstrlenW (lpString=".cfml") returned 5
	[0058.923] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0058.923] lstrlenW (lpString=".cfu") returned 4
	[0058.923] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0058.923] lstrlenW (lpString=".chm") returned 4
	[0058.923] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0058.923] lstrlenW (lpString=".cin") returned 4
	[0058.923] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0058.923] lstrlenW (lpString=".class") returned 6
	[0058.923] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0058.923] lstrlenW (lpString=".clx") returned 4
	[0058.923] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0058.923] lstrlenW (lpString=".config") returned 7
	[0058.923] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0058.923] lstrlenW (lpString=".cpp") returned 4
	[0058.923] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0058.923] lstrlenW (lpString=".cr2") returned 4
	[0058.923] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".crt") returned 4
	[0058.924] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".crw") returned 4
	[0058.924] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".cs") returned 3
	[0058.924] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0058.924] lstrlenW (lpString=".css") returned 4
	[0058.924] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".csv") returned 4
	[0058.924] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".cub") returned 4
	[0058.924] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".dae") returned 4
	[0058.924] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".dat") returned 4
	[0058.924] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".db") returned 3
	[0058.924] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0058.924] lstrlenW (lpString=".dbf") returned 4
	[0058.924] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".dbx") returned 4
	[0058.924] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".dc3") returned 4
	[0058.924] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".dcm") returned 4
	[0058.924] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0058.924] lstrlenW (lpString=".dcr") returned 4
	[0058.924] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0058.925] lstrlenW (lpString=".der") returned 4
	[0058.925] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0058.925] lstrlenW (lpString=".dib") returned 4
	[0058.925] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0058.925] lstrlenW (lpString=".dic") returned 4
	[0058.925] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0058.925] lstrlenW (lpString=".dif") returned 4
	[0058.925] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0058.925] lstrlenW (lpString=".divx") returned 5
	[0058.925] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0058.925] lstrlenW (lpString=".djvu") returned 5
	[0058.925] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0058.925] lstrlenW (lpString=".dng") returned 4
	[0058.925] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0058.925] lstrlenW (lpString=".doc") returned 4
	[0058.925] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.925] lstrlenW (lpString=".docm") returned 5
	[0058.925] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0058.925] lstrlenW (lpString=".docx") returned 5
	[0058.925] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.925] lstrlenW (lpString=".dot") returned 4
	[0058.925] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0058.925] lstrlenW (lpString=".dotm") returned 5
	[0058.925] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0058.925] lstrlenW (lpString=".dotx") returned 5
	[0058.925] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0058.925] lstrlenW (lpString=".dpx") returned 4
	[0058.926] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0058.926] lstrlenW (lpString=".dqy") returned 4
	[0058.926] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0058.926] lstrlenW (lpString=".dsn") returned 4
	[0058.926] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0058.926] lstrlenW (lpString=".dt") returned 3
	[0058.926] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0058.926] lstrlenW (lpString=".dtd") returned 4
	[0058.926] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0058.926] lstrlenW (lpString=".dwg") returned 4
	[0058.926] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0058.926] lstrlenW (lpString=".dwt") returned 4
	[0058.926] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0058.926] lstrlenW (lpString=".dx") returned 3
	[0058.926] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0058.926] lstrlenW (lpString=".dxf") returned 4
	[0058.926] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0058.926] lstrlenW (lpString=".edml") returned 5
	[0058.926] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0058.926] lstrlenW (lpString=".efd") returned 4
	[0058.926] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0058.926] lstrlenW (lpString=".elf") returned 4
	[0058.926] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0058.926] lstrlenW (lpString=".emf") returned 4
	[0058.926] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0058.926] lstrlenW (lpString=".emz") returned 4
	[0058.927] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0058.927] lstrlenW (lpString=".epf") returned 4
	[0058.927] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0058.927] lstrlenW (lpString=".eps") returned 4
	[0058.927] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0058.927] lstrlenW (lpString=".epsf") returned 5
	[0058.927] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0058.927] lstrlenW (lpString=".epsp") returned 5
	[0058.927] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0058.927] lstrlenW (lpString=".erf") returned 4
	[0058.927] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0058.927] lstrlenW (lpString=".exr") returned 4
	[0058.927] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0058.927] lstrlenW (lpString=".f4v") returned 4
	[0058.927] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0058.927] lstrlenW (lpString=".fido") returned 5
	[0058.927] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0058.927] lstrlenW (lpString=".flm") returned 4
	[0058.927] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0058.927] lstrlenW (lpString=".flv") returned 4
	[0058.927] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0058.927] lstrlenW (lpString=".frm") returned 4
	[0058.927] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0058.927] lstrlenW (lpString=".fxg") returned 4
	[0058.927] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0058.927] lstrlenW (lpString=".geo") returned 4
	[0058.928] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0058.928] lstrlenW (lpString=".gif") returned 4
	[0058.928] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0058.928] lstrlenW (lpString=".grs") returned 4
	[0058.928] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0058.928] lstrlenW (lpString=".gz") returned 3
	[0058.928] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0058.928] lstrlenW (lpString=".h") returned 2
	[0058.928] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0058.928] lstrlenW (lpString=".hdr") returned 4
	[0058.928] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0058.928] lstrlenW (lpString=".hpp") returned 4
	[0058.928] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0058.928] lstrlenW (lpString=".hta") returned 4
	[0058.928] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0058.928] lstrlenW (lpString=".htc") returned 4
	[0058.928] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0058.928] lstrlenW (lpString=".htm") returned 4
	[0058.928] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0058.928] lstrlenW (lpString=".html") returned 5
	[0058.928] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0058.928] lstrlenW (lpString=".icb") returned 4
	[0058.928] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0058.928] lstrlenW (lpString=".ics") returned 4
	[0058.928] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0058.928] lstrlenW (lpString=".iff") returned 4
	[0058.928] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0058.929] lstrlenW (lpString=".inc") returned 4
	[0058.929] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0058.929] lstrlenW (lpString=".indd") returned 5
	[0058.929] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0058.929] lstrlenW (lpString=".ini") returned 4
	[0058.929] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0058.929] lstrlenW (lpString=".iqy") returned 4
	[0058.929] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0058.929] lstrlenW (lpString=".j2c") returned 4
	[0058.929] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0058.929] lstrlenW (lpString=".j2k") returned 4
	[0058.929] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0058.929] lstrlenW (lpString=".java") returned 5
	[0058.929] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0058.929] lstrlenW (lpString=".jp2") returned 4
	[0058.929] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0058.929] lstrlenW (lpString=".jpc") returned 4
	[0058.929] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0058.929] lstrlenW (lpString=".jpe") returned 4
	[0058.929] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0058.929] lstrlenW (lpString=".jpeg") returned 5
	[0058.929] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0058.929] lstrlenW (lpString=".jpf") returned 4
	[0058.929] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0058.929] lstrlenW (lpString=".jpg") returned 4
	[0058.929] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.929] lstrlenW (lpString=".jpx") returned 4
	[0058.929] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0058.930] lstrlenW (lpString=".js") returned 3
	[0058.930] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0058.930] lstrlenW (lpString=".jsf") returned 4
	[0058.930] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0058.930] lstrlenW (lpString=".json") returned 5
	[0058.930] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0058.930] lstrlenW (lpString=".jsp") returned 4
	[0058.930] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0058.930] lstrlenW (lpString=".kdc") returned 4
	[0058.930] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0058.930] lstrlenW (lpString=".kmz") returned 4
	[0058.930] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0058.930] lstrlenW (lpString=".kwm") returned 4
	[0058.930] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0058.930] lstrlenW (lpString=".lasso") returned 6
	[0058.930] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0058.930] lstrlenW (lpString=".lbi") returned 4
	[0058.930] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0058.930] lstrlenW (lpString=".lgf") returned 4
	[0058.930] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0058.930] lstrlenW (lpString=".lgp") returned 4
	[0058.930] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0058.930] lstrlenW (lpString=".log") returned 4
	[0058.930] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0058.930] lstrlenW (lpString=".m1v") returned 4
	[0058.930] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".m4a") returned 4
	[0058.931] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".m4v") returned 4
	[0058.931] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".max") returned 4
	[0058.931] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".md") returned 3
	[0058.931] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0058.931] lstrlenW (lpString=".mda") returned 4
	[0058.931] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".mdb") returned 4
	[0058.931] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".mde") returned 4
	[0058.931] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".mdf") returned 4
	[0058.931] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".mdw") returned 4
	[0058.931] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".mef") returned 4
	[0058.931] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".mft") returned 4
	[0058.931] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".mfw") returned 4
	[0058.931] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".mht") returned 4
	[0058.931] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0058.931] lstrlenW (lpString=".mhtml") returned 6
	[0058.931] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0058.931] lstrlenW (lpString=".mka") returned 4
	[0058.932] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".mkidx") returned 6
	[0058.932] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0058.932] lstrlenW (lpString=".mkv") returned 4
	[0058.932] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".mos") returned 4
	[0058.932] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".mov") returned 4
	[0058.932] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".mp3") returned 4
	[0058.932] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".mp4") returned 4
	[0058.932] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".mpeg") returned 5
	[0058.932] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0058.932] lstrlenW (lpString=".mpg") returned 4
	[0058.932] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".mpv") returned 4
	[0058.932] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".mrw") returned 4
	[0058.932] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".msg") returned 4
	[0058.932] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".mxl") returned 4
	[0058.932] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".myd") returned 4
	[0058.932] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0058.932] lstrlenW (lpString=".myi") returned 4
	[0058.932] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".nef") returned 4
	[0058.933] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".nrw") returned 4
	[0058.933] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".obj") returned 4
	[0058.933] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".odb") returned 4
	[0058.933] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".odc") returned 4
	[0058.933] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".odm") returned 4
	[0058.933] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".odp") returned 4
	[0058.933] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".ods") returned 4
	[0058.933] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".oft") returned 4
	[0058.933] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".one") returned 4
	[0058.933] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".onepkg") returned 7
	[0058.933] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0058.933] lstrlenW (lpString=".onetoc2") returned 8
	[0058.933] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0058.933] lstrlenW (lpString=".opt") returned 4
	[0058.933] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".oqy") returned 4
	[0058.933] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0058.933] lstrlenW (lpString=".orf") returned 4
	[0058.934] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".p12") returned 4
	[0058.934] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".p7b") returned 4
	[0058.934] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".p7c") returned 4
	[0058.934] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".pam") returned 4
	[0058.934] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".pbm") returned 4
	[0058.934] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".pct") returned 4
	[0058.934] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".pcx") returned 4
	[0058.934] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".pdd") returned 4
	[0058.934] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".pdf") returned 4
	[0058.934] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".pdp") returned 4
	[0058.934] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".pef") returned 4
	[0058.934] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".pem") returned 4
	[0058.934] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".pff") returned 4
	[0058.934] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0058.934] lstrlenW (lpString=".pfm") returned 4
	[0058.934] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0058.935] lstrlenW (lpString=".pfx") returned 4
	[0058.935] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0058.935] lstrlenW (lpString=".pgm") returned 4
	[0058.935] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0058.935] lstrlenW (lpString=".php") returned 4
	[0058.935] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0058.935] lstrlenW (lpString=".php3") returned 5
	[0058.935] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0058.935] lstrlenW (lpString=".php4") returned 5
	[0058.935] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0058.935] lstrlenW (lpString=".php5") returned 5
	[0058.935] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0058.935] lstrlenW (lpString=".phtml") returned 6
	[0058.935] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0058.935] lstrlenW (lpString=".pict") returned 5
	[0058.935] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0058.935] lstrlenW (lpString=".pl") returned 3
	[0058.935] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0058.935] lstrlenW (lpString=".pls") returned 4
	[0058.935] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0058.935] lstrlenW (lpString=".pm") returned 3
	[0058.935] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0058.935] lstrlenW (lpString=".png") returned 4
	[0058.935] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0058.935] lstrlenW (lpString=".pnm") returned 4
	[0058.935] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0058.935] lstrlenW (lpString=".pot") returned 4
	[0058.935] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0058.935] lstrlenW (lpString=".potm") returned 5
	[0058.935] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0058.935] lstrlenW (lpString=".potx") returned 5
	[0058.936] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0058.936] lstrlenW (lpString=".ppa") returned 4
	[0058.936] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0058.936] lstrlenW (lpString=".ppam") returned 5
	[0058.936] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0058.936] lstrlenW (lpString=".ppm") returned 4
	[0058.936] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0058.936] lstrlenW (lpString=".pps") returned 4
	[0058.936] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0058.936] lstrlenW (lpString=".ppsm") returned 5
	[0058.936] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0058.936] lstrlenW (lpString=".ppt") returned 4
	[0058.936] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.936] lstrlenW (lpString=".pptm") returned 5
	[0058.936] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0058.936] lstrlenW (lpString=".pptx") returned 5
	[0058.936] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0058.936] lstrlenW (lpString=".prn") returned 4
	[0058.936] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0058.936] lstrlenW (lpString=".ps") returned 3
	[0058.936] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0058.936] lstrlenW (lpString=".psb") returned 4
	[0058.936] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0058.936] lstrlenW (lpString=".psd") returned 4
	[0058.936] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0058.936] lstrlenW (lpString=".pst") returned 4
	[0058.936] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0058.936] lstrlenW (lpString=".ptx") returned 4
	[0058.937] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0058.937] lstrlenW (lpString=".pub") returned 4
	[0058.937] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0058.937] lstrlenW (lpString=".pwm") returned 4
	[0058.937] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0058.937] lstrlenW (lpString=".pxr") returned 4
	[0058.937] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0058.937] lstrlenW (lpString=".py") returned 3
	[0058.937] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0058.937] lstrlenW (lpString=".qt") returned 3
	[0058.937] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0058.937] lstrlenW (lpString=".r3d") returned 4
	[0058.937] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0058.937] lstrlenW (lpString=".raf") returned 4
	[0058.937] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0058.937] lstrlenW (lpString=".rar") returned 4
	[0058.937] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.937] FindNextFileW (in: hFindFile=0x6f4268, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0058.937] FindNextFileW (in: hFindFile=0x6f4268, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0058.937] FindNextFileW (in: hFindFile=0x6f4268, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0058.938] FindClose (in: hFindFile=0x6f4268 | out: hFindFile=0x6f4268) returned 1
	[0058.938] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0058.938] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1
	[0058.938] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0058.938] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037") returned 26
	[0058.938] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f41e8
	[0058.938] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.938] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0058.938] lstrlenW (lpString="eula.rtf") returned 8
	[0058.938] lstrlenW (lpString=".1cd") returned 4
	[0058.938] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.938] lstrlenW (lpString=".3ds") returned 4
	[0058.939] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0058.939] lstrlenW (lpString=".3fr") returned 4
	[0058.939] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0058.939] lstrlenW (lpString=".3g2") returned 4
	[0058.939] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0058.939] lstrlenW (lpString=".3gp") returned 4
	[0058.939] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0058.939] lstrlenW (lpString=".7z") returned 3
	[0058.939] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.939] lstrlenW (lpString=".accda") returned 6
	[0058.939] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0058.939] lstrlenW (lpString=".accdb") returned 6
	[0058.939] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0058.939] lstrlenW (lpString=".accdc") returned 6
	[0058.939] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0058.939] lstrlenW (lpString=".accde") returned 6
	[0058.939] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0058.939] lstrlenW (lpString=".accdt") returned 6
	[0058.939] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0058.939] lstrlenW (lpString=".accdw") returned 6
	[0058.939] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0058.939] lstrlenW (lpString=".adb") returned 4
	[0058.939] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0058.939] lstrlenW (lpString=".adp") returned 4
	[0058.939] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0058.939] lstrlenW (lpString=".ai") returned 3
	[0058.939] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0058.939] lstrlenW (lpString=".ai3") returned 4
	[0058.939] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0058.940] lstrlenW (lpString=".ai4") returned 4
	[0058.940] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0058.940] lstrlenW (lpString=".ai5") returned 4
	[0058.940] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0058.940] lstrlenW (lpString=".ai6") returned 4
	[0058.940] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0058.940] lstrlenW (lpString=".ai7") returned 4
	[0058.940] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0058.940] lstrlenW (lpString=".ai8") returned 4
	[0058.940] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0058.940] lstrlenW (lpString=".anim") returned 5
	[0058.940] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0058.940] lstrlenW (lpString=".arw") returned 4
	[0058.940] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0058.940] lstrlenW (lpString=".as") returned 3
	[0058.940] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0058.940] lstrlenW (lpString=".asa") returned 4
	[0058.940] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0058.940] lstrlenW (lpString=".asc") returned 4
	[0058.940] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0058.940] lstrlenW (lpString=".ascx") returned 5
	[0058.940] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0058.940] lstrlenW (lpString=".asm") returned 4
	[0058.940] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0058.940] lstrlenW (lpString=".asmx") returned 5
	[0058.940] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0058.940] lstrlenW (lpString=".asp") returned 4
	[0058.940] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0058.941] lstrlenW (lpString=".aspx") returned 5
	[0058.941] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0058.941] lstrlenW (lpString=".asr") returned 4
	[0058.941] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0058.941] lstrlenW (lpString=".asx") returned 4
	[0058.941] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0058.941] lstrlenW (lpString=".avi") returned 4
	[0058.941] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0058.941] lstrlenW (lpString=".avs") returned 4
	[0058.941] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0058.941] lstrlenW (lpString=".backup") returned 7
	[0058.941] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0058.941] lstrlenW (lpString=".bak") returned 4
	[0058.941] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0058.941] lstrlenW (lpString=".bay") returned 4
	[0058.941] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0058.941] lstrlenW (lpString=".bd") returned 3
	[0058.941] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0058.941] lstrlenW (lpString=".bin") returned 4
	[0058.941] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0058.941] lstrlenW (lpString=".bmp") returned 4
	[0058.941] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0058.941] lstrlenW (lpString=".bz2") returned 4
	[0058.941] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.941] lstrlenW (lpString=".c") returned 2
	[0058.941] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0058.941] lstrlenW (lpString=".cdr") returned 4
	[0058.942] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0058.942] lstrlenW (lpString=".cer") returned 4
	[0058.942] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0058.942] lstrlenW (lpString=".cf") returned 3
	[0058.942] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0058.942] lstrlenW (lpString=".cfc") returned 4
	[0058.942] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0058.942] lstrlenW (lpString=".cfm") returned 4
	[0058.942] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0058.942] lstrlenW (lpString=".cfml") returned 5
	[0058.942] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0058.942] lstrlenW (lpString=".cfu") returned 4
	[0058.942] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0058.942] lstrlenW (lpString=".chm") returned 4
	[0058.942] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0059.299] lstrlenW (lpString=".cin") returned 4
	[0059.299] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0059.299] lstrlenW (lpString=".class") returned 6
	[0059.299] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0059.299] lstrlenW (lpString=".clx") returned 4
	[0059.299] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0059.299] lstrlenW (lpString=".config") returned 7
	[0059.299] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0059.299] lstrlenW (lpString=".cpp") returned 4
	[0059.299] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0059.299] lstrlenW (lpString=".cr2") returned 4
	[0059.299] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0059.299] lstrlenW (lpString=".crt") returned 4
	[0059.299] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0059.299] lstrlenW (lpString=".crw") returned 4
	[0059.299] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0059.299] lstrlenW (lpString=".cs") returned 3
	[0059.299] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0059.299] lstrlenW (lpString=".css") returned 4
	[0059.299] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0059.299] lstrlenW (lpString=".csv") returned 4
	[0059.299] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".cub") returned 4
	[0059.300] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".dae") returned 4
	[0059.300] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".dat") returned 4
	[0059.300] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".db") returned 3
	[0059.300] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0059.300] lstrlenW (lpString=".dbf") returned 4
	[0059.300] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".dbx") returned 4
	[0059.300] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".dc3") returned 4
	[0059.300] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".dcm") returned 4
	[0059.300] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".dcr") returned 4
	[0059.300] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".der") returned 4
	[0059.300] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".dib") returned 4
	[0059.300] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".dic") returned 4
	[0059.300] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0059.300] lstrlenW (lpString=".dif") returned 4
	[0059.300] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0059.301] lstrlenW (lpString=".divx") returned 5
	[0059.301] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0059.301] lstrlenW (lpString=".djvu") returned 5
	[0059.301] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0059.301] lstrlenW (lpString=".dng") returned 4
	[0059.301] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0059.301] lstrlenW (lpString=".doc") returned 4
	[0059.301] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.301] lstrlenW (lpString=".docm") returned 5
	[0059.301] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0059.301] lstrlenW (lpString=".docx") returned 5
	[0059.301] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.301] lstrlenW (lpString=".dot") returned 4
	[0059.301] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0059.301] lstrlenW (lpString=".dotm") returned 5
	[0059.301] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0059.301] lstrlenW (lpString=".dotx") returned 5
	[0059.301] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0059.301] lstrlenW (lpString=".dpx") returned 4
	[0059.301] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0059.301] lstrlenW (lpString=".dqy") returned 4
	[0059.301] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0059.301] lstrlenW (lpString=".dsn") returned 4
	[0059.301] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0059.301] lstrlenW (lpString=".dt") returned 3
	[0059.302] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0059.302] lstrlenW (lpString=".dtd") returned 4
	[0059.302] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0059.302] lstrlenW (lpString=".dwg") returned 4
	[0059.302] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0059.302] lstrlenW (lpString=".dwt") returned 4
	[0059.302] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0059.302] lstrlenW (lpString=".dx") returned 3
	[0059.302] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0059.302] lstrlenW (lpString=".dxf") returned 4
	[0059.302] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0059.302] lstrlenW (lpString=".edml") returned 5
	[0059.302] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0059.302] lstrlenW (lpString=".efd") returned 4
	[0059.302] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0059.302] lstrlenW (lpString=".elf") returned 4
	[0059.302] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0059.302] lstrlenW (lpString=".emf") returned 4
	[0059.302] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0059.302] lstrlenW (lpString=".emz") returned 4
	[0059.302] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0059.302] lstrlenW (lpString=".epf") returned 4
	[0059.302] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0059.302] lstrlenW (lpString=".eps") returned 4
	[0059.302] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0059.302] lstrlenW (lpString=".epsf") returned 5
	[0059.302] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0059.303] lstrlenW (lpString=".epsp") returned 5
	[0059.303] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0059.303] lstrlenW (lpString=".erf") returned 4
	[0059.303] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0059.303] lstrlenW (lpString=".exr") returned 4
	[0059.303] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0059.303] lstrlenW (lpString=".f4v") returned 4
	[0059.303] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0059.303] lstrlenW (lpString=".fido") returned 5
	[0059.303] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0059.303] lstrlenW (lpString=".flm") returned 4
	[0059.303] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0059.303] lstrlenW (lpString=".flv") returned 4
	[0059.303] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0059.303] lstrlenW (lpString=".frm") returned 4
	[0059.303] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0059.303] lstrlenW (lpString=".fxg") returned 4
	[0059.303] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0059.303] lstrlenW (lpString=".geo") returned 4
	[0059.303] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0059.303] lstrlenW (lpString=".gif") returned 4
	[0059.303] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0059.303] lstrlenW (lpString=".grs") returned 4
	[0059.303] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0059.304] lstrlenW (lpString=".gz") returned 3
	[0059.304] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0059.304] lstrlenW (lpString=".h") returned 2
	[0059.304] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0059.304] lstrlenW (lpString=".hdr") returned 4
	[0059.304] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0059.304] lstrlenW (lpString=".hpp") returned 4
	[0059.304] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0059.304] lstrlenW (lpString=".hta") returned 4
	[0059.304] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0059.304] lstrlenW (lpString=".htc") returned 4
	[0059.304] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0059.304] lstrlenW (lpString=".htm") returned 4
	[0059.304] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0059.304] lstrlenW (lpString=".html") returned 5
	[0059.304] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0059.304] lstrlenW (lpString=".icb") returned 4
	[0059.304] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0059.304] lstrlenW (lpString=".ics") returned 4
	[0059.304] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0059.304] lstrlenW (lpString=".iff") returned 4
	[0059.304] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0059.304] lstrlenW (lpString=".inc") returned 4
	[0059.304] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0059.304] lstrlenW (lpString=".indd") returned 5
	[0059.304] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0059.305] lstrlenW (lpString=".ini") returned 4
	[0059.305] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0059.305] lstrlenW (lpString=".iqy") returned 4
	[0059.305] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0059.305] lstrlenW (lpString=".j2c") returned 4
	[0059.305] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0059.305] lstrlenW (lpString=".j2k") returned 4
	[0059.305] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0059.305] lstrlenW (lpString=".java") returned 5
	[0059.305] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0059.305] lstrlenW (lpString=".jp2") returned 4
	[0059.305] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0059.305] lstrlenW (lpString=".jpc") returned 4
	[0059.305] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0059.305] lstrlenW (lpString=".jpe") returned 4
	[0059.305] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0059.305] lstrlenW (lpString=".jpeg") returned 5
	[0059.305] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0059.305] lstrlenW (lpString=".jpf") returned 4
	[0059.305] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0059.305] lstrlenW (lpString=".jpg") returned 4
	[0059.305] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.305] lstrlenW (lpString=".jpx") returned 4
	[0059.305] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0059.305] lstrlenW (lpString=".js") returned 3
	[0059.305] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0059.305] lstrlenW (lpString=".jsf") returned 4
	[0059.305] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".json") returned 5
	[0059.306] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0059.306] lstrlenW (lpString=".jsp") returned 4
	[0059.306] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".kdc") returned 4
	[0059.306] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".kmz") returned 4
	[0059.306] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".kwm") returned 4
	[0059.306] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".lasso") returned 6
	[0059.306] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0059.306] lstrlenW (lpString=".lbi") returned 4
	[0059.306] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".lgf") returned 4
	[0059.306] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".lgp") returned 4
	[0059.306] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".log") returned 4
	[0059.306] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".m1v") returned 4
	[0059.306] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".m4a") returned 4
	[0059.306] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".m4v") returned 4
	[0059.306] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0059.306] lstrlenW (lpString=".max") returned 4
	[0059.306] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0059.307] lstrlenW (lpString=".md") returned 3
	[0059.307] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0059.307] lstrlenW (lpString=".mda") returned 4
	[0059.307] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0059.307] lstrlenW (lpString=".mdb") returned 4
	[0059.307] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0059.307] lstrlenW (lpString=".mde") returned 4
	[0059.307] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0059.307] lstrlenW (lpString=".mdf") returned 4
	[0059.307] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0059.307] lstrlenW (lpString=".mdw") returned 4
	[0059.307] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0059.307] lstrlenW (lpString=".mef") returned 4
	[0059.307] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0059.307] lstrlenW (lpString=".mft") returned 4
	[0059.307] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0059.307] lstrlenW (lpString=".mfw") returned 4
	[0059.307] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0059.307] lstrlenW (lpString=".mht") returned 4
	[0059.307] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0059.307] lstrlenW (lpString=".mhtml") returned 6
	[0059.307] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0059.307] lstrlenW (lpString=".mka") returned 4
	[0059.308] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0059.308] lstrlenW (lpString=".mkidx") returned 6
	[0059.308] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0059.308] lstrlenW (lpString=".mkv") returned 4
	[0059.308] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0059.308] lstrlenW (lpString=".mos") returned 4
	[0059.308] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0059.308] lstrlenW (lpString=".mov") returned 4
	[0059.308] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0059.308] lstrlenW (lpString=".mp3") returned 4
	[0059.308] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0059.308] lstrlenW (lpString=".mp4") returned 4
	[0059.308] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0059.308] lstrlenW (lpString=".mpeg") returned 5
	[0059.308] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0059.309] lstrlenW (lpString=".mpg") returned 4
	[0059.309] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".mpv") returned 4
	[0059.309] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".mrw") returned 4
	[0059.309] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".msg") returned 4
	[0059.309] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".mxl") returned 4
	[0059.309] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".myd") returned 4
	[0059.309] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".myi") returned 4
	[0059.309] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".nef") returned 4
	[0059.309] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".nrw") returned 4
	[0059.309] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".obj") returned 4
	[0059.309] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".odb") returned 4
	[0059.309] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".odc") returned 4
	[0059.309] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".odm") returned 4
	[0059.309] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0059.309] lstrlenW (lpString=".odp") returned 4
	[0059.310] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0059.310] lstrlenW (lpString=".ods") returned 4
	[0059.310] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0059.310] lstrlenW (lpString=".oft") returned 4
	[0059.310] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0059.310] lstrlenW (lpString=".one") returned 4
	[0059.310] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0059.310] lstrlenW (lpString=".onepkg") returned 7
	[0059.310] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0059.310] lstrlenW (lpString=".onetoc2") returned 8
	[0059.310] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0059.310] lstrlenW (lpString=".opt") returned 4
	[0059.310] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0059.310] lstrlenW (lpString=".oqy") returned 4
	[0059.310] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0059.310] lstrlenW (lpString=".orf") returned 4
	[0059.310] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0059.310] lstrlenW (lpString=".p12") returned 4
	[0059.310] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0059.310] lstrlenW (lpString=".p7b") returned 4
	[0059.310] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0059.310] lstrlenW (lpString=".p7c") returned 4
	[0059.310] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0059.311] lstrlenW (lpString=".pam") returned 4
	[0059.311] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0059.311] lstrlenW (lpString=".pbm") returned 4
	[0059.311] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0059.311] lstrlenW (lpString=".pct") returned 4
	[0059.311] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0059.311] lstrlenW (lpString=".pcx") returned 4
	[0059.311] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0059.311] lstrlenW (lpString=".pdd") returned 4
	[0059.311] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0059.311] lstrlenW (lpString=".pdf") returned 4
	[0059.311] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.311] lstrlenW (lpString=".pdp") returned 4
	[0059.311] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0059.311] lstrlenW (lpString=".pef") returned 4
	[0059.311] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0059.311] lstrlenW (lpString=".pem") returned 4
	[0059.311] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0059.311] lstrlenW (lpString=".pff") returned 4
	[0059.311] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0059.311] lstrlenW (lpString=".pfm") returned 4
	[0059.311] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0059.312] lstrlenW (lpString=".pfx") returned 4
	[0059.312] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0059.312] lstrlenW (lpString=".pgm") returned 4
	[0059.312] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0059.312] lstrlenW (lpString=".php") returned 4
	[0059.312] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0059.312] lstrlenW (lpString=".php3") returned 5
	[0059.312] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0059.312] lstrlenW (lpString=".php4") returned 5
	[0059.312] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0059.312] lstrlenW (lpString=".php5") returned 5
	[0059.312] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0059.312] lstrlenW (lpString=".phtml") returned 6
	[0059.312] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0059.312] lstrlenW (lpString=".pict") returned 5
	[0059.312] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0059.312] lstrlenW (lpString=".pl") returned 3
	[0059.312] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0059.312] lstrlenW (lpString=".pls") returned 4
	[0059.312] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0059.312] lstrlenW (lpString=".pm") returned 3
	[0059.312] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0059.313] lstrlenW (lpString=".png") returned 4
	[0059.313] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0059.313] lstrlenW (lpString=".pnm") returned 4
	[0059.313] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0059.313] lstrlenW (lpString=".pot") returned 4
	[0059.313] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0059.313] lstrlenW (lpString=".potm") returned 5
	[0059.313] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0059.313] lstrlenW (lpString=".potx") returned 5
	[0059.313] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0059.313] lstrlenW (lpString=".ppa") returned 4
	[0059.313] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0059.313] lstrlenW (lpString=".ppam") returned 5
	[0059.313] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0059.313] lstrlenW (lpString=".ppm") returned 4
	[0059.313] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0059.313] lstrlenW (lpString=".pps") returned 4
	[0059.313] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0059.313] lstrlenW (lpString=".ppsm") returned 5
	[0059.313] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0059.313] lstrlenW (lpString=".ppt") returned 4
	[0059.313] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.313] lstrlenW (lpString=".pptm") returned 5
	[0059.313] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0059.313] lstrlenW (lpString=".pptx") returned 5
	[0059.313] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0059.313] lstrlenW (lpString=".prn") returned 4
	[0059.314] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0059.314] lstrlenW (lpString=".ps") returned 3
	[0059.314] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0059.314] lstrlenW (lpString=".psb") returned 4
	[0059.314] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0059.314] lstrlenW (lpString=".psd") returned 4
	[0059.314] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0059.314] lstrlenW (lpString=".pst") returned 4
	[0059.314] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0059.314] lstrlenW (lpString=".ptx") returned 4
	[0059.314] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0059.314] lstrlenW (lpString=".pub") returned 4
	[0059.314] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0059.314] lstrlenW (lpString=".pwm") returned 4
	[0059.314] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0059.314] lstrlenW (lpString=".pxr") returned 4
	[0059.314] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0059.314] lstrlenW (lpString=".py") returned 3
	[0059.314] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0059.314] lstrlenW (lpString=".qt") returned 3
	[0059.314] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0059.314] lstrlenW (lpString=".r3d") returned 4
	[0059.314] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0059.315] lstrlenW (lpString=".raf") returned 4
	[0059.315] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0059.315] lstrlenW (lpString=".rar") returned 4
	[0059.315] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.315] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.315] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.315] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.315] FindClose (in: hFindFile=0x6f41e8 | out: hFindFile=0x6f41e8) returned 1
	[0059.315] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.315] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1
	[0059.316] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038") returned 26
	[0059.316] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f44a8
	[0059.316] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.316] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.316] lstrlenW (lpString="eula.rtf") returned 8
	[0059.316] lstrlenW (lpString=".1cd") returned 4
	[0059.316] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.316] lstrlenW (lpString=".3ds") returned 4
	[0059.316] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0059.316] lstrlenW (lpString=".3fr") returned 4
	[0059.316] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0059.316] lstrlenW (lpString=".3g2") returned 4
	[0059.316] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0059.316] lstrlenW (lpString=".3gp") returned 4
	[0059.317] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0059.317] lstrlenW (lpString=".7z") returned 3
	[0059.317] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.317] lstrlenW (lpString=".accda") returned 6
	[0059.317] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0059.317] lstrlenW (lpString=".accdb") returned 6
	[0059.317] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0059.317] lstrlenW (lpString=".accdc") returned 6
	[0059.317] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0059.317] lstrlenW (lpString=".accde") returned 6
	[0059.317] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0059.317] lstrlenW (lpString=".accdt") returned 6
	[0059.317] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0059.317] lstrlenW (lpString=".accdw") returned 6
	[0059.317] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0059.317] lstrlenW (lpString=".adb") returned 4
	[0059.317] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0059.317] lstrlenW (lpString=".adp") returned 4
	[0059.317] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0059.317] lstrlenW (lpString=".ai") returned 3
	[0059.317] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0059.317] lstrlenW (lpString=".ai3") returned 4
	[0059.318] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0059.318] lstrlenW (lpString=".ai4") returned 4
	[0059.318] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0059.318] lstrlenW (lpString=".ai5") returned 4
	[0059.318] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0059.318] lstrlenW (lpString=".ai6") returned 4
	[0059.318] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0059.318] lstrlenW (lpString=".ai7") returned 4
	[0059.318] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0059.318] lstrlenW (lpString=".ai8") returned 4
	[0059.318] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0059.318] lstrlenW (lpString=".anim") returned 5
	[0059.318] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0059.318] lstrlenW (lpString=".arw") returned 4
	[0059.318] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0059.318] lstrlenW (lpString=".as") returned 3
	[0059.318] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0059.318] lstrlenW (lpString=".asa") returned 4
	[0059.318] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0059.318] lstrlenW (lpString=".asc") returned 4
	[0059.318] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0059.318] lstrlenW (lpString=".ascx") returned 5
	[0059.318] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0059.318] lstrlenW (lpString=".asm") returned 4
	[0059.318] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0059.319] lstrlenW (lpString=".asmx") returned 5
	[0059.319] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0059.319] lstrlenW (lpString=".asp") returned 4
	[0059.319] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0059.319] lstrlenW (lpString=".aspx") returned 5
	[0059.319] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0059.319] lstrlenW (lpString=".asr") returned 4
	[0059.319] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0059.319] lstrlenW (lpString=".asx") returned 4
	[0059.319] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0059.319] lstrlenW (lpString=".avi") returned 4
	[0059.319] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0059.319] lstrlenW (lpString=".avs") returned 4
	[0059.319] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0059.319] lstrlenW (lpString=".backup") returned 7
	[0059.319] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0059.319] lstrlenW (lpString=".bak") returned 4
	[0059.319] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0059.319] lstrlenW (lpString=".bay") returned 4
	[0059.319] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0059.319] lstrlenW (lpString=".bd") returned 3
	[0059.319] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0059.319] lstrlenW (lpString=".bin") returned 4
	[0059.319] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0059.320] lstrlenW (lpString=".bmp") returned 4
	[0059.320] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0059.320] lstrlenW (lpString=".bz2") returned 4
	[0059.320] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.320] lstrlenW (lpString=".c") returned 2
	[0059.320] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0059.320] lstrlenW (lpString=".cdr") returned 4
	[0059.320] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0059.320] lstrlenW (lpString=".cer") returned 4
	[0059.320] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0059.320] lstrlenW (lpString=".cf") returned 3
	[0059.320] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0059.320] lstrlenW (lpString=".cfc") returned 4
	[0059.320] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0059.320] lstrlenW (lpString=".cfm") returned 4
	[0059.320] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0059.320] lstrlenW (lpString=".cfml") returned 5
	[0059.320] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0059.320] lstrlenW (lpString=".cfu") returned 4
	[0059.320] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0059.320] lstrlenW (lpString=".chm") returned 4
	[0059.320] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0059.320] lstrlenW (lpString=".cin") returned 4
	[0059.320] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0059.320] lstrlenW (lpString=".class") returned 6
	[0059.320] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0059.321] lstrlenW (lpString=".clx") returned 4
	[0059.321] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0059.321] lstrlenW (lpString=".config") returned 7
	[0059.321] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0059.321] lstrlenW (lpString=".cpp") returned 4
	[0059.321] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0059.321] lstrlenW (lpString=".cr2") returned 4
	[0059.321] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0059.321] lstrlenW (lpString=".crt") returned 4
	[0059.321] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0059.321] lstrlenW (lpString=".crw") returned 4
	[0059.321] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0059.321] lstrlenW (lpString=".cs") returned 3
	[0059.321] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0059.321] lstrlenW (lpString=".css") returned 4
	[0059.321] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0059.321] lstrlenW (lpString=".csv") returned 4
	[0059.321] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0059.321] lstrlenW (lpString=".cub") returned 4
	[0059.321] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0059.321] lstrlenW (lpString=".dae") returned 4
	[0059.321] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0059.321] lstrlenW (lpString=".dat") returned 4
	[0059.321] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0059.321] lstrlenW (lpString=".db") returned 3
	[0059.321] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0059.321] lstrlenW (lpString=".dbf") returned 4
	[0059.321] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.322] lstrlenW (lpString=".dbx") returned 4
	[0059.322] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0059.322] lstrlenW (lpString=".dc3") returned 4
	[0059.322] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0059.322] lstrlenW (lpString=".dcm") returned 4
	[0059.322] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0059.322] lstrlenW (lpString=".dcr") returned 4
	[0059.322] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0059.322] lstrlenW (lpString=".der") returned 4
	[0059.322] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0059.322] lstrlenW (lpString=".dib") returned 4
	[0059.322] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0059.322] lstrlenW (lpString=".dic") returned 4
	[0059.322] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0059.322] lstrlenW (lpString=".dif") returned 4
	[0059.322] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0059.322] lstrlenW (lpString=".divx") returned 5
	[0059.322] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0059.322] lstrlenW (lpString=".djvu") returned 5
	[0059.322] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0059.322] lstrlenW (lpString=".dng") returned 4
	[0059.322] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0059.322] lstrlenW (lpString=".doc") returned 4
	[0059.322] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.323] lstrlenW (lpString=".docm") returned 5
	[0059.323] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0059.323] lstrlenW (lpString=".docx") returned 5
	[0059.323] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.323] lstrlenW (lpString=".dot") returned 4
	[0059.323] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0059.323] lstrlenW (lpString=".dotm") returned 5
	[0059.323] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0059.323] lstrlenW (lpString=".dotx") returned 5
	[0059.323] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0059.323] lstrlenW (lpString=".dpx") returned 4
	[0059.323] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0059.323] lstrlenW (lpString=".dqy") returned 4
	[0059.324] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0059.324] lstrlenW (lpString=".dsn") returned 4
	[0059.324] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0059.324] lstrlenW (lpString=".dt") returned 3
	[0059.324] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0059.324] lstrlenW (lpString=".dtd") returned 4
	[0059.324] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0059.324] lstrlenW (lpString=".dwg") returned 4
	[0059.324] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0059.324] lstrlenW (lpString=".dwt") returned 4
	[0059.324] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0059.324] lstrlenW (lpString=".dx") returned 3
	[0059.324] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0059.324] lstrlenW (lpString=".dxf") returned 4
	[0059.324] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0059.324] lstrlenW (lpString=".edml") returned 5
	[0059.324] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0059.324] lstrlenW (lpString=".efd") returned 4
	[0059.324] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0059.324] lstrlenW (lpString=".elf") returned 4
	[0059.324] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0059.324] lstrlenW (lpString=".emf") returned 4
	[0059.324] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0059.324] lstrlenW (lpString=".emz") returned 4
	[0059.325] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0059.325] lstrlenW (lpString=".epf") returned 4
	[0059.325] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0059.325] lstrlenW (lpString=".eps") returned 4
	[0059.325] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0059.325] lstrlenW (lpString=".epsf") returned 5
	[0059.325] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0059.325] lstrlenW (lpString=".epsp") returned 5
	[0059.325] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0059.325] lstrlenW (lpString=".erf") returned 4
	[0059.325] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0059.325] lstrlenW (lpString=".exr") returned 4
	[0059.325] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0059.325] lstrlenW (lpString=".f4v") returned 4
	[0059.325] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0059.325] lstrlenW (lpString=".fido") returned 5
	[0059.325] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0059.325] lstrlenW (lpString=".flm") returned 4
	[0059.325] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0059.325] lstrlenW (lpString=".flv") returned 4
	[0059.325] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0059.325] lstrlenW (lpString=".frm") returned 4
	[0059.325] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0059.325] lstrlenW (lpString=".fxg") returned 4
	[0059.325] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0059.325] lstrlenW (lpString=".geo") returned 4
	[0059.325] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".gif") returned 4
	[0059.326] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".grs") returned 4
	[0059.326] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".gz") returned 3
	[0059.326] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0059.326] lstrlenW (lpString=".h") returned 2
	[0059.326] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0059.326] lstrlenW (lpString=".hdr") returned 4
	[0059.326] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".hpp") returned 4
	[0059.326] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".hta") returned 4
	[0059.326] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".htc") returned 4
	[0059.326] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".htm") returned 4
	[0059.326] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".html") returned 5
	[0059.326] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0059.326] lstrlenW (lpString=".icb") returned 4
	[0059.326] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".ics") returned 4
	[0059.326] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".iff") returned 4
	[0059.326] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".inc") returned 4
	[0059.326] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0059.326] lstrlenW (lpString=".indd") returned 5
	[0059.327] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0059.327] lstrlenW (lpString=".ini") returned 4
	[0059.327] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0059.327] lstrlenW (lpString=".iqy") returned 4
	[0059.327] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0059.327] lstrlenW (lpString=".j2c") returned 4
	[0059.327] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0059.327] lstrlenW (lpString=".j2k") returned 4
	[0059.327] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0059.327] lstrlenW (lpString=".java") returned 5
	[0059.327] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0059.327] lstrlenW (lpString=".jp2") returned 4
	[0059.327] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0059.327] lstrlenW (lpString=".jpc") returned 4
	[0059.327] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0059.327] lstrlenW (lpString=".jpe") returned 4
	[0059.327] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0059.327] lstrlenW (lpString=".jpeg") returned 5
	[0059.327] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0059.327] lstrlenW (lpString=".jpf") returned 4
	[0059.327] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0059.327] lstrlenW (lpString=".jpg") returned 4
	[0059.327] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.327] lstrlenW (lpString=".jpx") returned 4
	[0059.328] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0059.328] lstrlenW (lpString=".js") returned 3
	[0059.328] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0059.328] lstrlenW (lpString=".jsf") returned 4
	[0059.328] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0059.328] lstrlenW (lpString=".json") returned 5
	[0059.328] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0059.328] lstrlenW (lpString=".jsp") returned 4
	[0059.328] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0059.328] lstrlenW (lpString=".kdc") returned 4
	[0059.328] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0059.328] lstrlenW (lpString=".kmz") returned 4
	[0059.328] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0059.328] lstrlenW (lpString=".kwm") returned 4
	[0059.328] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0059.328] lstrlenW (lpString=".lasso") returned 6
	[0059.328] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0059.328] lstrlenW (lpString=".lbi") returned 4
	[0059.328] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0059.328] lstrlenW (lpString=".lgf") returned 4
	[0059.328] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0059.328] lstrlenW (lpString=".lgp") returned 4
	[0059.328] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0059.328] lstrlenW (lpString=".log") returned 4
	[0059.328] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".m1v") returned 4
	[0059.329] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".m4a") returned 4
	[0059.329] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".m4v") returned 4
	[0059.329] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".max") returned 4
	[0059.329] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".md") returned 3
	[0059.329] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0059.329] lstrlenW (lpString=".mda") returned 4
	[0059.329] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".mdb") returned 4
	[0059.329] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".mde") returned 4
	[0059.329] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".mdf") returned 4
	[0059.329] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".mdw") returned 4
	[0059.329] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".mef") returned 4
	[0059.329] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".mft") returned 4
	[0059.329] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".mfw") returned 4
	[0059.329] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0059.329] lstrlenW (lpString=".mht") returned 4
	[0059.330] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0059.330] lstrlenW (lpString=".mhtml") returned 6
	[0059.330] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0059.330] lstrlenW (lpString=".mka") returned 4
	[0059.330] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0059.330] lstrlenW (lpString=".mkidx") returned 6
	[0059.330] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0059.330] lstrlenW (lpString=".mkv") returned 4
	[0059.330] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0059.330] lstrlenW (lpString=".mos") returned 4
	[0059.330] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0059.330] lstrlenW (lpString=".mov") returned 4
	[0059.330] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0059.330] lstrlenW (lpString=".mp3") returned 4
	[0059.330] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0059.330] lstrlenW (lpString=".mp4") returned 4
	[0059.330] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0059.330] lstrlenW (lpString=".mpeg") returned 5
	[0059.330] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0059.330] lstrlenW (lpString=".mpg") returned 4
	[0059.330] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0059.330] lstrlenW (lpString=".mpv") returned 4
	[0059.330] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0059.330] lstrlenW (lpString=".mrw") returned 4
	[0059.330] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0059.330] lstrlenW (lpString=".msg") returned 4
	[0059.331] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".mxl") returned 4
	[0059.331] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".myd") returned 4
	[0059.331] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".myi") returned 4
	[0059.331] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".nef") returned 4
	[0059.331] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".nrw") returned 4
	[0059.331] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".obj") returned 4
	[0059.331] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".odb") returned 4
	[0059.331] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".odc") returned 4
	[0059.331] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".odm") returned 4
	[0059.331] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".odp") returned 4
	[0059.331] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".ods") returned 4
	[0059.331] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".oft") returned 4
	[0059.331] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0059.331] lstrlenW (lpString=".one") returned 4
	[0059.331] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".onepkg") returned 7
	[0059.332] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0059.332] lstrlenW (lpString=".onetoc2") returned 8
	[0059.332] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0059.332] lstrlenW (lpString=".opt") returned 4
	[0059.332] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".oqy") returned 4
	[0059.332] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".orf") returned 4
	[0059.332] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".p12") returned 4
	[0059.332] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".p7b") returned 4
	[0059.332] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".p7c") returned 4
	[0059.332] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".pam") returned 4
	[0059.332] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".pbm") returned 4
	[0059.332] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".pct") returned 4
	[0059.332] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".pcx") returned 4
	[0059.332] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".pdd") returned 4
	[0059.332] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0059.332] lstrlenW (lpString=".pdf") returned 4
	[0059.332] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.333] lstrlenW (lpString=".pdp") returned 4
	[0059.333] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0059.333] lstrlenW (lpString=".pef") returned 4
	[0059.333] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0059.333] lstrlenW (lpString=".pem") returned 4
	[0059.333] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0059.333] lstrlenW (lpString=".pff") returned 4
	[0059.333] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0059.333] lstrlenW (lpString=".pfm") returned 4
	[0059.333] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0059.333] lstrlenW (lpString=".pfx") returned 4
	[0059.333] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0059.333] lstrlenW (lpString=".pgm") returned 4
	[0059.333] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0059.333] lstrlenW (lpString=".php") returned 4
	[0059.333] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0059.333] lstrlenW (lpString=".php3") returned 5
	[0059.333] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0059.333] lstrlenW (lpString=".php4") returned 5
	[0059.333] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0059.333] lstrlenW (lpString=".php5") returned 5
	[0059.333] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0059.333] lstrlenW (lpString=".phtml") returned 6
	[0059.333] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0059.333] lstrlenW (lpString=".pict") returned 5
	[0059.333] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0059.334] lstrlenW (lpString=".pl") returned 3
	[0059.334] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0059.334] lstrlenW (lpString=".pls") returned 4
	[0059.334] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0059.334] lstrlenW (lpString=".pm") returned 3
	[0059.334] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0059.334] lstrlenW (lpString=".png") returned 4
	[0059.334] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0059.334] lstrlenW (lpString=".pnm") returned 4
	[0059.334] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0059.334] lstrlenW (lpString=".pot") returned 4
	[0059.334] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0059.334] lstrlenW (lpString=".potm") returned 5
	[0059.334] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0059.334] lstrlenW (lpString=".potx") returned 5
	[0059.334] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0059.334] lstrlenW (lpString=".ppa") returned 4
	[0059.334] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0059.334] lstrlenW (lpString=".ppam") returned 5
	[0059.334] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0059.334] lstrlenW (lpString=".ppm") returned 4
	[0059.334] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0059.334] lstrlenW (lpString=".pps") returned 4
	[0059.334] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0059.335] lstrlenW (lpString=".ppsm") returned 5
	[0059.335] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0059.335] lstrlenW (lpString=".ppt") returned 4
	[0059.335] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.335] lstrlenW (lpString=".pptm") returned 5
	[0059.335] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0059.335] lstrlenW (lpString=".pptx") returned 5
	[0059.335] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0059.335] lstrlenW (lpString=".prn") returned 4
	[0059.335] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0059.335] lstrlenW (lpString=".ps") returned 3
	[0059.335] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0059.335] lstrlenW (lpString=".psb") returned 4
	[0059.335] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0059.335] lstrlenW (lpString=".psd") returned 4
	[0059.335] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0059.335] lstrlenW (lpString=".pst") returned 4
	[0059.335] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0059.335] lstrlenW (lpString=".ptx") returned 4
	[0059.335] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0059.335] lstrlenW (lpString=".pub") returned 4
	[0059.335] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0059.335] lstrlenW (lpString=".pwm") returned 4
	[0059.335] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0059.335] lstrlenW (lpString=".pxr") returned 4
	[0059.335] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0059.335] lstrlenW (lpString=".py") returned 3
	[0059.335] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0059.336] lstrlenW (lpString=".qt") returned 3
	[0059.336] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0059.336] lstrlenW (lpString=".r3d") returned 4
	[0059.336] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0059.336] lstrlenW (lpString=".raf") returned 4
	[0059.336] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0059.336] lstrlenW (lpString=".rar") returned 4
	[0059.336] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.336] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.336] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.336] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.336] FindClose (in: hFindFile=0x6f44a8 | out: hFindFile=0x6f44a8) returned 1
	[0059.337] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.337] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1
	[0059.337] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040") returned 26
	[0059.337] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4628
	[0059.418] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.418] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.418] lstrlenW (lpString="eula.rtf") returned 8
	[0059.418] lstrlenW (lpString=".1cd") returned 4
	[0059.418] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.418] lstrlenW (lpString=".3ds") returned 4
	[0059.418] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0059.418] lstrlenW (lpString=".3fr") returned 4
	[0059.418] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0059.419] lstrlenW (lpString=".3g2") returned 4
	[0059.419] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0059.419] lstrlenW (lpString=".3gp") returned 4
	[0059.419] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0059.419] lstrlenW (lpString=".7z") returned 3
	[0059.419] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.419] lstrlenW (lpString=".accda") returned 6
	[0059.419] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0059.419] lstrlenW (lpString=".accdb") returned 6
	[0059.419] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0059.419] lstrlenW (lpString=".accdc") returned 6
	[0059.419] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0059.419] lstrlenW (lpString=".accde") returned 6
	[0059.419] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0059.419] lstrlenW (lpString=".accdt") returned 6
	[0059.419] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0059.419] lstrlenW (lpString=".accdw") returned 6
	[0059.419] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0059.419] lstrlenW (lpString=".adb") returned 4
	[0059.419] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0059.419] lstrlenW (lpString=".adp") returned 4
	[0059.419] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0059.419] lstrlenW (lpString=".ai") returned 3
	[0059.419] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0059.419] lstrlenW (lpString=".ai3") returned 4
	[0059.419] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0059.420] lstrlenW (lpString=".ai4") returned 4
	[0059.420] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0059.420] lstrlenW (lpString=".ai5") returned 4
	[0059.420] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0059.420] lstrlenW (lpString=".ai6") returned 4
	[0059.420] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0059.420] lstrlenW (lpString=".ai7") returned 4
	[0059.420] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0059.420] lstrlenW (lpString=".ai8") returned 4
	[0059.420] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0059.420] lstrlenW (lpString=".anim") returned 5
	[0059.420] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0059.420] lstrlenW (lpString=".arw") returned 4
	[0059.420] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0059.420] lstrlenW (lpString=".as") returned 3
	[0059.420] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0059.420] lstrlenW (lpString=".asa") returned 4
	[0059.420] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0059.420] lstrlenW (lpString=".asc") returned 4
	[0059.420] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0059.420] lstrlenW (lpString=".ascx") returned 5
	[0059.420] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0059.420] lstrlenW (lpString=".asm") returned 4
	[0059.420] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0059.420] lstrlenW (lpString=".asmx") returned 5
	[0059.420] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0059.421] lstrlenW (lpString=".asp") returned 4
	[0059.421] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0059.421] lstrlenW (lpString=".aspx") returned 5
	[0059.421] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0059.421] lstrlenW (lpString=".asr") returned 4
	[0059.421] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0059.421] lstrlenW (lpString=".asx") returned 4
	[0059.421] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0059.421] lstrlenW (lpString=".avi") returned 4
	[0059.421] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0059.421] lstrlenW (lpString=".avs") returned 4
	[0059.421] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0059.421] lstrlenW (lpString=".backup") returned 7
	[0059.421] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0059.421] lstrlenW (lpString=".bak") returned 4
	[0059.421] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0059.421] lstrlenW (lpString=".bay") returned 4
	[0059.421] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0059.421] lstrlenW (lpString=".bd") returned 3
	[0059.421] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0059.421] lstrlenW (lpString=".bin") returned 4
	[0059.421] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0059.421] lstrlenW (lpString=".bmp") returned 4
	[0059.422] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0059.422] lstrlenW (lpString=".bz2") returned 4
	[0059.422] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.422] lstrlenW (lpString=".c") returned 2
	[0059.422] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0059.422] lstrlenW (lpString=".cdr") returned 4
	[0059.422] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0059.422] lstrlenW (lpString=".cer") returned 4
	[0059.422] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0059.422] lstrlenW (lpString=".cf") returned 3
	[0059.422] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0059.422] lstrlenW (lpString=".cfc") returned 4
	[0059.422] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0059.422] lstrlenW (lpString=".cfm") returned 4
	[0059.422] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0059.422] lstrlenW (lpString=".cfml") returned 5
	[0059.422] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0059.422] lstrlenW (lpString=".cfu") returned 4
	[0059.422] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0059.422] lstrlenW (lpString=".chm") returned 4
	[0059.422] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0059.422] lstrlenW (lpString=".cin") returned 4
	[0059.422] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0059.422] lstrlenW (lpString=".class") returned 6
	[0059.422] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0059.422] lstrlenW (lpString=".clx") returned 4
	[0059.423] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0059.423] lstrlenW (lpString=".config") returned 7
	[0059.423] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0059.423] lstrlenW (lpString=".cpp") returned 4
	[0059.423] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0059.423] lstrlenW (lpString=".cr2") returned 4
	[0059.423] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0059.423] lstrlenW (lpString=".crt") returned 4
	[0059.423] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0059.423] lstrlenW (lpString=".crw") returned 4
	[0059.423] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0059.423] lstrlenW (lpString=".cs") returned 3
	[0059.423] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0059.423] lstrlenW (lpString=".css") returned 4
	[0059.423] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0059.423] lstrlenW (lpString=".csv") returned 4
	[0059.423] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0059.423] lstrlenW (lpString=".cub") returned 4
	[0059.423] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0059.423] lstrlenW (lpString=".dae") returned 4
	[0059.423] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0059.423] lstrlenW (lpString=".dat") returned 4
	[0059.423] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0059.423] lstrlenW (lpString=".db") returned 3
	[0059.423] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0059.423] lstrlenW (lpString=".dbf") returned 4
	[0059.424] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.424] lstrlenW (lpString=".dbx") returned 4
	[0059.424] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0059.424] lstrlenW (lpString=".dc3") returned 4
	[0059.424] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0059.424] lstrlenW (lpString=".dcm") returned 4
	[0059.424] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0059.424] lstrlenW (lpString=".dcr") returned 4
	[0059.424] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0059.424] lstrlenW (lpString=".der") returned 4
	[0059.424] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0059.424] lstrlenW (lpString=".dib") returned 4
	[0059.424] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0059.424] lstrlenW (lpString=".dic") returned 4
	[0059.424] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0059.424] lstrlenW (lpString=".dif") returned 4
	[0059.424] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0059.424] lstrlenW (lpString=".divx") returned 5
	[0059.424] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0059.424] lstrlenW (lpString=".djvu") returned 5
	[0059.424] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0059.424] lstrlenW (lpString=".dng") returned 4
	[0059.424] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0059.425] lstrlenW (lpString=".doc") returned 4
	[0059.425] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.425] lstrlenW (lpString=".docm") returned 5
	[0059.425] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0059.425] lstrlenW (lpString=".docx") returned 5
	[0059.425] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.425] lstrlenW (lpString=".dot") returned 4
	[0059.425] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0059.425] lstrlenW (lpString=".dotm") returned 5
	[0059.425] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0059.425] lstrlenW (lpString=".dotx") returned 5
	[0059.425] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0059.425] lstrlenW (lpString=".dpx") returned 4
	[0059.425] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0059.425] lstrlenW (lpString=".dqy") returned 4
	[0059.425] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0059.425] lstrlenW (lpString=".dsn") returned 4
	[0059.425] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0059.425] lstrlenW (lpString=".dt") returned 3
	[0059.425] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0059.425] lstrlenW (lpString=".dtd") returned 4
	[0059.425] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0059.425] lstrlenW (lpString=".dwg") returned 4
	[0059.425] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0059.425] lstrlenW (lpString=".dwt") returned 4
	[0059.426] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0059.426] lstrlenW (lpString=".dx") returned 3
	[0059.426] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0059.426] lstrlenW (lpString=".dxf") returned 4
	[0059.426] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0059.426] lstrlenW (lpString=".edml") returned 5
	[0059.426] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0059.426] lstrlenW (lpString=".efd") returned 4
	[0059.426] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0059.426] lstrlenW (lpString=".elf") returned 4
	[0059.426] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0059.426] lstrlenW (lpString=".emf") returned 4
	[0059.426] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0059.426] lstrlenW (lpString=".emz") returned 4
	[0059.426] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0059.426] lstrlenW (lpString=".epf") returned 4
	[0059.426] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0059.426] lstrlenW (lpString=".eps") returned 4
	[0059.426] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0059.426] lstrlenW (lpString=".epsf") returned 5
	[0059.426] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0059.426] lstrlenW (lpString=".epsp") returned 5
	[0059.426] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0059.426] lstrlenW (lpString=".erf") returned 4
	[0059.426] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0059.427] lstrlenW (lpString=".exr") returned 4
	[0059.427] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0059.427] lstrlenW (lpString=".f4v") returned 4
	[0059.427] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0059.427] lstrlenW (lpString=".fido") returned 5
	[0059.427] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0059.427] lstrlenW (lpString=".flm") returned 4
	[0059.427] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0059.427] lstrlenW (lpString=".flv") returned 4
	[0059.427] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0059.427] lstrlenW (lpString=".frm") returned 4
	[0059.427] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0059.427] lstrlenW (lpString=".fxg") returned 4
	[0059.427] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0059.427] lstrlenW (lpString=".geo") returned 4
	[0059.427] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0059.427] lstrlenW (lpString=".gif") returned 4
	[0059.427] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0059.427] lstrlenW (lpString=".grs") returned 4
	[0059.427] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0059.427] lstrlenW (lpString=".gz") returned 3
	[0059.427] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0059.427] lstrlenW (lpString=".h") returned 2
	[0059.427] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0059.427] lstrlenW (lpString=".hdr") returned 4
	[0059.428] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0059.428] lstrlenW (lpString=".hpp") returned 4
	[0059.428] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0059.428] lstrlenW (lpString=".hta") returned 4
	[0059.428] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0059.428] lstrlenW (lpString=".htc") returned 4
	[0059.428] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0059.428] lstrlenW (lpString=".htm") returned 4
	[0059.428] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0059.428] lstrlenW (lpString=".html") returned 5
	[0059.428] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0059.428] lstrlenW (lpString=".icb") returned 4
	[0059.428] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0059.428] lstrlenW (lpString=".ics") returned 4
	[0059.428] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0059.428] lstrlenW (lpString=".iff") returned 4
	[0059.428] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0059.428] lstrlenW (lpString=".inc") returned 4
	[0059.428] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0059.428] lstrlenW (lpString=".indd") returned 5
	[0059.428] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0059.428] lstrlenW (lpString=".ini") returned 4
	[0059.428] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0059.428] lstrlenW (lpString=".iqy") returned 4
	[0059.428] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0059.429] lstrlenW (lpString=".j2c") returned 4
	[0059.429] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0059.429] lstrlenW (lpString=".j2k") returned 4
	[0059.429] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0059.429] lstrlenW (lpString=".java") returned 5
	[0059.429] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0059.429] lstrlenW (lpString=".jp2") returned 4
	[0059.429] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0059.429] lstrlenW (lpString=".jpc") returned 4
	[0059.429] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0059.429] lstrlenW (lpString=".jpe") returned 4
	[0059.429] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0059.429] lstrlenW (lpString=".jpeg") returned 5
	[0059.429] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0059.429] lstrlenW (lpString=".jpf") returned 4
	[0059.429] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0059.429] lstrlenW (lpString=".jpg") returned 4
	[0059.429] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.429] lstrlenW (lpString=".jpx") returned 4
	[0059.429] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0059.429] lstrlenW (lpString=".js") returned 3
	[0059.429] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0059.429] lstrlenW (lpString=".jsf") returned 4
	[0059.429] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0059.430] lstrlenW (lpString=".json") returned 5
	[0059.430] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0059.430] lstrlenW (lpString=".jsp") returned 4
	[0059.430] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0059.430] lstrlenW (lpString=".kdc") returned 4
	[0059.430] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0059.430] lstrlenW (lpString=".kmz") returned 4
	[0059.430] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0059.430] lstrlenW (lpString=".kwm") returned 4
	[0059.430] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0059.430] lstrlenW (lpString=".lasso") returned 6
	[0059.430] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0059.430] lstrlenW (lpString=".lbi") returned 4
	[0059.430] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0059.430] lstrlenW (lpString=".lgf") returned 4
	[0059.430] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0059.430] lstrlenW (lpString=".lgp") returned 4
	[0059.430] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0059.430] lstrlenW (lpString=".log") returned 4
	[0059.430] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0059.430] lstrlenW (lpString=".m1v") returned 4
	[0059.430] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0059.430] lstrlenW (lpString=".m4a") returned 4
	[0059.430] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0059.430] lstrlenW (lpString=".m4v") returned 4
	[0059.430] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0059.431] lstrlenW (lpString=".max") returned 4
	[0059.431] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0059.431] lstrlenW (lpString=".md") returned 3
	[0059.431] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0059.431] lstrlenW (lpString=".mda") returned 4
	[0059.431] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0059.431] lstrlenW (lpString=".mdb") returned 4
	[0059.431] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0059.431] lstrlenW (lpString=".mde") returned 4
	[0059.431] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0059.431] lstrlenW (lpString=".mdf") returned 4
	[0059.431] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0059.431] lstrlenW (lpString=".mdw") returned 4
	[0059.431] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0059.431] lstrlenW (lpString=".mef") returned 4
	[0059.431] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0059.431] lstrlenW (lpString=".mft") returned 4
	[0059.431] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0059.431] lstrlenW (lpString=".mfw") returned 4
	[0059.431] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0059.431] lstrlenW (lpString=".mht") returned 4
	[0059.431] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0059.431] lstrlenW (lpString=".mhtml") returned 6
	[0059.431] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0059.431] lstrlenW (lpString=".mka") returned 4
	[0059.431] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0059.432] lstrlenW (lpString=".mkidx") returned 6
	[0059.432] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0059.432] lstrlenW (lpString=".mkv") returned 4
	[0059.432] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0059.432] lstrlenW (lpString=".mos") returned 4
	[0059.432] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0059.432] lstrlenW (lpString=".mov") returned 4
	[0059.432] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0059.432] lstrlenW (lpString=".mp3") returned 4
	[0059.432] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0059.432] lstrlenW (lpString=".mp4") returned 4
	[0059.432] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0059.432] lstrlenW (lpString=".mpeg") returned 5
	[0059.432] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0059.432] lstrlenW (lpString=".mpg") returned 4
	[0059.432] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0059.432] lstrlenW (lpString=".mpv") returned 4
	[0059.432] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0059.432] lstrlenW (lpString=".mrw") returned 4
	[0059.432] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0059.432] lstrlenW (lpString=".msg") returned 4
	[0059.433] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0059.433] lstrlenW (lpString=".mxl") returned 4
	[0059.433] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0059.433] lstrlenW (lpString=".myd") returned 4
	[0059.433] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0059.433] lstrlenW (lpString=".myi") returned 4
	[0059.433] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0059.434] lstrlenW (lpString=".nef") returned 4
	[0059.434] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0059.434] lstrlenW (lpString=".nrw") returned 4
	[0059.434] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0059.434] lstrlenW (lpString=".obj") returned 4
	[0059.434] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0059.434] lstrlenW (lpString=".odb") returned 4
	[0059.434] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0059.434] lstrlenW (lpString=".odc") returned 4
	[0059.434] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0059.434] lstrlenW (lpString=".odm") returned 4
	[0059.434] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0059.434] lstrlenW (lpString=".odp") returned 4
	[0059.434] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0059.434] lstrlenW (lpString=".ods") returned 4
	[0059.434] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0059.434] lstrlenW (lpString=".oft") returned 4
	[0059.434] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0059.434] lstrlenW (lpString=".one") returned 4
	[0059.434] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0059.434] lstrlenW (lpString=".onepkg") returned 7
	[0059.434] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0059.434] lstrlenW (lpString=".onetoc2") returned 8
	[0059.434] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0059.434] lstrlenW (lpString=".opt") returned 4
	[0059.434] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".oqy") returned 4
	[0059.435] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".orf") returned 4
	[0059.435] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".p12") returned 4
	[0059.435] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".p7b") returned 4
	[0059.435] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".p7c") returned 4
	[0059.435] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".pam") returned 4
	[0059.435] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".pbm") returned 4
	[0059.435] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".pct") returned 4
	[0059.435] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".pcx") returned 4
	[0059.435] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".pdd") returned 4
	[0059.435] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".pdf") returned 4
	[0059.435] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.435] lstrlenW (lpString=".pdp") returned 4
	[0059.436] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0059.436] lstrlenW (lpString=".pef") returned 4
	[0059.436] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0059.436] lstrlenW (lpString=".pem") returned 4
	[0059.436] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0059.436] lstrlenW (lpString=".pff") returned 4
	[0059.436] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0059.436] lstrlenW (lpString=".pfm") returned 4
	[0059.436] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0059.436] lstrlenW (lpString=".pfx") returned 4
	[0059.436] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0059.436] lstrlenW (lpString=".pgm") returned 4
	[0059.436] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0059.436] lstrlenW (lpString=".php") returned 4
	[0059.436] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0059.436] lstrlenW (lpString=".php3") returned 5
	[0059.436] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0059.436] lstrlenW (lpString=".php4") returned 5
	[0059.436] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0059.436] lstrlenW (lpString=".php5") returned 5
	[0059.436] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0059.436] lstrlenW (lpString=".phtml") returned 6
	[0059.436] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0059.436] lstrlenW (lpString=".pict") returned 5
	[0059.436] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0059.436] lstrlenW (lpString=".pl") returned 3
	[0059.437] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0059.437] lstrlenW (lpString=".pls") returned 4
	[0059.437] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0059.437] lstrlenW (lpString=".pm") returned 3
	[0059.437] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0059.437] lstrlenW (lpString=".png") returned 4
	[0059.437] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0059.437] lstrlenW (lpString=".pnm") returned 4
	[0059.437] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0059.437] lstrlenW (lpString=".pot") returned 4
	[0059.437] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0059.437] lstrlenW (lpString=".potm") returned 5
	[0059.437] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0059.437] lstrlenW (lpString=".potx") returned 5
	[0059.437] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0059.437] lstrlenW (lpString=".ppa") returned 4
	[0059.437] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0059.437] lstrlenW (lpString=".ppam") returned 5
	[0059.437] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0059.437] lstrlenW (lpString=".ppm") returned 4
	[0059.437] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0059.437] lstrlenW (lpString=".pps") returned 4
	[0059.437] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0059.437] lstrlenW (lpString=".ppsm") returned 5
	[0059.437] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0059.437] lstrlenW (lpString=".ppt") returned 4
	[0059.438] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.438] lstrlenW (lpString=".pptm") returned 5
	[0059.438] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0059.438] lstrlenW (lpString=".pptx") returned 5
	[0059.438] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0059.438] lstrlenW (lpString=".prn") returned 4
	[0059.438] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0059.438] lstrlenW (lpString=".ps") returned 3
	[0059.438] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0059.438] lstrlenW (lpString=".psb") returned 4
	[0059.438] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0059.438] lstrlenW (lpString=".psd") returned 4
	[0059.438] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0059.438] lstrlenW (lpString=".pst") returned 4
	[0059.438] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0059.438] lstrlenW (lpString=".ptx") returned 4
	[0059.438] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0059.438] lstrlenW (lpString=".pub") returned 4
	[0059.438] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0059.438] lstrlenW (lpString=".pwm") returned 4
	[0059.438] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0059.438] lstrlenW (lpString=".pxr") returned 4
	[0059.438] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0059.438] lstrlenW (lpString=".py") returned 3
	[0059.438] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0059.438] lstrlenW (lpString=".qt") returned 3
	[0059.439] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0059.439] lstrlenW (lpString=".r3d") returned 4
	[0059.439] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0059.439] lstrlenW (lpString=".raf") returned 4
	[0059.439] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0059.439] lstrlenW (lpString=".rar") returned 4
	[0059.439] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.439] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.439] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.439] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.439] FindClose (in: hFindFile=0x6f4628 | out: hFindFile=0x6f4628) returned 1
	[0059.439] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.439] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1
	[0059.440] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26
	[0059.440] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4428
	[0059.440] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.440] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.440] lstrlenW (lpString="eula.rtf") returned 8
	[0059.440] lstrlenW (lpString=".1cd") returned 4
	[0059.440] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.440] lstrlenW (lpString=".3ds") returned 4
	[0059.440] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0059.440] lstrlenW (lpString=".3fr") returned 4
	[0059.440] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0059.440] lstrlenW (lpString=".3g2") returned 4
	[0059.440] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0059.440] lstrlenW (lpString=".3gp") returned 4
	[0059.440] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0059.440] lstrlenW (lpString=".7z") returned 3
	[0059.440] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.441] lstrlenW (lpString=".accda") returned 6
	[0059.441] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0059.441] lstrlenW (lpString=".accdb") returned 6
	[0059.441] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0059.441] lstrlenW (lpString=".accdc") returned 6
	[0059.441] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0059.441] lstrlenW (lpString=".accde") returned 6
	[0059.441] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0059.441] lstrlenW (lpString=".accdt") returned 6
	[0059.441] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0059.441] lstrlenW (lpString=".accdw") returned 6
	[0059.441] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0059.441] lstrlenW (lpString=".adb") returned 4
	[0059.441] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0059.441] lstrlenW (lpString=".adp") returned 4
	[0059.441] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0059.441] lstrlenW (lpString=".ai") returned 3
	[0059.441] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0059.441] lstrlenW (lpString=".ai3") returned 4
	[0059.441] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0059.441] lstrlenW (lpString=".ai4") returned 4
	[0059.441] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0059.441] lstrlenW (lpString=".ai5") returned 4
	[0059.442] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0059.442] lstrlenW (lpString=".ai6") returned 4
	[0059.442] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0059.442] lstrlenW (lpString=".ai7") returned 4
	[0059.442] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0059.442] lstrlenW (lpString=".ai8") returned 4
	[0059.442] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0059.442] lstrlenW (lpString=".anim") returned 5
	[0059.442] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0059.442] lstrlenW (lpString=".arw") returned 4
	[0059.442] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0059.442] lstrlenW (lpString=".as") returned 3
	[0059.442] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0059.442] lstrlenW (lpString=".asa") returned 4
	[0059.442] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0059.442] lstrlenW (lpString=".asc") returned 4
	[0059.442] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0059.442] lstrlenW (lpString=".ascx") returned 5
	[0059.442] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0059.442] lstrlenW (lpString=".asm") returned 4
	[0059.442] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0059.442] lstrlenW (lpString=".asmx") returned 5
	[0059.442] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0059.442] lstrlenW (lpString=".asp") returned 4
	[0059.442] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0059.442] lstrlenW (lpString=".aspx") returned 5
	[0059.442] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0059.442] lstrlenW (lpString=".asr") returned 4
	[0059.442] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".asx") returned 4
	[0059.443] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".avi") returned 4
	[0059.443] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".avs") returned 4
	[0059.443] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".backup") returned 7
	[0059.443] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0059.443] lstrlenW (lpString=".bak") returned 4
	[0059.443] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".bay") returned 4
	[0059.443] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".bd") returned 3
	[0059.443] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0059.443] lstrlenW (lpString=".bin") returned 4
	[0059.443] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".bmp") returned 4
	[0059.443] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".bz2") returned 4
	[0059.443] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".c") returned 2
	[0059.443] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0059.443] lstrlenW (lpString=".cdr") returned 4
	[0059.443] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".cer") returned 4
	[0059.443] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".cf") returned 3
	[0059.443] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0059.443] lstrlenW (lpString=".cfc") returned 4
	[0059.443] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0059.443] lstrlenW (lpString=".cfm") returned 4
	[0059.444] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0059.444] lstrlenW (lpString=".cfml") returned 5
	[0059.444] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0059.444] lstrlenW (lpString=".cfu") returned 4
	[0059.444] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0059.444] lstrlenW (lpString=".chm") returned 4
	[0059.444] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0059.444] lstrlenW (lpString=".cin") returned 4
	[0059.444] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0059.444] lstrlenW (lpString=".class") returned 6
	[0059.444] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0059.444] lstrlenW (lpString=".clx") returned 4
	[0059.444] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0059.444] lstrlenW (lpString=".config") returned 7
	[0059.444] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0059.444] lstrlenW (lpString=".cpp") returned 4
	[0059.444] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0059.444] lstrlenW (lpString=".cr2") returned 4
	[0059.444] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0059.444] lstrlenW (lpString=".crt") returned 4
	[0059.444] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0059.444] lstrlenW (lpString=".crw") returned 4
	[0059.444] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0059.444] lstrlenW (lpString=".cs") returned 3
	[0059.444] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0059.445] lstrlenW (lpString=".css") returned 4
	[0059.445] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".csv") returned 4
	[0059.445] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".cub") returned 4
	[0059.445] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".dae") returned 4
	[0059.445] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".dat") returned 4
	[0059.445] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".db") returned 3
	[0059.445] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0059.445] lstrlenW (lpString=".dbf") returned 4
	[0059.445] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".dbx") returned 4
	[0059.445] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".dc3") returned 4
	[0059.445] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".dcm") returned 4
	[0059.445] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".dcr") returned 4
	[0059.445] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".der") returned 4
	[0059.445] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".dib") returned 4
	[0059.445] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0059.445] lstrlenW (lpString=".dic") returned 4
	[0059.445] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0059.446] lstrlenW (lpString=".dif") returned 4
	[0059.446] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0059.446] lstrlenW (lpString=".divx") returned 5
	[0059.446] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0059.446] lstrlenW (lpString=".djvu") returned 5
	[0059.446] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0059.446] lstrlenW (lpString=".dng") returned 4
	[0059.446] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0059.446] lstrlenW (lpString=".doc") returned 4
	[0059.446] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.446] lstrlenW (lpString=".docm") returned 5
	[0059.446] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0059.446] lstrlenW (lpString=".docx") returned 5
	[0059.446] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.446] lstrlenW (lpString=".dot") returned 4
	[0059.446] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0059.446] lstrlenW (lpString=".dotm") returned 5
	[0059.446] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0059.446] lstrlenW (lpString=".dotx") returned 5
	[0059.446] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0059.446] lstrlenW (lpString=".dpx") returned 4
	[0059.446] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0059.446] lstrlenW (lpString=".dqy") returned 4
	[0059.446] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0059.446] lstrlenW (lpString=".dsn") returned 4
	[0059.446] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0059.446] lstrlenW (lpString=".dt") returned 3
	[0059.447] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0059.447] lstrlenW (lpString=".dtd") returned 4
	[0059.447] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0059.447] lstrlenW (lpString=".dwg") returned 4
	[0059.447] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0059.447] lstrlenW (lpString=".dwt") returned 4
	[0059.447] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0059.447] lstrlenW (lpString=".dx") returned 3
	[0059.447] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0059.447] lstrlenW (lpString=".dxf") returned 4
	[0059.447] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0059.447] lstrlenW (lpString=".edml") returned 5
	[0059.447] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0059.447] lstrlenW (lpString=".efd") returned 4
	[0059.447] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0059.447] lstrlenW (lpString=".elf") returned 4
	[0059.447] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0059.447] lstrlenW (lpString=".emf") returned 4
	[0059.447] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0059.447] lstrlenW (lpString=".emz") returned 4
	[0059.447] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0059.447] lstrlenW (lpString=".epf") returned 4
	[0059.447] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0059.447] lstrlenW (lpString=".eps") returned 4
	[0059.447] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0059.448] lstrlenW (lpString=".epsf") returned 5
	[0059.448] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0059.448] lstrlenW (lpString=".epsp") returned 5
	[0059.448] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0059.448] lstrlenW (lpString=".erf") returned 4
	[0059.448] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0059.448] lstrlenW (lpString=".exr") returned 4
	[0059.448] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0059.448] lstrlenW (lpString=".f4v") returned 4
	[0059.448] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0059.448] lstrlenW (lpString=".fido") returned 5
	[0059.448] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0059.448] lstrlenW (lpString=".flm") returned 4
	[0059.448] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0059.448] lstrlenW (lpString=".flv") returned 4
	[0059.448] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0059.448] lstrlenW (lpString=".frm") returned 4
	[0059.448] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0059.448] lstrlenW (lpString=".fxg") returned 4
	[0059.448] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0059.448] lstrlenW (lpString=".geo") returned 4
	[0059.448] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0059.448] lstrlenW (lpString=".gif") returned 4
	[0059.448] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0059.449] lstrlenW (lpString=".grs") returned 4
	[0059.449] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0059.449] lstrlenW (lpString=".gz") returned 3
	[0059.449] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0059.449] lstrlenW (lpString=".h") returned 2
	[0059.449] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0059.449] lstrlenW (lpString=".hdr") returned 4
	[0059.449] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0059.449] lstrlenW (lpString=".hpp") returned 4
	[0059.449] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0059.449] lstrlenW (lpString=".hta") returned 4
	[0059.449] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0059.449] lstrlenW (lpString=".htc") returned 4
	[0059.449] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0059.449] lstrlenW (lpString=".htm") returned 4
	[0059.449] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0059.449] lstrlenW (lpString=".html") returned 5
	[0059.449] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0059.449] lstrlenW (lpString=".icb") returned 4
	[0059.449] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0059.449] lstrlenW (lpString=".ics") returned 4
	[0059.449] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0059.449] lstrlenW (lpString=".iff") returned 4
	[0059.449] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0059.449] lstrlenW (lpString=".inc") returned 4
	[0059.449] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0059.449] lstrlenW (lpString=".indd") returned 5
	[0059.449] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0059.450] lstrlenW (lpString=".ini") returned 4
	[0059.450] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0059.450] lstrlenW (lpString=".iqy") returned 4
	[0059.450] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0059.450] lstrlenW (lpString=".j2c") returned 4
	[0059.450] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0059.450] lstrlenW (lpString=".j2k") returned 4
	[0059.450] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0059.450] lstrlenW (lpString=".java") returned 5
	[0059.450] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0059.450] lstrlenW (lpString=".jp2") returned 4
	[0059.450] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0059.450] lstrlenW (lpString=".jpc") returned 4
	[0059.450] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0059.450] lstrlenW (lpString=".jpe") returned 4
	[0059.450] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0059.450] lstrlenW (lpString=".jpeg") returned 5
	[0059.450] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0059.450] lstrlenW (lpString=".jpf") returned 4
	[0059.450] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0059.450] lstrlenW (lpString=".jpg") returned 4
	[0059.450] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.450] lstrlenW (lpString=".jpx") returned 4
	[0059.450] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0059.450] lstrlenW (lpString=".js") returned 3
	[0059.450] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0059.451] lstrlenW (lpString=".jsf") returned 4
	[0059.451] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0059.451] lstrlenW (lpString=".json") returned 5
	[0059.451] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0059.451] lstrlenW (lpString=".jsp") returned 4
	[0059.451] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0059.451] lstrlenW (lpString=".kdc") returned 4
	[0059.451] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0059.451] lstrlenW (lpString=".kmz") returned 4
	[0059.451] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0059.451] lstrlenW (lpString=".kwm") returned 4
	[0059.451] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0059.451] lstrlenW (lpString=".lasso") returned 6
	[0059.451] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0059.451] lstrlenW (lpString=".lbi") returned 4
	[0059.451] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0059.451] lstrlenW (lpString=".lgf") returned 4
	[0059.451] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0059.451] lstrlenW (lpString=".lgp") returned 4
	[0059.451] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0059.451] lstrlenW (lpString=".log") returned 4
	[0059.451] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0059.451] lstrlenW (lpString=".m1v") returned 4
	[0059.451] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0059.451] lstrlenW (lpString=".m4a") returned 4
	[0059.451] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".m4v") returned 4
	[0059.452] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".max") returned 4
	[0059.452] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".md") returned 3
	[0059.452] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0059.452] lstrlenW (lpString=".mda") returned 4
	[0059.452] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".mdb") returned 4
	[0059.452] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".mde") returned 4
	[0059.452] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".mdf") returned 4
	[0059.452] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".mdw") returned 4
	[0059.452] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".mef") returned 4
	[0059.452] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".mft") returned 4
	[0059.452] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".mfw") returned 4
	[0059.452] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".mht") returned 4
	[0059.452] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0059.452] lstrlenW (lpString=".mhtml") returned 6
	[0059.452] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0059.452] lstrlenW (lpString=".mka") returned 4
	[0059.453] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0059.453] lstrlenW (lpString=".mkidx") returned 6
	[0059.453] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0059.453] lstrlenW (lpString=".mkv") returned 4
	[0059.453] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0059.453] lstrlenW (lpString=".mos") returned 4
	[0059.453] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0059.453] lstrlenW (lpString=".mov") returned 4
	[0059.453] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0059.453] lstrlenW (lpString=".mp3") returned 4
	[0059.453] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0059.453] lstrlenW (lpString=".mp4") returned 4
	[0059.453] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0059.453] lstrlenW (lpString=".mpeg") returned 5
	[0059.453] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0059.453] lstrlenW (lpString=".mpg") returned 4
	[0059.453] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0059.453] lstrlenW (lpString=".mpv") returned 4
	[0059.453] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0059.453] lstrlenW (lpString=".mrw") returned 4
	[0059.453] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0059.453] lstrlenW (lpString=".msg") returned 4
	[0059.453] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0059.453] lstrlenW (lpString=".mxl") returned 4
	[0059.453] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0059.453] lstrlenW (lpString=".myd") returned 4
	[0059.454] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".myi") returned 4
	[0059.454] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".nef") returned 4
	[0059.454] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".nrw") returned 4
	[0059.454] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".obj") returned 4
	[0059.454] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".odb") returned 4
	[0059.454] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".odc") returned 4
	[0059.454] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".odm") returned 4
	[0059.454] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".odp") returned 4
	[0059.454] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".ods") returned 4
	[0059.454] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".oft") returned 4
	[0059.454] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".one") returned 4
	[0059.454] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0059.454] lstrlenW (lpString=".onepkg") returned 7
	[0059.454] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0059.455] lstrlenW (lpString=".onetoc2") returned 8
	[0059.455] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0059.455] lstrlenW (lpString=".opt") returned 4
	[0059.455] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0059.455] lstrlenW (lpString=".oqy") returned 4
	[0059.455] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0059.455] lstrlenW (lpString=".orf") returned 4
	[0059.455] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0059.455] lstrlenW (lpString=".p12") returned 4
	[0059.455] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0059.455] lstrlenW (lpString=".p7b") returned 4
	[0059.455] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0059.455] lstrlenW (lpString=".p7c") returned 4
	[0059.455] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0059.455] lstrlenW (lpString=".pam") returned 4
	[0059.455] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0059.455] lstrlenW (lpString=".pbm") returned 4
	[0059.455] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0059.455] lstrlenW (lpString=".pct") returned 4
	[0059.455] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0059.455] lstrlenW (lpString=".pcx") returned 4
	[0059.455] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0059.455] lstrlenW (lpString=".pdd") returned 4
	[0059.455] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0059.455] lstrlenW (lpString=".pdf") returned 4
	[0059.455] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.456] lstrlenW (lpString=".pdp") returned 4
	[0059.456] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0059.456] lstrlenW (lpString=".pef") returned 4
	[0059.456] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0059.456] lstrlenW (lpString=".pem") returned 4
	[0059.456] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0059.456] lstrlenW (lpString=".pff") returned 4
	[0059.456] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0059.456] lstrlenW (lpString=".pfm") returned 4
	[0059.456] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0059.456] lstrlenW (lpString=".pfx") returned 4
	[0059.456] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0059.456] lstrlenW (lpString=".pgm") returned 4
	[0059.456] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0059.456] lstrlenW (lpString=".php") returned 4
	[0059.456] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0059.456] lstrlenW (lpString=".php3") returned 5
	[0059.456] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0059.456] lstrlenW (lpString=".php4") returned 5
	[0059.456] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0059.456] lstrlenW (lpString=".php5") returned 5
	[0059.456] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0059.456] lstrlenW (lpString=".phtml") returned 6
	[0059.456] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0059.456] lstrlenW (lpString=".pict") returned 5
	[0059.456] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0059.457] lstrlenW (lpString=".pl") returned 3
	[0059.457] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0059.457] lstrlenW (lpString=".pls") returned 4
	[0059.457] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0059.457] lstrlenW (lpString=".pm") returned 3
	[0059.457] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0059.457] lstrlenW (lpString=".png") returned 4
	[0059.457] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0059.457] lstrlenW (lpString=".pnm") returned 4
	[0059.457] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0059.457] lstrlenW (lpString=".pot") returned 4
	[0059.457] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0059.457] lstrlenW (lpString=".potm") returned 5
	[0059.457] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0059.457] lstrlenW (lpString=".potx") returned 5
	[0059.457] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0059.457] lstrlenW (lpString=".ppa") returned 4
	[0059.457] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0059.457] lstrlenW (lpString=".ppam") returned 5
	[0059.457] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0059.457] lstrlenW (lpString=".ppm") returned 4
	[0059.457] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0059.457] lstrlenW (lpString=".pps") returned 4
	[0059.457] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0059.457] lstrlenW (lpString=".ppsm") returned 5
	[0059.458] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0059.458] lstrlenW (lpString=".ppt") returned 4
	[0059.458] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.458] lstrlenW (lpString=".pptm") returned 5
	[0059.458] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0059.458] lstrlenW (lpString=".pptx") returned 5
	[0059.458] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0059.458] lstrlenW (lpString=".prn") returned 4
	[0059.458] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0059.458] lstrlenW (lpString=".ps") returned 3
	[0059.458] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0059.458] lstrlenW (lpString=".psb") returned 4
	[0059.458] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0059.458] lstrlenW (lpString=".psd") returned 4
	[0059.458] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0059.458] lstrlenW (lpString=".pst") returned 4
	[0059.458] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0059.458] lstrlenW (lpString=".ptx") returned 4
	[0059.458] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0059.458] lstrlenW (lpString=".pub") returned 4
	[0059.458] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0059.458] lstrlenW (lpString=".pwm") returned 4
	[0059.458] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0059.458] lstrlenW (lpString=".pxr") returned 4
	[0059.458] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0059.458] lstrlenW (lpString=".py") returned 3
	[0059.459] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0059.459] lstrlenW (lpString=".qt") returned 3
	[0059.459] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0059.459] lstrlenW (lpString=".r3d") returned 4
	[0059.459] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0059.459] lstrlenW (lpString=".raf") returned 4
	[0059.459] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0059.459] lstrlenW (lpString=".rar") returned 4
	[0059.459] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.459] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.459] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.459] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.460] FindClose (in: hFindFile=0x6f4428 | out: hFindFile=0x6f4428) returned 1
	[0059.460] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.460] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1
	[0059.460] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.460] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4328
	[0059.460] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.460] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.460] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.461] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.461] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.461] FindClose (in: hFindFile=0x6f4328 | out: hFindFile=0x6f4328) returned 1
	[0059.461] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.461] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1
	[0059.461] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.461] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f3f68
	[0059.461] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.461] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.462] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.462] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.462] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.462] FindClose (in: hFindFile=0x6f3f68 | out: hFindFile=0x6f3f68) returned 1
	[0059.462] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.462] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1
	[0059.462] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.462] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f41a8
	[0059.664] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.664] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.664] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.664] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.664] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.664] FindClose (in: hFindFile=0x6f41a8 | out: hFindFile=0x6f41a8) returned 1
	[0059.665] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.665] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1
	[0059.665] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.665] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4568
	[0059.665] FindNextFileW (in: hFindFile=0x6f4568, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.666] FindNextFileW (in: hFindFile=0x6f4568, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.667] FindNextFileW (in: hFindFile=0x6f4568, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.667] FindNextFileW (in: hFindFile=0x6f4568, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.667] FindNextFileW (in: hFindFile=0x6f4568, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.667] FindClose (in: hFindFile=0x6f4568 | out: hFindFile=0x6f4568) returned 1
	[0059.667] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.667] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1
	[0059.668] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.668] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4268
	[0059.669] FindNextFileW (in: hFindFile=0x6f4268, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.669] FindNextFileW (in: hFindFile=0x6f4268, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.669] FindNextFileW (in: hFindFile=0x6f4268, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.669] FindNextFileW (in: hFindFile=0x6f4268, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.669] FindNextFileW (in: hFindFile=0x6f4268, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.669] FindClose (in: hFindFile=0x6f4268 | out: hFindFile=0x6f4268) returned 1
	[0059.669] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.669] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1
	[0059.670] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.670] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4328
	[0059.670] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.670] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.670] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.670] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.670] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.671] FindClose (in: hFindFile=0x6f4328 | out: hFindFile=0x6f4328) returned 1
	[0059.671] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.671] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1
	[0059.671] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.671] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4668
	[0059.672] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.672] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.672] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.672] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.672] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.672] FindClose (in: hFindFile=0x6f4668 | out: hFindFile=0x6f4668) returned 1
	[0059.672] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.672] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1
	[0059.673] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.673] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f40a8
	[0059.673] FindNextFileW (in: hFindFile=0x6f40a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.673] FindNextFileW (in: hFindFile=0x6f40a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.673] FindNextFileW (in: hFindFile=0x6f40a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.673] FindNextFileW (in: hFindFile=0x6f40a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.673] FindNextFileW (in: hFindFile=0x6f40a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.673] FindClose (in: hFindFile=0x6f40a8 | out: hFindFile=0x6f40a8) returned 1
	[0059.674] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.674] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1
	[0059.674] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.674] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f42a8
	[0059.674] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.674] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.674] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.675] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.675] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.675] FindClose (in: hFindFile=0x6f42a8 | out: hFindFile=0x6f42a8) returned 1
	[0059.675] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.675] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1
	[0059.675] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.675] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f40a8
	[0059.675] FindNextFileW (in: hFindFile=0x6f40a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.676] FindNextFileW (in: hFindFile=0x6f40a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.676] FindNextFileW (in: hFindFile=0x6f40a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.676] FindNextFileW (in: hFindFile=0x6f40a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.676] FindNextFileW (in: hFindFile=0x6f40a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.676] FindClose (in: hFindFile=0x6f40a8 | out: hFindFile=0x6f40a8) returned 1
	[0059.676] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.676] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1
	[0059.676] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.676] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f44e8
	[0059.677] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.677] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.677] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.677] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.677] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.677] FindClose (in: hFindFile=0x6f44e8 | out: hFindFile=0x6f44e8) returned 1
	[0059.677] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.677] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1
	[0059.678] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.678] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f46a8
	[0059.678] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.678] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.679] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.679] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.679] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.679] FindClose (in: hFindFile=0x6f46a8 | out: hFindFile=0x6f46a8) returned 1
	[0059.679] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.679] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1
	[0059.679] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.679] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4128
	[0059.680] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.680] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0059.680] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0059.681] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0059.681] FindClose (in: hFindFile=0x6f4128 | out: hFindFile=0x6f4128) returned 1
	[0059.681] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.681] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0059.681] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1
	[0059.681] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1
	[0059.681] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.681] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4368
	[0059.682] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.682] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0059.682] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0059.682] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0059.683] FindClose (in: hFindFile=0x6f4368 | out: hFindFile=0x6f4368) returned 1
	[0059.683] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.683] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0059.683] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.683] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f40e8
	[0059.685] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.685] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1
	[0059.685] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1
	[0059.686] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1
	[0059.686] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1
	[0059.686] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1
	[0059.686] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1
	[0059.686] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1
	[0059.686] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1
	[0059.687] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1
	[0059.687] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1
	[0059.687] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1
	[0059.687] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1
	[0059.687] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1
	[0059.687] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1
	[0059.688] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1
	[0059.688] FindNextFileW (in: hFindFile=0x6f40e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0
	[0059.688] FindClose (in: hFindFile=0x6f40e8 | out: hFindFile=0x6f40e8) returned 1
	[0059.689] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.689] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1
	[0059.689] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1
	[0059.689] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1
	[0059.689] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1
	[0059.689] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1
	[0059.690] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1
	[0059.690] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1
	[0059.690] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0059.691] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1
	[0059.691] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1
	[0059.691] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1
	[0059.691] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1
	[0059.691] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1
	[0059.691] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1
	[0059.692] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1
	[0059.692] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1
	[0059.692] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0059.692] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1
	[0059.692] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0059.693] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1
	[0059.693] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0059.693] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1
	[0059.693] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1
	[0059.693] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1
	[0059.694] FindNextFileW (in: hFindFile=0x6f42e8, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0
	[0059.694] FindClose (in: hFindFile=0x6f42e8 | out: hFindFile=0x6f42e8) returned 1
	[0059.694] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3570728 | out: hHeap=0x600000) returned 1
	[0059.694] FindNextFileW (in: hFindFile=0x62c9f8, lpFindFileData=0x2defcf8 | out: lpFindFileData=0x2defcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0059.694] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3570728
	[0059.694] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6f3f68
	[0059.695] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0059.695] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1
	[0059.695] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0059.696] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0059.696] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0059.696] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0059.696] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.696] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f43e8
	[0059.696] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.696] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0059.697] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0059.697] FindClose (in: hFindFile=0x6f43e8 | out: hFindFile=0x6f43e8) returned 1
	[0059.697] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0059.697] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0059.697] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0059.697] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0059.697] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0059.697] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0059.698] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f3fa8
	[0060.263] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.264] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.264] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0060.264] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0060.264] FindClose (in: hFindFile=0x6f3fa8 | out: hFindFile=0x6f3fa8) returned 1
	[0060.264] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.264] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0060.264] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.264] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f3fa8
	[0060.265] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.265] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.265] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0060.265] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0060.265] FindClose (in: hFindFile=0x6f3fa8 | out: hFindFile=0x6f3fa8) returned 1
	[0060.265] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.265] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0060.266] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.266] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4128
	[0060.266] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.266] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.266] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0060.266] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0060.266] FindClose (in: hFindFile=0x6f4128 | out: hFindFile=0x6f4128) returned 1
	[0060.266] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.266] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0060.266] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.266] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4628
	[0060.267] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.267] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.267] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0060.267] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0060.268] FindClose (in: hFindFile=0x6f4628 | out: hFindFile=0x6f4628) returned 1
	[0060.268] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.268] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0060.268] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.268] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4628
	[0060.269] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.269] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.269] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0060.269] FindClose (in: hFindFile=0x6f4628 | out: hFindFile=0x6f4628) returned 1
	[0060.269] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.269] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0060.269] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.269] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f42a8
	[0060.269] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.269] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.269] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0060.269] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0060.270] FindClose (in: hFindFile=0x6f42a8 | out: hFindFile=0x6f42a8) returned 1
	[0060.270] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.270] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0060.270] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.270] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4368
	[0060.271] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.271] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.271] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0060.271] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0060.271] FindClose (in: hFindFile=0x6f4368 | out: hFindFile=0x6f4368) returned 1
	[0060.271] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.271] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0060.271] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.271] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4628
	[0060.272] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.272] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.272] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0060.272] FindClose (in: hFindFile=0x6f4628 | out: hFindFile=0x6f4628) returned 1
	[0060.272] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.272] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0060.272] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.272] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f42a8
	[0060.272] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.272] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.273] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0060.273] FindClose (in: hFindFile=0x6f42a8 | out: hFindFile=0x6f42a8) returned 1
	[0060.273] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.273] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0060.273] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.273] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f44e8
	[0060.273] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.274] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.274] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0060.274] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0060.274] FindClose (in: hFindFile=0x6f44e8 | out: hFindFile=0x6f44e8) returned 1
	[0060.274] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.274] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0060.274] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.274] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4128
	[0060.277] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.277] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0060.277] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0060.277] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0060.277] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0060.278] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1
	[0060.278] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1
	[0060.278] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1
	[0060.278] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1
	[0060.278] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1
	[0060.278] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1
	[0060.278] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1
	[0060.279] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1
	[0060.279] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1
	[0060.279] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1
	[0060.279] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1
	[0060.279] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0060.279] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0060.279] FindClose (in: hFindFile=0x6f4128 | out: hFindFile=0x6f4128) returned 1
	[0060.280] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.280] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0060.280] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.280] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4128
	[0060.281] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.281] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.281] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0060.281] FindClose (in: hFindFile=0x6f4128 | out: hFindFile=0x6f4128) returned 1
	[0060.281] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.281] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0060.282] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.282] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f41e8
	[0060.282] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.282] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.282] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0060.282] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0060.282] FindClose (in: hFindFile=0x6f41e8 | out: hFindFile=0x6f41e8) returned 1
	[0060.282] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.282] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0060.282] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.283] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4328
	[0060.283] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.283] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.283] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0060.283] FindClose (in: hFindFile=0x6f4328 | out: hFindFile=0x6f4328) returned 1
	[0060.283] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.284] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0060.284] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.284] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4128
	[0060.284] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.284] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.284] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0060.284] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0060.284] FindClose (in: hFindFile=0x6f4128 | out: hFindFile=0x6f4128) returned 1
	[0060.284] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.284] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x2defa7c | out: lpFindFileData=0x2defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0060.285] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.285] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4468
	[0060.285] FindNextFileW (in: hFindFile=0x6f4468, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.285] FindNextFileW (in: hFindFile=0x6f4468, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.285] FindNextFileW (in: hFindFile=0x6f4468, lpFindFileData=0x2def800 | out: lpFindFileData=0x2def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0060.287] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.287] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x3590738
	[0060.292] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.293] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.293] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.294] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.295] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.295] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.295] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.296] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.297] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.297] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.298] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0060.298] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.299] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.670] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.670] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.671] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.671] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.671] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.672] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.672] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.673] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.673] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.674] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.674] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0060.674] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3570728 | out: hHeap=0x600000) returned 1
	[0060.676] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3570728 | out: hHeap=0x600000) returned 1
	[0060.793] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3570728 | out: hHeap=0x600000) returned 1
	[0060.841] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3570728 | out: hHeap=0x600000) returned 1
	[0060.842] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3570728 | out: hHeap=0x600000) returned 1
	[0060.843] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0060.846] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0060.848] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.848] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.848] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.848] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.849] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.849] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.849] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.851] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.852] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.853] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.853] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.853] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.854] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.854] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0060.856] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0060.856] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0060.857] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0060.860] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0060.860] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0061.457] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0061.457] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0061.458] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0061.458] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0061.458] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0061.459] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.459] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.459] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.459] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.459] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.461] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.461] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.461] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.462] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.462] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.462] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.462] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.463] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.463] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.463] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.463] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.464] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.465] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.465] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.465] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.466] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.466] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.466] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.466] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.467] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.467] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.467] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.467] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.470] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.470] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.473] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.473] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.473] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.474] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.476] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.477] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.477] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.478] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.478] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.478] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.478] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.482] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0061.482] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.482] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.484] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.485] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.488] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.488] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.489] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.490] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.491] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.492] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.493] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.493] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.494] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0061.495] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.930] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.931] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.931] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0061.934] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.940] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.941] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.942] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.948] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.950] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.952] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.953] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.958] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.961] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.965] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0061.965] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.969] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0062.740] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c65a8 | out: hHeap=0x600000) returned 1
	[0062.755] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0062.757] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0062.759] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0062.772] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x3590738 | out: hHeap=0x600000) returned 1
	[0062.775] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0062.799] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0062.817] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0064.093] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0064.096] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43045a8 | out: hHeap=0x600000) returned 1
	[0064.096] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0064.096] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0064.109] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0064.112] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0064.172] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0064.172] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43045a8 | out: hHeap=0x600000) returned 1
	[0064.175] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43045a8 | out: hHeap=0x600000) returned 1
	[0064.178] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43045a8 | out: hHeap=0x600000) returned 1
	[0064.674] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43045a8 | out: hHeap=0x600000) returned 1
	[0065.865] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d60 | out: hHeap=0x600000) returned 1
	[0065.866] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43445b0 | out: hHeap=0x600000) returned 1
	[0065.871] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0065.871] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0065.872] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0065.875] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0065.876] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43445b0 | out: hHeap=0x600000) returned 1
	[0066.104] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0066.108] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0066.140] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0066.153] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0066.156] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0066.181] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0066.182] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0066.182] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0066.182] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0066.728] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0066.731] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0066.732] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0066.734] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0066.735] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0066.737] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0066.738] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0066.740] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0066.742] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0066.743] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0066.745] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0066.746] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0066.747] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.122] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.130] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.131] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.133] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.133] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.137] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.143] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.145] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.148] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.149] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.151] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.153] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.155] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.157] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.158] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.160] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.177] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.184] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.185] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.187] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.687] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.688] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.689] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.690] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.696] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.697] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.699] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.701] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.709] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.711] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.713] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0067.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43545b8 | out: hHeap=0x600000) returned 1
	[0067.718] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43545b8 | out: hHeap=0x600000) returned 1
	[0067.720] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0067.721] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0067.724] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0067.726] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0067.751] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0067.753] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0067.754] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.193] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.196] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.197] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.199] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.200] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.203] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.204] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.206] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.209] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.212] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.214] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.217] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.218] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.220] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.222] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.224] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.226] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.228] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.230] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.620] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.634] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.636] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.639] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.640] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.642] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.643] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.645] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.647] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.649] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.651] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.653] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.654] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.657] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.658] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.660] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.662] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.664] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.664] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43545b8 | out: hHeap=0x600000) returned 1
	[0068.873] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.875] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.877] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.880] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.882] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.885] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.887] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.889] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.890] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.892] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.894] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.896] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.898] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.901] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.902] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.905] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.907] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.909] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.911] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.913] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0068.915] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.271] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.273] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.275] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.277] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.279] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.282] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.284] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.286] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.288] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.331] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.333] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.335] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.335] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.335] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.336] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.336] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.336] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.336] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.336] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.338] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.338] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.339] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.339] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.339] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.340] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.341] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.341] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.342] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.712] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.712] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.713] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.713] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.713] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.713] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.713] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.713] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.713] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.713] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.714] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.715] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.715] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.715] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.715] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.715] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.715] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.715] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.715] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.716] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0069.716] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.719] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.721] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.723] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.725] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.727] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.997] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0069.999] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0070.001] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0070.003] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0070.006] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0070.009] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0070.012] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0070.015] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0070.018] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43645c0 | out: hHeap=0x600000) returned 1
	[0070.018] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43545b8 | out: hHeap=0x600000) returned 1
	[0070.018] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0070.025] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43545b8 | out: hHeap=0x600000) returned 1
	[0070.029] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43545b8 | out: hHeap=0x600000) returned 1
	[0070.029] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0071.453] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0071.455] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0071.457] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.457] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0071.458] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c45a0 | out: hHeap=0x600000) returned 1
	[0071.458] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.459] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0071.464] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.464] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0071.464] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42d45a8 | out: hHeap=0x600000) returned 1
	[0071.464] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42d45a8 | out: hHeap=0x600000) returned 1
	[0071.464] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42d45a8 | out: hHeap=0x600000) returned 1
	[0071.464] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c45a0 | out: hHeap=0x600000) returned 1
	[0071.466] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42d45a8 | out: hHeap=0x600000) returned 1
	[0071.466] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c45a0 | out: hHeap=0x600000) returned 1
	[0071.466] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.470] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c45a0 | out: hHeap=0x600000) returned 1
	[0071.472] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c45a0 | out: hHeap=0x600000) returned 1
	[0071.595] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c45a0 | out: hHeap=0x600000) returned 1
	[0071.595] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.598] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.601] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42d45a8 | out: hHeap=0x600000) returned 1
	[0071.602] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42d45a8 | out: hHeap=0x600000) returned 1
	[0071.602] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c45a0 | out: hHeap=0x600000) returned 1
	[0071.602] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.608] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.608] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0071.610] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.611] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.611] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1

Thread:
	id = 13
	os_tid = 0x260

	[0055.913] GetTickCount () returned 0x114e6b8
	[0055.914] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x24) returned 0x6c2778
	[0055.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c2778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4
	[0055.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c2778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8
	[0055.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c2778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac
	[0055.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c2778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0
	[0055.916] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f218
	[0055.916] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f218, Size=0x20) returned 0x631128
	[0055.916] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f218
	[0055.916] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f218, Size=0x20) returned 0x6311f0
	[0055.917] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0055.918] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0055.918] Wow64DisableWow64FsRedirection (in: OldValue=0x332ff7c | out: OldValue=0x332ff7c*=0x0) returned 1
	[0055.918] lstrlenW (lpString="kernel32.dll") returned 12
	[0055.918] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631128 | out: hHeap=0x600000) returned 1
	[0055.918] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0055.918] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6311f0 | out: hHeap=0x600000) returned 1
	[0055.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x67de48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4
	[0055.919] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0057.217] GetTickCount () returned 0x114ebc8
	[0057.241] GetTickCount () returned 0x114ebe8
	[0057.242] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0057.494] GetTickCount () returned 0x114ece2
	[0057.494] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0057.868] GetTickCount () returned 0x114ee59
	[0057.868] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0058.489] GetTickCount () returned 0x114f0ca
	[0058.489] GetTickCount () returned 0x114f0ca
	[0058.489] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0059.115] GetTickCount () returned 0x114f33b
	[0059.115] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0059.514] GetTickCount () returned 0x114f4c1
	[0059.514] GetTickCount () returned 0x114f4c1
	[0059.514] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0060.181] GetTickCount () returned 0x114f752
	[0060.181] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0060.631] GetTickCount () returned 0x114f917
	[0060.631] GetTickCount () returned 0x114f917
	[0060.631] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0061.308] GetTickCount () returned 0x114fbc6
	[0061.308] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0061.930] GetTickCount () returned 0x114fe28
	[0061.930] GetTickCount () returned 0x114fe28
	[0061.930] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0062.411] GetTickCount () returned 0x115001c
	[0062.411] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0062.993] GetTickCount () returned 0x115025e
	[0062.993] GetTickCount () returned 0x115025e
	[0063.007] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0063.645] GetTickCount () returned 0x11504ee
	[0063.645] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0064.084] GetTickCount () returned 0x11506a3
	[0064.086] GetTickCount () returned 0x11506a3
	[0064.086] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0064.675] GetTickCount () returned 0x11508e6
	[0064.675] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0065.259] GetTickCount () returned 0x1150b37
	[0065.259] GetTickCount () returned 0x1150b37
	[0065.259] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0065.825] GetTickCount () returned 0x1150d6a
	[0065.825] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0066.197] GetTickCount () returned 0x1150ee1
	[0066.197] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0066.786] GetTickCount () returned 0x1151133
	[0066.786] GetTickCount () returned 0x1151133
	[0066.786] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0067.302] GetTickCount () returned 0x1151336
	[0067.302] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0067.590] GetTickCount () returned 0x115144f
	[0067.590] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0067.975] GetTickCount () returned 0x11515d6
	[0067.975] GetTickCount () returned 0x11515d6
	[0067.975] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0068.508] GetTickCount () returned 0x11517da
	[0068.508] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0068.870] GetTickCount () returned 0x1151951
	[0068.870] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0069.372] GetTickCount () returned 0x1151b45
	[0069.372] GetTickCount () returned 0x1151b45
	[0069.372] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0069.832] GetTickCount () returned 0x1151d0a
	[0069.832] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0070.623] GetTickCount () returned 0x1152027
	[0070.623] GetTickCount () returned 0x1152027
	[0070.623] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0071.137] GetTickCount () returned 0x115222a
	[0071.137] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0071.575] GetTickCount () returned 0x11523e0
	[0071.577] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0072.291] GetTickCount () returned 0x115269f
	[0072.291] GetTickCount () returned 0x115269f
	[0072.291] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0072.781] GetTickCount () returned 0x1152883
	[0072.781] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0072.982] GetTickCount () returned 0x115294e
	[0072.982] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0073.428] GetTickCount () returned 0x1152b14
	[0073.428] GetTickCount () returned 0x1152b14
	[0073.428] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0073.866] GetTickCount () returned 0x1152cc9
	[0073.866] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0074.436] GetTickCount () returned 0x1152f0b
	[0074.436] GetTickCount () returned 0x1152f0b
	[0074.436] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0074.942] GetTickCount () returned 0x11530ff
	[0074.942] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0075.367] GetTickCount () returned 0x11532a5
	[0075.367] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0075.770] GetTickCount () returned 0x115343b
	[0075.770] GetTickCount () returned 0x115343b
	[0075.770] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0076.277] GetTickCount () returned 0x115362f
	[0076.277] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0077.106] GetTickCount () returned 0x115396b
	[0077.106] GetTickCount () returned 0x115396b
	[0077.106] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0077.279] GetTickCount () returned 0x1153a17
	[0077.279] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0077.781] GetTickCount () returned 0x1153c0b
	[0077.781] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0078.291] GetTickCount () returned 0x1153e0f
	[0078.291] GetTickCount () returned 0x1153e0f
	[0078.291] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0078.853] GetTickCount () returned 0x1154051
	[0078.853] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0080.026] GetTickCount () returned 0x11544d5
	[0080.026] GetTickCount () returned 0x11544d5
	[0080.026] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0080.595] GetTickCount () returned 0x1154708
	[0080.595] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0081.194] GetTickCount () returned 0x1154969
	[0081.194] GetTickCount () returned 0x1154969
	[0081.194] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0081.687] GetTickCount () returned 0x1154b4e
	[0081.687] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0082.203] GetTickCount () returned 0x1154d51
	[0082.203] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0082.689] GetTickCount () returned 0x1154f36
	[0082.689] GetTickCount () returned 0x1154f36
	[0082.701] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0083.223] GetTickCount () returned 0x1155158
	[0083.223] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0083.592] GetTickCount () returned 0x11552c0
	[0083.592] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0084.334] GetTickCount () returned 0x11555bd
	[0084.334] GetTickCount () returned 0x11555bd
	[0084.334] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0084.862] GetTickCount () returned 0x11557c1
	[0084.862] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0085.420] GetTickCount () returned 0x11559f4
	[0085.420] GetTickCount () returned 0x11559f4
	[0085.420] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0085.875] GetTickCount () returned 0x1155bb9
	[0085.875] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0086.248] GetTickCount () returned 0x1155d30
	[0086.248] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0086.657] GetTickCount () returned 0x1155ec6
	[0086.657] GetTickCount () returned 0x1155ec6
	[0086.657] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) returned 0x102
	[0087.148] GetTickCount () returned 0x11560aa
	[0087.148] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x64) 

Thread:
	id = 17
	os_tid = 0x4a0

	[0057.430] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x35c0750
	[0057.431] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x35d0758
	[0057.431] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f548
	[0057.431] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x6) returned 0x69f028
	[0057.431] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f410
	[0057.431] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x100000) returned 0x3ebc020
	[0057.434] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f4e8
	[0057.434] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f4e8, Size=0x20) returned 0x631178
	[0057.434] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f500
	[0057.434] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f500, Size=0x20) returned 0x631218
	[0057.434] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.434] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.434] Wow64DisableWow64FsRedirection (in: OldValue=0x389ff50 | out: OldValue=0x389ff50*=0x0) returned 1
	[0057.435] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.435] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631178 | out: hHeap=0x600000) returned 1
	[0057.435] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.435] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631218 | out: hHeap=0x600000) returned 1
	[0057.435] Sleep (dwMilliseconds=0x64) 
	[0057.804] Sleep (dwMilliseconds=0x64) 
	[0058.430] Sleep (dwMilliseconds=0x64) 
	[0059.061] Sleep (dwMilliseconds=0x64) 
	[0059.478] Sleep (dwMilliseconds=0x64) 
	[0060.180] Sleep (dwMilliseconds=0x64) 
	[0060.662] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0060.667] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.667] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.667] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=17752) returned 1
	[0060.668] CloseHandle (hObject=0x318) returned 1
	[0060.668] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80
	[0060.668] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.668] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.668] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.668] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.668] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0061.276] GetLastError () returned 0x0
	[0061.276] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x4558, lpOverlapped=0x0) returned 1
	[0061.290] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x4560, lpOverlapped=0x0) returned 1
	[0061.292] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.292] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.292] SetEndOfFile (hFile=0x2d4) returned 1
	[0061.292] CloseHandle (hObject=0x2d4) returned 1
	[0061.293] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.293] SetEndOfFile (hFile=0x318) returned 1
	[0061.294] CloseHandle (hObject=0x318) returned 1
	[0061.294] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.295] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1
	[0061.295] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.295] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.295] lstrlenW (lpString=".doc") returned 4
	[0061.295] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.295] lstrlenW (lpString=".docx") returned 5
	[0061.295] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.295] lstrlenW (lpString=".pdf") returned 4
	[0061.295] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.295] lstrlenW (lpString=".xls") returned 4
	[0061.295] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.295] lstrlenW (lpString=".xlsx") returned 5
	[0061.295] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.295] lstrlenW (lpString=".ppt") returned 4
	[0061.295] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.295] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.295] lstrlenW (lpString=".zip") returned 4
	[0061.295] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.295] lstrlenW (lpString=".rar") returned 4
	[0061.295] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.295] lstrlenW (lpString=".bz2") returned 4
	[0061.296] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.296] lstrlenW (lpString=".7z") returned 3
	[0061.296] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.296] lstrlenW (lpString=".dbf") returned 4
	[0061.296] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.296] lstrlenW (lpString=".1cd") returned 4
	[0061.296] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.296] lstrlenW (lpString=".jpg") returned 4
	[0061.296] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.296] lstrlenW (lpString=".doc") returned 4
	[0061.296] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.296] lstrlenW (lpString=".docx") returned 5
	[0061.296] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.296] lstrlenW (lpString=".pdf") returned 4
	[0061.296] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.296] lstrlenW (lpString=".xls") returned 4
	[0061.296] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.296] lstrlenW (lpString=".xlsx") returned 5
	[0061.296] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.297] lstrlenW (lpString=".ppt") returned 4
	[0061.297] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.297] lstrlenW (lpString=".zip") returned 4
	[0061.297] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.297] lstrlenW (lpString=".rar") returned 4
	[0061.297] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.297] lstrlenW (lpString=".bz2") returned 4
	[0061.297] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.297] lstrlenW (lpString=".7z") returned 3
	[0061.297] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.297] lstrlenW (lpString=".dbf") returned 4
	[0061.297] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.297] lstrlenW (lpString=".1cd") returned 4
	[0061.297] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.297] lstrlenW (lpString=".jpg") returned 4
	[0061.297] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.297] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.297] lstrlenW (lpString="Rotate3.ico") returned 11
	[0061.297] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0061.298] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=894) returned 1
	[0061.298] CloseHandle (hObject=0x318) returned 1
	[0061.298] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80
	[0061.298] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.298] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0061.298] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.298] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.298] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0061.298] GetLastError () returned 0x0
	[0061.298] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0061.300] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x380, lpOverlapped=0x0) returned 1
	[0061.301] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.301] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.301] SetEndOfFile (hFile=0x2d4) returned 1
	[0061.301] CloseHandle (hObject=0x2d4) returned 1
	[0061.302] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.302] SetEndOfFile (hFile=0x318) returned 1
	[0061.303] CloseHandle (hObject=0x318) returned 1
	[0061.303] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.303] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1
	[0061.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.303] lstrlenW (lpString=".doc") returned 4
	[0061.303] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.303] lstrlenW (lpString=".docx") returned 5
	[0061.303] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1
	[0061.303] lstrlenW (lpString=".pdf") returned 4
	[0061.304] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.304] lstrlenW (lpString=".xls") returned 4
	[0061.304] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.304] lstrlenW (lpString=".xlsx") returned 5
	[0061.304] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1
	[0061.304] lstrlenW (lpString=".ppt") returned 4
	[0061.304] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.304] lstrlenW (lpString=".zip") returned 4
	[0061.304] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.304] lstrlenW (lpString=".rar") returned 4
	[0061.304] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.304] lstrlenW (lpString=".bz2") returned 4
	[0061.304] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.304] lstrlenW (lpString=".7z") returned 3
	[0061.304] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.304] lstrlenW (lpString=".dbf") returned 4
	[0061.304] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.304] lstrlenW (lpString=".1cd") returned 4
	[0061.304] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.304] lstrlenW (lpString=".jpg") returned 4
	[0061.304] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.305] lstrlenW (lpString=".doc") returned 4
	[0061.305] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.305] lstrlenW (lpString=".docx") returned 5
	[0061.305] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1
	[0061.305] lstrlenW (lpString=".pdf") returned 4
	[0061.305] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.305] lstrlenW (lpString=".xls") returned 4
	[0061.305] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.305] lstrlenW (lpString=".xlsx") returned 5
	[0061.305] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1
	[0061.305] lstrlenW (lpString=".ppt") returned 4
	[0061.305] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.305] lstrlenW (lpString=".zip") returned 4
	[0061.305] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.305] lstrlenW (lpString=".rar") returned 4
	[0061.305] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.305] lstrlenW (lpString=".bz2") returned 4
	[0061.305] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.305] lstrlenW (lpString=".7z") returned 3
	[0061.305] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.305] lstrlenW (lpString=".dbf") returned 4
	[0061.305] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.305] lstrlenW (lpString=".1cd") returned 4
	[0061.305] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0061.306] lstrlenW (lpString=".jpg") returned 4
	[0061.306] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.306] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.306] lstrlenW (lpString="Rotate4.ico") returned 11
	[0061.306] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0061.306] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=894) returned 1
	[0061.307] CloseHandle (hObject=0x318) returned 1
	[0061.307] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80
	[0061.307] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.307] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0061.307] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.307] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.307] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0061.307] GetLastError () returned 0x0
	[0061.307] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0061.824] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x380, lpOverlapped=0x0) returned 1
	[0061.825] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.825] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.826] SetEndOfFile (hFile=0x2d4) returned 1
	[0061.826] CloseHandle (hObject=0x2d4) returned 1
	[0061.826] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.826] SetEndOfFile (hFile=0x318) returned 1
	[0061.827] CloseHandle (hObject=0x318) returned 1
	[0061.827] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.828] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1
	[0061.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.828] lstrlenW (lpString=".doc") returned 4
	[0061.828] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.828] lstrlenW (lpString=".docx") returned 5
	[0061.828] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1
	[0061.828] lstrlenW (lpString=".pdf") returned 4
	[0061.828] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.828] lstrlenW (lpString=".xls") returned 4
	[0061.828] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.828] lstrlenW (lpString=".xlsx") returned 5
	[0061.828] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1
	[0061.828] lstrlenW (lpString=".ppt") returned 4
	[0061.828] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.828] lstrlenW (lpString=".zip") returned 4
	[0061.828] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.828] lstrlenW (lpString=".rar") returned 4
	[0061.828] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.828] lstrlenW (lpString=".bz2") returned 4
	[0061.829] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.829] lstrlenW (lpString=".7z") returned 3
	[0061.829] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.829] lstrlenW (lpString=".dbf") returned 4
	[0061.829] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.829] lstrlenW (lpString=".1cd") returned 4
	[0061.829] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.829] lstrlenW (lpString=".jpg") returned 4
	[0061.829] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.829] lstrlenW (lpString=".doc") returned 4
	[0061.829] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.829] lstrlenW (lpString=".docx") returned 5
	[0061.829] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1
	[0061.829] lstrlenW (lpString=".pdf") returned 4
	[0061.829] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.829] lstrlenW (lpString=".xls") returned 4
	[0061.829] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.829] lstrlenW (lpString=".xlsx") returned 5
	[0061.829] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1
	[0061.829] lstrlenW (lpString=".ppt") returned 4
	[0061.829] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.829] lstrlenW (lpString=".zip") returned 4
	[0061.830] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.830] lstrlenW (lpString=".rar") returned 4
	[0061.830] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.830] lstrlenW (lpString=".bz2") returned 4
	[0061.830] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.830] lstrlenW (lpString=".7z") returned 3
	[0061.830] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.830] lstrlenW (lpString=".dbf") returned 4
	[0061.830] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.830] lstrlenW (lpString=".1cd") returned 4
	[0061.830] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0061.830] lstrlenW (lpString=".jpg") returned 4
	[0061.830] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.830] lstrcmpiW (lpString1=".msi", lpString2=".money") returned 1
	[0061.830] lstrlenW (lpString="netfx_Core_x64.msi") returned 18
	[0061.830] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0061.831] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=1901056) returned 1
	[0061.831] CloseHandle (hObject=0x318) returned 1
	[0061.831] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80
	[0061.831] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.831] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[admin@stex777.com].money")) returned 1
	[0061.832] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0061.832] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fc64 | out: lpNewFilePointer=0x0) returned 1
	[0061.832] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fc24 | out: lpNewFilePointer=0x0) returned 1
	[0061.832] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x389fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ebc058*, lpNumberOfBytesRead=0x389fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0061.836] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x389fc24 | out: lpNewFilePointer=0x0) returned 1
	[0061.836] ReadFile (in: hFile=0x318, lpBuffer=0x3efc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x389fc30, lpOverlapped=0x0 | out: lpBuffer=0x3efc058*, lpNumberOfBytesRead=0x389fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0061.840] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x389fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0061.840] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x389fc24 | out: lpNewFilePointer=0x0) returned 1
	[0061.840] ReadFile (in: hFile=0x318, lpBuffer=0x3f3c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x389fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f3c058*, lpNumberOfBytesRead=0x389fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0061.855] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.855] WriteFile (in: hFile=0x318, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x389fca8, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fca8*=0xc0110, lpOverlapped=0x0) returned 1
	[0062.296] SetEndOfFile (hFile=0x318) returned 1
	[0062.296] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x42d65b0
	[0062.296] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fc74 | out: lpNewFilePointer=0x0) returned 1
	[0062.296] WriteFile (in: hFile=0x318, lpBuffer=0x42d65b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x389fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d65b0*, lpNumberOfBytesWritten=0x389fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0062.298] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x389fc74 | out: lpNewFilePointer=0x0) returned 1
	[0062.298] WriteFile (in: hFile=0x318, lpBuffer=0x42d65b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x389fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d65b0*, lpNumberOfBytesWritten=0x389fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0062.300] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x389fc74 | out: lpNewFilePointer=0x0) returned 1
	[0062.300] WriteFile (in: hFile=0x318, lpBuffer=0x42d65b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x389fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d65b0*, lpNumberOfBytesWritten=0x389fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0062.303] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42d65b0 | out: hHeap=0x600000) returned 1
	[0062.303] CloseHandle (hObject=0x318) returned 1
	[0063.165] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0063.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.166] lstrlenW (lpString=".doc") returned 4
	[0063.166] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0063.166] lstrlenW (lpString=".docx") returned 5
	[0063.166] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0063.166] lstrlenW (lpString=".pdf") returned 4
	[0063.166] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0063.166] lstrlenW (lpString=".xls") returned 4
	[0063.166] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0063.166] lstrlenW (lpString=".xlsx") returned 5
	[0063.166] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0063.166] lstrlenW (lpString=".ppt") returned 4
	[0063.166] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0063.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.166] lstrlenW (lpString=".zip") returned 4
	[0063.166] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0063.166] lstrlenW (lpString=".rar") returned 4
	[0063.166] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0063.166] lstrlenW (lpString=".bz2") returned 4
	[0063.166] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0063.166] lstrlenW (lpString=".7z") returned 3
	[0063.166] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0063.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.167] lstrlenW (lpString=".dbf") returned 4
	[0063.167] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0063.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.167] lstrlenW (lpString=".1cd") returned 4
	[0063.167] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0063.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.167] lstrlenW (lpString=".jpg") returned 4
	[0063.167] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0063.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.167] lstrlenW (lpString=".doc") returned 4
	[0063.167] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0063.167] lstrlenW (lpString=".docx") returned 5
	[0063.167] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0063.167] lstrlenW (lpString=".pdf") returned 4
	[0063.167] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0063.167] lstrlenW (lpString=".xls") returned 4
	[0063.168] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0063.168] lstrlenW (lpString=".xlsx") returned 5
	[0063.168] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0063.168] lstrlenW (lpString=".ppt") returned 4
	[0063.168] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0063.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.168] lstrlenW (lpString=".zip") returned 4
	[0063.168] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0063.168] lstrlenW (lpString=".rar") returned 4
	[0063.168] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0063.168] lstrlenW (lpString=".bz2") returned 4
	[0063.168] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0063.168] lstrlenW (lpString=".7z") returned 3
	[0063.168] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0063.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.168] lstrlenW (lpString=".dbf") returned 4
	[0063.168] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0063.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.168] lstrlenW (lpString=".1cd") returned 4
	[0063.168] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0063.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0063.168] lstrlenW (lpString=".jpg") returned 4
	[0063.168] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0063.169] lstrcmpiW (lpString1=".msi", lpString2=".money") returned 1
	[0063.169] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22
	[0063.169] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.169] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=495616) returned 1
	[0063.169] CloseHandle (hObject=0x318) returned 1
	[0063.169] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80
	[0063.169] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.169] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.169] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.170] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.170] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0063.170] GetLastError () returned 0x0
	[0063.170] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x79000, lpOverlapped=0x0) returned 1
	[0063.181] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x79010, lpOverlapped=0x0) returned 1
	[0063.336] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.336] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x100, lpOverlapped=0x0) returned 1
	[0063.337] SetEndOfFile (hFile=0x378) returned 1
	[0063.337] CloseHandle (hObject=0x378) returned 1
	[0063.346] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.346] SetEndOfFile (hFile=0x318) returned 1
	[0063.728] CloseHandle (hObject=0x318) returned 1
	[0063.735] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0063.737] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1
	[0063.737] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.737] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.737] lstrlenW (lpString=".doc") returned 4
	[0063.737] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0063.737] lstrlenW (lpString=".docx") returned 5
	[0063.737] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0063.737] lstrlenW (lpString=".pdf") returned 4
	[0063.737] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0063.737] lstrlenW (lpString=".xls") returned 4
	[0063.737] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0063.737] lstrlenW (lpString=".xlsx") returned 5
	[0063.737] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0063.738] lstrlenW (lpString=".ppt") returned 4
	[0063.738] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.738] lstrlenW (lpString=".zip") returned 4
	[0063.738] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0063.738] lstrlenW (lpString=".rar") returned 4
	[0063.738] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0063.738] lstrlenW (lpString=".bz2") returned 4
	[0063.738] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0063.738] lstrlenW (lpString=".7z") returned 3
	[0063.738] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.738] lstrlenW (lpString=".dbf") returned 4
	[0063.738] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.738] lstrlenW (lpString=".1cd") returned 4
	[0063.738] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.738] lstrlenW (lpString=".jpg") returned 4
	[0063.738] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.738] lstrlenW (lpString=".doc") returned 4
	[0063.738] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0063.738] lstrlenW (lpString=".docx") returned 5
	[0063.738] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0063.738] lstrlenW (lpString=".pdf") returned 4
	[0063.739] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0063.739] lstrlenW (lpString=".xls") returned 4
	[0063.739] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0063.739] lstrlenW (lpString=".xlsx") returned 5
	[0063.739] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0063.739] lstrlenW (lpString=".ppt") returned 4
	[0063.739] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0063.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.739] lstrlenW (lpString=".zip") returned 4
	[0063.739] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0063.739] lstrlenW (lpString=".rar") returned 4
	[0063.739] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0063.739] lstrlenW (lpString=".bz2") returned 4
	[0063.739] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0063.739] lstrlenW (lpString=".7z") returned 3
	[0063.739] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0063.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.739] lstrlenW (lpString=".dbf") returned 4
	[0063.739] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0063.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.739] lstrlenW (lpString=".1cd") returned 4
	[0063.739] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0063.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0063.739] lstrlenW (lpString=".jpg") returned 4
	[0063.739] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0063.740] lstrcmpiW (lpString1=".msi", lpString2=".money") returned 1
	[0063.740] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16
	[0063.740] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.740] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=94720) returned 1
	[0063.740] CloseHandle (hObject=0x318) returned 1
	[0063.740] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80
	[0063.740] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.740] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.740] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.740] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.740] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0063.741] GetLastError () returned 0x0
	[0063.741] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x17200, lpOverlapped=0x0) returned 1
	[0063.744] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x17210, lpOverlapped=0x0) returned 1
	[0063.746] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.746] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0063.746] SetEndOfFile (hFile=0x37c) returned 1
	[0063.746] CloseHandle (hObject=0x37c) returned 1
	[0063.749] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.749] SetEndOfFile (hFile=0x318) returned 1
	[0063.750] CloseHandle (hObject=0x318) returned 1
	[0063.751] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0063.751] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1
	[0063.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.751] lstrlenW (lpString=".doc") returned 4
	[0063.751] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0063.751] lstrlenW (lpString=".docx") returned 5
	[0063.751] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0063.751] lstrlenW (lpString=".pdf") returned 4
	[0063.751] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0063.751] lstrlenW (lpString=".xls") returned 4
	[0063.751] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0063.751] lstrlenW (lpString=".xlsx") returned 5
	[0063.751] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0063.752] lstrlenW (lpString=".ppt") returned 4
	[0063.752] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0063.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.752] lstrlenW (lpString=".zip") returned 4
	[0063.752] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0063.752] lstrlenW (lpString=".rar") returned 4
	[0063.752] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0063.752] lstrlenW (lpString=".bz2") returned 4
	[0063.752] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0063.752] lstrlenW (lpString=".7z") returned 3
	[0063.752] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0063.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.752] lstrlenW (lpString=".dbf") returned 4
	[0063.752] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0063.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.752] lstrlenW (lpString=".1cd") returned 4
	[0063.752] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0063.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.752] lstrlenW (lpString=".jpg") returned 4
	[0063.752] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0063.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.752] lstrlenW (lpString=".doc") returned 4
	[0063.752] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0063.752] lstrlenW (lpString=".docx") returned 5
	[0063.753] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0063.753] lstrlenW (lpString=".pdf") returned 4
	[0063.753] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0063.753] lstrlenW (lpString=".xls") returned 4
	[0063.753] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0063.753] lstrlenW (lpString=".xlsx") returned 5
	[0063.753] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0063.753] lstrlenW (lpString=".ppt") returned 4
	[0063.753] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0063.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.753] lstrlenW (lpString=".zip") returned 4
	[0063.753] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0063.753] lstrlenW (lpString=".rar") returned 4
	[0063.753] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0063.753] lstrlenW (lpString=".bz2") returned 4
	[0063.753] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0063.753] lstrlenW (lpString=".7z") returned 3
	[0063.753] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0063.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.753] lstrlenW (lpString=".dbf") returned 4
	[0063.753] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0063.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.753] lstrlenW (lpString=".1cd") returned 4
	[0063.753] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0063.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0063.753] lstrlenW (lpString=".jpg") returned 4
	[0063.754] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0063.754] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0063.754] lstrlenW (lpString="Setup.exe") returned 9
	[0063.754] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.754] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=78152) returned 1
	[0063.754] CloseHandle (hObject=0x318) returned 1
	[0063.754] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80
	[0063.754] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.754] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.754] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.755] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0063.755] GetLastError () returned 0x0
	[0063.755] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x13148, lpOverlapped=0x0) returned 1
	[0063.758] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x13150, lpOverlapped=0x0) returned 1
	[0063.760] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.760] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0063.760] SetEndOfFile (hFile=0x37c) returned 1
	[0063.760] CloseHandle (hObject=0x37c) returned 1
	[0063.762] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.762] SetEndOfFile (hFile=0x318) returned 1
	[0063.764] CloseHandle (hObject=0x318) returned 1
	[0063.764] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0063.764] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1
	[0063.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.764] lstrlenW (lpString=".doc") returned 4
	[0063.764] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0063.764] lstrlenW (lpString=".docx") returned 5
	[0063.764] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0063.764] lstrlenW (lpString=".pdf") returned 4
	[0063.764] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0063.764] lstrlenW (lpString=".xls") returned 4
	[0063.765] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0063.765] lstrlenW (lpString=".xlsx") returned 5
	[0063.765] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0063.765] lstrlenW (lpString=".ppt") returned 4
	[0063.765] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0063.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.765] lstrlenW (lpString=".zip") returned 4
	[0063.765] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0063.765] lstrlenW (lpString=".rar") returned 4
	[0063.765] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0063.765] lstrlenW (lpString=".bz2") returned 4
	[0063.765] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0063.765] lstrlenW (lpString=".7z") returned 3
	[0063.765] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0063.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.765] lstrlenW (lpString=".dbf") returned 4
	[0063.765] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0063.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.765] lstrlenW (lpString=".1cd") returned 4
	[0063.765] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0063.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.765] lstrlenW (lpString=".jpg") returned 4
	[0063.765] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0063.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.766] lstrlenW (lpString=".doc") returned 4
	[0063.766] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0063.766] lstrlenW (lpString=".docx") returned 5
	[0063.766] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0063.766] lstrlenW (lpString=".pdf") returned 4
	[0063.766] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0063.766] lstrlenW (lpString=".xls") returned 4
	[0063.766] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0063.766] lstrlenW (lpString=".xlsx") returned 5
	[0063.766] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0063.766] lstrlenW (lpString=".ppt") returned 4
	[0063.766] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0063.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.766] lstrlenW (lpString=".zip") returned 4
	[0063.766] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0063.766] lstrlenW (lpString=".rar") returned 4
	[0063.766] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0063.766] lstrlenW (lpString=".bz2") returned 4
	[0063.766] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0063.766] lstrlenW (lpString=".7z") returned 3
	[0063.766] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0063.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.766] lstrlenW (lpString=".dbf") returned 4
	[0063.766] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0063.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.766] lstrlenW (lpString=".1cd") returned 4
	[0063.766] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0063.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0063.767] lstrlenW (lpString=".jpg") returned 4
	[0063.767] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0063.767] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0063.767] lstrlenW (lpString="SetupEngine.dll") returned 15
	[0063.767] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.767] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=807256) returned 1
	[0063.767] CloseHandle (hObject=0x318) returned 1
	[0063.767] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80
	[0063.767] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.767] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0063.768] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.768] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.768] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0064.694] GetLastError () returned 0x0
	[0064.694] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0xc5158, lpOverlapped=0x0) returned 1
	[0064.712] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xc5160, lpOverlapped=0x0) returned 1
	[0064.728] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.728] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0064.728] SetEndOfFile (hFile=0x314) returned 1
	[0064.728] CloseHandle (hObject=0x314) returned 1
	[0065.196] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.196] SetEndOfFile (hFile=0x318) returned 1
	[0065.204] CloseHandle (hObject=0x318) returned 1
	[0065.204] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0065.204] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1
	[0065.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.205] lstrlenW (lpString=".doc") returned 4
	[0065.205] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0065.205] lstrlenW (lpString=".docx") returned 5
	[0065.205] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0065.205] lstrlenW (lpString=".pdf") returned 4
	[0065.205] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0065.205] lstrlenW (lpString=".xls") returned 4
	[0065.205] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0065.205] lstrlenW (lpString=".xlsx") returned 5
	[0065.206] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0065.206] lstrlenW (lpString=".ppt") returned 4
	[0065.206] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0065.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.206] lstrlenW (lpString=".zip") returned 4
	[0065.206] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0065.206] lstrlenW (lpString=".rar") returned 4
	[0065.206] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0065.206] lstrlenW (lpString=".bz2") returned 4
	[0065.206] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0065.206] lstrlenW (lpString=".7z") returned 3
	[0065.206] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0065.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.206] lstrlenW (lpString=".dbf") returned 4
	[0065.206] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0065.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.206] lstrlenW (lpString=".1cd") returned 4
	[0065.206] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0065.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.206] lstrlenW (lpString=".jpg") returned 4
	[0065.206] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0065.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.206] lstrlenW (lpString=".doc") returned 4
	[0065.207] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0065.207] lstrlenW (lpString=".docx") returned 5
	[0065.207] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0065.207] lstrlenW (lpString=".pdf") returned 4
	[0065.207] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0065.207] lstrlenW (lpString=".xls") returned 4
	[0065.207] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0065.207] lstrlenW (lpString=".xlsx") returned 5
	[0065.207] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0065.207] lstrlenW (lpString=".ppt") returned 4
	[0065.207] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0065.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.207] lstrlenW (lpString=".zip") returned 4
	[0065.207] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0065.207] lstrlenW (lpString=".rar") returned 4
	[0065.207] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0065.207] lstrlenW (lpString=".bz2") returned 4
	[0065.207] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0065.207] lstrlenW (lpString=".7z") returned 3
	[0065.207] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0065.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.209] lstrlenW (lpString=".dbf") returned 4
	[0065.209] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0065.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.209] lstrlenW (lpString=".1cd") returned 4
	[0065.209] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0065.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0065.209] lstrlenW (lpString=".jpg") returned 4
	[0065.209] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0065.210] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0065.210] lstrlenW (lpString="sqmapi.dll") returned 10
	[0065.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0065.210] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=144416) returned 1
	[0065.210] CloseHandle (hObject=0x318) returned 1
	[0065.210] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80
	[0065.210] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0065.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0065.211] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.211] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0065.211] GetLastError () returned 0x0
	[0065.211] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x23420, lpOverlapped=0x0) returned 1
	[0065.215] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x23430, lpOverlapped=0x0) returned 1
	[0065.217] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.218] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0065.218] SetEndOfFile (hFile=0x314) returned 1
	[0065.218] CloseHandle (hObject=0x314) returned 1
	[0065.221] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.221] SetEndOfFile (hFile=0x318) returned 1
	[0065.223] CloseHandle (hObject=0x318) returned 1
	[0065.403] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0065.404] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1
	[0065.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.405] lstrlenW (lpString=".doc") returned 4
	[0065.405] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0065.405] lstrlenW (lpString=".docx") returned 5
	[0065.405] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0065.405] lstrlenW (lpString=".pdf") returned 4
	[0065.405] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0065.405] lstrlenW (lpString=".xls") returned 4
	[0065.405] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0065.405] lstrlenW (lpString=".xlsx") returned 5
	[0065.405] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0065.405] lstrlenW (lpString=".ppt") returned 4
	[0065.405] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0065.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.406] lstrlenW (lpString=".zip") returned 4
	[0065.406] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0065.406] lstrlenW (lpString=".rar") returned 4
	[0065.406] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0065.406] lstrlenW (lpString=".bz2") returned 4
	[0065.406] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0065.406] lstrlenW (lpString=".7z") returned 3
	[0065.406] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0065.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.406] lstrlenW (lpString=".dbf") returned 4
	[0065.406] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0065.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.406] lstrlenW (lpString=".1cd") returned 4
	[0065.406] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0065.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.406] lstrlenW (lpString=".jpg") returned 4
	[0065.406] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0065.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.406] lstrlenW (lpString=".doc") returned 4
	[0065.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0065.407] lstrlenW (lpString=".docx") returned 5
	[0065.407] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0065.407] lstrlenW (lpString=".pdf") returned 4
	[0065.407] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0065.407] lstrlenW (lpString=".xls") returned 4
	[0065.407] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0065.407] lstrlenW (lpString=".xlsx") returned 5
	[0065.407] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0065.407] lstrlenW (lpString=".ppt") returned 4
	[0065.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0065.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.407] lstrlenW (lpString=".zip") returned 4
	[0065.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0065.407] lstrlenW (lpString=".rar") returned 4
	[0065.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0065.407] lstrlenW (lpString=".bz2") returned 4
	[0065.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0065.407] lstrlenW (lpString=".7z") returned 3
	[0065.407] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0065.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.407] lstrlenW (lpString=".dbf") returned 4
	[0065.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0065.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.407] lstrlenW (lpString=".1cd") returned 4
	[0065.408] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0065.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0065.408] lstrlenW (lpString=".jpg") returned 4
	[0065.408] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0065.408] lstrcmpiW (lpString1=".msu", lpString2=".money") returned 1
	[0065.408] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33
	[0065.408] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0065.408] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=2192672) returned 1
	[0065.408] CloseHandle (hObject=0x374) returned 1
	[0065.409] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80
	[0065.409] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0065.409] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[admin@stex777.com].money")) returned 1
	[0065.409] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0065.409] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fc64 | out: lpNewFilePointer=0x0) returned 1
	[0065.409] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.410] ReadFile (in: hFile=0x374, lpBuffer=0x3ebc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x389fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ebc058*, lpNumberOfBytesRead=0x389fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.414] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x389fc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.414] ReadFile (in: hFile=0x374, lpBuffer=0x3efc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x389fc30, lpOverlapped=0x0 | out: lpBuffer=0x3efc058*, lpNumberOfBytesRead=0x389fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.417] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x389fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0065.417] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x389fc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.417] ReadFile (in: hFile=0x374, lpBuffer=0x3f3c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x389fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f3c058*, lpNumberOfBytesRead=0x389fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.441] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.441] WriteFile (in: hFile=0x374, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x389fca8, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0065.910] SetEndOfFile (hFile=0x374) returned 1
	[0065.910] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x43545b8
	[0065.917] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fc74 | out: lpNewFilePointer=0x0) returned 1
	[0065.917] WriteFile (in: hFile=0x374, lpBuffer=0x43545b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x389fc80, lpOverlapped=0x0 | out: lpBuffer=0x43545b8*, lpNumberOfBytesWritten=0x389fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.919] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x389fc74 | out: lpNewFilePointer=0x0) returned 1
	[0065.919] WriteFile (in: hFile=0x374, lpBuffer=0x43545b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x389fc80, lpOverlapped=0x0 | out: lpBuffer=0x43545b8*, lpNumberOfBytesWritten=0x389fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.921] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x389fc74 | out: lpNewFilePointer=0x0) returned 1
	[0065.921] WriteFile (in: hFile=0x374, lpBuffer=0x43545b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x389fc80, lpOverlapped=0x0 | out: lpBuffer=0x43545b8*, lpNumberOfBytesWritten=0x389fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.922] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43545b8 | out: hHeap=0x600000) returned 1
	[0065.922] CloseHandle (hObject=0x374) returned 1
	[0066.772] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0066.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.772] lstrlenW (lpString=".doc") returned 4
	[0066.772] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0066.772] lstrlenW (lpString=".docx") returned 5
	[0066.772] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0066.773] lstrlenW (lpString=".pdf") returned 4
	[0066.773] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0066.773] lstrlenW (lpString=".xls") returned 4
	[0066.773] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0066.773] lstrlenW (lpString=".xlsx") returned 5
	[0066.773] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0066.773] lstrlenW (lpString=".ppt") returned 4
	[0066.773] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0066.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.773] lstrlenW (lpString=".zip") returned 4
	[0066.773] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0066.773] lstrlenW (lpString=".rar") returned 4
	[0066.773] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0066.773] lstrlenW (lpString=".bz2") returned 4
	[0066.773] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0066.773] lstrlenW (lpString=".7z") returned 3
	[0066.773] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0066.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.773] lstrlenW (lpString=".dbf") returned 4
	[0066.773] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0066.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.773] lstrlenW (lpString=".1cd") returned 4
	[0066.773] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0066.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.773] lstrlenW (lpString=".jpg") returned 4
	[0066.773] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0066.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.774] lstrlenW (lpString=".doc") returned 4
	[0066.774] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0066.774] lstrlenW (lpString=".docx") returned 5
	[0066.774] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0066.774] lstrlenW (lpString=".pdf") returned 4
	[0066.774] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0066.774] lstrlenW (lpString=".xls") returned 4
	[0066.774] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0066.774] lstrlenW (lpString=".xlsx") returned 5
	[0066.774] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0066.774] lstrlenW (lpString=".ppt") returned 4
	[0066.774] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0066.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.774] lstrlenW (lpString=".zip") returned 4
	[0066.774] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0066.774] lstrlenW (lpString=".rar") returned 4
	[0066.774] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0066.774] lstrlenW (lpString=".bz2") returned 4
	[0066.774] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0066.774] lstrlenW (lpString=".7z") returned 3
	[0066.774] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0066.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.774] lstrlenW (lpString=".dbf") returned 4
	[0066.774] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0066.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.774] lstrlenW (lpString=".1cd") returned 4
	[0066.774] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0066.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0066.774] lstrlenW (lpString=".jpg") returned 4
	[0066.774] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0066.775] lstrlenW (lpString="BCD") returned 3
	[0066.775] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0066.775] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.775] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.775] lstrlenW (lpString=".doc") returned 4
	[0066.775] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0066.775] lstrlenW (lpString=".docx") returned 5
	[0066.775] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0066.775] lstrlenW (lpString=".pdf") returned 4
	[0066.775] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0066.775] lstrlenW (lpString=".xls") returned 4
	[0066.775] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0066.775] lstrlenW (lpString=".xlsx") returned 5
	[0066.775] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0066.775] lstrlenW (lpString=".ppt") returned 4
	[0066.775] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0066.775] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.775] lstrlenW (lpString=".zip") returned 4
	[0066.775] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0066.775] lstrlenW (lpString=".rar") returned 4
	[0066.775] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0066.775] lstrlenW (lpString=".bz2") returned 4
	[0066.775] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0066.775] lstrlenW (lpString=".7z") returned 3
	[0066.775] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0066.775] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.776] lstrlenW (lpString=".dbf") returned 4
	[0066.776] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0066.776] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.776] lstrlenW (lpString=".1cd") returned 4
	[0066.776] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0066.776] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.776] lstrlenW (lpString=".jpg") returned 4
	[0066.776] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0066.776] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.776] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.776] lstrlenW (lpString=".doc") returned 4
	[0066.776] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0066.776] lstrlenW (lpString=".docx") returned 5
	[0066.776] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0066.776] lstrlenW (lpString=".pdf") returned 4
	[0066.776] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0066.776] lstrlenW (lpString=".xls") returned 4
	[0066.776] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0066.776] lstrlenW (lpString=".xlsx") returned 5
	[0066.776] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0066.776] lstrlenW (lpString=".ppt") returned 4
	[0066.776] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0066.776] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.776] lstrlenW (lpString=".zip") returned 4
	[0066.776] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0066.776] lstrlenW (lpString=".rar") returned 4
	[0066.776] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0066.776] lstrlenW (lpString=".bz2") returned 4
	[0066.776] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0066.777] lstrlenW (lpString=".7z") returned 3
	[0066.777] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0066.777] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.777] lstrlenW (lpString=".dbf") returned 4
	[0066.777] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0066.777] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.777] lstrlenW (lpString=".1cd") returned 4
	[0066.777] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0066.777] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0066.777] lstrlenW (lpString=".jpg") returned 4
	[0066.777] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0066.777] lstrcmpiW (lpString1=".LOG1", lpString2=".money") returned -1
	[0066.777] lstrlenW (lpString="BCD.LOG1") returned 8
	[0066.777] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0066.777] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=0) returned 1
	[0066.777] CloseHandle (hObject=0x374) returned 1
	[0066.777] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.777] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.778] lstrlenW (lpString=".doc") returned 4
	[0066.778] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0066.778] lstrlenW (lpString=".docx") returned 5
	[0066.778] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0066.778] lstrlenW (lpString=".pdf") returned 4
	[0066.778] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0066.778] lstrlenW (lpString=".xls") returned 4
	[0066.778] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0066.778] lstrlenW (lpString=".xlsx") returned 5
	[0066.778] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0066.778] lstrlenW (lpString=".ppt") returned 4
	[0066.778] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0066.778] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.778] lstrlenW (lpString=".zip") returned 4
	[0066.778] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0066.778] lstrlenW (lpString=".rar") returned 4
	[0066.778] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0066.778] lstrlenW (lpString=".bz2") returned 4
	[0066.778] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0066.778] lstrlenW (lpString=".7z") returned 3
	[0066.778] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0066.778] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.778] lstrlenW (lpString=".dbf") returned 4
	[0066.778] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0066.778] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.778] lstrlenW (lpString=".1cd") returned 4
	[0066.778] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0066.778] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.778] lstrlenW (lpString=".jpg") returned 4
	[0066.778] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0066.779] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.779] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.779] lstrlenW (lpString=".doc") returned 4
	[0066.779] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0066.779] lstrlenW (lpString=".docx") returned 5
	[0066.779] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0066.779] lstrlenW (lpString=".pdf") returned 4
	[0066.779] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0066.779] lstrlenW (lpString=".xls") returned 4
	[0066.779] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0066.779] lstrlenW (lpString=".xlsx") returned 5
	[0066.779] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0066.779] lstrlenW (lpString=".ppt") returned 4
	[0066.779] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0066.779] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.779] lstrlenW (lpString=".zip") returned 4
	[0066.779] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0066.779] lstrlenW (lpString=".rar") returned 4
	[0066.779] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0066.779] lstrlenW (lpString=".bz2") returned 4
	[0066.779] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0066.779] lstrlenW (lpString=".7z") returned 3
	[0066.779] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0066.779] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.779] lstrlenW (lpString=".dbf") returned 4
	[0066.779] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0066.779] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.779] lstrlenW (lpString=".1cd") returned 4
	[0066.779] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0066.779] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0066.779] lstrlenW (lpString=".jpg") returned 4
	[0066.780] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0066.780] lstrcmpiW (lpString1=".LOG2", lpString2=".money") returned -1
	[0066.780] lstrlenW (lpString="BCD.LOG2") returned 8
	[0066.780] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0066.780] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=0) returned 1
	[0066.780] CloseHandle (hObject=0x374) returned 1
	[0066.780] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.780] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.780] lstrlenW (lpString=".doc") returned 4
	[0066.780] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0066.780] lstrlenW (lpString=".docx") returned 5
	[0066.780] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0066.780] lstrlenW (lpString=".pdf") returned 4
	[0066.780] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0066.780] lstrlenW (lpString=".xls") returned 4
	[0066.780] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0066.780] lstrlenW (lpString=".xlsx") returned 5
	[0066.780] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0066.780] lstrlenW (lpString=".ppt") returned 4
	[0066.780] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0066.781] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.781] lstrlenW (lpString=".zip") returned 4
	[0066.781] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0066.781] lstrlenW (lpString=".rar") returned 4
	[0066.781] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0066.781] lstrlenW (lpString=".bz2") returned 4
	[0066.781] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0066.781] lstrlenW (lpString=".7z") returned 3
	[0066.781] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0066.781] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.781] lstrlenW (lpString=".dbf") returned 4
	[0066.781] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0066.781] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.781] lstrlenW (lpString=".1cd") returned 4
	[0066.781] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0066.781] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.781] lstrlenW (lpString=".jpg") returned 4
	[0066.781] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0066.781] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.781] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.781] lstrlenW (lpString=".doc") returned 4
	[0066.781] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0066.781] lstrlenW (lpString=".docx") returned 5
	[0066.781] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0066.781] lstrlenW (lpString=".pdf") returned 4
	[0066.781] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0066.781] lstrlenW (lpString=".xls") returned 4
	[0066.781] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0066.781] lstrlenW (lpString=".xlsx") returned 5
	[0066.781] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0066.781] lstrlenW (lpString=".ppt") returned 4
	[0066.782] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0066.782] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.782] lstrlenW (lpString=".zip") returned 4
	[0066.782] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0066.782] lstrlenW (lpString=".rar") returned 4
	[0066.782] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0066.782] lstrlenW (lpString=".bz2") returned 4
	[0066.782] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0066.782] lstrlenW (lpString=".7z") returned 3
	[0066.782] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0066.782] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.782] lstrlenW (lpString=".dbf") returned 4
	[0066.782] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0066.782] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.782] lstrlenW (lpString=".1cd") returned 4
	[0066.782] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0066.782] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0066.782] lstrlenW (lpString=".jpg") returned 4
	[0066.782] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0066.782] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0066.782] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0066.782] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0066.783] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=77664) returned 1
	[0066.783] CloseHandle (hObject=0x374) returned 1
	[0066.783] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20
	[0066.783] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0066.783] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0066.783] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.783] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.783] lstrlenW (lpString=".doc") returned 4
	[0066.783] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0066.783] lstrlenW (lpString=".docx") returned 5
	[0066.783] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0066.783] lstrlenW (lpString=".pdf") returned 4
	[0066.783] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0066.783] lstrlenW (lpString=".xls") returned 4
	[0066.783] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0066.783] lstrlenW (lpString=".xlsx") returned 5
	[0066.783] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0066.783] lstrlenW (lpString=".ppt") returned 4
	[0066.783] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0066.783] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.783] lstrlenW (lpString=".zip") returned 4
	[0066.784] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0066.784] lstrlenW (lpString=".rar") returned 4
	[0066.784] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0066.784] lstrlenW (lpString=".bz2") returned 4
	[0066.784] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0066.784] lstrlenW (lpString=".7z") returned 3
	[0066.784] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0066.784] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.784] lstrlenW (lpString=".dbf") returned 4
	[0066.784] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0066.784] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.784] lstrlenW (lpString=".1cd") returned 4
	[0066.784] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0066.784] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.784] lstrlenW (lpString=".jpg") returned 4
	[0066.784] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0066.784] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.784] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.784] lstrlenW (lpString=".doc") returned 4
	[0066.784] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0066.784] lstrlenW (lpString=".docx") returned 5
	[0066.784] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0066.784] lstrlenW (lpString=".pdf") returned 4
	[0066.784] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0066.784] lstrlenW (lpString=".xls") returned 4
	[0066.784] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0066.784] lstrlenW (lpString=".xlsx") returned 5
	[0066.784] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0066.784] lstrlenW (lpString=".ppt") returned 4
	[0066.785] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0066.785] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.785] lstrlenW (lpString=".zip") returned 4
	[0066.785] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0066.785] lstrlenW (lpString=".rar") returned 4
	[0066.785] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0066.785] lstrlenW (lpString=".bz2") returned 4
	[0066.785] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0066.785] lstrlenW (lpString=".7z") returned 3
	[0066.785] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0066.785] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.785] lstrlenW (lpString=".dbf") returned 4
	[0066.785] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0066.785] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.785] lstrlenW (lpString=".1cd") returned 4
	[0066.785] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0066.785] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0066.785] lstrlenW (lpString=".jpg") returned 4
	[0066.785] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0066.785] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0066.785] lstrlenW (lpString="bootspaces.dll") returned 14
	[0066.785] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.189] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=95648) returned 1
	[0067.189] CloseHandle (hObject=0x388) returned 1
	[0067.190] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20
	[0067.190] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.190] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0067.190] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.190] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.190] lstrlenW (lpString=".doc") returned 4
	[0067.190] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0067.190] lstrlenW (lpString=".docx") returned 5
	[0067.190] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0067.190] lstrlenW (lpString=".pdf") returned 4
	[0067.190] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0067.190] lstrlenW (lpString=".xls") returned 4
	[0067.190] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0067.190] lstrlenW (lpString=".xlsx") returned 5
	[0067.190] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0067.190] lstrlenW (lpString=".ppt") returned 4
	[0067.190] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0067.191] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.191] lstrlenW (lpString=".zip") returned 4
	[0067.191] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0067.191] lstrlenW (lpString=".rar") returned 4
	[0067.191] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0067.191] lstrlenW (lpString=".bz2") returned 4
	[0067.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0067.191] lstrlenW (lpString=".7z") returned 3
	[0067.191] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0067.191] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.191] lstrlenW (lpString=".dbf") returned 4
	[0067.191] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0067.191] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.191] lstrlenW (lpString=".1cd") returned 4
	[0067.191] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0067.191] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.191] lstrlenW (lpString=".jpg") returned 4
	[0067.191] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0067.191] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.191] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.191] lstrlenW (lpString=".doc") returned 4
	[0067.192] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0067.192] lstrlenW (lpString=".docx") returned 5
	[0067.192] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0067.192] lstrlenW (lpString=".pdf") returned 4
	[0067.192] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0067.192] lstrlenW (lpString=".xls") returned 4
	[0067.192] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0067.192] lstrlenW (lpString=".xlsx") returned 5
	[0067.192] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0067.192] lstrlenW (lpString=".ppt") returned 4
	[0067.192] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0067.192] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.192] lstrlenW (lpString=".zip") returned 4
	[0067.192] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0067.192] lstrlenW (lpString=".rar") returned 4
	[0067.192] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0067.192] lstrlenW (lpString=".bz2") returned 4
	[0067.193] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0067.193] lstrlenW (lpString=".7z") returned 3
	[0067.193] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0067.193] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.193] lstrlenW (lpString=".dbf") returned 4
	[0067.193] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0067.193] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.193] lstrlenW (lpString=".1cd") returned 4
	[0067.193] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0067.193] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0067.193] lstrlenW (lpString=".jpg") returned 4
	[0067.193] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0067.193] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0067.193] lstrlenW (lpString="bootvhd.dll") returned 11
	[0067.193] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0067.193] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=99744) returned 1
	[0067.194] CloseHandle (hObject=0x388) returned 1
	[0067.194] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20
	[0067.194] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.194] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0067.194] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0067.194] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0067.194] lstrlenW (lpString=".doc") returned 4
	[0067.194] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0067.194] lstrlenW (lpString=".docx") returned 5
	[0067.194] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0067.194] lstrlenW (lpString=".pdf") returned 4
	[0067.194] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0067.194] lstrlenW (lpString=".xls") returned 4
	[0067.194] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0067.194] lstrlenW (lpString=".xlsx") returned 5
	[0067.194] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0067.194] lstrlenW (lpString=".ppt") returned 4
	[0067.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0067.194] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0067.194] lstrlenW (lpString=".zip") returned 4
	[0067.194] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0067.194] lstrlenW (lpString=".rar") returned 4
	[0067.195] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0067.195] lstrlenW (lpString=".bz2") returned 4
	[0067.195] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0067.195] lstrlenW (lpString=".7z") returned 3
	[0067.195] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0067.195] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0067.195] lstrlenW (lpString=".dbf") returned 4
	[0067.195] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0067.198] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0
	[0067.199] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0
	[0067.202] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0
	[0067.203] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0
	[0067.222] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0
	[0067.222] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0067.223] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.224] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.224] CreateFileW (lpFileName="C:\\BOOTNXT.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\bootnxt.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0067.224] GetLastError () returned 0x0
	[0067.224] ReadFile (in: hFile=0x388, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x1, lpOverlapped=0x0) returned 1
	[0067.225] WriteFile (in: hFile=0x368, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x10, lpOverlapped=0x0) returned 1
	[0067.226] ReadFile (in: hFile=0x388, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.226] WriteFile (in: hFile=0x368, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0067.226] SetEndOfFile (hFile=0x368) returned 1
	[0067.226] CloseHandle (hObject=0x368) returned 1
	[0067.227] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.227] SetEndOfFile (hFile=0x388) returned 1
	[0067.228] CloseHandle (hObject=0x388) returned 1
	[0067.228] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x26) returned 1
	[0067.228] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1
	[0067.228] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.228] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.228] lstrlenW (lpString=".doc") returned 4
	[0067.228] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1
	[0067.228] lstrlenW (lpString=".docx") returned 5
	[0067.228] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1
	[0067.228] lstrlenW (lpString=".pdf") returned 4
	[0067.229] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1
	[0067.229] lstrlenW (lpString=".xls") returned 4
	[0067.229] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1
	[0067.229] lstrlenW (lpString=".xlsx") returned 5
	[0067.229] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1
	[0067.229] lstrlenW (lpString=".ppt") returned 4
	[0067.229] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1
	[0067.229] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.229] lstrlenW (lpString=".zip") returned 4
	[0067.229] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1
	[0067.229] lstrlenW (lpString=".rar") returned 4
	[0067.229] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1
	[0067.229] lstrlenW (lpString=".bz2") returned 4
	[0067.229] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1
	[0067.229] lstrlenW (lpString=".7z") returned 3
	[0067.229] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1
	[0067.229] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.229] lstrlenW (lpString=".dbf") returned 4
	[0067.229] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1
	[0067.229] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.229] lstrlenW (lpString=".1cd") returned 4
	[0067.229] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1
	[0067.229] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.229] lstrlenW (lpString=".jpg") returned 4
	[0067.229] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1
	[0067.229] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.229] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.229] lstrlenW (lpString=".doc") returned 4
	[0067.229] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1
	[0067.229] lstrlenW (lpString=".docx") returned 5
	[0067.229] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1
	[0067.230] lstrlenW (lpString=".pdf") returned 4
	[0067.230] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1
	[0067.230] lstrlenW (lpString=".xls") returned 4
	[0067.230] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1
	[0067.230] lstrlenW (lpString=".xlsx") returned 5
	[0067.230] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1
	[0067.230] lstrlenW (lpString=".ppt") returned 4
	[0067.230] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1
	[0067.230] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.230] lstrlenW (lpString=".zip") returned 4
	[0067.230] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1
	[0067.230] lstrlenW (lpString=".rar") returned 4
	[0067.230] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1
	[0067.230] lstrlenW (lpString=".bz2") returned 4
	[0067.230] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1
	[0067.230] lstrlenW (lpString=".7z") returned 3
	[0067.230] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1
	[0067.230] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.230] lstrlenW (lpString=".dbf") returned 4
	[0067.230] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1
	[0067.230] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.230] lstrlenW (lpString=".1cd") returned 4
	[0067.230] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1
	[0067.230] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0067.230] lstrlenW (lpString=".jpg") returned 4
	[0067.230] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1
	[0067.231] lstrcmpiW (lpString1=".sys", lpString2=".money") returned 1
	[0067.231] lstrlenW (lpString="hiberfil.sys") returned 12
	[0067.231] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0067.231] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.231] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.231] lstrlenW (lpString=".doc") returned 4
	[0067.231] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0067.231] lstrlenW (lpString=".docx") returned 5
	[0067.231] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0067.231] lstrlenW (lpString=".pdf") returned 4
	[0067.231] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0067.231] lstrlenW (lpString=".xls") returned 4
	[0067.231] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0067.231] lstrlenW (lpString=".xlsx") returned 5
	[0067.231] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0067.231] lstrlenW (lpString=".ppt") returned 4
	[0067.231] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0067.231] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.231] lstrlenW (lpString=".zip") returned 4
	[0067.231] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0067.232] lstrlenW (lpString=".rar") returned 4
	[0067.232] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0067.232] lstrlenW (lpString=".bz2") returned 4
	[0067.232] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0067.232] lstrlenW (lpString=".7z") returned 3
	[0067.232] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0067.232] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.232] lstrlenW (lpString=".dbf") returned 4
	[0067.232] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0067.232] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.232] lstrlenW (lpString=".1cd") returned 4
	[0067.232] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0067.232] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.232] lstrlenW (lpString=".jpg") returned 4
	[0067.232] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0067.232] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.232] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.232] lstrlenW (lpString=".doc") returned 4
	[0067.232] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0067.232] lstrlenW (lpString=".docx") returned 5
	[0067.232] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0067.232] lstrlenW (lpString=".pdf") returned 4
	[0067.232] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0067.232] lstrlenW (lpString=".xls") returned 4
	[0067.232] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0067.233] lstrlenW (lpString=".xlsx") returned 5
	[0067.233] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0067.233] lstrlenW (lpString=".ppt") returned 4
	[0067.233] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0067.233] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.233] lstrlenW (lpString=".zip") returned 4
	[0067.233] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0067.233] lstrlenW (lpString=".rar") returned 4
	[0067.233] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0067.233] lstrlenW (lpString=".bz2") returned 4
	[0067.233] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0067.233] lstrlenW (lpString=".7z") returned 3
	[0067.233] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0067.233] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.233] lstrlenW (lpString=".dbf") returned 4
	[0067.233] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0067.233] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.233] lstrlenW (lpString=".1cd") returned 4
	[0067.233] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0067.233] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0067.233] lstrlenW (lpString=".jpg") returned 4
	[0067.233] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0067.233] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0067.233] lstrlenW (lpString="Application.evtx") returned 16
	[0067.234] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0067.680] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0067.680] CloseHandle (hObject=0x350) returned 1
	[0067.680] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20
	[0067.680] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\application.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.681] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0067.681] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.681] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.681] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\application.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0068.106] GetLastError () returned 0x0
	[0068.106] ReadFile (in: hFile=0x350, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.108] WriteFile (in: hFile=0x33c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.110] ReadFile (in: hFile=0x350, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.110] WriteFile (in: hFile=0x33c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0068.110] SetEndOfFile (hFile=0x33c) returned 1
	[0068.110] CloseHandle (hObject=0x33c) returned 1
	[0068.112] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.112] SetEndOfFile (hFile=0x350) returned 1
	[0068.114] CloseHandle (hObject=0x350) returned 1
	[0068.115] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.115] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1
	[0068.115] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.115] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.115] lstrlenW (lpString=".doc") returned 4
	[0068.115] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.115] lstrlenW (lpString=".docx") returned 5
	[0068.115] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.115] lstrlenW (lpString=".pdf") returned 4
	[0068.115] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.115] lstrlenW (lpString=".xls") returned 4
	[0068.115] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.116] lstrlenW (lpString=".xlsx") returned 5
	[0068.116] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.116] lstrlenW (lpString=".ppt") returned 4
	[0068.116] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.116] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.116] lstrlenW (lpString=".zip") returned 4
	[0068.116] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.116] lstrlenW (lpString=".rar") returned 4
	[0068.116] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.116] lstrlenW (lpString=".bz2") returned 4
	[0068.116] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.116] lstrlenW (lpString=".7z") returned 3
	[0068.116] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.116] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.116] lstrlenW (lpString=".dbf") returned 4
	[0068.116] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.116] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.116] lstrlenW (lpString=".1cd") returned 4
	[0068.116] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.116] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.116] lstrlenW (lpString=".jpg") returned 4
	[0068.116] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.117] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.117] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.117] lstrlenW (lpString=".doc") returned 4
	[0068.117] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.117] lstrlenW (lpString=".docx") returned 5
	[0068.117] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.117] lstrlenW (lpString=".pdf") returned 4
	[0068.117] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.117] lstrlenW (lpString=".xls") returned 4
	[0068.117] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.117] lstrlenW (lpString=".xlsx") returned 5
	[0068.117] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.117] lstrlenW (lpString=".ppt") returned 4
	[0068.117] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.117] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.117] lstrlenW (lpString=".zip") returned 4
	[0068.117] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.117] lstrlenW (lpString=".rar") returned 4
	[0068.117] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.117] lstrlenW (lpString=".bz2") returned 4
	[0068.117] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.117] lstrlenW (lpString=".7z") returned 3
	[0068.117] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.117] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.117] lstrlenW (lpString=".dbf") returned 4
	[0068.118] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.118] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.118] lstrlenW (lpString=".1cd") returned 4
	[0068.118] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.118] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0068.118] lstrlenW (lpString=".jpg") returned 4
	[0068.118] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.118] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.118] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57
	[0068.118] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0068.118] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0068.118] CloseHandle (hObject=0x350) returned 1
	[0068.118] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20
	[0068.118] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.119] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0068.119] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.119] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.119] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0068.119] GetLastError () returned 0x0
	[0068.119] ReadFile (in: hFile=0x350, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.122] WriteFile (in: hFile=0x33c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.124] ReadFile (in: hFile=0x350, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.124] WriteFile (in: hFile=0x33c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x146, lpOverlapped=0x0) returned 1
	[0068.124] SetEndOfFile (hFile=0x33c) returned 1
	[0068.124] CloseHandle (hObject=0x33c) returned 1
	[0068.126] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.126] SetEndOfFile (hFile=0x350) returned 1
	[0068.127] CloseHandle (hObject=0x350) returned 1
	[0068.127] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.127] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1
	[0068.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.128] lstrlenW (lpString=".doc") returned 4
	[0068.128] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.128] lstrlenW (lpString=".docx") returned 5
	[0068.128] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.128] lstrlenW (lpString=".pdf") returned 4
	[0068.128] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.128] lstrlenW (lpString=".xls") returned 4
	[0068.128] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.128] lstrlenW (lpString=".xlsx") returned 5
	[0068.128] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.128] lstrlenW (lpString=".ppt") returned 4
	[0068.128] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.128] lstrlenW (lpString=".zip") returned 4
	[0068.128] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.128] lstrlenW (lpString=".rar") returned 4
	[0068.128] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.128] lstrlenW (lpString=".bz2") returned 4
	[0068.128] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.128] lstrlenW (lpString=".7z") returned 3
	[0068.128] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.129] lstrlenW (lpString=".dbf") returned 4
	[0068.129] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.129] lstrlenW (lpString=".1cd") returned 4
	[0068.129] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.129] lstrlenW (lpString=".jpg") returned 4
	[0068.129] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.129] lstrlenW (lpString=".doc") returned 4
	[0068.129] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.129] lstrlenW (lpString=".docx") returned 5
	[0068.129] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.129] lstrlenW (lpString=".pdf") returned 4
	[0068.130] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.130] lstrlenW (lpString=".xls") returned 4
	[0068.130] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.130] lstrlenW (lpString=".xlsx") returned 5
	[0068.130] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.130] lstrlenW (lpString=".ppt") returned 4
	[0068.130] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.130] lstrlenW (lpString=".zip") returned 4
	[0068.130] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.130] lstrlenW (lpString=".rar") returned 4
	[0068.130] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.130] lstrlenW (lpString=".bz2") returned 4
	[0068.130] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.130] lstrlenW (lpString=".7z") returned 3
	[0068.130] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.130] lstrlenW (lpString=".dbf") returned 4
	[0068.130] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.130] lstrlenW (lpString=".1cd") returned 4
	[0068.131] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0068.131] lstrlenW (lpString=".jpg") returned 4
	[0068.131] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.131] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.131] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56
	[0068.131] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0068.131] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0068.131] CloseHandle (hObject=0x350) returned 1
	[0068.131] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20
	[0068.131] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.132] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0068.132] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.132] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.132] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0068.132] GetLastError () returned 0x0
	[0068.132] ReadFile (in: hFile=0x350, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.137] WriteFile (in: hFile=0x33c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.139] ReadFile (in: hFile=0x350, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.139] WriteFile (in: hFile=0x33c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x144, lpOverlapped=0x0) returned 1
	[0068.139] SetEndOfFile (hFile=0x33c) returned 1
	[0068.139] CloseHandle (hObject=0x33c) returned 1
	[0068.141] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.141] SetEndOfFile (hFile=0x350) returned 1
	[0068.142] CloseHandle (hObject=0x350) returned 1
	[0068.142] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.143] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1
	[0068.143] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.143] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.143] lstrlenW (lpString=".doc") returned 4
	[0068.143] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.143] lstrlenW (lpString=".docx") returned 5
	[0068.143] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.143] lstrlenW (lpString=".pdf") returned 4
	[0068.143] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.143] lstrlenW (lpString=".xls") returned 4
	[0068.143] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.143] lstrlenW (lpString=".xlsx") returned 5
	[0068.143] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.143] lstrlenW (lpString=".ppt") returned 4
	[0068.143] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.144] lstrlenW (lpString=".zip") returned 4
	[0068.144] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.144] lstrlenW (lpString=".rar") returned 4
	[0068.144] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.144] lstrlenW (lpString=".bz2") returned 4
	[0068.144] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.144] lstrlenW (lpString=".7z") returned 3
	[0068.144] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.144] lstrlenW (lpString=".dbf") returned 4
	[0068.144] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.144] lstrlenW (lpString=".1cd") returned 4
	[0068.144] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.144] lstrlenW (lpString=".jpg") returned 4
	[0068.144] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.144] lstrlenW (lpString=".doc") returned 4
	[0068.144] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.145] lstrlenW (lpString=".docx") returned 5
	[0068.145] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.145] lstrlenW (lpString=".pdf") returned 4
	[0068.145] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.145] lstrlenW (lpString=".xls") returned 4
	[0068.145] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.145] lstrlenW (lpString=".xlsx") returned 5
	[0068.145] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.145] lstrlenW (lpString=".ppt") returned 4
	[0068.145] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.513] lstrlenW (lpString=".zip") returned 4
	[0068.513] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.513] lstrlenW (lpString=".rar") returned 4
	[0068.513] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.513] lstrlenW (lpString=".bz2") returned 4
	[0068.513] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.513] lstrlenW (lpString=".7z") returned 3
	[0068.513] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.513] lstrlenW (lpString=".dbf") returned 4
	[0068.513] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.513] lstrlenW (lpString=".1cd") returned 4
	[0068.513] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0068.513] lstrlenW (lpString=".jpg") returned 4
	[0068.513] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.514] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.514] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50
	[0068.514] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.822] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0068.822] CloseHandle (hObject=0x320) returned 1
	[0068.822] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20
	[0068.822] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.822] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.822] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.822] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.822] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0068.822] GetLastError () returned 0x0
	[0068.822] ReadFile (in: hFile=0x320, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.830] WriteFile (in: hFile=0x38c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.832] ReadFile (in: hFile=0x320, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.832] WriteFile (in: hFile=0x38c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x138, lpOverlapped=0x0) returned 1
	[0068.832] SetEndOfFile (hFile=0x38c) returned 1
	[0068.832] CloseHandle (hObject=0x38c) returned 1
	[0068.834] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.834] SetEndOfFile (hFile=0x320) returned 1
	[0068.836] CloseHandle (hObject=0x320) returned 1
	[0068.836] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.836] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1
	[0068.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.836] lstrlenW (lpString=".doc") returned 4
	[0068.836] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.836] lstrlenW (lpString=".docx") returned 5
	[0068.836] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.836] lstrlenW (lpString=".pdf") returned 4
	[0068.836] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.836] lstrlenW (lpString=".xls") returned 4
	[0068.836] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.837] lstrlenW (lpString=".xlsx") returned 5
	[0068.837] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.837] lstrlenW (lpString=".ppt") returned 4
	[0068.837] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.837] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.837] lstrlenW (lpString=".zip") returned 4
	[0068.837] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.837] lstrlenW (lpString=".rar") returned 4
	[0068.837] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.837] lstrlenW (lpString=".bz2") returned 4
	[0068.837] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.837] lstrlenW (lpString=".7z") returned 3
	[0068.837] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.837] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.837] lstrlenW (lpString=".dbf") returned 4
	[0068.837] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.837] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.837] lstrlenW (lpString=".1cd") returned 4
	[0068.837] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.838] lstrlenW (lpString=".jpg") returned 4
	[0068.838] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.838] lstrlenW (lpString=".doc") returned 4
	[0068.838] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.838] lstrlenW (lpString=".docx") returned 5
	[0068.838] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.838] lstrlenW (lpString=".pdf") returned 4
	[0068.838] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.838] lstrlenW (lpString=".xls") returned 4
	[0068.838] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.838] lstrlenW (lpString=".xlsx") returned 5
	[0068.838] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.838] lstrlenW (lpString=".ppt") returned 4
	[0068.838] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.838] lstrlenW (lpString=".zip") returned 4
	[0068.838] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.838] lstrlenW (lpString=".rar") returned 4
	[0068.838] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.838] lstrlenW (lpString=".bz2") returned 4
	[0068.838] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.838] lstrlenW (lpString=".7z") returned 3
	[0068.838] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.838] lstrlenW (lpString=".dbf") returned 4
	[0068.838] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.838] lstrlenW (lpString=".1cd") returned 4
	[0068.839] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0068.839] lstrlenW (lpString=".jpg") returned 4
	[0068.839] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.839] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.839] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55
	[0068.839] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.839] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0068.840] CloseHandle (hObject=0x320) returned 1
	[0068.840] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20
	[0068.840] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.840] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.840] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.840] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.840] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0068.840] GetLastError () returned 0x0
	[0068.840] ReadFile (in: hFile=0x320, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.843] WriteFile (in: hFile=0x38c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.845] ReadFile (in: hFile=0x320, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.845] WriteFile (in: hFile=0x38c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x142, lpOverlapped=0x0) returned 1
	[0068.845] SetEndOfFile (hFile=0x38c) returned 1
	[0068.845] CloseHandle (hObject=0x38c) returned 1
	[0068.847] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.847] SetEndOfFile (hFile=0x320) returned 1
	[0068.848] CloseHandle (hObject=0x320) returned 1
	[0068.848] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.849] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1
	[0068.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.849] lstrlenW (lpString=".doc") returned 4
	[0068.849] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.849] lstrlenW (lpString=".docx") returned 5
	[0068.849] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.849] lstrlenW (lpString=".pdf") returned 4
	[0068.849] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.849] lstrlenW (lpString=".xls") returned 4
	[0068.849] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.849] lstrlenW (lpString=".xlsx") returned 5
	[0068.849] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.849] lstrlenW (lpString=".ppt") returned 4
	[0068.849] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.849] lstrlenW (lpString=".zip") returned 4
	[0068.849] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.849] lstrlenW (lpString=".rar") returned 4
	[0068.850] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.850] lstrlenW (lpString=".bz2") returned 4
	[0068.850] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.850] lstrlenW (lpString=".7z") returned 3
	[0068.850] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.850] lstrlenW (lpString=".dbf") returned 4
	[0068.850] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.850] lstrlenW (lpString=".1cd") returned 4
	[0068.850] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.850] lstrlenW (lpString=".jpg") returned 4
	[0068.850] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.850] lstrlenW (lpString=".doc") returned 4
	[0068.850] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.850] lstrlenW (lpString=".docx") returned 5
	[0068.850] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.850] lstrlenW (lpString=".pdf") returned 4
	[0068.850] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.850] lstrlenW (lpString=".xls") returned 4
	[0068.850] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.850] lstrlenW (lpString=".xlsx") returned 5
	[0068.850] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.850] lstrlenW (lpString=".ppt") returned 4
	[0068.850] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.851] lstrlenW (lpString=".zip") returned 4
	[0068.851] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.851] lstrlenW (lpString=".rar") returned 4
	[0068.851] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.851] lstrlenW (lpString=".bz2") returned 4
	[0068.851] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.851] lstrlenW (lpString=".7z") returned 3
	[0068.851] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.851] lstrlenW (lpString=".dbf") returned 4
	[0068.851] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.851] lstrlenW (lpString=".1cd") returned 4
	[0068.851] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0068.851] lstrlenW (lpString=".jpg") returned 4
	[0068.851] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.851] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.851] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49
	[0068.851] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.851] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0068.852] CloseHandle (hObject=0x320) returned 1
	[0068.852] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20
	[0068.852] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.852] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.852] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.852] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.852] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0068.852] GetLastError () returned 0x0
	[0068.852] ReadFile (in: hFile=0x320, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.855] WriteFile (in: hFile=0x38c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.857] ReadFile (in: hFile=0x320, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.857] WriteFile (in: hFile=0x38c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x136, lpOverlapped=0x0) returned 1
	[0068.857] SetEndOfFile (hFile=0x38c) returned 1
	[0068.857] CloseHandle (hObject=0x38c) returned 1
	[0068.861] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.861] SetEndOfFile (hFile=0x320) returned 1
	[0068.862] CloseHandle (hObject=0x320) returned 1
	[0068.862] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.863] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1
	[0068.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.863] lstrlenW (lpString=".doc") returned 4
	[0068.863] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.863] lstrlenW (lpString=".docx") returned 5
	[0068.863] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.863] lstrlenW (lpString=".pdf") returned 4
	[0068.863] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.863] lstrlenW (lpString=".xls") returned 4
	[0068.863] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.863] lstrlenW (lpString=".xlsx") returned 5
	[0068.863] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.863] lstrlenW (lpString=".ppt") returned 4
	[0068.863] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.863] lstrlenW (lpString=".zip") returned 4
	[0068.863] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.863] lstrlenW (lpString=".rar") returned 4
	[0068.863] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.863] lstrlenW (lpString=".bz2") returned 4
	[0068.864] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.864] lstrlenW (lpString=".7z") returned 3
	[0068.864] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.864] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.864] lstrlenW (lpString=".dbf") returned 4
	[0068.864] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.864] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.864] lstrlenW (lpString=".1cd") returned 4
	[0068.864] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.864] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.864] lstrlenW (lpString=".jpg") returned 4
	[0068.864] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.864] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.864] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.864] lstrlenW (lpString=".doc") returned 4
	[0068.864] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.864] lstrlenW (lpString=".docx") returned 5
	[0068.864] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.864] lstrlenW (lpString=".pdf") returned 4
	[0068.864] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.864] lstrlenW (lpString=".xls") returned 4
	[0068.864] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.864] lstrlenW (lpString=".xlsx") returned 5
	[0068.864] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.864] lstrlenW (lpString=".ppt") returned 4
	[0068.864] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.864] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.865] lstrlenW (lpString=".zip") returned 4
	[0068.865] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.865] lstrlenW (lpString=".rar") returned 4
	[0068.865] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.865] lstrlenW (lpString=".bz2") returned 4
	[0068.865] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.865] lstrlenW (lpString=".7z") returned 3
	[0068.865] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.865] lstrlenW (lpString=".dbf") returned 4
	[0068.865] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.865] lstrlenW (lpString=".1cd") returned 4
	[0068.865] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0068.865] lstrlenW (lpString=".jpg") returned 4
	[0068.865] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.865] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.865] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64
	[0068.865] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.529] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0069.529] CloseHandle (hObject=0x368) returned 1
	[0069.530] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20
	[0069.530] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.530] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.530] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.530] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.530] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.530] GetLastError () returned 0x0
	[0069.530] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0069.533] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0069.535] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.535] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x154, lpOverlapped=0x0) returned 1
	[0069.535] SetEndOfFile (hFile=0x364) returned 1
	[0069.535] CloseHandle (hObject=0x364) returned 1
	[0069.537] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.537] SetEndOfFile (hFile=0x368) returned 1
	[0069.539] CloseHandle (hObject=0x368) returned 1
	[0069.539] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.539] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1
	[0069.539] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.539] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.539] lstrlenW (lpString=".doc") returned 4
	[0069.539] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.539] lstrlenW (lpString=".docx") returned 5
	[0069.539] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.539] lstrlenW (lpString=".pdf") returned 4
	[0069.539] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.539] lstrlenW (lpString=".xls") returned 4
	[0069.540] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.540] lstrlenW (lpString=".xlsx") returned 5
	[0069.540] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.540] lstrlenW (lpString=".ppt") returned 4
	[0069.540] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.540] lstrlenW (lpString=".zip") returned 4
	[0069.540] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.540] lstrlenW (lpString=".rar") returned 4
	[0069.540] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.540] lstrlenW (lpString=".bz2") returned 4
	[0069.540] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.540] lstrlenW (lpString=".7z") returned 3
	[0069.540] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.540] lstrlenW (lpString=".dbf") returned 4
	[0069.540] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.540] lstrlenW (lpString=".1cd") returned 4
	[0069.540] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.541] lstrlenW (lpString=".jpg") returned 4
	[0069.541] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.541] lstrlenW (lpString=".doc") returned 4
	[0069.541] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.541] lstrlenW (lpString=".docx") returned 5
	[0069.541] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.541] lstrlenW (lpString=".pdf") returned 4
	[0069.541] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.541] lstrlenW (lpString=".xls") returned 4
	[0069.541] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.541] lstrlenW (lpString=".xlsx") returned 5
	[0069.541] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.541] lstrlenW (lpString=".ppt") returned 4
	[0069.541] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.541] lstrlenW (lpString=".zip") returned 4
	[0069.541] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.541] lstrlenW (lpString=".rar") returned 4
	[0069.541] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.541] lstrlenW (lpString=".bz2") returned 4
	[0069.541] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.541] lstrlenW (lpString=".7z") returned 3
	[0069.541] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.541] lstrlenW (lpString=".dbf") returned 4
	[0069.541] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.542] lstrlenW (lpString=".1cd") returned 4
	[0069.542] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0069.542] lstrlenW (lpString=".jpg") returned 4
	[0069.542] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.542] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0069.542] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49
	[0069.542] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.542] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0069.542] CloseHandle (hObject=0x368) returned 1
	[0069.542] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20
	[0069.542] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.542] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.543] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.543] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.543] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.543] GetLastError () returned 0x0
	[0069.543] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0069.545] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0069.547] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.547] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x136, lpOverlapped=0x0) returned 1
	[0069.547] SetEndOfFile (hFile=0x364) returned 1
	[0069.548] CloseHandle (hObject=0x364) returned 1
	[0069.549] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.550] SetEndOfFile (hFile=0x368) returned 1
	[0069.551] CloseHandle (hObject=0x368) returned 1
	[0069.551] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.551] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1
	[0069.551] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.551] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.551] lstrlenW (lpString=".doc") returned 4
	[0069.551] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.551] lstrlenW (lpString=".docx") returned 5
	[0069.551] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.551] lstrlenW (lpString=".pdf") returned 4
	[0069.552] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.552] lstrlenW (lpString=".xls") returned 4
	[0069.552] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.552] lstrlenW (lpString=".xlsx") returned 5
	[0069.552] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.552] lstrlenW (lpString=".ppt") returned 4
	[0069.552] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.552] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.552] lstrlenW (lpString=".zip") returned 4
	[0069.552] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.552] lstrlenW (lpString=".rar") returned 4
	[0069.552] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.552] lstrlenW (lpString=".bz2") returned 4
	[0069.552] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.552] lstrlenW (lpString=".7z") returned 3
	[0069.552] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.552] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.552] lstrlenW (lpString=".dbf") returned 4
	[0069.552] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.552] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.552] lstrlenW (lpString=".1cd") returned 4
	[0069.552] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.552] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.552] lstrlenW (lpString=".jpg") returned 4
	[0069.552] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.552] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.552] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.553] lstrlenW (lpString=".doc") returned 4
	[0069.553] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.553] lstrlenW (lpString=".docx") returned 5
	[0069.553] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.553] lstrlenW (lpString=".pdf") returned 4
	[0069.553] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.553] lstrlenW (lpString=".xls") returned 4
	[0069.553] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.553] lstrlenW (lpString=".xlsx") returned 5
	[0069.553] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.553] lstrlenW (lpString=".ppt") returned 4
	[0069.553] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.553] lstrlenW (lpString=".zip") returned 4
	[0069.553] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.553] lstrlenW (lpString=".rar") returned 4
	[0069.553] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.553] lstrlenW (lpString=".bz2") returned 4
	[0069.553] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.553] lstrlenW (lpString=".7z") returned 3
	[0069.553] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.553] lstrlenW (lpString=".dbf") returned 4
	[0069.553] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.553] lstrlenW (lpString=".1cd") returned 4
	[0069.553] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0069.553] lstrlenW (lpString=".jpg") returned 4
	[0069.553] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.554] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0069.554] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63
	[0069.554] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.554] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0069.554] CloseHandle (hObject=0x368) returned 1
	[0069.554] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20
	[0069.554] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.554] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.554] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.554] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.554] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.555] GetLastError () returned 0x0
	[0069.555] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0069.558] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0069.560] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.560] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x152, lpOverlapped=0x0) returned 1
	[0069.560] SetEndOfFile (hFile=0x364) returned 1
	[0069.561] CloseHandle (hObject=0x364) returned 1
	[0069.562] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.562] SetEndOfFile (hFile=0x368) returned 1
	[0069.564] CloseHandle (hObject=0x368) returned 1
	[0069.564] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.564] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1
	[0069.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.564] lstrlenW (lpString=".doc") returned 4
	[0069.564] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.564] lstrlenW (lpString=".docx") returned 5
	[0069.564] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.564] lstrlenW (lpString=".pdf") returned 4
	[0069.564] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.564] lstrlenW (lpString=".xls") returned 4
	[0069.565] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.565] lstrlenW (lpString=".xlsx") returned 5
	[0069.565] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.565] lstrlenW (lpString=".ppt") returned 4
	[0069.565] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.565] lstrlenW (lpString=".zip") returned 4
	[0069.565] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.565] lstrlenW (lpString=".rar") returned 4
	[0069.565] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.565] lstrlenW (lpString=".bz2") returned 4
	[0069.565] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.565] lstrlenW (lpString=".7z") returned 3
	[0069.565] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.565] lstrlenW (lpString=".dbf") returned 4
	[0069.565] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.565] lstrlenW (lpString=".1cd") returned 4
	[0069.565] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.565] lstrlenW (lpString=".jpg") returned 4
	[0069.565] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.565] lstrlenW (lpString=".doc") returned 4
	[0069.565] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.565] lstrlenW (lpString=".docx") returned 5
	[0069.565] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.566] lstrlenW (lpString=".pdf") returned 4
	[0069.566] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.566] lstrlenW (lpString=".xls") returned 4
	[0069.566] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.566] lstrlenW (lpString=".xlsx") returned 5
	[0069.566] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.566] lstrlenW (lpString=".ppt") returned 4
	[0069.566] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.566] lstrlenW (lpString=".zip") returned 4
	[0069.566] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.566] lstrlenW (lpString=".rar") returned 4
	[0069.566] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.566] lstrlenW (lpString=".bz2") returned 4
	[0069.566] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.566] lstrlenW (lpString=".7z") returned 3
	[0069.566] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.566] lstrlenW (lpString=".dbf") returned 4
	[0069.566] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.566] lstrlenW (lpString=".1cd") returned 4
	[0069.566] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0069.566] lstrlenW (lpString=".jpg") returned 4
	[0069.566] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.566] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0069.567] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49
	[0069.567] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.567] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0069.567] CloseHandle (hObject=0x368) returned 1
	[0069.567] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20
	[0069.567] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.567] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.567] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.567] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.567] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.568] GetLastError () returned 0x0
	[0069.568] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0069.845] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0069.847] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.847] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x136, lpOverlapped=0x0) returned 1
	[0069.847] SetEndOfFile (hFile=0x364) returned 1
	[0069.847] CloseHandle (hObject=0x364) returned 1
	[0069.849] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.849] SetEndOfFile (hFile=0x368) returned 1
	[0069.851] CloseHandle (hObject=0x368) returned 1
	[0069.851] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.851] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1
	[0069.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.851] lstrlenW (lpString=".doc") returned 4
	[0069.851] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.851] lstrlenW (lpString=".docx") returned 5
	[0069.851] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.851] lstrlenW (lpString=".pdf") returned 4
	[0069.852] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.852] lstrlenW (lpString=".xls") returned 4
	[0069.852] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.852] lstrlenW (lpString=".xlsx") returned 5
	[0069.852] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.852] lstrlenW (lpString=".ppt") returned 4
	[0069.852] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.852] lstrlenW (lpString=".zip") returned 4
	[0069.852] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.852] lstrlenW (lpString=".rar") returned 4
	[0069.852] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.852] lstrlenW (lpString=".bz2") returned 4
	[0069.852] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.852] lstrlenW (lpString=".7z") returned 3
	[0069.852] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.852] lstrlenW (lpString=".dbf") returned 4
	[0069.852] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.852] lstrlenW (lpString=".1cd") returned 4
	[0069.852] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.852] lstrlenW (lpString=".jpg") returned 4
	[0069.852] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.853] lstrlenW (lpString=".doc") returned 4
	[0069.853] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.853] lstrlenW (lpString=".docx") returned 5
	[0069.853] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.853] lstrlenW (lpString=".pdf") returned 4
	[0069.853] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.853] lstrlenW (lpString=".xls") returned 4
	[0069.853] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.853] lstrlenW (lpString=".xlsx") returned 5
	[0069.853] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.853] lstrlenW (lpString=".ppt") returned 4
	[0069.853] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.853] lstrlenW (lpString=".zip") returned 4
	[0069.853] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.853] lstrlenW (lpString=".rar") returned 4
	[0069.853] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.853] lstrlenW (lpString=".bz2") returned 4
	[0069.853] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.853] lstrlenW (lpString=".7z") returned 3
	[0069.853] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.854] lstrlenW (lpString=".dbf") returned 4
	[0069.854] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.854] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.854] lstrlenW (lpString=".1cd") returned 4
	[0069.854] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.854] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0069.854] lstrlenW (lpString=".jpg") returned 4
	[0069.854] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.854] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0069.854] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41
	[0069.854] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.854] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0069.854] CloseHandle (hObject=0x368) returned 1
	[0069.854] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20
	[0069.855] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.855] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.855] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.855] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.855] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.855] GetLastError () returned 0x0
	[0069.855] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0069.858] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0069.860] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.860] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x126, lpOverlapped=0x0) returned 1
	[0069.860] SetEndOfFile (hFile=0x364) returned 1
	[0069.860] CloseHandle (hObject=0x364) returned 1
	[0069.862] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.862] SetEndOfFile (hFile=0x368) returned 1
	[0069.863] CloseHandle (hObject=0x368) returned 1
	[0069.863] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.864] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1
	[0069.864] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.864] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.864] lstrlenW (lpString=".doc") returned 4
	[0069.864] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.864] lstrlenW (lpString=".docx") returned 5
	[0069.864] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.864] lstrlenW (lpString=".pdf") returned 4
	[0069.864] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.864] lstrlenW (lpString=".xls") returned 4
	[0069.864] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.864] lstrlenW (lpString=".xlsx") returned 5
	[0069.864] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.864] lstrlenW (lpString=".ppt") returned 4
	[0069.864] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.864] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.865] lstrlenW (lpString=".zip") returned 4
	[0069.865] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.865] lstrlenW (lpString=".rar") returned 4
	[0069.865] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.865] lstrlenW (lpString=".bz2") returned 4
	[0069.865] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.865] lstrlenW (lpString=".7z") returned 3
	[0069.865] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.865] lstrlenW (lpString=".dbf") returned 4
	[0069.865] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.865] lstrlenW (lpString=".1cd") returned 4
	[0069.865] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.865] lstrlenW (lpString=".jpg") returned 4
	[0069.865] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.865] lstrlenW (lpString=".doc") returned 4
	[0069.865] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.865] lstrlenW (lpString=".docx") returned 5
	[0069.865] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.866] lstrlenW (lpString=".pdf") returned 4
	[0069.866] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.866] lstrlenW (lpString=".xls") returned 4
	[0069.866] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.866] lstrlenW (lpString=".xlsx") returned 5
	[0069.866] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.866] lstrlenW (lpString=".ppt") returned 4
	[0069.866] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.866] lstrlenW (lpString=".zip") returned 4
	[0069.866] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.866] lstrlenW (lpString=".rar") returned 4
	[0069.866] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.866] lstrlenW (lpString=".bz2") returned 4
	[0069.866] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.866] lstrlenW (lpString=".7z") returned 3
	[0069.866] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.866] lstrlenW (lpString=".dbf") returned 4
	[0069.866] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.866] lstrlenW (lpString=".1cd") returned 4
	[0069.866] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0069.866] lstrlenW (lpString=".jpg") returned 4
	[0069.866] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.867] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0069.867] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43
	[0069.867] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.867] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0069.867] CloseHandle (hObject=0x368) returned 1
	[0069.867] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20
	[0069.867] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.867] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0069.867] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.868] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.868] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.868] GetLastError () returned 0x0
	[0069.868] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0069.871] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0069.873] ReadFile (in: hFile=0x368, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.873] WriteFile (in: hFile=0x364, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x12a, lpOverlapped=0x0) returned 1
	[0069.873] SetEndOfFile (hFile=0x364) returned 1
	[0069.873] CloseHandle (hObject=0x364) returned 1
	[0069.875] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.875] SetEndOfFile (hFile=0x368) returned 1
	[0069.876] CloseHandle (hObject=0x368) returned 1
	[0069.877] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.877] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1
	[0069.877] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.877] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.877] lstrlenW (lpString=".doc") returned 4
	[0069.877] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.877] lstrlenW (lpString=".docx") returned 5
	[0069.877] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.877] lstrlenW (lpString=".pdf") returned 4
	[0069.877] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.877] lstrlenW (lpString=".xls") returned 4
	[0069.877] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.877] lstrlenW (lpString=".xlsx") returned 5
	[0069.878] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.878] lstrlenW (lpString=".ppt") returned 4
	[0069.878] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.878] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.878] lstrlenW (lpString=".zip") returned 4
	[0069.878] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.878] lstrlenW (lpString=".rar") returned 4
	[0069.878] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.878] lstrlenW (lpString=".bz2") returned 4
	[0069.878] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.878] lstrlenW (lpString=".7z") returned 3
	[0069.878] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.878] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.878] lstrlenW (lpString=".dbf") returned 4
	[0069.878] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.878] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.878] lstrlenW (lpString=".1cd") returned 4
	[0069.878] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.878] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.878] lstrlenW (lpString=".jpg") returned 4
	[0069.878] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.878] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.879] lstrlenW (lpString=".doc") returned 4
	[0069.879] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.879] lstrlenW (lpString=".docx") returned 5
	[0069.879] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.879] lstrlenW (lpString=".pdf") returned 4
	[0069.879] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.879] lstrlenW (lpString=".xls") returned 4
	[0069.879] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.879] lstrlenW (lpString=".xlsx") returned 5
	[0069.879] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.879] lstrlenW (lpString=".ppt") returned 4
	[0069.879] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.879] lstrlenW (lpString=".zip") returned 4
	[0069.879] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.879] lstrlenW (lpString=".rar") returned 4
	[0069.879] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.879] lstrlenW (lpString=".bz2") returned 4
	[0069.879] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.879] lstrlenW (lpString=".7z") returned 3
	[0069.879] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.879] lstrlenW (lpString=".dbf") returned 4
	[0069.880] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.880] lstrlenW (lpString=".1cd") returned 4
	[0069.880] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0069.880] lstrlenW (lpString=".jpg") returned 4
	[0069.880] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.880] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0069.880] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49
	[0069.880] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.484] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0070.484] CloseHandle (hObject=0x364) returned 1
	[0070.484] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20
	[0070.484] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.484] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.484] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.484] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.484] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0070.485] GetLastError () returned 0x0
	[0070.485] ReadFile (in: hFile=0x364, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0070.487] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0070.489] ReadFile (in: hFile=0x364, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.489] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x136, lpOverlapped=0x0) returned 1
	[0070.489] SetEndOfFile (hFile=0x37c) returned 1
	[0070.489] CloseHandle (hObject=0x37c) returned 1
	[0070.492] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.492] SetEndOfFile (hFile=0x364) returned 1
	[0070.493] CloseHandle (hObject=0x364) returned 1
	[0070.493] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0070.494] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1
	[0070.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.494] lstrlenW (lpString=".doc") returned 4
	[0070.494] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.494] lstrlenW (lpString=".docx") returned 5
	[0070.494] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.494] lstrlenW (lpString=".pdf") returned 4
	[0070.494] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.494] lstrlenW (lpString=".xls") returned 4
	[0070.494] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.494] lstrlenW (lpString=".xlsx") returned 5
	[0070.494] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.494] lstrlenW (lpString=".ppt") returned 4
	[0070.495] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.495] lstrlenW (lpString=".zip") returned 4
	[0070.495] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.495] lstrlenW (lpString=".rar") returned 4
	[0070.495] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.495] lstrlenW (lpString=".bz2") returned 4
	[0070.495] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.495] lstrlenW (lpString=".7z") returned 3
	[0070.495] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.495] lstrlenW (lpString=".dbf") returned 4
	[0070.495] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.495] lstrlenW (lpString=".1cd") returned 4
	[0070.495] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.495] lstrlenW (lpString=".jpg") returned 4
	[0070.495] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.495] lstrlenW (lpString=".doc") returned 4
	[0070.496] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.496] lstrlenW (lpString=".docx") returned 5
	[0070.496] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.496] lstrlenW (lpString=".pdf") returned 4
	[0070.496] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.496] lstrlenW (lpString=".xls") returned 4
	[0070.496] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.496] lstrlenW (lpString=".xlsx") returned 5
	[0070.496] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.496] lstrlenW (lpString=".ppt") returned 4
	[0070.496] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.496] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.496] lstrlenW (lpString=".zip") returned 4
	[0070.496] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.496] lstrlenW (lpString=".rar") returned 4
	[0070.496] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.496] lstrlenW (lpString=".bz2") returned 4
	[0070.496] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.496] lstrlenW (lpString=".7z") returned 3
	[0070.496] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.496] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.497] lstrlenW (lpString=".dbf") returned 4
	[0070.497] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.497] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.497] lstrlenW (lpString=".1cd") returned 4
	[0070.497] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.497] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0070.497] lstrlenW (lpString=".jpg") returned 4
	[0070.497] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.497] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0070.497] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47
	[0070.497] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.498] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0070.498] CloseHandle (hObject=0x364) returned 1
	[0070.498] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20
	[0070.498] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.498] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.498] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.499] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.499] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0070.499] GetLastError () returned 0x0
	[0070.499] ReadFile (in: hFile=0x364, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0070.502] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0070.503] ReadFile (in: hFile=0x364, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.504] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x132, lpOverlapped=0x0) returned 1
	[0070.504] SetEndOfFile (hFile=0x37c) returned 1
	[0070.504] CloseHandle (hObject=0x37c) returned 1
	[0070.506] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.506] SetEndOfFile (hFile=0x364) returned 1
	[0070.507] CloseHandle (hObject=0x364) returned 1
	[0070.507] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0070.508] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1
	[0070.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.508] lstrlenW (lpString=".doc") returned 4
	[0070.508] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.508] lstrlenW (lpString=".docx") returned 5
	[0070.508] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.508] lstrlenW (lpString=".pdf") returned 4
	[0070.508] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.508] lstrlenW (lpString=".xls") returned 4
	[0070.508] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.508] lstrlenW (lpString=".xlsx") returned 5
	[0070.508] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.508] lstrlenW (lpString=".ppt") returned 4
	[0070.508] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.509] lstrlenW (lpString=".zip") returned 4
	[0070.509] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.509] lstrlenW (lpString=".rar") returned 4
	[0070.509] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.509] lstrlenW (lpString=".bz2") returned 4
	[0070.509] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.509] lstrlenW (lpString=".7z") returned 3
	[0070.509] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.509] lstrlenW (lpString=".dbf") returned 4
	[0070.509] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.509] lstrlenW (lpString=".1cd") returned 4
	[0070.509] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.510] lstrlenW (lpString=".jpg") returned 4
	[0070.510] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.510] lstrlenW (lpString=".doc") returned 4
	[0070.510] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.510] lstrlenW (lpString=".docx") returned 5
	[0070.510] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.510] lstrlenW (lpString=".pdf") returned 4
	[0070.510] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.510] lstrlenW (lpString=".xls") returned 4
	[0070.510] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.510] lstrlenW (lpString=".xlsx") returned 5
	[0070.510] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.510] lstrlenW (lpString=".ppt") returned 4
	[0070.510] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.510] lstrlenW (lpString=".zip") returned 4
	[0070.510] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.511] lstrlenW (lpString=".rar") returned 4
	[0070.511] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.511] lstrlenW (lpString=".bz2") returned 4
	[0070.511] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.511] lstrlenW (lpString=".7z") returned 3
	[0070.511] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.511] lstrlenW (lpString=".dbf") returned 4
	[0070.511] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.511] lstrlenW (lpString=".1cd") returned 4
	[0070.511] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0070.511] lstrlenW (lpString=".jpg") returned 4
	[0070.511] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.512] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0070.512] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51
	[0070.512] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.512] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0070.512] CloseHandle (hObject=0x364) returned 1
	[0070.512] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20
	[0070.512] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.512] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.512] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.512] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.513] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0070.513] GetLastError () returned 0x0
	[0070.513] ReadFile (in: hFile=0x364, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0070.516] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0070.518] ReadFile (in: hFile=0x364, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.518] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x13a, lpOverlapped=0x0) returned 1
	[0070.518] SetEndOfFile (hFile=0x37c) returned 1
	[0070.518] CloseHandle (hObject=0x37c) returned 1
	[0070.520] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.521] SetEndOfFile (hFile=0x364) returned 1
	[0070.522] CloseHandle (hObject=0x364) returned 1
	[0070.522] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0070.522] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1
	[0070.522] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.522] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.522] lstrlenW (lpString=".doc") returned 4
	[0070.523] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.523] lstrlenW (lpString=".docx") returned 5
	[0070.523] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.523] lstrlenW (lpString=".pdf") returned 4
	[0070.523] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.523] lstrlenW (lpString=".xls") returned 4
	[0070.523] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.523] lstrlenW (lpString=".xlsx") returned 5
	[0070.523] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.523] lstrlenW (lpString=".ppt") returned 4
	[0070.523] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.523] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.523] lstrlenW (lpString=".zip") returned 4
	[0070.523] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.523] lstrlenW (lpString=".rar") returned 4
	[0070.523] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.523] lstrlenW (lpString=".bz2") returned 4
	[0070.523] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.523] lstrlenW (lpString=".7z") returned 3
	[0070.523] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.523] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.523] lstrlenW (lpString=".dbf") returned 4
	[0070.523] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.523] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.523] lstrlenW (lpString=".1cd") returned 4
	[0070.524] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.524] lstrlenW (lpString=".jpg") returned 4
	[0070.524] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.524] lstrlenW (lpString=".doc") returned 4
	[0070.524] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.524] lstrlenW (lpString=".docx") returned 5
	[0070.524] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.524] lstrlenW (lpString=".pdf") returned 4
	[0070.524] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.524] lstrlenW (lpString=".xls") returned 4
	[0070.524] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.524] lstrlenW (lpString=".xlsx") returned 5
	[0070.524] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.524] lstrlenW (lpString=".ppt") returned 4
	[0070.524] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.524] lstrlenW (lpString=".zip") returned 4
	[0070.524] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.524] lstrlenW (lpString=".rar") returned 4
	[0070.524] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.963] lstrlenW (lpString=".bz2") returned 4
	[0070.963] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.963] lstrlenW (lpString=".7z") returned 3
	[0070.963] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.963] lstrlenW (lpString=".dbf") returned 4
	[0070.963] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.963] lstrlenW (lpString=".1cd") returned 4
	[0070.964] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0070.964] lstrlenW (lpString=".jpg") returned 4
	[0070.964] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.964] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0070.969] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48
	[0070.981] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.993] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=1052672) returned 1
	[0070.993] CloseHandle (hObject=0x380) returned 1
	[0071.001] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20
	[0071.001] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.001] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.001] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.001] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.001] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.001] GetLastError () returned 0x0
	[0071.001] ReadFile (in: hFile=0x380, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0071.023] WriteFile (in: hFile=0x350, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0071.368] ReadFile (in: hFile=0x380, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0071.410] WriteFile (in: hFile=0x350, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0071.414] ReadFile (in: hFile=0x380, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.414] WriteFile (in: hFile=0x350, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x134, lpOverlapped=0x0) returned 1
	[0071.414] SetEndOfFile (hFile=0x350) returned 1
	[0071.741] CloseHandle (hObject=0x350) returned 1
	[0071.859] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.859] SetEndOfFile (hFile=0x380) returned 1
	[0071.860] CloseHandle (hObject=0x380) returned 1
	[0071.860] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.860] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1
	[0071.861] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.861] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.861] lstrlenW (lpString=".doc") returned 4
	[0071.861] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.861] lstrlenW (lpString=".docx") returned 5
	[0071.861] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.861] lstrlenW (lpString=".pdf") returned 4
	[0071.861] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.861] lstrlenW (lpString=".xls") returned 4
	[0071.861] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.861] lstrlenW (lpString=".xlsx") returned 5
	[0071.861] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.861] lstrlenW (lpString=".ppt") returned 4
	[0071.861] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.861] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.861] lstrlenW (lpString=".zip") returned 4
	[0071.861] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.861] lstrlenW (lpString=".rar") returned 4
	[0071.861] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.861] lstrlenW (lpString=".bz2") returned 4
	[0071.861] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.862] lstrlenW (lpString=".7z") returned 3
	[0071.862] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.862] lstrlenW (lpString=".dbf") returned 4
	[0071.862] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.862] lstrlenW (lpString=".1cd") returned 4
	[0071.862] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.862] lstrlenW (lpString=".jpg") returned 4
	[0071.862] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.862] lstrlenW (lpString=".doc") returned 4
	[0071.862] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.862] lstrlenW (lpString=".docx") returned 5
	[0071.862] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.862] lstrlenW (lpString=".pdf") returned 4
	[0071.862] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.862] lstrlenW (lpString=".xls") returned 4
	[0071.862] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.862] lstrlenW (lpString=".xlsx") returned 5
	[0071.862] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.863] lstrlenW (lpString=".ppt") returned 4
	[0071.863] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.863] lstrlenW (lpString=".zip") returned 4
	[0071.863] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.863] lstrlenW (lpString=".rar") returned 4
	[0071.863] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.863] lstrlenW (lpString=".bz2") returned 4
	[0071.863] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.863] lstrlenW (lpString=".7z") returned 3
	[0071.863] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.863] lstrlenW (lpString=".dbf") returned 4
	[0071.863] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.863] lstrlenW (lpString=".1cd") returned 4
	[0071.863] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0071.863] lstrlenW (lpString=".jpg") returned 4
	[0071.863] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.863] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.863] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47
	[0071.864] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.864] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0071.864] CloseHandle (hObject=0x380) returned 1
	[0071.864] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20
	[0071.864] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.864] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.864] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.864] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.864] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.865] GetLastError () returned 0x0
	[0071.865] ReadFile (in: hFile=0x380, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.867] WriteFile (in: hFile=0x350, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.869] ReadFile (in: hFile=0x380, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.870] WriteFile (in: hFile=0x350, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x132, lpOverlapped=0x0) returned 1
	[0071.870] SetEndOfFile (hFile=0x350) returned 1
	[0071.870] CloseHandle (hObject=0x350) returned 1
	[0071.872] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.872] SetEndOfFile (hFile=0x380) returned 1
	[0071.873] CloseHandle (hObject=0x380) returned 1
	[0071.873] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.874] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1
	[0071.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.874] lstrlenW (lpString=".doc") returned 4
	[0071.874] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.874] lstrlenW (lpString=".docx") returned 5
	[0071.874] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.874] lstrlenW (lpString=".pdf") returned 4
	[0071.874] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.874] lstrlenW (lpString=".xls") returned 4
	[0071.874] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.874] lstrlenW (lpString=".xlsx") returned 5
	[0071.875] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.875] lstrlenW (lpString=".ppt") returned 4
	[0071.875] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.875] lstrlenW (lpString=".zip") returned 4
	[0071.875] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.875] lstrlenW (lpString=".rar") returned 4
	[0071.875] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.875] lstrlenW (lpString=".bz2") returned 4
	[0071.875] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.875] lstrlenW (lpString=".7z") returned 3
	[0071.875] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.875] lstrlenW (lpString=".dbf") returned 4
	[0071.875] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.875] lstrlenW (lpString=".1cd") returned 4
	[0071.875] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.875] lstrlenW (lpString=".jpg") returned 4
	[0071.875] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.876] lstrlenW (lpString=".doc") returned 4
	[0071.876] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.876] lstrlenW (lpString=".docx") returned 5
	[0071.876] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.876] lstrlenW (lpString=".pdf") returned 4
	[0071.876] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.876] lstrlenW (lpString=".xls") returned 4
	[0071.876] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.876] lstrlenW (lpString=".xlsx") returned 5
	[0071.876] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.876] lstrlenW (lpString=".ppt") returned 4
	[0071.876] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.876] lstrlenW (lpString=".zip") returned 4
	[0071.876] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.876] lstrlenW (lpString=".rar") returned 4
	[0071.876] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.876] lstrlenW (lpString=".bz2") returned 4
	[0071.876] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.876] lstrlenW (lpString=".7z") returned 3
	[0071.877] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.877] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.877] lstrlenW (lpString=".dbf") returned 4
	[0071.877] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.877] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.877] lstrlenW (lpString=".1cd") returned 4
	[0071.877] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.877] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0071.877] lstrlenW (lpString=".jpg") returned 4
	[0071.877] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.877] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.877] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47
	[0071.877] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.878] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0071.878] CloseHandle (hObject=0x380) returned 1
	[0072.365] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20
	[0072.365] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.365] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.365] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.365] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.365] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.365] GetLastError () returned 0x0
	[0072.365] ReadFile (in: hFile=0x340, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.368] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.370] ReadFile (in: hFile=0x340, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.370] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x132, lpOverlapped=0x0) returned 1
	[0072.370] SetEndOfFile (hFile=0x37c) returned 1
	[0072.370] CloseHandle (hObject=0x37c) returned 1
	[0072.373] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.373] SetEndOfFile (hFile=0x340) returned 1
	[0072.374] CloseHandle (hObject=0x340) returned 1
	[0072.374] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.374] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1
	[0072.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.375] lstrlenW (lpString=".doc") returned 4
	[0072.375] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.375] lstrlenW (lpString=".docx") returned 5
	[0072.375] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.375] lstrlenW (lpString=".pdf") returned 4
	[0072.375] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.375] lstrlenW (lpString=".xls") returned 4
	[0072.375] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.375] lstrlenW (lpString=".xlsx") returned 5
	[0072.375] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.375] lstrlenW (lpString=".ppt") returned 4
	[0072.375] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.375] lstrlenW (lpString=".zip") returned 4
	[0072.375] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.376] lstrlenW (lpString=".rar") returned 4
	[0072.376] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.376] lstrlenW (lpString=".bz2") returned 4
	[0072.376] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.376] lstrlenW (lpString=".7z") returned 3
	[0072.376] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.376] lstrlenW (lpString=".dbf") returned 4
	[0072.376] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.376] lstrlenW (lpString=".1cd") returned 4
	[0072.376] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.376] lstrlenW (lpString=".jpg") returned 4
	[0072.376] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.376] lstrlenW (lpString=".doc") returned 4
	[0072.376] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.377] lstrlenW (lpString=".docx") returned 5
	[0072.377] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.377] lstrlenW (lpString=".pdf") returned 4
	[0072.377] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.377] lstrlenW (lpString=".xls") returned 4
	[0072.377] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.377] lstrlenW (lpString=".xlsx") returned 5
	[0072.377] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.377] lstrlenW (lpString=".ppt") returned 4
	[0072.377] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.377] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.377] lstrlenW (lpString=".zip") returned 4
	[0072.377] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.377] lstrlenW (lpString=".rar") returned 4
	[0072.377] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.377] lstrlenW (lpString=".bz2") returned 4
	[0072.377] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.377] lstrlenW (lpString=".7z") returned 3
	[0072.377] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.377] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.377] lstrlenW (lpString=".dbf") returned 4
	[0072.377] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.377] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.378] lstrlenW (lpString=".1cd") returned 4
	[0072.378] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.378] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0072.378] lstrlenW (lpString=".jpg") returned 4
	[0072.378] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.378] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.378] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46
	[0072.378] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.378] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0072.378] CloseHandle (hObject=0x340) returned 1
	[0072.378] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20
	[0072.379] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.379] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.412] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.412] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.412] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.412] GetLastError () returned 0x0
	[0072.412] ReadFile (in: hFile=0x340, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.415] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.417] ReadFile (in: hFile=0x340, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.417] WriteFile (in: hFile=0x37c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x130, lpOverlapped=0x0) returned 1
	[0072.417] SetEndOfFile (hFile=0x37c) returned 1
	[0072.417] CloseHandle (hObject=0x37c) returned 1
	[0072.419] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.419] SetEndOfFile (hFile=0x340) returned 1
	[0072.420] CloseHandle (hObject=0x340) returned 1
	[0072.421] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.421] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1
	[0072.421] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.421] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.421] lstrlenW (lpString=".doc") returned 4
	[0072.421] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.421] lstrlenW (lpString=".docx") returned 5
	[0072.421] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.421] lstrlenW (lpString=".pdf") returned 4
	[0072.421] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.421] lstrlenW (lpString=".xls") returned 4
	[0072.421] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.421] lstrlenW (lpString=".xlsx") returned 5
	[0072.421] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.421] lstrlenW (lpString=".ppt") returned 4
	[0072.422] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.422] lstrlenW (lpString=".zip") returned 4
	[0072.422] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.422] lstrlenW (lpString=".rar") returned 4
	[0072.422] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.422] lstrlenW (lpString=".bz2") returned 4
	[0072.422] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.422] lstrlenW (lpString=".7z") returned 3
	[0072.422] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.422] lstrlenW (lpString=".dbf") returned 4
	[0072.422] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.422] lstrlenW (lpString=".1cd") returned 4
	[0072.422] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.422] lstrlenW (lpString=".jpg") returned 4
	[0072.422] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.422] lstrlenW (lpString=".doc") returned 4
	[0072.423] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.423] lstrlenW (lpString=".docx") returned 5
	[0072.423] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.423] lstrlenW (lpString=".pdf") returned 4
	[0072.423] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.423] lstrlenW (lpString=".xls") returned 4
	[0072.423] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.423] lstrlenW (lpString=".xlsx") returned 5
	[0072.423] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.423] lstrlenW (lpString=".ppt") returned 4
	[0072.423] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.423] lstrlenW (lpString=".zip") returned 4
	[0072.423] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.423] lstrlenW (lpString=".rar") returned 4
	[0072.423] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.423] lstrlenW (lpString=".bz2") returned 4
	[0072.423] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.423] lstrlenW (lpString=".7z") returned 3
	[0072.423] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.423] lstrlenW (lpString=".dbf") returned 4
	[0072.423] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.424] lstrlenW (lpString=".1cd") returned 4
	[0072.424] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.424] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0072.424] lstrlenW (lpString=".jpg") returned 4
	[0072.424] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.424] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.424] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45
	[0072.424] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.424] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0072.424] CloseHandle (hObject=0x340) returned 1
	[0072.424] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20
	[0072.424] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.424] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.425] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.425] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.425] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0072.426] GetLastError () returned 0x0
	[0072.426] ReadFile (in: hFile=0x340, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.428] WriteFile (in: hFile=0x384, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.430] ReadFile (in: hFile=0x340, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.430] WriteFile (in: hFile=0x384, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0072.431] SetEndOfFile (hFile=0x384) returned 1
	[0072.431] CloseHandle (hObject=0x384) returned 1
	[0072.433] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.433] SetEndOfFile (hFile=0x340) returned 1
	[0072.434] CloseHandle (hObject=0x340) returned 1
	[0072.434] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.435] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1
	[0072.435] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.435] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.435] lstrlenW (lpString=".doc") returned 4
	[0072.435] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.435] lstrlenW (lpString=".docx") returned 5
	[0072.435] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.435] lstrlenW (lpString=".pdf") returned 4
	[0072.435] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.435] lstrlenW (lpString=".xls") returned 4
	[0072.435] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.435] lstrlenW (lpString=".xlsx") returned 5
	[0072.435] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.435] lstrlenW (lpString=".ppt") returned 4
	[0072.435] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.436] lstrlenW (lpString=".zip") returned 4
	[0072.436] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.436] lstrlenW (lpString=".rar") returned 4
	[0072.436] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.436] lstrlenW (lpString=".bz2") returned 4
	[0072.436] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.436] lstrlenW (lpString=".7z") returned 3
	[0072.436] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.436] lstrlenW (lpString=".dbf") returned 4
	[0072.436] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.436] lstrlenW (lpString=".1cd") returned 4
	[0072.436] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.436] lstrlenW (lpString=".jpg") returned 4
	[0072.436] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.437] lstrlenW (lpString=".doc") returned 4
	[0072.437] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.437] lstrlenW (lpString=".docx") returned 5
	[0072.437] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.437] lstrlenW (lpString=".pdf") returned 4
	[0072.437] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.437] lstrlenW (lpString=".xls") returned 4
	[0072.437] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.437] lstrlenW (lpString=".xlsx") returned 5
	[0072.437] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.437] lstrlenW (lpString=".ppt") returned 4
	[0072.437] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.437] lstrlenW (lpString=".zip") returned 4
	[0072.437] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.437] lstrlenW (lpString=".rar") returned 4
	[0072.437] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.437] lstrlenW (lpString=".bz2") returned 4
	[0072.437] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.437] lstrlenW (lpString=".7z") returned 3
	[0072.437] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.437] lstrlenW (lpString=".dbf") returned 4
	[0072.437] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.437] lstrlenW (lpString=".1cd") returned 4
	[0072.438] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.438] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0072.438] lstrlenW (lpString=".jpg") returned 4
	[0072.438] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.438] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.438] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42
	[0072.438] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.438] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0072.438] CloseHandle (hObject=0x340) returned 1
	[0072.438] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20
	[0072.438] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.438] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0072.439] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.439] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.439] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0072.439] GetLastError () returned 0x0
	[0072.439] ReadFile (in: hFile=0x340, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.782] WriteFile (in: hFile=0x384, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.784] ReadFile (in: hFile=0x340, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.784] WriteFile (in: hFile=0x384, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x128, lpOverlapped=0x0) returned 1
	[0072.784] SetEndOfFile (hFile=0x384) returned 1
	[0073.264] CloseHandle (hObject=0x384) returned 1
	[0073.331] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.331] SetEndOfFile (hFile=0x340) returned 1
	[0073.878] CloseHandle (hObject=0x340) returned 1
	[0073.910] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0073.911] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1
	[0073.911] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.911] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.911] lstrlenW (lpString=".doc") returned 4
	[0073.911] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.911] lstrlenW (lpString=".docx") returned 5
	[0073.911] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.911] lstrlenW (lpString=".pdf") returned 4
	[0073.911] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.911] lstrlenW (lpString=".xls") returned 4
	[0073.911] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.911] lstrlenW (lpString=".xlsx") returned 5
	[0073.911] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.911] lstrlenW (lpString=".ppt") returned 4
	[0073.911] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.911] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.911] lstrlenW (lpString=".zip") returned 4
	[0073.911] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.912] lstrlenW (lpString=".rar") returned 4
	[0073.912] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.912] lstrlenW (lpString=".bz2") returned 4
	[0073.912] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.912] lstrlenW (lpString=".7z") returned 3
	[0073.912] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.912] lstrlenW (lpString=".dbf") returned 4
	[0073.912] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.912] lstrlenW (lpString=".1cd") returned 4
	[0073.912] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.912] lstrlenW (lpString=".jpg") returned 4
	[0073.912] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.912] lstrlenW (lpString=".doc") returned 4
	[0073.912] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.912] lstrlenW (lpString=".docx") returned 5
	[0073.912] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.912] lstrlenW (lpString=".pdf") returned 4
	[0073.912] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.912] lstrlenW (lpString=".xls") returned 4
	[0073.912] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.913] lstrlenW (lpString=".xlsx") returned 5
	[0073.913] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.913] lstrlenW (lpString=".ppt") returned 4
	[0073.913] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.913] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.913] lstrlenW (lpString=".zip") returned 4
	[0073.913] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.913] lstrlenW (lpString=".rar") returned 4
	[0073.913] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.913] lstrlenW (lpString=".bz2") returned 4
	[0073.913] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.913] lstrlenW (lpString=".7z") returned 3
	[0073.913] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.913] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.913] lstrlenW (lpString=".dbf") returned 4
	[0073.913] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.913] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.913] lstrlenW (lpString=".1cd") returned 4
	[0073.913] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.913] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0073.913] lstrlenW (lpString=".jpg") returned 4
	[0073.913] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.914] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0073.914] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72
	[0073.914] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.914] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=1052672) returned 1
	[0073.914] CloseHandle (hObject=0x318) returned 1
	[0073.914] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20
	[0073.915] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.915] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.915] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.915] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.915] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0073.915] GetLastError () returned 0x0
	[0073.915] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0073.938] WriteFile (in: hFile=0x374, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0074.299] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0074.334] WriteFile (in: hFile=0x374, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0074.338] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.338] WriteFile (in: hFile=0x374, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x164, lpOverlapped=0x0) returned 1
	[0074.338] SetEndOfFile (hFile=0x374) returned 1
	[0074.338] CloseHandle (hObject=0x374) returned 1
	[0074.864] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.864] SetEndOfFile (hFile=0x318) returned 1
	[0074.866] CloseHandle (hObject=0x318) returned 1
	[0074.866] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0074.867] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1
	[0074.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.867] lstrlenW (lpString=".doc") returned 4
	[0074.868] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.868] lstrlenW (lpString=".docx") returned 5
	[0074.868] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.868] lstrlenW (lpString=".pdf") returned 4
	[0074.868] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.868] lstrlenW (lpString=".xls") returned 4
	[0074.868] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.868] lstrlenW (lpString=".xlsx") returned 5
	[0074.868] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.868] lstrlenW (lpString=".ppt") returned 4
	[0074.868] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.868] lstrlenW (lpString=".zip") returned 4
	[0074.869] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.869] lstrlenW (lpString=".rar") returned 4
	[0074.869] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.869] lstrlenW (lpString=".bz2") returned 4
	[0074.869] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.869] lstrlenW (lpString=".7z") returned 3
	[0074.869] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.869] lstrlenW (lpString=".dbf") returned 4
	[0074.869] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.869] lstrlenW (lpString=".1cd") returned 4
	[0074.869] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.869] lstrlenW (lpString=".jpg") returned 4
	[0074.869] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.870] lstrlenW (lpString=".doc") returned 4
	[0074.870] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.870] lstrlenW (lpString=".docx") returned 5
	[0074.870] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.870] lstrlenW (lpString=".pdf") returned 4
	[0074.870] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.870] lstrlenW (lpString=".xls") returned 4
	[0074.870] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.870] lstrlenW (lpString=".xlsx") returned 5
	[0074.870] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.870] lstrlenW (lpString=".ppt") returned 4
	[0074.870] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.870] lstrlenW (lpString=".zip") returned 4
	[0074.871] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.871] lstrlenW (lpString=".rar") returned 4
	[0074.871] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.871] lstrlenW (lpString=".bz2") returned 4
	[0074.871] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.871] lstrlenW (lpString=".7z") returned 3
	[0074.871] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.871] lstrlenW (lpString=".dbf") returned 4
	[0074.871] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.871] lstrlenW (lpString=".1cd") returned 4
	[0074.871] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0074.871] lstrlenW (lpString=".jpg") returned 4
	[0074.871] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.872] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0074.872] lstrlenW (lpString="Windows PowerShell.evtx") returned 23
	[0074.872] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0074.872] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=69632) returned 1
	[0074.872] CloseHandle (hObject=0x318) returned 1
	[0074.872] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20
	[0074.873] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.873] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0074.873] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.873] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.873] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0074.873] GetLastError () returned 0x0
	[0074.874] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.876] WriteFile (in: hFile=0x374, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.878] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.878] WriteFile (in: hFile=0x374, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x102, lpOverlapped=0x0) returned 1
	[0074.878] SetEndOfFile (hFile=0x374) returned 1
	[0074.878] CloseHandle (hObject=0x374) returned 1
	[0074.886] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.886] SetEndOfFile (hFile=0x318) returned 1
	[0074.887] CloseHandle (hObject=0x318) returned 1
	[0074.887] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0074.887] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1
	[0074.888] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.888] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.888] lstrlenW (lpString=".doc") returned 4
	[0074.888] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.888] lstrlenW (lpString=".docx") returned 5
	[0074.888] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.888] lstrlenW (lpString=".pdf") returned 4
	[0074.888] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.888] lstrlenW (lpString=".xls") returned 4
	[0074.888] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.888] lstrlenW (lpString=".xlsx") returned 5
	[0074.888] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.888] lstrlenW (lpString=".ppt") returned 4
	[0074.888] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.888] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.888] lstrlenW (lpString=".zip") returned 4
	[0074.889] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.889] lstrlenW (lpString=".rar") returned 4
	[0074.889] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.889] lstrlenW (lpString=".bz2") returned 4
	[0074.889] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.889] lstrlenW (lpString=".7z") returned 3
	[0074.889] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.889] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.889] lstrlenW (lpString=".dbf") returned 4
	[0074.889] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.889] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.889] lstrlenW (lpString=".1cd") returned 4
	[0074.889] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.889] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.889] lstrlenW (lpString=".jpg") returned 4
	[0074.889] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.889] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.889] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.890] lstrlenW (lpString=".doc") returned 4
	[0074.890] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.890] lstrlenW (lpString=".docx") returned 5
	[0074.890] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.890] lstrlenW (lpString=".pdf") returned 4
	[0074.890] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.890] lstrlenW (lpString=".xls") returned 4
	[0074.890] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.890] lstrlenW (lpString=".xlsx") returned 5
	[0074.890] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.890] lstrlenW (lpString=".ppt") returned 4
	[0074.890] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.890] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.890] lstrlenW (lpString=".zip") returned 4
	[0074.890] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.890] lstrlenW (lpString=".rar") returned 4
	[0074.890] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.890] lstrlenW (lpString=".bz2") returned 4
	[0074.891] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.891] lstrlenW (lpString=".7z") returned 3
	[0074.891] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.891] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.891] lstrlenW (lpString=".dbf") returned 4
	[0074.891] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.891] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.891] lstrlenW (lpString=".1cd") returned 4
	[0074.891] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.891] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0074.891] lstrlenW (lpString=".jpg") returned 4
	[0074.891] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.892] lstrcmpiW (lpString1=".sys", lpString2=".money") returned 1
	[0074.892] lstrlenW (lpString="pagefile.sys") returned 12
	[0074.892] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.892] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.892] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.892] lstrlenW (lpString=".doc") returned 4
	[0074.892] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0074.892] lstrlenW (lpString=".docx") returned 5
	[0074.892] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0074.892] lstrlenW (lpString=".pdf") returned 4
	[0074.892] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0074.892] lstrlenW (lpString=".xls") returned 4
	[0074.892] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0074.892] lstrlenW (lpString=".xlsx") returned 5
	[0074.892] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0074.892] lstrlenW (lpString=".ppt") returned 4
	[0074.892] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0074.893] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.893] lstrlenW (lpString=".zip") returned 4
	[0074.893] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0074.893] lstrlenW (lpString=".rar") returned 4
	[0074.893] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0074.893] lstrlenW (lpString=".bz2") returned 4
	[0074.893] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0074.893] lstrlenW (lpString=".7z") returned 3
	[0074.893] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0074.893] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.893] lstrlenW (lpString=".dbf") returned 4
	[0074.893] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0074.893] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.893] lstrlenW (lpString=".1cd") returned 4
	[0074.893] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0074.893] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.893] lstrlenW (lpString=".jpg") returned 4
	[0074.893] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0074.894] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.894] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.894] lstrlenW (lpString=".doc") returned 4
	[0074.894] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0074.894] lstrlenW (lpString=".docx") returned 5
	[0074.894] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0074.894] lstrlenW (lpString=".pdf") returned 4
	[0074.894] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0074.894] lstrlenW (lpString=".xls") returned 4
	[0074.894] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0074.894] lstrlenW (lpString=".xlsx") returned 5
	[0074.894] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0074.894] lstrlenW (lpString=".ppt") returned 4
	[0074.894] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0074.894] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.895] lstrlenW (lpString=".zip") returned 4
	[0074.895] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0074.895] lstrlenW (lpString=".rar") returned 4
	[0074.895] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0074.895] lstrlenW (lpString=".bz2") returned 4
	[0074.895] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0074.895] lstrlenW (lpString=".7z") returned 3
	[0074.895] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0074.895] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.895] lstrlenW (lpString=".dbf") returned 4
	[0074.895] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0074.895] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.895] lstrlenW (lpString=".1cd") returned 4
	[0074.895] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0074.895] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0074.895] lstrlenW (lpString=".jpg") returned 4
	[0074.896] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0074.896] lstrcmpiW (lpString1=".OLB", lpString2=".money") returned 1
	[0074.896] lstrlenW (lpString="MSADDNDR.OLB") returned 12
	[0074.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0074.897] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=15984) returned 1
	[0074.897] CloseHandle (hObject=0x318) returned 1
	[0074.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20
	[0074.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0074.897] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.898] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0075.168] GetLastError () returned 0x0
	[0075.168] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x3e70, lpOverlapped=0x0) returned 1
	[0075.170] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x3e80, lpOverlapped=0x0) returned 1
	[0075.171] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.172] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.172] SetEndOfFile (hFile=0x378) returned 1
	[0075.172] CloseHandle (hObject=0x378) returned 1
	[0075.173] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.173] SetEndOfFile (hFile=0x318) returned 1
	[0075.174] CloseHandle (hObject=0x318) returned 1
	[0075.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.174] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1
	[0075.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.175] lstrlenW (lpString=".doc") returned 4
	[0075.175] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1
	[0075.175] lstrlenW (lpString=".docx") returned 5
	[0075.175] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1
	[0075.175] lstrlenW (lpString=".pdf") returned 4
	[0075.175] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1
	[0075.175] lstrlenW (lpString=".xls") returned 4
	[0075.175] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1
	[0075.175] lstrlenW (lpString=".xlsx") returned 5
	[0075.175] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1
	[0075.175] lstrlenW (lpString=".ppt") returned 4
	[0075.175] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1
	[0075.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.175] lstrlenW (lpString=".zip") returned 4
	[0075.175] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1
	[0075.175] lstrlenW (lpString=".rar") returned 4
	[0075.175] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1
	[0075.175] lstrlenW (lpString=".bz2") returned 4
	[0075.175] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1
	[0075.175] lstrlenW (lpString=".7z") returned 3
	[0075.175] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1
	[0075.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.175] lstrlenW (lpString=".dbf") returned 4
	[0075.175] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1
	[0075.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.176] lstrlenW (lpString=".1cd") returned 4
	[0075.176] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1
	[0075.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.176] lstrlenW (lpString=".jpg") returned 4
	[0075.176] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1
	[0075.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.176] lstrlenW (lpString=".doc") returned 4
	[0075.176] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1
	[0075.176] lstrlenW (lpString=".docx") returned 5
	[0075.176] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1
	[0075.176] lstrlenW (lpString=".pdf") returned 4
	[0075.176] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1
	[0075.176] lstrlenW (lpString=".xls") returned 4
	[0075.176] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1
	[0075.176] lstrlenW (lpString=".xlsx") returned 5
	[0075.176] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1
	[0075.176] lstrlenW (lpString=".ppt") returned 4
	[0075.176] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1
	[0075.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.176] lstrlenW (lpString=".zip") returned 4
	[0075.177] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1
	[0075.177] lstrlenW (lpString=".rar") returned 4
	[0075.177] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1
	[0075.177] lstrlenW (lpString=".bz2") returned 4
	[0075.177] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1
	[0075.177] lstrlenW (lpString=".7z") returned 3
	[0075.177] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1
	[0075.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.177] lstrlenW (lpString=".dbf") returned 4
	[0075.177] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1
	[0075.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.177] lstrlenW (lpString=".1cd") returned 4
	[0075.177] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1
	[0075.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0075.177] lstrlenW (lpString=".jpg") returned 4
	[0075.177] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1
	[0075.177] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.177] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41
	[0075.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0075.178] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=19136) returned 1
	[0075.178] CloseHandle (hObject=0x318) returned 1
	[0075.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20
	[0075.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0075.178] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.178] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0075.179] GetLastError () returned 0x0
	[0075.180] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0075.181] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0075.182] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.182] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x126, lpOverlapped=0x0) returned 1
	[0075.182] SetEndOfFile (hFile=0x378) returned 1
	[0075.183] CloseHandle (hObject=0x378) returned 1
	[0075.187] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.187] SetEndOfFile (hFile=0x318) returned 1
	[0075.188] CloseHandle (hObject=0x318) returned 1
	[0075.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.189] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1
	[0075.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.189] lstrlenW (lpString=".doc") returned 4
	[0075.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.189] lstrlenW (lpString=".docx") returned 5
	[0075.189] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0075.189] lstrlenW (lpString=".pdf") returned 4
	[0075.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.189] lstrlenW (lpString=".xls") returned 4
	[0075.189] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.190] lstrlenW (lpString=".xlsx") returned 5
	[0075.190] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0075.190] lstrlenW (lpString=".ppt") returned 4
	[0075.190] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.190] lstrlenW (lpString=".zip") returned 4
	[0075.190] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.190] lstrlenW (lpString=".rar") returned 4
	[0075.190] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.190] lstrlenW (lpString=".bz2") returned 4
	[0075.190] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.190] lstrlenW (lpString=".7z") returned 3
	[0075.190] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.190] lstrlenW (lpString=".dbf") returned 4
	[0075.190] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.190] lstrlenW (lpString=".1cd") returned 4
	[0075.190] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.190] lstrlenW (lpString=".jpg") returned 4
	[0075.190] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.190] lstrlenW (lpString=".doc") returned 4
	[0075.190] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.190] lstrlenW (lpString=".docx") returned 5
	[0075.191] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0075.191] lstrlenW (lpString=".pdf") returned 4
	[0075.191] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.191] lstrlenW (lpString=".xls") returned 4
	[0075.191] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.191] lstrlenW (lpString=".xlsx") returned 5
	[0075.191] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0075.191] lstrlenW (lpString=".ppt") returned 4
	[0075.191] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.191] lstrlenW (lpString=".zip") returned 4
	[0075.191] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.191] lstrlenW (lpString=".rar") returned 4
	[0075.191] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.191] lstrlenW (lpString=".bz2") returned 4
	[0075.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.191] lstrlenW (lpString=".7z") returned 3
	[0075.192] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.192] lstrlenW (lpString=".dbf") returned 4
	[0075.192] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.192] lstrlenW (lpString=".1cd") returned 4
	[0075.192] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0075.192] lstrlenW (lpString=".jpg") returned 4
	[0075.192] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.192] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.192] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32
	[0075.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0075.192] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=19136) returned 1
	[0075.193] CloseHandle (hObject=0x318) returned 1
	[0075.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20
	[0075.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0075.193] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.193] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0075.193] GetLastError () returned 0x0
	[0075.193] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0075.195] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0075.196] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.196] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x114, lpOverlapped=0x0) returned 1
	[0075.196] SetEndOfFile (hFile=0x378) returned 1
	[0075.196] CloseHandle (hObject=0x378) returned 1
	[0075.198] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.198] SetEndOfFile (hFile=0x318) returned 1
	[0075.199] CloseHandle (hObject=0x318) returned 1
	[0075.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.200] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1
	[0075.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.200] lstrlenW (lpString=".doc") returned 4
	[0075.200] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.200] lstrlenW (lpString=".docx") returned 5
	[0075.200] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.200] lstrlenW (lpString=".pdf") returned 4
	[0075.200] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.200] lstrlenW (lpString=".xls") returned 4
	[0075.200] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.200] lstrlenW (lpString=".xlsx") returned 5
	[0075.200] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.201] lstrlenW (lpString=".ppt") returned 4
	[0075.201] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.201] lstrlenW (lpString=".zip") returned 4
	[0075.201] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.201] lstrlenW (lpString=".rar") returned 4
	[0075.201] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.201] lstrlenW (lpString=".bz2") returned 4
	[0075.201] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.201] lstrlenW (lpString=".7z") returned 3
	[0075.201] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.201] lstrlenW (lpString=".dbf") returned 4
	[0075.201] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.201] lstrlenW (lpString=".1cd") returned 4
	[0075.201] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.201] lstrlenW (lpString=".jpg") returned 4
	[0075.201] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.201] lstrlenW (lpString=".doc") returned 4
	[0075.201] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.201] lstrlenW (lpString=".docx") returned 5
	[0075.201] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.201] lstrlenW (lpString=".pdf") returned 4
	[0075.202] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.202] lstrlenW (lpString=".xls") returned 4
	[0075.202] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.202] lstrlenW (lpString=".xlsx") returned 5
	[0075.202] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.202] lstrlenW (lpString=".ppt") returned 4
	[0075.202] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.202] lstrlenW (lpString=".zip") returned 4
	[0075.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.202] lstrlenW (lpString=".rar") returned 4
	[0075.202] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.202] lstrlenW (lpString=".bz2") returned 4
	[0075.202] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.202] lstrlenW (lpString=".7z") returned 3
	[0075.202] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.202] lstrlenW (lpString=".dbf") returned 4
	[0075.202] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.202] lstrlenW (lpString=".1cd") returned 4
	[0075.202] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0075.202] lstrlenW (lpString=".jpg") returned 4
	[0075.202] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.202] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.203] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35
	[0075.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0075.237] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=18624) returned 1
	[0075.237] CloseHandle (hObject=0x38c) returned 1
	[0075.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20
	[0075.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0075.237] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.238] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.004] GetLastError () returned 0x0
	[0076.004] ReadFile (in: hFile=0x38c, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0076.006] WriteFile (in: hFile=0x370, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0076.007] ReadFile (in: hFile=0x38c, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.007] WriteFile (in: hFile=0x370, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0076.008] SetEndOfFile (hFile=0x370) returned 1
	[0076.008] CloseHandle (hObject=0x370) returned 1
	[0076.009] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.009] SetEndOfFile (hFile=0x38c) returned 1
	[0076.010] CloseHandle (hObject=0x38c) returned 1
	[0076.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0076.010] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1
	[0076.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.011] lstrlenW (lpString=".doc") returned 4
	[0076.011] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.011] lstrlenW (lpString=".docx") returned 5
	[0076.011] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0076.011] lstrlenW (lpString=".pdf") returned 4
	[0076.011] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.011] lstrlenW (lpString=".xls") returned 4
	[0076.011] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.011] lstrlenW (lpString=".xlsx") returned 5
	[0076.011] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0076.011] lstrlenW (lpString=".ppt") returned 4
	[0076.011] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.011] lstrlenW (lpString=".zip") returned 4
	[0076.011] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.011] lstrlenW (lpString=".rar") returned 4
	[0076.011] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.011] lstrlenW (lpString=".bz2") returned 4
	[0076.011] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.011] lstrlenW (lpString=".7z") returned 3
	[0076.011] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.011] lstrlenW (lpString=".dbf") returned 4
	[0076.011] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.011] lstrlenW (lpString=".1cd") returned 4
	[0076.012] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.012] lstrlenW (lpString=".jpg") returned 4
	[0076.012] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.012] lstrlenW (lpString=".doc") returned 4
	[0076.012] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.012] lstrlenW (lpString=".docx") returned 5
	[0076.012] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0076.012] lstrlenW (lpString=".pdf") returned 4
	[0076.012] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.012] lstrlenW (lpString=".xls") returned 4
	[0076.012] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.012] lstrlenW (lpString=".xlsx") returned 5
	[0076.012] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0076.012] lstrlenW (lpString=".ppt") returned 4
	[0076.012] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.012] lstrlenW (lpString=".zip") returned 4
	[0076.012] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.012] lstrlenW (lpString=".rar") returned 4
	[0076.012] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.012] lstrlenW (lpString=".bz2") returned 4
	[0076.012] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.012] lstrlenW (lpString=".7z") returned 3
	[0076.012] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.012] lstrlenW (lpString=".dbf") returned 4
	[0076.012] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.013] lstrlenW (lpString=".1cd") returned 4
	[0076.013] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0076.013] lstrlenW (lpString=".jpg") returned 4
	[0076.013] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.013] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.013] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26
	[0076.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.013] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=307416) returned 1
	[0076.013] CloseHandle (hObject=0x38c) returned 1
	[0076.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20
	[0076.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.014] lstrlenW (lpString=".doc") returned 4
	[0076.014] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.014] lstrlenW (lpString=".docx") returned 5
	[0076.014] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0076.014] lstrlenW (lpString=".pdf") returned 4
	[0076.014] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.014] lstrlenW (lpString=".xls") returned 4
	[0076.014] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.014] lstrlenW (lpString=".xlsx") returned 5
	[0076.014] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0076.014] lstrlenW (lpString=".ppt") returned 4
	[0076.014] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.014] lstrlenW (lpString=".zip") returned 4
	[0076.014] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.014] lstrlenW (lpString=".rar") returned 4
	[0076.014] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.014] lstrlenW (lpString=".bz2") returned 4
	[0076.014] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.014] lstrlenW (lpString=".7z") returned 3
	[0076.014] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.015] lstrlenW (lpString=".dbf") returned 4
	[0076.015] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.015] lstrlenW (lpString=".1cd") returned 4
	[0076.015] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.015] lstrlenW (lpString=".jpg") returned 4
	[0076.015] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.015] lstrlenW (lpString=".doc") returned 4
	[0076.015] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.015] lstrlenW (lpString=".docx") returned 5
	[0076.015] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0076.015] lstrlenW (lpString=".pdf") returned 4
	[0076.015] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.015] lstrlenW (lpString=".xls") returned 4
	[0076.015] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.015] lstrlenW (lpString=".xlsx") returned 5
	[0076.015] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0076.015] lstrlenW (lpString=".ppt") returned 4
	[0076.015] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.015] lstrlenW (lpString=".zip") returned 4
	[0076.015] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.015] lstrlenW (lpString=".rar") returned 4
	[0076.015] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.015] lstrlenW (lpString=".bz2") returned 4
	[0076.016] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.016] lstrlenW (lpString=".7z") returned 3
	[0076.016] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.016] lstrlenW (lpString=".dbf") returned 4
	[0076.016] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.016] lstrlenW (lpString=".1cd") returned 4
	[0076.016] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0076.016] lstrlenW (lpString=".jpg") returned 4
	[0076.016] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.016] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.016] lstrlenW (lpString="AppVIntegration.dll") returned 19
	[0076.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.016] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=2118360) returned 1
	[0076.016] CloseHandle (hObject=0x38c) returned 1
	[0076.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20
	[0076.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[admin@stex777.com].money")) returned 1
	[0076.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0076.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[admin@stex777.com].money"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1
	[0076.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.018] lstrlenW (lpString=".doc") returned 4
	[0076.018] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.018] lstrlenW (lpString=".docx") returned 5
	[0076.018] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0076.018] lstrlenW (lpString=".pdf") returned 4
	[0076.018] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.018] lstrlenW (lpString=".xls") returned 4
	[0076.018] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.018] lstrlenW (lpString=".xlsx") returned 5
	[0076.018] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0076.019] lstrlenW (lpString=".ppt") returned 4
	[0076.019] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.019] lstrlenW (lpString=".zip") returned 4
	[0076.019] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.019] lstrlenW (lpString=".rar") returned 4
	[0076.019] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.019] lstrlenW (lpString=".bz2") returned 4
	[0076.019] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.019] lstrlenW (lpString=".7z") returned 3
	[0076.019] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.019] lstrlenW (lpString=".dbf") returned 4
	[0076.019] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.019] lstrlenW (lpString=".1cd") returned 4
	[0076.019] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.019] lstrlenW (lpString=".jpg") returned 4
	[0076.019] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.020] lstrlenW (lpString=".doc") returned 4
	[0076.020] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.020] lstrlenW (lpString=".docx") returned 5
	[0076.020] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0076.020] lstrlenW (lpString=".pdf") returned 4
	[0076.020] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.020] lstrlenW (lpString=".xls") returned 4
	[0076.020] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.020] lstrlenW (lpString=".xlsx") returned 5
	[0076.020] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0076.020] lstrlenW (lpString=".ppt") returned 4
	[0076.020] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.020] lstrlenW (lpString=".zip") returned 4
	[0076.020] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.020] lstrlenW (lpString=".rar") returned 4
	[0076.020] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.020] lstrlenW (lpString=".bz2") returned 4
	[0076.020] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.020] lstrlenW (lpString=".7z") returned 3
	[0076.020] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.020] lstrlenW (lpString=".dbf") returned 4
	[0076.020] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.020] lstrlenW (lpString=".1cd") returned 4
	[0076.020] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0076.021] lstrlenW (lpString=".jpg") returned 4
	[0076.021] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.021] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.021] lstrlenW (lpString="AppVIsvApi.dll") returned 14
	[0076.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.021] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=468696) returned 1
	[0076.021] CloseHandle (hObject=0x38c) returned 1
	[0076.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20
	[0076.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.022] lstrlenW (lpString=".doc") returned 4
	[0076.022] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.022] lstrlenW (lpString=".docx") returned 5
	[0076.022] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0076.022] lstrlenW (lpString=".pdf") returned 4
	[0076.022] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.022] lstrlenW (lpString=".xls") returned 4
	[0076.022] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.022] lstrlenW (lpString=".xlsx") returned 5
	[0076.022] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0076.022] lstrlenW (lpString=".ppt") returned 4
	[0076.022] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.022] lstrlenW (lpString=".zip") returned 4
	[0076.022] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.022] lstrlenW (lpString=".rar") returned 4
	[0076.022] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.022] lstrlenW (lpString=".bz2") returned 4
	[0076.022] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.022] lstrlenW (lpString=".7z") returned 3
	[0076.022] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.022] lstrlenW (lpString=".dbf") returned 4
	[0076.023] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.023] lstrlenW (lpString=".1cd") returned 4
	[0076.023] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.023] lstrlenW (lpString=".jpg") returned 4
	[0076.023] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.023] lstrlenW (lpString=".doc") returned 4
	[0076.023] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.023] lstrlenW (lpString=".docx") returned 5
	[0076.023] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0076.023] lstrlenW (lpString=".pdf") returned 4
	[0076.023] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.023] lstrlenW (lpString=".xls") returned 4
	[0076.023] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.023] lstrlenW (lpString=".xlsx") returned 5
	[0076.023] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0076.023] lstrlenW (lpString=".ppt") returned 4
	[0076.023] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.024] lstrlenW (lpString=".zip") returned 4
	[0076.024] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.024] lstrlenW (lpString=".rar") returned 4
	[0076.024] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.024] lstrlenW (lpString=".bz2") returned 4
	[0076.024] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.024] lstrlenW (lpString=".7z") returned 3
	[0076.024] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.024] lstrlenW (lpString=".dbf") returned 4
	[0076.024] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.024] lstrlenW (lpString=".1cd") returned 4
	[0076.024] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0076.024] lstrlenW (lpString=".jpg") returned 4
	[0076.024] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.025] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.025] lstrlenW (lpString="AppvIsvStream32.dll") returned 19
	[0076.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.025] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=396960) returned 1
	[0076.025] CloseHandle (hObject=0x38c) returned 1
	[0076.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20
	[0076.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.025] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.026] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.026] GetLastError () returned 0x0
	[0076.026] ReadFile (in: hFile=0x38c, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x60ea0, lpOverlapped=0x0) returned 1
	[0076.035] WriteFile (in: hFile=0x370, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x60eb0, lpOverlapped=0x0) returned 1
	[0076.043] ReadFile (in: hFile=0x38c, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.043] WriteFile (in: hFile=0x370, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0076.044] SetEndOfFile (hFile=0x370) returned 1
	[0076.044] CloseHandle (hObject=0x370) returned 1
	[0076.362] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.362] SetEndOfFile (hFile=0x38c) returned 1
	[0076.366] CloseHandle (hObject=0x38c) returned 1
	[0076.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0076.366] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1
	[0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.367] lstrlenW (lpString=".doc") returned 4
	[0076.367] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.367] lstrlenW (lpString=".docx") returned 5
	[0076.367] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0076.367] lstrlenW (lpString=".pdf") returned 4
	[0076.367] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.367] lstrlenW (lpString=".xls") returned 4
	[0076.367] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.367] lstrlenW (lpString=".xlsx") returned 5
	[0076.367] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0076.367] lstrlenW (lpString=".ppt") returned 4
	[0076.367] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.367] lstrlenW (lpString=".zip") returned 4
	[0076.367] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.367] lstrlenW (lpString=".rar") returned 4
	[0076.367] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.367] lstrlenW (lpString=".bz2") returned 4
	[0076.367] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.367] lstrlenW (lpString=".7z") returned 3
	[0076.367] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.367] lstrlenW (lpString=".dbf") returned 4
	[0076.367] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.367] lstrlenW (lpString=".1cd") returned 4
	[0076.367] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.368] lstrlenW (lpString=".jpg") returned 4
	[0076.368] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.368] lstrlenW (lpString=".doc") returned 4
	[0076.368] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.368] lstrlenW (lpString=".docx") returned 5
	[0076.368] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0076.368] lstrlenW (lpString=".pdf") returned 4
	[0076.368] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.368] lstrlenW (lpString=".xls") returned 4
	[0076.368] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.368] lstrlenW (lpString=".xlsx") returned 5
	[0076.368] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0076.368] lstrlenW (lpString=".ppt") returned 4
	[0076.368] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.368] lstrlenW (lpString=".zip") returned 4
	[0076.368] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.368] lstrlenW (lpString=".rar") returned 4
	[0076.368] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.368] lstrlenW (lpString=".bz2") returned 4
	[0076.368] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.368] lstrlenW (lpString=".7z") returned 3
	[0076.368] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.369] lstrlenW (lpString=".dbf") returned 4
	[0076.369] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.369] lstrlenW (lpString=".1cd") returned 4
	[0076.369] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0076.369] lstrlenW (lpString=".jpg") returned 4
	[0076.369] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.369] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.369] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25
	[0076.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.429] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=567512) returned 1
	[0076.429] CloseHandle (hObject=0x38c) returned 1
	[0076.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20
	[0076.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.430] lstrlenW (lpString=".doc") returned 4
	[0076.430] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.430] lstrlenW (lpString=".docx") returned 5
	[0076.430] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0076.430] lstrlenW (lpString=".pdf") returned 4
	[0076.430] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.430] lstrlenW (lpString=".xls") returned 4
	[0076.430] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.430] lstrlenW (lpString=".xlsx") returned 5
	[0076.430] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0076.430] lstrlenW (lpString=".ppt") returned 4
	[0076.430] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.430] lstrlenW (lpString=".zip") returned 4
	[0076.430] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.430] lstrlenW (lpString=".rar") returned 4
	[0076.430] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.431] lstrlenW (lpString=".bz2") returned 4
	[0076.431] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.431] lstrlenW (lpString=".7z") returned 3
	[0076.431] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.431] lstrlenW (lpString=".dbf") returned 4
	[0076.431] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.431] lstrlenW (lpString=".1cd") returned 4
	[0076.431] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.431] lstrlenW (lpString=".jpg") returned 4
	[0076.431] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.431] lstrlenW (lpString=".doc") returned 4
	[0076.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.431] lstrlenW (lpString=".docx") returned 5
	[0076.431] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0076.431] lstrlenW (lpString=".pdf") returned 4
	[0076.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.432] lstrlenW (lpString=".xls") returned 4
	[0076.432] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.432] lstrlenW (lpString=".xlsx") returned 5
	[0076.432] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0076.432] lstrlenW (lpString=".ppt") returned 4
	[0076.432] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.432] lstrlenW (lpString=".zip") returned 4
	[0076.432] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.432] lstrlenW (lpString=".rar") returned 4
	[0076.432] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.432] lstrlenW (lpString=".bz2") returned 4
	[0076.432] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.432] lstrlenW (lpString=".7z") returned 3
	[0076.432] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.432] lstrlenW (lpString=".dbf") returned 4
	[0076.432] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.432] lstrlenW (lpString=".1cd") returned 4
	[0076.432] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0076.433] lstrlenW (lpString=".jpg") returned 4
	[0076.433] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.433] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.433] lstrlenW (lpString="AppVManifest.dll") returned 16
	[0076.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.433] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=1231576) returned 1
	[0076.433] CloseHandle (hObject=0x38c) returned 1
	[0076.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20
	[0076.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.434] lstrlenW (lpString=".doc") returned 4
	[0076.434] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.434] lstrlenW (lpString=".docx") returned 5
	[0076.434] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0076.434] lstrlenW (lpString=".pdf") returned 4
	[0076.434] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.434] lstrlenW (lpString=".xls") returned 4
	[0076.434] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.434] lstrlenW (lpString=".xlsx") returned 5
	[0076.434] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0076.434] lstrlenW (lpString=".ppt") returned 4
	[0076.434] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.434] lstrlenW (lpString=".zip") returned 4
	[0076.434] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.434] lstrlenW (lpString=".rar") returned 4
	[0076.434] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.434] lstrlenW (lpString=".bz2") returned 4
	[0076.434] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.434] lstrlenW (lpString=".7z") returned 3
	[0076.435] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.435] lstrlenW (lpString=".dbf") returned 4
	[0076.435] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.435] lstrlenW (lpString=".1cd") returned 4
	[0076.435] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.435] lstrlenW (lpString=".jpg") returned 4
	[0076.435] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.435] lstrlenW (lpString=".doc") returned 4
	[0076.435] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.435] lstrlenW (lpString=".docx") returned 5
	[0076.435] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0076.435] lstrlenW (lpString=".pdf") returned 4
	[0076.435] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.435] lstrlenW (lpString=".xls") returned 4
	[0076.435] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.435] lstrlenW (lpString=".xlsx") returned 5
	[0076.436] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0076.436] lstrlenW (lpString=".ppt") returned 4
	[0076.436] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.436] lstrlenW (lpString=".zip") returned 4
	[0076.436] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.436] lstrlenW (lpString=".rar") returned 4
	[0076.436] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.436] lstrlenW (lpString=".bz2") returned 4
	[0076.436] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.436] lstrlenW (lpString=".7z") returned 3
	[0076.436] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.436] lstrlenW (lpString=".dbf") returned 4
	[0076.436] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.436] lstrlenW (lpString=".1cd") returned 4
	[0076.436] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0076.436] lstrlenW (lpString=".jpg") returned 4
	[0076.436] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.437] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.437] lstrlenW (lpString="AppVOrchestration.dll") returned 21
	[0076.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.437] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=947928) returned 1
	[0076.437] CloseHandle (hObject=0x38c) returned 1
	[0076.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20
	[0076.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.438] lstrlenW (lpString=".doc") returned 4
	[0076.438] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.438] lstrlenW (lpString=".docx") returned 5
	[0076.438] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0076.438] lstrlenW (lpString=".pdf") returned 4
	[0076.438] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.438] lstrlenW (lpString=".xls") returned 4
	[0076.438] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.438] lstrlenW (lpString=".xlsx") returned 5
	[0076.438] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0076.438] lstrlenW (lpString=".ppt") returned 4
	[0076.438] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.438] lstrlenW (lpString=".zip") returned 4
	[0076.438] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.438] lstrlenW (lpString=".rar") returned 4
	[0076.438] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.438] lstrlenW (lpString=".bz2") returned 4
	[0076.438] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.438] lstrlenW (lpString=".7z") returned 3
	[0076.438] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.439] lstrlenW (lpString=".dbf") returned 4
	[0076.439] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.439] lstrlenW (lpString=".1cd") returned 4
	[0076.439] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.439] lstrlenW (lpString=".jpg") returned 4
	[0076.439] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.439] lstrlenW (lpString=".doc") returned 4
	[0076.439] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.439] lstrlenW (lpString=".docx") returned 5
	[0076.439] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0076.439] lstrlenW (lpString=".pdf") returned 4
	[0076.439] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.439] lstrlenW (lpString=".xls") returned 4
	[0076.439] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.439] lstrlenW (lpString=".xlsx") returned 5
	[0076.439] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0076.439] lstrlenW (lpString=".ppt") returned 4
	[0076.439] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.440] lstrlenW (lpString=".zip") returned 4
	[0076.440] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.440] lstrlenW (lpString=".rar") returned 4
	[0076.440] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.440] lstrlenW (lpString=".bz2") returned 4
	[0076.440] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.440] lstrlenW (lpString=".7z") returned 3
	[0076.440] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.440] lstrlenW (lpString=".dbf") returned 4
	[0076.440] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.440] lstrlenW (lpString=".1cd") returned 4
	[0076.440] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0076.440] lstrlenW (lpString=".jpg") returned 4
	[0076.440] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.440] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.441] lstrlenW (lpString="AppVPolicy.dll") returned 14
	[0076.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.441] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=1295576) returned 1
	[0076.441] CloseHandle (hObject=0x38c) returned 1
	[0076.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20
	[0076.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.441] lstrlenW (lpString=".doc") returned 4
	[0076.442] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.442] lstrlenW (lpString=".docx") returned 5
	[0076.442] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0076.442] lstrlenW (lpString=".pdf") returned 4
	[0076.442] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.442] lstrlenW (lpString=".xls") returned 4
	[0076.442] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.442] lstrlenW (lpString=".xlsx") returned 5
	[0076.442] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0076.442] lstrlenW (lpString=".ppt") returned 4
	[0076.442] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.442] lstrlenW (lpString=".zip") returned 4
	[0076.442] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.442] lstrlenW (lpString=".rar") returned 4
	[0076.442] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.442] lstrlenW (lpString=".bz2") returned 4
	[0076.442] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.442] lstrlenW (lpString=".7z") returned 3
	[0076.443] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.443] lstrlenW (lpString=".dbf") returned 4
	[0076.443] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.443] lstrlenW (lpString=".1cd") returned 4
	[0076.443] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.443] lstrlenW (lpString=".jpg") returned 4
	[0076.443] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.443] lstrlenW (lpString=".doc") returned 4
	[0076.443] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.444] lstrlenW (lpString=".docx") returned 5
	[0076.444] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0076.444] lstrlenW (lpString=".pdf") returned 4
	[0076.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.444] lstrlenW (lpString=".xls") returned 4
	[0076.444] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.444] lstrlenW (lpString=".xlsx") returned 5
	[0076.444] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0076.444] lstrlenW (lpString=".ppt") returned 4
	[0076.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.444] lstrlenW (lpString=".zip") returned 4
	[0076.444] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.444] lstrlenW (lpString=".rar") returned 4
	[0076.444] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.444] lstrlenW (lpString=".bz2") returned 4
	[0076.444] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.444] lstrlenW (lpString=".7z") returned 3
	[0076.444] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.444] lstrlenW (lpString=".dbf") returned 4
	[0076.444] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.445] lstrlenW (lpString=".1cd") returned 4
	[0076.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0076.445] lstrlenW (lpString=".jpg") returned 4
	[0076.445] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.445] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.445] lstrlenW (lpString="AppVScripting.dll") returned 17
	[0076.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.447] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=512216) returned 1
	[0076.447] CloseHandle (hObject=0x370) returned 1
	[0076.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20
	[0076.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.447] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.447] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.448] GetLastError () returned 0x0
	[0076.448] ReadFile (in: hFile=0x370, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x7d0d8, lpOverlapped=0x0) returned 1
	[0076.458] WriteFile (in: hFile=0x33c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x7d0e0, lpOverlapped=0x0) returned 1
	[0076.467] ReadFile (in: hFile=0x370, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.467] WriteFile (in: hFile=0x33c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0076.467] SetEndOfFile (hFile=0x33c) returned 1
	[0076.467] CloseHandle (hObject=0x33c) returned 1
	[0076.468] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.468] SetEndOfFile (hFile=0x370) returned 1
	[0076.570] CloseHandle (hObject=0x370) returned 1
	[0076.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0076.570] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1
	[0076.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.571] lstrlenW (lpString=".doc") returned 4
	[0076.571] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.571] lstrlenW (lpString=".docx") returned 5
	[0076.571] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0076.571] lstrlenW (lpString=".pdf") returned 4
	[0076.571] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.571] lstrlenW (lpString=".xls") returned 4
	[0076.571] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.571] lstrlenW (lpString=".xlsx") returned 5
	[0076.571] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0076.571] lstrlenW (lpString=".ppt") returned 4
	[0076.571] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.572] lstrlenW (lpString=".zip") returned 4
	[0076.572] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.572] lstrlenW (lpString=".rar") returned 4
	[0076.572] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.572] lstrlenW (lpString=".bz2") returned 4
	[0076.572] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.572] lstrlenW (lpString=".7z") returned 3
	[0076.572] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.572] lstrlenW (lpString=".dbf") returned 4
	[0076.572] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.572] lstrlenW (lpString=".1cd") returned 4
	[0076.572] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.572] lstrlenW (lpString=".jpg") returned 4
	[0076.572] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.573] lstrlenW (lpString=".doc") returned 4
	[0076.573] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.573] lstrlenW (lpString=".docx") returned 5
	[0076.573] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0076.573] lstrlenW (lpString=".pdf") returned 4
	[0076.573] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.573] lstrlenW (lpString=".xls") returned 4
	[0076.573] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.573] lstrlenW (lpString=".xlsx") returned 5
	[0076.573] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0076.573] lstrlenW (lpString=".ppt") returned 4
	[0076.573] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.573] lstrlenW (lpString=".zip") returned 4
	[0076.573] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.573] lstrlenW (lpString=".rar") returned 4
	[0076.573] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.573] lstrlenW (lpString=".bz2") returned 4
	[0076.573] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.573] lstrlenW (lpString=".7z") returned 3
	[0076.573] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.574] lstrlenW (lpString=".dbf") returned 4
	[0076.574] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.574] lstrlenW (lpString=".1cd") returned 4
	[0076.574] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0076.574] lstrlenW (lpString=".jpg") returned 4
	[0076.574] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.574] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.574] lstrlenW (lpString="C2R64.dll") returned 9
	[0076.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.574] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=1208928) returned 1
	[0076.575] CloseHandle (hObject=0x370) returned 1
	[0076.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20
	[0076.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.575] lstrlenW (lpString=".doc") returned 4
	[0076.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.575] lstrlenW (lpString=".docx") returned 5
	[0076.575] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0076.575] lstrlenW (lpString=".pdf") returned 4
	[0076.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.575] lstrlenW (lpString=".xls") returned 4
	[0076.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.575] lstrlenW (lpString=".xlsx") returned 5
	[0076.575] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0076.576] lstrlenW (lpString=".ppt") returned 4
	[0076.576] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.576] lstrlenW (lpString=".zip") returned 4
	[0076.576] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.576] lstrlenW (lpString=".rar") returned 4
	[0076.576] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.576] lstrlenW (lpString=".bz2") returned 4
	[0076.576] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.576] lstrlenW (lpString=".7z") returned 3
	[0076.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.576] lstrlenW (lpString=".dbf") returned 4
	[0076.576] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.576] lstrlenW (lpString=".1cd") returned 4
	[0076.576] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.576] lstrlenW (lpString=".jpg") returned 4
	[0076.576] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.576] lstrlenW (lpString=".doc") returned 4
	[0076.576] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.576] lstrlenW (lpString=".docx") returned 5
	[0076.577] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0076.577] lstrlenW (lpString=".pdf") returned 4
	[0076.577] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.577] lstrlenW (lpString=".xls") returned 4
	[0076.577] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.577] lstrlenW (lpString=".xlsx") returned 5
	[0076.577] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0076.577] lstrlenW (lpString=".ppt") returned 4
	[0076.577] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.577] lstrlenW (lpString=".zip") returned 4
	[0076.577] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.577] lstrlenW (lpString=".rar") returned 4
	[0076.577] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.577] lstrlenW (lpString=".bz2") returned 4
	[0076.577] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.577] lstrlenW (lpString=".7z") returned 3
	[0076.577] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.577] lstrlenW (lpString=".dbf") returned 4
	[0076.577] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.577] lstrlenW (lpString=".1cd") returned 4
	[0076.577] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0076.577] lstrlenW (lpString=".jpg") returned 4
	[0076.578] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.578] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.578] lstrlenW (lpString="C2RUI.en-us.dll") returned 15
	[0076.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.578] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=902328) returned 1
	[0076.578] CloseHandle (hObject=0x370) returned 1
	[0076.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20
	[0076.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.579] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.579] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0076.579] GetLastError () returned 0x0
	[0076.579] ReadFile (in: hFile=0x370, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0xdc4b8, lpOverlapped=0x0) returned 1
	[0076.602] WriteFile (in: hFile=0x368, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xdc4c0, lpOverlapped=0x0) returned 1
	[0077.169] ReadFile (in: hFile=0x370, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.169] WriteFile (in: hFile=0x368, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0077.170] SetEndOfFile (hFile=0x368) returned 1
	[0077.170] CloseHandle (hObject=0x368) returned 1
	[0077.170] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.170] SetEndOfFile (hFile=0x370) returned 1
	[0077.180] CloseHandle (hObject=0x370) returned 1
	[0077.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.180] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1
	[0077.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.181] lstrlenW (lpString=".doc") returned 4
	[0077.181] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.181] lstrlenW (lpString=".docx") returned 5
	[0077.181] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0077.181] lstrlenW (lpString=".pdf") returned 4
	[0077.181] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.181] lstrlenW (lpString=".xls") returned 4
	[0077.181] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.181] lstrlenW (lpString=".xlsx") returned 5
	[0077.181] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0077.181] lstrlenW (lpString=".ppt") returned 4
	[0077.181] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.181] lstrlenW (lpString=".zip") returned 4
	[0077.181] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.181] lstrlenW (lpString=".rar") returned 4
	[0077.181] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.181] lstrlenW (lpString=".bz2") returned 4
	[0077.181] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.181] lstrlenW (lpString=".7z") returned 3
	[0077.182] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.182] lstrlenW (lpString=".dbf") returned 4
	[0077.182] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.182] lstrlenW (lpString=".1cd") returned 4
	[0077.182] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.182] lstrlenW (lpString=".jpg") returned 4
	[0077.182] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.182] lstrlenW (lpString=".doc") returned 4
	[0077.182] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.182] lstrlenW (lpString=".docx") returned 5
	[0077.182] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0077.182] lstrlenW (lpString=".pdf") returned 4
	[0077.182] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.182] lstrlenW (lpString=".xls") returned 4
	[0077.182] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.182] lstrlenW (lpString=".xlsx") returned 5
	[0077.182] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0077.182] lstrlenW (lpString=".ppt") returned 4
	[0077.182] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.182] lstrlenW (lpString=".zip") returned 4
	[0077.183] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.183] lstrlenW (lpString=".rar") returned 4
	[0077.183] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.183] lstrlenW (lpString=".bz2") returned 4
	[0077.183] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.183] lstrlenW (lpString=".7z") returned 3
	[0077.183] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.183] lstrlenW (lpString=".dbf") returned 4
	[0077.183] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.183] lstrlenW (lpString=".1cd") returned 4
	[0077.183] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0077.183] lstrlenW (lpString=".jpg") returned 4
	[0077.183] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.183] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0077.183] lstrlenW (lpString="MavInject32.exe") returned 15
	[0077.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.184] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=358616) returned 1
	[0077.184] CloseHandle (hObject=0x370) returned 1
	[0077.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20
	[0077.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.185] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.185] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.185] GetLastError () returned 0x0
	[0077.185] ReadFile (in: hFile=0x370, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x578d8, lpOverlapped=0x0) returned 1
	[0077.193] WriteFile (in: hFile=0x368, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x578e0, lpOverlapped=0x0) returned 1
	[0077.200] ReadFile (in: hFile=0x370, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.200] WriteFile (in: hFile=0x368, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0077.200] SetEndOfFile (hFile=0x368) returned 1
	[0077.200] CloseHandle (hObject=0x368) returned 1
	[0077.200] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.200] SetEndOfFile (hFile=0x370) returned 1
	[0077.275] CloseHandle (hObject=0x370) returned 1
	[0077.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.275] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1
	[0077.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.275] lstrlenW (lpString=".doc") returned 4
	[0077.275] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0077.275] lstrlenW (lpString=".docx") returned 5
	[0077.275] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1
	[0077.275] lstrlenW (lpString=".pdf") returned 4
	[0077.276] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0077.276] lstrlenW (lpString=".xls") returned 4
	[0077.276] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0077.276] lstrlenW (lpString=".xlsx") returned 5
	[0077.276] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1
	[0077.276] lstrlenW (lpString=".ppt") returned 4
	[0077.276] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0077.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.276] lstrlenW (lpString=".zip") returned 4
	[0077.276] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0077.276] lstrlenW (lpString=".rar") returned 4
	[0077.276] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0077.276] lstrlenW (lpString=".bz2") returned 4
	[0077.276] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0077.276] lstrlenW (lpString=".7z") returned 3
	[0077.276] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0077.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.276] lstrlenW (lpString=".dbf") returned 4
	[0077.276] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0077.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.276] lstrlenW (lpString=".1cd") returned 4
	[0077.276] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0077.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.276] lstrlenW (lpString=".jpg") returned 4
	[0077.277] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0077.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.277] lstrlenW (lpString=".doc") returned 4
	[0077.277] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0077.277] lstrlenW (lpString=".docx") returned 5
	[0077.277] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1
	[0077.277] lstrlenW (lpString=".pdf") returned 4
	[0077.277] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0077.277] lstrlenW (lpString=".xls") returned 4
	[0077.277] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0077.277] lstrlenW (lpString=".xlsx") returned 5
	[0077.277] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1
	[0077.277] lstrlenW (lpString=".ppt") returned 4
	[0077.277] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0077.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.277] lstrlenW (lpString=".zip") returned 4
	[0077.277] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0077.277] lstrlenW (lpString=".rar") returned 4
	[0077.277] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0077.277] lstrlenW (lpString=".bz2") returned 4
	[0077.277] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0077.278] lstrlenW (lpString=".7z") returned 3
	[0077.278] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0077.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.278] lstrlenW (lpString=".dbf") returned 4
	[0077.278] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0077.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.278] lstrlenW (lpString=".1cd") returned 4
	[0077.278] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0077.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0077.278] lstrlenW (lpString=".jpg") returned 4
	[0077.278] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0077.278] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.278] lstrlenW (lpString="mso30win32client.dll") returned 20
	[0077.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.279] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=4677216) returned 1
	[0077.279] CloseHandle (hObject=0x370) returned 1
	[0077.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20
	[0077.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[admin@stex777.com].money")) returned 1
	[0077.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[admin@stex777.com].money"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1
	[0077.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.483] lstrlenW (lpString=".doc") returned 4
	[0077.483] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.483] lstrlenW (lpString=".docx") returned 5
	[0077.483] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0077.483] lstrlenW (lpString=".pdf") returned 4
	[0077.483] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.483] lstrlenW (lpString=".xls") returned 4
	[0077.483] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.483] lstrlenW (lpString=".xlsx") returned 5
	[0077.483] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0077.483] lstrlenW (lpString=".ppt") returned 4
	[0077.484] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.484] lstrlenW (lpString=".zip") returned 4
	[0077.484] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.484] lstrlenW (lpString=".rar") returned 4
	[0077.484] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.484] lstrlenW (lpString=".bz2") returned 4
	[0077.484] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.484] lstrlenW (lpString=".7z") returned 3
	[0077.484] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.484] lstrlenW (lpString=".dbf") returned 4
	[0077.484] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.484] lstrlenW (lpString=".1cd") returned 4
	[0077.484] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.484] lstrlenW (lpString=".jpg") returned 4
	[0077.484] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.484] lstrlenW (lpString=".doc") returned 4
	[0077.484] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.484] lstrlenW (lpString=".docx") returned 5
	[0077.484] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0077.484] lstrlenW (lpString=".pdf") returned 4
	[0077.484] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.485] lstrlenW (lpString=".xls") returned 4
	[0077.485] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.485] lstrlenW (lpString=".xlsx") returned 5
	[0077.485] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0077.485] lstrlenW (lpString=".ppt") returned 4
	[0077.485] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.485] lstrlenW (lpString=".zip") returned 4
	[0077.485] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.485] lstrlenW (lpString=".rar") returned 4
	[0077.485] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.485] lstrlenW (lpString=".bz2") returned 4
	[0077.485] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.485] lstrlenW (lpString=".7z") returned 3
	[0077.485] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.485] lstrlenW (lpString=".dbf") returned 4
	[0077.485] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.485] lstrlenW (lpString=".1cd") returned 4
	[0077.485] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0077.485] lstrlenW (lpString=".jpg") returned 4
	[0077.485] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.486] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.486] lstrlenW (lpString="OfficeC2RCom.dll") returned 16
	[0077.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.486] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=996568) returned 1
	[0077.486] CloseHandle (hObject=0x320) returned 1
	[0077.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20
	[0077.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.486] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.486] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0077.487] GetLastError () returned 0x0
	[0077.487] ReadFile (in: hFile=0x320, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0xf34d8, lpOverlapped=0x0) returned 1
	[0077.506] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf34e0, lpOverlapped=0x0) returned 1
	[0077.930] ReadFile (in: hFile=0x320, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.930] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0077.930] SetEndOfFile (hFile=0x2d4) returned 1
	[0077.930] CloseHandle (hObject=0x2d4) returned 1
	[0077.930] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.930] SetEndOfFile (hFile=0x320) returned 1
	[0077.939] CloseHandle (hObject=0x320) returned 1
	[0077.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.939] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1
	[0077.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.939] lstrlenW (lpString=".doc") returned 4
	[0077.939] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.939] lstrlenW (lpString=".docx") returned 5
	[0077.939] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0077.939] lstrlenW (lpString=".pdf") returned 4
	[0077.939] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.939] lstrlenW (lpString=".xls") returned 4
	[0077.939] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.939] lstrlenW (lpString=".xlsx") returned 5
	[0077.939] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0077.939] lstrlenW (lpString=".ppt") returned 4
	[0077.940] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.940] lstrlenW (lpString=".zip") returned 4
	[0077.940] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.940] lstrlenW (lpString=".rar") returned 4
	[0077.940] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.940] lstrlenW (lpString=".bz2") returned 4
	[0077.940] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.940] lstrlenW (lpString=".7z") returned 3
	[0077.940] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.940] lstrlenW (lpString=".dbf") returned 4
	[0077.940] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.940] lstrlenW (lpString=".1cd") returned 4
	[0077.940] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.940] lstrlenW (lpString=".jpg") returned 4
	[0077.940] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.940] lstrlenW (lpString=".doc") returned 4
	[0077.940] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.940] lstrlenW (lpString=".docx") returned 5
	[0077.940] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0077.940] lstrlenW (lpString=".pdf") returned 4
	[0077.940] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.941] lstrlenW (lpString=".xls") returned 4
	[0077.941] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.941] lstrlenW (lpString=".xlsx") returned 5
	[0077.941] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0077.941] lstrlenW (lpString=".ppt") returned 4
	[0077.941] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.941] lstrlenW (lpString=".zip") returned 4
	[0077.941] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.941] lstrlenW (lpString=".rar") returned 4
	[0077.941] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.941] lstrlenW (lpString=".bz2") returned 4
	[0077.941] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.941] lstrlenW (lpString=".7z") returned 3
	[0077.941] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.941] lstrlenW (lpString=".dbf") returned 4
	[0077.941] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.941] lstrlenW (lpString=".1cd") returned 4
	[0077.941] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0077.941] lstrlenW (lpString=".jpg") returned 4
	[0077.941] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.942] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.942] lstrlenW (lpString="vccorlib140.dll") returned 15
	[0077.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.942] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=390320) returned 1
	[0077.942] CloseHandle (hObject=0x320) returned 1
	[0077.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20
	[0077.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.943] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.943] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0077.943] GetLastError () returned 0x0
	[0077.943] ReadFile (in: hFile=0x320, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x5f4b0, lpOverlapped=0x0) returned 1
	[0077.951] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x5f4c0, lpOverlapped=0x0) returned 1
	[0077.959] ReadFile (in: hFile=0x320, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.959] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0077.959] SetEndOfFile (hFile=0x2d4) returned 1
	[0077.960] CloseHandle (hObject=0x2d4) returned 1
	[0077.960] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.960] SetEndOfFile (hFile=0x320) returned 1
	[0077.964] CloseHandle (hObject=0x320) returned 1
	[0077.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.964] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1
	[0077.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.964] lstrlenW (lpString=".doc") returned 4
	[0077.964] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.964] lstrlenW (lpString=".docx") returned 5
	[0077.964] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0077.964] lstrlenW (lpString=".pdf") returned 4
	[0077.964] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.964] lstrlenW (lpString=".xls") returned 4
	[0077.964] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.964] lstrlenW (lpString=".xlsx") returned 5
	[0077.965] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0077.965] lstrlenW (lpString=".ppt") returned 4
	[0077.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.965] lstrlenW (lpString=".zip") returned 4
	[0077.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.965] lstrlenW (lpString=".rar") returned 4
	[0077.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.965] lstrlenW (lpString=".bz2") returned 4
	[0077.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.965] lstrlenW (lpString=".7z") returned 3
	[0077.965] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.965] lstrlenW (lpString=".dbf") returned 4
	[0077.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.965] lstrlenW (lpString=".1cd") returned 4
	[0077.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.965] lstrlenW (lpString=".jpg") returned 4
	[0077.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.965] lstrlenW (lpString=".doc") returned 4
	[0077.965] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.965] lstrlenW (lpString=".docx") returned 5
	[0077.965] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0077.966] lstrlenW (lpString=".pdf") returned 4
	[0077.966] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.966] lstrlenW (lpString=".xls") returned 4
	[0077.966] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.966] lstrlenW (lpString=".xlsx") returned 5
	[0077.966] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0077.966] lstrlenW (lpString=".ppt") returned 4
	[0077.966] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.966] lstrlenW (lpString=".zip") returned 4
	[0077.966] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.966] lstrlenW (lpString=".rar") returned 4
	[0077.966] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.966] lstrlenW (lpString=".bz2") returned 4
	[0077.966] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.966] lstrlenW (lpString=".7z") returned 3
	[0077.966] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.966] lstrlenW (lpString=".dbf") returned 4
	[0077.966] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.966] lstrlenW (lpString=".1cd") returned 4
	[0077.966] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0077.966] lstrlenW (lpString=".jpg") returned 4
	[0077.966] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.967] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.967] lstrlenW (lpString="vcruntime140.dll") returned 16
	[0077.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.967] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=88752) returned 1
	[0077.967] CloseHandle (hObject=0x320) returned 1
	[0077.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20
	[0077.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.968] lstrlenW (lpString=".doc") returned 4
	[0077.968] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.968] lstrlenW (lpString=".docx") returned 5
	[0077.968] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0077.968] lstrlenW (lpString=".pdf") returned 4
	[0077.968] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.968] lstrlenW (lpString=".xls") returned 4
	[0077.968] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.968] lstrlenW (lpString=".xlsx") returned 5
	[0077.968] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0077.968] lstrlenW (lpString=".ppt") returned 4
	[0077.968] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.968] lstrlenW (lpString=".zip") returned 4
	[0077.968] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.968] lstrlenW (lpString=".rar") returned 4
	[0077.968] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.968] lstrlenW (lpString=".bz2") returned 4
	[0077.968] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.968] lstrlenW (lpString=".7z") returned 3
	[0077.968] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.968] lstrlenW (lpString=".dbf") returned 4
	[0077.968] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.968] lstrlenW (lpString=".1cd") returned 4
	[0077.968] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.968] lstrlenW (lpString=".jpg") returned 4
	[0077.969] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.969] lstrlenW (lpString=".doc") returned 4
	[0077.969] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.969] lstrlenW (lpString=".docx") returned 5
	[0077.969] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0077.969] lstrlenW (lpString=".pdf") returned 4
	[0077.969] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.969] lstrlenW (lpString=".xls") returned 4
	[0077.969] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.969] lstrlenW (lpString=".xlsx") returned 5
	[0077.969] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0077.969] lstrlenW (lpString=".ppt") returned 4
	[0077.969] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.969] lstrlenW (lpString=".zip") returned 4
	[0077.969] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.969] lstrlenW (lpString=".rar") returned 4
	[0077.969] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.969] lstrlenW (lpString=".bz2") returned 4
	[0077.969] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.969] lstrlenW (lpString=".7z") returned 3
	[0077.969] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.969] lstrlenW (lpString=".dbf") returned 4
	[0077.969] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.970] lstrlenW (lpString=".1cd") returned 4
	[0077.970] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0077.970] lstrlenW (lpString=".jpg") returned 4
	[0077.970] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.970] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0077.970] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0077.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.319] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=10752) returned 1
	[0078.319] CloseHandle (hObject=0x374) returned 1
	[0078.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20
	[0078.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.319] lstrlenW (lpString=".doc") returned 4
	[0078.319] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.319] lstrlenW (lpString=".docx") returned 5
	[0078.320] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.320] lstrlenW (lpString=".pdf") returned 4
	[0078.320] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.320] lstrlenW (lpString=".xls") returned 4
	[0078.320] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.320] lstrlenW (lpString=".xlsx") returned 5
	[0078.320] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.320] lstrlenW (lpString=".ppt") returned 4
	[0078.320] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.320] lstrlenW (lpString=".zip") returned 4
	[0078.320] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.320] lstrlenW (lpString=".rar") returned 4
	[0078.320] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.320] lstrlenW (lpString=".bz2") returned 4
	[0078.320] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.320] lstrlenW (lpString=".7z") returned 3
	[0078.320] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.320] lstrlenW (lpString=".dbf") returned 4
	[0078.320] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.320] lstrlenW (lpString=".1cd") returned 4
	[0078.320] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.320] lstrlenW (lpString=".jpg") returned 4
	[0078.320] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.321] lstrlenW (lpString=".doc") returned 4
	[0078.321] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.321] lstrlenW (lpString=".docx") returned 5
	[0078.321] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.321] lstrlenW (lpString=".pdf") returned 4
	[0078.321] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.321] lstrlenW (lpString=".xls") returned 4
	[0078.321] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.321] lstrlenW (lpString=".xlsx") returned 5
	[0078.321] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.321] lstrlenW (lpString=".ppt") returned 4
	[0078.321] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.321] lstrlenW (lpString=".zip") returned 4
	[0078.321] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.321] lstrlenW (lpString=".rar") returned 4
	[0078.321] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.321] lstrlenW (lpString=".bz2") returned 4
	[0078.321] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.321] lstrlenW (lpString=".7z") returned 3
	[0078.321] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.321] lstrlenW (lpString=".dbf") returned 4
	[0078.321] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.321] lstrlenW (lpString=".1cd") returned 4
	[0078.321] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0078.322] lstrlenW (lpString=".jpg") returned 4
	[0078.322] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.322] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.322] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26
	[0078.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.338] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=2560) returned 1
	[0078.342] CloseHandle (hObject=0x374) returned 1
	[0078.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20
	[0078.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.618] lstrlenW (lpString=".doc") returned 4
	[0078.618] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.618] lstrlenW (lpString=".docx") returned 5
	[0078.618] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.618] lstrlenW (lpString=".pdf") returned 4
	[0078.618] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.618] lstrlenW (lpString=".xls") returned 4
	[0078.618] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.618] lstrlenW (lpString=".xlsx") returned 5
	[0078.618] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.618] lstrlenW (lpString=".ppt") returned 4
	[0078.618] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.618] lstrlenW (lpString=".zip") returned 4
	[0078.618] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.618] lstrlenW (lpString=".rar") returned 4
	[0078.618] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.618] lstrlenW (lpString=".bz2") returned 4
	[0078.618] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.618] lstrlenW (lpString=".7z") returned 3
	[0078.618] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.618] lstrlenW (lpString=".dbf") returned 4
	[0078.618] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.618] lstrlenW (lpString=".1cd") returned 4
	[0078.619] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.619] lstrlenW (lpString=".jpg") returned 4
	[0078.619] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.619] lstrlenW (lpString=".doc") returned 4
	[0078.619] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.619] lstrlenW (lpString=".docx") returned 5
	[0078.619] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.619] lstrlenW (lpString=".pdf") returned 4
	[0078.619] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.619] lstrlenW (lpString=".xls") returned 4
	[0078.619] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.619] lstrlenW (lpString=".xlsx") returned 5
	[0078.619] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.619] lstrlenW (lpString=".ppt") returned 4
	[0078.619] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.619] lstrlenW (lpString=".zip") returned 4
	[0078.619] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.619] lstrlenW (lpString=".rar") returned 4
	[0078.619] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.619] lstrlenW (lpString=".bz2") returned 4
	[0078.619] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.619] lstrlenW (lpString=".7z") returned 3
	[0078.619] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.619] lstrlenW (lpString=".dbf") returned 4
	[0078.620] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.620] lstrlenW (lpString=".1cd") returned 4
	[0078.620] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0078.620] lstrlenW (lpString=".jpg") returned 4
	[0078.620] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.620] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0078.620] lstrlenW (lpString="TipRes.dll") returned 10
	[0078.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.776] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=1086464) returned 1
	[0078.776] CloseHandle (hObject=0x374) returned 1
	[0078.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20
	[0078.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.777] lstrlenW (lpString=".doc") returned 4
	[0078.777] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.777] lstrlenW (lpString=".docx") returned 5
	[0078.777] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0078.777] lstrlenW (lpString=".pdf") returned 4
	[0078.778] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.778] lstrlenW (lpString=".xls") returned 4
	[0078.778] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.778] lstrlenW (lpString=".xlsx") returned 5
	[0078.778] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0078.778] lstrlenW (lpString=".ppt") returned 4
	[0078.778] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.778] lstrlenW (lpString=".zip") returned 4
	[0078.778] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.778] lstrlenW (lpString=".rar") returned 4
	[0078.778] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.778] lstrlenW (lpString=".bz2") returned 4
	[0078.778] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.778] lstrlenW (lpString=".7z") returned 3
	[0078.778] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.778] lstrlenW (lpString=".dbf") returned 4
	[0078.778] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.778] lstrlenW (lpString=".1cd") returned 4
	[0078.778] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.778] lstrlenW (lpString=".jpg") returned 4
	[0078.778] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.779] lstrlenW (lpString=".doc") returned 4
	[0078.779] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.779] lstrlenW (lpString=".docx") returned 5
	[0078.779] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0078.779] lstrlenW (lpString=".pdf") returned 4
	[0078.779] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.779] lstrlenW (lpString=".xls") returned 4
	[0078.779] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.779] lstrlenW (lpString=".xlsx") returned 5
	[0078.779] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0078.779] lstrlenW (lpString=".ppt") returned 4
	[0078.779] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.779] lstrlenW (lpString=".zip") returned 4
	[0078.780] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.780] lstrlenW (lpString=".rar") returned 4
	[0078.780] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.780] lstrlenW (lpString=".bz2") returned 4
	[0078.780] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.780] lstrlenW (lpString=".7z") returned 3
	[0078.780] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.780] lstrlenW (lpString=".dbf") returned 4
	[0078.780] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.780] lstrlenW (lpString=".1cd") returned 4
	[0078.780] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 61
	[0078.780] lstrlenW (lpString=".jpg") returned 4
	[0078.780] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.780] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0078.780] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24
	[0078.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.781] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=18624) returned 1
	[0078.781] CloseHandle (hObject=0x374) returned 1
	[0078.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20
	[0078.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.782] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.782] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0078.782] GetLastError () returned 0x0
	[0078.782] ReadFile (in: hFile=0x374, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0078.784] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0078.786] ReadFile (in: hFile=0x374, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.786] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x104, lpOverlapped=0x0) returned 1
	[0078.786] SetEndOfFile (hFile=0x314) returned 1
	[0078.786] CloseHandle (hObject=0x314) returned 1
	[0078.786] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.786] SetEndOfFile (hFile=0x374) returned 1
	[0078.787] CloseHandle (hObject=0x374) returned 1
	[0078.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0078.787] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1
	[0078.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.788] lstrlenW (lpString=".doc") returned 4
	[0078.788] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.788] lstrlenW (lpString=".docx") returned 5
	[0078.788] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0078.788] lstrlenW (lpString=".pdf") returned 4
	[0078.788] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.788] lstrlenW (lpString=".xls") returned 4
	[0078.788] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.788] lstrlenW (lpString=".xlsx") returned 5
	[0078.788] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0078.788] lstrlenW (lpString=".ppt") returned 4
	[0078.788] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.788] lstrlenW (lpString=".zip") returned 4
	[0078.788] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.788] lstrlenW (lpString=".rar") returned 4
	[0078.789] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.789] lstrlenW (lpString=".bz2") returned 4
	[0078.789] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.789] lstrlenW (lpString=".7z") returned 3
	[0078.789] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.789] lstrlenW (lpString=".dbf") returned 4
	[0078.789] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.789] lstrlenW (lpString=".1cd") returned 4
	[0078.789] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.789] lstrlenW (lpString=".jpg") returned 4
	[0078.789] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.789] lstrlenW (lpString=".doc") returned 4
	[0078.789] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.789] lstrlenW (lpString=".docx") returned 5
	[0078.789] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0078.789] lstrlenW (lpString=".pdf") returned 4
	[0078.789] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.789] lstrlenW (lpString=".xls") returned 4
	[0078.789] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.790] lstrlenW (lpString=".xlsx") returned 5
	[0078.790] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0078.790] lstrlenW (lpString=".ppt") returned 4
	[0078.790] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.791] lstrlenW (lpString=".zip") returned 4
	[0078.791] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.791] lstrlenW (lpString=".rar") returned 4
	[0078.791] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.791] lstrlenW (lpString=".bz2") returned 4
	[0078.791] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.791] lstrlenW (lpString=".7z") returned 3
	[0078.791] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.791] lstrlenW (lpString=".dbf") returned 4
	[0078.791] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.791] lstrlenW (lpString=".1cd") returned 4
	[0078.791] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0078.791] lstrlenW (lpString=".jpg") returned 4
	[0078.791] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.791] lstrcmpiW (lpString1=".EXE", lpString2=".money") returned -1
	[0078.791] lstrlenW (lpString="OSE.EXE") returned 7
	[0078.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.792] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=244296) returned 1
	[0078.792] CloseHandle (hObject=0x374) returned 1
	[0078.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20
	[0078.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.793] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.793] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0078.793] GetLastError () returned 0x0
	[0078.793] ReadFile (in: hFile=0x374, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x3ba48, lpOverlapped=0x0) returned 1
	[0078.798] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x3ba50, lpOverlapped=0x0) returned 1
	[0078.802] ReadFile (in: hFile=0x374, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.802] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0078.802] SetEndOfFile (hFile=0x314) returned 1
	[0078.802] CloseHandle (hObject=0x314) returned 1
	[0078.803] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.803] SetEndOfFile (hFile=0x374) returned 1
	[0078.805] CloseHandle (hObject=0x374) returned 1
	[0078.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0078.805] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1
	[0078.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0078.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0078.805] lstrlenW (lpString=".doc") returned 4
	[0078.805] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0078.805] lstrlenW (lpString=".docx") returned 5
	[0078.805] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1
	[0078.805] lstrlenW (lpString=".pdf") returned 4
	[0078.805] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0078.805] lstrlenW (lpString=".xls") returned 4
	[0078.805] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0078.806] lstrlenW (lpString=".xlsx") returned 5
	[0078.806] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1
	[0078.806] lstrlenW (lpString=".ppt") returned 4
	[0078.806] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0078.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0078.806] lstrlenW (lpString=".zip") returned 4
	[0078.806] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0079.884] lstrlenW (lpString=".rar") returned 4
	[0079.886] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0079.886] lstrlenW (lpString=".bz2") returned 4
	[0079.886] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0079.946] lstrlenW (lpString=".7z") returned 3
	[0079.946] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0079.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0079.946] lstrlenW (lpString=".dbf") returned 4
	[0079.946] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0079.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0079.946] lstrlenW (lpString=".1cd") returned 4
	[0079.946] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0079.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0079.946] lstrlenW (lpString=".jpg") returned 4
	[0079.946] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0079.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0079.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0079.946] lstrlenW (lpString=".doc") returned 4
	[0079.946] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0079.946] lstrlenW (lpString=".docx") returned 5
	[0079.946] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1
	[0079.946] lstrlenW (lpString=".pdf") returned 4
	[0079.946] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0079.946] lstrlenW (lpString=".xls") returned 4
	[0079.946] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0079.947] lstrlenW (lpString=".xlsx") returned 5
	[0079.947] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1
	[0079.947] lstrlenW (lpString=".ppt") returned 4
	[0079.947] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0079.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0079.947] lstrlenW (lpString=".zip") returned 4
	[0079.947] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0079.947] lstrlenW (lpString=".rar") returned 4
	[0079.947] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0079.947] lstrlenW (lpString=".bz2") returned 4
	[0079.947] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0079.947] lstrlenW (lpString=".7z") returned 3
	[0079.947] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0079.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0079.947] lstrlenW (lpString=".dbf") returned 4
	[0079.947] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0079.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0079.947] lstrlenW (lpString=".1cd") returned 4
	[0079.947] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0079.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0079.947] lstrlenW (lpString=".jpg") returned 4
	[0079.947] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0079.948] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0079.948] lstrlenW (lpString="VGX.dll") returned 7
	[0079.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0079.949] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=987136) returned 1
	[0079.949] CloseHandle (hObject=0x374) returned 1
	[0079.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20
	[0079.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0079.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0079.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.949] lstrlenW (lpString=".doc") returned 4
	[0079.949] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.949] lstrlenW (lpString=".docx") returned 5
	[0079.949] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0079.949] lstrlenW (lpString=".pdf") returned 4
	[0079.949] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.949] lstrlenW (lpString=".xls") returned 4
	[0079.950] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.950] lstrlenW (lpString=".xlsx") returned 5
	[0079.950] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0079.950] lstrlenW (lpString=".ppt") returned 4
	[0079.950] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.950] lstrlenW (lpString=".zip") returned 4
	[0079.950] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.950] lstrlenW (lpString=".rar") returned 4
	[0079.950] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.950] lstrlenW (lpString=".bz2") returned 4
	[0079.950] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.950] lstrlenW (lpString=".7z") returned 3
	[0079.950] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.950] lstrlenW (lpString=".dbf") returned 4
	[0079.950] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.950] lstrlenW (lpString=".1cd") returned 4
	[0079.950] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.950] lstrlenW (lpString=".jpg") returned 4
	[0079.950] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.950] lstrlenW (lpString=".doc") returned 4
	[0079.951] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.951] lstrlenW (lpString=".docx") returned 5
	[0079.951] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0079.951] lstrlenW (lpString=".pdf") returned 4
	[0079.951] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.951] lstrlenW (lpString=".xls") returned 4
	[0079.951] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.951] lstrlenW (lpString=".xlsx") returned 5
	[0079.951] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0079.951] lstrlenW (lpString=".ppt") returned 4
	[0079.951] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.951] lstrlenW (lpString=".zip") returned 4
	[0079.951] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.951] lstrlenW (lpString=".rar") returned 4
	[0079.951] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.951] lstrlenW (lpString=".bz2") returned 4
	[0079.951] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.951] lstrlenW (lpString=".7z") returned 3
	[0079.951] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.951] lstrlenW (lpString=".dbf") returned 4
	[0079.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.951] lstrlenW (lpString=".1cd") returned 4
	[0079.952] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0079.952] lstrlenW (lpString=".jpg") returned 4
	[0079.952] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.952] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0079.952] lstrlenW (lpString="VSTOInstallerUI.dll") returned 19
	[0079.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0079.955] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=12448) returned 1
	[0079.955] CloseHandle (hObject=0x374) returned 1
	[0079.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20
	[0079.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0079.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0079.956] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.956] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0079.958] GetLastError () returned 0x0
	[0079.958] ReadFile (in: hFile=0x374, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x30a0, lpOverlapped=0x0) returned 1
	[0079.960] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x30b0, lpOverlapped=0x0) returned 1
	[0079.961] ReadFile (in: hFile=0x374, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0079.961] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0079.961] SetEndOfFile (hFile=0x314) returned 1
	[0079.961] CloseHandle (hObject=0x314) returned 1
	[0079.961] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.961] SetEndOfFile (hFile=0x374) returned 1
	[0079.962] CloseHandle (hObject=0x374) returned 1
	[0079.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0079.962] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1
	[0079.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.963] lstrlenW (lpString=".doc") returned 4
	[0079.963] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.963] lstrlenW (lpString=".docx") returned 5
	[0079.963] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0079.963] lstrlenW (lpString=".pdf") returned 4
	[0079.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.963] lstrlenW (lpString=".xls") returned 4
	[0079.963] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.963] lstrlenW (lpString=".xlsx") returned 5
	[0079.963] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0079.963] lstrlenW (lpString=".ppt") returned 4
	[0079.963] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.963] lstrlenW (lpString=".zip") returned 4
	[0079.963] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.963] lstrlenW (lpString=".rar") returned 4
	[0079.963] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.963] lstrlenW (lpString=".bz2") returned 4
	[0079.963] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.963] lstrlenW (lpString=".7z") returned 3
	[0079.963] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.963] lstrlenW (lpString=".dbf") returned 4
	[0079.964] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.964] lstrlenW (lpString=".1cd") returned 4
	[0079.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.964] lstrlenW (lpString=".jpg") returned 4
	[0079.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.964] lstrlenW (lpString=".doc") returned 4
	[0079.964] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.964] lstrlenW (lpString=".docx") returned 5
	[0079.964] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0079.964] lstrlenW (lpString=".pdf") returned 4
	[0079.964] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.964] lstrlenW (lpString=".xls") returned 4
	[0079.964] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.964] lstrlenW (lpString=".xlsx") returned 5
	[0079.964] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0079.964] lstrlenW (lpString=".ppt") returned 4
	[0079.964] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.964] lstrlenW (lpString=".zip") returned 4
	[0079.964] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.965] lstrlenW (lpString=".rar") returned 4
	[0079.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.965] lstrlenW (lpString=".bz2") returned 4
	[0079.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.965] lstrlenW (lpString=".7z") returned 3
	[0079.965] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.965] lstrlenW (lpString=".dbf") returned 4
	[0079.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.965] lstrlenW (lpString=".1cd") returned 4
	[0079.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0079.965] lstrlenW (lpString=".jpg") returned 4
	[0079.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.965] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0079.965] lstrlenW (lpString="VSTOLoaderUI.dll") returned 16
	[0079.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0079.966] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=20608) returned 1
	[0079.966] CloseHandle (hObject=0x374) returned 1
	[0079.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20
	[0079.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0079.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0079.966] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.966] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0079.967] GetLastError () returned 0x0
	[0079.967] ReadFile (in: hFile=0x374, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x5080, lpOverlapped=0x0) returned 1
	[0079.968] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x5090, lpOverlapped=0x0) returned 1
	[0079.970] ReadFile (in: hFile=0x374, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0079.970] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0079.970] SetEndOfFile (hFile=0x314) returned 1
	[0079.970] CloseHandle (hObject=0x314) returned 1
	[0079.970] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.970] SetEndOfFile (hFile=0x374) returned 1
	[0079.971] CloseHandle (hObject=0x374) returned 1
	[0079.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0079.971] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1
	[0079.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.971] lstrlenW (lpString=".doc") returned 4
	[0079.971] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.971] lstrlenW (lpString=".docx") returned 5
	[0079.972] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0079.972] lstrlenW (lpString=".pdf") returned 4
	[0079.972] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.972] lstrlenW (lpString=".xls") returned 4
	[0079.972] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.972] lstrlenW (lpString=".xlsx") returned 5
	[0079.972] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0079.972] lstrlenW (lpString=".ppt") returned 4
	[0079.972] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.972] lstrlenW (lpString=".zip") returned 4
	[0079.972] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.972] lstrlenW (lpString=".rar") returned 4
	[0079.972] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.972] lstrlenW (lpString=".bz2") returned 4
	[0079.972] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.972] lstrlenW (lpString=".7z") returned 3
	[0079.972] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.972] lstrlenW (lpString=".dbf") returned 4
	[0079.972] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.972] lstrlenW (lpString=".1cd") returned 4
	[0079.972] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.972] lstrlenW (lpString=".jpg") returned 4
	[0079.972] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.973] lstrlenW (lpString=".doc") returned 4
	[0079.973] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.973] lstrlenW (lpString=".docx") returned 5
	[0079.973] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0079.976] lstrlenW (lpString=".pdf") returned 4
	[0079.976] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.976] lstrlenW (lpString=".xls") returned 4
	[0079.976] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.976] lstrlenW (lpString=".xlsx") returned 5
	[0079.976] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0079.976] lstrlenW (lpString=".ppt") returned 4
	[0079.976] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.976] lstrlenW (lpString=".zip") returned 4
	[0079.976] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.976] lstrlenW (lpString=".rar") returned 4
	[0079.976] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.976] lstrlenW (lpString=".bz2") returned 4
	[0079.976] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.976] lstrlenW (lpString=".7z") returned 3
	[0079.976] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.976] lstrlenW (lpString=".dbf") returned 4
	[0079.976] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.976] lstrlenW (lpString=".1cd") returned 4
	[0079.976] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0079.976] lstrlenW (lpString=".jpg") returned 4
	[0079.977] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.977] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0079.977] lstrlenW (lpString="VSTOInstaller.exe") returned 17
	[0079.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0079.978] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=100488) returned 1
	[0079.978] CloseHandle (hObject=0x374) returned 1
	[0079.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20
	[0079.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0079.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0079.978] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.978] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0079.978] GetLastError () returned 0x0
	[0079.978] ReadFile (in: hFile=0x374, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x18888, lpOverlapped=0x0) returned 1
	[0079.982] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x18890, lpOverlapped=0x0) returned 1
	[0079.984] ReadFile (in: hFile=0x374, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0079.984] WriteFile (in: hFile=0x314, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0079.984] SetEndOfFile (hFile=0x314) returned 1
	[0079.984] CloseHandle (hObject=0x314) returned 1
	[0079.984] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.984] SetEndOfFile (hFile=0x374) returned 1
	[0079.986] CloseHandle (hObject=0x374) returned 1
	[0079.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0079.986] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1
	[0079.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.986] lstrlenW (lpString=".doc") returned 4
	[0079.986] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0079.986] lstrlenW (lpString=".docx") returned 5
	[0079.986] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0079.986] lstrlenW (lpString=".pdf") returned 4
	[0079.986] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0079.986] lstrlenW (lpString=".xls") returned 4
	[0079.987] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0079.987] lstrlenW (lpString=".xlsx") returned 5
	[0079.987] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0079.987] lstrlenW (lpString=".ppt") returned 4
	[0079.987] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0079.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.987] lstrlenW (lpString=".zip") returned 4
	[0079.987] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0079.987] lstrlenW (lpString=".rar") returned 4
	[0079.987] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0079.987] lstrlenW (lpString=".bz2") returned 4
	[0079.987] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0079.987] lstrlenW (lpString=".7z") returned 3
	[0079.987] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0079.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.987] lstrlenW (lpString=".dbf") returned 4
	[0079.987] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0079.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.987] lstrlenW (lpString=".1cd") returned 4
	[0079.987] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0079.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.987] lstrlenW (lpString=".jpg") returned 4
	[0079.987] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0079.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.987] lstrlenW (lpString=".doc") returned 4
	[0079.987] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0079.987] lstrlenW (lpString=".docx") returned 5
	[0079.987] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0079.987] lstrlenW (lpString=".pdf") returned 4
	[0079.988] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0079.988] lstrlenW (lpString=".xls") returned 4
	[0079.988] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0079.988] lstrlenW (lpString=".xlsx") returned 5
	[0079.988] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0079.988] lstrlenW (lpString=".ppt") returned 4
	[0079.988] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0079.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.988] lstrlenW (lpString=".zip") returned 4
	[0079.988] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0079.988] lstrlenW (lpString=".rar") returned 4
	[0079.988] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0079.988] lstrlenW (lpString=".bz2") returned 4
	[0079.988] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0079.988] lstrlenW (lpString=".7z") returned 3
	[0079.988] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0079.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.988] lstrlenW (lpString=".dbf") returned 4
	[0079.988] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0079.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.988] lstrlenW (lpString=".1cd") returned 4
	[0079.988] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0079.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0079.988] lstrlenW (lpString=".jpg") returned 4
	[0079.988] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0080.519] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0080.519] lstrlenW (lpString="screensaver.exe") returned 15
	[0080.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\screensaver.exe" (normalized: "c:\\program files\\common files\\screensaver.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0080.519] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=78336) returned 1
	[0080.519] CloseHandle (hObject=0x360) returned 1
	[0080.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\screensaver.exe" (normalized: "c:\\program files\\common files\\screensaver.exe")) returned 0x20
	[0080.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\screensaver.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\screensaver.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\screensaver.exe" (normalized: "c:\\program files\\common files\\screensaver.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0080.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.523] lstrlenW (lpString=".doc") returned 4
	[0080.523] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0080.523] lstrlenW (lpString=".docx") returned 5
	[0080.523] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0080.523] lstrlenW (lpString=".pdf") returned 4
	[0080.523] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0080.523] lstrlenW (lpString=".xls") returned 4
	[0080.523] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0080.523] lstrlenW (lpString=".xlsx") returned 5
	[0080.523] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0080.523] lstrlenW (lpString=".ppt") returned 4
	[0080.523] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0080.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.524] lstrlenW (lpString=".zip") returned 4
	[0080.524] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0080.524] lstrlenW (lpString=".rar") returned 4
	[0080.524] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0080.524] lstrlenW (lpString=".bz2") returned 4
	[0080.524] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0080.524] lstrlenW (lpString=".7z") returned 3
	[0080.524] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0080.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.524] lstrlenW (lpString=".dbf") returned 4
	[0080.524] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0080.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.524] lstrlenW (lpString=".1cd") returned 4
	[0080.524] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0080.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.524] lstrlenW (lpString=".jpg") returned 4
	[0080.524] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0080.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.524] lstrlenW (lpString=".doc") returned 4
	[0080.524] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0080.524] lstrlenW (lpString=".docx") returned 5
	[0080.524] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0080.524] lstrlenW (lpString=".pdf") returned 4
	[0080.524] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0080.524] lstrlenW (lpString=".xls") returned 4
	[0080.524] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0080.524] lstrlenW (lpString=".xlsx") returned 5
	[0080.524] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0080.524] lstrlenW (lpString=".ppt") returned 4
	[0080.525] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0080.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.525] lstrlenW (lpString=".zip") returned 4
	[0080.525] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0080.525] lstrlenW (lpString=".rar") returned 4
	[0080.525] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0080.525] lstrlenW (lpString=".bz2") returned 4
	[0080.525] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0080.525] lstrlenW (lpString=".7z") returned 3
	[0080.525] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0080.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.525] lstrlenW (lpString=".dbf") returned 4
	[0080.525] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0080.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.525] lstrlenW (lpString=".1cd") returned 4
	[0080.525] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0080.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\screensaver.exe") returned 45
	[0080.525] lstrlenW (lpString=".jpg") returned 4
	[0080.525] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0080.525] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0080.525] lstrlenW (lpString="msader15.dll.mui") returned 16
	[0080.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0080.527] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=17920) returned 1
	[0080.527] CloseHandle (hObject=0x360) returned 1
	[0080.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20
	[0080.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0080.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.528] lstrlenW (lpString=".doc") returned 4
	[0080.528] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0080.528] lstrlenW (lpString=".docx") returned 5
	[0080.528] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0080.528] lstrlenW (lpString=".pdf") returned 4
	[0080.528] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0080.528] lstrlenW (lpString=".xls") returned 4
	[0080.528] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0080.528] lstrlenW (lpString=".xlsx") returned 5
	[0080.528] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0080.528] lstrlenW (lpString=".ppt") returned 4
	[0080.528] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0080.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.528] lstrlenW (lpString=".zip") returned 4
	[0080.528] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0080.528] lstrlenW (lpString=".rar") returned 4
	[0080.528] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0080.528] lstrlenW (lpString=".bz2") returned 4
	[0080.528] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0080.528] lstrlenW (lpString=".7z") returned 3
	[0080.528] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0080.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.528] lstrlenW (lpString=".dbf") returned 4
	[0080.528] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0080.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.528] lstrlenW (lpString=".1cd") returned 4
	[0080.528] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0080.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.528] lstrlenW (lpString=".jpg") returned 4
	[0080.529] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0080.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.529] lstrlenW (lpString=".doc") returned 4
	[0080.529] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0080.529] lstrlenW (lpString=".docx") returned 5
	[0080.529] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0080.529] lstrlenW (lpString=".pdf") returned 4
	[0080.529] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0080.529] lstrlenW (lpString=".xls") returned 4
	[0080.529] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0080.529] lstrlenW (lpString=".xlsx") returned 5
	[0080.529] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0080.529] lstrlenW (lpString=".ppt") returned 4
	[0080.529] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0080.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.529] lstrlenW (lpString=".zip") returned 4
	[0080.529] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0080.529] lstrlenW (lpString=".rar") returned 4
	[0080.529] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0080.529] lstrlenW (lpString=".bz2") returned 4
	[0080.529] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0080.529] lstrlenW (lpString=".7z") returned 3
	[0080.529] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0080.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.529] lstrlenW (lpString=".dbf") returned 4
	[0080.529] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0080.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.529] lstrlenW (lpString=".1cd") returned 4
	[0080.529] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0080.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0080.530] lstrlenW (lpString=".jpg") returned 4
	[0080.530] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0080.530] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0080.530] lstrlenW (lpString="msader15.dll") returned 12
	[0080.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0080.531] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=2560) returned 1
	[0080.531] CloseHandle (hObject=0x360) returned 1
	[0080.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20
	[0080.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0080.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.531] lstrlenW (lpString=".doc") returned 4
	[0080.531] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.531] lstrlenW (lpString=".docx") returned 5
	[0080.531] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0080.531] lstrlenW (lpString=".pdf") returned 4
	[0080.531] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.531] lstrlenW (lpString=".xls") returned 4
	[0080.531] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.531] lstrlenW (lpString=".xlsx") returned 5
	[0080.531] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0080.531] lstrlenW (lpString=".ppt") returned 4
	[0080.531] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.531] lstrlenW (lpString=".zip") returned 4
	[0080.531] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.531] lstrlenW (lpString=".rar") returned 4
	[0080.532] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.532] lstrlenW (lpString=".bz2") returned 4
	[0080.532] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.532] lstrlenW (lpString=".7z") returned 3
	[0080.532] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.532] lstrlenW (lpString=".dbf") returned 4
	[0080.532] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.532] lstrlenW (lpString=".1cd") returned 4
	[0080.532] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.532] lstrlenW (lpString=".jpg") returned 4
	[0080.532] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.532] lstrlenW (lpString=".doc") returned 4
	[0080.532] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.532] lstrlenW (lpString=".docx") returned 5
	[0080.532] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0080.532] lstrlenW (lpString=".pdf") returned 4
	[0080.532] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.532] lstrlenW (lpString=".xls") returned 4
	[0080.532] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.532] lstrlenW (lpString=".xlsx") returned 5
	[0080.532] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0080.533] lstrlenW (lpString=".ppt") returned 4
	[0080.533] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.533] lstrlenW (lpString=".zip") returned 4
	[0080.533] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.533] lstrlenW (lpString=".rar") returned 4
	[0080.533] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.533] lstrlenW (lpString=".bz2") returned 4
	[0080.533] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.533] lstrlenW (lpString=".7z") returned 3
	[0080.533] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.533] lstrlenW (lpString=".dbf") returned 4
	[0080.533] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.533] lstrlenW (lpString=".1cd") returned 4
	[0080.533] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0080.533] lstrlenW (lpString=".jpg") returned 4
	[0080.533] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.533] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0080.533] lstrlenW (lpString="msado15.dll") returned 11
	[0080.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0080.534] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=1233920) returned 1
	[0080.534] CloseHandle (hObject=0x360) returned 1
	[0080.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20
	[0080.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0080.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.535] lstrlenW (lpString=".doc") returned 4
	[0080.535] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.535] lstrlenW (lpString=".docx") returned 5
	[0080.535] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0080.535] lstrlenW (lpString=".pdf") returned 4
	[0080.535] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.535] lstrlenW (lpString=".xls") returned 4
	[0080.535] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.535] lstrlenW (lpString=".xlsx") returned 5
	[0080.535] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0080.535] lstrlenW (lpString=".ppt") returned 4
	[0080.535] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.535] lstrlenW (lpString=".zip") returned 4
	[0080.535] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.535] lstrlenW (lpString=".rar") returned 4
	[0080.535] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.535] lstrlenW (lpString=".bz2") returned 4
	[0080.537] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.537] lstrlenW (lpString=".7z") returned 3
	[0080.537] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.537] lstrlenW (lpString=".dbf") returned 4
	[0080.537] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.537] lstrlenW (lpString=".1cd") returned 4
	[0080.537] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.537] lstrlenW (lpString=".jpg") returned 4
	[0080.538] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.538] lstrlenW (lpString=".doc") returned 4
	[0080.538] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.538] lstrlenW (lpString=".docx") returned 5
	[0080.538] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0080.538] lstrlenW (lpString=".pdf") returned 4
	[0080.538] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.538] lstrlenW (lpString=".xls") returned 4
	[0080.538] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.538] lstrlenW (lpString=".xlsx") returned 5
	[0080.538] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0080.538] lstrlenW (lpString=".ppt") returned 4
	[0080.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.538] lstrlenW (lpString=".zip") returned 4
	[0080.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.538] lstrlenW (lpString=".rar") returned 4
	[0080.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.538] lstrlenW (lpString=".bz2") returned 4
	[0080.538] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.538] lstrlenW (lpString=".7z") returned 3
	[0080.538] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.539] lstrlenW (lpString=".dbf") returned 4
	[0080.539] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.539] lstrlenW (lpString=".1cd") returned 4
	[0080.539] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0080.539] lstrlenW (lpString=".jpg") returned 4
	[0080.539] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.539] lstrcmpiW (lpString1=".tlb", lpString2=".money") returned 1
	[0080.539] lstrlenW (lpString="msado20.tlb") returned 11
	[0080.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0080.540] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=50688) returned 1
	[0080.540] CloseHandle (hObject=0x360) returned 1
	[0080.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20
	[0080.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0080.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.540] lstrlenW (lpString=".doc") returned 4
	[0080.540] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0080.540] lstrlenW (lpString=".docx") returned 5
	[0080.540] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0080.540] lstrlenW (lpString=".pdf") returned 4
	[0080.540] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0080.540] lstrlenW (lpString=".xls") returned 4
	[0080.541] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0080.541] lstrlenW (lpString=".xlsx") returned 5
	[0080.541] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0080.541] lstrlenW (lpString=".ppt") returned 4
	[0080.541] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0080.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.541] lstrlenW (lpString=".zip") returned 4
	[0080.541] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0080.541] lstrlenW (lpString=".rar") returned 4
	[0080.541] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0080.541] lstrlenW (lpString=".bz2") returned 4
	[0080.541] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0080.541] lstrlenW (lpString=".7z") returned 3
	[0080.541] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0080.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.541] lstrlenW (lpString=".dbf") returned 4
	[0080.541] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0080.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.541] lstrlenW (lpString=".1cd") returned 4
	[0080.541] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0080.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.541] lstrlenW (lpString=".jpg") returned 4
	[0080.541] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0080.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.541] lstrlenW (lpString=".doc") returned 4
	[0080.542] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0080.542] lstrlenW (lpString=".docx") returned 5
	[0080.542] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0080.542] lstrlenW (lpString=".pdf") returned 4
	[0080.542] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0080.542] lstrlenW (lpString=".xls") returned 4
	[0080.542] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0080.542] lstrlenW (lpString=".xlsx") returned 5
	[0080.542] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0080.542] lstrlenW (lpString=".ppt") returned 4
	[0080.542] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0080.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.542] lstrlenW (lpString=".zip") returned 4
	[0080.542] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0080.542] lstrlenW (lpString=".rar") returned 4
	[0080.542] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0080.542] lstrlenW (lpString=".bz2") returned 4
	[0080.542] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0080.542] lstrlenW (lpString=".7z") returned 3
	[0080.542] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0080.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.542] lstrlenW (lpString=".dbf") returned 4
	[0080.542] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0080.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.542] lstrlenW (lpString=".1cd") returned 4
	[0080.542] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0080.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0080.543] lstrlenW (lpString=".jpg") returned 4
	[0080.543] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0080.543] lstrcmpiW (lpString1=".tlb", lpString2=".money") returned 1
	[0080.543] lstrlenW (lpString="msado21.tlb") returned 11
	[0080.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0080.543] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=53760) returned 1
	[0080.543] CloseHandle (hObject=0x360) returned 1
	[0080.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20
	[0080.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0080.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0080.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0080.544] lstrlenW (lpString=".doc") returned 4
	[0080.544] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0080.544] lstrlenW (lpString=".docx") returned 5
	[0080.544] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1
	[0080.544] lstrlenW (lpString=".pdf") returned 4
	[0080.544] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0080.544] lstrlenW (lpString=".xls") returned 4
	[0080.544] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0080.544] lstrlenW (lpString=".xlsx") returned 5
	[0080.544] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1
	[0080.544] lstrlenW (lpString=".ppt") returned 4
	[0080.544] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0080.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0080.544] lstrlenW (lpString=".zip") returned 4
	[0080.544] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0080.544] lstrlenW (lpString=".rar") returned 4
	[0080.544] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0080.544] lstrlenW (lpString=".bz2") returned 4
	[0080.544] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0080.544] lstrlenW (lpString=".7z") returned 3
	[0080.544] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0080.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0080.544] lstrlenW (lpString=".dbf") returned 4
	[0080.544] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0080.940] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.941] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.941] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0080.941] GetLastError () returned 0x0
	[0080.941] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x1c4, lpOverlapped=0x0) returned 1
	[0080.945] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x1d0, lpOverlapped=0x0) returned 1
	[0080.946] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.946] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xea, lpOverlapped=0x0) returned 1
	[0080.947] SetEndOfFile (hFile=0x2d4) returned 1
	[0080.947] CloseHandle (hObject=0x2d4) returned 1
	[0080.947] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.947] SetEndOfFile (hFile=0x314) returned 1
	[0080.948] CloseHandle (hObject=0x314) returned 1
	[0080.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0080.948] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1
	[0080.949] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.949] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.949] lstrlenW (lpString=".doc") returned 4
	[0080.949] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1
	[0080.949] lstrlenW (lpString=".docx") returned 5
	[0080.949] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1
	[0080.949] lstrlenW (lpString=".pdf") returned 4
	[0080.949] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1
	[0080.949] lstrlenW (lpString=".xls") returned 4
	[0080.949] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1
	[0080.949] lstrlenW (lpString=".xlsx") returned 5
	[0080.949] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1
	[0080.949] lstrlenW (lpString=".ppt") returned 4
	[0080.949] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1
	[0080.949] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.949] lstrlenW (lpString=".zip") returned 4
	[0080.949] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1
	[0080.949] lstrlenW (lpString=".rar") returned 4
	[0080.949] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1
	[0080.949] lstrlenW (lpString=".bz2") returned 4
	[0080.949] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1
	[0080.949] lstrlenW (lpString=".7z") returned 3
	[0080.949] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1
	[0080.950] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.950] lstrlenW (lpString=".dbf") returned 4
	[0080.950] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1
	[0080.950] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.950] lstrlenW (lpString=".1cd") returned 4
	[0080.950] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1
	[0080.950] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.950] lstrlenW (lpString=".jpg") returned 4
	[0080.950] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1
	[0080.950] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.950] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.950] lstrlenW (lpString=".doc") returned 4
	[0080.950] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1
	[0080.950] lstrlenW (lpString=".docx") returned 5
	[0080.950] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1
	[0080.950] lstrlenW (lpString=".pdf") returned 4
	[0080.950] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1
	[0080.950] lstrlenW (lpString=".xls") returned 4
	[0080.950] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1
	[0080.950] lstrlenW (lpString=".xlsx") returned 5
	[0080.950] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1
	[0080.950] lstrlenW (lpString=".ppt") returned 4
	[0080.950] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1
	[0080.950] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.951] lstrlenW (lpString=".zip") returned 4
	[0080.951] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1
	[0080.951] lstrlenW (lpString=".rar") returned 4
	[0080.951] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1
	[0080.951] lstrlenW (lpString=".bz2") returned 4
	[0080.951] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1
	[0080.951] lstrlenW (lpString=".7z") returned 3
	[0080.951] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1
	[0080.951] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.951] lstrlenW (lpString=".dbf") returned 4
	[0080.951] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1
	[0080.951] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.951] lstrlenW (lpString=".1cd") returned 4
	[0080.951] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1
	[0080.951] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0080.951] lstrlenW (lpString=".jpg") returned 4
	[0080.951] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1
	[0080.951] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0080.951] lstrlenW (lpString="sqmapi.dll") returned 10
	[0080.951] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0080.953] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=49688) returned 1
	[0080.953] CloseHandle (hObject=0x314) returned 1
	[0080.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20
	[0080.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.954] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0080.954] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.954] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.954] lstrlenW (lpString=".doc") returned 4
	[0080.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.954] lstrlenW (lpString=".docx") returned 5
	[0080.954] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0080.954] lstrlenW (lpString=".pdf") returned 4
	[0080.954] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.954] lstrlenW (lpString=".xls") returned 4
	[0080.954] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.954] lstrlenW (lpString=".xlsx") returned 5
	[0080.954] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0080.954] lstrlenW (lpString=".ppt") returned 4
	[0080.954] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.954] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.954] lstrlenW (lpString=".zip") returned 4
	[0080.954] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.954] lstrlenW (lpString=".rar") returned 4
	[0080.955] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.955] lstrlenW (lpString=".bz2") returned 4
	[0080.955] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.955] lstrlenW (lpString=".7z") returned 3
	[0080.955] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.955] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.955] lstrlenW (lpString=".dbf") returned 4
	[0080.955] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.955] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.955] lstrlenW (lpString=".1cd") returned 4
	[0080.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.955] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.955] lstrlenW (lpString=".jpg") returned 4
	[0080.955] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.955] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.955] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.955] lstrlenW (lpString=".doc") returned 4
	[0080.955] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.955] lstrlenW (lpString=".docx") returned 5
	[0080.955] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0080.955] lstrlenW (lpString=".pdf") returned 4
	[0080.955] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.955] lstrlenW (lpString=".xls") returned 4
	[0080.955] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.955] lstrlenW (lpString=".xlsx") returned 5
	[0080.955] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0080.956] lstrlenW (lpString=".ppt") returned 4
	[0080.956] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.956] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.956] lstrlenW (lpString=".zip") returned 4
	[0080.956] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.956] lstrlenW (lpString=".rar") returned 4
	[0080.956] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.956] lstrlenW (lpString=".bz2") returned 4
	[0080.956] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.956] lstrlenW (lpString=".7z") returned 3
	[0080.956] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.956] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.956] lstrlenW (lpString=".dbf") returned 4
	[0080.956] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.956] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.956] lstrlenW (lpString=".1cd") returned 4
	[0080.956] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.956] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0080.956] lstrlenW (lpString=".jpg") returned 4
	[0080.956] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.956] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0080.956] lstrlenW (lpString="awt.dll") returned 7
	[0080.956] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0080.957] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=1516608) returned 1
	[0080.957] CloseHandle (hObject=0x314) returned 1
	[0080.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20
	[0080.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.960] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0080.960] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.960] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.960] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0080.961] GetLastError () returned 0x0
	[0080.961] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0081.274] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0081.291] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x72450, lpOverlapped=0x0) returned 1
	[0081.691] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x72460, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x72460, lpOverlapped=0x0) returned 1
	[0081.930] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.930] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0081.930] SetEndOfFile (hFile=0x2d4) returned 1
	[0081.930] CloseHandle (hObject=0x2d4) returned 1
	[0081.931] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.931] SetEndOfFile (hFile=0x314) returned 1
	[0081.935] CloseHandle (hObject=0x314) returned 1
	[0081.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.935] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1
	[0081.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.936] lstrlenW (lpString=".doc") returned 4
	[0081.936] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.936] lstrlenW (lpString=".docx") returned 5
	[0081.936] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0081.936] lstrlenW (lpString=".pdf") returned 4
	[0081.936] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.936] lstrlenW (lpString=".xls") returned 4
	[0081.936] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.936] lstrlenW (lpString=".xlsx") returned 5
	[0081.936] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0081.936] lstrlenW (lpString=".ppt") returned 4
	[0081.936] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.936] lstrlenW (lpString=".zip") returned 4
	[0081.936] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.936] lstrlenW (lpString=".rar") returned 4
	[0081.936] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.936] lstrlenW (lpString=".bz2") returned 4
	[0081.936] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.936] lstrlenW (lpString=".7z") returned 3
	[0081.936] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.936] lstrlenW (lpString=".dbf") returned 4
	[0081.936] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.937] lstrlenW (lpString=".1cd") returned 4
	[0081.937] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.937] lstrlenW (lpString=".jpg") returned 4
	[0081.937] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.937] lstrlenW (lpString=".doc") returned 4
	[0081.937] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.937] lstrlenW (lpString=".docx") returned 5
	[0081.937] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0081.937] lstrlenW (lpString=".pdf") returned 4
	[0081.937] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.937] lstrlenW (lpString=".xls") returned 4
	[0081.937] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.937] lstrlenW (lpString=".xlsx") returned 5
	[0081.937] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0081.937] lstrlenW (lpString=".ppt") returned 4
	[0081.937] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.938] lstrlenW (lpString=".zip") returned 4
	[0081.938] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.938] lstrlenW (lpString=".rar") returned 4
	[0081.938] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.938] lstrlenW (lpString=".bz2") returned 4
	[0081.938] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.938] lstrlenW (lpString=".7z") returned 3
	[0081.938] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.938] lstrlenW (lpString=".dbf") returned 4
	[0081.938] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.938] lstrlenW (lpString=".1cd") returned 4
	[0081.938] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0081.938] lstrlenW (lpString=".jpg") returned 4
	[0081.938] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.939] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0081.939] lstrlenW (lpString="fxplugins.dll") returned 13
	[0081.939] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0081.939] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=186944) returned 1
	[0081.940] CloseHandle (hObject=0x314) returned 1
	[0081.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20
	[0081.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.940] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0081.940] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.940] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.940] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0081.940] GetLastError () returned 0x0
	[0081.940] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x2da40, lpOverlapped=0x0) returned 1
	[0081.944] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x2da50, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x2da50, lpOverlapped=0x0) returned 1
	[0081.948] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.948] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xee, lpOverlapped=0x0) returned 1
	[0081.948] SetEndOfFile (hFile=0x2d4) returned 1
	[0081.948] CloseHandle (hObject=0x2d4) returned 1
	[0081.948] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.948] SetEndOfFile (hFile=0x314) returned 1
	[0081.950] CloseHandle (hObject=0x314) returned 1
	[0081.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.950] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 1
	[0081.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.950] lstrlenW (lpString=".doc") returned 4
	[0081.950] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.950] lstrlenW (lpString=".docx") returned 5
	[0081.951] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0081.951] lstrlenW (lpString=".pdf") returned 4
	[0081.951] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.951] lstrlenW (lpString=".xls") returned 4
	[0081.951] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.951] lstrlenW (lpString=".xlsx") returned 5
	[0081.951] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0081.951] lstrlenW (lpString=".ppt") returned 4
	[0081.951] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.951] lstrlenW (lpString=".zip") returned 4
	[0081.951] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.951] lstrlenW (lpString=".rar") returned 4
	[0081.951] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.951] lstrlenW (lpString=".bz2") returned 4
	[0081.951] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.951] lstrlenW (lpString=".7z") returned 3
	[0081.951] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.951] lstrlenW (lpString=".dbf") returned 4
	[0081.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.951] lstrlenW (lpString=".1cd") returned 4
	[0081.951] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.951] lstrlenW (lpString=".jpg") returned 4
	[0081.951] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.952] lstrlenW (lpString=".doc") returned 4
	[0081.952] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.952] lstrlenW (lpString=".docx") returned 5
	[0081.952] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0081.952] lstrlenW (lpString=".pdf") returned 4
	[0081.952] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.952] lstrlenW (lpString=".xls") returned 4
	[0081.952] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.952] lstrlenW (lpString=".xlsx") returned 5
	[0081.952] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0081.952] lstrlenW (lpString=".ppt") returned 4
	[0081.952] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.952] lstrlenW (lpString=".zip") returned 4
	[0081.952] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.952] lstrlenW (lpString=".rar") returned 4
	[0081.952] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.952] lstrlenW (lpString=".bz2") returned 4
	[0081.952] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.952] lstrlenW (lpString=".7z") returned 3
	[0081.952] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.952] lstrlenW (lpString=".dbf") returned 4
	[0081.952] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.952] lstrlenW (lpString=".1cd") returned 4
	[0081.952] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0081.953] lstrlenW (lpString=".jpg") returned 4
	[0081.953] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.953] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0081.953] lstrlenW (lpString="glass.dll") returned 9
	[0081.953] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0081.953] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=265792) returned 1
	[0081.953] CloseHandle (hObject=0x314) returned 1
	[0081.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20
	[0081.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.953] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0081.954] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.954] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.954] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0081.954] GetLastError () returned 0x0
	[0081.954] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x40e40, lpOverlapped=0x0) returned 1
	[0082.249] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x40e50, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x40e50, lpOverlapped=0x0) returned 1
	[0082.254] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.254] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0082.254] SetEndOfFile (hFile=0x2d4) returned 1
	[0082.254] CloseHandle (hObject=0x2d4) returned 1
	[0082.254] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.255] SetEndOfFile (hFile=0x314) returned 1
	[0082.257] CloseHandle (hObject=0x314) returned 1
	[0082.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.258] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 1
	[0082.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.261] lstrlenW (lpString=".doc") returned 4
	[0082.261] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.261] lstrlenW (lpString=".docx") returned 5
	[0082.261] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0082.261] lstrlenW (lpString=".pdf") returned 4
	[0082.261] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.261] lstrlenW (lpString=".xls") returned 4
	[0082.261] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.261] lstrlenW (lpString=".xlsx") returned 5
	[0082.262] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0082.262] lstrlenW (lpString=".ppt") returned 4
	[0082.262] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.262] lstrlenW (lpString=".zip") returned 4
	[0082.262] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.262] lstrlenW (lpString=".rar") returned 4
	[0082.262] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.262] lstrlenW (lpString=".bz2") returned 4
	[0082.262] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.262] lstrlenW (lpString=".7z") returned 3
	[0082.262] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.262] lstrlenW (lpString=".dbf") returned 4
	[0082.262] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.262] lstrlenW (lpString=".1cd") returned 4
	[0082.262] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.262] lstrlenW (lpString=".jpg") returned 4
	[0082.262] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.262] lstrlenW (lpString=".doc") returned 4
	[0082.262] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.262] lstrlenW (lpString=".docx") returned 5
	[0082.262] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0082.262] lstrlenW (lpString=".pdf") returned 4
	[0082.262] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.263] lstrlenW (lpString=".xls") returned 4
	[0082.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.263] lstrlenW (lpString=".xlsx") returned 5
	[0082.263] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0082.263] lstrlenW (lpString=".ppt") returned 4
	[0082.263] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.263] lstrlenW (lpString=".zip") returned 4
	[0082.263] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.263] lstrlenW (lpString=".rar") returned 4
	[0082.263] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.263] lstrlenW (lpString=".bz2") returned 4
	[0082.263] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.263] lstrlenW (lpString=".7z") returned 3
	[0082.263] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.263] lstrlenW (lpString=".dbf") returned 4
	[0082.263] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.263] lstrlenW (lpString=".1cd") returned 4
	[0082.263] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0082.263] lstrlenW (lpString=".jpg") returned 4
	[0082.263] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.263] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0082.263] lstrlenW (lpString="j2pkcs11.dll") returned 12
	[0082.263] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0082.264] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=63552) returned 1
	[0082.264] CloseHandle (hObject=0x314) returned 1
	[0082.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20
	[0082.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0082.264] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.264] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0082.265] GetLastError () returned 0x0
	[0082.265] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0xf840, lpOverlapped=0x0) returned 1
	[0082.267] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf850, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf850, lpOverlapped=0x0) returned 1
	[0082.269] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.269] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xec, lpOverlapped=0x0) returned 1
	[0082.269] SetEndOfFile (hFile=0x2d4) returned 1
	[0082.269] CloseHandle (hObject=0x2d4) returned 1
	[0082.269] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.269] SetEndOfFile (hFile=0x314) returned 1
	[0082.271] CloseHandle (hObject=0x314) returned 1
	[0082.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.271] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 1
	[0082.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.271] lstrlenW (lpString=".doc") returned 4
	[0082.271] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.271] lstrlenW (lpString=".docx") returned 5
	[0082.271] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0082.271] lstrlenW (lpString=".pdf") returned 4
	[0082.271] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.271] lstrlenW (lpString=".xls") returned 4
	[0082.271] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.271] lstrlenW (lpString=".xlsx") returned 5
	[0082.271] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0082.271] lstrlenW (lpString=".ppt") returned 4
	[0082.271] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.272] lstrlenW (lpString=".zip") returned 4
	[0082.272] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.272] lstrlenW (lpString=".rar") returned 4
	[0082.272] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.272] lstrlenW (lpString=".bz2") returned 4
	[0082.272] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.272] lstrlenW (lpString=".7z") returned 3
	[0082.272] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.272] lstrlenW (lpString=".dbf") returned 4
	[0082.272] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.272] lstrlenW (lpString=".1cd") returned 4
	[0082.272] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.272] lstrlenW (lpString=".jpg") returned 4
	[0082.272] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.272] lstrlenW (lpString=".doc") returned 4
	[0082.272] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.272] lstrlenW (lpString=".docx") returned 5
	[0082.272] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0082.272] lstrlenW (lpString=".pdf") returned 4
	[0082.272] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.272] lstrlenW (lpString=".xls") returned 4
	[0082.273] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.273] lstrlenW (lpString=".xlsx") returned 5
	[0082.273] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0082.273] lstrlenW (lpString=".ppt") returned 4
	[0082.273] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.273] lstrlenW (lpString=".zip") returned 4
	[0082.273] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.273] lstrlenW (lpString=".rar") returned 4
	[0082.273] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.273] lstrlenW (lpString=".bz2") returned 4
	[0082.273] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.273] lstrlenW (lpString=".7z") returned 3
	[0082.273] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.273] lstrlenW (lpString=".dbf") returned 4
	[0082.273] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.273] lstrlenW (lpString=".1cd") returned 4
	[0082.273] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0082.273] lstrlenW (lpString=".jpg") returned 4
	[0082.273] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.273] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0082.274] lstrlenW (lpString="jaas_nt.dll") returned 11
	[0082.274] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0082.274] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=21056) returned 1
	[0082.274] CloseHandle (hObject=0x314) returned 1
	[0082.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20
	[0082.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.274] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0082.274] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.274] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.274] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0082.275] GetLastError () returned 0x0
	[0082.275] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x5240, lpOverlapped=0x0) returned 1
	[0082.276] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x5250, lpOverlapped=0x0) returned 1
	[0082.278] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.278] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xea, lpOverlapped=0x0) returned 1
	[0082.278] SetEndOfFile (hFile=0x2d4) returned 1
	[0082.278] CloseHandle (hObject=0x2d4) returned 1
	[0082.278] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.278] SetEndOfFile (hFile=0x314) returned 1
	[0082.279] CloseHandle (hObject=0x314) returned 1
	[0082.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.279] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 1
	[0082.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.279] lstrlenW (lpString=".doc") returned 4
	[0082.279] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.279] lstrlenW (lpString=".docx") returned 5
	[0082.279] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0082.280] lstrlenW (lpString=".pdf") returned 4
	[0082.280] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.280] lstrlenW (lpString=".xls") returned 4
	[0082.280] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.280] lstrlenW (lpString=".xlsx") returned 5
	[0082.280] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0082.280] lstrlenW (lpString=".ppt") returned 4
	[0082.280] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.280] lstrlenW (lpString=".zip") returned 4
	[0082.280] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.280] lstrlenW (lpString=".rar") returned 4
	[0082.280] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.280] lstrlenW (lpString=".bz2") returned 4
	[0082.280] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.280] lstrlenW (lpString=".7z") returned 3
	[0082.280] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.280] lstrlenW (lpString=".dbf") returned 4
	[0082.280] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.280] lstrlenW (lpString=".1cd") returned 4
	[0082.280] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.280] lstrlenW (lpString=".jpg") returned 4
	[0082.280] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.281] lstrlenW (lpString=".doc") returned 4
	[0082.281] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.281] lstrlenW (lpString=".docx") returned 5
	[0082.281] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0082.281] lstrlenW (lpString=".pdf") returned 4
	[0082.281] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.281] lstrlenW (lpString=".xls") returned 4
	[0082.281] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.281] lstrlenW (lpString=".xlsx") returned 5
	[0082.281] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0082.281] lstrlenW (lpString=".ppt") returned 4
	[0082.281] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.281] lstrlenW (lpString=".zip") returned 4
	[0082.281] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.281] lstrlenW (lpString=".rar") returned 4
	[0082.281] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.281] lstrlenW (lpString=".bz2") returned 4
	[0082.281] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.281] lstrlenW (lpString=".7z") returned 3
	[0082.281] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.281] lstrlenW (lpString=".dbf") returned 4
	[0082.282] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.282] lstrlenW (lpString=".1cd") returned 4
	[0082.282] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0082.282] lstrlenW (lpString=".jpg") returned 4
	[0082.282] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.282] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0082.282] lstrlenW (lpString="jabswitch.exe") returned 13
	[0082.282] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0082.282] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=34368) returned 1
	[0082.282] CloseHandle (hObject=0x314) returned 1
	[0082.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20
	[0082.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.283] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0082.283] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.283] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.283] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0082.283] GetLastError () returned 0x0
	[0082.283] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x8640, lpOverlapped=0x0) returned 1
	[0082.681] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x8650, lpOverlapped=0x0) returned 1
	[0082.683] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.683] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xee, lpOverlapped=0x0) returned 1
	[0082.683] SetEndOfFile (hFile=0x2d4) returned 1
	[0082.683] CloseHandle (hObject=0x2d4) returned 1
	[0082.683] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.683] SetEndOfFile (hFile=0x314) returned 1
	[0082.684] CloseHandle (hObject=0x314) returned 1
	[0082.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.684] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 1
	[0082.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.685] lstrlenW (lpString=".doc") returned 4
	[0082.685] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0082.685] lstrlenW (lpString=".docx") returned 5
	[0082.685] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1
	[0082.685] lstrlenW (lpString=".pdf") returned 4
	[0082.685] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0082.685] lstrlenW (lpString=".xls") returned 4
	[0082.685] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0082.685] lstrlenW (lpString=".xlsx") returned 5
	[0082.685] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1
	[0082.685] lstrlenW (lpString=".ppt") returned 4
	[0082.685] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0082.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.685] lstrlenW (lpString=".zip") returned 4
	[0082.685] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0082.685] lstrlenW (lpString=".rar") returned 4
	[0082.685] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0082.685] lstrlenW (lpString=".bz2") returned 4
	[0082.685] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0082.685] lstrlenW (lpString=".7z") returned 3
	[0082.685] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0082.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.685] lstrlenW (lpString=".dbf") returned 4
	[0082.685] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0082.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.686] lstrlenW (lpString=".1cd") returned 4
	[0082.686] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0082.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.686] lstrlenW (lpString=".jpg") returned 4
	[0082.686] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0082.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.686] lstrlenW (lpString=".doc") returned 4
	[0082.686] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0082.686] lstrlenW (lpString=".docx") returned 5
	[0082.686] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1
	[0082.686] lstrlenW (lpString=".pdf") returned 4
	[0082.686] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0082.686] lstrlenW (lpString=".xls") returned 4
	[0082.686] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0082.686] lstrlenW (lpString=".xlsx") returned 5
	[0082.686] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1
	[0082.686] lstrlenW (lpString=".ppt") returned 4
	[0082.686] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0082.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.686] lstrlenW (lpString=".zip") returned 4
	[0082.686] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0082.686] lstrlenW (lpString=".rar") returned 4
	[0082.686] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0082.686] lstrlenW (lpString=".bz2") returned 4
	[0082.686] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0082.686] lstrlenW (lpString=".7z") returned 3
	[0082.686] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0082.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.686] lstrlenW (lpString=".dbf") returned 4
	[0082.687] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0082.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.687] lstrlenW (lpString=".1cd") returned 4
	[0082.687] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0082.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0082.687] lstrlenW (lpString=".jpg") returned 4
	[0082.687] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0082.687] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0082.687] lstrlenW (lpString="javafx_iio.dll") returned 14
	[0082.687] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0082.687] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=128064) returned 1
	[0082.687] CloseHandle (hObject=0x314) returned 1
	[0082.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20
	[0082.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.688] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0082.688] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.688] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.688] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0082.688] GetLastError () returned 0x0
	[0082.688] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x1f440, lpOverlapped=0x0) returned 1
	[0082.691] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x1f450, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x1f450, lpOverlapped=0x0) returned 1
	[0082.694] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.694] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0082.694] SetEndOfFile (hFile=0x2d4) returned 1
	[0082.694] CloseHandle (hObject=0x2d4) returned 1
	[0082.694] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.695] SetEndOfFile (hFile=0x314) returned 1
	[0082.696] CloseHandle (hObject=0x314) returned 1
	[0082.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.696] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 1
	[0082.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.697] lstrlenW (lpString=".doc") returned 4
	[0082.697] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.697] lstrlenW (lpString=".docx") returned 5
	[0082.697] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0082.697] lstrlenW (lpString=".pdf") returned 4
	[0082.697] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.697] lstrlenW (lpString=".xls") returned 4
	[0082.697] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.697] lstrlenW (lpString=".xlsx") returned 5
	[0082.697] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0082.697] lstrlenW (lpString=".ppt") returned 4
	[0082.697] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.697] lstrlenW (lpString=".zip") returned 4
	[0082.697] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.697] lstrlenW (lpString=".rar") returned 4
	[0082.697] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.697] lstrlenW (lpString=".bz2") returned 4
	[0082.697] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.697] lstrlenW (lpString=".7z") returned 3
	[0082.697] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.697] lstrlenW (lpString=".dbf") returned 4
	[0082.697] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.698] lstrlenW (lpString=".1cd") returned 4
	[0082.698] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.698] lstrlenW (lpString=".jpg") returned 4
	[0082.698] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.698] lstrlenW (lpString=".doc") returned 4
	[0082.698] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.698] lstrlenW (lpString=".docx") returned 5
	[0082.698] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0082.698] lstrlenW (lpString=".pdf") returned 4
	[0082.698] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.698] lstrlenW (lpString=".xls") returned 4
	[0082.698] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.698] lstrlenW (lpString=".xlsx") returned 5
	[0082.698] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0082.698] lstrlenW (lpString=".ppt") returned 4
	[0082.698] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.698] lstrlenW (lpString=".zip") returned 4
	[0082.698] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.698] lstrlenW (lpString=".rar") returned 4
	[0082.698] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.698] lstrlenW (lpString=".bz2") returned 4
	[0082.698] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.698] lstrlenW (lpString=".7z") returned 3
	[0082.699] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.699] lstrlenW (lpString=".dbf") returned 4
	[0082.699] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.699] lstrlenW (lpString=".1cd") returned 4
	[0082.699] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0082.699] lstrlenW (lpString=".jpg") returned 4
	[0082.699] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.699] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0082.699] lstrlenW (lpString="javaw.exe") returned 9
	[0082.699] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0082.699] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=206912) returned 1
	[0082.700] CloseHandle (hObject=0x314) returned 1
	[0082.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20
	[0082.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.700] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0082.700] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.700] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.700] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0082.700] GetLastError () returned 0x0
	[0082.700] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x32840, lpOverlapped=0x0) returned 1
	[0082.705] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x32850, lpOverlapped=0x0) returned 1
	[0082.709] ReadFile (in: hFile=0x314, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.709] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0082.709] SetEndOfFile (hFile=0x2d4) returned 1
	[0082.709] CloseHandle (hObject=0x2d4) returned 1
	[0082.709] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.709] SetEndOfFile (hFile=0x314) returned 1
	[0082.711] CloseHandle (hObject=0x314) returned 1
	[0082.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.711] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 1
	[0082.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.712] lstrlenW (lpString=".doc") returned 4
	[0082.712] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0082.712] lstrlenW (lpString=".docx") returned 5
	[0082.712] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1
	[0082.712] lstrlenW (lpString=".pdf") returned 4
	[0082.712] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0082.712] lstrlenW (lpString=".xls") returned 4
	[0082.712] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0082.712] lstrlenW (lpString=".xlsx") returned 5
	[0082.712] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1
	[0082.712] lstrlenW (lpString=".ppt") returned 4
	[0082.712] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0082.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.712] lstrlenW (lpString=".zip") returned 4
	[0082.712] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0082.712] lstrlenW (lpString=".rar") returned 4
	[0082.712] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0082.712] lstrlenW (lpString=".bz2") returned 4
	[0082.712] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0082.712] lstrlenW (lpString=".7z") returned 3
	[0082.712] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0082.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.713] lstrlenW (lpString=".dbf") returned 4
	[0082.713] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0082.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.713] lstrlenW (lpString=".1cd") returned 4
	[0082.713] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0082.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.713] lstrlenW (lpString=".jpg") returned 4
	[0082.713] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0082.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.713] lstrlenW (lpString=".doc") returned 4
	[0082.713] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0082.713] lstrlenW (lpString=".docx") returned 5
	[0082.713] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1
	[0082.713] lstrlenW (lpString=".pdf") returned 4
	[0082.713] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0082.713] lstrlenW (lpString=".xls") returned 4
	[0082.713] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0082.713] lstrlenW (lpString=".xlsx") returned 5
	[0082.713] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1
	[0082.713] lstrlenW (lpString=".ppt") returned 4
	[0082.713] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0082.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.713] lstrlenW (lpString=".zip") returned 4
	[0082.713] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0082.714] lstrlenW (lpString=".rar") returned 4
	[0082.714] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0082.714] lstrlenW (lpString=".bz2") returned 4
	[0082.714] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0082.714] lstrlenW (lpString=".7z") returned 3
	[0082.714] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0082.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.714] lstrlenW (lpString=".dbf") returned 4
	[0082.714] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0082.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.714] lstrlenW (lpString=".1cd") returned 4
	[0082.714] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0082.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0082.714] lstrlenW (lpString=".jpg") returned 4
	[0082.714] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0082.714] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0082.714] lstrlenW (lpString="javaws.exe") returned 10
	[0082.714] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0083.077] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=319552) returned 1
	[0083.107] CloseHandle (hObject=0x318) returned 1
	[0083.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20
	[0083.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.107] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0083.107] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.107] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.107] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0083.108] GetLastError () returned 0x0
	[0083.108] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x4e040, lpOverlapped=0x0) returned 1
	[0083.116] WriteFile (in: hFile=0x35c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x4e050, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x4e050, lpOverlapped=0x0) returned 1
	[0083.121] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.121] WriteFile (in: hFile=0x35c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0083.122] SetEndOfFile (hFile=0x35c) returned 1
	[0083.122] CloseHandle (hObject=0x35c) returned 1
	[0083.122] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.122] SetEndOfFile (hFile=0x318) returned 1
	[0083.125] CloseHandle (hObject=0x318) returned 1
	[0083.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.125] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 1
	[0083.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.126] lstrlenW (lpString=".doc") returned 4
	[0083.126] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.126] lstrlenW (lpString=".docx") returned 5
	[0083.126] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0083.126] lstrlenW (lpString=".pdf") returned 4
	[0083.126] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.126] lstrlenW (lpString=".xls") returned 4
	[0083.126] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.126] lstrlenW (lpString=".xlsx") returned 5
	[0083.126] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0083.126] lstrlenW (lpString=".ppt") returned 4
	[0083.126] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.126] lstrlenW (lpString=".zip") returned 4
	[0083.126] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.127] lstrlenW (lpString=".rar") returned 4
	[0083.127] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.127] lstrlenW (lpString=".bz2") returned 4
	[0083.127] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.127] lstrlenW (lpString=".7z") returned 3
	[0083.127] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.127] lstrlenW (lpString=".dbf") returned 4
	[0083.127] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.127] lstrlenW (lpString=".1cd") returned 4
	[0083.127] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.127] lstrlenW (lpString=".jpg") returned 4
	[0083.127] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.127] lstrlenW (lpString=".doc") returned 4
	[0083.127] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.127] lstrlenW (lpString=".docx") returned 5
	[0083.127] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0083.127] lstrlenW (lpString=".pdf") returned 4
	[0083.128] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.128] lstrlenW (lpString=".xls") returned 4
	[0083.128] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.128] lstrlenW (lpString=".xlsx") returned 5
	[0083.128] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0083.128] lstrlenW (lpString=".ppt") returned 4
	[0083.128] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.128] lstrlenW (lpString=".zip") returned 4
	[0083.128] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.128] lstrlenW (lpString=".rar") returned 4
	[0083.128] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.128] lstrlenW (lpString=".bz2") returned 4
	[0083.128] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.128] lstrlenW (lpString=".7z") returned 3
	[0083.128] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.128] lstrlenW (lpString=".dbf") returned 4
	[0083.128] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.128] lstrlenW (lpString=".1cd") returned 4
	[0083.128] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0083.128] lstrlenW (lpString=".jpg") returned 4
	[0083.129] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.129] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.129] lstrlenW (lpString="jfr.dll") returned 7
	[0083.129] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0083.129] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=26688) returned 1
	[0083.129] CloseHandle (hObject=0x318) returned 1
	[0083.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20
	[0083.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.130] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0083.130] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.130] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.130] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0083.130] GetLastError () returned 0x0
	[0083.130] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x6840, lpOverlapped=0x0) returned 1
	[0083.132] WriteFile (in: hFile=0x35c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x6850, lpOverlapped=0x0) returned 1
	[0083.134] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.134] WriteFile (in: hFile=0x35c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0083.134] SetEndOfFile (hFile=0x35c) returned 1
	[0083.134] CloseHandle (hObject=0x35c) returned 1
	[0083.134] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.134] SetEndOfFile (hFile=0x318) returned 1
	[0083.135] CloseHandle (hObject=0x318) returned 1
	[0083.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.135] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 1
	[0083.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.135] lstrlenW (lpString=".doc") returned 4
	[0083.136] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.136] lstrlenW (lpString=".docx") returned 5
	[0083.136] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0083.136] lstrlenW (lpString=".pdf") returned 4
	[0083.136] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.136] lstrlenW (lpString=".xls") returned 4
	[0083.136] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.136] lstrlenW (lpString=".xlsx") returned 5
	[0083.136] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0083.136] lstrlenW (lpString=".ppt") returned 4
	[0083.136] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.136] lstrlenW (lpString=".zip") returned 4
	[0083.136] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.136] lstrlenW (lpString=".rar") returned 4
	[0083.136] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.136] lstrlenW (lpString=".bz2") returned 4
	[0083.136] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.136] lstrlenW (lpString=".7z") returned 3
	[0083.136] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.136] lstrlenW (lpString=".dbf") returned 4
	[0083.136] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.136] lstrlenW (lpString=".1cd") returned 4
	[0083.136] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.137] lstrlenW (lpString=".jpg") returned 4
	[0083.137] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.137] lstrlenW (lpString=".doc") returned 4
	[0083.137] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.137] lstrlenW (lpString=".docx") returned 5
	[0083.137] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0083.137] lstrlenW (lpString=".pdf") returned 4
	[0083.137] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.137] lstrlenW (lpString=".xls") returned 4
	[0083.137] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.137] lstrlenW (lpString=".xlsx") returned 5
	[0083.137] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0083.137] lstrlenW (lpString=".ppt") returned 4
	[0083.137] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.137] lstrlenW (lpString=".zip") returned 4
	[0083.137] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.137] lstrlenW (lpString=".rar") returned 4
	[0083.137] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.137] lstrlenW (lpString=".bz2") returned 4
	[0083.137] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.137] lstrlenW (lpString=".7z") returned 3
	[0083.138] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.138] lstrlenW (lpString=".dbf") returned 4
	[0083.138] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.138] lstrlenW (lpString=".1cd") returned 4
	[0083.138] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0083.138] lstrlenW (lpString=".jpg") returned 4
	[0083.138] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.138] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.138] lstrlenW (lpString="jfxmedia.dll") returned 12
	[0083.138] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0083.138] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=139840) returned 1
	[0083.138] CloseHandle (hObject=0x318) returned 1
	[0083.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20
	[0083.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.139] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0083.139] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.139] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.139] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0083.139] GetLastError () returned 0x0
	[0083.139] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x22240, lpOverlapped=0x0) returned 1
	[0083.473] WriteFile (in: hFile=0x35c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x22250, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x22250, lpOverlapped=0x0) returned 1
	[0083.477] ReadFile (in: hFile=0x318, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.478] WriteFile (in: hFile=0x35c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.478] SetEndOfFile (hFile=0x35c) returned 1
	[0083.478] CloseHandle (hObject=0x35c) returned 1
	[0083.478] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.478] SetEndOfFile (hFile=0x318) returned 1
	[0083.480] CloseHandle (hObject=0x318) returned 1
	[0083.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.480] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 1
	[0083.692] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.692] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.692] lstrlenW (lpString=".doc") returned 4
	[0083.693] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.693] lstrlenW (lpString=".docx") returned 5
	[0083.693] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0083.693] lstrlenW (lpString=".pdf") returned 4
	[0083.693] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.693] lstrlenW (lpString=".xls") returned 4
	[0083.693] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.693] lstrlenW (lpString=".xlsx") returned 5
	[0083.693] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0083.693] lstrlenW (lpString=".ppt") returned 4
	[0083.693] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.693] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.693] lstrlenW (lpString=".zip") returned 4
	[0083.693] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.693] lstrlenW (lpString=".rar") returned 4
	[0083.693] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.693] lstrlenW (lpString=".bz2") returned 4
	[0083.693] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.693] lstrlenW (lpString=".7z") returned 3
	[0083.693] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.693] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.693] lstrlenW (lpString=".dbf") returned 4
	[0083.694] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.694] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.694] lstrlenW (lpString=".1cd") returned 4
	[0083.694] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.694] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.694] lstrlenW (lpString=".jpg") returned 4
	[0083.694] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.694] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.694] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.694] lstrlenW (lpString=".doc") returned 4
	[0083.694] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.694] lstrlenW (lpString=".docx") returned 5
	[0083.694] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0083.694] lstrlenW (lpString=".pdf") returned 4
	[0083.694] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.694] lstrlenW (lpString=".xls") returned 4
	[0083.694] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.695] lstrlenW (lpString=".xlsx") returned 5
	[0083.695] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0083.695] lstrlenW (lpString=".ppt") returned 4
	[0083.695] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.695] lstrlenW (lpString=".zip") returned 4
	[0083.695] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.695] lstrlenW (lpString=".rar") returned 4
	[0083.695] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.695] lstrlenW (lpString=".bz2") returned 4
	[0083.695] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.695] lstrlenW (lpString=".7z") returned 3
	[0083.695] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.695] lstrlenW (lpString=".dbf") returned 4
	[0083.695] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.695] lstrlenW (lpString=".1cd") returned 4
	[0083.695] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0083.695] lstrlenW (lpString=".jpg") returned 4
	[0083.695] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.696] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.696] lstrlenW (lpString="jsdt.dll") returned 8
	[0083.696] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0084.596] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=18496) returned 1
	[0084.597] CloseHandle (hObject=0x360) returned 1
	[0084.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20
	[0084.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.687] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0084.695] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.695] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.695] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.695] GetLastError () returned 0x0
	[0084.695] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x4840, lpOverlapped=0x0) returned 1
	[0084.697] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x4850, lpOverlapped=0x0) returned 1
	[0084.698] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.698] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0084.698] SetEndOfFile (hFile=0x378) returned 1
	[0084.698] CloseHandle (hObject=0x378) returned 1
	[0084.698] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.698] SetEndOfFile (hFile=0x390) returned 1
	[0084.699] CloseHandle (hObject=0x390) returned 1
	[0084.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0084.700] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 1
	[0084.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.700] lstrlenW (lpString=".doc") returned 4
	[0084.700] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.700] lstrlenW (lpString=".docx") returned 5
	[0084.700] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0084.700] lstrlenW (lpString=".pdf") returned 4
	[0084.700] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.700] lstrlenW (lpString=".xls") returned 4
	[0084.700] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.700] lstrlenW (lpString=".xlsx") returned 5
	[0084.700] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0084.700] lstrlenW (lpString=".ppt") returned 4
	[0084.700] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.701] lstrlenW (lpString=".zip") returned 4
	[0084.701] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.701] lstrlenW (lpString=".rar") returned 4
	[0084.701] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.701] lstrlenW (lpString=".bz2") returned 4
	[0084.701] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.701] lstrlenW (lpString=".7z") returned 3
	[0084.701] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.701] lstrlenW (lpString=".dbf") returned 4
	[0084.701] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.701] lstrlenW (lpString=".1cd") returned 4
	[0084.701] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.701] lstrlenW (lpString=".jpg") returned 4
	[0084.701] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.701] lstrlenW (lpString=".doc") returned 4
	[0084.701] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.701] lstrlenW (lpString=".docx") returned 5
	[0084.701] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0084.701] lstrlenW (lpString=".pdf") returned 4
	[0084.701] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.701] lstrlenW (lpString=".xls") returned 4
	[0084.702] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.702] lstrlenW (lpString=".xlsx") returned 5
	[0084.702] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0084.702] lstrlenW (lpString=".ppt") returned 4
	[0084.702] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.702] lstrlenW (lpString=".zip") returned 4
	[0084.702] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.702] lstrlenW (lpString=".rar") returned 4
	[0084.702] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.702] lstrlenW (lpString=".bz2") returned 4
	[0084.702] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.702] lstrlenW (lpString=".7z") returned 3
	[0084.702] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.702] lstrlenW (lpString=".dbf") returned 4
	[0084.702] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.702] lstrlenW (lpString=".1cd") returned 4
	[0084.702] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0084.702] lstrlenW (lpString=".jpg") returned 4
	[0084.702] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.702] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0084.703] lstrlenW (lpString="management.dll") returned 14
	[0084.703] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0084.703] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=36928) returned 1
	[0084.703] CloseHandle (hObject=0x390) returned 1
	[0084.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20
	[0084.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.703] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0084.703] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.703] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.703] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.704] GetLastError () returned 0x0
	[0084.704] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x9040, lpOverlapped=0x0) returned 1
	[0084.706] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x9050, lpOverlapped=0x0) returned 1
	[0084.707] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.707] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0084.707] SetEndOfFile (hFile=0x378) returned 1
	[0084.707] CloseHandle (hObject=0x378) returned 1
	[0084.707] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.708] SetEndOfFile (hFile=0x390) returned 1
	[0084.709] CloseHandle (hObject=0x390) returned 1
	[0084.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0084.709] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1
	[0084.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.709] lstrlenW (lpString=".doc") returned 4
	[0084.709] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.709] lstrlenW (lpString=".docx") returned 5
	[0084.709] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0084.709] lstrlenW (lpString=".pdf") returned 4
	[0084.709] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.709] lstrlenW (lpString=".xls") returned 4
	[0084.709] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.709] lstrlenW (lpString=".xlsx") returned 5
	[0084.709] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0084.710] lstrlenW (lpString=".ppt") returned 4
	[0084.710] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.710] lstrlenW (lpString=".zip") returned 4
	[0084.710] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.710] lstrlenW (lpString=".rar") returned 4
	[0084.710] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.710] lstrlenW (lpString=".bz2") returned 4
	[0084.710] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.710] lstrlenW (lpString=".7z") returned 3
	[0084.710] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.710] lstrlenW (lpString=".dbf") returned 4
	[0084.710] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.710] lstrlenW (lpString=".1cd") returned 4
	[0084.710] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.710] lstrlenW (lpString=".jpg") returned 4
	[0084.710] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.711] lstrlenW (lpString=".doc") returned 4
	[0084.711] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.711] lstrlenW (lpString=".docx") returned 5
	[0084.711] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0084.711] lstrlenW (lpString=".pdf") returned 4
	[0084.711] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.711] lstrlenW (lpString=".xls") returned 4
	[0084.711] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.711] lstrlenW (lpString=".xlsx") returned 5
	[0084.711] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0084.711] lstrlenW (lpString=".ppt") returned 4
	[0084.711] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.711] lstrlenW (lpString=".zip") returned 4
	[0084.711] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.711] lstrlenW (lpString=".rar") returned 4
	[0084.711] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.711] lstrlenW (lpString=".bz2") returned 4
	[0084.711] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.711] lstrlenW (lpString=".7z") returned 3
	[0084.711] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.711] lstrlenW (lpString=".dbf") returned 4
	[0084.711] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.711] lstrlenW (lpString=".1cd") returned 4
	[0084.712] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0084.712] lstrlenW (lpString=".jpg") returned 4
	[0084.712] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.712] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0084.712] lstrlenW (lpString="mlib_image.dll") returned 14
	[0084.712] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0084.713] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=653888) returned 1
	[0084.713] CloseHandle (hObject=0x390) returned 1
	[0084.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20
	[0084.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0084.713] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.713] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.713] GetLastError () returned 0x0
	[0084.714] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x9fa40, lpOverlapped=0x0) returned 1
	[0084.726] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x9fa50, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x9fa50, lpOverlapped=0x0) returned 1
	[0084.737] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.737] WriteFile (in: hFile=0x378, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0084.738] SetEndOfFile (hFile=0x378) returned 1
	[0084.738] CloseHandle (hObject=0x378) returned 1
	[0084.738] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.738] SetEndOfFile (hFile=0x390) returned 1
	[0085.228] CloseHandle (hObject=0x390) returned 1
	[0085.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.229] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 1
	[0085.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.229] lstrlenW (lpString=".doc") returned 4
	[0085.229] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.229] lstrlenW (lpString=".docx") returned 5
	[0085.229] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0085.229] lstrlenW (lpString=".pdf") returned 4
	[0085.229] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.229] lstrlenW (lpString=".xls") returned 4
	[0085.229] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.229] lstrlenW (lpString=".xlsx") returned 5
	[0085.229] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0085.229] lstrlenW (lpString=".ppt") returned 4
	[0085.229] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.229] lstrlenW (lpString=".zip") returned 4
	[0085.230] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.230] lstrlenW (lpString=".rar") returned 4
	[0085.230] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.230] lstrlenW (lpString=".bz2") returned 4
	[0085.230] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.230] lstrlenW (lpString=".7z") returned 3
	[0085.230] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.230] lstrlenW (lpString=".dbf") returned 4
	[0085.230] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.230] lstrlenW (lpString=".1cd") returned 4
	[0085.230] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.230] lstrlenW (lpString=".jpg") returned 4
	[0085.230] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.230] lstrlenW (lpString=".doc") returned 4
	[0085.230] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.230] lstrlenW (lpString=".docx") returned 5
	[0085.230] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0085.230] lstrlenW (lpString=".pdf") returned 4
	[0085.230] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.230] lstrlenW (lpString=".xls") returned 4
	[0085.230] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.230] lstrlenW (lpString=".xlsx") returned 5
	[0085.230] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0085.230] lstrlenW (lpString=".ppt") returned 4
	[0085.230] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.231] lstrlenW (lpString=".zip") returned 4
	[0085.231] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.231] lstrlenW (lpString=".rar") returned 4
	[0085.231] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.231] lstrlenW (lpString=".bz2") returned 4
	[0085.231] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.231] lstrlenW (lpString=".7z") returned 3
	[0085.231] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.231] lstrlenW (lpString=".dbf") returned 4
	[0085.231] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.231] lstrlenW (lpString=".1cd") returned 4
	[0085.231] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0085.231] lstrlenW (lpString=".jpg") returned 4
	[0085.231] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.231] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0085.231] lstrlenW (lpString="net.dll") returned 7
	[0085.231] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0085.232] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=96832) returned 1
	[0085.232] CloseHandle (hObject=0x390) returned 1
	[0085.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20
	[0085.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0085.233] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.233] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0085.233] GetLastError () returned 0x0
	[0085.233] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x17a40, lpOverlapped=0x0) returned 1
	[0085.239] WriteFile (in: hFile=0x340, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x17a50, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x17a50, lpOverlapped=0x0) returned 1
	[0085.242] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.242] WriteFile (in: hFile=0x340, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0085.242] SetEndOfFile (hFile=0x340) returned 1
	[0085.242] CloseHandle (hObject=0x340) returned 1
	[0085.242] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.242] SetEndOfFile (hFile=0x390) returned 1
	[0085.244] CloseHandle (hObject=0x390) returned 1
	[0085.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.244] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 1
	[0085.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.244] lstrlenW (lpString=".doc") returned 4
	[0085.244] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.244] lstrlenW (lpString=".docx") returned 5
	[0085.244] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0085.244] lstrlenW (lpString=".pdf") returned 4
	[0085.245] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.245] lstrlenW (lpString=".xls") returned 4
	[0085.245] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.245] lstrlenW (lpString=".xlsx") returned 5
	[0085.245] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0085.245] lstrlenW (lpString=".ppt") returned 4
	[0085.245] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.245] lstrlenW (lpString=".zip") returned 4
	[0085.245] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.245] lstrlenW (lpString=".rar") returned 4
	[0085.245] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.245] lstrlenW (lpString=".bz2") returned 4
	[0085.245] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.245] lstrlenW (lpString=".7z") returned 3
	[0085.245] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.245] lstrlenW (lpString=".dbf") returned 4
	[0085.245] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.245] lstrlenW (lpString=".1cd") returned 4
	[0085.245] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.245] lstrlenW (lpString=".jpg") returned 4
	[0085.245] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.246] lstrlenW (lpString=".doc") returned 4
	[0085.246] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.246] lstrlenW (lpString=".docx") returned 5
	[0085.246] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0085.246] lstrlenW (lpString=".pdf") returned 4
	[0085.246] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.246] lstrlenW (lpString=".xls") returned 4
	[0085.246] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.246] lstrlenW (lpString=".xlsx") returned 5
	[0085.246] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0085.246] lstrlenW (lpString=".ppt") returned 4
	[0085.246] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.246] lstrlenW (lpString=".zip") returned 4
	[0085.246] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.246] lstrlenW (lpString=".rar") returned 4
	[0085.246] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.246] lstrlenW (lpString=".bz2") returned 4
	[0085.246] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.246] lstrlenW (lpString=".7z") returned 3
	[0085.246] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.246] lstrlenW (lpString=".dbf") returned 4
	[0085.246] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.246] lstrlenW (lpString=".1cd") returned 4
	[0085.246] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0085.246] lstrlenW (lpString=".jpg") returned 4
	[0085.247] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.247] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0085.247] lstrlenW (lpString="nio.dll") returned 7
	[0085.247] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0085.247] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=60480) returned 1
	[0085.247] CloseHandle (hObject=0x390) returned 1
	[0085.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20
	[0085.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.247] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0085.247] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.248] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.248] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0085.248] GetLastError () returned 0x0
	[0085.248] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0xec40, lpOverlapped=0x0) returned 1
	[0085.250] WriteFile (in: hFile=0x340, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xec50, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xec50, lpOverlapped=0x0) returned 1
	[0085.252] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.252] WriteFile (in: hFile=0x340, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0085.252] SetEndOfFile (hFile=0x340) returned 1
	[0085.252] CloseHandle (hObject=0x340) returned 1
	[0085.252] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.252] SetEndOfFile (hFile=0x390) returned 1
	[0085.253] CloseHandle (hObject=0x390) returned 1
	[0085.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.254] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 1
	[0085.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.254] lstrlenW (lpString=".doc") returned 4
	[0085.254] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.254] lstrlenW (lpString=".docx") returned 5
	[0085.254] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0085.254] lstrlenW (lpString=".pdf") returned 4
	[0085.254] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.254] lstrlenW (lpString=".xls") returned 4
	[0085.254] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.254] lstrlenW (lpString=".xlsx") returned 5
	[0085.254] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0085.254] lstrlenW (lpString=".ppt") returned 4
	[0085.254] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.255] lstrlenW (lpString=".zip") returned 4
	[0085.255] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.255] lstrlenW (lpString=".rar") returned 4
	[0085.255] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.255] lstrlenW (lpString=".bz2") returned 4
	[0085.255] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.255] lstrlenW (lpString=".7z") returned 3
	[0085.255] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.255] lstrlenW (lpString=".dbf") returned 4
	[0085.255] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.255] lstrlenW (lpString=".1cd") returned 4
	[0085.255] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.255] lstrlenW (lpString=".jpg") returned 4
	[0085.255] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.255] lstrlenW (lpString=".doc") returned 4
	[0085.255] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.255] lstrlenW (lpString=".docx") returned 5
	[0085.255] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0085.255] lstrlenW (lpString=".pdf") returned 4
	[0085.255] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.255] lstrlenW (lpString=".xls") returned 4
	[0085.255] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.255] lstrlenW (lpString=".xlsx") returned 5
	[0085.256] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0085.256] lstrlenW (lpString=".ppt") returned 4
	[0085.256] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.256] lstrlenW (lpString=".zip") returned 4
	[0085.256] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.256] lstrlenW (lpString=".rar") returned 4
	[0085.256] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.256] lstrlenW (lpString=".bz2") returned 4
	[0085.256] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.256] lstrlenW (lpString=".7z") returned 3
	[0085.256] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.256] lstrlenW (lpString=".dbf") returned 4
	[0085.256] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.256] lstrlenW (lpString=".1cd") returned 4
	[0085.256] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0085.256] lstrlenW (lpString=".jpg") returned 4
	[0085.256] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.256] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0085.257] lstrlenW (lpString="npt.dll") returned 7
	[0085.257] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0085.257] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=19008) returned 1
	[0085.257] CloseHandle (hObject=0x390) returned 1
	[0085.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20
	[0085.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.257] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0085.257] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.257] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.257] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0085.258] GetLastError () returned 0x0
	[0085.258] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x4a40, lpOverlapped=0x0) returned 1
	[0085.259] WriteFile (in: hFile=0x340, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x4a50, lpOverlapped=0x0) returned 1
	[0085.261] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.261] WriteFile (in: hFile=0x340, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0085.261] SetEndOfFile (hFile=0x340) returned 1
	[0085.261] CloseHandle (hObject=0x340) returned 1
	[0085.261] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.261] SetEndOfFile (hFile=0x390) returned 1
	[0085.262] CloseHandle (hObject=0x390) returned 1
	[0085.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.262] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 1
	[0085.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.262] lstrlenW (lpString=".doc") returned 4
	[0085.263] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.263] lstrlenW (lpString=".docx") returned 5
	[0085.263] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0085.263] lstrlenW (lpString=".pdf") returned 4
	[0085.263] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.263] lstrlenW (lpString=".xls") returned 4
	[0085.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.263] lstrlenW (lpString=".xlsx") returned 5
	[0085.263] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0085.263] lstrlenW (lpString=".ppt") returned 4
	[0085.263] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.263] lstrlenW (lpString=".zip") returned 4
	[0085.263] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.263] lstrlenW (lpString=".rar") returned 4
	[0085.263] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.263] lstrlenW (lpString=".bz2") returned 4
	[0085.263] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.263] lstrlenW (lpString=".7z") returned 3
	[0085.263] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.263] lstrlenW (lpString=".dbf") returned 4
	[0085.263] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.263] lstrlenW (lpString=".1cd") returned 4
	[0085.263] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.263] lstrlenW (lpString=".jpg") returned 4
	[0085.263] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.264] lstrlenW (lpString=".doc") returned 4
	[0085.264] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.264] lstrlenW (lpString=".docx") returned 5
	[0085.264] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0085.264] lstrlenW (lpString=".pdf") returned 4
	[0085.264] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.264] lstrlenW (lpString=".xls") returned 4
	[0085.264] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.264] lstrlenW (lpString=".xlsx") returned 5
	[0085.264] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0085.264] lstrlenW (lpString=".ppt") returned 4
	[0085.264] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.264] lstrlenW (lpString=".zip") returned 4
	[0085.264] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.264] lstrlenW (lpString=".rar") returned 4
	[0085.264] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.264] lstrlenW (lpString=".bz2") returned 4
	[0085.264] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.264] lstrlenW (lpString=".7z") returned 3
	[0085.264] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.264] lstrlenW (lpString=".dbf") returned 4
	[0085.264] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.264] lstrlenW (lpString=".1cd") returned 4
	[0085.264] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0085.265] lstrlenW (lpString=".jpg") returned 4
	[0085.265] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.265] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0085.265] lstrlenW (lpString="orbd.exe") returned 8
	[0085.265] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0085.265] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=16448) returned 1
	[0085.265] CloseHandle (hObject=0x390) returned 1
	[0085.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20
	[0085.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.265] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0085.265] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.266] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.266] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0085.266] GetLastError () returned 0x0
	[0085.266] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0085.487] WriteFile (in: hFile=0x340, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0085.489] ReadFile (in: hFile=0x390, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.489] WriteFile (in: hFile=0x340, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0085.490] SetEndOfFile (hFile=0x340) returned 1
	[0085.490] CloseHandle (hObject=0x340) returned 1
	[0085.490] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.490] SetEndOfFile (hFile=0x390) returned 1
	[0085.491] CloseHandle (hObject=0x390) returned 1
	[0085.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.865] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 1
	[0086.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.273] lstrlenW (lpString=".doc") returned 4
	[0086.273] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.273] lstrlenW (lpString=".docx") returned 5
	[0086.273] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1
	[0086.273] lstrlenW (lpString=".pdf") returned 4
	[0086.273] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.273] lstrlenW (lpString=".xls") returned 4
	[0086.273] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.273] lstrlenW (lpString=".xlsx") returned 5
	[0086.273] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1
	[0086.273] lstrlenW (lpString=".ppt") returned 4
	[0086.273] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.273] lstrlenW (lpString=".zip") returned 4
	[0086.273] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.273] lstrlenW (lpString=".rar") returned 4
	[0086.273] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.273] lstrlenW (lpString=".bz2") returned 4
	[0086.273] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.273] lstrlenW (lpString=".7z") returned 3
	[0086.273] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.274] lstrlenW (lpString=".dbf") returned 4
	[0086.274] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.274] lstrlenW (lpString=".1cd") returned 4
	[0086.274] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.274] lstrlenW (lpString=".jpg") returned 4
	[0086.274] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.274] lstrlenW (lpString=".doc") returned 4
	[0086.274] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.274] lstrlenW (lpString=".docx") returned 5
	[0086.274] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1
	[0086.274] lstrlenW (lpString=".pdf") returned 4
	[0086.274] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.274] lstrlenW (lpString=".xls") returned 4
	[0086.274] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.274] lstrlenW (lpString=".xlsx") returned 5
	[0086.274] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1
	[0086.274] lstrlenW (lpString=".ppt") returned 4
	[0086.274] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.275] lstrlenW (lpString=".zip") returned 4
	[0086.275] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.275] lstrlenW (lpString=".rar") returned 4
	[0086.275] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.275] lstrlenW (lpString=".bz2") returned 4
	[0086.275] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.275] lstrlenW (lpString=".7z") returned 3
	[0086.275] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.275] lstrlenW (lpString=".dbf") returned 4
	[0086.275] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.275] lstrlenW (lpString=".1cd") returned 4
	[0086.275] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0086.275] lstrlenW (lpString=".jpg") returned 4
	[0086.275] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.275] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0086.276] lstrlenW (lpString="rmiregistry.exe") returned 15
	[0086.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0086.503] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=16448) returned 1
	[0086.504] CloseHandle (hObject=0x398) returned 1
	[0086.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20
	[0086.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.506] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0086.506] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.541] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.541] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.541] GetLastError () returned 0x0
	[0086.542] ReadFile (in: hFile=0x398, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0086.545] WriteFile (in: hFile=0x34c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0086.546] ReadFile (in: hFile=0x398, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.546] WriteFile (in: hFile=0x34c, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0086.546] SetEndOfFile (hFile=0x34c) returned 1
	[0086.547] CloseHandle (hObject=0x34c) returned 1
	[0086.547] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.547] SetEndOfFile (hFile=0x398) returned 1
	[0086.548] CloseHandle (hObject=0x398) returned 1
	[0086.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0086.548] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 1
	[0086.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.548] lstrlenW (lpString=".doc") returned 4
	[0086.548] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.548] lstrlenW (lpString=".docx") returned 5
	[0086.548] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0086.549] lstrlenW (lpString=".pdf") returned 4
	[0086.549] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.549] lstrlenW (lpString=".xls") returned 4
	[0086.549] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.549] lstrlenW (lpString=".xlsx") returned 5
	[0086.549] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0086.549] lstrlenW (lpString=".ppt") returned 4
	[0086.549] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.549] lstrlenW (lpString=".zip") returned 4
	[0086.549] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.549] lstrlenW (lpString=".rar") returned 4
	[0086.549] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.549] lstrlenW (lpString=".bz2") returned 4
	[0086.549] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.549] lstrlenW (lpString=".7z") returned 3
	[0086.549] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.549] lstrlenW (lpString=".dbf") returned 4
	[0086.549] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.549] lstrlenW (lpString=".1cd") returned 4
	[0086.550] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.550] lstrlenW (lpString=".jpg") returned 4
	[0086.550] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.550] lstrlenW (lpString=".doc") returned 4
	[0086.550] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.550] lstrlenW (lpString=".docx") returned 5
	[0086.550] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0086.550] lstrlenW (lpString=".pdf") returned 4
	[0086.550] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.550] lstrlenW (lpString=".xls") returned 4
	[0086.550] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.550] lstrlenW (lpString=".xlsx") returned 5
	[0086.550] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0086.550] lstrlenW (lpString=".ppt") returned 4
	[0086.550] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.550] lstrlenW (lpString=".zip") returned 4
	[0086.551] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.551] lstrlenW (lpString=".rar") returned 4
	[0086.551] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.551] lstrlenW (lpString=".bz2") returned 4
	[0086.551] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.551] lstrlenW (lpString=".7z") returned 3
	[0086.551] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.551] lstrlenW (lpString=".dbf") returned 4
	[0086.551] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.551] lstrlenW (lpString=".1cd") returned 4
	[0086.551] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0086.551] lstrlenW (lpString=".jpg") returned 4
	[0086.551] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.551] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0086.551] lstrlenW (lpString="jvm.dll") returned 7
	[0086.551] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0086.552] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=8809536) returned 1
	[0086.552] CloseHandle (hObject=0x398) returned 1
	[0086.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20
	[0086.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[admin@stex777.com].money")) returned 1
	[0086.553] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0086.553] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fc64 | out: lpNewFilePointer=0x0) returned 1
	[0086.553] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fc24 | out: lpNewFilePointer=0x0) returned 1
	[0086.553] ReadFile (in: hFile=0x398, lpBuffer=0x3ebc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x389fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ebc058*, lpNumberOfBytesRead=0x389fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0086.563] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x389fc24 | out: lpNewFilePointer=0x0) returned 1
	[0086.564] ReadFile (in: hFile=0x398, lpBuffer=0x3efc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x389fc30, lpOverlapped=0x0 | out: lpBuffer=0x3efc058*, lpNumberOfBytesRead=0x389fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0086.572] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x389fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0086.572] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x389fc24 | out: lpNewFilePointer=0x0) returned 1
	[0086.573] ReadFile (in: hFile=0x398, lpBuffer=0x3f3c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x389fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f3c058*, lpNumberOfBytesRead=0x389fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0086.950] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.950] WriteFile (in: hFile=0x398, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x389fca8, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fca8*=0xc00fa, lpOverlapped=0x0) returned 1
	[0086.970] SetEndOfFile (hFile=0x398) returned 1
	[0086.970] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x4223d50
	[0086.976] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fc74 | out: lpNewFilePointer=0x0) returned 1
	[0086.976] WriteFile (in: hFile=0x398, lpBuffer=0x4223d50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x389fc80, lpOverlapped=0x0 | out: lpBuffer=0x4223d50*, lpNumberOfBytesWritten=0x389fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0086.978] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x389fc74 | out: lpNewFilePointer=0x0) returned 1
	[0086.978] WriteFile (in: hFile=0x398, lpBuffer=0x4223d50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x389fc80, lpOverlapped=0x0 | out: lpBuffer=0x4223d50*, lpNumberOfBytesWritten=0x389fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0086.984] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x389fc74 | out: lpNewFilePointer=0x0) returned 1
	[0086.984] WriteFile (in: hFile=0x398, lpBuffer=0x4223d50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x389fc80, lpOverlapped=0x0 | out: lpBuffer=0x4223d50*, lpNumberOfBytesWritten=0x389fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0086.987] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0086.987] CloseHandle (hObject=0x398) returned 1
	[0086.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0086.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.987] lstrlenW (lpString=".doc") returned 4
	[0086.987] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.987] lstrlenW (lpString=".docx") returned 5
	[0086.987] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0086.987] lstrlenW (lpString=".pdf") returned 4
	[0086.987] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.988] lstrlenW (lpString=".xls") returned 4
	[0086.988] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.988] lstrlenW (lpString=".xlsx") returned 5
	[0086.988] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0086.988] lstrlenW (lpString=".ppt") returned 4
	[0086.988] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.988] lstrlenW (lpString=".zip") returned 4
	[0086.988] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.988] lstrlenW (lpString=".rar") returned 4
	[0086.988] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.988] lstrlenW (lpString=".bz2") returned 4
	[0086.988] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.988] lstrlenW (lpString=".7z") returned 3
	[0086.988] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.988] lstrlenW (lpString=".dbf") returned 4
	[0086.988] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.988] lstrlenW (lpString=".1cd") returned 4
	[0086.988] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.988] lstrlenW (lpString=".jpg") returned 4
	[0086.988] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.989] lstrlenW (lpString=".doc") returned 4
	[0086.989] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.989] lstrlenW (lpString=".docx") returned 5
	[0086.989] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0086.989] lstrlenW (lpString=".pdf") returned 4
	[0086.989] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.989] lstrlenW (lpString=".xls") returned 4
	[0086.989] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.989] lstrlenW (lpString=".xlsx") returned 5
	[0086.989] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0086.989] lstrlenW (lpString=".ppt") returned 4
	[0086.989] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.989] lstrlenW (lpString=".zip") returned 4
	[0086.989] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.989] lstrlenW (lpString=".rar") returned 4
	[0086.989] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.989] lstrlenW (lpString=".bz2") returned 4
	[0086.989] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.989] lstrlenW (lpString=".7z") returned 3
	[0086.989] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.989] lstrlenW (lpString=".dbf") returned 4
	[0086.990] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.990] lstrlenW (lpString=".1cd") returned 4
	[0086.990] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0086.990] lstrlenW (lpString=".jpg") returned 4
	[0086.990] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.990] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0086.990] lstrlenW (lpString="tnameserv.exe") returned 13
	[0086.990] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0086.990] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=16448) returned 1
	[0086.990] CloseHandle (hObject=0x398) returned 1
	[0086.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20
	[0086.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0086.991] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.991] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0086.991] GetLastError () returned 0x0
	[0086.991] ReadFile (in: hFile=0x398, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0087.498] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0087.499] ReadFile (in: hFile=0x398, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.499] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xee, lpOverlapped=0x0) returned 1
	[0087.499] SetEndOfFile (hFile=0x2d4) returned 1
	[0087.499] CloseHandle (hObject=0x2d4) returned 1
	[0087.500] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.500] SetEndOfFile (hFile=0x398) returned 1
	[0087.501] CloseHandle (hObject=0x398) returned 1
	[0087.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.501] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 1
	[0087.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.501] lstrlenW (lpString=".doc") returned 4
	[0087.501] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.501] lstrlenW (lpString=".docx") returned 5
	[0087.501] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1
	[0087.501] lstrlenW (lpString=".pdf") returned 4
	[0087.501] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.501] lstrlenW (lpString=".xls") returned 4
	[0087.501] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.501] lstrlenW (lpString=".xlsx") returned 5
	[0087.501] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1
	[0087.501] lstrlenW (lpString=".ppt") returned 4
	[0087.501] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.502] lstrlenW (lpString=".zip") returned 4
	[0087.502] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.502] lstrlenW (lpString=".rar") returned 4
	[0087.502] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.502] lstrlenW (lpString=".bz2") returned 4
	[0087.502] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.502] lstrlenW (lpString=".7z") returned 3
	[0087.502] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.502] lstrlenW (lpString=".dbf") returned 4
	[0087.502] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.502] lstrlenW (lpString=".1cd") returned 4
	[0087.502] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.502] lstrlenW (lpString=".jpg") returned 4
	[0087.502] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.502] lstrlenW (lpString=".doc") returned 4
	[0087.502] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.502] lstrlenW (lpString=".docx") returned 5
	[0087.502] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1
	[0087.502] lstrlenW (lpString=".pdf") returned 4
	[0087.502] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.502] lstrlenW (lpString=".xls") returned 4
	[0087.503] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.503] lstrlenW (lpString=".xlsx") returned 5
	[0087.503] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1
	[0087.503] lstrlenW (lpString=".ppt") returned 4
	[0087.503] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.503] lstrlenW (lpString=".zip") returned 4
	[0087.503] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.503] lstrlenW (lpString=".rar") returned 4
	[0087.503] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.503] lstrlenW (lpString=".bz2") returned 4
	[0087.503] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.503] lstrlenW (lpString=".7z") returned 3
	[0087.503] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.503] lstrlenW (lpString=".dbf") returned 4
	[0087.503] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.503] lstrlenW (lpString=".1cd") returned 4
	[0087.503] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52
	[0087.503] lstrlenW (lpString=".jpg") returned 4
	[0087.503] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.504] lstrcmpiW (lpString1=".0_144\\COPYRIGHT", lpString2=".money") returned -1
	[0087.504] lstrlenW (lpString="COPYRIGHT") returned 9
	[0087.504] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0087.504] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=3244) returned 1
	[0087.504] CloseHandle (hObject=0x398) returned 1
	[0087.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20
	[0087.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.504] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0087.504] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.504] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.505] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0087.505] GetLastError () returned 0x0
	[0087.505] ReadFile (in: hFile=0x398, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0xcac, lpOverlapped=0x0) returned 1
	[0087.506] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xcb0, lpOverlapped=0x0) returned 1
	[0087.507] ReadFile (in: hFile=0x398, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.507] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0087.507] SetEndOfFile (hFile=0x2d4) returned 1
	[0087.508] CloseHandle (hObject=0x2d4) returned 1
	[0087.508] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.508] SetEndOfFile (hFile=0x398) returned 1
	[0087.509] CloseHandle (hObject=0x398) returned 1
	[0087.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.509] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1
	[0087.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.509] lstrlenW (lpString=".doc") returned 4
	[0087.509] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1
	[0087.509] lstrlenW (lpString=".docx") returned 5
	[0087.509] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1
	[0087.509] lstrlenW (lpString=".pdf") returned 4
	[0087.509] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1
	[0087.510] lstrlenW (lpString=".xls") returned 4
	[0087.510] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1
	[0087.510] lstrlenW (lpString=".xlsx") returned 5
	[0087.510] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1
	[0087.510] lstrlenW (lpString=".ppt") returned 4
	[0087.510] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1
	[0087.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.510] lstrlenW (lpString=".zip") returned 4
	[0087.510] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1
	[0087.510] lstrlenW (lpString=".rar") returned 4
	[0087.510] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1
	[0087.510] lstrlenW (lpString=".bz2") returned 4
	[0087.510] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1
	[0087.510] lstrlenW (lpString=".7z") returned 3
	[0087.510] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1
	[0087.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.510] lstrlenW (lpString=".dbf") returned 4
	[0087.510] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1
	[0087.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.510] lstrlenW (lpString=".1cd") returned 4
	[0087.510] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1
	[0087.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.510] lstrlenW (lpString=".jpg") returned 4
	[0087.510] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1
	[0087.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.511] lstrlenW (lpString=".doc") returned 4
	[0087.511] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1
	[0087.511] lstrlenW (lpString=".docx") returned 5
	[0087.511] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1
	[0087.511] lstrlenW (lpString=".pdf") returned 4
	[0087.511] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1
	[0087.511] lstrlenW (lpString=".xls") returned 4
	[0087.511] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1
	[0087.511] lstrlenW (lpString=".xlsx") returned 5
	[0087.511] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1
	[0087.511] lstrlenW (lpString=".ppt") returned 4
	[0087.511] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1
	[0087.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.511] lstrlenW (lpString=".zip") returned 4
	[0087.511] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1
	[0087.511] lstrlenW (lpString=".rar") returned 4
	[0087.511] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1
	[0087.511] lstrlenW (lpString=".bz2") returned 4
	[0087.511] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1
	[0087.511] lstrlenW (lpString=".7z") returned 3
	[0087.511] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1
	[0087.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.512] lstrlenW (lpString=".dbf") returned 4
	[0087.512] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1
	[0087.512] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.512] lstrlenW (lpString=".1cd") returned 4
	[0087.512] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1
	[0087.512] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0087.512] lstrlenW (lpString=".jpg") returned 4
	[0087.512] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1
	[0087.512] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0087.512] lstrlenW (lpString="accessibility.properties") returned 24
	[0087.512] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0087.512] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=149) returned 1
	[0087.512] CloseHandle (hObject=0x398) returned 1
	[0087.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20
	[0087.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.513] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0087.513] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.513] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.513] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0087.513] GetLastError () returned 0x0
	[0087.513] ReadFile (in: hFile=0x398, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x95, lpOverlapped=0x0) returned 1
	[0087.514] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0087.516] ReadFile (in: hFile=0x398, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.516] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x104, lpOverlapped=0x0) returned 1
	[0087.516] SetEndOfFile (hFile=0x2d4) returned 1
	[0087.516] CloseHandle (hObject=0x2d4) returned 1
	[0087.516] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.516] SetEndOfFile (hFile=0x398) returned 1
	[0087.517] CloseHandle (hObject=0x398) returned 1
	[0087.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.517] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1
	[0087.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.518] lstrlenW (lpString=".doc") returned 4
	[0087.518] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0087.518] lstrlenW (lpString=".docx") returned 5
	[0087.518] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0087.518] lstrlenW (lpString=".pdf") returned 4
	[0087.518] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0087.518] lstrlenW (lpString=".xls") returned 4
	[0087.518] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0087.518] lstrlenW (lpString=".xlsx") returned 5
	[0087.518] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0087.518] lstrlenW (lpString=".ppt") returned 4
	[0087.518] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0087.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.518] lstrlenW (lpString=".zip") returned 4
	[0087.518] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0087.518] lstrlenW (lpString=".rar") returned 4
	[0087.518] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0087.518] lstrlenW (lpString=".bz2") returned 4
	[0087.518] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0087.518] lstrlenW (lpString=".7z") returned 3
	[0087.518] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0087.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.518] lstrlenW (lpString=".dbf") returned 4
	[0087.518] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0087.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.519] lstrlenW (lpString=".1cd") returned 4
	[0087.519] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0087.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.519] lstrlenW (lpString=".jpg") returned 4
	[0087.519] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0087.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.519] lstrlenW (lpString=".doc") returned 4
	[0087.519] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0087.519] lstrlenW (lpString=".docx") returned 5
	[0087.519] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0087.519] lstrlenW (lpString=".pdf") returned 4
	[0087.519] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0087.519] lstrlenW (lpString=".xls") returned 4
	[0087.519] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0087.519] lstrlenW (lpString=".xlsx") returned 5
	[0087.519] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0087.519] lstrlenW (lpString=".ppt") returned 4
	[0087.519] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0087.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.519] lstrlenW (lpString=".zip") returned 4
	[0087.519] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0087.519] lstrlenW (lpString=".rar") returned 4
	[0087.520] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0087.520] lstrlenW (lpString=".bz2") returned 4
	[0087.520] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0087.520] lstrlenW (lpString=".7z") returned 3
	[0087.520] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0087.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.520] lstrlenW (lpString=".dbf") returned 4
	[0087.520] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0087.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.520] lstrlenW (lpString=".1cd") returned 4
	[0087.520] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0087.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0087.520] lstrlenW (lpString=".jpg") returned 4
	[0087.520] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0087.520] lstrcmpiW (lpString1=".cfg", lpString2=".money") returned -1
	[0087.520] lstrlenW (lpString="jvm.cfg") returned 7
	[0087.520] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0087.521] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=634) returned 1
	[0087.521] CloseHandle (hObject=0x398) returned 1
	[0087.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20
	[0087.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.521] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0087.521] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.521] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.521] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0087.521] GetLastError () returned 0x0
	[0087.521] ReadFile (in: hFile=0x398, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x27a, lpOverlapped=0x0) returned 1
	[0087.522] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0x280, lpOverlapped=0x0) returned 1
	[0087.523] ReadFile (in: hFile=0x398, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesRead=0x389fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.523] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ebc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x389fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ebc020*, lpNumberOfBytesWritten=0x389fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0087.523] SetEndOfFile (hFile=0x2d4) returned 1
	[0087.524] CloseHandle (hObject=0x2d4) returned 1
	[0087.524] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.524] SetEndOfFile (hFile=0x398) returned 1
	[0087.525] CloseHandle (hObject=0x398) returned 1
	[0087.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.525] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1
	[0087.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.525] lstrlenW (lpString=".doc") returned 4
	[0087.526] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1
	[0087.526] lstrlenW (lpString=".docx") returned 5
	[0087.526] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1
	[0087.526] lstrlenW (lpString=".pdf") returned 4
	[0087.526] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1
	[0087.526] lstrlenW (lpString=".xls") returned 4
	[0087.526] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1
	[0087.526] lstrlenW (lpString=".xlsx") returned 5
	[0087.526] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1
	[0087.526] lstrlenW (lpString=".ppt") returned 4
	[0087.526] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1
	[0087.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.526] lstrlenW (lpString=".zip") returned 4
	[0087.526] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1
	[0087.526] lstrlenW (lpString=".rar") returned 4
	[0087.526] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1
	[0087.526] lstrlenW (lpString=".bz2") returned 4
	[0087.526] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1
	[0087.526] lstrlenW (lpString=".7z") returned 3
	[0087.526] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1
	[0087.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.526] lstrlenW (lpString=".dbf") returned 4
	[0087.526] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1
	[0087.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.526] lstrlenW (lpString=".1cd") returned 4
	[0087.526] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1
	[0087.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.527] lstrlenW (lpString=".jpg") returned 4
	[0087.527] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1
	[0087.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.527] lstrlenW (lpString=".doc") returned 4
	[0087.527] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1
	[0087.527] lstrlenW (lpString=".docx") returned 5
	[0087.527] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1
	[0087.527] lstrlenW (lpString=".pdf") returned 4
	[0087.527] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1
	[0087.527] lstrlenW (lpString=".xls") returned 4
	[0087.527] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1
	[0087.527] lstrlenW (lpString=".xlsx") returned 5
	[0087.527] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1
	[0087.527] lstrlenW (lpString=".ppt") returned 4
	[0087.527] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1
	[0087.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.527] lstrlenW (lpString=".zip") returned 4
	[0087.527] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1
	[0087.527] lstrlenW (lpString=".rar") returned 4
	[0087.527] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1
	[0087.527] lstrlenW (lpString=".bz2") returned 4
	[0087.527] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1
	[0087.528] lstrlenW (lpString=".7z") returned 3
	[0087.528] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1
	[0087.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.528] lstrlenW (lpString=".dbf") returned 4
	[0087.528] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1
	[0087.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.528] lstrlenW (lpString=".1cd") returned 4
	[0087.528] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1
	[0087.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0087.528] lstrlenW (lpString=".jpg") returned 4
	[0087.528] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1
	[0087.528] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0087.528] lstrlenW (lpString="calendars.properties") returned 20
	[0087.528] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0087.528] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x389ff14 | out: lpFileSize=0x389ff14*=1378) returned 1
	[0087.528] CloseHandle (hObject=0x398) returned 1
	[0087.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20
	[0087.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.529] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0087.529] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.529] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.529] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0087.529] GetLastError () returned 0x0
	[0087.529] ReadFile (hFile=0x398, lpBuffer=0x3ebc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x389fecc, lpOverlapped=0x0) 

Thread:
	id = 18
	os_tid = 0xd04

	[0057.435] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x35e0760
	[0057.436] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x35f0768
	[0057.436] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f260
	[0057.436] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x6) returned 0x69f038
	[0057.436] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f428
	[0057.436] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x100000) returned 0x3fc0020
	[0057.439] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f4e8
	[0057.439] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f4e8, Size=0x20) returned 0x631178
	[0057.439] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f500
	[0057.439] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f500, Size=0x20) returned 0x631218
	[0057.440] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.440] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.440] Wow64DisableWow64FsRedirection (in: OldValue=0x39dff50 | out: OldValue=0x39dff50*=0x0) returned 1
	[0057.440] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.440] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631178 | out: hHeap=0x600000) returned 1
	[0057.440] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.440] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631218 | out: hHeap=0x600000) returned 1
	[0057.440] Sleep (dwMilliseconds=0x64) 
	[0057.796] lstrcmpiW (lpString1=".MARKER", lpString2=".money") returned -1
	[0057.796] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30
	[0057.796] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0057.797] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=0) returned 1
	[0057.797] CloseHandle (hObject=0x304) returned 1
	[0057.797] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.797] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.797] lstrlenW (lpString=".doc") returned 4
	[0057.797] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0057.797] lstrlenW (lpString=".docx") returned 5
	[0057.797] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0057.798] lstrlenW (lpString=".pdf") returned 4
	[0057.798] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0057.798] lstrlenW (lpString=".xls") returned 4
	[0057.798] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0057.798] lstrlenW (lpString=".xlsx") returned 5
	[0057.798] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0057.798] lstrlenW (lpString=".ppt") returned 4
	[0057.798] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0057.798] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.798] lstrlenW (lpString=".zip") returned 4
	[0057.798] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0057.798] lstrlenW (lpString=".rar") returned 4
	[0057.798] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0057.798] lstrlenW (lpString=".bz2") returned 4
	[0057.798] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0057.798] lstrlenW (lpString=".7z") returned 3
	[0057.798] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0057.798] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.798] lstrlenW (lpString=".dbf") returned 4
	[0057.798] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0057.798] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.798] lstrlenW (lpString=".1cd") returned 4
	[0057.798] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0057.798] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.798] lstrlenW (lpString=".jpg") returned 4
	[0057.798] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0057.798] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.798] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.799] lstrlenW (lpString=".doc") returned 4
	[0057.799] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0057.799] lstrlenW (lpString=".docx") returned 5
	[0057.799] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0057.799] lstrlenW (lpString=".pdf") returned 4
	[0057.799] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0057.799] lstrlenW (lpString=".xls") returned 4
	[0057.799] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0057.799] lstrlenW (lpString=".xlsx") returned 5
	[0057.799] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0057.799] lstrlenW (lpString=".ppt") returned 4
	[0057.799] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0057.799] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.799] lstrlenW (lpString=".zip") returned 4
	[0057.799] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0057.799] lstrlenW (lpString=".rar") returned 4
	[0057.799] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0057.799] lstrlenW (lpString=".bz2") returned 4
	[0057.799] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0057.799] lstrlenW (lpString=".7z") returned 3
	[0057.799] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0057.799] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.799] lstrlenW (lpString=".dbf") returned 4
	[0057.799] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0057.799] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.799] lstrlenW (lpString=".1cd") returned 4
	[0057.799] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0057.799] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0057.799] lstrlenW (lpString=".jpg") returned 4
	[0057.799] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0057.800] Sleep (dwMilliseconds=0x64) 
	[0058.443] Sleep (dwMilliseconds=0x64) 
	[0059.024] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0059.024] lstrlenW (lpString="SetupResources.dll") returned 18
	[0059.024] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.024] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=19288) returned 1
	[0059.024] CloseHandle (hObject=0x314) returned 1
	[0059.024] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80
	[0059.024] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.024] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.025] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.025] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.025] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0059.025] GetLastError () returned 0x0
	[0059.025] ReadFile (in: hFile=0x314, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4b58, lpOverlapped=0x0) returned 1
	[0059.041] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x4b60, lpOverlapped=0x0) returned 1
	[0059.042] ReadFile (in: hFile=0x314, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.042] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0059.042] SetEndOfFile (hFile=0x318) returned 1
	[0059.042] CloseHandle (hObject=0x318) returned 1
	[0059.044] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.044] SetEndOfFile (hFile=0x314) returned 1
	[0059.045] CloseHandle (hObject=0x314) returned 1
	[0059.045] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.045] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1
	[0059.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.046] lstrlenW (lpString=".doc") returned 4
	[0059.046] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.046] lstrlenW (lpString=".docx") returned 5
	[0059.046] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0059.046] lstrlenW (lpString=".pdf") returned 4
	[0059.046] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.046] lstrlenW (lpString=".xls") returned 4
	[0059.046] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.046] lstrlenW (lpString=".xlsx") returned 5
	[0059.046] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0059.046] lstrlenW (lpString=".ppt") returned 4
	[0059.046] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.046] lstrlenW (lpString=".zip") returned 4
	[0059.046] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.046] lstrlenW (lpString=".rar") returned 4
	[0059.046] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.046] lstrlenW (lpString=".bz2") returned 4
	[0059.047] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.047] lstrlenW (lpString=".7z") returned 3
	[0059.047] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.047] lstrlenW (lpString=".dbf") returned 4
	[0059.047] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.047] lstrlenW (lpString=".1cd") returned 4
	[0059.047] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.047] lstrlenW (lpString=".jpg") returned 4
	[0059.047] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.047] lstrlenW (lpString=".doc") returned 4
	[0059.047] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.047] lstrlenW (lpString=".docx") returned 5
	[0059.047] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0059.047] lstrlenW (lpString=".pdf") returned 4
	[0059.047] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.047] lstrlenW (lpString=".xls") returned 4
	[0059.047] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.047] lstrlenW (lpString=".xlsx") returned 5
	[0059.048] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0059.048] lstrlenW (lpString=".ppt") returned 4
	[0059.048] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.048] lstrlenW (lpString=".zip") returned 4
	[0059.048] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.048] lstrlenW (lpString=".rar") returned 4
	[0059.048] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.048] lstrlenW (lpString=".bz2") returned 4
	[0059.048] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.048] lstrlenW (lpString=".7z") returned 3
	[0059.048] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.048] lstrlenW (lpString=".dbf") returned 4
	[0059.048] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.048] lstrlenW (lpString=".1cd") returned 4
	[0059.048] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0059.048] lstrlenW (lpString=".jpg") returned 4
	[0059.048] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.049] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0059.049] lstrlenW (lpString="SetupResources.dll") returned 18
	[0059.049] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.049] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=17240) returned 1
	[0059.049] CloseHandle (hObject=0x314) returned 1
	[0059.049] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80
	[0059.049] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.049] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.050] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.050] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.050] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0059.050] GetLastError () returned 0x0
	[0059.050] ReadFile (in: hFile=0x314, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4358, lpOverlapped=0x0) returned 1
	[0059.387] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x4360, lpOverlapped=0x0) returned 1
	[0059.388] ReadFile (in: hFile=0x314, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.388] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0059.388] SetEndOfFile (hFile=0x318) returned 1
	[0059.388] CloseHandle (hObject=0x318) returned 1
	[0059.390] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.390] SetEndOfFile (hFile=0x314) returned 1
	[0059.391] CloseHandle (hObject=0x314) returned 1
	[0059.391] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.391] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1
	[0059.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.391] lstrlenW (lpString=".doc") returned 4
	[0059.391] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.391] lstrlenW (lpString=".docx") returned 5
	[0059.392] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0059.392] lstrlenW (lpString=".pdf") returned 4
	[0059.392] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.392] lstrlenW (lpString=".xls") returned 4
	[0059.392] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.392] lstrlenW (lpString=".xlsx") returned 5
	[0059.392] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0059.392] lstrlenW (lpString=".ppt") returned 4
	[0059.392] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.392] lstrlenW (lpString=".zip") returned 4
	[0059.392] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.392] lstrlenW (lpString=".rar") returned 4
	[0059.392] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.392] lstrlenW (lpString=".bz2") returned 4
	[0059.392] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.392] lstrlenW (lpString=".7z") returned 3
	[0059.392] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.392] lstrlenW (lpString=".dbf") returned 4
	[0059.392] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.392] lstrlenW (lpString=".1cd") returned 4
	[0059.393] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.393] lstrlenW (lpString=".jpg") returned 4
	[0059.393] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.393] lstrlenW (lpString=".doc") returned 4
	[0059.393] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.393] lstrlenW (lpString=".docx") returned 5
	[0059.393] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0059.393] lstrlenW (lpString=".pdf") returned 4
	[0059.393] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.393] lstrlenW (lpString=".xls") returned 4
	[0059.393] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.393] lstrlenW (lpString=".xlsx") returned 5
	[0059.393] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0059.393] lstrlenW (lpString=".ppt") returned 4
	[0059.393] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.393] lstrlenW (lpString=".zip") returned 4
	[0059.393] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.393] lstrlenW (lpString=".rar") returned 4
	[0059.393] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.394] lstrlenW (lpString=".bz2") returned 4
	[0059.394] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.394] lstrlenW (lpString=".7z") returned 3
	[0059.394] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.394] lstrlenW (lpString=".dbf") returned 4
	[0059.394] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.394] lstrlenW (lpString=".1cd") returned 4
	[0059.394] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0059.394] lstrlenW (lpString=".jpg") returned 4
	[0059.394] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.394] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0059.394] lstrlenW (lpString="SetupResources.dll") returned 18
	[0059.394] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.395] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=18264) returned 1
	[0059.395] CloseHandle (hObject=0x314) returned 1
	[0059.395] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80
	[0059.395] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.395] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.395] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.395] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.395] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0059.396] GetLastError () returned 0x0
	[0059.396] ReadFile (in: hFile=0x314, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4758, lpOverlapped=0x0) returned 1
	[0059.397] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x4760, lpOverlapped=0x0) returned 1
	[0059.399] ReadFile (in: hFile=0x314, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.399] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0059.399] SetEndOfFile (hFile=0x318) returned 1
	[0059.399] CloseHandle (hObject=0x318) returned 1
	[0059.400] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.400] SetEndOfFile (hFile=0x314) returned 1
	[0059.401] CloseHandle (hObject=0x314) returned 1
	[0059.401] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.402] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1
	[0059.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.402] lstrlenW (lpString=".doc") returned 4
	[0059.402] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.402] lstrlenW (lpString=".docx") returned 5
	[0059.402] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0059.402] lstrlenW (lpString=".pdf") returned 4
	[0059.402] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.402] lstrlenW (lpString=".xls") returned 4
	[0059.402] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.402] lstrlenW (lpString=".xlsx") returned 5
	[0059.402] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0059.403] lstrlenW (lpString=".ppt") returned 4
	[0059.403] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.403] lstrlenW (lpString=".zip") returned 4
	[0059.403] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.403] lstrlenW (lpString=".rar") returned 4
	[0059.403] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.403] lstrlenW (lpString=".bz2") returned 4
	[0059.403] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.403] lstrlenW (lpString=".7z") returned 3
	[0059.403] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.403] lstrlenW (lpString=".dbf") returned 4
	[0059.403] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.403] lstrlenW (lpString=".1cd") returned 4
	[0059.403] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.403] lstrlenW (lpString=".jpg") returned 4
	[0059.403] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.403] lstrlenW (lpString=".doc") returned 4
	[0059.403] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.403] lstrlenW (lpString=".docx") returned 5
	[0059.404] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0059.404] lstrlenW (lpString=".pdf") returned 4
	[0059.404] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.404] lstrlenW (lpString=".xls") returned 4
	[0059.404] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.404] lstrlenW (lpString=".xlsx") returned 5
	[0059.404] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0059.404] lstrlenW (lpString=".ppt") returned 4
	[0059.404] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.404] lstrlenW (lpString=".zip") returned 4
	[0059.404] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.404] lstrlenW (lpString=".rar") returned 4
	[0059.404] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.404] lstrlenW (lpString=".bz2") returned 4
	[0059.404] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.404] lstrlenW (lpString=".7z") returned 3
	[0059.404] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.404] lstrlenW (lpString=".dbf") returned 4
	[0059.404] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.404] lstrlenW (lpString=".1cd") returned 4
	[0059.404] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0059.404] lstrlenW (lpString=".jpg") returned 4
	[0059.404] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.405] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0059.405] lstrlenW (lpString="SetupResources.dll") returned 18
	[0059.405] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.405] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=18776) returned 1
	[0059.405] CloseHandle (hObject=0x314) returned 1
	[0059.405] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80
	[0059.405] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.405] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0059.405] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.405] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.406] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0059.406] GetLastError () returned 0x0
	[0059.406] ReadFile (in: hFile=0x314, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4958, lpOverlapped=0x0) returned 1
	[0059.408] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x4960, lpOverlapped=0x0) returned 1
	[0059.412] ReadFile (in: hFile=0x314, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.412] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0059.412] SetEndOfFile (hFile=0x318) returned 1
	[0059.412] CloseHandle (hObject=0x318) returned 1
	[0059.413] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.413] SetEndOfFile (hFile=0x314) returned 1
	[0059.414] CloseHandle (hObject=0x314) returned 1
	[0059.414] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0059.415] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1
	[0059.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.415] lstrlenW (lpString=".doc") returned 4
	[0059.415] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.415] lstrlenW (lpString=".docx") returned 5
	[0059.415] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0059.415] lstrlenW (lpString=".pdf") returned 4
	[0059.415] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.415] lstrlenW (lpString=".xls") returned 4
	[0059.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.415] lstrlenW (lpString=".xlsx") returned 5
	[0059.415] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0059.415] lstrlenW (lpString=".ppt") returned 4
	[0059.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.415] lstrlenW (lpString=".zip") returned 4
	[0059.415] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.415] lstrlenW (lpString=".rar") returned 4
	[0059.415] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.416] lstrlenW (lpString=".bz2") returned 4
	[0059.416] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.416] lstrlenW (lpString=".7z") returned 3
	[0059.416] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.416] lstrlenW (lpString=".dbf") returned 4
	[0059.416] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.416] lstrlenW (lpString=".1cd") returned 4
	[0059.416] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.416] lstrlenW (lpString=".jpg") returned 4
	[0059.416] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.416] lstrlenW (lpString=".doc") returned 4
	[0059.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.416] lstrlenW (lpString=".docx") returned 5
	[0059.416] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0059.416] lstrlenW (lpString=".pdf") returned 4
	[0059.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.416] lstrlenW (lpString=".xls") returned 4
	[0059.416] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.416] lstrlenW (lpString=".xlsx") returned 5
	[0059.416] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0059.417] lstrlenW (lpString=".ppt") returned 4
	[0059.417] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.417] lstrlenW (lpString=".zip") returned 4
	[0059.417] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.417] lstrlenW (lpString=".rar") returned 4
	[0059.417] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.417] lstrlenW (lpString=".bz2") returned 4
	[0059.417] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.417] lstrlenW (lpString=".7z") returned 3
	[0059.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.417] lstrlenW (lpString=".dbf") returned 4
	[0059.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.417] lstrlenW (lpString=".1cd") returned 4
	[0059.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.418] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0059.418] lstrlenW (lpString=".jpg") returned 4
	[0059.418] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.418] Sleep (dwMilliseconds=0x64) 
	[0059.894] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0059.894] lstrlenW (lpString="SetupResources.dll") returned 18
	[0059.894] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0059.916] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=16728) returned 1
	[0059.916] CloseHandle (hObject=0x340) returned 1
	[0059.916] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80
	[0059.917] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0059.989] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0060.013] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.013] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0060.013] GetLastError () returned 0x0
	[0060.013] ReadFile (in: hFile=0x33c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4158, lpOverlapped=0x0) returned 1
	[0060.015] WriteFile (in: hFile=0x344, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x4160, lpOverlapped=0x0) returned 1
	[0060.016] ReadFile (in: hFile=0x33c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.016] WriteFile (in: hFile=0x344, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.016] SetEndOfFile (hFile=0x344) returned 1
	[0060.016] CloseHandle (hObject=0x344) returned 1
	[0060.017] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.017] SetEndOfFile (hFile=0x33c) returned 1
	[0060.018] CloseHandle (hObject=0x33c) returned 1
	[0060.018] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.019] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1
	[0060.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.019] lstrlenW (lpString=".doc") returned 4
	[0060.019] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.019] lstrlenW (lpString=".docx") returned 5
	[0060.019] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.019] lstrlenW (lpString=".pdf") returned 4
	[0060.019] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.019] lstrlenW (lpString=".xls") returned 4
	[0060.019] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.019] lstrlenW (lpString=".xlsx") returned 5
	[0060.019] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.019] lstrlenW (lpString=".ppt") returned 4
	[0060.019] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.020] lstrlenW (lpString=".zip") returned 4
	[0060.020] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.020] lstrlenW (lpString=".rar") returned 4
	[0060.020] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.020] lstrlenW (lpString=".bz2") returned 4
	[0060.020] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.020] lstrlenW (lpString=".7z") returned 3
	[0060.020] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.020] lstrlenW (lpString=".dbf") returned 4
	[0060.020] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.020] lstrlenW (lpString=".1cd") returned 4
	[0060.020] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.020] lstrlenW (lpString=".jpg") returned 4
	[0060.020] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.020] lstrlenW (lpString=".doc") returned 4
	[0060.020] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.020] lstrlenW (lpString=".docx") returned 5
	[0060.020] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.020] lstrlenW (lpString=".pdf") returned 4
	[0060.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.021] lstrlenW (lpString=".xls") returned 4
	[0060.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.021] lstrlenW (lpString=".xlsx") returned 5
	[0060.021] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.021] lstrlenW (lpString=".ppt") returned 4
	[0060.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.021] lstrlenW (lpString=".zip") returned 4
	[0060.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.021] lstrlenW (lpString=".rar") returned 4
	[0060.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.021] lstrlenW (lpString=".bz2") returned 4
	[0060.021] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.021] lstrlenW (lpString=".7z") returned 3
	[0060.021] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.021] lstrlenW (lpString=".dbf") returned 4
	[0060.021] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.021] lstrlenW (lpString=".1cd") returned 4
	[0060.021] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0060.021] lstrlenW (lpString=".jpg") returned 4
	[0060.022] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.022] Sleep (dwMilliseconds=0x64) 
	[0060.476] Sleep (dwMilliseconds=0x64) 
	[0061.174] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0061.174] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.174] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.174] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=14168) returned 1
	[0061.174] CloseHandle (hObject=0x33c) returned 1
	[0061.174] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80
	[0061.174] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.174] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.175] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.175] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.175] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0061.175] GetLastError () returned 0x0
	[0061.175] ReadFile (in: hFile=0x33c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x3758, lpOverlapped=0x0) returned 1
	[0061.177] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x3760, lpOverlapped=0x0) returned 1
	[0061.178] ReadFile (in: hFile=0x33c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.178] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.178] SetEndOfFile (hFile=0x378) returned 1
	[0061.178] CloseHandle (hObject=0x378) returned 1
	[0061.180] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.180] SetEndOfFile (hFile=0x33c) returned 1
	[0061.181] CloseHandle (hObject=0x33c) returned 1
	[0061.181] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.181] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1
	[0061.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.181] lstrlenW (lpString=".doc") returned 4
	[0061.181] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.181] lstrlenW (lpString=".docx") returned 5
	[0061.181] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.181] lstrlenW (lpString=".pdf") returned 4
	[0061.181] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.181] lstrlenW (lpString=".xls") returned 4
	[0061.181] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.182] lstrlenW (lpString=".xlsx") returned 5
	[0061.182] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.182] lstrlenW (lpString=".ppt") returned 4
	[0061.182] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.182] lstrlenW (lpString=".zip") returned 4
	[0061.182] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.182] lstrlenW (lpString=".rar") returned 4
	[0061.182] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.182] lstrlenW (lpString=".bz2") returned 4
	[0061.182] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.182] lstrlenW (lpString=".7z") returned 3
	[0061.182] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.182] lstrlenW (lpString=".dbf") returned 4
	[0061.182] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.182] lstrlenW (lpString=".1cd") returned 4
	[0061.182] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.182] lstrlenW (lpString=".jpg") returned 4
	[0061.182] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.182] lstrlenW (lpString=".doc") returned 4
	[0061.182] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.183] lstrlenW (lpString=".docx") returned 5
	[0061.183] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.183] lstrlenW (lpString=".pdf") returned 4
	[0061.183] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.183] lstrlenW (lpString=".xls") returned 4
	[0061.183] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.183] lstrlenW (lpString=".xlsx") returned 5
	[0061.183] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.183] lstrlenW (lpString=".ppt") returned 4
	[0061.183] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.183] lstrlenW (lpString=".zip") returned 4
	[0061.183] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.183] lstrlenW (lpString=".rar") returned 4
	[0061.183] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.183] lstrlenW (lpString=".bz2") returned 4
	[0061.183] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.183] lstrlenW (lpString=".7z") returned 3
	[0061.183] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.183] lstrlenW (lpString=".dbf") returned 4
	[0061.183] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.183] lstrlenW (lpString=".1cd") returned 4
	[0061.183] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0061.183] lstrlenW (lpString=".jpg") returned 4
	[0061.183] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.184] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0061.184] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.184] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.184] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=18776) returned 1
	[0061.184] CloseHandle (hObject=0x33c) returned 1
	[0061.184] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80
	[0061.184] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.184] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.184] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.184] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.184] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0061.185] GetLastError () returned 0x0
	[0061.185] ReadFile (in: hFile=0x33c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4958, lpOverlapped=0x0) returned 1
	[0061.186] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x4960, lpOverlapped=0x0) returned 1
	[0061.188] ReadFile (in: hFile=0x33c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.188] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.188] SetEndOfFile (hFile=0x378) returned 1
	[0061.188] CloseHandle (hObject=0x378) returned 1
	[0061.189] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.189] SetEndOfFile (hFile=0x33c) returned 1
	[0061.190] CloseHandle (hObject=0x33c) returned 1
	[0061.190] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.190] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1
	[0061.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.191] lstrlenW (lpString=".doc") returned 4
	[0061.191] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.191] lstrlenW (lpString=".docx") returned 5
	[0061.191] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.191] lstrlenW (lpString=".pdf") returned 4
	[0061.191] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.191] lstrlenW (lpString=".xls") returned 4
	[0061.191] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.191] lstrlenW (lpString=".xlsx") returned 5
	[0061.191] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.191] lstrlenW (lpString=".ppt") returned 4
	[0061.191] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.191] lstrlenW (lpString=".zip") returned 4
	[0061.191] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.191] lstrlenW (lpString=".rar") returned 4
	[0061.191] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.191] lstrlenW (lpString=".bz2") returned 4
	[0061.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.191] lstrlenW (lpString=".7z") returned 3
	[0061.191] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.191] lstrlenW (lpString=".dbf") returned 4
	[0061.191] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.191] lstrlenW (lpString=".1cd") returned 4
	[0061.192] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.192] lstrlenW (lpString=".jpg") returned 4
	[0061.192] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.192] lstrlenW (lpString=".doc") returned 4
	[0061.192] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.192] lstrlenW (lpString=".docx") returned 5
	[0061.192] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.192] lstrlenW (lpString=".pdf") returned 4
	[0061.192] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.192] lstrlenW (lpString=".xls") returned 4
	[0061.192] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.192] lstrlenW (lpString=".xlsx") returned 5
	[0061.192] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.192] lstrlenW (lpString=".ppt") returned 4
	[0061.192] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.192] lstrlenW (lpString=".zip") returned 4
	[0061.192] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.192] lstrlenW (lpString=".rar") returned 4
	[0061.192] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.192] lstrlenW (lpString=".bz2") returned 4
	[0061.192] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.193] lstrlenW (lpString=".7z") returned 3
	[0061.193] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.193] lstrlenW (lpString=".dbf") returned 4
	[0061.193] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.193] lstrlenW (lpString=".1cd") returned 4
	[0061.193] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0061.193] lstrlenW (lpString=".jpg") returned 4
	[0061.193] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.193] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0061.193] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.193] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.194] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=14168) returned 1
	[0061.194] CloseHandle (hObject=0x33c) returned 1
	[0061.194] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80
	[0061.194] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.194] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.194] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.194] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.194] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0061.195] GetLastError () returned 0x0
	[0061.195] ReadFile (in: hFile=0x33c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x3758, lpOverlapped=0x0) returned 1
	[0061.196] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x3760, lpOverlapped=0x0) returned 1
	[0061.197] ReadFile (in: hFile=0x33c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.197] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.198] SetEndOfFile (hFile=0x378) returned 1
	[0061.198] CloseHandle (hObject=0x378) returned 1
	[0061.199] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.199] SetEndOfFile (hFile=0x33c) returned 1
	[0061.200] CloseHandle (hObject=0x33c) returned 1
	[0061.200] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.200] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1
	[0061.201] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.201] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.201] lstrlenW (lpString=".doc") returned 4
	[0061.201] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.201] lstrlenW (lpString=".docx") returned 5
	[0061.201] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.201] lstrlenW (lpString=".pdf") returned 4
	[0061.201] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.201] lstrlenW (lpString=".xls") returned 4
	[0061.201] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.201] lstrlenW (lpString=".xlsx") returned 5
	[0061.201] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.201] lstrlenW (lpString=".ppt") returned 4
	[0061.201] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.201] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.201] lstrlenW (lpString=".zip") returned 4
	[0061.201] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.201] lstrlenW (lpString=".rar") returned 4
	[0061.201] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.201] lstrlenW (lpString=".bz2") returned 4
	[0061.201] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.201] lstrlenW (lpString=".7z") returned 3
	[0061.201] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.201] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.201] lstrlenW (lpString=".dbf") returned 4
	[0061.201] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.202] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.202] lstrlenW (lpString=".1cd") returned 4
	[0061.202] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.202] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.202] lstrlenW (lpString=".jpg") returned 4
	[0061.202] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.202] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.202] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.202] lstrlenW (lpString=".doc") returned 4
	[0061.202] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.202] lstrlenW (lpString=".docx") returned 5
	[0061.202] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.202] lstrlenW (lpString=".pdf") returned 4
	[0061.202] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.202] lstrlenW (lpString=".xls") returned 4
	[0061.202] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.202] lstrlenW (lpString=".xlsx") returned 5
	[0061.202] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.202] lstrlenW (lpString=".ppt") returned 4
	[0061.202] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.202] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.202] lstrlenW (lpString=".zip") returned 4
	[0061.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.202] lstrlenW (lpString=".rar") returned 4
	[0061.202] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.203] lstrlenW (lpString=".bz2") returned 4
	[0061.203] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.203] lstrlenW (lpString=".7z") returned 3
	[0061.203] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.203] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.203] lstrlenW (lpString=".dbf") returned 4
	[0061.203] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.203] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.203] lstrlenW (lpString=".1cd") returned 4
	[0061.203] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.203] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0061.203] lstrlenW (lpString=".jpg") returned 4
	[0061.203] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.203] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0061.203] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.203] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.203] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=18776) returned 1
	[0061.203] CloseHandle (hObject=0x33c) returned 1
	[0061.204] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80
	[0061.204] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.204] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.204] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.204] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.204] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0061.204] GetLastError () returned 0x0
	[0061.204] ReadFile (in: hFile=0x33c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4958, lpOverlapped=0x0) returned 1
	[0061.206] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x4960, lpOverlapped=0x0) returned 1
	[0061.207] ReadFile (in: hFile=0x33c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.207] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.207] SetEndOfFile (hFile=0x378) returned 1
	[0061.207] CloseHandle (hObject=0x378) returned 1
	[0061.208] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.208] SetEndOfFile (hFile=0x33c) returned 1
	[0061.209] CloseHandle (hObject=0x33c) returned 1
	[0061.209] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.210] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1
	[0061.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.210] lstrlenW (lpString=".doc") returned 4
	[0061.210] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.210] lstrlenW (lpString=".docx") returned 5
	[0061.210] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.210] lstrlenW (lpString=".pdf") returned 4
	[0061.210] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.211] lstrlenW (lpString=".xls") returned 4
	[0061.211] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.211] lstrlenW (lpString=".xlsx") returned 5
	[0061.211] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.211] lstrlenW (lpString=".ppt") returned 4
	[0061.211] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.211] lstrlenW (lpString=".zip") returned 4
	[0061.211] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.211] lstrlenW (lpString=".rar") returned 4
	[0061.211] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.211] lstrlenW (lpString=".bz2") returned 4
	[0061.211] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.211] lstrlenW (lpString=".7z") returned 3
	[0061.211] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.211] lstrlenW (lpString=".dbf") returned 4
	[0061.211] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.211] lstrlenW (lpString=".1cd") returned 4
	[0061.211] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.211] lstrlenW (lpString=".jpg") returned 4
	[0061.211] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.212] lstrlenW (lpString=".doc") returned 4
	[0061.212] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.212] lstrlenW (lpString=".docx") returned 5
	[0061.212] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.212] lstrlenW (lpString=".pdf") returned 4
	[0061.212] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.212] lstrlenW (lpString=".xls") returned 4
	[0061.212] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.212] lstrlenW (lpString=".xlsx") returned 5
	[0061.212] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.212] lstrlenW (lpString=".ppt") returned 4
	[0061.212] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.212] lstrlenW (lpString=".zip") returned 4
	[0061.212] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.212] lstrlenW (lpString=".rar") returned 4
	[0061.212] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.212] lstrlenW (lpString=".bz2") returned 4
	[0061.212] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.212] lstrlenW (lpString=".7z") returned 3
	[0061.212] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.212] lstrlenW (lpString=".dbf") returned 4
	[0061.212] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.213] lstrlenW (lpString=".1cd") returned 4
	[0061.213] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0061.213] lstrlenW (lpString=".jpg") returned 4
	[0061.213] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.213] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.213] lstrlenW (lpString="DisplayIcon.ico") returned 15
	[0061.213] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.213] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=88533) returned 1
	[0061.213] CloseHandle (hObject=0x33c) returned 1
	[0061.213] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80
	[0061.214] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.710] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.710] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.710] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.710] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.710] GetLastError () returned 0x0
	[0061.710] ReadFile (in: hFile=0x370, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x159d5, lpOverlapped=0x0) returned 1
	[0061.714] WriteFile (in: hFile=0x374, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x159e0, lpOverlapped=0x0) returned 1
	[0061.716] ReadFile (in: hFile=0x370, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.716] WriteFile (in: hFile=0x374, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf2, lpOverlapped=0x0) returned 1
	[0061.717] SetEndOfFile (hFile=0x374) returned 1
	[0061.717] CloseHandle (hObject=0x374) returned 1
	[0061.720] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.720] SetEndOfFile (hFile=0x370) returned 1
	[0061.721] CloseHandle (hObject=0x370) returned 1
	[0061.721] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.722] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1
	[0061.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.722] lstrlenW (lpString=".doc") returned 4
	[0061.722] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.722] lstrlenW (lpString=".docx") returned 5
	[0061.722] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0061.722] lstrlenW (lpString=".pdf") returned 4
	[0061.722] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.722] lstrlenW (lpString=".xls") returned 4
	[0061.722] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.722] lstrlenW (lpString=".xlsx") returned 5
	[0061.722] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0061.722] lstrlenW (lpString=".ppt") returned 4
	[0061.722] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.722] lstrlenW (lpString=".zip") returned 4
	[0061.722] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.722] lstrlenW (lpString=".rar") returned 4
	[0061.722] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.723] lstrlenW (lpString=".bz2") returned 4
	[0061.723] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.723] lstrlenW (lpString=".7z") returned 3
	[0061.723] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.723] lstrlenW (lpString=".dbf") returned 4
	[0061.723] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.723] lstrlenW (lpString=".1cd") returned 4
	[0061.723] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.723] lstrlenW (lpString=".jpg") returned 4
	[0061.723] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.723] lstrlenW (lpString=".doc") returned 4
	[0061.723] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.723] lstrlenW (lpString=".docx") returned 5
	[0061.723] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0061.723] lstrlenW (lpString=".pdf") returned 4
	[0061.723] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.723] lstrlenW (lpString=".xls") returned 4
	[0061.723] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.723] lstrlenW (lpString=".xlsx") returned 5
	[0061.723] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0061.724] lstrlenW (lpString=".ppt") returned 4
	[0061.724] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.724] lstrlenW (lpString=".zip") returned 4
	[0061.724] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.724] lstrlenW (lpString=".rar") returned 4
	[0061.724] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.724] lstrlenW (lpString=".bz2") returned 4
	[0061.724] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.724] lstrlenW (lpString=".7z") returned 3
	[0061.724] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.724] lstrlenW (lpString=".dbf") returned 4
	[0061.724] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.724] lstrlenW (lpString=".1cd") returned 4
	[0061.724] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0061.724] lstrlenW (lpString=".jpg") returned 4
	[0061.724] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.724] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.724] lstrlenW (lpString="Save.ico") returned 8
	[0061.724] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.725] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=1150) returned 1
	[0061.725] CloseHandle (hObject=0x370) returned 1
	[0061.725] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80
	[0061.725] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.726] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.726] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.726] GetLastError () returned 0x0
	[0061.726] ReadFile (in: hFile=0x370, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x47e, lpOverlapped=0x0) returned 1
	[0061.728] WriteFile (in: hFile=0x374, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x480, lpOverlapped=0x0) returned 1
	[0061.729] ReadFile (in: hFile=0x370, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.729] WriteFile (in: hFile=0x374, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0061.730] SetEndOfFile (hFile=0x374) returned 1
	[0061.730] CloseHandle (hObject=0x374) returned 1
	[0061.731] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.731] SetEndOfFile (hFile=0x370) returned 1
	[0061.732] CloseHandle (hObject=0x370) returned 1
	[0061.732] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.733] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1
	[0061.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.733] lstrlenW (lpString=".doc") returned 4
	[0061.733] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.733] lstrlenW (lpString=".docx") returned 5
	[0061.733] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1
	[0061.733] lstrlenW (lpString=".pdf") returned 4
	[0061.733] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.733] lstrlenW (lpString=".xls") returned 4
	[0061.733] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.733] lstrlenW (lpString=".xlsx") returned 5
	[0061.733] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1
	[0061.733] lstrlenW (lpString=".ppt") returned 4
	[0061.733] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.733] lstrlenW (lpString=".zip") returned 4
	[0061.733] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.733] lstrlenW (lpString=".rar") returned 4
	[0061.733] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.733] lstrlenW (lpString=".bz2") returned 4
	[0061.734] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.734] lstrlenW (lpString=".7z") returned 3
	[0061.734] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.734] lstrlenW (lpString=".dbf") returned 4
	[0061.734] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.734] lstrlenW (lpString=".1cd") returned 4
	[0061.734] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.734] lstrlenW (lpString=".jpg") returned 4
	[0061.734] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.734] lstrlenW (lpString=".doc") returned 4
	[0061.734] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.734] lstrlenW (lpString=".docx") returned 5
	[0061.734] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1
	[0061.734] lstrlenW (lpString=".pdf") returned 4
	[0061.734] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.734] lstrlenW (lpString=".xls") returned 4
	[0061.734] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.734] lstrlenW (lpString=".xlsx") returned 5
	[0061.734] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1
	[0061.734] lstrlenW (lpString=".ppt") returned 4
	[0061.734] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.734] lstrlenW (lpString=".zip") returned 4
	[0061.735] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.735] lstrlenW (lpString=".rar") returned 4
	[0061.735] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.735] lstrlenW (lpString=".bz2") returned 4
	[0061.735] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.735] lstrlenW (lpString=".7z") returned 3
	[0061.735] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.735] lstrlenW (lpString=".dbf") returned 4
	[0061.735] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.735] lstrlenW (lpString=".1cd") returned 4
	[0061.735] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0061.735] lstrlenW (lpString=".jpg") returned 4
	[0061.735] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.735] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.735] lstrlenW (lpString="Setup.ico") returned 9
	[0061.735] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.736] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=36710) returned 1
	[0061.736] CloseHandle (hObject=0x370) returned 1
	[0061.736] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80
	[0061.736] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.736] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.736] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.736] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.736] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.737] GetLastError () returned 0x0
	[0061.737] ReadFile (in: hFile=0x370, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x8f66, lpOverlapped=0x0) returned 1
	[0061.738] WriteFile (in: hFile=0x374, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x8f70, lpOverlapped=0x0) returned 1
	[0061.740] ReadFile (in: hFile=0x370, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.740] WriteFile (in: hFile=0x374, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xe6, lpOverlapped=0x0) returned 1
	[0061.740] SetEndOfFile (hFile=0x374) returned 1
	[0061.740] CloseHandle (hObject=0x374) returned 1
	[0061.743] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.743] SetEndOfFile (hFile=0x370) returned 1
	[0061.744] CloseHandle (hObject=0x370) returned 1
	[0061.744] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.744] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1
	[0061.744] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0061.744] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0061.744] lstrlenW (lpString=".doc") returned 4
	[0061.744] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.745] lstrlenW (lpString=".docx") returned 5
	[0061.745] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0061.745] lstrlenW (lpString=".pdf") returned 4
	[0061.745] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.745] lstrlenW (lpString=".xls") returned 4
	[0061.745] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.745] lstrlenW (lpString=".xlsx") returned 5
	[0061.745] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0061.745] lstrlenW (lpString=".ppt") returned 4
	[0061.745] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.745] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.045] lstrlenW (lpString=".zip") returned 4
	[0062.045] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.045] lstrlenW (lpString=".rar") returned 4
	[0062.045] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.045] lstrlenW (lpString=".bz2") returned 4
	[0062.045] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.045] lstrlenW (lpString=".7z") returned 3
	[0062.045] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.045] lstrlenW (lpString=".dbf") returned 4
	[0062.045] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.046] lstrlenW (lpString=".1cd") returned 4
	[0062.046] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.046] lstrlenW (lpString=".jpg") returned 4
	[0062.046] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.046] lstrlenW (lpString=".doc") returned 4
	[0062.046] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.046] lstrlenW (lpString=".docx") returned 5
	[0062.046] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0062.046] lstrlenW (lpString=".pdf") returned 4
	[0062.046] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.047] lstrlenW (lpString=".xls") returned 4
	[0062.048] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.048] lstrlenW (lpString=".xlsx") returned 5
	[0062.048] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0062.048] lstrlenW (lpString=".ppt") returned 4
	[0062.048] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.048] lstrlenW (lpString=".zip") returned 4
	[0062.048] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.048] lstrlenW (lpString=".rar") returned 4
	[0062.048] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.048] lstrlenW (lpString=".bz2") returned 4
	[0062.048] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.048] lstrlenW (lpString=".7z") returned 3
	[0062.048] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.049] lstrlenW (lpString=".dbf") returned 4
	[0062.049] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.049] lstrlenW (lpString=".1cd") returned 4
	[0062.049] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.049] lstrlenW (lpString=".jpg") returned 4
	[0062.049] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.049] lstrcmpiW (lpString1=".msi", lpString2=".money") returned 1
	[0062.049] lstrlenW (lpString="netfx_Core_x86.msi") returned 18
	[0062.049] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.050] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=1163264) returned 1
	[0062.050] CloseHandle (hObject=0x364) returned 1
	[0062.050] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80
	[0062.050] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.050] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.051] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.051] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.051] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.051] GetLastError () returned 0x0
	[0062.051] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0062.101] WriteFile (in: hFile=0x320, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0062.422] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x1c010, lpOverlapped=0x0) returned 1
	[0062.435] WriteFile (in: hFile=0x320, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x1c020, lpOverlapped=0x0) returned 1
	[0062.440] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.440] WriteFile (in: hFile=0x320, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0062.440] SetEndOfFile (hFile=0x320) returned 1
	[0062.440] CloseHandle (hObject=0x320) returned 1
	[0062.829] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.854] SetEndOfFile (hFile=0x364) returned 1
	[0062.865] CloseHandle (hObject=0x364) returned 1
	[0062.866] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0062.866] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1
	[0062.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.866] lstrlenW (lpString=".doc") returned 4
	[0062.866] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0062.866] lstrlenW (lpString=".docx") returned 5
	[0062.866] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0062.866] lstrlenW (lpString=".pdf") returned 4
	[0062.866] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0062.867] lstrlenW (lpString=".xls") returned 4
	[0062.867] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0062.867] lstrlenW (lpString=".xlsx") returned 5
	[0062.867] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0062.867] lstrlenW (lpString=".ppt") returned 4
	[0062.867] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0062.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.867] lstrlenW (lpString=".zip") returned 4
	[0062.867] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0062.867] lstrlenW (lpString=".rar") returned 4
	[0062.867] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0062.867] lstrlenW (lpString=".bz2") returned 4
	[0062.867] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0062.867] lstrlenW (lpString=".7z") returned 3
	[0062.867] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0062.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.867] lstrlenW (lpString=".dbf") returned 4
	[0062.867] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0062.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.867] lstrlenW (lpString=".1cd") returned 4
	[0062.867] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0062.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.867] lstrlenW (lpString=".jpg") returned 4
	[0062.867] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0062.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.867] lstrlenW (lpString=".doc") returned 4
	[0062.867] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0062.867] lstrlenW (lpString=".docx") returned 5
	[0062.867] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0062.868] lstrlenW (lpString=".pdf") returned 4
	[0062.868] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0062.868] lstrlenW (lpString=".xls") returned 4
	[0062.868] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0062.868] lstrlenW (lpString=".xlsx") returned 5
	[0062.868] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0062.868] lstrlenW (lpString=".ppt") returned 4
	[0062.868] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0062.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.868] lstrlenW (lpString=".zip") returned 4
	[0062.868] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0062.868] lstrlenW (lpString=".rar") returned 4
	[0062.868] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0062.868] lstrlenW (lpString=".bz2") returned 4
	[0062.868] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0062.868] lstrlenW (lpString=".7z") returned 3
	[0062.868] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0062.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.868] lstrlenW (lpString=".dbf") returned 4
	[0062.868] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0062.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.868] lstrlenW (lpString=".1cd") returned 4
	[0062.868] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0062.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0062.868] lstrlenW (lpString=".jpg") returned 4
	[0062.868] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0062.869] lstrcmpiW (lpString1=".msi", lpString2=".money") returned 1
	[0062.869] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22
	[0062.869] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.869] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=872448) returned 1
	[0062.869] CloseHandle (hObject=0x364) returned 1
	[0062.869] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80
	[0062.869] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.870] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.870] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.870] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.870] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0062.870] GetLastError () returned 0x0
	[0062.870] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0xd5000, lpOverlapped=0x0) returned 1
	[0062.887] WriteFile (in: hFile=0x370, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xd5010, lpOverlapped=0x0) returned 1
	[0063.486] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.486] WriteFile (in: hFile=0x370, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x100, lpOverlapped=0x0) returned 1
	[0063.486] SetEndOfFile (hFile=0x370) returned 1
	[0063.486] CloseHandle (hObject=0x370) returned 1
	[0063.504] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.504] SetEndOfFile (hFile=0x364) returned 1
	[0063.512] CloseHandle (hObject=0x364) returned 1
	[0063.512] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0063.512] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1
	[0063.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.513] lstrlenW (lpString=".doc") returned 4
	[0063.513] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0063.513] lstrlenW (lpString=".docx") returned 5
	[0063.513] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0063.513] lstrlenW (lpString=".pdf") returned 4
	[0063.513] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0063.513] lstrlenW (lpString=".xls") returned 4
	[0063.513] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0063.513] lstrlenW (lpString=".xlsx") returned 5
	[0063.513] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0063.513] lstrlenW (lpString=".ppt") returned 4
	[0063.513] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0063.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.513] lstrlenW (lpString=".zip") returned 4
	[0063.513] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0063.513] lstrlenW (lpString=".rar") returned 4
	[0063.513] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0063.513] lstrlenW (lpString=".bz2") returned 4
	[0063.513] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0063.513] lstrlenW (lpString=".7z") returned 3
	[0063.513] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0063.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.513] lstrlenW (lpString=".dbf") returned 4
	[0063.513] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0063.514] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.514] lstrlenW (lpString=".1cd") returned 4
	[0063.514] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0063.514] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.514] lstrlenW (lpString=".jpg") returned 4
	[0063.514] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0063.514] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.514] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.514] lstrlenW (lpString=".doc") returned 4
	[0063.514] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0063.514] lstrlenW (lpString=".docx") returned 5
	[0063.514] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0063.514] lstrlenW (lpString=".pdf") returned 4
	[0063.514] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0063.514] lstrlenW (lpString=".xls") returned 4
	[0063.514] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0063.514] lstrlenW (lpString=".xlsx") returned 5
	[0063.514] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0063.514] lstrlenW (lpString=".ppt") returned 4
	[0063.514] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0063.514] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.515] lstrlenW (lpString=".zip") returned 4
	[0063.515] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0063.515] lstrlenW (lpString=".rar") returned 4
	[0063.515] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0063.515] lstrlenW (lpString=".bz2") returned 4
	[0063.515] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0063.515] lstrlenW (lpString=".7z") returned 3
	[0063.515] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0063.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.515] lstrlenW (lpString=".dbf") returned 4
	[0063.515] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0063.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.515] lstrlenW (lpString=".1cd") returned 4
	[0063.515] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0063.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0063.515] lstrlenW (lpString=".jpg") returned 4
	[0063.515] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0063.515] lstrcmpiW (lpString1=".msi", lpString2=".money") returned 1
	[0063.515] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16
	[0063.516] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0063.516] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=184832) returned 1
	[0063.516] CloseHandle (hObject=0x364) returned 1
	[0063.516] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80
	[0063.516] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0063.516] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0063.516] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.516] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.516] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0063.517] GetLastError () returned 0x0
	[0063.517] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x2d200, lpOverlapped=0x0) returned 1
	[0063.867] WriteFile (in: hFile=0x370, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x2d210, lpOverlapped=0x0) returned 1
	[0063.874] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.874] WriteFile (in: hFile=0x370, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf4, lpOverlapped=0x0) returned 1
	[0063.875] SetEndOfFile (hFile=0x370) returned 1
	[0064.739] CloseHandle (hObject=0x370) returned 1
	[0064.744] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.744] SetEndOfFile (hFile=0x364) returned 1
	[0064.746] CloseHandle (hObject=0x364) returned 1
	[0064.746] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0064.746] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1
	[0064.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.747] lstrlenW (lpString=".doc") returned 4
	[0064.747] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0064.747] lstrlenW (lpString=".docx") returned 5
	[0064.747] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0064.747] lstrlenW (lpString=".pdf") returned 4
	[0064.747] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0064.747] lstrlenW (lpString=".xls") returned 4
	[0064.747] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0064.747] lstrlenW (lpString=".xlsx") returned 5
	[0064.747] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0064.747] lstrlenW (lpString=".ppt") returned 4
	[0064.747] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0064.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.747] lstrlenW (lpString=".zip") returned 4
	[0064.747] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0064.748] lstrlenW (lpString=".rar") returned 4
	[0064.748] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0064.748] lstrlenW (lpString=".bz2") returned 4
	[0064.748] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0064.748] lstrlenW (lpString=".7z") returned 3
	[0064.748] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0064.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.748] lstrlenW (lpString=".dbf") returned 4
	[0064.748] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0064.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.748] lstrlenW (lpString=".1cd") returned 4
	[0064.748] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0064.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.748] lstrlenW (lpString=".jpg") returned 4
	[0064.748] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0064.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.748] lstrlenW (lpString=".doc") returned 4
	[0064.749] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0064.749] lstrlenW (lpString=".docx") returned 5
	[0064.749] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0064.749] lstrlenW (lpString=".pdf") returned 4
	[0064.749] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0064.749] lstrlenW (lpString=".xls") returned 4
	[0064.749] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0064.749] lstrlenW (lpString=".xlsx") returned 5
	[0064.749] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0064.749] lstrlenW (lpString=".ppt") returned 4
	[0064.749] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0064.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.749] lstrlenW (lpString=".zip") returned 4
	[0064.749] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0064.749] lstrlenW (lpString=".rar") returned 4
	[0064.749] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0064.749] lstrlenW (lpString=".bz2") returned 4
	[0064.749] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0064.749] lstrlenW (lpString=".7z") returned 3
	[0064.749] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0064.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.749] lstrlenW (lpString=".dbf") returned 4
	[0064.749] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0064.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.750] lstrlenW (lpString=".1cd") returned 4
	[0064.750] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0064.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0064.750] lstrlenW (lpString=".jpg") returned 4
	[0064.750] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0064.750] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0064.750] lstrlenW (lpString="SetupUi.dll") returned 11
	[0064.750] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.750] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=295248) returned 1
	[0064.750] CloseHandle (hObject=0x364) returned 1
	[0064.750] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80
	[0064.751] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0064.751] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.751] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.751] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.751] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0064.751] GetLastError () returned 0x0
	[0064.751] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x48150, lpOverlapped=0x0) returned 1
	[0064.758] WriteFile (in: hFile=0x370, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x48160, lpOverlapped=0x0) returned 1
	[0064.764] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.764] WriteFile (in: hFile=0x370, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xea, lpOverlapped=0x0) returned 1
	[0064.764] SetEndOfFile (hFile=0x370) returned 1
	[0064.764] CloseHandle (hObject=0x370) returned 1
	[0064.773] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.773] SetEndOfFile (hFile=0x364) returned 1
	[0064.777] CloseHandle (hObject=0x364) returned 1
	[0064.777] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0064.777] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1
	[0064.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.778] lstrlenW (lpString=".doc") returned 4
	[0064.778] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0064.778] lstrlenW (lpString=".docx") returned 5
	[0064.778] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0064.778] lstrlenW (lpString=".pdf") returned 4
	[0064.778] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0064.778] lstrlenW (lpString=".xls") returned 4
	[0064.778] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0064.778] lstrlenW (lpString=".xlsx") returned 5
	[0064.778] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0064.778] lstrlenW (lpString=".ppt") returned 4
	[0064.778] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0064.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.778] lstrlenW (lpString=".zip") returned 4
	[0064.778] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0064.778] lstrlenW (lpString=".rar") returned 4
	[0064.778] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0064.778] lstrlenW (lpString=".bz2") returned 4
	[0064.778] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0064.778] lstrlenW (lpString=".7z") returned 3
	[0064.779] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0064.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.779] lstrlenW (lpString=".dbf") returned 4
	[0064.779] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0064.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.779] lstrlenW (lpString=".1cd") returned 4
	[0064.779] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0064.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.779] lstrlenW (lpString=".jpg") returned 4
	[0064.779] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0064.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.779] lstrlenW (lpString=".doc") returned 4
	[0064.779] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0064.779] lstrlenW (lpString=".docx") returned 5
	[0064.779] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0064.779] lstrlenW (lpString=".pdf") returned 4
	[0064.779] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0064.780] lstrlenW (lpString=".xls") returned 4
	[0064.780] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0064.780] lstrlenW (lpString=".xlsx") returned 5
	[0064.780] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0064.780] lstrlenW (lpString=".ppt") returned 4
	[0064.780] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0064.780] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.780] lstrlenW (lpString=".zip") returned 4
	[0064.780] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0064.780] lstrlenW (lpString=".rar") returned 4
	[0064.780] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0064.780] lstrlenW (lpString=".bz2") returned 4
	[0064.780] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0064.780] lstrlenW (lpString=".7z") returned 3
	[0064.780] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0064.780] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.780] lstrlenW (lpString=".dbf") returned 4
	[0064.780] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0064.780] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.780] lstrlenW (lpString=".1cd") returned 4
	[0064.780] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0064.780] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0064.780] lstrlenW (lpString=".jpg") returned 4
	[0064.781] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0064.781] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0064.781] lstrlenW (lpString="SetupUtility.exe") returned 16
	[0064.781] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.781] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=96088) returned 1
	[0064.781] CloseHandle (hObject=0x364) returned 1
	[0064.781] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80
	[0064.781] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0064.781] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.782] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.782] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.782] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0064.782] GetLastError () returned 0x0
	[0064.782] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x17758, lpOverlapped=0x0) returned 1
	[0065.261] WriteFile (in: hFile=0x370, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x17760, lpOverlapped=0x0) returned 1
	[0065.263] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.263] WriteFile (in: hFile=0x370, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf4, lpOverlapped=0x0) returned 1
	[0065.263] SetEndOfFile (hFile=0x370) returned 1
	[0065.264] CloseHandle (hObject=0x370) returned 1
	[0065.266] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.266] SetEndOfFile (hFile=0x364) returned 1
	[0065.268] CloseHandle (hObject=0x364) returned 1
	[0065.268] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0065.268] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1
	[0065.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.268] lstrlenW (lpString=".doc") returned 4
	[0065.268] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0065.268] lstrlenW (lpString=".docx") returned 5
	[0065.269] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0065.269] lstrlenW (lpString=".pdf") returned 4
	[0065.269] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0065.269] lstrlenW (lpString=".xls") returned 4
	[0065.269] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0065.269] lstrlenW (lpString=".xlsx") returned 5
	[0065.269] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0065.269] lstrlenW (lpString=".ppt") returned 4
	[0065.269] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0065.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.269] lstrlenW (lpString=".zip") returned 4
	[0065.269] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0065.269] lstrlenW (lpString=".rar") returned 4
	[0065.269] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0065.269] lstrlenW (lpString=".bz2") returned 4
	[0065.269] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0065.269] lstrlenW (lpString=".7z") returned 3
	[0065.269] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0065.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.269] lstrlenW (lpString=".dbf") returned 4
	[0065.269] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0065.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.269] lstrlenW (lpString=".1cd") returned 4
	[0065.269] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0065.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.269] lstrlenW (lpString=".jpg") returned 4
	[0065.270] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0065.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.270] lstrlenW (lpString=".doc") returned 4
	[0065.270] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0065.270] lstrlenW (lpString=".docx") returned 5
	[0065.270] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0065.270] lstrlenW (lpString=".pdf") returned 4
	[0065.270] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0065.270] lstrlenW (lpString=".xls") returned 4
	[0065.270] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0065.270] lstrlenW (lpString=".xlsx") returned 5
	[0065.270] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0065.270] lstrlenW (lpString=".ppt") returned 4
	[0065.270] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0065.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.270] lstrlenW (lpString=".zip") returned 4
	[0065.270] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0065.270] lstrlenW (lpString=".rar") returned 4
	[0065.271] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0065.271] lstrlenW (lpString=".bz2") returned 4
	[0065.271] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0065.271] lstrlenW (lpString=".7z") returned 3
	[0065.271] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0065.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.271] lstrlenW (lpString=".dbf") returned 4
	[0065.271] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0065.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.271] lstrlenW (lpString=".1cd") returned 4
	[0065.271] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0065.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0065.271] lstrlenW (lpString=".jpg") returned 4
	[0065.271] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0065.271] lstrcmpiW (lpString1=".msu", lpString2=".money") returned 1
	[0065.271] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33
	[0065.271] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0065.272] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=5198099) returned 1
	[0065.272] CloseHandle (hObject=0x364) returned 1
	[0065.272] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80
	[0065.272] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0065.272] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[admin@stex777.com].money")) returned 1
	[0065.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0065.273] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc64 | out: lpNewFilePointer=0x0) returned 1
	[0065.273] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.273] ReadFile (in: hFile=0x364, lpBuffer=0x3fc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3fc0058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.277] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.277] ReadFile (in: hFile=0x364, lpBuffer=0x4000058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4000058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.280] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x39dfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0065.280] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.280] ReadFile (in: hFile=0x364, lpBuffer=0x4040058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4040058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.295] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.295] WriteFile (in: hFile=0x364, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x39dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0065.642] SetEndOfFile (hFile=0x364) returned 1
	[0065.642] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x43045a8
	[0065.648] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0065.649] WriteFile (in: hFile=0x364, lpBuffer=0x43045a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x43045a8*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.650] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0065.650] WriteFile (in: hFile=0x364, lpBuffer=0x43045a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x43045a8*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.652] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0065.652] WriteFile (in: hFile=0x364, lpBuffer=0x43045a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x43045a8*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.655] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43045a8 | out: hHeap=0x600000) returned 1
	[0065.657] CloseHandle (hObject=0x364) returned 1
	[0067.553] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0067.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.554] lstrlenW (lpString=".doc") returned 4
	[0067.554] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0067.554] lstrlenW (lpString=".docx") returned 5
	[0067.554] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0067.554] lstrlenW (lpString=".pdf") returned 4
	[0067.554] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0067.554] lstrlenW (lpString=".xls") returned 4
	[0067.554] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0067.554] lstrlenW (lpString=".xlsx") returned 5
	[0067.554] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0067.554] lstrlenW (lpString=".ppt") returned 4
	[0067.554] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0067.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.554] lstrlenW (lpString=".zip") returned 4
	[0067.554] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0067.554] lstrlenW (lpString=".rar") returned 4
	[0067.554] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0067.554] lstrlenW (lpString=".bz2") returned 4
	[0067.554] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0067.554] lstrlenW (lpString=".7z") returned 3
	[0067.554] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0067.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.554] lstrlenW (lpString=".dbf") returned 4
	[0067.554] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0067.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.554] lstrlenW (lpString=".1cd") returned 4
	[0067.555] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0067.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.555] lstrlenW (lpString=".jpg") returned 4
	[0067.555] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0067.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.555] lstrlenW (lpString=".doc") returned 4
	[0067.555] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0067.555] lstrlenW (lpString=".docx") returned 5
	[0067.555] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0067.555] lstrlenW (lpString=".pdf") returned 4
	[0067.555] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0067.555] lstrlenW (lpString=".xls") returned 4
	[0067.555] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0067.555] lstrlenW (lpString=".xlsx") returned 5
	[0067.555] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0067.555] lstrlenW (lpString=".ppt") returned 4
	[0067.555] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0067.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.555] lstrlenW (lpString=".zip") returned 4
	[0067.555] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0067.555] lstrlenW (lpString=".rar") returned 4
	[0067.555] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0067.555] lstrlenW (lpString=".bz2") returned 4
	[0067.555] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0067.555] lstrlenW (lpString=".7z") returned 3
	[0067.556] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0067.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.556] lstrlenW (lpString=".dbf") returned 4
	[0067.556] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0067.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.556] lstrlenW (lpString=".1cd") returned 4
	[0067.556] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0067.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0067.556] lstrlenW (lpString=".jpg") returned 4
	[0067.556] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0067.556] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0067.556] lstrlenW (lpString="Internet Explorer.evtx") returned 22
	[0067.556] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0068.068] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0068.068] CloseHandle (hObject=0x384) returned 1
	[0068.068] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20
	[0068.068] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.068] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0068.068] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.069] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.069] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.069] GetLastError () returned 0x0
	[0068.069] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.071] WriteFile (in: hFile=0x320, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.073] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.073] WriteFile (in: hFile=0x320, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x100, lpOverlapped=0x0) returned 1
	[0068.073] SetEndOfFile (hFile=0x320) returned 1
	[0068.074] CloseHandle (hObject=0x320) returned 1
	[0068.076] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.076] SetEndOfFile (hFile=0x384) returned 1
	[0068.077] CloseHandle (hObject=0x384) returned 1
	[0068.077] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.077] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1
	[0068.078] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.078] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.078] lstrlenW (lpString=".doc") returned 4
	[0068.078] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.078] lstrlenW (lpString=".docx") returned 5
	[0068.078] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.078] lstrlenW (lpString=".pdf") returned 4
	[0068.078] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.078] lstrlenW (lpString=".xls") returned 4
	[0068.078] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.078] lstrlenW (lpString=".xlsx") returned 5
	[0068.078] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.078] lstrlenW (lpString=".ppt") returned 4
	[0068.078] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.078] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.078] lstrlenW (lpString=".zip") returned 4
	[0068.078] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.078] lstrlenW (lpString=".rar") returned 4
	[0068.078] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.078] lstrlenW (lpString=".bz2") returned 4
	[0068.078] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.078] lstrlenW (lpString=".7z") returned 3
	[0068.078] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.078] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.078] lstrlenW (lpString=".dbf") returned 4
	[0068.078] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.078] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.078] lstrlenW (lpString=".1cd") returned 4
	[0068.079] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.079] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.079] lstrlenW (lpString=".jpg") returned 4
	[0068.079] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.079] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.079] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.079] lstrlenW (lpString=".doc") returned 4
	[0068.079] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.079] lstrlenW (lpString=".docx") returned 5
	[0068.079] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.079] lstrlenW (lpString=".pdf") returned 4
	[0068.079] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.079] lstrlenW (lpString=".xls") returned 4
	[0068.079] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.079] lstrlenW (lpString=".xlsx") returned 5
	[0068.079] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.079] lstrlenW (lpString=".ppt") returned 4
	[0068.079] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.079] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.079] lstrlenW (lpString=".zip") returned 4
	[0068.079] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.079] lstrlenW (lpString=".rar") returned 4
	[0068.079] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.079] lstrlenW (lpString=".bz2") returned 4
	[0068.079] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.080] lstrlenW (lpString=".7z") returned 3
	[0068.080] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.080] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.080] lstrlenW (lpString=".dbf") returned 4
	[0068.080] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.080] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.080] lstrlenW (lpString=".1cd") returned 4
	[0068.080] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.080] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0068.080] lstrlenW (lpString=".jpg") returned 4
	[0068.080] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.080] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.080] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45
	[0068.080] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0068.080] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0068.080] CloseHandle (hObject=0x384) returned 1
	[0068.080] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20
	[0068.081] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.081] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0068.081] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.081] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.081] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.090] GetLastError () returned 0x0
	[0068.090] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.092] WriteFile (in: hFile=0x320, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.095] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.095] WriteFile (in: hFile=0x320, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x12e, lpOverlapped=0x0) returned 1
	[0068.095] SetEndOfFile (hFile=0x320) returned 1
	[0068.096] CloseHandle (hObject=0x320) returned 1
	[0068.099] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.099] SetEndOfFile (hFile=0x384) returned 1
	[0068.100] CloseHandle (hObject=0x384) returned 1
	[0068.100] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.100] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1
	[0068.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.101] lstrlenW (lpString=".doc") returned 4
	[0068.101] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.101] lstrlenW (lpString=".docx") returned 5
	[0068.101] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.101] lstrlenW (lpString=".pdf") returned 4
	[0068.101] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.101] lstrlenW (lpString=".xls") returned 4
	[0068.101] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.101] lstrlenW (lpString=".xlsx") returned 5
	[0068.101] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.101] lstrlenW (lpString=".ppt") returned 4
	[0068.101] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.102] lstrlenW (lpString=".zip") returned 4
	[0068.102] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.102] lstrlenW (lpString=".rar") returned 4
	[0068.102] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.102] lstrlenW (lpString=".bz2") returned 4
	[0068.102] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.102] lstrlenW (lpString=".7z") returned 3
	[0068.102] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.102] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.102] lstrlenW (lpString=".dbf") returned 4
	[0068.102] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.102] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.102] lstrlenW (lpString=".1cd") returned 4
	[0068.102] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.102] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.102] lstrlenW (lpString=".jpg") returned 4
	[0068.102] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.102] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.102] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.102] lstrlenW (lpString=".doc") returned 4
	[0068.102] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.102] lstrlenW (lpString=".docx") returned 5
	[0068.102] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.102] lstrlenW (lpString=".pdf") returned 4
	[0068.102] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.102] lstrlenW (lpString=".xls") returned 4
	[0068.102] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.102] lstrlenW (lpString=".xlsx") returned 5
	[0068.103] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.103] lstrlenW (lpString=".ppt") returned 4
	[0068.103] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.103] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.103] lstrlenW (lpString=".zip") returned 4
	[0068.103] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.103] lstrlenW (lpString=".rar") returned 4
	[0068.103] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.103] lstrlenW (lpString=".bz2") returned 4
	[0068.103] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.103] lstrlenW (lpString=".7z") returned 3
	[0068.103] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.103] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.103] lstrlenW (lpString=".dbf") returned 4
	[0068.103] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.103] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.103] lstrlenW (lpString=".1cd") returned 4
	[0068.103] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.103] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0068.103] lstrlenW (lpString=".jpg") returned 4
	[0068.103] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.103] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.104] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48
	[0068.104] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0068.104] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0068.104] CloseHandle (hObject=0x384) returned 1
	[0068.104] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20
	[0068.104] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.104] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0068.104] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.104] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.104] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0068.105] GetLastError () returned 0x0
	[0068.105] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.510] WriteFile (in: hFile=0x320, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.512] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.512] WriteFile (in: hFile=0x320, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x134, lpOverlapped=0x0) returned 1
	[0068.512] SetEndOfFile (hFile=0x320) returned 1
	[0068.753] CloseHandle (hObject=0x320) returned 1
	[0068.794] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.794] SetEndOfFile (hFile=0x384) returned 1
	[0068.796] CloseHandle (hObject=0x384) returned 1
	[0068.796] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.797] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1
	[0068.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.797] lstrlenW (lpString=".doc") returned 4
	[0068.797] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.797] lstrlenW (lpString=".docx") returned 5
	[0068.797] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.797] lstrlenW (lpString=".pdf") returned 4
	[0068.797] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.797] lstrlenW (lpString=".xls") returned 4
	[0068.797] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.797] lstrlenW (lpString=".xlsx") returned 5
	[0068.797] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.797] lstrlenW (lpString=".ppt") returned 4
	[0068.797] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.797] lstrlenW (lpString=".zip") returned 4
	[0068.797] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.798] lstrlenW (lpString=".rar") returned 4
	[0068.798] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.798] lstrlenW (lpString=".bz2") returned 4
	[0068.798] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.798] lstrlenW (lpString=".7z") returned 3
	[0068.798] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.798] lstrlenW (lpString=".dbf") returned 4
	[0068.798] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.798] lstrlenW (lpString=".1cd") returned 4
	[0068.798] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.798] lstrlenW (lpString=".jpg") returned 4
	[0068.798] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.798] lstrlenW (lpString=".doc") returned 4
	[0068.798] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.798] lstrlenW (lpString=".docx") returned 5
	[0068.798] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.798] lstrlenW (lpString=".pdf") returned 4
	[0068.798] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.798] lstrlenW (lpString=".xls") returned 4
	[0068.798] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.798] lstrlenW (lpString=".xlsx") returned 5
	[0068.798] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.798] lstrlenW (lpString=".ppt") returned 4
	[0068.798] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.799] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.799] lstrlenW (lpString=".zip") returned 4
	[0068.799] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.799] lstrlenW (lpString=".rar") returned 4
	[0068.799] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.799] lstrlenW (lpString=".bz2") returned 4
	[0068.799] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.799] lstrlenW (lpString=".7z") returned 3
	[0068.799] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.799] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.799] lstrlenW (lpString=".dbf") returned 4
	[0068.799] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.799] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.799] lstrlenW (lpString=".1cd") returned 4
	[0068.799] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.799] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0068.799] lstrlenW (lpString=".jpg") returned 4
	[0068.799] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.799] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.799] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56
	[0068.799] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0068.800] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=2166784) returned 1
	[0068.800] CloseHandle (hObject=0x384) returned 1
	[0068.800] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20
	[0068.800] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.800] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 1
	[0068.801] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0068.801] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc64 | out: lpNewFilePointer=0x0) returned 1
	[0068.801] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0068.801] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3fc0058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0068.805] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0068.805] ReadFile (in: hFile=0x384, lpBuffer=0x4000058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4000058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0068.809] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x39dfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0068.809] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0068.809] ReadFile (in: hFile=0x384, lpBuffer=0x4040058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4040058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0069.252] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.252] WriteFile (in: hFile=0x384, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x39dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfca8*=0xc015c, lpOverlapped=0x0) returned 1
	[0069.265] SetEndOfFile (hFile=0x384) returned 1
	[0069.646] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x42c45a0
	[0069.652] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.652] WriteFile (in: hFile=0x384, lpBuffer=0x42c45a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x42c45a0*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.653] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.653] WriteFile (in: hFile=0x384, lpBuffer=0x42c45a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x42c45a0*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.656] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.656] WriteFile (in: hFile=0x384, lpBuffer=0x42c45a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x42c45a0*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.657] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c45a0 | out: hHeap=0x600000) returned 1
	[0069.660] CloseHandle (hObject=0x384) returned 1
	[0071.104] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.104] lstrlenW (lpString=".doc") returned 4
	[0071.104] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.104] lstrlenW (lpString=".docx") returned 5
	[0071.104] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.104] lstrlenW (lpString=".pdf") returned 4
	[0071.104] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.104] lstrlenW (lpString=".xls") returned 4
	[0071.104] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.104] lstrlenW (lpString=".xlsx") returned 5
	[0071.104] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.105] lstrlenW (lpString=".ppt") returned 4
	[0071.105] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.105] lstrlenW (lpString=".zip") returned 4
	[0071.105] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.105] lstrlenW (lpString=".rar") returned 4
	[0071.105] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.105] lstrlenW (lpString=".bz2") returned 4
	[0071.105] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.105] lstrlenW (lpString=".7z") returned 3
	[0071.105] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.105] lstrlenW (lpString=".dbf") returned 4
	[0071.105] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.105] lstrlenW (lpString=".1cd") returned 4
	[0071.105] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.105] lstrlenW (lpString=".jpg") returned 4
	[0071.105] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.105] lstrlenW (lpString=".doc") returned 4
	[0071.105] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.105] lstrlenW (lpString=".docx") returned 5
	[0071.106] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.106] lstrlenW (lpString=".pdf") returned 4
	[0071.106] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.106] lstrlenW (lpString=".xls") returned 4
	[0071.106] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.106] lstrlenW (lpString=".xlsx") returned 5
	[0071.106] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.106] lstrlenW (lpString=".ppt") returned 4
	[0071.106] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.106] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.106] lstrlenW (lpString=".zip") returned 4
	[0071.106] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.106] lstrlenW (lpString=".rar") returned 4
	[0071.106] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.106] lstrlenW (lpString=".bz2") returned 4
	[0071.106] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.106] lstrlenW (lpString=".7z") returned 3
	[0071.106] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.106] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.106] lstrlenW (lpString=".dbf") returned 4
	[0071.106] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.106] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.106] lstrlenW (lpString=".1cd") returned 4
	[0071.106] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.106] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0071.106] lstrlenW (lpString=".jpg") returned 4
	[0071.106] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.107] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.107] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47
	[0071.107] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.107] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0071.108] CloseHandle (hObject=0x384) returned 1
	[0071.108] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20
	[0071.108] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.108] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.108] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.108] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.108] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0071.108] GetLastError () returned 0x0
	[0071.108] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.111] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.113] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.113] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x132, lpOverlapped=0x0) returned 1
	[0071.113] SetEndOfFile (hFile=0x318) returned 1
	[0071.113] CloseHandle (hObject=0x318) returned 1
	[0071.115] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.115] SetEndOfFile (hFile=0x384) returned 1
	[0071.116] CloseHandle (hObject=0x384) returned 1
	[0071.116] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.117] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1
	[0071.117] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.117] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.117] lstrlenW (lpString=".doc") returned 4
	[0071.117] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.117] lstrlenW (lpString=".docx") returned 5
	[0071.117] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.117] lstrlenW (lpString=".pdf") returned 4
	[0071.117] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.117] lstrlenW (lpString=".xls") returned 4
	[0071.117] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.117] lstrlenW (lpString=".xlsx") returned 5
	[0071.117] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.117] lstrlenW (lpString=".ppt") returned 4
	[0071.117] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.117] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.117] lstrlenW (lpString=".zip") returned 4
	[0071.117] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.117] lstrlenW (lpString=".rar") returned 4
	[0071.117] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.117] lstrlenW (lpString=".bz2") returned 4
	[0071.118] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.118] lstrlenW (lpString=".7z") returned 3
	[0071.118] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.118] lstrlenW (lpString=".dbf") returned 4
	[0071.118] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.118] lstrlenW (lpString=".1cd") returned 4
	[0071.118] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.118] lstrlenW (lpString=".jpg") returned 4
	[0071.118] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.118] lstrlenW (lpString=".doc") returned 4
	[0071.118] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.118] lstrlenW (lpString=".docx") returned 5
	[0071.118] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.118] lstrlenW (lpString=".pdf") returned 4
	[0071.118] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.118] lstrlenW (lpString=".xls") returned 4
	[0071.118] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.118] lstrlenW (lpString=".xlsx") returned 5
	[0071.118] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.118] lstrlenW (lpString=".ppt") returned 4
	[0071.119] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.119] lstrlenW (lpString=".zip") returned 4
	[0071.119] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.119] lstrlenW (lpString=".rar") returned 4
	[0071.119] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.119] lstrlenW (lpString=".bz2") returned 4
	[0071.119] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.119] lstrlenW (lpString=".7z") returned 3
	[0071.119] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.119] lstrlenW (lpString=".dbf") returned 4
	[0071.119] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.119] lstrlenW (lpString=".1cd") returned 4
	[0071.119] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0071.119] lstrlenW (lpString=".jpg") returned 4
	[0071.119] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.119] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.119] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48
	[0071.119] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.120] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0071.120] CloseHandle (hObject=0x384) returned 1
	[0071.120] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20
	[0071.120] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.120] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.120] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.120] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.120] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0071.120] GetLastError () returned 0x0
	[0071.120] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.125] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.127] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.127] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x134, lpOverlapped=0x0) returned 1
	[0071.127] SetEndOfFile (hFile=0x318) returned 1
	[0071.127] CloseHandle (hObject=0x318) returned 1
	[0071.129] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.129] SetEndOfFile (hFile=0x384) returned 1
	[0071.130] CloseHandle (hObject=0x384) returned 1
	[0071.131] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.131] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1
	[0071.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.131] lstrlenW (lpString=".doc") returned 4
	[0071.131] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.131] lstrlenW (lpString=".docx") returned 5
	[0071.131] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.131] lstrlenW (lpString=".pdf") returned 4
	[0071.131] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.131] lstrlenW (lpString=".xls") returned 4
	[0071.131] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.131] lstrlenW (lpString=".xlsx") returned 5
	[0071.131] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.131] lstrlenW (lpString=".ppt") returned 4
	[0071.131] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.132] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.132] lstrlenW (lpString=".zip") returned 4
	[0071.132] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.132] lstrlenW (lpString=".rar") returned 4
	[0071.132] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.132] lstrlenW (lpString=".bz2") returned 4
	[0071.132] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.132] lstrlenW (lpString=".7z") returned 3
	[0071.132] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.132] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.132] lstrlenW (lpString=".dbf") returned 4
	[0071.132] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.132] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.132] lstrlenW (lpString=".1cd") returned 4
	[0071.132] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.132] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.132] lstrlenW (lpString=".jpg") returned 4
	[0071.132] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.132] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.132] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.132] lstrlenW (lpString=".doc") returned 4
	[0071.132] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.132] lstrlenW (lpString=".docx") returned 5
	[0071.132] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.132] lstrlenW (lpString=".pdf") returned 4
	[0071.132] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.133] lstrlenW (lpString=".xls") returned 4
	[0071.133] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.133] lstrlenW (lpString=".xlsx") returned 5
	[0071.133] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.133] lstrlenW (lpString=".ppt") returned 4
	[0071.133] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.133] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.133] lstrlenW (lpString=".zip") returned 4
	[0071.133] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.133] lstrlenW (lpString=".rar") returned 4
	[0071.133] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.133] lstrlenW (lpString=".bz2") returned 4
	[0071.133] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.133] lstrlenW (lpString=".7z") returned 3
	[0071.133] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.133] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.133] lstrlenW (lpString=".dbf") returned 4
	[0071.133] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.133] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.133] lstrlenW (lpString=".1cd") returned 4
	[0071.133] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.133] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0071.133] lstrlenW (lpString=".jpg") returned 4
	[0071.133] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.133] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.134] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42
	[0071.134] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.134] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0071.134] CloseHandle (hObject=0x384) returned 1
	[0071.134] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20
	[0071.134] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.134] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.135] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.135] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.135] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0071.136] GetLastError () returned 0x0
	[0071.136] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.512] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.515] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.515] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x128, lpOverlapped=0x0) returned 1
	[0071.515] SetEndOfFile (hFile=0x318) returned 1
	[0071.880] CloseHandle (hObject=0x318) returned 1
	[0071.882] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.882] SetEndOfFile (hFile=0x384) returned 1
	[0071.883] CloseHandle (hObject=0x384) returned 1
	[0071.883] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.884] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1
	[0071.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.884] lstrlenW (lpString=".doc") returned 4
	[0071.884] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.884] lstrlenW (lpString=".docx") returned 5
	[0071.885] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.885] lstrlenW (lpString=".pdf") returned 4
	[0071.885] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.885] lstrlenW (lpString=".xls") returned 4
	[0071.885] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.885] lstrlenW (lpString=".xlsx") returned 5
	[0071.885] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.885] lstrlenW (lpString=".ppt") returned 4
	[0071.885] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.885] lstrlenW (lpString=".zip") returned 4
	[0071.885] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.885] lstrlenW (lpString=".rar") returned 4
	[0071.885] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.885] lstrlenW (lpString=".bz2") returned 4
	[0071.885] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.885] lstrlenW (lpString=".7z") returned 3
	[0071.885] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.885] lstrlenW (lpString=".dbf") returned 4
	[0071.885] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.885] lstrlenW (lpString=".1cd") returned 4
	[0071.885] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.886] lstrlenW (lpString=".jpg") returned 4
	[0071.886] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.886] lstrlenW (lpString=".doc") returned 4
	[0071.886] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.886] lstrlenW (lpString=".docx") returned 5
	[0071.886] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.886] lstrlenW (lpString=".pdf") returned 4
	[0071.886] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.886] lstrlenW (lpString=".xls") returned 4
	[0071.886] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.886] lstrlenW (lpString=".xlsx") returned 5
	[0071.886] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.886] lstrlenW (lpString=".ppt") returned 4
	[0071.886] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.886] lstrlenW (lpString=".zip") returned 4
	[0071.886] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.886] lstrlenW (lpString=".rar") returned 4
	[0071.887] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.887] lstrlenW (lpString=".bz2") returned 4
	[0071.887] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.887] lstrlenW (lpString=".7z") returned 3
	[0071.887] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.887] lstrlenW (lpString=".dbf") returned 4
	[0071.887] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.887] lstrlenW (lpString=".1cd") returned 4
	[0071.887] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0071.887] lstrlenW (lpString=".jpg") returned 4
	[0071.887] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.887] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.887] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46
	[0071.887] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.888] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0071.888] CloseHandle (hObject=0x384) returned 1
	[0071.888] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20
	[0071.888] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.888] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.888] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.888] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.888] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0071.889] GetLastError () returned 0x0
	[0071.889] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.892] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.894] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.894] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x130, lpOverlapped=0x0) returned 1
	[0071.894] SetEndOfFile (hFile=0x318) returned 1
	[0071.894] CloseHandle (hObject=0x318) returned 1
	[0071.899] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.900] SetEndOfFile (hFile=0x384) returned 1
	[0071.901] CloseHandle (hObject=0x384) returned 1
	[0071.901] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.902] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1
	[0071.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.902] lstrlenW (lpString=".doc") returned 4
	[0071.902] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.902] lstrlenW (lpString=".docx") returned 5
	[0071.902] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.902] lstrlenW (lpString=".pdf") returned 4
	[0071.902] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.902] lstrlenW (lpString=".xls") returned 4
	[0071.902] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.902] lstrlenW (lpString=".xlsx") returned 5
	[0071.903] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.903] lstrlenW (lpString=".ppt") returned 4
	[0071.903] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.903] lstrlenW (lpString=".zip") returned 4
	[0071.903] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.903] lstrlenW (lpString=".rar") returned 4
	[0071.903] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.903] lstrlenW (lpString=".bz2") returned 4
	[0071.903] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.903] lstrlenW (lpString=".7z") returned 3
	[0071.903] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.903] lstrlenW (lpString=".dbf") returned 4
	[0071.903] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.904] lstrlenW (lpString=".1cd") returned 4
	[0071.904] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.904] lstrlenW (lpString=".jpg") returned 4
	[0071.904] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.904] lstrlenW (lpString=".doc") returned 4
	[0071.904] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.904] lstrlenW (lpString=".docx") returned 5
	[0071.904] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.904] lstrlenW (lpString=".pdf") returned 4
	[0071.904] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.905] lstrlenW (lpString=".xls") returned 4
	[0071.905] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.905] lstrlenW (lpString=".xlsx") returned 5
	[0071.905] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.905] lstrlenW (lpString=".ppt") returned 4
	[0071.905] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.905] lstrlenW (lpString=".zip") returned 4
	[0071.905] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.905] lstrlenW (lpString=".rar") returned 4
	[0071.905] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.905] lstrlenW (lpString=".bz2") returned 4
	[0071.905] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.905] lstrlenW (lpString=".7z") returned 3
	[0071.906] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.906] lstrlenW (lpString=".dbf") returned 4
	[0071.906] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.906] lstrlenW (lpString=".1cd") returned 4
	[0071.906] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0071.906] lstrlenW (lpString=".jpg") returned 4
	[0071.906] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.906] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.906] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46
	[0071.906] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.907] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0071.907] CloseHandle (hObject=0x384) returned 1
	[0071.907] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20
	[0071.907] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.907] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.907] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.907] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.907] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0071.908] GetLastError () returned 0x0
	[0071.908] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.910] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.912] ReadFile (in: hFile=0x384, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.912] WriteFile (in: hFile=0x318, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x130, lpOverlapped=0x0) returned 1
	[0071.912] SetEndOfFile (hFile=0x318) returned 1
	[0071.912] CloseHandle (hObject=0x318) returned 1
	[0071.914] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.914] SetEndOfFile (hFile=0x384) returned 1
	[0072.367] CloseHandle (hObject=0x384) returned 1
	[0072.427] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.441] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1
	[0072.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.443] lstrlenW (lpString=".doc") returned 4
	[0072.443] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.443] lstrlenW (lpString=".docx") returned 5
	[0072.443] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.443] lstrlenW (lpString=".pdf") returned 4
	[0072.443] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.443] lstrlenW (lpString=".xls") returned 4
	[0072.443] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.443] lstrlenW (lpString=".xlsx") returned 5
	[0072.443] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.443] lstrlenW (lpString=".ppt") returned 4
	[0072.443] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.443] lstrlenW (lpString=".zip") returned 4
	[0072.443] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.443] lstrlenW (lpString=".rar") returned 4
	[0072.443] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.443] lstrlenW (lpString=".bz2") returned 4
	[0072.443] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.443] lstrlenW (lpString=".7z") returned 3
	[0072.443] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.444] lstrlenW (lpString=".dbf") returned 4
	[0072.444] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.444] lstrlenW (lpString=".1cd") returned 4
	[0072.444] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.444] lstrlenW (lpString=".jpg") returned 4
	[0072.444] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.444] lstrlenW (lpString=".doc") returned 4
	[0072.444] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.444] lstrlenW (lpString=".docx") returned 5
	[0072.444] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.444] lstrlenW (lpString=".pdf") returned 4
	[0072.444] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.444] lstrlenW (lpString=".xls") returned 4
	[0072.444] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.444] lstrlenW (lpString=".xlsx") returned 5
	[0072.444] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.444] lstrlenW (lpString=".ppt") returned 4
	[0072.444] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.444] lstrlenW (lpString=".zip") returned 4
	[0072.444] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.445] lstrlenW (lpString=".rar") returned 4
	[0072.445] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.445] lstrlenW (lpString=".bz2") returned 4
	[0072.445] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.445] lstrlenW (lpString=".7z") returned 3
	[0072.445] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.445] lstrlenW (lpString=".dbf") returned 4
	[0072.445] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.445] lstrlenW (lpString=".1cd") returned 4
	[0072.445] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0072.445] lstrlenW (lpString=".jpg") returned 4
	[0072.445] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.445] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.445] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41
	[0072.445] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.446] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0072.446] CloseHandle (hObject=0x37c) returned 1
	[0072.446] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20
	[0072.446] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.446] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.447] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.447] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.447] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.447] GetLastError () returned 0x0
	[0072.447] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.450] WriteFile (in: hFile=0x38c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.452] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.452] WriteFile (in: hFile=0x38c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x126, lpOverlapped=0x0) returned 1
	[0072.452] SetEndOfFile (hFile=0x38c) returned 1
	[0072.452] CloseHandle (hObject=0x38c) returned 1
	[0072.455] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.455] SetEndOfFile (hFile=0x37c) returned 1
	[0072.456] CloseHandle (hObject=0x37c) returned 1
	[0072.456] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.456] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1
	[0072.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.457] lstrlenW (lpString=".doc") returned 4
	[0072.457] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.457] lstrlenW (lpString=".docx") returned 5
	[0072.457] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.457] lstrlenW (lpString=".pdf") returned 4
	[0072.457] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.457] lstrlenW (lpString=".xls") returned 4
	[0072.457] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.457] lstrlenW (lpString=".xlsx") returned 5
	[0072.457] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.457] lstrlenW (lpString=".ppt") returned 4
	[0072.457] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.457] lstrlenW (lpString=".zip") returned 4
	[0072.457] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.458] lstrlenW (lpString=".rar") returned 4
	[0072.458] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.458] lstrlenW (lpString=".bz2") returned 4
	[0072.458] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.458] lstrlenW (lpString=".7z") returned 3
	[0072.458] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.458] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.458] lstrlenW (lpString=".dbf") returned 4
	[0072.458] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.458] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.458] lstrlenW (lpString=".1cd") returned 4
	[0072.458] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.458] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.458] lstrlenW (lpString=".jpg") returned 4
	[0072.458] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.458] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.458] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.458] lstrlenW (lpString=".doc") returned 4
	[0072.458] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.458] lstrlenW (lpString=".docx") returned 5
	[0072.458] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.458] lstrlenW (lpString=".pdf") returned 4
	[0072.458] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.458] lstrlenW (lpString=".xls") returned 4
	[0072.458] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.459] lstrlenW (lpString=".xlsx") returned 5
	[0072.459] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.459] lstrlenW (lpString=".ppt") returned 4
	[0072.459] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.459] lstrlenW (lpString=".zip") returned 4
	[0072.459] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.459] lstrlenW (lpString=".rar") returned 4
	[0072.459] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.459] lstrlenW (lpString=".bz2") returned 4
	[0072.459] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.459] lstrlenW (lpString=".7z") returned 3
	[0072.459] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.459] lstrlenW (lpString=".dbf") returned 4
	[0072.459] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.459] lstrlenW (lpString=".1cd") returned 4
	[0072.459] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0072.459] lstrlenW (lpString=".jpg") returned 4
	[0072.460] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.460] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.460] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49
	[0072.460] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.460] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0072.460] CloseHandle (hObject=0x37c) returned 1
	[0072.460] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20
	[0072.460] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.461] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.461] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.461] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.461] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.461] GetLastError () returned 0x0
	[0072.461] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.464] WriteFile (in: hFile=0x38c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.465] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.465] WriteFile (in: hFile=0x38c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x136, lpOverlapped=0x0) returned 1
	[0072.466] SetEndOfFile (hFile=0x38c) returned 1
	[0072.466] CloseHandle (hObject=0x38c) returned 1
	[0072.468] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.468] SetEndOfFile (hFile=0x37c) returned 1
	[0072.470] CloseHandle (hObject=0x37c) returned 1
	[0072.470] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.470] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1
	[0072.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.470] lstrlenW (lpString=".doc") returned 4
	[0072.470] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.470] lstrlenW (lpString=".docx") returned 5
	[0072.470] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.470] lstrlenW (lpString=".pdf") returned 4
	[0072.470] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.470] lstrlenW (lpString=".xls") returned 4
	[0072.471] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.471] lstrlenW (lpString=".xlsx") returned 5
	[0072.471] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.471] lstrlenW (lpString=".ppt") returned 4
	[0072.471] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.471] lstrlenW (lpString=".zip") returned 4
	[0072.471] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.471] lstrlenW (lpString=".rar") returned 4
	[0072.471] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.471] lstrlenW (lpString=".bz2") returned 4
	[0072.471] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.471] lstrlenW (lpString=".7z") returned 3
	[0072.471] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.471] lstrlenW (lpString=".dbf") returned 4
	[0072.471] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.471] lstrlenW (lpString=".1cd") returned 4
	[0072.471] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.471] lstrlenW (lpString=".jpg") returned 4
	[0072.471] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.471] lstrlenW (lpString=".doc") returned 4
	[0072.471] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.472] lstrlenW (lpString=".docx") returned 5
	[0072.472] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.472] lstrlenW (lpString=".pdf") returned 4
	[0072.472] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.472] lstrlenW (lpString=".xls") returned 4
	[0072.472] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.472] lstrlenW (lpString=".xlsx") returned 5
	[0072.472] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.472] lstrlenW (lpString=".ppt") returned 4
	[0072.472] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.472] lstrlenW (lpString=".zip") returned 4
	[0072.472] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.472] lstrlenW (lpString=".rar") returned 4
	[0072.472] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.472] lstrlenW (lpString=".bz2") returned 4
	[0072.472] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.472] lstrlenW (lpString=".7z") returned 3
	[0072.472] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.472] lstrlenW (lpString=".dbf") returned 4
	[0072.472] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.472] lstrlenW (lpString=".1cd") returned 4
	[0072.472] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0072.472] lstrlenW (lpString=".jpg") returned 4
	[0072.473] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.473] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.473] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66
	[0072.473] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.473] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0072.473] CloseHandle (hObject=0x37c) returned 1
	[0072.473] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20
	[0072.473] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.473] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.474] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.474] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.474] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.474] GetLastError () returned 0x0
	[0072.474] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.808] WriteFile (in: hFile=0x38c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.811] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.811] WriteFile (in: hFile=0x38c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x158, lpOverlapped=0x0) returned 1
	[0072.811] SetEndOfFile (hFile=0x38c) returned 1
	[0073.332] CloseHandle (hObject=0x38c) returned 1
	[0073.867] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.867] SetEndOfFile (hFile=0x37c) returned 1
	[0073.958] CloseHandle (hObject=0x37c) returned 1
	[0073.958] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0073.958] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1
	[0073.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.958] lstrlenW (lpString=".doc") returned 4
	[0073.958] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.958] lstrlenW (lpString=".docx") returned 5
	[0073.959] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.959] lstrlenW (lpString=".pdf") returned 4
	[0073.959] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.959] lstrlenW (lpString=".xls") returned 4
	[0073.959] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.959] lstrlenW (lpString=".xlsx") returned 5
	[0073.959] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.959] lstrlenW (lpString=".ppt") returned 4
	[0073.959] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.959] lstrlenW (lpString=".zip") returned 4
	[0073.959] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.959] lstrlenW (lpString=".rar") returned 4
	[0073.959] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.959] lstrlenW (lpString=".bz2") returned 4
	[0073.959] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.959] lstrlenW (lpString=".7z") returned 3
	[0073.959] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.959] lstrlenW (lpString=".dbf") returned 4
	[0073.959] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.959] lstrlenW (lpString=".1cd") returned 4
	[0073.959] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.960] lstrlenW (lpString=".jpg") returned 4
	[0073.960] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.960] lstrlenW (lpString=".doc") returned 4
	[0073.960] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.960] lstrlenW (lpString=".docx") returned 5
	[0073.960] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.960] lstrlenW (lpString=".pdf") returned 4
	[0073.960] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.960] lstrlenW (lpString=".xls") returned 4
	[0073.960] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.960] lstrlenW (lpString=".xlsx") returned 5
	[0073.960] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.960] lstrlenW (lpString=".ppt") returned 4
	[0073.960] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.960] lstrlenW (lpString=".zip") returned 4
	[0073.960] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.960] lstrlenW (lpString=".rar") returned 4
	[0073.960] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.960] lstrlenW (lpString=".bz2") returned 4
	[0073.960] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.960] lstrlenW (lpString=".7z") returned 3
	[0073.960] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.961] lstrlenW (lpString=".dbf") returned 4
	[0073.961] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.961] lstrlenW (lpString=".1cd") returned 4
	[0073.961] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0073.961] lstrlenW (lpString=".jpg") returned 4
	[0073.961] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.961] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0073.961] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57
	[0073.961] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.962] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0073.962] CloseHandle (hObject=0x37c) returned 1
	[0073.962] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20
	[0073.962] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.962] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.962] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.962] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.962] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0073.963] GetLastError () returned 0x0
	[0073.963] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.966] WriteFile (in: hFile=0x380, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.968] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.968] WriteFile (in: hFile=0x380, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x146, lpOverlapped=0x0) returned 1
	[0073.968] SetEndOfFile (hFile=0x380) returned 1
	[0073.968] CloseHandle (hObject=0x380) returned 1
	[0073.970] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.970] SetEndOfFile (hFile=0x37c) returned 1
	[0073.972] CloseHandle (hObject=0x37c) returned 1
	[0073.972] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0073.972] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1
	[0073.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.972] lstrlenW (lpString=".doc") returned 4
	[0073.972] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.972] lstrlenW (lpString=".docx") returned 5
	[0073.972] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.972] lstrlenW (lpString=".pdf") returned 4
	[0073.972] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.973] lstrlenW (lpString=".xls") returned 4
	[0073.973] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.973] lstrlenW (lpString=".xlsx") returned 5
	[0073.973] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.973] lstrlenW (lpString=".ppt") returned 4
	[0073.973] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.973] lstrlenW (lpString=".zip") returned 4
	[0073.973] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.973] lstrlenW (lpString=".rar") returned 4
	[0073.973] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.973] lstrlenW (lpString=".bz2") returned 4
	[0073.973] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.973] lstrlenW (lpString=".7z") returned 3
	[0073.973] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.973] lstrlenW (lpString=".dbf") returned 4
	[0073.973] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.973] lstrlenW (lpString=".1cd") returned 4
	[0073.973] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.974] lstrlenW (lpString=".jpg") returned 4
	[0073.974] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.974] lstrlenW (lpString=".doc") returned 4
	[0073.974] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.974] lstrlenW (lpString=".docx") returned 5
	[0073.974] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.974] lstrlenW (lpString=".pdf") returned 4
	[0073.974] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.974] lstrlenW (lpString=".xls") returned 4
	[0073.974] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.974] lstrlenW (lpString=".xlsx") returned 5
	[0073.974] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.974] lstrlenW (lpString=".ppt") returned 4
	[0073.974] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.974] lstrlenW (lpString=".zip") returned 4
	[0073.974] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.974] lstrlenW (lpString=".rar") returned 4
	[0073.974] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.974] lstrlenW (lpString=".bz2") returned 4
	[0073.974] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.974] lstrlenW (lpString=".7z") returned 3
	[0073.975] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.975] lstrlenW (lpString=".dbf") returned 4
	[0073.975] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.975] lstrlenW (lpString=".1cd") returned 4
	[0073.975] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0073.975] lstrlenW (lpString=".jpg") returned 4
	[0073.975] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.975] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0073.975] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44
	[0073.975] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.975] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=69632) returned 1
	[0073.975] CloseHandle (hObject=0x37c) returned 1
	[0073.975] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20
	[0073.976] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.976] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.976] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.976] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.976] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0073.976] GetLastError () returned 0x0
	[0073.976] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.984] WriteFile (in: hFile=0x380, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.986] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.987] WriteFile (in: hFile=0x380, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x12c, lpOverlapped=0x0) returned 1
	[0073.987] SetEndOfFile (hFile=0x380) returned 1
	[0073.987] CloseHandle (hObject=0x380) returned 1
	[0073.990] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.990] SetEndOfFile (hFile=0x37c) returned 1
	[0073.991] CloseHandle (hObject=0x37c) returned 1
	[0073.991] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0073.992] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1
	[0073.992] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.992] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.992] lstrlenW (lpString=".doc") returned 4
	[0073.992] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.992] lstrlenW (lpString=".docx") returned 5
	[0073.992] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.992] lstrlenW (lpString=".pdf") returned 4
	[0073.992] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.992] lstrlenW (lpString=".xls") returned 4
	[0073.992] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.992] lstrlenW (lpString=".xlsx") returned 5
	[0073.992] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.993] lstrlenW (lpString=".ppt") returned 4
	[0073.993] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.993] lstrlenW (lpString=".zip") returned 4
	[0073.993] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.993] lstrlenW (lpString=".rar") returned 4
	[0073.993] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.993] lstrlenW (lpString=".bz2") returned 4
	[0073.993] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.993] lstrlenW (lpString=".7z") returned 3
	[0073.993] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.993] lstrlenW (lpString=".dbf") returned 4
	[0073.993] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.993] lstrlenW (lpString=".1cd") returned 4
	[0073.993] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.993] lstrlenW (lpString=".jpg") returned 4
	[0073.993] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.993] lstrlenW (lpString=".doc") returned 4
	[0073.994] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.994] lstrlenW (lpString=".docx") returned 5
	[0073.994] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.994] lstrlenW (lpString=".pdf") returned 4
	[0073.994] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.994] lstrlenW (lpString=".xls") returned 4
	[0073.994] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.994] lstrlenW (lpString=".xlsx") returned 5
	[0073.994] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.994] lstrlenW (lpString=".ppt") returned 4
	[0073.994] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.994] lstrlenW (lpString=".zip") returned 4
	[0073.994] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.994] lstrlenW (lpString=".rar") returned 4
	[0073.994] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.994] lstrlenW (lpString=".bz2") returned 4
	[0073.994] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.994] lstrlenW (lpString=".7z") returned 3
	[0073.994] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.994] lstrlenW (lpString=".dbf") returned 4
	[0073.994] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.994] lstrlenW (lpString=".1cd") returned 4
	[0073.994] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0073.995] lstrlenW (lpString=".jpg") returned 4
	[0073.995] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.995] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0073.995] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48
	[0073.995] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.995] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=1052672) returned 1
	[0073.995] CloseHandle (hObject=0x37c) returned 1
	[0073.995] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20
	[0073.995] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.995] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.996] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.996] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.996] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0074.000] GetLastError () returned 0x0
	[0074.000] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0074.456] WriteFile (in: hFile=0x380, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0074.900] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x1010, lpOverlapped=0x0) returned 1
	[0074.909] WriteFile (in: hFile=0x380, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x1020, lpOverlapped=0x0) returned 1
	[0074.913] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.913] WriteFile (in: hFile=0x380, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x134, lpOverlapped=0x0) returned 1
	[0074.913] SetEndOfFile (hFile=0x380) returned 1
	[0074.913] CloseHandle (hObject=0x380) returned 1
	[0074.935] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.935] SetEndOfFile (hFile=0x37c) returned 1
	[0074.936] CloseHandle (hObject=0x37c) returned 1
	[0074.936] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0074.937] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1
	[0074.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.937] lstrlenW (lpString=".doc") returned 4
	[0074.937] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.937] lstrlenW (lpString=".docx") returned 5
	[0074.937] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.937] lstrlenW (lpString=".pdf") returned 4
	[0074.937] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.937] lstrlenW (lpString=".xls") returned 4
	[0074.937] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.937] lstrlenW (lpString=".xlsx") returned 5
	[0074.937] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.937] lstrlenW (lpString=".ppt") returned 4
	[0074.937] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.938] lstrlenW (lpString=".zip") returned 4
	[0074.938] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.938] lstrlenW (lpString=".rar") returned 4
	[0074.938] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.938] lstrlenW (lpString=".bz2") returned 4
	[0074.938] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.938] lstrlenW (lpString=".7z") returned 3
	[0074.938] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.938] lstrlenW (lpString=".dbf") returned 4
	[0074.938] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.938] lstrlenW (lpString=".1cd") returned 4
	[0074.938] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.938] lstrlenW (lpString=".jpg") returned 4
	[0074.938] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.938] lstrlenW (lpString=".doc") returned 4
	[0074.938] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.938] lstrlenW (lpString=".docx") returned 5
	[0074.938] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.938] lstrlenW (lpString=".pdf") returned 4
	[0074.938] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.938] lstrlenW (lpString=".xls") returned 4
	[0074.939] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString=".xlsx") returned 5
	[0074.939] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.939] lstrlenW (lpString=".ppt") returned 4
	[0074.939] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.939] lstrlenW (lpString=".zip") returned 4
	[0074.939] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString=".rar") returned 4
	[0074.939] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString=".bz2") returned 4
	[0074.939] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString=".7z") returned 3
	[0074.939] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.939] lstrlenW (lpString=".dbf") returned 4
	[0074.939] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.939] lstrlenW (lpString=".1cd") returned 4
	[0074.939] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0074.939] lstrlenW (lpString=".jpg") returned 4
	[0074.939] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.939] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0074.940] lstrlenW (lpString="guests production meanwhile.exe") returned 31
	[0074.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\guests production meanwhile.exe" (normalized: "c:\\program files\\common files\\guests production meanwhile.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0074.940] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=78336) returned 1
	[0074.940] CloseHandle (hObject=0x37c) returned 1
	[0074.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\guests production meanwhile.exe" (normalized: "c:\\program files\\common files\\guests production meanwhile.exe")) returned 0x20
	[0074.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\guests production meanwhile.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\guests production meanwhile.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\guests production meanwhile.exe" (normalized: "c:\\program files\\common files\\guests production meanwhile.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0074.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0074.940] lstrlenW (lpString=".doc") returned 4
	[0074.941] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0074.941] lstrlenW (lpString=".docx") returned 5
	[0074.941] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0074.941] lstrlenW (lpString=".pdf") returned 4
	[0074.941] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0074.941] lstrlenW (lpString=".xls") returned 4
	[0074.941] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0074.941] lstrlenW (lpString=".xlsx") returned 5
	[0074.941] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0074.941] lstrlenW (lpString=".ppt") returned 4
	[0074.941] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0074.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0074.941] lstrlenW (lpString=".zip") returned 4
	[0074.941] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0074.941] lstrlenW (lpString=".rar") returned 4
	[0074.941] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0074.941] lstrlenW (lpString=".bz2") returned 4
	[0074.941] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0074.941] lstrlenW (lpString=".7z") returned 3
	[0075.169] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0075.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0075.169] lstrlenW (lpString=".dbf") returned 4
	[0075.169] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0075.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0075.203] lstrlenW (lpString=".1cd") returned 4
	[0075.203] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0075.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0075.203] lstrlenW (lpString=".jpg") returned 4
	[0075.203] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0075.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0075.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0075.203] lstrlenW (lpString=".doc") returned 4
	[0075.203] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0075.203] lstrlenW (lpString=".docx") returned 5
	[0075.203] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0075.203] lstrlenW (lpString=".pdf") returned 4
	[0075.203] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0075.204] lstrlenW (lpString=".xls") returned 4
	[0075.204] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0075.204] lstrlenW (lpString=".xlsx") returned 5
	[0075.204] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0075.204] lstrlenW (lpString=".ppt") returned 4
	[0075.204] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0075.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0075.204] lstrlenW (lpString=".zip") returned 4
	[0075.204] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0075.204] lstrlenW (lpString=".rar") returned 4
	[0075.204] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0075.204] lstrlenW (lpString=".bz2") returned 4
	[0075.204] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0075.204] lstrlenW (lpString=".7z") returned 3
	[0075.204] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0075.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0075.204] lstrlenW (lpString=".dbf") returned 4
	[0075.204] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0075.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0075.204] lstrlenW (lpString=".1cd") returned 4
	[0075.204] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0075.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\guests production meanwhile.exe") returned 61
	[0075.204] lstrlenW (lpString=".jpg") returned 4
	[0075.204] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0075.204] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.205] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33
	[0075.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0075.208] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=11616) returned 1
	[0075.208] CloseHandle (hObject=0x318) returned 1
	[0075.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20
	[0075.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0075.208] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.208] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0075.208] GetLastError () returned 0x0
	[0075.209] ReadFile (in: hFile=0x318, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x2d60, lpOverlapped=0x0) returned 1
	[0075.210] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0075.211] ReadFile (in: hFile=0x318, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.211] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x116, lpOverlapped=0x0) returned 1
	[0075.211] SetEndOfFile (hFile=0x378) returned 1
	[0075.211] CloseHandle (hObject=0x378) returned 1
	[0075.212] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.212] SetEndOfFile (hFile=0x318) returned 1
	[0075.213] CloseHandle (hObject=0x318) returned 1
	[0075.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.213] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1
	[0075.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.214] lstrlenW (lpString=".doc") returned 4
	[0075.214] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.214] lstrlenW (lpString=".docx") returned 5
	[0075.214] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.214] lstrlenW (lpString=".pdf") returned 4
	[0075.214] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.214] lstrlenW (lpString=".xls") returned 4
	[0075.214] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.214] lstrlenW (lpString=".xlsx") returned 5
	[0075.214] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.214] lstrlenW (lpString=".ppt") returned 4
	[0075.214] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.214] lstrlenW (lpString=".zip") returned 4
	[0075.214] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.214] lstrlenW (lpString=".rar") returned 4
	[0075.214] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.214] lstrlenW (lpString=".bz2") returned 4
	[0075.214] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.214] lstrlenW (lpString=".7z") returned 3
	[0075.214] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.214] lstrlenW (lpString=".dbf") returned 4
	[0075.214] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.214] lstrlenW (lpString=".1cd") returned 4
	[0075.215] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.215] lstrlenW (lpString=".jpg") returned 4
	[0075.215] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.215] lstrlenW (lpString=".doc") returned 4
	[0075.215] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.215] lstrlenW (lpString=".docx") returned 5
	[0075.215] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.215] lstrlenW (lpString=".pdf") returned 4
	[0075.215] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.215] lstrlenW (lpString=".xls") returned 4
	[0075.215] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.215] lstrlenW (lpString=".xlsx") returned 5
	[0075.215] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.215] lstrlenW (lpString=".ppt") returned 4
	[0075.215] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.215] lstrlenW (lpString=".zip") returned 4
	[0075.215] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.215] lstrlenW (lpString=".rar") returned 4
	[0075.215] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.215] lstrlenW (lpString=".bz2") returned 4
	[0075.215] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.215] lstrlenW (lpString=".7z") returned 3
	[0075.215] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.215] lstrlenW (lpString=".dbf") returned 4
	[0075.216] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.216] lstrlenW (lpString=".1cd") returned 4
	[0075.216] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0075.216] lstrlenW (lpString=".jpg") returned 4
	[0075.216] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.216] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.216] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31
	[0075.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0075.216] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=19648) returned 1
	[0075.216] CloseHandle (hObject=0x318) returned 1
	[0075.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20
	[0075.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0075.217] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.217] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0075.217] GetLastError () returned 0x0
	[0075.217] ReadFile (in: hFile=0x318, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4cc0, lpOverlapped=0x0) returned 1
	[0075.219] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0075.220] ReadFile (in: hFile=0x318, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.220] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x112, lpOverlapped=0x0) returned 1
	[0075.220] SetEndOfFile (hFile=0x378) returned 1
	[0075.220] CloseHandle (hObject=0x378) returned 1
	[0075.221] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.221] SetEndOfFile (hFile=0x318) returned 1
	[0075.222] CloseHandle (hObject=0x318) returned 1
	[0075.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.222] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1
	[0075.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.223] lstrlenW (lpString=".doc") returned 4
	[0075.223] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.223] lstrlenW (lpString=".docx") returned 5
	[0075.223] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.223] lstrlenW (lpString=".pdf") returned 4
	[0075.223] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.223] lstrlenW (lpString=".xls") returned 4
	[0075.223] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.223] lstrlenW (lpString=".xlsx") returned 5
	[0075.223] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.223] lstrlenW (lpString=".ppt") returned 4
	[0075.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.223] lstrlenW (lpString=".zip") returned 4
	[0075.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.223] lstrlenW (lpString=".rar") returned 4
	[0075.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.223] lstrlenW (lpString=".bz2") returned 4
	[0075.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.224] lstrlenW (lpString=".7z") returned 3
	[0075.224] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.224] lstrlenW (lpString=".dbf") returned 4
	[0075.224] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.224] lstrlenW (lpString=".1cd") returned 4
	[0075.224] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.224] lstrlenW (lpString=".jpg") returned 4
	[0075.224] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.224] lstrlenW (lpString=".doc") returned 4
	[0075.224] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.224] lstrlenW (lpString=".docx") returned 5
	[0075.224] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.224] lstrlenW (lpString=".pdf") returned 4
	[0075.224] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.224] lstrlenW (lpString=".xls") returned 4
	[0075.224] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.224] lstrlenW (lpString=".xlsx") returned 5
	[0075.224] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.224] lstrlenW (lpString=".ppt") returned 4
	[0075.224] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.225] lstrlenW (lpString=".zip") returned 4
	[0075.225] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.225] lstrlenW (lpString=".rar") returned 4
	[0075.225] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.225] lstrlenW (lpString=".bz2") returned 4
	[0075.225] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.225] lstrlenW (lpString=".7z") returned 3
	[0075.225] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.225] lstrlenW (lpString=".dbf") returned 4
	[0075.225] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.225] lstrlenW (lpString=".1cd") returned 4
	[0075.225] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0075.225] lstrlenW (lpString=".jpg") returned 4
	[0075.225] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.225] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.225] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33
	[0075.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0075.226] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=22720) returned 1
	[0075.226] CloseHandle (hObject=0x318) returned 1
	[0075.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20
	[0075.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0075.226] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.226] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0075.226] GetLastError () returned 0x0
	[0075.226] ReadFile (in: hFile=0x318, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x58c0, lpOverlapped=0x0) returned 1
	[0075.228] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x58d0, lpOverlapped=0x0) returned 1
	[0075.229] ReadFile (in: hFile=0x318, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.229] WriteFile (in: hFile=0x378, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x116, lpOverlapped=0x0) returned 1
	[0075.230] SetEndOfFile (hFile=0x378) returned 1
	[0075.230] CloseHandle (hObject=0x378) returned 1
	[0075.231] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.231] SetEndOfFile (hFile=0x318) returned 1
	[0075.232] CloseHandle (hObject=0x318) returned 1
	[0075.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1
	[0075.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.233] lstrlenW (lpString=".doc") returned 4
	[0075.233] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.233] lstrlenW (lpString=".docx") returned 5
	[0075.233] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.233] lstrlenW (lpString=".pdf") returned 4
	[0075.233] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.233] lstrlenW (lpString=".xls") returned 4
	[0075.233] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.233] lstrlenW (lpString=".xlsx") returned 5
	[0075.233] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.233] lstrlenW (lpString=".ppt") returned 4
	[0075.233] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.233] lstrlenW (lpString=".zip") returned 4
	[0075.233] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.233] lstrlenW (lpString=".rar") returned 4
	[0075.233] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.234] lstrlenW (lpString=".bz2") returned 4
	[0075.234] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.234] lstrlenW (lpString=".7z") returned 3
	[0075.234] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.234] lstrlenW (lpString=".dbf") returned 4
	[0075.234] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.234] lstrlenW (lpString=".1cd") returned 4
	[0075.234] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.234] lstrlenW (lpString=".jpg") returned 4
	[0075.234] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.234] lstrlenW (lpString=".doc") returned 4
	[0075.234] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.234] lstrlenW (lpString=".docx") returned 5
	[0075.235] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.235] lstrlenW (lpString=".pdf") returned 4
	[0075.235] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.235] lstrlenW (lpString=".xls") returned 4
	[0075.235] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.235] lstrlenW (lpString=".xlsx") returned 5
	[0075.235] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.235] lstrlenW (lpString=".ppt") returned 4
	[0075.235] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.235] lstrlenW (lpString=".zip") returned 4
	[0075.235] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.235] lstrlenW (lpString=".rar") returned 4
	[0075.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.235] lstrlenW (lpString=".bz2") returned 4
	[0075.235] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.235] lstrlenW (lpString=".7z") returned 3
	[0075.235] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.236] lstrlenW (lpString=".dbf") returned 4
	[0075.236] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.236] lstrlenW (lpString=".1cd") returned 4
	[0075.236] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0075.236] lstrlenW (lpString=".jpg") returned 4
	[0075.236] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.236] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.236] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37
	[0075.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.629] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=19136) returned 1
	[0075.629] CloseHandle (hObject=0x37c) returned 1
	[0075.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20
	[0075.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.630] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.630] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0075.630] GetLastError () returned 0x0
	[0075.630] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0075.632] WriteFile (in: hFile=0x384, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0075.633] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.633] WriteFile (in: hFile=0x384, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0075.633] SetEndOfFile (hFile=0x384) returned 1
	[0075.634] CloseHandle (hObject=0x384) returned 1
	[0075.635] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.635] SetEndOfFile (hFile=0x37c) returned 1
	[0075.636] CloseHandle (hObject=0x37c) returned 1
	[0075.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.636] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1
	[0075.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.636] lstrlenW (lpString=".doc") returned 4
	[0075.636] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.637] lstrlenW (lpString=".docx") returned 5
	[0075.637] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.637] lstrlenW (lpString=".pdf") returned 4
	[0075.637] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.637] lstrlenW (lpString=".xls") returned 4
	[0075.637] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.637] lstrlenW (lpString=".xlsx") returned 5
	[0075.637] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.637] lstrlenW (lpString=".ppt") returned 4
	[0075.637] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.637] lstrlenW (lpString=".zip") returned 4
	[0075.637] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.637] lstrlenW (lpString=".rar") returned 4
	[0075.637] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.637] lstrlenW (lpString=".bz2") returned 4
	[0075.637] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.637] lstrlenW (lpString=".7z") returned 3
	[0075.637] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.637] lstrlenW (lpString=".dbf") returned 4
	[0075.637] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.637] lstrlenW (lpString=".1cd") returned 4
	[0075.637] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.637] lstrlenW (lpString=".jpg") returned 4
	[0075.637] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.638] lstrlenW (lpString=".doc") returned 4
	[0075.638] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.638] lstrlenW (lpString=".docx") returned 5
	[0075.638] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.638] lstrlenW (lpString=".pdf") returned 4
	[0075.638] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.638] lstrlenW (lpString=".xls") returned 4
	[0075.638] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.638] lstrlenW (lpString=".xlsx") returned 5
	[0075.638] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.638] lstrlenW (lpString=".ppt") returned 4
	[0075.638] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.638] lstrlenW (lpString=".zip") returned 4
	[0075.638] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.638] lstrlenW (lpString=".rar") returned 4
	[0075.638] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.638] lstrlenW (lpString=".bz2") returned 4
	[0075.638] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.638] lstrlenW (lpString=".7z") returned 3
	[0075.638] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.638] lstrlenW (lpString=".dbf") returned 4
	[0075.639] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.639] lstrlenW (lpString=".1cd") returned 4
	[0075.639] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0075.639] lstrlenW (lpString=".jpg") returned 4
	[0075.639] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.639] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.639] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33
	[0075.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.639] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=70848) returned 1
	[0075.639] CloseHandle (hObject=0x37c) returned 1
	[0075.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20
	[0075.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.640] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.640] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0075.640] GetLastError () returned 0x0
	[0075.640] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x114c0, lpOverlapped=0x0) returned 1
	[0075.643] WriteFile (in: hFile=0x384, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x114d0, lpOverlapped=0x0) returned 1
	[0075.645] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.645] WriteFile (in: hFile=0x384, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x116, lpOverlapped=0x0) returned 1
	[0075.645] SetEndOfFile (hFile=0x384) returned 1
	[0075.645] CloseHandle (hObject=0x384) returned 1
	[0075.647] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.647] SetEndOfFile (hFile=0x37c) returned 1
	[0075.649] CloseHandle (hObject=0x37c) returned 1
	[0075.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.649] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1
	[0075.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.649] lstrlenW (lpString=".doc") returned 4
	[0075.649] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.650] lstrlenW (lpString=".docx") returned 5
	[0075.650] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.650] lstrlenW (lpString=".pdf") returned 4
	[0075.650] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.650] lstrlenW (lpString=".xls") returned 4
	[0075.650] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.650] lstrlenW (lpString=".xlsx") returned 5
	[0075.650] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.650] lstrlenW (lpString=".ppt") returned 4
	[0075.650] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.650] lstrlenW (lpString=".zip") returned 4
	[0075.650] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.650] lstrlenW (lpString=".rar") returned 4
	[0075.650] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.650] lstrlenW (lpString=".bz2") returned 4
	[0075.650] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.650] lstrlenW (lpString=".7z") returned 3
	[0075.650] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.650] lstrlenW (lpString=".dbf") returned 4
	[0075.650] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.651] lstrlenW (lpString=".1cd") returned 4
	[0075.651] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.651] lstrlenW (lpString=".jpg") returned 4
	[0075.651] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.651] lstrlenW (lpString=".doc") returned 4
	[0075.651] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.651] lstrlenW (lpString=".docx") returned 5
	[0075.651] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.651] lstrlenW (lpString=".pdf") returned 4
	[0075.651] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.651] lstrlenW (lpString=".xls") returned 4
	[0075.651] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.651] lstrlenW (lpString=".xlsx") returned 5
	[0075.651] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.651] lstrlenW (lpString=".ppt") returned 4
	[0075.651] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.651] lstrlenW (lpString=".zip") returned 4
	[0075.651] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.652] lstrlenW (lpString=".rar") returned 4
	[0075.652] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.652] lstrlenW (lpString=".bz2") returned 4
	[0075.652] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.652] lstrlenW (lpString=".7z") returned 3
	[0075.652] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.652] lstrlenW (lpString=".dbf") returned 4
	[0075.652] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.652] lstrlenW (lpString=".1cd") returned 4
	[0075.652] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0075.652] lstrlenW (lpString=".jpg") returned 4
	[0075.652] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.652] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.653] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33
	[0075.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.653] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=19648) returned 1
	[0075.653] CloseHandle (hObject=0x37c) returned 1
	[0075.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20
	[0075.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.653] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.653] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0075.654] GetLastError () returned 0x0
	[0075.654] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4cc0, lpOverlapped=0x0) returned 1
	[0075.656] WriteFile (in: hFile=0x384, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0075.657] ReadFile (in: hFile=0x37c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.657] WriteFile (in: hFile=0x384, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x116, lpOverlapped=0x0) returned 1
	[0075.657] SetEndOfFile (hFile=0x384) returned 1
	[0075.657] CloseHandle (hObject=0x384) returned 1
	[0075.658] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.658] SetEndOfFile (hFile=0x37c) returned 1
	[0075.659] CloseHandle (hObject=0x37c) returned 1
	[0075.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.660] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1
	[0075.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.660] lstrlenW (lpString=".doc") returned 4
	[0075.660] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.661] lstrlenW (lpString=".docx") returned 5
	[0075.661] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.661] lstrlenW (lpString=".pdf") returned 4
	[0075.661] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.661] lstrlenW (lpString=".xls") returned 4
	[0075.661] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.661] lstrlenW (lpString=".xlsx") returned 5
	[0075.661] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.661] lstrlenW (lpString=".ppt") returned 4
	[0075.661] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.661] lstrlenW (lpString=".zip") returned 4
	[0075.661] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.661] lstrlenW (lpString=".rar") returned 4
	[0075.661] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.661] lstrlenW (lpString=".bz2") returned 4
	[0075.661] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.662] lstrlenW (lpString=".7z") returned 3
	[0075.662] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.662] lstrlenW (lpString=".dbf") returned 4
	[0075.662] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.957] lstrlenW (lpString=".1cd") returned 4
	[0075.957] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.957] lstrlenW (lpString=".jpg") returned 4
	[0075.957] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.957] lstrlenW (lpString=".doc") returned 4
	[0075.957] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.957] lstrlenW (lpString=".docx") returned 5
	[0075.957] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.958] lstrlenW (lpString=".pdf") returned 4
	[0075.958] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.958] lstrlenW (lpString=".xls") returned 4
	[0075.958] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.958] lstrlenW (lpString=".xlsx") returned 5
	[0075.958] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.958] lstrlenW (lpString=".ppt") returned 4
	[0075.958] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.958] lstrlenW (lpString=".zip") returned 4
	[0075.958] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.958] lstrlenW (lpString=".rar") returned 4
	[0075.958] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.958] lstrlenW (lpString=".bz2") returned 4
	[0075.958] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.958] lstrlenW (lpString=".7z") returned 3
	[0075.958] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.958] lstrlenW (lpString=".dbf") returned 4
	[0075.958] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.958] lstrlenW (lpString=".1cd") returned 4
	[0075.958] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0075.958] lstrlenW (lpString=".jpg") returned 4
	[0075.958] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.958] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0075.959] lstrlenW (lpString="appvcleaner.exe") returned 15
	[0075.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.959] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=2054872) returned 1
	[0075.959] CloseHandle (hObject=0x368) returned 1
	[0075.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20
	[0075.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[admin@stex777.com].money")) returned 1
	[0075.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.960] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc64 | out: lpNewFilePointer=0x0) returned 1
	[0075.960] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0075.960] ReadFile (in: hFile=0x368, lpBuffer=0x3fc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3fc0058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0075.964] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0075.964] ReadFile (in: hFile=0x368, lpBuffer=0x4000058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4000058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0075.967] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x39dfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0075.967] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0075.967] ReadFile (in: hFile=0x368, lpBuffer=0x4040058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4040058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0075.983] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.983] WriteFile (in: hFile=0x368, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x39dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfca8*=0xc010a, lpOverlapped=0x0) returned 1
	[0076.362] SetEndOfFile (hFile=0x368) returned 1
	[0076.362] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x4344008
	[0076.481] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0076.481] WriteFile (in: hFile=0x368, lpBuffer=0x4344008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4344008*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0076.488] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0076.488] WriteFile (in: hFile=0x368, lpBuffer=0x4344008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4344008*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0076.491] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0076.491] WriteFile (in: hFile=0x368, lpBuffer=0x4344008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4344008*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0076.493] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4344008 | out: hHeap=0x600000) returned 1
	[0076.495] CloseHandle (hObject=0x368) returned 1
	[0076.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0076.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.495] lstrlenW (lpString=".doc") returned 4
	[0076.495] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0076.496] lstrlenW (lpString=".docx") returned 5
	[0076.496] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0076.496] lstrlenW (lpString=".pdf") returned 4
	[0076.496] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0076.496] lstrlenW (lpString=".xls") returned 4
	[0076.496] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0076.496] lstrlenW (lpString=".xlsx") returned 5
	[0076.496] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0076.496] lstrlenW (lpString=".ppt") returned 4
	[0076.496] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0076.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.496] lstrlenW (lpString=".zip") returned 4
	[0076.496] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0076.496] lstrlenW (lpString=".rar") returned 4
	[0076.496] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0076.496] lstrlenW (lpString=".bz2") returned 4
	[0076.496] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0076.496] lstrlenW (lpString=".7z") returned 3
	[0076.496] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0076.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.496] lstrlenW (lpString=".dbf") returned 4
	[0076.496] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0076.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.496] lstrlenW (lpString=".1cd") returned 4
	[0076.496] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0076.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.496] lstrlenW (lpString=".jpg") returned 4
	[0076.496] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0076.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.497] lstrlenW (lpString=".doc") returned 4
	[0076.497] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0076.497] lstrlenW (lpString=".docx") returned 5
	[0076.497] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0076.497] lstrlenW (lpString=".pdf") returned 4
	[0076.497] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0076.497] lstrlenW (lpString=".xls") returned 4
	[0076.497] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0076.497] lstrlenW (lpString=".xlsx") returned 5
	[0076.497] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0076.497] lstrlenW (lpString=".ppt") returned 4
	[0076.497] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0076.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.497] lstrlenW (lpString=".zip") returned 4
	[0076.497] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0076.497] lstrlenW (lpString=".rar") returned 4
	[0076.497] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0076.497] lstrlenW (lpString=".bz2") returned 4
	[0076.497] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0076.497] lstrlenW (lpString=".7z") returned 3
	[0076.497] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0076.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.497] lstrlenW (lpString=".dbf") returned 4
	[0076.497] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0076.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.497] lstrlenW (lpString=".1cd") returned 4
	[0076.497] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0076.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0076.498] lstrlenW (lpString=".jpg") returned 4
	[0076.498] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0076.498] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0076.498] lstrlenW (lpString="AppVShNotify.exe") returned 16
	[0076.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0076.498] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=263896) returned 1
	[0076.498] CloseHandle (hObject=0x368) returned 1
	[0076.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20
	[0076.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0076.499] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.499] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0076.499] GetLastError () returned 0x0
	[0076.499] ReadFile (in: hFile=0x368, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x406d8, lpOverlapped=0x0) returned 1
	[0076.508] WriteFile (in: hFile=0x2d4, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x406e0, lpOverlapped=0x0) returned 1
	[0076.514] ReadFile (in: hFile=0x368, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.514] WriteFile (in: hFile=0x2d4, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf4, lpOverlapped=0x0) returned 1
	[0076.514] SetEndOfFile (hFile=0x2d4) returned 1
	[0076.514] CloseHandle (hObject=0x2d4) returned 1
	[0076.514] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.514] SetEndOfFile (hFile=0x368) returned 1
	[0076.517] CloseHandle (hObject=0x368) returned 1
	[0076.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0076.517] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1
	[0076.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.518] lstrlenW (lpString=".doc") returned 4
	[0076.518] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0076.518] lstrlenW (lpString=".docx") returned 5
	[0076.518] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0076.518] lstrlenW (lpString=".pdf") returned 4
	[0076.518] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0076.518] lstrlenW (lpString=".xls") returned 4
	[0076.518] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0076.518] lstrlenW (lpString=".xlsx") returned 5
	[0076.518] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0076.518] lstrlenW (lpString=".ppt") returned 4
	[0076.518] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0076.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.518] lstrlenW (lpString=".zip") returned 4
	[0076.518] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0076.518] lstrlenW (lpString=".rar") returned 4
	[0076.518] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0076.518] lstrlenW (lpString=".bz2") returned 4
	[0076.518] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0076.518] lstrlenW (lpString=".7z") returned 3
	[0076.518] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0076.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.518] lstrlenW (lpString=".dbf") returned 4
	[0076.518] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0076.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.518] lstrlenW (lpString=".1cd") returned 4
	[0076.518] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0076.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.519] lstrlenW (lpString=".jpg") returned 4
	[0076.519] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0076.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.519] lstrlenW (lpString=".doc") returned 4
	[0076.519] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0076.519] lstrlenW (lpString=".docx") returned 5
	[0076.519] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0076.519] lstrlenW (lpString=".pdf") returned 4
	[0076.519] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0076.519] lstrlenW (lpString=".xls") returned 4
	[0076.519] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0076.519] lstrlenW (lpString=".xlsx") returned 5
	[0076.519] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0076.519] lstrlenW (lpString=".ppt") returned 4
	[0076.519] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0076.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.519] lstrlenW (lpString=".zip") returned 4
	[0076.520] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0076.520] lstrlenW (lpString=".rar") returned 4
	[0076.520] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0076.520] lstrlenW (lpString=".bz2") returned 4
	[0076.520] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0076.520] lstrlenW (lpString=".7z") returned 3
	[0076.520] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0076.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.520] lstrlenW (lpString=".dbf") returned 4
	[0076.520] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0076.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.520] lstrlenW (lpString=".1cd") returned 4
	[0076.520] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0076.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0076.520] lstrlenW (lpString=".jpg") returned 4
	[0076.520] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0076.520] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.520] lstrlenW (lpString="C2R32.dll") returned 9
	[0076.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0076.521] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=820416) returned 1
	[0076.521] CloseHandle (hObject=0x368) returned 1
	[0076.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20
	[0076.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0076.521] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.521] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0076.522] GetLastError () returned 0x0
	[0076.522] ReadFile (in: hFile=0x368, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0xc84c0, lpOverlapped=0x0) returned 1
	[0076.540] WriteFile (in: hFile=0x2d4, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xc84d0, lpOverlapped=0x0) returned 1
	[0076.555] ReadFile (in: hFile=0x368, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.555] WriteFile (in: hFile=0x2d4, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xe6, lpOverlapped=0x0) returned 1
	[0076.556] SetEndOfFile (hFile=0x2d4) returned 1
	[0076.556] CloseHandle (hObject=0x2d4) returned 1
	[0076.556] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.556] SetEndOfFile (hFile=0x368) returned 1
	[0076.563] CloseHandle (hObject=0x368) returned 1
	[0076.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0076.563] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1
	[0076.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0076.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0076.564] lstrlenW (lpString=".doc") returned 4
	[0076.564] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.564] lstrlenW (lpString=".docx") returned 5
	[0076.564] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0076.564] lstrlenW (lpString=".pdf") returned 4
	[0076.564] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.564] lstrlenW (lpString=".xls") returned 4
	[0076.564] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.564] lstrlenW (lpString=".xlsx") returned 5
	[0076.564] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0076.564] lstrlenW (lpString=".ppt") returned 4
	[0076.564] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0076.564] lstrlenW (lpString=".zip") returned 4
	[0076.564] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.564] lstrlenW (lpString=".rar") returned 4
	[0076.564] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.564] lstrlenW (lpString=".bz2") returned 4
	[0076.564] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.564] lstrlenW (lpString=".7z") returned 3
	[0076.565] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0076.565] lstrlenW (lpString=".dbf") returned 4
	[0076.565] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0076.565] lstrlenW (lpString=".1cd") returned 4
	[0076.565] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0076.565] lstrlenW (lpString=".jpg") returned 4
	[0076.565] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0076.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0076.565] lstrlenW (lpString=".doc") returned 4
	[0076.565] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.565] lstrlenW (lpString=".docx") returned 5
	[0076.565] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0076.565] lstrlenW (lpString=".pdf") returned 4
	[0076.565] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.565] lstrlenW (lpString=".xls") returned 4
	[0076.565] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.565] lstrlenW (lpString=".xlsx") returned 5
	[0076.565] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0076.565] lstrlenW (lpString=".ppt") returned 4
	[0076.566] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0076.566] lstrlenW (lpString=".zip") returned 4
	[0076.566] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.566] lstrlenW (lpString=".rar") returned 4
	[0076.566] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.566] lstrlenW (lpString=".bz2") returned 4
	[0076.566] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.566] lstrlenW (lpString=".7z") returned 3
	[0076.566] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0076.566] lstrlenW (lpString=".dbf") returned 4
	[0076.566] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0076.566] lstrlenW (lpString=".1cd") returned 4
	[0076.566] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0077.152] lstrlenW (lpString=".jpg") returned 4
	[0077.152] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.152] lstrcmpiW (lpString1=".hash", lpString2=".money") returned -1
	[0077.152] lstrlenW (lpString="i641033.hash") returned 12
	[0077.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0077.153] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=102) returned 1
	[0077.153] CloseHandle (hObject=0x360) returned 1
	[0077.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20
	[0077.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0077.153] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.153] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0077.154] GetLastError () returned 0x0
	[0077.154] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x66, lpOverlapped=0x0) returned 1
	[0077.155] WriteFile (in: hFile=0x314, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x70, lpOverlapped=0x0) returned 1
	[0077.156] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.156] WriteFile (in: hFile=0x314, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0077.156] SetEndOfFile (hFile=0x314) returned 1
	[0077.156] CloseHandle (hObject=0x314) returned 1
	[0077.157] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.157] SetEndOfFile (hFile=0x360) returned 1
	[0077.157] CloseHandle (hObject=0x360) returned 1
	[0077.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.158] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1
	[0077.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.158] lstrlenW (lpString=".doc") returned 4
	[0077.158] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0077.158] lstrlenW (lpString=".docx") returned 5
	[0077.158] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0077.158] lstrlenW (lpString=".pdf") returned 4
	[0077.158] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0077.158] lstrlenW (lpString=".xls") returned 4
	[0077.158] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0077.158] lstrlenW (lpString=".xlsx") returned 5
	[0077.158] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0077.158] lstrlenW (lpString=".ppt") returned 4
	[0077.158] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0077.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.158] lstrlenW (lpString=".zip") returned 4
	[0077.159] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0077.159] lstrlenW (lpString=".rar") returned 4
	[0077.159] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0077.159] lstrlenW (lpString=".bz2") returned 4
	[0077.159] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0077.159] lstrlenW (lpString=".7z") returned 3
	[0077.159] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0077.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.159] lstrlenW (lpString=".dbf") returned 4
	[0077.159] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0077.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.159] lstrlenW (lpString=".1cd") returned 4
	[0077.159] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0077.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.159] lstrlenW (lpString=".jpg") returned 4
	[0077.159] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0077.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.159] lstrlenW (lpString=".doc") returned 4
	[0077.159] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0077.159] lstrlenW (lpString=".docx") returned 5
	[0077.159] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0077.159] lstrlenW (lpString=".pdf") returned 4
	[0077.159] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0077.159] lstrlenW (lpString=".xls") returned 4
	[0077.159] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0077.159] lstrlenW (lpString=".xlsx") returned 5
	[0077.160] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0077.160] lstrlenW (lpString=".ppt") returned 4
	[0077.160] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0077.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.160] lstrlenW (lpString=".zip") returned 4
	[0077.160] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0077.160] lstrlenW (lpString=".rar") returned 4
	[0077.160] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0077.160] lstrlenW (lpString=".bz2") returned 4
	[0077.160] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0077.160] lstrlenW (lpString=".7z") returned 3
	[0077.160] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0077.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.160] lstrlenW (lpString=".dbf") returned 4
	[0077.160] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0077.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.160] lstrlenW (lpString=".1cd") returned 4
	[0077.160] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0077.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0077.160] lstrlenW (lpString=".jpg") returned 4
	[0077.160] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0077.161] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0077.161] lstrlenW (lpString="IntegratedOffice.exe") returned 20
	[0077.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0077.161] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=1093248) returned 1
	[0077.161] CloseHandle (hObject=0x360) returned 1
	[0077.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20
	[0077.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0077.521] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.521] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0077.522] GetLastError () returned 0x0
	[0077.522] ReadFile (in: hFile=0x314, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0077.560] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0077.579] ReadFile (in: hFile=0x314, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0xae90, lpOverlapped=0x0) returned 1
	[0077.977] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xaea0, lpOverlapped=0x0) returned 1
	[0077.981] ReadFile (in: hFile=0x314, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.981] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xfc, lpOverlapped=0x0) returned 1
	[0077.981] SetEndOfFile (hFile=0x35c) returned 1
	[0077.981] CloseHandle (hObject=0x35c) returned 1
	[0077.982] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.982] SetEndOfFile (hFile=0x314) returned 1
	[0077.983] CloseHandle (hObject=0x314) returned 1
	[0077.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.983] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1
	[0077.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.983] lstrlenW (lpString=".doc") returned 4
	[0077.983] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0077.983] lstrlenW (lpString=".docx") returned 5
	[0077.983] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0077.983] lstrlenW (lpString=".pdf") returned 4
	[0077.983] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0077.983] lstrlenW (lpString=".xls") returned 4
	[0077.983] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0077.983] lstrlenW (lpString=".xlsx") returned 5
	[0077.983] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0077.984] lstrlenW (lpString=".ppt") returned 4
	[0077.984] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0077.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.984] lstrlenW (lpString=".zip") returned 4
	[0077.984] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0077.984] lstrlenW (lpString=".rar") returned 4
	[0077.984] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0077.984] lstrlenW (lpString=".bz2") returned 4
	[0077.984] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0077.984] lstrlenW (lpString=".7z") returned 3
	[0077.984] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0077.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.984] lstrlenW (lpString=".dbf") returned 4
	[0077.984] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0077.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.984] lstrlenW (lpString=".1cd") returned 4
	[0077.984] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0077.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.984] lstrlenW (lpString=".jpg") returned 4
	[0077.984] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0077.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.984] lstrlenW (lpString=".doc") returned 4
	[0077.984] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0077.984] lstrlenW (lpString=".docx") returned 5
	[0077.984] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0077.984] lstrlenW (lpString=".pdf") returned 4
	[0077.984] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0077.984] lstrlenW (lpString=".xls") returned 4
	[0077.984] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0077.985] lstrlenW (lpString=".xlsx") returned 5
	[0077.985] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0077.985] lstrlenW (lpString=".ppt") returned 4
	[0077.985] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0077.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.985] lstrlenW (lpString=".zip") returned 4
	[0077.985] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0077.985] lstrlenW (lpString=".rar") returned 4
	[0077.985] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0077.985] lstrlenW (lpString=".bz2") returned 4
	[0077.985] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0077.985] lstrlenW (lpString=".7z") returned 3
	[0077.985] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0077.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.985] lstrlenW (lpString=".dbf") returned 4
	[0077.985] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0077.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.985] lstrlenW (lpString=".1cd") returned 4
	[0077.985] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0077.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0077.985] lstrlenW (lpString=".jpg") returned 4
	[0077.985] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0077.985] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0077.985] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0077.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0077.986] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=10752) returned 1
	[0077.986] CloseHandle (hObject=0x314) returned 1
	[0077.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20
	[0077.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.987] lstrlenW (lpString=".doc") returned 4
	[0077.987] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.987] lstrlenW (lpString=".docx") returned 5
	[0077.987] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0077.987] lstrlenW (lpString=".pdf") returned 4
	[0077.987] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.987] lstrlenW (lpString=".xls") returned 4
	[0077.987] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.987] lstrlenW (lpString=".xlsx") returned 5
	[0077.987] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0077.987] lstrlenW (lpString=".ppt") returned 4
	[0077.987] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.987] lstrlenW (lpString=".zip") returned 4
	[0077.987] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.987] lstrlenW (lpString=".rar") returned 4
	[0077.987] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.987] lstrlenW (lpString=".bz2") returned 4
	[0077.987] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.987] lstrlenW (lpString=".7z") returned 3
	[0077.987] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.987] lstrlenW (lpString=".dbf") returned 4
	[0077.987] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.987] lstrlenW (lpString=".1cd") returned 4
	[0077.987] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.988] lstrlenW (lpString=".jpg") returned 4
	[0077.988] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.988] lstrlenW (lpString=".doc") returned 4
	[0077.988] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.988] lstrlenW (lpString=".docx") returned 5
	[0077.988] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0077.988] lstrlenW (lpString=".pdf") returned 4
	[0077.988] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.988] lstrlenW (lpString=".xls") returned 4
	[0077.988] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.988] lstrlenW (lpString=".xlsx") returned 5
	[0077.988] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0077.988] lstrlenW (lpString=".ppt") returned 4
	[0077.988] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.988] lstrlenW (lpString=".zip") returned 4
	[0077.988] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.988] lstrlenW (lpString=".rar") returned 4
	[0077.988] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.988] lstrlenW (lpString=".bz2") returned 4
	[0077.988] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.988] lstrlenW (lpString=".7z") returned 3
	[0077.988] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.988] lstrlenW (lpString=".dbf") returned 4
	[0077.988] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.989] lstrlenW (lpString=".1cd") returned 4
	[0077.989] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0077.989] lstrlenW (lpString=".jpg") returned 4
	[0077.989] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.989] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0077.989] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0077.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0077.989] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=9728) returned 1
	[0077.989] CloseHandle (hObject=0x314) returned 1
	[0077.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20
	[0077.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.990] lstrlenW (lpString=".doc") returned 4
	[0077.990] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.990] lstrlenW (lpString=".docx") returned 5
	[0077.990] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0077.990] lstrlenW (lpString=".pdf") returned 4
	[0077.990] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.990] lstrlenW (lpString=".xls") returned 4
	[0077.990] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.990] lstrlenW (lpString=".xlsx") returned 5
	[0077.990] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0077.990] lstrlenW (lpString=".ppt") returned 4
	[0077.990] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.990] lstrlenW (lpString=".zip") returned 4
	[0077.990] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.990] lstrlenW (lpString=".rar") returned 4
	[0077.990] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.990] lstrlenW (lpString=".bz2") returned 4
	[0077.990] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.990] lstrlenW (lpString=".7z") returned 3
	[0077.990] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.990] lstrlenW (lpString=".dbf") returned 4
	[0077.990] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.990] lstrlenW (lpString=".1cd") returned 4
	[0077.990] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.991] lstrlenW (lpString=".jpg") returned 4
	[0077.991] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.991] lstrlenW (lpString=".doc") returned 4
	[0077.991] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.991] lstrlenW (lpString=".docx") returned 5
	[0077.991] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0077.991] lstrlenW (lpString=".pdf") returned 4
	[0077.991] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.991] lstrlenW (lpString=".xls") returned 4
	[0077.991] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.991] lstrlenW (lpString=".xlsx") returned 5
	[0077.991] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0077.991] lstrlenW (lpString=".ppt") returned 4
	[0077.991] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.991] lstrlenW (lpString=".zip") returned 4
	[0077.991] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.991] lstrlenW (lpString=".rar") returned 4
	[0077.991] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.991] lstrlenW (lpString=".bz2") returned 4
	[0077.991] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.991] lstrlenW (lpString=".7z") returned 3
	[0077.991] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.991] lstrlenW (lpString=".dbf") returned 4
	[0077.991] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.992] lstrlenW (lpString=".1cd") returned 4
	[0077.992] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0077.992] lstrlenW (lpString=".jpg") returned 4
	[0077.992] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.992] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0077.992] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0077.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0077.993] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=10240) returned 1
	[0077.993] CloseHandle (hObject=0x314) returned 1
	[0077.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20
	[0077.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.993] lstrlenW (lpString=".doc") returned 4
	[0077.993] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.993] lstrlenW (lpString=".docx") returned 5
	[0077.993] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0077.993] lstrlenW (lpString=".pdf") returned 4
	[0077.993] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.993] lstrlenW (lpString=".xls") returned 4
	[0077.993] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.993] lstrlenW (lpString=".xlsx") returned 5
	[0077.993] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0077.993] lstrlenW (lpString=".ppt") returned 4
	[0077.993] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.993] lstrlenW (lpString=".zip") returned 4
	[0077.994] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.994] lstrlenW (lpString=".rar") returned 4
	[0077.994] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.994] lstrlenW (lpString=".bz2") returned 4
	[0077.994] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.994] lstrlenW (lpString=".7z") returned 3
	[0077.994] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.994] lstrlenW (lpString=".dbf") returned 4
	[0077.994] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.994] lstrlenW (lpString=".1cd") returned 4
	[0077.994] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.994] lstrlenW (lpString=".jpg") returned 4
	[0077.994] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.994] lstrlenW (lpString=".doc") returned 4
	[0077.994] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.994] lstrlenW (lpString=".docx") returned 5
	[0077.994] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0077.994] lstrlenW (lpString=".pdf") returned 4
	[0077.994] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.994] lstrlenW (lpString=".xls") returned 4
	[0077.994] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.994] lstrlenW (lpString=".xlsx") returned 5
	[0077.994] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0077.994] lstrlenW (lpString=".ppt") returned 4
	[0077.994] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.995] lstrlenW (lpString=".zip") returned 4
	[0077.995] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.995] lstrlenW (lpString=".rar") returned 4
	[0077.995] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.995] lstrlenW (lpString=".bz2") returned 4
	[0077.995] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.995] lstrlenW (lpString=".7z") returned 3
	[0077.995] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.995] lstrlenW (lpString=".dbf") returned 4
	[0077.995] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.995] lstrlenW (lpString=".1cd") returned 4
	[0077.995] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0077.995] lstrlenW (lpString=".jpg") returned 4
	[0077.995] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.995] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0077.995] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0077.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0077.995] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=10752) returned 1
	[0077.996] CloseHandle (hObject=0x314) returned 1
	[0077.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20
	[0077.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.996] lstrlenW (lpString=".doc") returned 4
	[0077.996] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.996] lstrlenW (lpString=".docx") returned 5
	[0077.996] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0077.996] lstrlenW (lpString=".pdf") returned 4
	[0077.996] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.996] lstrlenW (lpString=".xls") returned 4
	[0077.996] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.996] lstrlenW (lpString=".xlsx") returned 5
	[0077.996] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0077.996] lstrlenW (lpString=".ppt") returned 4
	[0077.996] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.996] lstrlenW (lpString=".zip") returned 4
	[0077.996] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.996] lstrlenW (lpString=".rar") returned 4
	[0077.996] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.996] lstrlenW (lpString=".bz2") returned 4
	[0077.997] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.997] lstrlenW (lpString=".7z") returned 3
	[0077.997] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.997] lstrlenW (lpString=".dbf") returned 4
	[0077.997] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.997] lstrlenW (lpString=".1cd") returned 4
	[0077.997] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.997] lstrlenW (lpString=".jpg") returned 4
	[0077.997] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.997] lstrlenW (lpString=".doc") returned 4
	[0077.997] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.997] lstrlenW (lpString=".docx") returned 5
	[0077.997] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0077.997] lstrlenW (lpString=".pdf") returned 4
	[0077.997] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.997] lstrlenW (lpString=".xls") returned 4
	[0077.997] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.997] lstrlenW (lpString=".xlsx") returned 5
	[0077.997] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0077.997] lstrlenW (lpString=".ppt") returned 4
	[0077.997] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.997] lstrlenW (lpString=".zip") returned 4
	[0077.997] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.997] lstrlenW (lpString=".rar") returned 4
	[0077.998] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.998] lstrlenW (lpString=".bz2") returned 4
	[0077.998] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.998] lstrlenW (lpString=".7z") returned 3
	[0077.998] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.998] lstrlenW (lpString=".dbf") returned 4
	[0077.998] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.998] lstrlenW (lpString=".1cd") returned 4
	[0077.998] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0077.998] lstrlenW (lpString=".jpg") returned 4
	[0077.998] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.998] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0077.998] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0077.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0077.998] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=10752) returned 1
	[0077.998] CloseHandle (hObject=0x314) returned 1
	[0077.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20
	[0077.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0077.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0077.999] lstrlenW (lpString=".doc") returned 4
	[0077.999] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.999] lstrlenW (lpString=".docx") returned 5
	[0077.999] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0077.999] lstrlenW (lpString=".pdf") returned 4
	[0077.999] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.999] lstrlenW (lpString=".xls") returned 4
	[0077.999] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.999] lstrlenW (lpString=".xlsx") returned 5
	[0077.999] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0077.999] lstrlenW (lpString=".ppt") returned 4
	[0077.999] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0077.999] lstrlenW (lpString=".zip") returned 4
	[0077.999] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.999] lstrlenW (lpString=".rar") returned 4
	[0077.999] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.999] lstrlenW (lpString=".bz2") returned 4
	[0077.999] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.999] lstrlenW (lpString=".7z") returned 3
	[0077.999] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0077.999] lstrlenW (lpString=".dbf") returned 4
	[0078.000] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0078.000] lstrlenW (lpString=".1cd") returned 4
	[0078.000] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0078.000] lstrlenW (lpString=".jpg") returned 4
	[0078.000] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0078.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0078.000] lstrlenW (lpString=".doc") returned 4
	[0078.000] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.000] lstrlenW (lpString=".docx") returned 5
	[0078.000] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.000] lstrlenW (lpString=".pdf") returned 4
	[0078.000] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.000] lstrlenW (lpString=".xls") returned 4
	[0078.000] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.000] lstrlenW (lpString=".xlsx") returned 5
	[0078.000] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.000] lstrlenW (lpString=".ppt") returned 4
	[0078.000] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0078.000] lstrlenW (lpString=".zip") returned 4
	[0078.000] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.000] lstrlenW (lpString=".rar") returned 4
	[0078.000] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.000] lstrlenW (lpString=".bz2") returned 4
	[0078.000] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.001] lstrlenW (lpString=".7z") returned 3
	[0078.001] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0078.001] lstrlenW (lpString=".dbf") returned 4
	[0078.001] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0078.001] lstrlenW (lpString=".1cd") returned 4
	[0078.001] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0078.001] lstrlenW (lpString=".jpg") returned 4
	[0078.001] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.001] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.001] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0078.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0078.002] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=9728) returned 1
	[0078.002] CloseHandle (hObject=0x314) returned 1
	[0078.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20
	[0078.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0078.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0078.002] lstrlenW (lpString=".doc") returned 4
	[0078.002] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.002] lstrlenW (lpString=".docx") returned 5
	[0078.002] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.002] lstrlenW (lpString=".pdf") returned 4
	[0078.002] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.002] lstrlenW (lpString=".xls") returned 4
	[0078.002] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.002] lstrlenW (lpString=".xlsx") returned 5
	[0078.003] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.003] lstrlenW (lpString=".ppt") returned 4
	[0078.003] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0078.003] lstrlenW (lpString=".zip") returned 4
	[0078.003] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.003] lstrlenW (lpString=".rar") returned 4
	[0078.003] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.003] lstrlenW (lpString=".bz2") returned 4
	[0078.003] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.003] lstrlenW (lpString=".7z") returned 3
	[0078.003] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0078.003] lstrlenW (lpString=".dbf") returned 4
	[0078.003] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0078.624] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.624] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0078.625] GetLastError () returned 0x0
	[0078.625] ReadFile (in: hFile=0x380, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x58cd0, lpOverlapped=0x0) returned 1
	[0078.715] WriteFile (in: hFile=0x38c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x58ce0, lpOverlapped=0x0) returned 1
	[0078.722] ReadFile (in: hFile=0x380, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.722] WriteFile (in: hFile=0x38c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xe8, lpOverlapped=0x0) returned 1
	[0078.722] SetEndOfFile (hFile=0x38c) returned 1
	[0078.722] CloseHandle (hObject=0x38c) returned 1
	[0078.723] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.723] SetEndOfFile (hFile=0x380) returned 1
	[0078.726] CloseHandle (hObject=0x380) returned 1
	[0078.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0078.726] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1
	[0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.727] lstrlenW (lpString=".doc") returned 4
	[0078.727] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0078.727] lstrlenW (lpString=".docx") returned 5
	[0078.727] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1
	[0078.727] lstrlenW (lpString=".pdf") returned 4
	[0078.727] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0078.727] lstrlenW (lpString=".xls") returned 4
	[0078.727] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0078.727] lstrlenW (lpString=".xlsx") returned 5
	[0078.727] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1
	[0078.727] lstrlenW (lpString=".ppt") returned 4
	[0078.727] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.727] lstrlenW (lpString=".zip") returned 4
	[0078.727] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0078.727] lstrlenW (lpString=".rar") returned 4
	[0078.728] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0078.728] lstrlenW (lpString=".bz2") returned 4
	[0078.728] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0078.728] lstrlenW (lpString=".7z") returned 3
	[0078.728] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0078.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.728] lstrlenW (lpString=".dbf") returned 4
	[0078.728] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0078.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.728] lstrlenW (lpString=".1cd") returned 4
	[0078.728] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0078.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.728] lstrlenW (lpString=".jpg") returned 4
	[0078.728] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0078.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.728] lstrlenW (lpString=".doc") returned 4
	[0078.728] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0078.728] lstrlenW (lpString=".docx") returned 5
	[0078.728] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1
	[0078.728] lstrlenW (lpString=".pdf") returned 4
	[0078.728] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0078.728] lstrlenW (lpString=".xls") returned 4
	[0078.728] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0078.728] lstrlenW (lpString=".xlsx") returned 5
	[0078.728] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1
	[0078.728] lstrlenW (lpString=".ppt") returned 4
	[0078.728] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0078.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.729] lstrlenW (lpString=".zip") returned 4
	[0078.729] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0078.729] lstrlenW (lpString=".rar") returned 4
	[0078.729] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0078.729] lstrlenW (lpString=".bz2") returned 4
	[0078.729] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0078.729] lstrlenW (lpString=".7z") returned 3
	[0078.729] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0078.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.729] lstrlenW (lpString=".dbf") returned 4
	[0078.729] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0078.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.729] lstrlenW (lpString=".1cd") returned 4
	[0078.729] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0078.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0078.729] lstrlenW (lpString=".jpg") returned 4
	[0078.729] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0078.729] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0078.729] lstrlenW (lpString="pidgenx.dll") returned 11
	[0078.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.731] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=1475160) returned 1
	[0078.731] CloseHandle (hObject=0x380) returned 1
	[0078.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20
	[0078.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.731] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.731] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0078.732] GetLastError () returned 0x0
	[0078.732] ReadFile (in: hFile=0x380, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0079.627] WriteFile (in: hFile=0x38c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0079.867] ReadFile (in: hFile=0x380, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x68268, lpOverlapped=0x0) returned 1
	[0080.481] WriteFile (in: hFile=0x38c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x68270, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x68270, lpOverlapped=0x0) returned 1
	[0080.493] ReadFile (in: hFile=0x380, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.493] WriteFile (in: hFile=0x38c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xea, lpOverlapped=0x0) returned 1
	[0080.493] SetEndOfFile (hFile=0x38c) returned 1
	[0080.494] CloseHandle (hObject=0x38c) returned 1
	[0080.494] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.494] SetEndOfFile (hFile=0x380) returned 1
	[0080.501] CloseHandle (hObject=0x380) returned 1
	[0080.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0080.501] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1
	[0080.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.502] lstrlenW (lpString=".doc") returned 4
	[0080.502] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.502] lstrlenW (lpString=".docx") returned 5
	[0080.502] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0080.502] lstrlenW (lpString=".pdf") returned 4
	[0080.502] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.502] lstrlenW (lpString=".xls") returned 4
	[0080.502] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.502] lstrlenW (lpString=".xlsx") returned 5
	[0080.502] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0080.502] lstrlenW (lpString=".ppt") returned 4
	[0080.502] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.502] lstrlenW (lpString=".zip") returned 4
	[0080.502] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.502] lstrlenW (lpString=".rar") returned 4
	[0080.502] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.502] lstrlenW (lpString=".bz2") returned 4
	[0080.502] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.503] lstrlenW (lpString=".7z") returned 3
	[0080.503] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.503] lstrlenW (lpString=".dbf") returned 4
	[0080.503] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.503] lstrlenW (lpString=".1cd") returned 4
	[0080.503] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.503] lstrlenW (lpString=".jpg") returned 4
	[0080.503] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.503] lstrlenW (lpString=".doc") returned 4
	[0080.503] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.503] lstrlenW (lpString=".docx") returned 5
	[0080.503] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0080.503] lstrlenW (lpString=".pdf") returned 4
	[0080.503] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.503] lstrlenW (lpString=".xls") returned 4
	[0080.503] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.503] lstrlenW (lpString=".xlsx") returned 5
	[0080.504] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0080.504] lstrlenW (lpString=".ppt") returned 4
	[0080.504] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.504] lstrlenW (lpString=".zip") returned 4
	[0080.504] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.504] lstrlenW (lpString=".rar") returned 4
	[0080.504] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.504] lstrlenW (lpString=".bz2") returned 4
	[0080.511] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.511] lstrlenW (lpString=".7z") returned 3
	[0080.511] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.511] lstrlenW (lpString=".dbf") returned 4
	[0080.511] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.511] lstrlenW (lpString=".1cd") returned 4
	[0080.511] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0080.511] lstrlenW (lpString=".jpg") returned 4
	[0080.511] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.511] lstrcmpiW (lpString1=".tlb", lpString2=".money") returned 1
	[0080.511] lstrlenW (lpString="vstoee100.tlb") returned 13
	[0080.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0080.579] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=17048) returned 1
	[0080.579] CloseHandle (hObject=0x360) returned 1
	[0080.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20
	[0080.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0080.579] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.579] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0081.069] GetLastError () returned 0x0
	[0081.069] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4298, lpOverlapped=0x0) returned 1
	[0081.071] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x42a0, lpOverlapped=0x0) returned 1
	[0081.072] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.072] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xee, lpOverlapped=0x0) returned 1
	[0081.072] SetEndOfFile (hFile=0x35c) returned 1
	[0081.073] CloseHandle (hObject=0x35c) returned 1
	[0081.073] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.073] SetEndOfFile (hFile=0x360) returned 1
	[0081.074] CloseHandle (hObject=0x360) returned 1
	[0081.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.074] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1
	[0081.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.074] lstrlenW (lpString=".doc") returned 4
	[0081.074] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0081.074] lstrlenW (lpString=".docx") returned 5
	[0081.075] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0081.075] lstrlenW (lpString=".pdf") returned 4
	[0081.075] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0081.075] lstrlenW (lpString=".xls") returned 4
	[0081.075] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0081.075] lstrlenW (lpString=".xlsx") returned 5
	[0081.075] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0081.075] lstrlenW (lpString=".ppt") returned 4
	[0081.075] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0081.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.075] lstrlenW (lpString=".zip") returned 4
	[0081.075] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0081.075] lstrlenW (lpString=".rar") returned 4
	[0081.075] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0081.075] lstrlenW (lpString=".bz2") returned 4
	[0081.075] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0081.075] lstrlenW (lpString=".7z") returned 3
	[0081.075] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0081.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.075] lstrlenW (lpString=".dbf") returned 4
	[0081.075] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0081.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.075] lstrlenW (lpString=".1cd") returned 4
	[0081.075] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0081.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.075] lstrlenW (lpString=".jpg") returned 4
	[0081.076] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0081.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.076] lstrlenW (lpString=".doc") returned 4
	[0081.076] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0081.076] lstrlenW (lpString=".docx") returned 5
	[0081.076] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0081.076] lstrlenW (lpString=".pdf") returned 4
	[0081.076] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0081.076] lstrlenW (lpString=".xls") returned 4
	[0081.076] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0081.076] lstrlenW (lpString=".xlsx") returned 5
	[0081.076] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0081.076] lstrlenW (lpString=".ppt") returned 4
	[0081.076] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0081.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.076] lstrlenW (lpString=".zip") returned 4
	[0081.076] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0081.076] lstrlenW (lpString=".rar") returned 4
	[0081.076] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0081.076] lstrlenW (lpString=".bz2") returned 4
	[0081.076] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0081.076] lstrlenW (lpString=".7z") returned 3
	[0081.077] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0081.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.077] lstrlenW (lpString=".dbf") returned 4
	[0081.077] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0081.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.077] lstrlenW (lpString=".1cd") returned 4
	[0081.077] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0081.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0081.077] lstrlenW (lpString=".jpg") returned 4
	[0081.077] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0081.077] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0081.077] lstrlenW (lpString="deployJava1.dll") returned 15
	[0081.077] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0081.078] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=1026112) returned 1
	[0081.078] CloseHandle (hObject=0x360) returned 1
	[0081.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20
	[0081.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.078] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0081.078] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.078] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.078] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0081.086] GetLastError () returned 0x0
	[0081.086] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0xfa840, lpOverlapped=0x0) returned 1
	[0081.124] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xfa850, lpOverlapped=0x0) returned 1
	[0081.471] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.471] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf2, lpOverlapped=0x0) returned 1
	[0081.471] SetEndOfFile (hFile=0x35c) returned 1
	[0081.989] CloseHandle (hObject=0x35c) returned 1
	[0081.989] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.989] SetEndOfFile (hFile=0x360) returned 1
	[0081.997] CloseHandle (hObject=0x360) returned 1
	[0081.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.997] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1
	[0081.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0081.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0081.998] lstrlenW (lpString=".doc") returned 4
	[0081.998] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.998] lstrlenW (lpString=".docx") returned 5
	[0081.998] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0081.998] lstrlenW (lpString=".pdf") returned 4
	[0081.998] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.998] lstrlenW (lpString=".xls") returned 4
	[0081.998] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.998] lstrlenW (lpString=".xlsx") returned 5
	[0081.998] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0081.998] lstrlenW (lpString=".ppt") returned 4
	[0081.998] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0081.998] lstrlenW (lpString=".zip") returned 4
	[0081.998] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.998] lstrlenW (lpString=".rar") returned 4
	[0081.998] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.998] lstrlenW (lpString=".bz2") returned 4
	[0081.998] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.998] lstrlenW (lpString=".7z") returned 3
	[0081.998] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0081.998] lstrlenW (lpString=".dbf") returned 4
	[0081.998] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0081.999] lstrlenW (lpString=".1cd") returned 4
	[0081.999] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0081.999] lstrlenW (lpString=".jpg") returned 4
	[0081.999] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0081.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0081.999] lstrlenW (lpString=".doc") returned 4
	[0081.999] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.999] lstrlenW (lpString=".docx") returned 5
	[0081.999] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0081.999] lstrlenW (lpString=".pdf") returned 4
	[0081.999] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.999] lstrlenW (lpString=".xls") returned 4
	[0081.999] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.999] lstrlenW (lpString=".xlsx") returned 5
	[0081.999] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0081.999] lstrlenW (lpString=".ppt") returned 4
	[0081.999] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0081.999] lstrlenW (lpString=".zip") returned 4
	[0081.999] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.999] lstrlenW (lpString=".rar") returned 4
	[0081.999] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.999] lstrlenW (lpString=".bz2") returned 4
	[0081.999] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.999] lstrlenW (lpString=".7z") returned 3
	[0081.999] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0082.000] lstrlenW (lpString=".dbf") returned 4
	[0082.000] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0082.000] lstrlenW (lpString=".1cd") returned 4
	[0082.000] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0082.000] lstrlenW (lpString=".jpg") returned 4
	[0082.000] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.000] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0082.000] lstrlenW (lpString="gstreamer-lite.dll") returned 18
	[0082.000] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0082.001] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=619584) returned 1
	[0082.001] CloseHandle (hObject=0x360) returned 1
	[0082.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20
	[0082.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0082.001] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.001] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0082.002] GetLastError () returned 0x0
	[0082.002] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x97440, lpOverlapped=0x0) returned 1
	[0082.014] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x97450, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x97450, lpOverlapped=0x0) returned 1
	[0082.443] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.443] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0082.444] SetEndOfFile (hFile=0x35c) returned 1
	[0082.444] CloseHandle (hObject=0x35c) returned 1
	[0082.444] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.444] SetEndOfFile (hFile=0x360) returned 1
	[0082.449] CloseHandle (hObject=0x360) returned 1
	[0082.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.450] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 1
	[0082.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.450] lstrlenW (lpString=".doc") returned 4
	[0082.450] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.450] lstrlenW (lpString=".docx") returned 5
	[0082.450] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0082.450] lstrlenW (lpString=".pdf") returned 4
	[0082.450] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.450] lstrlenW (lpString=".xls") returned 4
	[0082.450] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.450] lstrlenW (lpString=".xlsx") returned 5
	[0082.450] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0082.450] lstrlenW (lpString=".ppt") returned 4
	[0082.450] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.450] lstrlenW (lpString=".zip") returned 4
	[0082.451] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.451] lstrlenW (lpString=".rar") returned 4
	[0082.451] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.451] lstrlenW (lpString=".bz2") returned 4
	[0082.451] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.451] lstrlenW (lpString=".7z") returned 3
	[0082.451] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.451] lstrlenW (lpString=".dbf") returned 4
	[0082.451] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.451] lstrlenW (lpString=".1cd") returned 4
	[0082.451] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.451] lstrlenW (lpString=".jpg") returned 4
	[0082.451] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.451] lstrlenW (lpString=".doc") returned 4
	[0082.451] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.451] lstrlenW (lpString=".docx") returned 5
	[0082.451] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0082.451] lstrlenW (lpString=".pdf") returned 4
	[0082.451] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.451] lstrlenW (lpString=".xls") returned 4
	[0082.451] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.451] lstrlenW (lpString=".xlsx") returned 5
	[0082.451] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0082.451] lstrlenW (lpString=".ppt") returned 4
	[0082.452] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.452] lstrlenW (lpString=".zip") returned 4
	[0082.452] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.452] lstrlenW (lpString=".rar") returned 4
	[0082.452] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.452] lstrlenW (lpString=".bz2") returned 4
	[0082.452] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.452] lstrlenW (lpString=".7z") returned 3
	[0082.452] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.452] lstrlenW (lpString=".dbf") returned 4
	[0082.452] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.452] lstrlenW (lpString=".1cd") returned 4
	[0082.452] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0082.452] lstrlenW (lpString=".jpg") returned 4
	[0082.452] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.452] lstrcmpiW (lpString1=".cpl", lpString2=".money") returned -1
	[0082.452] lstrlenW (lpString="javacpl.cpl") returned 11
	[0082.452] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0082.453] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=187392) returned 1
	[0082.453] CloseHandle (hObject=0x360) returned 1
	[0082.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20
	[0082.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.453] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0082.453] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.453] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.453] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0082.454] GetLastError () returned 0x0
	[0082.454] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x2dc00, lpOverlapped=0x0) returned 1
	[0082.459] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x2dc10, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x2dc10, lpOverlapped=0x0) returned 1
	[0082.462] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.462] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xea, lpOverlapped=0x0) returned 1
	[0082.462] SetEndOfFile (hFile=0x35c) returned 1
	[0082.462] CloseHandle (hObject=0x35c) returned 1
	[0082.462] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.462] SetEndOfFile (hFile=0x360) returned 1
	[0082.464] CloseHandle (hObject=0x360) returned 1
	[0082.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.464] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 1
	[0082.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.464] lstrlenW (lpString=".doc") returned 4
	[0082.465] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1
	[0082.465] lstrlenW (lpString=".docx") returned 5
	[0082.465] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1
	[0082.465] lstrlenW (lpString=".pdf") returned 4
	[0082.465] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1
	[0082.465] lstrlenW (lpString=".xls") returned 4
	[0082.465] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1
	[0082.465] lstrlenW (lpString=".xlsx") returned 5
	[0082.465] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1
	[0082.465] lstrlenW (lpString=".ppt") returned 4
	[0082.465] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1
	[0082.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.465] lstrlenW (lpString=".zip") returned 4
	[0082.465] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1
	[0082.465] lstrlenW (lpString=".rar") returned 4
	[0082.465] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1
	[0082.465] lstrlenW (lpString=".bz2") returned 4
	[0082.465] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1
	[0082.465] lstrlenW (lpString=".7z") returned 3
	[0082.465] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1
	[0082.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.465] lstrlenW (lpString=".dbf") returned 4
	[0082.465] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1
	[0082.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.465] lstrlenW (lpString=".1cd") returned 4
	[0082.465] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1
	[0082.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.465] lstrlenW (lpString=".jpg") returned 4
	[0082.465] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1
	[0082.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.466] lstrlenW (lpString=".doc") returned 4
	[0082.466] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1
	[0082.466] lstrlenW (lpString=".docx") returned 5
	[0082.466] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1
	[0082.466] lstrlenW (lpString=".pdf") returned 4
	[0082.466] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1
	[0082.466] lstrlenW (lpString=".xls") returned 4
	[0082.466] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1
	[0082.466] lstrlenW (lpString=".xlsx") returned 5
	[0082.466] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1
	[0082.466] lstrlenW (lpString=".ppt") returned 4
	[0082.466] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1
	[0082.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.466] lstrlenW (lpString=".zip") returned 4
	[0082.466] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1
	[0082.466] lstrlenW (lpString=".rar") returned 4
	[0082.466] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1
	[0082.466] lstrlenW (lpString=".bz2") returned 4
	[0082.466] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1
	[0082.466] lstrlenW (lpString=".7z") returned 3
	[0082.466] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1
	[0082.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.466] lstrlenW (lpString=".dbf") returned 4
	[0082.466] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1
	[0082.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.466] lstrlenW (lpString=".1cd") returned 4
	[0082.466] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1
	[0082.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0082.466] lstrlenW (lpString=".jpg") returned 4
	[0082.467] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1
	[0082.467] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0082.467] lstrlenW (lpString="javacpl.exe") returned 11
	[0082.467] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0082.467] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=80448) returned 1
	[0082.467] CloseHandle (hObject=0x360) returned 1
	[0082.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20
	[0082.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.467] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0082.467] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.467] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.468] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0082.468] GetLastError () returned 0x0
	[0082.468] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x13a40, lpOverlapped=0x0) returned 1
	[0082.470] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x13a50, lpOverlapped=0x0) returned 1
	[0082.472] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.472] WriteFile (in: hFile=0x35c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xea, lpOverlapped=0x0) returned 1
	[0082.472] SetEndOfFile (hFile=0x35c) returned 1
	[0082.473] CloseHandle (hObject=0x35c) returned 1
	[0082.473] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.730] SetEndOfFile (hFile=0x360) returned 1
	[0083.140] CloseHandle (hObject=0x360) returned 1
	[0083.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.141] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 1
	[0083.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.141] lstrlenW (lpString=".doc") returned 4
	[0083.142] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.142] lstrlenW (lpString=".docx") returned 5
	[0083.142] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0083.142] lstrlenW (lpString=".pdf") returned 4
	[0083.142] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.142] lstrlenW (lpString=".xls") returned 4
	[0083.142] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.142] lstrlenW (lpString=".xlsx") returned 5
	[0083.142] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0083.142] lstrlenW (lpString=".ppt") returned 4
	[0083.142] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.142] lstrlenW (lpString=".zip") returned 4
	[0083.142] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.142] lstrlenW (lpString=".rar") returned 4
	[0083.142] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.142] lstrlenW (lpString=".bz2") returned 4
	[0083.142] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.142] lstrlenW (lpString=".7z") returned 3
	[0083.142] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.142] lstrlenW (lpString=".dbf") returned 4
	[0083.142] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.143] lstrlenW (lpString=".1cd") returned 4
	[0083.143] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.143] lstrlenW (lpString=".jpg") returned 4
	[0083.143] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.143] lstrlenW (lpString=".doc") returned 4
	[0083.143] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.143] lstrlenW (lpString=".docx") returned 5
	[0083.143] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0083.143] lstrlenW (lpString=".pdf") returned 4
	[0083.143] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.143] lstrlenW (lpString=".xls") returned 4
	[0083.143] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.143] lstrlenW (lpString=".xlsx") returned 5
	[0083.143] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0083.143] lstrlenW (lpString=".ppt") returned 4
	[0083.143] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.143] lstrlenW (lpString=".zip") returned 4
	[0083.144] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.144] lstrlenW (lpString=".rar") returned 4
	[0083.144] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.144] lstrlenW (lpString=".bz2") returned 4
	[0083.144] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.144] lstrlenW (lpString=".7z") returned 3
	[0083.144] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.144] lstrlenW (lpString=".dbf") returned 4
	[0083.144] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.144] lstrlenW (lpString=".1cd") returned 4
	[0083.144] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0083.144] lstrlenW (lpString=".jpg") returned 4
	[0083.144] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.145] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.145] lstrlenW (lpString="jfxwebkit.dll") returned 13
	[0083.145] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0083.145] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=41503296) returned 1
	[0083.145] CloseHandle (hObject=0x360) returned 1
	[0083.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20
	[0083.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[admin@stex777.com].money")) returned 1
	[0083.146] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0083.146] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc64 | out: lpNewFilePointer=0x0) returned 1
	[0083.146] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0083.146] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3fc0058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0083.149] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0083.151] ReadFile (in: hFile=0x360, lpBuffer=0x4000058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4000058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0083.155] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x39dfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0083.155] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0083.155] ReadFile (in: hFile=0x360, lpBuffer=0x4040058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4040058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0083.170] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.170] WriteFile (in: hFile=0x360, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x39dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfca8*=0xc0106, lpOverlapped=0x0) returned 1
	[0083.490] SetEndOfFile (hFile=0x360) returned 1
	[0084.586] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x4223d50
	[0084.591] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0084.591] WriteFile (in: hFile=0x360, lpBuffer=0x4223d50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4223d50*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0084.592] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0084.592] WriteFile (in: hFile=0x360, lpBuffer=0x4223d50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4223d50*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0084.592] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0084.592] WriteFile (in: hFile=0x360, lpBuffer=0x4223d50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4223d50*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0084.594] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0084.596] CloseHandle (hObject=0x360) returned 1
	[0084.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0084.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.597] lstrlenW (lpString=".doc") returned 4
	[0084.597] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.597] lstrlenW (lpString=".docx") returned 5
	[0084.597] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0084.597] lstrlenW (lpString=".pdf") returned 4
	[0084.597] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.597] lstrlenW (lpString=".xls") returned 4
	[0084.597] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.597] lstrlenW (lpString=".xlsx") returned 5
	[0084.597] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0084.597] lstrlenW (lpString=".ppt") returned 4
	[0084.597] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.598] lstrlenW (lpString=".zip") returned 4
	[0084.598] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.598] lstrlenW (lpString=".rar") returned 4
	[0084.598] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.598] lstrlenW (lpString=".bz2") returned 4
	[0084.598] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.598] lstrlenW (lpString=".7z") returned 3
	[0084.598] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.598] lstrlenW (lpString=".dbf") returned 4
	[0084.598] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.598] lstrlenW (lpString=".1cd") returned 4
	[0084.598] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.598] lstrlenW (lpString=".jpg") returned 4
	[0084.598] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.598] lstrlenW (lpString=".doc") returned 4
	[0084.598] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.598] lstrlenW (lpString=".docx") returned 5
	[0084.598] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0084.598] lstrlenW (lpString=".pdf") returned 4
	[0084.598] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.598] lstrlenW (lpString=".xls") returned 4
	[0084.598] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.598] lstrlenW (lpString=".xlsx") returned 5
	[0084.599] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0084.599] lstrlenW (lpString=".ppt") returned 4
	[0084.599] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.599] lstrlenW (lpString=".zip") returned 4
	[0084.599] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.599] lstrlenW (lpString=".rar") returned 4
	[0084.599] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.599] lstrlenW (lpString=".bz2") returned 4
	[0084.599] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.599] lstrlenW (lpString=".7z") returned 3
	[0084.599] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.599] lstrlenW (lpString=".dbf") returned 4
	[0084.599] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.599] lstrlenW (lpString=".1cd") returned 4
	[0084.599] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0084.599] lstrlenW (lpString=".jpg") returned 4
	[0084.599] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.599] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0084.599] lstrlenW (lpString="jsound.dll") returned 10
	[0084.600] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0084.601] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=35392) returned 1
	[0084.601] CloseHandle (hObject=0x360) returned 1
	[0084.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20
	[0084.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.602] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0084.602] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.602] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.602] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0084.602] GetLastError () returned 0x0
	[0084.602] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x8a40, lpOverlapped=0x0) returned 1
	[0084.604] WriteFile (in: hFile=0x33c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x8a50, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x8a50, lpOverlapped=0x0) returned 1
	[0084.606] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.606] WriteFile (in: hFile=0x33c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xe8, lpOverlapped=0x0) returned 1
	[0084.606] SetEndOfFile (hFile=0x33c) returned 1
	[0084.606] CloseHandle (hObject=0x33c) returned 1
	[0084.606] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.606] SetEndOfFile (hFile=0x360) returned 1
	[0084.607] CloseHandle (hObject=0x360) returned 1
	[0084.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0084.607] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 1
	[0084.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.607] lstrlenW (lpString=".doc") returned 4
	[0084.608] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.608] lstrlenW (lpString=".docx") returned 5
	[0084.608] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0084.608] lstrlenW (lpString=".pdf") returned 4
	[0084.608] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.608] lstrlenW (lpString=".xls") returned 4
	[0084.608] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.608] lstrlenW (lpString=".xlsx") returned 5
	[0084.608] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0084.608] lstrlenW (lpString=".ppt") returned 4
	[0084.608] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.608] lstrlenW (lpString=".zip") returned 4
	[0084.608] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.608] lstrlenW (lpString=".rar") returned 4
	[0084.608] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.608] lstrlenW (lpString=".bz2") returned 4
	[0084.608] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.608] lstrlenW (lpString=".7z") returned 3
	[0084.608] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.608] lstrlenW (lpString=".dbf") returned 4
	[0084.608] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.608] lstrlenW (lpString=".1cd") returned 4
	[0084.608] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.608] lstrlenW (lpString=".jpg") returned 4
	[0084.608] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.609] lstrlenW (lpString=".doc") returned 4
	[0084.609] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.609] lstrlenW (lpString=".docx") returned 5
	[0084.609] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0084.609] lstrlenW (lpString=".pdf") returned 4
	[0084.609] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.609] lstrlenW (lpString=".xls") returned 4
	[0084.609] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.609] lstrlenW (lpString=".xlsx") returned 5
	[0084.609] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0084.609] lstrlenW (lpString=".ppt") returned 4
	[0084.609] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.609] lstrlenW (lpString=".zip") returned 4
	[0084.609] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.609] lstrlenW (lpString=".rar") returned 4
	[0084.609] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.609] lstrlenW (lpString=".bz2") returned 4
	[0084.609] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.609] lstrlenW (lpString=".7z") returned 3
	[0084.609] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.609] lstrlenW (lpString=".dbf") returned 4
	[0084.609] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.609] lstrlenW (lpString=".1cd") returned 4
	[0084.609] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0084.610] lstrlenW (lpString=".jpg") returned 4
	[0084.610] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.610] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0084.610] lstrlenW (lpString="jsoundds.dll") returned 12
	[0084.610] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0084.610] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=31296) returned 1
	[0084.610] CloseHandle (hObject=0x360) returned 1
	[0084.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20
	[0084.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.610] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0084.610] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.610] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.611] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0084.611] GetLastError () returned 0x0
	[0084.611] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x7a40, lpOverlapped=0x0) returned 1
	[0084.613] WriteFile (in: hFile=0x33c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x7a50, lpOverlapped=0x0) returned 1
	[0084.614] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.614] WriteFile (in: hFile=0x33c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.614] SetEndOfFile (hFile=0x33c) returned 1
	[0084.614] CloseHandle (hObject=0x33c) returned 1
	[0084.614] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.614] SetEndOfFile (hFile=0x360) returned 1
	[0084.615] CloseHandle (hObject=0x360) returned 1
	[0084.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0084.616] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 1
	[0084.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.616] lstrlenW (lpString=".doc") returned 4
	[0084.616] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.616] lstrlenW (lpString=".docx") returned 5
	[0084.616] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0084.616] lstrlenW (lpString=".pdf") returned 4
	[0084.616] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.616] lstrlenW (lpString=".xls") returned 4
	[0084.616] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.616] lstrlenW (lpString=".xlsx") returned 5
	[0084.616] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0084.616] lstrlenW (lpString=".ppt") returned 4
	[0084.616] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.616] lstrlenW (lpString=".zip") returned 4
	[0084.616] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.616] lstrlenW (lpString=".rar") returned 4
	[0084.616] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.617] lstrlenW (lpString=".bz2") returned 4
	[0084.617] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.617] lstrlenW (lpString=".7z") returned 3
	[0084.617] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.617] lstrlenW (lpString=".dbf") returned 4
	[0084.617] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.617] lstrlenW (lpString=".1cd") returned 4
	[0084.617] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.617] lstrlenW (lpString=".jpg") returned 4
	[0084.617] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.617] lstrlenW (lpString=".doc") returned 4
	[0084.617] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.617] lstrlenW (lpString=".docx") returned 5
	[0084.617] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0084.617] lstrlenW (lpString=".pdf") returned 4
	[0084.617] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.618] lstrlenW (lpString=".xls") returned 4
	[0084.618] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.618] lstrlenW (lpString=".xlsx") returned 5
	[0084.618] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0084.618] lstrlenW (lpString=".ppt") returned 4
	[0084.618] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.618] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.618] lstrlenW (lpString=".zip") returned 4
	[0084.618] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.618] lstrlenW (lpString=".rar") returned 4
	[0084.618] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.618] lstrlenW (lpString=".bz2") returned 4
	[0084.618] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.618] lstrlenW (lpString=".7z") returned 3
	[0084.618] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.618] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.618] lstrlenW (lpString=".dbf") returned 4
	[0084.618] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.618] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.618] lstrlenW (lpString=".1cd") returned 4
	[0084.618] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.618] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0084.618] lstrlenW (lpString=".jpg") returned 4
	[0084.618] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.619] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0084.619] lstrlenW (lpString="kcms.dll") returned 8
	[0084.619] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0084.619] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=220736) returned 1
	[0084.619] CloseHandle (hObject=0x360) returned 1
	[0084.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20
	[0084.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.619] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0084.619] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.619] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.619] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0084.620] GetLastError () returned 0x0
	[0084.620] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x35e40, lpOverlapped=0x0) returned 1
	[0085.090] WriteFile (in: hFile=0x33c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x35e50, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x35e50, lpOverlapped=0x0) returned 1
	[0085.094] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.094] WriteFile (in: hFile=0x33c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0085.094] SetEndOfFile (hFile=0x33c) returned 1
	[0085.094] CloseHandle (hObject=0x33c) returned 1
	[0085.094] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.094] SetEndOfFile (hFile=0x360) returned 1
	[0085.096] CloseHandle (hObject=0x360) returned 1
	[0085.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.096] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 1
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.097] lstrlenW (lpString=".doc") returned 4
	[0085.097] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString=".docx") returned 5
	[0085.097] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0085.097] lstrlenW (lpString=".pdf") returned 4
	[0085.097] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString=".xls") returned 4
	[0085.097] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString=".xlsx") returned 5
	[0085.097] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0085.097] lstrlenW (lpString=".ppt") returned 4
	[0085.097] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.097] lstrlenW (lpString=".zip") returned 4
	[0085.097] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString=".rar") returned 4
	[0085.097] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString=".bz2") returned 4
	[0085.097] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.097] lstrlenW (lpString=".7z") returned 3
	[0085.097] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.097] lstrlenW (lpString=".dbf") returned 4
	[0085.097] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.097] lstrlenW (lpString=".1cd") returned 4
	[0085.097] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.097] lstrlenW (lpString=".jpg") returned 4
	[0085.098] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.098] lstrlenW (lpString=".doc") returned 4
	[0085.098] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.098] lstrlenW (lpString=".docx") returned 5
	[0085.098] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0085.098] lstrlenW (lpString=".pdf") returned 4
	[0085.098] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.098] lstrlenW (lpString=".xls") returned 4
	[0085.098] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.098] lstrlenW (lpString=".xlsx") returned 5
	[0085.098] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0085.098] lstrlenW (lpString=".ppt") returned 4
	[0085.098] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.098] lstrlenW (lpString=".zip") returned 4
	[0085.098] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.098] lstrlenW (lpString=".rar") returned 4
	[0085.098] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.098] lstrlenW (lpString=".bz2") returned 4
	[0085.098] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.098] lstrlenW (lpString=".7z") returned 3
	[0085.098] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.098] lstrlenW (lpString=".dbf") returned 4
	[0085.098] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.098] lstrlenW (lpString=".1cd") returned 4
	[0085.098] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0085.099] lstrlenW (lpString=".jpg") returned 4
	[0085.099] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.099] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0085.099] lstrlenW (lpString="msvcp120.dll") returned 12
	[0085.099] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0085.099] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=660128) returned 1
	[0085.099] CloseHandle (hObject=0x360) returned 1
	[0085.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20
	[0085.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0085.100] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.100] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0085.100] GetLastError () returned 0x0
	[0085.100] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0xa12a0, lpOverlapped=0x0) returned 1
	[0085.122] WriteFile (in: hFile=0x33c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xa12b0, lpOverlapped=0x0) returned 1
	[0085.467] ReadFile (in: hFile=0x360, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.467] WriteFile (in: hFile=0x33c, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.467] SetEndOfFile (hFile=0x33c) returned 1
	[0085.467] CloseHandle (hObject=0x33c) returned 1
	[0085.467] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.468] SetEndOfFile (hFile=0x360) returned 1
	[0085.473] CloseHandle (hObject=0x360) returned 1
	[0085.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.501] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 1
	[0085.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.742] lstrlenW (lpString=".doc") returned 4
	[0085.742] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.742] lstrlenW (lpString=".docx") returned 5
	[0085.742] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0085.742] lstrlenW (lpString=".pdf") returned 4
	[0085.742] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.742] lstrlenW (lpString=".xls") returned 4
	[0085.742] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.742] lstrlenW (lpString=".xlsx") returned 5
	[0085.742] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0085.742] lstrlenW (lpString=".ppt") returned 4
	[0085.742] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.742] lstrlenW (lpString=".zip") returned 4
	[0085.742] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.742] lstrlenW (lpString=".rar") returned 4
	[0085.742] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.742] lstrlenW (lpString=".bz2") returned 4
	[0085.742] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.742] lstrlenW (lpString=".7z") returned 3
	[0085.742] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.743] lstrlenW (lpString=".dbf") returned 4
	[0085.743] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.743] lstrlenW (lpString=".1cd") returned 4
	[0085.743] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.743] lstrlenW (lpString=".jpg") returned 4
	[0085.743] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.743] lstrlenW (lpString=".doc") returned 4
	[0085.743] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.743] lstrlenW (lpString=".docx") returned 5
	[0085.743] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0085.743] lstrlenW (lpString=".pdf") returned 4
	[0085.743] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.743] lstrlenW (lpString=".xls") returned 4
	[0085.743] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.743] lstrlenW (lpString=".xlsx") returned 5
	[0085.743] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0085.743] lstrlenW (lpString=".ppt") returned 4
	[0085.743] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.743] lstrlenW (lpString=".zip") returned 4
	[0085.743] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.743] lstrlenW (lpString=".rar") returned 4
	[0085.743] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.744] lstrlenW (lpString=".bz2") returned 4
	[0085.744] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.744] lstrlenW (lpString=".7z") returned 3
	[0085.744] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.744] lstrlenW (lpString=".dbf") returned 4
	[0085.744] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.744] lstrlenW (lpString=".1cd") returned 4
	[0085.744] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0085.744] lstrlenW (lpString=".jpg") returned 4
	[0085.744] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.744] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0085.744] lstrlenW (lpString="policytool.exe") returned 14
	[0085.744] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0085.745] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=16448) returned 1
	[0085.745] CloseHandle (hObject=0x34c) returned 1
	[0085.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20
	[0085.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.745] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0085.745] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.745] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.746] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.746] GetLastError () returned 0x0
	[0085.746] ReadFile (in: hFile=0x34c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x4040, lpOverlapped=0x0) returned 1
	[0085.747] WriteFile (in: hFile=0x2d4, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x4050, lpOverlapped=0x0) returned 1
	[0085.749] ReadFile (in: hFile=0x34c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.749] WriteFile (in: hFile=0x2d4, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf0, lpOverlapped=0x0) returned 1
	[0085.749] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.749] CloseHandle (hObject=0x2d4) returned 1
	[0085.749] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.749] SetEndOfFile (hFile=0x34c) returned 1
	[0085.750] CloseHandle (hObject=0x34c) returned 1
	[0085.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.750] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 1
	[0085.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.750] lstrlenW (lpString=".doc") returned 4
	[0085.750] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0085.751] lstrlenW (lpString=".docx") returned 5
	[0085.751] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0085.751] lstrlenW (lpString=".pdf") returned 4
	[0085.751] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0085.751] lstrlenW (lpString=".xls") returned 4
	[0085.751] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0085.751] lstrlenW (lpString=".xlsx") returned 5
	[0085.751] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0085.751] lstrlenW (lpString=".ppt") returned 4
	[0085.751] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0085.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.751] lstrlenW (lpString=".zip") returned 4
	[0085.751] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0085.751] lstrlenW (lpString=".rar") returned 4
	[0085.751] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0085.751] lstrlenW (lpString=".bz2") returned 4
	[0085.751] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0085.751] lstrlenW (lpString=".7z") returned 3
	[0085.751] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0085.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.751] lstrlenW (lpString=".dbf") returned 4
	[0085.751] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0085.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.751] lstrlenW (lpString=".1cd") returned 4
	[0085.751] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0085.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.751] lstrlenW (lpString=".jpg") returned 4
	[0085.751] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0085.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.752] lstrlenW (lpString=".doc") returned 4
	[0085.752] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0085.752] lstrlenW (lpString=".docx") returned 5
	[0085.752] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0085.752] lstrlenW (lpString=".pdf") returned 4
	[0085.752] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0085.752] lstrlenW (lpString=".xls") returned 4
	[0085.752] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0085.752] lstrlenW (lpString=".xlsx") returned 5
	[0085.752] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0085.752] lstrlenW (lpString=".ppt") returned 4
	[0085.752] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0085.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.752] lstrlenW (lpString=".zip") returned 4
	[0085.752] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0085.752] lstrlenW (lpString=".rar") returned 4
	[0085.752] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0085.752] lstrlenW (lpString=".bz2") returned 4
	[0085.752] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0085.752] lstrlenW (lpString=".7z") returned 3
	[0085.752] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0085.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.752] lstrlenW (lpString=".dbf") returned 4
	[0085.752] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0085.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.752] lstrlenW (lpString=".1cd") returned 4
	[0085.752] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0085.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0085.752] lstrlenW (lpString=".jpg") returned 4
	[0085.753] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0085.753] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0085.753] lstrlenW (lpString="prism_common.dll") returned 16
	[0085.753] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0085.753] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=57408) returned 1
	[0085.753] CloseHandle (hObject=0x34c) returned 1
	[0085.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20
	[0085.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.753] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0085.754] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.754] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.754] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.754] GetLastError () returned 0x0
	[0085.754] ReadFile (in: hFile=0x34c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0xe040, lpOverlapped=0x0) returned 1
	[0085.756] WriteFile (in: hFile=0x2d4, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xe050, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xe050, lpOverlapped=0x0) returned 1
	[0085.802] ReadFile (in: hFile=0x34c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.803] WriteFile (in: hFile=0x2d4, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xf4, lpOverlapped=0x0) returned 1
	[0085.803] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.803] CloseHandle (hObject=0x2d4) returned 1
	[0085.803] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.803] SetEndOfFile (hFile=0x34c) returned 1
	[0085.804] CloseHandle (hObject=0x34c) returned 1
	[0085.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.805] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 1
	[0085.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.805] lstrlenW (lpString=".doc") returned 4
	[0085.805] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.805] lstrlenW (lpString=".docx") returned 5
	[0085.805] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0085.805] lstrlenW (lpString=".pdf") returned 4
	[0085.805] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.805] lstrlenW (lpString=".xls") returned 4
	[0085.805] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.805] lstrlenW (lpString=".xlsx") returned 5
	[0085.805] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0085.805] lstrlenW (lpString=".ppt") returned 4
	[0085.805] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.805] lstrlenW (lpString=".zip") returned 4
	[0085.805] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.805] lstrlenW (lpString=".rar") returned 4
	[0085.805] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.805] lstrlenW (lpString=".bz2") returned 4
	[0085.805] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.805] lstrlenW (lpString=".7z") returned 3
	[0085.806] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.806] lstrlenW (lpString=".dbf") returned 4
	[0085.806] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.806] lstrlenW (lpString=".1cd") returned 4
	[0085.806] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.806] lstrlenW (lpString=".jpg") returned 4
	[0085.806] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.806] lstrlenW (lpString=".doc") returned 4
	[0085.806] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.806] lstrlenW (lpString=".docx") returned 5
	[0085.806] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0085.806] lstrlenW (lpString=".pdf") returned 4
	[0085.806] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.806] lstrlenW (lpString=".xls") returned 4
	[0085.806] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.806] lstrlenW (lpString=".xlsx") returned 5
	[0085.806] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0085.806] lstrlenW (lpString=".ppt") returned 4
	[0085.806] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.806] lstrlenW (lpString=".zip") returned 4
	[0085.806] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.806] lstrlenW (lpString=".rar") returned 4
	[0085.806] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.806] lstrlenW (lpString=".bz2") returned 4
	[0085.807] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.807] lstrlenW (lpString=".7z") returned 3
	[0085.807] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.807] lstrlenW (lpString=".dbf") returned 4
	[0085.807] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.807] lstrlenW (lpString=".1cd") returned 4
	[0085.807] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0085.807] lstrlenW (lpString=".jpg") returned 4
	[0085.807] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.807] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0085.807] lstrlenW (lpString="prism_d3d.dll") returned 13
	[0085.807] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0085.808] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=130624) returned 1
	[0085.808] CloseHandle (hObject=0x34c) returned 1
	[0085.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20
	[0085.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.808] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0085.808] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.808] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.808] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.809] GetLastError () returned 0x0
	[0085.809] ReadFile (in: hFile=0x34c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x1fe40, lpOverlapped=0x0) returned 1
	[0085.812] WriteFile (in: hFile=0x2d4, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x1fe50, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x1fe50, lpOverlapped=0x0) returned 1
	[0085.815] ReadFile (in: hFile=0x34c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.815] WriteFile (in: hFile=0x2d4, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xee, lpOverlapped=0x0) returned 1
	[0085.815] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.815] CloseHandle (hObject=0x2d4) returned 1
	[0085.815] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.815] SetEndOfFile (hFile=0x34c) returned 1
	[0085.817] CloseHandle (hObject=0x34c) returned 1
	[0085.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.817] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 1
	[0085.817] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.817] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.817] lstrlenW (lpString=".doc") returned 4
	[0085.817] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.817] lstrlenW (lpString=".docx") returned 5
	[0085.817] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0085.817] lstrlenW (lpString=".pdf") returned 4
	[0085.817] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.817] lstrlenW (lpString=".xls") returned 4
	[0085.818] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.818] lstrlenW (lpString=".xlsx") returned 5
	[0085.818] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0085.818] lstrlenW (lpString=".ppt") returned 4
	[0085.818] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.818] lstrlenW (lpString=".zip") returned 4
	[0085.818] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.818] lstrlenW (lpString=".rar") returned 4
	[0085.818] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.818] lstrlenW (lpString=".bz2") returned 4
	[0085.818] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.818] lstrlenW (lpString=".7z") returned 3
	[0085.818] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.818] lstrlenW (lpString=".dbf") returned 4
	[0085.818] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.818] lstrlenW (lpString=".1cd") returned 4
	[0085.818] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.818] lstrlenW (lpString=".jpg") returned 4
	[0085.818] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.818] lstrlenW (lpString=".doc") returned 4
	[0085.818] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.818] lstrlenW (lpString=".docx") returned 5
	[0085.819] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0085.819] lstrlenW (lpString=".pdf") returned 4
	[0085.819] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.819] lstrlenW (lpString=".xls") returned 4
	[0085.819] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.819] lstrlenW (lpString=".xlsx") returned 5
	[0085.819] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0085.819] lstrlenW (lpString=".ppt") returned 4
	[0085.819] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.819] lstrlenW (lpString=".zip") returned 4
	[0085.819] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.819] lstrlenW (lpString=".rar") returned 4
	[0085.819] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.819] lstrlenW (lpString=".bz2") returned 4
	[0085.819] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.819] lstrlenW (lpString=".7z") returned 3
	[0085.819] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.819] lstrlenW (lpString=".dbf") returned 4
	[0085.819] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.819] lstrlenW (lpString=".1cd") returned 4
	[0085.819] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0085.819] lstrlenW (lpString=".jpg") returned 4
	[0085.819] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.820] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0086.132] lstrlenW (lpString="prism_sw.dll") returned 12
	[0086.133] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.276] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=97856) returned 1
	[0086.276] CloseHandle (hObject=0x34c) returned 1
	[0086.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20
	[0086.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.276] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.276] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.277] GetLastError () returned 0x0
	[0086.277] ReadFile (in: hFile=0x34c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x17e40, lpOverlapped=0x0) returned 1
	[0086.280] WriteFile (in: hFile=0x390, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x17e50, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x17e50, lpOverlapped=0x0) returned 1
	[0086.282] ReadFile (in: hFile=0x34c, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.282] WriteFile (in: hFile=0x390, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.282] SetEndOfFile (hFile=0x390) returned 1
	[0086.282] CloseHandle (hObject=0x390) returned 1
	[0086.282] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.282] SetEndOfFile (hFile=0x34c) returned 1
	[0086.284] CloseHandle (hObject=0x34c) returned 1
	[0086.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0086.284] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 1
	[0086.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.284] lstrlenW (lpString=".doc") returned 4
	[0086.284] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.285] lstrlenW (lpString=".docx") returned 5
	[0086.285] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1
	[0086.285] lstrlenW (lpString=".pdf") returned 4
	[0086.285] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.285] lstrlenW (lpString=".xls") returned 4
	[0086.285] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.285] lstrlenW (lpString=".xlsx") returned 5
	[0086.285] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1
	[0086.285] lstrlenW (lpString=".ppt") returned 4
	[0086.285] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.285] lstrlenW (lpString=".zip") returned 4
	[0086.285] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.285] lstrlenW (lpString=".rar") returned 4
	[0086.285] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.285] lstrlenW (lpString=".bz2") returned 4
	[0086.285] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.285] lstrlenW (lpString=".7z") returned 3
	[0086.285] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.285] lstrlenW (lpString=".dbf") returned 4
	[0086.285] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.285] lstrlenW (lpString=".1cd") returned 4
	[0086.286] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.286] lstrlenW (lpString=".jpg") returned 4
	[0086.286] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.286] lstrlenW (lpString=".doc") returned 4
	[0086.286] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.286] lstrlenW (lpString=".docx") returned 5
	[0086.286] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1
	[0086.286] lstrlenW (lpString=".pdf") returned 4
	[0086.286] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.286] lstrlenW (lpString=".xls") returned 4
	[0086.286] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.286] lstrlenW (lpString=".xlsx") returned 5
	[0086.286] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1
	[0086.286] lstrlenW (lpString=".ppt") returned 4
	[0086.286] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.286] lstrlenW (lpString=".zip") returned 4
	[0086.286] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.287] lstrlenW (lpString=".rar") returned 4
	[0086.287] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.287] lstrlenW (lpString=".bz2") returned 4
	[0086.287] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.287] lstrlenW (lpString=".7z") returned 3
	[0086.287] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.287] lstrlenW (lpString=".dbf") returned 4
	[0086.287] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.287] lstrlenW (lpString=".1cd") returned 4
	[0086.287] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0086.287] lstrlenW (lpString=".jpg") returned 4
	[0086.287] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.287] lstrcmpiW (lpString1=".jsa", lpString2=".money") returned -1
	[0086.287] lstrlenW (lpString="classes.jsa") returned 11
	[0086.287] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.288] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=18677760) returned 1
	[0086.288] CloseHandle (hObject=0x34c) returned 1
	[0086.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21
	[0086.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1
	[0086.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[admin@stex777.com].money")) returned 1
	[0086.504] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.504] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc64 | out: lpNewFilePointer=0x0) returned 1
	[0086.504] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0086.505] ReadFile (in: hFile=0x340, lpBuffer=0x3fc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3fc0058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0086.508] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0086.509] ReadFile (in: hFile=0x340, lpBuffer=0x4000058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4000058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0086.517] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x39dfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0086.517] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0086.517] ReadFile (in: hFile=0x340, lpBuffer=0x4040058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x39dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4040058*, lpNumberOfBytesRead=0x39dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0086.534] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.534] WriteFile (in: hFile=0x340, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x39dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfca8*=0xc0102, lpOverlapped=0x0) returned 1
	[0086.867] SetEndOfFile (hFile=0x340) returned 1
	[0086.867] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x4223d50
	[0086.871] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0086.871] WriteFile (in: hFile=0x340, lpBuffer=0x4223d50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4223d50*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0086.873] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0086.873] WriteFile (in: hFile=0x340, lpBuffer=0x4223d50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4223d50*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0086.877] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x39dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0086.877] WriteFile (in: hFile=0x340, lpBuffer=0x4223d50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x39dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4223d50*, lpNumberOfBytesWritten=0x39dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0086.879] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0086.882] CloseHandle (hObject=0x340) returned 1
	[0086.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x21) returned 1
	[0086.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.882] lstrlenW (lpString=".doc") returned 4
	[0086.882] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1
	[0086.882] lstrlenW (lpString=".docx") returned 5
	[0086.882] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1
	[0086.882] lstrlenW (lpString=".pdf") returned 4
	[0086.882] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1
	[0086.882] lstrlenW (lpString=".xls") returned 4
	[0086.882] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1
	[0086.882] lstrlenW (lpString=".xlsx") returned 5
	[0086.882] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1
	[0086.883] lstrlenW (lpString=".ppt") returned 4
	[0086.883] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1
	[0086.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.883] lstrlenW (lpString=".zip") returned 4
	[0086.883] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1
	[0086.883] lstrlenW (lpString=".rar") returned 4
	[0086.883] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1
	[0086.883] lstrlenW (lpString=".bz2") returned 4
	[0086.883] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1
	[0086.883] lstrlenW (lpString=".7z") returned 3
	[0086.883] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1
	[0086.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.883] lstrlenW (lpString=".dbf") returned 4
	[0086.883] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1
	[0086.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.883] lstrlenW (lpString=".1cd") returned 4
	[0086.883] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1
	[0086.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.883] lstrlenW (lpString=".jpg") returned 4
	[0086.883] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1
	[0086.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.884] lstrlenW (lpString=".doc") returned 4
	[0086.884] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1
	[0086.884] lstrlenW (lpString=".docx") returned 5
	[0086.884] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1
	[0086.884] lstrlenW (lpString=".pdf") returned 4
	[0086.884] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1
	[0086.884] lstrlenW (lpString=".xls") returned 4
	[0086.884] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1
	[0086.884] lstrlenW (lpString=".xlsx") returned 5
	[0086.884] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1
	[0086.884] lstrlenW (lpString=".ppt") returned 4
	[0086.884] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1
	[0086.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.884] lstrlenW (lpString=".zip") returned 4
	[0086.884] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1
	[0086.884] lstrlenW (lpString=".rar") returned 4
	[0086.884] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1
	[0086.884] lstrlenW (lpString=".bz2") returned 4
	[0086.932] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1
	[0086.932] lstrlenW (lpString=".7z") returned 3
	[0086.932] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1
	[0086.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.932] lstrlenW (lpString=".dbf") returned 4
	[0086.932] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1
	[0086.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.932] lstrlenW (lpString=".1cd") returned 4
	[0086.932] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1
	[0086.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0086.932] lstrlenW (lpString=".jpg") returned 4
	[0086.932] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1
	[0086.932] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0086.932] lstrlenW (lpString="sunmscapi.dll") returned 13
	[0086.932] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.933] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=31808) returned 1
	[0086.933] CloseHandle (hObject=0x340) returned 1
	[0086.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20
	[0086.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.933] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.933] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.933] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.934] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0086.934] GetLastError () returned 0x0
	[0086.934] ReadFile (in: hFile=0x340, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x7c40, lpOverlapped=0x0) returned 1
	[0086.936] WriteFile (in: hFile=0x354, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x7c50, lpOverlapped=0x0) returned 1
	[0086.937] ReadFile (in: hFile=0x340, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.937] WriteFile (in: hFile=0x354, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xee, lpOverlapped=0x0) returned 1
	[0086.938] SetEndOfFile (hFile=0x354) returned 1
	[0086.938] CloseHandle (hObject=0x354) returned 1
	[0086.938] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.938] SetEndOfFile (hFile=0x340) returned 1
	[0086.939] CloseHandle (hObject=0x340) returned 1
	[0086.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0086.939] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 1
	[0086.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.939] lstrlenW (lpString=".doc") returned 4
	[0086.940] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.940] lstrlenW (lpString=".docx") returned 5
	[0086.940] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0086.940] lstrlenW (lpString=".pdf") returned 4
	[0086.940] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.940] lstrlenW (lpString=".xls") returned 4
	[0086.940] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.940] lstrlenW (lpString=".xlsx") returned 5
	[0086.940] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0086.940] lstrlenW (lpString=".ppt") returned 4
	[0086.940] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.940] lstrlenW (lpString=".zip") returned 4
	[0086.940] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.940] lstrlenW (lpString=".rar") returned 4
	[0086.940] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.940] lstrlenW (lpString=".bz2") returned 4
	[0086.940] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.941] lstrlenW (lpString=".7z") returned 3
	[0086.941] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.941] lstrlenW (lpString=".dbf") returned 4
	[0086.941] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.941] lstrlenW (lpString=".1cd") returned 4
	[0086.941] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.941] lstrlenW (lpString=".jpg") returned 4
	[0086.941] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.942] lstrlenW (lpString=".doc") returned 4
	[0086.942] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.942] lstrlenW (lpString=".docx") returned 5
	[0086.942] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0086.942] lstrlenW (lpString=".pdf") returned 4
	[0086.942] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.942] lstrlenW (lpString=".xls") returned 4
	[0086.942] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.942] lstrlenW (lpString=".xlsx") returned 5
	[0086.942] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0086.942] lstrlenW (lpString=".ppt") returned 4
	[0086.942] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.942] lstrlenW (lpString=".zip") returned 4
	[0086.942] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.942] lstrlenW (lpString=".rar") returned 4
	[0086.943] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.943] lstrlenW (lpString=".bz2") returned 4
	[0086.943] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.943] lstrlenW (lpString=".7z") returned 3
	[0086.943] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.943] lstrlenW (lpString=".dbf") returned 4
	[0086.943] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.943] lstrlenW (lpString=".1cd") returned 4
	[0086.943] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0086.943] lstrlenW (lpString=".jpg") returned 4
	[0086.943] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.944] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0086.944] lstrlenW (lpString="t2k.dll") returned 7
	[0086.944] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.944] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=255040) returned 1
	[0086.944] CloseHandle (hObject=0x340) returned 1
	[0086.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20
	[0086.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.945] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0086.945] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.945] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.945] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0086.946] GetLastError () returned 0x0
	[0086.946] ReadFile (in: hFile=0x340, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x3e440, lpOverlapped=0x0) returned 1
	[0087.378] WriteFile (in: hFile=0x354, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x3e450, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x3e450, lpOverlapped=0x0) returned 1
	[0087.382] ReadFile (in: hFile=0x340, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.382] WriteFile (in: hFile=0x354, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xe2, lpOverlapped=0x0) returned 1
	[0087.383] SetEndOfFile (hFile=0x354) returned 1
	[0087.383] CloseHandle (hObject=0x354) returned 1
	[0087.383] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.383] SetEndOfFile (hFile=0x340) returned 1
	[0087.385] CloseHandle (hObject=0x340) returned 1
	[0087.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.386] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 1
	[0087.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.386] lstrlenW (lpString=".doc") returned 4
	[0087.386] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.386] lstrlenW (lpString=".docx") returned 5
	[0087.386] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1
	[0087.386] lstrlenW (lpString=".pdf") returned 4
	[0087.386] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.386] lstrlenW (lpString=".xls") returned 4
	[0087.386] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.386] lstrlenW (lpString=".xlsx") returned 5
	[0087.386] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1
	[0087.386] lstrlenW (lpString=".ppt") returned 4
	[0087.386] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.386] lstrlenW (lpString=".zip") returned 4
	[0087.387] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.387] lstrlenW (lpString=".rar") returned 4
	[0087.387] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.387] lstrlenW (lpString=".bz2") returned 4
	[0087.387] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.387] lstrlenW (lpString=".7z") returned 3
	[0087.387] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.387] lstrlenW (lpString=".dbf") returned 4
	[0087.387] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.387] lstrlenW (lpString=".1cd") returned 4
	[0087.387] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.387] lstrlenW (lpString=".jpg") returned 4
	[0087.387] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.387] lstrlenW (lpString=".doc") returned 4
	[0087.387] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.387] lstrlenW (lpString=".docx") returned 5
	[0087.387] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1
	[0087.387] lstrlenW (lpString=".pdf") returned 4
	[0087.387] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.387] lstrlenW (lpString=".xls") returned 4
	[0087.387] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.387] lstrlenW (lpString=".xlsx") returned 5
	[0087.388] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1
	[0087.388] lstrlenW (lpString=".ppt") returned 4
	[0087.388] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.388] lstrlenW (lpString=".zip") returned 4
	[0087.388] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.388] lstrlenW (lpString=".rar") returned 4
	[0087.388] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.388] lstrlenW (lpString=".bz2") returned 4
	[0087.388] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.388] lstrlenW (lpString=".7z") returned 3
	[0087.388] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.388] lstrlenW (lpString=".dbf") returned 4
	[0087.388] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.388] lstrlenW (lpString=".1cd") returned 4
	[0087.388] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46
	[0087.388] lstrlenW (lpString=".jpg") returned 4
	[0087.388] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.389] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0087.389] lstrlenW (lpString="wsdetect.dll") returned 12
	[0087.389] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0087.389] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=192576) returned 1
	[0087.389] CloseHandle (hObject=0x340) returned 1
	[0087.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20
	[0087.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.389] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0087.389] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.390] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.390] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0087.390] GetLastError () returned 0x0
	[0087.390] ReadFile (in: hFile=0x340, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x2f040, lpOverlapped=0x0) returned 1
	[0087.394] WriteFile (in: hFile=0x354, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0x2f050, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0x2f050, lpOverlapped=0x0) returned 1
	[0087.398] ReadFile (in: hFile=0x340, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesRead=0x39dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.398] WriteFile (in: hFile=0x354, lpBuffer=0x3fc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fc0020*, lpNumberOfBytesWritten=0x39dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.398] SetEndOfFile (hFile=0x354) returned 1
	[0087.398] CloseHandle (hObject=0x354) returned 1
	[0087.398] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.398] SetEndOfFile (hFile=0x340) returned 1
	[0087.452] CloseHandle (hObject=0x340) returned 1
	[0087.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.458] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 1
	[0087.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.476] lstrlenW (lpString=".doc") returned 4
	[0087.491] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.491] lstrlenW (lpString=".docx") returned 5
	[0087.491] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0087.492] lstrlenW (lpString=".pdf") returned 4
	[0087.492] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.492] lstrlenW (lpString=".xls") returned 4
	[0087.492] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.492] lstrlenW (lpString=".xlsx") returned 5
	[0087.492] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0087.492] lstrlenW (lpString=".ppt") returned 4
	[0087.492] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.492] lstrlenW (lpString=".zip") returned 4
	[0087.492] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.492] lstrlenW (lpString=".rar") returned 4
	[0087.492] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.492] lstrlenW (lpString=".bz2") returned 4
	[0087.492] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.492] lstrlenW (lpString=".7z") returned 3
	[0087.492] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.492] lstrlenW (lpString=".dbf") returned 4
	[0087.492] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.492] lstrlenW (lpString=".1cd") returned 4
	[0087.492] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.493] lstrlenW (lpString=".jpg") returned 4
	[0087.493] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.493] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.493] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.493] lstrlenW (lpString=".doc") returned 4
	[0087.493] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.493] lstrlenW (lpString=".docx") returned 5
	[0087.493] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0087.493] lstrlenW (lpString=".pdf") returned 4
	[0087.493] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.493] lstrlenW (lpString=".xls") returned 4
	[0087.493] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.493] lstrlenW (lpString=".xlsx") returned 5
	[0087.493] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0087.493] lstrlenW (lpString=".ppt") returned 4
	[0087.493] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.493] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.493] lstrlenW (lpString=".zip") returned 4
	[0087.493] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.493] lstrlenW (lpString=".rar") returned 4
	[0087.493] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.493] lstrlenW (lpString=".bz2") returned 4
	[0087.493] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.493] lstrlenW (lpString=".7z") returned 3
	[0087.493] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.493] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.494] lstrlenW (lpString=".dbf") returned 4
	[0087.494] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.494] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.494] lstrlenW (lpString=".1cd") returned 4
	[0087.494] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.494] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51
	[0087.494] lstrlenW (lpString=".jpg") returned 4
	[0087.494] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.494] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0087.494] lstrlenW (lpString="zip.dll") returned 7
	[0087.494] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0087.495] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x39dff14 | out: lpFileSize=0x39dff14*=77888) returned 1
	[0087.495] CloseHandle (hObject=0x340) returned 1
	[0087.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20
	[0087.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.495] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0087.495] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.495] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.495] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0087.496] GetLastError () returned 0x0
	[0087.496] ReadFile (hFile=0x340, lpBuffer=0x3fc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39dfecc, lpOverlapped=0x0) 

Thread:
	id = 19
	os_tid = 0xd94

	[0057.441] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x3600770
	[0057.441] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x3610778
	[0057.441] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f2c0
	[0057.442] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x6) returned 0x69f048
	[0057.442] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f440
	[0057.442] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x100000) returned 0x40d7020
	[0057.445] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f4e8
	[0057.445] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f4e8, Size=0x20) returned 0x631178
	[0057.445] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f500
	[0057.445] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f500, Size=0x20) returned 0x631218
	[0057.445] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.445] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.445] Wow64DisableWow64FsRedirection (in: OldValue=0x3b1ff50 | out: OldValue=0x3b1ff50*=0x0) returned 1
	[0057.445] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.445] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631178 | out: hHeap=0x600000) returned 1
	[0057.445] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.445] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631218 | out: hHeap=0x600000) returned 1
	[0057.446] Sleep (dwMilliseconds=0x64) 
	[0057.771] lstrcmpiW (lpString1=".cmd", lpString2=".money") returned -1
	[0057.772] lstrlenW (lpString="preoobe.cmd") returned 11
	[0057.772] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0057.772] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=74) returned 1
	[0057.772] CloseHandle (hObject=0x2fc) returned 1
	[0057.772] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20
	[0057.772] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0057.773] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0057.773] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.773] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.773] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0057.773] GetLastError () returned 0x0
	[0057.773] ReadFile (in: hFile=0x2fc, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x4a, lpOverlapped=0x0) returned 1
	[0057.787] WriteFile (in: hFile=0x300, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x50, lpOverlapped=0x0) returned 1
	[0057.788] ReadFile (in: hFile=0x2fc, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.788] WriteFile (in: hFile=0x300, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xea, lpOverlapped=0x0) returned 1
	[0057.788] SetEndOfFile (hFile=0x300) returned 1
	[0057.788] CloseHandle (hObject=0x300) returned 1
	[0057.788] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.789] SetEndOfFile (hFile=0x2fc) returned 1
	[0057.789] CloseHandle (hObject=0x2fc) returned 1
	[0057.789] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0057.790] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1
	[0057.790] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.790] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.790] lstrlenW (lpString=".doc") returned 4
	[0057.790] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0057.790] lstrlenW (lpString=".docx") returned 5
	[0057.790] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0057.790] lstrlenW (lpString=".pdf") returned 4
	[0057.790] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0057.790] lstrlenW (lpString=".xls") returned 4
	[0057.790] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0057.790] lstrlenW (lpString=".xlsx") returned 5
	[0057.790] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0057.790] lstrlenW (lpString=".ppt") returned 4
	[0057.790] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0057.790] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.790] lstrlenW (lpString=".zip") returned 4
	[0057.790] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0057.790] lstrlenW (lpString=".rar") returned 4
	[0057.790] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0057.790] lstrlenW (lpString=".bz2") returned 4
	[0057.790] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0057.791] lstrlenW (lpString=".7z") returned 3
	[0057.791] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0057.791] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.791] lstrlenW (lpString=".dbf") returned 4
	[0057.791] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0057.791] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.791] lstrlenW (lpString=".1cd") returned 4
	[0057.791] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0057.791] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.791] lstrlenW (lpString=".jpg") returned 4
	[0057.791] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0057.791] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.791] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.791] lstrlenW (lpString=".doc") returned 4
	[0057.791] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0057.791] lstrlenW (lpString=".docx") returned 5
	[0057.791] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0057.791] lstrlenW (lpString=".pdf") returned 4
	[0057.791] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0057.791] lstrlenW (lpString=".xls") returned 4
	[0057.791] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0057.791] lstrlenW (lpString=".xlsx") returned 5
	[0057.791] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0057.791] lstrlenW (lpString=".ppt") returned 4
	[0057.791] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0057.791] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.791] lstrlenW (lpString=".zip") returned 4
	[0057.791] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0057.791] lstrlenW (lpString=".rar") returned 4
	[0057.791] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0057.792] lstrlenW (lpString=".bz2") returned 4
	[0057.792] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0057.792] lstrlenW (lpString=".7z") returned 3
	[0057.792] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0057.792] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.792] lstrlenW (lpString=".dbf") returned 4
	[0057.792] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0057.792] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.792] lstrlenW (lpString=".1cd") returned 4
	[0057.792] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0057.792] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0057.792] lstrlenW (lpString=".jpg") returned 4
	[0057.792] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0057.792] lstrcmpiW (lpString1=".cmd", lpString2=".money") returned -1
	[0057.792] lstrlenW (lpString="SetupComplete.cmd") returned 17
	[0057.792] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0057.793] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=307) returned 1
	[0057.793] CloseHandle (hObject=0x2fc) returned 1
	[0057.793] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20
	[0057.793] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0057.793] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0057.793] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.793] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.793] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0057.794] GetLastError () returned 0x0
	[0057.794] ReadFile (in: hFile=0x2fc, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x133, lpOverlapped=0x0) returned 1
	[0057.795] WriteFile (in: hFile=0x300, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x140, lpOverlapped=0x0) returned 1
	[0057.796] ReadFile (in: hFile=0x2fc, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.796] WriteFile (in: hFile=0x300, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0057.800] SetEndOfFile (hFile=0x300) returned 1
	[0057.800] CloseHandle (hObject=0x300) returned 1
	[0057.800] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.801] SetEndOfFile (hFile=0x2fc) returned 1
	[0057.801] CloseHandle (hObject=0x2fc) returned 1
	[0057.801] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0057.802] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1
	[0057.802] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.802] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.802] lstrlenW (lpString=".doc") returned 4
	[0057.802] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0057.802] lstrlenW (lpString=".docx") returned 5
	[0057.802] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0057.802] lstrlenW (lpString=".pdf") returned 4
	[0057.802] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0057.802] lstrlenW (lpString=".xls") returned 4
	[0057.802] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0057.802] lstrlenW (lpString=".xlsx") returned 5
	[0057.802] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0057.802] lstrlenW (lpString=".ppt") returned 4
	[0057.802] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0057.802] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.802] lstrlenW (lpString=".zip") returned 4
	[0057.802] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0057.802] lstrlenW (lpString=".rar") returned 4
	[0057.802] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0057.803] lstrlenW (lpString=".bz2") returned 4
	[0057.803] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0057.803] lstrlenW (lpString=".7z") returned 3
	[0057.803] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0057.803] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.803] lstrlenW (lpString=".dbf") returned 4
	[0057.803] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0057.803] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.803] lstrlenW (lpString=".1cd") returned 4
	[0057.803] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0057.803] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.803] lstrlenW (lpString=".jpg") returned 4
	[0057.803] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0057.803] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.803] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.803] lstrlenW (lpString=".doc") returned 4
	[0057.803] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0057.803] lstrlenW (lpString=".docx") returned 5
	[0057.803] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0057.803] lstrlenW (lpString=".pdf") returned 4
	[0057.803] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0057.803] lstrlenW (lpString=".xls") returned 4
	[0057.803] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0057.803] lstrlenW (lpString=".xlsx") returned 5
	[0057.803] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0057.803] lstrlenW (lpString=".ppt") returned 4
	[0057.803] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0057.803] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.803] lstrlenW (lpString=".zip") returned 4
	[0057.803] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0057.803] lstrlenW (lpString=".rar") returned 4
	[0057.804] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0057.804] lstrlenW (lpString=".bz2") returned 4
	[0057.804] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0057.804] lstrlenW (lpString=".7z") returned 3
	[0057.804] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0057.804] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.804] lstrlenW (lpString=".dbf") returned 4
	[0057.804] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0057.804] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.804] lstrlenW (lpString=".1cd") returned 4
	[0057.804] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0057.804] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0057.804] lstrlenW (lpString=".jpg") returned 4
	[0057.804] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0057.804] Sleep (dwMilliseconds=0x64) 
	[0058.442] Sleep (dwMilliseconds=0x64) 
	[0059.061] Sleep (dwMilliseconds=0x64) 
	[0059.478] Sleep (dwMilliseconds=0x64) 
	[0060.168] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0060.168] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.168] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0060.169] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=18776) returned 1
	[0060.169] CloseHandle (hObject=0x344) returned 1
	[0060.169] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80
	[0060.169] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.169] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0060.169] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.170] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.170] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0060.170] GetLastError () returned 0x0
	[0060.170] ReadFile (in: hFile=0x344, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x4958, lpOverlapped=0x0) returned 1
	[0060.174] WriteFile (in: hFile=0x348, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x4960, lpOverlapped=0x0) returned 1
	[0060.175] ReadFile (in: hFile=0x344, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.175] WriteFile (in: hFile=0x348, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.175] SetEndOfFile (hFile=0x348) returned 1
	[0060.175] CloseHandle (hObject=0x348) returned 1
	[0060.176] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.176] SetEndOfFile (hFile=0x344) returned 1
	[0060.177] CloseHandle (hObject=0x344) returned 1
	[0060.177] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.178] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1
	[0060.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.178] lstrlenW (lpString=".doc") returned 4
	[0060.178] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.178] lstrlenW (lpString=".docx") returned 5
	[0060.178] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.178] lstrlenW (lpString=".pdf") returned 4
	[0060.178] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.178] lstrlenW (lpString=".xls") returned 4
	[0060.178] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.178] lstrlenW (lpString=".xlsx") returned 5
	[0060.178] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.178] lstrlenW (lpString=".ppt") returned 4
	[0060.178] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.178] lstrlenW (lpString=".zip") returned 4
	[0060.178] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.178] lstrlenW (lpString=".rar") returned 4
	[0060.178] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.178] lstrlenW (lpString=".bz2") returned 4
	[0060.178] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.178] lstrlenW (lpString=".7z") returned 3
	[0060.179] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.179] lstrlenW (lpString=".dbf") returned 4
	[0060.179] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.179] lstrlenW (lpString=".1cd") returned 4
	[0060.179] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.179] lstrlenW (lpString=".jpg") returned 4
	[0060.179] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.179] lstrlenW (lpString=".doc") returned 4
	[0060.179] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.179] lstrlenW (lpString=".docx") returned 5
	[0060.179] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.179] lstrlenW (lpString=".pdf") returned 4
	[0060.179] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.179] lstrlenW (lpString=".xls") returned 4
	[0060.179] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.179] lstrlenW (lpString=".xlsx") returned 5
	[0060.179] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.179] lstrlenW (lpString=".ppt") returned 4
	[0060.179] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.179] lstrlenW (lpString=".zip") returned 4
	[0060.179] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.179] lstrlenW (lpString=".rar") returned 4
	[0060.179] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.180] lstrlenW (lpString=".bz2") returned 4
	[0060.180] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.180] lstrlenW (lpString=".7z") returned 3
	[0060.180] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.180] lstrlenW (lpString=".dbf") returned 4
	[0060.180] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.180] lstrlenW (lpString=".1cd") returned 4
	[0060.180] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0060.180] lstrlenW (lpString=".jpg") returned 4
	[0060.180] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.180] Sleep (dwMilliseconds=0x64) 
	[0060.668] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0060.668] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.668] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.669] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=18264) returned 1
	[0060.669] CloseHandle (hObject=0x320) returned 1
	[0060.669] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80
	[0060.669] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.669] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.669] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.669] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.669] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0060.677] GetLastError () returned 0x0
	[0060.677] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0060.681] WriteFile (in: hFile=0x2b8, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0060.794] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.794] WriteFile (in: hFile=0x2b8, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.794] SetEndOfFile (hFile=0x2b8) returned 1
	[0060.795] CloseHandle (hObject=0x2b8) returned 1
	[0060.796] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.796] SetEndOfFile (hFile=0x320) returned 1
	[0060.797] CloseHandle (hObject=0x320) returned 1
	[0060.797] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.797] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1
	[0060.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.798] lstrlenW (lpString=".doc") returned 4
	[0060.798] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.798] lstrlenW (lpString=".docx") returned 5
	[0060.798] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.798] lstrlenW (lpString=".pdf") returned 4
	[0060.798] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.798] lstrlenW (lpString=".xls") returned 4
	[0060.798] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.798] lstrlenW (lpString=".xlsx") returned 5
	[0060.798] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.798] lstrlenW (lpString=".ppt") returned 4
	[0060.798] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.798] lstrlenW (lpString=".zip") returned 4
	[0060.798] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.798] lstrlenW (lpString=".rar") returned 4
	[0060.798] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.798] lstrlenW (lpString=".bz2") returned 4
	[0060.798] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.798] lstrlenW (lpString=".7z") returned 3
	[0060.798] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.798] lstrlenW (lpString=".dbf") returned 4
	[0060.799] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.799] lstrlenW (lpString=".1cd") returned 4
	[0060.799] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.799] lstrlenW (lpString=".jpg") returned 4
	[0060.799] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.799] lstrlenW (lpString=".doc") returned 4
	[0060.799] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.799] lstrlenW (lpString=".docx") returned 5
	[0060.799] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.799] lstrlenW (lpString=".pdf") returned 4
	[0060.799] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.799] lstrlenW (lpString=".xls") returned 4
	[0060.799] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.799] lstrlenW (lpString=".xlsx") returned 5
	[0060.799] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.799] lstrlenW (lpString=".ppt") returned 4
	[0060.799] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.799] lstrlenW (lpString=".zip") returned 4
	[0060.799] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.799] lstrlenW (lpString=".rar") returned 4
	[0060.799] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.799] lstrlenW (lpString=".bz2") returned 4
	[0060.799] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.799] lstrlenW (lpString=".7z") returned 3
	[0060.800] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.800] lstrlenW (lpString=".dbf") returned 4
	[0060.800] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.800] lstrlenW (lpString=".1cd") returned 4
	[0060.800] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0060.800] lstrlenW (lpString=".jpg") returned 4
	[0060.800] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.800] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0060.800] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.800] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.802] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=18264) returned 1
	[0060.802] CloseHandle (hObject=0x320) returned 1
	[0060.802] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80
	[0060.802] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.802] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.802] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.802] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.802] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0060.804] GetLastError () returned 0x0
	[0060.804] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0060.806] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0060.807] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.807] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.807] SetEndOfFile (hFile=0x344) returned 1
	[0060.807] CloseHandle (hObject=0x344) returned 1
	[0060.808] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.808] SetEndOfFile (hFile=0x320) returned 1
	[0060.809] CloseHandle (hObject=0x320) returned 1
	[0060.809] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.810] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1
	[0060.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.810] lstrlenW (lpString=".doc") returned 4
	[0060.810] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.810] lstrlenW (lpString=".docx") returned 5
	[0060.810] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.810] lstrlenW (lpString=".pdf") returned 4
	[0060.810] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.810] lstrlenW (lpString=".xls") returned 4
	[0060.810] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.810] lstrlenW (lpString=".xlsx") returned 5
	[0060.810] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.810] lstrlenW (lpString=".ppt") returned 4
	[0060.810] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.810] lstrlenW (lpString=".zip") returned 4
	[0060.810] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.810] lstrlenW (lpString=".rar") returned 4
	[0060.810] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.810] lstrlenW (lpString=".bz2") returned 4
	[0060.811] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.811] lstrlenW (lpString=".7z") returned 3
	[0060.811] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.811] lstrlenW (lpString=".dbf") returned 4
	[0060.811] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.811] lstrlenW (lpString=".1cd") returned 4
	[0060.811] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.811] lstrlenW (lpString=".jpg") returned 4
	[0060.811] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.811] lstrlenW (lpString=".doc") returned 4
	[0060.811] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.811] lstrlenW (lpString=".docx") returned 5
	[0060.811] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.811] lstrlenW (lpString=".pdf") returned 4
	[0060.811] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.811] lstrlenW (lpString=".xls") returned 4
	[0060.811] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.811] lstrlenW (lpString=".xlsx") returned 5
	[0060.811] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.811] lstrlenW (lpString=".ppt") returned 4
	[0060.811] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.811] lstrlenW (lpString=".zip") returned 4
	[0060.811] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.812] lstrlenW (lpString=".rar") returned 4
	[0060.812] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.812] lstrlenW (lpString=".bz2") returned 4
	[0060.812] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.812] lstrlenW (lpString=".7z") returned 3
	[0060.812] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.812] lstrlenW (lpString=".dbf") returned 4
	[0060.812] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.812] lstrlenW (lpString=".1cd") returned 4
	[0060.812] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0060.812] lstrlenW (lpString=".jpg") returned 4
	[0060.812] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.812] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0060.812] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.812] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.812] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=18264) returned 1
	[0060.812] CloseHandle (hObject=0x320) returned 1
	[0060.813] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80
	[0060.813] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.813] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.813] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.813] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.813] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0060.813] GetLastError () returned 0x0
	[0060.813] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0060.815] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0060.816] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.816] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.816] SetEndOfFile (hFile=0x344) returned 1
	[0060.817] CloseHandle (hObject=0x344) returned 1
	[0060.817] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.817] SetEndOfFile (hFile=0x320) returned 1
	[0060.818] CloseHandle (hObject=0x320) returned 1
	[0060.818] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.819] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1
	[0060.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.819] lstrlenW (lpString=".doc") returned 4
	[0060.819] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.819] lstrlenW (lpString=".docx") returned 5
	[0060.819] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.819] lstrlenW (lpString=".pdf") returned 4
	[0060.819] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.819] lstrlenW (lpString=".xls") returned 4
	[0060.819] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.819] lstrlenW (lpString=".xlsx") returned 5
	[0060.819] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.819] lstrlenW (lpString=".ppt") returned 4
	[0060.819] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.820] lstrlenW (lpString=".zip") returned 4
	[0060.820] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.820] lstrlenW (lpString=".rar") returned 4
	[0060.820] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.820] lstrlenW (lpString=".bz2") returned 4
	[0060.820] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.820] lstrlenW (lpString=".7z") returned 3
	[0060.820] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.820] lstrlenW (lpString=".dbf") returned 4
	[0060.820] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.820] lstrlenW (lpString=".1cd") returned 4
	[0060.820] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.820] lstrlenW (lpString=".jpg") returned 4
	[0060.820] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.820] lstrlenW (lpString=".doc") returned 4
	[0060.820] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.820] lstrlenW (lpString=".docx") returned 5
	[0060.820] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.820] lstrlenW (lpString=".pdf") returned 4
	[0060.820] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.820] lstrlenW (lpString=".xls") returned 4
	[0060.820] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.820] lstrlenW (lpString=".xlsx") returned 5
	[0060.820] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.821] lstrlenW (lpString=".ppt") returned 4
	[0060.821] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.821] lstrlenW (lpString=".zip") returned 4
	[0060.821] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.821] lstrlenW (lpString=".rar") returned 4
	[0060.821] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.821] lstrlenW (lpString=".bz2") returned 4
	[0060.821] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.821] lstrlenW (lpString=".7z") returned 3
	[0060.821] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.821] lstrlenW (lpString=".dbf") returned 4
	[0060.821] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.821] lstrlenW (lpString=".1cd") returned 4
	[0060.821] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0060.821] lstrlenW (lpString=".jpg") returned 4
	[0060.821] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.821] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0060.821] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.821] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.822] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=17752) returned 1
	[0060.822] CloseHandle (hObject=0x320) returned 1
	[0060.822] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80
	[0060.822] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.822] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.822] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.822] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.822] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0060.822] GetLastError () returned 0x0
	[0060.822] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x4558, lpOverlapped=0x0) returned 1
	[0060.825] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x4560, lpOverlapped=0x0) returned 1
	[0060.826] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.826] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.826] SetEndOfFile (hFile=0x344) returned 1
	[0060.826] CloseHandle (hObject=0x344) returned 1
	[0060.827] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.827] SetEndOfFile (hFile=0x320) returned 1
	[0060.828] CloseHandle (hObject=0x320) returned 1
	[0060.828] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.829] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1
	[0060.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.829] lstrlenW (lpString=".doc") returned 4
	[0060.829] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.829] lstrlenW (lpString=".docx") returned 5
	[0060.829] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.829] lstrlenW (lpString=".pdf") returned 4
	[0060.829] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.829] lstrlenW (lpString=".xls") returned 4
	[0060.829] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.829] lstrlenW (lpString=".xlsx") returned 5
	[0060.829] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.829] lstrlenW (lpString=".ppt") returned 4
	[0060.829] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.829] lstrlenW (lpString=".zip") returned 4
	[0060.829] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.830] lstrlenW (lpString=".rar") returned 4
	[0060.830] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.830] lstrlenW (lpString=".bz2") returned 4
	[0060.830] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.830] lstrlenW (lpString=".7z") returned 3
	[0060.830] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.830] lstrlenW (lpString=".dbf") returned 4
	[0060.830] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.830] lstrlenW (lpString=".1cd") returned 4
	[0060.830] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.830] lstrlenW (lpString=".jpg") returned 4
	[0060.830] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.830] lstrlenW (lpString=".doc") returned 4
	[0060.830] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.830] lstrlenW (lpString=".docx") returned 5
	[0060.830] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.830] lstrlenW (lpString=".pdf") returned 4
	[0060.830] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.830] lstrlenW (lpString=".xls") returned 4
	[0060.830] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.830] lstrlenW (lpString=".xlsx") returned 5
	[0060.830] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.830] lstrlenW (lpString=".ppt") returned 4
	[0060.830] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.831] lstrlenW (lpString=".zip") returned 4
	[0060.831] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.831] lstrlenW (lpString=".rar") returned 4
	[0060.831] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.831] lstrlenW (lpString=".bz2") returned 4
	[0060.831] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.831] lstrlenW (lpString=".7z") returned 3
	[0060.831] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.831] lstrlenW (lpString=".dbf") returned 4
	[0060.831] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.831] lstrlenW (lpString=".1cd") returned 4
	[0060.831] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0060.831] lstrlenW (lpString=".jpg") returned 4
	[0060.831] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.831] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0060.831] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.831] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.831] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=17752) returned 1
	[0060.832] CloseHandle (hObject=0x320) returned 1
	[0060.832] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80
	[0060.832] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.832] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0060.832] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.832] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.832] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0060.832] GetLastError () returned 0x0
	[0060.832] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x4558, lpOverlapped=0x0) returned 1
	[0061.313] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x4560, lpOverlapped=0x0) returned 1
	[0061.314] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.314] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.314] SetEndOfFile (hFile=0x344) returned 1
	[0061.314] CloseHandle (hObject=0x344) returned 1
	[0061.315] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.315] SetEndOfFile (hFile=0x320) returned 1
	[0061.316] CloseHandle (hObject=0x320) returned 1
	[0061.316] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.316] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1
	[0061.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.317] lstrlenW (lpString=".doc") returned 4
	[0061.317] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.317] lstrlenW (lpString=".docx") returned 5
	[0061.317] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.317] lstrlenW (lpString=".pdf") returned 4
	[0061.317] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.317] lstrlenW (lpString=".xls") returned 4
	[0061.317] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.317] lstrlenW (lpString=".xlsx") returned 5
	[0061.317] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.317] lstrlenW (lpString=".ppt") returned 4
	[0061.317] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.317] lstrlenW (lpString=".zip") returned 4
	[0061.317] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.317] lstrlenW (lpString=".rar") returned 4
	[0061.317] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.317] lstrlenW (lpString=".bz2") returned 4
	[0061.317] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.317] lstrlenW (lpString=".7z") returned 3
	[0061.317] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.318] lstrlenW (lpString=".dbf") returned 4
	[0061.318] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.318] lstrlenW (lpString=".1cd") returned 4
	[0061.318] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.318] lstrlenW (lpString=".jpg") returned 4
	[0061.318] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.318] lstrlenW (lpString=".doc") returned 4
	[0061.318] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.318] lstrlenW (lpString=".docx") returned 5
	[0061.318] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.318] lstrlenW (lpString=".pdf") returned 4
	[0061.318] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.318] lstrlenW (lpString=".xls") returned 4
	[0061.318] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.318] lstrlenW (lpString=".xlsx") returned 5
	[0061.318] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.318] lstrlenW (lpString=".ppt") returned 4
	[0061.318] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.319] lstrlenW (lpString=".zip") returned 4
	[0061.319] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.319] lstrlenW (lpString=".rar") returned 4
	[0061.319] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.319] lstrlenW (lpString=".bz2") returned 4
	[0061.319] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.319] lstrlenW (lpString=".7z") returned 3
	[0061.319] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.319] lstrlenW (lpString=".dbf") returned 4
	[0061.319] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.319] lstrlenW (lpString=".1cd") returned 4
	[0061.319] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0061.319] lstrlenW (lpString=".jpg") returned 4
	[0061.319] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.319] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.319] lstrlenW (lpString="Rotate5.ico") returned 11
	[0061.319] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.320] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=894) returned 1
	[0061.320] CloseHandle (hObject=0x320) returned 1
	[0061.320] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80
	[0061.320] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.320] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.320] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.320] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.320] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0061.320] GetLastError () returned 0x0
	[0061.320] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0061.322] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x380, lpOverlapped=0x0) returned 1
	[0061.323] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.323] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.323] SetEndOfFile (hFile=0x344) returned 1
	[0061.323] CloseHandle (hObject=0x344) returned 1
	[0061.324] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.324] SetEndOfFile (hFile=0x320) returned 1
	[0061.325] CloseHandle (hObject=0x320) returned 1
	[0061.325] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.325] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1
	[0061.326] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.326] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.326] lstrlenW (lpString=".doc") returned 4
	[0061.326] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.326] lstrlenW (lpString=".docx") returned 5
	[0061.326] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1
	[0061.326] lstrlenW (lpString=".pdf") returned 4
	[0061.326] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.326] lstrlenW (lpString=".xls") returned 4
	[0061.326] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.326] lstrlenW (lpString=".xlsx") returned 5
	[0061.326] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1
	[0061.326] lstrlenW (lpString=".ppt") returned 4
	[0061.326] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.326] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.326] lstrlenW (lpString=".zip") returned 4
	[0061.326] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.326] lstrlenW (lpString=".rar") returned 4
	[0061.326] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.326] lstrlenW (lpString=".bz2") returned 4
	[0061.326] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.326] lstrlenW (lpString=".7z") returned 3
	[0061.326] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.326] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.326] lstrlenW (lpString=".dbf") returned 4
	[0061.326] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.326] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.326] lstrlenW (lpString=".1cd") returned 4
	[0061.326] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.326] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.327] lstrlenW (lpString=".jpg") returned 4
	[0061.327] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.327] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.327] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.327] lstrlenW (lpString=".doc") returned 4
	[0061.327] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.327] lstrlenW (lpString=".docx") returned 5
	[0061.327] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1
	[0061.327] lstrlenW (lpString=".pdf") returned 4
	[0061.327] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.327] lstrlenW (lpString=".xls") returned 4
	[0061.327] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.327] lstrlenW (lpString=".xlsx") returned 5
	[0061.327] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1
	[0061.327] lstrlenW (lpString=".ppt") returned 4
	[0061.327] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.327] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.327] lstrlenW (lpString=".zip") returned 4
	[0061.327] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.327] lstrlenW (lpString=".rar") returned 4
	[0061.327] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.327] lstrlenW (lpString=".bz2") returned 4
	[0061.327] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.327] lstrlenW (lpString=".7z") returned 3
	[0061.327] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.327] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.327] lstrlenW (lpString=".dbf") returned 4
	[0061.327] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.327] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.328] lstrlenW (lpString=".1cd") returned 4
	[0061.328] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.328] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0061.328] lstrlenW (lpString=".jpg") returned 4
	[0061.328] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.328] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.328] lstrlenW (lpString="Rotate6.ico") returned 11
	[0061.328] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.328] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=894) returned 1
	[0061.328] CloseHandle (hObject=0x320) returned 1
	[0061.328] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80
	[0061.328] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.328] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.328] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.329] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.329] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0061.329] GetLastError () returned 0x0
	[0061.329] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0061.331] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x380, lpOverlapped=0x0) returned 1
	[0061.332] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.332] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.332] SetEndOfFile (hFile=0x344) returned 1
	[0061.332] CloseHandle (hObject=0x344) returned 1
	[0061.333] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.333] SetEndOfFile (hFile=0x320) returned 1
	[0061.333] CloseHandle (hObject=0x320) returned 1
	[0061.334] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.334] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1
	[0061.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.334] lstrlenW (lpString=".doc") returned 4
	[0061.334] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.334] lstrlenW (lpString=".docx") returned 5
	[0061.334] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1
	[0061.334] lstrlenW (lpString=".pdf") returned 4
	[0061.334] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.334] lstrlenW (lpString=".xls") returned 4
	[0061.334] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.335] lstrlenW (lpString=".xlsx") returned 5
	[0061.335] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1
	[0061.335] lstrlenW (lpString=".ppt") returned 4
	[0061.335] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.335] lstrlenW (lpString=".zip") returned 4
	[0061.335] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.335] lstrlenW (lpString=".rar") returned 4
	[0061.335] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.335] lstrlenW (lpString=".bz2") returned 4
	[0061.335] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.335] lstrlenW (lpString=".7z") returned 3
	[0061.335] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.335] lstrlenW (lpString=".dbf") returned 4
	[0061.335] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.335] lstrlenW (lpString=".1cd") returned 4
	[0061.335] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.335] lstrlenW (lpString=".jpg") returned 4
	[0061.335] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.336] lstrlenW (lpString=".doc") returned 4
	[0061.336] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.336] lstrlenW (lpString=".docx") returned 5
	[0061.336] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1
	[0061.336] lstrlenW (lpString=".pdf") returned 4
	[0061.336] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.336] lstrlenW (lpString=".xls") returned 4
	[0061.336] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.336] lstrlenW (lpString=".xlsx") returned 5
	[0061.336] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1
	[0061.336] lstrlenW (lpString=".ppt") returned 4
	[0061.336] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.336] lstrlenW (lpString=".zip") returned 4
	[0061.336] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.336] lstrlenW (lpString=".rar") returned 4
	[0061.336] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.336] lstrlenW (lpString=".bz2") returned 4
	[0061.336] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.336] lstrlenW (lpString=".7z") returned 3
	[0061.336] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.336] lstrlenW (lpString=".dbf") returned 4
	[0061.337] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.337] lstrlenW (lpString=".1cd") returned 4
	[0061.337] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0061.337] lstrlenW (lpString=".jpg") returned 4
	[0061.337] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.337] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.337] lstrlenW (lpString="Rotate7.ico") returned 11
	[0061.337] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.337] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=894) returned 1
	[0061.337] CloseHandle (hObject=0x320) returned 1
	[0061.337] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80
	[0061.338] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.338] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.338] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.338] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.338] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0061.338] GetLastError () returned 0x0
	[0061.338] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0061.340] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x380, lpOverlapped=0x0) returned 1
	[0061.341] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.341] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.341] SetEndOfFile (hFile=0x344) returned 1
	[0061.341] CloseHandle (hObject=0x344) returned 1
	[0061.342] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.342] SetEndOfFile (hFile=0x320) returned 1
	[0061.343] CloseHandle (hObject=0x320) returned 1
	[0061.343] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.343] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1
	[0061.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.344] lstrlenW (lpString=".doc") returned 4
	[0061.344] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.344] lstrlenW (lpString=".docx") returned 5
	[0061.344] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1
	[0061.344] lstrlenW (lpString=".pdf") returned 4
	[0061.344] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.344] lstrlenW (lpString=".xls") returned 4
	[0061.344] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.344] lstrlenW (lpString=".xlsx") returned 5
	[0061.344] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1
	[0061.344] lstrlenW (lpString=".ppt") returned 4
	[0061.344] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.344] lstrlenW (lpString=".zip") returned 4
	[0061.344] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.344] lstrlenW (lpString=".rar") returned 4
	[0061.344] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.344] lstrlenW (lpString=".bz2") returned 4
	[0061.344] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.344] lstrlenW (lpString=".7z") returned 3
	[0061.344] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.344] lstrlenW (lpString=".dbf") returned 4
	[0061.345] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.345] lstrlenW (lpString=".1cd") returned 4
	[0061.345] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.345] lstrlenW (lpString=".jpg") returned 4
	[0061.345] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.345] lstrlenW (lpString=".doc") returned 4
	[0061.345] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.345] lstrlenW (lpString=".docx") returned 5
	[0061.345] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1
	[0061.345] lstrlenW (lpString=".pdf") returned 4
	[0061.345] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.345] lstrlenW (lpString=".xls") returned 4
	[0061.345] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.345] lstrlenW (lpString=".xlsx") returned 5
	[0061.345] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1
	[0061.345] lstrlenW (lpString=".ppt") returned 4
	[0061.345] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.345] lstrlenW (lpString=".zip") returned 4
	[0061.345] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.345] lstrlenW (lpString=".rar") returned 4
	[0061.345] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.345] lstrlenW (lpString=".bz2") returned 4
	[0061.346] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.346] lstrlenW (lpString=".7z") returned 3
	[0061.346] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.346] lstrlenW (lpString=".dbf") returned 4
	[0061.346] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.346] lstrlenW (lpString=".1cd") returned 4
	[0061.346] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0061.346] lstrlenW (lpString=".jpg") returned 4
	[0061.346] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.346] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.346] lstrlenW (lpString="Rotate8.ico") returned 11
	[0061.346] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0061.745] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=894) returned 1
	[0061.745] CloseHandle (hObject=0x34c) returned 1
	[0061.745] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80
	[0061.745] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.745] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0061.746] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.746] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.746] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.747] GetLastError () returned 0x0
	[0061.747] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0061.748] WriteFile (in: hFile=0x370, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x380, lpOverlapped=0x0) returned 1
	[0061.749] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.749] WriteFile (in: hFile=0x370, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.749] SetEndOfFile (hFile=0x370) returned 1
	[0061.749] CloseHandle (hObject=0x370) returned 1
	[0061.750] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.750] SetEndOfFile (hFile=0x34c) returned 1
	[0061.751] CloseHandle (hObject=0x34c) returned 1
	[0061.751] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.751] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1
	[0061.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.752] lstrlenW (lpString=".doc") returned 4
	[0061.752] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.752] lstrlenW (lpString=".docx") returned 5
	[0061.752] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1
	[0061.752] lstrlenW (lpString=".pdf") returned 4
	[0061.752] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.752] lstrlenW (lpString=".xls") returned 4
	[0061.752] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.752] lstrlenW (lpString=".xlsx") returned 5
	[0061.752] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1
	[0061.752] lstrlenW (lpString=".ppt") returned 4
	[0061.752] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.752] lstrlenW (lpString=".zip") returned 4
	[0061.752] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.752] lstrlenW (lpString=".rar") returned 4
	[0061.752] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.752] lstrlenW (lpString=".bz2") returned 4
	[0061.752] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.752] lstrlenW (lpString=".7z") returned 3
	[0061.753] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.753] lstrlenW (lpString=".dbf") returned 4
	[0061.753] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.753] lstrlenW (lpString=".1cd") returned 4
	[0061.753] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.753] lstrlenW (lpString=".jpg") returned 4
	[0061.753] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.753] lstrlenW (lpString=".doc") returned 4
	[0061.753] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.753] lstrlenW (lpString=".docx") returned 5
	[0061.753] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1
	[0061.753] lstrlenW (lpString=".pdf") returned 4
	[0061.753] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.753] lstrlenW (lpString=".xls") returned 4
	[0061.753] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.753] lstrlenW (lpString=".xlsx") returned 5
	[0061.753] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1
	[0061.753] lstrlenW (lpString=".ppt") returned 4
	[0061.753] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.754] lstrlenW (lpString=".zip") returned 4
	[0061.754] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.754] lstrlenW (lpString=".rar") returned 4
	[0061.754] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.754] lstrlenW (lpString=".bz2") returned 4
	[0061.754] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.754] lstrlenW (lpString=".7z") returned 3
	[0061.754] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.754] lstrlenW (lpString=".dbf") returned 4
	[0061.754] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.754] lstrlenW (lpString=".1cd") returned 4
	[0061.754] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0061.754] lstrlenW (lpString=".jpg") returned 4
	[0061.754] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.754] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.754] lstrlenW (lpString="stop.ico") returned 8
	[0061.754] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0061.755] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=10134) returned 1
	[0061.755] CloseHandle (hObject=0x34c) returned 1
	[0061.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80
	[0061.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0061.755] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.755] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.755] GetLastError () returned 0x0
	[0061.755] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x2796, lpOverlapped=0x0) returned 1
	[0061.757] WriteFile (in: hFile=0x370, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x27a0, lpOverlapped=0x0) returned 1
	[0061.758] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.758] WriteFile (in: hFile=0x370, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0061.758] SetEndOfFile (hFile=0x370) returned 1
	[0061.758] CloseHandle (hObject=0x370) returned 1
	[0061.762] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.762] SetEndOfFile (hFile=0x34c) returned 1
	[0061.763] CloseHandle (hObject=0x34c) returned 1
	[0061.763] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.763] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1
	[0061.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.763] lstrlenW (lpString=".doc") returned 4
	[0061.763] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.763] lstrlenW (lpString=".docx") returned 5
	[0061.763] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0061.763] lstrlenW (lpString=".pdf") returned 4
	[0061.763] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.763] lstrlenW (lpString=".xls") returned 4
	[0061.763] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.764] lstrlenW (lpString=".xlsx") returned 5
	[0061.764] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0061.764] lstrlenW (lpString=".ppt") returned 4
	[0061.764] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.764] lstrlenW (lpString=".zip") returned 4
	[0061.764] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.764] lstrlenW (lpString=".rar") returned 4
	[0061.764] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.764] lstrlenW (lpString=".bz2") returned 4
	[0061.764] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.764] lstrlenW (lpString=".7z") returned 3
	[0061.764] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.764] lstrlenW (lpString=".dbf") returned 4
	[0061.764] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.764] lstrlenW (lpString=".1cd") returned 4
	[0061.764] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.764] lstrlenW (lpString=".jpg") returned 4
	[0061.764] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.764] lstrlenW (lpString=".doc") returned 4
	[0061.765] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.765] lstrlenW (lpString=".docx") returned 5
	[0061.765] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0061.765] lstrlenW (lpString=".pdf") returned 4
	[0061.765] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.765] lstrlenW (lpString=".xls") returned 4
	[0061.765] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.765] lstrlenW (lpString=".xlsx") returned 5
	[0061.765] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0061.765] lstrlenW (lpString=".ppt") returned 4
	[0061.765] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.765] lstrlenW (lpString=".zip") returned 4
	[0061.765] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.765] lstrlenW (lpString=".rar") returned 4
	[0061.765] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.765] lstrlenW (lpString=".bz2") returned 4
	[0061.765] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.765] lstrlenW (lpString=".7z") returned 3
	[0061.765] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.765] lstrlenW (lpString=".dbf") returned 4
	[0061.765] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.766] lstrlenW (lpString=".1cd") returned 4
	[0061.766] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0061.766] lstrlenW (lpString=".jpg") returned 4
	[0061.766] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.766] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.766] lstrlenW (lpString="SysReqMet.ico") returned 13
	[0061.766] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0061.767] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=1150) returned 1
	[0061.767] CloseHandle (hObject=0x34c) returned 1
	[0061.767] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80
	[0061.767] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.767] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0061.767] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.767] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.767] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.767] GetLastError () returned 0x0
	[0061.767] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x47e, lpOverlapped=0x0) returned 1
	[0061.769] WriteFile (in: hFile=0x370, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x480, lpOverlapped=0x0) returned 1
	[0061.771] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.771] WriteFile (in: hFile=0x370, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xee, lpOverlapped=0x0) returned 1
	[0061.771] SetEndOfFile (hFile=0x370) returned 1
	[0061.771] CloseHandle (hObject=0x370) returned 1
	[0061.772] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.772] SetEndOfFile (hFile=0x34c) returned 1
	[0061.773] CloseHandle (hObject=0x34c) returned 1
	[0061.773] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.773] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1
	[0061.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.774] lstrlenW (lpString=".doc") returned 4
	[0061.774] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.774] lstrlenW (lpString=".docx") returned 5
	[0061.774] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0061.774] lstrlenW (lpString=".pdf") returned 4
	[0061.774] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.774] lstrlenW (lpString=".xls") returned 4
	[0061.774] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.774] lstrlenW (lpString=".xlsx") returned 5
	[0061.774] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0061.774] lstrlenW (lpString=".ppt") returned 4
	[0061.774] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.774] lstrlenW (lpString=".zip") returned 4
	[0061.774] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.774] lstrlenW (lpString=".rar") returned 4
	[0061.774] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.774] lstrlenW (lpString=".bz2") returned 4
	[0061.774] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.775] lstrlenW (lpString=".7z") returned 3
	[0061.775] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.775] lstrlenW (lpString=".dbf") returned 4
	[0061.775] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.775] lstrlenW (lpString=".1cd") returned 4
	[0061.775] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.775] lstrlenW (lpString=".jpg") returned 4
	[0061.775] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.775] lstrlenW (lpString=".doc") returned 4
	[0061.775] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.775] lstrlenW (lpString=".docx") returned 5
	[0061.775] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0061.775] lstrlenW (lpString=".pdf") returned 4
	[0061.775] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.775] lstrlenW (lpString=".xls") returned 4
	[0061.776] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.776] lstrlenW (lpString=".xlsx") returned 5
	[0061.776] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0061.776] lstrlenW (lpString=".ppt") returned 4
	[0061.776] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.776] lstrlenW (lpString=".zip") returned 4
	[0061.776] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.776] lstrlenW (lpString=".rar") returned 4
	[0061.776] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.776] lstrlenW (lpString=".bz2") returned 4
	[0061.776] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.776] lstrlenW (lpString=".7z") returned 3
	[0061.776] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.776] lstrlenW (lpString=".dbf") returned 4
	[0061.776] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.776] lstrlenW (lpString=".1cd") returned 4
	[0061.776] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0061.776] lstrlenW (lpString=".jpg") returned 4
	[0061.777] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.777] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.777] lstrlenW (lpString="SysReqNotMet.ico") returned 16
	[0061.777] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0061.777] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=1150) returned 1
	[0061.777] CloseHandle (hObject=0x34c) returned 1
	[0061.777] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80
	[0061.777] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.777] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0061.778] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.778] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0061.778] GetLastError () returned 0x0
	[0061.778] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x47e, lpOverlapped=0x0) returned 1
	[0062.162] WriteFile (in: hFile=0x370, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x480, lpOverlapped=0x0) returned 1
	[0062.163] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.163] WriteFile (in: hFile=0x370, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0062.164] SetEndOfFile (hFile=0x370) returned 1
	[0062.164] CloseHandle (hObject=0x370) returned 1
	[0062.165] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.165] SetEndOfFile (hFile=0x34c) returned 1
	[0062.166] CloseHandle (hObject=0x34c) returned 1
	[0062.166] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0062.166] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1
	[0062.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.167] lstrlenW (lpString=".doc") returned 4
	[0062.167] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.167] lstrlenW (lpString=".docx") returned 5
	[0062.167] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0062.167] lstrlenW (lpString=".pdf") returned 4
	[0062.167] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.167] lstrlenW (lpString=".xls") returned 4
	[0062.167] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.167] lstrlenW (lpString=".xlsx") returned 5
	[0062.167] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0062.167] lstrlenW (lpString=".ppt") returned 4
	[0062.167] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.167] lstrlenW (lpString=".zip") returned 4
	[0062.167] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.167] lstrlenW (lpString=".rar") returned 4
	[0062.167] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.167] lstrlenW (lpString=".bz2") returned 4
	[0062.167] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.167] lstrlenW (lpString=".7z") returned 3
	[0062.167] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.167] lstrlenW (lpString=".dbf") returned 4
	[0062.167] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.168] lstrlenW (lpString=".1cd") returned 4
	[0062.168] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.168] lstrlenW (lpString=".jpg") returned 4
	[0062.168] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.168] lstrlenW (lpString=".doc") returned 4
	[0062.168] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.168] lstrlenW (lpString=".docx") returned 5
	[0062.168] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0062.168] lstrlenW (lpString=".pdf") returned 4
	[0062.168] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.168] lstrlenW (lpString=".xls") returned 4
	[0062.168] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.168] lstrlenW (lpString=".xlsx") returned 5
	[0062.168] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0062.168] lstrlenW (lpString=".ppt") returned 4
	[0062.168] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.168] lstrlenW (lpString=".zip") returned 4
	[0062.168] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.168] lstrlenW (lpString=".rar") returned 4
	[0062.168] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.168] lstrlenW (lpString=".bz2") returned 4
	[0062.169] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.169] lstrlenW (lpString=".7z") returned 3
	[0062.169] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.169] lstrlenW (lpString=".dbf") returned 4
	[0062.169] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.169] lstrlenW (lpString=".1cd") returned 4
	[0062.169] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.169] lstrlenW (lpString=".jpg") returned 4
	[0062.169] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.169] lstrcmpiW (lpString1=".mzz", lpString2=".money") returned 1
	[0062.169] lstrlenW (lpString="netfx_Extended.mzz") returned 18
	[0062.169] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0062.169] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=43131591) returned 1
	[0062.169] CloseHandle (hObject=0x34c) returned 1
	[0062.170] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20
	[0062.170] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0062.170] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[admin@stex777.com].money")) returned 1
	[0062.170] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0062.170] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc64 | out: lpNewFilePointer=0x0) returned 1
	[0062.170] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0062.170] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x40d7058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0062.176] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0062.176] ReadFile (in: hFile=0x34c, lpBuffer=0x4117058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x4117058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0062.180] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b1fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0062.180] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0062.180] ReadFile (in: hFile=0x34c, lpBuffer=0x4157058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x4157058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0062.198] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.198] WriteFile (in: hFile=0x34c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x3b1fca8, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fca8*=0xc0110, lpOverlapped=0x0) returned 1
	[0062.814] SetEndOfFile (hFile=0x34c) returned 1
	[0062.895] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x42c85a8
	[0062.900] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0062.900] WriteFile (in: hFile=0x34c, lpBuffer=0x42c85a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c85a8*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0062.901] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0062.901] WriteFile (in: hFile=0x34c, lpBuffer=0x42c85a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c85a8*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0062.902] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0062.902] WriteFile (in: hFile=0x34c, lpBuffer=0x42c85a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c85a8*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0062.903] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c85a8 | out: hHeap=0x600000) returned 1
	[0062.903] CloseHandle (hObject=0x34c) returned 1
	[0066.025] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0066.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.026] lstrlenW (lpString=".doc") returned 4
	[0066.026] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0066.026] lstrlenW (lpString=".docx") returned 5
	[0066.026] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1
	[0066.026] lstrlenW (lpString=".pdf") returned 4
	[0066.026] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0066.026] lstrlenW (lpString=".xls") returned 4
	[0066.026] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0066.026] lstrlenW (lpString=".xlsx") returned 5
	[0066.026] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1
	[0066.026] lstrlenW (lpString=".ppt") returned 4
	[0066.026] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0066.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.026] lstrlenW (lpString=".zip") returned 4
	[0066.026] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0066.026] lstrlenW (lpString=".rar") returned 4
	[0066.026] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0066.026] lstrlenW (lpString=".bz2") returned 4
	[0066.026] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0066.026] lstrlenW (lpString=".7z") returned 3
	[0066.026] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0066.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.026] lstrlenW (lpString=".dbf") returned 4
	[0066.026] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0066.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.027] lstrlenW (lpString=".1cd") returned 4
	[0066.027] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0066.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.027] lstrlenW (lpString=".jpg") returned 4
	[0066.027] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0066.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.027] lstrlenW (lpString=".doc") returned 4
	[0066.027] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0066.027] lstrlenW (lpString=".docx") returned 5
	[0066.027] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1
	[0066.027] lstrlenW (lpString=".pdf") returned 4
	[0066.027] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0066.027] lstrlenW (lpString=".xls") returned 4
	[0066.027] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0066.027] lstrlenW (lpString=".xlsx") returned 5
	[0066.027] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1
	[0066.027] lstrlenW (lpString=".ppt") returned 4
	[0066.027] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0066.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.027] lstrlenW (lpString=".zip") returned 4
	[0066.027] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0066.028] lstrlenW (lpString=".rar") returned 4
	[0066.028] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0066.028] lstrlenW (lpString=".bz2") returned 4
	[0066.028] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0066.028] lstrlenW (lpString=".7z") returned 3
	[0066.028] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0066.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.028] lstrlenW (lpString=".dbf") returned 4
	[0066.028] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0066.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.028] lstrlenW (lpString=".1cd") returned 4
	[0066.028] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0066.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0066.028] lstrlenW (lpString=".jpg") returned 4
	[0066.028] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0066.028] lstrcmpiW (lpString1=".msu", lpString2=".money") returned 1
	[0066.028] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33
	[0066.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0066.029] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=2141433) returned 1
	[0066.029] CloseHandle (hObject=0x34c) returned 1
	[0066.029] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80
	[0066.029] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0066.029] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[admin@stex777.com].money")) returned 1
	[0066.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0066.029] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc64 | out: lpNewFilePointer=0x0) returned 1
	[0066.030] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0066.030] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x40d7058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0066.034] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0066.034] ReadFile (in: hFile=0x34c, lpBuffer=0x4117058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x4117058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0066.038] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b1fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0066.038] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0066.038] ReadFile (in: hFile=0x34c, lpBuffer=0x4157058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x4157058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0066.061] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.062] WriteFile (in: hFile=0x34c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x3b1fca8, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0066.565] SetEndOfFile (hFile=0x34c) returned 1
	[0066.565] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x42c45a0
	[0066.570] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0066.571] WriteFile (in: hFile=0x34c, lpBuffer=0x42c45a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c45a0*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0066.572] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0066.572] WriteFile (in: hFile=0x34c, lpBuffer=0x42c45a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c45a0*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0066.574] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0066.574] WriteFile (in: hFile=0x34c, lpBuffer=0x42c45a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42c45a0*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0066.576] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c45a0 | out: hHeap=0x600000) returned 1
	[0066.577] CloseHandle (hObject=0x34c) returned 1
	[0067.516] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0067.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.516] lstrlenW (lpString=".doc") returned 4
	[0067.516] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0067.517] lstrlenW (lpString=".docx") returned 5
	[0067.517] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0067.517] lstrlenW (lpString=".pdf") returned 4
	[0067.517] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0067.517] lstrlenW (lpString=".xls") returned 4
	[0067.517] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0067.517] lstrlenW (lpString=".xlsx") returned 5
	[0067.517] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0067.517] lstrlenW (lpString=".ppt") returned 4
	[0067.517] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0067.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.517] lstrlenW (lpString=".zip") returned 4
	[0067.517] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0067.517] lstrlenW (lpString=".rar") returned 4
	[0067.517] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0067.517] lstrlenW (lpString=".bz2") returned 4
	[0067.517] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0067.517] lstrlenW (lpString=".7z") returned 3
	[0067.517] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0067.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.517] lstrlenW (lpString=".dbf") returned 4
	[0067.517] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0067.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.517] lstrlenW (lpString=".1cd") returned 4
	[0067.518] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0067.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.518] lstrlenW (lpString=".jpg") returned 4
	[0067.518] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0067.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.518] lstrlenW (lpString=".doc") returned 4
	[0067.518] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0067.518] lstrlenW (lpString=".docx") returned 5
	[0067.518] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0067.518] lstrlenW (lpString=".pdf") returned 4
	[0067.518] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0067.518] lstrlenW (lpString=".xls") returned 4
	[0067.518] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0067.518] lstrlenW (lpString=".xlsx") returned 5
	[0067.518] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0067.518] lstrlenW (lpString=".ppt") returned 4
	[0067.518] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0067.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.518] lstrlenW (lpString=".zip") returned 4
	[0067.518] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0067.518] lstrlenW (lpString=".rar") returned 4
	[0067.519] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0067.519] lstrlenW (lpString=".bz2") returned 4
	[0067.519] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0067.519] lstrlenW (lpString=".7z") returned 3
	[0067.519] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0067.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.519] lstrlenW (lpString=".dbf") returned 4
	[0067.519] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0067.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.519] lstrlenW (lpString=".1cd") returned 4
	[0067.519] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0067.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0067.519] lstrlenW (lpString=".jpg") returned 4
	[0067.519] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0067.519] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0067.519] lstrlenW (lpString="HardwareEvents.evtx") returned 19
	[0067.519] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.853] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0067.853] CloseHandle (hObject=0x318) returned 1
	[0067.853] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20
	[0067.853] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.853] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.854] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.854] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.854] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0067.854] GetLastError () returned 0x0
	[0067.854] ReadFile (in: hFile=0x318, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0067.857] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0067.858] ReadFile (in: hFile=0x318, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.859] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0067.859] SetEndOfFile (hFile=0x384) returned 1
	[0067.859] CloseHandle (hObject=0x384) returned 1
	[0067.861] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.861] SetEndOfFile (hFile=0x318) returned 1
	[0067.862] CloseHandle (hObject=0x318) returned 1
	[0067.862] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0067.863] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1
	[0067.863] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.863] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.863] lstrlenW (lpString=".doc") returned 4
	[0067.863] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0067.863] lstrlenW (lpString=".docx") returned 5
	[0067.863] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0067.863] lstrlenW (lpString=".pdf") returned 4
	[0067.863] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0067.863] lstrlenW (lpString=".xls") returned 4
	[0067.863] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0067.863] lstrlenW (lpString=".xlsx") returned 5
	[0067.863] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0067.863] lstrlenW (lpString=".ppt") returned 4
	[0067.863] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0067.863] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.863] lstrlenW (lpString=".zip") returned 4
	[0067.864] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0067.864] lstrlenW (lpString=".rar") returned 4
	[0067.864] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0067.864] lstrlenW (lpString=".bz2") returned 4
	[0067.864] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0067.864] lstrlenW (lpString=".7z") returned 3
	[0067.864] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0067.864] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.864] lstrlenW (lpString=".dbf") returned 4
	[0067.864] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0067.864] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.864] lstrlenW (lpString=".1cd") returned 4
	[0067.864] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0067.864] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.864] lstrlenW (lpString=".jpg") returned 4
	[0067.864] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0067.865] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.865] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.865] lstrlenW (lpString=".doc") returned 4
	[0067.865] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0067.865] lstrlenW (lpString=".docx") returned 5
	[0067.865] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0067.865] lstrlenW (lpString=".pdf") returned 4
	[0067.865] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0067.865] lstrlenW (lpString=".xls") returned 4
	[0067.865] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0067.865] lstrlenW (lpString=".xlsx") returned 5
	[0067.865] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0067.865] lstrlenW (lpString=".ppt") returned 4
	[0067.865] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0067.865] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.865] lstrlenW (lpString=".zip") returned 4
	[0067.865] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0067.865] lstrlenW (lpString=".rar") returned 4
	[0067.865] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0067.865] lstrlenW (lpString=".bz2") returned 4
	[0067.865] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0067.865] lstrlenW (lpString=".7z") returned 3
	[0067.865] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0067.865] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.865] lstrlenW (lpString=".dbf") returned 4
	[0067.865] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0067.865] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.865] lstrlenW (lpString=".1cd") returned 4
	[0067.865] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0067.865] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0067.866] lstrlenW (lpString=".jpg") returned 4
	[0067.866] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0067.866] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0067.866] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47
	[0067.866] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.866] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0067.866] CloseHandle (hObject=0x318) returned 1
	[0067.866] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20
	[0067.866] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.867] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.867] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.867] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.867] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0067.867] GetLastError () returned 0x0
	[0067.867] ReadFile (in: hFile=0x318, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0067.869] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0067.871] ReadFile (in: hFile=0x318, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.871] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x132, lpOverlapped=0x0) returned 1
	[0067.871] SetEndOfFile (hFile=0x384) returned 1
	[0067.872] CloseHandle (hObject=0x384) returned 1
	[0067.874] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.874] SetEndOfFile (hFile=0x318) returned 1
	[0067.875] CloseHandle (hObject=0x318) returned 1
	[0067.875] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0067.875] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1
	[0067.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.876] lstrlenW (lpString=".doc") returned 4
	[0067.876] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0067.876] lstrlenW (lpString=".docx") returned 5
	[0067.877] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0067.877] lstrlenW (lpString=".pdf") returned 4
	[0067.877] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0067.877] lstrlenW (lpString=".xls") returned 4
	[0067.877] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0067.877] lstrlenW (lpString=".xlsx") returned 5
	[0067.877] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0067.877] lstrlenW (lpString=".ppt") returned 4
	[0067.877] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0067.877] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.877] lstrlenW (lpString=".zip") returned 4
	[0067.877] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0067.877] lstrlenW (lpString=".rar") returned 4
	[0067.877] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0067.877] lstrlenW (lpString=".bz2") returned 4
	[0067.877] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0067.877] lstrlenW (lpString=".7z") returned 3
	[0067.877] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0067.877] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.877] lstrlenW (lpString=".dbf") returned 4
	[0067.877] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0067.878] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.878] lstrlenW (lpString=".1cd") returned 4
	[0067.878] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0067.878] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.878] lstrlenW (lpString=".jpg") returned 4
	[0067.878] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0067.878] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.878] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.878] lstrlenW (lpString=".doc") returned 4
	[0067.878] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0067.878] lstrlenW (lpString=".docx") returned 5
	[0067.878] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0067.878] lstrlenW (lpString=".pdf") returned 4
	[0067.878] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0067.878] lstrlenW (lpString=".xls") returned 4
	[0067.878] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0067.878] lstrlenW (lpString=".xlsx") returned 5
	[0067.878] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0067.878] lstrlenW (lpString=".ppt") returned 4
	[0067.878] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0067.878] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.879] lstrlenW (lpString=".zip") returned 4
	[0067.879] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0067.879] lstrlenW (lpString=".rar") returned 4
	[0067.879] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0067.879] lstrlenW (lpString=".bz2") returned 4
	[0067.879] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0067.879] lstrlenW (lpString=".7z") returned 3
	[0067.879] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0067.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.879] lstrlenW (lpString=".dbf") returned 4
	[0067.879] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0067.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.879] lstrlenW (lpString=".1cd") returned 4
	[0067.879] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0067.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0067.879] lstrlenW (lpString=".jpg") returned 4
	[0067.879] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0067.880] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0067.880] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78
	[0067.880] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.881] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0067.881] CloseHandle (hObject=0x318) returned 1
	[0067.881] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20
	[0067.881] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.881] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0067.881] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.882] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.882] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0067.882] GetLastError () returned 0x0
	[0067.882] ReadFile (in: hFile=0x318, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0067.885] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0067.887] ReadFile (in: hFile=0x318, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.887] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x170, lpOverlapped=0x0) returned 1
	[0067.888] SetEndOfFile (hFile=0x384) returned 1
	[0067.888] CloseHandle (hObject=0x384) returned 1
	[0067.890] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.890] SetEndOfFile (hFile=0x318) returned 1
	[0067.891] CloseHandle (hObject=0x318) returned 1
	[0067.891] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0067.891] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1
	[0067.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.892] lstrlenW (lpString=".doc") returned 4
	[0067.892] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0067.892] lstrlenW (lpString=".docx") returned 5
	[0067.892] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0067.892] lstrlenW (lpString=".pdf") returned 4
	[0067.892] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0067.892] lstrlenW (lpString=".xls") returned 4
	[0067.892] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0067.892] lstrlenW (lpString=".xlsx") returned 5
	[0067.892] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0067.892] lstrlenW (lpString=".ppt") returned 4
	[0067.892] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0067.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.892] lstrlenW (lpString=".zip") returned 4
	[0067.892] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0067.892] lstrlenW (lpString=".rar") returned 4
	[0067.892] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0067.892] lstrlenW (lpString=".bz2") returned 4
	[0067.892] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0067.892] lstrlenW (lpString=".7z") returned 3
	[0067.893] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0067.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.893] lstrlenW (lpString=".dbf") returned 4
	[0067.893] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0067.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.893] lstrlenW (lpString=".1cd") returned 4
	[0067.893] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0067.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.893] lstrlenW (lpString=".jpg") returned 4
	[0067.893] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0067.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.893] lstrlenW (lpString=".doc") returned 4
	[0067.893] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0067.893] lstrlenW (lpString=".docx") returned 5
	[0067.893] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0067.893] lstrlenW (lpString=".pdf") returned 4
	[0067.893] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0067.893] lstrlenW (lpString=".xls") returned 4
	[0067.893] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0067.894] lstrlenW (lpString=".xlsx") returned 5
	[0067.894] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0067.894] lstrlenW (lpString=".ppt") returned 4
	[0067.894] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0067.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.894] lstrlenW (lpString=".zip") returned 4
	[0067.894] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0067.894] lstrlenW (lpString=".rar") returned 4
	[0067.894] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0067.894] lstrlenW (lpString=".bz2") returned 4
	[0067.894] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0067.894] lstrlenW (lpString=".7z") returned 3
	[0067.894] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0067.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.894] lstrlenW (lpString=".dbf") returned 4
	[0067.894] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0067.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.894] lstrlenW (lpString=".1cd") returned 4
	[0067.894] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0067.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0067.894] lstrlenW (lpString=".jpg") returned 4
	[0067.894] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0067.895] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0067.895] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71
	[0067.895] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0068.176] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=1052672) returned 1
	[0068.189] CloseHandle (hObject=0x350) returned 1
	[0068.189] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20
	[0068.189] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.189] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0068.189] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.189] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.189] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0069.067] GetLastError () returned 0x0
	[0069.067] ReadFile (in: hFile=0x350, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0069.098] WriteFile (in: hFile=0x388, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0069.148] ReadFile (in: hFile=0x350, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0069.447] WriteFile (in: hFile=0x388, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0069.451] ReadFile (in: hFile=0x350, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.451] WriteFile (in: hFile=0x388, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x162, lpOverlapped=0x0) returned 1
	[0069.451] SetEndOfFile (hFile=0x388) returned 1
	[0069.603] CloseHandle (hObject=0x388) returned 1
	[0069.627] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.627] SetEndOfFile (hFile=0x350) returned 1
	[0069.628] CloseHandle (hObject=0x350) returned 1
	[0069.628] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.629] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1
	[0069.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.629] lstrlenW (lpString=".doc") returned 4
	[0069.629] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.629] lstrlenW (lpString=".docx") returned 5
	[0069.629] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.629] lstrlenW (lpString=".pdf") returned 4
	[0069.629] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.629] lstrlenW (lpString=".xls") returned 4
	[0069.629] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.629] lstrlenW (lpString=".xlsx") returned 5
	[0069.629] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.629] lstrlenW (lpString=".ppt") returned 4
	[0069.629] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.629] lstrlenW (lpString=".zip") returned 4
	[0069.629] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.629] lstrlenW (lpString=".rar") returned 4
	[0069.629] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.630] lstrlenW (lpString=".bz2") returned 4
	[0069.630] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.630] lstrlenW (lpString=".7z") returned 3
	[0069.630] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.630] lstrlenW (lpString=".dbf") returned 4
	[0069.630] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.630] lstrlenW (lpString=".1cd") returned 4
	[0069.630] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.630] lstrlenW (lpString=".jpg") returned 4
	[0069.630] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.630] lstrlenW (lpString=".doc") returned 4
	[0069.630] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.630] lstrlenW (lpString=".docx") returned 5
	[0069.630] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.630] lstrlenW (lpString=".pdf") returned 4
	[0069.630] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.630] lstrlenW (lpString=".xls") returned 4
	[0069.630] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.630] lstrlenW (lpString=".xlsx") returned 5
	[0069.630] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.630] lstrlenW (lpString=".ppt") returned 4
	[0069.630] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.630] lstrlenW (lpString=".zip") returned 4
	[0069.630] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.631] lstrlenW (lpString=".rar") returned 4
	[0069.631] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.631] lstrlenW (lpString=".bz2") returned 4
	[0069.631] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.631] lstrlenW (lpString=".7z") returned 3
	[0069.631] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.631] lstrlenW (lpString=".dbf") returned 4
	[0069.631] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.631] lstrlenW (lpString=".1cd") returned 4
	[0069.631] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0069.631] lstrlenW (lpString=".jpg") returned 4
	[0069.631] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.631] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0069.631] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48
	[0069.631] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0069.632] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0069.632] CloseHandle (hObject=0x350) returned 1
	[0069.632] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20
	[0069.632] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.632] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0069.632] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.632] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.632] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0069.632] GetLastError () returned 0x0
	[0069.632] ReadFile (in: hFile=0x350, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0069.635] WriteFile (in: hFile=0x388, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0069.637] ReadFile (in: hFile=0x350, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.637] WriteFile (in: hFile=0x388, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x134, lpOverlapped=0x0) returned 1
	[0069.638] SetEndOfFile (hFile=0x388) returned 1
	[0069.638] CloseHandle (hObject=0x388) returned 1
	[0069.640] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.640] SetEndOfFile (hFile=0x350) returned 1
	[0069.641] CloseHandle (hObject=0x350) returned 1
	[0069.641] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.641] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1
	[0069.642] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.642] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.642] lstrlenW (lpString=".doc") returned 4
	[0069.642] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.642] lstrlenW (lpString=".docx") returned 5
	[0069.642] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.642] lstrlenW (lpString=".pdf") returned 4
	[0069.642] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.642] lstrlenW (lpString=".xls") returned 4
	[0069.642] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.642] lstrlenW (lpString=".xlsx") returned 5
	[0069.642] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.642] lstrlenW (lpString=".ppt") returned 4
	[0069.642] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.642] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.642] lstrlenW (lpString=".zip") returned 4
	[0069.642] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.642] lstrlenW (lpString=".rar") returned 4
	[0069.642] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.642] lstrlenW (lpString=".bz2") returned 4
	[0069.642] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.642] lstrlenW (lpString=".7z") returned 3
	[0069.642] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.642] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.642] lstrlenW (lpString=".dbf") returned 4
	[0069.642] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.642] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.642] lstrlenW (lpString=".1cd") returned 4
	[0069.642] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.643] lstrlenW (lpString=".jpg") returned 4
	[0069.643] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.643] lstrlenW (lpString=".doc") returned 4
	[0069.643] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.643] lstrlenW (lpString=".docx") returned 5
	[0069.643] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.643] lstrlenW (lpString=".pdf") returned 4
	[0069.643] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.643] lstrlenW (lpString=".xls") returned 4
	[0069.643] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.643] lstrlenW (lpString=".xlsx") returned 5
	[0069.643] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.643] lstrlenW (lpString=".ppt") returned 4
	[0069.643] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.643] lstrlenW (lpString=".zip") returned 4
	[0069.643] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.643] lstrlenW (lpString=".rar") returned 4
	[0069.643] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.643] lstrlenW (lpString=".bz2") returned 4
	[0069.643] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.643] lstrlenW (lpString=".7z") returned 3
	[0069.643] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.644] lstrlenW (lpString=".dbf") returned 4
	[0069.644] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.644] lstrlenW (lpString=".1cd") returned 4
	[0069.644] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0069.644] lstrlenW (lpString=".jpg") returned 4
	[0069.644] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.644] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0069.644] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54
	[0069.644] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0069.644] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0069.644] CloseHandle (hObject=0x350) returned 1
	[0069.644] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20
	[0069.644] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.645] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0069.645] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.645] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.645] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0069.645] GetLastError () returned 0x0
	[0069.645] ReadFile (in: hFile=0x350, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0069.932] WriteFile (in: hFile=0x388, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0069.934] ReadFile (in: hFile=0x350, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.934] WriteFile (in: hFile=0x388, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x140, lpOverlapped=0x0) returned 1
	[0069.934] SetEndOfFile (hFile=0x388) returned 1
	[0069.945] CloseHandle (hObject=0x388) returned 1
	[0069.948] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.948] SetEndOfFile (hFile=0x350) returned 1
	[0069.949] CloseHandle (hObject=0x350) returned 1
	[0069.949] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.949] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1
	[0070.463] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.463] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.463] lstrlenW (lpString=".doc") returned 4
	[0070.463] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.463] lstrlenW (lpString=".docx") returned 5
	[0070.463] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.464] lstrlenW (lpString=".pdf") returned 4
	[0070.464] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.464] lstrlenW (lpString=".xls") returned 4
	[0070.464] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.464] lstrlenW (lpString=".xlsx") returned 5
	[0070.464] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.464] lstrlenW (lpString=".ppt") returned 4
	[0070.464] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.464] lstrlenW (lpString=".zip") returned 4
	[0070.464] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.464] lstrlenW (lpString=".rar") returned 4
	[0070.464] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.464] lstrlenW (lpString=".bz2") returned 4
	[0070.464] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.464] lstrlenW (lpString=".7z") returned 3
	[0070.464] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.464] lstrlenW (lpString=".dbf") returned 4
	[0070.464] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.464] lstrlenW (lpString=".1cd") returned 4
	[0070.464] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.464] lstrlenW (lpString=".jpg") returned 4
	[0070.464] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.465] lstrlenW (lpString=".doc") returned 4
	[0070.465] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.465] lstrlenW (lpString=".docx") returned 5
	[0070.465] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.465] lstrlenW (lpString=".pdf") returned 4
	[0070.465] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.465] lstrlenW (lpString=".xls") returned 4
	[0070.465] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.465] lstrlenW (lpString=".xlsx") returned 5
	[0070.465] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.465] lstrlenW (lpString=".ppt") returned 4
	[0070.465] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.465] lstrlenW (lpString=".zip") returned 4
	[0070.465] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.465] lstrlenW (lpString=".rar") returned 4
	[0070.465] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.465] lstrlenW (lpString=".bz2") returned 4
	[0070.465] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.465] lstrlenW (lpString=".7z") returned 3
	[0070.465] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.465] lstrlenW (lpString=".dbf") returned 4
	[0070.466] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.466] lstrlenW (lpString=".1cd") returned 4
	[0070.466] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0070.466] lstrlenW (lpString=".jpg") returned 4
	[0070.466] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.467] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0070.467] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59
	[0070.467] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.467] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0070.467] CloseHandle (hObject=0x388) returned 1
	[0070.467] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20
	[0070.467] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.468] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.468] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.468] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.468] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0070.469] GetLastError () returned 0x0
	[0070.469] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0070.471] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0070.473] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.473] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x14a, lpOverlapped=0x0) returned 1
	[0070.474] SetEndOfFile (hFile=0x368) returned 1
	[0070.474] CloseHandle (hObject=0x368) returned 1
	[0070.476] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.476] SetEndOfFile (hFile=0x388) returned 1
	[0070.477] CloseHandle (hObject=0x388) returned 1
	[0070.477] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0070.478] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1
	[0070.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.478] lstrlenW (lpString=".doc") returned 4
	[0070.478] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.478] lstrlenW (lpString=".docx") returned 5
	[0070.478] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.478] lstrlenW (lpString=".pdf") returned 4
	[0070.478] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.478] lstrlenW (lpString=".xls") returned 4
	[0070.479] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.479] lstrlenW (lpString=".xlsx") returned 5
	[0070.479] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.479] lstrlenW (lpString=".ppt") returned 4
	[0070.479] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.479] lstrlenW (lpString=".zip") returned 4
	[0070.479] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.479] lstrlenW (lpString=".rar") returned 4
	[0070.479] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.479] lstrlenW (lpString=".bz2") returned 4
	[0070.479] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.479] lstrlenW (lpString=".7z") returned 3
	[0070.479] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.479] lstrlenW (lpString=".dbf") returned 4
	[0070.479] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.479] lstrlenW (lpString=".1cd") returned 4
	[0070.479] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.479] lstrlenW (lpString=".jpg") returned 4
	[0070.479] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.479] lstrlenW (lpString=".doc") returned 4
	[0070.479] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.479] lstrlenW (lpString=".docx") returned 5
	[0070.480] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.480] lstrlenW (lpString=".pdf") returned 4
	[0070.480] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.480] lstrlenW (lpString=".xls") returned 4
	[0070.480] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.480] lstrlenW (lpString=".xlsx") returned 5
	[0070.480] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.480] lstrlenW (lpString=".ppt") returned 4
	[0070.480] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.480] lstrlenW (lpString=".zip") returned 4
	[0070.480] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.480] lstrlenW (lpString=".rar") returned 4
	[0070.480] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.480] lstrlenW (lpString=".bz2") returned 4
	[0070.480] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.480] lstrlenW (lpString=".7z") returned 3
	[0070.480] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.480] lstrlenW (lpString=".dbf") returned 4
	[0070.480] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.480] lstrlenW (lpString=".1cd") returned 4
	[0070.480] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0070.480] lstrlenW (lpString=".jpg") returned 4
	[0070.480] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.481] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0070.481] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47
	[0070.481] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.481] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0070.481] CloseHandle (hObject=0x388) returned 1
	[0070.481] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20
	[0070.481] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.482] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.482] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.482] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.482] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0070.482] GetLastError () returned 0x0
	[0070.482] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0070.952] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0070.954] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.954] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x132, lpOverlapped=0x0) returned 1
	[0070.954] SetEndOfFile (hFile=0x368) returned 1
	[0070.954] CloseHandle (hObject=0x368) returned 1
	[0070.956] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.956] SetEndOfFile (hFile=0x388) returned 1
	[0070.957] CloseHandle (hObject=0x388) returned 1
	[0070.957] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0070.958] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1
	[0070.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.958] lstrlenW (lpString=".doc") returned 4
	[0070.958] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.958] lstrlenW (lpString=".docx") returned 5
	[0070.958] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.958] lstrlenW (lpString=".pdf") returned 4
	[0070.958] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.958] lstrlenW (lpString=".xls") returned 4
	[0070.958] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.958] lstrlenW (lpString=".xlsx") returned 5
	[0070.958] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.959] lstrlenW (lpString=".ppt") returned 4
	[0070.959] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.959] lstrlenW (lpString=".zip") returned 4
	[0070.959] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.959] lstrlenW (lpString=".rar") returned 4
	[0070.959] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.959] lstrlenW (lpString=".bz2") returned 4
	[0070.959] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.959] lstrlenW (lpString=".7z") returned 3
	[0070.959] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.959] lstrlenW (lpString=".dbf") returned 4
	[0070.959] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.959] lstrlenW (lpString=".1cd") returned 4
	[0070.959] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.959] lstrlenW (lpString=".jpg") returned 4
	[0070.959] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.960] lstrlenW (lpString=".doc") returned 4
	[0070.960] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.960] lstrlenW (lpString=".docx") returned 5
	[0070.960] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.960] lstrlenW (lpString=".pdf") returned 4
	[0070.960] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.960] lstrlenW (lpString=".xls") returned 4
	[0070.960] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.960] lstrlenW (lpString=".xlsx") returned 5
	[0070.960] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.960] lstrlenW (lpString=".ppt") returned 4
	[0070.960] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.960] lstrlenW (lpString=".zip") returned 4
	[0070.960] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.960] lstrlenW (lpString=".rar") returned 4
	[0070.960] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.960] lstrlenW (lpString=".bz2") returned 4
	[0070.960] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.961] lstrlenW (lpString=".7z") returned 3
	[0070.961] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.961] lstrlenW (lpString=".dbf") returned 4
	[0070.961] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.961] lstrlenW (lpString=".1cd") returned 4
	[0070.961] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0070.961] lstrlenW (lpString=".jpg") returned 4
	[0070.961] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.961] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0070.961] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49
	[0070.962] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.962] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0070.962] CloseHandle (hObject=0x388) returned 1
	[0070.962] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20
	[0070.962] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.962] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.963] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.963] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.963] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0070.968] GetLastError () returned 0x0
	[0070.968] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0070.970] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0070.972] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.972] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x136, lpOverlapped=0x0) returned 1
	[0070.972] SetEndOfFile (hFile=0x368) returned 1
	[0070.972] CloseHandle (hObject=0x368) returned 1
	[0070.974] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.974] SetEndOfFile (hFile=0x388) returned 1
	[0070.975] CloseHandle (hObject=0x388) returned 1
	[0070.975] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0070.976] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1
	[0070.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.976] lstrlenW (lpString=".doc") returned 4
	[0070.976] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.976] lstrlenW (lpString=".docx") returned 5
	[0070.976] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.976] lstrlenW (lpString=".pdf") returned 4
	[0070.976] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.976] lstrlenW (lpString=".xls") returned 4
	[0070.976] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.976] lstrlenW (lpString=".xlsx") returned 5
	[0070.976] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.976] lstrlenW (lpString=".ppt") returned 4
	[0070.976] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.976] lstrlenW (lpString=".zip") returned 4
	[0070.976] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.977] lstrlenW (lpString=".rar") returned 4
	[0070.977] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.977] lstrlenW (lpString=".bz2") returned 4
	[0070.977] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.977] lstrlenW (lpString=".7z") returned 3
	[0070.977] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.977] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.977] lstrlenW (lpString=".dbf") returned 4
	[0070.977] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.977] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.977] lstrlenW (lpString=".1cd") returned 4
	[0070.977] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.977] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.977] lstrlenW (lpString=".jpg") returned 4
	[0070.977] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.977] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.977] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.977] lstrlenW (lpString=".doc") returned 4
	[0070.977] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.977] lstrlenW (lpString=".docx") returned 5
	[0070.977] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.977] lstrlenW (lpString=".pdf") returned 4
	[0070.977] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.977] lstrlenW (lpString=".xls") returned 4
	[0070.977] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.978] lstrlenW (lpString=".xlsx") returned 5
	[0070.978] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.978] lstrlenW (lpString=".ppt") returned 4
	[0070.978] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.978] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.978] lstrlenW (lpString=".zip") returned 4
	[0070.978] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.978] lstrlenW (lpString=".rar") returned 4
	[0070.978] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.978] lstrlenW (lpString=".bz2") returned 4
	[0070.978] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.978] lstrlenW (lpString=".7z") returned 3
	[0070.978] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.978] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.978] lstrlenW (lpString=".dbf") returned 4
	[0070.978] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.978] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.978] lstrlenW (lpString=".1cd") returned 4
	[0070.979] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0070.979] lstrlenW (lpString=".jpg") returned 4
	[0070.979] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.979] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0070.979] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56
	[0070.979] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.979] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0070.979] CloseHandle (hObject=0x388) returned 1
	[0070.979] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20
	[0070.979] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.979] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.980] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.980] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.980] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0070.980] GetLastError () returned 0x0
	[0070.980] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0070.983] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0070.985] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.985] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x144, lpOverlapped=0x0) returned 1
	[0070.985] SetEndOfFile (hFile=0x368) returned 1
	[0070.985] CloseHandle (hObject=0x368) returned 1
	[0070.987] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.987] SetEndOfFile (hFile=0x388) returned 1
	[0070.988] CloseHandle (hObject=0x388) returned 1
	[0070.988] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0070.988] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1
	[0070.989] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.989] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.989] lstrlenW (lpString=".doc") returned 4
	[0070.989] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.989] lstrlenW (lpString=".docx") returned 5
	[0070.989] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.989] lstrlenW (lpString=".pdf") returned 4
	[0070.989] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.989] lstrlenW (lpString=".xls") returned 4
	[0070.989] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.989] lstrlenW (lpString=".xlsx") returned 5
	[0070.989] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.989] lstrlenW (lpString=".ppt") returned 4
	[0070.989] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.989] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.989] lstrlenW (lpString=".zip") returned 4
	[0070.989] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.989] lstrlenW (lpString=".rar") returned 4
	[0070.989] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.989] lstrlenW (lpString=".bz2") returned 4
	[0070.989] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.989] lstrlenW (lpString=".7z") returned 3
	[0070.989] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.989] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.989] lstrlenW (lpString=".dbf") returned 4
	[0070.989] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.989] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.989] lstrlenW (lpString=".1cd") returned 4
	[0070.989] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.989] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.990] lstrlenW (lpString=".jpg") returned 4
	[0070.990] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.990] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.990] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.990] lstrlenW (lpString=".doc") returned 4
	[0070.990] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.990] lstrlenW (lpString=".docx") returned 5
	[0070.990] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.990] lstrlenW (lpString=".pdf") returned 4
	[0070.990] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.990] lstrlenW (lpString=".xls") returned 4
	[0070.990] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.990] lstrlenW (lpString=".xlsx") returned 5
	[0070.990] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.990] lstrlenW (lpString=".ppt") returned 4
	[0070.990] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.990] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.990] lstrlenW (lpString=".zip") returned 4
	[0070.990] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.990] lstrlenW (lpString=".rar") returned 4
	[0070.990] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.990] lstrlenW (lpString=".bz2") returned 4
	[0070.990] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.990] lstrlenW (lpString=".7z") returned 3
	[0070.990] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.990] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.990] lstrlenW (lpString=".dbf") returned 4
	[0070.990] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.990] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.991] lstrlenW (lpString=".1cd") returned 4
	[0070.991] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.991] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0070.991] lstrlenW (lpString=".jpg") returned 4
	[0070.991] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.991] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0070.991] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53
	[0070.991] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.991] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0070.991] CloseHandle (hObject=0x388) returned 1
	[0070.991] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20
	[0070.991] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.992] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.992] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.992] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.992] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0070.992] GetLastError () returned 0x0
	[0070.992] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.331] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.333] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.333] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0071.333] SetEndOfFile (hFile=0x368) returned 1
	[0071.333] CloseHandle (hObject=0x368) returned 1
	[0071.335] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.335] SetEndOfFile (hFile=0x388) returned 1
	[0071.336] CloseHandle (hObject=0x388) returned 1
	[0071.336] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.337] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1
	[0071.337] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.337] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.337] lstrlenW (lpString=".doc") returned 4
	[0071.337] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.337] lstrlenW (lpString=".docx") returned 5
	[0071.337] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.337] lstrlenW (lpString=".pdf") returned 4
	[0071.337] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.337] lstrlenW (lpString=".xls") returned 4
	[0071.337] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.337] lstrlenW (lpString=".xlsx") returned 5
	[0071.337] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.337] lstrlenW (lpString=".ppt") returned 4
	[0071.337] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.337] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.338] lstrlenW (lpString=".zip") returned 4
	[0071.338] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.338] lstrlenW (lpString=".rar") returned 4
	[0071.338] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.338] lstrlenW (lpString=".bz2") returned 4
	[0071.338] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.338] lstrlenW (lpString=".7z") returned 3
	[0071.338] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.338] lstrlenW (lpString=".dbf") returned 4
	[0071.338] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.338] lstrlenW (lpString=".1cd") returned 4
	[0071.338] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.338] lstrlenW (lpString=".jpg") returned 4
	[0071.338] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.338] lstrlenW (lpString=".doc") returned 4
	[0071.338] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.338] lstrlenW (lpString=".docx") returned 5
	[0071.338] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.338] lstrlenW (lpString=".pdf") returned 4
	[0071.338] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.339] lstrlenW (lpString=".xls") returned 4
	[0071.339] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.339] lstrlenW (lpString=".xlsx") returned 5
	[0071.339] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.339] lstrlenW (lpString=".ppt") returned 4
	[0071.339] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.339] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.339] lstrlenW (lpString=".zip") returned 4
	[0071.339] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.339] lstrlenW (lpString=".rar") returned 4
	[0071.339] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.339] lstrlenW (lpString=".bz2") returned 4
	[0071.339] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.339] lstrlenW (lpString=".7z") returned 3
	[0071.339] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.339] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.339] lstrlenW (lpString=".dbf") returned 4
	[0071.339] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.339] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.339] lstrlenW (lpString=".1cd") returned 4
	[0071.339] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.339] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0071.339] lstrlenW (lpString=".jpg") returned 4
	[0071.340] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.340] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.340] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33
	[0071.340] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.340] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0071.340] CloseHandle (hObject=0x388) returned 1
	[0071.340] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20
	[0071.340] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.340] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.341] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.341] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.341] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.341] GetLastError () returned 0x0
	[0071.341] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.344] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.346] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.346] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x116, lpOverlapped=0x0) returned 1
	[0071.346] SetEndOfFile (hFile=0x368) returned 1
	[0071.346] CloseHandle (hObject=0x368) returned 1
	[0071.348] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.348] SetEndOfFile (hFile=0x388) returned 1
	[0071.349] CloseHandle (hObject=0x388) returned 1
	[0071.349] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.350] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1
	[0071.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.350] lstrlenW (lpString=".doc") returned 4
	[0071.350] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.350] lstrlenW (lpString=".docx") returned 5
	[0071.350] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.350] lstrlenW (lpString=".pdf") returned 4
	[0071.350] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.350] lstrlenW (lpString=".xls") returned 4
	[0071.350] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.350] lstrlenW (lpString=".xlsx") returned 5
	[0071.350] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.350] lstrlenW (lpString=".ppt") returned 4
	[0071.350] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.350] lstrlenW (lpString=".zip") returned 4
	[0071.350] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.350] lstrlenW (lpString=".rar") returned 4
	[0071.350] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.350] lstrlenW (lpString=".bz2") returned 4
	[0071.350] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.351] lstrlenW (lpString=".7z") returned 3
	[0071.351] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.351] lstrlenW (lpString=".dbf") returned 4
	[0071.351] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.351] lstrlenW (lpString=".1cd") returned 4
	[0071.351] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.351] lstrlenW (lpString=".jpg") returned 4
	[0071.351] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.351] lstrlenW (lpString=".doc") returned 4
	[0071.351] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.351] lstrlenW (lpString=".docx") returned 5
	[0071.351] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.351] lstrlenW (lpString=".pdf") returned 4
	[0071.351] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.351] lstrlenW (lpString=".xls") returned 4
	[0071.351] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.351] lstrlenW (lpString=".xlsx") returned 5
	[0071.351] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.351] lstrlenW (lpString=".ppt") returned 4
	[0071.351] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.351] lstrlenW (lpString=".zip") returned 4
	[0071.351] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.351] lstrlenW (lpString=".rar") returned 4
	[0071.351] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.352] lstrlenW (lpString=".bz2") returned 4
	[0071.352] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.352] lstrlenW (lpString=".7z") returned 3
	[0071.352] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.352] lstrlenW (lpString=".dbf") returned 4
	[0071.352] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.352] lstrlenW (lpString=".1cd") returned 4
	[0071.352] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0071.352] lstrlenW (lpString=".jpg") returned 4
	[0071.352] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.352] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.352] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39
	[0071.352] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.352] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0071.352] CloseHandle (hObject=0x388) returned 1
	[0071.353] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20
	[0071.353] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.353] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.353] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.353] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.353] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.354] GetLastError () returned 0x0
	[0071.354] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.356] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.358] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.358] WriteFile (in: hFile=0x368, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x122, lpOverlapped=0x0) returned 1
	[0071.359] SetEndOfFile (hFile=0x368) returned 1
	[0071.359] CloseHandle (hObject=0x368) returned 1
	[0071.361] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.361] SetEndOfFile (hFile=0x388) returned 1
	[0071.362] CloseHandle (hObject=0x388) returned 1
	[0071.362] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.363] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1
	[0071.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.363] lstrlenW (lpString=".doc") returned 4
	[0071.363] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.363] lstrlenW (lpString=".docx") returned 5
	[0071.363] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.363] lstrlenW (lpString=".pdf") returned 4
	[0071.363] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.363] lstrlenW (lpString=".xls") returned 4
	[0071.363] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.363] lstrlenW (lpString=".xlsx") returned 5
	[0071.363] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.363] lstrlenW (lpString=".ppt") returned 4
	[0071.363] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.363] lstrlenW (lpString=".zip") returned 4
	[0071.363] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.364] lstrlenW (lpString=".rar") returned 4
	[0071.364] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.364] lstrlenW (lpString=".bz2") returned 4
	[0071.364] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.364] lstrlenW (lpString=".7z") returned 3
	[0071.364] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.364] lstrlenW (lpString=".dbf") returned 4
	[0071.364] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.364] lstrlenW (lpString=".1cd") returned 4
	[0071.364] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.364] lstrlenW (lpString=".jpg") returned 4
	[0071.364] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.364] lstrlenW (lpString=".doc") returned 4
	[0071.364] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.364] lstrlenW (lpString=".docx") returned 5
	[0071.364] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.364] lstrlenW (lpString=".pdf") returned 4
	[0071.364] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.364] lstrlenW (lpString=".xls") returned 4
	[0071.364] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.364] lstrlenW (lpString=".xlsx") returned 5
	[0071.365] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.365] lstrlenW (lpString=".ppt") returned 4
	[0071.365] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.365] lstrlenW (lpString=".zip") returned 4
	[0071.365] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.365] lstrlenW (lpString=".rar") returned 4
	[0071.365] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.365] lstrlenW (lpString=".bz2") returned 4
	[0071.365] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.365] lstrlenW (lpString=".7z") returned 3
	[0071.365] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.365] lstrlenW (lpString=".dbf") returned 4
	[0071.365] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.365] lstrlenW (lpString=".1cd") returned 4
	[0071.365] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0071.365] lstrlenW (lpString=".jpg") returned 4
	[0071.365] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.365] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.365] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40
	[0071.365] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.366] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0071.366] CloseHandle (hObject=0x388) returned 1
	[0071.366] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20
	[0071.366] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.366] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.366] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0071.696] GetLastError () returned 0x0
	[0071.696] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.709] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.711] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.711] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x124, lpOverlapped=0x0) returned 1
	[0071.711] SetEndOfFile (hFile=0x33c) returned 1
	[0071.711] CloseHandle (hObject=0x33c) returned 1
	[0071.713] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.713] SetEndOfFile (hFile=0x388) returned 1
	[0071.714] CloseHandle (hObject=0x388) returned 1
	[0071.714] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.715] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1
	[0071.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.715] lstrlenW (lpString=".doc") returned 4
	[0071.715] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.715] lstrlenW (lpString=".docx") returned 5
	[0071.715] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.715] lstrlenW (lpString=".pdf") returned 4
	[0071.715] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.715] lstrlenW (lpString=".xls") returned 4
	[0071.715] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.715] lstrlenW (lpString=".xlsx") returned 5
	[0071.715] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.715] lstrlenW (lpString=".ppt") returned 4
	[0071.715] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.716] lstrlenW (lpString=".zip") returned 4
	[0071.716] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.716] lstrlenW (lpString=".rar") returned 4
	[0071.716] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.716] lstrlenW (lpString=".bz2") returned 4
	[0071.716] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.716] lstrlenW (lpString=".7z") returned 3
	[0071.716] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.716] lstrlenW (lpString=".dbf") returned 4
	[0071.716] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.716] lstrlenW (lpString=".1cd") returned 4
	[0071.716] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.716] lstrlenW (lpString=".jpg") returned 4
	[0071.716] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.716] lstrlenW (lpString=".doc") returned 4
	[0071.716] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.716] lstrlenW (lpString=".docx") returned 5
	[0071.716] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.716] lstrlenW (lpString=".pdf") returned 4
	[0071.716] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.716] lstrlenW (lpString=".xls") returned 4
	[0071.716] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.716] lstrlenW (lpString=".xlsx") returned 5
	[0071.717] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.717] lstrlenW (lpString=".ppt") returned 4
	[0071.717] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.717] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.717] lstrlenW (lpString=".zip") returned 4
	[0071.717] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.717] lstrlenW (lpString=".rar") returned 4
	[0071.717] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.717] lstrlenW (lpString=".bz2") returned 4
	[0071.717] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.717] lstrlenW (lpString=".7z") returned 3
	[0071.717] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.717] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.717] lstrlenW (lpString=".dbf") returned 4
	[0071.717] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.717] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.717] lstrlenW (lpString=".1cd") returned 4
	[0071.717] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.717] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0071.717] lstrlenW (lpString=".jpg") returned 4
	[0071.717] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.717] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.717] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46
	[0071.717] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.718] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0071.718] CloseHandle (hObject=0x388) returned 1
	[0071.718] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20
	[0071.718] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.718] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.718] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.718] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.718] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0071.718] GetLastError () returned 0x0
	[0071.718] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.721] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.723] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.723] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x130, lpOverlapped=0x0) returned 1
	[0071.723] SetEndOfFile (hFile=0x33c) returned 1
	[0071.723] CloseHandle (hObject=0x33c) returned 1
	[0071.725] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.725] SetEndOfFile (hFile=0x388) returned 1
	[0071.726] CloseHandle (hObject=0x388) returned 1
	[0071.726] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.726] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1
	[0071.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.726] lstrlenW (lpString=".doc") returned 4
	[0071.727] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.727] lstrlenW (lpString=".docx") returned 5
	[0071.727] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.727] lstrlenW (lpString=".pdf") returned 4
	[0071.727] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.727] lstrlenW (lpString=".xls") returned 4
	[0071.727] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.727] lstrlenW (lpString=".xlsx") returned 5
	[0071.727] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.727] lstrlenW (lpString=".ppt") returned 4
	[0071.727] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.727] lstrlenW (lpString=".zip") returned 4
	[0071.727] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.727] lstrlenW (lpString=".rar") returned 4
	[0071.727] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.727] lstrlenW (lpString=".bz2") returned 4
	[0071.727] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.727] lstrlenW (lpString=".7z") returned 3
	[0071.727] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.727] lstrlenW (lpString=".dbf") returned 4
	[0071.727] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.727] lstrlenW (lpString=".1cd") returned 4
	[0071.727] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.727] lstrlenW (lpString=".jpg") returned 4
	[0071.727] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.728] lstrlenW (lpString=".doc") returned 4
	[0071.728] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.728] lstrlenW (lpString=".docx") returned 5
	[0071.728] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.728] lstrlenW (lpString=".pdf") returned 4
	[0071.728] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.728] lstrlenW (lpString=".xls") returned 4
	[0071.728] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.728] lstrlenW (lpString=".xlsx") returned 5
	[0071.728] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.728] lstrlenW (lpString=".ppt") returned 4
	[0071.728] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.728] lstrlenW (lpString=".zip") returned 4
	[0071.728] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.728] lstrlenW (lpString=".rar") returned 4
	[0071.728] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.729] lstrlenW (lpString=".bz2") returned 4
	[0071.729] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.729] lstrlenW (lpString=".7z") returned 3
	[0071.729] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.729] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.729] lstrlenW (lpString=".dbf") returned 4
	[0071.729] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.729] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.729] lstrlenW (lpString=".1cd") returned 4
	[0071.729] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.729] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0071.729] lstrlenW (lpString=".jpg") returned 4
	[0071.729] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.729] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.729] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64
	[0071.729] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.733] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0071.733] CloseHandle (hObject=0x388) returned 1
	[0071.733] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20
	[0071.733] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.733] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.733] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.733] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.734] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0071.734] GetLastError () returned 0x0
	[0071.734] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.737] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.738] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.739] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x154, lpOverlapped=0x0) returned 1
	[0071.739] SetEndOfFile (hFile=0x33c) returned 1
	[0072.291] CloseHandle (hObject=0x33c) returned 1
	[0072.293] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.293] SetEndOfFile (hFile=0x388) returned 1
	[0072.294] CloseHandle (hObject=0x388) returned 1
	[0072.295] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.295] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1
	[0072.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.295] lstrlenW (lpString=".doc") returned 4
	[0072.295] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.295] lstrlenW (lpString=".docx") returned 5
	[0072.295] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.295] lstrlenW (lpString=".pdf") returned 4
	[0072.295] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.295] lstrlenW (lpString=".xls") returned 4
	[0072.295] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.295] lstrlenW (lpString=".xlsx") returned 5
	[0072.296] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.296] lstrlenW (lpString=".ppt") returned 4
	[0072.296] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.296] lstrlenW (lpString=".zip") returned 4
	[0072.296] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.296] lstrlenW (lpString=".rar") returned 4
	[0072.296] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.296] lstrlenW (lpString=".bz2") returned 4
	[0072.296] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.296] lstrlenW (lpString=".7z") returned 3
	[0072.296] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.296] lstrlenW (lpString=".dbf") returned 4
	[0072.296] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.296] lstrlenW (lpString=".1cd") returned 4
	[0072.296] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.296] lstrlenW (lpString=".jpg") returned 4
	[0072.296] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.297] lstrlenW (lpString=".doc") returned 4
	[0072.297] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.297] lstrlenW (lpString=".docx") returned 5
	[0072.297] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.297] lstrlenW (lpString=".pdf") returned 4
	[0072.297] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.297] lstrlenW (lpString=".xls") returned 4
	[0072.297] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.297] lstrlenW (lpString=".xlsx") returned 5
	[0072.297] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.297] lstrlenW (lpString=".ppt") returned 4
	[0072.297] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.297] lstrlenW (lpString=".zip") returned 4
	[0072.297] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.297] lstrlenW (lpString=".rar") returned 4
	[0072.297] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.297] lstrlenW (lpString=".bz2") returned 4
	[0072.297] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.297] lstrlenW (lpString=".7z") returned 3
	[0072.298] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.298] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.298] lstrlenW (lpString=".dbf") returned 4
	[0072.298] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.298] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.298] lstrlenW (lpString=".1cd") returned 4
	[0072.298] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.298] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0072.298] lstrlenW (lpString=".jpg") returned 4
	[0072.298] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.298] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.298] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45
	[0072.298] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.298] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0072.299] CloseHandle (hObject=0x388) returned 1
	[0072.299] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20
	[0072.299] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.299] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.299] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.299] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.299] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.299] GetLastError () returned 0x0
	[0072.299] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.302] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.304] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.304] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0072.304] SetEndOfFile (hFile=0x33c) returned 1
	[0072.304] CloseHandle (hObject=0x33c) returned 1
	[0072.306] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.306] SetEndOfFile (hFile=0x388) returned 1
	[0072.308] CloseHandle (hObject=0x388) returned 1
	[0072.308] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.308] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1
	[0072.308] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.308] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.308] lstrlenW (lpString=".doc") returned 4
	[0072.308] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.308] lstrlenW (lpString=".docx") returned 5
	[0072.308] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.308] lstrlenW (lpString=".pdf") returned 4
	[0072.308] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.308] lstrlenW (lpString=".xls") returned 4
	[0072.309] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.309] lstrlenW (lpString=".xlsx") returned 5
	[0072.309] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.309] lstrlenW (lpString=".ppt") returned 4
	[0072.309] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.309] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.309] lstrlenW (lpString=".zip") returned 4
	[0072.309] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.309] lstrlenW (lpString=".rar") returned 4
	[0072.309] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.309] lstrlenW (lpString=".bz2") returned 4
	[0072.309] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.309] lstrlenW (lpString=".7z") returned 3
	[0072.309] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.309] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.309] lstrlenW (lpString=".dbf") returned 4
	[0072.309] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.309] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.309] lstrlenW (lpString=".1cd") returned 4
	[0072.309] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.309] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.309] lstrlenW (lpString=".jpg") returned 4
	[0072.309] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.310] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.310] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.310] lstrlenW (lpString=".doc") returned 4
	[0072.310] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.310] lstrlenW (lpString=".docx") returned 5
	[0072.310] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.310] lstrlenW (lpString=".pdf") returned 4
	[0072.310] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.310] lstrlenW (lpString=".xls") returned 4
	[0072.310] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.310] lstrlenW (lpString=".xlsx") returned 5
	[0072.310] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.310] lstrlenW (lpString=".ppt") returned 4
	[0072.310] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.310] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.310] lstrlenW (lpString=".zip") returned 4
	[0072.310] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.310] lstrlenW (lpString=".rar") returned 4
	[0072.310] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.310] lstrlenW (lpString=".bz2") returned 4
	[0072.310] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.311] lstrlenW (lpString=".7z") returned 3
	[0072.311] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.311] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.311] lstrlenW (lpString=".dbf") returned 4
	[0072.311] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.311] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.311] lstrlenW (lpString=".1cd") returned 4
	[0072.311] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.311] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0072.311] lstrlenW (lpString=".jpg") returned 4
	[0072.311] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.311] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.311] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42
	[0072.311] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.313] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0072.313] CloseHandle (hObject=0x388) returned 1
	[0072.313] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20
	[0072.313] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.313] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.313] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.313] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.313] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.314] GetLastError () returned 0x0
	[0072.314] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.316] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.318] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.318] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x128, lpOverlapped=0x0) returned 1
	[0072.319] SetEndOfFile (hFile=0x33c) returned 1
	[0072.319] CloseHandle (hObject=0x33c) returned 1
	[0072.321] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.321] SetEndOfFile (hFile=0x388) returned 1
	[0072.322] CloseHandle (hObject=0x388) returned 1
	[0072.322] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.322] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1
	[0072.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.323] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.323] lstrlenW (lpString=".doc") returned 4
	[0072.323] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.323] lstrlenW (lpString=".docx") returned 5
	[0072.323] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.323] lstrlenW (lpString=".pdf") returned 4
	[0072.323] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.323] lstrlenW (lpString=".xls") returned 4
	[0072.323] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.323] lstrlenW (lpString=".xlsx") returned 5
	[0072.323] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.323] lstrlenW (lpString=".ppt") returned 4
	[0072.323] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.323] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.323] lstrlenW (lpString=".zip") returned 4
	[0072.323] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.323] lstrlenW (lpString=".rar") returned 4
	[0072.323] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.323] lstrlenW (lpString=".bz2") returned 4
	[0072.323] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.323] lstrlenW (lpString=".7z") returned 3
	[0072.323] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.324] lstrlenW (lpString=".dbf") returned 4
	[0072.324] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.324] lstrlenW (lpString=".1cd") returned 4
	[0072.324] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.324] lstrlenW (lpString=".jpg") returned 4
	[0072.324] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.324] lstrlenW (lpString=".doc") returned 4
	[0072.324] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.324] lstrlenW (lpString=".docx") returned 5
	[0072.324] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.324] lstrlenW (lpString=".pdf") returned 4
	[0072.324] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.324] lstrlenW (lpString=".xls") returned 4
	[0072.324] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.324] lstrlenW (lpString=".xlsx") returned 5
	[0072.324] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.325] lstrlenW (lpString=".ppt") returned 4
	[0072.325] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.325] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.325] lstrlenW (lpString=".zip") returned 4
	[0072.325] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.325] lstrlenW (lpString=".rar") returned 4
	[0072.325] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.325] lstrlenW (lpString=".bz2") returned 4
	[0072.325] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.325] lstrlenW (lpString=".7z") returned 3
	[0072.325] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.325] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.325] lstrlenW (lpString=".dbf") returned 4
	[0072.325] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.325] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.325] lstrlenW (lpString=".1cd") returned 4
	[0072.325] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.325] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0072.325] lstrlenW (lpString=".jpg") returned 4
	[0072.325] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.326] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.326] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39
	[0072.326] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.326] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0072.326] CloseHandle (hObject=0x388) returned 1
	[0072.326] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20
	[0072.326] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.326] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.326] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.326] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.327] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.327] GetLastError () returned 0x0
	[0072.327] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.706] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.709] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.709] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x122, lpOverlapped=0x0) returned 1
	[0072.709] SetEndOfFile (hFile=0x33c) returned 1
	[0072.709] CloseHandle (hObject=0x33c) returned 1
	[0072.711] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.711] SetEndOfFile (hFile=0x388) returned 1
	[0072.712] CloseHandle (hObject=0x388) returned 1
	[0072.713] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.713] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1
	[0072.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.713] lstrlenW (lpString=".doc") returned 4
	[0072.713] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.713] lstrlenW (lpString=".docx") returned 5
	[0072.713] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.713] lstrlenW (lpString=".pdf") returned 4
	[0072.713] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.713] lstrlenW (lpString=".xls") returned 4
	[0072.713] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.713] lstrlenW (lpString=".xlsx") returned 5
	[0072.713] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.713] lstrlenW (lpString=".ppt") returned 4
	[0072.713] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.714] lstrlenW (lpString=".zip") returned 4
	[0072.714] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.714] lstrlenW (lpString=".rar") returned 4
	[0072.714] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.714] lstrlenW (lpString=".bz2") returned 4
	[0072.714] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.714] lstrlenW (lpString=".7z") returned 3
	[0072.714] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.714] lstrlenW (lpString=".dbf") returned 4
	[0072.714] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.714] lstrlenW (lpString=".1cd") returned 4
	[0072.714] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.714] lstrlenW (lpString=".jpg") returned 4
	[0072.714] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.714] lstrlenW (lpString=".doc") returned 4
	[0072.714] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.714] lstrlenW (lpString=".docx") returned 5
	[0072.714] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.714] lstrlenW (lpString=".pdf") returned 4
	[0072.714] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.714] lstrlenW (lpString=".xls") returned 4
	[0072.715] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.715] lstrlenW (lpString=".xlsx") returned 5
	[0072.715] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.715] lstrlenW (lpString=".ppt") returned 4
	[0072.715] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.715] lstrlenW (lpString=".zip") returned 4
	[0072.715] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.715] lstrlenW (lpString=".rar") returned 4
	[0072.715] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.715] lstrlenW (lpString=".bz2") returned 4
	[0072.715] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.715] lstrlenW (lpString=".7z") returned 3
	[0072.715] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.715] lstrlenW (lpString=".dbf") returned 4
	[0072.715] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.715] lstrlenW (lpString=".1cd") returned 4
	[0072.715] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0072.715] lstrlenW (lpString=".jpg") returned 4
	[0072.715] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.716] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.716] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72
	[0072.716] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.716] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0072.716] CloseHandle (hObject=0x388) returned 1
	[0072.716] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20
	[0072.716] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.716] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.716] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.716] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.716] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.717] GetLastError () returned 0x0
	[0072.717] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.719] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.721] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.721] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x164, lpOverlapped=0x0) returned 1
	[0072.722] SetEndOfFile (hFile=0x33c) returned 1
	[0072.722] CloseHandle (hObject=0x33c) returned 1
	[0072.724] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.724] SetEndOfFile (hFile=0x388) returned 1
	[0072.725] CloseHandle (hObject=0x388) returned 1
	[0072.725] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.725] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1
	[0072.725] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.725] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.725] lstrlenW (lpString=".doc") returned 4
	[0072.725] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.725] lstrlenW (lpString=".docx") returned 5
	[0072.725] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.726] lstrlenW (lpString=".pdf") returned 4
	[0072.726] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.726] lstrlenW (lpString=".xls") returned 4
	[0072.726] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.726] lstrlenW (lpString=".xlsx") returned 5
	[0072.726] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.726] lstrlenW (lpString=".ppt") returned 4
	[0072.726] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.726] lstrlenW (lpString=".zip") returned 4
	[0072.726] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.726] lstrlenW (lpString=".rar") returned 4
	[0072.726] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.726] lstrlenW (lpString=".bz2") returned 4
	[0072.726] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.726] lstrlenW (lpString=".7z") returned 3
	[0072.726] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.726] lstrlenW (lpString=".dbf") returned 4
	[0072.726] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.726] lstrlenW (lpString=".1cd") returned 4
	[0072.726] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.726] lstrlenW (lpString=".jpg") returned 4
	[0072.726] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.726] lstrlenW (lpString=".doc") returned 4
	[0072.726] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.727] lstrlenW (lpString=".docx") returned 5
	[0072.727] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.727] lstrlenW (lpString=".pdf") returned 4
	[0072.727] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.727] lstrlenW (lpString=".xls") returned 4
	[0072.727] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.727] lstrlenW (lpString=".xlsx") returned 5
	[0072.727] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.727] lstrlenW (lpString=".ppt") returned 4
	[0072.727] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.727] lstrlenW (lpString=".zip") returned 4
	[0072.727] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.727] lstrlenW (lpString=".rar") returned 4
	[0072.727] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.727] lstrlenW (lpString=".bz2") returned 4
	[0072.727] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.727] lstrlenW (lpString=".7z") returned 3
	[0072.727] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.727] lstrlenW (lpString=".dbf") returned 4
	[0072.727] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.727] lstrlenW (lpString=".1cd") returned 4
	[0072.727] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0072.727] lstrlenW (lpString=".jpg") returned 4
	[0072.728] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.728] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.728] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70
	[0072.728] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.729] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0072.729] CloseHandle (hObject=0x388) returned 1
	[0072.729] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20
	[0072.729] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.729] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.729] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.729] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.729] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.730] GetLastError () returned 0x0
	[0072.730] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.732] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.734] ReadFile (in: hFile=0x388, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.734] WriteFile (in: hFile=0x33c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x160, lpOverlapped=0x0) returned 1
	[0072.734] SetEndOfFile (hFile=0x33c) returned 1
	[0072.734] CloseHandle (hObject=0x33c) returned 1
	[0072.736] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.736] SetEndOfFile (hFile=0x388) returned 1
	[0072.737] CloseHandle (hObject=0x388) returned 1
	[0072.737] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.737] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1
	[0072.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.738] lstrlenW (lpString=".doc") returned 4
	[0072.738] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.738] lstrlenW (lpString=".docx") returned 5
	[0072.738] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.738] lstrlenW (lpString=".pdf") returned 4
	[0072.738] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.738] lstrlenW (lpString=".xls") returned 4
	[0072.738] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.738] lstrlenW (lpString=".xlsx") returned 5
	[0072.944] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.944] lstrlenW (lpString=".ppt") returned 4
	[0072.944] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.944] lstrlenW (lpString=".zip") returned 4
	[0072.944] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.944] lstrlenW (lpString=".rar") returned 4
	[0072.944] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.944] lstrlenW (lpString=".bz2") returned 4
	[0072.944] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.944] lstrlenW (lpString=".7z") returned 3
	[0072.944] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.944] lstrlenW (lpString=".dbf") returned 4
	[0072.944] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.944] lstrlenW (lpString=".1cd") returned 4
	[0072.944] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.944] lstrlenW (lpString=".jpg") returned 4
	[0072.944] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.944] lstrlenW (lpString=".doc") returned 4
	[0072.944] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.945] lstrlenW (lpString=".docx") returned 5
	[0072.945] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.945] lstrlenW (lpString=".pdf") returned 4
	[0072.945] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.945] lstrlenW (lpString=".xls") returned 4
	[0072.945] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.945] lstrlenW (lpString=".xlsx") returned 5
	[0072.945] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.945] lstrlenW (lpString=".ppt") returned 4
	[0072.945] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.945] lstrlenW (lpString=".zip") returned 4
	[0072.945] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.945] lstrlenW (lpString=".rar") returned 4
	[0072.945] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.945] lstrlenW (lpString=".bz2") returned 4
	[0072.945] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.945] lstrlenW (lpString=".7z") returned 3
	[0072.945] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.945] lstrlenW (lpString=".dbf") returned 4
	[0072.945] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.945] lstrlenW (lpString=".1cd") returned 4
	[0072.945] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0072.945] lstrlenW (lpString=".jpg") returned 4
	[0072.945] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.946] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.946] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56
	[0072.946] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.296] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0073.296] CloseHandle (hObject=0x384) returned 1
	[0073.301] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20
	[0073.301] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.301] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.301] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.301] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.301] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.302] GetLastError () returned 0x0
	[0073.302] ReadFile (in: hFile=0x384, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.305] WriteFile (in: hFile=0x350, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.307] ReadFile (in: hFile=0x384, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.307] WriteFile (in: hFile=0x350, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x144, lpOverlapped=0x0) returned 1
	[0073.308] SetEndOfFile (hFile=0x350) returned 1
	[0073.308] CloseHandle (hObject=0x350) returned 1
	[0073.311] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.311] SetEndOfFile (hFile=0x384) returned 1
	[0073.313] CloseHandle (hObject=0x384) returned 1
	[0073.313] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0073.313] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1
	[0073.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.313] lstrlenW (lpString=".doc") returned 4
	[0073.313] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.313] lstrlenW (lpString=".docx") returned 5
	[0073.313] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.314] lstrlenW (lpString=".pdf") returned 4
	[0073.314] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.314] lstrlenW (lpString=".xls") returned 4
	[0073.314] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.314] lstrlenW (lpString=".xlsx") returned 5
	[0073.314] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.314] lstrlenW (lpString=".ppt") returned 4
	[0073.314] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.314] lstrlenW (lpString=".zip") returned 4
	[0073.314] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.314] lstrlenW (lpString=".rar") returned 4
	[0073.314] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.314] lstrlenW (lpString=".bz2") returned 4
	[0073.314] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.314] lstrlenW (lpString=".7z") returned 3
	[0073.314] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.314] lstrlenW (lpString=".dbf") returned 4
	[0073.314] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.314] lstrlenW (lpString=".1cd") returned 4
	[0073.314] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.314] lstrlenW (lpString=".jpg") returned 4
	[0073.314] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.315] lstrlenW (lpString=".doc") returned 4
	[0073.315] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.315] lstrlenW (lpString=".docx") returned 5
	[0073.315] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.315] lstrlenW (lpString=".pdf") returned 4
	[0073.315] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.315] lstrlenW (lpString=".xls") returned 4
	[0073.315] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.315] lstrlenW (lpString=".xlsx") returned 5
	[0073.315] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.315] lstrlenW (lpString=".ppt") returned 4
	[0073.315] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.315] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.315] lstrlenW (lpString=".zip") returned 4
	[0073.315] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.315] lstrlenW (lpString=".rar") returned 4
	[0073.315] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.315] lstrlenW (lpString=".bz2") returned 4
	[0073.315] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.315] lstrlenW (lpString=".7z") returned 3
	[0073.315] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.315] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.315] lstrlenW (lpString=".dbf") returned 4
	[0073.315] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.315] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.315] lstrlenW (lpString=".1cd") returned 4
	[0073.315] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.315] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0073.315] lstrlenW (lpString=".jpg") returned 4
	[0073.315] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.316] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0073.316] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57
	[0073.316] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.316] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0073.317] CloseHandle (hObject=0x384) returned 1
	[0073.317] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20
	[0073.317] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.317] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.317] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.317] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.317] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.317] GetLastError () returned 0x0
	[0073.317] ReadFile (in: hFile=0x384, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.320] WriteFile (in: hFile=0x350, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.322] ReadFile (in: hFile=0x384, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.322] WriteFile (in: hFile=0x350, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x146, lpOverlapped=0x0) returned 1
	[0073.322] SetEndOfFile (hFile=0x350) returned 1
	[0073.322] CloseHandle (hObject=0x350) returned 1
	[0073.324] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.324] SetEndOfFile (hFile=0x384) returned 1
	[0073.325] CloseHandle (hObject=0x384) returned 1
	[0073.325] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0073.326] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1
	[0073.326] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.326] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.326] lstrlenW (lpString=".doc") returned 4
	[0073.326] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.326] lstrlenW (lpString=".docx") returned 5
	[0073.326] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.326] lstrlenW (lpString=".pdf") returned 4
	[0073.326] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.326] lstrlenW (lpString=".xls") returned 4
	[0073.326] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.326] lstrlenW (lpString=".xlsx") returned 5
	[0073.326] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.326] lstrlenW (lpString=".ppt") returned 4
	[0073.326] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.326] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.326] lstrlenW (lpString=".zip") returned 4
	[0073.327] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.327] lstrlenW (lpString=".rar") returned 4
	[0073.327] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.327] lstrlenW (lpString=".bz2") returned 4
	[0073.327] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.327] lstrlenW (lpString=".7z") returned 3
	[0073.327] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.327] lstrlenW (lpString=".dbf") returned 4
	[0073.327] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.327] lstrlenW (lpString=".1cd") returned 4
	[0073.327] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.327] lstrlenW (lpString=".jpg") returned 4
	[0073.327] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.327] lstrlenW (lpString=".doc") returned 4
	[0073.328] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.328] lstrlenW (lpString=".docx") returned 5
	[0073.328] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.328] lstrlenW (lpString=".pdf") returned 4
	[0073.328] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.328] lstrlenW (lpString=".xls") returned 4
	[0073.328] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.328] lstrlenW (lpString=".xlsx") returned 5
	[0073.328] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.328] lstrlenW (lpString=".ppt") returned 4
	[0073.328] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.328] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.328] lstrlenW (lpString=".zip") returned 4
	[0073.328] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.328] lstrlenW (lpString=".rar") returned 4
	[0073.328] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.328] lstrlenW (lpString=".bz2") returned 4
	[0073.328] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.328] lstrlenW (lpString=".7z") returned 3
	[0073.328] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.328] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.328] lstrlenW (lpString=".dbf") returned 4
	[0073.328] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.329] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.329] lstrlenW (lpString=".1cd") returned 4
	[0073.329] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.329] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0073.329] lstrlenW (lpString=".jpg") returned 4
	[0073.329] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.329] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0073.329] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42
	[0073.329] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.329] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0073.329] CloseHandle (hObject=0x384) returned 1
	[0073.330] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20
	[0073.330] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.330] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.330] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.330] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.330] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0073.868] GetLastError () returned 0x0
	[0073.868] ReadFile (in: hFile=0x384, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.871] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.873] ReadFile (in: hFile=0x384, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.873] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x128, lpOverlapped=0x0) returned 1
	[0073.873] SetEndOfFile (hFile=0x318) returned 1
	[0073.873] CloseHandle (hObject=0x318) returned 1
	[0073.876] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.876] SetEndOfFile (hFile=0x384) returned 1
	[0073.878] CloseHandle (hObject=0x384) returned 1
	[0073.878] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0073.878] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1
	[0073.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.879] lstrlenW (lpString=".doc") returned 4
	[0073.879] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.879] lstrlenW (lpString=".docx") returned 5
	[0073.879] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.879] lstrlenW (lpString=".pdf") returned 4
	[0073.879] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.879] lstrlenW (lpString=".xls") returned 4
	[0073.879] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.879] lstrlenW (lpString=".xlsx") returned 5
	[0073.879] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.879] lstrlenW (lpString=".ppt") returned 4
	[0073.879] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.879] lstrlenW (lpString=".zip") returned 4
	[0073.879] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.879] lstrlenW (lpString=".rar") returned 4
	[0073.879] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.879] lstrlenW (lpString=".bz2") returned 4
	[0073.879] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.879] lstrlenW (lpString=".7z") returned 3
	[0073.880] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.880] lstrlenW (lpString=".dbf") returned 4
	[0073.880] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.880] lstrlenW (lpString=".1cd") returned 4
	[0073.880] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.880] lstrlenW (lpString=".jpg") returned 4
	[0073.880] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.880] lstrlenW (lpString=".doc") returned 4
	[0073.880] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.880] lstrlenW (lpString=".docx") returned 5
	[0073.880] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.880] lstrlenW (lpString=".pdf") returned 4
	[0073.880] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.880] lstrlenW (lpString=".xls") returned 4
	[0073.880] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.880] lstrlenW (lpString=".xlsx") returned 5
	[0073.880] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.880] lstrlenW (lpString=".ppt") returned 4
	[0073.880] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.881] lstrlenW (lpString=".zip") returned 4
	[0073.881] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.881] lstrlenW (lpString=".rar") returned 4
	[0073.881] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.881] lstrlenW (lpString=".bz2") returned 4
	[0073.881] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.881] lstrlenW (lpString=".7z") returned 3
	[0073.881] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.881] lstrlenW (lpString=".dbf") returned 4
	[0073.881] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.881] lstrlenW (lpString=".1cd") returned 4
	[0073.881] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0073.881] lstrlenW (lpString=".jpg") returned 4
	[0073.881] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.882] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0073.882] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52
	[0073.882] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0073.882] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0073.882] CloseHandle (hObject=0x340) returned 1
	[0073.882] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20
	[0073.883] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.883] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0073.883] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.883] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.883] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.883] GetLastError () returned 0x0
	[0073.883] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.886] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.888] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.888] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x13c, lpOverlapped=0x0) returned 1
	[0073.888] SetEndOfFile (hFile=0x384) returned 1
	[0073.888] CloseHandle (hObject=0x384) returned 1
	[0073.890] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.890] SetEndOfFile (hFile=0x340) returned 1
	[0073.891] CloseHandle (hObject=0x340) returned 1
	[0073.891] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0073.892] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1
	[0073.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.892] lstrlenW (lpString=".doc") returned 4
	[0073.892] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.892] lstrlenW (lpString=".docx") returned 5
	[0073.892] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.892] lstrlenW (lpString=".pdf") returned 4
	[0073.892] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.892] lstrlenW (lpString=".xls") returned 4
	[0073.892] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.892] lstrlenW (lpString=".xlsx") returned 5
	[0073.892] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.892] lstrlenW (lpString=".ppt") returned 4
	[0073.892] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.893] lstrlenW (lpString=".zip") returned 4
	[0073.893] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.893] lstrlenW (lpString=".rar") returned 4
	[0073.893] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.893] lstrlenW (lpString=".bz2") returned 4
	[0073.893] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.893] lstrlenW (lpString=".7z") returned 3
	[0073.893] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.893] lstrlenW (lpString=".dbf") returned 4
	[0073.893] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.893] lstrlenW (lpString=".1cd") returned 4
	[0073.893] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.893] lstrlenW (lpString=".jpg") returned 4
	[0073.893] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.893] lstrlenW (lpString=".doc") returned 4
	[0073.893] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.893] lstrlenW (lpString=".docx") returned 5
	[0073.893] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.893] lstrlenW (lpString=".pdf") returned 4
	[0073.893] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.893] lstrlenW (lpString=".xls") returned 4
	[0073.893] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.893] lstrlenW (lpString=".xlsx") returned 5
	[0073.894] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.894] lstrlenW (lpString=".ppt") returned 4
	[0073.894] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.894] lstrlenW (lpString=".zip") returned 4
	[0073.894] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.894] lstrlenW (lpString=".rar") returned 4
	[0073.894] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.894] lstrlenW (lpString=".bz2") returned 4
	[0073.894] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.894] lstrlenW (lpString=".7z") returned 3
	[0073.894] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.894] lstrlenW (lpString=".dbf") returned 4
	[0073.894] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.894] lstrlenW (lpString=".1cd") returned 4
	[0073.894] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0073.894] lstrlenW (lpString=".jpg") returned 4
	[0073.894] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.894] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0073.895] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44
	[0073.895] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0073.895] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0073.895] CloseHandle (hObject=0x340) returned 1
	[0073.895] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20
	[0073.895] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.895] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0073.895] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.895] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.895] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.896] GetLastError () returned 0x0
	[0073.896] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.898] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.900] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.901] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x12c, lpOverlapped=0x0) returned 1
	[0073.901] SetEndOfFile (hFile=0x384) returned 1
	[0073.901] CloseHandle (hObject=0x384) returned 1
	[0073.903] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.903] SetEndOfFile (hFile=0x340) returned 1
	[0073.904] CloseHandle (hObject=0x340) returned 1
	[0073.904] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0073.904] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1
	[0073.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.905] lstrlenW (lpString=".doc") returned 4
	[0073.905] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.905] lstrlenW (lpString=".docx") returned 5
	[0073.905] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.905] lstrlenW (lpString=".pdf") returned 4
	[0073.905] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.905] lstrlenW (lpString=".xls") returned 4
	[0073.905] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.905] lstrlenW (lpString=".xlsx") returned 5
	[0073.905] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.905] lstrlenW (lpString=".ppt") returned 4
	[0073.905] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.905] lstrlenW (lpString=".zip") returned 4
	[0073.905] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.905] lstrlenW (lpString=".rar") returned 4
	[0073.905] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.905] lstrlenW (lpString=".bz2") returned 4
	[0073.905] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.906] lstrlenW (lpString=".7z") returned 3
	[0073.906] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.906] lstrlenW (lpString=".dbf") returned 4
	[0073.906] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.906] lstrlenW (lpString=".1cd") returned 4
	[0073.906] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.906] lstrlenW (lpString=".jpg") returned 4
	[0073.906] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.906] lstrlenW (lpString=".doc") returned 4
	[0073.906] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.906] lstrlenW (lpString=".docx") returned 5
	[0073.906] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.906] lstrlenW (lpString=".pdf") returned 4
	[0073.906] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.906] lstrlenW (lpString=".xls") returned 4
	[0073.906] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.906] lstrlenW (lpString=".xlsx") returned 5
	[0073.906] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.906] lstrlenW (lpString=".ppt") returned 4
	[0073.906] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.907] lstrlenW (lpString=".zip") returned 4
	[0073.907] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.907] lstrlenW (lpString=".rar") returned 4
	[0073.907] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.907] lstrlenW (lpString=".bz2") returned 4
	[0073.907] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.907] lstrlenW (lpString=".7z") returned 3
	[0073.907] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.907] lstrlenW (lpString=".dbf") returned 4
	[0073.907] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.907] lstrlenW (lpString=".1cd") returned 4
	[0073.907] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0073.907] lstrlenW (lpString=".jpg") returned 4
	[0073.907] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.907] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0073.907] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82
	[0073.908] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0073.908] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0073.908] CloseHandle (hObject=0x340) returned 1
	[0073.908] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20
	[0073.908] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.908] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0073.908] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.908] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.908] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.909] GetLastError () returned 0x0
	[0073.909] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.287] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.289] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.289] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x178, lpOverlapped=0x0) returned 1
	[0074.289] SetEndOfFile (hFile=0x384) returned 1
	[0074.289] CloseHandle (hObject=0x384) returned 1
	[0074.292] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.292] SetEndOfFile (hFile=0x340) returned 1
	[0074.294] CloseHandle (hObject=0x340) returned 1
	[0074.294] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0074.294] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1
	[0074.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.294] lstrlenW (lpString=".doc") returned 4
	[0074.294] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.295] lstrlenW (lpString=".docx") returned 5
	[0074.295] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.295] lstrlenW (lpString=".pdf") returned 4
	[0074.295] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.295] lstrlenW (lpString=".xls") returned 4
	[0074.295] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.295] lstrlenW (lpString=".xlsx") returned 5
	[0074.295] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.295] lstrlenW (lpString=".ppt") returned 4
	[0074.295] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.295] lstrlenW (lpString=".zip") returned 4
	[0074.295] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.295] lstrlenW (lpString=".rar") returned 4
	[0074.295] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.295] lstrlenW (lpString=".bz2") returned 4
	[0074.295] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.295] lstrlenW (lpString=".7z") returned 3
	[0074.295] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.295] lstrlenW (lpString=".dbf") returned 4
	[0074.295] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.296] lstrlenW (lpString=".1cd") returned 4
	[0074.296] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.296] lstrlenW (lpString=".jpg") returned 4
	[0074.296] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.296] lstrlenW (lpString=".doc") returned 4
	[0074.296] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.296] lstrlenW (lpString=".docx") returned 5
	[0074.296] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.296] lstrlenW (lpString=".pdf") returned 4
	[0074.296] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.296] lstrlenW (lpString=".xls") returned 4
	[0074.296] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.296] lstrlenW (lpString=".xlsx") returned 5
	[0074.296] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.296] lstrlenW (lpString=".ppt") returned 4
	[0074.296] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.296] lstrlenW (lpString=".zip") returned 4
	[0074.297] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.297] lstrlenW (lpString=".rar") returned 4
	[0074.297] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.297] lstrlenW (lpString=".bz2") returned 4
	[0074.297] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.297] lstrlenW (lpString=".7z") returned 3
	[0074.297] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.297] lstrlenW (lpString=".dbf") returned 4
	[0074.297] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.297] lstrlenW (lpString=".1cd") returned 4
	[0074.297] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0074.297] lstrlenW (lpString=".jpg") returned 4
	[0074.297] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.297] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0074.298] lstrlenW (lpString="Setup.evtx") returned 10
	[0074.298] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0074.298] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=69632) returned 1
	[0074.298] CloseHandle (hObject=0x340) returned 1
	[0074.298] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20
	[0074.298] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.298] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0074.298] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.298] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.299] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0074.300] GetLastError () returned 0x0
	[0074.300] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.303] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.305] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.305] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0074.305] SetEndOfFile (hFile=0x384) returned 1
	[0074.305] CloseHandle (hObject=0x384) returned 1
	[0074.307] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.307] SetEndOfFile (hFile=0x340) returned 1
	[0074.308] CloseHandle (hObject=0x340) returned 1
	[0074.309] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0074.309] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1
	[0074.309] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.309] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.309] lstrlenW (lpString=".doc") returned 4
	[0074.309] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.309] lstrlenW (lpString=".docx") returned 5
	[0074.309] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.309] lstrlenW (lpString=".pdf") returned 4
	[0074.309] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.309] lstrlenW (lpString=".xls") returned 4
	[0074.309] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.309] lstrlenW (lpString=".xlsx") returned 5
	[0074.309] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.309] lstrlenW (lpString=".ppt") returned 4
	[0074.309] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.310] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.310] lstrlenW (lpString=".zip") returned 4
	[0074.310] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.310] lstrlenW (lpString=".rar") returned 4
	[0074.310] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.310] lstrlenW (lpString=".bz2") returned 4
	[0074.310] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.310] lstrlenW (lpString=".7z") returned 3
	[0074.310] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.310] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.310] lstrlenW (lpString=".dbf") returned 4
	[0074.310] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.310] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.310] lstrlenW (lpString=".1cd") returned 4
	[0074.310] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.310] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.310] lstrlenW (lpString=".jpg") returned 4
	[0074.310] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.310] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.310] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.310] lstrlenW (lpString=".doc") returned 4
	[0074.310] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.311] lstrlenW (lpString=".docx") returned 5
	[0074.311] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.311] lstrlenW (lpString=".pdf") returned 4
	[0074.311] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.311] lstrlenW (lpString=".xls") returned 4
	[0074.311] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.311] lstrlenW (lpString=".xlsx") returned 5
	[0074.311] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.311] lstrlenW (lpString=".ppt") returned 4
	[0074.311] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.311] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.311] lstrlenW (lpString=".zip") returned 4
	[0074.311] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.311] lstrlenW (lpString=".rar") returned 4
	[0074.311] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.311] lstrlenW (lpString=".bz2") returned 4
	[0074.311] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.311] lstrlenW (lpString=".7z") returned 3
	[0074.311] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.311] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.311] lstrlenW (lpString=".dbf") returned 4
	[0074.311] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.312] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.312] lstrlenW (lpString=".1cd") returned 4
	[0074.312] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.312] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0074.312] lstrlenW (lpString=".jpg") returned 4
	[0074.312] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.312] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0074.312] lstrlenW (lpString="System.evtx") returned 11
	[0074.312] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0074.317] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=1118208) returned 1
	[0074.317] CloseHandle (hObject=0x340) returned 1
	[0074.318] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20
	[0074.318] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\system.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.318] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0074.318] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.318] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.318] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\system.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0074.318] GetLastError () returned 0x0
	[0074.318] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0074.844] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0075.128] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11010, lpOverlapped=0x0) returned 1
	[0075.137] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11020, lpOverlapped=0x0) returned 1
	[0075.142] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.142] WriteFile (in: hFile=0x384, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xea, lpOverlapped=0x0) returned 1
	[0075.142] SetEndOfFile (hFile=0x384) returned 1
	[0075.142] CloseHandle (hObject=0x384) returned 1
	[0075.511] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.511] SetEndOfFile (hFile=0x340) returned 1
	[0075.512] CloseHandle (hObject=0x340) returned 1
	[0075.513] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.513] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1
	[0075.513] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.513] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.513] lstrlenW (lpString=".doc") returned 4
	[0075.513] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.513] lstrlenW (lpString=".docx") returned 5
	[0075.513] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.514] lstrlenW (lpString=".pdf") returned 4
	[0075.514] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.514] lstrlenW (lpString=".xls") returned 4
	[0075.514] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.514] lstrlenW (lpString=".xlsx") returned 5
	[0075.514] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.514] lstrlenW (lpString=".ppt") returned 4
	[0075.514] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.514] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.514] lstrlenW (lpString=".zip") returned 4
	[0075.514] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.514] lstrlenW (lpString=".rar") returned 4
	[0075.514] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.514] lstrlenW (lpString=".bz2") returned 4
	[0075.514] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.514] lstrlenW (lpString=".7z") returned 3
	[0075.514] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.514] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.514] lstrlenW (lpString=".dbf") returned 4
	[0075.514] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.514] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.514] lstrlenW (lpString=".1cd") returned 4
	[0075.514] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.514] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.514] lstrlenW (lpString=".jpg") returned 4
	[0075.514] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.515] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.515] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.515] lstrlenW (lpString=".doc") returned 4
	[0075.515] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.515] lstrlenW (lpString=".docx") returned 5
	[0075.515] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.515] lstrlenW (lpString=".pdf") returned 4
	[0075.515] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.515] lstrlenW (lpString=".xls") returned 4
	[0075.515] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.515] lstrlenW (lpString=".xlsx") returned 5
	[0075.515] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.515] lstrlenW (lpString=".ppt") returned 4
	[0075.515] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.515] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.515] lstrlenW (lpString=".zip") returned 4
	[0075.515] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.515] lstrlenW (lpString=".rar") returned 4
	[0075.515] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.515] lstrlenW (lpString=".bz2") returned 4
	[0075.515] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.515] lstrlenW (lpString=".7z") returned 3
	[0075.515] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.515] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.515] lstrlenW (lpString=".dbf") returned 4
	[0075.516] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.516] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.516] lstrlenW (lpString=".1cd") returned 4
	[0075.516] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.516] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0075.516] lstrlenW (lpString=".jpg") returned 4
	[0075.516] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.516] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.516] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36
	[0075.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0075.655] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=20672) returned 1
	[0075.663] CloseHandle (hObject=0x374) returned 1
	[0075.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20
	[0075.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0075.663] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.663] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.664] GetLastError () returned 0x0
	[0075.664] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x50c0, lpOverlapped=0x0) returned 1
	[0075.667] WriteFile (in: hFile=0x37c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x50d0, lpOverlapped=0x0) returned 1
	[0075.668] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.668] WriteFile (in: hFile=0x37c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0075.668] SetEndOfFile (hFile=0x37c) returned 1
	[0075.668] CloseHandle (hObject=0x37c) returned 1
	[0075.669] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.669] SetEndOfFile (hFile=0x374) returned 1
	[0075.670] CloseHandle (hObject=0x374) returned 1
	[0075.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.671] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1
	[0075.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.671] lstrlenW (lpString=".doc") returned 4
	[0075.671] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.671] lstrlenW (lpString=".docx") returned 5
	[0075.671] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.671] lstrlenW (lpString=".pdf") returned 4
	[0075.671] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.671] lstrlenW (lpString=".xls") returned 4
	[0075.671] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.671] lstrlenW (lpString=".xlsx") returned 5
	[0075.672] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.672] lstrlenW (lpString=".ppt") returned 4
	[0075.672] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.672] lstrlenW (lpString=".zip") returned 4
	[0075.672] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.672] lstrlenW (lpString=".rar") returned 4
	[0075.672] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.672] lstrlenW (lpString=".bz2") returned 4
	[0075.672] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.672] lstrlenW (lpString=".7z") returned 3
	[0075.672] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.672] lstrlenW (lpString=".dbf") returned 4
	[0075.672] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.672] lstrlenW (lpString=".1cd") returned 4
	[0075.672] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.672] lstrlenW (lpString=".jpg") returned 4
	[0075.672] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.673] lstrlenW (lpString=".doc") returned 4
	[0075.673] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.673] lstrlenW (lpString=".docx") returned 5
	[0075.673] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.673] lstrlenW (lpString=".pdf") returned 4
	[0075.673] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.673] lstrlenW (lpString=".xls") returned 4
	[0075.673] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.673] lstrlenW (lpString=".xlsx") returned 5
	[0075.673] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.673] lstrlenW (lpString=".ppt") returned 4
	[0075.673] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.673] lstrlenW (lpString=".zip") returned 4
	[0075.673] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.673] lstrlenW (lpString=".rar") returned 4
	[0075.673] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.673] lstrlenW (lpString=".bz2") returned 4
	[0075.673] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.673] lstrlenW (lpString=".7z") returned 3
	[0075.673] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.673] lstrlenW (lpString=".dbf") returned 4
	[0075.673] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.674] lstrlenW (lpString=".1cd") returned 4
	[0075.674] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0075.674] lstrlenW (lpString=".jpg") returned 4
	[0075.674] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.674] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.674] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33
	[0075.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0075.675] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=23232) returned 1
	[0075.675] CloseHandle (hObject=0x374) returned 1
	[0075.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20
	[0075.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0075.675] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.675] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.676] GetLastError () returned 0x0
	[0075.676] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x5ac0, lpOverlapped=0x0) returned 1
	[0075.678] WriteFile (in: hFile=0x37c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x5ad0, lpOverlapped=0x0) returned 1
	[0075.679] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.679] WriteFile (in: hFile=0x37c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x116, lpOverlapped=0x0) returned 1
	[0075.679] SetEndOfFile (hFile=0x37c) returned 1
	[0075.679] CloseHandle (hObject=0x37c) returned 1
	[0075.680] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.680] SetEndOfFile (hFile=0x374) returned 1
	[0075.681] CloseHandle (hObject=0x374) returned 1
	[0075.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.682] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1
	[0075.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.682] lstrlenW (lpString=".doc") returned 4
	[0075.682] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.682] lstrlenW (lpString=".docx") returned 5
	[0075.682] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.682] lstrlenW (lpString=".pdf") returned 4
	[0075.682] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.682] lstrlenW (lpString=".xls") returned 4
	[0075.682] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.682] lstrlenW (lpString=".xlsx") returned 5
	[0075.682] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.683] lstrlenW (lpString=".ppt") returned 4
	[0075.683] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.683] lstrlenW (lpString=".zip") returned 4
	[0075.683] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.683] lstrlenW (lpString=".rar") returned 4
	[0075.683] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.683] lstrlenW (lpString=".bz2") returned 4
	[0075.683] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.683] lstrlenW (lpString=".7z") returned 3
	[0075.683] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.683] lstrlenW (lpString=".dbf") returned 4
	[0075.683] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.683] lstrlenW (lpString=".1cd") returned 4
	[0075.683] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.683] lstrlenW (lpString=".jpg") returned 4
	[0075.683] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.684] lstrlenW (lpString=".doc") returned 4
	[0075.684] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.684] lstrlenW (lpString=".docx") returned 5
	[0075.684] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.684] lstrlenW (lpString=".pdf") returned 4
	[0075.684] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.684] lstrlenW (lpString=".xls") returned 4
	[0075.684] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.684] lstrlenW (lpString=".xlsx") returned 5
	[0075.684] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.684] lstrlenW (lpString=".ppt") returned 4
	[0075.684] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.684] lstrlenW (lpString=".zip") returned 4
	[0075.684] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.684] lstrlenW (lpString=".rar") returned 4
	[0075.684] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.684] lstrlenW (lpString=".bz2") returned 4
	[0075.684] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.684] lstrlenW (lpString=".7z") returned 3
	[0075.684] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.684] lstrlenW (lpString=".dbf") returned 4
	[0075.685] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.685] lstrlenW (lpString=".1cd") returned 4
	[0075.685] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0075.685] lstrlenW (lpString=".jpg") returned 4
	[0075.685] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.685] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.685] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31
	[0075.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0075.685] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=24768) returned 1
	[0075.685] CloseHandle (hObject=0x374) returned 1
	[0075.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20
	[0075.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0075.686] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.686] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.686] GetLastError () returned 0x0
	[0075.686] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x60c0, lpOverlapped=0x0) returned 1
	[0075.688] WriteFile (in: hFile=0x37c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x60d0, lpOverlapped=0x0) returned 1
	[0075.689] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.689] WriteFile (in: hFile=0x37c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x112, lpOverlapped=0x0) returned 1
	[0075.689] SetEndOfFile (hFile=0x37c) returned 1
	[0075.690] CloseHandle (hObject=0x37c) returned 1
	[0075.692] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.692] SetEndOfFile (hFile=0x374) returned 1
	[0075.693] CloseHandle (hObject=0x374) returned 1
	[0075.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.693] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1
	[0075.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.694] lstrlenW (lpString=".doc") returned 4
	[0075.694] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.694] lstrlenW (lpString=".docx") returned 5
	[0075.694] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.694] lstrlenW (lpString=".pdf") returned 4
	[0075.694] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.694] lstrlenW (lpString=".xls") returned 4
	[0075.694] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.694] lstrlenW (lpString=".xlsx") returned 5
	[0075.694] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.694] lstrlenW (lpString=".ppt") returned 4
	[0075.694] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.694] lstrlenW (lpString=".zip") returned 4
	[0075.694] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.694] lstrlenW (lpString=".rar") returned 4
	[0075.694] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.694] lstrlenW (lpString=".bz2") returned 4
	[0075.694] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.694] lstrlenW (lpString=".7z") returned 3
	[0075.694] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.694] lstrlenW (lpString=".dbf") returned 4
	[0075.694] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.695] lstrlenW (lpString=".1cd") returned 4
	[0075.695] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.695] lstrlenW (lpString=".jpg") returned 4
	[0075.695] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.695] lstrlenW (lpString=".doc") returned 4
	[0075.695] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.695] lstrlenW (lpString=".docx") returned 5
	[0075.695] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.695] lstrlenW (lpString=".pdf") returned 4
	[0075.695] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.695] lstrlenW (lpString=".xls") returned 4
	[0075.695] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.695] lstrlenW (lpString=".xlsx") returned 5
	[0075.695] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.695] lstrlenW (lpString=".ppt") returned 4
	[0075.695] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.695] lstrlenW (lpString=".zip") returned 4
	[0075.695] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.695] lstrlenW (lpString=".rar") returned 4
	[0075.695] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.696] lstrlenW (lpString=".bz2") returned 4
	[0075.696] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.696] lstrlenW (lpString=".7z") returned 3
	[0075.696] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.696] lstrlenW (lpString=".dbf") returned 4
	[0075.696] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.696] lstrlenW (lpString=".1cd") returned 4
	[0075.696] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0075.696] lstrlenW (lpString=".jpg") returned 4
	[0075.696] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.696] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.696] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32
	[0075.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0075.697] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=24768) returned 1
	[0075.697] CloseHandle (hObject=0x374) returned 1
	[0075.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20
	[0075.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0075.697] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.697] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.698] GetLastError () returned 0x0
	[0075.698] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x60c0, lpOverlapped=0x0) returned 1
	[0076.054] WriteFile (in: hFile=0x37c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x60d0, lpOverlapped=0x0) returned 1
	[0076.055] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.055] WriteFile (in: hFile=0x37c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x114, lpOverlapped=0x0) returned 1
	[0076.056] SetEndOfFile (hFile=0x37c) returned 1
	[0076.056] CloseHandle (hObject=0x37c) returned 1
	[0076.057] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.057] SetEndOfFile (hFile=0x374) returned 1
	[0076.058] CloseHandle (hObject=0x374) returned 1
	[0076.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0076.059] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1
	[0076.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.059] lstrlenW (lpString=".doc") returned 4
	[0076.059] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.059] lstrlenW (lpString=".docx") returned 5
	[0076.059] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0076.059] lstrlenW (lpString=".pdf") returned 4
	[0076.059] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.059] lstrlenW (lpString=".xls") returned 4
	[0076.059] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.059] lstrlenW (lpString=".xlsx") returned 5
	[0076.059] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0076.060] lstrlenW (lpString=".ppt") returned 4
	[0076.060] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.060] lstrlenW (lpString=".zip") returned 4
	[0076.060] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.060] lstrlenW (lpString=".rar") returned 4
	[0076.060] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.060] lstrlenW (lpString=".bz2") returned 4
	[0076.060] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.060] lstrlenW (lpString=".7z") returned 3
	[0076.060] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.060] lstrlenW (lpString=".dbf") returned 4
	[0076.060] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.060] lstrlenW (lpString=".1cd") returned 4
	[0076.060] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.060] lstrlenW (lpString=".jpg") returned 4
	[0076.061] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.061] lstrlenW (lpString=".doc") returned 4
	[0076.061] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.061] lstrlenW (lpString=".docx") returned 5
	[0076.061] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0076.061] lstrlenW (lpString=".pdf") returned 4
	[0076.061] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.061] lstrlenW (lpString=".xls") returned 4
	[0076.061] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.061] lstrlenW (lpString=".xlsx") returned 5
	[0076.061] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0076.061] lstrlenW (lpString=".ppt") returned 4
	[0076.061] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.062] lstrlenW (lpString=".zip") returned 4
	[0076.062] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.062] lstrlenW (lpString=".rar") returned 4
	[0076.062] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.062] lstrlenW (lpString=".bz2") returned 4
	[0076.062] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.062] lstrlenW (lpString=".7z") returned 3
	[0076.062] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.062] lstrlenW (lpString=".dbf") returned 4
	[0076.062] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.062] lstrlenW (lpString=".1cd") returned 4
	[0076.062] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0076.062] lstrlenW (lpString=".jpg") returned 4
	[0076.062] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.063] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.063] lstrlenW (lpString="AppvIsvStream64.dll") returned 19
	[0076.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0076.063] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=473760) returned 1
	[0076.063] CloseHandle (hObject=0x374) returned 1
	[0076.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20
	[0076.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.064] lstrlenW (lpString=".doc") returned 4
	[0076.064] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.064] lstrlenW (lpString=".docx") returned 5
	[0076.064] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0076.064] lstrlenW (lpString=".pdf") returned 4
	[0076.064] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.064] lstrlenW (lpString=".xls") returned 4
	[0076.064] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.064] lstrlenW (lpString=".xlsx") returned 5
	[0076.064] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0076.064] lstrlenW (lpString=".ppt") returned 4
	[0076.065] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.065] lstrlenW (lpString=".zip") returned 4
	[0076.065] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.065] lstrlenW (lpString=".rar") returned 4
	[0076.065] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.065] lstrlenW (lpString=".bz2") returned 4
	[0076.065] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.065] lstrlenW (lpString=".7z") returned 3
	[0076.065] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.065] lstrlenW (lpString=".dbf") returned 4
	[0076.065] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.065] lstrlenW (lpString=".1cd") returned 4
	[0076.065] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.066] lstrlenW (lpString=".jpg") returned 4
	[0076.066] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.066] lstrlenW (lpString=".doc") returned 4
	[0076.066] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.066] lstrlenW (lpString=".docx") returned 5
	[0076.066] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0076.066] lstrlenW (lpString=".pdf") returned 4
	[0076.066] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.066] lstrlenW (lpString=".xls") returned 4
	[0076.066] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.066] lstrlenW (lpString=".xlsx") returned 5
	[0076.066] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0076.066] lstrlenW (lpString=".ppt") returned 4
	[0076.067] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.067] lstrlenW (lpString=".zip") returned 4
	[0076.067] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.067] lstrlenW (lpString=".rar") returned 4
	[0076.067] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.067] lstrlenW (lpString=".bz2") returned 4
	[0076.067] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.067] lstrlenW (lpString=".7z") returned 3
	[0076.067] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.067] lstrlenW (lpString=".dbf") returned 4
	[0076.067] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.067] lstrlenW (lpString=".1cd") returned 4
	[0076.067] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0076.068] lstrlenW (lpString=".jpg") returned 4
	[0076.068] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.068] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.068] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27
	[0076.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0076.068] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=210648) returned 1
	[0076.068] CloseHandle (hObject=0x374) returned 1
	[0076.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20
	[0076.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.069] lstrlenW (lpString=".doc") returned 4
	[0076.069] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.069] lstrlenW (lpString=".docx") returned 5
	[0076.069] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0076.069] lstrlenW (lpString=".pdf") returned 4
	[0076.069] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.069] lstrlenW (lpString=".xls") returned 4
	[0076.069] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.069] lstrlenW (lpString=".xlsx") returned 5
	[0076.069] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0076.069] lstrlenW (lpString=".ppt") returned 4
	[0076.069] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.069] lstrlenW (lpString=".zip") returned 4
	[0076.069] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.069] lstrlenW (lpString=".rar") returned 4
	[0076.070] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.070] lstrlenW (lpString=".bz2") returned 4
	[0076.070] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.070] lstrlenW (lpString=".7z") returned 3
	[0076.070] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.070] lstrlenW (lpString=".dbf") returned 4
	[0076.070] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.070] lstrlenW (lpString=".1cd") returned 4
	[0076.070] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.070] lstrlenW (lpString=".jpg") returned 4
	[0076.070] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.070] lstrlenW (lpString=".doc") returned 4
	[0076.070] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.070] lstrlenW (lpString=".docx") returned 5
	[0076.070] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0076.070] lstrlenW (lpString=".pdf") returned 4
	[0076.070] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.070] lstrlenW (lpString=".xls") returned 4
	[0076.070] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.070] lstrlenW (lpString=".xlsx") returned 5
	[0076.070] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0076.071] lstrlenW (lpString=".ppt") returned 4
	[0076.071] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.071] lstrlenW (lpString=".zip") returned 4
	[0076.071] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.071] lstrlenW (lpString=".rar") returned 4
	[0076.071] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.071] lstrlenW (lpString=".bz2") returned 4
	[0076.071] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.071] lstrlenW (lpString=".7z") returned 3
	[0076.071] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.071] lstrlenW (lpString=".dbf") returned 4
	[0076.071] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.071] lstrlenW (lpString=".1cd") returned 4
	[0076.071] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0076.071] lstrlenW (lpString=".jpg") returned 4
	[0076.071] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.071] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.072] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30
	[0076.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0076.072] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=1402584) returned 1
	[0076.072] CloseHandle (hObject=0x374) returned 1
	[0076.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20
	[0076.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.072] lstrlenW (lpString=".doc") returned 4
	[0076.072] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.072] lstrlenW (lpString=".docx") returned 5
	[0076.072] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0076.072] lstrlenW (lpString=".pdf") returned 4
	[0076.073] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.073] lstrlenW (lpString=".xls") returned 4
	[0076.073] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.073] lstrlenW (lpString=".xlsx") returned 5
	[0076.073] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0076.073] lstrlenW (lpString=".ppt") returned 4
	[0076.073] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.073] lstrlenW (lpString=".zip") returned 4
	[0076.073] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.073] lstrlenW (lpString=".rar") returned 4
	[0076.073] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.073] lstrlenW (lpString=".bz2") returned 4
	[0076.073] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.073] lstrlenW (lpString=".7z") returned 3
	[0076.073] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.073] lstrlenW (lpString=".dbf") returned 4
	[0076.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.073] lstrlenW (lpString=".1cd") returned 4
	[0076.073] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.073] lstrlenW (lpString=".jpg") returned 4
	[0076.074] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.074] lstrlenW (lpString=".doc") returned 4
	[0076.074] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.074] lstrlenW (lpString=".docx") returned 5
	[0076.074] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0076.074] lstrlenW (lpString=".pdf") returned 4
	[0076.074] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.074] lstrlenW (lpString=".xls") returned 4
	[0076.074] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.074] lstrlenW (lpString=".xlsx") returned 5
	[0076.074] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0076.074] lstrlenW (lpString=".ppt") returned 4
	[0076.074] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.074] lstrlenW (lpString=".zip") returned 4
	[0076.074] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.074] lstrlenW (lpString=".rar") returned 4
	[0076.074] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.074] lstrlenW (lpString=".bz2") returned 4
	[0076.074] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.075] lstrlenW (lpString=".7z") returned 3
	[0076.075] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.075] lstrlenW (lpString=".dbf") returned 4
	[0076.075] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.075] lstrlenW (lpString=".1cd") returned 4
	[0076.075] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0076.075] lstrlenW (lpString=".jpg") returned 4
	[0076.075] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.075] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.075] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23
	[0076.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0076.075] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=1761448) returned 1
	[0076.076] CloseHandle (hObject=0x374) returned 1
	[0076.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20
	[0076.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[admin@stex777.com].money")) returned 1
	[0076.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0076.077] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc64 | out: lpNewFilePointer=0x0) returned 1
	[0076.077] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0076.077] ReadFile (in: hFile=0x374, lpBuffer=0x40d7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x40d7058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0076.081] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0076.081] ReadFile (in: hFile=0x374, lpBuffer=0x4117058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x4117058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0076.084] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b1fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0076.084] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0076.084] ReadFile (in: hFile=0x374, lpBuffer=0x4157058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x4157058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0076.370] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.371] WriteFile (in: hFile=0x374, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x3b1fca8, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fca8*=0xc011a, lpOverlapped=0x0) returned 1
	[0076.394] SetEndOfFile (hFile=0x374) returned 1
	[0076.395] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x42b4598
	[0076.421] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0076.421] WriteFile (in: hFile=0x374, lpBuffer=0x42b4598*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42b4598*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0076.423] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0076.423] WriteFile (in: hFile=0x374, lpBuffer=0x42b4598*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42b4598*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0076.425] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0076.425] WriteFile (in: hFile=0x374, lpBuffer=0x42b4598*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42b4598*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0077.109] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42b4598 | out: hHeap=0x600000) returned 1
	[0077.446] CloseHandle (hObject=0x374) returned 1
	[0077.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.446] lstrlenW (lpString=".doc") returned 4
	[0077.446] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.446] lstrlenW (lpString=".docx") returned 5
	[0077.446] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0077.446] lstrlenW (lpString=".pdf") returned 4
	[0077.446] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.446] lstrlenW (lpString=".xls") returned 4
	[0077.446] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.446] lstrlenW (lpString=".xlsx") returned 5
	[0077.446] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0077.446] lstrlenW (lpString=".ppt") returned 4
	[0077.447] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.447] lstrlenW (lpString=".zip") returned 4
	[0077.447] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.447] lstrlenW (lpString=".rar") returned 4
	[0077.447] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.447] lstrlenW (lpString=".bz2") returned 4
	[0077.447] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.447] lstrlenW (lpString=".7z") returned 3
	[0077.447] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.447] lstrlenW (lpString=".dbf") returned 4
	[0077.447] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.447] lstrlenW (lpString=".1cd") returned 4
	[0077.447] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.447] lstrlenW (lpString=".jpg") returned 4
	[0077.447] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.447] lstrlenW (lpString=".doc") returned 4
	[0077.448] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.448] lstrlenW (lpString=".docx") returned 5
	[0077.448] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0077.448] lstrlenW (lpString=".pdf") returned 4
	[0077.448] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.448] lstrlenW (lpString=".xls") returned 4
	[0077.448] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.448] lstrlenW (lpString=".xlsx") returned 5
	[0077.448] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0077.448] lstrlenW (lpString=".ppt") returned 4
	[0077.448] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.448] lstrlenW (lpString=".zip") returned 4
	[0077.448] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.448] lstrlenW (lpString=".rar") returned 4
	[0077.448] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.448] lstrlenW (lpString=".bz2") returned 4
	[0077.448] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.448] lstrlenW (lpString=".7z") returned 3
	[0077.448] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.448] lstrlenW (lpString=".dbf") returned 4
	[0077.448] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.448] lstrlenW (lpString=".1cd") returned 4
	[0077.448] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0077.449] lstrlenW (lpString=".jpg") returned 4
	[0077.449] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.449] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.449] lstrlenW (lpString="mso40uires.dll") returned 14
	[0077.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.449] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=3177152) returned 1
	[0077.449] CloseHandle (hObject=0x374) returned 1
	[0077.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20
	[0077.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[admin@stex777.com].money")) returned 1
	[0077.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[admin@stex777.com].money"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1
	[0077.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.451] lstrlenW (lpString=".doc") returned 4
	[0077.451] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.451] lstrlenW (lpString=".docx") returned 5
	[0077.451] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0077.452] lstrlenW (lpString=".pdf") returned 4
	[0077.452] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.452] lstrlenW (lpString=".xls") returned 4
	[0077.452] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.452] lstrlenW (lpString=".xlsx") returned 5
	[0077.452] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0077.452] lstrlenW (lpString=".ppt") returned 4
	[0077.452] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.452] lstrlenW (lpString=".zip") returned 4
	[0077.452] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.452] lstrlenW (lpString=".rar") returned 4
	[0077.452] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.452] lstrlenW (lpString=".bz2") returned 4
	[0077.452] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.452] lstrlenW (lpString=".7z") returned 3
	[0077.452] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.452] lstrlenW (lpString=".dbf") returned 4
	[0077.452] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.452] lstrlenW (lpString=".1cd") returned 4
	[0077.452] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.452] lstrlenW (lpString=".jpg") returned 4
	[0077.453] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.453] lstrlenW (lpString=".doc") returned 4
	[0077.453] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.453] lstrlenW (lpString=".docx") returned 5
	[0077.453] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0077.453] lstrlenW (lpString=".pdf") returned 4
	[0077.453] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.453] lstrlenW (lpString=".xls") returned 4
	[0077.453] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.453] lstrlenW (lpString=".xlsx") returned 5
	[0077.453] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0077.453] lstrlenW (lpString=".ppt") returned 4
	[0077.453] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.453] lstrlenW (lpString=".zip") returned 4
	[0077.453] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.453] lstrlenW (lpString=".rar") returned 4
	[0077.453] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.454] lstrlenW (lpString=".bz2") returned 4
	[0077.454] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.454] lstrlenW (lpString=".7z") returned 3
	[0077.454] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.454] lstrlenW (lpString=".dbf") returned 4
	[0077.454] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.454] lstrlenW (lpString=".1cd") returned 4
	[0077.454] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0077.454] lstrlenW (lpString=".jpg") returned 4
	[0077.454] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.454] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.454] lstrlenW (lpString="mso40uiwin32client.dll") returned 22
	[0077.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.455] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=9330784) returned 1
	[0077.455] CloseHandle (hObject=0x374) returned 1
	[0077.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20
	[0077.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[admin@stex777.com].money")) returned 1
	[0077.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[admin@stex777.com].money"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1
	[0077.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.456] lstrlenW (lpString=".doc") returned 4
	[0077.456] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.456] lstrlenW (lpString=".docx") returned 5
	[0077.456] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0077.456] lstrlenW (lpString=".pdf") returned 4
	[0077.456] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.456] lstrlenW (lpString=".xls") returned 4
	[0077.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.456] lstrlenW (lpString=".xlsx") returned 5
	[0077.456] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0077.456] lstrlenW (lpString=".ppt") returned 4
	[0077.457] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.457] lstrlenW (lpString=".zip") returned 4
	[0077.457] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.457] lstrlenW (lpString=".rar") returned 4
	[0077.457] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.457] lstrlenW (lpString=".bz2") returned 4
	[0077.457] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.457] lstrlenW (lpString=".7z") returned 3
	[0077.457] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.457] lstrlenW (lpString=".dbf") returned 4
	[0077.457] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.457] lstrlenW (lpString=".1cd") returned 4
	[0077.457] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.457] lstrlenW (lpString=".jpg") returned 4
	[0077.457] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.458] lstrlenW (lpString=".doc") returned 4
	[0077.458] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.458] lstrlenW (lpString=".docx") returned 5
	[0077.458] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0077.458] lstrlenW (lpString=".pdf") returned 4
	[0077.458] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.458] lstrlenW (lpString=".xls") returned 4
	[0077.458] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.458] lstrlenW (lpString=".xlsx") returned 5
	[0077.458] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0077.458] lstrlenW (lpString=".ppt") returned 4
	[0077.458] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.458] lstrlenW (lpString=".zip") returned 4
	[0077.458] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.458] lstrlenW (lpString=".rar") returned 4
	[0077.458] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.458] lstrlenW (lpString=".bz2") returned 4
	[0077.458] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.458] lstrlenW (lpString=".7z") returned 3
	[0077.458] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.458] lstrlenW (lpString=".dbf") returned 4
	[0077.458] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.459] lstrlenW (lpString=".1cd") returned 4
	[0077.459] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0077.459] lstrlenW (lpString=".jpg") returned 4
	[0077.459] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.459] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.459] lstrlenW (lpString="msointl30.en-us.dll") returned 19
	[0077.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.459] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=61024) returned 1
	[0077.459] CloseHandle (hObject=0x374) returned 1
	[0077.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20
	[0077.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.460] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.460] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0077.460] GetLastError () returned 0x0
	[0077.460] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0xee60, lpOverlapped=0x0) returned 1
	[0077.463] WriteFile (in: hFile=0x320, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xee70, lpOverlapped=0x0) returned 1
	[0077.464] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.464] WriteFile (in: hFile=0x320, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0077.465] SetEndOfFile (hFile=0x320) returned 1
	[0077.465] CloseHandle (hObject=0x320) returned 1
	[0077.465] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.465] SetEndOfFile (hFile=0x374) returned 1
	[0077.466] CloseHandle (hObject=0x374) returned 1
	[0077.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.466] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1
	[0077.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.467] lstrlenW (lpString=".doc") returned 4
	[0077.467] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.467] lstrlenW (lpString=".docx") returned 5
	[0077.467] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0077.467] lstrlenW (lpString=".pdf") returned 4
	[0077.467] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.467] lstrlenW (lpString=".xls") returned 4
	[0077.467] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.467] lstrlenW (lpString=".xlsx") returned 5
	[0077.467] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0077.467] lstrlenW (lpString=".ppt") returned 4
	[0077.467] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.467] lstrlenW (lpString=".zip") returned 4
	[0077.467] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.467] lstrlenW (lpString=".rar") returned 4
	[0077.467] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.467] lstrlenW (lpString=".bz2") returned 4
	[0077.467] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.467] lstrlenW (lpString=".7z") returned 3
	[0077.467] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.467] lstrlenW (lpString=".dbf") returned 4
	[0077.467] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.467] lstrlenW (lpString=".1cd") returned 4
	[0077.467] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.467] lstrlenW (lpString=".jpg") returned 4
	[0077.468] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.468] lstrlenW (lpString=".doc") returned 4
	[0077.468] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.468] lstrlenW (lpString=".docx") returned 5
	[0077.468] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0077.468] lstrlenW (lpString=".pdf") returned 4
	[0077.468] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.468] lstrlenW (lpString=".xls") returned 4
	[0077.468] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.468] lstrlenW (lpString=".xlsx") returned 5
	[0077.468] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0077.468] lstrlenW (lpString=".ppt") returned 4
	[0077.468] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.468] lstrlenW (lpString=".zip") returned 4
	[0077.468] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.468] lstrlenW (lpString=".rar") returned 4
	[0077.468] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.468] lstrlenW (lpString=".bz2") returned 4
	[0077.468] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.468] lstrlenW (lpString=".7z") returned 3
	[0077.468] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.468] lstrlenW (lpString=".dbf") returned 4
	[0077.468] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.468] lstrlenW (lpString=".1cd") returned 4
	[0077.469] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0077.469] lstrlenW (lpString=".jpg") returned 4
	[0077.469] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.469] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.469] lstrlenW (lpString="msvcp120.dll") returned 12
	[0077.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.469] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=660136) returned 1
	[0077.469] CloseHandle (hObject=0x374) returned 1
	[0077.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20
	[0077.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.470] lstrlenW (lpString=".doc") returned 4
	[0077.470] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.470] lstrlenW (lpString=".docx") returned 5
	[0077.470] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0077.470] lstrlenW (lpString=".pdf") returned 4
	[0077.470] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.470] lstrlenW (lpString=".xls") returned 4
	[0077.470] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.470] lstrlenW (lpString=".xlsx") returned 5
	[0077.470] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0077.470] lstrlenW (lpString=".ppt") returned 4
	[0077.470] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.470] lstrlenW (lpString=".zip") returned 4
	[0077.470] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.470] lstrlenW (lpString=".rar") returned 4
	[0077.470] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.470] lstrlenW (lpString=".bz2") returned 4
	[0077.470] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.470] lstrlenW (lpString=".7z") returned 3
	[0077.470] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.470] lstrlenW (lpString=".dbf") returned 4
	[0077.470] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.470] lstrlenW (lpString=".1cd") returned 4
	[0077.470] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.470] lstrlenW (lpString=".jpg") returned 4
	[0077.471] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.471] lstrlenW (lpString=".doc") returned 4
	[0077.471] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.471] lstrlenW (lpString=".docx") returned 5
	[0077.471] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0077.471] lstrlenW (lpString=".pdf") returned 4
	[0077.471] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.471] lstrlenW (lpString=".xls") returned 4
	[0077.471] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.471] lstrlenW (lpString=".xlsx") returned 5
	[0077.471] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0077.471] lstrlenW (lpString=".ppt") returned 4
	[0077.471] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.471] lstrlenW (lpString=".zip") returned 4
	[0077.471] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.471] lstrlenW (lpString=".rar") returned 4
	[0077.471] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.471] lstrlenW (lpString=".bz2") returned 4
	[0077.471] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.471] lstrlenW (lpString=".7z") returned 3
	[0077.471] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.471] lstrlenW (lpString=".dbf") returned 4
	[0077.471] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.471] lstrlenW (lpString=".1cd") returned 4
	[0077.471] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0077.472] lstrlenW (lpString=".jpg") returned 4
	[0077.472] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.472] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.472] lstrlenW (lpString="msvcp140.dll") returned 12
	[0077.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.472] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=635040) returned 1
	[0077.472] CloseHandle (hObject=0x374) returned 1
	[0077.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20
	[0077.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.473] lstrlenW (lpString=".doc") returned 4
	[0077.473] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.473] lstrlenW (lpString=".docx") returned 5
	[0077.473] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0077.473] lstrlenW (lpString=".pdf") returned 4
	[0077.473] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.473] lstrlenW (lpString=".xls") returned 4
	[0077.473] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.473] lstrlenW (lpString=".xlsx") returned 5
	[0077.473] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0077.473] lstrlenW (lpString=".ppt") returned 4
	[0077.473] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.473] lstrlenW (lpString=".zip") returned 4
	[0077.473] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.473] lstrlenW (lpString=".rar") returned 4
	[0077.473] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.473] lstrlenW (lpString=".bz2") returned 4
	[0077.473] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.473] lstrlenW (lpString=".7z") returned 3
	[0077.473] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.474] lstrlenW (lpString=".dbf") returned 4
	[0077.474] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.474] lstrlenW (lpString=".1cd") returned 4
	[0077.474] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.474] lstrlenW (lpString=".jpg") returned 4
	[0077.474] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.474] lstrlenW (lpString=".doc") returned 4
	[0077.474] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.474] lstrlenW (lpString=".docx") returned 5
	[0077.474] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0077.474] lstrlenW (lpString=".pdf") returned 4
	[0077.474] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.474] lstrlenW (lpString=".xls") returned 4
	[0077.474] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.474] lstrlenW (lpString=".xlsx") returned 5
	[0077.474] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0077.474] lstrlenW (lpString=".ppt") returned 4
	[0077.474] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.474] lstrlenW (lpString=".zip") returned 4
	[0077.474] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.474] lstrlenW (lpString=".rar") returned 4
	[0077.474] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.475] lstrlenW (lpString=".bz2") returned 4
	[0077.475] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.475] lstrlenW (lpString=".7z") returned 3
	[0077.475] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.475] lstrlenW (lpString=".dbf") returned 4
	[0077.475] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.475] lstrlenW (lpString=".1cd") returned 4
	[0077.475] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0077.475] lstrlenW (lpString=".jpg") returned 4
	[0077.475] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.475] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.475] lstrlenW (lpString="msvcr120.dll") returned 12
	[0077.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.475] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=963240) returned 1
	[0077.475] CloseHandle (hObject=0x374) returned 1
	[0077.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20
	[0077.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.476] lstrlenW (lpString=".doc") returned 4
	[0077.476] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.476] lstrlenW (lpString=".docx") returned 5
	[0077.476] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0077.476] lstrlenW (lpString=".pdf") returned 4
	[0077.476] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.476] lstrlenW (lpString=".xls") returned 4
	[0077.476] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.476] lstrlenW (lpString=".xlsx") returned 5
	[0077.476] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0077.476] lstrlenW (lpString=".ppt") returned 4
	[0077.476] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.476] lstrlenW (lpString=".zip") returned 4
	[0077.476] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.477] lstrlenW (lpString=".rar") returned 4
	[0077.477] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.477] lstrlenW (lpString=".bz2") returned 4
	[0077.477] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.477] lstrlenW (lpString=".7z") returned 3
	[0077.477] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.477] lstrlenW (lpString=".dbf") returned 4
	[0077.477] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.477] lstrlenW (lpString=".1cd") returned 4
	[0077.477] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.477] lstrlenW (lpString=".jpg") returned 4
	[0077.477] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.477] lstrlenW (lpString=".doc") returned 4
	[0077.477] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.477] lstrlenW (lpString=".docx") returned 5
	[0077.477] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0077.477] lstrlenW (lpString=".pdf") returned 4
	[0077.477] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.478] lstrlenW (lpString=".xls") returned 4
	[0077.478] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.478] lstrlenW (lpString=".xlsx") returned 5
	[0077.478] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0077.478] lstrlenW (lpString=".ppt") returned 4
	[0077.478] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.478] lstrlenW (lpString=".zip") returned 4
	[0077.478] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.478] lstrlenW (lpString=".rar") returned 4
	[0077.478] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.478] lstrlenW (lpString=".bz2") returned 4
	[0077.478] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.478] lstrlenW (lpString=".7z") returned 3
	[0077.478] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.478] lstrlenW (lpString=".dbf") returned 4
	[0077.478] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.478] lstrlenW (lpString=".1cd") returned 4
	[0077.478] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0077.478] lstrlenW (lpString=".jpg") returned 4
	[0077.478] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.479] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0077.479] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0077.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.479] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=5967976) returned 1
	[0077.479] CloseHandle (hObject=0x374) returned 1
	[0077.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20
	[0077.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[admin@stex777.com].money")) returned 1
	[0077.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.480] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc64 | out: lpNewFilePointer=0x0) returned 1
	[0077.480] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0077.480] ReadFile (in: hFile=0x374, lpBuffer=0x40d7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x40d7058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0077.891] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0077.891] ReadFile (in: hFile=0x374, lpBuffer=0x4117058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x4117058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0077.901] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b1fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0077.901] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc24 | out: lpNewFilePointer=0x0) returned 1
	[0077.901] ReadFile (in: hFile=0x374, lpBuffer=0x4157058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b1fc30, lpOverlapped=0x0 | out: lpBuffer=0x4157058*, lpNumberOfBytesRead=0x3b1fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0077.917] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.917] WriteFile (in: hFile=0x374, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x3b1fca8, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fca8*=0xc0112, lpOverlapped=0x0) returned 1
	[0078.300] SetEndOfFile (hFile=0x374) returned 1
	[0078.300] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x42b4598
	[0078.306] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0078.306] WriteFile (in: hFile=0x374, lpBuffer=0x42b4598*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42b4598*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0078.307] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0078.308] WriteFile (in: hFile=0x374, lpBuffer=0x42b4598*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42b4598*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0078.313] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fc74 | out: lpNewFilePointer=0x0) returned 1
	[0078.313] WriteFile (in: hFile=0x374, lpBuffer=0x42b4598*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b1fc80, lpOverlapped=0x0 | out: lpBuffer=0x42b4598*, lpNumberOfBytesWritten=0x3b1fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0078.315] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42b4598 | out: hHeap=0x600000) returned 1
	[0078.315] CloseHandle (hObject=0x374) returned 1
	[0078.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0078.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.315] lstrlenW (lpString=".doc") returned 4
	[0078.315] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0078.315] lstrlenW (lpString=".docx") returned 5
	[0078.315] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0078.315] lstrlenW (lpString=".pdf") returned 4
	[0078.316] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0078.316] lstrlenW (lpString=".xls") returned 4
	[0078.316] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0078.316] lstrlenW (lpString=".xlsx") returned 5
	[0078.316] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0078.316] lstrlenW (lpString=".ppt") returned 4
	[0078.316] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0078.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.316] lstrlenW (lpString=".zip") returned 4
	[0078.316] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0078.316] lstrlenW (lpString=".rar") returned 4
	[0078.316] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0078.316] lstrlenW (lpString=".bz2") returned 4
	[0078.316] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0078.316] lstrlenW (lpString=".7z") returned 3
	[0078.316] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0078.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.316] lstrlenW (lpString=".dbf") returned 4
	[0078.316] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0078.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.317] lstrlenW (lpString=".1cd") returned 4
	[0078.317] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0078.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.317] lstrlenW (lpString=".jpg") returned 4
	[0078.317] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0078.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.317] lstrlenW (lpString=".doc") returned 4
	[0078.317] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0078.317] lstrlenW (lpString=".docx") returned 5
	[0078.317] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0078.317] lstrlenW (lpString=".pdf") returned 4
	[0078.317] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0078.317] lstrlenW (lpString=".xls") returned 4
	[0078.317] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0078.317] lstrlenW (lpString=".xlsx") returned 5
	[0078.317] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0078.317] lstrlenW (lpString=".ppt") returned 4
	[0078.317] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0078.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.317] lstrlenW (lpString=".zip") returned 4
	[0078.317] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0078.317] lstrlenW (lpString=".rar") returned 4
	[0078.317] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0078.317] lstrlenW (lpString=".bz2") returned 4
	[0078.317] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0078.318] lstrlenW (lpString=".7z") returned 3
	[0078.318] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0078.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.318] lstrlenW (lpString=".dbf") returned 4
	[0078.318] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0078.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.318] lstrlenW (lpString=".1cd") returned 4
	[0078.318] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0078.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0078.318] lstrlenW (lpString=".jpg") returned 4
	[0078.318] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0078.318] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.318] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22
	[0078.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.363] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=23040) returned 1
	[0078.363] CloseHandle (hObject=0x374) returned 1
	[0078.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20
	[0078.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.364] lstrlenW (lpString=".doc") returned 4
	[0078.364] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.364] lstrlenW (lpString=".docx") returned 5
	[0078.364] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.364] lstrlenW (lpString=".pdf") returned 4
	[0078.364] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.364] lstrlenW (lpString=".xls") returned 4
	[0078.364] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.364] lstrlenW (lpString=".xlsx") returned 5
	[0078.364] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.364] lstrlenW (lpString=".ppt") returned 4
	[0078.364] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.364] lstrlenW (lpString=".zip") returned 4
	[0078.364] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.365] lstrlenW (lpString=".rar") returned 4
	[0078.365] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.365] lstrlenW (lpString=".bz2") returned 4
	[0078.365] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.365] lstrlenW (lpString=".7z") returned 3
	[0078.365] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.365] lstrlenW (lpString=".dbf") returned 4
	[0078.365] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.365] lstrlenW (lpString=".1cd") returned 4
	[0078.365] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.365] lstrlenW (lpString=".jpg") returned 4
	[0078.365] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.365] lstrlenW (lpString=".doc") returned 4
	[0078.366] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.366] lstrlenW (lpString=".docx") returned 5
	[0078.366] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.366] lstrlenW (lpString=".pdf") returned 4
	[0078.366] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.366] lstrlenW (lpString=".xls") returned 4
	[0078.366] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.366] lstrlenW (lpString=".xlsx") returned 5
	[0078.366] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.366] lstrlenW (lpString=".ppt") returned 4
	[0078.366] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.366] lstrlenW (lpString=".zip") returned 4
	[0078.366] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.366] lstrlenW (lpString=".rar") returned 4
	[0078.366] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.366] lstrlenW (lpString=".bz2") returned 4
	[0078.366] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.366] lstrlenW (lpString=".7z") returned 3
	[0078.366] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.366] lstrlenW (lpString=".dbf") returned 4
	[0078.366] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.367] lstrlenW (lpString=".1cd") returned 4
	[0078.367] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0078.367] lstrlenW (lpString=".jpg") returned 4
	[0078.367] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.367] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.367] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0078.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.367] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=10240) returned 1
	[0078.367] CloseHandle (hObject=0x374) returned 1
	[0078.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20
	[0078.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.368] lstrlenW (lpString=".doc") returned 4
	[0078.368] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.368] lstrlenW (lpString=".docx") returned 5
	[0078.368] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.368] lstrlenW (lpString=".pdf") returned 4
	[0078.368] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.368] lstrlenW (lpString=".xls") returned 4
	[0078.368] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.368] lstrlenW (lpString=".xlsx") returned 5
	[0078.368] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.368] lstrlenW (lpString=".ppt") returned 4
	[0078.368] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.368] lstrlenW (lpString=".zip") returned 4
	[0078.368] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.368] lstrlenW (lpString=".rar") returned 4
	[0078.368] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.368] lstrlenW (lpString=".bz2") returned 4
	[0078.369] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.369] lstrlenW (lpString=".7z") returned 3
	[0078.369] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.369] lstrlenW (lpString=".dbf") returned 4
	[0078.369] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.369] lstrlenW (lpString=".1cd") returned 4
	[0078.369] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.369] lstrlenW (lpString=".jpg") returned 4
	[0078.369] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.369] lstrlenW (lpString=".doc") returned 4
	[0078.369] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.369] lstrlenW (lpString=".docx") returned 5
	[0078.369] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.369] lstrlenW (lpString=".pdf") returned 4
	[0078.369] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.369] lstrlenW (lpString=".xls") returned 4
	[0078.369] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.369] lstrlenW (lpString=".xlsx") returned 5
	[0078.369] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.369] lstrlenW (lpString=".ppt") returned 4
	[0078.369] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.370] lstrlenW (lpString=".zip") returned 4
	[0078.370] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.370] lstrlenW (lpString=".rar") returned 4
	[0078.370] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.370] lstrlenW (lpString=".bz2") returned 4
	[0078.370] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.370] lstrlenW (lpString=".7z") returned 3
	[0078.370] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.370] lstrlenW (lpString=".dbf") returned 4
	[0078.370] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.370] lstrlenW (lpString=".1cd") returned 4
	[0078.370] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72
	[0078.370] lstrlenW (lpString=".jpg") returned 4
	[0078.370] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.370] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.370] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0078.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.371] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=9728) returned 1
	[0078.371] CloseHandle (hObject=0x374) returned 1
	[0078.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20
	[0078.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.371] lstrlenW (lpString=".doc") returned 4
	[0078.371] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.371] lstrlenW (lpString=".docx") returned 5
	[0078.371] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.371] lstrlenW (lpString=".pdf") returned 4
	[0078.371] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.371] lstrlenW (lpString=".xls") returned 4
	[0078.371] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.371] lstrlenW (lpString=".xlsx") returned 5
	[0078.372] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.372] lstrlenW (lpString=".ppt") returned 4
	[0078.372] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.372] lstrlenW (lpString=".zip") returned 4
	[0078.372] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.372] lstrlenW (lpString=".rar") returned 4
	[0078.372] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.372] lstrlenW (lpString=".bz2") returned 4
	[0078.372] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.372] lstrlenW (lpString=".7z") returned 3
	[0078.372] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.372] lstrlenW (lpString=".dbf") returned 4
	[0078.372] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.372] lstrlenW (lpString=".1cd") returned 4
	[0078.372] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.372] lstrlenW (lpString=".jpg") returned 4
	[0078.372] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.373] lstrlenW (lpString=".doc") returned 4
	[0078.373] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.373] lstrlenW (lpString=".docx") returned 5
	[0078.373] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.373] lstrlenW (lpString=".pdf") returned 4
	[0078.373] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.373] lstrlenW (lpString=".xls") returned 4
	[0078.373] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.373] lstrlenW (lpString=".xlsx") returned 5
	[0078.373] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.373] lstrlenW (lpString=".ppt") returned 4
	[0078.373] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.373] lstrlenW (lpString=".zip") returned 4
	[0078.373] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.373] lstrlenW (lpString=".rar") returned 4
	[0078.373] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.373] lstrlenW (lpString=".bz2") returned 4
	[0078.373] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.373] lstrlenW (lpString=".7z") returned 3
	[0078.374] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.374] lstrlenW (lpString=".dbf") returned 4
	[0078.374] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.374] lstrlenW (lpString=".1cd") returned 4
	[0078.374] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77
	[0078.374] lstrlenW (lpString=".jpg") returned 4
	[0078.374] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.374] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.374] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0078.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.374] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=10240) returned 1
	[0078.375] CloseHandle (hObject=0x374) returned 1
	[0078.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20
	[0078.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.375] lstrlenW (lpString=".doc") returned 4
	[0078.375] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.375] lstrlenW (lpString=".docx") returned 5
	[0078.375] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.375] lstrlenW (lpString=".pdf") returned 4
	[0078.375] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.375] lstrlenW (lpString=".xls") returned 4
	[0078.375] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.375] lstrlenW (lpString=".xlsx") returned 5
	[0078.376] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.376] lstrlenW (lpString=".ppt") returned 4
	[0078.376] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.376] lstrlenW (lpString=".zip") returned 4
	[0078.376] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.376] lstrlenW (lpString=".rar") returned 4
	[0078.376] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.376] lstrlenW (lpString=".bz2") returned 4
	[0078.376] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.376] lstrlenW (lpString=".7z") returned 3
	[0078.376] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.376] lstrlenW (lpString=".dbf") returned 4
	[0078.376] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.376] lstrlenW (lpString=".1cd") returned 4
	[0078.376] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.376] lstrlenW (lpString=".jpg") returned 4
	[0078.376] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.377] lstrlenW (lpString=".doc") returned 4
	[0078.377] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.377] lstrlenW (lpString=".docx") returned 5
	[0078.377] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.377] lstrlenW (lpString=".pdf") returned 4
	[0078.377] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.377] lstrlenW (lpString=".xls") returned 4
	[0078.377] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.377] lstrlenW (lpString=".xlsx") returned 5
	[0078.377] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.377] lstrlenW (lpString=".ppt") returned 4
	[0078.377] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.377] lstrlenW (lpString=".zip") returned 4
	[0078.377] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.377] lstrlenW (lpString=".rar") returned 4
	[0078.377] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.377] lstrlenW (lpString=".bz2") returned 4
	[0078.377] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.377] lstrlenW (lpString=".7z") returned 3
	[0078.377] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.377] lstrlenW (lpString=".dbf") returned 4
	[0078.378] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.378] lstrlenW (lpString=".1cd") returned 4
	[0078.378] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72
	[0078.378] lstrlenW (lpString=".jpg") returned 4
	[0078.378] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.378] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0078.378] lstrlenW (lpString="TabIpsps.dll") returned 12
	[0078.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.379] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=41984) returned 1
	[0078.379] CloseHandle (hObject=0x374) returned 1
	[0078.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20
	[0078.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.380] lstrlenW (lpString=".doc") returned 4
	[0078.380] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.380] lstrlenW (lpString=".docx") returned 5
	[0078.380] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0078.380] lstrlenW (lpString=".pdf") returned 4
	[0078.380] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.380] lstrlenW (lpString=".xls") returned 4
	[0078.380] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.380] lstrlenW (lpString=".xlsx") returned 5
	[0078.380] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0078.380] lstrlenW (lpString=".ppt") returned 4
	[0078.380] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.380] lstrlenW (lpString=".zip") returned 4
	[0078.381] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.381] lstrlenW (lpString=".rar") returned 4
	[0078.381] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.381] lstrlenW (lpString=".bz2") returned 4
	[0078.381] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.381] lstrlenW (lpString=".7z") returned 3
	[0078.381] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.381] lstrlenW (lpString=".dbf") returned 4
	[0078.381] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.381] lstrlenW (lpString=".1cd") returned 4
	[0078.381] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.381] lstrlenW (lpString=".jpg") returned 4
	[0078.381] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.382] lstrlenW (lpString=".doc") returned 4
	[0078.382] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.382] lstrlenW (lpString=".docx") returned 5
	[0078.382] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0078.382] lstrlenW (lpString=".pdf") returned 4
	[0078.382] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.382] lstrlenW (lpString=".xls") returned 4
	[0078.382] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.382] lstrlenW (lpString=".xlsx") returned 5
	[0078.382] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0078.382] lstrlenW (lpString=".ppt") returned 4
	[0078.382] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.382] lstrlenW (lpString=".zip") returned 4
	[0078.382] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.382] lstrlenW (lpString=".rar") returned 4
	[0078.382] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.382] lstrlenW (lpString=".bz2") returned 4
	[0078.383] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.383] lstrlenW (lpString=".7z") returned 3
	[0078.383] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.383] lstrlenW (lpString=".dbf") returned 4
	[0078.383] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.383] lstrlenW (lpString=".1cd") returned 4
	[0078.383] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63
	[0078.383] lstrlenW (lpString=".jpg") returned 4
	[0078.383] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.383] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0078.383] lstrlenW (lpString="TabTip.exe") returned 10
	[0078.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.384] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=391040) returned 1
	[0078.384] CloseHandle (hObject=0x374) returned 1
	[0078.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20
	[0078.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe") returned 61
	[0078.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe") returned 61
	[0078.384] lstrlenW (lpString=".doc") returned 4
	[0078.384] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0078.384] lstrlenW (lpString=".docx") returned 5
	[0078.384] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0078.385] lstrlenW (lpString=".pdf") returned 4
	[0078.385] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0078.385] lstrlenW (lpString=".xls") returned 4
	[0078.385] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0078.385] lstrlenW (lpString=".xlsx") returned 5
	[0078.385] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0078.385] lstrlenW (lpString=".ppt") returned 4
	[0078.385] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0078.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe") returned 61
	[0078.385] lstrlenW (lpString=".zip") returned 4
	[0078.385] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0078.385] lstrlenW (lpString=".rar") returned 4
	[0078.385] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0078.385] lstrlenW (lpString=".bz2") returned 4
	[0078.385] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0078.385] lstrlenW (lpString=".7z") returned 3
	[0078.385] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0078.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe") returned 61
	[0078.385] lstrlenW (lpString=".dbf") returned 4
	[0078.385] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0078.807] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.807] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0078.807] GetLastError () returned 0x0
	[0078.807] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0xf1b50, lpOverlapped=0x0) returned 1
	[0078.826] WriteFile (in: hFile=0x314, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf1b60, lpOverlapped=0x0) returned 1
	[0078.842] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.842] WriteFile (in: hFile=0x314, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.843] SetEndOfFile (hFile=0x314) returned 1
	[0078.843] CloseHandle (hObject=0x314) returned 1
	[0078.843] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.843] SetEndOfFile (hFile=0x374) returned 1
	[0078.852] CloseHandle (hObject=0x374) returned 1
	[0078.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0078.852] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1
	[0078.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0078.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0078.853] lstrlenW (lpString=".doc") returned 4
	[0078.853] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.853] lstrlenW (lpString=".docx") returned 5
	[0078.853] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0079.956] lstrlenW (lpString=".pdf") returned 4
	[0079.956] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.956] lstrlenW (lpString=".xls") returned 4
	[0079.956] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.956] lstrlenW (lpString=".xlsx") returned 5
	[0079.959] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0079.968] lstrlenW (lpString=".ppt") returned 4
	[0079.977] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0079.979] lstrlenW (lpString=".zip") returned 4
	[0079.979] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.980] lstrlenW (lpString=".rar") returned 4
	[0079.980] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.980] lstrlenW (lpString=".bz2") returned 4
	[0079.980] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.989] lstrlenW (lpString=".7z") returned 3
	[0079.989] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0079.989] lstrlenW (lpString=".dbf") returned 4
	[0079.989] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0079.989] lstrlenW (lpString=".1cd") returned 4
	[0079.989] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0079.989] lstrlenW (lpString=".jpg") returned 4
	[0079.989] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0079.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0079.989] lstrlenW (lpString=".doc") returned 4
	[0079.989] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.989] lstrlenW (lpString=".docx") returned 5
	[0079.989] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0079.989] lstrlenW (lpString=".pdf") returned 4
	[0079.989] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.989] lstrlenW (lpString=".xls") returned 4
	[0079.989] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.990] lstrlenW (lpString=".xlsx") returned 5
	[0079.990] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0079.990] lstrlenW (lpString=".ppt") returned 4
	[0079.990] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0079.990] lstrlenW (lpString=".zip") returned 4
	[0079.990] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.990] lstrlenW (lpString=".rar") returned 4
	[0079.990] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.990] lstrlenW (lpString=".bz2") returned 4
	[0079.990] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.990] lstrlenW (lpString=".7z") returned 3
	[0079.990] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0079.990] lstrlenW (lpString=".dbf") returned 4
	[0079.990] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0079.990] lstrlenW (lpString=".1cd") returned 4
	[0079.990] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0079.990] lstrlenW (lpString=".jpg") returned 4
	[0079.990] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.990] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0079.990] lstrlenW (lpString="VSTOLoader.dll") returned 14
	[0079.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0079.991] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=367216) returned 1
	[0079.991] CloseHandle (hObject=0x374) returned 1
	[0079.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20
	[0079.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0079.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0079.991] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.991] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0079.992] GetLastError () returned 0x0
	[0079.992] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x59a70, lpOverlapped=0x0) returned 1
	[0079.999] WriteFile (in: hFile=0x314, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x59a80, lpOverlapped=0x0) returned 1
	[0080.009] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.009] WriteFile (in: hFile=0x314, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0080.009] SetEndOfFile (hFile=0x314) returned 1
	[0080.009] CloseHandle (hObject=0x314) returned 1
	[0080.009] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.009] SetEndOfFile (hFile=0x374) returned 1
	[0080.013] CloseHandle (hObject=0x374) returned 1
	[0080.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0080.013] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1
	[0080.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.014] lstrlenW (lpString=".doc") returned 4
	[0080.014] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.014] lstrlenW (lpString=".docx") returned 5
	[0080.014] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0080.014] lstrlenW (lpString=".pdf") returned 4
	[0080.014] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.014] lstrlenW (lpString=".xls") returned 4
	[0080.014] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.014] lstrlenW (lpString=".xlsx") returned 5
	[0080.014] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0080.014] lstrlenW (lpString=".ppt") returned 4
	[0080.014] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.014] lstrlenW (lpString=".zip") returned 4
	[0080.014] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.014] lstrlenW (lpString=".rar") returned 4
	[0080.014] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.014] lstrlenW (lpString=".bz2") returned 4
	[0080.014] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.014] lstrlenW (lpString=".7z") returned 3
	[0080.014] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.014] lstrlenW (lpString=".dbf") returned 4
	[0080.014] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.014] lstrlenW (lpString=".1cd") returned 4
	[0080.014] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.014] lstrlenW (lpString=".jpg") returned 4
	[0080.014] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.015] lstrlenW (lpString=".doc") returned 4
	[0080.015] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.015] lstrlenW (lpString=".docx") returned 5
	[0080.015] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0080.015] lstrlenW (lpString=".pdf") returned 4
	[0080.015] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.015] lstrlenW (lpString=".xls") returned 4
	[0080.015] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.015] lstrlenW (lpString=".xlsx") returned 5
	[0080.015] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0080.015] lstrlenW (lpString=".ppt") returned 4
	[0080.015] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.015] lstrlenW (lpString=".zip") returned 4
	[0080.015] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.015] lstrlenW (lpString=".rar") returned 4
	[0080.015] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.015] lstrlenW (lpString=".bz2") returned 4
	[0080.015] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.015] lstrlenW (lpString=".7z") returned 3
	[0080.015] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.015] lstrlenW (lpString=".dbf") returned 4
	[0080.015] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.015] lstrlenW (lpString=".1cd") returned 4
	[0080.015] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0080.015] lstrlenW (lpString=".jpg") returned 4
	[0080.016] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.016] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0080.016] lstrlenW (lpString="VSTOMessageProvider.dll") returned 23
	[0080.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0080.016] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=48872) returned 1
	[0080.016] CloseHandle (hObject=0x374) returned 1
	[0080.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20
	[0080.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0080.017] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.017] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0080.017] GetLastError () returned 0x0
	[0080.017] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0xbee8, lpOverlapped=0x0) returned 1
	[0080.019] WriteFile (in: hFile=0x314, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xbef0, lpOverlapped=0x0) returned 1
	[0080.021] ReadFile (in: hFile=0x374, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.021] WriteFile (in: hFile=0x314, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x102, lpOverlapped=0x0) returned 1
	[0080.021] SetEndOfFile (hFile=0x314) returned 1
	[0080.021] CloseHandle (hObject=0x314) returned 1
	[0080.021] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.021] SetEndOfFile (hFile=0x374) returned 1
	[0080.022] CloseHandle (hObject=0x374) returned 1
	[0080.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0080.023] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1
	[0080.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.023] lstrlenW (lpString=".doc") returned 4
	[0080.023] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.023] lstrlenW (lpString=".docx") returned 5
	[0080.023] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0080.023] lstrlenW (lpString=".pdf") returned 4
	[0080.023] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.023] lstrlenW (lpString=".xls") returned 4
	[0080.023] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.023] lstrlenW (lpString=".xlsx") returned 5
	[0080.023] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0080.023] lstrlenW (lpString=".ppt") returned 4
	[0080.023] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.023] lstrlenW (lpString=".zip") returned 4
	[0080.023] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.023] lstrlenW (lpString=".rar") returned 4
	[0080.023] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.024] lstrlenW (lpString=".bz2") returned 4
	[0080.024] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.024] lstrlenW (lpString=".7z") returned 3
	[0080.024] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.024] lstrlenW (lpString=".dbf") returned 4
	[0080.024] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.024] lstrlenW (lpString=".1cd") returned 4
	[0080.024] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.024] lstrlenW (lpString=".jpg") returned 4
	[0080.024] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.024] lstrlenW (lpString=".doc") returned 4
	[0080.024] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.024] lstrlenW (lpString=".docx") returned 5
	[0080.024] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0080.024] lstrlenW (lpString=".pdf") returned 4
	[0080.024] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.024] lstrlenW (lpString=".xls") returned 4
	[0080.024] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.024] lstrlenW (lpString=".xlsx") returned 5
	[0080.024] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0080.024] lstrlenW (lpString=".ppt") returned 4
	[0080.024] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.024] lstrlenW (lpString=".zip") returned 4
	[0080.024] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.025] lstrlenW (lpString=".rar") returned 4
	[0080.025] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.025] lstrlenW (lpString=".bz2") returned 4
	[0080.025] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.025] lstrlenW (lpString=".7z") returned 3
	[0080.025] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.025] lstrlenW (lpString=".dbf") returned 4
	[0080.025] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.025] lstrlenW (lpString=".1cd") returned 4
	[0080.025] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0080.025] lstrlenW (lpString=".jpg") returned 4
	[0080.025] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.025] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0080.025] lstrlenW (lpString="vstoee.dll") returned 10
	[0080.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0080.978] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=168064) returned 1
	[0080.987] CloseHandle (hObject=0x320) returned 1
	[0080.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20
	[0080.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0081.011] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.021] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0081.021] GetLastError () returned 0x0
	[0081.021] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x29080, lpOverlapped=0x0) returned 1
	[0081.025] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x29090, lpOverlapped=0x0) returned 1
	[0081.029] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.029] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0081.029] SetEndOfFile (hFile=0x318) returned 1
	[0081.029] CloseHandle (hObject=0x318) returned 1
	[0081.029] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.029] SetEndOfFile (hFile=0x320) returned 1
	[0081.031] CloseHandle (hObject=0x320) returned 1
	[0081.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.031] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1
	[0081.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.031] lstrlenW (lpString=".doc") returned 4
	[0081.031] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.031] lstrlenW (lpString=".docx") returned 5
	[0081.031] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0081.031] lstrlenW (lpString=".pdf") returned 4
	[0081.031] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.032] lstrlenW (lpString=".xls") returned 4
	[0081.032] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.032] lstrlenW (lpString=".xlsx") returned 5
	[0081.032] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0081.032] lstrlenW (lpString=".ppt") returned 4
	[0081.032] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.032] lstrlenW (lpString=".zip") returned 4
	[0081.032] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.032] lstrlenW (lpString=".rar") returned 4
	[0081.032] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.032] lstrlenW (lpString=".bz2") returned 4
	[0081.032] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.032] lstrlenW (lpString=".7z") returned 3
	[0081.032] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.032] lstrlenW (lpString=".dbf") returned 4
	[0081.032] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.032] lstrlenW (lpString=".1cd") returned 4
	[0081.032] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.032] lstrlenW (lpString=".jpg") returned 4
	[0081.032] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.033] lstrlenW (lpString=".doc") returned 4
	[0081.033] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.033] lstrlenW (lpString=".docx") returned 5
	[0081.033] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0081.033] lstrlenW (lpString=".pdf") returned 4
	[0081.033] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.033] lstrlenW (lpString=".xls") returned 4
	[0081.033] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.033] lstrlenW (lpString=".xlsx") returned 5
	[0081.033] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0081.033] lstrlenW (lpString=".ppt") returned 4
	[0081.033] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.033] lstrlenW (lpString=".zip") returned 4
	[0081.033] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.033] lstrlenW (lpString=".rar") returned 4
	[0081.033] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.033] lstrlenW (lpString=".bz2") returned 4
	[0081.033] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.033] lstrlenW (lpString=".7z") returned 3
	[0081.033] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.033] lstrlenW (lpString=".dbf") returned 4
	[0081.033] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.033] lstrlenW (lpString=".1cd") returned 4
	[0081.033] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0081.033] lstrlenW (lpString=".jpg") returned 4
	[0081.033] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.034] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0081.034] lstrlenW (lpString="deploy.dll") returned 10
	[0081.034] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0081.034] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=587840) returned 1
	[0081.034] CloseHandle (hObject=0x320) returned 1
	[0081.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20
	[0081.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.034] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0081.034] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.035] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.035] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0081.035] GetLastError () returned 0x0
	[0081.035] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x8f840, lpOverlapped=0x0) returned 1
	[0081.050] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x8f850, lpOverlapped=0x0) returned 1
	[0081.060] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.061] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0081.061] SetEndOfFile (hFile=0x318) returned 1
	[0081.061] CloseHandle (hObject=0x318) returned 1
	[0081.061] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.061] SetEndOfFile (hFile=0x320) returned 1
	[0081.066] CloseHandle (hObject=0x320) returned 1
	[0081.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.079] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1
	[0081.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.079] lstrlenW (lpString=".doc") returned 4
	[0081.079] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.079] lstrlenW (lpString=".docx") returned 5
	[0081.079] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0081.080] lstrlenW (lpString=".pdf") returned 4
	[0081.080] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.080] lstrlenW (lpString=".xls") returned 4
	[0081.080] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.080] lstrlenW (lpString=".xlsx") returned 5
	[0081.080] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0081.080] lstrlenW (lpString=".ppt") returned 4
	[0081.080] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.080] lstrlenW (lpString=".zip") returned 4
	[0081.080] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.080] lstrlenW (lpString=".rar") returned 4
	[0081.080] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.080] lstrlenW (lpString=".bz2") returned 4
	[0081.080] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.080] lstrlenW (lpString=".7z") returned 3
	[0081.080] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.080] lstrlenW (lpString=".dbf") returned 4
	[0081.080] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.080] lstrlenW (lpString=".1cd") returned 4
	[0081.080] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.081] lstrlenW (lpString=".jpg") returned 4
	[0081.081] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.129] lstrlenW (lpString=".doc") returned 4
	[0081.129] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.129] lstrlenW (lpString=".docx") returned 5
	[0081.129] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0081.129] lstrlenW (lpString=".pdf") returned 4
	[0081.129] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.130] lstrlenW (lpString=".xls") returned 4
	[0081.130] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.130] lstrlenW (lpString=".xlsx") returned 5
	[0081.130] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0081.130] lstrlenW (lpString=".ppt") returned 4
	[0081.130] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.130] lstrlenW (lpString=".zip") returned 4
	[0081.130] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.130] lstrlenW (lpString=".rar") returned 4
	[0081.130] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.130] lstrlenW (lpString=".bz2") returned 4
	[0081.130] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.130] lstrlenW (lpString=".7z") returned 3
	[0081.130] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.130] lstrlenW (lpString=".dbf") returned 4
	[0081.130] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.130] lstrlenW (lpString=".1cd") returned 4
	[0081.130] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0081.130] lstrlenW (lpString=".jpg") returned 4
	[0081.130] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.131] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0081.131] lstrlenW (lpString="npdeployJava1.dll") returned 17
	[0081.131] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0081.131] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=1156672) returned 1
	[0081.131] CloseHandle (hObject=0x320) returned 1
	[0081.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20
	[0081.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0081.132] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.132] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0081.133] GetLastError () returned 0x0
	[0081.133] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0081.157] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0081.175] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x1a650, lpOverlapped=0x0) returned 1
	[0081.584] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x1a660, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x1a660, lpOverlapped=0x0) returned 1
	[0081.962] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.962] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0081.962] SetEndOfFile (hFile=0x318) returned 1
	[0081.962] CloseHandle (hObject=0x318) returned 1
	[0081.962] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.962] SetEndOfFile (hFile=0x320) returned 1
	[0081.964] CloseHandle (hObject=0x320) returned 1
	[0081.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.964] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 1
	[0081.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.964] lstrlenW (lpString=".doc") returned 4
	[0081.964] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.964] lstrlenW (lpString=".docx") returned 5
	[0081.964] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0081.964] lstrlenW (lpString=".pdf") returned 4
	[0081.964] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.964] lstrlenW (lpString=".xls") returned 4
	[0081.964] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.965] lstrlenW (lpString=".xlsx") returned 5
	[0081.965] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0081.965] lstrlenW (lpString=".ppt") returned 4
	[0081.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.965] lstrlenW (lpString=".zip") returned 4
	[0081.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.965] lstrlenW (lpString=".rar") returned 4
	[0081.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.965] lstrlenW (lpString=".bz2") returned 4
	[0081.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.965] lstrlenW (lpString=".7z") returned 3
	[0081.965] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.965] lstrlenW (lpString=".dbf") returned 4
	[0081.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.965] lstrlenW (lpString=".1cd") returned 4
	[0081.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.965] lstrlenW (lpString=".jpg") returned 4
	[0081.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.965] lstrlenW (lpString=".doc") returned 4
	[0081.965] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.965] lstrlenW (lpString=".docx") returned 5
	[0081.966] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0081.966] lstrlenW (lpString=".pdf") returned 4
	[0081.966] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.966] lstrlenW (lpString=".xls") returned 4
	[0081.966] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.966] lstrlenW (lpString=".xlsx") returned 5
	[0081.966] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0081.966] lstrlenW (lpString=".ppt") returned 4
	[0081.966] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.966] lstrlenW (lpString=".zip") returned 4
	[0081.966] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.966] lstrlenW (lpString=".rar") returned 4
	[0081.966] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.966] lstrlenW (lpString=".bz2") returned 4
	[0081.966] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.966] lstrlenW (lpString=".7z") returned 3
	[0081.966] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.966] lstrlenW (lpString=".dbf") returned 4
	[0081.966] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.966] lstrlenW (lpString=".1cd") returned 4
	[0081.966] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0081.966] lstrlenW (lpString=".jpg") returned 4
	[0081.966] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.967] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0081.967] lstrlenW (lpString="glib-lite.dll") returned 13
	[0081.967] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0081.967] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=455744) returned 1
	[0081.967] CloseHandle (hObject=0x320) returned 1
	[0081.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20
	[0081.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.967] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0081.967] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.967] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.968] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0081.968] GetLastError () returned 0x0
	[0081.968] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x6f440, lpOverlapped=0x0) returned 1
	[0081.976] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x6f450, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x6f450, lpOverlapped=0x0) returned 1
	[0081.984] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.984] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xee, lpOverlapped=0x0) returned 1
	[0081.984] SetEndOfFile (hFile=0x318) returned 1
	[0081.984] CloseHandle (hObject=0x318) returned 1
	[0081.984] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.984] SetEndOfFile (hFile=0x320) returned 1
	[0081.988] CloseHandle (hObject=0x320) returned 1
	[0081.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.988] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 1
	[0082.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.285] lstrlenW (lpString=".doc") returned 4
	[0082.285] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.285] lstrlenW (lpString=".docx") returned 5
	[0082.285] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0082.285] lstrlenW (lpString=".pdf") returned 4
	[0082.285] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.285] lstrlenW (lpString=".xls") returned 4
	[0082.285] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.285] lstrlenW (lpString=".xlsx") returned 5
	[0082.285] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0082.285] lstrlenW (lpString=".ppt") returned 4
	[0082.285] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.285] lstrlenW (lpString=".zip") returned 4
	[0082.285] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.285] lstrlenW (lpString=".rar") returned 4
	[0082.285] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.285] lstrlenW (lpString=".bz2") returned 4
	[0082.285] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.285] lstrlenW (lpString=".7z") returned 3
	[0082.285] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.285] lstrlenW (lpString=".dbf") returned 4
	[0082.285] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.285] lstrlenW (lpString=".1cd") returned 4
	[0082.285] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.286] lstrlenW (lpString=".jpg") returned 4
	[0082.286] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.286] lstrlenW (lpString=".doc") returned 4
	[0082.286] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.286] lstrlenW (lpString=".docx") returned 5
	[0082.286] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0082.286] lstrlenW (lpString=".pdf") returned 4
	[0082.286] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.286] lstrlenW (lpString=".xls") returned 4
	[0082.286] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.286] lstrlenW (lpString=".xlsx") returned 5
	[0082.286] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0082.286] lstrlenW (lpString=".ppt") returned 4
	[0082.286] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.286] lstrlenW (lpString=".zip") returned 4
	[0082.286] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.286] lstrlenW (lpString=".rar") returned 4
	[0082.286] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.286] lstrlenW (lpString=".bz2") returned 4
	[0082.286] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.286] lstrlenW (lpString=".7z") returned 3
	[0082.286] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.286] lstrlenW (lpString=".dbf") returned 4
	[0082.287] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.287] lstrlenW (lpString=".1cd") returned 4
	[0082.287] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0082.287] lstrlenW (lpString=".jpg") returned 4
	[0082.287] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.287] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0082.287] lstrlenW (lpString="java-rmi.exe") returned 12
	[0082.287] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.288] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=15936) returned 1
	[0082.288] CloseHandle (hObject=0x340) returned 1
	[0082.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20
	[0082.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.288] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.288] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.288] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.288] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0082.289] GetLastError () returned 0x0
	[0082.289] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x3e40, lpOverlapped=0x0) returned 1
	[0082.290] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x3e50, lpOverlapped=0x0) returned 1
	[0082.291] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.291] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xec, lpOverlapped=0x0) returned 1
	[0082.291] SetEndOfFile (hFile=0x318) returned 1
	[0082.291] CloseHandle (hObject=0x318) returned 1
	[0082.292] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.292] SetEndOfFile (hFile=0x340) returned 1
	[0082.293] CloseHandle (hObject=0x340) returned 1
	[0082.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.293] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 1
	[0082.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.293] lstrlenW (lpString=".doc") returned 4
	[0082.293] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0082.293] lstrlenW (lpString=".docx") returned 5
	[0082.293] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1
	[0082.293] lstrlenW (lpString=".pdf") returned 4
	[0082.293] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0082.293] lstrlenW (lpString=".xls") returned 4
	[0082.293] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0082.293] lstrlenW (lpString=".xlsx") returned 5
	[0082.293] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1
	[0082.293] lstrlenW (lpString=".ppt") returned 4
	[0082.293] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0082.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.294] lstrlenW (lpString=".zip") returned 4
	[0082.294] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0082.294] lstrlenW (lpString=".rar") returned 4
	[0082.294] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0082.294] lstrlenW (lpString=".bz2") returned 4
	[0082.294] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0082.294] lstrlenW (lpString=".7z") returned 3
	[0082.294] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0082.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.294] lstrlenW (lpString=".dbf") returned 4
	[0082.294] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0082.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.294] lstrlenW (lpString=".1cd") returned 4
	[0082.294] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0082.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.294] lstrlenW (lpString=".jpg") returned 4
	[0082.294] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0082.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.294] lstrlenW (lpString=".doc") returned 4
	[0082.294] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0082.294] lstrlenW (lpString=".docx") returned 5
	[0082.294] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1
	[0082.294] lstrlenW (lpString=".pdf") returned 4
	[0082.294] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0082.294] lstrlenW (lpString=".xls") returned 4
	[0082.295] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0082.295] lstrlenW (lpString=".xlsx") returned 5
	[0082.295] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1
	[0082.295] lstrlenW (lpString=".ppt") returned 4
	[0082.295] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0082.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.295] lstrlenW (lpString=".zip") returned 4
	[0082.295] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0082.295] lstrlenW (lpString=".rar") returned 4
	[0082.295] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0082.295] lstrlenW (lpString=".bz2") returned 4
	[0082.295] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0082.295] lstrlenW (lpString=".7z") returned 3
	[0082.295] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0082.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.295] lstrlenW (lpString=".dbf") returned 4
	[0082.295] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0082.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.295] lstrlenW (lpString=".1cd") returned 4
	[0082.295] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0082.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0082.295] lstrlenW (lpString=".jpg") returned 4
	[0082.295] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0082.296] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0082.296] lstrlenW (lpString="java.dll") returned 8
	[0082.296] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.296] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=159808) returned 1
	[0082.296] CloseHandle (hObject=0x340) returned 1
	[0082.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20
	[0082.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.296] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.296] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.296] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.296] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0082.297] GetLastError () returned 0x0
	[0082.297] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x27040, lpOverlapped=0x0) returned 1
	[0082.300] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x27050, lpOverlapped=0x0) returned 1
	[0082.304] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.304] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0082.304] SetEndOfFile (hFile=0x318) returned 1
	[0082.304] CloseHandle (hObject=0x318) returned 1
	[0082.304] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.304] SetEndOfFile (hFile=0x340) returned 1
	[0082.306] CloseHandle (hObject=0x340) returned 1
	[0082.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.306] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 1
	[0082.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.306] lstrlenW (lpString=".doc") returned 4
	[0082.307] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.307] lstrlenW (lpString=".docx") returned 5
	[0082.307] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0082.307] lstrlenW (lpString=".pdf") returned 4
	[0082.307] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.307] lstrlenW (lpString=".xls") returned 4
	[0082.307] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.307] lstrlenW (lpString=".xlsx") returned 5
	[0082.307] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0082.307] lstrlenW (lpString=".ppt") returned 4
	[0082.307] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.307] lstrlenW (lpString=".zip") returned 4
	[0082.307] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.307] lstrlenW (lpString=".rar") returned 4
	[0082.307] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.307] lstrlenW (lpString=".bz2") returned 4
	[0082.307] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.307] lstrlenW (lpString=".7z") returned 3
	[0082.307] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.307] lstrlenW (lpString=".dbf") returned 4
	[0082.307] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.307] lstrlenW (lpString=".1cd") returned 4
	[0082.307] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.308] lstrlenW (lpString=".jpg") returned 4
	[0082.308] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.308] lstrlenW (lpString=".doc") returned 4
	[0082.308] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.308] lstrlenW (lpString=".docx") returned 5
	[0082.308] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0082.308] lstrlenW (lpString=".pdf") returned 4
	[0082.308] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.308] lstrlenW (lpString=".xls") returned 4
	[0082.308] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.308] lstrlenW (lpString=".xlsx") returned 5
	[0082.308] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0082.308] lstrlenW (lpString=".ppt") returned 4
	[0082.308] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.308] lstrlenW (lpString=".zip") returned 4
	[0082.308] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.308] lstrlenW (lpString=".rar") returned 4
	[0082.308] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.308] lstrlenW (lpString=".bz2") returned 4
	[0082.308] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.308] lstrlenW (lpString=".7z") returned 3
	[0082.308] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.308] lstrlenW (lpString=".dbf") returned 4
	[0082.309] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.309] lstrlenW (lpString=".1cd") returned 4
	[0082.309] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0082.309] lstrlenW (lpString=".jpg") returned 4
	[0082.309] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.309] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0082.309] lstrlenW (lpString="java.exe") returned 8
	[0082.309] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.309] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=206912) returned 1
	[0082.309] CloseHandle (hObject=0x340) returned 1
	[0082.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20
	[0082.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.310] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.310] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.310] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.310] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0082.311] GetLastError () returned 0x0
	[0082.311] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x32840, lpOverlapped=0x0) returned 1
	[0082.315] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x32850, lpOverlapped=0x0) returned 1
	[0082.319] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.319] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0082.319] SetEndOfFile (hFile=0x318) returned 1
	[0082.319] CloseHandle (hObject=0x318) returned 1
	[0082.319] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.319] SetEndOfFile (hFile=0x340) returned 1
	[0082.321] CloseHandle (hObject=0x340) returned 1
	[0082.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.321] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 1
	[0082.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.322] lstrlenW (lpString=".doc") returned 4
	[0082.322] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0082.322] lstrlenW (lpString=".docx") returned 5
	[0082.322] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1
	[0082.322] lstrlenW (lpString=".pdf") returned 4
	[0082.322] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0082.322] lstrlenW (lpString=".xls") returned 4
	[0082.322] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0082.322] lstrlenW (lpString=".xlsx") returned 5
	[0082.322] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1
	[0082.322] lstrlenW (lpString=".ppt") returned 4
	[0082.322] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0082.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.322] lstrlenW (lpString=".zip") returned 4
	[0082.322] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0082.322] lstrlenW (lpString=".rar") returned 4
	[0082.322] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0082.322] lstrlenW (lpString=".bz2") returned 4
	[0082.322] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0082.322] lstrlenW (lpString=".7z") returned 3
	[0082.322] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0082.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.322] lstrlenW (lpString=".dbf") returned 4
	[0082.323] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0082.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.323] lstrlenW (lpString=".1cd") returned 4
	[0082.323] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0082.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.323] lstrlenW (lpString=".jpg") returned 4
	[0082.323] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0082.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.323] lstrlenW (lpString=".doc") returned 4
	[0082.323] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0082.323] lstrlenW (lpString=".docx") returned 5
	[0082.323] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1
	[0082.323] lstrlenW (lpString=".pdf") returned 4
	[0082.323] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0082.323] lstrlenW (lpString=".xls") returned 4
	[0082.323] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0082.323] lstrlenW (lpString=".xlsx") returned 5
	[0082.323] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1
	[0082.323] lstrlenW (lpString=".ppt") returned 4
	[0082.323] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0082.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.323] lstrlenW (lpString=".zip") returned 4
	[0082.323] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0082.323] lstrlenW (lpString=".rar") returned 4
	[0082.323] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0082.323] lstrlenW (lpString=".bz2") returned 4
	[0082.323] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0082.324] lstrlenW (lpString=".7z") returned 3
	[0082.324] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0082.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.324] lstrlenW (lpString=".dbf") returned 4
	[0082.324] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0082.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.324] lstrlenW (lpString=".1cd") returned 4
	[0082.324] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0082.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0082.324] lstrlenW (lpString=".jpg") returned 4
	[0082.324] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0082.324] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0082.324] lstrlenW (lpString="JavaAccessBridge-64.dll") returned 23
	[0082.324] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.324] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=142400) returned 1
	[0082.325] CloseHandle (hObject=0x340) returned 1
	[0082.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20
	[0082.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.325] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.325] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.325] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.325] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0082.325] GetLastError () returned 0x0
	[0082.325] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x22c40, lpOverlapped=0x0) returned 1
	[0082.718] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x22c50, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x22c50, lpOverlapped=0x0) returned 1
	[0082.721] ReadFile (in: hFile=0x340, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.721] WriteFile (in: hFile=0x318, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x102, lpOverlapped=0x0) returned 1
	[0082.721] SetEndOfFile (hFile=0x318) returned 1
	[0082.721] CloseHandle (hObject=0x318) returned 1
	[0082.721] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.721] SetEndOfFile (hFile=0x340) returned 1
	[0082.723] CloseHandle (hObject=0x340) returned 1
	[0082.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.723] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 1
	[0083.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.062] lstrlenW (lpString=".doc") returned 4
	[0083.062] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.062] lstrlenW (lpString=".docx") returned 5
	[0083.062] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0083.063] lstrlenW (lpString=".pdf") returned 4
	[0083.063] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.063] lstrlenW (lpString=".xls") returned 4
	[0083.063] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.063] lstrlenW (lpString=".xlsx") returned 5
	[0083.063] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0083.063] lstrlenW (lpString=".ppt") returned 4
	[0083.063] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.063] lstrlenW (lpString=".zip") returned 4
	[0083.063] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.063] lstrlenW (lpString=".rar") returned 4
	[0083.063] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.063] lstrlenW (lpString=".bz2") returned 4
	[0083.063] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.063] lstrlenW (lpString=".7z") returned 3
	[0083.063] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.063] lstrlenW (lpString=".dbf") returned 4
	[0083.063] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.063] lstrlenW (lpString=".1cd") returned 4
	[0083.064] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.064] lstrlenW (lpString=".jpg") returned 4
	[0083.064] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.064] lstrlenW (lpString=".doc") returned 4
	[0083.064] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.064] lstrlenW (lpString=".docx") returned 5
	[0083.064] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0083.064] lstrlenW (lpString=".pdf") returned 4
	[0083.064] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.064] lstrlenW (lpString=".xls") returned 4
	[0083.064] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.064] lstrlenW (lpString=".xlsx") returned 5
	[0083.064] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0083.064] lstrlenW (lpString=".ppt") returned 4
	[0083.064] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.064] lstrlenW (lpString=".zip") returned 4
	[0083.064] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.064] lstrlenW (lpString=".rar") returned 4
	[0083.064] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.064] lstrlenW (lpString=".bz2") returned 4
	[0083.064] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.064] lstrlenW (lpString=".7z") returned 3
	[0083.065] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.065] lstrlenW (lpString=".dbf") returned 4
	[0083.065] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.065] lstrlenW (lpString=".1cd") returned 4
	[0083.065] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0083.065] lstrlenW (lpString=".jpg") returned 4
	[0083.065] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.065] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.065] lstrlenW (lpString="jawt.dll") returned 8
	[0083.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.066] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=14400) returned 1
	[0083.067] CloseHandle (hObject=0x320) returned 1
	[0083.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20
	[0083.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.067] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.067] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.067] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.067] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0083.067] GetLastError () returned 0x0
	[0083.067] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x3840, lpOverlapped=0x0) returned 1
	[0083.069] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x3850, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x3850, lpOverlapped=0x0) returned 1
	[0083.070] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.070] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0083.070] SetEndOfFile (hFile=0x35c) returned 1
	[0083.070] CloseHandle (hObject=0x35c) returned 1
	[0083.071] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.071] SetEndOfFile (hFile=0x320) returned 1
	[0083.072] CloseHandle (hObject=0x320) returned 1
	[0083.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.072] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 1
	[0083.072] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.072] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.072] lstrlenW (lpString=".doc") returned 4
	[0083.072] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.072] lstrlenW (lpString=".docx") returned 5
	[0083.072] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0083.072] lstrlenW (lpString=".pdf") returned 4
	[0083.072] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.072] lstrlenW (lpString=".xls") returned 4
	[0083.073] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.073] lstrlenW (lpString=".xlsx") returned 5
	[0083.073] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0083.073] lstrlenW (lpString=".ppt") returned 4
	[0083.073] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.073] lstrlenW (lpString=".zip") returned 4
	[0083.073] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.073] lstrlenW (lpString=".rar") returned 4
	[0083.073] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.073] lstrlenW (lpString=".bz2") returned 4
	[0083.073] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.073] lstrlenW (lpString=".7z") returned 3
	[0083.073] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.073] lstrlenW (lpString=".dbf") returned 4
	[0083.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.073] lstrlenW (lpString=".1cd") returned 4
	[0083.073] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.073] lstrlenW (lpString=".jpg") returned 4
	[0083.073] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.074] lstrlenW (lpString=".doc") returned 4
	[0083.074] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.074] lstrlenW (lpString=".docx") returned 5
	[0083.074] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0083.074] lstrlenW (lpString=".pdf") returned 4
	[0083.074] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.074] lstrlenW (lpString=".xls") returned 4
	[0083.074] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.074] lstrlenW (lpString=".xlsx") returned 5
	[0083.074] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0083.074] lstrlenW (lpString=".ppt") returned 4
	[0083.074] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.074] lstrlenW (lpString=".zip") returned 4
	[0083.074] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.074] lstrlenW (lpString=".rar") returned 4
	[0083.074] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.074] lstrlenW (lpString=".bz2") returned 4
	[0083.074] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.074] lstrlenW (lpString=".7z") returned 3
	[0083.074] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.074] lstrlenW (lpString=".dbf") returned 4
	[0083.074] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.074] lstrlenW (lpString=".1cd") returned 4
	[0083.074] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0083.074] lstrlenW (lpString=".jpg") returned 4
	[0083.074] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.075] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.075] lstrlenW (lpString="JAWTAccessBridge-64.dll") returned 23
	[0083.075] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.075] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=15424) returned 1
	[0083.075] CloseHandle (hObject=0x320) returned 1
	[0083.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20
	[0083.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.075] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.075] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.075] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.076] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0083.076] GetLastError () returned 0x0
	[0083.076] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x3c40, lpOverlapped=0x0) returned 1
	[0083.077] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x3c50, lpOverlapped=0x0) returned 1
	[0083.079] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.079] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x102, lpOverlapped=0x0) returned 1
	[0083.079] SetEndOfFile (hFile=0x35c) returned 1
	[0083.079] CloseHandle (hObject=0x35c) returned 1
	[0083.079] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.079] SetEndOfFile (hFile=0x320) returned 1
	[0083.080] CloseHandle (hObject=0x320) returned 1
	[0083.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.080] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 1
	[0083.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.081] lstrlenW (lpString=".doc") returned 4
	[0083.081] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.081] lstrlenW (lpString=".docx") returned 5
	[0083.081] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0083.081] lstrlenW (lpString=".pdf") returned 4
	[0083.081] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.081] lstrlenW (lpString=".xls") returned 4
	[0083.081] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.081] lstrlenW (lpString=".xlsx") returned 5
	[0083.081] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0083.081] lstrlenW (lpString=".ppt") returned 4
	[0083.081] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.081] lstrlenW (lpString=".zip") returned 4
	[0083.081] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.081] lstrlenW (lpString=".rar") returned 4
	[0083.081] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.081] lstrlenW (lpString=".bz2") returned 4
	[0083.081] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.081] lstrlenW (lpString=".7z") returned 3
	[0083.081] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.082] lstrlenW (lpString=".dbf") returned 4
	[0083.082] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.082] lstrlenW (lpString=".1cd") returned 4
	[0083.082] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.082] lstrlenW (lpString=".jpg") returned 4
	[0083.082] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.082] lstrlenW (lpString=".doc") returned 4
	[0083.082] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.082] lstrlenW (lpString=".docx") returned 5
	[0083.082] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0083.082] lstrlenW (lpString=".pdf") returned 4
	[0083.083] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.083] lstrlenW (lpString=".xls") returned 4
	[0083.083] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.083] lstrlenW (lpString=".xlsx") returned 5
	[0083.083] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0083.083] lstrlenW (lpString=".ppt") returned 4
	[0083.083] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.083] lstrlenW (lpString=".zip") returned 4
	[0083.083] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.083] lstrlenW (lpString=".rar") returned 4
	[0083.083] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.083] lstrlenW (lpString=".bz2") returned 4
	[0083.083] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.083] lstrlenW (lpString=".7z") returned 3
	[0083.083] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.083] lstrlenW (lpString=".dbf") returned 4
	[0083.083] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.083] lstrlenW (lpString=".1cd") returned 4
	[0083.083] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0083.083] lstrlenW (lpString=".jpg") returned 4
	[0083.083] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.084] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.084] lstrlenW (lpString="jdwp.dll") returned 8
	[0083.084] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.085] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=201792) returned 1
	[0083.085] CloseHandle (hObject=0x320) returned 1
	[0083.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20
	[0083.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.085] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.085] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.085] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.085] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0083.085] GetLastError () returned 0x0
	[0083.085] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x31440, lpOverlapped=0x0) returned 1
	[0083.091] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x31450, lpOverlapped=0x0) returned 1
	[0083.095] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.095] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0083.095] SetEndOfFile (hFile=0x35c) returned 1
	[0083.095] CloseHandle (hObject=0x35c) returned 1
	[0083.095] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.095] SetEndOfFile (hFile=0x320) returned 1
	[0083.097] CloseHandle (hObject=0x320) returned 1
	[0083.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.431] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 1
	[0083.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.431] lstrlenW (lpString=".doc") returned 4
	[0083.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.431] lstrlenW (lpString=".docx") returned 5
	[0083.431] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0083.431] lstrlenW (lpString=".pdf") returned 4
	[0083.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.431] lstrlenW (lpString=".xls") returned 4
	[0083.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.431] lstrlenW (lpString=".xlsx") returned 5
	[0083.432] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0083.432] lstrlenW (lpString=".ppt") returned 4
	[0083.432] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.432] lstrlenW (lpString=".zip") returned 4
	[0083.432] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.432] lstrlenW (lpString=".rar") returned 4
	[0083.432] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.432] lstrlenW (lpString=".bz2") returned 4
	[0083.432] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.432] lstrlenW (lpString=".7z") returned 3
	[0083.432] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.432] lstrlenW (lpString=".dbf") returned 4
	[0083.432] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.432] lstrlenW (lpString=".1cd") returned 4
	[0083.432] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.432] lstrlenW (lpString=".jpg") returned 4
	[0083.432] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.432] lstrlenW (lpString=".doc") returned 4
	[0083.433] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.433] lstrlenW (lpString=".docx") returned 5
	[0083.433] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0083.433] lstrlenW (lpString=".pdf") returned 4
	[0083.433] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.433] lstrlenW (lpString=".xls") returned 4
	[0083.433] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.433] lstrlenW (lpString=".xlsx") returned 5
	[0083.433] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0083.433] lstrlenW (lpString=".ppt") returned 4
	[0083.433] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.433] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.433] lstrlenW (lpString=".zip") returned 4
	[0083.433] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.433] lstrlenW (lpString=".rar") returned 4
	[0083.433] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.433] lstrlenW (lpString=".bz2") returned 4
	[0083.433] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.433] lstrlenW (lpString=".7z") returned 3
	[0083.433] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.433] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.433] lstrlenW (lpString=".dbf") returned 4
	[0083.433] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.433] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.433] lstrlenW (lpString=".1cd") returned 4
	[0083.434] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.434] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0083.434] lstrlenW (lpString=".jpg") returned 4
	[0083.434] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.434] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0083.434] lstrlenW (lpString="jp2launcher.exe") returned 15
	[0083.434] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.435] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=112192) returned 1
	[0083.435] CloseHandle (hObject=0x320) returned 1
	[0083.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20
	[0083.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.435] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.435] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.435] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.435] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0083.436] GetLastError () returned 0x0
	[0083.436] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x1b640, lpOverlapped=0x0) returned 1
	[0083.439] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x1b650, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x1b650, lpOverlapped=0x0) returned 1
	[0083.441] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.441] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0083.441] SetEndOfFile (hFile=0x344) returned 1
	[0083.441] CloseHandle (hObject=0x344) returned 1
	[0083.441] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.442] SetEndOfFile (hFile=0x320) returned 1
	[0083.443] CloseHandle (hObject=0x320) returned 1
	[0083.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.443] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 1
	[0083.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.443] lstrlenW (lpString=".doc") returned 4
	[0083.444] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.444] lstrlenW (lpString=".docx") returned 5
	[0083.444] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0083.444] lstrlenW (lpString=".pdf") returned 4
	[0083.444] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.444] lstrlenW (lpString=".xls") returned 4
	[0083.444] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.444] lstrlenW (lpString=".xlsx") returned 5
	[0083.444] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0083.444] lstrlenW (lpString=".ppt") returned 4
	[0083.444] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.444] lstrlenW (lpString=".zip") returned 4
	[0083.444] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.444] lstrlenW (lpString=".rar") returned 4
	[0083.444] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.444] lstrlenW (lpString=".bz2") returned 4
	[0083.444] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.444] lstrlenW (lpString=".7z") returned 3
	[0083.444] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.444] lstrlenW (lpString=".dbf") returned 4
	[0083.444] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.444] lstrlenW (lpString=".1cd") returned 4
	[0083.445] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.445] lstrlenW (lpString=".jpg") returned 4
	[0083.445] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.445] lstrlenW (lpString=".doc") returned 4
	[0083.445] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.445] lstrlenW (lpString=".docx") returned 5
	[0083.445] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0083.445] lstrlenW (lpString=".pdf") returned 4
	[0083.445] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.445] lstrlenW (lpString=".xls") returned 4
	[0083.445] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.445] lstrlenW (lpString=".xlsx") returned 5
	[0083.445] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0083.445] lstrlenW (lpString=".ppt") returned 4
	[0083.445] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.445] lstrlenW (lpString=".zip") returned 4
	[0083.445] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.445] lstrlenW (lpString=".rar") returned 4
	[0083.445] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.445] lstrlenW (lpString=".bz2") returned 4
	[0083.446] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.446] lstrlenW (lpString=".7z") returned 3
	[0083.446] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.446] lstrlenW (lpString=".dbf") returned 4
	[0083.446] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.446] lstrlenW (lpString=".1cd") returned 4
	[0083.446] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0083.446] lstrlenW (lpString=".jpg") returned 4
	[0083.446] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.446] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.446] lstrlenW (lpString="jp2native.dll") returned 13
	[0083.446] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.447] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=20032) returned 1
	[0083.447] CloseHandle (hObject=0x320) returned 1
	[0083.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20
	[0083.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.447] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.447] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.447] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.447] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0083.448] GetLastError () returned 0x0
	[0083.448] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x4e40, lpOverlapped=0x0) returned 1
	[0083.449] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x4e50, lpOverlapped=0x0) returned 1
	[0083.450] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.451] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xee, lpOverlapped=0x0) returned 1
	[0083.451] SetEndOfFile (hFile=0x344) returned 1
	[0083.451] CloseHandle (hObject=0x344) returned 1
	[0083.451] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.451] SetEndOfFile (hFile=0x320) returned 1
	[0083.452] CloseHandle (hObject=0x320) returned 1
	[0083.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.452] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 1
	[0083.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.452] lstrlenW (lpString=".doc") returned 4
	[0083.452] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.452] lstrlenW (lpString=".docx") returned 5
	[0083.453] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0083.453] lstrlenW (lpString=".pdf") returned 4
	[0083.453] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.453] lstrlenW (lpString=".xls") returned 4
	[0083.453] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.453] lstrlenW (lpString=".xlsx") returned 5
	[0083.453] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0083.453] lstrlenW (lpString=".ppt") returned 4
	[0083.453] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.453] lstrlenW (lpString=".zip") returned 4
	[0083.453] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.453] lstrlenW (lpString=".rar") returned 4
	[0083.453] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.453] lstrlenW (lpString=".bz2") returned 4
	[0083.453] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.453] lstrlenW (lpString=".7z") returned 3
	[0083.453] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.453] lstrlenW (lpString=".dbf") returned 4
	[0083.453] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.453] lstrlenW (lpString=".1cd") returned 4
	[0083.453] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.453] lstrlenW (lpString=".jpg") returned 4
	[0083.453] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.454] lstrlenW (lpString=".doc") returned 4
	[0083.454] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.454] lstrlenW (lpString=".docx") returned 5
	[0083.454] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0083.454] lstrlenW (lpString=".pdf") returned 4
	[0083.454] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.454] lstrlenW (lpString=".xls") returned 4
	[0083.454] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.454] lstrlenW (lpString=".xlsx") returned 5
	[0083.454] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0083.454] lstrlenW (lpString=".ppt") returned 4
	[0083.454] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.454] lstrlenW (lpString=".zip") returned 4
	[0083.454] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.454] lstrlenW (lpString=".rar") returned 4
	[0083.454] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.454] lstrlenW (lpString=".bz2") returned 4
	[0083.454] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.454] lstrlenW (lpString=".7z") returned 3
	[0083.454] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.454] lstrlenW (lpString=".dbf") returned 4
	[0083.454] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.454] lstrlenW (lpString=".1cd") returned 4
	[0083.454] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0083.455] lstrlenW (lpString=".jpg") returned 4
	[0083.455] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.455] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.455] lstrlenW (lpString="jp2ssv.dll") returned 10
	[0083.455] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.455] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=235584) returned 1
	[0083.455] CloseHandle (hObject=0x320) returned 1
	[0083.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20
	[0083.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.456] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.456] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.456] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.456] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0083.456] GetLastError () returned 0x0
	[0083.456] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x39840, lpOverlapped=0x0) returned 1
	[0083.461] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x39850, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x39850, lpOverlapped=0x0) returned 1
	[0083.465] ReadFile (in: hFile=0x320, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.465] WriteFile (in: hFile=0x344, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0083.465] SetEndOfFile (hFile=0x344) returned 1
	[0083.465] CloseHandle (hObject=0x344) returned 1
	[0083.466] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.466] SetEndOfFile (hFile=0x320) returned 1
	[0083.468] CloseHandle (hObject=0x320) returned 1
	[0083.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.468] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 1
	[0083.468] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.468] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.468] lstrlenW (lpString=".doc") returned 4
	[0083.468] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.468] lstrlenW (lpString=".docx") returned 5
	[0083.468] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1
	[0083.468] lstrlenW (lpString=".pdf") returned 4
	[0083.468] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.469] lstrlenW (lpString=".xls") returned 4
	[0083.469] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.469] lstrlenW (lpString=".xlsx") returned 5
	[0083.469] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1
	[0083.469] lstrlenW (lpString=".ppt") returned 4
	[0083.469] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.469] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.469] lstrlenW (lpString=".zip") returned 4
	[0083.469] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.469] lstrlenW (lpString=".rar") returned 4
	[0083.469] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.469] lstrlenW (lpString=".bz2") returned 4
	[0083.469] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.469] lstrlenW (lpString=".7z") returned 3
	[0083.469] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.469] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.469] lstrlenW (lpString=".dbf") returned 4
	[0083.469] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.469] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.469] lstrlenW (lpString=".1cd") returned 4
	[0083.469] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.469] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.469] lstrlenW (lpString=".jpg") returned 4
	[0083.469] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.469] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.470] lstrlenW (lpString=".doc") returned 4
	[0083.470] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.470] lstrlenW (lpString=".docx") returned 5
	[0083.470] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1
	[0083.470] lstrlenW (lpString=".pdf") returned 4
	[0083.470] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.470] lstrlenW (lpString=".xls") returned 4
	[0083.470] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.470] lstrlenW (lpString=".xlsx") returned 5
	[0083.470] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1
	[0083.470] lstrlenW (lpString=".ppt") returned 4
	[0083.470] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.470] lstrlenW (lpString=".zip") returned 4
	[0083.470] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.470] lstrlenW (lpString=".rar") returned 4
	[0083.470] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.470] lstrlenW (lpString=".bz2") returned 4
	[0083.470] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.470] lstrlenW (lpString=".7z") returned 3
	[0083.470] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.470] lstrlenW (lpString=".dbf") returned 4
	[0083.470] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.471] lstrlenW (lpString=".1cd") returned 4
	[0083.471] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0083.471] lstrlenW (lpString=".jpg") returned 4
	[0083.471] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.471] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.471] lstrlenW (lpString="jpeg.dll") returned 8
	[0083.471] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0084.661] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=185920) returned 1
	[0084.661] CloseHandle (hObject=0x354) returned 1
	[0084.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20
	[0084.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.661] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0084.662] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.662] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.662] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0084.662] GetLastError () returned 0x0
	[0084.662] ReadFile (in: hFile=0x354, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x2d640, lpOverlapped=0x0) returned 1
	[0084.667] WriteFile (in: hFile=0x340, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x2d650, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x2d650, lpOverlapped=0x0) returned 1
	[0084.671] ReadFile (in: hFile=0x354, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.671] WriteFile (in: hFile=0x340, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0084.671] SetEndOfFile (hFile=0x340) returned 1
	[0084.671] CloseHandle (hObject=0x340) returned 1
	[0084.671] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.671] SetEndOfFile (hFile=0x354) returned 1
	[0084.673] CloseHandle (hObject=0x354) returned 1
	[0084.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0084.674] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 1
	[0084.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.674] lstrlenW (lpString=".doc") returned 4
	[0084.674] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.674] lstrlenW (lpString=".docx") returned 5
	[0084.674] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0084.674] lstrlenW (lpString=".pdf") returned 4
	[0084.674] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.674] lstrlenW (lpString=".xls") returned 4
	[0084.674] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.674] lstrlenW (lpString=".xlsx") returned 5
	[0084.674] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0084.674] lstrlenW (lpString=".ppt") returned 4
	[0084.674] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.674] lstrlenW (lpString=".zip") returned 4
	[0084.674] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.674] lstrlenW (lpString=".rar") returned 4
	[0084.674] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.674] lstrlenW (lpString=".bz2") returned 4
	[0084.674] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.674] lstrlenW (lpString=".7z") returned 3
	[0084.675] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.675] lstrlenW (lpString=".dbf") returned 4
	[0084.675] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.675] lstrlenW (lpString=".1cd") returned 4
	[0084.675] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.675] lstrlenW (lpString=".jpg") returned 4
	[0084.675] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.675] lstrlenW (lpString=".doc") returned 4
	[0084.675] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.675] lstrlenW (lpString=".docx") returned 5
	[0084.675] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0084.675] lstrlenW (lpString=".pdf") returned 4
	[0084.675] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.675] lstrlenW (lpString=".xls") returned 4
	[0084.675] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.675] lstrlenW (lpString=".xlsx") returned 5
	[0084.675] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0084.675] lstrlenW (lpString=".ppt") returned 4
	[0084.675] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.675] lstrlenW (lpString=".zip") returned 4
	[0084.675] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.676] lstrlenW (lpString=".rar") returned 4
	[0084.676] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.676] lstrlenW (lpString=".bz2") returned 4
	[0084.676] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.676] lstrlenW (lpString=".7z") returned 3
	[0084.676] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.676] lstrlenW (lpString=".dbf") returned 4
	[0084.676] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.676] lstrlenW (lpString=".1cd") returned 4
	[0084.676] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0084.676] lstrlenW (lpString=".jpg") returned 4
	[0084.676] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.676] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0084.676] lstrlenW (lpString="ktab.exe") returned 8
	[0084.676] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0084.676] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=16448) returned 1
	[0084.677] CloseHandle (hObject=0x354) returned 1
	[0084.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20
	[0084.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.677] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0084.677] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.677] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.677] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0084.677] GetLastError () returned 0x0
	[0084.677] ReadFile (in: hFile=0x354, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0084.679] WriteFile (in: hFile=0x340, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0084.680] ReadFile (in: hFile=0x354, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.680] WriteFile (in: hFile=0x340, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0084.680] SetEndOfFile (hFile=0x340) returned 1
	[0084.681] CloseHandle (hObject=0x340) returned 1
	[0084.681] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.681] SetEndOfFile (hFile=0x354) returned 1
	[0084.681] CloseHandle (hObject=0x354) returned 1
	[0084.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0084.682] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 1
	[0084.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.682] lstrlenW (lpString=".doc") returned 4
	[0084.682] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0084.682] lstrlenW (lpString=".docx") returned 5
	[0084.682] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1
	[0084.682] lstrlenW (lpString=".pdf") returned 4
	[0084.682] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0084.682] lstrlenW (lpString=".xls") returned 4
	[0084.682] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0084.682] lstrlenW (lpString=".xlsx") returned 5
	[0084.682] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1
	[0084.682] lstrlenW (lpString=".ppt") returned 4
	[0084.682] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0084.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.683] lstrlenW (lpString=".zip") returned 4
	[0084.683] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0084.683] lstrlenW (lpString=".rar") returned 4
	[0084.683] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0084.683] lstrlenW (lpString=".bz2") returned 4
	[0084.683] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0084.683] lstrlenW (lpString=".7z") returned 3
	[0084.683] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0084.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.683] lstrlenW (lpString=".dbf") returned 4
	[0084.683] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0084.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.683] lstrlenW (lpString=".1cd") returned 4
	[0084.683] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0084.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.683] lstrlenW (lpString=".jpg") returned 4
	[0084.683] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0084.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.683] lstrlenW (lpString=".doc") returned 4
	[0084.683] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0084.683] lstrlenW (lpString=".docx") returned 5
	[0084.683] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1
	[0084.683] lstrlenW (lpString=".pdf") returned 4
	[0084.683] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0084.683] lstrlenW (lpString=".xls") returned 4
	[0084.683] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0084.684] lstrlenW (lpString=".xlsx") returned 5
	[0084.684] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1
	[0084.684] lstrlenW (lpString=".ppt") returned 4
	[0084.684] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0084.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.684] lstrlenW (lpString=".zip") returned 4
	[0084.684] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0084.684] lstrlenW (lpString=".rar") returned 4
	[0084.684] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0084.684] lstrlenW (lpString=".bz2") returned 4
	[0084.684] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0084.684] lstrlenW (lpString=".7z") returned 3
	[0084.684] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0084.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.684] lstrlenW (lpString=".dbf") returned 4
	[0084.684] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0084.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.684] lstrlenW (lpString=".1cd") returned 4
	[0084.684] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0084.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0084.684] lstrlenW (lpString=".jpg") returned 4
	[0084.684] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0084.684] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0084.684] lstrlenW (lpString="lcms.dll") returned 8
	[0084.685] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0084.685] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=233536) returned 1
	[0084.685] CloseHandle (hObject=0x354) returned 1
	[0084.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20
	[0084.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.685] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0084.686] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.686] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.686] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0084.686] GetLastError () returned 0x0
	[0084.686] ReadFile (in: hFile=0x354, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x39040, lpOverlapped=0x0) returned 1
	[0084.691] WriteFile (in: hFile=0x340, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x39050, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x39050, lpOverlapped=0x0) returned 1
	[0084.695] ReadFile (in: hFile=0x354, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.180] WriteFile (in: hFile=0x340, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0085.180] SetEndOfFile (hFile=0x340) returned 1
	[0085.181] CloseHandle (hObject=0x340) returned 1
	[0085.181] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.181] SetEndOfFile (hFile=0x354) returned 1
	[0085.183] CloseHandle (hObject=0x354) returned 1
	[0085.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.183] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 1
	[0085.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.183] lstrlenW (lpString=".doc") returned 4
	[0085.184] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.184] lstrlenW (lpString=".docx") returned 5
	[0085.184] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0085.184] lstrlenW (lpString=".pdf") returned 4
	[0085.184] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.184] lstrlenW (lpString=".xls") returned 4
	[0085.184] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.184] lstrlenW (lpString=".xlsx") returned 5
	[0085.184] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0085.184] lstrlenW (lpString=".ppt") returned 4
	[0085.184] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.184] lstrlenW (lpString=".zip") returned 4
	[0085.184] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.184] lstrlenW (lpString=".rar") returned 4
	[0085.184] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.184] lstrlenW (lpString=".bz2") returned 4
	[0085.184] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.184] lstrlenW (lpString=".7z") returned 3
	[0085.184] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.184] lstrlenW (lpString=".dbf") returned 4
	[0085.184] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.184] lstrlenW (lpString=".1cd") returned 4
	[0085.184] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.184] lstrlenW (lpString=".jpg") returned 4
	[0085.185] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.185] lstrlenW (lpString=".doc") returned 4
	[0085.185] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.185] lstrlenW (lpString=".docx") returned 5
	[0085.185] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0085.185] lstrlenW (lpString=".pdf") returned 4
	[0085.185] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.185] lstrlenW (lpString=".xls") returned 4
	[0085.185] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.185] lstrlenW (lpString=".xlsx") returned 5
	[0085.185] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0085.185] lstrlenW (lpString=".ppt") returned 4
	[0085.185] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.185] lstrlenW (lpString=".zip") returned 4
	[0085.185] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.185] lstrlenW (lpString=".rar") returned 4
	[0085.185] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.185] lstrlenW (lpString=".bz2") returned 4
	[0085.185] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.185] lstrlenW (lpString=".7z") returned 3
	[0085.185] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.185] lstrlenW (lpString=".dbf") returned 4
	[0085.185] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.186] lstrlenW (lpString=".1cd") returned 4
	[0085.186] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0085.186] lstrlenW (lpString=".jpg") returned 4
	[0085.186] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.186] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0085.186] lstrlenW (lpString="msvcr120.dll") returned 12
	[0085.186] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0085.186] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=963232) returned 1
	[0085.186] CloseHandle (hObject=0x354) returned 1
	[0085.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20
	[0085.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.187] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0085.187] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.187] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.187] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0085.187] GetLastError () returned 0x0
	[0085.187] ReadFile (in: hFile=0x354, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0xeb2a0, lpOverlapped=0x0) returned 1
	[0085.205] WriteFile (in: hFile=0x340, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xeb2b0, lpOverlapped=0x0) returned 1
	[0085.221] ReadFile (in: hFile=0x354, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.222] WriteFile (in: hFile=0x340, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.222] SetEndOfFile (hFile=0x340) returned 1
	[0085.222] CloseHandle (hObject=0x340) returned 1
	[0085.222] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.222] SetEndOfFile (hFile=0x354) returned 1
	[0085.481] CloseHandle (hObject=0x354) returned 1
	[0085.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.501] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 1
	[0085.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.695] lstrlenW (lpString=".doc") returned 4
	[0085.695] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.695] lstrlenW (lpString=".docx") returned 5
	[0085.695] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0085.695] lstrlenW (lpString=".pdf") returned 4
	[0085.695] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.695] lstrlenW (lpString=".xls") returned 4
	[0085.695] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.695] lstrlenW (lpString=".xlsx") returned 5
	[0085.695] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0085.695] lstrlenW (lpString=".ppt") returned 4
	[0085.695] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.695] lstrlenW (lpString=".zip") returned 4
	[0085.696] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.696] lstrlenW (lpString=".rar") returned 4
	[0085.696] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.696] lstrlenW (lpString=".bz2") returned 4
	[0085.696] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.696] lstrlenW (lpString=".7z") returned 3
	[0085.696] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.696] lstrlenW (lpString=".dbf") returned 4
	[0085.696] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.696] lstrlenW (lpString=".1cd") returned 4
	[0085.696] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.696] lstrlenW (lpString=".jpg") returned 4
	[0085.696] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.696] lstrlenW (lpString=".doc") returned 4
	[0085.696] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.696] lstrlenW (lpString=".docx") returned 5
	[0085.696] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0085.696] lstrlenW (lpString=".pdf") returned 4
	[0085.696] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.696] lstrlenW (lpString=".xls") returned 4
	[0085.696] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.696] lstrlenW (lpString=".xlsx") returned 5
	[0085.696] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0085.697] lstrlenW (lpString=".ppt") returned 4
	[0085.697] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.697] lstrlenW (lpString=".zip") returned 4
	[0085.697] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.697] lstrlenW (lpString=".rar") returned 4
	[0085.697] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.697] lstrlenW (lpString=".bz2") returned 4
	[0085.697] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.697] lstrlenW (lpString=".7z") returned 3
	[0085.697] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.697] lstrlenW (lpString=".dbf") returned 4
	[0085.697] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.697] lstrlenW (lpString=".1cd") returned 4
	[0085.697] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0085.697] lstrlenW (lpString=".jpg") returned 4
	[0085.697] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.697] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0085.698] lstrlenW (lpString="msvcr100.dll") returned 12
	[0085.698] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0085.698] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=829264) returned 1
	[0085.698] CloseHandle (hObject=0x34c) returned 1
	[0085.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20
	[0085.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.698] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0085.699] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.699] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.699] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.699] GetLastError () returned 0x0
	[0085.699] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0xca750, lpOverlapped=0x0) returned 1
	[0085.715] WriteFile (in: hFile=0x2d4, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xca760, lpOverlapped=0x0) returned 1
	[0085.730] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.730] WriteFile (in: hFile=0x2d4, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.730] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.731] CloseHandle (hObject=0x2d4) returned 1
	[0085.731] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.731] SetEndOfFile (hFile=0x34c) returned 1
	[0085.738] CloseHandle (hObject=0x34c) returned 1
	[0085.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.738] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 1
	[0085.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.738] lstrlenW (lpString=".doc") returned 4
	[0085.738] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.738] lstrlenW (lpString=".docx") returned 5
	[0085.739] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0085.739] lstrlenW (lpString=".pdf") returned 4
	[0085.739] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.739] lstrlenW (lpString=".xls") returned 4
	[0085.739] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.739] lstrlenW (lpString=".xlsx") returned 5
	[0085.739] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0085.739] lstrlenW (lpString=".ppt") returned 4
	[0085.739] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.739] lstrlenW (lpString=".zip") returned 4
	[0085.739] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.739] lstrlenW (lpString=".rar") returned 4
	[0085.739] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.739] lstrlenW (lpString=".bz2") returned 4
	[0085.739] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.739] lstrlenW (lpString=".7z") returned 3
	[0085.739] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.739] lstrlenW (lpString=".dbf") returned 4
	[0085.739] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.739] lstrlenW (lpString=".1cd") returned 4
	[0085.739] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.739] lstrlenW (lpString=".jpg") returned 4
	[0085.739] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.739] lstrlenW (lpString=".doc") returned 4
	[0085.740] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.740] lstrlenW (lpString=".docx") returned 5
	[0085.740] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0085.740] lstrlenW (lpString=".pdf") returned 4
	[0085.740] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.740] lstrlenW (lpString=".xls") returned 4
	[0085.740] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.740] lstrlenW (lpString=".xlsx") returned 5
	[0085.740] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0085.740] lstrlenW (lpString=".ppt") returned 4
	[0085.740] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.740] lstrlenW (lpString=".zip") returned 4
	[0085.740] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.740] lstrlenW (lpString=".rar") returned 4
	[0085.740] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.740] lstrlenW (lpString=".bz2") returned 4
	[0085.740] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.740] lstrlenW (lpString=".7z") returned 3
	[0085.740] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.740] lstrlenW (lpString=".dbf") returned 4
	[0085.740] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.740] lstrlenW (lpString=".1cd") returned 4
	[0085.740] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0085.741] lstrlenW (lpString=".jpg") returned 4
	[0085.741] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.741] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0085.741] lstrlenW (lpString="npjp2.dll") returned 9
	[0085.741] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.264] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=234560) returned 1
	[0086.264] CloseHandle (hObject=0x390) returned 1
	[0086.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20
	[0086.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.597] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.597] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.597] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.597] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0086.614] GetLastError () returned 0x0
	[0086.614] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x39440, lpOverlapped=0x0) returned 1
	[0086.619] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x39450, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x39450, lpOverlapped=0x0) returned 1
	[0086.623] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.623] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0086.624] SetEndOfFile (hFile=0x35c) returned 1
	[0086.624] CloseHandle (hObject=0x35c) returned 1
	[0086.624] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.624] SetEndOfFile (hFile=0x34c) returned 1
	[0086.626] CloseHandle (hObject=0x34c) returned 1
	[0086.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0086.626] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 1
	[0086.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.626] lstrlenW (lpString=".doc") returned 4
	[0086.626] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.626] lstrlenW (lpString=".docx") returned 5
	[0086.626] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0086.627] lstrlenW (lpString=".pdf") returned 4
	[0086.627] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.627] lstrlenW (lpString=".xls") returned 4
	[0086.627] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.627] lstrlenW (lpString=".xlsx") returned 5
	[0086.627] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0086.627] lstrlenW (lpString=".ppt") returned 4
	[0086.627] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.627] lstrlenW (lpString=".zip") returned 4
	[0086.627] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.627] lstrlenW (lpString=".rar") returned 4
	[0086.627] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.627] lstrlenW (lpString=".bz2") returned 4
	[0086.627] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.627] lstrlenW (lpString=".7z") returned 3
	[0086.627] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.627] lstrlenW (lpString=".dbf") returned 4
	[0086.627] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.627] lstrlenW (lpString=".1cd") returned 4
	[0086.627] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.627] lstrlenW (lpString=".jpg") returned 4
	[0086.627] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.628] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.628] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.628] lstrlenW (lpString=".doc") returned 4
	[0086.628] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.628] lstrlenW (lpString=".docx") returned 5
	[0086.628] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0086.628] lstrlenW (lpString=".pdf") returned 4
	[0086.628] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.628] lstrlenW (lpString=".xls") returned 4
	[0086.628] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.628] lstrlenW (lpString=".xlsx") returned 5
	[0086.628] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0086.628] lstrlenW (lpString=".ppt") returned 4
	[0086.628] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.628] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.628] lstrlenW (lpString=".zip") returned 4
	[0086.628] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.628] lstrlenW (lpString=".rar") returned 4
	[0086.628] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.628] lstrlenW (lpString=".bz2") returned 4
	[0086.628] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.628] lstrlenW (lpString=".7z") returned 3
	[0086.628] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.628] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.628] lstrlenW (lpString=".dbf") returned 4
	[0086.628] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.628] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.628] lstrlenW (lpString=".1cd") returned 4
	[0086.629] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.629] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0086.629] lstrlenW (lpString=".jpg") returned 4
	[0086.629] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.629] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0086.629] lstrlenW (lpString="ssvagent.exe") returned 12
	[0086.629] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.629] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=70208) returned 1
	[0086.629] CloseHandle (hObject=0x34c) returned 1
	[0086.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20
	[0086.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.629] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.630] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.630] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.630] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0086.630] GetLastError () returned 0x0
	[0086.630] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x11240, lpOverlapped=0x0) returned 1
	[0086.633] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x11250, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x11250, lpOverlapped=0x0) returned 1
	[0086.635] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.635] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.635] SetEndOfFile (hFile=0x35c) returned 1
	[0086.635] CloseHandle (hObject=0x35c) returned 1
	[0086.635] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.635] SetEndOfFile (hFile=0x34c) returned 1
	[0086.636] CloseHandle (hObject=0x34c) returned 1
	[0086.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0086.637] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 1
	[0086.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.638] lstrlenW (lpString=".doc") returned 4
	[0086.638] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.638] lstrlenW (lpString=".docx") returned 5
	[0086.638] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0086.638] lstrlenW (lpString=".pdf") returned 4
	[0086.638] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.638] lstrlenW (lpString=".xls") returned 4
	[0086.638] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.638] lstrlenW (lpString=".xlsx") returned 5
	[0086.638] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0086.638] lstrlenW (lpString=".ppt") returned 4
	[0086.638] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.638] lstrlenW (lpString=".zip") returned 4
	[0086.638] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.638] lstrlenW (lpString=".rar") returned 4
	[0086.638] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.638] lstrlenW (lpString=".bz2") returned 4
	[0086.638] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.638] lstrlenW (lpString=".7z") returned 3
	[0086.638] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.639] lstrlenW (lpString=".dbf") returned 4
	[0086.639] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.639] lstrlenW (lpString=".1cd") returned 4
	[0086.639] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.639] lstrlenW (lpString=".jpg") returned 4
	[0086.639] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.639] lstrlenW (lpString=".doc") returned 4
	[0086.639] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.639] lstrlenW (lpString=".docx") returned 5
	[0086.639] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0086.639] lstrlenW (lpString=".pdf") returned 4
	[0086.639] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.639] lstrlenW (lpString=".xls") returned 4
	[0086.639] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.639] lstrlenW (lpString=".xlsx") returned 5
	[0086.639] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0086.639] lstrlenW (lpString=".ppt") returned 4
	[0086.639] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.640] lstrlenW (lpString=".zip") returned 4
	[0086.640] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.640] lstrlenW (lpString=".rar") returned 4
	[0086.640] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.640] lstrlenW (lpString=".bz2") returned 4
	[0086.640] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.640] lstrlenW (lpString=".7z") returned 3
	[0086.640] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.640] lstrlenW (lpString=".dbf") returned 4
	[0086.640] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.640] lstrlenW (lpString=".1cd") returned 4
	[0086.640] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0086.640] lstrlenW (lpString=".jpg") returned 4
	[0086.640] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.640] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0086.641] lstrlenW (lpString="sunec.dll") returned 9
	[0086.641] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.641] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=135744) returned 1
	[0086.641] CloseHandle (hObject=0x34c) returned 1
	[0086.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20
	[0086.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.642] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.642] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.642] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.642] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0086.642] GetLastError () returned 0x0
	[0086.642] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x21240, lpOverlapped=0x0) returned 1
	[0086.646] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x21250, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x21250, lpOverlapped=0x0) returned 1
	[0086.648] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.648] WriteFile (in: hFile=0x35c, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0086.649] SetEndOfFile (hFile=0x35c) returned 1
	[0086.649] CloseHandle (hObject=0x35c) returned 1
	[0086.649] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.649] SetEndOfFile (hFile=0x34c) returned 1
	[0087.025] CloseHandle (hObject=0x34c) returned 1
	[0087.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.026] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 1
	[0087.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.026] lstrlenW (lpString=".doc") returned 4
	[0087.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.026] lstrlenW (lpString=".docx") returned 5
	[0087.026] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0087.026] lstrlenW (lpString=".pdf") returned 4
	[0087.026] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.026] lstrlenW (lpString=".xls") returned 4
	[0087.026] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.026] lstrlenW (lpString=".xlsx") returned 5
	[0087.026] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0087.026] lstrlenW (lpString=".ppt") returned 4
	[0087.026] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.026] lstrlenW (lpString=".zip") returned 4
	[0087.026] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.026] lstrlenW (lpString=".rar") returned 4
	[0087.026] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.026] lstrlenW (lpString=".bz2") returned 4
	[0087.026] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.026] lstrlenW (lpString=".7z") returned 3
	[0087.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.027] lstrlenW (lpString=".dbf") returned 4
	[0087.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.027] lstrlenW (lpString=".1cd") returned 4
	[0087.027] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.027] lstrlenW (lpString=".jpg") returned 4
	[0087.027] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.027] lstrlenW (lpString=".doc") returned 4
	[0087.027] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.027] lstrlenW (lpString=".docx") returned 5
	[0087.027] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0087.027] lstrlenW (lpString=".pdf") returned 4
	[0087.027] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.027] lstrlenW (lpString=".xls") returned 4
	[0087.027] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.027] lstrlenW (lpString=".xlsx") returned 5
	[0087.027] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0087.027] lstrlenW (lpString=".ppt") returned 4
	[0087.027] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.027] lstrlenW (lpString=".zip") returned 4
	[0087.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.027] lstrlenW (lpString=".rar") returned 4
	[0087.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.028] lstrlenW (lpString=".bz2") returned 4
	[0087.028] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.028] lstrlenW (lpString=".7z") returned 3
	[0087.028] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.028] lstrlenW (lpString=".dbf") returned 4
	[0087.028] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.028] lstrlenW (lpString=".1cd") returned 4
	[0087.028] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0087.028] lstrlenW (lpString=".jpg") returned 4
	[0087.028] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.028] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0087.028] lstrlenW (lpString="unpack200.exe") returned 13
	[0087.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.029] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=197184) returned 1
	[0087.029] CloseHandle (hObject=0x34c) returned 1
	[0087.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20
	[0087.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.029] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.029] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.030] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.030] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0087.030] GetLastError () returned 0x0
	[0087.030] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x30240, lpOverlapped=0x0) returned 1
	[0087.034] WriteFile (in: hFile=0x360, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x30250, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x30250, lpOverlapped=0x0) returned 1
	[0087.038] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.038] WriteFile (in: hFile=0x360, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xee, lpOverlapped=0x0) returned 1
	[0087.038] SetEndOfFile (hFile=0x360) returned 1
	[0087.038] CloseHandle (hObject=0x360) returned 1
	[0087.039] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.039] SetEndOfFile (hFile=0x34c) returned 1
	[0087.040] CloseHandle (hObject=0x34c) returned 1
	[0087.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.041] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 1
	[0087.041] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.041] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.041] lstrlenW (lpString=".doc") returned 4
	[0087.041] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.041] lstrlenW (lpString=".docx") returned 5
	[0087.041] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0087.041] lstrlenW (lpString=".pdf") returned 4
	[0087.041] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.041] lstrlenW (lpString=".xls") returned 4
	[0087.041] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.041] lstrlenW (lpString=".xlsx") returned 5
	[0087.041] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0087.041] lstrlenW (lpString=".ppt") returned 4
	[0087.041] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.041] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.042] lstrlenW (lpString=".zip") returned 4
	[0087.042] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.042] lstrlenW (lpString=".rar") returned 4
	[0087.042] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.042] lstrlenW (lpString=".bz2") returned 4
	[0087.042] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.042] lstrlenW (lpString=".7z") returned 3
	[0087.042] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.042] lstrlenW (lpString=".dbf") returned 4
	[0087.042] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.042] lstrlenW (lpString=".1cd") returned 4
	[0087.042] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.042] lstrlenW (lpString=".jpg") returned 4
	[0087.042] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.042] lstrlenW (lpString=".doc") returned 4
	[0087.042] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.042] lstrlenW (lpString=".docx") returned 5
	[0087.042] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0087.042] lstrlenW (lpString=".pdf") returned 4
	[0087.042] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.042] lstrlenW (lpString=".xls") returned 4
	[0087.042] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.042] lstrlenW (lpString=".xlsx") returned 5
	[0087.042] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0087.043] lstrlenW (lpString=".ppt") returned 4
	[0087.043] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.043] lstrlenW (lpString=".zip") returned 4
	[0087.043] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.043] lstrlenW (lpString=".rar") returned 4
	[0087.043] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.043] lstrlenW (lpString=".bz2") returned 4
	[0087.043] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.043] lstrlenW (lpString=".7z") returned 3
	[0087.043] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.043] lstrlenW (lpString=".dbf") returned 4
	[0087.043] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.043] lstrlenW (lpString=".1cd") returned 4
	[0087.043] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52
	[0087.043] lstrlenW (lpString=".jpg") returned 4
	[0087.043] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.043] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0087.043] lstrlenW (lpString="verify.dll") returned 10
	[0087.043] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.044] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=49216) returned 1
	[0087.044] CloseHandle (hObject=0x34c) returned 1
	[0087.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20
	[0087.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.044] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.044] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.044] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.044] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0087.044] GetLastError () returned 0x0
	[0087.044] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0xc040, lpOverlapped=0x0) returned 1
	[0087.046] WriteFile (in: hFile=0x360, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xc050, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xc050, lpOverlapped=0x0) returned 1
	[0087.048] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.048] WriteFile (in: hFile=0x360, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0087.048] SetEndOfFile (hFile=0x360) returned 1
	[0087.048] CloseHandle (hObject=0x360) returned 1
	[0087.049] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.049] SetEndOfFile (hFile=0x34c) returned 1
	[0087.050] CloseHandle (hObject=0x34c) returned 1
	[0087.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.050] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 1
	[0087.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.050] lstrlenW (lpString=".doc") returned 4
	[0087.050] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.050] lstrlenW (lpString=".docx") returned 5
	[0087.050] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0087.050] lstrlenW (lpString=".pdf") returned 4
	[0087.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.050] lstrlenW (lpString=".xls") returned 4
	[0087.050] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.050] lstrlenW (lpString=".xlsx") returned 5
	[0087.050] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0087.051] lstrlenW (lpString=".ppt") returned 4
	[0087.051] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.051] lstrlenW (lpString=".zip") returned 4
	[0087.051] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.051] lstrlenW (lpString=".rar") returned 4
	[0087.051] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.051] lstrlenW (lpString=".bz2") returned 4
	[0087.051] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.051] lstrlenW (lpString=".7z") returned 3
	[0087.051] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.051] lstrlenW (lpString=".dbf") returned 4
	[0087.051] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.051] lstrlenW (lpString=".1cd") returned 4
	[0087.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.051] lstrlenW (lpString=".jpg") returned 4
	[0087.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.051] lstrlenW (lpString=".doc") returned 4
	[0087.051] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.051] lstrlenW (lpString=".docx") returned 5
	[0087.051] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0087.051] lstrlenW (lpString=".pdf") returned 4
	[0087.052] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.052] lstrlenW (lpString=".xls") returned 4
	[0087.052] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.052] lstrlenW (lpString=".xlsx") returned 5
	[0087.052] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0087.052] lstrlenW (lpString=".ppt") returned 4
	[0087.052] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.052] lstrlenW (lpString=".zip") returned 4
	[0087.052] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.052] lstrlenW (lpString=".rar") returned 4
	[0087.052] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.052] lstrlenW (lpString=".bz2") returned 4
	[0087.052] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.052] lstrlenW (lpString=".7z") returned 3
	[0087.052] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.052] lstrlenW (lpString=".dbf") returned 4
	[0087.052] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.052] lstrlenW (lpString=".1cd") returned 4
	[0087.052] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49
	[0087.052] lstrlenW (lpString=".jpg") returned 4
	[0087.052] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.053] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0087.053] lstrlenW (lpString="w2k_lsa_auth.dll") returned 16
	[0087.053] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.053] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=24128) returned 1
	[0087.053] CloseHandle (hObject=0x34c) returned 1
	[0087.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20
	[0087.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.053] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.053] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.053] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.054] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0087.054] GetLastError () returned 0x0
	[0087.054] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x5e40, lpOverlapped=0x0) returned 1
	[0087.056] WriteFile (in: hFile=0x360, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x5e50, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x5e50, lpOverlapped=0x0) returned 1
	[0087.057] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.057] WriteFile (in: hFile=0x360, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0087.057] SetEndOfFile (hFile=0x360) returned 1
	[0087.057] CloseHandle (hObject=0x360) returned 1
	[0087.057] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.057] SetEndOfFile (hFile=0x34c) returned 1
	[0087.058] CloseHandle (hObject=0x34c) returned 1
	[0087.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.059] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 1
	[0087.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.059] lstrlenW (lpString=".doc") returned 4
	[0087.059] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.059] lstrlenW (lpString=".docx") returned 5
	[0087.059] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1
	[0087.059] lstrlenW (lpString=".pdf") returned 4
	[0087.059] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.059] lstrlenW (lpString=".xls") returned 4
	[0087.059] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.059] lstrlenW (lpString=".xlsx") returned 5
	[0087.059] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1
	[0087.059] lstrlenW (lpString=".ppt") returned 4
	[0087.059] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.059] lstrlenW (lpString=".zip") returned 4
	[0087.059] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.059] lstrlenW (lpString=".rar") returned 4
	[0087.059] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.059] lstrlenW (lpString=".bz2") returned 4
	[0087.060] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.060] lstrlenW (lpString=".7z") returned 3
	[0087.060] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.060] lstrlenW (lpString=".dbf") returned 4
	[0087.060] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.060] lstrlenW (lpString=".1cd") returned 4
	[0087.060] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.060] lstrlenW (lpString=".jpg") returned 4
	[0087.060] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.060] lstrlenW (lpString=".doc") returned 4
	[0087.060] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.060] lstrlenW (lpString=".docx") returned 5
	[0087.060] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1
	[0087.060] lstrlenW (lpString=".pdf") returned 4
	[0087.060] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.060] lstrlenW (lpString=".xls") returned 4
	[0087.060] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.060] lstrlenW (lpString=".xlsx") returned 5
	[0087.060] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1
	[0087.060] lstrlenW (lpString=".ppt") returned 4
	[0087.060] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.061] lstrlenW (lpString=".zip") returned 4
	[0087.061] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.061] lstrlenW (lpString=".rar") returned 4
	[0087.061] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.061] lstrlenW (lpString=".bz2") returned 4
	[0087.061] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.061] lstrlenW (lpString=".7z") returned 3
	[0087.061] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.061] lstrlenW (lpString=".dbf") returned 4
	[0087.061] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.061] lstrlenW (lpString=".1cd") returned 4
	[0087.061] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55
	[0087.061] lstrlenW (lpString=".jpg") returned 4
	[0087.061] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.061] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0087.061] lstrlenW (lpString="WindowsAccessBridge-64.dll") returned 26
	[0087.061] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.062] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=110144) returned 1
	[0087.062] CloseHandle (hObject=0x34c) returned 1
	[0087.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20
	[0087.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.062] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.062] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.062] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.062] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0087.062] GetLastError () returned 0x0
	[0087.062] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x1ae40, lpOverlapped=0x0) returned 1
	[0087.574] WriteFile (in: hFile=0x360, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x1ae50, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x1ae50, lpOverlapped=0x0) returned 1
	[0087.576] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.576] WriteFile (in: hFile=0x360, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x108, lpOverlapped=0x0) returned 1
	[0087.576] SetEndOfFile (hFile=0x360) returned 1
	[0087.577] CloseHandle (hObject=0x360) returned 1
	[0087.577] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.577] SetEndOfFile (hFile=0x34c) returned 1
	[0087.578] CloseHandle (hObject=0x34c) returned 1
	[0087.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.579] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 1
	[0087.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.579] lstrlenW (lpString=".doc") returned 4
	[0087.579] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.579] lstrlenW (lpString=".docx") returned 5
	[0087.579] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0087.579] lstrlenW (lpString=".pdf") returned 4
	[0087.579] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.579] lstrlenW (lpString=".xls") returned 4
	[0087.579] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.579] lstrlenW (lpString=".xlsx") returned 5
	[0087.579] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0087.579] lstrlenW (lpString=".ppt") returned 4
	[0087.579] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.579] lstrlenW (lpString=".zip") returned 4
	[0087.580] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.580] lstrlenW (lpString=".rar") returned 4
	[0087.580] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.580] lstrlenW (lpString=".bz2") returned 4
	[0087.580] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.580] lstrlenW (lpString=".7z") returned 3
	[0087.580] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.580] lstrlenW (lpString=".dbf") returned 4
	[0087.580] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.580] lstrlenW (lpString=".1cd") returned 4
	[0087.580] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.580] lstrlenW (lpString=".jpg") returned 4
	[0087.580] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.580] lstrlenW (lpString=".doc") returned 4
	[0087.580] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString=".docx") returned 5
	[0087.581] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0087.581] lstrlenW (lpString=".pdf") returned 4
	[0087.581] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString=".xls") returned 4
	[0087.581] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString=".xlsx") returned 5
	[0087.581] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0087.581] lstrlenW (lpString=".ppt") returned 4
	[0087.581] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.581] lstrlenW (lpString=".zip") returned 4
	[0087.581] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString=".rar") returned 4
	[0087.581] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString=".bz2") returned 4
	[0087.581] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.581] lstrlenW (lpString=".7z") returned 3
	[0087.581] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.581] lstrlenW (lpString=".dbf") returned 4
	[0087.582] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.582] lstrlenW (lpString=".1cd") returned 4
	[0087.582] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65
	[0087.582] lstrlenW (lpString=".jpg") returned 4
	[0087.582] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.582] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".money") returned -1
	[0087.582] lstrlenW (lpString="classlist") returned 9
	[0087.582] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.583] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=84355) returned 1
	[0087.583] CloseHandle (hObject=0x34c) returned 1
	[0087.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20
	[0087.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.583] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.583] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0087.583] GetLastError () returned 0x0
	[0087.584] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x14983, lpOverlapped=0x0) returned 1
	[0087.586] WriteFile (in: hFile=0x360, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0x14990, lpOverlapped=0x0) returned 1
	[0087.588] ReadFile (in: hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesRead=0x3b1fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.589] WriteFile (in: hFile=0x360, lpBuffer=0x40d7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x40d7020*, lpNumberOfBytesWritten=0x3b1fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0087.589] SetEndOfFile (hFile=0x360) returned 1
	[0087.589] CloseHandle (hObject=0x360) returned 1
	[0087.589] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.589] SetEndOfFile (hFile=0x34c) returned 1
	[0087.590] CloseHandle (hObject=0x34c) returned 1
	[0087.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.590] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1
	[0087.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.591] lstrlenW (lpString=".doc") returned 4
	[0087.591] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0087.591] lstrlenW (lpString=".docx") returned 5
	[0087.591] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1
	[0087.591] lstrlenW (lpString=".pdf") returned 4
	[0087.591] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0087.591] lstrlenW (lpString=".xls") returned 4
	[0087.591] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0087.591] lstrlenW (lpString=".xlsx") returned 5
	[0087.591] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1
	[0087.591] lstrlenW (lpString=".ppt") returned 4
	[0087.591] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0087.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.591] lstrlenW (lpString=".zip") returned 4
	[0087.591] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0087.591] lstrlenW (lpString=".rar") returned 4
	[0087.591] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0087.591] lstrlenW (lpString=".bz2") returned 4
	[0087.591] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0087.591] lstrlenW (lpString=".7z") returned 3
	[0087.591] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0087.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.591] lstrlenW (lpString=".dbf") returned 4
	[0087.592] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0087.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.592] lstrlenW (lpString=".1cd") returned 4
	[0087.592] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0087.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.592] lstrlenW (lpString=".jpg") returned 4
	[0087.592] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0087.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.592] lstrlenW (lpString=".doc") returned 4
	[0087.592] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0087.592] lstrlenW (lpString=".docx") returned 5
	[0087.592] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1
	[0087.592] lstrlenW (lpString=".pdf") returned 4
	[0087.592] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0087.592] lstrlenW (lpString=".xls") returned 4
	[0087.592] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0087.592] lstrlenW (lpString=".xlsx") returned 5
	[0087.592] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1
	[0087.592] lstrlenW (lpString=".ppt") returned 4
	[0087.592] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0087.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.592] lstrlenW (lpString=".zip") returned 4
	[0087.592] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0087.592] lstrlenW (lpString=".rar") returned 4
	[0087.592] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0087.592] lstrlenW (lpString=".bz2") returned 4
	[0087.592] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0087.593] lstrlenW (lpString=".7z") returned 3
	[0087.593] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0087.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.593] lstrlenW (lpString=".dbf") returned 4
	[0087.593] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0087.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.593] lstrlenW (lpString=".1cd") returned 4
	[0087.593] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0087.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0087.593] lstrlenW (lpString=".jpg") returned 4
	[0087.593] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0087.593] lstrcmpiW (lpString1=".pf", lpString2=".money") returned 1
	[0087.593] lstrlenW (lpString="CIEXYZ.pf") returned 9
	[0087.593] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.593] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b1ff14 | out: lpFileSize=0x3b1ff14*=51236) returned 1
	[0087.594] CloseHandle (hObject=0x34c) returned 1
	[0087.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20
	[0087.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.594] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0087.594] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.594] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.594] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0087.596] GetLastError () returned 0x0
	[0087.596] ReadFile (hFile=0x34c, lpBuffer=0x40d7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b1fecc, lpOverlapped=0x0) 

Thread:
	id = 20
	os_tid = 0xf70

	[0057.446] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x3620780
	[0057.446] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10000) returned 0x41e0048
	[0057.448] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f2d8
	[0057.448] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x6) returned 0x69f058
	[0057.448] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f458
	[0057.448] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x100000) returned 0x43e4020
	[0057.451] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f4e8
	[0057.451] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f4e8, Size=0x20) returned 0x631178
	[0057.451] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x66f500
	[0057.451] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x66f500, Size=0x20) returned 0x631218
	[0057.452] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.452] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.452] Wow64DisableWow64FsRedirection (in: OldValue=0x3c5ff50 | out: OldValue=0x3c5ff50*=0x0) returned 1
	[0057.452] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.452] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631178 | out: hHeap=0x600000) returned 1
	[0057.452] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.452] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x631218 | out: hHeap=0x600000) returned 1
	[0057.452] Sleep (dwMilliseconds=0x64) 
	[0057.724] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0057.724] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18
	[0057.724] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.725] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=144072) returned 1
	[0057.725] CloseHandle (hObject=0x2f4) returned 1
	[0057.725] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20
	[0057.725] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0057.725] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.726] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.726] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.726] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0057.726] GetLastError () returned 0x0
	[0057.726] ReadFile (in: hFile=0x2f4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x232c8, lpOverlapped=0x0) returned 1
	[0057.742] WriteFile (in: hFile=0x2f8, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x232d0, lpOverlapped=0x0) returned 1
	[0057.745] ReadFile (in: hFile=0x2f4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.745] WriteFile (in: hFile=0x2f8, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0057.745] SetEndOfFile (hFile=0x2f8) returned 1
	[0057.757] CloseHandle (hObject=0x2f8) returned 1
	[0057.761] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.761] SetEndOfFile (hFile=0x2f4) returned 1
	[0057.763] CloseHandle (hObject=0x2f4) returned 1
	[0057.763] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0057.763] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1
	[0057.763] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.763] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.763] lstrlenW (lpString=".doc") returned 4
	[0057.763] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0057.763] lstrlenW (lpString=".docx") returned 5
	[0057.763] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1
	[0057.763] lstrlenW (lpString=".pdf") returned 4
	[0057.763] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0057.763] lstrlenW (lpString=".xls") returned 4
	[0057.764] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0057.764] lstrlenW (lpString=".xlsx") returned 5
	[0057.764] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1
	[0057.764] lstrlenW (lpString=".ppt") returned 4
	[0057.764] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0057.764] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.764] lstrlenW (lpString=".zip") returned 4
	[0057.764] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0057.764] lstrlenW (lpString=".rar") returned 4
	[0057.764] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0057.764] lstrlenW (lpString=".bz2") returned 4
	[0057.764] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0057.764] lstrlenW (lpString=".7z") returned 3
	[0057.764] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0057.764] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.764] lstrlenW (lpString=".dbf") returned 4
	[0057.764] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0057.764] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.764] lstrlenW (lpString=".1cd") returned 4
	[0057.764] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0057.764] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.764] lstrlenW (lpString=".jpg") returned 4
	[0057.764] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0057.764] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.764] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.764] lstrlenW (lpString=".doc") returned 4
	[0057.765] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0057.765] lstrlenW (lpString=".docx") returned 5
	[0057.765] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1
	[0057.765] lstrlenW (lpString=".pdf") returned 4
	[0057.765] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0057.765] lstrlenW (lpString=".xls") returned 4
	[0057.765] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0057.765] lstrlenW (lpString=".xlsx") returned 5
	[0057.765] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1
	[0057.765] lstrlenW (lpString=".ppt") returned 4
	[0057.765] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0057.765] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.765] lstrlenW (lpString=".zip") returned 4
	[0057.765] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0057.765] lstrlenW (lpString=".rar") returned 4
	[0057.765] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0057.765] lstrlenW (lpString=".bz2") returned 4
	[0057.765] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0057.765] lstrlenW (lpString=".7z") returned 3
	[0057.765] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0057.765] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.765] lstrlenW (lpString=".dbf") returned 4
	[0057.765] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0057.765] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.765] lstrlenW (lpString=".1cd") returned 4
	[0057.765] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0057.765] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0057.765] lstrlenW (lpString=".jpg") returned 4
	[0057.765] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0057.766] lstrcmpiW (lpString1=".cmd", lpString2=".money") returned -1
	[0057.766] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24
	[0057.766] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.766] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=577) returned 1
	[0057.766] CloseHandle (hObject=0x2f4) returned 1
	[0057.766] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20
	[0057.766] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0057.766] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.766] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.766] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.766] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0057.767] GetLastError () returned 0x0
	[0057.767] ReadFile (in: hFile=0x2f4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x241, lpOverlapped=0x0) returned 1
	[0058.151] WriteFile (in: hFile=0x2f8, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x250, lpOverlapped=0x0) returned 1
	[0058.152] ReadFile (in: hFile=0x2f4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.152] WriteFile (in: hFile=0x2f8, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x104, lpOverlapped=0x0) returned 1
	[0058.152] SetEndOfFile (hFile=0x2f8) returned 1
	[0058.152] CloseHandle (hObject=0x2f8) returned 1
	[0058.153] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.153] SetEndOfFile (hFile=0x2f4) returned 1
	[0058.154] CloseHandle (hObject=0x2f4) returned 1
	[0058.154] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0058.154] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1
	[0058.155] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.155] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.155] lstrlenW (lpString=".doc") returned 4
	[0058.155] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0058.155] lstrlenW (lpString=".docx") returned 5
	[0058.155] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0058.155] lstrlenW (lpString=".pdf") returned 4
	[0058.155] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0058.155] lstrlenW (lpString=".xls") returned 4
	[0058.155] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0058.155] lstrlenW (lpString=".xlsx") returned 5
	[0058.155] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0058.155] lstrlenW (lpString=".ppt") returned 4
	[0058.155] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0058.155] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.155] lstrlenW (lpString=".zip") returned 4
	[0058.155] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0058.155] lstrlenW (lpString=".rar") returned 4
	[0058.155] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0058.155] lstrlenW (lpString=".bz2") returned 4
	[0058.156] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0058.156] lstrlenW (lpString=".7z") returned 3
	[0058.156] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0058.156] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.156] lstrlenW (lpString=".dbf") returned 4
	[0058.156] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0058.156] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.156] lstrlenW (lpString=".1cd") returned 4
	[0058.156] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0058.156] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.156] lstrlenW (lpString=".jpg") returned 4
	[0058.156] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0058.156] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.156] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.156] lstrlenW (lpString=".doc") returned 4
	[0058.156] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0058.156] lstrlenW (lpString=".docx") returned 5
	[0058.156] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0058.156] lstrlenW (lpString=".pdf") returned 4
	[0058.156] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0058.156] lstrlenW (lpString=".xls") returned 4
	[0058.156] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0058.156] lstrlenW (lpString=".xlsx") returned 5
	[0058.157] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0058.157] lstrlenW (lpString=".ppt") returned 4
	[0058.157] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0058.157] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.157] lstrlenW (lpString=".zip") returned 4
	[0058.157] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0058.157] lstrlenW (lpString=".rar") returned 4
	[0058.157] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0058.157] lstrlenW (lpString=".bz2") returned 4
	[0058.157] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0058.157] lstrlenW (lpString=".7z") returned 3
	[0058.157] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0058.157] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.157] lstrlenW (lpString=".dbf") returned 4
	[0058.157] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0058.157] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.157] lstrlenW (lpString=".1cd") returned 4
	[0058.157] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0058.157] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0058.157] lstrlenW (lpString=".jpg") returned 4
	[0058.157] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0058.157] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0058.158] lstrlenW (lpString="SetupResources.dll") returned 18
	[0058.158] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0058.158] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=17240) returned 1
	[0058.158] CloseHandle (hObject=0x2f4) returned 1
	[0058.158] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80
	[0058.158] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.159] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0058.159] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.159] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.159] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0058.159] GetLastError () returned 0x0
	[0058.159] ReadFile (in: hFile=0x2f4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4358, lpOverlapped=0x0) returned 1
	[0058.161] WriteFile (in: hFile=0x2f8, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4360, lpOverlapped=0x0) returned 1
	[0058.163] ReadFile (in: hFile=0x2f4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.163] WriteFile (in: hFile=0x2f8, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0058.163] SetEndOfFile (hFile=0x2f8) returned 1
	[0058.163] CloseHandle (hObject=0x2f8) returned 1
	[0058.166] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.166] SetEndOfFile (hFile=0x2f4) returned 1
	[0058.167] CloseHandle (hObject=0x2f4) returned 1
	[0058.167] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.167] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1
	[0058.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.168] lstrlenW (lpString=".doc") returned 4
	[0058.168] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0058.168] lstrlenW (lpString=".docx") returned 5
	[0058.168] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0058.168] lstrlenW (lpString=".pdf") returned 4
	[0058.168] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0058.168] lstrlenW (lpString=".xls") returned 4
	[0058.168] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0058.168] lstrlenW (lpString=".xlsx") returned 5
	[0058.168] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0058.168] lstrlenW (lpString=".ppt") returned 4
	[0058.168] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0058.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.168] lstrlenW (lpString=".zip") returned 4
	[0058.168] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0058.168] lstrlenW (lpString=".rar") returned 4
	[0058.168] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0058.168] lstrlenW (lpString=".bz2") returned 4
	[0058.169] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0058.169] lstrlenW (lpString=".7z") returned 3
	[0058.169] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0058.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.169] lstrlenW (lpString=".dbf") returned 4
	[0058.169] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0058.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.169] lstrlenW (lpString=".1cd") returned 4
	[0058.169] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0058.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.169] lstrlenW (lpString=".jpg") returned 4
	[0058.169] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0058.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.169] lstrlenW (lpString=".doc") returned 4
	[0058.169] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0058.169] lstrlenW (lpString=".docx") returned 5
	[0058.169] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0058.169] lstrlenW (lpString=".pdf") returned 4
	[0058.169] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0058.169] lstrlenW (lpString=".xls") returned 4
	[0058.169] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0058.169] lstrlenW (lpString=".xlsx") returned 5
	[0058.169] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0058.170] lstrlenW (lpString=".ppt") returned 4
	[0058.170] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0058.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.170] lstrlenW (lpString=".zip") returned 4
	[0058.170] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0058.170] lstrlenW (lpString=".rar") returned 4
	[0058.170] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0058.170] lstrlenW (lpString=".bz2") returned 4
	[0058.170] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0058.170] lstrlenW (lpString=".7z") returned 3
	[0058.170] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0058.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.170] lstrlenW (lpString=".dbf") returned 4
	[0058.170] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0058.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.170] lstrlenW (lpString=".1cd") returned 4
	[0058.170] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0058.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0058.170] lstrlenW (lpString=".jpg") returned 4
	[0058.170] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0058.171] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0058.171] lstrlenW (lpString="SetupResources.dll") returned 18
	[0058.171] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0058.172] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=14168) returned 1
	[0058.172] CloseHandle (hObject=0x2f4) returned 1
	[0058.172] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80
	[0058.172] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.172] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0058.172] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.172] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.172] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0058.172] GetLastError () returned 0x0
	[0058.172] ReadFile (in: hFile=0x2f4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x3758, lpOverlapped=0x0) returned 1
	[0058.174] WriteFile (in: hFile=0x2f8, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x3760, lpOverlapped=0x0) returned 1
	[0058.175] ReadFile (in: hFile=0x2f4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.175] WriteFile (in: hFile=0x2f8, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0058.176] SetEndOfFile (hFile=0x2f8) returned 1
	[0058.176] CloseHandle (hObject=0x2f8) returned 1
	[0058.177] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.177] SetEndOfFile (hFile=0x2f4) returned 1
	[0058.178] CloseHandle (hObject=0x2f4) returned 1
	[0058.178] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.178] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1
	[0058.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.179] lstrlenW (lpString=".doc") returned 4
	[0058.179] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0058.179] lstrlenW (lpString=".docx") returned 5
	[0058.179] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0058.179] lstrlenW (lpString=".pdf") returned 4
	[0058.179] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0058.179] lstrlenW (lpString=".xls") returned 4
	[0058.179] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0058.179] lstrlenW (lpString=".xlsx") returned 5
	[0058.179] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0058.179] lstrlenW (lpString=".ppt") returned 4
	[0058.179] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0058.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.179] lstrlenW (lpString=".zip") returned 4
	[0058.179] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0058.179] lstrlenW (lpString=".rar") returned 4
	[0058.179] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0058.179] lstrlenW (lpString=".bz2") returned 4
	[0058.180] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0058.180] lstrlenW (lpString=".7z") returned 3
	[0058.180] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0058.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.180] lstrlenW (lpString=".dbf") returned 4
	[0058.180] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0058.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.180] lstrlenW (lpString=".1cd") returned 4
	[0058.180] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0058.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.180] lstrlenW (lpString=".jpg") returned 4
	[0058.180] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0058.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.180] lstrlenW (lpString=".doc") returned 4
	[0058.180] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0058.180] lstrlenW (lpString=".docx") returned 5
	[0058.180] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0058.180] lstrlenW (lpString=".pdf") returned 4
	[0058.180] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0058.181] lstrlenW (lpString=".xls") returned 4
	[0058.181] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0058.181] lstrlenW (lpString=".xlsx") returned 5
	[0058.181] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0058.181] lstrlenW (lpString=".ppt") returned 4
	[0058.181] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0058.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.181] lstrlenW (lpString=".zip") returned 4
	[0058.181] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0058.181] lstrlenW (lpString=".rar") returned 4
	[0058.181] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0058.181] lstrlenW (lpString=".bz2") returned 4
	[0058.181] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0058.181] lstrlenW (lpString=".7z") returned 3
	[0058.181] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0058.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.181] lstrlenW (lpString=".dbf") returned 4
	[0058.181] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0058.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.181] lstrlenW (lpString=".1cd") returned 4
	[0058.181] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0058.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0058.181] lstrlenW (lpString=".jpg") returned 4
	[0058.181] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0058.182] Sleep (dwMilliseconds=0x64) 
	[0058.765] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0058.765] lstrlenW (lpString="SetupResources.dll") returned 18
	[0058.765] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0058.766] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=18264) returned 1
	[0058.766] CloseHandle (hObject=0x314) returned 1
	[0058.766] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80
	[0058.766] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.766] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0058.766] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.766] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.766] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0058.767] GetLastError () returned 0x0
	[0058.767] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0058.771] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0058.772] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.772] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0058.772] SetEndOfFile (hFile=0x318) returned 1
	[0058.773] CloseHandle (hObject=0x318) returned 1
	[0058.774] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.774] SetEndOfFile (hFile=0x314) returned 1
	[0058.775] CloseHandle (hObject=0x314) returned 1
	[0058.775] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.775] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1
	[0058.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.775] lstrlenW (lpString=".doc") returned 4
	[0058.775] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0058.776] lstrlenW (lpString=".docx") returned 5
	[0058.776] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0058.776] lstrlenW (lpString=".pdf") returned 4
	[0058.776] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0058.776] lstrlenW (lpString=".xls") returned 4
	[0058.776] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0058.776] lstrlenW (lpString=".xlsx") returned 5
	[0058.776] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0058.776] lstrlenW (lpString=".ppt") returned 4
	[0058.776] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0058.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.776] lstrlenW (lpString=".zip") returned 4
	[0058.776] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0058.776] lstrlenW (lpString=".rar") returned 4
	[0058.776] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0058.776] lstrlenW (lpString=".bz2") returned 4
	[0058.776] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0058.776] lstrlenW (lpString=".7z") returned 3
	[0058.776] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0058.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.776] lstrlenW (lpString=".dbf") returned 4
	[0058.776] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0058.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.776] lstrlenW (lpString=".1cd") returned 4
	[0058.777] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0058.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.777] lstrlenW (lpString=".jpg") returned 4
	[0058.777] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0058.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.777] lstrlenW (lpString=".doc") returned 4
	[0058.777] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0058.777] lstrlenW (lpString=".docx") returned 5
	[0058.777] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0058.777] lstrlenW (lpString=".pdf") returned 4
	[0058.777] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0058.777] lstrlenW (lpString=".xls") returned 4
	[0058.777] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0058.777] lstrlenW (lpString=".xlsx") returned 5
	[0058.777] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0058.777] lstrlenW (lpString=".ppt") returned 4
	[0058.777] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0058.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.777] lstrlenW (lpString=".zip") returned 4
	[0058.777] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0058.777] lstrlenW (lpString=".rar") returned 4
	[0058.777] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0058.777] lstrlenW (lpString=".bz2") returned 4
	[0058.778] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0058.778] lstrlenW (lpString=".7z") returned 3
	[0058.778] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0058.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.778] lstrlenW (lpString=".dbf") returned 4
	[0058.778] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0058.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.778] lstrlenW (lpString=".1cd") returned 4
	[0058.778] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0058.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0058.778] lstrlenW (lpString=".jpg") returned 4
	[0058.778] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0058.778] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0058.778] lstrlenW (lpString="SetupResources.dll") returned 18
	[0058.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0058.779] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=18264) returned 1
	[0058.779] CloseHandle (hObject=0x314) returned 1
	[0058.779] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80
	[0058.779] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.779] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0058.780] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.780] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0058.780] GetLastError () returned 0x0
	[0058.780] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0058.782] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0058.783] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.783] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0058.783] SetEndOfFile (hFile=0x318) returned 1
	[0058.783] CloseHandle (hObject=0x318) returned 1
	[0058.789] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.789] SetEndOfFile (hFile=0x314) returned 1
	[0058.790] CloseHandle (hObject=0x314) returned 1
	[0058.790] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.790] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1
	[0058.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.790] lstrlenW (lpString=".doc") returned 4
	[0058.790] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0058.790] lstrlenW (lpString=".docx") returned 5
	[0058.790] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0058.791] lstrlenW (lpString=".pdf") returned 4
	[0058.791] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0058.791] lstrlenW (lpString=".xls") returned 4
	[0058.791] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0058.791] lstrlenW (lpString=".xlsx") returned 5
	[0058.791] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0058.791] lstrlenW (lpString=".ppt") returned 4
	[0058.791] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0058.791] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.791] lstrlenW (lpString=".zip") returned 4
	[0058.791] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0058.791] lstrlenW (lpString=".rar") returned 4
	[0058.791] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0058.791] lstrlenW (lpString=".bz2") returned 4
	[0058.791] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0058.791] lstrlenW (lpString=".7z") returned 3
	[0058.791] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0058.791] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.791] lstrlenW (lpString=".dbf") returned 4
	[0058.791] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0058.791] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.791] lstrlenW (lpString=".1cd") returned 4
	[0058.791] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0058.791] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.791] lstrlenW (lpString=".jpg") returned 4
	[0058.791] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0058.791] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.791] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.792] lstrlenW (lpString=".doc") returned 4
	[0058.792] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0058.792] lstrlenW (lpString=".docx") returned 5
	[0058.792] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0058.792] lstrlenW (lpString=".pdf") returned 4
	[0058.792] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0058.792] lstrlenW (lpString=".xls") returned 4
	[0058.792] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0058.792] lstrlenW (lpString=".xlsx") returned 5
	[0058.792] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0058.792] lstrlenW (lpString=".ppt") returned 4
	[0058.792] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0058.792] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.792] lstrlenW (lpString=".zip") returned 4
	[0058.792] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0058.792] lstrlenW (lpString=".rar") returned 4
	[0058.792] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0058.792] lstrlenW (lpString=".bz2") returned 4
	[0058.792] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0058.792] lstrlenW (lpString=".7z") returned 3
	[0058.792] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0058.792] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.792] lstrlenW (lpString=".dbf") returned 4
	[0058.792] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0058.792] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.792] lstrlenW (lpString=".1cd") returned 4
	[0058.792] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0058.792] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0058.793] lstrlenW (lpString=".jpg") returned 4
	[0058.793] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0058.793] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0058.793] lstrlenW (lpString="SetupResources.dll") returned 18
	[0058.793] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0058.793] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=18776) returned 1
	[0058.793] CloseHandle (hObject=0x314) returned 1
	[0058.793] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80
	[0058.793] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0058.793] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0058.793] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.794] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.794] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0058.794] GetLastError () returned 0x0
	[0058.794] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4958, lpOverlapped=0x0) returned 1
	[0058.796] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4960, lpOverlapped=0x0) returned 1
	[0058.797] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.797] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0058.797] SetEndOfFile (hFile=0x318) returned 1
	[0058.797] CloseHandle (hObject=0x318) returned 1
	[0058.799] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.799] SetEndOfFile (hFile=0x314) returned 1
	[0058.799] CloseHandle (hObject=0x314) returned 1
	[0058.800] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0058.800] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1
	[0058.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0058.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0058.800] lstrlenW (lpString=".doc") returned 4
	[0058.800] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0058.800] lstrlenW (lpString=".docx") returned 5
	[0058.800] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0058.800] lstrlenW (lpString=".pdf") returned 4
	[0058.800] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0058.801] lstrlenW (lpString=".xls") returned 4
	[0058.801] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0058.801] lstrlenW (lpString=".xlsx") returned 5
	[0058.801] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0058.801] lstrlenW (lpString=".ppt") returned 4
	[0058.801] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0058.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0058.801] lstrlenW (lpString=".zip") returned 4
	[0058.801] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0058.801] lstrlenW (lpString=".rar") returned 4
	[0058.801] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0058.801] lstrlenW (lpString=".bz2") returned 4
	[0058.801] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0058.801] lstrlenW (lpString=".7z") returned 3
	[0058.801] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0058.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0058.801] lstrlenW (lpString=".dbf") returned 4
	[0058.801] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0058.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0058.801] lstrlenW (lpString=".1cd") returned 4
	[0058.801] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0058.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0058.801] lstrlenW (lpString=".jpg") returned 4
	[0058.801] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0058.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0059.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0059.210] lstrlenW (lpString=".doc") returned 4
	[0059.210] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.210] lstrlenW (lpString=".docx") returned 5
	[0059.210] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0059.210] lstrlenW (lpString=".pdf") returned 4
	[0059.210] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.210] lstrlenW (lpString=".xls") returned 4
	[0059.211] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.211] lstrlenW (lpString=".xlsx") returned 5
	[0059.211] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0059.211] lstrlenW (lpString=".ppt") returned 4
	[0059.211] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0059.211] lstrlenW (lpString=".zip") returned 4
	[0059.211] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.211] lstrlenW (lpString=".rar") returned 4
	[0059.211] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.211] lstrlenW (lpString=".bz2") returned 4
	[0059.211] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.211] lstrlenW (lpString=".7z") returned 3
	[0059.211] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0059.211] lstrlenW (lpString=".dbf") returned 4
	[0059.211] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0059.211] lstrlenW (lpString=".1cd") returned 4
	[0059.211] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0059.211] lstrlenW (lpString=".jpg") returned 4
	[0059.211] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.212] Sleep (dwMilliseconds=0x64) 
	[0059.540] Sleep (dwMilliseconds=0x64) 
	[0060.192] Sleep (dwMilliseconds=0x64) 
	[0060.632] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0060.632] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.632] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0060.632] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=18264) returned 1
	[0060.632] CloseHandle (hObject=0x2d4) returned 1
	[0060.633] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80
	[0060.633] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.633] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0060.633] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.633] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.633] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.633] GetLastError () returned 0x0
	[0060.633] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0060.635] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0060.636] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.636] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.637] SetEndOfFile (hFile=0x318) returned 1
	[0060.637] CloseHandle (hObject=0x318) returned 1
	[0060.638] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.638] SetEndOfFile (hFile=0x2d4) returned 1
	[0060.639] CloseHandle (hObject=0x2d4) returned 1
	[0060.639] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.639] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1
	[0060.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.639] lstrlenW (lpString=".doc") returned 4
	[0060.640] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.640] lstrlenW (lpString=".docx") returned 5
	[0060.640] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.640] lstrlenW (lpString=".pdf") returned 4
	[0060.640] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.640] lstrlenW (lpString=".xls") returned 4
	[0060.640] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.640] lstrlenW (lpString=".xlsx") returned 5
	[0060.640] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.640] lstrlenW (lpString=".ppt") returned 4
	[0060.640] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.640] lstrlenW (lpString=".zip") returned 4
	[0060.640] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.640] lstrlenW (lpString=".rar") returned 4
	[0060.640] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.640] lstrlenW (lpString=".bz2") returned 4
	[0060.640] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.640] lstrlenW (lpString=".7z") returned 3
	[0060.640] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.640] lstrlenW (lpString=".dbf") returned 4
	[0060.640] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.641] lstrlenW (lpString=".1cd") returned 4
	[0060.641] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.641] lstrlenW (lpString=".jpg") returned 4
	[0060.641] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.641] lstrlenW (lpString=".doc") returned 4
	[0060.641] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.641] lstrlenW (lpString=".docx") returned 5
	[0060.641] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.641] lstrlenW (lpString=".pdf") returned 4
	[0060.641] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.641] lstrlenW (lpString=".xls") returned 4
	[0060.641] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.641] lstrlenW (lpString=".xlsx") returned 5
	[0060.641] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.641] lstrlenW (lpString=".ppt") returned 4
	[0060.641] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.641] lstrlenW (lpString=".zip") returned 4
	[0060.641] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.641] lstrlenW (lpString=".rar") returned 4
	[0060.641] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.641] lstrlenW (lpString=".bz2") returned 4
	[0060.642] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.642] lstrlenW (lpString=".7z") returned 3
	[0060.642] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.642] lstrlenW (lpString=".dbf") returned 4
	[0060.642] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.642] lstrlenW (lpString=".1cd") returned 4
	[0060.642] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0060.642] lstrlenW (lpString=".jpg") returned 4
	[0060.642] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.642] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0060.642] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.642] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0060.642] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=15704) returned 1
	[0060.643] CloseHandle (hObject=0x2d4) returned 1
	[0060.643] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80
	[0060.643] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.643] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0060.643] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.643] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.643] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.643] GetLastError () returned 0x0
	[0060.643] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x3d58, lpOverlapped=0x0) returned 1
	[0060.645] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x3d60, lpOverlapped=0x0) returned 1
	[0060.646] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.646] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.646] SetEndOfFile (hFile=0x318) returned 1
	[0060.646] CloseHandle (hObject=0x318) returned 1
	[0060.647] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.647] SetEndOfFile (hFile=0x2d4) returned 1
	[0060.648] CloseHandle (hObject=0x2d4) returned 1
	[0060.648] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.648] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1
	[0060.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.649] lstrlenW (lpString=".doc") returned 4
	[0060.649] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.649] lstrlenW (lpString=".docx") returned 5
	[0060.649] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.649] lstrlenW (lpString=".pdf") returned 4
	[0060.649] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.649] lstrlenW (lpString=".xls") returned 4
	[0060.649] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.649] lstrlenW (lpString=".xlsx") returned 5
	[0060.649] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.649] lstrlenW (lpString=".ppt") returned 4
	[0060.649] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.649] lstrlenW (lpString=".zip") returned 4
	[0060.649] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.649] lstrlenW (lpString=".rar") returned 4
	[0060.649] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.649] lstrlenW (lpString=".bz2") returned 4
	[0060.649] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.649] lstrlenW (lpString=".7z") returned 3
	[0060.649] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.649] lstrlenW (lpString=".dbf") returned 4
	[0060.649] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.650] lstrlenW (lpString=".1cd") returned 4
	[0060.650] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.650] lstrlenW (lpString=".jpg") returned 4
	[0060.650] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.650] lstrlenW (lpString=".doc") returned 4
	[0060.650] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.650] lstrlenW (lpString=".docx") returned 5
	[0060.650] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.650] lstrlenW (lpString=".pdf") returned 4
	[0060.650] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.650] lstrlenW (lpString=".xls") returned 4
	[0060.650] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.650] lstrlenW (lpString=".xlsx") returned 5
	[0060.650] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.650] lstrlenW (lpString=".ppt") returned 4
	[0060.650] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.650] lstrlenW (lpString=".zip") returned 4
	[0060.650] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.650] lstrlenW (lpString=".rar") returned 4
	[0060.650] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.650] lstrlenW (lpString=".bz2") returned 4
	[0060.650] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.650] lstrlenW (lpString=".7z") returned 3
	[0060.650] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.651] lstrlenW (lpString=".dbf") returned 4
	[0060.651] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.651] lstrlenW (lpString=".1cd") returned 4
	[0060.651] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0060.651] lstrlenW (lpString=".jpg") returned 4
	[0060.651] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.651] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0060.651] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.651] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0060.651] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=15192) returned 1
	[0060.651] CloseHandle (hObject=0x2d4) returned 1
	[0060.651] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80
	[0060.652] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.652] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0060.652] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.652] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.652] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.652] GetLastError () returned 0x0
	[0060.652] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x3b58, lpOverlapped=0x0) returned 1
	[0060.654] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x3b60, lpOverlapped=0x0) returned 1
	[0060.655] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.655] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.655] SetEndOfFile (hFile=0x318) returned 1
	[0060.655] CloseHandle (hObject=0x318) returned 1
	[0060.656] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.656] SetEndOfFile (hFile=0x2d4) returned 1
	[0060.657] CloseHandle (hObject=0x2d4) returned 1
	[0060.657] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0060.657] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1
	[0060.657] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.658] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.658] lstrlenW (lpString=".doc") returned 4
	[0060.658] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.658] lstrlenW (lpString=".docx") returned 5
	[0060.658] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.658] lstrlenW (lpString=".pdf") returned 4
	[0060.658] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.658] lstrlenW (lpString=".xls") returned 4
	[0060.658] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.658] lstrlenW (lpString=".xlsx") returned 5
	[0060.658] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.658] lstrlenW (lpString=".ppt") returned 4
	[0060.658] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.658] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.658] lstrlenW (lpString=".zip") returned 4
	[0060.658] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.658] lstrlenW (lpString=".rar") returned 4
	[0060.658] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.658] lstrlenW (lpString=".bz2") returned 4
	[0060.658] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.658] lstrlenW (lpString=".7z") returned 3
	[0060.658] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.658] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.658] lstrlenW (lpString=".dbf") returned 4
	[0060.658] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.658] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.659] lstrlenW (lpString=".1cd") returned 4
	[0060.659] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.659] lstrlenW (lpString=".jpg") returned 4
	[0060.659] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.659] lstrlenW (lpString=".doc") returned 4
	[0060.659] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.659] lstrlenW (lpString=".docx") returned 5
	[0060.659] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.659] lstrlenW (lpString=".pdf") returned 4
	[0060.659] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.659] lstrlenW (lpString=".xls") returned 4
	[0060.659] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.659] lstrlenW (lpString=".xlsx") returned 5
	[0060.659] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.659] lstrlenW (lpString=".ppt") returned 4
	[0060.659] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.659] lstrlenW (lpString=".zip") returned 4
	[0060.659] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.659] lstrlenW (lpString=".rar") returned 4
	[0060.659] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.659] lstrlenW (lpString=".bz2") returned 4
	[0060.659] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.659] lstrlenW (lpString=".7z") returned 3
	[0060.659] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.660] lstrlenW (lpString=".dbf") returned 4
	[0060.660] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.660] lstrlenW (lpString=".1cd") returned 4
	[0060.660] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0060.660] lstrlenW (lpString=".jpg") returned 4
	[0060.660] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.660] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0060.660] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.660] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0060.661] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=19288) returned 1
	[0060.661] CloseHandle (hObject=0x2d4) returned 1
	[0060.661] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80
	[0060.661] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0060.661] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0060.661] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.661] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.661] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0060.661] GetLastError () returned 0x0
	[0060.661] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4b58, lpOverlapped=0x0) returned 1
	[0060.663] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4b60, lpOverlapped=0x0) returned 1
	[0060.665] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.665] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.665] SetEndOfFile (hFile=0x318) returned 1
	[0060.665] CloseHandle (hObject=0x318) returned 1
	[0061.242] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.242] SetEndOfFile (hFile=0x2d4) returned 1
	[0061.243] CloseHandle (hObject=0x2d4) returned 1
	[0061.243] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.243] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1
	[0061.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.243] lstrlenW (lpString=".doc") returned 4
	[0061.243] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.244] lstrlenW (lpString=".docx") returned 5
	[0061.244] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.244] lstrlenW (lpString=".pdf") returned 4
	[0061.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.244] lstrlenW (lpString=".xls") returned 4
	[0061.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.244] lstrlenW (lpString=".xlsx") returned 5
	[0061.244] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.244] lstrlenW (lpString=".ppt") returned 4
	[0061.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.244] lstrlenW (lpString=".zip") returned 4
	[0061.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.244] lstrlenW (lpString=".rar") returned 4
	[0061.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.244] lstrlenW (lpString=".bz2") returned 4
	[0061.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.244] lstrlenW (lpString=".7z") returned 3
	[0061.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.244] lstrlenW (lpString=".dbf") returned 4
	[0061.244] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.244] lstrlenW (lpString=".1cd") returned 4
	[0061.244] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.244] lstrlenW (lpString=".jpg") returned 4
	[0061.245] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.245] lstrlenW (lpString=".doc") returned 4
	[0061.245] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.245] lstrlenW (lpString=".docx") returned 5
	[0061.245] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.245] lstrlenW (lpString=".pdf") returned 4
	[0061.245] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.245] lstrlenW (lpString=".xls") returned 4
	[0061.245] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.245] lstrlenW (lpString=".xlsx") returned 5
	[0061.245] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.245] lstrlenW (lpString=".ppt") returned 4
	[0061.245] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.245] lstrlenW (lpString=".zip") returned 4
	[0061.245] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.245] lstrlenW (lpString=".rar") returned 4
	[0061.245] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.245] lstrlenW (lpString=".bz2") returned 4
	[0061.245] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.246] lstrlenW (lpString=".7z") returned 3
	[0061.246] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.246] lstrlenW (lpString=".dbf") returned 4
	[0061.246] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.246] lstrlenW (lpString=".1cd") returned 4
	[0061.246] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.246] lstrlenW (lpString=".jpg") returned 4
	[0061.246] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.246] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.246] lstrlenW (lpString="Print.ico") returned 9
	[0061.246] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0061.248] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=1150) returned 1
	[0061.248] CloseHandle (hObject=0x2d4) returned 1
	[0061.248] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80
	[0061.248] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.248] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0061.248] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.249] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.249] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.249] GetLastError () returned 0x0
	[0061.249] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x47e, lpOverlapped=0x0) returned 1
	[0061.251] WriteFile (in: hFile=0x33c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x480, lpOverlapped=0x0) returned 1
	[0061.252] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.252] WriteFile (in: hFile=0x33c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0061.252] SetEndOfFile (hFile=0x33c) returned 1
	[0061.253] CloseHandle (hObject=0x33c) returned 1
	[0061.254] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.254] SetEndOfFile (hFile=0x2d4) returned 1
	[0061.255] CloseHandle (hObject=0x2d4) returned 1
	[0061.255] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.256] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1
	[0061.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.256] lstrlenW (lpString=".doc") returned 4
	[0061.256] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.256] lstrlenW (lpString=".docx") returned 5
	[0061.256] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0061.256] lstrlenW (lpString=".pdf") returned 4
	[0061.256] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.256] lstrlenW (lpString=".xls") returned 4
	[0061.256] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.256] lstrlenW (lpString=".xlsx") returned 5
	[0061.256] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0061.257] lstrlenW (lpString=".ppt") returned 4
	[0061.257] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.257] lstrlenW (lpString=".zip") returned 4
	[0061.257] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.257] lstrlenW (lpString=".rar") returned 4
	[0061.257] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.257] lstrlenW (lpString=".bz2") returned 4
	[0061.257] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.257] lstrlenW (lpString=".7z") returned 3
	[0061.257] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.257] lstrlenW (lpString=".dbf") returned 4
	[0061.257] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.257] lstrlenW (lpString=".1cd") returned 4
	[0061.257] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.257] lstrlenW (lpString=".jpg") returned 4
	[0061.257] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.258] lstrlenW (lpString=".doc") returned 4
	[0061.258] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.258] lstrlenW (lpString=".docx") returned 5
	[0061.258] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0061.258] lstrlenW (lpString=".pdf") returned 4
	[0061.258] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.258] lstrlenW (lpString=".xls") returned 4
	[0061.258] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.258] lstrlenW (lpString=".xlsx") returned 5
	[0061.258] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0061.258] lstrlenW (lpString=".ppt") returned 4
	[0061.258] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.258] lstrlenW (lpString=".zip") returned 4
	[0061.258] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.258] lstrlenW (lpString=".rar") returned 4
	[0061.258] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.258] lstrlenW (lpString=".bz2") returned 4
	[0061.258] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.258] lstrlenW (lpString=".7z") returned 3
	[0061.258] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.258] lstrlenW (lpString=".dbf") returned 4
	[0061.258] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.259] lstrlenW (lpString=".1cd") returned 4
	[0061.259] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0061.259] lstrlenW (lpString=".jpg") returned 4
	[0061.259] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.259] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.259] lstrlenW (lpString="Rotate1.ico") returned 11
	[0061.259] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0061.259] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=894) returned 1
	[0061.260] CloseHandle (hObject=0x2d4) returned 1
	[0061.260] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80
	[0061.260] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.260] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0061.260] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.260] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.260] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.260] GetLastError () returned 0x0
	[0061.261] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0061.263] WriteFile (in: hFile=0x33c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x380, lpOverlapped=0x0) returned 1
	[0061.264] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.264] WriteFile (in: hFile=0x33c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.264] SetEndOfFile (hFile=0x33c) returned 1
	[0061.264] CloseHandle (hObject=0x33c) returned 1
	[0061.265] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.265] SetEndOfFile (hFile=0x2d4) returned 1
	[0061.266] CloseHandle (hObject=0x2d4) returned 1
	[0061.266] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.266] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1
	[0061.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.266] lstrlenW (lpString=".doc") returned 4
	[0061.266] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.266] lstrlenW (lpString=".docx") returned 5
	[0061.266] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1
	[0061.266] lstrlenW (lpString=".pdf") returned 4
	[0061.267] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.267] lstrlenW (lpString=".xls") returned 4
	[0061.267] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.267] lstrlenW (lpString=".xlsx") returned 5
	[0061.267] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1
	[0061.267] lstrlenW (lpString=".ppt") returned 4
	[0061.267] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.267] lstrlenW (lpString=".zip") returned 4
	[0061.267] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.267] lstrlenW (lpString=".rar") returned 4
	[0061.267] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.267] lstrlenW (lpString=".bz2") returned 4
	[0061.267] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.267] lstrlenW (lpString=".7z") returned 3
	[0061.267] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.267] lstrlenW (lpString=".dbf") returned 4
	[0061.267] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.267] lstrlenW (lpString=".1cd") returned 4
	[0061.267] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.267] lstrlenW (lpString=".jpg") returned 4
	[0061.267] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.268] lstrlenW (lpString=".doc") returned 4
	[0061.268] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.268] lstrlenW (lpString=".docx") returned 5
	[0061.268] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1
	[0061.268] lstrlenW (lpString=".pdf") returned 4
	[0061.268] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.268] lstrlenW (lpString=".xls") returned 4
	[0061.268] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.268] lstrlenW (lpString=".xlsx") returned 5
	[0061.268] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1
	[0061.268] lstrlenW (lpString=".ppt") returned 4
	[0061.268] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.268] lstrlenW (lpString=".zip") returned 4
	[0061.268] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.268] lstrlenW (lpString=".rar") returned 4
	[0061.268] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.268] lstrlenW (lpString=".bz2") returned 4
	[0061.268] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.268] lstrlenW (lpString=".7z") returned 3
	[0061.268] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.268] lstrlenW (lpString=".dbf") returned 4
	[0061.268] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.268] lstrlenW (lpString=".1cd") returned 4
	[0061.269] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0061.269] lstrlenW (lpString=".jpg") returned 4
	[0061.269] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.269] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.269] lstrlenW (lpString="Rotate2.ico") returned 11
	[0061.269] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0061.269] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=894) returned 1
	[0061.269] CloseHandle (hObject=0x2d4) returned 1
	[0061.269] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80
	[0061.269] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.269] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0061.270] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.270] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.270] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0061.270] GetLastError () returned 0x0
	[0061.270] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0061.271] WriteFile (in: hFile=0x33c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x380, lpOverlapped=0x0) returned 1
	[0061.272] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.272] WriteFile (in: hFile=0x33c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xea, lpOverlapped=0x0) returned 1
	[0061.272] SetEndOfFile (hFile=0x33c) returned 1
	[0061.272] CloseHandle (hObject=0x33c) returned 1
	[0061.273] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.273] SetEndOfFile (hFile=0x2d4) returned 1
	[0061.274] CloseHandle (hObject=0x2d4) returned 1
	[0061.274] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.274] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1
	[0061.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.275] lstrlenW (lpString=".doc") returned 4
	[0061.275] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.275] lstrlenW (lpString=".docx") returned 5
	[0061.275] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1
	[0061.275] lstrlenW (lpString=".pdf") returned 4
	[0061.275] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.275] lstrlenW (lpString=".xls") returned 4
	[0061.275] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.275] lstrlenW (lpString=".xlsx") returned 5
	[0061.275] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1
	[0061.275] lstrlenW (lpString=".ppt") returned 4
	[0061.275] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.275] lstrlenW (lpString=".zip") returned 4
	[0061.275] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.275] lstrlenW (lpString=".rar") returned 4
	[0061.275] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.275] lstrlenW (lpString=".bz2") returned 4
	[0061.275] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.275] lstrlenW (lpString=".7z") returned 3
	[0061.275] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.275] lstrlenW (lpString=".dbf") returned 4
	[0061.275] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.276] lstrlenW (lpString=".1cd") returned 4
	[0061.276] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.276] lstrlenW (lpString=".jpg") returned 4
	[0061.276] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.276] lstrlenW (lpString=".doc") returned 4
	[0061.276] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.276] lstrlenW (lpString=".docx") returned 5
	[0061.276] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1
	[0061.276] lstrlenW (lpString=".pdf") returned 4
	[0061.276] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.779] lstrlenW (lpString=".xls") returned 4
	[0061.779] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.780] lstrlenW (lpString=".xlsx") returned 5
	[0061.780] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1
	[0061.780] lstrlenW (lpString=".ppt") returned 4
	[0061.780] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.780] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.780] lstrlenW (lpString=".zip") returned 4
	[0061.780] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.780] lstrlenW (lpString=".rar") returned 4
	[0061.780] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.780] lstrlenW (lpString=".bz2") returned 4
	[0061.780] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.780] lstrlenW (lpString=".7z") returned 3
	[0061.780] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.780] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.780] lstrlenW (lpString=".dbf") returned 4
	[0061.780] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.780] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.780] lstrlenW (lpString=".1cd") returned 4
	[0061.780] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.780] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0061.780] lstrlenW (lpString=".jpg") returned 4
	[0061.780] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.781] lstrcmpiW (lpString1=".ico", lpString2=".money") returned -1
	[0061.781] lstrlenW (lpString="warn.ico") returned 8
	[0061.781] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.781] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=10134) returned 1
	[0061.781] CloseHandle (hObject=0x374) returned 1
	[0061.781] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80
	[0061.781] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.781] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.781] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.782] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.782] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0061.782] GetLastError () returned 0x0
	[0061.782] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x2796, lpOverlapped=0x0) returned 1
	[0061.783] WriteFile (in: hFile=0x350, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x27a0, lpOverlapped=0x0) returned 1
	[0061.784] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.785] WriteFile (in: hFile=0x350, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0061.785] SetEndOfFile (hFile=0x350) returned 1
	[0061.785] CloseHandle (hObject=0x350) returned 1
	[0061.785] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.786] SetEndOfFile (hFile=0x374) returned 1
	[0061.786] CloseHandle (hObject=0x374) returned 1
	[0061.786] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0061.787] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1
	[0061.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.787] lstrlenW (lpString=".doc") returned 4
	[0061.787] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.787] lstrlenW (lpString=".docx") returned 5
	[0061.787] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0061.787] lstrlenW (lpString=".pdf") returned 4
	[0061.787] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.787] lstrlenW (lpString=".xls") returned 4
	[0061.787] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.787] lstrlenW (lpString=".xlsx") returned 5
	[0061.787] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0061.787] lstrlenW (lpString=".ppt") returned 4
	[0061.787] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.787] lstrlenW (lpString=".zip") returned 4
	[0061.787] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.787] lstrlenW (lpString=".rar") returned 4
	[0061.788] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.788] lstrlenW (lpString=".bz2") returned 4
	[0061.788] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.788] lstrlenW (lpString=".7z") returned 3
	[0061.788] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.788] lstrlenW (lpString=".dbf") returned 4
	[0061.788] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.788] lstrlenW (lpString=".1cd") returned 4
	[0061.788] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.788] lstrlenW (lpString=".jpg") returned 4
	[0061.788] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.788] lstrlenW (lpString=".doc") returned 4
	[0061.788] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0061.788] lstrlenW (lpString=".docx") returned 5
	[0061.788] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0061.788] lstrlenW (lpString=".pdf") returned 4
	[0061.788] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0061.788] lstrlenW (lpString=".xls") returned 4
	[0061.788] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0061.788] lstrlenW (lpString=".xlsx") returned 5
	[0061.788] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0061.788] lstrlenW (lpString=".ppt") returned 4
	[0061.788] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0061.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.789] lstrlenW (lpString=".zip") returned 4
	[0061.789] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0061.789] lstrlenW (lpString=".rar") returned 4
	[0061.789] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0061.789] lstrlenW (lpString=".bz2") returned 4
	[0061.789] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0061.789] lstrlenW (lpString=".7z") returned 3
	[0061.789] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0061.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.789] lstrlenW (lpString=".dbf") returned 4
	[0061.789] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0061.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.789] lstrlenW (lpString=".1cd") returned 4
	[0061.789] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0061.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0061.789] lstrlenW (lpString=".jpg") returned 4
	[0061.789] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0061.789] lstrcmpiW (lpString1=".mzz", lpString2=".money") returned 1
	[0061.789] lstrlenW (lpString="netfx_Core.mzz") returned 14
	[0061.789] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.790] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=181483595) returned 1
	[0061.790] CloseHandle (hObject=0x374) returned 1
	[0061.790] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80
	[0061.790] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0061.790] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[admin@stex777.com].money")) returned 1
	[0061.790] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0061.790] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc64 | out: lpNewFilePointer=0x0) returned 1
	[0061.791] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc24 | out: lpNewFilePointer=0x0) returned 1
	[0061.791] ReadFile (in: hFile=0x374, lpBuffer=0x43e4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3c5fc30, lpOverlapped=0x0 | out: lpBuffer=0x43e4058*, lpNumberOfBytesRead=0x3c5fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0061.799] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc24 | out: lpNewFilePointer=0x0) returned 1
	[0061.799] ReadFile (in: hFile=0x374, lpBuffer=0x4424058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3c5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4424058*, lpNumberOfBytesRead=0x3c5fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0061.802] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3c5fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0061.802] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc24 | out: lpNewFilePointer=0x0) returned 1
	[0061.802] ReadFile (in: hFile=0x374, lpBuffer=0x4464058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3c5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4464058*, lpNumberOfBytesRead=0x3c5fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0061.818] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.819] WriteFile (in: hFile=0x374, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x3c5fca8, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fca8*=0xc0108, lpOverlapped=0x0) returned 1
	[0062.251] SetEndOfFile (hFile=0x374) returned 1
	[0062.251] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x42d65b0
	[0062.257] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc74 | out: lpNewFilePointer=0x0) returned 1
	[0062.258] WriteFile (in: hFile=0x374, lpBuffer=0x42d65b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3c5fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d65b0*, lpNumberOfBytesWritten=0x3c5fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0062.258] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc74 | out: lpNewFilePointer=0x0) returned 1
	[0062.258] WriteFile (in: hFile=0x374, lpBuffer=0x42d65b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3c5fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d65b0*, lpNumberOfBytesWritten=0x3c5fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0062.259] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc74 | out: lpNewFilePointer=0x0) returned 1
	[0062.259] WriteFile (in: hFile=0x374, lpBuffer=0x42d65b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3c5fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d65b0*, lpNumberOfBytesWritten=0x3c5fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0062.261] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42d65b0 | out: hHeap=0x600000) returned 1
	[0062.261] CloseHandle (hObject=0x374) returned 1
	[0065.442] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0065.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.443] lstrlenW (lpString=".doc") returned 4
	[0065.443] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0065.443] lstrlenW (lpString=".docx") returned 5
	[0065.443] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1
	[0065.443] lstrlenW (lpString=".pdf") returned 4
	[0065.443] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0065.443] lstrlenW (lpString=".xls") returned 4
	[0065.443] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0065.443] lstrlenW (lpString=".xlsx") returned 5
	[0065.443] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1
	[0065.443] lstrlenW (lpString=".ppt") returned 4
	[0065.443] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0065.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.443] lstrlenW (lpString=".zip") returned 4
	[0065.443] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0065.443] lstrlenW (lpString=".rar") returned 4
	[0065.444] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0065.444] lstrlenW (lpString=".bz2") returned 4
	[0065.444] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0065.444] lstrlenW (lpString=".7z") returned 3
	[0065.444] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0065.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.444] lstrlenW (lpString=".dbf") returned 4
	[0065.444] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0065.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.444] lstrlenW (lpString=".1cd") returned 4
	[0065.444] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0065.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.444] lstrlenW (lpString=".jpg") returned 4
	[0065.444] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0065.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.444] lstrlenW (lpString=".doc") returned 4
	[0065.444] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0065.444] lstrlenW (lpString=".docx") returned 5
	[0065.444] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1
	[0065.444] lstrlenW (lpString=".pdf") returned 4
	[0065.445] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0065.445] lstrlenW (lpString=".xls") returned 4
	[0065.445] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0065.445] lstrlenW (lpString=".xlsx") returned 5
	[0065.445] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1
	[0065.445] lstrlenW (lpString=".ppt") returned 4
	[0065.445] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0065.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.445] lstrlenW (lpString=".zip") returned 4
	[0065.445] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0065.445] lstrlenW (lpString=".rar") returned 4
	[0065.445] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0065.445] lstrlenW (lpString=".bz2") returned 4
	[0065.445] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0065.445] lstrlenW (lpString=".7z") returned 3
	[0065.445] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0065.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.445] lstrlenW (lpString=".dbf") returned 4
	[0065.445] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0065.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.445] lstrlenW (lpString=".1cd") returned 4
	[0065.445] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0065.446] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0065.446] lstrlenW (lpString=".jpg") returned 4
	[0065.446] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0065.446] lstrcmpiW (lpString1=".msu", lpString2=".money") returned 1
	[0065.446] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33
	[0065.446] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0065.446] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=5091790) returned 1
	[0065.446] CloseHandle (hObject=0x378) returned 1
	[0065.446] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80
	[0065.447] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0065.447] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[admin@stex777.com].money")) returned 1
	[0065.447] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0065.447] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc64 | out: lpNewFilePointer=0x0) returned 1
	[0065.447] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.447] ReadFile (in: hFile=0x378, lpBuffer=0x43e4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3c5fc30, lpOverlapped=0x0 | out: lpBuffer=0x43e4058*, lpNumberOfBytesRead=0x3c5fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.452] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.452] ReadFile (in: hFile=0x378, lpBuffer=0x4424058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3c5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4424058*, lpNumberOfBytesRead=0x3c5fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.455] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3c5fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0065.455] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.455] ReadFile (in: hFile=0x378, lpBuffer=0x4464058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3c5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4464058*, lpNumberOfBytesRead=0x3c5fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.470] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.471] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x3c5fca8, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0065.940] SetEndOfFile (hFile=0x378) returned 1
	[0065.940] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x40000) returned 0x43545b8
	[0065.940] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc74 | out: lpNewFilePointer=0x0) returned 1
	[0065.940] WriteFile (in: hFile=0x378, lpBuffer=0x43545b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3c5fc80, lpOverlapped=0x0 | out: lpBuffer=0x43545b8*, lpNumberOfBytesWritten=0x3c5fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.946] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc74 | out: lpNewFilePointer=0x0) returned 1
	[0065.946] WriteFile (in: hFile=0x378, lpBuffer=0x43545b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3c5fc80, lpOverlapped=0x0 | out: lpBuffer=0x43545b8*, lpNumberOfBytesWritten=0x3c5fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.948] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc74 | out: lpNewFilePointer=0x0) returned 1
	[0065.948] WriteFile (in: hFile=0x378, lpBuffer=0x43545b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3c5fc80, lpOverlapped=0x0 | out: lpBuffer=0x43545b8*, lpNumberOfBytesWritten=0x3c5fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.950] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43545b8 | out: hHeap=0x600000) returned 1
	[0065.950] CloseHandle (hObject=0x378) returned 1
	[0067.755] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x80) returned 1
	[0067.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.755] lstrlenW (lpString=".doc") returned 4
	[0067.755] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0067.755] lstrlenW (lpString=".docx") returned 5
	[0067.755] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0067.755] lstrlenW (lpString=".pdf") returned 4
	[0067.755] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0067.755] lstrlenW (lpString=".xls") returned 4
	[0067.756] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0067.756] lstrlenW (lpString=".xlsx") returned 5
	[0067.756] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0067.756] lstrlenW (lpString=".ppt") returned 4
	[0067.756] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0067.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.756] lstrlenW (lpString=".zip") returned 4
	[0067.756] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0067.756] lstrlenW (lpString=".rar") returned 4
	[0067.756] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0067.756] lstrlenW (lpString=".bz2") returned 4
	[0067.756] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0067.756] lstrlenW (lpString=".7z") returned 3
	[0067.756] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0067.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.756] lstrlenW (lpString=".dbf") returned 4
	[0067.756] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0067.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.756] lstrlenW (lpString=".1cd") returned 4
	[0067.756] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0067.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.756] lstrlenW (lpString=".jpg") returned 4
	[0067.756] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0067.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.757] lstrlenW (lpString=".doc") returned 4
	[0067.757] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0067.757] lstrlenW (lpString=".docx") returned 5
	[0067.757] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0067.757] lstrlenW (lpString=".pdf") returned 4
	[0067.757] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0067.757] lstrlenW (lpString=".xls") returned 4
	[0067.757] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0067.757] lstrlenW (lpString=".xlsx") returned 5
	[0067.757] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0067.757] lstrlenW (lpString=".ppt") returned 4
	[0067.757] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0067.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.757] lstrlenW (lpString=".zip") returned 4
	[0067.757] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0067.757] lstrlenW (lpString=".rar") returned 4
	[0067.757] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0067.757] lstrlenW (lpString=".bz2") returned 4
	[0067.757] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0067.757] lstrlenW (lpString=".7z") returned 3
	[0067.757] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0067.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.757] lstrlenW (lpString=".dbf") returned 4
	[0067.758] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0067.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.758] lstrlenW (lpString=".1cd") returned 4
	[0067.758] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0067.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0067.758] lstrlenW (lpString=".jpg") returned 4
	[0067.758] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0067.758] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0067.758] lstrlenW (lpString="Key Management Service.evtx") returned 27
	[0067.758] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0067.868] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0067.884] CloseHandle (hObject=0x374) returned 1
	[0067.974] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20
	[0067.974] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0067.974] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0067.974] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.974] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.974] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0068.135] GetLastError () returned 0x0
	[0068.135] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.150] WriteFile (in: hFile=0x368, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.151] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.152] WriteFile (in: hFile=0x368, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0068.152] SetEndOfFile (hFile=0x368) returned 1
	[0068.152] CloseHandle (hObject=0x368) returned 1
	[0068.154] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.154] SetEndOfFile (hFile=0x374) returned 1
	[0068.155] CloseHandle (hObject=0x374) returned 1
	[0068.155] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.156] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1
	[0068.156] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.156] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.156] lstrlenW (lpString=".doc") returned 4
	[0068.156] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.156] lstrlenW (lpString=".docx") returned 5
	[0068.156] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.156] lstrlenW (lpString=".pdf") returned 4
	[0068.156] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.156] lstrlenW (lpString=".xls") returned 4
	[0068.156] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.156] lstrlenW (lpString=".xlsx") returned 5
	[0068.156] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.156] lstrlenW (lpString=".ppt") returned 4
	[0068.157] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.157] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.157] lstrlenW (lpString=".zip") returned 4
	[0068.157] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.157] lstrlenW (lpString=".rar") returned 4
	[0068.157] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.157] lstrlenW (lpString=".bz2") returned 4
	[0068.157] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.157] lstrlenW (lpString=".7z") returned 3
	[0068.157] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.157] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.157] lstrlenW (lpString=".dbf") returned 4
	[0068.157] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.157] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.157] lstrlenW (lpString=".1cd") returned 4
	[0068.157] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.157] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.157] lstrlenW (lpString=".jpg") returned 4
	[0068.157] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.157] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.157] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.157] lstrlenW (lpString=".doc") returned 4
	[0068.157] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.157] lstrlenW (lpString=".docx") returned 5
	[0068.157] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.157] lstrlenW (lpString=".pdf") returned 4
	[0068.157] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.158] lstrlenW (lpString=".xls") returned 4
	[0068.158] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.158] lstrlenW (lpString=".xlsx") returned 5
	[0068.158] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.158] lstrlenW (lpString=".ppt") returned 4
	[0068.158] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.158] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.158] lstrlenW (lpString=".zip") returned 4
	[0068.158] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.158] lstrlenW (lpString=".rar") returned 4
	[0068.158] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.158] lstrlenW (lpString=".bz2") returned 4
	[0068.158] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.158] lstrlenW (lpString=".7z") returned 3
	[0068.158] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.158] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.158] lstrlenW (lpString=".dbf") returned 4
	[0068.158] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.158] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.158] lstrlenW (lpString=".1cd") returned 4
	[0068.158] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.158] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0068.158] lstrlenW (lpString=".jpg") returned 4
	[0068.158] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.159] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.159] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46
	[0068.159] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0068.159] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0068.159] CloseHandle (hObject=0x374) returned 1
	[0068.159] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20
	[0068.159] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.159] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0068.159] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.159] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.160] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0068.160] GetLastError () returned 0x0
	[0068.160] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.163] WriteFile (in: hFile=0x368, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.165] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.165] WriteFile (in: hFile=0x368, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x130, lpOverlapped=0x0) returned 1
	[0068.165] SetEndOfFile (hFile=0x368) returned 1
	[0068.165] CloseHandle (hObject=0x368) returned 1
	[0068.168] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.168] SetEndOfFile (hFile=0x374) returned 1
	[0068.169] CloseHandle (hObject=0x374) returned 1
	[0068.169] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.170] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1
	[0068.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.170] lstrlenW (lpString=".doc") returned 4
	[0068.170] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.170] lstrlenW (lpString=".docx") returned 5
	[0068.170] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.170] lstrlenW (lpString=".pdf") returned 4
	[0068.170] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.170] lstrlenW (lpString=".xls") returned 4
	[0068.170] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.171] lstrlenW (lpString=".xlsx") returned 5
	[0068.171] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.171] lstrlenW (lpString=".ppt") returned 4
	[0068.171] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.171] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.171] lstrlenW (lpString=".zip") returned 4
	[0068.171] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.171] lstrlenW (lpString=".rar") returned 4
	[0068.171] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.171] lstrlenW (lpString=".bz2") returned 4
	[0068.171] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.171] lstrlenW (lpString=".7z") returned 3
	[0068.171] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.171] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.171] lstrlenW (lpString=".dbf") returned 4
	[0068.171] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.171] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.172] lstrlenW (lpString=".1cd") returned 4
	[0068.172] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.172] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.172] lstrlenW (lpString=".jpg") returned 4
	[0068.172] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.172] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.172] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.172] lstrlenW (lpString=".doc") returned 4
	[0068.172] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.172] lstrlenW (lpString=".docx") returned 5
	[0068.172] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.172] lstrlenW (lpString=".pdf") returned 4
	[0068.172] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.172] lstrlenW (lpString=".xls") returned 4
	[0068.172] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.172] lstrlenW (lpString=".xlsx") returned 5
	[0068.172] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.172] lstrlenW (lpString=".ppt") returned 4
	[0068.173] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.173] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.173] lstrlenW (lpString=".zip") returned 4
	[0068.173] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.173] lstrlenW (lpString=".rar") returned 4
	[0068.173] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.173] lstrlenW (lpString=".bz2") returned 4
	[0068.173] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.173] lstrlenW (lpString=".7z") returned 3
	[0068.173] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.173] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.173] lstrlenW (lpString=".dbf") returned 4
	[0068.173] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.173] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.173] lstrlenW (lpString=".1cd") returned 4
	[0068.173] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.173] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0068.173] lstrlenW (lpString=".jpg") returned 4
	[0068.173] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.173] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.173] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42
	[0068.173] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0068.174] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0068.174] CloseHandle (hObject=0x374) returned 1
	[0068.174] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20
	[0068.174] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.174] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0068.174] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.174] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.174] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0068.174] GetLastError () returned 0x0
	[0068.174] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0068.177] WriteFile (in: hFile=0x368, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0068.180] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.180] WriteFile (in: hFile=0x368, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x128, lpOverlapped=0x0) returned 1
	[0068.180] SetEndOfFile (hFile=0x368) returned 1
	[0068.180] CloseHandle (hObject=0x368) returned 1
	[0068.182] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.182] SetEndOfFile (hFile=0x374) returned 1
	[0068.183] CloseHandle (hObject=0x374) returned 1
	[0068.184] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0068.184] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1
	[0068.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.184] lstrlenW (lpString=".doc") returned 4
	[0068.184] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.184] lstrlenW (lpString=".docx") returned 5
	[0068.184] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.184] lstrlenW (lpString=".pdf") returned 4
	[0068.184] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.184] lstrlenW (lpString=".xls") returned 4
	[0068.184] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.184] lstrlenW (lpString=".xlsx") returned 5
	[0068.184] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.184] lstrlenW (lpString=".ppt") returned 4
	[0068.185] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.185] lstrlenW (lpString=".zip") returned 4
	[0068.185] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.185] lstrlenW (lpString=".rar") returned 4
	[0068.185] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.185] lstrlenW (lpString=".bz2") returned 4
	[0068.185] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.185] lstrlenW (lpString=".7z") returned 3
	[0068.185] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.185] lstrlenW (lpString=".dbf") returned 4
	[0068.185] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.185] lstrlenW (lpString=".1cd") returned 4
	[0068.185] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.185] lstrlenW (lpString=".jpg") returned 4
	[0068.185] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.185] lstrlenW (lpString=".doc") returned 4
	[0068.185] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0068.185] lstrlenW (lpString=".docx") returned 5
	[0068.185] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0068.185] lstrlenW (lpString=".pdf") returned 4
	[0068.185] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0068.185] lstrlenW (lpString=".xls") returned 4
	[0068.186] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0068.186] lstrlenW (lpString=".xlsx") returned 5
	[0068.186] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0068.186] lstrlenW (lpString=".ppt") returned 4
	[0068.186] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0068.186] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.186] lstrlenW (lpString=".zip") returned 4
	[0068.186] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0068.186] lstrlenW (lpString=".rar") returned 4
	[0068.186] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0068.186] lstrlenW (lpString=".bz2") returned 4
	[0068.186] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0068.186] lstrlenW (lpString=".7z") returned 3
	[0068.186] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0068.186] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.186] lstrlenW (lpString=".dbf") returned 4
	[0068.186] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0068.186] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.186] lstrlenW (lpString=".1cd") returned 4
	[0068.186] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0068.186] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0068.186] lstrlenW (lpString=".jpg") returned 4
	[0068.186] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0068.186] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0068.187] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48
	[0068.187] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0068.750] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=1118208) returned 1
	[0068.750] CloseHandle (hObject=0x318) returned 1
	[0068.750] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20
	[0068.750] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0068.750] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0068.750] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.750] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.750] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0068.751] GetLastError () returned 0x0
	[0068.751] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0068.772] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0069.199] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11010, lpOverlapped=0x0) returned 1
	[0069.208] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11020, lpOverlapped=0x0) returned 1
	[0069.213] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.213] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x134, lpOverlapped=0x0) returned 1
	[0069.213] SetEndOfFile (hFile=0x378) returned 1
	[0069.213] CloseHandle (hObject=0x378) returned 1
	[0069.239] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.239] SetEndOfFile (hFile=0x318) returned 1
	[0069.240] CloseHandle (hObject=0x318) returned 1
	[0069.240] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.241] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1
	[0069.265] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.265] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.265] lstrlenW (lpString=".doc") returned 4
	[0069.265] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.266] lstrlenW (lpString=".docx") returned 5
	[0069.266] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.266] lstrlenW (lpString=".pdf") returned 4
	[0069.266] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.266] lstrlenW (lpString=".xls") returned 4
	[0069.266] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.266] lstrlenW (lpString=".xlsx") returned 5
	[0069.266] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.266] lstrlenW (lpString=".ppt") returned 4
	[0069.266] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.266] lstrlenW (lpString=".zip") returned 4
	[0069.266] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.266] lstrlenW (lpString=".rar") returned 4
	[0069.266] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.266] lstrlenW (lpString=".bz2") returned 4
	[0069.266] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.266] lstrlenW (lpString=".7z") returned 3
	[0069.266] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.266] lstrlenW (lpString=".dbf") returned 4
	[0069.266] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.266] lstrlenW (lpString=".1cd") returned 4
	[0069.266] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.266] lstrlenW (lpString=".jpg") returned 4
	[0069.266] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.267] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.267] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.267] lstrlenW (lpString=".doc") returned 4
	[0069.267] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.267] lstrlenW (lpString=".docx") returned 5
	[0069.267] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.267] lstrlenW (lpString=".pdf") returned 4
	[0069.267] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.267] lstrlenW (lpString=".xls") returned 4
	[0069.267] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.267] lstrlenW (lpString=".xlsx") returned 5
	[0069.267] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.267] lstrlenW (lpString=".ppt") returned 4
	[0069.267] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.267] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.267] lstrlenW (lpString=".zip") returned 4
	[0069.267] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.267] lstrlenW (lpString=".rar") returned 4
	[0069.267] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.267] lstrlenW (lpString=".bz2") returned 4
	[0069.267] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.267] lstrlenW (lpString=".7z") returned 3
	[0069.267] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.267] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.267] lstrlenW (lpString=".dbf") returned 4
	[0069.267] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.267] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.267] lstrlenW (lpString=".1cd") returned 4
	[0069.267] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.267] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0069.267] lstrlenW (lpString=".jpg") returned 4
	[0069.267] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.268] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0069.268] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47
	[0069.268] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0069.569] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0069.570] CloseHandle (hObject=0x318) returned 1
	[0069.570] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20
	[0069.570] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.570] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0069.570] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.570] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.570] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0069.570] GetLastError () returned 0x0
	[0069.570] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0069.573] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0069.575] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.575] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x132, lpOverlapped=0x0) returned 1
	[0069.575] SetEndOfFile (hFile=0x378) returned 1
	[0069.575] CloseHandle (hObject=0x378) returned 1
	[0069.577] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.577] SetEndOfFile (hFile=0x318) returned 1
	[0069.578] CloseHandle (hObject=0x318) returned 1
	[0069.578] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.578] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1
	[0069.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.579] lstrlenW (lpString=".doc") returned 4
	[0069.579] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.579] lstrlenW (lpString=".docx") returned 5
	[0069.579] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.579] lstrlenW (lpString=".pdf") returned 4
	[0069.579] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.579] lstrlenW (lpString=".xls") returned 4
	[0069.579] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.579] lstrlenW (lpString=".xlsx") returned 5
	[0069.579] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.579] lstrlenW (lpString=".ppt") returned 4
	[0069.579] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.579] lstrlenW (lpString=".zip") returned 4
	[0069.579] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.579] lstrlenW (lpString=".rar") returned 4
	[0069.579] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.579] lstrlenW (lpString=".bz2") returned 4
	[0069.579] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.579] lstrlenW (lpString=".7z") returned 3
	[0069.579] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.579] lstrlenW (lpString=".dbf") returned 4
	[0069.579] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.579] lstrlenW (lpString=".1cd") returned 4
	[0069.580] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.580] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.580] lstrlenW (lpString=".jpg") returned 4
	[0069.580] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.580] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.580] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.580] lstrlenW (lpString=".doc") returned 4
	[0069.580] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.580] lstrlenW (lpString=".docx") returned 5
	[0069.580] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.580] lstrlenW (lpString=".pdf") returned 4
	[0069.580] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.580] lstrlenW (lpString=".xls") returned 4
	[0069.580] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.580] lstrlenW (lpString=".xlsx") returned 5
	[0069.580] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.580] lstrlenW (lpString=".ppt") returned 4
	[0069.580] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.580] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.580] lstrlenW (lpString=".zip") returned 4
	[0069.580] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.580] lstrlenW (lpString=".rar") returned 4
	[0069.580] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.580] lstrlenW (lpString=".bz2") returned 4
	[0069.580] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.581] lstrlenW (lpString=".7z") returned 3
	[0069.581] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.581] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.581] lstrlenW (lpString=".dbf") returned 4
	[0069.581] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.581] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.581] lstrlenW (lpString=".1cd") returned 4
	[0069.581] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.581] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0069.581] lstrlenW (lpString=".jpg") returned 4
	[0069.581] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.581] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0069.581] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48
	[0069.581] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0069.582] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0069.582] CloseHandle (hObject=0x318) returned 1
	[0069.582] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20
	[0069.582] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.582] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0069.582] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.582] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.582] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0069.583] GetLastError () returned 0x0
	[0069.583] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0069.586] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0069.588] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.589] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x134, lpOverlapped=0x0) returned 1
	[0069.589] SetEndOfFile (hFile=0x378) returned 1
	[0069.589] CloseHandle (hObject=0x378) returned 1
	[0069.591] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.591] SetEndOfFile (hFile=0x318) returned 1
	[0069.592] CloseHandle (hObject=0x318) returned 1
	[0069.592] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0069.592] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1
	[0069.592] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.593] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.593] lstrlenW (lpString=".doc") returned 4
	[0069.593] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.593] lstrlenW (lpString=".docx") returned 5
	[0069.593] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.593] lstrlenW (lpString=".pdf") returned 4
	[0069.593] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.593] lstrlenW (lpString=".xls") returned 4
	[0069.593] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.593] lstrlenW (lpString=".xlsx") returned 5
	[0069.593] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.593] lstrlenW (lpString=".ppt") returned 4
	[0069.593] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.593] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.593] lstrlenW (lpString=".zip") returned 4
	[0069.593] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.593] lstrlenW (lpString=".rar") returned 4
	[0069.593] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.593] lstrlenW (lpString=".bz2") returned 4
	[0069.593] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.593] lstrlenW (lpString=".7z") returned 3
	[0069.593] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.593] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.593] lstrlenW (lpString=".dbf") returned 4
	[0069.593] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.593] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.593] lstrlenW (lpString=".1cd") returned 4
	[0069.593] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.593] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.593] lstrlenW (lpString=".jpg") returned 4
	[0069.594] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.594] lstrlenW (lpString=".doc") returned 4
	[0069.594] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0069.594] lstrlenW (lpString=".docx") returned 5
	[0069.594] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0069.594] lstrlenW (lpString=".pdf") returned 4
	[0069.594] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0069.594] lstrlenW (lpString=".xls") returned 4
	[0069.594] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0069.594] lstrlenW (lpString=".xlsx") returned 5
	[0069.594] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0069.594] lstrlenW (lpString=".ppt") returned 4
	[0069.594] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0069.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.594] lstrlenW (lpString=".zip") returned 4
	[0069.594] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0069.594] lstrlenW (lpString=".rar") returned 4
	[0069.594] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0069.594] lstrlenW (lpString=".bz2") returned 4
	[0069.594] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0069.594] lstrlenW (lpString=".7z") returned 3
	[0069.594] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0069.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.594] lstrlenW (lpString=".dbf") returned 4
	[0069.594] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0069.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.594] lstrlenW (lpString=".1cd") returned 4
	[0069.595] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0069.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0069.595] lstrlenW (lpString=".jpg") returned 4
	[0069.595] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0069.595] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0069.595] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78
	[0069.595] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0069.595] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=1052672) returned 1
	[0069.595] CloseHandle (hObject=0x318) returned 1
	[0069.595] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20
	[0069.595] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0069.595] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0069.595] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.596] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.596] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0069.596] GetLastError () returned 0x0
	[0069.596] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0069.899] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0069.918] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0069.927] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0069.930] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.930] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x170, lpOverlapped=0x0) returned 1
	[0069.930] SetEndOfFile (hFile=0x378) returned 1
	[0069.930] CloseHandle (hObject=0x378) returned 1
	[0070.645] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.646] SetEndOfFile (hFile=0x318) returned 1
	[0070.646] CloseHandle (hObject=0x318) returned 1
	[0070.647] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0070.647] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1
	[0070.647] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.647] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.647] lstrlenW (lpString=".doc") returned 4
	[0070.647] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.647] lstrlenW (lpString=".docx") returned 5
	[0070.647] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.647] lstrlenW (lpString=".pdf") returned 4
	[0070.647] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.647] lstrlenW (lpString=".xls") returned 4
	[0070.648] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.648] lstrlenW (lpString=".xlsx") returned 5
	[0070.648] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.648] lstrlenW (lpString=".ppt") returned 4
	[0070.648] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.648] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.648] lstrlenW (lpString=".zip") returned 4
	[0070.648] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.648] lstrlenW (lpString=".rar") returned 4
	[0070.648] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.648] lstrlenW (lpString=".bz2") returned 4
	[0070.648] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.648] lstrlenW (lpString=".7z") returned 3
	[0070.648] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.648] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.648] lstrlenW (lpString=".dbf") returned 4
	[0070.648] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.648] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.648] lstrlenW (lpString=".1cd") returned 4
	[0070.648] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.648] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.648] lstrlenW (lpString=".jpg") returned 4
	[0070.648] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.648] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.648] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.648] lstrlenW (lpString=".doc") returned 4
	[0070.648] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.648] lstrlenW (lpString=".docx") returned 5
	[0070.649] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.649] lstrlenW (lpString=".pdf") returned 4
	[0070.649] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.649] lstrlenW (lpString=".xls") returned 4
	[0070.649] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.649] lstrlenW (lpString=".xlsx") returned 5
	[0070.649] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.649] lstrlenW (lpString=".ppt") returned 4
	[0070.649] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.649] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.649] lstrlenW (lpString=".zip") returned 4
	[0070.649] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.649] lstrlenW (lpString=".rar") returned 4
	[0070.649] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.649] lstrlenW (lpString=".bz2") returned 4
	[0070.649] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.649] lstrlenW (lpString=".7z") returned 3
	[0070.649] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.649] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.649] lstrlenW (lpString=".dbf") returned 4
	[0070.649] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.649] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.649] lstrlenW (lpString=".1cd") returned 4
	[0070.649] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.649] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0070.649] lstrlenW (lpString=".jpg") returned 4
	[0070.649] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.650] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0070.650] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49
	[0070.650] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0070.651] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0070.651] CloseHandle (hObject=0x318) returned 1
	[0070.651] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20
	[0070.651] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.651] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0070.651] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.651] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.651] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0070.652] GetLastError () returned 0x0
	[0070.652] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0070.654] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0070.656] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.656] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x136, lpOverlapped=0x0) returned 1
	[0070.656] SetEndOfFile (hFile=0x378) returned 1
	[0070.656] CloseHandle (hObject=0x378) returned 1
	[0070.658] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.658] SetEndOfFile (hFile=0x318) returned 1
	[0070.659] CloseHandle (hObject=0x318) returned 1
	[0070.659] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0070.660] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1
	[0070.660] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.660] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.660] lstrlenW (lpString=".doc") returned 4
	[0070.660] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.660] lstrlenW (lpString=".docx") returned 5
	[0070.660] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.660] lstrlenW (lpString=".pdf") returned 4
	[0070.660] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.660] lstrlenW (lpString=".xls") returned 4
	[0070.660] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.660] lstrlenW (lpString=".xlsx") returned 5
	[0070.660] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.660] lstrlenW (lpString=".ppt") returned 4
	[0070.660] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.660] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.660] lstrlenW (lpString=".zip") returned 4
	[0070.660] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.660] lstrlenW (lpString=".rar") returned 4
	[0070.660] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.660] lstrlenW (lpString=".bz2") returned 4
	[0070.661] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.661] lstrlenW (lpString=".7z") returned 3
	[0070.661] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.661] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.661] lstrlenW (lpString=".dbf") returned 4
	[0070.661] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.661] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.661] lstrlenW (lpString=".1cd") returned 4
	[0070.661] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.661] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.661] lstrlenW (lpString=".jpg") returned 4
	[0070.661] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.661] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.661] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.661] lstrlenW (lpString=".doc") returned 4
	[0070.661] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0070.661] lstrlenW (lpString=".docx") returned 5
	[0070.661] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0070.661] lstrlenW (lpString=".pdf") returned 4
	[0070.661] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0070.661] lstrlenW (lpString=".xls") returned 4
	[0070.661] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0070.661] lstrlenW (lpString=".xlsx") returned 5
	[0070.661] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0070.661] lstrlenW (lpString=".ppt") returned 4
	[0070.661] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0070.661] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.661] lstrlenW (lpString=".zip") returned 4
	[0070.662] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0070.662] lstrlenW (lpString=".rar") returned 4
	[0070.662] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0070.662] lstrlenW (lpString=".bz2") returned 4
	[0070.662] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0070.662] lstrlenW (lpString=".7z") returned 3
	[0070.662] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0070.662] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.662] lstrlenW (lpString=".dbf") returned 4
	[0070.662] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0070.662] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.662] lstrlenW (lpString=".1cd") returned 4
	[0070.662] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0070.662] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0070.662] lstrlenW (lpString=".jpg") returned 4
	[0070.662] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0070.662] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0070.662] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47
	[0070.662] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0070.663] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0070.663] CloseHandle (hObject=0x318) returned 1
	[0070.663] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20
	[0070.663] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0070.663] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0070.663] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.663] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.663] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0070.663] GetLastError () returned 0x0
	[0070.663] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.057] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.059] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.059] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x132, lpOverlapped=0x0) returned 1
	[0071.059] SetEndOfFile (hFile=0x378) returned 1
	[0071.060] CloseHandle (hObject=0x378) returned 1
	[0071.062] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.062] SetEndOfFile (hFile=0x318) returned 1
	[0071.063] CloseHandle (hObject=0x318) returned 1
	[0071.063] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.063] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1
	[0071.064] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.064] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.064] lstrlenW (lpString=".doc") returned 4
	[0071.064] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.064] lstrlenW (lpString=".docx") returned 5
	[0071.064] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.064] lstrlenW (lpString=".pdf") returned 4
	[0071.064] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.064] lstrlenW (lpString=".xls") returned 4
	[0071.064] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.064] lstrlenW (lpString=".xlsx") returned 5
	[0071.064] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.064] lstrlenW (lpString=".ppt") returned 4
	[0071.064] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.064] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.064] lstrlenW (lpString=".zip") returned 4
	[0071.064] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.064] lstrlenW (lpString=".rar") returned 4
	[0071.064] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.064] lstrlenW (lpString=".bz2") returned 4
	[0071.064] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.065] lstrlenW (lpString=".7z") returned 3
	[0071.065] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.065] lstrlenW (lpString=".dbf") returned 4
	[0071.065] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.065] lstrlenW (lpString=".1cd") returned 4
	[0071.065] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.065] lstrlenW (lpString=".jpg") returned 4
	[0071.065] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.065] lstrlenW (lpString=".doc") returned 4
	[0071.065] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.065] lstrlenW (lpString=".docx") returned 5
	[0071.065] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.065] lstrlenW (lpString=".pdf") returned 4
	[0071.065] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.065] lstrlenW (lpString=".xls") returned 4
	[0071.065] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.065] lstrlenW (lpString=".xlsx") returned 5
	[0071.065] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.066] lstrlenW (lpString=".ppt") returned 4
	[0071.066] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.066] lstrlenW (lpString=".zip") returned 4
	[0071.066] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.066] lstrlenW (lpString=".rar") returned 4
	[0071.066] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.066] lstrlenW (lpString=".bz2") returned 4
	[0071.066] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.066] lstrlenW (lpString=".7z") returned 3
	[0071.066] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.066] lstrlenW (lpString=".dbf") returned 4
	[0071.066] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.066] lstrlenW (lpString=".1cd") returned 4
	[0071.066] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0071.066] lstrlenW (lpString=".jpg") returned 4
	[0071.066] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.066] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.067] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51
	[0071.067] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0071.067] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0071.067] CloseHandle (hObject=0x318) returned 1
	[0071.067] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20
	[0071.067] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.067] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0071.067] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.067] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.067] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0071.068] GetLastError () returned 0x0
	[0071.068] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.074] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.076] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.076] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x13a, lpOverlapped=0x0) returned 1
	[0071.076] SetEndOfFile (hFile=0x378) returned 1
	[0071.076] CloseHandle (hObject=0x378) returned 1
	[0071.078] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.078] SetEndOfFile (hFile=0x318) returned 1
	[0071.079] CloseHandle (hObject=0x318) returned 1
	[0071.080] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.080] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1
	[0071.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.080] lstrlenW (lpString=".doc") returned 4
	[0071.080] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.080] lstrlenW (lpString=".docx") returned 5
	[0071.080] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.080] lstrlenW (lpString=".pdf") returned 4
	[0071.080] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.080] lstrlenW (lpString=".xls") returned 4
	[0071.080] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.080] lstrlenW (lpString=".xlsx") returned 5
	[0071.080] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.080] lstrlenW (lpString=".ppt") returned 4
	[0071.081] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.081] lstrlenW (lpString=".zip") returned 4
	[0071.081] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.081] lstrlenW (lpString=".rar") returned 4
	[0071.081] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.081] lstrlenW (lpString=".bz2") returned 4
	[0071.081] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.081] lstrlenW (lpString=".7z") returned 3
	[0071.081] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.081] lstrlenW (lpString=".dbf") returned 4
	[0071.081] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.081] lstrlenW (lpString=".1cd") returned 4
	[0071.081] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.081] lstrlenW (lpString=".jpg") returned 4
	[0071.081] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.081] lstrlenW (lpString=".doc") returned 4
	[0071.081] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.081] lstrlenW (lpString=".docx") returned 5
	[0071.081] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.081] lstrlenW (lpString=".pdf") returned 4
	[0071.081] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.082] lstrlenW (lpString=".xls") returned 4
	[0071.082] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.082] lstrlenW (lpString=".xlsx") returned 5
	[0071.082] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.082] lstrlenW (lpString=".ppt") returned 4
	[0071.082] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.082] lstrlenW (lpString=".zip") returned 4
	[0071.082] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.082] lstrlenW (lpString=".rar") returned 4
	[0071.082] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.082] lstrlenW (lpString=".bz2") returned 4
	[0071.082] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.082] lstrlenW (lpString=".7z") returned 3
	[0071.082] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.082] lstrlenW (lpString=".dbf") returned 4
	[0071.082] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.082] lstrlenW (lpString=".1cd") returned 4
	[0071.082] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0071.082] lstrlenW (lpString=".jpg") returned 4
	[0071.082] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.083] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.083] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42
	[0071.083] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0071.083] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0071.083] CloseHandle (hObject=0x318) returned 1
	[0071.084] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20
	[0071.084] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.084] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0071.084] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.084] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.084] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0071.085] GetLastError () returned 0x0
	[0071.085] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.096] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.098] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.098] WriteFile (in: hFile=0x378, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x128, lpOverlapped=0x0) returned 1
	[0071.098] SetEndOfFile (hFile=0x378) returned 1
	[0071.098] CloseHandle (hObject=0x378) returned 1
	[0071.101] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.101] SetEndOfFile (hFile=0x318) returned 1
	[0071.102] CloseHandle (hObject=0x318) returned 1
	[0071.102] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.102] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1
	[0071.102] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.102] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.507] lstrlenW (lpString=".doc") returned 4
	[0071.507] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.507] lstrlenW (lpString=".docx") returned 5
	[0071.507] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.507] lstrlenW (lpString=".pdf") returned 4
	[0071.507] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.507] lstrlenW (lpString=".xls") returned 4
	[0071.507] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.507] lstrlenW (lpString=".xlsx") returned 5
	[0071.507] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.508] lstrlenW (lpString=".ppt") returned 4
	[0071.508] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.508] lstrlenW (lpString=".zip") returned 4
	[0071.508] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.508] lstrlenW (lpString=".rar") returned 4
	[0071.508] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.508] lstrlenW (lpString=".bz2") returned 4
	[0071.508] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.508] lstrlenW (lpString=".7z") returned 3
	[0071.508] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.508] lstrlenW (lpString=".dbf") returned 4
	[0071.508] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.508] lstrlenW (lpString=".1cd") returned 4
	[0071.508] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.508] lstrlenW (lpString=".jpg") returned 4
	[0071.508] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.508] lstrlenW (lpString=".doc") returned 4
	[0071.508] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.508] lstrlenW (lpString=".docx") returned 5
	[0071.508] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.508] lstrlenW (lpString=".pdf") returned 4
	[0071.509] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.509] lstrlenW (lpString=".xls") returned 4
	[0071.509] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.509] lstrlenW (lpString=".xlsx") returned 5
	[0071.509] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.509] lstrlenW (lpString=".ppt") returned 4
	[0071.509] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.509] lstrlenW (lpString=".zip") returned 4
	[0071.509] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.509] lstrlenW (lpString=".rar") returned 4
	[0071.509] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.509] lstrlenW (lpString=".bz2") returned 4
	[0071.509] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.509] lstrlenW (lpString=".7z") returned 3
	[0071.509] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.510] lstrlenW (lpString=".dbf") returned 4
	[0071.510] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.510] lstrlenW (lpString=".1cd") returned 4
	[0071.510] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0071.510] lstrlenW (lpString=".jpg") returned 4
	[0071.510] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.510] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.510] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50
	[0071.510] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.668] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0071.668] CloseHandle (hObject=0x368) returned 1
	[0071.668] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20
	[0071.668] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.668] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.668] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.668] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.668] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0071.668] GetLastError () returned 0x0
	[0071.668] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.671] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.673] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.673] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x138, lpOverlapped=0x0) returned 1
	[0071.673] SetEndOfFile (hFile=0x34c) returned 1
	[0071.673] CloseHandle (hObject=0x34c) returned 1
	[0071.676] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.676] SetEndOfFile (hFile=0x368) returned 1
	[0071.677] CloseHandle (hObject=0x368) returned 1
	[0071.677] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.677] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1
	[0071.677] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.678] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.678] lstrlenW (lpString=".doc") returned 4
	[0071.678] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.678] lstrlenW (lpString=".docx") returned 5
	[0071.678] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.678] lstrlenW (lpString=".pdf") returned 4
	[0071.678] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.678] lstrlenW (lpString=".xls") returned 4
	[0071.678] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.678] lstrlenW (lpString=".xlsx") returned 5
	[0071.678] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.678] lstrlenW (lpString=".ppt") returned 4
	[0071.678] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.678] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.678] lstrlenW (lpString=".zip") returned 4
	[0071.678] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.678] lstrlenW (lpString=".rar") returned 4
	[0071.678] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.678] lstrlenW (lpString=".bz2") returned 4
	[0071.678] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.678] lstrlenW (lpString=".7z") returned 3
	[0071.678] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.678] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.678] lstrlenW (lpString=".dbf") returned 4
	[0071.678] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.679] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.679] lstrlenW (lpString=".1cd") returned 4
	[0071.679] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.679] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.679] lstrlenW (lpString=".jpg") returned 4
	[0071.679] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.679] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.679] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.679] lstrlenW (lpString=".doc") returned 4
	[0071.679] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.679] lstrlenW (lpString=".docx") returned 5
	[0071.679] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.679] lstrlenW (lpString=".pdf") returned 4
	[0071.679] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.679] lstrlenW (lpString=".xls") returned 4
	[0071.679] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.679] lstrlenW (lpString=".xlsx") returned 5
	[0071.679] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.679] lstrlenW (lpString=".ppt") returned 4
	[0071.679] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.680] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.680] lstrlenW (lpString=".zip") returned 4
	[0071.680] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.680] lstrlenW (lpString=".rar") returned 4
	[0071.680] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.680] lstrlenW (lpString=".bz2") returned 4
	[0071.680] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.680] lstrlenW (lpString=".7z") returned 3
	[0071.680] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.680] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.680] lstrlenW (lpString=".dbf") returned 4
	[0071.680] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.680] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.680] lstrlenW (lpString=".1cd") returned 4
	[0071.680] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.680] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0071.680] lstrlenW (lpString=".jpg") returned 4
	[0071.680] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.681] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.681] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40
	[0071.681] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.681] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0071.681] CloseHandle (hObject=0x368) returned 1
	[0071.681] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20
	[0071.682] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.682] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.682] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.682] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.682] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0071.682] GetLastError () returned 0x0
	[0071.682] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.685] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.687] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.687] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x124, lpOverlapped=0x0) returned 1
	[0071.687] SetEndOfFile (hFile=0x34c) returned 1
	[0071.687] CloseHandle (hObject=0x34c) returned 1
	[0071.689] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.689] SetEndOfFile (hFile=0x368) returned 1
	[0071.690] CloseHandle (hObject=0x368) returned 1
	[0071.690] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.691] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1
	[0071.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.691] lstrlenW (lpString=".doc") returned 4
	[0071.691] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.691] lstrlenW (lpString=".docx") returned 5
	[0071.691] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.691] lstrlenW (lpString=".pdf") returned 4
	[0071.691] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.691] lstrlenW (lpString=".xls") returned 4
	[0071.691] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.691] lstrlenW (lpString=".xlsx") returned 5
	[0071.691] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.691] lstrlenW (lpString=".ppt") returned 4
	[0071.691] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.691] lstrlenW (lpString=".zip") returned 4
	[0071.691] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.691] lstrlenW (lpString=".rar") returned 4
	[0071.692] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.692] lstrlenW (lpString=".bz2") returned 4
	[0071.692] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.692] lstrlenW (lpString=".7z") returned 3
	[0071.692] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.692] lstrlenW (lpString=".dbf") returned 4
	[0071.692] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.692] lstrlenW (lpString=".1cd") returned 4
	[0071.692] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.692] lstrlenW (lpString=".jpg") returned 4
	[0071.692] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.692] lstrlenW (lpString=".doc") returned 4
	[0071.692] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.692] lstrlenW (lpString=".docx") returned 5
	[0071.693] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.693] lstrlenW (lpString=".pdf") returned 4
	[0071.693] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.693] lstrlenW (lpString=".xls") returned 4
	[0071.693] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.693] lstrlenW (lpString=".xlsx") returned 5
	[0071.693] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.693] lstrlenW (lpString=".ppt") returned 4
	[0071.693] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.693] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.693] lstrlenW (lpString=".zip") returned 4
	[0071.693] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.693] lstrlenW (lpString=".rar") returned 4
	[0071.693] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.693] lstrlenW (lpString=".bz2") returned 4
	[0071.693] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.693] lstrlenW (lpString=".7z") returned 3
	[0071.693] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.693] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.693] lstrlenW (lpString=".dbf") returned 4
	[0071.693] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.693] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.693] lstrlenW (lpString=".1cd") returned 4
	[0071.693] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.694] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0071.694] lstrlenW (lpString=".jpg") returned 4
	[0071.694] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.694] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.694] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32
	[0071.694] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.694] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0071.694] CloseHandle (hObject=0x368) returned 1
	[0071.694] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20
	[0071.694] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.695] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.695] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.695] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.695] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0071.695] GetLastError () returned 0x0
	[0071.695] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.698] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.700] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.700] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x114, lpOverlapped=0x0) returned 1
	[0071.700] SetEndOfFile (hFile=0x34c) returned 1
	[0071.700] CloseHandle (hObject=0x34c) returned 1
	[0071.702] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.702] SetEndOfFile (hFile=0x368) returned 1
	[0071.703] CloseHandle (hObject=0x368) returned 1
	[0071.703] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.704] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1
	[0071.704] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.704] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.704] lstrlenW (lpString=".doc") returned 4
	[0071.704] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.704] lstrlenW (lpString=".docx") returned 5
	[0071.704] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.704] lstrlenW (lpString=".pdf") returned 4
	[0071.704] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.704] lstrlenW (lpString=".xls") returned 4
	[0071.704] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.704] lstrlenW (lpString=".xlsx") returned 5
	[0071.704] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.704] lstrlenW (lpString=".ppt") returned 4
	[0071.704] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.704] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.704] lstrlenW (lpString=".zip") returned 4
	[0071.704] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.704] lstrlenW (lpString=".rar") returned 4
	[0071.704] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.705] lstrlenW (lpString=".bz2") returned 4
	[0071.705] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.705] lstrlenW (lpString=".7z") returned 3
	[0071.705] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.705] lstrlenW (lpString=".dbf") returned 4
	[0071.705] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.705] lstrlenW (lpString=".1cd") returned 4
	[0071.705] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.705] lstrlenW (lpString=".jpg") returned 4
	[0071.705] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.705] lstrlenW (lpString=".doc") returned 4
	[0071.705] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.705] lstrlenW (lpString=".docx") returned 5
	[0071.705] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.705] lstrlenW (lpString=".pdf") returned 4
	[0071.705] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.705] lstrlenW (lpString=".xls") returned 4
	[0071.705] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.705] lstrlenW (lpString=".xlsx") returned 5
	[0071.705] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.705] lstrlenW (lpString=".ppt") returned 4
	[0071.705] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.706] lstrlenW (lpString=".zip") returned 4
	[0071.706] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.706] lstrlenW (lpString=".rar") returned 4
	[0071.706] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.706] lstrlenW (lpString=".bz2") returned 4
	[0071.706] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.706] lstrlenW (lpString=".7z") returned 3
	[0071.706] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.706] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.706] lstrlenW (lpString=".dbf") returned 4
	[0071.706] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.706] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.706] lstrlenW (lpString=".1cd") returned 4
	[0071.706] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.706] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0071.706] lstrlenW (lpString=".jpg") returned 4
	[0071.706] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.706] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.706] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74
	[0071.706] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.734] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0071.735] CloseHandle (hObject=0x368) returned 1
	[0071.739] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20
	[0071.739] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.739] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.739] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.739] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.739] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0071.740] GetLastError () returned 0x0
	[0071.740] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.742] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.744] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.744] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x168, lpOverlapped=0x0) returned 1
	[0071.744] SetEndOfFile (hFile=0x34c) returned 1
	[0071.744] CloseHandle (hObject=0x34c) returned 1
	[0071.746] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.746] SetEndOfFile (hFile=0x368) returned 1
	[0071.748] CloseHandle (hObject=0x368) returned 1
	[0071.748] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0071.748] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1
	[0071.748] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.748] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.748] lstrlenW (lpString=".doc") returned 4
	[0071.748] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.748] lstrlenW (lpString=".docx") returned 5
	[0071.748] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.748] lstrlenW (lpString=".pdf") returned 4
	[0071.748] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.748] lstrlenW (lpString=".xls") returned 4
	[0071.749] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.749] lstrlenW (lpString=".xlsx") returned 5
	[0071.749] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.749] lstrlenW (lpString=".ppt") returned 4
	[0071.749] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.749] lstrlenW (lpString=".zip") returned 4
	[0071.749] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.749] lstrlenW (lpString=".rar") returned 4
	[0071.749] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.749] lstrlenW (lpString=".bz2") returned 4
	[0071.749] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.749] lstrlenW (lpString=".7z") returned 3
	[0071.749] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.749] lstrlenW (lpString=".dbf") returned 4
	[0071.749] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.749] lstrlenW (lpString=".1cd") returned 4
	[0071.749] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.749] lstrlenW (lpString=".jpg") returned 4
	[0071.749] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.749] lstrlenW (lpString=".doc") returned 4
	[0071.749] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.750] lstrlenW (lpString=".docx") returned 5
	[0071.750] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.750] lstrlenW (lpString=".pdf") returned 4
	[0071.750] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.750] lstrlenW (lpString=".xls") returned 4
	[0071.750] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.750] lstrlenW (lpString=".xlsx") returned 5
	[0071.750] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.750] lstrlenW (lpString=".ppt") returned 4
	[0071.750] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.750] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.750] lstrlenW (lpString=".zip") returned 4
	[0071.750] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.750] lstrlenW (lpString=".rar") returned 4
	[0071.750] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.750] lstrlenW (lpString=".bz2") returned 4
	[0071.750] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.750] lstrlenW (lpString=".7z") returned 3
	[0071.750] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.750] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.750] lstrlenW (lpString=".dbf") returned 4
	[0071.750] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.750] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.750] lstrlenW (lpString=".1cd") returned 4
	[0071.750] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.750] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0071.750] lstrlenW (lpString=".jpg") returned 4
	[0071.750] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.751] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0071.751] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41
	[0071.751] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.752] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=1052672) returned 1
	[0071.752] CloseHandle (hObject=0x368) returned 1
	[0071.752] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20
	[0071.752] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0071.752] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0071.752] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.752] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.752] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0071.752] GetLastError () returned 0x0
	[0071.752] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0071.774] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0072.348] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0072.357] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0072.360] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.360] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x126, lpOverlapped=0x0) returned 1
	[0072.360] SetEndOfFile (hFile=0x34c) returned 1
	[0072.361] CloseHandle (hObject=0x34c) returned 1
	[0072.758] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.758] SetEndOfFile (hFile=0x368) returned 1
	[0072.759] CloseHandle (hObject=0x368) returned 1
	[0072.759] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.760] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1
	[0072.760] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.760] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.760] lstrlenW (lpString=".doc") returned 4
	[0072.760] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.760] lstrlenW (lpString=".docx") returned 5
	[0072.760] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.760] lstrlenW (lpString=".pdf") returned 4
	[0072.760] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.760] lstrlenW (lpString=".xls") returned 4
	[0072.760] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.760] lstrlenW (lpString=".xlsx") returned 5
	[0072.760] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.760] lstrlenW (lpString=".ppt") returned 4
	[0072.760] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.760] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.760] lstrlenW (lpString=".zip") returned 4
	[0072.760] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.760] lstrlenW (lpString=".rar") returned 4
	[0072.761] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.761] lstrlenW (lpString=".bz2") returned 4
	[0072.761] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.761] lstrlenW (lpString=".7z") returned 3
	[0072.761] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.761] lstrlenW (lpString=".dbf") returned 4
	[0072.761] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.761] lstrlenW (lpString=".1cd") returned 4
	[0072.761] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.761] lstrlenW (lpString=".jpg") returned 4
	[0072.761] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.761] lstrlenW (lpString=".doc") returned 4
	[0072.761] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.761] lstrlenW (lpString=".docx") returned 5
	[0072.761] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.761] lstrlenW (lpString=".pdf") returned 4
	[0072.761] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.761] lstrlenW (lpString=".xls") returned 4
	[0072.761] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.761] lstrlenW (lpString=".xlsx") returned 5
	[0072.761] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.761] lstrlenW (lpString=".ppt") returned 4
	[0072.762] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.762] lstrlenW (lpString=".zip") returned 4
	[0072.762] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.762] lstrlenW (lpString=".rar") returned 4
	[0072.762] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.762] lstrlenW (lpString=".bz2") returned 4
	[0072.762] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.762] lstrlenW (lpString=".7z") returned 3
	[0072.762] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.762] lstrlenW (lpString=".dbf") returned 4
	[0072.762] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.762] lstrlenW (lpString=".1cd") returned 4
	[0072.762] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0072.762] lstrlenW (lpString=".jpg") returned 4
	[0072.762] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.762] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.762] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76
	[0072.762] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0072.763] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0072.763] CloseHandle (hObject=0x368) returned 1
	[0072.764] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20
	[0072.764] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.764] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0072.764] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.764] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.764] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0072.764] GetLastError () returned 0x0
	[0072.764] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.767] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.768] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.768] WriteFile (in: hFile=0x34c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x16c, lpOverlapped=0x0) returned 1
	[0072.768] SetEndOfFile (hFile=0x34c) returned 1
	[0072.769] CloseHandle (hObject=0x34c) returned 1
	[0072.774] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.775] SetEndOfFile (hFile=0x368) returned 1
	[0072.776] CloseHandle (hObject=0x368) returned 1
	[0072.776] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0072.776] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1
	[0072.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.776] lstrlenW (lpString=".doc") returned 4
	[0072.776] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.776] lstrlenW (lpString=".docx") returned 5
	[0072.776] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.777] lstrlenW (lpString=".pdf") returned 4
	[0072.777] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.777] lstrlenW (lpString=".xls") returned 4
	[0072.777] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.777] lstrlenW (lpString=".xlsx") returned 5
	[0072.777] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.777] lstrlenW (lpString=".ppt") returned 4
	[0072.777] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.777] lstrlenW (lpString=".zip") returned 4
	[0072.777] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.777] lstrlenW (lpString=".rar") returned 4
	[0072.777] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.777] lstrlenW (lpString=".bz2") returned 4
	[0072.777] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.777] lstrlenW (lpString=".7z") returned 3
	[0072.777] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.777] lstrlenW (lpString=".dbf") returned 4
	[0072.777] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.777] lstrlenW (lpString=".1cd") returned 4
	[0072.777] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.777] lstrlenW (lpString=".jpg") returned 4
	[0072.778] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.778] lstrlenW (lpString=".doc") returned 4
	[0072.778] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.778] lstrlenW (lpString=".docx") returned 5
	[0072.778] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.778] lstrlenW (lpString=".pdf") returned 4
	[0072.778] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.778] lstrlenW (lpString=".xls") returned 4
	[0072.778] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.778] lstrlenW (lpString=".xlsx") returned 5
	[0072.778] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.778] lstrlenW (lpString=".ppt") returned 4
	[0072.778] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.778] lstrlenW (lpString=".zip") returned 4
	[0072.778] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.778] lstrlenW (lpString=".rar") returned 4
	[0072.778] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.778] lstrlenW (lpString=".bz2") returned 4
	[0072.778] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.778] lstrlenW (lpString=".7z") returned 3
	[0072.778] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.779] lstrlenW (lpString=".dbf") returned 4
	[0072.779] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.779] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.779] lstrlenW (lpString=".1cd") returned 4
	[0072.779] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.779] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0072.779] lstrlenW (lpString=".jpg") returned 4
	[0072.779] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.779] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0072.779] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42
	[0072.779] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0072.779] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0072.779] CloseHandle (hObject=0x368) returned 1
	[0072.779] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20
	[0072.779] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0072.780] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0072.780] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.780] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.780] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0073.260] GetLastError () returned 0x0
	[0073.260] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.262] WriteFile (in: hFile=0x380, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.264] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.264] WriteFile (in: hFile=0x380, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x128, lpOverlapped=0x0) returned 1
	[0073.264] SetEndOfFile (hFile=0x380) returned 1
	[0073.269] CloseHandle (hObject=0x380) returned 1
	[0073.271] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.272] SetEndOfFile (hFile=0x368) returned 1
	[0073.273] CloseHandle (hObject=0x368) returned 1
	[0073.273] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0073.273] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1
	[0073.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.274] lstrlenW (lpString=".doc") returned 4
	[0073.274] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.274] lstrlenW (lpString=".docx") returned 5
	[0073.274] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.274] lstrlenW (lpString=".pdf") returned 4
	[0073.274] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.274] lstrlenW (lpString=".xls") returned 4
	[0073.274] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.274] lstrlenW (lpString=".xlsx") returned 5
	[0073.274] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.274] lstrlenW (lpString=".ppt") returned 4
	[0073.274] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.274] lstrlenW (lpString=".zip") returned 4
	[0073.274] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.274] lstrlenW (lpString=".rar") returned 4
	[0073.274] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.274] lstrlenW (lpString=".bz2") returned 4
	[0073.274] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.274] lstrlenW (lpString=".7z") returned 3
	[0073.274] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.274] lstrlenW (lpString=".dbf") returned 4
	[0073.274] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.275] lstrlenW (lpString=".1cd") returned 4
	[0073.275] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.275] lstrlenW (lpString=".jpg") returned 4
	[0073.275] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.275] lstrlenW (lpString=".doc") returned 4
	[0073.275] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.275] lstrlenW (lpString=".docx") returned 5
	[0073.275] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.275] lstrlenW (lpString=".pdf") returned 4
	[0073.275] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.275] lstrlenW (lpString=".xls") returned 4
	[0073.275] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.275] lstrlenW (lpString=".xlsx") returned 5
	[0073.275] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.275] lstrlenW (lpString=".ppt") returned 4
	[0073.275] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.275] lstrlenW (lpString=".zip") returned 4
	[0073.275] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.275] lstrlenW (lpString=".rar") returned 4
	[0073.275] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.275] lstrlenW (lpString=".bz2") returned 4
	[0073.275] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.275] lstrlenW (lpString=".7z") returned 3
	[0073.275] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.276] lstrlenW (lpString=".dbf") returned 4
	[0073.276] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.276] lstrlenW (lpString=".1cd") returned 4
	[0073.276] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0073.276] lstrlenW (lpString=".jpg") returned 4
	[0073.276] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.276] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0073.276] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44
	[0073.276] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0073.276] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0073.277] CloseHandle (hObject=0x368) returned 1
	[0073.277] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20
	[0073.277] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.277] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0073.277] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.277] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.277] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0073.277] GetLastError () returned 0x0
	[0073.277] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.280] WriteFile (in: hFile=0x380, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.282] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.282] WriteFile (in: hFile=0x380, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x12c, lpOverlapped=0x0) returned 1
	[0073.282] SetEndOfFile (hFile=0x380) returned 1
	[0073.282] CloseHandle (hObject=0x380) returned 1
	[0073.284] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.284] SetEndOfFile (hFile=0x368) returned 1
	[0073.285] CloseHandle (hObject=0x368) returned 1
	[0073.289] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0073.289] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1
	[0073.289] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.290] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.290] lstrlenW (lpString=".doc") returned 4
	[0073.290] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.290] lstrlenW (lpString=".docx") returned 5
	[0073.290] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.290] lstrlenW (lpString=".pdf") returned 4
	[0073.290] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.290] lstrlenW (lpString=".xls") returned 4
	[0073.290] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.290] lstrlenW (lpString=".xlsx") returned 5
	[0073.290] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.290] lstrlenW (lpString=".ppt") returned 4
	[0073.290] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.290] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.290] lstrlenW (lpString=".zip") returned 4
	[0073.290] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.290] lstrlenW (lpString=".rar") returned 4
	[0073.290] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.290] lstrlenW (lpString=".bz2") returned 4
	[0073.290] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.291] lstrlenW (lpString=".7z") returned 3
	[0073.291] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.291] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.291] lstrlenW (lpString=".dbf") returned 4
	[0073.291] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.291] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.291] lstrlenW (lpString=".1cd") returned 4
	[0073.291] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.291] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.291] lstrlenW (lpString=".jpg") returned 4
	[0073.291] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.291] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.291] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.291] lstrlenW (lpString=".doc") returned 4
	[0073.291] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.291] lstrlenW (lpString=".docx") returned 5
	[0073.291] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.291] lstrlenW (lpString=".pdf") returned 4
	[0073.291] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.292] lstrlenW (lpString=".xls") returned 4
	[0073.292] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.292] lstrlenW (lpString=".xlsx") returned 5
	[0073.292] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.292] lstrlenW (lpString=".ppt") returned 4
	[0073.292] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.292] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.292] lstrlenW (lpString=".zip") returned 4
	[0073.292] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.292] lstrlenW (lpString=".rar") returned 4
	[0073.292] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.292] lstrlenW (lpString=".bz2") returned 4
	[0073.292] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.292] lstrlenW (lpString=".7z") returned 3
	[0073.292] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.292] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.292] lstrlenW (lpString=".dbf") returned 4
	[0073.292] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.293] lstrlenW (lpString=".1cd") returned 4
	[0073.293] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0073.293] lstrlenW (lpString=".jpg") returned 4
	[0073.293] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.293] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0073.293] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45
	[0073.293] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0073.294] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69632) returned 1
	[0073.294] CloseHandle (hObject=0x368) returned 1
	[0073.294] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20
	[0073.294] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0073.294] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0073.294] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.294] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.294] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0073.295] GetLastError () returned 0x0
	[0073.295] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.297] WriteFile (in: hFile=0x380, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.299] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.299] WriteFile (in: hFile=0x380, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0073.299] SetEndOfFile (hFile=0x380) returned 1
	[0073.300] CloseHandle (hObject=0x380) returned 1
	[0073.964] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.964] SetEndOfFile (hFile=0x368) returned 1
	[0074.003] CloseHandle (hObject=0x368) returned 1
	[0074.003] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0074.003] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1
	[0074.004] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.004] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.004] lstrlenW (lpString=".doc") returned 4
	[0074.004] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.004] lstrlenW (lpString=".docx") returned 5
	[0074.004] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.004] lstrlenW (lpString=".pdf") returned 4
	[0074.004] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.004] lstrlenW (lpString=".xls") returned 4
	[0074.004] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.004] lstrlenW (lpString=".xlsx") returned 5
	[0074.004] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.004] lstrlenW (lpString=".ppt") returned 4
	[0074.004] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.004] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.004] lstrlenW (lpString=".zip") returned 4
	[0074.004] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.004] lstrlenW (lpString=".rar") returned 4
	[0074.004] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.004] lstrlenW (lpString=".bz2") returned 4
	[0074.005] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.005] lstrlenW (lpString=".7z") returned 3
	[0074.005] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.005] lstrlenW (lpString=".dbf") returned 4
	[0074.005] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.005] lstrlenW (lpString=".1cd") returned 4
	[0074.005] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.005] lstrlenW (lpString=".jpg") returned 4
	[0074.005] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.005] lstrlenW (lpString=".doc") returned 4
	[0074.005] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.005] lstrlenW (lpString=".docx") returned 5
	[0074.005] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.005] lstrlenW (lpString=".pdf") returned 4
	[0074.005] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.005] lstrlenW (lpString=".xls") returned 4
	[0074.005] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.005] lstrlenW (lpString=".xlsx") returned 5
	[0074.005] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.005] lstrlenW (lpString=".ppt") returned 4
	[0074.005] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.006] lstrlenW (lpString=".zip") returned 4
	[0074.006] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.006] lstrlenW (lpString=".rar") returned 4
	[0074.006] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.006] lstrlenW (lpString=".bz2") returned 4
	[0074.006] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.006] lstrlenW (lpString=".7z") returned 3
	[0074.006] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.006] lstrlenW (lpString=".dbf") returned 4
	[0074.006] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.006] lstrlenW (lpString=".1cd") returned 4
	[0074.006] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0074.006] lstrlenW (lpString=".jpg") returned 4
	[0074.006] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.006] lstrcmpiW (lpString1=".evtx", lpString2=".money") returned -1
	[0074.006] lstrlenW (lpString="Security.evtx") returned 13
	[0074.006] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0074.007] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=1118208) returned 1
	[0074.007] CloseHandle (hObject=0x368) returned 1
	[0074.007] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20
	[0074.007] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\security.evtx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.007] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0074.007] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.007] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.007] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\logs\\security.evtx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0074.007] GetLastError () returned 0x0
	[0074.007] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0074.030] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0074.503] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x11010, lpOverlapped=0x0) returned 1
	[0074.514] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11020, lpOverlapped=0x0) returned 1
	[0074.519] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.519] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xee, lpOverlapped=0x0) returned 1
	[0074.520] SetEndOfFile (hFile=0x370) returned 1
	[0074.520] CloseHandle (hObject=0x370) returned 1
	[0074.950] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.950] SetEndOfFile (hFile=0x368) returned 1
	[0074.954] CloseHandle (hObject=0x368) returned 1
	[0074.954] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0074.954] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1
	[0074.954] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.954] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.954] lstrlenW (lpString=".doc") returned 4
	[0074.955] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.955] lstrlenW (lpString=".docx") returned 5
	[0074.955] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.955] lstrlenW (lpString=".pdf") returned 4
	[0074.955] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.955] lstrlenW (lpString=".xls") returned 4
	[0074.955] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.955] lstrlenW (lpString=".xlsx") returned 5
	[0074.955] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.955] lstrlenW (lpString=".ppt") returned 4
	[0074.955] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.955] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.955] lstrlenW (lpString=".zip") returned 4
	[0074.955] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.955] lstrlenW (lpString=".rar") returned 4
	[0074.955] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.955] lstrlenW (lpString=".bz2") returned 4
	[0074.955] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.955] lstrlenW (lpString=".7z") returned 3
	[0074.955] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.955] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.955] lstrlenW (lpString=".dbf") returned 4
	[0074.955] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.955] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.956] lstrlenW (lpString=".1cd") returned 4
	[0074.956] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.956] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.956] lstrlenW (lpString=".jpg") returned 4
	[0074.956] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.956] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.956] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.956] lstrlenW (lpString=".doc") returned 4
	[0074.956] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.956] lstrlenW (lpString=".docx") returned 5
	[0074.956] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.956] lstrlenW (lpString=".pdf") returned 4
	[0074.956] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.956] lstrlenW (lpString=".xls") returned 4
	[0074.956] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.956] lstrlenW (lpString=".xlsx") returned 5
	[0074.956] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.956] lstrlenW (lpString=".ppt") returned 4
	[0074.956] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.956] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.956] lstrlenW (lpString=".zip") returned 4
	[0074.956] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.956] lstrlenW (lpString=".rar") returned 4
	[0074.957] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.957] lstrlenW (lpString=".bz2") returned 4
	[0074.957] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.957] lstrlenW (lpString=".7z") returned 3
	[0074.957] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.957] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.957] lstrlenW (lpString=".dbf") returned 4
	[0074.957] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.957] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.957] lstrlenW (lpString=".1cd") returned 4
	[0074.957] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.958] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0074.958] lstrlenW (lpString=".jpg") returned 4
	[0074.958] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.958] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0074.958] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31
	[0074.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0074.959] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=18624) returned 1
	[0074.959] CloseHandle (hObject=0x368) returned 1
	[0074.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20
	[0074.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0074.960] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.960] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0074.961] GetLastError () returned 0x0
	[0074.961] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0074.963] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0074.964] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.964] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x112, lpOverlapped=0x0) returned 1
	[0074.965] SetEndOfFile (hFile=0x370) returned 1
	[0074.965] CloseHandle (hObject=0x370) returned 1
	[0074.966] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.966] SetEndOfFile (hFile=0x368) returned 1
	[0074.967] CloseHandle (hObject=0x368) returned 1
	[0074.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0074.967] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1
	[0074.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.968] lstrlenW (lpString=".doc") returned 4
	[0074.968] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0074.968] lstrlenW (lpString=".docx") returned 5
	[0074.968] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0074.968] lstrlenW (lpString=".pdf") returned 4
	[0074.968] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0074.968] lstrlenW (lpString=".xls") returned 4
	[0074.968] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0074.968] lstrlenW (lpString=".xlsx") returned 5
	[0074.968] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0074.968] lstrlenW (lpString=".ppt") returned 4
	[0074.968] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0074.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.968] lstrlenW (lpString=".zip") returned 4
	[0074.968] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0074.968] lstrlenW (lpString=".rar") returned 4
	[0074.968] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0074.969] lstrlenW (lpString=".bz2") returned 4
	[0074.969] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0074.969] lstrlenW (lpString=".7z") returned 3
	[0074.969] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0074.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.969] lstrlenW (lpString=".dbf") returned 4
	[0074.969] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0074.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.969] lstrlenW (lpString=".1cd") returned 4
	[0074.969] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0074.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.969] lstrlenW (lpString=".jpg") returned 4
	[0074.969] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0074.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.969] lstrlenW (lpString=".doc") returned 4
	[0074.969] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0074.969] lstrlenW (lpString=".docx") returned 5
	[0074.969] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0074.969] lstrlenW (lpString=".pdf") returned 4
	[0074.969] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0074.969] lstrlenW (lpString=".xls") returned 4
	[0074.969] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0074.969] lstrlenW (lpString=".xlsx") returned 5
	[0074.970] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0074.970] lstrlenW (lpString=".ppt") returned 4
	[0074.970] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0074.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.970] lstrlenW (lpString=".zip") returned 4
	[0074.970] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0074.970] lstrlenW (lpString=".rar") returned 4
	[0074.970] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0074.970] lstrlenW (lpString=".bz2") returned 4
	[0074.970] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0074.970] lstrlenW (lpString=".7z") returned 3
	[0074.970] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0074.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.970] lstrlenW (lpString=".dbf") returned 4
	[0074.970] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0074.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.970] lstrlenW (lpString=".1cd") returned 4
	[0074.970] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0074.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0074.970] lstrlenW (lpString=".jpg") returned 4
	[0074.970] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0074.971] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0074.971] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31
	[0074.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0074.972] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=18624) returned 1
	[0074.972] CloseHandle (hObject=0x368) returned 1
	[0074.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20
	[0074.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0074.972] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.972] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0074.973] GetLastError () returned 0x0
	[0074.973] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0074.974] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0074.975] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.975] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x112, lpOverlapped=0x0) returned 1
	[0074.975] SetEndOfFile (hFile=0x370) returned 1
	[0074.976] CloseHandle (hObject=0x370) returned 1
	[0074.977] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.977] SetEndOfFile (hFile=0x368) returned 1
	[0074.978] CloseHandle (hObject=0x368) returned 1
	[0074.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0074.978] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1
	[0074.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.979] lstrlenW (lpString=".doc") returned 4
	[0074.979] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0074.979] lstrlenW (lpString=".docx") returned 5
	[0074.979] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0074.979] lstrlenW (lpString=".pdf") returned 4
	[0074.979] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0074.979] lstrlenW (lpString=".xls") returned 4
	[0074.979] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0074.979] lstrlenW (lpString=".xlsx") returned 5
	[0074.979] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0074.979] lstrlenW (lpString=".ppt") returned 4
	[0074.979] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0074.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.979] lstrlenW (lpString=".zip") returned 4
	[0074.979] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0074.979] lstrlenW (lpString=".rar") returned 4
	[0074.979] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0074.979] lstrlenW (lpString=".bz2") returned 4
	[0074.979] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0074.979] lstrlenW (lpString=".7z") returned 3
	[0074.979] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0074.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.979] lstrlenW (lpString=".dbf") returned 4
	[0074.979] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0074.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.979] lstrlenW (lpString=".1cd") returned 4
	[0074.979] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0074.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.979] lstrlenW (lpString=".jpg") returned 4
	[0074.979] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0074.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.980] lstrlenW (lpString=".doc") returned 4
	[0074.980] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0074.980] lstrlenW (lpString=".docx") returned 5
	[0074.980] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0074.980] lstrlenW (lpString=".pdf") returned 4
	[0074.980] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0074.980] lstrlenW (lpString=".xls") returned 4
	[0074.980] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0074.980] lstrlenW (lpString=".xlsx") returned 5
	[0074.980] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0074.980] lstrlenW (lpString=".ppt") returned 4
	[0074.980] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0074.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.980] lstrlenW (lpString=".zip") returned 4
	[0074.980] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0074.980] lstrlenW (lpString=".rar") returned 4
	[0074.980] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0074.980] lstrlenW (lpString=".bz2") returned 4
	[0074.980] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0074.980] lstrlenW (lpString=".7z") returned 3
	[0074.980] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0074.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.980] lstrlenW (lpString=".dbf") returned 4
	[0074.980] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0074.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.981] lstrlenW (lpString=".1cd") returned 4
	[0074.981] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0074.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0074.981] lstrlenW (lpString=".jpg") returned 4
	[0074.981] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0074.981] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0074.981] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39
	[0074.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0074.981] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=21184) returned 1
	[0074.981] CloseHandle (hObject=0x368) returned 1
	[0074.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20
	[0074.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0074.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0074.982] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.982] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0074.982] GetLastError () returned 0x0
	[0074.982] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x52c0, lpOverlapped=0x0) returned 1
	[0075.238] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x52d0, lpOverlapped=0x0) returned 1
	[0075.240] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.240] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x122, lpOverlapped=0x0) returned 1
	[0075.240] SetEndOfFile (hFile=0x370) returned 1
	[0075.553] CloseHandle (hObject=0x370) returned 1
	[0075.554] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.554] SetEndOfFile (hFile=0x368) returned 1
	[0075.555] CloseHandle (hObject=0x368) returned 1
	[0075.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.555] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1
	[0075.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.556] lstrlenW (lpString=".doc") returned 4
	[0075.556] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.556] lstrlenW (lpString=".docx") returned 5
	[0075.556] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.556] lstrlenW (lpString=".pdf") returned 4
	[0075.556] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.556] lstrlenW (lpString=".xls") returned 4
	[0075.556] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.556] lstrlenW (lpString=".xlsx") returned 5
	[0075.556] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.556] lstrlenW (lpString=".ppt") returned 4
	[0075.556] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.556] lstrlenW (lpString=".zip") returned 4
	[0075.556] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.556] lstrlenW (lpString=".rar") returned 4
	[0075.556] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.556] lstrlenW (lpString=".bz2") returned 4
	[0075.556] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.557] lstrlenW (lpString=".7z") returned 3
	[0075.557] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.557] lstrlenW (lpString=".dbf") returned 4
	[0075.557] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.557] lstrlenW (lpString=".1cd") returned 4
	[0075.557] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.557] lstrlenW (lpString=".jpg") returned 4
	[0075.557] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.557] lstrlenW (lpString=".doc") returned 4
	[0075.557] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.557] lstrlenW (lpString=".docx") returned 5
	[0075.557] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.557] lstrlenW (lpString=".pdf") returned 4
	[0075.557] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.557] lstrlenW (lpString=".xls") returned 4
	[0075.557] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.557] lstrlenW (lpString=".xlsx") returned 5
	[0075.557] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.557] lstrlenW (lpString=".ppt") returned 4
	[0075.557] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.557] lstrlenW (lpString=".zip") returned 4
	[0075.558] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.558] lstrlenW (lpString=".rar") returned 4
	[0075.558] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.558] lstrlenW (lpString=".bz2") returned 4
	[0075.558] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.558] lstrlenW (lpString=".7z") returned 3
	[0075.558] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.558] lstrlenW (lpString=".dbf") returned 4
	[0075.558] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.558] lstrlenW (lpString=".1cd") returned 4
	[0075.558] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0075.558] lstrlenW (lpString=".jpg") returned 4
	[0075.558] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.558] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.558] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30
	[0075.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.559] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=19648) returned 1
	[0075.559] CloseHandle (hObject=0x368) returned 1
	[0075.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20
	[0075.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.559] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.559] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.560] GetLastError () returned 0x0
	[0075.560] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4cc0, lpOverlapped=0x0) returned 1
	[0075.562] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0075.563] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.563] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x110, lpOverlapped=0x0) returned 1
	[0075.563] SetEndOfFile (hFile=0x370) returned 1
	[0075.563] CloseHandle (hObject=0x370) returned 1
	[0075.564] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.564] SetEndOfFile (hFile=0x368) returned 1
	[0075.565] CloseHandle (hObject=0x368) returned 1
	[0075.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.566] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1
	[0075.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.566] lstrlenW (lpString=".doc") returned 4
	[0075.566] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.566] lstrlenW (lpString=".docx") returned 5
	[0075.566] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.566] lstrlenW (lpString=".pdf") returned 4
	[0075.566] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.566] lstrlenW (lpString=".xls") returned 4
	[0075.566] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.566] lstrlenW (lpString=".xlsx") returned 5
	[0075.567] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.567] lstrlenW (lpString=".ppt") returned 4
	[0075.567] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.567] lstrlenW (lpString=".zip") returned 4
	[0075.567] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.567] lstrlenW (lpString=".rar") returned 4
	[0075.567] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.567] lstrlenW (lpString=".bz2") returned 4
	[0075.567] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.567] lstrlenW (lpString=".7z") returned 3
	[0075.567] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.567] lstrlenW (lpString=".dbf") returned 4
	[0075.567] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.567] lstrlenW (lpString=".1cd") returned 4
	[0075.567] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.567] lstrlenW (lpString=".jpg") returned 4
	[0075.567] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.567] lstrlenW (lpString=".doc") returned 4
	[0075.567] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.567] lstrlenW (lpString=".docx") returned 5
	[0075.567] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.567] lstrlenW (lpString=".pdf") returned 4
	[0075.568] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.568] lstrlenW (lpString=".xls") returned 4
	[0075.568] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.568] lstrlenW (lpString=".xlsx") returned 5
	[0075.568] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.568] lstrlenW (lpString=".ppt") returned 4
	[0075.568] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.568] lstrlenW (lpString=".zip") returned 4
	[0075.568] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.568] lstrlenW (lpString=".rar") returned 4
	[0075.568] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.568] lstrlenW (lpString=".bz2") returned 4
	[0075.568] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.568] lstrlenW (lpString=".7z") returned 3
	[0075.568] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.568] lstrlenW (lpString=".dbf") returned 4
	[0075.568] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.568] lstrlenW (lpString=".1cd") returned 4
	[0075.568] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0075.568] lstrlenW (lpString=".jpg") returned 4
	[0075.568] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.569] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.569] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32
	[0075.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.569] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=19136) returned 1
	[0075.569] CloseHandle (hObject=0x368) returned 1
	[0075.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20
	[0075.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.569] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.569] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.570] GetLastError () returned 0x0
	[0075.570] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0075.572] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0075.573] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.573] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x114, lpOverlapped=0x0) returned 1
	[0075.573] SetEndOfFile (hFile=0x370) returned 1
	[0075.573] CloseHandle (hObject=0x370) returned 1
	[0075.575] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.575] SetEndOfFile (hFile=0x368) returned 1
	[0075.576] CloseHandle (hObject=0x368) returned 1
	[0075.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.576] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1
	[0075.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.576] lstrlenW (lpString=".doc") returned 4
	[0075.576] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.576] lstrlenW (lpString=".docx") returned 5
	[0075.576] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.576] lstrlenW (lpString=".pdf") returned 4
	[0075.576] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.577] lstrlenW (lpString=".xls") returned 4
	[0075.577] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.577] lstrlenW (lpString=".xlsx") returned 5
	[0075.577] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.577] lstrlenW (lpString=".ppt") returned 4
	[0075.577] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.577] lstrlenW (lpString=".zip") returned 4
	[0075.577] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.577] lstrlenW (lpString=".rar") returned 4
	[0075.577] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.577] lstrlenW (lpString=".bz2") returned 4
	[0075.577] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.577] lstrlenW (lpString=".7z") returned 3
	[0075.577] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.577] lstrlenW (lpString=".dbf") returned 4
	[0075.577] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.577] lstrlenW (lpString=".1cd") returned 4
	[0075.577] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.577] lstrlenW (lpString=".jpg") returned 4
	[0075.577] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.577] lstrlenW (lpString=".doc") returned 4
	[0075.577] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.577] lstrlenW (lpString=".docx") returned 5
	[0075.577] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.578] lstrlenW (lpString=".pdf") returned 4
	[0075.578] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.578] lstrlenW (lpString=".xls") returned 4
	[0075.578] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.578] lstrlenW (lpString=".xlsx") returned 5
	[0075.578] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.578] lstrlenW (lpString=".ppt") returned 4
	[0075.578] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.578] lstrlenW (lpString=".zip") returned 4
	[0075.578] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.578] lstrlenW (lpString=".rar") returned 4
	[0075.578] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.578] lstrlenW (lpString=".bz2") returned 4
	[0075.578] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.578] lstrlenW (lpString=".7z") returned 3
	[0075.578] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.578] lstrlenW (lpString=".dbf") returned 4
	[0075.578] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.578] lstrlenW (lpString=".1cd") returned 4
	[0075.578] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0075.578] lstrlenW (lpString=".jpg") returned 4
	[0075.578] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.579] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.579] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30
	[0075.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.579] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=27840) returned 1
	[0075.579] CloseHandle (hObject=0x368) returned 1
	[0075.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20
	[0075.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.580] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.580] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.580] GetLastError () returned 0x0
	[0075.580] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x6cc0, lpOverlapped=0x0) returned 1
	[0075.619] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x6cd0, lpOverlapped=0x0) returned 1
	[0075.620] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.620] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x110, lpOverlapped=0x0) returned 1
	[0075.621] SetEndOfFile (hFile=0x370) returned 1
	[0075.621] CloseHandle (hObject=0x370) returned 1
	[0075.622] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.622] SetEndOfFile (hFile=0x368) returned 1
	[0075.623] CloseHandle (hObject=0x368) returned 1
	[0075.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.624] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1
	[0075.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.624] lstrlenW (lpString=".doc") returned 4
	[0075.624] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.624] lstrlenW (lpString=".docx") returned 5
	[0075.624] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.624] lstrlenW (lpString=".pdf") returned 4
	[0075.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.624] lstrlenW (lpString=".xls") returned 4
	[0075.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.624] lstrlenW (lpString=".xlsx") returned 5
	[0075.624] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.624] lstrlenW (lpString=".ppt") returned 4
	[0075.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.625] lstrlenW (lpString=".zip") returned 4
	[0075.625] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.625] lstrlenW (lpString=".rar") returned 4
	[0075.625] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.625] lstrlenW (lpString=".bz2") returned 4
	[0075.625] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.625] lstrlenW (lpString=".7z") returned 3
	[0075.625] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.625] lstrlenW (lpString=".dbf") returned 4
	[0075.625] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.625] lstrlenW (lpString=".1cd") returned 4
	[0075.625] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.625] lstrlenW (lpString=".jpg") returned 4
	[0075.625] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.625] lstrlenW (lpString=".doc") returned 4
	[0075.625] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.625] lstrlenW (lpString=".docx") returned 5
	[0075.625] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.625] lstrlenW (lpString=".pdf") returned 4
	[0075.625] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.626] lstrlenW (lpString=".xls") returned 4
	[0075.626] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.626] lstrlenW (lpString=".xlsx") returned 5
	[0075.626] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.626] lstrlenW (lpString=".ppt") returned 4
	[0075.626] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.626] lstrlenW (lpString=".zip") returned 4
	[0075.626] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.626] lstrlenW (lpString=".rar") returned 4
	[0075.626] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.626] lstrlenW (lpString=".bz2") returned 4
	[0075.626] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.626] lstrlenW (lpString=".7z") returned 3
	[0075.626] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.626] lstrlenW (lpString=".dbf") returned 4
	[0075.626] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.626] lstrlenW (lpString=".1cd") returned 4
	[0075.626] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0075.626] lstrlenW (lpString=".jpg") returned 4
	[0075.626] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.627] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.627] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35
	[0075.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.627] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=26816) returned 1
	[0075.627] CloseHandle (hObject=0x368) returned 1
	[0075.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20
	[0075.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.627] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.628] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.628] GetLastError () returned 0x0
	[0075.628] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x68c0, lpOverlapped=0x0) returned 1
	[0075.924] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x68d0, lpOverlapped=0x0) returned 1
	[0075.926] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.927] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0075.927] SetEndOfFile (hFile=0x370) returned 1
	[0075.927] CloseHandle (hObject=0x370) returned 1
	[0075.928] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.928] SetEndOfFile (hFile=0x368) returned 1
	[0075.929] CloseHandle (hObject=0x368) returned 1
	[0075.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.929] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1
	[0075.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.930] lstrlenW (lpString=".doc") returned 4
	[0075.930] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.930] lstrlenW (lpString=".docx") returned 5
	[0075.930] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.930] lstrlenW (lpString=".pdf") returned 4
	[0075.930] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.930] lstrlenW (lpString=".xls") returned 4
	[0075.930] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.930] lstrlenW (lpString=".xlsx") returned 5
	[0075.930] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.930] lstrlenW (lpString=".ppt") returned 4
	[0075.930] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.930] lstrlenW (lpString=".zip") returned 4
	[0075.930] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.930] lstrlenW (lpString=".rar") returned 4
	[0075.930] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.930] lstrlenW (lpString=".bz2") returned 4
	[0075.930] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.930] lstrlenW (lpString=".7z") returned 3
	[0075.930] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.930] lstrlenW (lpString=".dbf") returned 4
	[0075.930] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.930] lstrlenW (lpString=".1cd") returned 4
	[0075.931] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.931] lstrlenW (lpString=".jpg") returned 4
	[0075.931] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.931] lstrlenW (lpString=".doc") returned 4
	[0075.931] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.931] lstrlenW (lpString=".docx") returned 5
	[0075.931] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.931] lstrlenW (lpString=".pdf") returned 4
	[0075.931] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.931] lstrlenW (lpString=".xls") returned 4
	[0075.931] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.931] lstrlenW (lpString=".xlsx") returned 5
	[0075.931] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.931] lstrlenW (lpString=".ppt") returned 4
	[0075.931] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.931] lstrlenW (lpString=".zip") returned 4
	[0075.931] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.931] lstrlenW (lpString=".rar") returned 4
	[0075.931] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.931] lstrlenW (lpString=".bz2") returned 4
	[0075.931] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.931] lstrlenW (lpString=".7z") returned 3
	[0075.931] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.931] lstrlenW (lpString=".dbf") returned 4
	[0075.932] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.932] lstrlenW (lpString=".1cd") returned 4
	[0075.932] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0075.932] lstrlenW (lpString=".jpg") returned 4
	[0075.932] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.932] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.932] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30
	[0075.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.932] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=21184) returned 1
	[0075.932] CloseHandle (hObject=0x368) returned 1
	[0075.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20
	[0075.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.933] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.933] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.933] GetLastError () returned 0x0
	[0075.933] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x52c0, lpOverlapped=0x0) returned 1
	[0075.935] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x52d0, lpOverlapped=0x0) returned 1
	[0075.936] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.936] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x110, lpOverlapped=0x0) returned 1
	[0075.936] SetEndOfFile (hFile=0x370) returned 1
	[0075.936] CloseHandle (hObject=0x370) returned 1
	[0075.938] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.938] SetEndOfFile (hFile=0x368) returned 1
	[0075.939] CloseHandle (hObject=0x368) returned 1
	[0075.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.940] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1
	[0075.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.940] lstrlenW (lpString=".doc") returned 4
	[0075.940] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.940] lstrlenW (lpString=".docx") returned 5
	[0075.940] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.940] lstrlenW (lpString=".pdf") returned 4
	[0075.940] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.940] lstrlenW (lpString=".xls") returned 4
	[0075.940] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.940] lstrlenW (lpString=".xlsx") returned 5
	[0075.940] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.940] lstrlenW (lpString=".ppt") returned 4
	[0075.941] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.941] lstrlenW (lpString=".zip") returned 4
	[0075.941] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.941] lstrlenW (lpString=".rar") returned 4
	[0075.941] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.941] lstrlenW (lpString=".bz2") returned 4
	[0075.941] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.941] lstrlenW (lpString=".7z") returned 3
	[0075.941] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.941] lstrlenW (lpString=".dbf") returned 4
	[0075.941] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.941] lstrlenW (lpString=".1cd") returned 4
	[0075.941] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.941] lstrlenW (lpString=".jpg") returned 4
	[0075.941] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.941] lstrlenW (lpString=".doc") returned 4
	[0075.941] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.942] lstrlenW (lpString=".docx") returned 5
	[0075.942] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.942] lstrlenW (lpString=".pdf") returned 4
	[0075.942] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.942] lstrlenW (lpString=".xls") returned 4
	[0075.942] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.942] lstrlenW (lpString=".xlsx") returned 5
	[0075.942] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.942] lstrlenW (lpString=".ppt") returned 4
	[0075.942] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.942] lstrlenW (lpString=".zip") returned 4
	[0075.942] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.942] lstrlenW (lpString=".rar") returned 4
	[0075.942] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.942] lstrlenW (lpString=".bz2") returned 4
	[0075.942] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.942] lstrlenW (lpString=".7z") returned 3
	[0075.942] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.942] lstrlenW (lpString=".dbf") returned 4
	[0075.942] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.942] lstrlenW (lpString=".1cd") returned 4
	[0075.942] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0075.942] lstrlenW (lpString=".jpg") returned 4
	[0075.942] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.943] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.943] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33
	[0075.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.943] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=19136) returned 1
	[0075.943] CloseHandle (hObject=0x368) returned 1
	[0075.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20
	[0075.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.943] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.944] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.944] GetLastError () returned 0x0
	[0075.944] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0075.946] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0075.947] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.947] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x116, lpOverlapped=0x0) returned 1
	[0075.947] SetEndOfFile (hFile=0x370) returned 1
	[0075.947] CloseHandle (hObject=0x370) returned 1
	[0075.948] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.948] SetEndOfFile (hFile=0x368) returned 1
	[0075.949] CloseHandle (hObject=0x368) returned 1
	[0075.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0075.949] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1
	[0075.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.950] lstrlenW (lpString=".doc") returned 4
	[0075.950] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.950] lstrlenW (lpString=".docx") returned 5
	[0075.950] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.950] lstrlenW (lpString=".pdf") returned 4
	[0075.950] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.950] lstrlenW (lpString=".xls") returned 4
	[0075.950] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.950] lstrlenW (lpString=".xlsx") returned 5
	[0075.950] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.950] lstrlenW (lpString=".ppt") returned 4
	[0075.950] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.950] lstrlenW (lpString=".zip") returned 4
	[0075.950] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.950] lstrlenW (lpString=".rar") returned 4
	[0075.950] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.950] lstrlenW (lpString=".bz2") returned 4
	[0075.950] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.950] lstrlenW (lpString=".7z") returned 3
	[0075.950] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.950] lstrlenW (lpString=".dbf") returned 4
	[0075.950] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.950] lstrlenW (lpString=".1cd") returned 4
	[0075.950] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.950] lstrlenW (lpString=".jpg") returned 4
	[0075.950] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.951] lstrlenW (lpString=".doc") returned 4
	[0075.951] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.951] lstrlenW (lpString=".docx") returned 5
	[0075.951] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0075.951] lstrlenW (lpString=".pdf") returned 4
	[0075.951] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.951] lstrlenW (lpString=".xls") returned 4
	[0075.951] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.951] lstrlenW (lpString=".xlsx") returned 5
	[0075.951] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0075.951] lstrlenW (lpString=".ppt") returned 4
	[0075.951] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.951] lstrlenW (lpString=".zip") returned 4
	[0075.951] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.951] lstrlenW (lpString=".rar") returned 4
	[0075.951] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.951] lstrlenW (lpString=".bz2") returned 4
	[0075.951] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.951] lstrlenW (lpString=".7z") returned 3
	[0075.951] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.951] lstrlenW (lpString=".dbf") returned 4
	[0075.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.951] lstrlenW (lpString=".1cd") returned 4
	[0075.951] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0075.951] lstrlenW (lpString=".jpg") returned 4
	[0075.952] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.952] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.952] lstrlenW (lpString="ApiClient.dll") returned 13
	[0075.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.952] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=162880) returned 1
	[0075.952] CloseHandle (hObject=0x368) returned 1
	[0075.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20
	[0075.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0075.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.952] lstrlenW (lpString=".doc") returned 4
	[0075.952] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.952] lstrlenW (lpString=".docx") returned 5
	[0075.953] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0075.953] lstrlenW (lpString=".pdf") returned 4
	[0075.953] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.953] lstrlenW (lpString=".xls") returned 4
	[0075.953] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.953] lstrlenW (lpString=".xlsx") returned 5
	[0075.953] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0075.953] lstrlenW (lpString=".ppt") returned 4
	[0075.953] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.953] lstrlenW (lpString=".zip") returned 4
	[0075.953] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.953] lstrlenW (lpString=".rar") returned 4
	[0075.953] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.953] lstrlenW (lpString=".bz2") returned 4
	[0075.953] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.953] lstrlenW (lpString=".7z") returned 3
	[0075.953] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.953] lstrlenW (lpString=".dbf") returned 4
	[0075.953] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.953] lstrlenW (lpString=".1cd") returned 4
	[0075.953] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.953] lstrlenW (lpString=".jpg") returned 4
	[0075.953] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.954] lstrlenW (lpString=".doc") returned 4
	[0075.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.954] lstrlenW (lpString=".docx") returned 5
	[0075.954] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0075.954] lstrlenW (lpString=".pdf") returned 4
	[0075.954] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.954] lstrlenW (lpString=".xls") returned 4
	[0075.954] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.954] lstrlenW (lpString=".xlsx") returned 5
	[0075.954] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0075.954] lstrlenW (lpString=".ppt") returned 4
	[0075.954] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.954] lstrlenW (lpString=".zip") returned 4
	[0075.954] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.954] lstrlenW (lpString=".rar") returned 4
	[0075.954] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.954] lstrlenW (lpString=".bz2") returned 4
	[0075.954] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.954] lstrlenW (lpString=".7z") returned 3
	[0075.954] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.954] lstrlenW (lpString=".dbf") returned 4
	[0075.954] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.954] lstrlenW (lpString=".1cd") returned 4
	[0075.954] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0075.954] lstrlenW (lpString=".jpg") returned 4
	[0075.954] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.955] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0075.955] lstrlenW (lpString="AppVCatalog.dll") returned 15
	[0075.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0075.955] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=656088) returned 1
	[0075.955] CloseHandle (hObject=0x368) returned 1
	[0075.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20
	[0075.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0075.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0075.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0075.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0075.955] lstrlenW (lpString=".doc") returned 4
	[0075.955] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.955] lstrlenW (lpString=".docx") returned 5
	[0075.955] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0075.956] lstrlenW (lpString=".pdf") returned 4
	[0075.956] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.956] lstrlenW (lpString=".xls") returned 4
	[0075.956] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.956] lstrlenW (lpString=".xlsx") returned 5
	[0075.956] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0075.956] lstrlenW (lpString=".ppt") returned 4
	[0075.956] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0075.956] lstrlenW (lpString=".zip") returned 4
	[0075.956] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0075.956] lstrlenW (lpString=".rar") returned 4
	[0075.956] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0075.956] lstrlenW (lpString=".bz2") returned 4
	[0075.956] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0075.956] lstrlenW (lpString=".7z") returned 3
	[0075.956] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0075.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0075.956] lstrlenW (lpString=".dbf") returned 4
	[0075.956] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0075.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0075.956] lstrlenW (lpString=".1cd") returned 4
	[0075.956] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0075.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0075.956] lstrlenW (lpString=".jpg") returned 4
	[0075.956] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0075.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0075.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0075.956] lstrlenW (lpString=".doc") returned 4
	[0075.956] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0075.956] lstrlenW (lpString=".docx") returned 5
	[0075.957] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0075.957] lstrlenW (lpString=".pdf") returned 4
	[0075.957] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0075.957] lstrlenW (lpString=".xls") returned 4
	[0075.957] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0075.957] lstrlenW (lpString=".xlsx") returned 5
	[0075.957] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0075.957] lstrlenW (lpString=".ppt") returned 4
	[0075.957] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0075.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0076.338] lstrlenW (lpString=".zip") returned 4
	[0076.358] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.358] lstrlenW (lpString=".rar") returned 4
	[0076.358] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.358] lstrlenW (lpString=".bz2") returned 4
	[0076.358] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.358] lstrlenW (lpString=".7z") returned 3
	[0076.358] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0076.358] lstrlenW (lpString=".dbf") returned 4
	[0076.358] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0076.358] lstrlenW (lpString=".1cd") returned 4
	[0076.358] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0076.358] lstrlenW (lpString=".jpg") returned 4
	[0076.358] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.359] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.359] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23
	[0076.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0076.581] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=2285736) returned 1
	[0076.581] CloseHandle (hObject=0x2d4) returned 1
	[0076.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20
	[0076.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[admin@stex777.com].money")) returned 1
	[0076.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0076.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[admin@stex777.com].money"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1
	[0076.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.583] lstrlenW (lpString=".doc") returned 4
	[0076.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.583] lstrlenW (lpString=".docx") returned 5
	[0076.583] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0076.583] lstrlenW (lpString=".pdf") returned 4
	[0076.583] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.583] lstrlenW (lpString=".xls") returned 4
	[0076.583] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.583] lstrlenW (lpString=".xlsx") returned 5
	[0076.584] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0076.584] lstrlenW (lpString=".ppt") returned 4
	[0076.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.584] lstrlenW (lpString=".zip") returned 4
	[0076.584] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.584] lstrlenW (lpString=".rar") returned 4
	[0076.584] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.584] lstrlenW (lpString=".bz2") returned 4
	[0076.584] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.584] lstrlenW (lpString=".7z") returned 3
	[0076.584] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.584] lstrlenW (lpString=".dbf") returned 4
	[0076.584] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.584] lstrlenW (lpString=".1cd") returned 4
	[0076.584] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.584] lstrlenW (lpString=".jpg") returned 4
	[0076.584] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.585] lstrlenW (lpString=".doc") returned 4
	[0076.585] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.585] lstrlenW (lpString=".docx") returned 5
	[0076.585] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0076.585] lstrlenW (lpString=".pdf") returned 4
	[0076.585] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.585] lstrlenW (lpString=".xls") returned 4
	[0076.585] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.585] lstrlenW (lpString=".xlsx") returned 5
	[0076.585] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0076.585] lstrlenW (lpString=".ppt") returned 4
	[0076.585] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.585] lstrlenW (lpString=".zip") returned 4
	[0076.585] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.585] lstrlenW (lpString=".rar") returned 4
	[0076.585] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.585] lstrlenW (lpString=".bz2") returned 4
	[0076.585] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.585] lstrlenW (lpString=".7z") returned 3
	[0076.585] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.585] lstrlenW (lpString=".dbf") returned 4
	[0076.585] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.586] lstrlenW (lpString=".1cd") returned 4
	[0076.586] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0076.586] lstrlenW (lpString=".jpg") returned 4
	[0076.586] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.586] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0076.586] lstrlenW (lpString="concrt140.dll") returned 13
	[0076.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0076.614] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=332968) returned 1
	[0076.614] CloseHandle (hObject=0x2d4) returned 1
	[0076.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20
	[0076.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0076.614] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.615] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0076.615] GetLastError () returned 0x0
	[0076.615] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x514a8, lpOverlapped=0x0) returned 1
	[0076.625] WriteFile (in: hFile=0x320, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x514b0, lpOverlapped=0x0) returned 1
	[0076.680] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.680] WriteFile (in: hFile=0x320, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xee, lpOverlapped=0x0) returned 1
	[0076.680] SetEndOfFile (hFile=0x320) returned 1
	[0076.680] CloseHandle (hObject=0x320) returned 1
	[0076.680] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.680] SetEndOfFile (hFile=0x2d4) returned 1
	[0076.684] CloseHandle (hObject=0x2d4) returned 1
	[0076.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0076.684] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1
	[0076.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.685] lstrlenW (lpString=".doc") returned 4
	[0076.685] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.685] lstrlenW (lpString=".docx") returned 5
	[0076.685] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0076.685] lstrlenW (lpString=".pdf") returned 4
	[0076.685] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.685] lstrlenW (lpString=".xls") returned 4
	[0076.685] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.685] lstrlenW (lpString=".xlsx") returned 5
	[0076.685] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0076.685] lstrlenW (lpString=".ppt") returned 4
	[0076.685] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.685] lstrlenW (lpString=".zip") returned 4
	[0076.685] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.685] lstrlenW (lpString=".rar") returned 4
	[0076.685] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.685] lstrlenW (lpString=".bz2") returned 4
	[0076.685] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.685] lstrlenW (lpString=".7z") returned 3
	[0076.685] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.685] lstrlenW (lpString=".dbf") returned 4
	[0076.686] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.686] lstrlenW (lpString=".1cd") returned 4
	[0076.686] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.686] lstrlenW (lpString=".jpg") returned 4
	[0076.686] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.686] lstrlenW (lpString=".doc") returned 4
	[0076.686] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0076.686] lstrlenW (lpString=".docx") returned 5
	[0076.686] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0076.686] lstrlenW (lpString=".pdf") returned 4
	[0076.686] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0076.686] lstrlenW (lpString=".xls") returned 4
	[0076.686] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0076.686] lstrlenW (lpString=".xlsx") returned 5
	[0076.686] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0076.686] lstrlenW (lpString=".ppt") returned 4
	[0076.686] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0076.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.686] lstrlenW (lpString=".zip") returned 4
	[0076.686] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0076.686] lstrlenW (lpString=".rar") returned 4
	[0076.686] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0076.687] lstrlenW (lpString=".bz2") returned 4
	[0076.687] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0076.687] lstrlenW (lpString=".7z") returned 3
	[0076.687] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0076.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.687] lstrlenW (lpString=".dbf") returned 4
	[0076.687] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0076.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.687] lstrlenW (lpString=".1cd") returned 4
	[0076.687] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0076.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0076.687] lstrlenW (lpString=".jpg") returned 4
	[0076.687] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0076.687] lstrcmpiW (lpString1=".hash", lpString2=".money") returned -1
	[0076.687] lstrlenW (lpString="i640.hash") returned 9
	[0076.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0076.688] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=102) returned 1
	[0076.688] CloseHandle (hObject=0x2d4) returned 1
	[0076.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20
	[0076.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0076.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0076.688] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.688] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0076.689] GetLastError () returned 0x0
	[0076.689] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x66, lpOverlapped=0x0) returned 1
	[0076.690] WriteFile (in: hFile=0x320, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x70, lpOverlapped=0x0) returned 1
	[0076.690] ReadFile (in: hFile=0x2d4, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.690] WriteFile (in: hFile=0x320, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0076.691] SetEndOfFile (hFile=0x320) returned 1
	[0076.691] CloseHandle (hObject=0x320) returned 1
	[0076.691] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.691] SetEndOfFile (hFile=0x2d4) returned 1
	[0077.186] CloseHandle (hObject=0x2d4) returned 1
	[0077.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.203] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1
	[0077.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.203] lstrlenW (lpString=".doc") returned 4
	[0077.203] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0077.203] lstrlenW (lpString=".docx") returned 5
	[0077.203] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0077.203] lstrlenW (lpString=".pdf") returned 4
	[0077.203] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0077.203] lstrlenW (lpString=".xls") returned 4
	[0077.203] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0077.203] lstrlenW (lpString=".xlsx") returned 5
	[0077.203] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0077.203] lstrlenW (lpString=".ppt") returned 4
	[0077.203] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0077.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.204] lstrlenW (lpString=".zip") returned 4
	[0077.204] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0077.204] lstrlenW (lpString=".rar") returned 4
	[0077.204] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0077.204] lstrlenW (lpString=".bz2") returned 4
	[0077.204] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0077.204] lstrlenW (lpString=".7z") returned 3
	[0077.204] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0077.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.204] lstrlenW (lpString=".dbf") returned 4
	[0077.204] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0077.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.204] lstrlenW (lpString=".1cd") returned 4
	[0077.204] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0077.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.204] lstrlenW (lpString=".jpg") returned 4
	[0077.204] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0077.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.204] lstrlenW (lpString=".doc") returned 4
	[0077.204] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0077.204] lstrlenW (lpString=".docx") returned 5
	[0077.204] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0077.204] lstrlenW (lpString=".pdf") returned 4
	[0077.204] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0077.205] lstrlenW (lpString=".xls") returned 4
	[0077.205] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0077.205] lstrlenW (lpString=".xlsx") returned 5
	[0077.205] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0077.205] lstrlenW (lpString=".ppt") returned 4
	[0077.205] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0077.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.205] lstrlenW (lpString=".zip") returned 4
	[0077.205] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0077.205] lstrlenW (lpString=".rar") returned 4
	[0077.205] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0077.205] lstrlenW (lpString=".bz2") returned 4
	[0077.205] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0077.205] lstrlenW (lpString=".7z") returned 3
	[0077.205] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0077.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.205] lstrlenW (lpString=".dbf") returned 4
	[0077.205] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0077.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.205] lstrlenW (lpString=".1cd") returned 4
	[0077.205] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0077.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0077.205] lstrlenW (lpString=".jpg") returned 4
	[0077.205] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0077.206] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.206] lstrlenW (lpString="mso20win32client.dll") returned 20
	[0077.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0077.206] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=3144288) returned 1
	[0077.206] CloseHandle (hObject=0x368) returned 1
	[0077.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20
	[0077.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[admin@stex777.com].money")) returned 1
	[0077.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[admin@stex777.com].money"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1
	[0077.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.529] lstrlenW (lpString=".doc") returned 4
	[0077.529] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.529] lstrlenW (lpString=".docx") returned 5
	[0077.529] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0077.529] lstrlenW (lpString=".pdf") returned 4
	[0077.529] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.529] lstrlenW (lpString=".xls") returned 4
	[0077.529] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.529] lstrlenW (lpString=".xlsx") returned 5
	[0077.529] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0077.529] lstrlenW (lpString=".ppt") returned 4
	[0077.529] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.529] lstrlenW (lpString=".zip") returned 4
	[0077.529] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.529] lstrlenW (lpString=".rar") returned 4
	[0077.530] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.530] lstrlenW (lpString=".bz2") returned 4
	[0077.530] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.530] lstrlenW (lpString=".7z") returned 3
	[0077.530] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.530] lstrlenW (lpString=".dbf") returned 4
	[0077.530] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.530] lstrlenW (lpString=".1cd") returned 4
	[0077.530] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.530] lstrlenW (lpString=".jpg") returned 4
	[0077.530] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.530] lstrlenW (lpString=".doc") returned 4
	[0077.530] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.530] lstrlenW (lpString=".docx") returned 5
	[0077.530] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0077.530] lstrlenW (lpString=".pdf") returned 4
	[0077.530] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.530] lstrlenW (lpString=".xls") returned 4
	[0077.530] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.530] lstrlenW (lpString=".xlsx") returned 5
	[0077.530] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0077.530] lstrlenW (lpString=".ppt") returned 4
	[0077.530] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.531] lstrlenW (lpString=".zip") returned 4
	[0077.531] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.531] lstrlenW (lpString=".rar") returned 4
	[0077.531] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.531] lstrlenW (lpString=".bz2") returned 4
	[0077.531] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.531] lstrlenW (lpString=".7z") returned 3
	[0077.531] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.531] lstrlenW (lpString=".dbf") returned 4
	[0077.531] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.531] lstrlenW (lpString=".1cd") returned 4
	[0077.531] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0077.531] lstrlenW (lpString=".jpg") returned 4
	[0077.531] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.531] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0077.531] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0077.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0077.532] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=2776664) returned 1
	[0077.532] CloseHandle (hObject=0x360) returned 1
	[0077.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20
	[0077.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[admin@stex777.com].money")) returned 1
	[0077.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0077.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[admin@stex777.com].money"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1
	[0077.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.533] lstrlenW (lpString=".doc") returned 4
	[0077.533] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0077.533] lstrlenW (lpString=".docx") returned 5
	[0077.533] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1
	[0077.533] lstrlenW (lpString=".pdf") returned 4
	[0077.533] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0077.533] lstrlenW (lpString=".xls") returned 4
	[0077.534] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0077.534] lstrlenW (lpString=".xlsx") returned 5
	[0077.534] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1
	[0077.534] lstrlenW (lpString=".ppt") returned 4
	[0077.534] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0077.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.534] lstrlenW (lpString=".zip") returned 4
	[0077.534] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0077.534] lstrlenW (lpString=".rar") returned 4
	[0077.534] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0077.534] lstrlenW (lpString=".bz2") returned 4
	[0077.534] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0077.534] lstrlenW (lpString=".7z") returned 3
	[0077.534] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0077.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.534] lstrlenW (lpString=".dbf") returned 4
	[0077.534] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0077.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.534] lstrlenW (lpString=".1cd") returned 4
	[0077.534] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0077.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.534] lstrlenW (lpString=".jpg") returned 4
	[0077.534] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0077.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.534] lstrlenW (lpString=".doc") returned 4
	[0077.534] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0077.534] lstrlenW (lpString=".docx") returned 5
	[0077.535] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1
	[0077.535] lstrlenW (lpString=".pdf") returned 4
	[0077.535] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0077.535] lstrlenW (lpString=".xls") returned 4
	[0077.535] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0077.535] lstrlenW (lpString=".xlsx") returned 5
	[0077.535] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1
	[0077.535] lstrlenW (lpString=".ppt") returned 4
	[0077.535] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0077.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.535] lstrlenW (lpString=".zip") returned 4
	[0077.535] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0077.535] lstrlenW (lpString=".rar") returned 4
	[0077.535] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0077.536] lstrlenW (lpString=".bz2") returned 4
	[0077.536] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0077.536] lstrlenW (lpString=".7z") returned 3
	[0077.536] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0077.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.536] lstrlenW (lpString=".dbf") returned 4
	[0077.536] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0077.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.536] lstrlenW (lpString=".1cd") returned 4
	[0077.536] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0077.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0077.536] lstrlenW (lpString=".jpg") returned 4
	[0077.536] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0077.537] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.537] lstrlenW (lpString="StreamServer.dll") returned 16
	[0077.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0077.537] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=1053784) returned 1
	[0077.537] CloseHandle (hObject=0x360) returned 1
	[0077.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20
	[0077.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.537] lstrlenW (lpString=".doc") returned 4
	[0077.537] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.537] lstrlenW (lpString=".docx") returned 5
	[0077.538] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0077.538] lstrlenW (lpString=".pdf") returned 4
	[0077.538] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.538] lstrlenW (lpString=".xls") returned 4
	[0077.538] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.538] lstrlenW (lpString=".xlsx") returned 5
	[0077.538] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0077.538] lstrlenW (lpString=".ppt") returned 4
	[0077.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.538] lstrlenW (lpString=".zip") returned 4
	[0077.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.538] lstrlenW (lpString=".rar") returned 4
	[0077.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.538] lstrlenW (lpString=".bz2") returned 4
	[0077.538] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.538] lstrlenW (lpString=".7z") returned 3
	[0077.538] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.538] lstrlenW (lpString=".dbf") returned 4
	[0077.538] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.538] lstrlenW (lpString=".1cd") returned 4
	[0077.538] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.538] lstrlenW (lpString=".jpg") returned 4
	[0077.538] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.539] lstrlenW (lpString=".doc") returned 4
	[0077.539] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0077.539] lstrlenW (lpString=".docx") returned 5
	[0077.539] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0077.539] lstrlenW (lpString=".pdf") returned 4
	[0077.539] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0077.539] lstrlenW (lpString=".xls") returned 4
	[0077.539] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0077.539] lstrlenW (lpString=".xlsx") returned 5
	[0077.539] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0077.539] lstrlenW (lpString=".ppt") returned 4
	[0077.539] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0077.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.539] lstrlenW (lpString=".zip") returned 4
	[0077.539] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0077.539] lstrlenW (lpString=".rar") returned 4
	[0077.539] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0077.539] lstrlenW (lpString=".bz2") returned 4
	[0077.539] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0077.539] lstrlenW (lpString=".7z") returned 3
	[0077.539] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0077.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.539] lstrlenW (lpString=".dbf") returned 4
	[0077.539] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0077.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.539] lstrlenW (lpString=".1cd") returned 4
	[0077.540] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0077.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0077.540] lstrlenW (lpString=".jpg") returned 4
	[0077.540] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0077.540] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0077.540] lstrlenW (lpString="ucrtbase.dll") returned 12
	[0077.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0077.583] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=982720) returned 1
	[0077.583] CloseHandle (hObject=0x360) returned 1
	[0077.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20
	[0077.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0077.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0077.583] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.583] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0077.584] GetLastError () returned 0x0
	[0077.584] ReadFile (in: hFile=0x360, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0xefec0, lpOverlapped=0x0) returned 1
	[0077.602] WriteFile (in: hFile=0x38c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xefed0, lpOverlapped=0x0) returned 1
	[0078.010] ReadFile (in: hFile=0x360, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.011] WriteFile (in: hFile=0x38c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.011] SetEndOfFile (hFile=0x38c) returned 1
	[0078.011] CloseHandle (hObject=0x38c) returned 1
	[0078.011] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.011] SetEndOfFile (hFile=0x360) returned 1
	[0078.019] CloseHandle (hObject=0x360) returned 1
	[0078.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0078.019] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1
	[0078.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.020] lstrlenW (lpString=".doc") returned 4
	[0078.020] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.020] lstrlenW (lpString=".docx") returned 5
	[0078.020] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0078.020] lstrlenW (lpString=".pdf") returned 4
	[0078.020] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.020] lstrlenW (lpString=".xls") returned 4
	[0078.020] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.020] lstrlenW (lpString=".xlsx") returned 5
	[0078.020] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0078.020] lstrlenW (lpString=".ppt") returned 4
	[0078.020] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.020] lstrlenW (lpString=".zip") returned 4
	[0078.020] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.020] lstrlenW (lpString=".rar") returned 4
	[0078.020] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.020] lstrlenW (lpString=".bz2") returned 4
	[0078.020] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.020] lstrlenW (lpString=".7z") returned 3
	[0078.020] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.020] lstrlenW (lpString=".dbf") returned 4
	[0078.020] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.020] lstrlenW (lpString=".1cd") returned 4
	[0078.021] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.021] lstrlenW (lpString=".jpg") returned 4
	[0078.021] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.021] lstrlenW (lpString=".doc") returned 4
	[0078.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.021] lstrlenW (lpString=".docx") returned 5
	[0078.021] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0078.021] lstrlenW (lpString=".pdf") returned 4
	[0078.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.021] lstrlenW (lpString=".xls") returned 4
	[0078.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.021] lstrlenW (lpString=".xlsx") returned 5
	[0078.021] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0078.021] lstrlenW (lpString=".ppt") returned 4
	[0078.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.021] lstrlenW (lpString=".zip") returned 4
	[0078.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.021] lstrlenW (lpString=".rar") returned 4
	[0078.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.021] lstrlenW (lpString=".bz2") returned 4
	[0078.021] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.021] lstrlenW (lpString=".7z") returned 3
	[0078.021] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.021] lstrlenW (lpString=".dbf") returned 4
	[0078.021] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.022] lstrlenW (lpString=".1cd") returned 4
	[0078.022] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0078.022] lstrlenW (lpString=".jpg") returned 4
	[0078.022] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.022] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.022] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28
	[0078.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.322] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=3072) returned 1
	[0078.323] CloseHandle (hObject=0x374) returned 1
	[0078.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20
	[0078.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.323] lstrlenW (lpString=".doc") returned 4
	[0078.323] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.323] lstrlenW (lpString=".docx") returned 5
	[0078.323] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0078.323] lstrlenW (lpString=".pdf") returned 4
	[0078.323] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.323] lstrlenW (lpString=".xls") returned 4
	[0078.323] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.323] lstrlenW (lpString=".xlsx") returned 5
	[0078.323] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0078.323] lstrlenW (lpString=".ppt") returned 4
	[0078.323] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.323] lstrlenW (lpString=".zip") returned 4
	[0078.323] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.323] lstrlenW (lpString=".rar") returned 4
	[0078.323] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.324] lstrlenW (lpString=".bz2") returned 4
	[0078.324] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.324] lstrlenW (lpString=".7z") returned 3
	[0078.324] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.324] lstrlenW (lpString=".dbf") returned 4
	[0078.324] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.324] lstrlenW (lpString=".1cd") returned 4
	[0078.324] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.324] lstrlenW (lpString=".jpg") returned 4
	[0078.324] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.324] lstrlenW (lpString=".doc") returned 4
	[0078.324] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.324] lstrlenW (lpString=".docx") returned 5
	[0078.324] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0078.324] lstrlenW (lpString=".pdf") returned 4
	[0078.324] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.324] lstrlenW (lpString=".xls") returned 4
	[0078.324] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.324] lstrlenW (lpString=".xlsx") returned 5
	[0078.324] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0078.324] lstrlenW (lpString=".ppt") returned 4
	[0078.324] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.324] lstrlenW (lpString=".zip") returned 4
	[0078.325] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.325] lstrlenW (lpString=".rar") returned 4
	[0078.325] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.325] lstrlenW (lpString=".bz2") returned 4
	[0078.325] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.325] lstrlenW (lpString=".7z") returned 3
	[0078.325] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.325] lstrlenW (lpString=".dbf") returned 4
	[0078.325] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.325] lstrlenW (lpString=".1cd") returned 4
	[0078.325] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0078.325] lstrlenW (lpString=".jpg") returned 4
	[0078.325] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.325] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.325] lstrlenW (lpString="micaut.dll.mui") returned 14
	[0078.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.327] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=9216) returned 1
	[0078.327] CloseHandle (hObject=0x374) returned 1
	[0078.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20
	[0078.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.327] lstrlenW (lpString=".doc") returned 4
	[0078.327] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.327] lstrlenW (lpString=".docx") returned 5
	[0078.327] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.327] lstrlenW (lpString=".pdf") returned 4
	[0078.327] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.327] lstrlenW (lpString=".xls") returned 4
	[0078.327] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.327] lstrlenW (lpString=".xlsx") returned 5
	[0078.327] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.327] lstrlenW (lpString=".ppt") returned 4
	[0078.327] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.328] lstrlenW (lpString=".zip") returned 4
	[0078.328] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.328] lstrlenW (lpString=".rar") returned 4
	[0078.328] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.328] lstrlenW (lpString=".bz2") returned 4
	[0078.328] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.328] lstrlenW (lpString=".7z") returned 3
	[0078.328] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.328] lstrlenW (lpString=".dbf") returned 4
	[0078.328] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.328] lstrlenW (lpString=".1cd") returned 4
	[0078.328] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.328] lstrlenW (lpString=".jpg") returned 4
	[0078.328] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.328] lstrlenW (lpString=".doc") returned 4
	[0078.328] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.328] lstrlenW (lpString=".docx") returned 5
	[0078.328] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.328] lstrlenW (lpString=".pdf") returned 4
	[0078.328] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.328] lstrlenW (lpString=".xls") returned 4
	[0078.329] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.329] lstrlenW (lpString=".xlsx") returned 5
	[0078.329] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.329] lstrlenW (lpString=".ppt") returned 4
	[0078.329] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.329] lstrlenW (lpString=".zip") returned 4
	[0078.329] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.329] lstrlenW (lpString=".rar") returned 4
	[0078.329] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.329] lstrlenW (lpString=".bz2") returned 4
	[0078.329] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.329] lstrlenW (lpString=".7z") returned 3
	[0078.329] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.329] lstrlenW (lpString=".dbf") returned 4
	[0078.329] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.329] lstrlenW (lpString=".1cd") returned 4
	[0078.329] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0078.329] lstrlenW (lpString=".jpg") returned 4
	[0078.329] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.330] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.330] lstrlenW (lpString="mip.exe.mui") returned 11
	[0078.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.331] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=10752) returned 1
	[0078.331] CloseHandle (hObject=0x374) returned 1
	[0078.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20
	[0078.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.331] lstrlenW (lpString=".doc") returned 4
	[0078.331] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.331] lstrlenW (lpString=".docx") returned 5
	[0078.331] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0078.331] lstrlenW (lpString=".pdf") returned 4
	[0078.331] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.331] lstrlenW (lpString=".xls") returned 4
	[0078.331] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.331] lstrlenW (lpString=".xlsx") returned 5
	[0078.331] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0078.331] lstrlenW (lpString=".ppt") returned 4
	[0078.331] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.332] lstrlenW (lpString=".zip") returned 4
	[0078.332] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.332] lstrlenW (lpString=".rar") returned 4
	[0078.332] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.332] lstrlenW (lpString=".bz2") returned 4
	[0078.332] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.332] lstrlenW (lpString=".7z") returned 3
	[0078.332] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.332] lstrlenW (lpString=".dbf") returned 4
	[0078.332] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.332] lstrlenW (lpString=".1cd") returned 4
	[0078.332] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.332] lstrlenW (lpString=".jpg") returned 4
	[0078.332] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.333] lstrlenW (lpString=".doc") returned 4
	[0078.333] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.333] lstrlenW (lpString=".docx") returned 5
	[0078.333] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0078.333] lstrlenW (lpString=".pdf") returned 4
	[0078.333] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.333] lstrlenW (lpString=".xls") returned 4
	[0078.333] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.333] lstrlenW (lpString=".xlsx") returned 5
	[0078.333] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0078.333] lstrlenW (lpString=".ppt") returned 4
	[0078.333] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.333] lstrlenW (lpString=".zip") returned 4
	[0078.333] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.333] lstrlenW (lpString=".rar") returned 4
	[0078.333] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.333] lstrlenW (lpString=".bz2") returned 4
	[0078.333] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.333] lstrlenW (lpString=".7z") returned 3
	[0078.333] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.334] lstrlenW (lpString=".dbf") returned 4
	[0078.334] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.334] lstrlenW (lpString=".1cd") returned 4
	[0078.334] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0078.334] lstrlenW (lpString=".jpg") returned 4
	[0078.334] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.334] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.334] lstrlenW (lpString="mshwLatin.dll.mui") returned 17
	[0078.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0078.335] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=3072) returned 1
	[0078.335] CloseHandle (hObject=0x314) returned 1
	[0078.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20
	[0078.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.335] lstrlenW (lpString=".doc") returned 4
	[0078.335] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.335] lstrlenW (lpString=".docx") returned 5
	[0078.336] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.336] lstrlenW (lpString=".pdf") returned 4
	[0078.336] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.336] lstrlenW (lpString=".xls") returned 4
	[0078.336] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.336] lstrlenW (lpString=".xlsx") returned 5
	[0078.336] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.336] lstrlenW (lpString=".ppt") returned 4
	[0078.336] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.336] lstrlenW (lpString=".zip") returned 4
	[0078.336] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.336] lstrlenW (lpString=".rar") returned 4
	[0078.336] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.336] lstrlenW (lpString=".bz2") returned 4
	[0078.336] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.336] lstrlenW (lpString=".7z") returned 3
	[0078.336] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.336] lstrlenW (lpString=".dbf") returned 4
	[0078.336] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.336] lstrlenW (lpString=".1cd") returned 4
	[0078.336] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.337] lstrlenW (lpString=".jpg") returned 4
	[0078.337] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.337] lstrlenW (lpString=".doc") returned 4
	[0078.337] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.337] lstrlenW (lpString=".docx") returned 5
	[0078.337] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.337] lstrlenW (lpString=".pdf") returned 4
	[0078.337] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.337] lstrlenW (lpString=".xls") returned 4
	[0078.337] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.337] lstrlenW (lpString=".xlsx") returned 5
	[0078.337] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.337] lstrlenW (lpString=".ppt") returned 4
	[0078.337] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.337] lstrlenW (lpString=".zip") returned 4
	[0078.337] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.337] lstrlenW (lpString=".rar") returned 4
	[0078.337] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.337] lstrlenW (lpString=".bz2") returned 4
	[0078.337] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.337] lstrlenW (lpString=".7z") returned 3
	[0078.338] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.338] lstrlenW (lpString=".dbf") returned 4
	[0078.338] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.338] lstrlenW (lpString=".1cd") returned 4
	[0078.338] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0078.338] lstrlenW (lpString=".jpg") returned 4
	[0078.338] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.338] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.338] lstrlenW (lpString="rtscom.dll.mui") returned 14
	[0078.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0078.339] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=3072) returned 1
	[0078.339] CloseHandle (hObject=0x314) returned 1
	[0078.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20
	[0078.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.339] lstrlenW (lpString=".doc") returned 4
	[0078.339] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.339] lstrlenW (lpString=".docx") returned 5
	[0078.339] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.339] lstrlenW (lpString=".pdf") returned 4
	[0078.339] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.339] lstrlenW (lpString=".xls") returned 4
	[0078.339] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.340] lstrlenW (lpString=".xlsx") returned 5
	[0078.340] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.340] lstrlenW (lpString=".ppt") returned 4
	[0078.340] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.340] lstrlenW (lpString=".zip") returned 4
	[0078.340] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.340] lstrlenW (lpString=".rar") returned 4
	[0078.340] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.340] lstrlenW (lpString=".bz2") returned 4
	[0078.340] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.340] lstrlenW (lpString=".7z") returned 3
	[0078.340] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.340] lstrlenW (lpString=".dbf") returned 4
	[0078.340] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.340] lstrlenW (lpString=".1cd") returned 4
	[0078.340] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.340] lstrlenW (lpString=".jpg") returned 4
	[0078.340] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.340] lstrlenW (lpString=".doc") returned 4
	[0078.340] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.340] lstrlenW (lpString=".docx") returned 5
	[0078.340] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0078.340] lstrlenW (lpString=".pdf") returned 4
	[0078.341] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.341] lstrlenW (lpString=".xls") returned 4
	[0078.341] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.341] lstrlenW (lpString=".xlsx") returned 5
	[0078.341] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0078.341] lstrlenW (lpString=".ppt") returned 4
	[0078.341] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.341] lstrlenW (lpString=".zip") returned 4
	[0078.341] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.341] lstrlenW (lpString=".rar") returned 4
	[0078.341] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.341] lstrlenW (lpString=".bz2") returned 4
	[0078.341] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.341] lstrlenW (lpString=".7z") returned 3
	[0078.341] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.341] lstrlenW (lpString=".dbf") returned 4
	[0078.341] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.341] lstrlenW (lpString=".1cd") returned 4
	[0078.341] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0078.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0078.341] lstrlenW (lpString=".jpg") returned 4
	[0078.341] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0078.342] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0078.342] lstrlenW (lpString="ShapeCollector.exe.mui") returned 22
	[0078.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0078.342] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=44032) returned 1
	[0078.342] CloseHandle (hObject=0x314) returned 1
	[0078.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20
	[0078.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0078.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79
	[0078.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79
	[0078.343] lstrlenW (lpString=".doc") returned 4
	[0078.343] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0078.343] lstrlenW (lpString=".docx") returned 5
	[0078.343] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0078.343] lstrlenW (lpString=".pdf") returned 4
	[0078.343] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0078.343] lstrlenW (lpString=".xls") returned 4
	[0078.343] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0078.343] lstrlenW (lpString=".xlsx") returned 5
	[0078.343] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0078.343] lstrlenW (lpString=".ppt") returned 4
	[0078.343] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0078.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79
	[0078.343] lstrlenW (lpString=".zip") returned 4
	[0078.343] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0078.343] lstrlenW (lpString=".rar") returned 4
	[0078.343] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0078.343] lstrlenW (lpString=".bz2") returned 4
	[0078.343] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0078.343] lstrlenW (lpString=".7z") returned 3
	[0078.343] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0078.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79
	[0078.344] lstrlenW (lpString=".dbf") returned 4
	[0078.344] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0078.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0078.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0078.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0078.743] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.743] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0078.744] GetLastError () returned 0x0
	[0078.744] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x902bb, lpOverlapped=0x0) returned 1
	[0078.756] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x902c0, lpOverlapped=0x0) returned 1
	[0078.767] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.767] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x104, lpOverlapped=0x0) returned 1
	[0078.767] SetEndOfFile (hFile=0x314) returned 1
	[0078.767] CloseHandle (hObject=0x314) returned 1
	[0078.767] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.767] SetEndOfFile (hFile=0x374) returned 1
	[0078.775] CloseHandle (hObject=0x374) returned 1
	[0078.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0078.775] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1
	[0078.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0078.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0078.776] lstrlenW (lpString=".doc") returned 4
	[0078.776] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0079.882] lstrlenW (lpString=".docx") returned 5
	[0079.882] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0079.882] lstrlenW (lpString=".pdf") returned 4
	[0079.882] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0079.882] lstrlenW (lpString=".xls") returned 4
	[0079.882] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0079.882] lstrlenW (lpString=".xlsx") returned 5
	[0079.882] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0079.882] lstrlenW (lpString=".ppt") returned 4
	[0079.882] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0079.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0079.882] lstrlenW (lpString=".zip") returned 4
	[0079.882] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0079.882] lstrlenW (lpString=".rar") returned 4
	[0079.882] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0079.882] lstrlenW (lpString=".bz2") returned 4
	[0079.882] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0079.882] lstrlenW (lpString=".7z") returned 3
	[0079.882] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0079.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0079.882] lstrlenW (lpString=".dbf") returned 4
	[0079.882] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0079.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0079.882] lstrlenW (lpString=".1cd") returned 4
	[0079.882] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0079.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0079.882] lstrlenW (lpString=".jpg") returned 4
	[0079.882] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0079.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0079.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0079.883] lstrlenW (lpString=".doc") returned 4
	[0079.883] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0079.883] lstrlenW (lpString=".docx") returned 5
	[0079.883] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0079.883] lstrlenW (lpString=".pdf") returned 4
	[0079.883] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0079.883] lstrlenW (lpString=".xls") returned 4
	[0079.883] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0079.883] lstrlenW (lpString=".xlsx") returned 5
	[0079.883] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0079.883] lstrlenW (lpString=".ppt") returned 4
	[0079.883] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0079.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0079.883] lstrlenW (lpString=".zip") returned 4
	[0079.883] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0079.883] lstrlenW (lpString=".rar") returned 4
	[0079.883] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0079.883] lstrlenW (lpString=".bz2") returned 4
	[0079.883] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0079.883] lstrlenW (lpString=".7z") returned 3
	[0079.883] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0079.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0079.883] lstrlenW (lpString=".dbf") returned 4
	[0079.883] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0079.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0079.883] lstrlenW (lpString=".1cd") returned 4
	[0079.883] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0079.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0079.883] lstrlenW (lpString=".jpg") returned 4
	[0079.883] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0079.884] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0079.884] lstrlenW (lpString="msdia90.dll") returned 11
	[0079.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0079.885] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=855376) returned 1
	[0079.885] CloseHandle (hObject=0x360) returned 1
	[0079.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20
	[0079.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0079.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0079.885] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.885] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0079.887] GetLastError () returned 0x0
	[0079.887] ReadFile (in: hFile=0x360, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0xd0d50, lpOverlapped=0x0) returned 1
	[0079.904] WriteFile (in: hFile=0x374, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xd0d60, lpOverlapped=0x0) returned 1
	[0079.935] ReadFile (in: hFile=0x360, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0079.935] WriteFile (in: hFile=0x374, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xea, lpOverlapped=0x0) returned 1
	[0079.935] SetEndOfFile (hFile=0x374) returned 1
	[0079.935] CloseHandle (hObject=0x374) returned 1
	[0079.936] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.936] SetEndOfFile (hFile=0x360) returned 1
	[0080.515] CloseHandle (hObject=0x360) returned 1
	[0080.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0080.515] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1
	[0080.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.516] lstrlenW (lpString=".doc") returned 4
	[0080.516] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.516] lstrlenW (lpString=".docx") returned 5
	[0080.516] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0080.516] lstrlenW (lpString=".pdf") returned 4
	[0080.516] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.516] lstrlenW (lpString=".xls") returned 4
	[0080.516] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.516] lstrlenW (lpString=".xlsx") returned 5
	[0080.516] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0080.516] lstrlenW (lpString=".ppt") returned 4
	[0080.516] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.516] lstrlenW (lpString=".zip") returned 4
	[0080.516] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.516] lstrlenW (lpString=".rar") returned 4
	[0080.516] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.516] lstrlenW (lpString=".bz2") returned 4
	[0080.516] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.516] lstrlenW (lpString=".7z") returned 3
	[0080.516] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.516] lstrlenW (lpString=".dbf") returned 4
	[0080.516] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.516] lstrlenW (lpString=".1cd") returned 4
	[0080.517] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.517] lstrlenW (lpString=".jpg") returned 4
	[0080.517] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.517] lstrlenW (lpString=".doc") returned 4
	[0080.517] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.517] lstrlenW (lpString=".docx") returned 5
	[0080.517] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0080.517] lstrlenW (lpString=".pdf") returned 4
	[0080.517] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.517] lstrlenW (lpString=".xls") returned 4
	[0080.517] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.517] lstrlenW (lpString=".xlsx") returned 5
	[0080.517] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0080.517] lstrlenW (lpString=".ppt") returned 4
	[0080.517] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.517] lstrlenW (lpString=".zip") returned 4
	[0080.517] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.517] lstrlenW (lpString=".rar") returned 4
	[0080.517] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.517] lstrlenW (lpString=".bz2") returned 4
	[0080.517] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.517] lstrlenW (lpString=".7z") returned 3
	[0080.517] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.518] lstrlenW (lpString=".dbf") returned 4
	[0080.518] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.518] lstrlenW (lpString=".1cd") returned 4
	[0080.518] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0080.518] lstrlenW (lpString=".jpg") returned 4
	[0080.518] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.518] lstrcmpiW (lpString1=".tlb", lpString2=".money") returned 1
	[0080.518] lstrlenW (lpString="vstoee90.tlb") returned 12
	[0080.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0080.977] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=22680) returned 1
	[0080.977] CloseHandle (hObject=0x318) returned 1
	[0080.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20
	[0080.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0080.977] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.977] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0080.977] GetLastError () returned 0x0
	[0080.977] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x5898, lpOverlapped=0x0) returned 1
	[0080.979] WriteFile (in: hFile=0x35c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x58a0, lpOverlapped=0x0) returned 1
	[0080.980] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.981] WriteFile (in: hFile=0x35c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xec, lpOverlapped=0x0) returned 1
	[0080.981] SetEndOfFile (hFile=0x35c) returned 1
	[0080.981] CloseHandle (hObject=0x35c) returned 1
	[0080.981] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.981] SetEndOfFile (hFile=0x318) returned 1
	[0080.982] CloseHandle (hObject=0x318) returned 1
	[0080.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0080.982] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1
	[0080.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.982] lstrlenW (lpString=".doc") returned 4
	[0080.982] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0080.982] lstrlenW (lpString=".docx") returned 5
	[0080.982] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0080.982] lstrlenW (lpString=".pdf") returned 4
	[0080.982] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0080.983] lstrlenW (lpString=".xls") returned 4
	[0080.983] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0080.983] lstrlenW (lpString=".xlsx") returned 5
	[0080.983] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0080.983] lstrlenW (lpString=".ppt") returned 4
	[0080.983] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0080.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.983] lstrlenW (lpString=".zip") returned 4
	[0080.983] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0080.983] lstrlenW (lpString=".rar") returned 4
	[0080.983] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0080.983] lstrlenW (lpString=".bz2") returned 4
	[0080.983] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0080.983] lstrlenW (lpString=".7z") returned 3
	[0080.983] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0080.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.983] lstrlenW (lpString=".dbf") returned 4
	[0080.983] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0080.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.983] lstrlenW (lpString=".1cd") returned 4
	[0080.983] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0080.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.983] lstrlenW (lpString=".jpg") returned 4
	[0080.983] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0080.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.983] lstrlenW (lpString=".doc") returned 4
	[0080.983] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0080.984] lstrlenW (lpString=".docx") returned 5
	[0080.984] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0080.984] lstrlenW (lpString=".pdf") returned 4
	[0080.984] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0080.984] lstrlenW (lpString=".xls") returned 4
	[0080.984] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0080.984] lstrlenW (lpString=".xlsx") returned 5
	[0080.984] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0080.984] lstrlenW (lpString=".ppt") returned 4
	[0080.984] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0080.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.984] lstrlenW (lpString=".zip") returned 4
	[0080.984] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0080.984] lstrlenW (lpString=".rar") returned 4
	[0080.984] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0080.984] lstrlenW (lpString=".bz2") returned 4
	[0080.984] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0080.984] lstrlenW (lpString=".7z") returned 3
	[0080.984] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0080.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.984] lstrlenW (lpString=".dbf") returned 4
	[0080.984] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0080.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.984] lstrlenW (lpString=".1cd") returned 4
	[0080.984] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0080.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0080.984] lstrlenW (lpString=".jpg") returned 4
	[0080.984] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0080.985] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0080.985] lstrlenW (lpString="bci.dll") returned 7
	[0080.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0080.985] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=16960) returned 1
	[0080.985] CloseHandle (hObject=0x318) returned 1
	[0080.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20
	[0080.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0080.985] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.985] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0080.986] GetLastError () returned 0x0
	[0080.986] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4240, lpOverlapped=0x0) returned 1
	[0080.987] WriteFile (in: hFile=0x35c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4250, lpOverlapped=0x0) returned 1
	[0080.992] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.992] WriteFile (in: hFile=0x35c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0080.992] SetEndOfFile (hFile=0x35c) returned 1
	[0080.993] CloseHandle (hObject=0x35c) returned 1
	[0080.993] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.993] SetEndOfFile (hFile=0x318) returned 1
	[0080.994] CloseHandle (hObject=0x318) returned 1
	[0080.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0080.994] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1
	[0080.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.994] lstrlenW (lpString=".doc") returned 4
	[0080.994] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.994] lstrlenW (lpString=".docx") returned 5
	[0080.994] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0080.994] lstrlenW (lpString=".pdf") returned 4
	[0080.994] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.994] lstrlenW (lpString=".xls") returned 4
	[0080.994] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.994] lstrlenW (lpString=".xlsx") returned 5
	[0080.994] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0080.994] lstrlenW (lpString=".ppt") returned 4
	[0080.994] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.994] lstrlenW (lpString=".zip") returned 4
	[0080.994] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.995] lstrlenW (lpString=".rar") returned 4
	[0080.995] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.995] lstrlenW (lpString=".bz2") returned 4
	[0080.995] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.995] lstrlenW (lpString=".7z") returned 3
	[0080.995] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.995] lstrlenW (lpString=".dbf") returned 4
	[0080.995] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.995] lstrlenW (lpString=".1cd") returned 4
	[0080.995] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.995] lstrlenW (lpString=".jpg") returned 4
	[0080.995] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.995] lstrlenW (lpString=".doc") returned 4
	[0080.995] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.995] lstrlenW (lpString=".docx") returned 5
	[0080.995] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0080.995] lstrlenW (lpString=".pdf") returned 4
	[0080.995] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.995] lstrlenW (lpString=".xls") returned 4
	[0080.995] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.995] lstrlenW (lpString=".xlsx") returned 5
	[0080.995] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0080.995] lstrlenW (lpString=".ppt") returned 4
	[0080.995] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.996] lstrlenW (lpString=".zip") returned 4
	[0080.996] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.996] lstrlenW (lpString=".rar") returned 4
	[0080.996] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.996] lstrlenW (lpString=".bz2") returned 4
	[0080.996] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.996] lstrlenW (lpString=".7z") returned 3
	[0080.996] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.996] lstrlenW (lpString=".dbf") returned 4
	[0080.996] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.996] lstrlenW (lpString=".1cd") returned 4
	[0080.996] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0080.996] lstrlenW (lpString=".jpg") returned 4
	[0080.996] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.996] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0080.996] lstrlenW (lpString="dcpr.dll") returned 8
	[0080.996] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0080.997] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=159808) returned 1
	[0080.997] CloseHandle (hObject=0x318) returned 1
	[0080.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20
	[0080.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0080.997] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0080.997] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.997] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.997] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0080.997] GetLastError () returned 0x0
	[0080.997] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x27040, lpOverlapped=0x0) returned 1
	[0081.001] WriteFile (in: hFile=0x35c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x27050, lpOverlapped=0x0) returned 1
	[0081.006] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.006] WriteFile (in: hFile=0x35c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0081.006] SetEndOfFile (hFile=0x35c) returned 1
	[0081.007] CloseHandle (hObject=0x35c) returned 1
	[0081.007] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.007] SetEndOfFile (hFile=0x318) returned 1
	[0081.008] CloseHandle (hObject=0x318) returned 1
	[0081.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.009] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1
	[0081.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.009] lstrlenW (lpString=".doc") returned 4
	[0081.009] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.009] lstrlenW (lpString=".docx") returned 5
	[0081.009] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0081.009] lstrlenW (lpString=".pdf") returned 4
	[0081.009] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.009] lstrlenW (lpString=".xls") returned 4
	[0081.009] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.009] lstrlenW (lpString=".xlsx") returned 5
	[0081.009] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0081.009] lstrlenW (lpString=".ppt") returned 4
	[0081.009] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.009] lstrlenW (lpString=".zip") returned 4
	[0081.009] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.009] lstrlenW (lpString=".rar") returned 4
	[0081.009] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.009] lstrlenW (lpString=".bz2") returned 4
	[0081.009] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.010] lstrlenW (lpString=".7z") returned 3
	[0081.010] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.010] lstrlenW (lpString=".dbf") returned 4
	[0081.010] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.010] lstrlenW (lpString=".1cd") returned 4
	[0081.010] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.010] lstrlenW (lpString=".jpg") returned 4
	[0081.010] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.010] lstrlenW (lpString=".doc") returned 4
	[0081.010] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.010] lstrlenW (lpString=".docx") returned 5
	[0081.010] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0081.010] lstrlenW (lpString=".pdf") returned 4
	[0081.010] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.010] lstrlenW (lpString=".xls") returned 4
	[0081.010] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.010] lstrlenW (lpString=".xlsx") returned 5
	[0081.010] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0081.010] lstrlenW (lpString=".ppt") returned 4
	[0081.010] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.010] lstrlenW (lpString=".zip") returned 4
	[0081.010] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.010] lstrlenW (lpString=".rar") returned 4
	[0081.010] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.010] lstrlenW (lpString=".bz2") returned 4
	[0081.011] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.011] lstrlenW (lpString=".7z") returned 3
	[0081.011] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.011] lstrlenW (lpString=".dbf") returned 4
	[0081.011] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.011] lstrlenW (lpString=".1cd") returned 4
	[0081.011] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0081.011] lstrlenW (lpString=".jpg") returned 4
	[0081.011] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.011] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0081.011] lstrlenW (lpString="decora_sse.dll") returned 14
	[0081.011] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0081.012] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=86080) returned 1
	[0081.012] CloseHandle (hObject=0x318) returned 1
	[0081.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20
	[0081.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0081.012] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.012] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0081.013] GetLastError () returned 0x0
	[0081.013] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x15040, lpOverlapped=0x0) returned 1
	[0081.015] WriteFile (in: hFile=0x35c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x15050, lpOverlapped=0x0) returned 1
	[0081.017] ReadFile (in: hFile=0x318, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.017] WriteFile (in: hFile=0x35c, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0081.017] SetEndOfFile (hFile=0x35c) returned 1
	[0081.017] CloseHandle (hObject=0x35c) returned 1
	[0081.018] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.018] SetEndOfFile (hFile=0x318) returned 1
	[0081.019] CloseHandle (hObject=0x318) returned 1
	[0081.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.019] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1
	[0081.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.019] lstrlenW (lpString=".doc") returned 4
	[0081.019] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.019] lstrlenW (lpString=".docx") returned 5
	[0081.019] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0081.301] lstrlenW (lpString=".pdf") returned 4
	[0081.301] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.301] lstrlenW (lpString=".xls") returned 4
	[0081.301] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.302] lstrlenW (lpString=".xlsx") returned 5
	[0081.302] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0081.302] lstrlenW (lpString=".ppt") returned 4
	[0081.302] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.302] lstrlenW (lpString=".zip") returned 4
	[0081.302] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.302] lstrlenW (lpString=".rar") returned 4
	[0081.302] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.302] lstrlenW (lpString=".bz2") returned 4
	[0081.302] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.302] lstrlenW (lpString=".7z") returned 3
	[0081.302] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.302] lstrlenW (lpString=".dbf") returned 4
	[0081.302] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.302] lstrlenW (lpString=".1cd") returned 4
	[0081.302] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.302] lstrlenW (lpString=".jpg") returned 4
	[0081.302] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.302] lstrlenW (lpString=".doc") returned 4
	[0081.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.303] lstrlenW (lpString=".docx") returned 5
	[0081.303] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0081.303] lstrlenW (lpString=".pdf") returned 4
	[0081.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.303] lstrlenW (lpString=".xls") returned 4
	[0081.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.303] lstrlenW (lpString=".xlsx") returned 5
	[0081.303] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0081.303] lstrlenW (lpString=".ppt") returned 4
	[0081.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.303] lstrlenW (lpString=".zip") returned 4
	[0081.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.303] lstrlenW (lpString=".rar") returned 4
	[0081.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.303] lstrlenW (lpString=".bz2") returned 4
	[0081.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.303] lstrlenW (lpString=".7z") returned 3
	[0081.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.303] lstrlenW (lpString=".dbf") returned 4
	[0081.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.303] lstrlenW (lpString=".1cd") returned 4
	[0081.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0081.303] lstrlenW (lpString=".jpg") returned 4
	[0081.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.304] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0081.304] lstrlenW (lpString="dt_shmem.dll") returned 12
	[0081.304] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.305] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=29760) returned 1
	[0081.305] CloseHandle (hObject=0x374) returned 1
	[0081.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20
	[0081.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.305] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.305] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.306] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.306] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0081.306] GetLastError () returned 0x0
	[0081.306] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x7440, lpOverlapped=0x0) returned 1
	[0081.308] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x7450, lpOverlapped=0x0) returned 1
	[0081.309] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.309] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.309] SetEndOfFile (hFile=0x370) returned 1
	[0081.310] CloseHandle (hObject=0x370) returned 1
	[0081.310] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.310] SetEndOfFile (hFile=0x374) returned 1
	[0081.311] CloseHandle (hObject=0x374) returned 1
	[0081.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.311] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1
	[0081.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.311] lstrlenW (lpString=".doc") returned 4
	[0081.311] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.311] lstrlenW (lpString=".docx") returned 5
	[0081.311] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0081.311] lstrlenW (lpString=".pdf") returned 4
	[0081.311] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.311] lstrlenW (lpString=".xls") returned 4
	[0081.311] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.311] lstrlenW (lpString=".xlsx") returned 5
	[0081.311] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0081.312] lstrlenW (lpString=".ppt") returned 4
	[0081.312] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.312] lstrlenW (lpString=".zip") returned 4
	[0081.312] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.312] lstrlenW (lpString=".rar") returned 4
	[0081.312] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.312] lstrlenW (lpString=".bz2") returned 4
	[0081.312] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.312] lstrlenW (lpString=".7z") returned 3
	[0081.312] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.312] lstrlenW (lpString=".dbf") returned 4
	[0081.312] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.312] lstrlenW (lpString=".1cd") returned 4
	[0081.312] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.312] lstrlenW (lpString=".jpg") returned 4
	[0081.312] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.312] lstrlenW (lpString=".doc") returned 4
	[0081.312] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.312] lstrlenW (lpString=".docx") returned 5
	[0081.313] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0081.313] lstrlenW (lpString=".pdf") returned 4
	[0081.313] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.313] lstrlenW (lpString=".xls") returned 4
	[0081.313] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.313] lstrlenW (lpString=".xlsx") returned 5
	[0081.313] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0081.313] lstrlenW (lpString=".ppt") returned 4
	[0081.313] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.313] lstrlenW (lpString=".zip") returned 4
	[0081.313] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.313] lstrlenW (lpString=".rar") returned 4
	[0081.313] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.313] lstrlenW (lpString=".bz2") returned 4
	[0081.313] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.313] lstrlenW (lpString=".7z") returned 3
	[0081.313] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.313] lstrlenW (lpString=".dbf") returned 4
	[0081.313] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.313] lstrlenW (lpString=".1cd") returned 4
	[0081.313] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0081.313] lstrlenW (lpString=".jpg") returned 4
	[0081.313] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.314] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0081.314] lstrlenW (lpString="dt_socket.dll") returned 13
	[0081.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.314] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=24640) returned 1
	[0081.314] CloseHandle (hObject=0x374) returned 1
	[0081.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20
	[0081.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.314] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.314] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.315] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0081.315] GetLastError () returned 0x0
	[0081.315] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x6040, lpOverlapped=0x0) returned 1
	[0081.317] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x6050, lpOverlapped=0x0) returned 1
	[0081.318] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.318] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xee, lpOverlapped=0x0) returned 1
	[0081.318] SetEndOfFile (hFile=0x370) returned 1
	[0081.318] CloseHandle (hObject=0x370) returned 1
	[0081.318] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.318] SetEndOfFile (hFile=0x374) returned 1
	[0081.319] CloseHandle (hObject=0x374) returned 1
	[0081.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.320] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 1
	[0081.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.320] lstrlenW (lpString=".doc") returned 4
	[0081.320] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.320] lstrlenW (lpString=".docx") returned 5
	[0081.320] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0081.320] lstrlenW (lpString=".pdf") returned 4
	[0081.320] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.320] lstrlenW (lpString=".xls") returned 4
	[0081.320] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.320] lstrlenW (lpString=".xlsx") returned 5
	[0081.320] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0081.320] lstrlenW (lpString=".ppt") returned 4
	[0081.320] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.320] lstrlenW (lpString=".zip") returned 4
	[0081.320] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.320] lstrlenW (lpString=".rar") returned 4
	[0081.320] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.321] lstrlenW (lpString=".bz2") returned 4
	[0081.321] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.321] lstrlenW (lpString=".7z") returned 3
	[0081.321] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.321] lstrlenW (lpString=".dbf") returned 4
	[0081.321] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.321] lstrlenW (lpString=".1cd") returned 4
	[0081.321] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.321] lstrlenW (lpString=".jpg") returned 4
	[0081.321] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.321] lstrlenW (lpString=".doc") returned 4
	[0081.321] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.321] lstrlenW (lpString=".docx") returned 5
	[0081.321] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0081.321] lstrlenW (lpString=".pdf") returned 4
	[0081.321] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.321] lstrlenW (lpString=".xls") returned 4
	[0081.321] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.321] lstrlenW (lpString=".xlsx") returned 5
	[0081.321] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0081.321] lstrlenW (lpString=".ppt") returned 4
	[0081.321] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.322] lstrlenW (lpString=".zip") returned 4
	[0081.322] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.322] lstrlenW (lpString=".rar") returned 4
	[0081.322] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.322] lstrlenW (lpString=".bz2") returned 4
	[0081.322] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.322] lstrlenW (lpString=".7z") returned 3
	[0081.322] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.322] lstrlenW (lpString=".dbf") returned 4
	[0081.322] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.322] lstrlenW (lpString=".1cd") returned 4
	[0081.322] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0081.322] lstrlenW (lpString=".jpg") returned 4
	[0081.322] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.322] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0081.322] lstrlenW (lpString="eula.dll") returned 8
	[0081.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.323] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=136256) returned 1
	[0081.323] CloseHandle (hObject=0x374) returned 1
	[0081.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20
	[0081.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.323] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0081.323] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.323] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.323] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0081.323] GetLastError () returned 0x0
	[0081.323] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x21440, lpOverlapped=0x0) returned 1
	[0081.327] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x21450, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x21450, lpOverlapped=0x0) returned 1
	[0081.329] ReadFile (in: hFile=0x374, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.329] WriteFile (in: hFile=0x370, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0081.329] SetEndOfFile (hFile=0x370) returned 1
	[0081.330] CloseHandle (hObject=0x370) returned 1
	[0081.330] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.330] SetEndOfFile (hFile=0x374) returned 1
	[0081.331] CloseHandle (hObject=0x374) returned 1
	[0081.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.331] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 1
	[0081.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.332] lstrlenW (lpString=".doc") returned 4
	[0081.332] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.332] lstrlenW (lpString=".docx") returned 5
	[0081.332] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0081.332] lstrlenW (lpString=".pdf") returned 4
	[0081.332] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.332] lstrlenW (lpString=".xls") returned 4
	[0081.332] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.332] lstrlenW (lpString=".xlsx") returned 5
	[0081.332] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0081.332] lstrlenW (lpString=".ppt") returned 4
	[0081.332] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.332] lstrlenW (lpString=".zip") returned 4
	[0081.332] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.332] lstrlenW (lpString=".rar") returned 4
	[0081.332] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.332] lstrlenW (lpString=".bz2") returned 4
	[0081.333] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.333] lstrlenW (lpString=".7z") returned 3
	[0081.333] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.333] lstrlenW (lpString=".dbf") returned 4
	[0081.333] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.333] lstrlenW (lpString=".1cd") returned 4
	[0081.333] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.333] lstrlenW (lpString=".jpg") returned 4
	[0081.333] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.333] lstrlenW (lpString=".doc") returned 4
	[0081.333] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.333] lstrlenW (lpString=".docx") returned 5
	[0081.333] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0081.333] lstrlenW (lpString=".pdf") returned 4
	[0081.333] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.333] lstrlenW (lpString=".xls") returned 4
	[0081.333] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.333] lstrlenW (lpString=".xlsx") returned 5
	[0081.333] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0081.333] lstrlenW (lpString=".ppt") returned 4
	[0081.333] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.333] lstrlenW (lpString=".zip") returned 4
	[0081.333] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.333] lstrlenW (lpString=".rar") returned 4
	[0081.334] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.334] lstrlenW (lpString=".bz2") returned 4
	[0081.334] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.334] lstrlenW (lpString=".7z") returned 3
	[0081.334] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.334] lstrlenW (lpString=".dbf") returned 4
	[0081.334] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.334] lstrlenW (lpString=".1cd") returned 4
	[0081.334] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0081.334] lstrlenW (lpString=".jpg") returned 4
	[0081.334] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.334] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0081.334] lstrlenW (lpString="fontmanager.dll") returned 15
	[0081.334] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0081.691] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=274496) returned 1
	[0081.692] CloseHandle (hObject=0x390) returned 1
	[0081.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20
	[0081.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0081.692] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0081.693] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.693] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.693] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0081.700] GetLastError () returned 0x0
	[0081.700] ReadFile (in: hFile=0x390, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x43040, lpOverlapped=0x0) returned 1
	[0081.706] WriteFile (in: hFile=0x350, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x43050, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x43050, lpOverlapped=0x0) returned 1
	[0081.768] ReadFile (in: hFile=0x390, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.768] WriteFile (in: hFile=0x350, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0081.768] SetEndOfFile (hFile=0x350) returned 1
	[0081.768] CloseHandle (hObject=0x350) returned 1
	[0081.768] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.769] SetEndOfFile (hFile=0x390) returned 1
	[0081.800] CloseHandle (hObject=0x390) returned 1
	[0081.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0081.800] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 1
	[0081.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0081.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0081.801] lstrlenW (lpString=".doc") returned 4
	[0081.801] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.801] lstrlenW (lpString=".docx") returned 5
	[0081.801] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0081.801] lstrlenW (lpString=".pdf") returned 4
	[0081.801] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.801] lstrlenW (lpString=".xls") returned 4
	[0082.204] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.204] lstrlenW (lpString=".xlsx") returned 5
	[0082.204] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0082.204] lstrlenW (lpString=".ppt") returned 4
	[0082.204] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0082.204] lstrlenW (lpString=".zip") returned 4
	[0082.204] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.204] lstrlenW (lpString=".rar") returned 4
	[0082.204] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.204] lstrlenW (lpString=".bz2") returned 4
	[0082.204] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.204] lstrlenW (lpString=".7z") returned 3
	[0082.204] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0082.204] lstrlenW (lpString=".dbf") returned 4
	[0082.204] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0082.205] lstrlenW (lpString=".1cd") returned 4
	[0082.205] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0082.205] lstrlenW (lpString=".jpg") returned 4
	[0082.205] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0082.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0082.205] lstrlenW (lpString=".doc") returned 4
	[0082.205] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.205] lstrlenW (lpString=".docx") returned 5
	[0082.205] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0082.205] lstrlenW (lpString=".pdf") returned 4
	[0082.205] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.205] lstrlenW (lpString=".xls") returned 4
	[0082.205] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.205] lstrlenW (lpString=".xlsx") returned 5
	[0082.205] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0082.205] lstrlenW (lpString=".ppt") returned 4
	[0082.205] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0082.205] lstrlenW (lpString=".zip") returned 4
	[0082.205] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.205] lstrlenW (lpString=".rar") returned 4
	[0082.205] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.206] lstrlenW (lpString=".bz2") returned 4
	[0082.206] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.206] lstrlenW (lpString=".7z") returned 3
	[0082.206] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0082.206] lstrlenW (lpString=".dbf") returned 4
	[0082.206] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0082.206] lstrlenW (lpString=".1cd") returned 4
	[0082.206] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0082.206] lstrlenW (lpString=".jpg") returned 4
	[0082.206] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.206] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0082.206] lstrlenW (lpString="hprof.dll") returned 9
	[0082.206] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.207] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=158272) returned 1
	[0082.207] CloseHandle (hObject=0x340) returned 1
	[0082.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20
	[0082.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.208] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.208] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.208] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.208] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0082.208] GetLastError () returned 0x0
	[0082.208] ReadFile (in: hFile=0x340, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x26a40, lpOverlapped=0x0) returned 1
	[0082.212] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x26a50, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x26a50, lpOverlapped=0x0) returned 1
	[0082.215] ReadFile (in: hFile=0x340, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.215] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0082.215] SetEndOfFile (hFile=0x318) returned 1
	[0082.215] CloseHandle (hObject=0x318) returned 1
	[0082.215] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.215] SetEndOfFile (hFile=0x340) returned 1
	[0082.217] CloseHandle (hObject=0x340) returned 1
	[0082.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.217] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 1
	[0082.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.217] lstrlenW (lpString=".doc") returned 4
	[0082.218] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.218] lstrlenW (lpString=".docx") returned 5
	[0082.218] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1
	[0082.218] lstrlenW (lpString=".pdf") returned 4
	[0082.218] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.218] lstrlenW (lpString=".xls") returned 4
	[0082.218] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.218] lstrlenW (lpString=".xlsx") returned 5
	[0082.218] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1
	[0082.218] lstrlenW (lpString=".ppt") returned 4
	[0082.218] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.218] lstrlenW (lpString=".zip") returned 4
	[0082.218] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.218] lstrlenW (lpString=".rar") returned 4
	[0082.218] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.218] lstrlenW (lpString=".bz2") returned 4
	[0082.218] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.218] lstrlenW (lpString=".7z") returned 3
	[0082.218] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.218] lstrlenW (lpString=".dbf") returned 4
	[0082.218] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.218] lstrlenW (lpString=".1cd") returned 4
	[0082.218] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.218] lstrlenW (lpString=".jpg") returned 4
	[0082.219] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.219] lstrlenW (lpString=".doc") returned 4
	[0082.219] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.219] lstrlenW (lpString=".docx") returned 5
	[0082.219] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1
	[0082.219] lstrlenW (lpString=".pdf") returned 4
	[0082.219] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.219] lstrlenW (lpString=".xls") returned 4
	[0082.219] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.219] lstrlenW (lpString=".xlsx") returned 5
	[0082.219] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1
	[0082.219] lstrlenW (lpString=".ppt") returned 4
	[0082.219] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.219] lstrlenW (lpString=".zip") returned 4
	[0082.219] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.219] lstrlenW (lpString=".rar") returned 4
	[0082.219] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.219] lstrlenW (lpString=".bz2") returned 4
	[0082.219] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.219] lstrlenW (lpString=".7z") returned 3
	[0082.219] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.219] lstrlenW (lpString=".dbf") returned 4
	[0082.219] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.219] lstrlenW (lpString=".1cd") returned 4
	[0082.219] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0082.220] lstrlenW (lpString=".jpg") returned 4
	[0082.220] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.220] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0082.220] lstrlenW (lpString="instrument.dll") returned 14
	[0082.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.220] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=123456) returned 1
	[0082.220] CloseHandle (hObject=0x340) returned 1
	[0082.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20
	[0082.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.221] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.221] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.221] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0082.221] GetLastError () returned 0x0
	[0082.221] ReadFile (in: hFile=0x340, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x1e240, lpOverlapped=0x0) returned 1
	[0082.224] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x1e250, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x1e250, lpOverlapped=0x0) returned 1
	[0082.226] ReadFile (in: hFile=0x340, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.226] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0082.227] SetEndOfFile (hFile=0x318) returned 1
	[0082.227] CloseHandle (hObject=0x318) returned 1
	[0082.227] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.227] SetEndOfFile (hFile=0x340) returned 1
	[0082.228] CloseHandle (hObject=0x340) returned 1
	[0082.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.229] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 1
	[0082.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.229] lstrlenW (lpString=".doc") returned 4
	[0082.229] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.229] lstrlenW (lpString=".docx") returned 5
	[0082.229] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0082.229] lstrlenW (lpString=".pdf") returned 4
	[0082.229] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.230] lstrlenW (lpString=".xls") returned 4
	[0082.230] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.230] lstrlenW (lpString=".xlsx") returned 5
	[0082.230] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0082.230] lstrlenW (lpString=".ppt") returned 4
	[0082.230] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.230] lstrlenW (lpString=".zip") returned 4
	[0082.230] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.230] lstrlenW (lpString=".rar") returned 4
	[0082.230] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.230] lstrlenW (lpString=".bz2") returned 4
	[0082.230] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.230] lstrlenW (lpString=".7z") returned 3
	[0082.230] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.230] lstrlenW (lpString=".dbf") returned 4
	[0082.230] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.230] lstrlenW (lpString=".1cd") returned 4
	[0082.231] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.231] lstrlenW (lpString=".jpg") returned 4
	[0082.231] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.231] lstrlenW (lpString=".doc") returned 4
	[0082.231] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.231] lstrlenW (lpString=".docx") returned 5
	[0082.231] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0082.231] lstrlenW (lpString=".pdf") returned 4
	[0082.231] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.231] lstrlenW (lpString=".xls") returned 4
	[0082.231] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.231] lstrlenW (lpString=".xlsx") returned 5
	[0082.231] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0082.231] lstrlenW (lpString=".ppt") returned 4
	[0082.231] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.231] lstrlenW (lpString=".zip") returned 4
	[0082.231] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.232] lstrlenW (lpString=".rar") returned 4
	[0082.232] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.232] lstrlenW (lpString=".bz2") returned 4
	[0082.232] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.232] lstrlenW (lpString=".7z") returned 3
	[0082.232] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.232] lstrlenW (lpString=".dbf") returned 4
	[0082.232] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.232] lstrlenW (lpString=".1cd") returned 4
	[0082.232] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0082.232] lstrlenW (lpString=".jpg") returned 4
	[0082.232] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.233] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0082.233] lstrlenW (lpString="j2pcsc.dll") returned 10
	[0082.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.234] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=19008) returned 1
	[0082.234] CloseHandle (hObject=0x340) returned 1
	[0082.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20
	[0082.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.234] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0082.234] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.234] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.234] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0082.234] GetLastError () returned 0x0
	[0082.234] ReadFile (in: hFile=0x340, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4a40, lpOverlapped=0x0) returned 1
	[0082.236] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4a50, lpOverlapped=0x0) returned 1
	[0082.237] ReadFile (in: hFile=0x340, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.237] WriteFile (in: hFile=0x318, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0082.237] SetEndOfFile (hFile=0x318) returned 1
	[0082.237] CloseHandle (hObject=0x318) returned 1
	[0082.237] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.237] SetEndOfFile (hFile=0x340) returned 1
	[0082.238] CloseHandle (hObject=0x340) returned 1
	[0082.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.601] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 1
	[0082.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.602] lstrlenW (lpString=".doc") returned 4
	[0082.602] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.602] lstrlenW (lpString=".docx") returned 5
	[0082.602] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0082.602] lstrlenW (lpString=".pdf") returned 4
	[0082.602] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.602] lstrlenW (lpString=".xls") returned 4
	[0082.602] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.602] lstrlenW (lpString=".xlsx") returned 5
	[0082.602] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0082.602] lstrlenW (lpString=".ppt") returned 4
	[0082.602] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.602] lstrlenW (lpString=".zip") returned 4
	[0082.602] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.602] lstrlenW (lpString=".rar") returned 4
	[0082.602] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.602] lstrlenW (lpString=".bz2") returned 4
	[0082.602] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.602] lstrlenW (lpString=".7z") returned 3
	[0082.602] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.603] lstrlenW (lpString=".dbf") returned 4
	[0082.603] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.603] lstrlenW (lpString=".1cd") returned 4
	[0082.603] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.603] lstrlenW (lpString=".jpg") returned 4
	[0082.603] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.603] lstrlenW (lpString=".doc") returned 4
	[0082.603] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.603] lstrlenW (lpString=".docx") returned 5
	[0082.603] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0082.603] lstrlenW (lpString=".pdf") returned 4
	[0082.603] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.603] lstrlenW (lpString=".xls") returned 4
	[0082.603] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.603] lstrlenW (lpString=".xlsx") returned 5
	[0082.603] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0082.603] lstrlenW (lpString=".ppt") returned 4
	[0082.603] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.604] lstrlenW (lpString=".zip") returned 4
	[0082.604] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.604] lstrlenW (lpString=".rar") returned 4
	[0082.604] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.604] lstrlenW (lpString=".bz2") returned 4
	[0082.604] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.604] lstrlenW (lpString=".7z") returned 3
	[0082.604] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.604] lstrlenW (lpString=".dbf") returned 4
	[0082.604] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.604] lstrlenW (lpString=".1cd") returned 4
	[0082.604] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0082.604] lstrlenW (lpString=".jpg") returned 4
	[0082.604] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.605] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0082.605] lstrlenW (lpString="javafx_font.dll") returned 15
	[0082.605] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.605] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=69184) returned 1
	[0082.605] CloseHandle (hObject=0x33c) returned 1
	[0082.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20
	[0082.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.606] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.606] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.606] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.606] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0082.606] GetLastError () returned 0x0
	[0082.606] ReadFile (in: hFile=0x33c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x10e40, lpOverlapped=0x0) returned 1
	[0082.609] WriteFile (in: hFile=0x344, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x10e50, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x10e50, lpOverlapped=0x0) returned 1
	[0082.611] ReadFile (in: hFile=0x33c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.611] WriteFile (in: hFile=0x344, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0082.611] SetEndOfFile (hFile=0x344) returned 1
	[0082.611] CloseHandle (hObject=0x344) returned 1
	[0082.611] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.611] SetEndOfFile (hFile=0x33c) returned 1
	[0082.612] CloseHandle (hObject=0x33c) returned 1
	[0082.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.613] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 1
	[0082.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.613] lstrlenW (lpString=".doc") returned 4
	[0082.613] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.613] lstrlenW (lpString=".docx") returned 5
	[0082.613] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0082.613] lstrlenW (lpString=".pdf") returned 4
	[0082.613] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.613] lstrlenW (lpString=".xls") returned 4
	[0082.613] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.613] lstrlenW (lpString=".xlsx") returned 5
	[0082.613] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0082.613] lstrlenW (lpString=".ppt") returned 4
	[0082.614] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.614] lstrlenW (lpString=".zip") returned 4
	[0082.614] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.614] lstrlenW (lpString=".rar") returned 4
	[0082.615] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.615] lstrlenW (lpString=".bz2") returned 4
	[0082.615] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.615] lstrlenW (lpString=".7z") returned 3
	[0082.615] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.615] lstrlenW (lpString=".dbf") returned 4
	[0082.615] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.615] lstrlenW (lpString=".1cd") returned 4
	[0082.615] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.615] lstrlenW (lpString=".jpg") returned 4
	[0082.615] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.615] lstrlenW (lpString=".doc") returned 4
	[0082.615] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.615] lstrlenW (lpString=".docx") returned 5
	[0082.615] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0082.615] lstrlenW (lpString=".pdf") returned 4
	[0082.615] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.615] lstrlenW (lpString=".xls") returned 4
	[0082.615] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.616] lstrlenW (lpString=".xlsx") returned 5
	[0082.616] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0082.616] lstrlenW (lpString=".ppt") returned 4
	[0082.616] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.616] lstrlenW (lpString=".zip") returned 4
	[0082.616] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.616] lstrlenW (lpString=".rar") returned 4
	[0082.616] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.616] lstrlenW (lpString=".bz2") returned 4
	[0082.616] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.616] lstrlenW (lpString=".7z") returned 3
	[0082.616] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.616] lstrlenW (lpString=".dbf") returned 4
	[0082.616] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.616] lstrlenW (lpString=".1cd") returned 4
	[0082.616] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0082.616] lstrlenW (lpString=".jpg") returned 4
	[0082.616] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.617] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0082.617] lstrlenW (lpString="javafx_font_t2k.dll") returned 19
	[0082.617] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.617] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=538176) returned 1
	[0082.617] CloseHandle (hObject=0x33c) returned 1
	[0082.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20
	[0082.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0082.617] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0082.617] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.618] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.618] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0082.618] GetLastError () returned 0x0
	[0082.618] ReadFile (in: hFile=0x33c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x83640, lpOverlapped=0x0) returned 1
	[0082.628] WriteFile (in: hFile=0x344, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x83650, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x83650, lpOverlapped=0x0) returned 1
	[0082.638] ReadFile (in: hFile=0x33c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.638] WriteFile (in: hFile=0x344, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0082.639] SetEndOfFile (hFile=0x344) returned 1
	[0082.639] CloseHandle (hObject=0x344) returned 1
	[0082.639] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.639] SetEndOfFile (hFile=0x33c) returned 1
	[0082.644] CloseHandle (hObject=0x33c) returned 1
	[0082.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0082.644] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 1
	[0082.644] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0082.644] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0082.644] lstrlenW (lpString=".doc") returned 4
	[0082.644] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.644] lstrlenW (lpString=".docx") returned 5
	[0082.645] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1
	[0083.058] lstrlenW (lpString=".pdf") returned 4
	[0083.058] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.058] lstrlenW (lpString=".xls") returned 4
	[0083.058] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.058] lstrlenW (lpString=".xlsx") returned 5
	[0083.058] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1
	[0083.058] lstrlenW (lpString=".ppt") returned 4
	[0083.058] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0083.058] lstrlenW (lpString=".zip") returned 4
	[0083.058] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.058] lstrlenW (lpString=".rar") returned 4
	[0083.059] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.059] lstrlenW (lpString=".bz2") returned 4
	[0083.059] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.059] lstrlenW (lpString=".7z") returned 3
	[0083.059] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0083.059] lstrlenW (lpString=".dbf") returned 4
	[0083.059] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0083.059] lstrlenW (lpString=".1cd") returned 4
	[0083.059] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0083.059] lstrlenW (lpString=".jpg") returned 4
	[0083.059] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0083.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0083.059] lstrlenW (lpString=".doc") returned 4
	[0083.059] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.059] lstrlenW (lpString=".docx") returned 5
	[0083.059] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1
	[0083.059] lstrlenW (lpString=".pdf") returned 4
	[0083.059] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.059] lstrlenW (lpString=".xls") returned 4
	[0083.059] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.059] lstrlenW (lpString=".xlsx") returned 5
	[0083.059] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1
	[0083.059] lstrlenW (lpString=".ppt") returned 4
	[0083.059] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0083.060] lstrlenW (lpString=".zip") returned 4
	[0083.060] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.060] lstrlenW (lpString=".rar") returned 4
	[0083.060] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.060] lstrlenW (lpString=".bz2") returned 4
	[0083.060] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.060] lstrlenW (lpString=".7z") returned 3
	[0083.060] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0083.060] lstrlenW (lpString=".dbf") returned 4
	[0083.060] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0083.060] lstrlenW (lpString=".1cd") returned 4
	[0083.060] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0083.060] lstrlenW (lpString=".jpg") returned 4
	[0083.060] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.060] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.060] lstrlenW (lpString="java_crw_demo.dll") returned 17
	[0083.060] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.176] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=29760) returned 1
	[0083.176] CloseHandle (hObject=0x314) returned 1
	[0083.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20
	[0083.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.177] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.177] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.177] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.177] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.177] GetLastError () returned 0x0
	[0083.177] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x7440, lpOverlapped=0x0) returned 1
	[0083.179] WriteFile (in: hFile=0x2d4, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x7450, lpOverlapped=0x0) returned 1
	[0083.180] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.181] WriteFile (in: hFile=0x2d4, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0083.181] SetEndOfFile (hFile=0x2d4) returned 1
	[0083.184] CloseHandle (hObject=0x2d4) returned 1
	[0083.184] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.184] SetEndOfFile (hFile=0x314) returned 1
	[0083.185] CloseHandle (hObject=0x314) returned 1
	[0083.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.185] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 1
	[0083.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.186] lstrlenW (lpString=".doc") returned 4
	[0083.186] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.186] lstrlenW (lpString=".docx") returned 5
	[0083.186] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0083.186] lstrlenW (lpString=".pdf") returned 4
	[0083.186] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.186] lstrlenW (lpString=".xls") returned 4
	[0083.186] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.186] lstrlenW (lpString=".xlsx") returned 5
	[0083.186] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0083.186] lstrlenW (lpString=".ppt") returned 4
	[0083.186] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.186] lstrlenW (lpString=".zip") returned 4
	[0083.186] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.186] lstrlenW (lpString=".rar") returned 4
	[0083.186] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.186] lstrlenW (lpString=".bz2") returned 4
	[0083.186] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.186] lstrlenW (lpString=".7z") returned 3
	[0083.186] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.186] lstrlenW (lpString=".dbf") returned 4
	[0083.186] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.186] lstrlenW (lpString=".1cd") returned 4
	[0083.186] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.187] lstrlenW (lpString=".jpg") returned 4
	[0083.187] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.187] lstrlenW (lpString=".doc") returned 4
	[0083.187] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.187] lstrlenW (lpString=".docx") returned 5
	[0083.187] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0083.187] lstrlenW (lpString=".pdf") returned 4
	[0083.187] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.187] lstrlenW (lpString=".xls") returned 4
	[0083.187] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.187] lstrlenW (lpString=".xlsx") returned 5
	[0083.187] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0083.187] lstrlenW (lpString=".ppt") returned 4
	[0083.187] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.187] lstrlenW (lpString=".zip") returned 4
	[0083.187] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.187] lstrlenW (lpString=".rar") returned 4
	[0083.187] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.187] lstrlenW (lpString=".bz2") returned 4
	[0083.187] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.187] lstrlenW (lpString=".7z") returned 3
	[0083.187] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.188] lstrlenW (lpString=".dbf") returned 4
	[0083.188] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.188] lstrlenW (lpString=".1cd") returned 4
	[0083.188] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0083.188] lstrlenW (lpString=".jpg") returned 4
	[0083.188] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.188] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0083.188] lstrlenW (lpString="jjs.exe") returned 7
	[0083.188] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.189] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=15936) returned 1
	[0083.189] CloseHandle (hObject=0x314) returned 1
	[0083.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20
	[0083.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.189] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.189] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.189] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.190] GetLastError () returned 0x0
	[0083.190] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x3e40, lpOverlapped=0x0) returned 1
	[0083.191] WriteFile (in: hFile=0x2d4, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x3e50, lpOverlapped=0x0) returned 1
	[0083.192] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.192] WriteFile (in: hFile=0x2d4, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0083.193] SetEndOfFile (hFile=0x2d4) returned 1
	[0083.193] CloseHandle (hObject=0x2d4) returned 1
	[0083.193] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.193] SetEndOfFile (hFile=0x314) returned 1
	[0083.194] CloseHandle (hObject=0x314) returned 1
	[0083.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.194] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 1
	[0083.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.194] lstrlenW (lpString=".doc") returned 4
	[0083.194] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.194] lstrlenW (lpString=".docx") returned 5
	[0083.194] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0083.194] lstrlenW (lpString=".pdf") returned 4
	[0083.194] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.194] lstrlenW (lpString=".xls") returned 4
	[0083.194] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.195] lstrlenW (lpString=".xlsx") returned 5
	[0083.195] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0083.195] lstrlenW (lpString=".ppt") returned 4
	[0083.195] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.195] lstrlenW (lpString=".zip") returned 4
	[0083.195] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.195] lstrlenW (lpString=".rar") returned 4
	[0083.195] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.195] lstrlenW (lpString=".bz2") returned 4
	[0083.195] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.195] lstrlenW (lpString=".7z") returned 3
	[0083.195] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.195] lstrlenW (lpString=".dbf") returned 4
	[0083.195] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.195] lstrlenW (lpString=".1cd") returned 4
	[0083.195] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.195] lstrlenW (lpString=".jpg") returned 4
	[0083.195] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.195] lstrlenW (lpString=".doc") returned 4
	[0083.195] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.195] lstrlenW (lpString=".docx") returned 5
	[0083.195] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0083.196] lstrlenW (lpString=".pdf") returned 4
	[0083.196] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.196] lstrlenW (lpString=".xls") returned 4
	[0083.196] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.196] lstrlenW (lpString=".xlsx") returned 5
	[0083.196] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0083.196] lstrlenW (lpString=".ppt") returned 4
	[0083.196] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.196] lstrlenW (lpString=".zip") returned 4
	[0083.196] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.196] lstrlenW (lpString=".rar") returned 4
	[0083.196] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.196] lstrlenW (lpString=".bz2") returned 4
	[0083.196] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.196] lstrlenW (lpString=".7z") returned 3
	[0083.196] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.196] lstrlenW (lpString=".dbf") returned 4
	[0083.196] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.196] lstrlenW (lpString=".1cd") returned 4
	[0083.196] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0083.196] lstrlenW (lpString=".jpg") returned 4
	[0083.196] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.197] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.197] lstrlenW (lpString="jli.dll") returned 7
	[0083.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.197] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=174656) returned 1
	[0083.197] CloseHandle (hObject=0x314) returned 1
	[0083.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20
	[0083.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0083.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0083.197] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.197] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0083.210] GetLastError () returned 0x0
	[0083.210] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x2aa40, lpOverlapped=0x0) returned 1
	[0083.214] WriteFile (in: hFile=0x2d4, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x2aa50, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x2aa50, lpOverlapped=0x0) returned 1
	[0083.217] ReadFile (in: hFile=0x314, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.217] WriteFile (in: hFile=0x2d4, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0083.217] SetEndOfFile (hFile=0x2d4) returned 1
	[0083.218] CloseHandle (hObject=0x2d4) returned 1
	[0083.218] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.218] SetEndOfFile (hFile=0x314) returned 1
	[0083.219] CloseHandle (hObject=0x314) returned 1
	[0083.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0083.220] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 1
	[0083.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.220] lstrlenW (lpString=".doc") returned 4
	[0083.220] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.220] lstrlenW (lpString=".docx") returned 5
	[0083.220] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0083.220] lstrlenW (lpString=".pdf") returned 4
	[0083.220] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.220] lstrlenW (lpString=".xls") returned 4
	[0083.220] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.220] lstrlenW (lpString=".xlsx") returned 5
	[0083.221] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0083.221] lstrlenW (lpString=".ppt") returned 4
	[0083.221] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.221] lstrlenW (lpString=".zip") returned 4
	[0083.221] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.221] lstrlenW (lpString=".rar") returned 4
	[0083.221] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.221] lstrlenW (lpString=".bz2") returned 4
	[0083.221] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.221] lstrlenW (lpString=".7z") returned 3
	[0083.221] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.221] lstrlenW (lpString=".dbf") returned 4
	[0083.221] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.221] lstrlenW (lpString=".1cd") returned 4
	[0083.221] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.221] lstrlenW (lpString=".jpg") returned 4
	[0083.221] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.221] lstrlenW (lpString=".doc") returned 4
	[0083.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.222] lstrlenW (lpString=".docx") returned 5
	[0083.222] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0083.222] lstrlenW (lpString=".pdf") returned 4
	[0083.222] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.222] lstrlenW (lpString=".xls") returned 4
	[0083.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.222] lstrlenW (lpString=".xlsx") returned 5
	[0083.222] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0083.222] lstrlenW (lpString=".ppt") returned 4
	[0083.222] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.222] lstrlenW (lpString=".zip") returned 4
	[0083.222] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.222] lstrlenW (lpString=".rar") returned 4
	[0083.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.222] lstrlenW (lpString=".bz2") returned 4
	[0083.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.222] lstrlenW (lpString=".7z") returned 3
	[0083.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.222] lstrlenW (lpString=".dbf") returned 4
	[0083.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.222] lstrlenW (lpString=".1cd") returned 4
	[0083.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0083.222] lstrlenW (lpString=".jpg") returned 4
	[0083.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.223] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0083.223] lstrlenW (lpString="jp2iexp.dll") returned 11
	[0083.492] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.621] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=296000) returned 1
	[0084.621] CloseHandle (hObject=0x37c) returned 1
	[0084.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20
	[0084.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.621] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.621] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.621] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.622] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.622] GetLastError () returned 0x0
	[0084.622] ReadFile (in: hFile=0x37c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x48440, lpOverlapped=0x0) returned 1
	[0084.628] WriteFile (in: hFile=0x384, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x48450, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x48450, lpOverlapped=0x0) returned 1
	[0084.635] ReadFile (in: hFile=0x37c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.635] WriteFile (in: hFile=0x384, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xea, lpOverlapped=0x0) returned 1
	[0084.635] SetEndOfFile (hFile=0x384) returned 1
	[0084.635] CloseHandle (hObject=0x384) returned 1
	[0084.635] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.635] SetEndOfFile (hFile=0x37c) returned 1
	[0084.638] CloseHandle (hObject=0x37c) returned 1
	[0084.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0084.639] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 1
	[0084.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.639] lstrlenW (lpString=".doc") returned 4
	[0084.639] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.639] lstrlenW (lpString=".docx") returned 5
	[0084.639] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0084.639] lstrlenW (lpString=".pdf") returned 4
	[0084.639] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.639] lstrlenW (lpString=".xls") returned 4
	[0084.639] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.639] lstrlenW (lpString=".xlsx") returned 5
	[0084.639] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0084.639] lstrlenW (lpString=".ppt") returned 4
	[0084.639] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.639] lstrlenW (lpString=".zip") returned 4
	[0084.639] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.639] lstrlenW (lpString=".rar") returned 4
	[0084.639] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.640] lstrlenW (lpString=".bz2") returned 4
	[0084.640] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.640] lstrlenW (lpString=".7z") returned 3
	[0084.640] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.640] lstrlenW (lpString=".dbf") returned 4
	[0084.640] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.640] lstrlenW (lpString=".1cd") returned 4
	[0084.640] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.640] lstrlenW (lpString=".jpg") returned 4
	[0084.640] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.640] lstrlenW (lpString=".doc") returned 4
	[0084.640] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.640] lstrlenW (lpString=".docx") returned 5
	[0084.640] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0084.640] lstrlenW (lpString=".pdf") returned 4
	[0084.640] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.640] lstrlenW (lpString=".xls") returned 4
	[0084.640] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.640] lstrlenW (lpString=".xlsx") returned 5
	[0084.640] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0084.641] lstrlenW (lpString=".ppt") returned 4
	[0084.641] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.641] lstrlenW (lpString=".zip") returned 4
	[0084.641] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.641] lstrlenW (lpString=".rar") returned 4
	[0084.641] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.641] lstrlenW (lpString=".bz2") returned 4
	[0084.641] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.641] lstrlenW (lpString=".7z") returned 3
	[0084.641] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.641] lstrlenW (lpString=".dbf") returned 4
	[0084.641] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.641] lstrlenW (lpString=".1cd") returned 4
	[0084.641] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0084.641] lstrlenW (lpString=".jpg") returned 4
	[0084.641] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.641] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0084.641] lstrlenW (lpString="keytool.exe") returned 11
	[0084.642] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.642] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=16448) returned 1
	[0084.642] CloseHandle (hObject=0x37c) returned 1
	[0084.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20
	[0084.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.643] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.643] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.643] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.643] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.643] GetLastError () returned 0x0
	[0084.643] ReadFile (in: hFile=0x37c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0084.645] WriteFile (in: hFile=0x384, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0084.646] ReadFile (in: hFile=0x37c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.646] WriteFile (in: hFile=0x384, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xea, lpOverlapped=0x0) returned 1
	[0084.646] SetEndOfFile (hFile=0x384) returned 1
	[0084.646] CloseHandle (hObject=0x384) returned 1
	[0084.646] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.647] SetEndOfFile (hFile=0x37c) returned 1
	[0084.647] CloseHandle (hObject=0x37c) returned 1
	[0084.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0084.648] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 1
	[0084.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.648] lstrlenW (lpString=".doc") returned 4
	[0084.648] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0084.649] lstrlenW (lpString=".docx") returned 5
	[0084.649] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0084.649] lstrlenW (lpString=".pdf") returned 4
	[0084.649] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0084.649] lstrlenW (lpString=".xls") returned 4
	[0084.649] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0084.649] lstrlenW (lpString=".xlsx") returned 5
	[0084.649] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0084.649] lstrlenW (lpString=".ppt") returned 4
	[0084.649] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0084.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.649] lstrlenW (lpString=".zip") returned 4
	[0084.649] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0084.649] lstrlenW (lpString=".rar") returned 4
	[0084.649] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0084.649] lstrlenW (lpString=".bz2") returned 4
	[0084.649] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0084.649] lstrlenW (lpString=".7z") returned 3
	[0084.649] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0084.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.649] lstrlenW (lpString=".dbf") returned 4
	[0084.649] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0084.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.649] lstrlenW (lpString=".1cd") returned 4
	[0084.649] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0084.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.649] lstrlenW (lpString=".jpg") returned 4
	[0084.649] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0084.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.650] lstrlenW (lpString=".doc") returned 4
	[0084.650] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0084.650] lstrlenW (lpString=".docx") returned 5
	[0084.650] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0084.650] lstrlenW (lpString=".pdf") returned 4
	[0084.650] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0084.650] lstrlenW (lpString=".xls") returned 4
	[0084.650] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0084.650] lstrlenW (lpString=".xlsx") returned 5
	[0084.650] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0084.650] lstrlenW (lpString=".ppt") returned 4
	[0084.650] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0084.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.650] lstrlenW (lpString=".zip") returned 4
	[0084.650] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0084.650] lstrlenW (lpString=".rar") returned 4
	[0084.650] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0084.650] lstrlenW (lpString=".bz2") returned 4
	[0084.650] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0084.650] lstrlenW (lpString=".7z") returned 3
	[0084.650] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0084.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.650] lstrlenW (lpString=".dbf") returned 4
	[0084.650] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0084.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.651] lstrlenW (lpString=".1cd") returned 4
	[0084.651] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0084.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0084.651] lstrlenW (lpString=".jpg") returned 4
	[0084.651] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0084.651] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0084.651] lstrlenW (lpString="kinit.exe") returned 9
	[0084.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.651] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=16448) returned 1
	[0084.651] CloseHandle (hObject=0x37c) returned 1
	[0084.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20
	[0084.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.652] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.652] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.652] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.652] GetLastError () returned 0x0
	[0084.652] ReadFile (in: hFile=0x37c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0084.654] WriteFile (in: hFile=0x384, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0084.655] ReadFile (in: hFile=0x37c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.655] WriteFile (in: hFile=0x384, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0084.655] SetEndOfFile (hFile=0x384) returned 1
	[0084.655] CloseHandle (hObject=0x384) returned 1
	[0084.655] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.655] SetEndOfFile (hFile=0x37c) returned 1
	[0084.656] CloseHandle (hObject=0x37c) returned 1
	[0084.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0084.656] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 1
	[0084.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.657] lstrlenW (lpString=".doc") returned 4
	[0084.657] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0084.657] lstrlenW (lpString=".docx") returned 5
	[0084.657] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0084.657] lstrlenW (lpString=".pdf") returned 4
	[0084.657] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0084.657] lstrlenW (lpString=".xls") returned 4
	[0084.657] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0084.657] lstrlenW (lpString=".xlsx") returned 5
	[0084.657] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0084.657] lstrlenW (lpString=".ppt") returned 4
	[0084.657] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0084.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.657] lstrlenW (lpString=".zip") returned 4
	[0084.657] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0084.657] lstrlenW (lpString=".rar") returned 4
	[0084.657] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0084.657] lstrlenW (lpString=".bz2") returned 4
	[0084.657] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0084.657] lstrlenW (lpString=".7z") returned 3
	[0084.657] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0084.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.657] lstrlenW (lpString=".dbf") returned 4
	[0084.657] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0084.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.657] lstrlenW (lpString=".1cd") returned 4
	[0084.657] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0084.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.658] lstrlenW (lpString=".jpg") returned 4
	[0084.658] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0084.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.658] lstrlenW (lpString=".doc") returned 4
	[0084.658] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0084.658] lstrlenW (lpString=".docx") returned 5
	[0084.658] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0084.658] lstrlenW (lpString=".pdf") returned 4
	[0084.658] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0084.658] lstrlenW (lpString=".xls") returned 4
	[0084.658] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0084.658] lstrlenW (lpString=".xlsx") returned 5
	[0084.658] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0084.658] lstrlenW (lpString=".ppt") returned 4
	[0084.658] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0084.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.658] lstrlenW (lpString=".zip") returned 4
	[0084.658] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0084.658] lstrlenW (lpString=".rar") returned 4
	[0084.658] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0084.658] lstrlenW (lpString=".bz2") returned 4
	[0084.658] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0084.658] lstrlenW (lpString=".7z") returned 3
	[0084.658] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0084.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.658] lstrlenW (lpString=".dbf") returned 4
	[0084.658] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0084.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.659] lstrlenW (lpString=".1cd") returned 4
	[0084.659] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0084.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0084.659] lstrlenW (lpString=".jpg") returned 4
	[0084.659] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0084.659] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0084.659] lstrlenW (lpString="klist.exe") returned 9
	[0084.659] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.659] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=16448) returned 1
	[0084.659] CloseHandle (hObject=0x37c) returned 1
	[0084.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20
	[0084.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0084.659] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.660] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.660] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.660] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.660] GetLastError () returned 0x0
	[0084.660] ReadFile (in: hFile=0x37c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0085.134] WriteFile (in: hFile=0x384, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0085.135] ReadFile (in: hFile=0x37c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.135] WriteFile (in: hFile=0x384, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0085.135] SetEndOfFile (hFile=0x384) returned 1
	[0085.135] CloseHandle (hObject=0x384) returned 1
	[0085.135] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.135] SetEndOfFile (hFile=0x37c) returned 1
	[0085.136] CloseHandle (hObject=0x37c) returned 1
	[0085.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.137] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 1
	[0085.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.137] lstrlenW (lpString=".doc") returned 4
	[0085.137] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0085.137] lstrlenW (lpString=".docx") returned 5
	[0085.137] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0085.137] lstrlenW (lpString=".pdf") returned 4
	[0085.137] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0085.137] lstrlenW (lpString=".xls") returned 4
	[0085.137] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0085.137] lstrlenW (lpString=".xlsx") returned 5
	[0085.137] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0085.137] lstrlenW (lpString=".ppt") returned 4
	[0085.137] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0085.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.137] lstrlenW (lpString=".zip") returned 4
	[0085.137] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0085.137] lstrlenW (lpString=".rar") returned 4
	[0085.137] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0085.138] lstrlenW (lpString=".bz2") returned 4
	[0085.138] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0085.138] lstrlenW (lpString=".7z") returned 3
	[0085.138] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0085.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.138] lstrlenW (lpString=".dbf") returned 4
	[0085.138] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0085.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.138] lstrlenW (lpString=".1cd") returned 4
	[0085.138] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0085.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.138] lstrlenW (lpString=".jpg") returned 4
	[0085.138] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0085.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.138] lstrlenW (lpString=".doc") returned 4
	[0085.138] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0085.138] lstrlenW (lpString=".docx") returned 5
	[0085.138] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0085.138] lstrlenW (lpString=".pdf") returned 4
	[0085.138] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0085.138] lstrlenW (lpString=".xls") returned 4
	[0085.138] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0085.138] lstrlenW (lpString=".xlsx") returned 5
	[0085.139] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0085.139] lstrlenW (lpString=".ppt") returned 4
	[0085.139] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0085.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.139] lstrlenW (lpString=".zip") returned 4
	[0085.139] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0085.139] lstrlenW (lpString=".rar") returned 4
	[0085.139] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0085.139] lstrlenW (lpString=".bz2") returned 4
	[0085.139] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0085.139] lstrlenW (lpString=".7z") returned 3
	[0085.139] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0085.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.139] lstrlenW (lpString=".dbf") returned 4
	[0085.139] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0085.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.139] lstrlenW (lpString=".1cd") returned 4
	[0085.139] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0085.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0085.139] lstrlenW (lpString=".jpg") returned 4
	[0085.139] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0085.140] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0085.140] lstrlenW (lpString="msvcr100.dll") returned 12
	[0085.140] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.140] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=829264) returned 1
	[0085.140] CloseHandle (hObject=0x37c) returned 1
	[0085.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20
	[0085.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.140] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.140] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.141] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.141] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0085.141] GetLastError () returned 0x0
	[0085.141] ReadFile (in: hFile=0x37c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0xca750, lpOverlapped=0x0) returned 1
	[0085.158] WriteFile (in: hFile=0x384, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xca760, lpOverlapped=0x0) returned 1
	[0085.172] ReadFile (in: hFile=0x37c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.172] WriteFile (in: hFile=0x384, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.172] SetEndOfFile (hFile=0x384) returned 1
	[0085.172] CloseHandle (hObject=0x384) returned 1
	[0085.172] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.172] SetEndOfFile (hFile=0x37c) returned 1
	[0085.179] CloseHandle (hObject=0x37c) returned 1
	[0085.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.179] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1
	[0085.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.474] lstrlenW (lpString=".doc") returned 4
	[0085.474] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.474] lstrlenW (lpString=".docx") returned 5
	[0085.474] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0085.474] lstrlenW (lpString=".pdf") returned 4
	[0085.474] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.474] lstrlenW (lpString=".xls") returned 4
	[0085.474] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.474] lstrlenW (lpString=".xlsx") returned 5
	[0085.474] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0085.474] lstrlenW (lpString=".ppt") returned 4
	[0085.474] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.474] lstrlenW (lpString=".zip") returned 4
	[0085.474] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.474] lstrlenW (lpString=".rar") returned 4
	[0085.474] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.474] lstrlenW (lpString=".bz2") returned 4
	[0085.475] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.475] lstrlenW (lpString=".7z") returned 3
	[0085.475] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.475] lstrlenW (lpString=".dbf") returned 4
	[0085.475] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.475] lstrlenW (lpString=".1cd") returned 4
	[0085.475] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.475] lstrlenW (lpString=".jpg") returned 4
	[0085.475] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.475] lstrlenW (lpString=".doc") returned 4
	[0085.475] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.475] lstrlenW (lpString=".docx") returned 5
	[0085.475] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0085.475] lstrlenW (lpString=".pdf") returned 4
	[0085.475] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.475] lstrlenW (lpString=".xls") returned 4
	[0085.475] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.475] lstrlenW (lpString=".xlsx") returned 5
	[0085.475] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0085.475] lstrlenW (lpString=".ppt") returned 4
	[0085.476] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.476] lstrlenW (lpString=".zip") returned 4
	[0085.476] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.476] lstrlenW (lpString=".rar") returned 4
	[0085.476] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.476] lstrlenW (lpString=".bz2") returned 4
	[0085.476] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.476] lstrlenW (lpString=".7z") returned 3
	[0085.476] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.476] lstrlenW (lpString=".dbf") returned 4
	[0085.476] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.476] lstrlenW (lpString=".1cd") returned 4
	[0085.476] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0085.476] lstrlenW (lpString=".jpg") returned 4
	[0085.476] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.476] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0085.476] lstrlenW (lpString="pack200.exe") returned 11
	[0085.477] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0085.810] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=16448) returned 1
	[0085.810] CloseHandle (hObject=0x354) returned 1
	[0085.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20
	[0085.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.820] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0085.820] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.820] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.820] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4
	[0085.820] GetLastError () returned 0x0
	[0085.820] ReadFile (in: hFile=0x34c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0085.822] WriteFile (in: hFile=0x2d4, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0085.823] ReadFile (in: hFile=0x34c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.823] WriteFile (in: hFile=0x2d4, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xea, lpOverlapped=0x0) returned 1
	[0085.823] SetEndOfFile (hFile=0x2d4) returned 1
	[0085.824] CloseHandle (hObject=0x2d4) returned 1
	[0085.824] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.824] SetEndOfFile (hFile=0x34c) returned 1
	[0085.825] CloseHandle (hObject=0x34c) returned 1
	[0085.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0085.825] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 1
	[0085.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.825] lstrlenW (lpString=".doc") returned 4
	[0085.825] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0085.825] lstrlenW (lpString=".docx") returned 5
	[0085.825] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0085.825] lstrlenW (lpString=".pdf") returned 4
	[0085.825] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0085.825] lstrlenW (lpString=".xls") returned 4
	[0085.825] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0085.825] lstrlenW (lpString=".xlsx") returned 5
	[0085.825] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0085.825] lstrlenW (lpString=".ppt") returned 4
	[0085.825] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0085.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.826] lstrlenW (lpString=".zip") returned 4
	[0085.826] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0085.826] lstrlenW (lpString=".rar") returned 4
	[0085.826] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0085.826] lstrlenW (lpString=".bz2") returned 4
	[0085.826] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0085.826] lstrlenW (lpString=".7z") returned 3
	[0085.826] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0085.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.826] lstrlenW (lpString=".dbf") returned 4
	[0085.826] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0085.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.826] lstrlenW (lpString=".1cd") returned 4
	[0085.826] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0085.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.826] lstrlenW (lpString=".jpg") returned 4
	[0085.826] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0085.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.826] lstrlenW (lpString=".doc") returned 4
	[0085.826] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0085.826] lstrlenW (lpString=".docx") returned 5
	[0085.826] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0085.826] lstrlenW (lpString=".pdf") returned 4
	[0085.826] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0085.827] lstrlenW (lpString=".xls") returned 4
	[0085.827] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0085.827] lstrlenW (lpString=".xlsx") returned 5
	[0085.827] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0085.827] lstrlenW (lpString=".ppt") returned 4
	[0085.827] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0085.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.827] lstrlenW (lpString=".zip") returned 4
	[0085.827] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0085.827] lstrlenW (lpString=".rar") returned 4
	[0085.827] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0085.827] lstrlenW (lpString=".bz2") returned 4
	[0085.827] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0085.827] lstrlenW (lpString=".7z") returned 3
	[0085.827] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0085.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.827] lstrlenW (lpString=".dbf") returned 4
	[0085.827] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0085.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.827] lstrlenW (lpString=".1cd") returned 4
	[0085.827] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0085.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0085.827] lstrlenW (lpString=".jpg") returned 4
	[0085.827] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0085.828] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0085.828] lstrlenW (lpString="resource.dll") returned 12
	[0085.828] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0085.828] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=15424) returned 1
	[0085.828] CloseHandle (hObject=0x34c) returned 1
	[0085.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20
	[0085.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0085.828] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0085.828] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.828] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.828] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.265] GetLastError () returned 0x0
	[0086.265] ReadFile (in: hFile=0x34c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x3c40, lpOverlapped=0x0) returned 1
	[0086.266] WriteFile (in: hFile=0x390, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x3c50, lpOverlapped=0x0) returned 1
	[0086.267] ReadFile (in: hFile=0x34c, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.267] WriteFile (in: hFile=0x390, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.267] SetEndOfFile (hFile=0x390) returned 1
	[0086.268] CloseHandle (hObject=0x390) returned 1
	[0086.268] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.268] SetEndOfFile (hFile=0x34c) returned 1
	[0086.269] CloseHandle (hObject=0x34c) returned 1
	[0086.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0086.269] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 1
	[0086.269] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.269] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.269] lstrlenW (lpString=".doc") returned 4
	[0086.269] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.269] lstrlenW (lpString=".docx") returned 5
	[0086.269] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0086.269] lstrlenW (lpString=".pdf") returned 4
	[0086.269] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.269] lstrlenW (lpString=".xls") returned 4
	[0086.269] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.270] lstrlenW (lpString=".xlsx") returned 5
	[0086.270] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0086.270] lstrlenW (lpString=".ppt") returned 4
	[0086.270] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.270] lstrlenW (lpString=".zip") returned 4
	[0086.270] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.270] lstrlenW (lpString=".rar") returned 4
	[0086.270] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.270] lstrlenW (lpString=".bz2") returned 4
	[0086.270] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.270] lstrlenW (lpString=".7z") returned 3
	[0086.270] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.270] lstrlenW (lpString=".dbf") returned 4
	[0086.270] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.270] lstrlenW (lpString=".1cd") returned 4
	[0086.270] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.270] lstrlenW (lpString=".jpg") returned 4
	[0086.270] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.271] lstrlenW (lpString=".doc") returned 4
	[0086.271] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.271] lstrlenW (lpString=".docx") returned 5
	[0086.271] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0086.271] lstrlenW (lpString=".pdf") returned 4
	[0086.271] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.271] lstrlenW (lpString=".xls") returned 4
	[0086.271] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.271] lstrlenW (lpString=".xlsx") returned 5
	[0086.271] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0086.271] lstrlenW (lpString=".ppt") returned 4
	[0086.271] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.271] lstrlenW (lpString=".zip") returned 4
	[0086.271] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.271] lstrlenW (lpString=".rar") returned 4
	[0086.271] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.271] lstrlenW (lpString=".bz2") returned 4
	[0086.271] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.271] lstrlenW (lpString=".7z") returned 3
	[0086.271] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.271] lstrlenW (lpString=".dbf") returned 4
	[0086.271] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.271] lstrlenW (lpString=".1cd") returned 4
	[0086.272] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51
	[0086.272] lstrlenW (lpString=".jpg") returned 4
	[0086.272] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.272] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0086.272] lstrlenW (lpString="rmid.exe") returned 8
	[0086.272] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0086.272] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=15936) returned 1
	[0086.272] CloseHandle (hObject=0x34c) returned 1
	[0086.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20
	[0086.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.543] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0086.543] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.543] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.543] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0086.544] GetLastError () returned 0x0
	[0086.544] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x3e40, lpOverlapped=0x0) returned 1
	[0086.555] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x3e50, lpOverlapped=0x0) returned 1
	[0086.556] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.556] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0086.556] SetEndOfFile (hFile=0x314) returned 1
	[0086.556] CloseHandle (hObject=0x314) returned 1
	[0086.556] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.556] SetEndOfFile (hFile=0x368) returned 1
	[0086.557] CloseHandle (hObject=0x368) returned 1
	[0086.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0086.557] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 1
	[0086.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.558] lstrlenW (lpString=".doc") returned 4
	[0086.558] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.558] lstrlenW (lpString=".docx") returned 5
	[0086.558] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1
	[0086.558] lstrlenW (lpString=".pdf") returned 4
	[0086.558] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.558] lstrlenW (lpString=".xls") returned 4
	[0086.558] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.558] lstrlenW (lpString=".xlsx") returned 5
	[0086.558] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1
	[0086.558] lstrlenW (lpString=".ppt") returned 4
	[0086.558] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.558] lstrlenW (lpString=".zip") returned 4
	[0086.558] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.558] lstrlenW (lpString=".rar") returned 4
	[0086.558] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.558] lstrlenW (lpString=".bz2") returned 4
	[0086.558] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.558] lstrlenW (lpString=".7z") returned 3
	[0086.558] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.559] lstrlenW (lpString=".dbf") returned 4
	[0086.559] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.559] lstrlenW (lpString=".1cd") returned 4
	[0086.559] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.559] lstrlenW (lpString=".jpg") returned 4
	[0086.559] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.559] lstrlenW (lpString=".doc") returned 4
	[0086.559] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.559] lstrlenW (lpString=".docx") returned 5
	[0086.559] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1
	[0086.559] lstrlenW (lpString=".pdf") returned 4
	[0086.559] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.559] lstrlenW (lpString=".xls") returned 4
	[0086.559] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.559] lstrlenW (lpString=".xlsx") returned 5
	[0086.559] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1
	[0086.559] lstrlenW (lpString=".ppt") returned 4
	[0086.559] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.559] lstrlenW (lpString=".zip") returned 4
	[0086.559] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.559] lstrlenW (lpString=".rar") returned 4
	[0086.559] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.560] lstrlenW (lpString=".bz2") returned 4
	[0086.560] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.560] lstrlenW (lpString=".7z") returned 3
	[0086.560] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.560] lstrlenW (lpString=".dbf") returned 4
	[0086.560] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.560] lstrlenW (lpString=".1cd") returned 4
	[0086.560] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47
	[0086.560] lstrlenW (lpString=".jpg") returned 4
	[0086.560] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.560] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0086.560] lstrlenW (lpString="servertool.exe") returned 14
	[0086.560] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0086.575] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=16448) returned 1
	[0086.575] CloseHandle (hObject=0x368) returned 1
	[0086.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20
	[0086.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.575] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0086.575] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.575] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.575] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0086.576] GetLastError () returned 0x0
	[0086.576] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0086.588] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0086.589] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.590] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0086.590] SetEndOfFile (hFile=0x314) returned 1
	[0086.590] CloseHandle (hObject=0x314) returned 1
	[0086.590] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.590] SetEndOfFile (hFile=0x368) returned 1
	[0086.591] CloseHandle (hObject=0x368) returned 1
	[0086.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0086.591] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 1
	[0086.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.591] lstrlenW (lpString=".doc") returned 4
	[0086.591] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.591] lstrlenW (lpString=".docx") returned 5
	[0086.591] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0086.592] lstrlenW (lpString=".pdf") returned 4
	[0086.592] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.592] lstrlenW (lpString=".xls") returned 4
	[0086.592] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.592] lstrlenW (lpString=".xlsx") returned 5
	[0086.592] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0086.592] lstrlenW (lpString=".ppt") returned 4
	[0086.592] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.592] lstrlenW (lpString=".zip") returned 4
	[0086.592] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.592] lstrlenW (lpString=".rar") returned 4
	[0086.592] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.592] lstrlenW (lpString=".bz2") returned 4
	[0086.592] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.592] lstrlenW (lpString=".7z") returned 3
	[0086.592] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.592] lstrlenW (lpString=".dbf") returned 4
	[0086.592] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.592] lstrlenW (lpString=".1cd") returned 4
	[0086.592] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.592] lstrlenW (lpString=".jpg") returned 4
	[0086.592] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.593] lstrlenW (lpString=".doc") returned 4
	[0086.593] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.593] lstrlenW (lpString=".docx") returned 5
	[0086.593] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0086.593] lstrlenW (lpString=".pdf") returned 4
	[0086.593] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.593] lstrlenW (lpString=".xls") returned 4
	[0086.593] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.593] lstrlenW (lpString=".xlsx") returned 5
	[0086.593] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0086.593] lstrlenW (lpString=".ppt") returned 4
	[0086.593] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.593] lstrlenW (lpString=".zip") returned 4
	[0086.593] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.593] lstrlenW (lpString=".rar") returned 4
	[0086.593] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.593] lstrlenW (lpString=".bz2") returned 4
	[0086.593] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.593] lstrlenW (lpString=".7z") returned 3
	[0086.593] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.594] lstrlenW (lpString=".dbf") returned 4
	[0086.594] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.594] lstrlenW (lpString=".1cd") returned 4
	[0086.594] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0086.594] lstrlenW (lpString=".jpg") returned 4
	[0086.594] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.594] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0086.594] lstrlenW (lpString="splashscreen.dll") returned 16
	[0086.594] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0086.594] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=204864) returned 1
	[0086.594] CloseHandle (hObject=0x368) returned 1
	[0086.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20
	[0086.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.595] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0086.595] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.595] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.595] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0086.595] GetLastError () returned 0x0
	[0086.595] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x32040, lpOverlapped=0x0) returned 1
	[0086.601] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x32050, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x32050, lpOverlapped=0x0) returned 1
	[0086.605] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.605] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0086.605] SetEndOfFile (hFile=0x314) returned 1
	[0086.605] CloseHandle (hObject=0x314) returned 1
	[0086.605] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.605] SetEndOfFile (hFile=0x368) returned 1
	[0086.607] CloseHandle (hObject=0x368) returned 1
	[0086.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0086.607] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 1
	[0086.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.608] lstrlenW (lpString=".doc") returned 4
	[0086.608] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.608] lstrlenW (lpString=".docx") returned 5
	[0086.608] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0086.608] lstrlenW (lpString=".pdf") returned 4
	[0086.608] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.608] lstrlenW (lpString=".xls") returned 4
	[0086.608] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.608] lstrlenW (lpString=".xlsx") returned 5
	[0086.608] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0086.608] lstrlenW (lpString=".ppt") returned 4
	[0086.608] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.608] lstrlenW (lpString=".zip") returned 4
	[0086.608] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.608] lstrlenW (lpString=".rar") returned 4
	[0086.608] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.608] lstrlenW (lpString=".bz2") returned 4
	[0086.608] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.608] lstrlenW (lpString=".7z") returned 3
	[0086.609] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.609] lstrlenW (lpString=".dbf") returned 4
	[0086.609] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.609] lstrlenW (lpString=".1cd") returned 4
	[0086.609] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.609] lstrlenW (lpString=".jpg") returned 4
	[0086.609] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.609] lstrlenW (lpString=".doc") returned 4
	[0086.609] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.609] lstrlenW (lpString=".docx") returned 5
	[0086.609] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0086.609] lstrlenW (lpString=".pdf") returned 4
	[0086.609] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.609] lstrlenW (lpString=".xls") returned 4
	[0086.609] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.609] lstrlenW (lpString=".xlsx") returned 5
	[0086.609] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0086.609] lstrlenW (lpString=".ppt") returned 4
	[0086.609] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.610] lstrlenW (lpString=".zip") returned 4
	[0086.610] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.610] lstrlenW (lpString=".rar") returned 4
	[0086.610] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.610] lstrlenW (lpString=".bz2") returned 4
	[0086.610] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.610] lstrlenW (lpString=".7z") returned 3
	[0086.610] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.610] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.610] lstrlenW (lpString=".dbf") returned 4
	[0086.610] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.610] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.610] lstrlenW (lpString=".1cd") returned 4
	[0086.610] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.610] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0086.610] lstrlenW (lpString=".jpg") returned 4
	[0086.610] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.610] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0086.610] lstrlenW (lpString="ssv.dll") returned 7
	[0086.610] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0086.611] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=571968) returned 1
	[0086.611] CloseHandle (hObject=0x368) returned 1
	[0086.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20
	[0086.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0086.611] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0086.611] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.611] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.611] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0086.612] GetLastError () returned 0x0
	[0086.612] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x8ba40, lpOverlapped=0x0) returned 1
	[0087.002] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x8ba50, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x8ba50, lpOverlapped=0x0) returned 1
	[0087.013] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.013] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0087.013] SetEndOfFile (hFile=0x314) returned 1
	[0087.013] CloseHandle (hObject=0x314) returned 1
	[0087.013] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.013] SetEndOfFile (hFile=0x368) returned 1
	[0087.019] CloseHandle (hObject=0x368) returned 1
	[0087.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.019] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 1
	[0087.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.019] lstrlenW (lpString=".doc") returned 4
	[0087.019] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.019] lstrlenW (lpString=".docx") returned 5
	[0087.019] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1
	[0087.019] lstrlenW (lpString=".pdf") returned 4
	[0087.019] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.020] lstrlenW (lpString=".xls") returned 4
	[0087.020] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.020] lstrlenW (lpString=".xlsx") returned 5
	[0087.020] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1
	[0087.020] lstrlenW (lpString=".ppt") returned 4
	[0087.020] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.020] lstrlenW (lpString=".zip") returned 4
	[0087.020] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.020] lstrlenW (lpString=".rar") returned 4
	[0087.020] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.020] lstrlenW (lpString=".bz2") returned 4
	[0087.020] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.020] lstrlenW (lpString=".7z") returned 3
	[0087.020] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.020] lstrlenW (lpString=".dbf") returned 4
	[0087.020] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.020] lstrlenW (lpString=".1cd") returned 4
	[0087.020] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.020] lstrlenW (lpString=".jpg") returned 4
	[0087.020] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.020] lstrlenW (lpString=".doc") returned 4
	[0087.020] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.020] lstrlenW (lpString=".docx") returned 5
	[0087.020] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1
	[0087.021] lstrlenW (lpString=".pdf") returned 4
	[0087.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.021] lstrlenW (lpString=".xls") returned 4
	[0087.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.021] lstrlenW (lpString=".xlsx") returned 5
	[0087.021] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1
	[0087.021] lstrlenW (lpString=".ppt") returned 4
	[0087.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.021] lstrlenW (lpString=".zip") returned 4
	[0087.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.021] lstrlenW (lpString=".rar") returned 4
	[0087.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.021] lstrlenW (lpString=".bz2") returned 4
	[0087.021] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.021] lstrlenW (lpString=".7z") returned 3
	[0087.021] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.021] lstrlenW (lpString=".dbf") returned 4
	[0087.021] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.021] lstrlenW (lpString=".1cd") returned 4
	[0087.021] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0087.021] lstrlenW (lpString=".jpg") returned 4
	[0087.021] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.021] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0087.022] lstrlenW (lpString="unpack.dll") returned 10
	[0087.022] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0087.022] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=79936) returned 1
	[0087.022] CloseHandle (hObject=0x368) returned 1
	[0087.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20
	[0087.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.022] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0087.022] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.022] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.022] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0087.023] GetLastError () returned 0x0
	[0087.023] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x13840, lpOverlapped=0x0) returned 1
	[0087.531] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0x13850, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0x13850, lpOverlapped=0x0) returned 1
	[0087.533] ReadFile (in: hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesRead=0x3c5fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.533] WriteFile (in: hFile=0x314, lpBuffer=0x43e4020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x43e4020*, lpNumberOfBytesWritten=0x3c5fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0087.533] SetEndOfFile (hFile=0x314) returned 1
	[0087.533] CloseHandle (hObject=0x314) returned 1
	[0087.533] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.533] SetEndOfFile (hFile=0x368) returned 1
	[0087.534] CloseHandle (hObject=0x368) returned 1
	[0087.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0087.535] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 1
	[0087.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.535] lstrlenW (lpString=".doc") returned 4
	[0087.535] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.535] lstrlenW (lpString=".docx") returned 5
	[0087.535] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1
	[0087.535] lstrlenW (lpString=".pdf") returned 4
	[0087.535] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.535] lstrlenW (lpString=".xls") returned 4
	[0087.535] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.535] lstrlenW (lpString=".xlsx") returned 5
	[0087.535] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1
	[0087.535] lstrlenW (lpString=".ppt") returned 4
	[0087.535] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.535] lstrlenW (lpString=".zip") returned 4
	[0087.535] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.535] lstrlenW (lpString=".rar") returned 4
	[0087.535] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.535] lstrlenW (lpString=".bz2") returned 4
	[0087.536] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.536] lstrlenW (lpString=".7z") returned 3
	[0087.536] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.536] lstrlenW (lpString=".dbf") returned 4
	[0087.536] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.536] lstrlenW (lpString=".1cd") returned 4
	[0087.536] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.536] lstrlenW (lpString=".jpg") returned 4
	[0087.536] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.536] lstrlenW (lpString=".doc") returned 4
	[0087.536] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.536] lstrlenW (lpString=".docx") returned 5
	[0087.536] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1
	[0087.536] lstrlenW (lpString=".pdf") returned 4
	[0087.536] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.536] lstrlenW (lpString=".xls") returned 4
	[0087.536] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.536] lstrlenW (lpString=".xlsx") returned 5
	[0087.536] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1
	[0087.536] lstrlenW (lpString=".ppt") returned 4
	[0087.536] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.536] lstrlenW (lpString=".zip") returned 4
	[0087.536] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.537] lstrlenW (lpString=".rar") returned 4
	[0087.537] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.537] lstrlenW (lpString=".bz2") returned 4
	[0087.537] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.537] lstrlenW (lpString=".7z") returned 3
	[0087.537] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.537] lstrlenW (lpString=".dbf") returned 4
	[0087.537] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.537] lstrlenW (lpString=".1cd") returned 4
	[0087.537] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49
	[0087.537] lstrlenW (lpString=".jpg") returned 4
	[0087.537] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.537] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0087.537] lstrlenW (lpString="charsets.jar") returned 12
	[0087.537] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0087.538] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3c5ff14 | out: lpFileSize=0x3c5ff14*=3036922) returned 1
	[0087.538] CloseHandle (hObject=0x368) returned 1
	[0087.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20
	[0087.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0087.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[admin@stex777.com].money")) returned 1
	[0087.538] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0087.538] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc64 | out: lpNewFilePointer=0x0) returned 1
	[0087.539] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc24 | out: lpNewFilePointer=0x0) returned 1
	[0087.539] ReadFile (in: hFile=0x368, lpBuffer=0x43e4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3c5fc30, lpOverlapped=0x0 | out: lpBuffer=0x43e4058*, lpNumberOfBytesRead=0x3c5fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0087.543] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xf7253, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc24 | out: lpNewFilePointer=0x0) returned 1
	[0087.543] ReadFile (in: hFile=0x368, lpBuffer=0x4424058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3c5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4424058*, lpNumberOfBytesRead=0x3c5fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0087.551] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3c5fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0087.551] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x2a56fa, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fc24 | out: lpNewFilePointer=0x0) returned 1
	[0087.551] ReadFile (in: hFile=0x368, lpBuffer=0x4464058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3c5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4464058*, lpNumberOfBytesRead=0x3c5fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0087.566] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.566] WriteFile (hFile=0x368, lpBuffer=0x43e4020, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x3c5fca8, lpOverlapped=0x0) 

Thread:
	id = 21
	os_tid = 0x15c

	[0057.453] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x41f0720
	[0057.453] lstrlenW (lpString="C:") returned 2
	[0057.453] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3d9fcf8 | out: lpFindFileData=0x3d9fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6f4528
	[0057.453] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0057.453] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0057.454] lstrlenW (lpString="$GetCurrent") returned 11
	[0057.454] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0057.454] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4200728
	[0057.454] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0057.454] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6f44a8
	[0057.454] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0057.454] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0057.454] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0057.455] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0057.455] lstrlenW (lpString="Logs") returned 4
	[0057.455] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0057.455] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0057.455] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0057.455] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f45a8
	[0057.455] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.455] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd838e407, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd838e407, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd83b4615, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DOWNLE~1.MON")) returned 1
	[0057.455] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[admin@stex777.com].money") returned 75
	[0057.455] lstrlenW (lpString=".1cd") returned 4
	[0057.455] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0057.456] lstrlenW (lpString=".3ds") returned 4
	[0057.456] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0057.456] lstrlenW (lpString=".3fr") returned 4
	[0057.456] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0057.456] lstrlenW (lpString=".3g2") returned 4
	[0057.456] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0057.456] lstrlenW (lpString=".3gp") returned 4
	[0057.456] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0057.456] lstrlenW (lpString=".7z") returned 3
	[0057.456] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0057.456] lstrlenW (lpString=".accda") returned 6
	[0057.456] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0057.456] lstrlenW (lpString=".accdb") returned 6
	[0057.456] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0057.456] lstrlenW (lpString=".accdc") returned 6
	[0057.456] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0057.456] lstrlenW (lpString=".accde") returned 6
	[0057.456] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0057.456] lstrlenW (lpString=".accdt") returned 6
	[0057.456] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0057.456] lstrlenW (lpString=".accdw") returned 6
	[0057.456] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0057.456] lstrlenW (lpString=".adb") returned 4
	[0057.456] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0057.456] lstrlenW (lpString=".adp") returned 4
	[0057.457] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0057.457] lstrlenW (lpString=".ai") returned 3
	[0057.457] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0057.457] lstrlenW (lpString=".ai3") returned 4
	[0057.457] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0057.457] lstrlenW (lpString=".ai4") returned 4
	[0057.457] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0057.457] lstrlenW (lpString=".ai5") returned 4
	[0057.457] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0057.457] lstrlenW (lpString=".ai6") returned 4
	[0057.457] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0057.457] lstrlenW (lpString=".ai7") returned 4
	[0057.457] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0057.457] lstrlenW (lpString=".ai8") returned 4
	[0057.457] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0057.457] lstrlenW (lpString=".anim") returned 5
	[0057.457] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0057.457] lstrlenW (lpString=".arw") returned 4
	[0057.457] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0057.457] lstrlenW (lpString=".as") returned 3
	[0057.457] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0057.457] lstrlenW (lpString=".asa") returned 4
	[0057.457] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0057.457] lstrlenW (lpString=".asc") returned 4
	[0057.457] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0057.457] lstrlenW (lpString=".ascx") returned 5
	[0057.457] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0057.458] lstrlenW (lpString=".asm") returned 4
	[0057.458] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0057.458] lstrlenW (lpString=".asmx") returned 5
	[0057.458] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0057.458] lstrlenW (lpString=".asp") returned 4
	[0057.458] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0057.458] lstrlenW (lpString=".aspx") returned 5
	[0057.458] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0057.458] lstrlenW (lpString=".asr") returned 4
	[0057.458] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0057.458] lstrlenW (lpString=".asx") returned 4
	[0057.458] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0057.458] lstrlenW (lpString=".avi") returned 4
	[0057.458] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0057.458] lstrlenW (lpString=".avs") returned 4
	[0057.458] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0057.459] lstrlenW (lpString=".backup") returned 7
	[0057.459] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0057.459] lstrlenW (lpString=".bak") returned 4
	[0057.459] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0057.459] lstrlenW (lpString=".bay") returned 4
	[0057.459] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0057.459] lstrlenW (lpString=".bd") returned 3
	[0057.459] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0057.459] lstrlenW (lpString=".bin") returned 4
	[0057.459] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0057.459] lstrlenW (lpString=".bmp") returned 4
	[0057.459] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0057.459] lstrlenW (lpString=".bz2") returned 4
	[0057.459] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0057.459] lstrlenW (lpString=".c") returned 2
	[0057.459] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0057.459] lstrlenW (lpString=".cdr") returned 4
	[0057.459] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0057.459] lstrlenW (lpString=".cer") returned 4
	[0057.459] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0057.459] lstrlenW (lpString=".cf") returned 3
	[0057.459] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0057.459] lstrlenW (lpString=".cfc") returned 4
	[0057.459] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0057.459] lstrlenW (lpString=".cfm") returned 4
	[0057.459] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0057.459] lstrlenW (lpString=".cfml") returned 5
	[0057.459] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0057.460] lstrlenW (lpString=".cfu") returned 4
	[0057.460] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0057.460] lstrlenW (lpString=".chm") returned 4
	[0057.460] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0057.460] lstrlenW (lpString=".cin") returned 4
	[0057.460] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0057.460] lstrlenW (lpString=".class") returned 6
	[0057.460] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0057.460] lstrlenW (lpString=".clx") returned 4
	[0057.460] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0057.460] lstrlenW (lpString=".config") returned 7
	[0057.460] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0057.460] lstrlenW (lpString=".cpp") returned 4
	[0057.460] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0057.460] lstrlenW (lpString=".cr2") returned 4
	[0057.460] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0057.460] lstrlenW (lpString=".crt") returned 4
	[0057.460] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0057.460] lstrlenW (lpString=".crw") returned 4
	[0057.460] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0057.460] lstrlenW (lpString=".cs") returned 3
	[0057.460] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0057.460] lstrlenW (lpString=".css") returned 4
	[0057.461] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0057.461] lstrlenW (lpString=".csv") returned 4
	[0057.461] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0057.461] lstrlenW (lpString=".cub") returned 4
	[0057.461] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0057.461] lstrlenW (lpString=".dae") returned 4
	[0057.461] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0057.461] lstrlenW (lpString=".dat") returned 4
	[0057.461] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0057.461] lstrlenW (lpString=".db") returned 3
	[0057.461] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0057.461] lstrlenW (lpString=".dbf") returned 4
	[0057.461] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0057.461] lstrlenW (lpString=".dbx") returned 4
	[0057.461] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0057.461] lstrlenW (lpString=".dc3") returned 4
	[0057.461] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0057.461] lstrlenW (lpString=".dcm") returned 4
	[0057.461] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0057.461] lstrlenW (lpString=".dcr") returned 4
	[0057.461] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0057.461] lstrlenW (lpString=".der") returned 4
	[0057.461] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0057.462] lstrlenW (lpString=".dib") returned 4
	[0057.462] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0057.462] lstrlenW (lpString=".dic") returned 4
	[0057.462] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0057.462] lstrlenW (lpString=".dif") returned 4
	[0057.462] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0057.462] lstrlenW (lpString=".divx") returned 5
	[0057.462] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0057.462] lstrlenW (lpString=".djvu") returned 5
	[0057.462] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0057.462] lstrlenW (lpString=".dng") returned 4
	[0057.462] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0057.462] lstrlenW (lpString=".doc") returned 4
	[0057.462] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0057.462] lstrlenW (lpString=".docm") returned 5
	[0057.462] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0057.462] lstrlenW (lpString=".docx") returned 5
	[0057.462] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0057.462] lstrlenW (lpString=".dot") returned 4
	[0057.462] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0057.462] lstrlenW (lpString=".dotm") returned 5
	[0057.462] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0057.462] lstrlenW (lpString=".dotx") returned 5
	[0057.462] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0057.462] lstrlenW (lpString=".dpx") returned 4
	[0057.462] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0057.463] lstrlenW (lpString=".dqy") returned 4
	[0057.463] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0057.463] lstrlenW (lpString=".dsn") returned 4
	[0057.463] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0057.463] lstrlenW (lpString=".dt") returned 3
	[0057.463] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0057.463] lstrlenW (lpString=".dtd") returned 4
	[0057.463] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0057.463] lstrlenW (lpString=".dwg") returned 4
	[0057.463] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0057.463] lstrlenW (lpString=".dwt") returned 4
	[0057.463] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0057.463] lstrlenW (lpString=".dx") returned 3
	[0057.463] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0057.463] lstrlenW (lpString=".dxf") returned 4
	[0057.463] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0057.463] lstrlenW (lpString=".edml") returned 5
	[0057.463] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0057.463] lstrlenW (lpString=".efd") returned 4
	[0057.463] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0057.463] lstrlenW (lpString=".elf") returned 4
	[0057.463] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0057.463] lstrlenW (lpString=".emf") returned 4
	[0057.463] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0057.463] lstrlenW (lpString=".emz") returned 4
	[0057.464] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0057.464] lstrlenW (lpString=".epf") returned 4
	[0057.464] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0057.464] lstrlenW (lpString=".eps") returned 4
	[0057.464] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0057.464] lstrlenW (lpString=".epsf") returned 5
	[0057.464] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0057.464] lstrlenW (lpString=".epsp") returned 5
	[0057.464] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0057.464] lstrlenW (lpString=".erf") returned 4
	[0057.464] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0057.464] lstrlenW (lpString=".exr") returned 4
	[0057.464] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0057.464] lstrlenW (lpString=".f4v") returned 4
	[0057.464] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0057.464] lstrlenW (lpString=".fido") returned 5
	[0057.464] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0057.464] lstrlenW (lpString=".flm") returned 4
	[0057.464] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0057.464] lstrlenW (lpString=".flv") returned 4
	[0057.464] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0057.464] lstrlenW (lpString=".frm") returned 4
	[0057.464] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0057.464] lstrlenW (lpString=".fxg") returned 4
	[0057.464] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0057.464] lstrlenW (lpString=".geo") returned 4
	[0057.465] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0057.465] lstrlenW (lpString=".gif") returned 4
	[0057.465] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0057.465] lstrlenW (lpString=".grs") returned 4
	[0057.465] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0057.465] lstrlenW (lpString=".gz") returned 3
	[0057.465] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0057.465] lstrlenW (lpString=".h") returned 2
	[0057.465] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0057.465] lstrlenW (lpString=".hdr") returned 4
	[0057.465] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0057.465] lstrlenW (lpString=".hpp") returned 4
	[0057.465] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0057.465] lstrlenW (lpString=".hta") returned 4
	[0057.465] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0057.465] lstrlenW (lpString=".htc") returned 4
	[0057.465] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0057.465] lstrlenW (lpString=".htm") returned 4
	[0057.465] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0057.465] lstrlenW (lpString=".html") returned 5
	[0057.465] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0057.465] lstrlenW (lpString=".icb") returned 4
	[0057.465] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0057.465] lstrlenW (lpString=".ics") returned 4
	[0057.465] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0057.465] lstrlenW (lpString=".iff") returned 4
	[0057.465] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0057.466] lstrlenW (lpString=".inc") returned 4
	[0057.466] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0057.466] lstrlenW (lpString=".indd") returned 5
	[0057.466] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0057.466] lstrlenW (lpString=".ini") returned 4
	[0057.466] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0057.466] lstrlenW (lpString=".iqy") returned 4
	[0057.466] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0057.466] lstrlenW (lpString=".j2c") returned 4
	[0057.466] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0057.466] lstrlenW (lpString=".j2k") returned 4
	[0057.466] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0057.466] lstrlenW (lpString=".java") returned 5
	[0057.466] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0057.466] lstrlenW (lpString=".jp2") returned 4
	[0057.466] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0057.466] lstrlenW (lpString=".jpc") returned 4
	[0057.466] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0057.466] lstrlenW (lpString=".jpe") returned 4
	[0057.466] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0057.466] lstrlenW (lpString=".jpeg") returned 5
	[0057.466] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0057.466] lstrlenW (lpString=".jpf") returned 4
	[0057.466] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0057.466] lstrlenW (lpString=".jpg") returned 4
	[0057.467] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0057.467] lstrlenW (lpString=".jpx") returned 4
	[0057.467] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0057.467] lstrlenW (lpString=".js") returned 3
	[0057.467] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0057.467] lstrlenW (lpString=".jsf") returned 4
	[0057.467] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0057.467] lstrlenW (lpString=".json") returned 5
	[0057.467] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0057.467] lstrlenW (lpString=".jsp") returned 4
	[0057.467] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0057.467] lstrlenW (lpString=".kdc") returned 4
	[0057.467] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0057.467] lstrlenW (lpString=".kmz") returned 4
	[0057.467] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0057.467] lstrlenW (lpString=".kwm") returned 4
	[0057.467] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0057.467] lstrlenW (lpString=".lasso") returned 6
	[0057.467] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0057.467] lstrlenW (lpString=".lbi") returned 4
	[0057.467] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0057.467] lstrlenW (lpString=".lgf") returned 4
	[0057.467] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0057.467] lstrlenW (lpString=".lgp") returned 4
	[0057.467] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0057.467] lstrlenW (lpString=".log") returned 4
	[0057.468] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0057.468] lstrlenW (lpString=".m1v") returned 4
	[0057.468] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0057.468] lstrlenW (lpString=".m4a") returned 4
	[0057.468] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0057.468] lstrlenW (lpString=".m4v") returned 4
	[0057.468] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0057.468] lstrlenW (lpString=".max") returned 4
	[0057.468] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0057.468] lstrlenW (lpString=".md") returned 3
	[0057.468] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0057.468] lstrlenW (lpString=".mda") returned 4
	[0057.468] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0057.468] lstrlenW (lpString=".mdb") returned 4
	[0057.468] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0057.468] lstrlenW (lpString=".mde") returned 4
	[0057.468] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0057.468] lstrlenW (lpString=".mdf") returned 4
	[0057.468] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0057.468] lstrlenW (lpString=".mdw") returned 4
	[0057.468] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0057.468] lstrlenW (lpString=".mef") returned 4
	[0057.468] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0057.468] lstrlenW (lpString=".mft") returned 4
	[0057.469] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0057.469] lstrlenW (lpString=".mfw") returned 4
	[0057.469] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0057.469] lstrlenW (lpString=".mht") returned 4
	[0057.469] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0057.469] lstrlenW (lpString=".mhtml") returned 6
	[0057.469] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0057.469] lstrlenW (lpString=".mka") returned 4
	[0057.469] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0057.469] lstrlenW (lpString=".mkidx") returned 6
	[0057.469] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0057.469] lstrlenW (lpString=".mkv") returned 4
	[0057.469] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0057.469] lstrlenW (lpString=".mos") returned 4
	[0057.469] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0057.469] lstrlenW (lpString=".mov") returned 4
	[0057.469] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0057.469] lstrlenW (lpString=".mp3") returned 4
	[0057.469] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0057.469] lstrlenW (lpString=".mp4") returned 4
	[0057.469] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0057.469] lstrlenW (lpString=".mpeg") returned 5
	[0057.469] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0057.470] lstrlenW (lpString=".mpg") returned 4
	[0057.470] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0057.470] lstrlenW (lpString=".mpv") returned 4
	[0057.470] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0057.470] lstrlenW (lpString=".mrw") returned 4
	[0057.470] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0057.470] lstrlenW (lpString=".msg") returned 4
	[0057.470] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0057.470] lstrlenW (lpString=".mxl") returned 4
	[0057.470] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0057.470] lstrlenW (lpString=".myd") returned 4
	[0057.470] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0057.470] lstrlenW (lpString=".myi") returned 4
	[0057.470] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0057.470] lstrlenW (lpString=".nef") returned 4
	[0057.470] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0057.470] lstrlenW (lpString=".nrw") returned 4
	[0057.470] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0057.470] lstrlenW (lpString=".obj") returned 4
	[0057.470] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0057.470] lstrlenW (lpString=".odb") returned 4
	[0057.471] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0057.471] lstrlenW (lpString=".odc") returned 4
	[0057.471] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0057.471] lstrlenW (lpString=".odm") returned 4
	[0057.471] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0057.471] lstrlenW (lpString=".odp") returned 4
	[0057.471] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0057.471] lstrlenW (lpString=".ods") returned 4
	[0057.471] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0057.471] lstrlenW (lpString=".oft") returned 4
	[0057.471] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0057.471] lstrlenW (lpString=".one") returned 4
	[0057.471] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0057.471] lstrlenW (lpString=".onepkg") returned 7
	[0057.471] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0057.471] lstrlenW (lpString=".onetoc2") returned 8
	[0057.471] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0057.471] lstrlenW (lpString=".opt") returned 4
	[0057.471] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0057.471] lstrlenW (lpString=".oqy") returned 4
	[0057.471] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0057.471] lstrlenW (lpString=".orf") returned 4
	[0057.472] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".p12") returned 4
	[0057.472] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".p7b") returned 4
	[0057.472] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".p7c") returned 4
	[0057.472] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".pam") returned 4
	[0057.472] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".pbm") returned 4
	[0057.472] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".pct") returned 4
	[0057.472] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".pcx") returned 4
	[0057.472] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".pdd") returned 4
	[0057.472] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".pdf") returned 4
	[0057.472] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".pdp") returned 4
	[0057.472] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".pef") returned 4
	[0057.472] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".pem") returned 4
	[0057.472] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0057.472] lstrlenW (lpString=".pff") returned 4
	[0057.473] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0057.473] lstrlenW (lpString=".pfm") returned 4
	[0057.473] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0057.473] lstrlenW (lpString=".pfx") returned 4
	[0057.473] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0057.473] lstrlenW (lpString=".pgm") returned 4
	[0057.473] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0057.473] lstrlenW (lpString=".php") returned 4
	[0057.473] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0057.473] lstrlenW (lpString=".php3") returned 5
	[0057.473] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0057.473] lstrlenW (lpString=".php4") returned 5
	[0057.473] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0057.473] lstrlenW (lpString=".php5") returned 5
	[0057.473] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0057.473] lstrlenW (lpString=".phtml") returned 6
	[0057.473] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0057.473] lstrlenW (lpString=".pict") returned 5
	[0057.473] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0057.473] lstrlenW (lpString=".pl") returned 3
	[0057.473] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0057.473] lstrlenW (lpString=".pls") returned 4
	[0057.473] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0057.474] lstrlenW (lpString=".pm") returned 3
	[0057.474] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0057.474] lstrlenW (lpString=".png") returned 4
	[0057.474] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0057.474] lstrlenW (lpString=".pnm") returned 4
	[0057.474] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0057.474] lstrlenW (lpString=".pot") returned 4
	[0057.474] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0057.474] lstrlenW (lpString=".potm") returned 5
	[0057.474] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0057.474] lstrlenW (lpString=".potx") returned 5
	[0057.474] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0057.474] lstrlenW (lpString=".ppa") returned 4
	[0057.474] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0057.474] lstrlenW (lpString=".ppam") returned 5
	[0057.474] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0057.474] lstrlenW (lpString=".ppm") returned 4
	[0057.474] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0057.474] lstrlenW (lpString=".pps") returned 4
	[0057.474] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0057.474] lstrlenW (lpString=".ppsm") returned 5
	[0057.474] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0057.474] lstrlenW (lpString=".ppt") returned 4
	[0057.474] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0057.474] lstrlenW (lpString=".pptm") returned 5
	[0057.474] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0057.475] lstrlenW (lpString=".pptx") returned 5
	[0057.475] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0057.475] lstrlenW (lpString=".prn") returned 4
	[0057.475] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0057.475] lstrlenW (lpString=".ps") returned 3
	[0057.475] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0057.475] lstrlenW (lpString=".psb") returned 4
	[0057.475] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0057.475] lstrlenW (lpString=".psd") returned 4
	[0057.475] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0057.475] lstrlenW (lpString=".pst") returned 4
	[0057.475] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0057.475] lstrlenW (lpString=".ptx") returned 4
	[0057.475] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0057.475] lstrlenW (lpString=".pub") returned 4
	[0057.475] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0057.475] lstrlenW (lpString=".pwm") returned 4
	[0057.475] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0057.475] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8426f15, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="OOBE_2~1.MON")) returned 1
	[0057.476] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83da953, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd83da953, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8400cf6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARTNE~1.MON")) returned 1
	[0057.476] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83da953, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd83da953, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8400cf6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARTNE~1.MON")) returned 0
	[0057.476] FindClose (in: hFindFile=0x6f45a8 | out: hFindFile=0x6f45a8) returned 1
	[0057.476] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0057.476] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0057.476] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0057.476] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f46a8
	[0057.476] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.476] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0057.477] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8400cf6, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8400cf6, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8400cf6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="GETCUR~1.MON")) returned 1
	[0057.477] lstrlenW (lpString="GetCurrentRollback.ini.id-B4197730.[admin@stex777.com].money") returned 60
	[0057.477] lstrlenW (lpString=".1cd") returned 4
	[0057.477] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0057.477] lstrlenW (lpString=".3ds") returned 4
	[0057.477] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0057.477] lstrlenW (lpString=".3fr") returned 4
	[0057.477] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0057.477] lstrlenW (lpString=".3g2") returned 4
	[0057.477] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0057.477] lstrlenW (lpString=".3gp") returned 4
	[0057.477] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0057.477] lstrlenW (lpString=".7z") returned 3
	[0057.477] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0057.477] lstrlenW (lpString=".accda") returned 6
	[0057.477] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0057.477] lstrlenW (lpString=".accdb") returned 6
	[0057.477] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0057.477] lstrlenW (lpString=".accdc") returned 6
	[0057.477] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0057.478] lstrlenW (lpString=".accde") returned 6
	[0057.478] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0057.478] lstrlenW (lpString=".accdt") returned 6
	[0057.478] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0057.478] lstrlenW (lpString=".accdw") returned 6
	[0057.478] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0057.478] lstrlenW (lpString=".adb") returned 4
	[0057.478] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0057.478] lstrlenW (lpString=".adp") returned 4
	[0057.478] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0057.478] lstrlenW (lpString=".ai") returned 3
	[0057.478] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0057.478] lstrlenW (lpString=".ai3") returned 4
	[0057.478] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0057.478] lstrlenW (lpString=".ai4") returned 4
	[0057.478] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0057.478] lstrlenW (lpString=".ai5") returned 4
	[0057.478] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0057.478] lstrlenW (lpString=".ai6") returned 4
	[0057.478] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0057.478] lstrlenW (lpString=".ai7") returned 4
	[0057.478] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0057.478] lstrlenW (lpString=".ai8") returned 4
	[0057.478] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0057.478] lstrlenW (lpString=".anim") returned 5
	[0057.479] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0057.479] lstrlenW (lpString=".arw") returned 4
	[0057.479] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0057.479] lstrlenW (lpString=".as") returned 3
	[0057.479] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0057.479] lstrlenW (lpString=".asa") returned 4
	[0057.479] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0057.479] lstrlenW (lpString=".asc") returned 4
	[0057.479] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0057.479] lstrlenW (lpString=".ascx") returned 5
	[0057.479] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0057.479] lstrlenW (lpString=".asm") returned 4
	[0057.479] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0057.479] lstrlenW (lpString=".asmx") returned 5
	[0057.479] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0057.479] lstrlenW (lpString=".asp") returned 4
	[0057.479] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0057.479] lstrlenW (lpString=".aspx") returned 5
	[0057.479] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0057.479] lstrlenW (lpString=".asr") returned 4
	[0057.479] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0057.479] lstrlenW (lpString=".asx") returned 4
	[0057.479] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0057.479] lstrlenW (lpString=".avi") returned 4
	[0057.479] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0057.479] lstrlenW (lpString=".avs") returned 4
	[0057.479] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0057.479] lstrlenW (lpString=".backup") returned 7
	[0057.480] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0057.480] lstrlenW (lpString=".bak") returned 4
	[0057.480] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0057.480] lstrlenW (lpString=".bay") returned 4
	[0057.480] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0057.480] lstrlenW (lpString=".bd") returned 3
	[0057.480] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0057.480] lstrlenW (lpString=".bin") returned 4
	[0057.480] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0057.480] lstrlenW (lpString=".bmp") returned 4
	[0057.480] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0057.480] lstrlenW (lpString=".bz2") returned 4
	[0057.480] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0057.480] lstrlenW (lpString=".c") returned 2
	[0057.480] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0057.480] lstrlenW (lpString=".cdr") returned 4
	[0057.480] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0057.480] lstrlenW (lpString=".cer") returned 4
	[0057.480] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0057.480] lstrlenW (lpString=".cf") returned 3
	[0057.480] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0057.480] lstrlenW (lpString=".cfc") returned 4
	[0057.480] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0057.480] lstrlenW (lpString=".cfm") returned 4
	[0057.480] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0057.480] lstrlenW (lpString=".cfml") returned 5
	[0057.480] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0057.480] lstrlenW (lpString=".cfu") returned 4
	[0057.480] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0057.481] lstrlenW (lpString=".chm") returned 4
	[0057.481] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0057.481] lstrlenW (lpString=".cin") returned 4
	[0057.481] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0057.481] lstrlenW (lpString=".class") returned 6
	[0057.481] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0057.481] lstrlenW (lpString=".clx") returned 4
	[0057.481] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0057.481] lstrlenW (lpString=".config") returned 7
	[0057.481] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0057.481] lstrlenW (lpString=".cpp") returned 4
	[0057.481] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0057.481] lstrlenW (lpString=".cr2") returned 4
	[0057.481] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0057.481] lstrlenW (lpString=".crt") returned 4
	[0057.481] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0057.481] lstrlenW (lpString=".crw") returned 4
	[0057.481] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0057.481] lstrlenW (lpString=".cs") returned 3
	[0057.481] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0057.481] lstrlenW (lpString=".css") returned 4
	[0057.481] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0057.481] lstrlenW (lpString=".csv") returned 4
	[0057.481] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0057.481] lstrlenW (lpString=".cub") returned 4
	[0057.481] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0057.481] lstrlenW (lpString=".dae") returned 4
	[0057.481] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0057.482] lstrlenW (lpString=".dat") returned 4
	[0057.482] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0057.482] lstrlenW (lpString=".db") returned 3
	[0057.482] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0057.482] lstrlenW (lpString=".dbf") returned 4
	[0057.482] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0057.482] lstrlenW (lpString=".dbx") returned 4
	[0057.482] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0057.482] lstrlenW (lpString=".dc3") returned 4
	[0057.482] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0057.482] lstrlenW (lpString=".dcm") returned 4
	[0057.482] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0057.482] lstrlenW (lpString=".dcr") returned 4
	[0057.482] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0057.482] lstrlenW (lpString=".der") returned 4
	[0057.482] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0057.482] lstrlenW (lpString=".dib") returned 4
	[0057.482] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0057.482] lstrlenW (lpString=".dic") returned 4
	[0057.482] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0057.482] lstrlenW (lpString=".dif") returned 4
	[0057.482] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0057.482] lstrlenW (lpString=".divx") returned 5
	[0057.482] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0057.482] lstrlenW (lpString=".djvu") returned 5
	[0057.482] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0057.482] lstrlenW (lpString=".dng") returned 4
	[0057.483] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0057.483] lstrlenW (lpString=".doc") returned 4
	[0057.483] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0057.483] lstrlenW (lpString=".docm") returned 5
	[0057.483] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0057.483] lstrlenW (lpString=".docx") returned 5
	[0057.483] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0057.483] lstrlenW (lpString=".dot") returned 4
	[0057.483] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0057.483] lstrlenW (lpString=".dotm") returned 5
	[0057.483] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0057.483] lstrlenW (lpString=".dotx") returned 5
	[0057.483] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0057.483] lstrlenW (lpString=".dpx") returned 4
	[0057.483] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0057.483] lstrlenW (lpString=".dqy") returned 4
	[0057.483] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0057.483] lstrlenW (lpString=".dsn") returned 4
	[0057.483] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0057.483] lstrlenW (lpString=".dt") returned 3
	[0057.483] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0057.483] lstrlenW (lpString=".dtd") returned 4
	[0057.483] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0057.483] lstrlenW (lpString=".dwg") returned 4
	[0057.483] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0057.483] lstrlenW (lpString=".dwt") returned 4
	[0057.483] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0057.483] lstrlenW (lpString=".dx") returned 3
	[0057.484] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0057.484] lstrlenW (lpString=".dxf") returned 4
	[0057.484] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0057.484] lstrlenW (lpString=".edml") returned 5
	[0057.484] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0057.484] lstrlenW (lpString=".efd") returned 4
	[0057.484] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0057.484] lstrlenW (lpString=".elf") returned 4
	[0057.484] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0057.484] lstrlenW (lpString=".emf") returned 4
	[0057.484] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0057.484] lstrlenW (lpString=".emz") returned 4
	[0057.484] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0057.484] lstrlenW (lpString=".epf") returned 4
	[0057.484] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0057.484] lstrlenW (lpString=".eps") returned 4
	[0057.484] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0057.484] lstrlenW (lpString=".epsf") returned 5
	[0057.484] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0057.484] lstrlenW (lpString=".epsp") returned 5
	[0057.484] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0057.484] lstrlenW (lpString=".erf") returned 4
	[0057.484] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0057.484] lstrlenW (lpString=".exr") returned 4
	[0057.484] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0057.484] lstrlenW (lpString=".f4v") returned 4
	[0057.484] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0057.484] lstrlenW (lpString=".fido") returned 5
	[0057.484] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0057.485] lstrlenW (lpString=".flm") returned 4
	[0057.485] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".flv") returned 4
	[0057.485] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".frm") returned 4
	[0057.485] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".fxg") returned 4
	[0057.485] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".geo") returned 4
	[0057.485] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".gif") returned 4
	[0057.485] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".grs") returned 4
	[0057.485] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".gz") returned 3
	[0057.485] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0057.485] lstrlenW (lpString=".h") returned 2
	[0057.485] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0057.485] lstrlenW (lpString=".hdr") returned 4
	[0057.485] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".hpp") returned 4
	[0057.485] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".hta") returned 4
	[0057.485] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".htc") returned 4
	[0057.485] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".htm") returned 4
	[0057.485] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0057.485] lstrlenW (lpString=".html") returned 5
	[0057.485] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0057.485] lstrlenW (lpString=".icb") returned 4
	[0057.486] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".ics") returned 4
	[0057.486] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".iff") returned 4
	[0057.486] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".inc") returned 4
	[0057.486] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".indd") returned 5
	[0057.486] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0057.486] lstrlenW (lpString=".ini") returned 4
	[0057.486] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".iqy") returned 4
	[0057.486] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".j2c") returned 4
	[0057.486] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".j2k") returned 4
	[0057.486] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".java") returned 5
	[0057.486] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0057.486] lstrlenW (lpString=".jp2") returned 4
	[0057.486] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".jpc") returned 4
	[0057.486] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".jpe") returned 4
	[0057.486] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".jpeg") returned 5
	[0057.486] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0057.486] lstrlenW (lpString=".jpf") returned 4
	[0057.486] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0057.486] lstrlenW (lpString=".jpg") returned 4
	[0057.486] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".jpx") returned 4
	[0057.487] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".js") returned 3
	[0057.487] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0057.487] lstrlenW (lpString=".jsf") returned 4
	[0057.487] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".json") returned 5
	[0057.487] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0057.487] lstrlenW (lpString=".jsp") returned 4
	[0057.487] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".kdc") returned 4
	[0057.487] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".kmz") returned 4
	[0057.487] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".kwm") returned 4
	[0057.487] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".lasso") returned 6
	[0057.487] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0057.487] lstrlenW (lpString=".lbi") returned 4
	[0057.487] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".lgf") returned 4
	[0057.487] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".lgp") returned 4
	[0057.487] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".log") returned 4
	[0057.487] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".m1v") returned 4
	[0057.487] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0057.487] lstrlenW (lpString=".m4a") returned 4
	[0057.488] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".m4v") returned 4
	[0057.488] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".max") returned 4
	[0057.488] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".md") returned 3
	[0057.488] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0057.488] lstrlenW (lpString=".mda") returned 4
	[0057.488] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".mdb") returned 4
	[0057.488] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".mde") returned 4
	[0057.488] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".mdf") returned 4
	[0057.488] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".mdw") returned 4
	[0057.488] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".mef") returned 4
	[0057.488] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".mft") returned 4
	[0057.488] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".mfw") returned 4
	[0057.488] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".mht") returned 4
	[0057.488] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".mhtml") returned 6
	[0057.488] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0057.488] lstrlenW (lpString=".mka") returned 4
	[0057.488] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0057.488] lstrlenW (lpString=".mkidx") returned 6
	[0057.489] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0057.489] lstrlenW (lpString=".mkv") returned 4
	[0057.489] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0057.489] lstrlenW (lpString=".mos") returned 4
	[0057.489] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0057.489] lstrlenW (lpString=".mov") returned 4
	[0057.489] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0057.489] lstrlenW (lpString=".mp3") returned 4
	[0057.489] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0057.489] lstrlenW (lpString=".mp4") returned 4
	[0057.489] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0057.677] lstrlenW (lpString=".mpeg") returned 5
	[0057.677] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0057.677] lstrlenW (lpString=".mpg") returned 4
	[0057.677] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0057.677] lstrlenW (lpString=".mpv") returned 4
	[0057.677] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0057.677] lstrlenW (lpString=".mrw") returned 4
	[0057.677] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0057.677] lstrlenW (lpString=".msg") returned 4
	[0057.677] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0057.677] lstrlenW (lpString=".mxl") returned 4
	[0057.677] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0057.678] lstrlenW (lpString=".myd") returned 4
	[0057.678] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0057.678] lstrlenW (lpString=".myi") returned 4
	[0057.678] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0057.678] lstrlenW (lpString=".nef") returned 4
	[0057.678] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0057.678] lstrlenW (lpString=".nrw") returned 4
	[0057.678] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0057.678] lstrlenW (lpString=".obj") returned 4
	[0057.678] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0057.678] lstrlenW (lpString=".odb") returned 4
	[0057.678] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0057.678] lstrlenW (lpString=".odc") returned 4
	[0057.678] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0057.678] lstrlenW (lpString=".odm") returned 4
	[0057.678] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0057.678] lstrlenW (lpString=".odp") returned 4
	[0057.678] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0057.678] lstrlenW (lpString=".ods") returned 4
	[0057.679] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0057.679] lstrlenW (lpString=".oft") returned 4
	[0057.679] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0057.679] lstrlenW (lpString=".one") returned 4
	[0057.679] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0057.679] lstrlenW (lpString=".onepkg") returned 7
	[0057.679] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0057.679] lstrlenW (lpString=".onetoc2") returned 8
	[0057.679] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0057.679] lstrlenW (lpString=".opt") returned 4
	[0057.679] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0057.679] lstrlenW (lpString=".oqy") returned 4
	[0057.679] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0057.679] lstrlenW (lpString=".orf") returned 4
	[0057.679] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0057.679] lstrlenW (lpString=".p12") returned 4
	[0057.679] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0057.679] lstrlenW (lpString=".p7b") returned 4
	[0057.679] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0057.679] lstrlenW (lpString=".p7c") returned 4
	[0057.680] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pam") returned 4
	[0057.680] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pbm") returned 4
	[0057.680] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pct") returned 4
	[0057.680] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pcx") returned 4
	[0057.680] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pdd") returned 4
	[0057.680] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pdf") returned 4
	[0057.680] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pdp") returned 4
	[0057.680] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pef") returned 4
	[0057.680] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pem") returned 4
	[0057.680] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pff") returned 4
	[0057.680] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pfm") returned 4
	[0057.680] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pfx") returned 4
	[0057.680] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".pgm") returned 4
	[0057.680] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0057.680] lstrlenW (lpString=".php") returned 4
	[0057.681] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0057.681] lstrlenW (lpString=".php3") returned 5
	[0057.681] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0057.681] lstrlenW (lpString=".php4") returned 5
	[0057.681] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0057.681] lstrlenW (lpString=".php5") returned 5
	[0057.681] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0057.681] lstrlenW (lpString=".phtml") returned 6
	[0057.681] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0057.681] lstrlenW (lpString=".pict") returned 5
	[0057.681] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0057.681] lstrlenW (lpString=".pl") returned 3
	[0057.681] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0057.681] lstrlenW (lpString=".pls") returned 4
	[0057.681] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0057.681] lstrlenW (lpString=".pm") returned 3
	[0057.681] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0057.681] lstrlenW (lpString=".png") returned 4
	[0057.681] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0057.681] lstrlenW (lpString=".pnm") returned 4
	[0057.681] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0057.681] lstrlenW (lpString=".pot") returned 4
	[0057.681] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0057.681] lstrlenW (lpString=".potm") returned 5
	[0057.681] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0057.681] lstrlenW (lpString=".potx") returned 5
	[0057.682] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0057.682] lstrlenW (lpString=".ppa") returned 4
	[0057.682] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0057.682] lstrlenW (lpString=".ppam") returned 5
	[0057.682] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0057.682] lstrlenW (lpString=".ppm") returned 4
	[0057.682] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0057.682] lstrlenW (lpString=".pps") returned 4
	[0057.682] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0057.682] lstrlenW (lpString=".ppsm") returned 5
	[0057.682] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0057.682] lstrlenW (lpString=".ppt") returned 4
	[0057.682] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0057.682] lstrlenW (lpString=".pptm") returned 5
	[0057.682] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0057.682] lstrlenW (lpString=".pptx") returned 5
	[0057.682] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0057.682] lstrlenW (lpString=".prn") returned 4
	[0057.682] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0057.682] lstrlenW (lpString=".ps") returned 3
	[0057.682] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0057.682] lstrlenW (lpString=".psb") returned 4
	[0057.683] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0057.683] lstrlenW (lpString=".psd") returned 4
	[0057.683] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0057.683] lstrlenW (lpString=".pst") returned 4
	[0057.683] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0057.683] lstrlenW (lpString=".ptx") returned 4
	[0057.683] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0057.683] lstrlenW (lpString=".pub") returned 4
	[0057.683] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0057.683] lstrlenW (lpString=".pwm") returned 4
	[0057.683] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0057.683] lstrlenW (lpString=".pxr") returned 4
	[0057.683] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0057.683] lstrlenW (lpString=".py") returned 3
	[0057.683] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0057.683] lstrlenW (lpString=".qt") returned 3
	[0057.683] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0057.683] lstrlenW (lpString=".r3d") returned 4
	[0057.683] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0057.683] lstrlenW (lpString=".raf") returned 4
	[0057.683] lstrcmpiW (lpString1=".raf", lpString2="oney") returned -1
	[0057.683] lstrlenW (lpString=".rar") returned 4
	[0057.684] lstrcmpiW (lpString1=".rar", lpString2="oney") returned -1
	[0057.684] lstrlenW (lpString=".raw") returned 4
	[0057.684] lstrcmpiW (lpString1=".raw", lpString2="oney") returned -1
	[0057.684] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1
	[0057.684] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1
	[0057.684] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1
	[0057.685] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0
	[0057.685] FindClose (in: hFindFile=0x6f46a8 | out: hFindFile=0x6f46a8) returned 1
	[0057.685] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0057.685] FindNextFileW (in: hFindFile=0x6f44a8, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0057.685] FindClose (in: hFindFile=0x6f44a8 | out: hFindFile=0x6f44a8) returned 1
	[0057.685] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0057.685] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x3d9fcf8 | out: lpFindFileData=0x3d9fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0057.685] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0057.685] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin") returned 1
	[0057.685] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0057.685] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$Recycle.Bin") returned 1
	[0057.685] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4200728
	[0057.685] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0057.685] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6f4328
	[0057.686] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0057.686] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0057.686] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24
	[0057.686] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-18") returned 1
	[0057.686] lstrlenW (lpString="S-1-5-18") returned 8
	[0057.686] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-18") returned -1
	[0057.686] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0057.686] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24
	[0057.686] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4428
	[0057.686] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.686] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd876e0d4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd876e0d4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DESKTO~1.MON")) returned 1
	[0057.687] lstrlenW (lpString="desktop.ini.id-B4197730.[admin@stex777.com].money") returned 49
	[0057.687] lstrlenW (lpString=".1cd") returned 4
	[0057.687] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0057.687] lstrlenW (lpString=".3ds") returned 4
	[0057.687] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0057.687] lstrlenW (lpString=".3fr") returned 4
	[0057.687] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0057.687] lstrlenW (lpString=".3g2") returned 4
	[0057.687] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0057.687] lstrlenW (lpString=".3gp") returned 4
	[0057.687] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0057.687] lstrlenW (lpString=".7z") returned 3
	[0057.687] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0057.687] lstrlenW (lpString=".accda") returned 6
	[0057.687] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0057.687] lstrlenW (lpString=".accdb") returned 6
	[0057.687] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0057.687] lstrlenW (lpString=".accdc") returned 6
	[0057.687] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0057.688] lstrlenW (lpString=".accde") returned 6
	[0057.688] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0057.688] lstrlenW (lpString=".accdt") returned 6
	[0057.688] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0057.688] lstrlenW (lpString=".accdw") returned 6
	[0057.688] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0057.688] lstrlenW (lpString=".adb") returned 4
	[0057.688] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0057.688] lstrlenW (lpString=".adp") returned 4
	[0057.688] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0057.688] lstrlenW (lpString=".ai") returned 3
	[0057.688] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0057.688] lstrlenW (lpString=".ai3") returned 4
	[0057.688] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0057.688] lstrlenW (lpString=".ai4") returned 4
	[0057.688] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0057.688] lstrlenW (lpString=".ai5") returned 4
	[0057.688] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0057.688] lstrlenW (lpString=".ai6") returned 4
	[0057.689] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0057.689] lstrlenW (lpString=".ai7") returned 4
	[0057.689] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0057.689] lstrlenW (lpString=".ai8") returned 4
	[0057.689] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0057.689] lstrlenW (lpString=".anim") returned 5
	[0057.689] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0057.689] lstrlenW (lpString=".arw") returned 4
	[0057.689] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0057.689] lstrlenW (lpString=".as") returned 3
	[0057.689] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0057.689] lstrlenW (lpString=".asa") returned 4
	[0057.689] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0057.689] lstrlenW (lpString=".asc") returned 4
	[0057.689] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0057.689] lstrlenW (lpString=".ascx") returned 5
	[0057.689] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0057.690] lstrlenW (lpString=".asm") returned 4
	[0057.690] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0057.690] lstrlenW (lpString=".asmx") returned 5
	[0057.690] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0057.690] lstrlenW (lpString=".asp") returned 4
	[0057.690] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0057.690] lstrlenW (lpString=".aspx") returned 5
	[0057.690] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0057.690] lstrlenW (lpString=".asr") returned 4
	[0057.690] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0057.690] lstrlenW (lpString=".asx") returned 4
	[0057.690] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0057.690] lstrlenW (lpString=".avi") returned 4
	[0057.690] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0057.690] lstrlenW (lpString=".avs") returned 4
	[0057.690] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0057.690] lstrlenW (lpString=".backup") returned 7
	[0057.690] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0057.690] lstrlenW (lpString=".bak") returned 4
	[0057.690] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0057.690] lstrlenW (lpString=".bay") returned 4
	[0057.690] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0057.691] lstrlenW (lpString=".bd") returned 3
	[0057.691] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0057.691] lstrlenW (lpString=".bin") returned 4
	[0057.691] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0057.691] lstrlenW (lpString=".bmp") returned 4
	[0057.691] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0057.691] lstrlenW (lpString=".bz2") returned 4
	[0057.691] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0057.691] lstrlenW (lpString=".c") returned 2
	[0057.691] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0057.691] lstrlenW (lpString=".cdr") returned 4
	[0057.691] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0057.691] lstrlenW (lpString=".cer") returned 4
	[0057.691] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0057.691] lstrlenW (lpString=".cf") returned 3
	[0057.691] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0057.691] lstrlenW (lpString=".cfc") returned 4
	[0057.691] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0057.691] lstrlenW (lpString=".cfm") returned 4
	[0057.691] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0057.691] lstrlenW (lpString=".cfml") returned 5
	[0057.692] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0057.692] lstrlenW (lpString=".cfu") returned 4
	[0057.692] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0057.692] lstrlenW (lpString=".chm") returned 4
	[0057.692] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0057.692] lstrlenW (lpString=".cin") returned 4
	[0057.692] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0057.692] lstrlenW (lpString=".class") returned 6
	[0057.692] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0057.692] lstrlenW (lpString=".clx") returned 4
	[0057.692] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0057.692] lstrlenW (lpString=".config") returned 7
	[0057.692] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0057.692] lstrlenW (lpString=".cpp") returned 4
	[0057.692] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0057.692] lstrlenW (lpString=".cr2") returned 4
	[0057.692] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0057.692] lstrlenW (lpString=".crt") returned 4
	[0057.692] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0057.692] lstrlenW (lpString=".crw") returned 4
	[0057.692] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0057.692] lstrlenW (lpString=".cs") returned 3
	[0057.692] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0057.692] lstrlenW (lpString=".css") returned 4
	[0057.693] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0057.693] lstrlenW (lpString=".csv") returned 4
	[0057.693] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0057.693] lstrlenW (lpString=".cub") returned 4
	[0057.693] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0057.693] lstrlenW (lpString=".dae") returned 4
	[0057.693] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0057.693] lstrlenW (lpString=".dat") returned 4
	[0057.693] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0057.693] lstrlenW (lpString=".db") returned 3
	[0057.693] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0057.693] lstrlenW (lpString=".dbf") returned 4
	[0057.693] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0057.693] lstrlenW (lpString=".dbx") returned 4
	[0057.693] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0057.693] lstrlenW (lpString=".dc3") returned 4
	[0057.693] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0057.693] lstrlenW (lpString=".dcm") returned 4
	[0057.693] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0057.693] lstrlenW (lpString=".dcr") returned 4
	[0057.693] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0057.693] lstrlenW (lpString=".der") returned 4
	[0057.693] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0057.694] lstrlenW (lpString=".dib") returned 4
	[0057.694] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0057.694] lstrlenW (lpString=".dic") returned 4
	[0057.694] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0057.694] lstrlenW (lpString=".dif") returned 4
	[0057.694] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0057.694] lstrlenW (lpString=".divx") returned 5
	[0057.694] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0057.694] lstrlenW (lpString=".djvu") returned 5
	[0057.694] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0057.694] lstrlenW (lpString=".dng") returned 4
	[0057.694] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0057.694] lstrlenW (lpString=".doc") returned 4
	[0057.694] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0057.694] lstrlenW (lpString=".docm") returned 5
	[0057.694] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0057.694] lstrlenW (lpString=".docx") returned 5
	[0057.694] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0057.694] lstrlenW (lpString=".dot") returned 4
	[0057.694] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0057.694] lstrlenW (lpString=".dotm") returned 5
	[0057.694] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0057.694] lstrlenW (lpString=".dotx") returned 5
	[0057.694] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0057.694] lstrlenW (lpString=".dpx") returned 4
	[0057.695] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0057.695] lstrlenW (lpString=".dqy") returned 4
	[0057.695] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0057.695] lstrlenW (lpString=".dsn") returned 4
	[0057.695] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0057.695] lstrlenW (lpString=".dt") returned 3
	[0057.695] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0057.695] lstrlenW (lpString=".dtd") returned 4
	[0057.695] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0057.695] lstrlenW (lpString=".dwg") returned 4
	[0057.695] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0057.695] lstrlenW (lpString=".dwt") returned 4
	[0057.695] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0057.695] lstrlenW (lpString=".dx") returned 3
	[0057.695] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0057.695] lstrlenW (lpString=".dxf") returned 4
	[0057.695] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0057.695] lstrlenW (lpString=".edml") returned 5
	[0057.695] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0057.695] lstrlenW (lpString=".efd") returned 4
	[0057.695] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0057.696] lstrlenW (lpString=".elf") returned 4
	[0057.696] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0057.696] lstrlenW (lpString=".emf") returned 4
	[0057.696] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0057.696] lstrlenW (lpString=".emz") returned 4
	[0057.696] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0057.696] lstrlenW (lpString=".epf") returned 4
	[0057.696] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0057.696] lstrlenW (lpString=".eps") returned 4
	[0057.696] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0057.696] lstrlenW (lpString=".epsf") returned 5
	[0057.696] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0057.696] lstrlenW (lpString=".epsp") returned 5
	[0057.696] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0057.696] lstrlenW (lpString=".erf") returned 4
	[0057.696] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0057.696] lstrlenW (lpString=".exr") returned 4
	[0057.696] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0057.696] lstrlenW (lpString=".f4v") returned 4
	[0057.696] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0057.696] lstrlenW (lpString=".fido") returned 5
	[0057.697] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0057.697] lstrlenW (lpString=".flm") returned 4
	[0057.697] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0057.697] lstrlenW (lpString=".flv") returned 4
	[0057.697] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0057.697] lstrlenW (lpString=".frm") returned 4
	[0057.697] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0057.697] lstrlenW (lpString=".fxg") returned 4
	[0057.697] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0057.697] lstrlenW (lpString=".geo") returned 4
	[0057.697] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0057.697] lstrlenW (lpString=".gif") returned 4
	[0057.697] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0057.697] lstrlenW (lpString=".grs") returned 4
	[0057.697] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0057.697] lstrlenW (lpString=".gz") returned 3
	[0057.697] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0057.698] lstrlenW (lpString=".h") returned 2
	[0057.698] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0057.698] lstrlenW (lpString=".hdr") returned 4
	[0057.698] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0057.698] lstrlenW (lpString=".hpp") returned 4
	[0057.698] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0057.698] lstrlenW (lpString=".hta") returned 4
	[0057.698] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0057.698] lstrlenW (lpString=".htc") returned 4
	[0057.698] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0057.698] lstrlenW (lpString=".htm") returned 4
	[0057.698] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0057.698] lstrlenW (lpString=".html") returned 5
	[0057.698] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0057.698] lstrlenW (lpString=".icb") returned 4
	[0057.698] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0057.698] lstrlenW (lpString=".ics") returned 4
	[0057.698] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0057.698] lstrlenW (lpString=".iff") returned 4
	[0057.698] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0057.698] lstrlenW (lpString=".inc") returned 4
	[0057.698] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0057.699] lstrlenW (lpString=".indd") returned 5
	[0057.699] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0057.699] lstrlenW (lpString=".ini") returned 4
	[0057.699] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0057.699] lstrlenW (lpString=".iqy") returned 4
	[0057.699] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0057.699] lstrlenW (lpString=".j2c") returned 4
	[0057.699] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0057.699] lstrlenW (lpString=".j2k") returned 4
	[0057.699] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0057.699] lstrlenW (lpString=".java") returned 5
	[0057.699] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0057.699] lstrlenW (lpString=".jp2") returned 4
	[0057.699] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0057.699] lstrlenW (lpString=".jpc") returned 4
	[0057.699] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0057.699] lstrlenW (lpString=".jpe") returned 4
	[0057.699] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0057.700] lstrlenW (lpString=".jpeg") returned 5
	[0057.700] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0057.700] lstrlenW (lpString=".jpf") returned 4
	[0057.700] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0057.700] lstrlenW (lpString=".jpg") returned 4
	[0057.700] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0057.700] lstrlenW (lpString=".jpx") returned 4
	[0057.700] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0057.700] lstrlenW (lpString=".js") returned 3
	[0057.700] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0057.700] lstrlenW (lpString=".jsf") returned 4
	[0057.700] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0057.700] lstrlenW (lpString=".json") returned 5
	[0057.700] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0057.700] lstrlenW (lpString=".jsp") returned 4
	[0057.700] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0057.700] lstrlenW (lpString=".kdc") returned 4
	[0057.700] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0057.700] lstrlenW (lpString=".kmz") returned 4
	[0057.701] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0057.701] lstrlenW (lpString=".kwm") returned 4
	[0057.701] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0057.701] lstrlenW (lpString=".lasso") returned 6
	[0057.701] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0057.701] lstrlenW (lpString=".lbi") returned 4
	[0057.701] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0057.701] lstrlenW (lpString=".lgf") returned 4
	[0057.701] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0057.701] lstrlenW (lpString=".lgp") returned 4
	[0057.701] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0057.701] lstrlenW (lpString=".log") returned 4
	[0057.701] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0057.701] lstrlenW (lpString=".m1v") returned 4
	[0057.701] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0057.701] lstrlenW (lpString=".m4a") returned 4
	[0057.701] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0057.701] lstrlenW (lpString=".m4v") returned 4
	[0057.702] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0057.702] lstrlenW (lpString=".max") returned 4
	[0057.702] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0057.702] lstrlenW (lpString=".md") returned 3
	[0057.702] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0057.702] lstrlenW (lpString=".mda") returned 4
	[0057.702] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0057.702] lstrlenW (lpString=".mdb") returned 4
	[0057.702] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0057.702] lstrlenW (lpString=".mde") returned 4
	[0057.702] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0057.702] lstrlenW (lpString=".mdf") returned 4
	[0057.702] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0057.702] lstrlenW (lpString=".mdw") returned 4
	[0057.702] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0057.702] lstrlenW (lpString=".mef") returned 4
	[0057.702] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0057.702] lstrlenW (lpString=".mft") returned 4
	[0057.702] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0057.702] lstrlenW (lpString=".mfw") returned 4
	[0057.702] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0057.702] lstrlenW (lpString=".mht") returned 4
	[0057.702] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0057.703] lstrlenW (lpString=".mhtml") returned 6
	[0057.703] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0057.703] lstrlenW (lpString=".mka") returned 4
	[0057.703] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0057.703] lstrlenW (lpString=".mkidx") returned 6
	[0057.703] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0057.703] lstrlenW (lpString=".mkv") returned 4
	[0057.703] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0057.703] lstrlenW (lpString=".mos") returned 4
	[0057.703] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0057.703] lstrlenW (lpString=".mov") returned 4
	[0057.703] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0057.703] lstrlenW (lpString=".mp3") returned 4
	[0057.703] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0057.703] lstrlenW (lpString=".mp4") returned 4
	[0057.703] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0057.703] lstrlenW (lpString=".mpeg") returned 5
	[0057.703] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0057.703] lstrlenW (lpString=".mpg") returned 4
	[0057.703] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0057.704] lstrlenW (lpString=".mpv") returned 4
	[0057.704] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0057.704] lstrlenW (lpString=".mrw") returned 4
	[0057.704] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0057.704] lstrlenW (lpString=".msg") returned 4
	[0057.704] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0057.704] lstrlenW (lpString=".mxl") returned 4
	[0057.704] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0057.704] lstrlenW (lpString=".myd") returned 4
	[0057.704] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0057.704] lstrlenW (lpString=".myi") returned 4
	[0057.704] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0057.704] lstrlenW (lpString=".nef") returned 4
	[0057.704] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0057.704] lstrlenW (lpString=".nrw") returned 4
	[0057.704] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0057.704] lstrlenW (lpString=".obj") returned 4
	[0057.704] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0057.704] lstrlenW (lpString=".odb") returned 4
	[0057.704] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0057.704] lstrlenW (lpString=".odc") returned 4
	[0057.704] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0057.705] lstrlenW (lpString=".odm") returned 4
	[0057.705] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0057.705] lstrlenW (lpString=".odp") returned 4
	[0057.705] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0057.705] lstrlenW (lpString=".ods") returned 4
	[0057.705] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0057.705] lstrlenW (lpString=".oft") returned 4
	[0057.705] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0057.705] lstrlenW (lpString=".one") returned 4
	[0057.705] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0057.705] lstrlenW (lpString=".onepkg") returned 7
	[0057.705] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0057.705] lstrlenW (lpString=".onetoc2") returned 8
	[0057.705] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0057.705] lstrlenW (lpString=".opt") returned 4
	[0057.705] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0057.705] lstrlenW (lpString=".oqy") returned 4
	[0057.705] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0057.705] lstrlenW (lpString=".orf") returned 4
	[0057.705] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0057.705] lstrlenW (lpString=".p12") returned 4
	[0057.705] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0057.705] lstrlenW (lpString=".p7b") returned 4
	[0057.705] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0057.706] lstrlenW (lpString=".p7c") returned 4
	[0057.706] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0057.706] lstrlenW (lpString=".pam") returned 4
	[0057.706] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0057.706] lstrlenW (lpString=".pbm") returned 4
	[0057.706] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0057.706] lstrlenW (lpString=".pct") returned 4
	[0057.706] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0057.706] lstrlenW (lpString=".pcx") returned 4
	[0057.706] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0057.706] lstrlenW (lpString=".pdd") returned 4
	[0057.706] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0057.706] lstrlenW (lpString=".pdf") returned 4
	[0057.706] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0057.706] lstrlenW (lpString=".pdp") returned 4
	[0057.706] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0057.706] lstrlenW (lpString=".pef") returned 4
	[0057.706] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0057.706] lstrlenW (lpString=".pem") returned 4
	[0057.706] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0057.706] lstrlenW (lpString=".pff") returned 4
	[0057.707] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0057.707] lstrlenW (lpString=".pfm") returned 4
	[0057.707] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0057.707] lstrlenW (lpString=".pfx") returned 4
	[0057.707] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0057.707] lstrlenW (lpString=".pgm") returned 4
	[0057.707] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0057.707] lstrlenW (lpString=".php") returned 4
	[0057.707] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0057.707] lstrlenW (lpString=".php3") returned 5
	[0057.707] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0057.707] lstrlenW (lpString=".php4") returned 5
	[0057.707] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0057.707] lstrlenW (lpString=".php5") returned 5
	[0057.707] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0057.707] lstrlenW (lpString=".phtml") returned 6
	[0057.707] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0057.707] lstrlenW (lpString=".pict") returned 5
	[0057.707] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0057.707] lstrlenW (lpString=".pl") returned 3
	[0057.707] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0057.707] lstrlenW (lpString=".pls") returned 4
	[0057.707] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0057.707] lstrlenW (lpString=".pm") returned 3
	[0057.708] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0057.708] lstrlenW (lpString=".png") returned 4
	[0057.708] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0057.708] lstrlenW (lpString=".pnm") returned 4
	[0057.708] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0057.709] lstrlenW (lpString=".pot") returned 4
	[0057.709] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0057.710] lstrlenW (lpString=".potm") returned 5
	[0057.710] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0057.710] lstrlenW (lpString=".potx") returned 5
	[0057.710] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0057.710] lstrlenW (lpString=".ppa") returned 4
	[0057.710] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0057.710] lstrlenW (lpString=".ppam") returned 5
	[0057.710] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0057.710] lstrlenW (lpString=".ppm") returned 4
	[0057.710] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0057.710] lstrlenW (lpString=".pps") returned 4
	[0057.710] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0057.710] lstrlenW (lpString=".ppsm") returned 5
	[0057.710] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0057.710] lstrlenW (lpString=".ppt") returned 4
	[0057.710] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0057.710] lstrlenW (lpString=".pptm") returned 5
	[0057.710] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0057.710] lstrlenW (lpString=".pptx") returned 5
	[0057.710] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0057.710] lstrlenW (lpString=".prn") returned 4
	[0057.710] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0057.710] lstrlenW (lpString=".ps") returned 3
	[0057.710] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0057.710] lstrlenW (lpString=".psb") returned 4
	[0057.710] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0057.710] lstrlenW (lpString=".psd") returned 4
	[0057.711] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0057.711] lstrlenW (lpString=".pst") returned 4
	[0057.711] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0057.711] lstrlenW (lpString=".ptx") returned 4
	[0057.711] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0057.711] lstrlenW (lpString=".pub") returned 4
	[0057.711] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0057.711] lstrlenW (lpString=".pwm") returned 4
	[0057.711] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0057.711] lstrlenW (lpString=".pxr") returned 4
	[0057.711] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0057.711] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd876e0d4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd876e0d4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DESKTO~1.MON")) returned 0
	[0057.711] FindClose (in: hFindFile=0x6f4428 | out: hFindFile=0x6f4428) returned 1
	[0057.711] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0057.711] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0057.711] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0057.711] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f43a8
	[0057.712] FindNextFileW (in: hFindFile=0x6f43a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.712] FindNextFileW (in: hFindFile=0x6f43a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd876e0d4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd876e0d4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DESKTO~1.MON")) returned 1
	[0057.712] FindNextFileW (in: hFindFile=0x6f43a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd876e0d4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd876e0d4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DESKTO~1.MON")) returned 0
	[0057.712] FindClose (in: hFindFile=0x6f43a8 | out: hFindFile=0x6f43a8) returned 1
	[0057.712] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0057.712] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0057.712] FindClose (in: hFindFile=0x6f4328 | out: hFindFile=0x6f4328) returned 1
	[0057.712] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0057.712] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x3d9fcf8 | out: lpFindFileData=0x3d9fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0057.712] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x3d9fcf8 | out: lpFindFileData=0x3d9fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0057.712] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0057.713] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212") returned 1
	[0057.713] lstrlenW (lpString="588bce7c90097ed212") returned 18
	[0057.713] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="588bce7c90097ed212") returned 1
	[0057.713] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4200728
	[0057.713] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0057.713] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6f4068
	[0057.713] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0057.713] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1
	[0057.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0057.713] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1
	[0057.713] lstrlenW (lpString="1025") returned 4
	[0057.713] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1
	[0057.713] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0057.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0057.713] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f41a8
	[0057.713] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.713] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0057.714] lstrlenW (lpString="eula.rtf") returned 8
	[0057.714] lstrlenW (lpString=".1cd") returned 4
	[0057.714] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0057.714] lstrlenW (lpString=".3ds") returned 4
	[0057.714] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0057.714] lstrlenW (lpString=".3fr") returned 4
	[0057.714] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0057.714] lstrlenW (lpString=".3g2") returned 4
	[0057.714] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0057.714] lstrlenW (lpString=".3gp") returned 4
	[0057.714] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0057.714] lstrlenW (lpString=".7z") returned 3
	[0057.714] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0057.714] lstrlenW (lpString=".accda") returned 6
	[0057.714] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0057.714] lstrlenW (lpString=".accdb") returned 6
	[0057.714] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0057.714] lstrlenW (lpString=".accdc") returned 6
	[0057.714] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0057.714] lstrlenW (lpString=".accde") returned 6
	[0057.714] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0057.714] lstrlenW (lpString=".accdt") returned 6
	[0057.715] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0057.715] lstrlenW (lpString=".accdw") returned 6
	[0057.715] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0057.715] lstrlenW (lpString=".adb") returned 4
	[0057.715] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0057.715] lstrlenW (lpString=".adp") returned 4
	[0057.715] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0057.715] lstrlenW (lpString=".ai") returned 3
	[0057.715] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0057.715] lstrlenW (lpString=".ai3") returned 4
	[0057.715] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0057.715] lstrlenW (lpString=".ai4") returned 4
	[0057.715] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0057.715] lstrlenW (lpString=".ai5") returned 4
	[0057.715] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0057.715] lstrlenW (lpString=".ai6") returned 4
	[0057.715] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0057.715] lstrlenW (lpString=".ai7") returned 4
	[0057.715] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0057.715] lstrlenW (lpString=".ai8") returned 4
	[0057.715] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0057.715] lstrlenW (lpString=".anim") returned 5
	[0057.715] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0057.715] lstrlenW (lpString=".arw") returned 4
	[0057.715] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0057.715] lstrlenW (lpString=".as") returned 3
	[0057.715] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0057.715] lstrlenW (lpString=".asa") returned 4
	[0057.716] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0057.716] lstrlenW (lpString=".asc") returned 4
	[0057.716] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0057.716] lstrlenW (lpString=".ascx") returned 5
	[0057.716] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0057.716] lstrlenW (lpString=".asm") returned 4
	[0057.716] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0057.716] lstrlenW (lpString=".asmx") returned 5
	[0057.716] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0057.716] lstrlenW (lpString=".asp") returned 4
	[0057.716] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0057.716] lstrlenW (lpString=".aspx") returned 5
	[0057.716] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0057.716] lstrlenW (lpString=".asr") returned 4
	[0057.716] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0057.716] lstrlenW (lpString=".asx") returned 4
	[0057.716] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0057.716] lstrlenW (lpString=".avi") returned 4
	[0057.716] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0057.716] lstrlenW (lpString=".avs") returned 4
	[0057.716] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0057.716] lstrlenW (lpString=".backup") returned 7
	[0057.716] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0057.716] lstrlenW (lpString=".bak") returned 4
	[0057.716] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0057.716] lstrlenW (lpString=".bay") returned 4
	[0057.716] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0057.716] lstrlenW (lpString=".bd") returned 3
	[0057.716] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0057.716] lstrlenW (lpString=".bin") returned 4
	[0057.716] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0057.717] lstrlenW (lpString=".bmp") returned 4
	[0057.717] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0057.717] lstrlenW (lpString=".bz2") returned 4
	[0057.717] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0057.717] lstrlenW (lpString=".c") returned 2
	[0057.717] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0057.717] lstrlenW (lpString=".cdr") returned 4
	[0057.717] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0057.717] lstrlenW (lpString=".cer") returned 4
	[0057.717] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0057.717] lstrlenW (lpString=".cf") returned 3
	[0057.717] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0057.717] lstrlenW (lpString=".cfc") returned 4
	[0057.717] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0057.717] lstrlenW (lpString=".cfm") returned 4
	[0057.717] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0057.717] lstrlenW (lpString=".cfml") returned 5
	[0057.717] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0057.717] lstrlenW (lpString=".cfu") returned 4
	[0057.717] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0057.717] lstrlenW (lpString=".chm") returned 4
	[0057.717] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0057.717] lstrlenW (lpString=".cin") returned 4
	[0057.717] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0057.717] lstrlenW (lpString=".class") returned 6
	[0057.717] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0057.717] lstrlenW (lpString=".clx") returned 4
	[0057.717] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0057.717] lstrlenW (lpString=".config") returned 7
	[0057.718] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0057.718] lstrlenW (lpString=".cpp") returned 4
	[0057.718] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".cr2") returned 4
	[0057.718] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".crt") returned 4
	[0057.718] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".crw") returned 4
	[0057.718] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".cs") returned 3
	[0057.718] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0057.718] lstrlenW (lpString=".css") returned 4
	[0057.718] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".csv") returned 4
	[0057.718] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".cub") returned 4
	[0057.718] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".dae") returned 4
	[0057.718] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".dat") returned 4
	[0057.718] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".db") returned 3
	[0057.718] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0057.718] lstrlenW (lpString=".dbf") returned 4
	[0057.718] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".dbx") returned 4
	[0057.718] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".dc3") returned 4
	[0057.718] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0057.718] lstrlenW (lpString=".dcm") returned 4
	[0057.719] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0057.719] lstrlenW (lpString=".dcr") returned 4
	[0057.719] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0057.719] lstrlenW (lpString=".der") returned 4
	[0057.719] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0057.719] lstrlenW (lpString=".dib") returned 4
	[0057.719] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0057.719] lstrlenW (lpString=".dic") returned 4
	[0057.719] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0057.719] lstrlenW (lpString=".dif") returned 4
	[0057.719] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0057.719] lstrlenW (lpString=".divx") returned 5
	[0057.719] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0057.719] lstrlenW (lpString=".djvu") returned 5
	[0057.719] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0057.719] lstrlenW (lpString=".dng") returned 4
	[0057.719] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0057.719] lstrlenW (lpString=".doc") returned 4
	[0057.719] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0057.719] lstrlenW (lpString=".docm") returned 5
	[0057.719] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0057.719] lstrlenW (lpString=".docx") returned 5
	[0057.719] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0057.719] lstrlenW (lpString=".dot") returned 4
	[0057.719] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0057.719] lstrlenW (lpString=".dotm") returned 5
	[0057.719] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0057.719] lstrlenW (lpString=".dotx") returned 5
	[0057.720] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0057.720] lstrlenW (lpString=".dpx") returned 4
	[0057.720] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0057.720] lstrlenW (lpString=".dqy") returned 4
	[0057.720] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0057.720] lstrlenW (lpString=".dsn") returned 4
	[0057.720] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0057.720] lstrlenW (lpString=".dt") returned 3
	[0057.720] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0057.720] lstrlenW (lpString=".dtd") returned 4
	[0057.720] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0057.720] lstrlenW (lpString=".dwg") returned 4
	[0057.720] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0057.720] lstrlenW (lpString=".dwt") returned 4
	[0057.720] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0057.720] lstrlenW (lpString=".dx") returned 3
	[0057.720] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0057.720] lstrlenW (lpString=".dxf") returned 4
	[0057.720] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0057.720] lstrlenW (lpString=".edml") returned 5
	[0057.720] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0057.720] lstrlenW (lpString=".efd") returned 4
	[0057.720] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0057.720] lstrlenW (lpString=".elf") returned 4
	[0057.720] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0057.720] lstrlenW (lpString=".emf") returned 4
	[0057.721] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0057.721] lstrlenW (lpString=".emz") returned 4
	[0057.721] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0057.721] lstrlenW (lpString=".epf") returned 4
	[0057.721] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0057.721] lstrlenW (lpString=".eps") returned 4
	[0057.721] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0057.721] lstrlenW (lpString=".epsf") returned 5
	[0057.721] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0057.721] lstrlenW (lpString=".epsp") returned 5
	[0057.721] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0057.721] lstrlenW (lpString=".erf") returned 4
	[0057.721] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0057.721] lstrlenW (lpString=".exr") returned 4
	[0057.721] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0057.721] lstrlenW (lpString=".f4v") returned 4
	[0057.721] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0057.721] lstrlenW (lpString=".fido") returned 5
	[0057.721] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0057.721] lstrlenW (lpString=".flm") returned 4
	[0057.721] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0057.721] lstrlenW (lpString=".flv") returned 4
	[0057.721] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0057.721] lstrlenW (lpString=".frm") returned 4
	[0057.721] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0057.721] lstrlenW (lpString=".fxg") returned 4
	[0057.721] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0057.722] lstrlenW (lpString=".geo") returned 4
	[0057.722] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0057.722] lstrlenW (lpString=".gif") returned 4
	[0057.722] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0057.722] lstrlenW (lpString=".grs") returned 4
	[0057.722] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0057.722] lstrlenW (lpString=".gz") returned 3
	[0057.722] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0057.722] lstrlenW (lpString=".h") returned 2
	[0057.722] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0057.722] lstrlenW (lpString=".hdr") returned 4
	[0057.722] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0057.722] lstrlenW (lpString=".hpp") returned 4
	[0057.722] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0057.722] lstrlenW (lpString=".hta") returned 4
	[0057.722] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0057.722] lstrlenW (lpString=".htc") returned 4
	[0057.722] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0057.722] lstrlenW (lpString=".htm") returned 4
	[0057.722] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0057.722] lstrlenW (lpString=".html") returned 5
	[0057.722] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0057.722] lstrlenW (lpString=".icb") returned 4
	[0057.722] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0057.722] lstrlenW (lpString=".ics") returned 4
	[0057.723] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0057.723] lstrlenW (lpString=".iff") returned 4
	[0057.723] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0057.723] lstrlenW (lpString=".inc") returned 4
	[0057.723] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0057.723] lstrlenW (lpString=".indd") returned 5
	[0057.723] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0057.723] lstrlenW (lpString=".ini") returned 4
	[0057.723] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0057.723] lstrlenW (lpString=".iqy") returned 4
	[0057.723] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0057.723] lstrlenW (lpString=".j2c") returned 4
	[0057.723] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0057.723] lstrlenW (lpString=".j2k") returned 4
	[0057.723] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0057.723] lstrlenW (lpString=".java") returned 5
	[0057.723] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0057.723] lstrlenW (lpString=".jp2") returned 4
	[0057.723] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0057.723] lstrlenW (lpString=".jpc") returned 4
	[0057.723] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0057.876] lstrlenW (lpString=".jpe") returned 4
	[0057.939] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0057.939] lstrlenW (lpString=".jpeg") returned 5
	[0057.958] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0057.958] lstrlenW (lpString=".jpf") returned 4
	[0057.958] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0057.958] lstrlenW (lpString=".jpg") returned 4
	[0057.958] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0057.958] lstrlenW (lpString=".jpx") returned 4
	[0057.958] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0057.958] lstrlenW (lpString=".js") returned 3
	[0057.958] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0057.958] lstrlenW (lpString=".jsf") returned 4
	[0057.958] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0057.958] lstrlenW (lpString=".json") returned 5
	[0057.958] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0057.958] lstrlenW (lpString=".jsp") returned 4
	[0057.958] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0057.958] lstrlenW (lpString=".kdc") returned 4
	[0057.958] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0057.958] lstrlenW (lpString=".kmz") returned 4
	[0057.958] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0057.958] lstrlenW (lpString=".kwm") returned 4
	[0057.959] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".lasso") returned 6
	[0057.959] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0057.959] lstrlenW (lpString=".lbi") returned 4
	[0057.959] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".lgf") returned 4
	[0057.959] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".lgp") returned 4
	[0057.959] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".log") returned 4
	[0057.959] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".m1v") returned 4
	[0057.959] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".m4a") returned 4
	[0057.959] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".m4v") returned 4
	[0057.959] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".max") returned 4
	[0057.959] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".md") returned 3
	[0057.959] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0057.959] lstrlenW (lpString=".mda") returned 4
	[0057.959] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".mdb") returned 4
	[0057.959] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".mde") returned 4
	[0057.959] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".mdf") returned 4
	[0057.959] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0057.959] lstrlenW (lpString=".mdw") returned 4
	[0057.959] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mef") returned 4
	[0057.960] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mft") returned 4
	[0057.960] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mfw") returned 4
	[0057.960] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mht") returned 4
	[0057.960] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mhtml") returned 6
	[0057.960] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0057.960] lstrlenW (lpString=".mka") returned 4
	[0057.960] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mkidx") returned 6
	[0057.960] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0057.960] lstrlenW (lpString=".mkv") returned 4
	[0057.960] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mos") returned 4
	[0057.960] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mov") returned 4
	[0057.960] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mp3") returned 4
	[0057.960] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mp4") returned 4
	[0057.960] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mpeg") returned 5
	[0057.960] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0057.960] lstrlenW (lpString=".mpg") returned 4
	[0057.960] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mpv") returned 4
	[0057.960] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0057.960] lstrlenW (lpString=".mrw") returned 4
	[0057.961] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".msg") returned 4
	[0057.961] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".mxl") returned 4
	[0057.961] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".myd") returned 4
	[0057.961] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".myi") returned 4
	[0057.961] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".nef") returned 4
	[0057.961] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".nrw") returned 4
	[0057.961] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".obj") returned 4
	[0057.961] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".odb") returned 4
	[0057.961] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".odc") returned 4
	[0057.961] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".odm") returned 4
	[0057.961] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".odp") returned 4
	[0057.961] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".ods") returned 4
	[0057.961] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0057.961] lstrlenW (lpString=".oft") returned 4
	[0057.962] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0057.962] lstrlenW (lpString=".one") returned 4
	[0057.962] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0057.962] lstrlenW (lpString=".onepkg") returned 7
	[0057.962] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0057.962] lstrlenW (lpString=".onetoc2") returned 8
	[0057.962] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0057.962] lstrlenW (lpString=".opt") returned 4
	[0057.962] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0057.962] lstrlenW (lpString=".oqy") returned 4
	[0057.962] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0057.962] lstrlenW (lpString=".orf") returned 4
	[0057.962] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0057.962] lstrlenW (lpString=".p12") returned 4
	[0057.962] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0057.962] lstrlenW (lpString=".p7b") returned 4
	[0057.962] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0057.962] lstrlenW (lpString=".p7c") returned 4
	[0057.962] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0057.962] lstrlenW (lpString=".pam") returned 4
	[0057.962] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0057.962] lstrlenW (lpString=".pbm") returned 4
	[0057.962] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0057.962] lstrlenW (lpString=".pct") returned 4
	[0057.962] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".pcx") returned 4
	[0057.963] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".pdd") returned 4
	[0057.963] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".pdf") returned 4
	[0057.963] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".pdp") returned 4
	[0057.963] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".pef") returned 4
	[0057.963] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".pem") returned 4
	[0057.963] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".pff") returned 4
	[0057.963] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".pfm") returned 4
	[0057.963] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".pfx") returned 4
	[0057.963] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".pgm") returned 4
	[0057.963] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".php") returned 4
	[0057.963] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0057.963] lstrlenW (lpString=".php3") returned 5
	[0057.963] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0057.964] lstrlenW (lpString=".php4") returned 5
	[0057.964] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0057.964] lstrlenW (lpString=".php5") returned 5
	[0057.964] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0057.964] lstrlenW (lpString=".phtml") returned 6
	[0057.964] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0057.964] lstrlenW (lpString=".pict") returned 5
	[0057.964] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0057.964] lstrlenW (lpString=".pl") returned 3
	[0057.964] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0057.964] lstrlenW (lpString=".pls") returned 4
	[0057.964] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0057.964] lstrlenW (lpString=".pm") returned 3
	[0057.964] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0057.964] lstrlenW (lpString=".png") returned 4
	[0057.964] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0057.964] lstrlenW (lpString=".pnm") returned 4
	[0057.964] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0057.964] lstrlenW (lpString=".pot") returned 4
	[0057.964] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0057.964] lstrlenW (lpString=".potm") returned 5
	[0057.964] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0057.964] lstrlenW (lpString=".potx") returned 5
	[0057.964] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0057.964] lstrlenW (lpString=".ppa") returned 4
	[0057.965] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0057.965] lstrlenW (lpString=".ppam") returned 5
	[0057.965] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0057.965] lstrlenW (lpString=".ppm") returned 4
	[0057.965] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0057.965] lstrlenW (lpString=".pps") returned 4
	[0057.965] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0057.965] lstrlenW (lpString=".ppsm") returned 5
	[0057.965] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0057.965] lstrlenW (lpString=".ppt") returned 4
	[0057.965] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0057.965] lstrlenW (lpString=".pptm") returned 5
	[0057.965] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0057.965] lstrlenW (lpString=".pptx") returned 5
	[0057.965] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0057.965] lstrlenW (lpString=".prn") returned 4
	[0057.965] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0057.965] lstrlenW (lpString=".ps") returned 3
	[0057.965] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0057.965] lstrlenW (lpString=".psb") returned 4
	[0057.965] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0057.965] lstrlenW (lpString=".psd") returned 4
	[0057.965] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0057.965] lstrlenW (lpString=".pst") returned 4
	[0057.965] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0057.965] lstrlenW (lpString=".ptx") returned 4
	[0057.965] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0057.966] lstrlenW (lpString=".pub") returned 4
	[0057.966] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0057.966] lstrlenW (lpString=".pwm") returned 4
	[0057.966] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0057.966] lstrlenW (lpString=".pxr") returned 4
	[0057.966] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0057.966] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0057.966] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0057.966] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0057.966] FindClose (in: hFindFile=0x6f41a8 | out: hFindFile=0x6f41a8) returned 1
	[0057.966] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0057.966] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1
	[0057.967] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0057.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26
	[0057.967] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4168
	[0057.967] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.967] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0057.967] lstrlenW (lpString="eula.rtf") returned 8
	[0057.967] lstrlenW (lpString=".1cd") returned 4
	[0057.967] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0057.967] lstrlenW (lpString=".3ds") returned 4
	[0057.967] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0057.967] lstrlenW (lpString=".3fr") returned 4
	[0057.967] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0057.967] lstrlenW (lpString=".3g2") returned 4
	[0057.967] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0057.967] lstrlenW (lpString=".3gp") returned 4
	[0057.967] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0057.967] lstrlenW (lpString=".7z") returned 3
	[0057.967] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0057.967] lstrlenW (lpString=".accda") returned 6
	[0057.967] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0057.968] lstrlenW (lpString=".accdb") returned 6
	[0057.968] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0057.968] lstrlenW (lpString=".accdc") returned 6
	[0057.968] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0057.968] lstrlenW (lpString=".accde") returned 6
	[0057.968] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0057.968] lstrlenW (lpString=".accdt") returned 6
	[0057.968] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0057.968] lstrlenW (lpString=".accdw") returned 6
	[0057.968] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0057.968] lstrlenW (lpString=".adb") returned 4
	[0057.968] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0057.968] lstrlenW (lpString=".adp") returned 4
	[0057.968] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0057.968] lstrlenW (lpString=".ai") returned 3
	[0057.968] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0057.968] lstrlenW (lpString=".ai3") returned 4
	[0057.968] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0057.968] lstrlenW (lpString=".ai4") returned 4
	[0057.968] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0057.968] lstrlenW (lpString=".ai5") returned 4
	[0057.968] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0057.968] lstrlenW (lpString=".ai6") returned 4
	[0057.968] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0057.968] lstrlenW (lpString=".ai7") returned 4
	[0057.969] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0057.969] lstrlenW (lpString=".ai8") returned 4
	[0057.969] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0057.969] lstrlenW (lpString=".anim") returned 5
	[0057.969] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0057.969] lstrlenW (lpString=".arw") returned 4
	[0057.969] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0057.969] lstrlenW (lpString=".as") returned 3
	[0057.969] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0057.969] lstrlenW (lpString=".asa") returned 4
	[0057.969] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0057.969] lstrlenW (lpString=".asc") returned 4
	[0057.969] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0057.969] lstrlenW (lpString=".ascx") returned 5
	[0057.969] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0057.969] lstrlenW (lpString=".asm") returned 4
	[0057.969] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0057.969] lstrlenW (lpString=".asmx") returned 5
	[0057.969] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0057.969] lstrlenW (lpString=".asp") returned 4
	[0057.969] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0057.969] lstrlenW (lpString=".aspx") returned 5
	[0057.969] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0057.969] lstrlenW (lpString=".asr") returned 4
	[0057.970] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0057.970] lstrlenW (lpString=".asx") returned 4
	[0057.970] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0057.970] lstrlenW (lpString=".avi") returned 4
	[0057.970] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0057.970] lstrlenW (lpString=".avs") returned 4
	[0057.970] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0057.970] lstrlenW (lpString=".backup") returned 7
	[0057.970] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0057.970] lstrlenW (lpString=".bak") returned 4
	[0057.970] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0057.970] lstrlenW (lpString=".bay") returned 4
	[0057.970] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0057.970] lstrlenW (lpString=".bd") returned 3
	[0057.970] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0057.970] lstrlenW (lpString=".bin") returned 4
	[0057.970] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0057.970] lstrlenW (lpString=".bmp") returned 4
	[0057.970] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0057.970] lstrlenW (lpString=".bz2") returned 4
	[0057.970] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0057.970] lstrlenW (lpString=".c") returned 2
	[0057.970] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0057.970] lstrlenW (lpString=".cdr") returned 4
	[0057.970] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0057.970] lstrlenW (lpString=".cer") returned 4
	[0057.971] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0057.971] lstrlenW (lpString=".cf") returned 3
	[0057.971] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0057.971] lstrlenW (lpString=".cfc") returned 4
	[0057.971] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0057.971] lstrlenW (lpString=".cfm") returned 4
	[0057.971] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0057.971] lstrlenW (lpString=".cfml") returned 5
	[0057.971] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0057.971] lstrlenW (lpString=".cfu") returned 4
	[0057.971] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0057.971] lstrlenW (lpString=".chm") returned 4
	[0057.971] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0057.971] lstrlenW (lpString=".cin") returned 4
	[0057.971] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0057.971] lstrlenW (lpString=".class") returned 6
	[0057.971] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0057.971] lstrlenW (lpString=".clx") returned 4
	[0057.971] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0057.971] lstrlenW (lpString=".config") returned 7
	[0057.971] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0057.971] lstrlenW (lpString=".cpp") returned 4
	[0057.971] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0057.971] lstrlenW (lpString=".cr2") returned 4
	[0057.971] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0057.971] lstrlenW (lpString=".crt") returned 4
	[0057.972] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0057.972] lstrlenW (lpString=".crw") returned 4
	[0057.972] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0057.972] lstrlenW (lpString=".cs") returned 3
	[0057.972] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0057.972] lstrlenW (lpString=".css") returned 4
	[0057.972] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0057.972] lstrlenW (lpString=".csv") returned 4
	[0057.972] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0057.972] lstrlenW (lpString=".cub") returned 4
	[0057.972] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0057.972] lstrlenW (lpString=".dae") returned 4
	[0057.972] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0057.972] lstrlenW (lpString=".dat") returned 4
	[0057.972] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0057.972] lstrlenW (lpString=".db") returned 3
	[0057.972] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0057.972] lstrlenW (lpString=".dbf") returned 4
	[0057.972] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0057.972] lstrlenW (lpString=".dbx") returned 4
	[0057.972] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0057.972] lstrlenW (lpString=".dc3") returned 4
	[0057.972] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0057.972] lstrlenW (lpString=".dcm") returned 4
	[0057.972] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0057.973] lstrlenW (lpString=".dcr") returned 4
	[0057.973] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0057.973] lstrlenW (lpString=".der") returned 4
	[0057.973] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0057.973] lstrlenW (lpString=".dib") returned 4
	[0057.973] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0057.973] lstrlenW (lpString=".dic") returned 4
	[0057.973] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0057.973] lstrlenW (lpString=".dif") returned 4
	[0057.973] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0057.973] lstrlenW (lpString=".divx") returned 5
	[0057.973] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0057.973] lstrlenW (lpString=".djvu") returned 5
	[0057.973] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0057.973] lstrlenW (lpString=".dng") returned 4
	[0057.973] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0057.973] lstrlenW (lpString=".doc") returned 4
	[0057.973] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0057.973] lstrlenW (lpString=".docm") returned 5
	[0057.973] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0057.973] lstrlenW (lpString=".docx") returned 5
	[0057.974] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0057.974] lstrlenW (lpString=".dot") returned 4
	[0057.974] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0057.974] lstrlenW (lpString=".dotm") returned 5
	[0057.974] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0057.974] lstrlenW (lpString=".dotx") returned 5
	[0057.974] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0057.974] lstrlenW (lpString=".dpx") returned 4
	[0057.974] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0057.974] lstrlenW (lpString=".dqy") returned 4
	[0057.974] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0057.974] lstrlenW (lpString=".dsn") returned 4
	[0057.974] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0057.974] lstrlenW (lpString=".dt") returned 3
	[0057.974] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0057.974] lstrlenW (lpString=".dtd") returned 4
	[0057.974] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0057.974] lstrlenW (lpString=".dwg") returned 4
	[0057.974] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0057.974] lstrlenW (lpString=".dwt") returned 4
	[0057.974] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0057.975] lstrlenW (lpString=".dx") returned 3
	[0057.975] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0057.975] lstrlenW (lpString=".dxf") returned 4
	[0057.975] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0057.975] lstrlenW (lpString=".edml") returned 5
	[0057.975] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0057.975] lstrlenW (lpString=".efd") returned 4
	[0057.975] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0057.975] lstrlenW (lpString=".elf") returned 4
	[0057.975] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0057.975] lstrlenW (lpString=".emf") returned 4
	[0057.975] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0057.975] lstrlenW (lpString=".emz") returned 4
	[0057.975] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0057.975] lstrlenW (lpString=".epf") returned 4
	[0057.975] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0057.975] lstrlenW (lpString=".eps") returned 4
	[0057.975] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0057.975] lstrlenW (lpString=".epsf") returned 5
	[0057.975] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0057.975] lstrlenW (lpString=".epsp") returned 5
	[0057.975] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0057.975] lstrlenW (lpString=".erf") returned 4
	[0057.975] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0057.975] lstrlenW (lpString=".exr") returned 4
	[0057.975] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0057.976] lstrlenW (lpString=".f4v") returned 4
	[0057.976] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0057.976] lstrlenW (lpString=".fido") returned 5
	[0057.976] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0057.976] lstrlenW (lpString=".flm") returned 4
	[0057.976] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0057.976] lstrlenW (lpString=".flv") returned 4
	[0057.976] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0057.976] lstrlenW (lpString=".frm") returned 4
	[0057.976] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0057.976] lstrlenW (lpString=".fxg") returned 4
	[0057.976] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0057.976] lstrlenW (lpString=".geo") returned 4
	[0057.976] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0057.976] lstrlenW (lpString=".gif") returned 4
	[0057.976] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0057.976] lstrlenW (lpString=".grs") returned 4
	[0057.976] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0057.976] lstrlenW (lpString=".gz") returned 3
	[0057.976] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0057.976] lstrlenW (lpString=".h") returned 2
	[0057.976] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0057.976] lstrlenW (lpString=".hdr") returned 4
	[0057.976] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0057.977] lstrlenW (lpString=".hpp") returned 4
	[0057.977] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0057.977] lstrlenW (lpString=".hta") returned 4
	[0057.977] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0057.977] lstrlenW (lpString=".htc") returned 4
	[0057.977] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0057.977] lstrlenW (lpString=".htm") returned 4
	[0057.977] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0057.977] lstrlenW (lpString=".html") returned 5
	[0057.977] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0057.977] lstrlenW (lpString=".icb") returned 4
	[0057.977] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0057.977] lstrlenW (lpString=".ics") returned 4
	[0057.977] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0057.977] lstrlenW (lpString=".iff") returned 4
	[0057.977] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0057.977] lstrlenW (lpString=".inc") returned 4
	[0057.977] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0057.977] lstrlenW (lpString=".indd") returned 5
	[0057.977] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0057.977] lstrlenW (lpString=".ini") returned 4
	[0057.977] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0057.977] lstrlenW (lpString=".iqy") returned 4
	[0057.977] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0057.978] lstrlenW (lpString=".j2c") returned 4
	[0057.978] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0057.978] lstrlenW (lpString=".j2k") returned 4
	[0057.978] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0057.978] lstrlenW (lpString=".java") returned 5
	[0057.978] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0057.978] lstrlenW (lpString=".jp2") returned 4
	[0057.978] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0057.978] lstrlenW (lpString=".jpc") returned 4
	[0057.978] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0057.978] lstrlenW (lpString=".jpe") returned 4
	[0057.978] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0057.978] lstrlenW (lpString=".jpeg") returned 5
	[0057.978] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0057.978] lstrlenW (lpString=".jpf") returned 4
	[0057.978] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0057.978] lstrlenW (lpString=".jpg") returned 4
	[0057.978] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0057.978] lstrlenW (lpString=".jpx") returned 4
	[0057.978] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0057.978] lstrlenW (lpString=".js") returned 3
	[0057.978] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0057.978] lstrlenW (lpString=".jsf") returned 4
	[0057.978] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".json") returned 5
	[0057.979] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0057.979] lstrlenW (lpString=".jsp") returned 4
	[0057.979] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".kdc") returned 4
	[0057.979] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".kmz") returned 4
	[0057.979] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".kwm") returned 4
	[0057.979] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".lasso") returned 6
	[0057.979] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0057.979] lstrlenW (lpString=".lbi") returned 4
	[0057.979] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".lgf") returned 4
	[0057.979] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".lgp") returned 4
	[0057.979] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".log") returned 4
	[0057.979] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".m1v") returned 4
	[0057.979] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".m4a") returned 4
	[0057.979] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".m4v") returned 4
	[0057.979] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0057.979] lstrlenW (lpString=".max") returned 4
	[0057.980] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0057.980] lstrlenW (lpString=".md") returned 3
	[0057.980] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0057.980] lstrlenW (lpString=".mda") returned 4
	[0057.980] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0057.980] lstrlenW (lpString=".mdb") returned 4
	[0057.980] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0057.980] lstrlenW (lpString=".mde") returned 4
	[0057.980] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0057.980] lstrlenW (lpString=".mdf") returned 4
	[0057.980] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0057.980] lstrlenW (lpString=".mdw") returned 4
	[0057.980] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0057.980] lstrlenW (lpString=".mef") returned 4
	[0057.980] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0057.980] lstrlenW (lpString=".mft") returned 4
	[0057.980] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0057.980] lstrlenW (lpString=".mfw") returned 4
	[0057.980] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0057.980] lstrlenW (lpString=".mht") returned 4
	[0057.980] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0057.980] lstrlenW (lpString=".mhtml") returned 6
	[0057.980] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0057.980] lstrlenW (lpString=".mka") returned 4
	[0057.980] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0057.980] lstrlenW (lpString=".mkidx") returned 6
	[0057.980] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0057.980] lstrlenW (lpString=".mkv") returned 4
	[0057.981] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".mos") returned 4
	[0057.981] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".mov") returned 4
	[0057.981] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".mp3") returned 4
	[0057.981] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".mp4") returned 4
	[0057.981] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".mpeg") returned 5
	[0057.981] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0057.981] lstrlenW (lpString=".mpg") returned 4
	[0057.981] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".mpv") returned 4
	[0057.981] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".mrw") returned 4
	[0057.981] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".msg") returned 4
	[0057.981] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".mxl") returned 4
	[0057.981] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".myd") returned 4
	[0057.981] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".myi") returned 4
	[0057.981] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".nef") returned 4
	[0057.981] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".nrw") returned 4
	[0057.981] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0057.981] lstrlenW (lpString=".obj") returned 4
	[0057.982] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".odb") returned 4
	[0057.982] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".odc") returned 4
	[0057.982] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".odm") returned 4
	[0057.982] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".odp") returned 4
	[0057.982] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".ods") returned 4
	[0057.982] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".oft") returned 4
	[0057.982] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".one") returned 4
	[0057.982] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".onepkg") returned 7
	[0057.982] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0057.982] lstrlenW (lpString=".onetoc2") returned 8
	[0057.982] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0057.982] lstrlenW (lpString=".opt") returned 4
	[0057.982] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".oqy") returned 4
	[0057.982] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".orf") returned 4
	[0057.982] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".p12") returned 4
	[0057.982] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0057.982] lstrlenW (lpString=".p7b") returned 4
	[0057.982] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".p7c") returned 4
	[0057.983] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pam") returned 4
	[0057.983] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pbm") returned 4
	[0057.983] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pct") returned 4
	[0057.983] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pcx") returned 4
	[0057.983] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pdd") returned 4
	[0057.983] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pdf") returned 4
	[0057.983] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pdp") returned 4
	[0057.983] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pef") returned 4
	[0057.983] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pem") returned 4
	[0057.983] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pff") returned 4
	[0057.983] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pfm") returned 4
	[0057.983] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pfx") returned 4
	[0057.983] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0057.983] lstrlenW (lpString=".pgm") returned 4
	[0057.984] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0057.984] lstrlenW (lpString=".php") returned 4
	[0057.984] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0057.984] lstrlenW (lpString=".php3") returned 5
	[0057.984] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0057.984] lstrlenW (lpString=".php4") returned 5
	[0057.984] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0057.984] lstrlenW (lpString=".php5") returned 5
	[0057.984] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0057.984] lstrlenW (lpString=".phtml") returned 6
	[0057.984] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0057.984] lstrlenW (lpString=".pict") returned 5
	[0057.984] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0057.984] lstrlenW (lpString=".pl") returned 3
	[0057.984] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0057.984] lstrlenW (lpString=".pls") returned 4
	[0057.984] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0057.984] lstrlenW (lpString=".pm") returned 3
	[0057.984] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0057.984] lstrlenW (lpString=".png") returned 4
	[0057.984] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0057.984] lstrlenW (lpString=".pnm") returned 4
	[0057.984] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0057.984] lstrlenW (lpString=".pot") returned 4
	[0057.984] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0057.984] lstrlenW (lpString=".potm") returned 5
	[0057.984] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0057.984] lstrlenW (lpString=".potx") returned 5
	[0057.985] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0057.985] lstrlenW (lpString=".ppa") returned 4
	[0057.985] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0057.985] lstrlenW (lpString=".ppam") returned 5
	[0057.985] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0057.985] lstrlenW (lpString=".ppm") returned 4
	[0057.985] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0057.985] lstrlenW (lpString=".pps") returned 4
	[0057.985] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0057.985] lstrlenW (lpString=".ppsm") returned 5
	[0057.985] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0057.985] lstrlenW (lpString=".ppt") returned 4
	[0057.985] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0057.985] lstrlenW (lpString=".pptm") returned 5
	[0057.985] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0057.985] lstrlenW (lpString=".pptx") returned 5
	[0057.985] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0057.985] lstrlenW (lpString=".prn") returned 4
	[0057.985] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0057.985] lstrlenW (lpString=".ps") returned 3
	[0057.985] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0057.985] lstrlenW (lpString=".psb") returned 4
	[0057.985] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0057.985] lstrlenW (lpString=".psd") returned 4
	[0057.985] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0057.985] lstrlenW (lpString=".pst") returned 4
	[0057.985] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0057.985] lstrlenW (lpString=".ptx") returned 4
	[0057.985] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0057.985] lstrlenW (lpString=".pub") returned 4
	[0057.986] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0057.986] lstrlenW (lpString=".pwm") returned 4
	[0057.986] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0057.986] lstrlenW (lpString=".pxr") returned 4
	[0057.986] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0057.986] lstrlenW (lpString=".py") returned 3
	[0057.986] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0057.986] lstrlenW (lpString=".qt") returned 3
	[0057.986] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0057.986] lstrlenW (lpString=".r3d") returned 4
	[0057.986] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0057.986] lstrlenW (lpString=".raf") returned 4
	[0057.986] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0057.986] lstrlenW (lpString=".rar") returned 4
	[0057.986] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0057.986] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0057.986] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0057.987] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0057.987] FindClose (in: hFindFile=0x6f4168 | out: hFindFile=0x6f4168) returned 1
	[0057.987] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0057.987] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1
	[0057.987] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0057.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26
	[0057.987] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4568
	[0057.987] FindNextFileW (in: hFindFile=0x6f4568, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.987] FindNextFileW (in: hFindFile=0x6f4568, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0057.987] lstrlenW (lpString="eula.rtf") returned 8
	[0057.987] lstrlenW (lpString=".1cd") returned 4
	[0057.987] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0057.987] lstrlenW (lpString=".3ds") returned 4
	[0057.987] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0057.987] lstrlenW (lpString=".3fr") returned 4
	[0057.987] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0057.988] lstrlenW (lpString=".3g2") returned 4
	[0057.988] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0057.988] lstrlenW (lpString=".3gp") returned 4
	[0057.988] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0057.988] lstrlenW (lpString=".7z") returned 3
	[0057.988] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0057.988] lstrlenW (lpString=".accda") returned 6
	[0057.988] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0057.988] lstrlenW (lpString=".accdb") returned 6
	[0057.988] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0057.988] lstrlenW (lpString=".accdc") returned 6
	[0057.988] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0057.988] lstrlenW (lpString=".accde") returned 6
	[0057.988] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0057.988] lstrlenW (lpString=".accdt") returned 6
	[0057.988] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0057.988] lstrlenW (lpString=".accdw") returned 6
	[0057.988] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0057.988] lstrlenW (lpString=".adb") returned 4
	[0057.988] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0057.988] lstrlenW (lpString=".adp") returned 4
	[0057.988] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0057.988] lstrlenW (lpString=".ai") returned 3
	[0057.988] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0057.988] lstrlenW (lpString=".ai3") returned 4
	[0057.988] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0057.988] lstrlenW (lpString=".ai4") returned 4
	[0057.988] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0057.989] lstrlenW (lpString=".ai5") returned 4
	[0057.989] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0057.989] lstrlenW (lpString=".ai6") returned 4
	[0057.989] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0057.989] lstrlenW (lpString=".ai7") returned 4
	[0057.989] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0057.989] lstrlenW (lpString=".ai8") returned 4
	[0057.989] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0057.989] lstrlenW (lpString=".anim") returned 5
	[0057.989] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0057.989] lstrlenW (lpString=".arw") returned 4
	[0057.989] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0057.989] lstrlenW (lpString=".as") returned 3
	[0057.989] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0057.989] lstrlenW (lpString=".asa") returned 4
	[0057.989] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0057.989] lstrlenW (lpString=".asc") returned 4
	[0057.989] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0057.989] lstrlenW (lpString=".ascx") returned 5
	[0057.989] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0057.989] lstrlenW (lpString=".asm") returned 4
	[0057.989] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0057.989] lstrlenW (lpString=".asmx") returned 5
	[0057.990] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0057.990] lstrlenW (lpString=".asp") returned 4
	[0057.990] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0057.990] lstrlenW (lpString=".aspx") returned 5
	[0057.990] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0057.990] lstrlenW (lpString=".asr") returned 4
	[0057.990] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0057.990] lstrlenW (lpString=".asx") returned 4
	[0057.990] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0057.990] lstrlenW (lpString=".avi") returned 4
	[0057.990] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0057.990] lstrlenW (lpString=".avs") returned 4
	[0057.990] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0057.990] lstrlenW (lpString=".backup") returned 7
	[0057.990] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0057.990] lstrlenW (lpString=".bak") returned 4
	[0057.990] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0057.990] lstrlenW (lpString=".bay") returned 4
	[0057.990] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0057.990] lstrlenW (lpString=".bd") returned 3
	[0057.990] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0057.990] lstrlenW (lpString=".bin") returned 4
	[0057.990] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0057.990] lstrlenW (lpString=".bmp") returned 4
	[0057.990] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0057.990] lstrlenW (lpString=".bz2") returned 4
	[0057.990] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0057.990] lstrlenW (lpString=".c") returned 2
	[0057.991] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0057.991] lstrlenW (lpString=".cdr") returned 4
	[0057.991] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0057.991] lstrlenW (lpString=".cer") returned 4
	[0057.991] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0057.991] lstrlenW (lpString=".cf") returned 3
	[0057.991] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0057.991] lstrlenW (lpString=".cfc") returned 4
	[0057.991] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0057.991] lstrlenW (lpString=".cfm") returned 4
	[0057.991] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0057.991] lstrlenW (lpString=".cfml") returned 5
	[0057.991] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0057.991] lstrlenW (lpString=".cfu") returned 4
	[0057.991] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0057.991] lstrlenW (lpString=".chm") returned 4
	[0057.991] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0057.991] lstrlenW (lpString=".cin") returned 4
	[0057.991] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0057.991] lstrlenW (lpString=".class") returned 6
	[0057.991] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0057.991] lstrlenW (lpString=".clx") returned 4
	[0057.992] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0057.992] lstrlenW (lpString=".config") returned 7
	[0057.992] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0057.992] lstrlenW (lpString=".cpp") returned 4
	[0057.992] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0057.992] lstrlenW (lpString=".cr2") returned 4
	[0057.992] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0057.992] lstrlenW (lpString=".crt") returned 4
	[0057.992] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0057.992] lstrlenW (lpString=".crw") returned 4
	[0057.992] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0057.992] lstrlenW (lpString=".cs") returned 3
	[0057.992] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0057.992] lstrlenW (lpString=".css") returned 4
	[0057.992] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0057.992] lstrlenW (lpString=".csv") returned 4
	[0057.992] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0057.992] lstrlenW (lpString=".cub") returned 4
	[0057.992] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0057.992] lstrlenW (lpString=".dae") returned 4
	[0057.992] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0057.992] lstrlenW (lpString=".dat") returned 4
	[0057.992] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0057.993] lstrlenW (lpString=".db") returned 3
	[0057.993] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0057.993] lstrlenW (lpString=".dbf") returned 4
	[0057.993] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0057.993] lstrlenW (lpString=".dbx") returned 4
	[0057.993] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0057.993] lstrlenW (lpString=".dc3") returned 4
	[0057.993] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0057.993] lstrlenW (lpString=".dcm") returned 4
	[0057.993] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0057.993] lstrlenW (lpString=".dcr") returned 4
	[0057.993] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0057.993] lstrlenW (lpString=".der") returned 4
	[0057.993] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0057.993] lstrlenW (lpString=".dib") returned 4
	[0057.993] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0057.993] lstrlenW (lpString=".dic") returned 4
	[0057.993] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0057.993] lstrlenW (lpString=".dif") returned 4
	[0057.993] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0057.993] lstrlenW (lpString=".divx") returned 5
	[0057.993] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0057.993] lstrlenW (lpString=".djvu") returned 5
	[0057.993] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0057.993] lstrlenW (lpString=".dng") returned 4
	[0057.993] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0057.994] lstrlenW (lpString=".doc") returned 4
	[0057.994] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0057.994] lstrlenW (lpString=".docm") returned 5
	[0057.994] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0057.994] lstrlenW (lpString=".docx") returned 5
	[0057.994] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0057.994] lstrlenW (lpString=".dot") returned 4
	[0057.994] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0057.994] lstrlenW (lpString=".dotm") returned 5
	[0057.994] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0057.994] lstrlenW (lpString=".dotx") returned 5
	[0057.994] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0057.994] lstrlenW (lpString=".dpx") returned 4
	[0057.994] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0057.994] lstrlenW (lpString=".dqy") returned 4
	[0057.994] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0057.994] lstrlenW (lpString=".dsn") returned 4
	[0057.994] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0057.994] lstrlenW (lpString=".dt") returned 3
	[0057.994] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0057.994] lstrlenW (lpString=".dtd") returned 4
	[0057.994] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0057.994] lstrlenW (lpString=".dwg") returned 4
	[0057.994] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0057.995] lstrlenW (lpString=".dwt") returned 4
	[0057.995] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0057.995] lstrlenW (lpString=".dx") returned 3
	[0057.995] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0057.995] lstrlenW (lpString=".dxf") returned 4
	[0057.995] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0057.995] lstrlenW (lpString=".edml") returned 5
	[0057.995] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0057.995] lstrlenW (lpString=".efd") returned 4
	[0057.995] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0057.995] lstrlenW (lpString=".elf") returned 4
	[0057.995] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0057.995] lstrlenW (lpString=".emf") returned 4
	[0057.995] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0057.995] lstrlenW (lpString=".emz") returned 4
	[0057.995] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0057.995] lstrlenW (lpString=".epf") returned 4
	[0057.995] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0057.995] lstrlenW (lpString=".eps") returned 4
	[0057.995] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0057.995] lstrlenW (lpString=".epsf") returned 5
	[0057.995] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0057.995] lstrlenW (lpString=".epsp") returned 5
	[0057.995] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0057.995] lstrlenW (lpString=".erf") returned 4
	[0057.995] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0057.995] lstrlenW (lpString=".exr") returned 4
	[0057.996] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0057.996] lstrlenW (lpString=".f4v") returned 4
	[0057.996] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0057.996] lstrlenW (lpString=".fido") returned 5
	[0057.996] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0057.996] lstrlenW (lpString=".flm") returned 4
	[0057.996] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0057.996] lstrlenW (lpString=".flv") returned 4
	[0057.996] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0057.996] lstrlenW (lpString=".frm") returned 4
	[0057.996] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0057.996] lstrlenW (lpString=".fxg") returned 4
	[0057.996] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0057.996] lstrlenW (lpString=".geo") returned 4
	[0057.996] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0057.996] lstrlenW (lpString=".gif") returned 4
	[0057.996] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0057.996] lstrlenW (lpString=".grs") returned 4
	[0057.996] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0057.996] lstrlenW (lpString=".gz") returned 3
	[0057.996] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0057.996] lstrlenW (lpString=".h") returned 2
	[0057.996] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0057.996] lstrlenW (lpString=".hdr") returned 4
	[0057.996] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0057.997] lstrlenW (lpString=".hpp") returned 4
	[0057.997] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0057.997] lstrlenW (lpString=".hta") returned 4
	[0057.997] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0057.997] lstrlenW (lpString=".htc") returned 4
	[0057.997] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0057.997] lstrlenW (lpString=".htm") returned 4
	[0057.997] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0057.997] lstrlenW (lpString=".html") returned 5
	[0057.997] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0057.997] lstrlenW (lpString=".icb") returned 4
	[0057.997] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0057.997] lstrlenW (lpString=".ics") returned 4
	[0057.997] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0057.997] lstrlenW (lpString=".iff") returned 4
	[0057.997] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0057.997] lstrlenW (lpString=".inc") returned 4
	[0057.997] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0057.997] lstrlenW (lpString=".indd") returned 5
	[0057.997] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0057.997] lstrlenW (lpString=".ini") returned 4
	[0057.997] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0057.997] lstrlenW (lpString=".iqy") returned 4
	[0057.997] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0057.998] lstrlenW (lpString=".j2c") returned 4
	[0057.998] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0057.998] lstrlenW (lpString=".j2k") returned 4
	[0057.998] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0057.998] lstrlenW (lpString=".java") returned 5
	[0057.998] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0057.998] lstrlenW (lpString=".jp2") returned 4
	[0057.998] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0057.998] lstrlenW (lpString=".jpc") returned 4
	[0057.998] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0057.998] lstrlenW (lpString=".jpe") returned 4
	[0057.998] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0057.998] lstrlenW (lpString=".jpeg") returned 5
	[0057.998] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0057.998] lstrlenW (lpString=".jpf") returned 4
	[0057.998] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0057.998] lstrlenW (lpString=".jpg") returned 4
	[0057.998] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0057.998] lstrlenW (lpString=".jpx") returned 4
	[0057.998] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0057.998] lstrlenW (lpString=".js") returned 3
	[0057.998] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0057.998] lstrlenW (lpString=".jsf") returned 4
	[0057.998] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0057.998] lstrlenW (lpString=".json") returned 5
	[0057.998] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0057.998] lstrlenW (lpString=".jsp") returned 4
	[0057.998] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0057.999] lstrlenW (lpString=".kdc") returned 4
	[0057.999] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0057.999] lstrlenW (lpString=".kmz") returned 4
	[0057.999] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0057.999] lstrlenW (lpString=".kwm") returned 4
	[0057.999] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0057.999] lstrlenW (lpString=".lasso") returned 6
	[0057.999] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0057.999] lstrlenW (lpString=".lbi") returned 4
	[0057.999] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0057.999] lstrlenW (lpString=".lgf") returned 4
	[0057.999] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0057.999] lstrlenW (lpString=".lgp") returned 4
	[0057.999] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0057.999] lstrlenW (lpString=".log") returned 4
	[0057.999] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0057.999] lstrlenW (lpString=".m1v") returned 4
	[0057.999] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0057.999] lstrlenW (lpString=".m4a") returned 4
	[0057.999] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0057.999] lstrlenW (lpString=".m4v") returned 4
	[0057.999] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0057.999] lstrlenW (lpString=".max") returned 4
	[0058.000] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0058.000] lstrlenW (lpString=".md") returned 3
	[0058.000] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0058.000] lstrlenW (lpString=".mda") returned 4
	[0058.000] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0058.000] lstrlenW (lpString=".mdb") returned 4
	[0058.000] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0058.000] lstrlenW (lpString=".mde") returned 4
	[0058.000] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0058.000] lstrlenW (lpString=".mdf") returned 4
	[0058.000] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0058.000] lstrlenW (lpString=".mdw") returned 4
	[0058.000] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0058.000] lstrlenW (lpString=".mef") returned 4
	[0058.000] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0058.000] lstrlenW (lpString=".mft") returned 4
	[0058.000] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0058.000] lstrlenW (lpString=".mfw") returned 4
	[0058.000] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0058.000] lstrlenW (lpString=".mht") returned 4
	[0058.000] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0058.000] lstrlenW (lpString=".mhtml") returned 6
	[0058.000] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0058.000] lstrlenW (lpString=".mka") returned 4
	[0058.000] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0058.000] lstrlenW (lpString=".mkidx") returned 6
	[0058.000] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0058.000] lstrlenW (lpString=".mkv") returned 4
	[0058.001] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".mos") returned 4
	[0058.001] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".mov") returned 4
	[0058.001] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".mp3") returned 4
	[0058.001] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".mp4") returned 4
	[0058.001] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".mpeg") returned 5
	[0058.001] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0058.001] lstrlenW (lpString=".mpg") returned 4
	[0058.001] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".mpv") returned 4
	[0058.001] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".mrw") returned 4
	[0058.001] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".msg") returned 4
	[0058.001] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".mxl") returned 4
	[0058.001] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".myd") returned 4
	[0058.001] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".myi") returned 4
	[0058.001] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".nef") returned 4
	[0058.001] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0058.001] lstrlenW (lpString=".nrw") returned 4
	[0058.002] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".obj") returned 4
	[0058.002] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".odb") returned 4
	[0058.002] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".odc") returned 4
	[0058.002] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".odm") returned 4
	[0058.002] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".odp") returned 4
	[0058.002] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".ods") returned 4
	[0058.002] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".oft") returned 4
	[0058.002] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".one") returned 4
	[0058.002] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".onepkg") returned 7
	[0058.002] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0058.002] lstrlenW (lpString=".onetoc2") returned 8
	[0058.002] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0058.002] lstrlenW (lpString=".opt") returned 4
	[0058.002] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".oqy") returned 4
	[0058.002] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".orf") returned 4
	[0058.002] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".p12") returned 4
	[0058.002] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0058.002] lstrlenW (lpString=".p7b") returned 4
	[0058.003] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".p7c") returned 4
	[0058.003] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pam") returned 4
	[0058.003] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pbm") returned 4
	[0058.003] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pct") returned 4
	[0058.003] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pcx") returned 4
	[0058.003] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pdd") returned 4
	[0058.003] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pdf") returned 4
	[0058.003] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pdp") returned 4
	[0058.003] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pef") returned 4
	[0058.003] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pem") returned 4
	[0058.003] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pff") returned 4
	[0058.003] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pfm") returned 4
	[0058.003] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pfx") returned 4
	[0058.003] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0058.003] lstrlenW (lpString=".pgm") returned 4
	[0058.004] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0058.004] lstrlenW (lpString=".php") returned 4
	[0058.004] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0058.004] lstrlenW (lpString=".php3") returned 5
	[0058.004] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0058.004] lstrlenW (lpString=".php4") returned 5
	[0058.004] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0058.004] lstrlenW (lpString=".php5") returned 5
	[0058.004] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0058.004] lstrlenW (lpString=".phtml") returned 6
	[0058.004] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0058.004] lstrlenW (lpString=".pict") returned 5
	[0058.004] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0058.004] lstrlenW (lpString=".pl") returned 3
	[0058.004] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0058.004] lstrlenW (lpString=".pls") returned 4
	[0058.004] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0058.004] lstrlenW (lpString=".pm") returned 3
	[0058.004] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0058.004] lstrlenW (lpString=".png") returned 4
	[0058.004] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0058.004] lstrlenW (lpString=".pnm") returned 4
	[0058.004] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0058.004] lstrlenW (lpString=".pot") returned 4
	[0058.004] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0058.004] lstrlenW (lpString=".potm") returned 5
	[0058.004] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0058.004] lstrlenW (lpString=".potx") returned 5
	[0058.005] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0058.491] lstrlenW (lpString=".ppa") returned 4
	[0058.491] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0058.491] lstrlenW (lpString=".ppam") returned 5
	[0058.491] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0058.491] lstrlenW (lpString=".ppm") returned 4
	[0058.491] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0058.491] lstrlenW (lpString=".pps") returned 4
	[0058.491] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0058.491] lstrlenW (lpString=".ppsm") returned 5
	[0058.491] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0058.491] lstrlenW (lpString=".ppt") returned 4
	[0058.491] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.491] lstrlenW (lpString=".pptm") returned 5
	[0058.491] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0058.492] lstrlenW (lpString=".pptx") returned 5
	[0058.492] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0058.492] lstrlenW (lpString=".prn") returned 4
	[0058.492] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0058.492] lstrlenW (lpString=".ps") returned 3
	[0058.492] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0058.492] lstrlenW (lpString=".psb") returned 4
	[0058.492] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0058.492] lstrlenW (lpString=".psd") returned 4
	[0058.492] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0058.492] lstrlenW (lpString=".pst") returned 4
	[0058.492] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0058.492] lstrlenW (lpString=".ptx") returned 4
	[0058.492] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0058.492] lstrlenW (lpString=".pub") returned 4
	[0058.492] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0058.492] lstrlenW (lpString=".pwm") returned 4
	[0058.492] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0058.492] lstrlenW (lpString=".pxr") returned 4
	[0058.492] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0058.492] lstrlenW (lpString=".py") returned 3
	[0058.492] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0058.492] lstrlenW (lpString=".qt") returned 3
	[0058.492] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0058.492] lstrlenW (lpString=".r3d") returned 4
	[0058.492] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0058.493] lstrlenW (lpString=".raf") returned 4
	[0058.493] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0058.493] lstrlenW (lpString=".rar") returned 4
	[0058.493] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.493] FindNextFileW (in: hFindFile=0x6f4568, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0058.493] FindNextFileW (in: hFindFile=0x6f4568, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0058.493] FindNextFileW (in: hFindFile=0x6f4568, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0058.493] FindClose (in: hFindFile=0x6f4568 | out: hFindFile=0x6f4568) returned 1
	[0058.493] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0058.493] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1
	[0058.493] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0058.494] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26
	[0058.494] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd8c32d6d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4328
	[0058.494] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd8c32d6d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.494] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c32d6d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c32d6d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0058.494] lstrlenW (lpString="eula.rtf.id-B4197730.[admin@stex777.com].money") returned 46
	[0058.494] lstrlenW (lpString=".1cd") returned 4
	[0058.494] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0058.494] lstrlenW (lpString=".3ds") returned 4
	[0058.494] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0058.494] lstrlenW (lpString=".3fr") returned 4
	[0058.494] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0058.494] lstrlenW (lpString=".3g2") returned 4
	[0058.494] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0058.494] lstrlenW (lpString=".3gp") returned 4
	[0058.494] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0058.494] lstrlenW (lpString=".7z") returned 3
	[0058.494] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0058.494] lstrlenW (lpString=".accda") returned 6
	[0058.494] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0058.494] lstrlenW (lpString=".accdb") returned 6
	[0058.494] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0058.495] lstrlenW (lpString=".accdc") returned 6
	[0058.495] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0058.495] lstrlenW (lpString=".accde") returned 6
	[0058.495] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0058.495] lstrlenW (lpString=".accdt") returned 6
	[0058.495] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0058.495] lstrlenW (lpString=".accdw") returned 6
	[0058.495] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0058.495] lstrlenW (lpString=".adb") returned 4
	[0058.495] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0058.495] lstrlenW (lpString=".adp") returned 4
	[0058.495] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0058.495] lstrlenW (lpString=".ai") returned 3
	[0058.495] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0058.495] lstrlenW (lpString=".ai3") returned 4
	[0058.495] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0058.495] lstrlenW (lpString=".ai4") returned 4
	[0058.495] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0058.495] lstrlenW (lpString=".ai5") returned 4
	[0058.495] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0058.495] lstrlenW (lpString=".ai6") returned 4
	[0058.495] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0058.495] lstrlenW (lpString=".ai7") returned 4
	[0058.495] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0058.495] lstrlenW (lpString=".ai8") returned 4
	[0058.495] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0058.495] lstrlenW (lpString=".anim") returned 5
	[0058.495] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0058.496] lstrlenW (lpString=".arw") returned 4
	[0058.496] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0058.496] lstrlenW (lpString=".as") returned 3
	[0058.496] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0058.496] lstrlenW (lpString=".asa") returned 4
	[0058.496] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0058.496] lstrlenW (lpString=".asc") returned 4
	[0058.496] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0058.496] lstrlenW (lpString=".ascx") returned 5
	[0058.496] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0058.496] lstrlenW (lpString=".asm") returned 4
	[0058.496] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0058.496] lstrlenW (lpString=".asmx") returned 5
	[0058.496] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0058.496] lstrlenW (lpString=".asp") returned 4
	[0058.496] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0058.496] lstrlenW (lpString=".aspx") returned 5
	[0058.496] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0058.496] lstrlenW (lpString=".asr") returned 4
	[0058.496] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0058.496] lstrlenW (lpString=".asx") returned 4
	[0058.496] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0058.496] lstrlenW (lpString=".avi") returned 4
	[0058.496] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0058.496] lstrlenW (lpString=".avs") returned 4
	[0058.496] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0058.496] lstrlenW (lpString=".backup") returned 7
	[0058.497] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0058.497] lstrlenW (lpString=".bak") returned 4
	[0058.497] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0058.497] lstrlenW (lpString=".bay") returned 4
	[0058.497] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0058.497] lstrlenW (lpString=".bd") returned 3
	[0058.497] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0058.497] lstrlenW (lpString=".bin") returned 4
	[0058.497] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0058.497] lstrlenW (lpString=".bmp") returned 4
	[0058.497] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0058.497] lstrlenW (lpString=".bz2") returned 4
	[0058.497] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0058.497] lstrlenW (lpString=".c") returned 2
	[0058.497] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0058.497] lstrlenW (lpString=".cdr") returned 4
	[0058.497] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0058.497] lstrlenW (lpString=".cer") returned 4
	[0058.497] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0058.497] lstrlenW (lpString=".cf") returned 3
	[0058.497] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0058.497] lstrlenW (lpString=".cfc") returned 4
	[0058.497] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0058.497] lstrlenW (lpString=".cfm") returned 4
	[0058.497] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0058.497] lstrlenW (lpString=".cfml") returned 5
	[0058.497] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0058.497] lstrlenW (lpString=".cfu") returned 4
	[0058.498] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".chm") returned 4
	[0058.498] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".cin") returned 4
	[0058.498] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".class") returned 6
	[0058.498] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0058.498] lstrlenW (lpString=".clx") returned 4
	[0058.498] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".config") returned 7
	[0058.498] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0058.498] lstrlenW (lpString=".cpp") returned 4
	[0058.498] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".cr2") returned 4
	[0058.498] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".crt") returned 4
	[0058.498] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".crw") returned 4
	[0058.498] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".cs") returned 3
	[0058.498] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0058.498] lstrlenW (lpString=".css") returned 4
	[0058.498] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".csv") returned 4
	[0058.498] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".cub") returned 4
	[0058.498] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".dae") returned 4
	[0058.498] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0058.498] lstrlenW (lpString=".dat") returned 4
	[0058.499] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0058.499] lstrlenW (lpString=".db") returned 3
	[0058.499] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0058.499] lstrlenW (lpString=".dbf") returned 4
	[0058.499] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0058.499] lstrlenW (lpString=".dbx") returned 4
	[0058.499] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0058.499] lstrlenW (lpString=".dc3") returned 4
	[0058.499] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0058.499] lstrlenW (lpString=".dcm") returned 4
	[0058.499] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0058.499] lstrlenW (lpString=".dcr") returned 4
	[0058.499] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0058.499] lstrlenW (lpString=".der") returned 4
	[0058.499] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0058.499] lstrlenW (lpString=".dib") returned 4
	[0058.499] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0058.499] lstrlenW (lpString=".dic") returned 4
	[0058.499] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0058.499] lstrlenW (lpString=".dif") returned 4
	[0058.499] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0058.499] lstrlenW (lpString=".divx") returned 5
	[0058.499] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0058.499] lstrlenW (lpString=".djvu") returned 5
	[0058.499] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0058.499] lstrlenW (lpString=".dng") returned 4
	[0058.499] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0058.499] lstrlenW (lpString=".doc") returned 4
	[0058.499] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0058.500] lstrlenW (lpString=".docm") returned 5
	[0058.500] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0058.500] lstrlenW (lpString=".docx") returned 5
	[0058.500] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0058.500] lstrlenW (lpString=".dot") returned 4
	[0058.500] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0058.500] lstrlenW (lpString=".dotm") returned 5
	[0058.500] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0058.500] lstrlenW (lpString=".dotx") returned 5
	[0058.500] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0058.500] lstrlenW (lpString=".dpx") returned 4
	[0058.500] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0058.500] lstrlenW (lpString=".dqy") returned 4
	[0058.500] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0058.500] lstrlenW (lpString=".dsn") returned 4
	[0058.500] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0058.500] lstrlenW (lpString=".dt") returned 3
	[0058.500] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0058.500] lstrlenW (lpString=".dtd") returned 4
	[0058.500] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0058.500] lstrlenW (lpString=".dwg") returned 4
	[0058.500] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0058.500] lstrlenW (lpString=".dwt") returned 4
	[0058.500] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0058.500] lstrlenW (lpString=".dx") returned 3
	[0058.500] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0058.500] lstrlenW (lpString=".dxf") returned 4
	[0058.500] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0058.500] lstrlenW (lpString=".edml") returned 5
	[0058.501] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0058.501] lstrlenW (lpString=".efd") returned 4
	[0058.501] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0058.501] lstrlenW (lpString=".elf") returned 4
	[0058.501] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0058.501] lstrlenW (lpString=".emf") returned 4
	[0058.501] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0058.501] lstrlenW (lpString=".emz") returned 4
	[0058.501] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0058.501] lstrlenW (lpString=".epf") returned 4
	[0058.501] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0058.501] lstrlenW (lpString=".eps") returned 4
	[0058.501] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0058.501] lstrlenW (lpString=".epsf") returned 5
	[0058.501] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0058.501] lstrlenW (lpString=".epsp") returned 5
	[0058.501] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0058.501] lstrlenW (lpString=".erf") returned 4
	[0058.501] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0058.501] lstrlenW (lpString=".exr") returned 4
	[0058.501] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0058.501] lstrlenW (lpString=".f4v") returned 4
	[0058.501] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0058.501] lstrlenW (lpString=".fido") returned 5
	[0058.501] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0058.501] lstrlenW (lpString=".flm") returned 4
	[0058.501] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0058.501] lstrlenW (lpString=".flv") returned 4
	[0058.501] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".frm") returned 4
	[0058.502] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".fxg") returned 4
	[0058.502] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".geo") returned 4
	[0058.502] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".gif") returned 4
	[0058.502] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".grs") returned 4
	[0058.502] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".gz") returned 3
	[0058.502] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0058.502] lstrlenW (lpString=".h") returned 2
	[0058.502] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0058.502] lstrlenW (lpString=".hdr") returned 4
	[0058.502] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".hpp") returned 4
	[0058.502] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".hta") returned 4
	[0058.502] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".htc") returned 4
	[0058.502] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".htm") returned 4
	[0058.502] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".html") returned 5
	[0058.502] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0058.502] lstrlenW (lpString=".icb") returned 4
	[0058.502] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0058.502] lstrlenW (lpString=".ics") returned 4
	[0058.502] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".iff") returned 4
	[0058.503] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".inc") returned 4
	[0058.503] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".indd") returned 5
	[0058.503] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0058.503] lstrlenW (lpString=".ini") returned 4
	[0058.503] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".iqy") returned 4
	[0058.503] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".j2c") returned 4
	[0058.503] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".j2k") returned 4
	[0058.503] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".java") returned 5
	[0058.503] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0058.503] lstrlenW (lpString=".jp2") returned 4
	[0058.503] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".jpc") returned 4
	[0058.503] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".jpe") returned 4
	[0058.503] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".jpeg") returned 5
	[0058.503] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0058.503] lstrlenW (lpString=".jpf") returned 4
	[0058.503] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".jpg") returned 4
	[0058.503] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0058.503] lstrlenW (lpString=".jpx") returned 4
	[0058.503] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".js") returned 3
	[0058.504] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0058.504] lstrlenW (lpString=".jsf") returned 4
	[0058.504] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".json") returned 5
	[0058.504] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0058.504] lstrlenW (lpString=".jsp") returned 4
	[0058.504] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".kdc") returned 4
	[0058.504] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".kmz") returned 4
	[0058.504] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".kwm") returned 4
	[0058.504] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".lasso") returned 6
	[0058.504] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0058.504] lstrlenW (lpString=".lbi") returned 4
	[0058.504] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".lgf") returned 4
	[0058.504] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".lgp") returned 4
	[0058.504] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".log") returned 4
	[0058.504] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".m1v") returned 4
	[0058.504] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".m4a") returned 4
	[0058.504] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0058.504] lstrlenW (lpString=".m4v") returned 4
	[0058.504] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0058.505] lstrlenW (lpString=".max") returned 4
	[0058.505] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0058.505] lstrlenW (lpString=".md") returned 3
	[0058.505] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0058.505] lstrlenW (lpString=".mda") returned 4
	[0058.505] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0058.505] lstrlenW (lpString=".mdb") returned 4
	[0058.505] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0058.505] lstrlenW (lpString=".mde") returned 4
	[0058.505] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0058.505] lstrlenW (lpString=".mdf") returned 4
	[0058.505] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0058.505] lstrlenW (lpString=".mdw") returned 4
	[0058.505] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0058.505] lstrlenW (lpString=".mef") returned 4
	[0058.505] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0058.505] lstrlenW (lpString=".mft") returned 4
	[0058.505] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0058.505] lstrlenW (lpString=".mfw") returned 4
	[0058.505] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0058.505] lstrlenW (lpString=".mht") returned 4
	[0058.505] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0058.505] lstrlenW (lpString=".mhtml") returned 6
	[0058.505] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0058.506] lstrlenW (lpString=".mka") returned 4
	[0058.506] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".mkidx") returned 6
	[0058.506] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0058.506] lstrlenW (lpString=".mkv") returned 4
	[0058.506] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".mos") returned 4
	[0058.506] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".mov") returned 4
	[0058.506] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".mp3") returned 4
	[0058.506] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".mp4") returned 4
	[0058.506] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".mpeg") returned 5
	[0058.506] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0058.506] lstrlenW (lpString=".mpg") returned 4
	[0058.506] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".mpv") returned 4
	[0058.506] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".mrw") returned 4
	[0058.506] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".msg") returned 4
	[0058.506] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".mxl") returned 4
	[0058.506] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".myd") returned 4
	[0058.506] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0058.506] lstrlenW (lpString=".myi") returned 4
	[0058.506] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".nef") returned 4
	[0058.507] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".nrw") returned 4
	[0058.507] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".obj") returned 4
	[0058.507] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".odb") returned 4
	[0058.507] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".odc") returned 4
	[0058.507] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".odm") returned 4
	[0058.507] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".odp") returned 4
	[0058.507] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".ods") returned 4
	[0058.507] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".oft") returned 4
	[0058.507] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".one") returned 4
	[0058.507] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".onepkg") returned 7
	[0058.507] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0058.507] lstrlenW (lpString=".onetoc2") returned 8
	[0058.507] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0058.507] lstrlenW (lpString=".opt") returned 4
	[0058.507] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".oqy") returned 4
	[0058.507] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".orf") returned 4
	[0058.507] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0058.507] lstrlenW (lpString=".p12") returned 4
	[0058.508] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".p7b") returned 4
	[0058.508] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".p7c") returned 4
	[0058.508] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pam") returned 4
	[0058.508] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pbm") returned 4
	[0058.508] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pct") returned 4
	[0058.508] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pcx") returned 4
	[0058.508] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pdd") returned 4
	[0058.508] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pdf") returned 4
	[0058.508] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pdp") returned 4
	[0058.508] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pef") returned 4
	[0058.508] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pem") returned 4
	[0058.508] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pff") returned 4
	[0058.508] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pfm") returned 4
	[0058.508] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0058.508] lstrlenW (lpString=".pfx") returned 4
	[0058.508] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0058.509] lstrlenW (lpString=".pgm") returned 4
	[0058.509] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0058.509] lstrlenW (lpString=".php") returned 4
	[0058.509] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0058.509] lstrlenW (lpString=".php3") returned 5
	[0058.509] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0058.509] lstrlenW (lpString=".php4") returned 5
	[0058.509] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0058.509] lstrlenW (lpString=".php5") returned 5
	[0058.509] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0058.509] lstrlenW (lpString=".phtml") returned 6
	[0058.509] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0058.509] lstrlenW (lpString=".pict") returned 5
	[0058.509] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0058.509] lstrlenW (lpString=".pl") returned 3
	[0058.509] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0058.509] lstrlenW (lpString=".pls") returned 4
	[0058.509] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0058.509] lstrlenW (lpString=".pm") returned 3
	[0058.509] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0058.509] lstrlenW (lpString=".png") returned 4
	[0058.509] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0058.509] lstrlenW (lpString=".pnm") returned 4
	[0058.509] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0058.509] lstrlenW (lpString=".pot") returned 4
	[0058.509] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0058.509] lstrlenW (lpString=".potm") returned 5
	[0058.509] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0058.509] lstrlenW (lpString=".potx") returned 5
	[0058.510] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0058.510] lstrlenW (lpString=".ppa") returned 4
	[0058.510] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0058.510] lstrlenW (lpString=".ppam") returned 5
	[0058.510] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0058.510] lstrlenW (lpString=".ppm") returned 4
	[0058.510] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0058.510] lstrlenW (lpString=".pps") returned 4
	[0058.510] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0058.510] lstrlenW (lpString=".ppsm") returned 5
	[0058.510] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0058.510] lstrlenW (lpString=".ppt") returned 4
	[0058.510] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0058.510] lstrlenW (lpString=".pptm") returned 5
	[0058.510] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0058.510] lstrlenW (lpString=".pptx") returned 5
	[0058.510] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0058.510] lstrlenW (lpString=".prn") returned 4
	[0058.510] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0058.510] lstrlenW (lpString=".ps") returned 3
	[0058.510] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0058.510] lstrlenW (lpString=".psb") returned 4
	[0058.510] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0058.510] lstrlenW (lpString=".psd") returned 4
	[0058.510] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0058.510] lstrlenW (lpString=".pst") returned 4
	[0058.510] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0058.510] lstrlenW (lpString=".ptx") returned 4
	[0058.510] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0058.511] lstrlenW (lpString=".pub") returned 4
	[0058.511] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0058.511] lstrlenW (lpString=".pwm") returned 4
	[0058.511] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0058.511] lstrlenW (lpString=".pxr") returned 4
	[0058.511] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0058.511] lstrlenW (lpString=".py") returned 3
	[0058.511] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0058.511] lstrlenW (lpString=".qt") returned 3
	[0058.511] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0058.511] lstrlenW (lpString=".r3d") returned 4
	[0058.511] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0058.511] lstrlenW (lpString=".raf") returned 4
	[0058.511] lstrcmpiW (lpString1=".raf", lpString2="oney") returned -1
	[0058.511] lstrlenW (lpString=".rar") returned 4
	[0058.511] lstrcmpiW (lpString1=".rar", lpString2="oney") returned -1
	[0058.511] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0058.511] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8c0c941, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c0c941, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c0c941, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0058.511] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0058.512] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0058.512] FindClose (in: hFindFile=0x6f4328 | out: hFindFile=0x6f4328) returned 1
	[0058.512] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0058.512] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1
	[0058.512] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0058.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26
	[0058.512] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c7f0c4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f3fe8
	[0058.512] FindNextFileW (in: hFindFile=0x6f3fe8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c7f0c4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.512] FindNextFileW (in: hFindFile=0x6f3fe8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c32d6d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c58e7d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0058.512] lstrlenW (lpString="eula.rtf.id-B4197730.[admin@stex777.com].money") returned 46
	[0058.512] lstrlenW (lpString=".1cd") returned 4
	[0058.512] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0058.512] lstrlenW (lpString=".3ds") returned 4
	[0058.512] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0058.512] lstrlenW (lpString=".3fr") returned 4
	[0058.512] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0058.513] lstrlenW (lpString=".3g2") returned 4
	[0058.513] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0058.513] lstrlenW (lpString=".3gp") returned 4
	[0058.513] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0058.513] lstrlenW (lpString=".7z") returned 3
	[0058.513] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0058.513] lstrlenW (lpString=".accda") returned 6
	[0058.513] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0058.513] lstrlenW (lpString=".accdb") returned 6
	[0058.513] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0058.513] lstrlenW (lpString=".accdc") returned 6
	[0058.513] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0058.513] lstrlenW (lpString=".accde") returned 6
	[0058.513] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0058.513] lstrlenW (lpString=".accdt") returned 6
	[0058.513] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0058.513] lstrlenW (lpString=".accdw") returned 6
	[0058.513] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0058.513] lstrlenW (lpString=".adb") returned 4
	[0058.513] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0058.513] lstrlenW (lpString=".adp") returned 4
	[0058.513] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0058.513] lstrlenW (lpString=".ai") returned 3
	[0058.513] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0058.513] lstrlenW (lpString=".ai3") returned 4
	[0058.513] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0058.513] lstrlenW (lpString=".ai4") returned 4
	[0058.513] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0058.514] lstrlenW (lpString=".ai5") returned 4
	[0058.514] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0058.514] lstrlenW (lpString=".ai6") returned 4
	[0058.514] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0058.514] lstrlenW (lpString=".ai7") returned 4
	[0058.514] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0058.514] lstrlenW (lpString=".ai8") returned 4
	[0058.514] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0058.514] lstrlenW (lpString=".anim") returned 5
	[0058.514] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0058.514] lstrlenW (lpString=".arw") returned 4
	[0058.514] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0058.514] lstrlenW (lpString=".as") returned 3
	[0058.514] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0058.514] lstrlenW (lpString=".asa") returned 4
	[0058.514] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0058.514] lstrlenW (lpString=".asc") returned 4
	[0058.514] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0058.514] lstrlenW (lpString=".ascx") returned 5
	[0058.514] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0058.514] lstrlenW (lpString=".asm") returned 4
	[0058.514] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0058.514] lstrlenW (lpString=".asmx") returned 5
	[0058.514] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0058.514] lstrlenW (lpString=".asp") returned 4
	[0058.514] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0058.514] lstrlenW (lpString=".aspx") returned 5
	[0058.515] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0058.515] lstrlenW (lpString=".asr") returned 4
	[0058.515] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0058.515] lstrlenW (lpString=".asx") returned 4
	[0058.515] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0058.515] lstrlenW (lpString=".avi") returned 4
	[0058.515] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0058.515] lstrlenW (lpString=".avs") returned 4
	[0058.515] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0058.515] lstrlenW (lpString=".backup") returned 7
	[0058.515] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0058.515] lstrlenW (lpString=".bak") returned 4
	[0058.515] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0058.515] lstrlenW (lpString=".bay") returned 4
	[0058.515] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0058.515] lstrlenW (lpString=".bd") returned 3
	[0058.515] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0058.515] lstrlenW (lpString=".bin") returned 4
	[0058.515] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0058.515] lstrlenW (lpString=".bmp") returned 4
	[0058.515] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0058.515] lstrlenW (lpString=".bz2") returned 4
	[0058.515] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0058.515] lstrlenW (lpString=".c") returned 2
	[0058.515] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0058.515] lstrlenW (lpString=".cdr") returned 4
	[0058.516] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0058.516] lstrlenW (lpString=".cer") returned 4
	[0058.516] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0058.516] lstrlenW (lpString=".cf") returned 3
	[0058.516] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0058.516] lstrlenW (lpString=".cfc") returned 4
	[0058.516] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0058.516] lstrlenW (lpString=".cfm") returned 4
	[0058.516] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0058.516] lstrlenW (lpString=".cfml") returned 5
	[0058.516] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0058.516] lstrlenW (lpString=".cfu") returned 4
	[0058.516] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0058.516] lstrlenW (lpString=".chm") returned 4
	[0058.516] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0058.516] lstrlenW (lpString=".cin") returned 4
	[0058.516] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0058.516] lstrlenW (lpString=".class") returned 6
	[0058.516] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0058.516] lstrlenW (lpString=".clx") returned 4
	[0058.516] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0058.516] lstrlenW (lpString=".config") returned 7
	[0058.516] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0058.516] lstrlenW (lpString=".cpp") returned 4
	[0058.516] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0058.516] lstrlenW (lpString=".cr2") returned 4
	[0058.516] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0058.516] lstrlenW (lpString=".crt") returned 4
	[0058.517] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0058.517] lstrlenW (lpString=".crw") returned 4
	[0058.517] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0058.517] lstrlenW (lpString=".cs") returned 3
	[0058.517] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0058.517] lstrlenW (lpString=".css") returned 4
	[0058.517] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0058.517] lstrlenW (lpString=".csv") returned 4
	[0058.517] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0058.517] lstrlenW (lpString=".cub") returned 4
	[0058.517] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0058.517] lstrlenW (lpString=".dae") returned 4
	[0058.517] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0058.517] lstrlenW (lpString=".dat") returned 4
	[0058.517] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0058.517] lstrlenW (lpString=".db") returned 3
	[0058.517] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0058.517] lstrlenW (lpString=".dbf") returned 4
	[0058.517] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0058.517] lstrlenW (lpString=".dbx") returned 4
	[0058.517] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0058.517] lstrlenW (lpString=".dc3") returned 4
	[0058.517] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0058.517] lstrlenW (lpString=".dcm") returned 4
	[0058.517] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0058.517] lstrlenW (lpString=".dcr") returned 4
	[0058.517] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0058.518] lstrlenW (lpString=".der") returned 4
	[0058.518] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0058.518] lstrlenW (lpString=".dib") returned 4
	[0058.518] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0058.518] lstrlenW (lpString=".dic") returned 4
	[0058.518] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0058.518] lstrlenW (lpString=".dif") returned 4
	[0058.518] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0058.518] lstrlenW (lpString=".divx") returned 5
	[0058.518] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0058.518] lstrlenW (lpString=".djvu") returned 5
	[0058.518] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0058.518] lstrlenW (lpString=".dng") returned 4
	[0058.518] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0058.518] lstrlenW (lpString=".doc") returned 4
	[0058.518] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0058.518] lstrlenW (lpString=".docm") returned 5
	[0058.518] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0058.518] lstrlenW (lpString=".docx") returned 5
	[0058.518] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0058.518] lstrlenW (lpString=".dot") returned 4
	[0058.518] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0058.518] lstrlenW (lpString=".dotm") returned 5
	[0058.518] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0058.518] lstrlenW (lpString=".dotx") returned 5
	[0058.518] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0058.518] lstrlenW (lpString=".dpx") returned 4
	[0058.518] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0058.518] lstrlenW (lpString=".dqy") returned 4
	[0058.519] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0058.519] lstrlenW (lpString=".dsn") returned 4
	[0058.519] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0058.519] lstrlenW (lpString=".dt") returned 3
	[0058.519] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0058.519] lstrlenW (lpString=".dtd") returned 4
	[0058.519] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0058.519] lstrlenW (lpString=".dwg") returned 4
	[0058.519] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0058.519] lstrlenW (lpString=".dwt") returned 4
	[0058.519] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0058.519] lstrlenW (lpString=".dx") returned 3
	[0058.519] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0058.519] lstrlenW (lpString=".dxf") returned 4
	[0058.519] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0058.519] lstrlenW (lpString=".edml") returned 5
	[0058.519] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0058.519] lstrlenW (lpString=".efd") returned 4
	[0058.519] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0058.519] lstrlenW (lpString=".elf") returned 4
	[0058.519] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0058.519] lstrlenW (lpString=".emf") returned 4
	[0058.519] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0058.519] lstrlenW (lpString=".emz") returned 4
	[0058.519] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0058.519] lstrlenW (lpString=".epf") returned 4
	[0058.519] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0058.519] lstrlenW (lpString=".eps") returned 4
	[0058.519] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0058.520] lstrlenW (lpString=".epsf") returned 5
	[0058.520] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0058.520] lstrlenW (lpString=".epsp") returned 5
	[0058.520] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0058.520] lstrlenW (lpString=".erf") returned 4
	[0058.520] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0058.520] lstrlenW (lpString=".exr") returned 4
	[0058.520] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0058.520] lstrlenW (lpString=".f4v") returned 4
	[0058.520] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0058.520] lstrlenW (lpString=".fido") returned 5
	[0058.520] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0058.520] lstrlenW (lpString=".flm") returned 4
	[0058.520] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0058.520] lstrlenW (lpString=".flv") returned 4
	[0058.520] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0058.520] lstrlenW (lpString=".frm") returned 4
	[0058.520] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0058.520] lstrlenW (lpString=".fxg") returned 4
	[0058.520] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0058.521] lstrlenW (lpString=".geo") returned 4
	[0058.521] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0058.521] lstrlenW (lpString=".gif") returned 4
	[0058.521] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0058.521] lstrlenW (lpString=".grs") returned 4
	[0058.521] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0058.521] lstrlenW (lpString=".gz") returned 3
	[0058.521] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0058.521] lstrlenW (lpString=".h") returned 2
	[0058.521] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0058.521] lstrlenW (lpString=".hdr") returned 4
	[0058.521] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0058.521] lstrlenW (lpString=".hpp") returned 4
	[0058.521] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0058.521] lstrlenW (lpString=".hta") returned 4
	[0058.521] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0058.521] lstrlenW (lpString=".htc") returned 4
	[0058.521] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0058.521] lstrlenW (lpString=".htm") returned 4
	[0058.521] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0058.521] lstrlenW (lpString=".html") returned 5
	[0058.521] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0058.521] lstrlenW (lpString=".icb") returned 4
	[0058.521] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0058.521] lstrlenW (lpString=".ics") returned 4
	[0058.521] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".iff") returned 4
	[0058.522] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".inc") returned 4
	[0058.522] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".indd") returned 5
	[0058.522] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0058.522] lstrlenW (lpString=".ini") returned 4
	[0058.522] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".iqy") returned 4
	[0058.522] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".j2c") returned 4
	[0058.522] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".j2k") returned 4
	[0058.522] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".java") returned 5
	[0058.522] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0058.522] lstrlenW (lpString=".jp2") returned 4
	[0058.522] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".jpc") returned 4
	[0058.522] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".jpe") returned 4
	[0058.522] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".jpeg") returned 5
	[0058.522] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0058.522] lstrlenW (lpString=".jpf") returned 4
	[0058.522] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".jpg") returned 4
	[0058.522] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0058.522] lstrlenW (lpString=".jpx") returned 4
	[0058.523] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0058.523] lstrlenW (lpString=".js") returned 3
	[0058.523] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0058.523] lstrlenW (lpString=".jsf") returned 4
	[0058.523] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0058.523] lstrlenW (lpString=".json") returned 5
	[0058.523] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0058.523] lstrlenW (lpString=".jsp") returned 4
	[0058.523] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0058.523] lstrlenW (lpString=".kdc") returned 4
	[0058.523] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0058.523] lstrlenW (lpString=".kmz") returned 4
	[0058.523] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0058.523] lstrlenW (lpString=".kwm") returned 4
	[0058.523] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0058.523] lstrlenW (lpString=".lasso") returned 6
	[0058.523] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0058.523] lstrlenW (lpString=".lbi") returned 4
	[0058.523] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0058.523] lstrlenW (lpString=".lgf") returned 4
	[0058.523] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0058.523] lstrlenW (lpString=".lgp") returned 4
	[0058.523] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0058.523] lstrlenW (lpString=".log") returned 4
	[0058.523] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0058.523] lstrlenW (lpString=".m1v") returned 4
	[0058.523] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".m4a") returned 4
	[0058.524] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".m4v") returned 4
	[0058.524] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".max") returned 4
	[0058.524] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".md") returned 3
	[0058.524] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0058.524] lstrlenW (lpString=".mda") returned 4
	[0058.524] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".mdb") returned 4
	[0058.524] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".mde") returned 4
	[0058.524] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".mdf") returned 4
	[0058.524] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".mdw") returned 4
	[0058.524] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".mef") returned 4
	[0058.524] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".mft") returned 4
	[0058.524] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".mfw") returned 4
	[0058.524] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0058.524] lstrlenW (lpString=".mht") returned 4
	[0058.525] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0058.525] lstrlenW (lpString=".mhtml") returned 6
	[0058.525] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0058.525] lstrlenW (lpString=".mka") returned 4
	[0058.525] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0058.525] lstrlenW (lpString=".mkidx") returned 6
	[0058.525] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0058.525] lstrlenW (lpString=".mkv") returned 4
	[0058.525] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0058.525] lstrlenW (lpString=".mos") returned 4
	[0058.525] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0058.525] lstrlenW (lpString=".mov") returned 4
	[0058.525] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0058.525] lstrlenW (lpString=".mp3") returned 4
	[0058.525] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0058.525] lstrlenW (lpString=".mp4") returned 4
	[0058.525] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0058.525] lstrlenW (lpString=".mpeg") returned 5
	[0058.525] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0058.525] lstrlenW (lpString=".mpg") returned 4
	[0058.525] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0058.525] lstrlenW (lpString=".mpv") returned 4
	[0058.525] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0058.525] lstrlenW (lpString=".mrw") returned 4
	[0058.525] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0058.525] lstrlenW (lpString=".msg") returned 4
	[0058.525] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".mxl") returned 4
	[0058.526] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".myd") returned 4
	[0058.526] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".myi") returned 4
	[0058.526] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".nef") returned 4
	[0058.526] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".nrw") returned 4
	[0058.526] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".obj") returned 4
	[0058.526] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".odb") returned 4
	[0058.526] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".odc") returned 4
	[0058.526] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".odm") returned 4
	[0058.526] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".odp") returned 4
	[0058.526] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".ods") returned 4
	[0058.526] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".oft") returned 4
	[0058.526] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".one") returned 4
	[0058.526] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0058.526] lstrlenW (lpString=".onepkg") returned 7
	[0058.527] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0058.527] lstrlenW (lpString=".onetoc2") returned 8
	[0058.527] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0058.527] lstrlenW (lpString=".opt") returned 4
	[0058.527] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".oqy") returned 4
	[0058.527] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".orf") returned 4
	[0058.527] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".p12") returned 4
	[0058.527] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".p7b") returned 4
	[0058.527] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".p7c") returned 4
	[0058.527] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".pam") returned 4
	[0058.527] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".pbm") returned 4
	[0058.527] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".pct") returned 4
	[0058.527] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".pcx") returned 4
	[0058.527] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".pdd") returned 4
	[0058.527] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".pdf") returned 4
	[0058.527] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0058.527] lstrlenW (lpString=".pdp") returned 4
	[0058.528] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0058.528] lstrlenW (lpString=".pef") returned 4
	[0058.528] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0058.528] lstrlenW (lpString=".pem") returned 4
	[0058.528] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0058.528] lstrlenW (lpString=".pff") returned 4
	[0058.528] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0058.528] lstrlenW (lpString=".pfm") returned 4
	[0058.528] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0058.528] lstrlenW (lpString=".pfx") returned 4
	[0058.528] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0058.528] lstrlenW (lpString=".pgm") returned 4
	[0058.528] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0058.528] lstrlenW (lpString=".php") returned 4
	[0058.528] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0058.528] lstrlenW (lpString=".php3") returned 5
	[0058.528] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0058.528] lstrlenW (lpString=".php4") returned 5
	[0058.528] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0058.528] lstrlenW (lpString=".php5") returned 5
	[0058.528] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0058.528] lstrlenW (lpString=".phtml") returned 6
	[0058.528] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0058.528] lstrlenW (lpString=".pict") returned 5
	[0058.528] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0058.528] lstrlenW (lpString=".pl") returned 3
	[0058.529] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0058.529] lstrlenW (lpString=".pls") returned 4
	[0058.529] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0058.529] lstrlenW (lpString=".pm") returned 3
	[0058.529] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0058.529] lstrlenW (lpString=".png") returned 4
	[0058.529] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0058.529] lstrlenW (lpString=".pnm") returned 4
	[0058.529] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0058.529] lstrlenW (lpString=".pot") returned 4
	[0058.529] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0058.529] lstrlenW (lpString=".potm") returned 5
	[0058.529] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0058.529] lstrlenW (lpString=".potx") returned 5
	[0058.529] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0058.529] lstrlenW (lpString=".ppa") returned 4
	[0058.529] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0058.529] lstrlenW (lpString=".ppam") returned 5
	[0058.529] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0058.529] lstrlenW (lpString=".ppm") returned 4
	[0058.529] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0058.529] lstrlenW (lpString=".pps") returned 4
	[0058.529] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0058.529] lstrlenW (lpString=".ppsm") returned 5
	[0058.529] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0058.529] lstrlenW (lpString=".ppt") returned 4
	[0058.529] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0058.529] lstrlenW (lpString=".pptm") returned 5
	[0058.529] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0058.530] lstrlenW (lpString=".pptx") returned 5
	[0058.530] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0058.530] lstrlenW (lpString=".prn") returned 4
	[0058.530] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0058.530] lstrlenW (lpString=".ps") returned 3
	[0058.530] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0058.530] lstrlenW (lpString=".psb") returned 4
	[0058.530] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0058.530] lstrlenW (lpString=".psd") returned 4
	[0058.530] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0058.530] lstrlenW (lpString=".pst") returned 4
	[0058.530] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0058.530] lstrlenW (lpString=".ptx") returned 4
	[0058.530] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0058.530] lstrlenW (lpString=".pub") returned 4
	[0058.530] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0058.530] lstrlenW (lpString=".pwm") returned 4
	[0058.530] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0058.530] lstrlenW (lpString=".pxr") returned 4
	[0058.530] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0058.530] lstrlenW (lpString=".py") returned 3
	[0058.530] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0058.530] lstrlenW (lpString=".qt") returned 3
	[0058.530] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0058.530] lstrlenW (lpString=".r3d") returned 4
	[0058.530] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0058.530] lstrlenW (lpString=".raf") returned 4
	[0058.530] lstrcmpiW (lpString1=".raf", lpString2="oney") returned -1
	[0058.530] lstrlenW (lpString=".rar") returned 4
	[0058.531] lstrcmpiW (lpString1=".rar", lpString2="oney") returned -1
	[0058.531] FindNextFileW (in: hFindFile=0x6f3fe8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c58e7d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c58e7d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c58e7d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0058.531] FindNextFileW (in: hFindFile=0x6f3fe8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0058.531] FindNextFileW (in: hFindFile=0x6f3fe8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0058.531] FindClose (in: hFindFile=0x6f3fe8 | out: hFindFile=0x6f3fe8) returned 1
	[0058.531] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0058.531] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1
	[0058.531] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0058.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26
	[0058.531] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4628
	[0058.531] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.531] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0058.532] lstrlenW (lpString="eula.rtf") returned 8
	[0058.532] lstrlenW (lpString=".1cd") returned 4
	[0058.532] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0058.532] lstrlenW (lpString=".3ds") returned 4
	[0058.532] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0058.532] lstrlenW (lpString=".3fr") returned 4
	[0058.532] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0058.532] lstrlenW (lpString=".3g2") returned 4
	[0058.532] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0058.532] lstrlenW (lpString=".3gp") returned 4
	[0058.532] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0058.532] lstrlenW (lpString=".7z") returned 3
	[0058.532] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0058.532] lstrlenW (lpString=".accda") returned 6
	[0058.532] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0058.532] lstrlenW (lpString=".accdb") returned 6
	[0058.532] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0058.532] lstrlenW (lpString=".accdc") returned 6
	[0058.532] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0058.532] lstrlenW (lpString=".accde") returned 6
	[0058.532] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0058.532] lstrlenW (lpString=".accdt") returned 6
	[0058.532] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0058.532] lstrlenW (lpString=".accdw") returned 6
	[0058.532] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0058.532] lstrlenW (lpString=".adb") returned 4
	[0058.532] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0058.532] lstrlenW (lpString=".adp") returned 4
	[0058.532] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0058.533] lstrlenW (lpString=".ai") returned 3
	[0058.533] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0058.533] lstrlenW (lpString=".ai3") returned 4
	[0058.533] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0058.533] lstrlenW (lpString=".ai4") returned 4
	[0058.533] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0058.533] lstrlenW (lpString=".ai5") returned 4
	[0058.533] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0058.533] lstrlenW (lpString=".ai6") returned 4
	[0058.533] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0058.533] lstrlenW (lpString=".ai7") returned 4
	[0058.533] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0058.533] lstrlenW (lpString=".ai8") returned 4
	[0058.533] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0058.533] lstrlenW (lpString=".anim") returned 5
	[0058.533] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0058.533] lstrlenW (lpString=".arw") returned 4
	[0058.533] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0058.533] lstrlenW (lpString=".as") returned 3
	[0058.533] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0058.533] lstrlenW (lpString=".asa") returned 4
	[0058.533] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0058.533] lstrlenW (lpString=".asc") returned 4
	[0058.533] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0058.533] lstrlenW (lpString=".ascx") returned 5
	[0058.533] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0058.533] lstrlenW (lpString=".asm") returned 4
	[0058.533] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0058.533] lstrlenW (lpString=".asmx") returned 5
	[0058.534] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0058.534] lstrlenW (lpString=".asp") returned 4
	[0058.534] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0058.534] lstrlenW (lpString=".aspx") returned 5
	[0058.534] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0058.534] lstrlenW (lpString=".asr") returned 4
	[0058.534] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0058.534] lstrlenW (lpString=".asx") returned 4
	[0058.534] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0058.534] lstrlenW (lpString=".avi") returned 4
	[0058.534] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0058.534] lstrlenW (lpString=".avs") returned 4
	[0058.534] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0058.534] lstrlenW (lpString=".backup") returned 7
	[0058.534] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0058.534] lstrlenW (lpString=".bak") returned 4
	[0058.534] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0058.534] lstrlenW (lpString=".bay") returned 4
	[0058.534] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0058.534] lstrlenW (lpString=".bd") returned 3
	[0058.534] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0058.534] lstrlenW (lpString=".bin") returned 4
	[0058.534] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0058.534] lstrlenW (lpString=".bmp") returned 4
	[0058.534] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0058.534] lstrlenW (lpString=".bz2") returned 4
	[0058.534] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0058.535] lstrlenW (lpString=".c") returned 2
	[0058.535] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0058.535] lstrlenW (lpString=".cdr") returned 4
	[0058.535] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0058.535] lstrlenW (lpString=".cer") returned 4
	[0058.535] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0058.535] lstrlenW (lpString=".cf") returned 3
	[0058.535] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0058.535] lstrlenW (lpString=".cfc") returned 4
	[0058.535] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0058.535] lstrlenW (lpString=".cfm") returned 4
	[0058.535] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0058.535] lstrlenW (lpString=".cfml") returned 5
	[0058.535] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0058.535] lstrlenW (lpString=".cfu") returned 4
	[0058.535] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0058.535] lstrlenW (lpString=".chm") returned 4
	[0058.535] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0058.535] lstrlenW (lpString=".cin") returned 4
	[0058.535] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0058.535] lstrlenW (lpString=".class") returned 6
	[0058.535] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0058.535] lstrlenW (lpString=".clx") returned 4
	[0058.535] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0058.535] lstrlenW (lpString=".config") returned 7
	[0058.535] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0058.535] lstrlenW (lpString=".cpp") returned 4
	[0058.535] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0058.536] lstrlenW (lpString=".cr2") returned 4
	[0058.536] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0058.536] lstrlenW (lpString=".crt") returned 4
	[0058.536] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0058.536] lstrlenW (lpString=".crw") returned 4
	[0058.536] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0058.536] lstrlenW (lpString=".cs") returned 3
	[0058.536] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0058.536] lstrlenW (lpString=".css") returned 4
	[0058.536] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0058.536] lstrlenW (lpString=".csv") returned 4
	[0058.536] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0058.536] lstrlenW (lpString=".cub") returned 4
	[0058.536] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0058.536] lstrlenW (lpString=".dae") returned 4
	[0058.536] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0058.536] lstrlenW (lpString=".dat") returned 4
	[0058.536] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0058.536] lstrlenW (lpString=".db") returned 3
	[0058.536] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0058.536] lstrlenW (lpString=".dbf") returned 4
	[0058.536] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0058.943] lstrlenW (lpString=".dbx") returned 4
	[0058.943] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0058.943] lstrlenW (lpString=".dc3") returned 4
	[0058.943] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0058.943] lstrlenW (lpString=".dcm") returned 4
	[0058.943] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0058.943] lstrlenW (lpString=".dcr") returned 4
	[0058.944] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0058.944] lstrlenW (lpString=".der") returned 4
	[0058.944] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0058.944] lstrlenW (lpString=".dib") returned 4
	[0058.944] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0058.944] lstrlenW (lpString=".dic") returned 4
	[0058.944] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0058.944] lstrlenW (lpString=".dif") returned 4
	[0058.944] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0058.944] lstrlenW (lpString=".divx") returned 5
	[0058.944] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0058.944] lstrlenW (lpString=".djvu") returned 5
	[0058.944] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0058.944] lstrlenW (lpString=".dng") returned 4
	[0058.944] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0058.944] lstrlenW (lpString=".doc") returned 4
	[0058.944] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0058.944] lstrlenW (lpString=".docm") returned 5
	[0058.944] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0058.944] lstrlenW (lpString=".docx") returned 5
	[0058.944] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0058.944] lstrlenW (lpString=".dot") returned 4
	[0058.944] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0058.945] lstrlenW (lpString=".dotm") returned 5
	[0058.945] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0058.945] lstrlenW (lpString=".dotx") returned 5
	[0058.945] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0058.945] lstrlenW (lpString=".dpx") returned 4
	[0058.945] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0058.945] lstrlenW (lpString=".dqy") returned 4
	[0058.945] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0058.945] lstrlenW (lpString=".dsn") returned 4
	[0058.945] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0058.945] lstrlenW (lpString=".dt") returned 3
	[0058.945] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0058.945] lstrlenW (lpString=".dtd") returned 4
	[0058.945] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0058.945] lstrlenW (lpString=".dwg") returned 4
	[0058.945] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0058.945] lstrlenW (lpString=".dwt") returned 4
	[0058.945] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0058.945] lstrlenW (lpString=".dx") returned 3
	[0058.945] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0058.945] lstrlenW (lpString=".dxf") returned 4
	[0058.945] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0058.945] lstrlenW (lpString=".edml") returned 5
	[0058.945] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0058.945] lstrlenW (lpString=".efd") returned 4
	[0058.945] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0058.945] lstrlenW (lpString=".elf") returned 4
	[0058.946] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0058.946] lstrlenW (lpString=".emf") returned 4
	[0058.946] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0058.946] lstrlenW (lpString=".emz") returned 4
	[0058.946] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0058.946] lstrlenW (lpString=".epf") returned 4
	[0058.946] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0058.946] lstrlenW (lpString=".eps") returned 4
	[0058.946] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0058.946] lstrlenW (lpString=".epsf") returned 5
	[0058.946] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0058.946] lstrlenW (lpString=".epsp") returned 5
	[0058.946] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0058.946] lstrlenW (lpString=".erf") returned 4
	[0058.946] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0058.946] lstrlenW (lpString=".exr") returned 4
	[0058.946] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0058.946] lstrlenW (lpString=".f4v") returned 4
	[0058.946] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0058.946] lstrlenW (lpString=".fido") returned 5
	[0058.946] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0058.946] lstrlenW (lpString=".flm") returned 4
	[0058.946] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0058.946] lstrlenW (lpString=".flv") returned 4
	[0058.946] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0058.946] lstrlenW (lpString=".frm") returned 4
	[0058.947] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0058.947] lstrlenW (lpString=".fxg") returned 4
	[0058.947] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0058.947] lstrlenW (lpString=".geo") returned 4
	[0058.947] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0058.947] lstrlenW (lpString=".gif") returned 4
	[0058.947] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0058.947] lstrlenW (lpString=".grs") returned 4
	[0058.947] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0058.947] lstrlenW (lpString=".gz") returned 3
	[0058.947] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0058.947] lstrlenW (lpString=".h") returned 2
	[0058.947] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0058.947] lstrlenW (lpString=".hdr") returned 4
	[0058.947] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0058.947] lstrlenW (lpString=".hpp") returned 4
	[0058.947] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0058.947] lstrlenW (lpString=".hta") returned 4
	[0058.947] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0058.947] lstrlenW (lpString=".htc") returned 4
	[0058.947] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0058.947] lstrlenW (lpString=".htm") returned 4
	[0058.947] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0058.948] lstrlenW (lpString=".html") returned 5
	[0058.948] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0058.948] lstrlenW (lpString=".icb") returned 4
	[0058.948] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0058.948] lstrlenW (lpString=".ics") returned 4
	[0058.948] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0058.948] lstrlenW (lpString=".iff") returned 4
	[0058.948] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0058.948] lstrlenW (lpString=".inc") returned 4
	[0058.948] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0058.948] lstrlenW (lpString=".indd") returned 5
	[0058.948] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0058.948] lstrlenW (lpString=".ini") returned 4
	[0058.948] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0058.948] lstrlenW (lpString=".iqy") returned 4
	[0058.948] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0058.948] lstrlenW (lpString=".j2c") returned 4
	[0058.948] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0058.948] lstrlenW (lpString=".j2k") returned 4
	[0058.948] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0058.948] lstrlenW (lpString=".java") returned 5
	[0058.948] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0058.948] lstrlenW (lpString=".jp2") returned 4
	[0058.948] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0058.949] lstrlenW (lpString=".jpc") returned 4
	[0058.949] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0058.949] lstrlenW (lpString=".jpe") returned 4
	[0058.949] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0058.949] lstrlenW (lpString=".jpeg") returned 5
	[0058.949] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0058.949] lstrlenW (lpString=".jpf") returned 4
	[0058.949] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0058.949] lstrlenW (lpString=".jpg") returned 4
	[0058.949] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0058.949] lstrlenW (lpString=".jpx") returned 4
	[0058.949] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0058.949] lstrlenW (lpString=".js") returned 3
	[0058.949] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0058.949] lstrlenW (lpString=".jsf") returned 4
	[0058.949] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0058.949] lstrlenW (lpString=".json") returned 5
	[0058.949] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0058.949] lstrlenW (lpString=".jsp") returned 4
	[0058.949] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0058.949] lstrlenW (lpString=".kdc") returned 4
	[0058.949] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0058.949] lstrlenW (lpString=".kmz") returned 4
	[0058.949] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0058.949] lstrlenW (lpString=".kwm") returned 4
	[0058.949] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".lasso") returned 6
	[0058.950] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0058.950] lstrlenW (lpString=".lbi") returned 4
	[0058.950] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".lgf") returned 4
	[0058.950] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".lgp") returned 4
	[0058.950] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".log") returned 4
	[0058.950] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".m1v") returned 4
	[0058.950] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".m4a") returned 4
	[0058.950] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".m4v") returned 4
	[0058.950] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".max") returned 4
	[0058.950] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".md") returned 3
	[0058.950] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0058.950] lstrlenW (lpString=".mda") returned 4
	[0058.950] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".mdb") returned 4
	[0058.950] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".mde") returned 4
	[0058.950] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0058.950] lstrlenW (lpString=".mdf") returned 4
	[0058.950] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mdw") returned 4
	[0058.951] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mef") returned 4
	[0058.951] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mft") returned 4
	[0058.951] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mfw") returned 4
	[0058.951] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mht") returned 4
	[0058.951] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mhtml") returned 6
	[0058.951] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0058.951] lstrlenW (lpString=".mka") returned 4
	[0058.951] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mkidx") returned 6
	[0058.951] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0058.951] lstrlenW (lpString=".mkv") returned 4
	[0058.951] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mos") returned 4
	[0058.951] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mov") returned 4
	[0058.951] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mp3") returned 4
	[0058.951] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mp4") returned 4
	[0058.951] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0058.951] lstrlenW (lpString=".mpeg") returned 5
	[0058.951] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0058.952] lstrlenW (lpString=".mpg") returned 4
	[0058.952] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".mpv") returned 4
	[0058.952] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".mrw") returned 4
	[0058.952] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".msg") returned 4
	[0058.952] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".mxl") returned 4
	[0058.952] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".myd") returned 4
	[0058.952] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".myi") returned 4
	[0058.952] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".nef") returned 4
	[0058.952] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".nrw") returned 4
	[0058.952] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".obj") returned 4
	[0058.952] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".odb") returned 4
	[0058.952] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".odc") returned 4
	[0058.952] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".odm") returned 4
	[0058.952] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0058.952] lstrlenW (lpString=".odp") returned 4
	[0058.953] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".ods") returned 4
	[0058.953] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".oft") returned 4
	[0058.953] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".one") returned 4
	[0058.953] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".onepkg") returned 7
	[0058.953] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0058.953] lstrlenW (lpString=".onetoc2") returned 8
	[0058.953] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0058.953] lstrlenW (lpString=".opt") returned 4
	[0058.953] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".oqy") returned 4
	[0058.953] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".orf") returned 4
	[0058.953] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".p12") returned 4
	[0058.953] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".p7b") returned 4
	[0058.953] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".p7c") returned 4
	[0058.953] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".pam") returned 4
	[0058.953] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".pbm") returned 4
	[0058.953] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0058.953] lstrlenW (lpString=".pct") returned 4
	[0058.953] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".pcx") returned 4
	[0058.954] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".pdd") returned 4
	[0058.954] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".pdf") returned 4
	[0058.954] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".pdp") returned 4
	[0058.954] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".pef") returned 4
	[0058.954] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".pem") returned 4
	[0058.954] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".pff") returned 4
	[0058.954] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".pfm") returned 4
	[0058.954] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".pfx") returned 4
	[0058.954] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".pgm") returned 4
	[0058.954] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".php") returned 4
	[0058.954] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0058.954] lstrlenW (lpString=".php3") returned 5
	[0058.954] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0058.954] lstrlenW (lpString=".php4") returned 5
	[0058.954] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0058.954] lstrlenW (lpString=".php5") returned 5
	[0058.955] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0058.955] lstrlenW (lpString=".phtml") returned 6
	[0058.955] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0058.955] lstrlenW (lpString=".pict") returned 5
	[0058.955] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0058.955] lstrlenW (lpString=".pl") returned 3
	[0058.955] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0058.955] lstrlenW (lpString=".pls") returned 4
	[0058.955] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0058.955] lstrlenW (lpString=".pm") returned 3
	[0058.955] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0058.955] lstrlenW (lpString=".png") returned 4
	[0058.955] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0058.955] lstrlenW (lpString=".pnm") returned 4
	[0058.955] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0058.955] lstrlenW (lpString=".pot") returned 4
	[0058.955] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0058.955] lstrlenW (lpString=".potm") returned 5
	[0058.955] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0058.955] lstrlenW (lpString=".potx") returned 5
	[0058.955] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0058.955] lstrlenW (lpString=".ppa") returned 4
	[0058.955] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0058.955] lstrlenW (lpString=".ppam") returned 5
	[0058.955] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0058.955] lstrlenW (lpString=".ppm") returned 4
	[0058.955] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0058.955] lstrlenW (lpString=".pps") returned 4
	[0058.956] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0058.956] lstrlenW (lpString=".ppsm") returned 5
	[0058.956] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0058.956] lstrlenW (lpString=".ppt") returned 4
	[0058.956] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0058.956] lstrlenW (lpString=".pptm") returned 5
	[0058.956] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0058.956] lstrlenW (lpString=".pptx") returned 5
	[0058.956] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0058.956] lstrlenW (lpString=".prn") returned 4
	[0058.956] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0058.956] lstrlenW (lpString=".ps") returned 3
	[0058.956] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0058.956] lstrlenW (lpString=".psb") returned 4
	[0058.956] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0058.956] lstrlenW (lpString=".psd") returned 4
	[0058.956] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0058.956] lstrlenW (lpString=".pst") returned 4
	[0058.956] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0058.956] lstrlenW (lpString=".ptx") returned 4
	[0058.956] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0058.956] lstrlenW (lpString=".pub") returned 4
	[0058.956] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0058.956] lstrlenW (lpString=".pwm") returned 4
	[0058.956] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0058.956] lstrlenW (lpString=".pxr") returned 4
	[0058.956] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0058.956] lstrlenW (lpString=".py") returned 3
	[0058.957] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0058.957] lstrlenW (lpString=".qt") returned 3
	[0058.957] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0058.957] lstrlenW (lpString=".r3d") returned 4
	[0058.957] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0058.957] lstrlenW (lpString=".raf") returned 4
	[0058.957] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0058.957] lstrlenW (lpString=".rar") returned 4
	[0058.957] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0058.957] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0058.957] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0058.957] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0058.957] FindClose (in: hFindFile=0x6f4628 | out: hFindFile=0x6f4628) returned 1
	[0058.958] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0058.958] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1
	[0058.994] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0058.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033") returned 26
	[0058.995] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd9143c0c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4628
	[0058.995] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd9143c0c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.995] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd90f7ae6, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd90f7ae6, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd911dc06, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0058.995] lstrlenW (lpString="eula.rtf.id-B4197730.[admin@stex777.com].money") returned 46
	[0058.995] lstrlenW (lpString=".1cd") returned 4
	[0058.995] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0058.995] lstrlenW (lpString=".3ds") returned 4
	[0058.995] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0058.995] lstrlenW (lpString=".3fr") returned 4
	[0058.995] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0058.995] lstrlenW (lpString=".3g2") returned 4
	[0058.995] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0058.995] lstrlenW (lpString=".3gp") returned 4
	[0058.995] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0058.995] lstrlenW (lpString=".7z") returned 3
	[0058.995] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0058.996] lstrlenW (lpString=".accda") returned 6
	[0058.996] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0058.996] lstrlenW (lpString=".accdb") returned 6
	[0058.996] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0058.996] lstrlenW (lpString=".accdc") returned 6
	[0058.996] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0058.996] lstrlenW (lpString=".accde") returned 6
	[0058.996] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0058.996] lstrlenW (lpString=".accdt") returned 6
	[0058.996] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0058.996] lstrlenW (lpString=".accdw") returned 6
	[0058.996] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0058.996] lstrlenW (lpString=".adb") returned 4
	[0058.996] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0058.996] lstrlenW (lpString=".adp") returned 4
	[0058.996] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0058.996] lstrlenW (lpString=".ai") returned 3
	[0058.996] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0058.996] lstrlenW (lpString=".ai3") returned 4
	[0058.996] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0058.996] lstrlenW (lpString=".ai4") returned 4
	[0058.996] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0058.996] lstrlenW (lpString=".ai5") returned 4
	[0058.996] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0058.996] lstrlenW (lpString=".ai6") returned 4
	[0058.996] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0058.997] lstrlenW (lpString=".ai7") returned 4
	[0058.997] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0058.997] lstrlenW (lpString=".ai8") returned 4
	[0058.997] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0058.997] lstrlenW (lpString=".anim") returned 5
	[0058.997] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0058.997] lstrlenW (lpString=".arw") returned 4
	[0058.997] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0058.997] lstrlenW (lpString=".as") returned 3
	[0058.997] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0058.997] lstrlenW (lpString=".asa") returned 4
	[0058.997] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0058.997] lstrlenW (lpString=".asc") returned 4
	[0058.997] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0058.997] lstrlenW (lpString=".ascx") returned 5
	[0058.997] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0058.997] lstrlenW (lpString=".asm") returned 4
	[0058.997] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0058.997] lstrlenW (lpString=".asmx") returned 5
	[0058.997] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0058.997] lstrlenW (lpString=".asp") returned 4
	[0058.997] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0058.997] lstrlenW (lpString=".aspx") returned 5
	[0058.997] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0058.998] lstrlenW (lpString=".asr") returned 4
	[0058.998] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0058.998] lstrlenW (lpString=".asx") returned 4
	[0058.998] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0058.998] lstrlenW (lpString=".avi") returned 4
	[0058.998] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0058.998] lstrlenW (lpString=".avs") returned 4
	[0058.998] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0058.998] lstrlenW (lpString=".backup") returned 7
	[0058.998] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0058.998] lstrlenW (lpString=".bak") returned 4
	[0058.998] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0058.998] lstrlenW (lpString=".bay") returned 4
	[0058.998] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0058.998] lstrlenW (lpString=".bd") returned 3
	[0058.998] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0058.998] lstrlenW (lpString=".bin") returned 4
	[0058.998] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0058.998] lstrlenW (lpString=".bmp") returned 4
	[0058.998] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0058.998] lstrlenW (lpString=".bz2") returned 4
	[0058.998] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0058.998] lstrlenW (lpString=".c") returned 2
	[0058.998] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0058.998] lstrlenW (lpString=".cdr") returned 4
	[0058.999] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0058.999] lstrlenW (lpString=".cer") returned 4
	[0058.999] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0058.999] lstrlenW (lpString=".cf") returned 3
	[0058.999] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0058.999] lstrlenW (lpString=".cfc") returned 4
	[0058.999] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0058.999] lstrlenW (lpString=".cfm") returned 4
	[0058.999] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0058.999] lstrlenW (lpString=".cfml") returned 5
	[0058.999] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0058.999] lstrlenW (lpString=".cfu") returned 4
	[0058.999] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0058.999] lstrlenW (lpString=".chm") returned 4
	[0058.999] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0058.999] lstrlenW (lpString=".cin") returned 4
	[0058.999] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0058.999] lstrlenW (lpString=".class") returned 6
	[0058.999] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0058.999] lstrlenW (lpString=".clx") returned 4
	[0058.999] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0058.999] lstrlenW (lpString=".config") returned 7
	[0058.999] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0059.000] lstrlenW (lpString=".cpp") returned 4
	[0059.000] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0059.000] lstrlenW (lpString=".cr2") returned 4
	[0059.000] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0059.000] lstrlenW (lpString=".crt") returned 4
	[0059.000] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0059.000] lstrlenW (lpString=".crw") returned 4
	[0059.000] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0059.000] lstrlenW (lpString=".cs") returned 3
	[0059.000] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0059.000] lstrlenW (lpString=".css") returned 4
	[0059.000] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0059.000] lstrlenW (lpString=".csv") returned 4
	[0059.000] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0059.000] lstrlenW (lpString=".cub") returned 4
	[0059.000] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0059.000] lstrlenW (lpString=".dae") returned 4
	[0059.000] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0059.000] lstrlenW (lpString=".dat") returned 4
	[0059.000] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0059.000] lstrlenW (lpString=".db") returned 3
	[0059.000] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0059.000] lstrlenW (lpString=".dbf") returned 4
	[0059.001] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0059.001] lstrlenW (lpString=".dbx") returned 4
	[0059.001] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0059.001] lstrlenW (lpString=".dc3") returned 4
	[0059.001] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0059.001] lstrlenW (lpString=".dcm") returned 4
	[0059.001] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0059.001] lstrlenW (lpString=".dcr") returned 4
	[0059.001] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0059.001] lstrlenW (lpString=".der") returned 4
	[0059.001] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0059.001] lstrlenW (lpString=".dib") returned 4
	[0059.001] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0059.001] lstrlenW (lpString=".dic") returned 4
	[0059.001] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0059.001] lstrlenW (lpString=".dif") returned 4
	[0059.001] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0059.001] lstrlenW (lpString=".divx") returned 5
	[0059.001] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0059.001] lstrlenW (lpString=".djvu") returned 5
	[0059.001] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0059.001] lstrlenW (lpString=".dng") returned 4
	[0059.002] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0059.002] lstrlenW (lpString=".doc") returned 4
	[0059.002] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0059.002] lstrlenW (lpString=".docm") returned 5
	[0059.002] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0059.002] lstrlenW (lpString=".docx") returned 5
	[0059.002] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0059.002] lstrlenW (lpString=".dot") returned 4
	[0059.002] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0059.002] lstrlenW (lpString=".dotm") returned 5
	[0059.002] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0059.002] lstrlenW (lpString=".dotx") returned 5
	[0059.002] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0059.002] lstrlenW (lpString=".dpx") returned 4
	[0059.002] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0059.002] lstrlenW (lpString=".dqy") returned 4
	[0059.002] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0059.002] lstrlenW (lpString=".dsn") returned 4
	[0059.002] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0059.002] lstrlenW (lpString=".dt") returned 3
	[0059.002] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0059.002] lstrlenW (lpString=".dtd") returned 4
	[0059.002] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0059.003] lstrlenW (lpString=".dwg") returned 4
	[0059.003] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0059.003] lstrlenW (lpString=".dwt") returned 4
	[0059.003] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0059.003] lstrlenW (lpString=".dx") returned 3
	[0059.003] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0059.003] lstrlenW (lpString=".dxf") returned 4
	[0059.003] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0059.003] lstrlenW (lpString=".edml") returned 5
	[0059.003] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0059.003] lstrlenW (lpString=".efd") returned 4
	[0059.003] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0059.003] lstrlenW (lpString=".elf") returned 4
	[0059.003] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0059.003] lstrlenW (lpString=".emf") returned 4
	[0059.003] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0059.003] lstrlenW (lpString=".emz") returned 4
	[0059.003] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0059.003] lstrlenW (lpString=".epf") returned 4
	[0059.003] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0059.003] lstrlenW (lpString=".eps") returned 4
	[0059.003] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0059.003] lstrlenW (lpString=".epsf") returned 5
	[0059.003] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0059.003] lstrlenW (lpString=".epsp") returned 5
	[0059.004] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0059.004] lstrlenW (lpString=".erf") returned 4
	[0059.004] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0059.004] lstrlenW (lpString=".exr") returned 4
	[0059.004] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0059.004] lstrlenW (lpString=".f4v") returned 4
	[0059.004] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0059.004] lstrlenW (lpString=".fido") returned 5
	[0059.004] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0059.004] lstrlenW (lpString=".flm") returned 4
	[0059.004] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0059.004] lstrlenW (lpString=".flv") returned 4
	[0059.004] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0059.004] lstrlenW (lpString=".frm") returned 4
	[0059.004] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0059.004] lstrlenW (lpString=".fxg") returned 4
	[0059.004] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0059.004] lstrlenW (lpString=".geo") returned 4
	[0059.004] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0059.004] lstrlenW (lpString=".gif") returned 4
	[0059.004] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0059.004] lstrlenW (lpString=".grs") returned 4
	[0059.004] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0059.004] lstrlenW (lpString=".gz") returned 3
	[0059.004] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0059.004] lstrlenW (lpString=".h") returned 2
	[0059.005] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0059.005] lstrlenW (lpString=".hdr") returned 4
	[0059.005] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0059.005] lstrlenW (lpString=".hpp") returned 4
	[0059.005] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0059.005] lstrlenW (lpString=".hta") returned 4
	[0059.005] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0059.005] lstrlenW (lpString=".htc") returned 4
	[0059.005] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0059.005] lstrlenW (lpString=".htm") returned 4
	[0059.005] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0059.006] lstrlenW (lpString=".html") returned 5
	[0059.006] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0059.006] lstrlenW (lpString=".icb") returned 4
	[0059.006] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0059.006] lstrlenW (lpString=".ics") returned 4
	[0059.006] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0059.006] lstrlenW (lpString=".iff") returned 4
	[0059.006] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0059.006] lstrlenW (lpString=".inc") returned 4
	[0059.006] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0059.006] lstrlenW (lpString=".indd") returned 5
	[0059.006] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0059.006] lstrlenW (lpString=".ini") returned 4
	[0059.006] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0059.006] lstrlenW (lpString=".iqy") returned 4
	[0059.006] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0059.006] lstrlenW (lpString=".j2c") returned 4
	[0059.006] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0059.006] lstrlenW (lpString=".j2k") returned 4
	[0059.006] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0059.006] lstrlenW (lpString=".java") returned 5
	[0059.006] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0059.006] lstrlenW (lpString=".jp2") returned 4
	[0059.006] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0059.007] lstrlenW (lpString=".jpc") returned 4
	[0059.007] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0059.007] lstrlenW (lpString=".jpe") returned 4
	[0059.007] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0059.007] lstrlenW (lpString=".jpeg") returned 5
	[0059.007] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0059.007] lstrlenW (lpString=".jpf") returned 4
	[0059.007] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0059.007] lstrlenW (lpString=".jpg") returned 4
	[0059.007] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0059.007] lstrlenW (lpString=".jpx") returned 4
	[0059.007] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0059.007] lstrlenW (lpString=".js") returned 3
	[0059.007] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0059.007] lstrlenW (lpString=".jsf") returned 4
	[0059.007] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0059.007] lstrlenW (lpString=".json") returned 5
	[0059.007] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0059.007] lstrlenW (lpString=".jsp") returned 4
	[0059.007] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0059.007] lstrlenW (lpString=".kdc") returned 4
	[0059.007] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0059.007] lstrlenW (lpString=".kmz") returned 4
	[0059.008] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0059.008] lstrlenW (lpString=".kwm") returned 4
	[0059.008] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0059.008] lstrlenW (lpString=".lasso") returned 6
	[0059.008] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0059.008] lstrlenW (lpString=".lbi") returned 4
	[0059.008] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0059.008] lstrlenW (lpString=".lgf") returned 4
	[0059.008] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0059.008] lstrlenW (lpString=".lgp") returned 4
	[0059.008] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0059.008] lstrlenW (lpString=".log") returned 4
	[0059.008] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0059.008] lstrlenW (lpString=".m1v") returned 4
	[0059.008] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0059.008] lstrlenW (lpString=".m4a") returned 4
	[0059.008] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0059.008] lstrlenW (lpString=".m4v") returned 4
	[0059.008] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0059.009] lstrlenW (lpString=".max") returned 4
	[0059.009] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0059.009] lstrlenW (lpString=".md") returned 3
	[0059.009] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0059.009] lstrlenW (lpString=".mda") returned 4
	[0059.009] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0059.009] lstrlenW (lpString=".mdb") returned 4
	[0059.009] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0059.009] lstrlenW (lpString=".mde") returned 4
	[0059.009] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0059.009] lstrlenW (lpString=".mdf") returned 4
	[0059.009] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0059.009] lstrlenW (lpString=".mdw") returned 4
	[0059.009] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0059.009] lstrlenW (lpString=".mef") returned 4
	[0059.009] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0059.009] lstrlenW (lpString=".mft") returned 4
	[0059.009] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0059.009] lstrlenW (lpString=".mfw") returned 4
	[0059.010] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0059.010] lstrlenW (lpString=".mht") returned 4
	[0059.010] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0059.010] lstrlenW (lpString=".mhtml") returned 6
	[0059.010] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0059.010] lstrlenW (lpString=".mka") returned 4
	[0059.010] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0059.010] lstrlenW (lpString=".mkidx") returned 6
	[0059.010] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0059.010] lstrlenW (lpString=".mkv") returned 4
	[0059.010] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0059.010] lstrlenW (lpString=".mos") returned 4
	[0059.010] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0059.010] lstrlenW (lpString=".mov") returned 4
	[0059.010] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0059.010] lstrlenW (lpString=".mp3") returned 4
	[0059.010] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0059.010] lstrlenW (lpString=".mp4") returned 4
	[0059.011] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0059.011] lstrlenW (lpString=".mpeg") returned 5
	[0059.011] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0059.011] lstrlenW (lpString=".mpg") returned 4
	[0059.011] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0059.011] lstrlenW (lpString=".mpv") returned 4
	[0059.011] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0059.011] lstrlenW (lpString=".mrw") returned 4
	[0059.011] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0059.011] lstrlenW (lpString=".msg") returned 4
	[0059.011] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0059.011] lstrlenW (lpString=".mxl") returned 4
	[0059.011] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0059.011] lstrlenW (lpString=".myd") returned 4
	[0059.011] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0059.011] lstrlenW (lpString=".myi") returned 4
	[0059.011] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0059.011] lstrlenW (lpString=".nef") returned 4
	[0059.011] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0059.011] lstrlenW (lpString=".nrw") returned 4
	[0059.011] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0059.011] lstrlenW (lpString=".obj") returned 4
	[0059.012] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0059.012] lstrlenW (lpString=".odb") returned 4
	[0059.012] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0059.012] lstrlenW (lpString=".odc") returned 4
	[0059.012] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0059.012] lstrlenW (lpString=".odm") returned 4
	[0059.012] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0059.012] lstrlenW (lpString=".odp") returned 4
	[0059.012] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0059.012] lstrlenW (lpString=".ods") returned 4
	[0059.012] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0059.012] lstrlenW (lpString=".oft") returned 4
	[0059.012] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0059.012] lstrlenW (lpString=".one") returned 4
	[0059.012] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0059.012] lstrlenW (lpString=".onepkg") returned 7
	[0059.012] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0059.012] lstrlenW (lpString=".onetoc2") returned 8
	[0059.012] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0059.012] lstrlenW (lpString=".opt") returned 4
	[0059.012] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0059.012] lstrlenW (lpString=".oqy") returned 4
	[0059.012] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".orf") returned 4
	[0059.013] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".p12") returned 4
	[0059.013] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".p7b") returned 4
	[0059.013] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".p7c") returned 4
	[0059.013] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".pam") returned 4
	[0059.013] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".pbm") returned 4
	[0059.013] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".pct") returned 4
	[0059.013] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".pcx") returned 4
	[0059.013] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".pdd") returned 4
	[0059.013] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".pdf") returned 4
	[0059.013] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".pdp") returned 4
	[0059.013] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".pef") returned 4
	[0059.013] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0059.013] lstrlenW (lpString=".pem") returned 4
	[0059.014] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0059.014] lstrlenW (lpString=".pff") returned 4
	[0059.014] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0059.014] lstrlenW (lpString=".pfm") returned 4
	[0059.014] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0059.014] lstrlenW (lpString=".pfx") returned 4
	[0059.014] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0059.014] lstrlenW (lpString=".pgm") returned 4
	[0059.014] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0059.014] lstrlenW (lpString=".php") returned 4
	[0059.014] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0059.014] lstrlenW (lpString=".php3") returned 5
	[0059.014] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0059.014] lstrlenW (lpString=".php4") returned 5
	[0059.014] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0059.014] lstrlenW (lpString=".php5") returned 5
	[0059.014] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0059.014] lstrlenW (lpString=".phtml") returned 6
	[0059.014] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0059.014] lstrlenW (lpString=".pict") returned 5
	[0059.014] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0059.014] lstrlenW (lpString=".pl") returned 3
	[0059.014] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0059.014] lstrlenW (lpString=".pls") returned 4
	[0059.015] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0059.015] lstrlenW (lpString=".pm") returned 3
	[0059.015] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0059.015] lstrlenW (lpString=".png") returned 4
	[0059.015] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0059.015] lstrlenW (lpString=".pnm") returned 4
	[0059.015] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0059.015] lstrlenW (lpString=".pot") returned 4
	[0059.015] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0059.015] lstrlenW (lpString=".potm") returned 5
	[0059.015] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0059.015] lstrlenW (lpString=".potx") returned 5
	[0059.015] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0059.015] lstrlenW (lpString=".ppa") returned 4
	[0059.015] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0059.015] lstrlenW (lpString=".ppam") returned 5
	[0059.015] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0059.015] lstrlenW (lpString=".ppm") returned 4
	[0059.015] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0059.015] lstrlenW (lpString=".pps") returned 4
	[0059.015] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0059.015] lstrlenW (lpString=".ppsm") returned 5
	[0059.015] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0059.015] lstrlenW (lpString=".ppt") returned 4
	[0059.016] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0059.016] lstrlenW (lpString=".pptm") returned 5
	[0059.016] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0059.016] lstrlenW (lpString=".pptx") returned 5
	[0059.016] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0059.016] lstrlenW (lpString=".prn") returned 4
	[0059.016] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0059.016] lstrlenW (lpString=".ps") returned 3
	[0059.016] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0059.016] lstrlenW (lpString=".psb") returned 4
	[0059.016] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0059.016] lstrlenW (lpString=".psd") returned 4
	[0059.016] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0059.016] lstrlenW (lpString=".pst") returned 4
	[0059.016] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0059.016] lstrlenW (lpString=".ptx") returned 4
	[0059.016] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0059.016] lstrlenW (lpString=".pub") returned 4
	[0059.016] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0059.016] lstrlenW (lpString=".pwm") returned 4
	[0059.016] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0059.016] lstrlenW (lpString=".pxr") returned 4
	[0059.016] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0059.016] lstrlenW (lpString=".py") returned 3
	[0059.016] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0059.016] lstrlenW (lpString=".qt") returned 3
	[0059.016] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0059.016] lstrlenW (lpString=".r3d") returned 4
	[0059.017] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0059.017] lstrlenW (lpString=".raf") returned 4
	[0059.017] lstrcmpiW (lpString1=".raf", lpString2="oney") returned -1
	[0059.017] lstrlenW (lpString=".rar") returned 4
	[0059.017] lstrcmpiW (lpString1=".rar", lpString2="oney") returned -1
	[0059.017] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd911dc06, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd911dc06, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd911dc06, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0059.017] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.017] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.017] FindClose (in: hFindFile=0x6f4628 | out: hFindFile=0x6f4628) returned 1
	[0059.017] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0059.017] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1
	[0059.018] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0059.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035") returned 26
	[0059.018] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4668
	[0059.018] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.018] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.018] lstrlenW (lpString="eula.rtf") returned 8
	[0059.018] lstrlenW (lpString=".1cd") returned 4
	[0059.018] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.018] lstrlenW (lpString=".3ds") returned 4
	[0059.018] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0059.018] lstrlenW (lpString=".3fr") returned 4
	[0059.018] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0059.018] lstrlenW (lpString=".3g2") returned 4
	[0059.018] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0059.018] lstrlenW (lpString=".3gp") returned 4
	[0059.018] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0059.018] lstrlenW (lpString=".7z") returned 3
	[0059.019] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.019] lstrlenW (lpString=".accda") returned 6
	[0059.019] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0059.019] lstrlenW (lpString=".accdb") returned 6
	[0059.019] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0059.019] lstrlenW (lpString=".accdc") returned 6
	[0059.019] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0059.019] lstrlenW (lpString=".accde") returned 6
	[0059.019] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0059.019] lstrlenW (lpString=".accdt") returned 6
	[0059.019] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0059.019] lstrlenW (lpString=".accdw") returned 6
	[0059.019] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0059.019] lstrlenW (lpString=".adb") returned 4
	[0059.019] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0059.019] lstrlenW (lpString=".adp") returned 4
	[0059.019] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0059.019] lstrlenW (lpString=".ai") returned 3
	[0059.019] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0059.019] lstrlenW (lpString=".ai3") returned 4
	[0059.019] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0059.019] lstrlenW (lpString=".ai4") returned 4
	[0059.019] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0059.019] lstrlenW (lpString=".ai5") returned 4
	[0059.019] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0059.020] lstrlenW (lpString=".ai6") returned 4
	[0059.020] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0059.020] lstrlenW (lpString=".ai7") returned 4
	[0059.020] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0059.020] lstrlenW (lpString=".ai8") returned 4
	[0059.020] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0059.020] lstrlenW (lpString=".anim") returned 5
	[0059.020] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0059.020] lstrlenW (lpString=".arw") returned 4
	[0059.020] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0059.020] lstrlenW (lpString=".as") returned 3
	[0059.020] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0059.020] lstrlenW (lpString=".asa") returned 4
	[0059.020] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0059.020] lstrlenW (lpString=".asc") returned 4
	[0059.020] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0059.020] lstrlenW (lpString=".ascx") returned 5
	[0059.341] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0059.341] lstrlenW (lpString=".asm") returned 4
	[0059.341] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0059.341] lstrlenW (lpString=".asmx") returned 5
	[0059.341] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0059.341] lstrlenW (lpString=".asp") returned 4
	[0059.341] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0059.341] lstrlenW (lpString=".aspx") returned 5
	[0059.341] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0059.341] lstrlenW (lpString=".asr") returned 4
	[0059.341] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0059.341] lstrlenW (lpString=".asx") returned 4
	[0059.341] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0059.341] lstrlenW (lpString=".avi") returned 4
	[0059.341] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0059.341] lstrlenW (lpString=".avs") returned 4
	[0059.341] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0059.341] lstrlenW (lpString=".backup") returned 7
	[0059.341] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0059.341] lstrlenW (lpString=".bak") returned 4
	[0059.341] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0059.341] lstrlenW (lpString=".bay") returned 4
	[0059.341] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0059.342] lstrlenW (lpString=".bd") returned 3
	[0059.342] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0059.342] lstrlenW (lpString=".bin") returned 4
	[0059.342] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0059.342] lstrlenW (lpString=".bmp") returned 4
	[0059.342] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0059.342] lstrlenW (lpString=".bz2") returned 4
	[0059.342] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.342] lstrlenW (lpString=".c") returned 2
	[0059.342] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0059.342] lstrlenW (lpString=".cdr") returned 4
	[0059.342] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0059.342] lstrlenW (lpString=".cer") returned 4
	[0059.342] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0059.342] lstrlenW (lpString=".cf") returned 3
	[0059.342] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0059.342] lstrlenW (lpString=".cfc") returned 4
	[0059.342] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0059.342] lstrlenW (lpString=".cfm") returned 4
	[0059.342] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0059.342] lstrlenW (lpString=".cfml") returned 5
	[0059.342] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0059.342] lstrlenW (lpString=".cfu") returned 4
	[0059.342] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0059.342] lstrlenW (lpString=".chm") returned 4
	[0059.343] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0059.343] lstrlenW (lpString=".cin") returned 4
	[0059.343] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0059.343] lstrlenW (lpString=".class") returned 6
	[0059.343] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0059.343] lstrlenW (lpString=".clx") returned 4
	[0059.343] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0059.343] lstrlenW (lpString=".config") returned 7
	[0059.343] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0059.343] lstrlenW (lpString=".cpp") returned 4
	[0059.343] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0059.343] lstrlenW (lpString=".cr2") returned 4
	[0059.343] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0059.343] lstrlenW (lpString=".crt") returned 4
	[0059.343] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0059.343] lstrlenW (lpString=".crw") returned 4
	[0059.343] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0059.343] lstrlenW (lpString=".cs") returned 3
	[0059.343] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0059.343] lstrlenW (lpString=".css") returned 4
	[0059.343] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0059.343] lstrlenW (lpString=".csv") returned 4
	[0059.343] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0059.343] lstrlenW (lpString=".cub") returned 4
	[0059.343] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0059.343] lstrlenW (lpString=".dae") returned 4
	[0059.343] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0059.343] lstrlenW (lpString=".dat") returned 4
	[0059.344] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0059.344] lstrlenW (lpString=".db") returned 3
	[0059.344] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0059.344] lstrlenW (lpString=".dbf") returned 4
	[0059.344] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.344] lstrlenW (lpString=".dbx") returned 4
	[0059.344] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0059.344] lstrlenW (lpString=".dc3") returned 4
	[0059.344] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0059.344] lstrlenW (lpString=".dcm") returned 4
	[0059.344] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0059.344] lstrlenW (lpString=".dcr") returned 4
	[0059.344] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0059.344] lstrlenW (lpString=".der") returned 4
	[0059.344] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0059.344] lstrlenW (lpString=".dib") returned 4
	[0059.344] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0059.344] lstrlenW (lpString=".dic") returned 4
	[0059.344] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0059.344] lstrlenW (lpString=".dif") returned 4
	[0059.344] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0059.344] lstrlenW (lpString=".divx") returned 5
	[0059.344] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0059.344] lstrlenW (lpString=".djvu") returned 5
	[0059.344] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0059.344] lstrlenW (lpString=".dng") returned 4
	[0059.345] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0059.345] lstrlenW (lpString=".doc") returned 4
	[0059.345] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.345] lstrlenW (lpString=".docm") returned 5
	[0059.345] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0059.345] lstrlenW (lpString=".docx") returned 5
	[0059.345] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.345] lstrlenW (lpString=".dot") returned 4
	[0059.345] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0059.345] lstrlenW (lpString=".dotm") returned 5
	[0059.345] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0059.345] lstrlenW (lpString=".dotx") returned 5
	[0059.345] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0059.345] lstrlenW (lpString=".dpx") returned 4
	[0059.345] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0059.345] lstrlenW (lpString=".dqy") returned 4
	[0059.345] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0059.345] lstrlenW (lpString=".dsn") returned 4
	[0059.345] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0059.345] lstrlenW (lpString=".dt") returned 3
	[0059.345] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0059.345] lstrlenW (lpString=".dtd") returned 4
	[0059.345] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0059.345] lstrlenW (lpString=".dwg") returned 4
	[0059.345] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0059.345] lstrlenW (lpString=".dwt") returned 4
	[0059.346] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0059.346] lstrlenW (lpString=".dx") returned 3
	[0059.346] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0059.346] lstrlenW (lpString=".dxf") returned 4
	[0059.346] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0059.346] lstrlenW (lpString=".edml") returned 5
	[0059.346] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0059.346] lstrlenW (lpString=".efd") returned 4
	[0059.346] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0059.346] lstrlenW (lpString=".elf") returned 4
	[0059.346] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0059.346] lstrlenW (lpString=".emf") returned 4
	[0059.346] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0059.346] lstrlenW (lpString=".emz") returned 4
	[0059.346] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0059.346] lstrlenW (lpString=".epf") returned 4
	[0059.346] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0059.346] lstrlenW (lpString=".eps") returned 4
	[0059.346] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0059.346] lstrlenW (lpString=".epsf") returned 5
	[0059.346] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0059.346] lstrlenW (lpString=".epsp") returned 5
	[0059.346] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0059.346] lstrlenW (lpString=".erf") returned 4
	[0059.346] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0059.346] lstrlenW (lpString=".exr") returned 4
	[0059.346] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0059.347] lstrlenW (lpString=".f4v") returned 4
	[0059.347] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0059.347] lstrlenW (lpString=".fido") returned 5
	[0059.347] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0059.347] lstrlenW (lpString=".flm") returned 4
	[0059.347] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0059.347] lstrlenW (lpString=".flv") returned 4
	[0059.347] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0059.347] lstrlenW (lpString=".frm") returned 4
	[0059.347] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0059.347] lstrlenW (lpString=".fxg") returned 4
	[0059.347] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0059.347] lstrlenW (lpString=".geo") returned 4
	[0059.347] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0059.347] lstrlenW (lpString=".gif") returned 4
	[0059.347] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0059.347] lstrlenW (lpString=".grs") returned 4
	[0059.347] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0059.347] lstrlenW (lpString=".gz") returned 3
	[0059.347] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0059.347] lstrlenW (lpString=".h") returned 2
	[0059.347] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0059.347] lstrlenW (lpString=".hdr") returned 4
	[0059.347] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0059.347] lstrlenW (lpString=".hpp") returned 4
	[0059.347] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0059.347] lstrlenW (lpString=".hta") returned 4
	[0059.348] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0059.348] lstrlenW (lpString=".htc") returned 4
	[0059.348] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0059.348] lstrlenW (lpString=".htm") returned 4
	[0059.348] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0059.348] lstrlenW (lpString=".html") returned 5
	[0059.348] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0059.348] lstrlenW (lpString=".icb") returned 4
	[0059.348] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0059.348] lstrlenW (lpString=".ics") returned 4
	[0059.348] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0059.348] lstrlenW (lpString=".iff") returned 4
	[0059.348] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0059.348] lstrlenW (lpString=".inc") returned 4
	[0059.348] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0059.348] lstrlenW (lpString=".indd") returned 5
	[0059.348] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0059.348] lstrlenW (lpString=".ini") returned 4
	[0059.348] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0059.348] lstrlenW (lpString=".iqy") returned 4
	[0059.348] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0059.348] lstrlenW (lpString=".j2c") returned 4
	[0059.348] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0059.348] lstrlenW (lpString=".j2k") returned 4
	[0059.348] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0059.348] lstrlenW (lpString=".java") returned 5
	[0059.348] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0059.348] lstrlenW (lpString=".jp2") returned 4
	[0059.349] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0059.349] lstrlenW (lpString=".jpc") returned 4
	[0059.349] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0059.349] lstrlenW (lpString=".jpe") returned 4
	[0059.349] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0059.349] lstrlenW (lpString=".jpeg") returned 5
	[0059.349] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0059.349] lstrlenW (lpString=".jpf") returned 4
	[0059.349] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0059.349] lstrlenW (lpString=".jpg") returned 4
	[0059.349] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.349] lstrlenW (lpString=".jpx") returned 4
	[0059.349] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0059.349] lstrlenW (lpString=".js") returned 3
	[0059.349] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0059.349] lstrlenW (lpString=".jsf") returned 4
	[0059.349] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0059.349] lstrlenW (lpString=".json") returned 5
	[0059.349] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0059.349] lstrlenW (lpString=".jsp") returned 4
	[0059.349] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0059.349] lstrlenW (lpString=".kdc") returned 4
	[0059.349] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0059.349] lstrlenW (lpString=".kmz") returned 4
	[0059.349] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0059.349] lstrlenW (lpString=".kwm") returned 4
	[0059.349] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0059.349] lstrlenW (lpString=".lasso") returned 6
	[0059.350] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0059.350] lstrlenW (lpString=".lbi") returned 4
	[0059.350] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0059.350] lstrlenW (lpString=".lgf") returned 4
	[0059.350] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0059.350] lstrlenW (lpString=".lgp") returned 4
	[0059.350] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0059.350] lstrlenW (lpString=".log") returned 4
	[0059.350] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0059.350] lstrlenW (lpString=".m1v") returned 4
	[0059.350] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0059.350] lstrlenW (lpString=".m4a") returned 4
	[0059.350] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0059.350] lstrlenW (lpString=".m4v") returned 4
	[0059.350] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0059.350] lstrlenW (lpString=".max") returned 4
	[0059.350] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0059.350] lstrlenW (lpString=".md") returned 3
	[0059.350] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0059.350] lstrlenW (lpString=".mda") returned 4
	[0059.350] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0059.350] lstrlenW (lpString=".mdb") returned 4
	[0059.350] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0059.350] lstrlenW (lpString=".mde") returned 4
	[0059.350] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0059.350] lstrlenW (lpString=".mdf") returned 4
	[0059.350] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0059.351] lstrlenW (lpString=".mdw") returned 4
	[0059.351] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0059.351] lstrlenW (lpString=".mef") returned 4
	[0059.351] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0059.351] lstrlenW (lpString=".mft") returned 4
	[0059.351] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0059.351] lstrlenW (lpString=".mfw") returned 4
	[0059.351] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0059.351] lstrlenW (lpString=".mht") returned 4
	[0059.351] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0059.351] lstrlenW (lpString=".mhtml") returned 6
	[0059.351] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0059.351] lstrlenW (lpString=".mka") returned 4
	[0059.351] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0059.351] lstrlenW (lpString=".mkidx") returned 6
	[0059.351] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0059.351] lstrlenW (lpString=".mkv") returned 4
	[0059.351] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0059.351] lstrlenW (lpString=".mos") returned 4
	[0059.351] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0059.351] lstrlenW (lpString=".mov") returned 4
	[0059.351] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0059.351] lstrlenW (lpString=".mp3") returned 4
	[0059.351] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0059.351] lstrlenW (lpString=".mp4") returned 4
	[0059.351] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0059.352] lstrlenW (lpString=".mpeg") returned 5
	[0059.352] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0059.352] lstrlenW (lpString=".mpg") returned 4
	[0059.352] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0059.352] lstrlenW (lpString=".mpv") returned 4
	[0059.352] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0059.352] lstrlenW (lpString=".mrw") returned 4
	[0059.352] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0059.352] lstrlenW (lpString=".msg") returned 4
	[0059.352] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0059.352] lstrlenW (lpString=".mxl") returned 4
	[0059.352] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0059.352] lstrlenW (lpString=".myd") returned 4
	[0059.352] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0059.352] lstrlenW (lpString=".myi") returned 4
	[0059.352] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0059.352] lstrlenW (lpString=".nef") returned 4
	[0059.352] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0059.352] lstrlenW (lpString=".nrw") returned 4
	[0059.352] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0059.352] lstrlenW (lpString=".obj") returned 4
	[0059.352] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0059.352] lstrlenW (lpString=".odb") returned 4
	[0059.353] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0059.353] lstrlenW (lpString=".odc") returned 4
	[0059.353] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0059.353] lstrlenW (lpString=".odm") returned 4
	[0059.353] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0059.353] lstrlenW (lpString=".odp") returned 4
	[0059.353] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0059.353] lstrlenW (lpString=".ods") returned 4
	[0059.353] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0059.353] lstrlenW (lpString=".oft") returned 4
	[0059.353] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0059.353] lstrlenW (lpString=".one") returned 4
	[0059.353] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0059.353] lstrlenW (lpString=".onepkg") returned 7
	[0059.353] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0059.353] lstrlenW (lpString=".onetoc2") returned 8
	[0059.353] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0059.353] lstrlenW (lpString=".opt") returned 4
	[0059.353] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0059.353] lstrlenW (lpString=".oqy") returned 4
	[0059.353] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0059.353] lstrlenW (lpString=".orf") returned 4
	[0059.354] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".p12") returned 4
	[0059.354] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".p7b") returned 4
	[0059.354] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".p7c") returned 4
	[0059.354] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".pam") returned 4
	[0059.354] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".pbm") returned 4
	[0059.354] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".pct") returned 4
	[0059.354] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".pcx") returned 4
	[0059.354] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".pdd") returned 4
	[0059.354] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".pdf") returned 4
	[0059.354] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".pdp") returned 4
	[0059.354] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".pef") returned 4
	[0059.354] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0059.354] lstrlenW (lpString=".pem") returned 4
	[0059.354] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0059.355] lstrlenW (lpString=".pff") returned 4
	[0059.355] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0059.355] lstrlenW (lpString=".pfm") returned 4
	[0059.355] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0059.355] lstrlenW (lpString=".pfx") returned 4
	[0059.355] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0059.355] lstrlenW (lpString=".pgm") returned 4
	[0059.355] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0059.355] lstrlenW (lpString=".php") returned 4
	[0059.355] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0059.355] lstrlenW (lpString=".php3") returned 5
	[0059.355] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0059.355] lstrlenW (lpString=".php4") returned 5
	[0059.355] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0059.355] lstrlenW (lpString=".php5") returned 5
	[0059.355] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0059.355] lstrlenW (lpString=".phtml") returned 6
	[0059.355] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0059.355] lstrlenW (lpString=".pict") returned 5
	[0059.355] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0059.355] lstrlenW (lpString=".pl") returned 3
	[0059.355] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0059.355] lstrlenW (lpString=".pls") returned 4
	[0059.355] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0059.355] lstrlenW (lpString=".pm") returned 3
	[0059.355] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0059.355] lstrlenW (lpString=".png") returned 4
	[0059.355] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0059.355] lstrlenW (lpString=".pnm") returned 4
	[0059.356] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0059.356] lstrlenW (lpString=".pot") returned 4
	[0059.356] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0059.356] lstrlenW (lpString=".potm") returned 5
	[0059.356] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0059.356] lstrlenW (lpString=".potx") returned 5
	[0059.356] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0059.356] lstrlenW (lpString=".ppa") returned 4
	[0059.356] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0059.356] lstrlenW (lpString=".ppam") returned 5
	[0059.356] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0059.356] lstrlenW (lpString=".ppm") returned 4
	[0059.356] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0059.356] lstrlenW (lpString=".pps") returned 4
	[0059.356] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0059.356] lstrlenW (lpString=".ppsm") returned 5
	[0059.356] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0059.356] lstrlenW (lpString=".ppt") returned 4
	[0059.356] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.356] lstrlenW (lpString=".pptm") returned 5
	[0059.356] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0059.356] lstrlenW (lpString=".pptx") returned 5
	[0059.356] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0059.357] lstrlenW (lpString=".prn") returned 4
	[0059.357] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0059.357] lstrlenW (lpString=".ps") returned 3
	[0059.357] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0059.357] lstrlenW (lpString=".psb") returned 4
	[0059.357] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0059.357] lstrlenW (lpString=".psd") returned 4
	[0059.357] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0059.357] lstrlenW (lpString=".pst") returned 4
	[0059.357] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0059.357] lstrlenW (lpString=".ptx") returned 4
	[0059.357] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0059.357] lstrlenW (lpString=".pub") returned 4
	[0059.357] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0059.357] lstrlenW (lpString=".pwm") returned 4
	[0059.357] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0059.357] lstrlenW (lpString=".pxr") returned 4
	[0059.357] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0059.357] lstrlenW (lpString=".py") returned 3
	[0059.357] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0059.357] lstrlenW (lpString=".qt") returned 3
	[0059.357] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0059.357] lstrlenW (lpString=".r3d") returned 4
	[0059.358] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0059.358] lstrlenW (lpString=".raf") returned 4
	[0059.358] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0059.358] lstrlenW (lpString=".rar") returned 4
	[0059.358] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.358] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.358] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.358] FindNextFileW (in: hFindFile=0x6f4668, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.358] FindClose (in: hFindFile=0x6f4668 | out: hFindFile=0x6f4668) returned 1
	[0059.358] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0059.358] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1
	[0059.359] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0059.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036") returned 26
	[0059.359] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f3f68
	[0059.359] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.359] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd960976b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0059.359] lstrlenW (lpString="eula.rtf.id-B4197730.[admin@stex777.com].money") returned 46
	[0059.359] lstrlenW (lpString=".1cd") returned 4
	[0059.359] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0059.359] lstrlenW (lpString=".3ds") returned 4
	[0059.359] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0059.359] lstrlenW (lpString=".3fr") returned 4
	[0059.359] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0059.359] lstrlenW (lpString=".3g2") returned 4
	[0059.359] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0059.359] lstrlenW (lpString=".3gp") returned 4
	[0059.359] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0059.359] lstrlenW (lpString=".7z") returned 3
	[0059.360] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0059.360] lstrlenW (lpString=".accda") returned 6
	[0059.360] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0059.360] lstrlenW (lpString=".accdb") returned 6
	[0059.360] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0059.360] lstrlenW (lpString=".accdc") returned 6
	[0059.360] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0059.360] lstrlenW (lpString=".accde") returned 6
	[0059.360] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0059.360] lstrlenW (lpString=".accdt") returned 6
	[0059.360] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0059.360] lstrlenW (lpString=".accdw") returned 6
	[0059.360] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0059.360] lstrlenW (lpString=".adb") returned 4
	[0059.360] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0059.360] lstrlenW (lpString=".adp") returned 4
	[0059.360] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0059.360] lstrlenW (lpString=".ai") returned 3
	[0059.360] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0059.360] lstrlenW (lpString=".ai3") returned 4
	[0059.360] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0059.360] lstrlenW (lpString=".ai4") returned 4
	[0059.360] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0059.360] lstrlenW (lpString=".ai5") returned 4
	[0059.360] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0059.361] lstrlenW (lpString=".ai6") returned 4
	[0059.361] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0059.361] lstrlenW (lpString=".ai7") returned 4
	[0059.361] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0059.361] lstrlenW (lpString=".ai8") returned 4
	[0059.361] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0059.361] lstrlenW (lpString=".anim") returned 5
	[0059.361] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0059.361] lstrlenW (lpString=".arw") returned 4
	[0059.361] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0059.361] lstrlenW (lpString=".as") returned 3
	[0059.361] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0059.361] lstrlenW (lpString=".asa") returned 4
	[0059.361] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0059.361] lstrlenW (lpString=".asc") returned 4
	[0059.361] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0059.361] lstrlenW (lpString=".ascx") returned 5
	[0059.361] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0059.361] lstrlenW (lpString=".asm") returned 4
	[0059.361] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0059.361] lstrlenW (lpString=".asmx") returned 5
	[0059.361] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0059.361] lstrlenW (lpString=".asp") returned 4
	[0059.362] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0059.362] lstrlenW (lpString=".aspx") returned 5
	[0059.362] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0059.362] lstrlenW (lpString=".asr") returned 4
	[0059.362] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0059.362] lstrlenW (lpString=".asx") returned 4
	[0059.362] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0059.362] lstrlenW (lpString=".avi") returned 4
	[0059.362] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0059.362] lstrlenW (lpString=".avs") returned 4
	[0059.362] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0059.362] lstrlenW (lpString=".backup") returned 7
	[0059.362] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0059.362] lstrlenW (lpString=".bak") returned 4
	[0059.362] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0059.362] lstrlenW (lpString=".bay") returned 4
	[0059.362] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0059.362] lstrlenW (lpString=".bd") returned 3
	[0059.362] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0059.362] lstrlenW (lpString=".bin") returned 4
	[0059.362] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0059.362] lstrlenW (lpString=".bmp") returned 4
	[0059.362] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0059.362] lstrlenW (lpString=".bz2") returned 4
	[0059.362] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0059.362] lstrlenW (lpString=".c") returned 2
	[0059.362] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0059.362] lstrlenW (lpString=".cdr") returned 4
	[0059.363] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0059.363] lstrlenW (lpString=".cer") returned 4
	[0059.363] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0059.363] lstrlenW (lpString=".cf") returned 3
	[0059.363] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0059.363] lstrlenW (lpString=".cfc") returned 4
	[0059.363] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0059.363] lstrlenW (lpString=".cfm") returned 4
	[0059.363] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0059.363] lstrlenW (lpString=".cfml") returned 5
	[0059.363] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0059.363] lstrlenW (lpString=".cfu") returned 4
	[0059.363] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0059.363] lstrlenW (lpString=".chm") returned 4
	[0059.363] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0059.363] lstrlenW (lpString=".cin") returned 4
	[0059.363] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0059.363] lstrlenW (lpString=".class") returned 6
	[0059.363] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0059.363] lstrlenW (lpString=".clx") returned 4
	[0059.363] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0059.363] lstrlenW (lpString=".config") returned 7
	[0059.363] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0059.363] lstrlenW (lpString=".cpp") returned 4
	[0059.363] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0059.363] lstrlenW (lpString=".cr2") returned 4
	[0059.363] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0059.363] lstrlenW (lpString=".crt") returned 4
	[0059.364] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0059.364] lstrlenW (lpString=".crw") returned 4
	[0059.364] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0059.364] lstrlenW (lpString=".cs") returned 3
	[0059.364] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0059.364] lstrlenW (lpString=".css") returned 4
	[0059.364] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0059.364] lstrlenW (lpString=".csv") returned 4
	[0059.364] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0059.364] lstrlenW (lpString=".cub") returned 4
	[0059.364] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0059.364] lstrlenW (lpString=".dae") returned 4
	[0059.364] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0059.364] lstrlenW (lpString=".dat") returned 4
	[0059.364] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0059.364] lstrlenW (lpString=".db") returned 3
	[0059.364] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0059.364] lstrlenW (lpString=".dbf") returned 4
	[0059.364] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0059.364] lstrlenW (lpString=".dbx") returned 4
	[0059.364] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0059.364] lstrlenW (lpString=".dc3") returned 4
	[0059.364] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0059.364] lstrlenW (lpString=".dcm") returned 4
	[0059.364] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0059.365] lstrlenW (lpString=".dcr") returned 4
	[0059.365] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0059.365] lstrlenW (lpString=".der") returned 4
	[0059.365] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0059.365] lstrlenW (lpString=".dib") returned 4
	[0059.365] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0059.365] lstrlenW (lpString=".dic") returned 4
	[0059.365] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0059.365] lstrlenW (lpString=".dif") returned 4
	[0059.365] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0059.365] lstrlenW (lpString=".divx") returned 5
	[0059.365] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0059.365] lstrlenW (lpString=".djvu") returned 5
	[0059.365] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0059.365] lstrlenW (lpString=".dng") returned 4
	[0059.365] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0059.365] lstrlenW (lpString=".doc") returned 4
	[0059.365] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0059.365] lstrlenW (lpString=".docm") returned 5
	[0059.365] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0059.365] lstrlenW (lpString=".docx") returned 5
	[0059.365] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0059.365] lstrlenW (lpString=".dot") returned 4
	[0059.365] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0059.365] lstrlenW (lpString=".dotm") returned 5
	[0059.366] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0059.366] lstrlenW (lpString=".dotx") returned 5
	[0059.366] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0059.366] lstrlenW (lpString=".dpx") returned 4
	[0059.366] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0059.366] lstrlenW (lpString=".dqy") returned 4
	[0059.366] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0059.366] lstrlenW (lpString=".dsn") returned 4
	[0059.366] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0059.366] lstrlenW (lpString=".dt") returned 3
	[0059.366] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0059.366] lstrlenW (lpString=".dtd") returned 4
	[0059.366] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0059.366] lstrlenW (lpString=".dwg") returned 4
	[0059.366] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0059.366] lstrlenW (lpString=".dwt") returned 4
	[0059.366] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0059.366] lstrlenW (lpString=".dx") returned 3
	[0059.366] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0059.366] lstrlenW (lpString=".dxf") returned 4
	[0059.366] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0059.366] lstrlenW (lpString=".edml") returned 5
	[0059.366] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0059.366] lstrlenW (lpString=".efd") returned 4
	[0059.366] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0059.367] lstrlenW (lpString=".elf") returned 4
	[0059.367] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0059.367] lstrlenW (lpString=".emf") returned 4
	[0059.367] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0059.367] lstrlenW (lpString=".emz") returned 4
	[0059.367] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0059.367] lstrlenW (lpString=".epf") returned 4
	[0059.367] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0059.367] lstrlenW (lpString=".eps") returned 4
	[0059.367] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0059.367] lstrlenW (lpString=".epsf") returned 5
	[0059.367] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0059.367] lstrlenW (lpString=".epsp") returned 5
	[0059.367] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0059.367] lstrlenW (lpString=".erf") returned 4
	[0059.367] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0059.367] lstrlenW (lpString=".exr") returned 4
	[0059.367] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0059.367] lstrlenW (lpString=".f4v") returned 4
	[0059.367] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0059.367] lstrlenW (lpString=".fido") returned 5
	[0059.367] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0059.367] lstrlenW (lpString=".flm") returned 4
	[0059.368] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0059.368] lstrlenW (lpString=".flv") returned 4
	[0059.368] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0059.368] lstrlenW (lpString=".frm") returned 4
	[0059.368] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0059.368] lstrlenW (lpString=".fxg") returned 4
	[0059.368] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0059.368] lstrlenW (lpString=".geo") returned 4
	[0059.368] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0059.368] lstrlenW (lpString=".gif") returned 4
	[0059.368] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0059.368] lstrlenW (lpString=".grs") returned 4
	[0059.368] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0059.368] lstrlenW (lpString=".gz") returned 3
	[0059.368] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0059.368] lstrlenW (lpString=".h") returned 2
	[0059.368] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0059.368] lstrlenW (lpString=".hdr") returned 4
	[0059.368] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0059.368] lstrlenW (lpString=".hpp") returned 4
	[0059.368] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0059.368] lstrlenW (lpString=".hta") returned 4
	[0059.368] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0059.368] lstrlenW (lpString=".htc") returned 4
	[0059.368] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0059.368] lstrlenW (lpString=".htm") returned 4
	[0059.368] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0059.369] lstrlenW (lpString=".html") returned 5
	[0059.369] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0059.369] lstrlenW (lpString=".icb") returned 4
	[0059.369] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0059.369] lstrlenW (lpString=".ics") returned 4
	[0059.369] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0059.369] lstrlenW (lpString=".iff") returned 4
	[0059.369] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0059.369] lstrlenW (lpString=".inc") returned 4
	[0059.369] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0059.369] lstrlenW (lpString=".indd") returned 5
	[0059.369] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0059.369] lstrlenW (lpString=".ini") returned 4
	[0059.369] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0059.369] lstrlenW (lpString=".iqy") returned 4
	[0059.369] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0059.369] lstrlenW (lpString=".j2c") returned 4
	[0059.369] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0059.369] lstrlenW (lpString=".j2k") returned 4
	[0059.369] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0059.369] lstrlenW (lpString=".java") returned 5
	[0059.369] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0059.369] lstrlenW (lpString=".jp2") returned 4
	[0059.369] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0059.370] lstrlenW (lpString=".jpc") returned 4
	[0059.370] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0059.370] lstrlenW (lpString=".jpe") returned 4
	[0059.370] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0059.370] lstrlenW (lpString=".jpeg") returned 5
	[0059.370] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0059.370] lstrlenW (lpString=".jpf") returned 4
	[0059.370] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0059.370] lstrlenW (lpString=".jpg") returned 4
	[0059.370] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0059.370] lstrlenW (lpString=".jpx") returned 4
	[0059.370] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0059.370] lstrlenW (lpString=".js") returned 3
	[0059.370] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0059.370] lstrlenW (lpString=".jsf") returned 4
	[0059.371] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0059.371] lstrlenW (lpString=".json") returned 5
	[0059.371] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0059.371] lstrlenW (lpString=".jsp") returned 4
	[0059.371] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0059.371] lstrlenW (lpString=".kdc") returned 4
	[0059.371] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0059.371] lstrlenW (lpString=".kmz") returned 4
	[0059.371] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0059.371] lstrlenW (lpString=".kwm") returned 4
	[0059.371] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0059.371] lstrlenW (lpString=".lasso") returned 6
	[0059.371] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0059.371] lstrlenW (lpString=".lbi") returned 4
	[0059.371] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0059.371] lstrlenW (lpString=".lgf") returned 4
	[0059.371] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0059.371] lstrlenW (lpString=".lgp") returned 4
	[0059.371] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0059.371] lstrlenW (lpString=".log") returned 4
	[0059.371] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0059.371] lstrlenW (lpString=".m1v") returned 4
	[0059.371] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0059.371] lstrlenW (lpString=".m4a") returned 4
	[0059.371] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0059.371] lstrlenW (lpString=".m4v") returned 4
	[0059.371] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0059.372] lstrlenW (lpString=".max") returned 4
	[0059.372] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0059.372] lstrlenW (lpString=".md") returned 3
	[0059.372] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0059.372] lstrlenW (lpString=".mda") returned 4
	[0059.372] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0059.372] lstrlenW (lpString=".mdb") returned 4
	[0059.372] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0059.372] lstrlenW (lpString=".mde") returned 4
	[0059.372] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0059.372] lstrlenW (lpString=".mdf") returned 4
	[0059.372] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0059.372] lstrlenW (lpString=".mdw") returned 4
	[0059.372] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0059.372] lstrlenW (lpString=".mef") returned 4
	[0059.372] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0059.372] lstrlenW (lpString=".mft") returned 4
	[0059.372] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0059.372] lstrlenW (lpString=".mfw") returned 4
	[0059.372] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0059.372] lstrlenW (lpString=".mht") returned 4
	[0059.372] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0059.372] lstrlenW (lpString=".mhtml") returned 6
	[0059.372] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0059.372] lstrlenW (lpString=".mka") returned 4
	[0059.373] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0059.373] lstrlenW (lpString=".mkidx") returned 6
	[0059.373] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0059.373] lstrlenW (lpString=".mkv") returned 4
	[0059.373] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0059.373] lstrlenW (lpString=".mos") returned 4
	[0059.373] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0059.373] lstrlenW (lpString=".mov") returned 4
	[0059.373] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0059.373] lstrlenW (lpString=".mp3") returned 4
	[0059.373] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0059.373] lstrlenW (lpString=".mp4") returned 4
	[0059.373] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0059.373] lstrlenW (lpString=".mpeg") returned 5
	[0059.373] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0059.373] lstrlenW (lpString=".mpg") returned 4
	[0059.373] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0059.373] lstrlenW (lpString=".mpv") returned 4
	[0059.373] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0059.373] lstrlenW (lpString=".mrw") returned 4
	[0059.373] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0059.373] lstrlenW (lpString=".msg") returned 4
	[0059.373] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0059.373] lstrlenW (lpString=".mxl") returned 4
	[0059.373] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0059.373] lstrlenW (lpString=".myd") returned 4
	[0059.373] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".myi") returned 4
	[0059.374] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".nef") returned 4
	[0059.374] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".nrw") returned 4
	[0059.374] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".obj") returned 4
	[0059.374] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".odb") returned 4
	[0059.374] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".odc") returned 4
	[0059.374] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".odm") returned 4
	[0059.374] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".odp") returned 4
	[0059.374] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".ods") returned 4
	[0059.374] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".oft") returned 4
	[0059.374] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".one") returned 4
	[0059.374] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0059.374] lstrlenW (lpString=".onepkg") returned 7
	[0059.374] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0059.374] lstrlenW (lpString=".onetoc2") returned 8
	[0059.375] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0059.375] lstrlenW (lpString=".opt") returned 4
	[0059.375] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0059.375] lstrlenW (lpString=".oqy") returned 4
	[0059.375] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0059.375] lstrlenW (lpString=".orf") returned 4
	[0059.375] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0059.375] lstrlenW (lpString=".p12") returned 4
	[0059.375] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0059.375] lstrlenW (lpString=".p7b") returned 4
	[0059.375] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0059.375] lstrlenW (lpString=".p7c") returned 4
	[0059.375] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0059.375] lstrlenW (lpString=".pam") returned 4
	[0059.375] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0059.375] lstrlenW (lpString=".pbm") returned 4
	[0059.375] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0059.375] lstrlenW (lpString=".pct") returned 4
	[0059.375] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0059.375] lstrlenW (lpString=".pcx") returned 4
	[0059.375] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0059.375] lstrlenW (lpString=".pdd") returned 4
	[0059.375] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0059.375] lstrlenW (lpString=".pdf") returned 4
	[0059.375] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0059.376] lstrlenW (lpString=".pdp") returned 4
	[0059.376] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0059.376] lstrlenW (lpString=".pef") returned 4
	[0059.376] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0059.376] lstrlenW (lpString=".pem") returned 4
	[0059.376] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0059.376] lstrlenW (lpString=".pff") returned 4
	[0059.376] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0059.376] lstrlenW (lpString=".pfm") returned 4
	[0059.376] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0059.376] lstrlenW (lpString=".pfx") returned 4
	[0059.376] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0059.376] lstrlenW (lpString=".pgm") returned 4
	[0059.376] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0059.376] lstrlenW (lpString=".php") returned 4
	[0059.376] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0059.376] lstrlenW (lpString=".php3") returned 5
	[0059.376] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0059.376] lstrlenW (lpString=".php4") returned 5
	[0059.376] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0059.376] lstrlenW (lpString=".php5") returned 5
	[0059.376] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0059.376] lstrlenW (lpString=".phtml") returned 6
	[0059.376] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0059.377] lstrlenW (lpString=".pict") returned 5
	[0059.377] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0059.377] lstrlenW (lpString=".pl") returned 3
	[0059.377] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0059.377] lstrlenW (lpString=".pls") returned 4
	[0059.377] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0059.377] lstrlenW (lpString=".pm") returned 3
	[0059.377] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0059.377] lstrlenW (lpString=".png") returned 4
	[0059.377] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0059.377] lstrlenW (lpString=".pnm") returned 4
	[0059.377] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0059.377] lstrlenW (lpString=".pot") returned 4
	[0059.377] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0059.377] lstrlenW (lpString=".potm") returned 5
	[0059.377] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0059.377] lstrlenW (lpString=".potx") returned 5
	[0059.377] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0059.377] lstrlenW (lpString=".ppa") returned 4
	[0059.377] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0059.377] lstrlenW (lpString=".ppam") returned 5
	[0059.377] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0059.377] lstrlenW (lpString=".ppm") returned 4
	[0059.377] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0059.377] lstrlenW (lpString=".pps") returned 4
	[0059.378] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0059.378] lstrlenW (lpString=".ppsm") returned 5
	[0059.378] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0059.378] lstrlenW (lpString=".ppt") returned 4
	[0059.378] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0059.378] lstrlenW (lpString=".pptm") returned 5
	[0059.378] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0059.378] lstrlenW (lpString=".pptx") returned 5
	[0059.378] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0059.378] lstrlenW (lpString=".prn") returned 4
	[0059.378] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0059.378] lstrlenW (lpString=".ps") returned 3
	[0059.378] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0059.378] lstrlenW (lpString=".psb") returned 4
	[0059.378] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0059.378] lstrlenW (lpString=".psd") returned 4
	[0059.378] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0059.378] lstrlenW (lpString=".pst") returned 4
	[0059.378] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0059.378] lstrlenW (lpString=".ptx") returned 4
	[0059.378] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0059.378] lstrlenW (lpString=".pub") returned 4
	[0059.378] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0059.379] lstrlenW (lpString=".pwm") returned 4
	[0059.379] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0059.379] lstrlenW (lpString=".pxr") returned 4
	[0059.379] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0059.379] lstrlenW (lpString=".py") returned 3
	[0059.379] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0059.379] lstrlenW (lpString=".qt") returned 3
	[0059.379] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0059.379] lstrlenW (lpString=".r3d") returned 4
	[0059.379] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0059.379] lstrlenW (lpString=".raf") returned 4
	[0059.379] lstrcmpiW (lpString1=".raf", lpString2="oney") returned -1
	[0059.379] lstrlenW (lpString=".rar") returned 4
	[0059.379] lstrcmpiW (lpString1=".rar", lpString2="oney") returned -1
	[0059.379] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.379] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd960976b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0059.379] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.380] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0059.380] FindClose (in: hFindFile=0x6f3f68 | out: hFindFile=0x6f3f68) returned 1
	[0059.380] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0059.380] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1
	[0059.380] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0059.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037") returned 26
	[0059.380] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f41e8
	[0059.380] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.380] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0059.380] lstrlenW (lpString="eula.rtf") returned 8
	[0059.380] lstrlenW (lpString=".1cd") returned 4
	[0059.381] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0059.381] lstrlenW (lpString=".3ds") returned 4
	[0059.381] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0059.381] lstrlenW (lpString=".3fr") returned 4
	[0059.381] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0059.381] lstrlenW (lpString=".3g2") returned 4
	[0059.381] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0059.381] lstrlenW (lpString=".3gp") returned 4
	[0059.381] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0059.381] lstrlenW (lpString=".7z") returned 3
	[0059.381] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0059.381] lstrlenW (lpString=".accda") returned 6
	[0059.381] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0059.381] lstrlenW (lpString=".accdb") returned 6
	[0059.381] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0059.381] lstrlenW (lpString=".accdc") returned 6
	[0059.381] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0059.381] lstrlenW (lpString=".accde") returned 6
	[0059.381] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0059.381] lstrlenW (lpString=".accdt") returned 6
	[0059.381] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0059.381] lstrlenW (lpString=".accdw") returned 6
	[0059.381] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0059.381] lstrlenW (lpString=".adb") returned 4
	[0059.381] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0059.381] lstrlenW (lpString=".adp") returned 4
	[0059.381] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0059.381] lstrlenW (lpString=".ai") returned 3
	[0059.382] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0059.382] lstrlenW (lpString=".ai3") returned 4
	[0059.382] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0059.382] lstrlenW (lpString=".ai4") returned 4
	[0059.382] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0059.382] lstrlenW (lpString=".ai5") returned 4
	[0059.382] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0059.382] lstrlenW (lpString=".ai6") returned 4
	[0059.382] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0059.382] lstrlenW (lpString=".ai7") returned 4
	[0059.382] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0059.382] lstrlenW (lpString=".ai8") returned 4
	[0059.382] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0059.382] lstrlenW (lpString=".anim") returned 5
	[0059.382] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0059.382] lstrlenW (lpString=".arw") returned 4
	[0059.382] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0059.382] lstrlenW (lpString=".as") returned 3
	[0059.382] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0059.382] lstrlenW (lpString=".asa") returned 4
	[0059.382] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0059.382] lstrlenW (lpString=".asc") returned 4
	[0059.382] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0059.382] lstrlenW (lpString=".ascx") returned 5
	[0059.382] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0059.382] lstrlenW (lpString=".asm") returned 4
	[0059.383] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0059.383] lstrlenW (lpString=".asmx") returned 5
	[0059.383] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0059.383] lstrlenW (lpString=".asp") returned 4
	[0059.383] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0059.383] lstrlenW (lpString=".aspx") returned 5
	[0059.383] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0059.383] lstrlenW (lpString=".asr") returned 4
	[0059.383] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0059.383] lstrlenW (lpString=".asx") returned 4
	[0059.383] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0059.383] lstrlenW (lpString=".avi") returned 4
	[0059.383] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0059.383] lstrlenW (lpString=".avs") returned 4
	[0059.383] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0059.383] lstrlenW (lpString=".backup") returned 7
	[0059.383] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0059.383] lstrlenW (lpString=".bak") returned 4
	[0059.383] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0059.383] lstrlenW (lpString=".bay") returned 4
	[0059.383] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0059.383] lstrlenW (lpString=".bd") returned 3
	[0059.383] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0059.383] lstrlenW (lpString=".bin") returned 4
	[0059.384] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0059.384] lstrlenW (lpString=".bmp") returned 4
	[0059.384] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0059.384] lstrlenW (lpString=".bz2") returned 4
	[0059.384] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0059.384] lstrlenW (lpString=".c") returned 2
	[0059.384] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0059.384] lstrlenW (lpString=".cdr") returned 4
	[0059.384] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0059.384] lstrlenW (lpString=".cer") returned 4
	[0059.384] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0059.384] lstrlenW (lpString=".cf") returned 3
	[0059.384] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0059.384] lstrlenW (lpString=".cfc") returned 4
	[0059.384] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0059.384] lstrlenW (lpString=".cfm") returned 4
	[0059.384] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0059.384] lstrlenW (lpString=".cfml") returned 5
	[0059.384] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0059.384] lstrlenW (lpString=".cfu") returned 4
	[0059.384] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0059.384] lstrlenW (lpString=".chm") returned 4
	[0059.384] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0059.384] lstrlenW (lpString=".cin") returned 4
	[0059.385] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0059.385] lstrlenW (lpString=".class") returned 6
	[0059.385] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0059.385] lstrlenW (lpString=".clx") returned 4
	[0059.385] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0059.385] lstrlenW (lpString=".config") returned 7
	[0059.385] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0059.385] lstrlenW (lpString=".cpp") returned 4
	[0059.385] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0059.385] lstrlenW (lpString=".cr2") returned 4
	[0059.385] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0059.385] lstrlenW (lpString=".crt") returned 4
	[0059.385] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0059.385] lstrlenW (lpString=".crw") returned 4
	[0059.385] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0059.385] lstrlenW (lpString=".cs") returned 3
	[0059.385] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0059.385] lstrlenW (lpString=".css") returned 4
	[0059.385] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0059.385] lstrlenW (lpString=".csv") returned 4
	[0059.385] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0059.385] lstrlenW (lpString=".cub") returned 4
	[0059.385] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0059.385] lstrlenW (lpString=".dae") returned 4
	[0059.385] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0059.541] lstrlenW (lpString=".dat") returned 4
	[0059.541] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0059.541] lstrlenW (lpString=".db") returned 3
	[0059.541] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0059.541] lstrlenW (lpString=".dbf") returned 4
	[0059.541] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0059.541] lstrlenW (lpString=".dbx") returned 4
	[0059.541] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0059.541] lstrlenW (lpString=".dc3") returned 4
	[0059.541] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0059.541] lstrlenW (lpString=".dcm") returned 4
	[0059.541] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0059.541] lstrlenW (lpString=".dcr") returned 4
	[0059.541] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0059.541] lstrlenW (lpString=".der") returned 4
	[0059.542] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0059.542] lstrlenW (lpString=".dib") returned 4
	[0059.542] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0059.542] lstrlenW (lpString=".dic") returned 4
	[0059.542] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0059.542] lstrlenW (lpString=".dif") returned 4
	[0059.542] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0059.542] lstrlenW (lpString=".divx") returned 5
	[0059.542] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0059.542] lstrlenW (lpString=".djvu") returned 5
	[0059.542] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0059.542] lstrlenW (lpString=".dng") returned 4
	[0059.542] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0059.542] lstrlenW (lpString=".doc") returned 4
	[0059.542] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0059.542] lstrlenW (lpString=".docm") returned 5
	[0059.542] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0059.542] lstrlenW (lpString=".docx") returned 5
	[0059.542] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0059.542] lstrlenW (lpString=".dot") returned 4
	[0059.542] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0059.543] lstrlenW (lpString=".dotm") returned 5
	[0059.543] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0059.543] lstrlenW (lpString=".dotx") returned 5
	[0059.543] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0059.543] lstrlenW (lpString=".dpx") returned 4
	[0059.543] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0059.543] lstrlenW (lpString=".dqy") returned 4
	[0059.543] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0059.543] lstrlenW (lpString=".dsn") returned 4
	[0059.543] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0059.543] lstrlenW (lpString=".dt") returned 3
	[0059.543] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0059.543] lstrlenW (lpString=".dtd") returned 4
	[0059.543] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0059.543] lstrlenW (lpString=".dwg") returned 4
	[0059.543] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0059.543] lstrlenW (lpString=".dwt") returned 4
	[0059.543] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0059.543] lstrlenW (lpString=".dx") returned 3
	[0059.543] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0059.543] lstrlenW (lpString=".dxf") returned 4
	[0059.543] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0059.543] lstrlenW (lpString=".edml") returned 5
	[0059.543] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0059.543] lstrlenW (lpString=".efd") returned 4
	[0059.543] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0059.543] lstrlenW (lpString=".elf") returned 4
	[0059.544] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0059.544] lstrlenW (lpString=".emf") returned 4
	[0059.544] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0059.544] lstrlenW (lpString=".emz") returned 4
	[0059.544] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0059.544] lstrlenW (lpString=".epf") returned 4
	[0059.544] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0059.544] lstrlenW (lpString=".eps") returned 4
	[0059.544] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0059.544] lstrlenW (lpString=".epsf") returned 5
	[0059.544] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0059.544] lstrlenW (lpString=".epsp") returned 5
	[0059.544] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0059.544] lstrlenW (lpString=".erf") returned 4
	[0059.544] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0059.544] lstrlenW (lpString=".exr") returned 4
	[0059.544] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0059.544] lstrlenW (lpString=".f4v") returned 4
	[0059.544] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0059.544] lstrlenW (lpString=".fido") returned 5
	[0059.544] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0059.544] lstrlenW (lpString=".flm") returned 4
	[0059.544] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0059.544] lstrlenW (lpString=".flv") returned 4
	[0059.545] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0059.545] lstrlenW (lpString=".frm") returned 4
	[0059.545] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0059.545] lstrlenW (lpString=".fxg") returned 4
	[0059.545] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0059.545] lstrlenW (lpString=".geo") returned 4
	[0059.545] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0059.545] lstrlenW (lpString=".gif") returned 4
	[0059.545] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0059.545] lstrlenW (lpString=".grs") returned 4
	[0059.545] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0059.545] lstrlenW (lpString=".gz") returned 3
	[0059.545] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0059.545] lstrlenW (lpString=".h") returned 2
	[0059.545] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0059.545] lstrlenW (lpString=".hdr") returned 4
	[0059.545] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0059.545] lstrlenW (lpString=".hpp") returned 4
	[0059.545] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0059.545] lstrlenW (lpString=".hta") returned 4
	[0059.545] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0059.545] lstrlenW (lpString=".htc") returned 4
	[0059.545] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0059.545] lstrlenW (lpString=".htm") returned 4
	[0059.546] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0059.546] lstrlenW (lpString=".html") returned 5
	[0059.546] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0059.546] lstrlenW (lpString=".icb") returned 4
	[0059.546] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0059.546] lstrlenW (lpString=".ics") returned 4
	[0059.546] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0059.546] lstrlenW (lpString=".iff") returned 4
	[0059.546] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0059.546] lstrlenW (lpString=".inc") returned 4
	[0059.546] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0059.546] lstrlenW (lpString=".indd") returned 5
	[0059.546] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0059.546] lstrlenW (lpString=".ini") returned 4
	[0059.546] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0059.546] lstrlenW (lpString=".iqy") returned 4
	[0059.546] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0059.546] lstrlenW (lpString=".j2c") returned 4
	[0059.546] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0059.546] lstrlenW (lpString=".j2k") returned 4
	[0059.546] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0059.546] lstrlenW (lpString=".java") returned 5
	[0059.546] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0059.546] lstrlenW (lpString=".jp2") returned 4
	[0059.546] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0059.547] lstrlenW (lpString=".jpc") returned 4
	[0059.547] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0059.547] lstrlenW (lpString=".jpe") returned 4
	[0059.547] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0059.547] lstrlenW (lpString=".jpeg") returned 5
	[0059.547] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0059.547] lstrlenW (lpString=".jpf") returned 4
	[0059.547] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0059.547] lstrlenW (lpString=".jpg") returned 4
	[0059.547] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0059.547] lstrlenW (lpString=".jpx") returned 4
	[0059.547] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0059.547] lstrlenW (lpString=".js") returned 3
	[0059.547] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0059.547] lstrlenW (lpString=".jsf") returned 4
	[0059.547] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0059.547] lstrlenW (lpString=".json") returned 5
	[0059.547] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0059.547] lstrlenW (lpString=".jsp") returned 4
	[0059.547] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0059.547] lstrlenW (lpString=".kdc") returned 4
	[0059.547] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0059.547] lstrlenW (lpString=".kmz") returned 4
	[0059.547] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0059.547] lstrlenW (lpString=".kwm") returned 4
	[0059.547] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0059.547] lstrlenW (lpString=".lasso") returned 6
	[0059.548] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0059.548] lstrlenW (lpString=".lbi") returned 4
	[0059.548] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".lgf") returned 4
	[0059.548] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".lgp") returned 4
	[0059.548] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".log") returned 4
	[0059.548] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".m1v") returned 4
	[0059.548] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".m4a") returned 4
	[0059.548] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".m4v") returned 4
	[0059.548] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".max") returned 4
	[0059.548] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".md") returned 3
	[0059.548] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0059.548] lstrlenW (lpString=".mda") returned 4
	[0059.548] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".mdb") returned 4
	[0059.548] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".mde") returned 4
	[0059.548] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".mdf") returned 4
	[0059.548] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0059.548] lstrlenW (lpString=".mdw") returned 4
	[0059.549] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0059.549] lstrlenW (lpString=".mef") returned 4
	[0059.549] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0059.549] lstrlenW (lpString=".mft") returned 4
	[0059.549] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0059.549] lstrlenW (lpString=".mfw") returned 4
	[0059.549] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0059.549] lstrlenW (lpString=".mht") returned 4
	[0059.549] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0059.549] lstrlenW (lpString=".mhtml") returned 6
	[0059.549] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0059.549] lstrlenW (lpString=".mka") returned 4
	[0059.549] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0059.549] lstrlenW (lpString=".mkidx") returned 6
	[0059.549] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0059.549] lstrlenW (lpString=".mkv") returned 4
	[0059.549] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0059.549] lstrlenW (lpString=".mos") returned 4
	[0059.549] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0059.549] lstrlenW (lpString=".mov") returned 4
	[0059.549] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0059.549] lstrlenW (lpString=".mp3") returned 4
	[0059.549] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0059.549] lstrlenW (lpString=".mp4") returned 4
	[0059.549] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0059.549] lstrlenW (lpString=".mpeg") returned 5
	[0059.550] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0059.550] lstrlenW (lpString=".mpg") returned 4
	[0059.550] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".mpv") returned 4
	[0059.550] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".mrw") returned 4
	[0059.550] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".msg") returned 4
	[0059.550] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".mxl") returned 4
	[0059.550] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".myd") returned 4
	[0059.550] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".myi") returned 4
	[0059.550] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".nef") returned 4
	[0059.550] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".nrw") returned 4
	[0059.550] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".obj") returned 4
	[0059.550] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".odb") returned 4
	[0059.550] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".odc") returned 4
	[0059.550] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0059.550] lstrlenW (lpString=".odm") returned 4
	[0059.550] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".odp") returned 4
	[0059.551] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".ods") returned 4
	[0059.551] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".oft") returned 4
	[0059.551] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".one") returned 4
	[0059.551] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".onepkg") returned 7
	[0059.551] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0059.551] lstrlenW (lpString=".onetoc2") returned 8
	[0059.551] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0059.551] lstrlenW (lpString=".opt") returned 4
	[0059.551] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".oqy") returned 4
	[0059.551] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".orf") returned 4
	[0059.551] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".p12") returned 4
	[0059.551] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".p7b") returned 4
	[0059.551] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".p7c") returned 4
	[0059.551] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".pam") returned 4
	[0059.551] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0059.551] lstrlenW (lpString=".pbm") returned 4
	[0059.551] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".pct") returned 4
	[0059.552] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".pcx") returned 4
	[0059.552] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".pdd") returned 4
	[0059.552] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".pdf") returned 4
	[0059.552] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".pdp") returned 4
	[0059.552] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".pef") returned 4
	[0059.552] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".pem") returned 4
	[0059.552] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".pff") returned 4
	[0059.552] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".pfm") returned 4
	[0059.552] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".pfx") returned 4
	[0059.552] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".pgm") returned 4
	[0059.552] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".php") returned 4
	[0059.552] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0059.552] lstrlenW (lpString=".php3") returned 5
	[0059.552] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0059.553] lstrlenW (lpString=".php4") returned 5
	[0059.553] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0059.553] lstrlenW (lpString=".php5") returned 5
	[0059.553] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0059.553] lstrlenW (lpString=".phtml") returned 6
	[0059.553] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0059.553] lstrlenW (lpString=".pict") returned 5
	[0059.553] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0059.553] lstrlenW (lpString=".pl") returned 3
	[0059.553] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0059.553] lstrlenW (lpString=".pls") returned 4
	[0059.553] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0059.553] lstrlenW (lpString=".pm") returned 3
	[0059.553] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0059.553] lstrlenW (lpString=".png") returned 4
	[0059.553] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0059.553] lstrlenW (lpString=".pnm") returned 4
	[0059.553] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0059.553] lstrlenW (lpString=".pot") returned 4
	[0059.553] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0059.553] lstrlenW (lpString=".potm") returned 5
	[0059.553] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0059.553] lstrlenW (lpString=".potx") returned 5
	[0059.553] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0059.553] lstrlenW (lpString=".ppa") returned 4
	[0059.553] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0059.553] lstrlenW (lpString=".ppam") returned 5
	[0059.554] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0059.554] lstrlenW (lpString=".ppm") returned 4
	[0059.554] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0059.554] lstrlenW (lpString=".pps") returned 4
	[0059.554] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0059.554] lstrlenW (lpString=".ppsm") returned 5
	[0059.554] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0059.554] lstrlenW (lpString=".ppt") returned 4
	[0059.554] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0059.554] lstrlenW (lpString=".pptm") returned 5
	[0059.554] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0059.554] lstrlenW (lpString=".pptx") returned 5
	[0059.554] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0059.554] lstrlenW (lpString=".prn") returned 4
	[0059.554] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0059.554] lstrlenW (lpString=".ps") returned 3
	[0059.554] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0059.554] lstrlenW (lpString=".psb") returned 4
	[0059.554] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0059.554] lstrlenW (lpString=".psd") returned 4
	[0059.554] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0059.554] lstrlenW (lpString=".pst") returned 4
	[0059.554] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0059.554] lstrlenW (lpString=".ptx") returned 4
	[0059.554] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0059.554] lstrlenW (lpString=".pub") returned 4
	[0059.554] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0059.555] lstrlenW (lpString=".pwm") returned 4
	[0059.555] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0059.555] lstrlenW (lpString=".pxr") returned 4
	[0059.555] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0059.555] lstrlenW (lpString=".py") returned 3
	[0059.555] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0059.555] lstrlenW (lpString=".qt") returned 3
	[0059.555] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0059.555] lstrlenW (lpString=".r3d") returned 4
	[0059.555] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0059.555] lstrlenW (lpString=".raf") returned 4
	[0059.555] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0059.555] lstrlenW (lpString=".rar") returned 4
	[0059.555] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0059.555] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0059.555] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0059.555] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0060.141] FindClose (in: hFindFile=0x6f41e8 | out: hFindFile=0x6f41e8) returned 1
	[0060.141] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.141] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1
	[0060.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038") returned 26
	[0060.142] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1038") returned 1
	[0060.142] lstrlenW (lpString="1038") returned 4
	[0060.142] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1038") returned 1
	[0060.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0060.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038") returned 26
	[0060.142] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd9a433e3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f4468
	[0060.143] FindNextFileW (in: hFindFile=0x6f4468, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd9a433e3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.143] FindNextFileW (in: hFindFile=0x6f4468, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd99d0df5, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd99d0df5, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a1d1bf, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0060.143] lstrlenW (lpString="eula.rtf.id-B4197730.[admin@stex777.com].money") returned 46
	[0060.143] lstrlenW (lpString=".1cd") returned 4
	[0060.143] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0060.143] lstrlenW (lpString=".3ds") returned 4
	[0060.143] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0060.143] lstrlenW (lpString=".3fr") returned 4
	[0060.143] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0060.143] lstrlenW (lpString=".3g2") returned 4
	[0060.143] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0060.143] lstrlenW (lpString=".3gp") returned 4
	[0060.143] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0060.143] lstrlenW (lpString=".7z") returned 3
	[0060.143] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0060.143] lstrlenW (lpString=".accda") returned 6
	[0060.143] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0060.143] lstrlenW (lpString=".accdb") returned 6
	[0060.143] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0060.143] lstrlenW (lpString=".accdc") returned 6
	[0060.143] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0060.143] lstrlenW (lpString=".accde") returned 6
	[0060.144] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0060.144] lstrlenW (lpString=".accdt") returned 6
	[0060.144] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0060.144] lstrlenW (lpString=".accdw") returned 6
	[0060.144] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0060.144] lstrlenW (lpString=".adb") returned 4
	[0060.144] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0060.144] lstrlenW (lpString=".adp") returned 4
	[0060.144] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0060.144] lstrlenW (lpString=".ai") returned 3
	[0060.144] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0060.144] lstrlenW (lpString=".ai3") returned 4
	[0060.144] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0060.144] lstrlenW (lpString=".ai4") returned 4
	[0060.144] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0060.144] lstrlenW (lpString=".ai5") returned 4
	[0060.144] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0060.144] lstrlenW (lpString=".ai6") returned 4
	[0060.144] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0060.144] lstrlenW (lpString=".ai7") returned 4
	[0060.144] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0060.144] lstrlenW (lpString=".ai8") returned 4
	[0060.144] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0060.144] lstrlenW (lpString=".anim") returned 5
	[0060.144] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0060.144] lstrlenW (lpString=".arw") returned 4
	[0060.144] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0060.144] lstrlenW (lpString=".as") returned 3
	[0060.144] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0060.144] lstrlenW (lpString=".asa") returned 4
	[0060.144] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0060.145] lstrlenW (lpString=".asc") returned 4
	[0060.145] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0060.145] lstrlenW (lpString=".ascx") returned 5
	[0060.145] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0060.145] lstrlenW (lpString=".asm") returned 4
	[0060.145] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0060.145] lstrlenW (lpString=".asmx") returned 5
	[0060.145] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0060.145] lstrlenW (lpString=".asp") returned 4
	[0060.145] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0060.145] lstrlenW (lpString=".aspx") returned 5
	[0060.145] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0060.145] lstrlenW (lpString=".asr") returned 4
	[0060.145] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0060.145] lstrlenW (lpString=".asx") returned 4
	[0060.145] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0060.145] lstrlenW (lpString=".avi") returned 4
	[0060.145] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0060.145] lstrlenW (lpString=".avs") returned 4
	[0060.145] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0060.145] lstrlenW (lpString=".backup") returned 7
	[0060.145] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0060.145] lstrlenW (lpString=".bak") returned 4
	[0060.145] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0060.145] lstrlenW (lpString=".bay") returned 4
	[0060.145] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0060.145] lstrlenW (lpString=".bd") returned 3
	[0060.145] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0060.145] lstrlenW (lpString=".bin") returned 4
	[0060.145] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0060.145] lstrlenW (lpString=".bmp") returned 4
	[0060.145] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0060.146] lstrlenW (lpString=".bz2") returned 4
	[0060.146] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0060.146] lstrlenW (lpString=".c") returned 2
	[0060.146] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0060.146] lstrlenW (lpString=".cdr") returned 4
	[0060.146] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0060.146] lstrlenW (lpString=".cer") returned 4
	[0060.146] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0060.146] lstrlenW (lpString=".cf") returned 3
	[0060.146] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0060.146] lstrlenW (lpString=".cfc") returned 4
	[0060.146] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0060.146] lstrlenW (lpString=".cfm") returned 4
	[0060.146] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0060.146] lstrlenW (lpString=".cfml") returned 5
	[0060.146] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0060.146] lstrlenW (lpString=".cfu") returned 4
	[0060.146] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0060.146] lstrlenW (lpString=".chm") returned 4
	[0060.146] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0060.146] lstrlenW (lpString=".cin") returned 4
	[0060.146] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0060.146] lstrlenW (lpString=".class") returned 6
	[0060.146] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0060.146] lstrlenW (lpString=".clx") returned 4
	[0060.146] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0060.146] lstrlenW (lpString=".config") returned 7
	[0060.146] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0060.146] lstrlenW (lpString=".cpp") returned 4
	[0060.146] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0060.146] lstrlenW (lpString=".cr2") returned 4
	[0060.146] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".crt") returned 4
	[0060.147] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".crw") returned 4
	[0060.147] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".cs") returned 3
	[0060.147] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0060.147] lstrlenW (lpString=".css") returned 4
	[0060.147] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".csv") returned 4
	[0060.147] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".cub") returned 4
	[0060.147] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".dae") returned 4
	[0060.147] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".dat") returned 4
	[0060.147] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".db") returned 3
	[0060.147] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0060.147] lstrlenW (lpString=".dbf") returned 4
	[0060.147] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".dbx") returned 4
	[0060.147] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".dc3") returned 4
	[0060.147] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".dcm") returned 4
	[0060.147] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".dcr") returned 4
	[0060.147] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0060.147] lstrlenW (lpString=".der") returned 4
	[0060.147] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0060.148] lstrlenW (lpString=".dib") returned 4
	[0060.148] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0060.148] lstrlenW (lpString=".dic") returned 4
	[0060.148] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0060.148] lstrlenW (lpString=".dif") returned 4
	[0060.148] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0060.148] lstrlenW (lpString=".divx") returned 5
	[0060.148] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0060.148] lstrlenW (lpString=".djvu") returned 5
	[0060.148] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0060.148] lstrlenW (lpString=".dng") returned 4
	[0060.148] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0060.148] lstrlenW (lpString=".doc") returned 4
	[0060.148] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0060.148] lstrlenW (lpString=".docm") returned 5
	[0060.148] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0060.148] lstrlenW (lpString=".docx") returned 5
	[0060.148] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0060.148] lstrlenW (lpString=".dot") returned 4
	[0060.148] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0060.148] lstrlenW (lpString=".dotm") returned 5
	[0060.148] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0060.148] lstrlenW (lpString=".dotx") returned 5
	[0060.148] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0060.148] lstrlenW (lpString=".dpx") returned 4
	[0060.148] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0060.148] lstrlenW (lpString=".dqy") returned 4
	[0060.148] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0060.148] lstrlenW (lpString=".dsn") returned 4
	[0060.148] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0060.148] lstrlenW (lpString=".dt") returned 3
	[0060.149] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0060.149] lstrlenW (lpString=".dtd") returned 4
	[0060.149] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0060.149] lstrlenW (lpString=".dwg") returned 4
	[0060.149] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0060.149] lstrlenW (lpString=".dwt") returned 4
	[0060.149] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0060.149] lstrlenW (lpString=".dx") returned 3
	[0060.149] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0060.149] lstrlenW (lpString=".dxf") returned 4
	[0060.149] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0060.149] lstrlenW (lpString=".edml") returned 5
	[0060.149] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0060.149] lstrlenW (lpString=".efd") returned 4
	[0060.149] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0060.149] lstrlenW (lpString=".elf") returned 4
	[0060.149] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0060.149] lstrlenW (lpString=".emf") returned 4
	[0060.149] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0060.149] lstrlenW (lpString=".emz") returned 4
	[0060.149] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0060.149] lstrlenW (lpString=".epf") returned 4
	[0060.149] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0060.149] lstrlenW (lpString=".eps") returned 4
	[0060.149] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0060.149] lstrlenW (lpString=".epsf") returned 5
	[0060.149] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0060.149] lstrlenW (lpString=".epsp") returned 5
	[0060.149] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0060.149] lstrlenW (lpString=".erf") returned 4
	[0060.149] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".exr") returned 4
	[0060.150] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".f4v") returned 4
	[0060.150] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".fido") returned 5
	[0060.150] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0060.150] lstrlenW (lpString=".flm") returned 4
	[0060.150] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".flv") returned 4
	[0060.150] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".frm") returned 4
	[0060.150] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".fxg") returned 4
	[0060.150] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".geo") returned 4
	[0060.150] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".gif") returned 4
	[0060.150] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".grs") returned 4
	[0060.150] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".gz") returned 3
	[0060.150] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0060.150] lstrlenW (lpString=".h") returned 2
	[0060.150] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0060.150] lstrlenW (lpString=".hdr") returned 4
	[0060.150] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".hpp") returned 4
	[0060.150] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0060.150] lstrlenW (lpString=".hta") returned 4
	[0060.150] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0060.151] lstrlenW (lpString=".htc") returned 4
	[0060.151] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0060.151] lstrlenW (lpString=".htm") returned 4
	[0060.151] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0060.151] lstrlenW (lpString=".html") returned 5
	[0060.151] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0060.151] lstrlenW (lpString=".icb") returned 4
	[0060.151] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0060.151] lstrlenW (lpString=".ics") returned 4
	[0060.151] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0060.151] lstrlenW (lpString=".iff") returned 4
	[0060.151] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0060.151] lstrlenW (lpString=".inc") returned 4
	[0060.151] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0060.151] lstrlenW (lpString=".indd") returned 5
	[0060.151] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0060.151] lstrlenW (lpString=".ini") returned 4
	[0060.151] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0060.151] lstrlenW (lpString=".iqy") returned 4
	[0060.151] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0060.151] lstrlenW (lpString=".j2c") returned 4
	[0060.151] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0060.151] lstrlenW (lpString=".j2k") returned 4
	[0060.151] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0060.151] lstrlenW (lpString=".java") returned 5
	[0060.151] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0060.151] lstrlenW (lpString=".jp2") returned 4
	[0060.151] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".jpc") returned 4
	[0060.152] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".jpe") returned 4
	[0060.152] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".jpeg") returned 5
	[0060.152] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0060.152] lstrlenW (lpString=".jpf") returned 4
	[0060.152] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".jpg") returned 4
	[0060.152] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".jpx") returned 4
	[0060.152] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".js") returned 3
	[0060.152] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0060.152] lstrlenW (lpString=".jsf") returned 4
	[0060.152] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".json") returned 5
	[0060.152] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0060.152] lstrlenW (lpString=".jsp") returned 4
	[0060.152] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".kdc") returned 4
	[0060.152] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".kmz") returned 4
	[0060.152] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".kwm") returned 4
	[0060.152] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".lasso") returned 6
	[0060.152] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0060.152] lstrlenW (lpString=".lbi") returned 4
	[0060.152] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0060.152] lstrlenW (lpString=".lgf") returned 4
	[0060.152] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".lgp") returned 4
	[0060.153] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".log") returned 4
	[0060.153] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".m1v") returned 4
	[0060.153] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".m4a") returned 4
	[0060.153] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".m4v") returned 4
	[0060.153] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".max") returned 4
	[0060.153] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".md") returned 3
	[0060.153] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0060.153] lstrlenW (lpString=".mda") returned 4
	[0060.153] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".mdb") returned 4
	[0060.153] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".mde") returned 4
	[0060.153] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".mdf") returned 4
	[0060.153] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".mdw") returned 4
	[0060.153] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".mef") returned 4
	[0060.153] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".mft") returned 4
	[0060.153] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".mfw") returned 4
	[0060.153] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0060.153] lstrlenW (lpString=".mht") returned 4
	[0060.153] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".mhtml") returned 6
	[0060.154] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0060.154] lstrlenW (lpString=".mka") returned 4
	[0060.154] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".mkidx") returned 6
	[0060.154] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0060.154] lstrlenW (lpString=".mkv") returned 4
	[0060.154] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".mos") returned 4
	[0060.154] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".mov") returned 4
	[0060.154] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".mp3") returned 4
	[0060.154] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".mp4") returned 4
	[0060.154] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".mpeg") returned 5
	[0060.154] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0060.154] lstrlenW (lpString=".mpg") returned 4
	[0060.154] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".mpv") returned 4
	[0060.154] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".mrw") returned 4
	[0060.154] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".msg") returned 4
	[0060.154] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".mxl") returned 4
	[0060.154] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".myd") returned 4
	[0060.154] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0060.154] lstrlenW (lpString=".myi") returned 4
	[0060.154] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".nef") returned 4
	[0060.155] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".nrw") returned 4
	[0060.155] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".obj") returned 4
	[0060.155] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".odb") returned 4
	[0060.155] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".odc") returned 4
	[0060.155] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".odm") returned 4
	[0060.155] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".odp") returned 4
	[0060.155] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".ods") returned 4
	[0060.155] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".oft") returned 4
	[0060.155] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".one") returned 4
	[0060.155] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".onepkg") returned 7
	[0060.155] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0060.155] lstrlenW (lpString=".onetoc2") returned 8
	[0060.155] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0060.155] lstrlenW (lpString=".opt") returned 4
	[0060.155] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".oqy") returned 4
	[0060.155] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".orf") returned 4
	[0060.155] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0060.155] lstrlenW (lpString=".p12") returned 4
	[0060.156] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".p7b") returned 4
	[0060.156] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".p7c") returned 4
	[0060.156] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pam") returned 4
	[0060.156] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pbm") returned 4
	[0060.156] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pct") returned 4
	[0060.156] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pcx") returned 4
	[0060.156] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pdd") returned 4
	[0060.156] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pdf") returned 4
	[0060.156] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pdp") returned 4
	[0060.156] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pef") returned 4
	[0060.156] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pem") returned 4
	[0060.156] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pff") returned 4
	[0060.156] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pfm") returned 4
	[0060.156] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pfx") returned 4
	[0060.156] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".pgm") returned 4
	[0060.156] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0060.156] lstrlenW (lpString=".php") returned 4
	[0060.157] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0060.157] lstrlenW (lpString=".php3") returned 5
	[0060.157] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0060.157] lstrlenW (lpString=".php4") returned 5
	[0060.157] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0060.157] lstrlenW (lpString=".php5") returned 5
	[0060.157] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0060.157] lstrlenW (lpString=".phtml") returned 6
	[0060.157] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0060.157] lstrlenW (lpString=".pict") returned 5
	[0060.157] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0060.157] lstrlenW (lpString=".pl") returned 3
	[0060.157] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0060.157] lstrlenW (lpString=".pls") returned 4
	[0060.157] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0060.157] lstrlenW (lpString=".pm") returned 3
	[0060.157] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0060.157] lstrlenW (lpString=".png") returned 4
	[0060.157] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0060.157] lstrlenW (lpString=".pnm") returned 4
	[0060.157] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0060.157] lstrlenW (lpString=".pot") returned 4
	[0060.157] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0060.157] lstrlenW (lpString=".potm") returned 5
	[0060.157] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0060.157] lstrlenW (lpString=".potx") returned 5
	[0060.157] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0060.157] lstrlenW (lpString=".ppa") returned 4
	[0060.157] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0060.157] lstrlenW (lpString=".ppam") returned 5
	[0060.158] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0060.158] lstrlenW (lpString=".ppm") returned 4
	[0060.158] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0060.158] lstrlenW (lpString=".pps") returned 4
	[0060.158] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0060.158] lstrlenW (lpString=".ppsm") returned 5
	[0060.158] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0060.158] lstrlenW (lpString=".ppt") returned 4
	[0060.158] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0060.158] lstrlenW (lpString=".pptm") returned 5
	[0060.158] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0060.158] lstrlenW (lpString=".pptx") returned 5
	[0060.158] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0060.158] lstrlenW (lpString=".prn") returned 4
	[0060.158] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0060.158] lstrlenW (lpString=".ps") returned 3
	[0060.158] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0060.158] lstrlenW (lpString=".psb") returned 4
	[0060.158] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0060.158] lstrlenW (lpString=".psd") returned 4
	[0060.158] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0060.158] lstrlenW (lpString=".pst") returned 4
	[0060.158] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0060.158] lstrlenW (lpString=".ptx") returned 4
	[0060.158] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0060.158] lstrlenW (lpString=".pub") returned 4
	[0060.158] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0060.158] lstrlenW (lpString=".pwm") returned 4
	[0060.158] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0060.158] lstrlenW (lpString=".pxr") returned 4
	[0060.158] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0060.159] lstrlenW (lpString=".py") returned 3
	[0060.159] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0060.159] lstrlenW (lpString=".qt") returned 3
	[0060.159] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0060.159] lstrlenW (lpString=".r3d") returned 4
	[0060.159] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0060.159] FindNextFileW (in: hFindFile=0x6f4468, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a1d1bf, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a1d1bf, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a433e3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0060.159] FindNextFileW (in: hFindFile=0x6f4468, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0060.159] FindNextFileW (in: hFindFile=0x6f4468, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0060.159] FindClose (in: hFindFile=0x6f4468 | out: hFindFile=0x6f4468) returned 1
	[0060.159] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.159] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1
	[0060.159] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4210730
	[0060.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040") returned 26
	[0060.159] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd9a8faca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6f45a8
	[0060.160] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd9a8faca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.160] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a433e3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a433e3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a6964c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0060.160] lstrlenW (lpString="eula.rtf.id-B4197730.[admin@stex777.com].money") returned 46
	[0060.160] lstrlenW (lpString=".1cd") returned 4
	[0060.160] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0060.160] lstrlenW (lpString=".3ds") returned 4
	[0060.160] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0060.160] lstrlenW (lpString=".3fr") returned 4
	[0060.160] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0060.160] lstrlenW (lpString=".3g2") returned 4
	[0060.160] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0060.160] lstrlenW (lpString=".3gp") returned 4
	[0060.160] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0060.160] lstrlenW (lpString=".7z") returned 3
	[0060.160] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0060.160] lstrlenW (lpString=".accda") returned 6
	[0060.160] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0060.160] lstrlenW (lpString=".accdb") returned 6
	[0060.160] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0060.160] lstrlenW (lpString=".accdc") returned 6
	[0060.160] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0060.160] lstrlenW (lpString=".accde") returned 6
	[0060.160] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0060.160] lstrlenW (lpString=".accdt") returned 6
	[0060.160] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0060.160] lstrlenW (lpString=".accdw") returned 6
	[0060.161] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0060.161] lstrlenW (lpString=".adb") returned 4
	[0060.161] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0060.161] lstrlenW (lpString=".adp") returned 4
	[0060.161] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0060.161] lstrlenW (lpString=".ai") returned 3
	[0060.161] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0060.161] lstrlenW (lpString=".ai3") returned 4
	[0060.161] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0060.161] lstrlenW (lpString=".ai4") returned 4
	[0060.161] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0060.161] lstrlenW (lpString=".ai5") returned 4
	[0060.161] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0060.161] lstrlenW (lpString=".ai6") returned 4
	[0060.161] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0060.161] lstrlenW (lpString=".ai7") returned 4
	[0060.161] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0060.161] lstrlenW (lpString=".ai8") returned 4
	[0060.161] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0060.161] lstrlenW (lpString=".anim") returned 5
	[0060.161] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0060.161] lstrlenW (lpString=".arw") returned 4
	[0060.161] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0060.161] lstrlenW (lpString=".as") returned 3
	[0060.161] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0060.161] lstrlenW (lpString=".asa") returned 4
	[0060.161] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0060.161] lstrlenW (lpString=".asc") returned 4
	[0060.161] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0060.161] lstrlenW (lpString=".ascx") returned 5
	[0060.161] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0060.162] lstrlenW (lpString=".asm") returned 4
	[0060.162] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0060.162] lstrlenW (lpString=".asmx") returned 5
	[0060.162] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0060.162] lstrlenW (lpString=".asp") returned 4
	[0060.162] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0060.162] lstrlenW (lpString=".aspx") returned 5
	[0060.162] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0060.162] lstrlenW (lpString=".asr") returned 4
	[0060.162] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0060.162] lstrlenW (lpString=".asx") returned 4
	[0060.162] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0060.162] lstrlenW (lpString=".avi") returned 4
	[0060.162] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0060.162] lstrlenW (lpString=".avs") returned 4
	[0060.162] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0060.162] lstrlenW (lpString=".backup") returned 7
	[0060.162] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0060.162] lstrlenW (lpString=".bak") returned 4
	[0060.162] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0060.162] lstrlenW (lpString=".bay") returned 4
	[0060.162] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0060.162] lstrlenW (lpString=".bd") returned 3
	[0060.162] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0060.162] lstrlenW (lpString=".bin") returned 4
	[0060.162] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0060.162] lstrlenW (lpString=".bmp") returned 4
	[0060.162] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0060.162] lstrlenW (lpString=".bz2") returned 4
	[0060.162] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0060.162] lstrlenW (lpString=".c") returned 2
	[0060.162] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0060.162] lstrlenW (lpString=".cdr") returned 4
	[0060.163] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0060.163] lstrlenW (lpString=".cer") returned 4
	[0060.163] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0060.163] lstrlenW (lpString=".cf") returned 3
	[0060.163] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0060.163] lstrlenW (lpString=".cfc") returned 4
	[0060.163] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0060.163] lstrlenW (lpString=".cfm") returned 4
	[0060.163] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0060.163] lstrlenW (lpString=".cfml") returned 5
	[0060.163] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0060.163] lstrlenW (lpString=".cfu") returned 4
	[0060.163] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0060.163] lstrlenW (lpString=".chm") returned 4
	[0060.163] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0060.163] lstrlenW (lpString=".cin") returned 4
	[0060.163] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0060.163] lstrlenW (lpString=".class") returned 6
	[0060.163] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0060.163] lstrlenW (lpString=".clx") returned 4
	[0060.163] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0060.163] lstrlenW (lpString=".config") returned 7
	[0060.163] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0060.163] lstrlenW (lpString=".cpp") returned 4
	[0060.163] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0060.163] lstrlenW (lpString=".cr2") returned 4
	[0060.163] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0060.163] lstrlenW (lpString=".crt") returned 4
	[0060.163] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0060.163] lstrlenW (lpString=".crw") returned 4
	[0060.164] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".cs") returned 3
	[0060.164] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0060.164] lstrlenW (lpString=".css") returned 4
	[0060.164] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".csv") returned 4
	[0060.164] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".cub") returned 4
	[0060.164] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".dae") returned 4
	[0060.164] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".dat") returned 4
	[0060.164] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".db") returned 3
	[0060.164] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0060.164] lstrlenW (lpString=".dbf") returned 4
	[0060.164] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".dbx") returned 4
	[0060.164] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".dc3") returned 4
	[0060.164] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".dcm") returned 4
	[0060.164] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".dcr") returned 4
	[0060.164] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".der") returned 4
	[0060.164] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".dib") returned 4
	[0060.164] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0060.164] lstrlenW (lpString=".dic") returned 4
	[0060.165] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0060.165] lstrlenW (lpString=".dif") returned 4
	[0060.165] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0060.165] lstrlenW (lpString=".divx") returned 5
	[0060.165] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0060.165] lstrlenW (lpString=".djvu") returned 5
	[0060.165] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0060.165] lstrlenW (lpString=".dng") returned 4
	[0060.165] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0060.165] lstrlenW (lpString=".doc") returned 4
	[0060.165] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0060.165] lstrlenW (lpString=".docm") returned 5
	[0060.165] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0060.165] lstrlenW (lpString=".docx") returned 5
	[0060.165] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0060.165] lstrlenW (lpString=".dot") returned 4
	[0060.165] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0060.165] lstrlenW (lpString=".dotm") returned 5
	[0060.165] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0060.165] lstrlenW (lpString=".dotx") returned 5
	[0060.165] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0060.165] lstrlenW (lpString=".dpx") returned 4
	[0060.165] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0060.165] lstrlenW (lpString=".dqy") returned 4
	[0060.165] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0060.165] lstrlenW (lpString=".dsn") returned 4
	[0060.165] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0060.165] lstrlenW (lpString=".dt") returned 3
	[0060.165] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0060.165] lstrlenW (lpString=".dtd") returned 4
	[0060.165] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".dwg") returned 4
	[0060.166] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".dwt") returned 4
	[0060.166] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".dx") returned 3
	[0060.166] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0060.166] lstrlenW (lpString=".dxf") returned 4
	[0060.166] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".edml") returned 5
	[0060.166] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0060.166] lstrlenW (lpString=".efd") returned 4
	[0060.166] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".elf") returned 4
	[0060.166] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".emf") returned 4
	[0060.166] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".emz") returned 4
	[0060.166] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".epf") returned 4
	[0060.166] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".eps") returned 4
	[0060.166] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".epsf") returned 5
	[0060.166] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0060.166] lstrlenW (lpString=".epsp") returned 5
	[0060.166] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0060.166] lstrlenW (lpString=".erf") returned 4
	[0060.166] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".exr") returned 4
	[0060.166] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0060.166] lstrlenW (lpString=".f4v") returned 4
	[0060.166] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0060.167] lstrlenW (lpString=".fido") returned 5
	[0060.167] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0060.167] lstrlenW (lpString=".flm") returned 4
	[0060.167] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0060.167] lstrlenW (lpString=".flv") returned 4
	[0060.167] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0060.167] lstrlenW (lpString=".frm") returned 4
	[0060.167] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0060.527] lstrlenW (lpString=".fxg") returned 4
	[0060.539] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0060.549] lstrlenW (lpString=".geo") returned 4
	[0060.562] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0060.562] lstrlenW (lpString=".gif") returned 4
	[0060.562] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0060.562] lstrlenW (lpString=".grs") returned 4
	[0060.562] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0060.562] lstrlenW (lpString=".gz") returned 3
	[0060.562] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0060.563] lstrlenW (lpString=".h") returned 2
	[0060.563] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0060.563] lstrlenW (lpString=".hdr") returned 4
	[0060.563] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0060.563] lstrlenW (lpString=".hpp") returned 4
	[0060.563] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0060.563] lstrlenW (lpString=".hta") returned 4
	[0060.563] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0060.563] lstrlenW (lpString=".htc") returned 4
	[0060.563] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0060.563] lstrlenW (lpString=".htm") returned 4
	[0060.563] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0060.563] lstrlenW (lpString=".html") returned 5
	[0060.563] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0060.563] lstrlenW (lpString=".icb") returned 4
	[0060.563] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0060.563] lstrlenW (lpString=".ics") returned 4
	[0060.563] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0060.563] lstrlenW (lpString=".iff") returned 4
	[0060.563] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0060.563] lstrlenW (lpString=".inc") returned 4
	[0060.563] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0060.563] lstrlenW (lpString=".indd") returned 5
	[0060.563] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0060.563] lstrlenW (lpString=".ini") returned 4
	[0060.564] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0060.564] lstrlenW (lpString=".iqy") returned 4
	[0060.564] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0060.564] lstrlenW (lpString=".j2c") returned 4
	[0060.564] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0060.564] lstrlenW (lpString=".j2k") returned 4
	[0060.564] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0060.564] lstrlenW (lpString=".java") returned 5
	[0060.564] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0060.564] lstrlenW (lpString=".jp2") returned 4
	[0060.564] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0060.564] lstrlenW (lpString=".jpc") returned 4
	[0060.564] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0060.564] lstrlenW (lpString=".jpe") returned 4
	[0060.564] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0060.564] lstrlenW (lpString=".jpeg") returned 5
	[0060.564] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0060.564] lstrlenW (lpString=".jpf") returned 4
	[0060.564] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0060.564] lstrlenW (lpString=".jpg") returned 4
	[0060.564] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0060.564] lstrlenW (lpString=".jpx") returned 4
	[0060.564] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0060.564] lstrlenW (lpString=".js") returned 3
	[0060.564] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0060.565] lstrlenW (lpString=".jsf") returned 4
	[0060.565] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0060.565] lstrlenW (lpString=".json") returned 5
	[0060.565] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0060.565] lstrlenW (lpString=".jsp") returned 4
	[0060.565] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0060.565] lstrlenW (lpString=".kdc") returned 4
	[0060.565] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0060.565] lstrlenW (lpString=".kmz") returned 4
	[0060.565] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0060.565] lstrlenW (lpString=".kwm") returned 4
	[0060.565] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0060.565] lstrlenW (lpString=".lasso") returned 6
	[0060.565] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0060.565] lstrlenW (lpString=".lbi") returned 4
	[0060.565] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0060.565] lstrlenW (lpString=".lgf") returned 4
	[0060.565] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0060.565] lstrlenW (lpString=".lgp") returned 4
	[0060.565] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0060.565] lstrlenW (lpString=".log") returned 4
	[0060.565] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0060.565] lstrlenW (lpString=".m1v") returned 4
	[0060.565] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0060.565] lstrlenW (lpString=".m4a") returned 4
	[0060.565] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".m4v") returned 4
	[0060.566] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".max") returned 4
	[0060.566] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".md") returned 3
	[0060.566] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0060.566] lstrlenW (lpString=".mda") returned 4
	[0060.566] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".mdb") returned 4
	[0060.566] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".mde") returned 4
	[0060.566] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".mdf") returned 4
	[0060.566] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".mdw") returned 4
	[0060.566] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".mef") returned 4
	[0060.566] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".mft") returned 4
	[0060.566] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".mfw") returned 4
	[0060.566] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".mht") returned 4
	[0060.566] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0060.566] lstrlenW (lpString=".mhtml") returned 6
	[0060.566] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0060.566] lstrlenW (lpString=".mka") returned 4
	[0060.566] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".mkidx") returned 6
	[0060.567] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0060.567] lstrlenW (lpString=".mkv") returned 4
	[0060.567] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".mos") returned 4
	[0060.567] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".mov") returned 4
	[0060.567] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".mp3") returned 4
	[0060.567] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".mp4") returned 4
	[0060.567] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".mpeg") returned 5
	[0060.567] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0060.567] lstrlenW (lpString=".mpg") returned 4
	[0060.567] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".mpv") returned 4
	[0060.567] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".mrw") returned 4
	[0060.567] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".msg") returned 4
	[0060.567] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".mxl") returned 4
	[0060.567] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".myd") returned 4
	[0060.567] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".myi") returned 4
	[0060.567] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0060.567] lstrlenW (lpString=".nef") returned 4
	[0060.568] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0060.568] lstrlenW (lpString=".nrw") returned 4
	[0060.568] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0060.568] lstrlenW (lpString=".obj") returned 4
	[0060.568] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0060.568] lstrlenW (lpString=".odb") returned 4
	[0060.568] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0060.568] lstrlenW (lpString=".odc") returned 4
	[0060.568] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0060.568] lstrlenW (lpString=".odm") returned 4
	[0060.568] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0060.568] lstrlenW (lpString=".odp") returned 4
	[0060.568] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0060.568] lstrlenW (lpString=".ods") returned 4
	[0060.568] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0060.568] lstrlenW (lpString=".oft") returned 4
	[0060.568] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0060.568] lstrlenW (lpString=".one") returned 4
	[0060.568] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0060.568] lstrlenW (lpString=".onepkg") returned 7
	[0060.568] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0060.568] lstrlenW (lpString=".onetoc2") returned 8
	[0060.568] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0060.568] lstrlenW (lpString=".opt") returned 4
	[0060.568] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0060.568] lstrlenW (lpString=".oqy") returned 4
	[0060.569] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".orf") returned 4
	[0060.569] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".p12") returned 4
	[0060.569] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".p7b") returned 4
	[0060.569] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".p7c") returned 4
	[0060.569] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".pam") returned 4
	[0060.569] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".pbm") returned 4
	[0060.569] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".pct") returned 4
	[0060.569] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".pcx") returned 4
	[0060.569] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".pdd") returned 4
	[0060.569] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".pdf") returned 4
	[0060.569] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".pdp") returned 4
	[0060.569] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".pef") returned 4
	[0060.569] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".pem") returned 4
	[0060.569] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".pff") returned 4
	[0060.569] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0060.569] lstrlenW (lpString=".pfm") returned 4
	[0060.570] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0060.570] lstrlenW (lpString=".pfx") returned 4
	[0060.570] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0060.570] lstrlenW (lpString=".pgm") returned 4
	[0060.570] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0060.570] lstrlenW (lpString=".php") returned 4
	[0060.570] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0060.570] lstrlenW (lpString=".php3") returned 5
	[0060.570] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0060.570] lstrlenW (lpString=".php4") returned 5
	[0060.570] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0060.570] lstrlenW (lpString=".php5") returned 5
	[0060.570] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0060.570] lstrlenW (lpString=".phtml") returned 6
	[0060.570] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0060.570] lstrlenW (lpString=".pict") returned 5
	[0060.570] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0060.570] lstrlenW (lpString=".pl") returned 3
	[0060.570] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0060.570] lstrlenW (lpString=".pls") returned 4
	[0060.570] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0060.570] lstrlenW (lpString=".pm") returned 3
	[0060.570] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0060.570] lstrlenW (lpString=".png") returned 4
	[0060.570] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0060.570] lstrlenW (lpString=".pnm") returned 4
	[0060.570] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0060.570] lstrlenW (lpString=".pot") returned 4
	[0060.571] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0060.571] lstrlenW (lpString=".potm") returned 5
	[0060.571] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0060.571] lstrlenW (lpString=".potx") returned 5
	[0060.571] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0060.571] lstrlenW (lpString=".ppa") returned 4
	[0060.571] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0060.571] lstrlenW (lpString=".ppam") returned 5
	[0060.571] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0060.571] lstrlenW (lpString=".ppm") returned 4
	[0060.571] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0060.571] lstrlenW (lpString=".pps") returned 4
	[0060.571] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0060.571] lstrlenW (lpString=".ppsm") returned 5
	[0060.571] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0060.571] lstrlenW (lpString=".ppt") returned 4
	[0060.571] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0060.571] lstrlenW (lpString=".pptm") returned 5
	[0060.571] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0060.571] lstrlenW (lpString=".pptx") returned 5
	[0060.571] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0060.571] lstrlenW (lpString=".prn") returned 4
	[0060.571] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0060.571] lstrlenW (lpString=".ps") returned 3
	[0060.571] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0060.572] lstrlenW (lpString=".psb") returned 4
	[0060.572] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0060.572] lstrlenW (lpString=".psd") returned 4
	[0060.572] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0060.572] lstrlenW (lpString=".pst") returned 4
	[0060.572] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0060.572] lstrlenW (lpString=".ptx") returned 4
	[0060.572] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0060.572] lstrlenW (lpString=".pub") returned 4
	[0060.572] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0060.572] lstrlenW (lpString=".pwm") returned 4
	[0060.572] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0060.572] lstrlenW (lpString=".pxr") returned 4
	[0060.572] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0060.572] lstrlenW (lpString=".py") returned 3
	[0060.572] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0060.572] lstrlenW (lpString=".qt") returned 3
	[0060.572] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0060.572] lstrlenW (lpString=".r3d") returned 4
	[0060.572] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0060.572] lstrlenW (lpString=".raf") returned 4
	[0060.572] lstrcmpiW (lpString1=".raf", lpString2="oney") returned -1
	[0060.572] lstrlenW (lpString=".rar") returned 4
	[0060.572] lstrcmpiW (lpString1=".rar", lpString2="oney") returned -1
	[0060.573] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.573] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1
	[0060.574] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.574] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1
	[0060.574] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.574] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1
	[0060.574] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.574] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1
	[0060.574] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.574] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1
	[0060.575] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.575] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1
	[0060.575] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.575] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1
	[0060.575] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.575] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1
	[0060.576] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.576] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1
	[0060.576] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.576] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1
	[0060.576] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.576] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1
	[0060.576] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.576] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1
	[0060.577] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.577] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1
	[0060.577] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.577] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1
	[0060.577] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0060.577] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0061.044] HeapFree (hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730) 
	[0061.044] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.044] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0061.046] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.046] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1
	[0061.047] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0061.047] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x3d9fcf8 | out: lpFindFileData=0x3d9fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0061.047] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.047] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0061.048] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.048] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0061.048] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.048] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0061.048] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.048] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0061.048] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.048] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0061.049] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.049] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0061.049] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.049] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0061.049] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.049] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0061.049] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.049] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0061.050] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.050] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0061.050] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.050] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0061.052] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.052] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0061.052] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.052] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0061.052] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.052] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0061.052] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.052] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0061.053] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.053] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0061.053] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.053] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0061.053] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.053] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0061.053] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.053] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0061.054] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.054] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0061.054] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.054] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0061.054] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.054] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0061.054] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.054] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0061.055] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.055] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0061.055] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.055] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0061.055] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.055] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0061.055] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.055] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0061.056] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4264578 | out: hHeap=0x600000) returned 1
	[0061.056] FindNextFileW (in: hFindFile=0x6f4428, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0061.056] FindClose (in: hFindFile=0x6f4428 | out: hFindFile=0x6f4428) returned 1
	[0061.056] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.056] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0061.056] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.056] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0061.057] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.057] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0061.057] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.057] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0061.057] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.057] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0061.057] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.057] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0061.066] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.066] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0061.066] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.066] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0061.066] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.066] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0061.066] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.066] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0061.067] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.067] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0061.067] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.067] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0061.067] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x670f30, Size=0x4000) returned 0x3632f98
	[0061.067] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0061.068] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.068] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0061.068] FindClose (in: hFindFile=0x6f4628 | out: hFindFile=0x6f4628) returned 1
	[0061.068] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0061.069] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x3d9fcf8 | out: lpFindFileData=0x3d9fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0061.070] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4264578 | out: hHeap=0x600000) returned 1
	[0061.070] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x3d9fcf8 | out: lpFindFileData=0x3d9fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0061.070] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4264578 | out: hHeap=0x600000) returned 1
	[0061.070] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x3d9fcf8 | out: lpFindFileData=0x3d9fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0061.076] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x3632f98, Size=0x8000) returned 0x3632f98
	[0061.076] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1
	[0061.078] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4264578 | out: hHeap=0x600000) returned 1
	[0061.078] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x3d9fcf8 | out: lpFindFileData=0x3d9fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0061.078] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4264578 | out: hHeap=0x600000) returned 1
	[0061.078] FindNextFileW (in: hFindFile=0x6f4528, lpFindFileData=0x3d9fcf8 | out: lpFindFileData=0x3d9fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbf104a7e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xbf104a7e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0061.079] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.079] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3fd3fe0, ftCreationTime.dwHighDateTime=0x1d57bea, ftLastAccessTime.dwLowDateTime=0xc3ed2370, ftLastAccessTime.dwHighDateTime=0x1d5372a, ftLastWriteTime.dwLowDateTime=0xc3ed2370, ftLastWriteTime.dwHighDateTime=0x1d5372a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="guests production meanwhile.exe", cAlternateFileName="GUESTS~1.EXE")) returned 1
	[0061.081] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.081] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1
	[0061.084] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.084] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0061.084] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.084] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1
	[0061.084] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.084] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0061.084] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.084] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0061.084] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.084] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0061.085] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.085] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0061.085] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.085] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0061.087] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.087] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0061.087] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.087] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0061.087] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.087] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0061.087] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.087] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0061.088] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.088] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0061.088] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.088] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0061.088] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.088] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0061.525] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.535] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1
	[0061.535] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.535] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1
	[0061.535] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.536] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1
	[0061.536] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.536] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1
	[0061.536] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.536] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1
	[0061.536] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.536] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1
	[0061.537] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.537] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1
	[0061.537] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.537] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1
	[0061.537] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.537] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1
	[0061.537] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.537] FindNextFileW (in: hFindFile=0x6f4128, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1
	[0061.538] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.538] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0061.538] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.538] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0061.538] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.538] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0061.538] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.538] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1
	[0061.538] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.539] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1
	[0061.540] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.540] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0061.540] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.540] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0061.540] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.540] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1
	[0061.540] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.540] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0061.540] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.540] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0061.541] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.541] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1
	[0061.541] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.541] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0061.541] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.541] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0061.541] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.542] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0061.542] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.542] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0061.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT") returned 56
	[0061.542] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT") returned 1
	[0061.542] lstrlenW (lpString="pt-PT") returned 5
	[0061.542] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="pt-PT") returned -1
	[0061.542] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x4284588
	[0061.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT") returned 56
	[0061.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6f42a8
	[0061.543] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0061.543] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0061.543] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0061.543] lstrlenW (lpString=".1cd") returned 4
	[0061.543] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0061.543] lstrlenW (lpString=".3ds") returned 4
	[0061.543] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0061.543] lstrlenW (lpString=".3fr") returned 4
	[0061.543] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0061.543] lstrlenW (lpString=".3g2") returned 4
	[0061.543] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0061.543] lstrlenW (lpString=".3gp") returned 4
	[0061.543] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0061.543] lstrlenW (lpString=".7z") returned 3
	[0061.543] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0061.543] lstrlenW (lpString=".accda") returned 6
	[0061.543] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1
	[0061.544] lstrlenW (lpString=".accdb") returned 6
	[0061.544] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1
	[0061.544] lstrlenW (lpString=".accdc") returned 6
	[0061.544] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1
	[0061.544] lstrlenW (lpString=".accde") returned 6
	[0061.544] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1
	[0061.544] lstrlenW (lpString=".accdt") returned 6
	[0061.544] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1
	[0061.544] lstrlenW (lpString=".accdw") returned 6
	[0061.544] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1
	[0061.544] lstrlenW (lpString=".adb") returned 4
	[0061.544] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0061.544] lstrlenW (lpString=".adp") returned 4
	[0061.544] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0061.544] lstrlenW (lpString=".ai") returned 3
	[0061.544] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0061.544] lstrlenW (lpString=".ai3") returned 4
	[0061.544] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0061.544] lstrlenW (lpString=".ai4") returned 4
	[0061.544] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0061.545] lstrlenW (lpString=".ai5") returned 4
	[0061.545] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0061.545] lstrlenW (lpString=".ai6") returned 4
	[0061.545] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0061.545] lstrlenW (lpString=".ai7") returned 4
	[0061.545] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0061.545] lstrlenW (lpString=".ai8") returned 4
	[0061.545] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0061.545] lstrlenW (lpString=".anim") returned 5
	[0061.545] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1
	[0061.545] lstrlenW (lpString=".arw") returned 4
	[0061.545] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0061.545] lstrlenW (lpString=".as") returned 3
	[0061.545] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0061.545] lstrlenW (lpString=".asa") returned 4
	[0061.545] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0061.545] lstrlenW (lpString=".asc") returned 4
	[0061.545] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0061.545] lstrlenW (lpString=".ascx") returned 5
	[0061.545] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1
	[0061.545] lstrlenW (lpString=".asm") returned 4
	[0061.546] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0061.546] lstrlenW (lpString=".asmx") returned 5
	[0061.546] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1
	[0061.546] lstrlenW (lpString=".asp") returned 4
	[0061.546] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0061.546] lstrlenW (lpString=".aspx") returned 5
	[0061.546] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1
	[0061.546] lstrlenW (lpString=".asr") returned 4
	[0061.546] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0061.546] lstrlenW (lpString=".asx") returned 4
	[0061.546] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0061.546] lstrlenW (lpString=".avi") returned 4
	[0061.546] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0061.546] lstrlenW (lpString=".avs") returned 4
	[0061.546] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0061.546] lstrlenW (lpString=".backup") returned 7
	[0061.546] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1
	[0061.546] lstrlenW (lpString=".bak") returned 4
	[0061.546] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0061.546] lstrlenW (lpString=".bay") returned 4
	[0061.546] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0061.546] lstrlenW (lpString=".bd") returned 3
	[0061.547] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0061.547] lstrlenW (lpString=".bin") returned 4
	[0061.547] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0061.547] lstrlenW (lpString=".bmp") returned 4
	[0061.547] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0061.547] lstrlenW (lpString=".bz2") returned 4
	[0061.547] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0061.547] lstrlenW (lpString=".c") returned 2
	[0061.547] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0061.547] lstrlenW (lpString=".cdr") returned 4
	[0061.547] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0061.547] lstrlenW (lpString=".cer") returned 4
	[0061.547] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0061.547] lstrlenW (lpString=".cf") returned 3
	[0061.547] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0061.547] lstrlenW (lpString=".cfc") returned 4
	[0061.547] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0061.547] lstrlenW (lpString=".cfm") returned 4
	[0061.547] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0061.547] lstrlenW (lpString=".cfml") returned 5
	[0061.547] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1
	[0061.548] lstrlenW (lpString=".cfu") returned 4
	[0061.548] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0061.548] lstrlenW (lpString=".chm") returned 4
	[0061.548] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0061.548] lstrlenW (lpString=".cin") returned 4
	[0061.548] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0061.548] lstrlenW (lpString=".class") returned 6
	[0061.548] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1
	[0061.548] lstrlenW (lpString=".clx") returned 4
	[0061.548] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0061.548] lstrlenW (lpString=".config") returned 7
	[0061.548] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1
	[0061.548] lstrlenW (lpString=".cpp") returned 4
	[0061.548] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0061.548] lstrlenW (lpString=".cr2") returned 4
	[0061.548] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0061.548] lstrlenW (lpString=".crt") returned 4
	[0061.548] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0061.548] lstrlenW (lpString=".crw") returned 4
	[0061.548] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0061.548] lstrlenW (lpString=".cs") returned 3
	[0061.549] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0061.549] lstrlenW (lpString=".css") returned 4
	[0061.549] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0061.549] lstrlenW (lpString=".csv") returned 4
	[0061.549] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0061.549] lstrlenW (lpString=".cub") returned 4
	[0061.549] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0061.549] lstrlenW (lpString=".dae") returned 4
	[0061.549] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0061.549] lstrlenW (lpString=".dat") returned 4
	[0061.549] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0061.549] lstrlenW (lpString=".db") returned 3
	[0061.549] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0061.549] lstrlenW (lpString=".dbf") returned 4
	[0061.549] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0061.549] lstrlenW (lpString=".dbx") returned 4
	[0061.549] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0061.549] lstrlenW (lpString=".dc3") returned 4
	[0061.549] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0061.549] lstrlenW (lpString=".dcm") returned 4
	[0061.549] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0061.550] lstrlenW (lpString=".dcr") returned 4
	[0061.550] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0061.550] lstrlenW (lpString=".der") returned 4
	[0061.550] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0061.550] lstrlenW (lpString=".dib") returned 4
	[0061.550] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0061.550] lstrlenW (lpString=".dic") returned 4
	[0061.550] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0061.550] lstrlenW (lpString=".dif") returned 4
	[0061.550] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0061.550] lstrlenW (lpString=".divx") returned 5
	[0061.550] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1
	[0061.550] lstrlenW (lpString=".djvu") returned 5
	[0061.550] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1
	[0061.550] lstrlenW (lpString=".dng") returned 4
	[0061.550] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0061.550] lstrlenW (lpString=".doc") returned 4
	[0061.550] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0061.550] lstrlenW (lpString=".docm") returned 5
	[0061.551] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1
	[0061.551] lstrlenW (lpString=".docx") returned 5
	[0061.551] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0061.551] lstrlenW (lpString=".dot") returned 4
	[0061.551] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0061.551] lstrlenW (lpString=".dotm") returned 5
	[0061.551] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1
	[0061.551] lstrlenW (lpString=".dotx") returned 5
	[0061.551] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1
	[0061.551] lstrlenW (lpString=".dpx") returned 4
	[0061.551] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0061.551] lstrlenW (lpString=".dqy") returned 4
	[0061.551] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0061.551] lstrlenW (lpString=".dsn") returned 4
	[0061.551] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0061.551] lstrlenW (lpString=".dt") returned 3
	[0061.551] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0061.551] lstrlenW (lpString=".dtd") returned 4
	[0061.551] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0061.551] lstrlenW (lpString=".dwg") returned 4
	[0061.551] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0061.551] lstrlenW (lpString=".dwt") returned 4
	[0061.551] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0061.552] lstrlenW (lpString=".dx") returned 3
	[0061.552] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0061.552] lstrlenW (lpString=".dxf") returned 4
	[0061.552] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0061.552] lstrlenW (lpString=".edml") returned 5
	[0061.552] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1
	[0061.552] lstrlenW (lpString=".efd") returned 4
	[0061.552] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0061.552] lstrlenW (lpString=".elf") returned 4
	[0061.552] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0061.552] lstrlenW (lpString=".emf") returned 4
	[0061.552] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0061.552] lstrlenW (lpString=".emz") returned 4
	[0061.552] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0061.552] lstrlenW (lpString=".epf") returned 4
	[0061.552] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0061.552] lstrlenW (lpString=".eps") returned 4
	[0061.552] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0061.552] lstrlenW (lpString=".epsf") returned 5
	[0061.552] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1
	[0061.553] lstrlenW (lpString=".epsp") returned 5
	[0061.553] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1
	[0061.553] lstrlenW (lpString=".erf") returned 4
	[0061.553] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0061.553] lstrlenW (lpString=".exr") returned 4
	[0061.553] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0061.553] lstrlenW (lpString=".f4v") returned 4
	[0061.553] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0061.553] lstrlenW (lpString=".fido") returned 5
	[0061.553] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1
	[0061.553] lstrlenW (lpString=".flm") returned 4
	[0061.553] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0061.553] lstrlenW (lpString=".flv") returned 4
	[0061.553] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0061.553] lstrlenW (lpString=".frm") returned 4
	[0061.553] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0061.553] lstrlenW (lpString=".fxg") returned 4
	[0061.553] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0061.553] lstrlenW (lpString=".geo") returned 4
	[0061.553] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0061.554] lstrlenW (lpString=".gif") returned 4
	[0061.554] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0061.554] lstrlenW (lpString=".grs") returned 4
	[0061.554] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0061.554] lstrlenW (lpString=".gz") returned 3
	[0061.554] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0061.554] lstrlenW (lpString=".h") returned 2
	[0061.554] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0061.554] lstrlenW (lpString=".hdr") returned 4
	[0061.554] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0061.554] lstrlenW (lpString=".hpp") returned 4
	[0061.554] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0061.554] lstrlenW (lpString=".hta") returned 4
	[0061.554] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0061.554] lstrlenW (lpString=".htc") returned 4
	[0061.554] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0061.554] lstrlenW (lpString=".htm") returned 4
	[0061.554] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0061.555] lstrlenW (lpString=".html") returned 5
	[0061.555] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1
	[0061.555] lstrlenW (lpString=".icb") returned 4
	[0061.555] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0061.555] lstrlenW (lpString=".ics") returned 4
	[0061.555] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0061.555] lstrlenW (lpString=".iff") returned 4
	[0061.555] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0061.555] lstrlenW (lpString=".inc") returned 4
	[0061.555] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0061.555] lstrlenW (lpString=".indd") returned 5
	[0061.555] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1
	[0061.555] lstrlenW (lpString=".ini") returned 4
	[0061.555] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0061.555] lstrlenW (lpString=".iqy") returned 4
	[0061.556] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0061.556] lstrlenW (lpString=".j2c") returned 4
	[0061.556] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0061.556] lstrlenW (lpString=".j2k") returned 4
	[0061.556] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0061.556] lstrlenW (lpString=".java") returned 5
	[0061.556] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1
	[0061.556] lstrlenW (lpString=".jp2") returned 4
	[0061.556] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0061.556] lstrlenW (lpString=".jpc") returned 4
	[0061.556] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0061.556] lstrlenW (lpString=".jpe") returned 4
	[0061.556] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0061.556] lstrlenW (lpString=".jpeg") returned 5
	[0061.556] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1
	[0061.556] lstrlenW (lpString=".jpf") returned 4
	[0061.557] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0061.557] lstrlenW (lpString=".jpg") returned 4
	[0061.557] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0061.557] lstrlenW (lpString=".jpx") returned 4
	[0061.557] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0061.557] lstrlenW (lpString=".js") returned 3
	[0061.557] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0061.557] lstrlenW (lpString=".jsf") returned 4
	[0061.557] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0061.557] lstrlenW (lpString=".json") returned 5
	[0061.557] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1
	[0061.557] lstrlenW (lpString=".jsp") returned 4
	[0061.557] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0061.557] lstrlenW (lpString=".kdc") returned 4
	[0061.557] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0061.557] lstrlenW (lpString=".kmz") returned 4
	[0061.557] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0061.557] lstrlenW (lpString=".kwm") returned 4
	[0061.557] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0061.557] lstrlenW (lpString=".lasso") returned 6
	[0061.557] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1
	[0061.558] lstrlenW (lpString=".lbi") returned 4
	[0061.558] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0061.558] lstrlenW (lpString=".lgf") returned 4
	[0061.558] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0061.558] lstrlenW (lpString=".lgp") returned 4
	[0061.558] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0061.558] lstrlenW (lpString=".log") returned 4
	[0061.558] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0061.558] lstrlenW (lpString=".m1v") returned 4
	[0061.558] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0061.558] lstrlenW (lpString=".m4a") returned 4
	[0061.558] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0061.558] lstrlenW (lpString=".m4v") returned 4
	[0061.558] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0061.558] lstrlenW (lpString=".max") returned 4
	[0061.558] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0061.558] lstrlenW (lpString=".md") returned 3
	[0061.558] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0061.558] lstrlenW (lpString=".mda") returned 4
	[0061.559] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0061.559] lstrlenW (lpString=".mdb") returned 4
	[0061.559] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0061.559] lstrlenW (lpString=".mde") returned 4
	[0061.559] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0061.559] lstrlenW (lpString=".mdf") returned 4
	[0061.559] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0061.559] lstrlenW (lpString=".mdw") returned 4
	[0061.559] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0061.559] lstrlenW (lpString=".mef") returned 4
	[0061.559] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0061.559] lstrlenW (lpString=".mft") returned 4
	[0061.559] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0061.559] lstrlenW (lpString=".mfw") returned 4
	[0061.559] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0061.559] lstrlenW (lpString=".mht") returned 4
	[0061.559] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0061.559] lstrlenW (lpString=".mhtml") returned 6
	[0061.559] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1
	[0061.559] lstrlenW (lpString=".mka") returned 4
	[0061.559] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0061.559] lstrlenW (lpString=".mkidx") returned 6
	[0061.560] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1
	[0061.560] lstrlenW (lpString=".mkv") returned 4
	[0061.560] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0061.560] lstrlenW (lpString=".mos") returned 4
	[0061.560] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0061.560] lstrlenW (lpString=".mov") returned 4
	[0061.560] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0061.560] lstrlenW (lpString=".mp3") returned 4
	[0061.560] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0061.560] lstrlenW (lpString=".mp4") returned 4
	[0061.560] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0061.560] lstrlenW (lpString=".mpeg") returned 5
	[0061.560] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1
	[0061.560] lstrlenW (lpString=".mpg") returned 4
	[0061.560] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0061.560] lstrlenW (lpString=".mpv") returned 4
	[0061.560] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0061.560] lstrlenW (lpString=".mrw") returned 4
	[0061.560] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0061.560] lstrlenW (lpString=".msg") returned 4
	[0061.560] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0061.560] lstrlenW (lpString=".mxl") returned 4
	[0061.560] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0061.560] lstrlenW (lpString=".myd") returned 4
	[0061.560] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0061.560] lstrlenW (lpString=".myi") returned 4
	[0061.560] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".nef") returned 4
	[0061.561] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".nrw") returned 4
	[0061.561] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".obj") returned 4
	[0061.561] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".odb") returned 4
	[0061.561] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".odc") returned 4
	[0061.561] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".odm") returned 4
	[0061.561] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".odp") returned 4
	[0061.561] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".ods") returned 4
	[0061.561] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".oft") returned 4
	[0061.561] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".one") returned 4
	[0061.561] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".onepkg") returned 7
	[0061.561] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1
	[0061.561] lstrlenW (lpString=".onetoc2") returned 8
	[0061.561] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1
	[0061.561] lstrlenW (lpString=".opt") returned 4
	[0061.561] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0061.561] lstrlenW (lpString=".oqy") returned 4
	[0061.562] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".orf") returned 4
	[0061.562] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".p12") returned 4
	[0061.562] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".p7b") returned 4
	[0061.562] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".p7c") returned 4
	[0061.562] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".pam") returned 4
	[0061.562] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".pbm") returned 4
	[0061.562] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".pct") returned 4
	[0061.562] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".pcx") returned 4
	[0061.562] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".pdd") returned 4
	[0061.562] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".pdf") returned 4
	[0061.562] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".pdp") returned 4
	[0061.562] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".pef") returned 4
	[0061.562] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0061.562] lstrlenW (lpString=".pem") returned 4
	[0061.562] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0061.563] lstrlenW (lpString=".pff") returned 4
	[0061.563] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0061.563] lstrlenW (lpString=".pfm") returned 4
	[0061.563] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0061.563] lstrlenW (lpString=".pfx") returned 4
	[0061.563] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0061.563] lstrlenW (lpString=".pgm") returned 4
	[0061.563] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0061.563] lstrlenW (lpString=".php") returned 4
	[0061.563] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0061.563] lstrlenW (lpString=".php3") returned 5
	[0061.563] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1
	[0061.563] lstrlenW (lpString=".php4") returned 5
	[0061.563] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1
	[0061.563] lstrlenW (lpString=".php5") returned 5
	[0061.563] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1
	[0061.563] lstrlenW (lpString=".phtml") returned 6
	[0061.563] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1
	[0061.563] lstrlenW (lpString=".pict") returned 5
	[0061.563] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1
	[0061.563] lstrlenW (lpString=".pl") returned 3
	[0061.563] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0061.563] lstrlenW (lpString=".pls") returned 4
	[0061.563] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0061.563] lstrlenW (lpString=".pm") returned 3
	[0061.563] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0061.563] lstrlenW (lpString=".png") returned 4
	[0061.563] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0061.563] lstrlenW (lpString=".pnm") returned 4
	[0061.564] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0061.564] lstrlenW (lpString=".pot") returned 4
	[0061.564] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0061.564] lstrlenW (lpString=".potm") returned 5
	[0061.564] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1
	[0061.564] lstrlenW (lpString=".potx") returned 5
	[0061.564] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1
	[0061.564] lstrlenW (lpString=".ppa") returned 4
	[0061.564] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0061.564] lstrlenW (lpString=".ppam") returned 5
	[0061.564] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1
	[0061.564] lstrlenW (lpString=".ppm") returned 4
	[0061.564] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0061.564] lstrlenW (lpString=".pps") returned 4
	[0061.564] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0061.564] lstrlenW (lpString=".ppsm") returned 5
	[0061.564] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1
	[0061.564] lstrlenW (lpString=".ppt") returned 4
	[0061.564] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0061.564] lstrlenW (lpString=".pptm") returned 5
	[0061.564] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1
	[0061.564] lstrlenW (lpString=".pptx") returned 5
	[0061.564] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1
	[0061.564] lstrlenW (lpString=".prn") returned 4
	[0061.564] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0061.564] lstrlenW (lpString=".ps") returned 3
	[0061.565] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0061.565] lstrlenW (lpString=".psb") returned 4
	[0061.565] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0061.565] lstrlenW (lpString=".psd") returned 4
	[0061.565] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0061.565] lstrlenW (lpString=".pst") returned 4
	[0061.565] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0061.565] lstrlenW (lpString=".ptx") returned 4
	[0061.565] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0061.565] lstrlenW (lpString=".pub") returned 4
	[0061.565] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0061.565] lstrlenW (lpString=".pwm") returned 4
	[0061.565] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0061.565] lstrlenW (lpString=".pxr") returned 4
	[0061.565] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0061.565] lstrlenW (lpString=".py") returned 3
	[0061.565] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0061.565] lstrlenW (lpString=".qt") returned 3
	[0061.565] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0061.565] lstrlenW (lpString=".r3d") returned 4
	[0061.565] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0061.565] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.565] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0061.566] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.566] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1
	[0061.566] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.566] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1
	[0061.566] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.566] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0061.566] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.566] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1
	[0061.566] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.566] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0061.567] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.567] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1
	[0061.567] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.567] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1
	[0061.567] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.567] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0061.567] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.567] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0061.568] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.568] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0061.568] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.568] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0061.568] FindClose (in: hFindFile=0x6f4068 | out: hFindFile=0x6f4068) returned 1
	[0061.568] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.570] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1
	[0061.570] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.570] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1
	[0061.570] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.571] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1
	[0061.572] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.572] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0
	[0061.572] FindClose (in: hFindFile=0x6f4368 | out: hFindFile=0x6f4368) returned 1
	[0061.572] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.572] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0061.573] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.573] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1
	[0061.573] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.573] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0061.619] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.619] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1
	[0061.619] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.620] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0061.620] FindClose (in: hFindFile=0x6f44e8 | out: hFindFile=0x6f44e8) returned 1
	[0061.620] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.620] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1
	[0061.620] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.620] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0061.620] FindClose (in: hFindFile=0x6f46a8 | out: hFindFile=0x6f46a8) returned 1
	[0061.620] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.620] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1
	[0061.621] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.621] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1
	[0061.621] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.621] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1
	[0061.622] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.622] FindNextFileW (in: hFindFile=0x6f4628, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1
	[0061.622] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.622] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1
	[0061.622] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.624] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0
	[0061.624] FindClose (in: hFindFile=0x6f3fa8 | out: hFindFile=0x6f3fa8) returned 1
	[0061.624] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.625] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522e8750, ftCreationTime.dwHighDateTime=0x1d5187c, ftLastAccessTime.dwLowDateTime=0xfff26e00, ftLastAccessTime.dwHighDateTime=0x1d53317, ftLastWriteTime.dwLowDateTime=0xfff26e00, ftLastWriteTime.dwHighDateTime=0x1d53317, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="screensaver.exe", cAlternateFileName="SCREEN~1.EXE")) returned 1
	[0061.625] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.625] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0061.625] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.625] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1
	[0061.626] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.626] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1
	[0061.626] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.626] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1
	[0061.627] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.627] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1
	[0061.627] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.627] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1
	[0061.627] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0061.627] FindNextFileW (in: hFindFile=0x6f41e8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1
	[0061.628] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0061.628] FindNextFileW (in: hFindFile=0x6f45a8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1
	[0061.628] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.628] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0
	[0061.628] FindClose (in: hFindFile=0x6f41a8 | out: hFindFile=0x6f41a8) returned 1
	[0061.628] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0061.630] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0061.630] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.630] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1
	[0061.634] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.634] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5ba10, ftCreationTime.dwHighDateTime=0x1d509b6, ftLastAccessTime.dwLowDateTime=0xa8f1d660, ftLastAccessTime.dwHighDateTime=0x1d50d4a, ftLastWriteTime.dwLowDateTime=0xa8f1d660, ftLastWriteTime.dwHighDateTime=0x1d50d4a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="percentage.exe", cAlternateFileName="PERCEN~1.EXE")) returned 1
	[0061.635] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0061.635] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0061.635] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0061.635] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1
	[0061.937] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.937] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1
	[0061.939] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0061.939] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1
	[0061.942] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.942] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1
	[0061.943] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0061.943] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1
	[0061.947] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.947] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1
	[0061.949] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.949] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1
	[0061.951] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.951] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1
	[0061.954] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.954] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1
	[0061.957] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.957] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1
	[0061.962] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.962] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1
	[0061.966] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42c65a8 | out: hHeap=0x600000) returned 1
	[0061.966] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0
	[0061.966] FindClose (in: hFindFile=0x6f46a8 | out: hFindFile=0x6f46a8) returned 1
	[0061.967] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.968] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1
	[0061.970] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0061.971] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1
	[0062.685] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0062.685] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1
	[0062.689] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42b4598 | out: hHeap=0x600000) returned 1
	[0062.689] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1
	[0062.689] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4223d50 | out: hHeap=0x600000) returned 1
	[0062.689] FindNextFileW (in: hFindFile=0x6f44e8, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0062.690] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4210730 | out: hHeap=0x600000) returned 1
	[0062.690] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0
	[0062.690] FindClose (in: hFindFile=0x6f43e8 | out: hFindFile=0x6f43e8) returned 1
	[0062.690] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0062.694] FindNextFileW (in: hFindFile=0x6f3f68, lpFindFileData=0x3d9fa7c | out: lpFindFileData=0x3d9fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9dfb986, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1
	[0062.695] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42b4598 | out: hHeap=0x600000) returned 1
	[0062.695] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1
	[0062.700] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x42b4598 | out: hHeap=0x600000) returned 1
	[0062.700] FindNextFileW (in: hFindFile=0x6f46a8, lpFindFileData=0x3d9f800 | out: lpFindFileData=0x3d9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0062.703] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d60 | out: hHeap=0x600000) returned 1
	[0062.703] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1
	[0064.186] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0064.186] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0064.188] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0064.188] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0
	[0064.188] FindClose (in: hFindFile=0x6f42a8 | out: hFindFile=0x6f42a8) returned 1
	[0064.188] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0064.188] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0
	[0064.188] FindClose (in: hFindFile=0x6f41a8 | out: hFindFile=0x6f41a8) returned 1
	[0064.188] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d60 | out: hHeap=0x600000) returned 1
	[0064.189] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1
	[0064.193] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d60 | out: hHeap=0x600000) returned 1
	[0064.193] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1
	[0064.195] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d60 | out: hHeap=0x600000) returned 1
	[0064.195] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1
	[0064.197] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d60 | out: hHeap=0x600000) returned 1
	[0064.197] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1
	[0064.197] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0064.198] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1
	[0064.200] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0064.200] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1
	[0064.202] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0064.202] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0064.617] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0064.618] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1
	[0065.885] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0065.886] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1
	[0065.886] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0065.886] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1
	[0065.888] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0065.888] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0065.889] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0065.889] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0065.889] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0065.889] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1
	[0065.891] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4274580 | out: hHeap=0x600000) returned 1
	[0065.891] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0
	[0065.891] FindClose (in: hFindFile=0x6f3fa8 | out: hFindFile=0x6f3fa8) returned 1
	[0065.891] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4200728 | out: hHeap=0x600000) returned 1
	[0065.892] FindNextFileW (in: hFindFile=0x6f4168, lpFindFileData=0x3d9f584 | out: lpFindFileData=0x3d9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1
	[0066.103] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0066.103] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1
	[0066.106] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0066.106] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1
	[0066.138] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0066.139] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1
	[0066.151] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0066.152] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1
	[0066.155] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0066.155] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1
	[0066.179] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0066.181] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1
	[0066.185] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0066.185] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1
	[0066.185] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0066.185] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1
	[0066.185] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0066.185] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1
	[0066.630] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0066.630] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1
	[0066.633] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.633] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1
	[0066.636] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.636] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1
	[0066.638] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.638] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1
	[0066.640] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.640] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1
	[0066.648] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.648] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1
	[0066.649] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.649] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1
	[0066.652] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.652] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1
	[0066.654] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.654] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1
	[0066.656] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.656] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1
	[0066.663] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.663] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1
	[0066.665] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.665] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1
	[0066.674] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0066.675] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1
	[0067.123] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.123] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1
	[0067.124] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.124] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1
	[0067.126] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.126] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1
	[0067.127] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.127] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1
	[0067.134] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.135] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1
	[0067.138] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.138] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1
	[0067.140] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.141] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1
	[0067.142] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.142] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1
	[0067.162] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.162] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1
	[0067.164] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.164] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1
	[0067.165] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.165] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1
	[0067.167] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.167] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1
	[0067.170] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.170] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1
	[0067.171] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.171] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1
	[0067.173] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.173] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1
	[0067.175] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.175] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0067.175] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.175] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1
	[0067.179] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.179] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1
	[0067.181] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.181] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1
	[0067.183] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.183] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1
	[0067.683] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.683] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1
	[0067.685] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.685] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1
	[0067.692] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.692] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1
	[0067.694] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.694] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0067.702] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.702] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1
	[0067.703] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.703] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1
	[0067.705] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.705] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1
	[0067.707] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.707] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1
	[0067.727] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.727] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1
	[0067.729] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.729] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1
	[0067.730] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.730] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1
	[0067.732] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0067.732] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0
	[0067.732] FindClose (in: hFindFile=0x6f43e8 | out: hFindFile=0x6f43e8) returned 1
	[0067.732] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0067.732] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0
	[0067.732] FindClose (in: hFindFile=0x6f3fa8 | out: hFindFile=0x6f3fa8) returned 1
	[0067.732] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0067.734] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1
	[0067.737] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0067.737] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1
	[0067.740] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0067.740] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0067.742] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0067.742] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1
	[0067.743] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0067.743] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0067.745] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0067.745] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0067.746] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0067.746] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0067.747] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0067.747] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0067.749] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0067.749] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0068.232] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.232] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0068.235] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.235] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0068.237] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.237] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0068.240] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.240] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0068.241] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.242] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1
	[0068.245] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.245] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0068.247] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.247] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0068.249] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.249] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0068.250] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.251] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0068.253] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.253] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0068.254] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.254] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0068.256] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.256] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0068.258] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.258] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1
	[0068.259] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.259] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0068.261] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.261] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0068.263] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.263] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0068.264] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.264] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0068.267] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.268] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0068.668] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.668] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0068.670] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.670] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0068.671] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.671] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1
	[0068.673] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.673] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0068.675] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.675] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0068.676] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.676] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0068.678] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.678] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0068.680] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.680] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0068.681] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.681] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1
	[0068.683] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.683] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1
	[0068.685] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.685] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0068.686] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.686] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0068.688] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.688] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0068.690] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.690] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0068.691] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.691] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0068.693] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.693] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0068.695] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.695] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1
	[0068.696] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.696] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1
	[0068.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT") returned 85
	[0068.697] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT") returned 1
	[0068.697] lstrlenW (lpString="zh-CHT") returned 6
	[0068.697] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-CHT") returned -1
	[0068.697] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x43845d0
	[0068.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT") returned 85
	[0068.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\*", lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6f42a8
	[0068.698] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0068.698] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164d461d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc1040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1
	[0068.698] lstrlenW (lpString="AdHocReportingExcelClient.dll") returned 29
	[0068.698] lstrlenW (lpString=".1cd") returned 4
	[0068.698] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0068.698] lstrlenW (lpString=".3ds") returned 4
	[0068.698] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0068.698] lstrlenW (lpString=".3fr") returned 4
	[0068.698] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0068.698] lstrlenW (lpString=".3g2") returned 4
	[0068.698] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0068.699] lstrlenW (lpString=".3gp") returned 4
	[0068.699] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0068.699] lstrlenW (lpString=".7z") returned 3
	[0068.699] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0068.699] lstrlenW (lpString=".accda") returned 6
	[0068.699] lstrcmpiW (lpString1=".accda", lpString2="nt.dll") returned -1
	[0068.699] lstrlenW (lpString=".accdb") returned 6
	[0068.699] lstrcmpiW (lpString1=".accdb", lpString2="nt.dll") returned -1
	[0068.699] lstrlenW (lpString=".accdc") returned 6
	[0068.699] lstrcmpiW (lpString1=".accdc", lpString2="nt.dll") returned -1
	[0068.699] lstrlenW (lpString=".accde") returned 6
	[0068.699] lstrcmpiW (lpString1=".accde", lpString2="nt.dll") returned -1
	[0068.699] lstrlenW (lpString=".accdt") returned 6
	[0068.699] lstrcmpiW (lpString1=".accdt", lpString2="nt.dll") returned -1
	[0068.699] lstrlenW (lpString=".accdw") returned 6
	[0068.699] lstrcmpiW (lpString1=".accdw", lpString2="nt.dll") returned -1
	[0068.699] lstrlenW (lpString=".adb") returned 4
	[0068.699] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0068.699] lstrlenW (lpString=".adp") returned 4
	[0068.699] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0068.699] lstrlenW (lpString=".ai") returned 3
	[0068.699] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0068.699] lstrlenW (lpString=".ai3") returned 4
	[0068.699] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0068.699] lstrlenW (lpString=".ai4") returned 4
	[0068.699] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0068.699] lstrlenW (lpString=".ai5") returned 4
	[0068.699] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0068.700] lstrlenW (lpString=".ai6") returned 4
	[0068.700] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0068.700] lstrlenW (lpString=".ai7") returned 4
	[0068.700] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0068.700] lstrlenW (lpString=".ai8") returned 4
	[0068.700] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0068.700] lstrlenW (lpString=".anim") returned 5
	[0068.700] lstrcmpiW (lpString1=".anim", lpString2="t.dll") returned -1
	[0068.700] lstrlenW (lpString=".arw") returned 4
	[0068.700] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0068.700] lstrlenW (lpString=".as") returned 3
	[0068.700] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0068.700] lstrlenW (lpString=".asa") returned 4
	[0068.700] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0068.700] lstrlenW (lpString=".asc") returned 4
	[0068.700] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0068.700] lstrlenW (lpString=".ascx") returned 5
	[0068.700] lstrcmpiW (lpString1=".ascx", lpString2="t.dll") returned -1
	[0068.700] lstrlenW (lpString=".asm") returned 4
	[0068.700] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0068.700] lstrlenW (lpString=".asmx") returned 5
	[0068.700] lstrcmpiW (lpString1=".asmx", lpString2="t.dll") returned -1
	[0068.700] lstrlenW (lpString=".asp") returned 4
	[0068.700] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0068.700] lstrlenW (lpString=".aspx") returned 5
	[0068.700] lstrcmpiW (lpString1=".aspx", lpString2="t.dll") returned -1
	[0068.700] lstrlenW (lpString=".asr") returned 4
	[0068.700] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0068.700] lstrlenW (lpString=".asx") returned 4
	[0068.700] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0068.700] lstrlenW (lpString=".avi") returned 4
	[0068.701] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0068.701] lstrlenW (lpString=".avs") returned 4
	[0068.701] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0068.701] lstrlenW (lpString=".backup") returned 7
	[0068.701] lstrcmpiW (lpString1=".backup", lpString2="ent.dll") returned -1
	[0068.701] lstrlenW (lpString=".bak") returned 4
	[0068.701] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0068.701] lstrlenW (lpString=".bay") returned 4
	[0068.701] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0068.701] lstrlenW (lpString=".bd") returned 3
	[0068.701] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0068.701] lstrlenW (lpString=".bin") returned 4
	[0068.701] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0068.701] lstrlenW (lpString=".bmp") returned 4
	[0068.701] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0068.701] lstrlenW (lpString=".bz2") returned 4
	[0068.701] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0068.701] lstrlenW (lpString=".c") returned 2
	[0068.701] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0068.701] lstrlenW (lpString=".cdr") returned 4
	[0068.701] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0068.701] lstrlenW (lpString=".cer") returned 4
	[0068.701] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0068.701] lstrlenW (lpString=".cf") returned 3
	[0068.701] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0068.701] lstrlenW (lpString=".cfc") returned 4
	[0068.701] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0068.702] lstrlenW (lpString=".cfm") returned 4
	[0068.702] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0068.702] lstrlenW (lpString=".cfml") returned 5
	[0068.702] lstrcmpiW (lpString1=".cfml", lpString2="t.dll") returned -1
	[0068.702] lstrlenW (lpString=".cfu") returned 4
	[0068.702] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0068.702] lstrlenW (lpString=".chm") returned 4
	[0068.702] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0068.702] lstrlenW (lpString=".cin") returned 4
	[0068.702] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0068.702] lstrlenW (lpString=".class") returned 6
	[0068.702] lstrcmpiW (lpString1=".class", lpString2="nt.dll") returned -1
	[0068.702] lstrlenW (lpString=".clx") returned 4
	[0068.702] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0068.702] lstrlenW (lpString=".config") returned 7
	[0068.702] lstrcmpiW (lpString1=".config", lpString2="ent.dll") returned -1
	[0068.702] lstrlenW (lpString=".cpp") returned 4
	[0068.702] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0068.702] lstrlenW (lpString=".cr2") returned 4
	[0068.702] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0068.702] lstrlenW (lpString=".crt") returned 4
	[0068.702] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0068.702] lstrlenW (lpString=".crw") returned 4
	[0068.702] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0068.702] lstrlenW (lpString=".cs") returned 3
	[0068.702] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0068.702] lstrlenW (lpString=".css") returned 4
	[0068.703] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".csv") returned 4
	[0068.703] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".cub") returned 4
	[0068.703] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".dae") returned 4
	[0068.703] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".dat") returned 4
	[0068.703] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".db") returned 3
	[0068.703] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0068.703] lstrlenW (lpString=".dbf") returned 4
	[0068.703] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".dbx") returned 4
	[0068.703] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".dc3") returned 4
	[0068.703] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".dcm") returned 4
	[0068.703] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".dcr") returned 4
	[0068.703] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".der") returned 4
	[0068.703] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".dib") returned 4
	[0068.703] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0068.703] lstrlenW (lpString=".dic") returned 4
	[0068.703] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0068.704] lstrlenW (lpString=".dif") returned 4
	[0068.704] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0068.704] lstrlenW (lpString=".divx") returned 5
	[0068.704] lstrcmpiW (lpString1=".divx", lpString2="t.dll") returned -1
	[0068.704] lstrlenW (lpString=".djvu") returned 5
	[0068.704] lstrcmpiW (lpString1=".djvu", lpString2="t.dll") returned -1
	[0068.704] lstrlenW (lpString=".dng") returned 4
	[0068.704] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0068.704] lstrlenW (lpString=".doc") returned 4
	[0068.704] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0068.704] lstrlenW (lpString=".docm") returned 5
	[0068.704] lstrcmpiW (lpString1=".docm", lpString2="t.dll") returned -1
	[0068.704] lstrlenW (lpString=".docx") returned 5
	[0068.704] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0068.704] lstrlenW (lpString=".dot") returned 4
	[0068.704] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0068.704] lstrlenW (lpString=".dotm") returned 5
	[0068.704] lstrcmpiW (lpString1=".dotm", lpString2="t.dll") returned -1
	[0068.704] lstrlenW (lpString=".dotx") returned 5
	[0068.704] lstrcmpiW (lpString1=".dotx", lpString2="t.dll") returned -1
	[0068.704] lstrlenW (lpString=".dpx") returned 4
	[0068.704] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0068.704] lstrlenW (lpString=".dqy") returned 4
	[0068.704] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0068.704] lstrlenW (lpString=".dsn") returned 4
	[0068.704] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0068.704] lstrlenW (lpString=".dt") returned 3
	[0068.704] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0068.704] lstrlenW (lpString=".dtd") returned 4
	[0068.704] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0068.704] lstrlenW (lpString=".dwg") returned 4
	[0068.705] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0068.705] lstrlenW (lpString=".dwt") returned 4
	[0068.705] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0068.705] lstrlenW (lpString=".dx") returned 3
	[0068.705] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0068.705] lstrlenW (lpString=".dxf") returned 4
	[0068.705] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0068.705] lstrlenW (lpString=".edml") returned 5
	[0068.705] lstrcmpiW (lpString1=".edml", lpString2="t.dll") returned -1
	[0068.705] lstrlenW (lpString=".efd") returned 4
	[0068.705] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0068.705] lstrlenW (lpString=".elf") returned 4
	[0068.705] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0068.705] lstrlenW (lpString=".emf") returned 4
	[0068.705] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0068.705] lstrlenW (lpString=".emz") returned 4
	[0068.705] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0068.705] lstrlenW (lpString=".epf") returned 4
	[0068.705] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0068.705] lstrlenW (lpString=".eps") returned 4
	[0068.705] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0068.705] lstrlenW (lpString=".epsf") returned 5
	[0068.705] lstrcmpiW (lpString1=".epsf", lpString2="t.dll") returned -1
	[0068.705] lstrlenW (lpString=".epsp") returned 5
	[0068.705] lstrcmpiW (lpString1=".epsp", lpString2="t.dll") returned -1
	[0068.705] lstrlenW (lpString=".erf") returned 4
	[0068.706] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0068.706] lstrlenW (lpString=".exr") returned 4
	[0068.706] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0068.706] lstrlenW (lpString=".f4v") returned 4
	[0068.706] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0068.706] lstrlenW (lpString=".fido") returned 5
	[0068.706] lstrcmpiW (lpString1=".fido", lpString2="t.dll") returned -1
	[0068.706] lstrlenW (lpString=".flm") returned 4
	[0068.706] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0068.706] lstrlenW (lpString=".flv") returned 4
	[0068.706] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0068.706] lstrlenW (lpString=".frm") returned 4
	[0068.706] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0068.706] lstrlenW (lpString=".fxg") returned 4
	[0068.706] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0068.706] lstrlenW (lpString=".geo") returned 4
	[0068.706] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0068.706] lstrlenW (lpString=".gif") returned 4
	[0068.706] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0068.706] lstrlenW (lpString=".grs") returned 4
	[0068.706] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0068.706] lstrlenW (lpString=".gz") returned 3
	[0068.706] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0068.706] lstrlenW (lpString=".h") returned 2
	[0068.706] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0068.706] lstrlenW (lpString=".hdr") returned 4
	[0068.706] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0068.707] lstrlenW (lpString=".hpp") returned 4
	[0068.707] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0068.707] lstrlenW (lpString=".hta") returned 4
	[0068.707] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0068.707] lstrlenW (lpString=".htc") returned 4
	[0068.707] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0068.707] lstrlenW (lpString=".htm") returned 4
	[0068.707] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0068.707] lstrlenW (lpString=".html") returned 5
	[0068.707] lstrcmpiW (lpString1=".html", lpString2="t.dll") returned -1
	[0068.707] lstrlenW (lpString=".icb") returned 4
	[0068.707] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0068.707] lstrlenW (lpString=".ics") returned 4
	[0068.707] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0068.707] lstrlenW (lpString=".iff") returned 4
	[0068.707] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0068.707] lstrlenW (lpString=".inc") returned 4
	[0068.707] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0068.707] lstrlenW (lpString=".indd") returned 5
	[0068.707] lstrcmpiW (lpString1=".indd", lpString2="t.dll") returned -1
	[0068.707] lstrlenW (lpString=".ini") returned 4
	[0068.707] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0068.707] lstrlenW (lpString=".iqy") returned 4
	[0068.707] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0068.707] lstrlenW (lpString=".j2c") returned 4
	[0068.708] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0068.708] lstrlenW (lpString=".j2k") returned 4
	[0068.708] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0068.708] lstrlenW (lpString=".java") returned 5
	[0068.708] lstrcmpiW (lpString1=".java", lpString2="t.dll") returned -1
	[0068.708] lstrlenW (lpString=".jp2") returned 4
	[0068.708] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0068.708] lstrlenW (lpString=".jpc") returned 4
	[0068.708] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0068.708] lstrlenW (lpString=".jpe") returned 4
	[0068.708] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0068.708] lstrlenW (lpString=".jpeg") returned 5
	[0068.708] lstrcmpiW (lpString1=".jpeg", lpString2="t.dll") returned -1
	[0068.708] lstrlenW (lpString=".jpf") returned 4
	[0068.708] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0068.708] lstrlenW (lpString=".jpg") returned 4
	[0068.708] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0068.708] lstrlenW (lpString=".jpx") returned 4
	[0068.708] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0068.708] lstrlenW (lpString=".js") returned 3
	[0068.708] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0068.708] lstrlenW (lpString=".jsf") returned 4
	[0068.708] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0068.708] lstrlenW (lpString=".json") returned 5
	[0068.708] lstrcmpiW (lpString1=".json", lpString2="t.dll") returned -1
	[0068.708] lstrlenW (lpString=".jsp") returned 4
	[0068.708] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".kdc") returned 4
	[0068.709] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".kmz") returned 4
	[0068.709] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".kwm") returned 4
	[0068.709] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".lasso") returned 6
	[0068.709] lstrcmpiW (lpString1=".lasso", lpString2="nt.dll") returned -1
	[0068.709] lstrlenW (lpString=".lbi") returned 4
	[0068.709] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".lgf") returned 4
	[0068.709] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".lgp") returned 4
	[0068.709] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".log") returned 4
	[0068.709] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".m1v") returned 4
	[0068.709] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".m4a") returned 4
	[0068.709] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".m4v") returned 4
	[0068.709] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".max") returned 4
	[0068.709] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0068.709] lstrlenW (lpString=".md") returned 3
	[0068.709] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0068.709] lstrlenW (lpString=".mda") returned 4
	[0068.710] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mdb") returned 4
	[0068.710] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mde") returned 4
	[0068.710] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mdf") returned 4
	[0068.710] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mdw") returned 4
	[0068.710] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mef") returned 4
	[0068.710] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mft") returned 4
	[0068.710] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mfw") returned 4
	[0068.710] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mht") returned 4
	[0068.710] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mhtml") returned 6
	[0068.710] lstrcmpiW (lpString1=".mhtml", lpString2="nt.dll") returned -1
	[0068.710] lstrlenW (lpString=".mka") returned 4
	[0068.710] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mkidx") returned 6
	[0068.710] lstrcmpiW (lpString1=".mkidx", lpString2="nt.dll") returned -1
	[0068.710] lstrlenW (lpString=".mkv") returned 4
	[0068.710] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mos") returned 4
	[0068.710] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0068.710] lstrlenW (lpString=".mov") returned 4
	[0068.710] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".mp3") returned 4
	[0068.711] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".mp4") returned 4
	[0068.711] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".mpeg") returned 5
	[0068.711] lstrcmpiW (lpString1=".mpeg", lpString2="t.dll") returned -1
	[0068.711] lstrlenW (lpString=".mpg") returned 4
	[0068.711] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".mpv") returned 4
	[0068.711] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".mrw") returned 4
	[0068.711] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".msg") returned 4
	[0068.711] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".mxl") returned 4
	[0068.711] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".myd") returned 4
	[0068.711] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".myi") returned 4
	[0068.711] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".nef") returned 4
	[0068.711] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".nrw") returned 4
	[0068.711] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".obj") returned 4
	[0068.711] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0068.711] lstrlenW (lpString=".odb") returned 4
	[0068.711] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0068.712] lstrlenW (lpString=".odc") returned 4
	[0068.712] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0068.712] lstrlenW (lpString=".odm") returned 4
	[0068.712] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0068.712] lstrlenW (lpString=".odp") returned 4
	[0068.712] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0068.712] lstrlenW (lpString=".ods") returned 4
	[0068.712] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0068.712] lstrlenW (lpString=".oft") returned 4
	[0068.712] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0068.878] lstrlenW (lpString=".one") returned 4
	[0068.878] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0068.878] lstrlenW (lpString=".onepkg") returned 7
	[0068.883] lstrcmpiW (lpString1=".onepkg", lpString2="ent.dll") returned -1
	[0068.916] lstrlenW (lpString=".onetoc2") returned 8
	[0068.916] lstrcmpiW (lpString1=".onetoc2", lpString2="ient.dll") returned -1
	[0068.916] lstrlenW (lpString=".opt") returned 4
	[0068.916] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0068.916] lstrlenW (lpString=".oqy") returned 4
	[0068.916] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0068.916] lstrlenW (lpString=".orf") returned 4
	[0068.916] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0068.916] lstrlenW (lpString=".p12") returned 4
	[0068.916] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0068.916] lstrlenW (lpString=".p7b") returned 4
	[0068.916] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0068.916] lstrlenW (lpString=".p7c") returned 4
	[0068.916] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0068.916] lstrlenW (lpString=".pam") returned 4
	[0068.916] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0068.916] lstrlenW (lpString=".pbm") returned 4
	[0068.916] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0068.916] lstrlenW (lpString=".pct") returned 4
	[0068.916] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0068.916] lstrlenW (lpString=".pcx") returned 4
	[0068.916] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0068.916] lstrlenW (lpString=".pdd") returned 4
	[0068.917] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0068.917] lstrlenW (lpString=".pdf") returned 4
	[0068.917] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0068.917] lstrlenW (lpString=".pdp") returned 4
	[0068.917] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0068.917] lstrlenW (lpString=".pef") returned 4
	[0068.917] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0068.917] lstrlenW (lpString=".pem") returned 4
	[0068.917] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0068.917] lstrlenW (lpString=".pff") returned 4
	[0068.917] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0068.917] lstrlenW (lpString=".pfm") returned 4
	[0068.917] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0068.917] lstrlenW (lpString=".pfx") returned 4
	[0068.917] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0068.917] lstrlenW (lpString=".pgm") returned 4
	[0068.917] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0068.917] lstrlenW (lpString=".php") returned 4
	[0068.917] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0068.917] lstrlenW (lpString=".php3") returned 5
	[0068.917] lstrcmpiW (lpString1=".php3", lpString2="t.dll") returned -1
	[0068.917] lstrlenW (lpString=".php4") returned 5
	[0068.917] lstrcmpiW (lpString1=".php4", lpString2="t.dll") returned -1
	[0068.917] lstrlenW (lpString=".php5") returned 5
	[0068.917] lstrcmpiW (lpString1=".php5", lpString2="t.dll") returned -1
	[0068.917] lstrlenW (lpString=".phtml") returned 6
	[0068.917] lstrcmpiW (lpString1=".phtml", lpString2="nt.dll") returned -1
	[0068.918] lstrlenW (lpString=".pict") returned 5
	[0068.918] lstrcmpiW (lpString1=".pict", lpString2="t.dll") returned -1
	[0068.918] lstrlenW (lpString=".pl") returned 3
	[0068.918] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0068.918] lstrlenW (lpString=".pls") returned 4
	[0068.918] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0068.918] lstrlenW (lpString=".pm") returned 3
	[0068.918] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0068.918] lstrlenW (lpString=".png") returned 4
	[0068.918] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0068.918] lstrlenW (lpString=".pnm") returned 4
	[0068.918] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0068.918] lstrlenW (lpString=".pot") returned 4
	[0068.918] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0068.918] lstrlenW (lpString=".potm") returned 5
	[0068.918] lstrcmpiW (lpString1=".potm", lpString2="t.dll") returned -1
	[0068.918] lstrlenW (lpString=".potx") returned 5
	[0068.918] lstrcmpiW (lpString1=".potx", lpString2="t.dll") returned -1
	[0068.918] lstrlenW (lpString=".ppa") returned 4
	[0068.918] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0068.918] lstrlenW (lpString=".ppam") returned 5
	[0068.918] lstrcmpiW (lpString1=".ppam", lpString2="t.dll") returned -1
	[0068.918] lstrlenW (lpString=".ppm") returned 4
	[0068.919] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0068.919] lstrlenW (lpString=".pps") returned 4
	[0068.919] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0068.919] lstrlenW (lpString=".ppsm") returned 5
	[0068.919] lstrcmpiW (lpString1=".ppsm", lpString2="t.dll") returned -1
	[0068.919] lstrlenW (lpString=".ppt") returned 4
	[0068.919] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0068.919] lstrlenW (lpString=".pptm") returned 5
	[0068.919] lstrcmpiW (lpString1=".pptm", lpString2="t.dll") returned -1
	[0068.919] lstrlenW (lpString=".pptx") returned 5
	[0068.919] lstrcmpiW (lpString1=".pptx", lpString2="t.dll") returned -1
	[0068.919] lstrlenW (lpString=".prn") returned 4
	[0068.919] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0068.919] lstrlenW (lpString=".ps") returned 3
	[0068.919] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0068.919] lstrlenW (lpString=".psb") returned 4
	[0068.919] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0068.919] lstrlenW (lpString=".psd") returned 4
	[0068.919] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0068.919] lstrlenW (lpString=".pst") returned 4
	[0068.919] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0068.919] lstrlenW (lpString=".ptx") returned 4
	[0068.919] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0068.920] lstrlenW (lpString=".pub") returned 4
	[0068.920] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0068.920] lstrlenW (lpString=".pwm") returned 4
	[0068.920] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0068.920] lstrlenW (lpString=".pxr") returned 4
	[0068.920] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0068.920] lstrlenW (lpString=".py") returned 3
	[0068.920] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0068.920] lstrlenW (lpString=".qt") returned 3
	[0068.920] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0068.920] lstrlenW (lpString=".r3d") returned 4
	[0068.920] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0068.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.921] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0
	[0068.921] FindClose (in: hFindFile=0x6f4068 | out: hFindFile=0x6f4068) returned 1
	[0068.921] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0068.921] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1
	[0068.924] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.924] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0068.926] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.926] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0068.928] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.928] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1
	[0068.930] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.930] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0068.932] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.932] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0068.935] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.935] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0068.937] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.937] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0068.939] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.939] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1
	[0068.939] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.939] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0068.941] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.941] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0068.944] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.944] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0068.946] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.946] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0068.948] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.948] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0068.950] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.950] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1
	[0068.952] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.953] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0068.955] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.955] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0068.957] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.957] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0068.959] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.959] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0068.961] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0068.961] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0069.344] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.344] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interop.MSDASC.dll", cAlternateFileName="INTERO~1.DLL")) returned 1
	[0069.346] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.346] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0069.348] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.348] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1
	[0069.350] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.350] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0069.352] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.352] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0069.354] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.354] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0069.356] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.357] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDXQueryGenerator.DLL", cAlternateFileName="MDXQUE~1.DLL")) returned 1
	[0069.360] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.360] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0069.362] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.362] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0069.365] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.365] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1
	[0069.367] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.367] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.dll", cAlternateFileName="POWERP~1.DLL")) returned 1
	[0069.370] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.370] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0069.372] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.372] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.dll", cAlternateFileName="REPORT~1.DLL")) returned 1
	[0069.669] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.669] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1026", cAlternateFileName="")) returned 1
	[0069.669] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.669] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10266", cAlternateFileName="")) returned 1
	[0069.669] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.670] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1027", cAlternateFileName="")) returned 1
	[0069.670] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.670] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1028", cAlternateFileName="")) returned 1
	[0069.670] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.670] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1029", cAlternateFileName="")) returned 1
	[0069.670] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.670] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1030", cAlternateFileName="")) returned 1
	[0069.670] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.670] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1
	[0069.671] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.671] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1032", cAlternateFileName="")) returned 1
	[0069.671] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.671] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1
	[0069.671] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.671] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1035", cAlternateFileName="")) returned 1
	[0069.671] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.671] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1
	[0069.671] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.671] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1037", cAlternateFileName="")) returned 1
	[0069.672] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.672] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1038", cAlternateFileName="")) returned 1
	[0069.672] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.672] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1
	[0069.672] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.672] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1
	[0069.672] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.672] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1
	[0069.673] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.673] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1043", cAlternateFileName="")) returned 1
	[0069.673] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.673] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1044", cAlternateFileName="")) returned 1
	[0069.673] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.673] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1045", cAlternateFileName="")) returned 1
	[0069.674] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.674] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1
	[0069.674] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.674] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1048", cAlternateFileName="")) returned 1
	[0069.675] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.675] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1
	[0069.675] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.675] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1050", cAlternateFileName="")) returned 1
	[0069.675] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.675] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1051", cAlternateFileName="")) returned 1
	[0069.676] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.676] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1053", cAlternateFileName="")) returned 1
	[0069.686] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.686] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1054", cAlternateFileName="")) returned 1
	[0069.687] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.687] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1055", cAlternateFileName="")) returned 1
	[0069.687] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.687] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1057", cAlternateFileName="")) returned 1
	[0069.688] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.688] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1058", cAlternateFileName="")) returned 1
	[0069.689] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.689] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1060", cAlternateFileName="")) returned 1
	[0069.689] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.689] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1061", cAlternateFileName="")) returned 1
	[0069.690] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.690] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1062", cAlternateFileName="")) returned 1
	[0069.690] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.690] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1063", cAlternateFileName="")) returned 1
	[0069.690] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.691] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1066", cAlternateFileName="")) returned 1
	[0069.691] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.691] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1069", cAlternateFileName="")) returned 1
	[0069.692] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.692] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1081", cAlternateFileName="")) returned 1
	[0069.693] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.693] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1086", cAlternateFileName="")) returned 1
	[0069.694] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.694] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1087", cAlternateFileName="")) returned 1
	[0069.695] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.695] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1110", cAlternateFileName="")) returned 1
	[0069.695] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.695] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1
	[0069.695] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.695] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2070", cAlternateFileName="")) returned 1
	[0069.696] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.696] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2074", cAlternateFileName="")) returned 1
	[0069.696] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.696] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1
	[0069.696] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.696] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 1
	[0069.697] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0069.697] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 0
	[0069.697] FindClose (in: hFindFile=0x6f42a8 | out: hFindFile=0x6f42a8) returned 1
	[0069.697] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.698] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0069.700] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.700] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0069.703] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.703] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0069.705] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.705] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0069.707] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.707] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0069.710] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0069.710] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1
	[0070.002] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0070.033] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0070.037] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0070.037] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0070.040] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0070.040] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0070.043] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0070.043] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0070.046] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0070.046] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f913, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracedefinition110.xml", cAlternateFileName="TRACED~1.XML")) returned 1
	[0070.050] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0070.050] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0070.053] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0070.053] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1
	[0070.056] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0070.056] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1
	[0070.060] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43845d0 | out: hHeap=0x600000) returned 1
	[0070.060] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0
	[0070.060] FindClose (in: hFindFile=0x6f4368 | out: hFindFile=0x6f4368) returned 1
	[0070.060] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x43745c8 | out: hHeap=0x600000) returned 1
	[0070.061] FindNextFileW (in: hFindFile=0x6f41a8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c5a96a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d4a250, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x163c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1
	[0070.061] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0070.063] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b680, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AdeModule.dll", cAlternateFileName="ADEMOD~1.DLL")) returned 1
	[0070.066] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0070.066] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 1
	[0070.068] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0070.068] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 0
	[0070.069] FindClose (in: hFindFile=0x6f4068 | out: hFindFile=0x6f4068) returned 1
	[0070.069] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0070.069] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1
	[0071.414] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0071.414] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cf4318, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf7e60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1
	[0071.417] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0071.417] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c80c48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c80c48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca4703d4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ee58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1
	[0071.421] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0071.421] FindNextFileW (in: hFindFile=0x6f4368, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b60d2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6b60d2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b60d2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x90e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1
	[0071.421] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0071.421] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="cpprest140_2_6.dll", cAlternateFileName="CPPRES~1.DLL")) returned 1
	[0071.422] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0071.423] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0
	[0071.423] FindClose (in: hFindFile=0x6f43e8 | out: hFindFile=0x6f43e8) returned 1
	[0071.423] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0071.423] FindNextFileW (in: hFindFile=0x6f42a8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0071.423] FindClose (in: hFindFile=0x6f42a8 | out: hFindFile=0x6f42a8) returned 1
	[0071.423] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0071.424] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4d40834, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x17dec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1
	[0071.434] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0071.434] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0071.435] FindClose (in: hFindFile=0x6f3fa8 | out: hFindFile=0x6f3fa8) returned 1
	[0071.435] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4284588 | out: hHeap=0x600000) returned 1
	[0071.435] FindNextFileW (in: hFindFile=0x6f4328, lpFindFileData=0x3d9f308 | out: lpFindFileData=0x3d9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4dd9107, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x15f450, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1
	[0071.437] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.437] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1
	[0071.439] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.439] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 1
	[0071.439] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.439] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 0
	[0071.439] FindClose (in: hFindFile=0x6f4068 | out: hFindFile=0x6f4068) returned 1
	[0071.440] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0071.440] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1
	[0071.442] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4253d68 | out: hHeap=0x600000) returned 1
	[0071.442] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9eb94 | out: lpFindFileData=0x3d9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0
	[0071.442] FindClose (in: hFindFile=0x6f4068 | out: hFindFile=0x6f4068) returned 1
	[0071.442] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0071.442] FindNextFileW (in: hFindFile=0x6f3fa8, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0
	[0071.442] FindClose (in: hFindFile=0x6f3fa8 | out: hFindFile=0x6f3fa8) returned 1
	[0071.443] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4233d58 | out: hHeap=0x600000) returned 1
	[0071.444] FindNextFileW (in: hFindFile=0x6f43e8, lpFindFileData=0x3d9f08c | out: lpFindFileData=0x3d9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sounds", cAlternateFileName="")) returned 1
	[0071.447] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0071.447] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1
	[0071.450] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x4243d60 | out: hHeap=0x600000) returned 1
	[0071.450] FindNextFileW (in: hFindFile=0x6f4068, lpFindFileData=0x3d9ee10 | out: lpFindFileData=0x3d9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1

Thread:
	id = 27
	os_tid = 0xbe4


Thread:
	id = 28
	os_tid = 0x6c8


Process:
	id = "2"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x5838000"
	os_pid = "0xe5c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xce8"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3
	os_tid = 0xf14

	[0060.389] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6571d0000
	[0060.389] __set_app_type (_Type=0x1) 
	[0060.389] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6571e6d00) returned 0x0
	[0060.390] __getmainargs (in: _Argc=0x7ff657209200, _Argv=0x7ff657209208, _Env=0x7ff657209210, _DoWildCard=0, _StartInfo=0x7ff65720921c | out: _Argc=0x7ff657209200, _Argv=0x7ff657209208, _Env=0x7ff657209210) returned 0
	[0060.390] _onexit (_Func=0x7ff6571e7fd0) returned 0x7ff6571e7fd0
	[0060.390] _onexit (_Func=0x7ff6571e7fe0) returned 0x7ff6571e7fe0
	[0060.390] _onexit (_Func=0x7ff6571e7ff0) returned 0x7ff6571e7ff0
	[0060.390] _onexit (_Func=0x7ff6571e8000) returned 0x7ff6571e8000
	[0060.391] _onexit (_Func=0x7ff6571e8010) returned 0x7ff6571e8010
	[0060.391] _onexit (_Func=0x7ff6571e8020) returned 0x7ff6571e8020
	[0060.391] GetCurrentThreadId () returned 0xf14
	[0060.391] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf14) returned 0x70
	[0060.391] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000
	[0060.392] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990
	[0060.392] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0061.347] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0061.347] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xcec8f5fe68 | out: phkResult=0xcec8f5fe68*=0x0) returned 0x2
	[0061.348] VirtualQuery (in: lpAddress=0xcec8f5fe54, lpBuffer=0xcec8f5fdd0, dwLength=0x30 | out: lpBuffer=0xcec8f5fdd0*(BaseAddress=0xcec8f5f000, AllocationBase=0xcec8e60000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0061.348] VirtualQuery (in: lpAddress=0xcec8e60000, lpBuffer=0xcec8f5fdd0, dwLength=0x30 | out: lpBuffer=0xcec8f5fdd0*(BaseAddress=0xcec8e60000, AllocationBase=0xcec8e60000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0061.348] VirtualQuery (in: lpAddress=0xcec8e61000, lpBuffer=0xcec8f5fdd0, dwLength=0x30 | out: lpBuffer=0xcec8f5fdd0*(BaseAddress=0xcec8e61000, AllocationBase=0xcec8e60000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0061.348] VirtualQuery (in: lpAddress=0xcec8e64000, lpBuffer=0xcec8f5fdd0, dwLength=0x30 | out: lpBuffer=0xcec8f5fdd0*(BaseAddress=0xcec8e64000, AllocationBase=0xcec8e60000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0061.348] VirtualQuery (in: lpAddress=0xcec8f60000, lpBuffer=0xcec8f5fdd0, dwLength=0x30 | out: lpBuffer=0xcec8f5fdd0*(BaseAddress=0xcec8f60000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb78a, RegionSize=0xa0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0061.348] GetConsoleOutputCP () returned 0x1b5
	[0062.333] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65720fbb0 | out: lpCPInfo=0x7ff65720fbb0) returned 1
	[0062.333] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6571f8150, Add=1) returned 1
	[0062.333] _get_osfhandle (_FileHandle=1) returned 0x258
	[0062.333] GetConsoleMode (in: hConsoleHandle=0x258, lpMode=0x7ff65720fc04 | out: lpMode=0x7ff65720fc04) returned 0
	[0062.333] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0062.334] GetConsoleMode (in: hConsoleHandle=0x24c, lpMode=0x7ff65720fc00 | out: lpMode=0x7ff65720fc00) returned 0
	[0062.334] _get_osfhandle (_FileHandle=1) returned 0x258
	[0062.334] SetConsoleMode (hConsoleHandle=0x258, dwMode=0x0) returned 0
	[0062.334] _get_osfhandle (_FileHandle=1) returned 0x258
	[0062.334] GetConsoleMode (in: hConsoleHandle=0x258, lpMode=0x7ff65720fc08 | out: lpMode=0x7ff65720fc08) returned 0
	[0062.334] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0062.334] GetConsoleMode (in: hConsoleHandle=0x24c, lpMode=0x7ff65720fc0c | out: lpMode=0x7ff65720fc0c) returned 0
	[0062.334] GetEnvironmentStringsW () returned 0x27983f45a10*
	[0062.334] GetProcessHeap () returned 0x27983f40000
	[0062.334] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0xa7c) returned 0x27983f464a0
	[0062.334] FreeEnvironmentStringsA (penv="A") returned 1
	[0062.334] GetProcessHeap () returned 0x27983f40000
	[0062.334] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x8) returned 0x27983f46f30
	[0062.334] GetEnvironmentStringsW () returned 0x27983f45a10*
	[0062.334] GetProcessHeap () returned 0x27983f40000
	[0062.334] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0xa7c) returned 0x27983f46f50
	[0062.335] FreeEnvironmentStringsA (penv="A") returned 1
	[0062.335] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xcec8f5ed18 | out: phkResult=0xcec8f5ed18*=0x7c) returned 0x0
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x0, lpData=0xcec8f5ed30*=0x4, lpcbData=0xcec8f5ed14*=0x1000) returned 0x2
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x4, lpData=0xcec8f5ed30*=0x1, lpcbData=0xcec8f5ed14*=0x4) returned 0x0
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x0, lpData=0xcec8f5ed30*=0x1, lpcbData=0xcec8f5ed14*=0x1000) returned 0x2
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x4, lpData=0xcec8f5ed30*=0x0, lpcbData=0xcec8f5ed14*=0x4) returned 0x0
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x4, lpData=0xcec8f5ed30*=0x40, lpcbData=0xcec8f5ed14*=0x4) returned 0x0
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x4, lpData=0xcec8f5ed30*=0x40, lpcbData=0xcec8f5ed14*=0x4) returned 0x0
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x0, lpData=0xcec8f5ed30*=0x40, lpcbData=0xcec8f5ed14*=0x1000) returned 0x2
	[0062.335] RegCloseKey (hKey=0x7c) returned 0x0
	[0062.335] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xcec8f5ed18 | out: phkResult=0xcec8f5ed18*=0x7c) returned 0x0
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x0, lpData=0xcec8f5ed30*=0x40, lpcbData=0xcec8f5ed14*=0x1000) returned 0x2
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x4, lpData=0xcec8f5ed30*=0x1, lpcbData=0xcec8f5ed14*=0x4) returned 0x0
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x0, lpData=0xcec8f5ed30*=0x1, lpcbData=0xcec8f5ed14*=0x1000) returned 0x2
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x4, lpData=0xcec8f5ed30*=0x0, lpcbData=0xcec8f5ed14*=0x4) returned 0x0
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x4, lpData=0xcec8f5ed30*=0x9, lpcbData=0xcec8f5ed14*=0x4) returned 0x0
	[0062.335] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x4, lpData=0xcec8f5ed30*=0x9, lpcbData=0xcec8f5ed14*=0x4) returned 0x0
	[0062.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xcec8f5ed10, lpData=0xcec8f5ed30, lpcbData=0xcec8f5ed14*=0x1000 | out: lpType=0xcec8f5ed10*=0x0, lpData=0xcec8f5ed30*=0x9, lpcbData=0xcec8f5ed14*=0x1000) returned 0x2
	[0062.336] RegCloseKey (hKey=0x7c) returned 0x0
	[0062.336] time (in: timer=0x0 | out: timer=0x0) returned 0x5dbc0d6c
	[0062.336] srand (_Seed=0x5dbc0d6c) 
	[0062.336] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0062.336] malloc (_Size=0x4000) returned 0x279842a54f0
	[0062.336] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0062.336] malloc (_Size=0xffce) returned 0x27984110080
	[0062.337] ??_V@YAXPEAX@Z () returned 0x27984110080
	[0062.337] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x27984110080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0062.337] malloc (_Size=0xffce) returned 0x27984120060
	[0062.338] ??_V@YAXPEAX@Z () returned 0x27984120060
	[0062.338] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x27984120060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0062.338] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65720bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0062.338] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65720bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0062.339] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65720bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0062.339] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0062.339] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0062.339] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0062.339] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0062.339] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0062.339] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0062.339] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0062.339] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0062.339] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0062.339] GetProcessHeap () returned 0x27983f40000
	[0062.339] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f464a0) returned 1
	[0062.339] GetEnvironmentStringsW () returned 0x27983f45a10*
	[0062.339] GetProcessHeap () returned 0x27983f40000
	[0062.339] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0xa94) returned 0x27983f47a10
	[0062.339] FreeEnvironmentStringsA (penv="A") returned 1
	[0062.339] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff65720bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0062.339] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff65720bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0062.340] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0062.340] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0062.340] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0062.340] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0062.340] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0062.340] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0062.340] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0062.340] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0062.340] malloc (_Size=0xffce) returned 0x27984130040
	[0062.340] ??_V@YAXPEAX@Z () returned 0x27984130040
	[0062.341] GetProcessHeap () returned 0x27983f40000
	[0062.341] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x40) returned 0x27983f484b0
	[0062.341] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x27984130040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0062.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x27984130040, lpFilePart=0xcec8f5f890 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xcec8f5f890*="Desktop") returned 0x17
	[0062.341] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0062.342] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xcec8f5f5c0 | out: lpFindFileData=0xcec8f5f5c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x27983f48500
	[0062.342] FindClose (in: hFindFile=0x27983f48500 | out: hFindFile=0x27983f48500) returned 1
	[0062.342] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xcec8f5f5c0 | out: lpFindFileData=0xcec8f5f5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x27983f48500
	[0062.342] FindClose (in: hFindFile=0x27983f48500 | out: hFindFile=0x27983f48500) returned 1
	[0062.342] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xcec8f5f5c0 | out: lpFindFileData=0xcec8f5f5c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xbf5c95a5, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xbf5c95a5, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x27983f48500
	[0062.342] FindClose (in: hFindFile=0x27983f48500 | out: hFindFile=0x27983f48500) returned 1
	[0062.342] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0062.343] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0062.343] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0062.343] GetProcessHeap () returned 0x27983f40000
	[0062.343] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f47a10) returned 1
	[0062.343] GetEnvironmentStringsW () returned 0x27983f40fc0*
	[0062.343] GetProcessHeap () returned 0x27983f40000
	[0062.343] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0xacc) returned 0x27983f48500
	[0062.343] FreeEnvironmentStringsA (penv="=") returned 1
	[0062.343] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x27984110080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0062.343] GetProcessHeap () returned 0x27983f40000
	[0062.343] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f484b0) returned 1
	[0062.343] ??_V@YAXPEAX@Z () returned 0x1
	[0062.343] ??_V@YAXPEAX@Z () returned 0x1
	[0062.343] GetProcessHeap () returned 0x27983f40000
	[0062.343] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x4016) returned 0x27983f48fe0
	[0062.344] GetProcessHeap () returned 0x27983f40000
	[0062.344] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f48fe0) returned 1
	[0062.344] GetConsoleOutputCP () returned 0x1b5
	[0063.349] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65720fbb0 | out: lpCPInfo=0x7ff65720fbb0) returned 1
	[0063.349] GetUserDefaultLCID () returned 0x409
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff65720bb78, cchData=8 | out: lpLCData=":") returned 2
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xcec8f5fc50, cchData=128 | out: lpLCData="0") returned 2
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xcec8f5fc50, cchData=128 | out: lpLCData="0") returned 2
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xcec8f5fc50, cchData=128 | out: lpLCData="1") returned 2
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff65720bb68, cchData=8 | out: lpLCData="/") returned 2
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff65720bb00, cchData=32 | out: lpLCData="Mon") returned 4
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff65720bac0, cchData=32 | out: lpLCData="Tue") returned 4
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff65720ba80, cchData=32 | out: lpLCData="Wed") returned 4
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff65720ba40, cchData=32 | out: lpLCData="Thu") returned 4
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff65720ba00, cchData=32 | out: lpLCData="Fri") returned 4
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff65720b9c0, cchData=32 | out: lpLCData="Sat") returned 4
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff65720b980, cchData=32 | out: lpLCData="Sun") returned 4
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff65720bb58, cchData=8 | out: lpLCData=".") returned 2
	[0063.350] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff65720bb40, cchData=8 | out: lpLCData=",") returned 2
	[0063.350] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0063.352] GetProcessHeap () returned 0x27983f40000
	[0063.352] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x0, Size=0x20c) returned 0x27983f46560
	[0063.352] GetConsoleTitleW (in: lpConsoleTitle=0x27983f46560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0064.092] _get_osfhandle (_FileHandle=1) returned 0x258
	[0064.092] GetFileType (hFile=0x258) returned 0x3
	[0064.203] ApiSetQueryApiSetPresence () returned 0x0
	[0064.203] ResolveDelayLoadedAPI () returned 0x7ff92580d990
	[0064.678] BrandingFormatString () returned 0x27983f41850
	[0064.688] GetVersion () returned 0x3ad7000a
	[0064.688] _vsnwprintf (in: _Buffer=0xcec8f5fdb0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xcec8f5fd48 | out: _Buffer="10.0.15063") returned 10
	[0064.688] _get_osfhandle (_FileHandle=1) returned 0x258
	[0064.688] GetFileType (hFile=0x258) returned 0x3
	[0064.688] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff657217f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0064.689] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff657217f60, nSize=0x2000, Arguments=0xcec8f5fd50 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26
	[0064.689] _get_osfhandle (_FileHandle=1) returned 0x258
	[0064.689] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff657209970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39
	[0064.689] WriteFile (in: hFile=0x258, lpBuffer=0x7ff657209970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xcec8f5fca8, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesWritten=0xcec8f5fca8*=0x26, lpOverlapped=0x0) returned 1
	[0064.689] _vsnwprintf (in: _Buffer=0x7ff657217f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xcec8f5fd78 | out: _Buffer="\r\n") returned 2
	[0064.689] _get_osfhandle (_FileHandle=1) returned 0x258
	[0064.689] GetFileType (hFile=0x258) returned 0x3
	[0064.689] _get_osfhandle (_FileHandle=1) returned 0x258
	[0064.689] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff657209970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0064.689] WriteFile (in: hFile=0x258, lpBuffer=0x7ff657209970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xcec8f5fd48, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesWritten=0xcec8f5fd48*=0x2, lpOverlapped=0x0) returned 1
	[0064.689] _vsnwprintf (in: _Buffer=0x7ff657217f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xcec8f5fd78 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52
	[0064.689] _get_osfhandle (_FileHandle=1) returned 0x258
	[0064.689] GetFileType (hFile=0x258) returned 0x3
	[0064.689] _get_osfhandle (_FileHandle=1) returned 0x258
	[0064.689] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff657209970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53
	[0064.689] WriteFile (in: hFile=0x258, lpBuffer=0x7ff657209970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xcec8f5fd48, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesWritten=0xcec8f5fd48*=0x34, lpOverlapped=0x0) returned 1
	[0064.689] _vsnwprintf (in: _Buffer=0x7ff657217f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xcec8f5fd78 | out: _Buffer="\r\n") returned 2
	[0064.689] _get_osfhandle (_FileHandle=1) returned 0x258
	[0064.689] GetFileType (hFile=0x258) returned 0x3
	[0064.689] _get_osfhandle (_FileHandle=1) returned 0x258
	[0064.689] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff657209970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0064.690] WriteFile (in: hFile=0x258, lpBuffer=0x7ff657209970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xcec8f5fd48, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesWritten=0xcec8f5fd48*=0x2, lpOverlapped=0x0) returned 1
	[0064.691] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000
	[0064.691] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830
	[0064.691] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300
	[0064.691] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40
	[0064.691] ??_V@YAXPEAX@Z () returned 0x1
	[0064.691] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0064.691] GetFileType (hFile=0x24c) returned 0x3
	[0064.691] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0064.692] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xcec8f5fbb8 | out: TokenHandle=0xcec8f5fbb8*=0x0) returned 0xc000007c
	[0064.692] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xcec8f5fbb8 | out: TokenHandle=0xcec8f5fbb8*=0x94) returned 0x0
	[0064.692] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xcec8f5fb68, TokenInformationLength=0x4, ReturnLength=0xcec8f5fb70 | out: TokenInformation=0xcec8f5fb68, ReturnLength=0xcec8f5fb70) returned 0x0
	[0064.692] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xcec8f5fb70, TokenInformationLength=0x4, ReturnLength=0xcec8f5fb68 | out: TokenInformation=0xcec8f5fb70, ReturnLength=0xcec8f5fb68) returned 0x0
	[0064.692] NtClose (Handle=0x94) returned 0x0
	[0064.692] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xcec8f5fb80, nSize=0x0, Arguments=0xcec8f5fb88 | out: lpBuffer="茠菴ɹ") returned 0xf
	[0064.693] GetProcessHeap () returned 0x27983f40000
	[0064.693] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x218) returned 0x27983f46c30
	[0064.694] GetConsoleTitleW (in: lpConsoleTitle=0xcec8f5fbd0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0065.402] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0
	[0065.402] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0066.186] GetProcessHeap () returned 0x27983f40000
	[0066.186] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f46c30) returned 1
	[0066.186] LocalFree (hMem=0x27983f48320) returned 0x0
	[0066.187] _vsnwprintf (in: _Buffer=0x7ff657217f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xcec8f5f9f8 | out: _Buffer="\r\n") returned 2
	[0066.188] _get_osfhandle (_FileHandle=1) returned 0x258
	[0066.188] GetFileType (hFile=0x258) returned 0x3
	[0066.188] _get_osfhandle (_FileHandle=1) returned 0x258
	[0066.188] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff657209970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0066.188] WriteFile (in: hFile=0x258, lpBuffer=0x7ff657209970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xcec8f5f9c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesWritten=0xcec8f5f9c8*=0x2, lpOverlapped=0x0) returned 1
	[0066.188] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65720bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0066.188] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x27984110080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0066.188] malloc (_Size=0x107ce) returned 0x27984120060
	[0066.188] _vsnwprintf (in: _Buffer=0x27984120060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xcec8f5fa08 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23
	[0066.189] _vsnwprintf (in: _Buffer=0x2798412008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xcec8f5fa08 | out: _Buffer=">") returned 1
	[0066.189] _get_osfhandle (_FileHandle=1) returned 0x258
	[0066.189] GetFileType (hFile=0x258) returned 0x3
	[0066.189] _get_osfhandle (_FileHandle=1) returned 0x258
	[0066.189] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff657209970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25
	[0066.189] WriteFile (in: hFile=0x258, lpBuffer=0x7ff657209970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xcec8f5f9f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesWritten=0xcec8f5f9f8*=0x18, lpOverlapped=0x0) returned 1
	[0066.189] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.189] GetFileType (hFile=0x24c) returned 0x3
	[0066.189] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.189] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.189] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.189] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0066.189] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.189] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.189] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.189] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0066.189] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.190] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.190] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0066.190] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.190] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.190] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0066.190] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.190] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.190] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0066.190] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.190] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.190] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0066.190] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.190] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.190] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0066.190] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.190] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.190] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0066.191] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.191] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.191] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0066.191] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.191] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.191] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0066.191] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.191] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.191] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0066.191] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.191] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.191] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0066.191] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.191] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.191] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0066.191] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.191] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.191] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0066.192] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.192] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.192] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0066.192] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.192] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.192] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0066.193] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.193] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.193] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0066.193] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.193] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.193] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0066.193] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.193] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.193] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0066.193] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.193] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.193] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0066.193] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.193] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.193] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1
	[0066.193] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.193] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.194] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.194] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1
	[0066.194] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.194] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.194] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.194] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0066.194] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.194] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.194] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff657209970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcec8f5fd58, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesRead=0xcec8f5fd58*=0x1, lpOverlapped=0x0) returned 1
	[0066.194] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff657209970, cbMultiByte=1, lpWideCharStr=0x7ff657213c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0066.195] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.195] GetFileType (hFile=0x24c) returned 0x3
	[0066.195] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0066.195] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0066.195] _get_osfhandle (_FileHandle=1) returned 0x258
	[0066.195] GetFileType (hFile=0x258) returned 0x3
	[0066.195] _get_osfhandle (_FileHandle=1) returned 0x258
	[0066.195] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff657209970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25
	[0066.195] WriteFile (in: hFile=0x258, lpBuffer=0x7ff657209970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xcec8f5fcf8, lpOverlapped=0x0 | out: lpBuffer=0x7ff657209970*, lpNumberOfBytesWritten=0xcec8f5fcf8*=0x18, lpOverlapped=0x0) returned 1
	[0066.195] GetProcessHeap () returned 0x27983f40000
	[0066.195] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x4012) returned 0x27983f48fe0
	[0066.195] GetProcessHeap () returned 0x27983f40000
	[0066.195] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f48fe0) returned 1
	[0066.195] _wcsicmp (_String1="mode", _String2=")") returned 68
	[0066.195] _wcsicmp (_String1="FOR", _String2="mode") returned -7
	[0066.195] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7
	[0066.195] _wcsicmp (_String1="IF", _String2="mode") returned -4
	[0066.196] _wcsicmp (_String1="IF/?", _String2="mode") returned -4
	[0066.196] _wcsicmp (_String1="REM", _String2="mode") returned 5
	[0066.196] _wcsicmp (_String1="REM/?", _String2="mode") returned 5
	[0066.196] GetProcessHeap () returned 0x27983f40000
	[0066.196] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0xb0) returned 0x27983f48320
	[0066.196] GetProcessHeap () returned 0x27983f40000
	[0066.196] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x1a) returned 0x27983f46a80
	[0066.196] GetProcessHeap () returned 0x27983f40000
	[0066.196] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x38) returned 0x27983f41850
	[0066.197] GetConsoleOutputCP () returned 0x1b5
	[0067.187] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65720fbb0 | out: lpCPInfo=0x7ff65720fbb0) returned 1
	[0067.187] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0067.755] GetConsoleTitleW (in: lpConsoleTitle=0xcec8f5fb40, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0068.269] malloc (_Size=0xffce) returned 0x27984130840
	[0068.269] ??_V@YAXPEAX@Z () returned 0x27984130840
	[0068.269] malloc (_Size=0xffce) returned 0x27984140820
	[0068.270] ??_V@YAXPEAX@Z () returned 0x27984140820
	[0068.270] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0068.270] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0068.270] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0068.270] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0068.270] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0068.270] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0068.270] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0068.270] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0068.270] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0068.270] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0068.271] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0068.271] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0068.271] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0068.271] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0068.271] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0068.271] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0068.271] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0068.271] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0068.271] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0068.271] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0068.271] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0068.271] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0068.271] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0068.271] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0068.271] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0068.271] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0068.271] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0068.271] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0068.271] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0068.271] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0068.271] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0068.271] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0068.271] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0068.271] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0068.271] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0068.271] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0068.271] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0068.271] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0068.271] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0068.271] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0068.272] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0068.272] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0068.272] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0068.272] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0068.272] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0068.272] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0068.272] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0068.272] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0068.272] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0068.272] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0068.272] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0068.272] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0068.272] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0068.272] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0068.272] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0068.272] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0068.272] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0068.272] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0068.272] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0068.272] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0068.272] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0068.272] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0068.272] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0068.272] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0068.272] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0068.272] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0068.272] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0068.272] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0068.272] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0068.272] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0068.272] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0068.273] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0068.273] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0068.273] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0068.273] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0068.273] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0068.273] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0068.273] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0068.273] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0068.273] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0068.273] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0068.273] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0068.273] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0068.273] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0068.273] _wcsicmp (_String1="mode", _String2="FOR") returned 7
	[0068.273] _wcsicmp (_String1="mode", _String2="IF") returned 4
	[0068.273] _wcsicmp (_String1="mode", _String2="REM") returned -5
	[0068.273] ??_V@YAXPEAX@Z () returned 0x1
	[0068.273] GetProcessHeap () returned 0x27983f40000
	[0068.273] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0xffde) returned 0x27983f48fe0
	[0068.274] GetProcessHeap () returned 0x27983f40000
	[0068.274] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x42) returned 0x27983f483e0
	[0068.274] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10
	[0068.274] malloc (_Size=0xffce) returned 0x27984140820
	[0068.274] ??_V@YAXPEAX@Z () returned 0x27984140820
	[0068.274] GetProcessHeap () returned 0x27983f40000
	[0068.274] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x1ffac) returned 0x27983f58fd0
	[0068.277] SetErrorMode (uMode=0x0) returned 0x0
	[0068.277] SetErrorMode (uMode=0x1) returned 0x0
	[0068.277] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x27983f58fe0, lpFilePart=0xcec8f5f3c0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xcec8f5f3c0*="Desktop") returned 0x17
	[0068.277] SetErrorMode (uMode=0x0) returned 0x1
	[0068.277] GetProcessHeap () returned 0x27983f40000
	[0068.277] RtlReAllocateHeap (Heap=0x27983f40000, Flags=0x0, Ptr=0x27983f58fd0, Size=0x4a) returned 0x27983f58fd0
	[0068.277] GetProcessHeap () returned 0x27983f40000
	[0068.277] RtlSizeHeap (HeapHandle=0x27983f40000, Flags=0x0, MemoryPointer=0x27983f58fd0) returned 0x4a
	[0068.277] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65720bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0068.277] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0068.277] GetProcessHeap () returned 0x27983f40000
	[0068.277] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x1bc) returned 0x27983f46c30
	[0068.277] GetProcessHeap () returned 0x27983f40000
	[0068.277] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x368) returned 0x27983f59030
	[0068.288] GetProcessHeap () returned 0x27983f40000
	[0068.288] RtlReAllocateHeap (Heap=0x27983f40000, Flags=0x0, Ptr=0x27983f59030, Size=0x1be) returned 0x27983f59030
	[0068.288] GetProcessHeap () returned 0x27983f40000
	[0068.288] RtlSizeHeap (HeapHandle=0x27983f40000, Flags=0x0, MemoryPointer=0x27983f59030) returned 0x1be
	[0068.288] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65720bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0068.288] GetProcessHeap () returned 0x27983f40000
	[0068.288] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0xe8) returned 0x27983f46e00
	[0068.290] GetProcessHeap () returned 0x27983f40000
	[0068.290] RtlReAllocateHeap (Heap=0x27983f40000, Flags=0x0, Ptr=0x27983f46e00, Size=0x7e) returned 0x27983f46e00
	[0068.290] GetProcessHeap () returned 0x27983f40000
	[0068.290] RtlSizeHeap (HeapHandle=0x27983f40000, Flags=0x0, MemoryPointer=0x27983f46e00) returned 0x7e
	[0068.290] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0068.290] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xcec8f5f130, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcec8f5f130) returned 0xffffffffffffffff
	[0068.291] GetLastError () returned 0x2
	[0068.291] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0068.291] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xcec8f5f130, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcec8f5f130) returned 0xffffffffffffffff
	[0068.293] GetLastError () returned 0x2
	[0068.293] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0068.293] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xcec8f5f130, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcec8f5f130) returned 0x27983f46e90
	[0068.294] GetProcessHeap () returned 0x27983f40000
	[0068.294] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x0, Size=0x28) returned 0x27983f41890
	[0068.294] FindClose (in: hFindFile=0x27983f46e90 | out: hFindFile=0x27983f46e90) returned 1
	[0068.294] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xcec8f5f130, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcec8f5f130) returned 0x27983f46e90
	[0068.294] GetProcessHeap () returned 0x27983f40000
	[0068.294] RtlReAllocateHeap (Heap=0x27983f40000, Flags=0x0, Ptr=0x27983f41890, Size=0x8) returned 0x27983f41890
	[0068.294] FindClose (in: hFindFile=0x27983f46e90 | out: hFindFile=0x27983f46e90) returned 1
	[0068.294] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1
	[0068.294] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2
	[0068.294] ??_V@YAXPEAX@Z () returned 0x1
	[0068.294] GetConsoleTitleW (in: lpConsoleTitle=0xcec8f5f6b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0068.962] GetProcessHeap () returned 0x27983f40000
	[0068.962] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x21c) returned 0x27983f59200
	[0068.962] GetConsoleTitleW (in: lpConsoleTitle=0x27983f59210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0069.728] GetProcessHeap () returned 0x27983f40000
	[0069.728] RtlReAllocateHeap (Heap=0x27983f40000, Flags=0x0, Ptr=0x27983f59200, Size=0xaa) returned 0x27983f59200
	[0069.728] GetProcessHeap () returned 0x27983f40000
	[0069.728] RtlSizeHeap (HeapHandle=0x27983f40000, Flags=0x0, MemoryPointer=0x27983f59200) returned 0xaa
	[0069.728] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode  con cp select=1251") returned 1
	[0070.723] GetProcessHeap () returned 0x27983f40000
	[0070.723] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f59200) returned 1
	[0070.724] InitializeProcThreadAttributeList (in: lpAttributeList=0xcec8f5f5d0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xcec8f5f4c0 | out: lpAttributeList=0xcec8f5f5d0, lpSize=0xcec8f5f4c0) returned 1
	[0070.724] UpdateProcThreadAttribute (in: lpAttributeList=0xcec8f5f5d0, dwFlags=0x0, Attribute=0x60001, lpValue=0xcec8f5f4ac, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xcec8f5f5d0, lpPreviousValue=0x0) returned 1
	[0070.724] GetStartupInfoW (in: lpStartupInfo=0xcec8f5f560 | out: lpStartupInfo=0xcec8f5f560*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x24c, hStdOutput=0x258, hStdError=0x258)) 
	[0070.724] GetProcessHeap () returned 0x27983f40000
	[0070.724] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x20) returned 0x27983f46e90
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.724] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0070.725] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0070.725] GetProcessHeap () returned 0x27983f40000
	[0070.725] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f46e90) returned 1
	[0070.725] GetProcessHeap () returned 0x27983f40000
	[0070.725] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0x12) returned 0x27983f46e90
	[0070.725] _get_osfhandle (_FileHandle=1) returned 0x258
	[0070.725] SetConsoleMode (hConsoleHandle=0x258, dwMode=0x0) returned 0
	[0070.725] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0070.725] SetConsoleMode (hConsoleHandle=0x24c, dwMode=0x0) returned 0
	[0070.725] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode  con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xcec8f5f4f0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode  con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xcec8f5f4c8 | out: lpCommandLine="mode  con cp select=1251", lpProcessInformation=0xcec8f5f4c8*(hProcess=0x98, hThread=0x94, dwProcessId=0x324, dwThreadId=0xcbc)) returned 1
	[0071.138] CloseHandle (hObject=0x94) returned 1
	[0071.138] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0071.138] GetProcessHeap () returned 0x27983f40000
	[0071.138] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f48500) returned 1
	[0071.138] GetEnvironmentStringsW () returned 0x27983f484c0*
	[0071.138] GetProcessHeap () returned 0x27983f40000
	[0071.138] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0xacc) returned 0x27983f59520
	[0071.139] FreeEnvironmentStringsA (penv="=") returned 1
	[0071.139] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000
	[0071.139] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0
	[0071.139] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xcec8f5e9c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xcec8f5e9c8, ReturnLength=0x0) returned 0x0
	[0071.139] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x7949c88000, lpBuffer=0xcec8f5ea00, nSize=0x7a0, lpNumberOfBytesRead=0xcec8f5e9c0 | out: lpBuffer=0xcec8f5ea00*, lpNumberOfBytesRead=0xcec8f5e9c0*=0x7a0) returned 1
	[0071.140] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0
	[0087.303] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xcec8f5f448 | out: lpExitCode=0xcec8f5f448*=0x0) returned 1
	[0087.303] CloseHandle (hObject=0x98) returned 1
	[0087.303] _vsnwprintf (in: _Buffer=0xcec8f5f618, _BufferCount=0x13, _Format="%08X", _ArgList=0xcec8f5f458 | out: _Buffer="00000000") returned 8
	[0087.304] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0087.304] GetProcessHeap () returned 0x27983f40000
	[0087.304] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f59520) returned 1
	[0087.304] GetEnvironmentStringsW () returned 0x27983f59520*
	[0087.305] GetProcessHeap () returned 0x27983f40000
	[0087.305] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0xaf2) returned 0x27983f5a020
	[0087.305] FreeEnvironmentStringsA (penv="=") returned 1
	[0087.305] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0087.305] GetProcessHeap () returned 0x27983f40000
	[0087.305] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f5a020) returned 1
	[0087.305] GetEnvironmentStringsW () returned 0x27983f59520*
	[0087.305] GetProcessHeap () returned 0x27983f40000
	[0087.305] RtlAllocateHeap (HeapHandle=0x27983f40000, Flags=0x8, Size=0xaf2) returned 0x27983f5a020
	[0087.305] FreeEnvironmentStringsA (penv="=") returned 1
	[0087.305] GetProcessHeap () returned 0x27983f40000
	[0087.305] RtlFreeHeap (HeapHandle=0x27983f40000, Flags=0x0, BaseAddress=0x27983f46e90) returned 1
	[0087.305] DeleteProcThreadAttributeList (in: lpAttributeList=0xcec8f5f5d0 | out: lpAttributeList=0xcec8f5f5d0) 
	[0087.305] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") 

Thread:
	id = 24
	os_tid = 0xa34


Process:
	id = "3"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x733d2000"
	os_pid = "0x344"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0xe5c"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 14
	os_tid = 0xf8c


Thread:
	id = 15
	os_tid = 0x770


Thread:
	id = 16
	os_tid = 0x3a8


Thread:
	id = 22
	os_tid = 0xf04


Thread:
	id = 23
	os_tid = 0x48c


Process:
	id = "4"
	image_name = "mode.com"
	filename = "c:\\windows\\system32\\mode.com"
	page_root = "0x70227000"
	os_pid = "0x324"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0xe5c"
	cmd_line = "mode  con cp select=1251"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 25
	os_tid = 0xcbc


Thread:
	id = 26
	os_tid = 0x8e8


Process:
	id = "5"
	image_name = "d2.exe"
	filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe"
	page_root = "0x549ca000"
	os_pid = "0xdb4"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe\" "
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012a52" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 29
	os_tid = 0xdb8

	[0143.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff74 | out: lpSystemTimeAsFileTime=0x19ff74*(dwLowDateTime=0xbe81852, dwHighDateTime=0x1d590a2)) 
	[0143.832] GetCurrentProcessId () returned 0xdb4
	[0143.832] GetCurrentThreadId () returned 0xdb8
	[0143.832] GetTickCount () returned 0x1137d06
	[0143.832] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff6c | out: lpPerformanceCount=0x19ff6c*=5466830248) returned 1
	[0144.060] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x19ff7c, hStdError=0x409539)) 
	[0144.060] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x960000
	[0144.061] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.061] GetProcAddress (hModule=0x760c0000, lpProcName="FlsAlloc") returned 0x760d4ae0
	[0144.061] GetProcAddress (hModule=0x760c0000, lpProcName="FlsGetValue") returned 0x760d4b20
	[0144.061] GetProcAddress (hModule=0x760c0000, lpProcName="FlsSetValue") returned 0x760d4b40
	[0144.062] GetProcAddress (hModule=0x760c0000, lpProcName="FlsFree") returned 0x760d4b00
	[0144.062] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.062] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.062] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.062] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.062] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.062] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.062] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.062] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.063] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.063] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.063] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.063] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.063] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.063] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.064] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.064] GetProcAddress (hModule=0x760c0000, lpProcName="DecodePointer") returned 0x77a51ec0
	[0144.064] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x214) returned 0x9605a8
	[0144.064] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.064] GetProcAddress (hModule=0x760c0000, lpProcName="DecodePointer") returned 0x77a51ec0
	[0144.064] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.064] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.064] GetProcAddress (hModule=0x760c0000, lpProcName="DecodePointer") returned 0x77a51ec0
	[0144.065] GetCurrentThreadId () returned 0xdb8
	[0144.065] GetStartupInfoA (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) 
	[0144.065] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x800) returned 0x9607c8
	[0144.065] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0144.065] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0144.065] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0144.065] SetHandleCount (uNumber=0x20) returned 0x20
	[0144.065] GetCommandLineW () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe\" "
	[0144.065] GetEnvironmentStringsW () returned 0x4d28a0*
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x0, Size=0xb04) returned 0x960fd0
	[0144.066] FreeEnvironmentStringsW (penv=0x4d28a0) returned 1
	[0144.066] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4377f0, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe")) returned 0x43
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x0, Size=0x90) returned 0x961ae0
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x98) returned 0x961b78
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x3e) returned 0x961c18
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x50) returned 0x961c60
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x6e) returned 0x961cb8
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x78) returned 0x961d30
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x62) returned 0x961db0
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x28) returned 0x961e20
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x48) returned 0x961e50
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x1a) returned 0x961ea0
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x2e) returned 0x961ec8
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x56) returned 0x961f00
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x2a) returned 0x961f60
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x2e) returned 0x961f98
	[0144.066] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x44) returned 0x961fd0
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x1c) returned 0x962020
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x184) returned 0x962048
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x7c) returned 0x9621d8
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x36) returned 0x962260
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x3a) returned 0x9622a0
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x90) returned 0x9622e8
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x24) returned 0x962380
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x30) returned 0x9623b0
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x36) returned 0x9623e8
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x48) returned 0x962428
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x52) returned 0x962478
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x3c) returned 0x9624d8
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0xd6) returned 0x962520
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x2e) returned 0x962600
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x28) returned 0x962638
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x1e) returned 0x962668
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x2c) returned 0x962690
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x50) returned 0x9626c8
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x4e) returned 0x962720
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x24) returned 0x962778
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x42) returned 0x9627a8
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x20) returned 0x9627f8
	[0144.067] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x38) returned 0x962820
	[0144.068] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x24) returned 0x962860
	[0144.068] HeapFree (in: hHeap=0x960000, dwFlags=0x0, lpMem=0x960fd0 | out: hHeap=0x960000) returned 1
	[0144.069] GetLastError () returned 0x0
	[0144.069] SetLastError (dwErrCode=0x0) 
	[0144.069] GetLastError () returned 0x0
	[0144.069] SetLastError (dwErrCode=0x0) 
	[0144.069] GetLastError () returned 0x0
	[0144.069] SetLastError (dwErrCode=0x0) 
	[0144.069] GetACP () returned 0x4e4
	[0144.069] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x0, Size=0x220) returned 0x962890
	[0144.069] GetLastError () returned 0x0
	[0144.070] SetLastError (dwErrCode=0x0) 
	[0144.070] IsValidCodePage (CodePage=0x4e4) returned 1
	[0144.070] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1
	[0144.070] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1
	[0144.070] GetLastError () returned 0x0
	[0144.070] SetLastError (dwErrCode=0x0) 
	[0144.070] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f8d8 | out: lpCharType=0x19f8d8) returned 1
	[0144.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0144.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ៯AĀ") returned 256
	[0144.070] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ៯AĀ", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1
	[0144.070] GetLastError () returned 0x0
	[0144.070] SetLastError (dwErrCode=0x0) 
	[0144.070] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1
	[0144.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0144.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0144.070] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0144.070] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0144.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ3>îN\x94þ\x19", lpUsedDefaultChar=0x0) returned 256
	[0144.070] GetLastError () returned 0x0
	[0144.071] SetLastError (dwErrCode=0x0) 
	[0144.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0144.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0144.071] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0144.071] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256
	[0144.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ3>îN\x94þ\x19", lpUsedDefaultChar=0x0) returned 256
	[0144.071] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x800) returned 0x960fd0
	[0144.071] RtlAllocateHeap (HeapHandle=0x960000, Flags=0x8, Size=0x80) returned 0x9617d8
	[0144.071] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4085ed) returned 0x0
	[0144.072] RtlSizeHeap (HeapHandle=0x960000, Flags=0x0, MemoryPointer=0x9617d8) returned 0x80
	[0144.072] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.091] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.099] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.103] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.103] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.103] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.103] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.103] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.103] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.103] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.103] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.103] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.103] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.104] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.104] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.104] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.104] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.104] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.104] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.104] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.104] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.104] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.104] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.105] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.105] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.105] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.105] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.105] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.105] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.105] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.105] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.105] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.105] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.105] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.105] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.106] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.106] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.106] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.106] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.106] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.106] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.106] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.106] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.106] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.106] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.106] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.107] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.107] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.107] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.107] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.107] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.107] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.107] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.107] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.107] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.107] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.107] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.107] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.107] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.107] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.107] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.107] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.107] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.108] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.108] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.108] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.108] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.108] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.108] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.108] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.108] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.108] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.108] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.108] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.108] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.108] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.108] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.108] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.108] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.108] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.109] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.109] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.109] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.109] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.109] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.109] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.109] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.109] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.109] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.109] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.109] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.109] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.109] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.110] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.110] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.110] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.110] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.110] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.110] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.110] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.110] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.110] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.110] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.110] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.110] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.110] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.110] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.110] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.111] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.111] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.111] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.111] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.111] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.111] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.111] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.111] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.111] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.111] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.111] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.111] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.111] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.112] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.112] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.112] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.112] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.112] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.112] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.112] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.112] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.112] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.112] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.112] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.112] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.112] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.112] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.112] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.112] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.112] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.113] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.113] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.113] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.113] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.113] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.113] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.113] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.113] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.113] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.113] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.113] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.113] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.113] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.113] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.113] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.113] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.113] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.114] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.114] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.114] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.114] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.114] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.114] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.114] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.114] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.114] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.114] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.114] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.114] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.114] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.114] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.114] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.114] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.115] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.115] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.115] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.115] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.115] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.115] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.115] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.115] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.115] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.115] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.115] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.115] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.115] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.115] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.115] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.115] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.115] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.115] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.116] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.116] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.116] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.116] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.116] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.116] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.116] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.116] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.116] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.116] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.116] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.116] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.116] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.116] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.116] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.116] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.117] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.117] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.117] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.117] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.117] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.117] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.117] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.117] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.117] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.117] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.117] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.117] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.117] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.117] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.117] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.117] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.117] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.118] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.118] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.118] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.118] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.118] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.118] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.118] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.118] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.118] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.118] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.118] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.118] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.118] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.118] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.118] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.118] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.118] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.119] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.119] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.119] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.119] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.119] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.119] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.119] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.119] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.119] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.119] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.119] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.119] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.119] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.119] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.119] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.119] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.120] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.120] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.120] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.120] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.120] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.120] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.120] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.120] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.120] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.160] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.160] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.160] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.160] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.160] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.160] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.160] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.161] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.161] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.161] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.161] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.161] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.161] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.161] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.161] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.161] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.161] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.161] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.161] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.161] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.161] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.161] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.161] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.162] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.162] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.162] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.162] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.162] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.162] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.162] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.162] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.162] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.163] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.163] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.163] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.163] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.163] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.163] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.163] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.163] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.163] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.164] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.164] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.164] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.164] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.164] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.164] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.164] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.164] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.164] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.164] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.164] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.164] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.164] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.164] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.164] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.164] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.165] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.165] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.165] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.165] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.165] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.165] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.166] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.166] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.166] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.166] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.166] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.166] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.166] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.166] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.166] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.166] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.166] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.166] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.167] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.167] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.167] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.167] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.167] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.167] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.167] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.167] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.167] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.167] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.167] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.167] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.167] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.167] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.168] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.168] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.168] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.168] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.168] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.168] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.168] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.168] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.168] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.168] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.168] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.168] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.168] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.168] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.168] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.168] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.169] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.169] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.169] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.169] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.169] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.169] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.169] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.169] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.169] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.169] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.169] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.169] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.169] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.169] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.169] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.170] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.170] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.170] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.170] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.170] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.170] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.170] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.170] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.170] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.170] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.170] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.170] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.170] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.170] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.170] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.171] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.171] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.171] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.171] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.171] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.171] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.171] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.171] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.171] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.171] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.171] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.171] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.171] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.171] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.171] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.172] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.172] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.172] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.172] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.172] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.172] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.172] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.172] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.172] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.172] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.172] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.172] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.172] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.172] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.172] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.173] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.173] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.173] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.173] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.173] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.173] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.173] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.173] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.173] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.173] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.173] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.173] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.173] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.173] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.173] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.174] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.174] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.174] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.174] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.174] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.174] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.174] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.174] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.174] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.174] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.174] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.174] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.175] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.175] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.175] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.175] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.175] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.175] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.175] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.175] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.175] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.175] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.175] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.175] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.175] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.176] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.176] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.176] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.176] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.176] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.176] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.176] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.176] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.177] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.177] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.177] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.177] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.177] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.177] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.177] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.177] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.177] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.177] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.177] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.177] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.177] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.177] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.177] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.177] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.178] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.178] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.178] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.178] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.178] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.178] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.178] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.178] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.178] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.178] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.178] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.178] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.178] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.178] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.178] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.178] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.178] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.179] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.179] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.179] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.179] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.179] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.179] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.179] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.179] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.179] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.179] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.179] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.179] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.179] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.179] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.179] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.179] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.179] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.179] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.180] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.180] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.180] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.180] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.180] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.180] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.180] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.180] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.180] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.180] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.180] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.180] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.180] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.180] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.180] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.180] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.181] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.181] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.181] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.181] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.181] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.181] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.181] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.181] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.181] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.181] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.181] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.181] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.181] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.181] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.181] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.181] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.181] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.182] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.182] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.182] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.182] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.182] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.182] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.182] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.182] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.182] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.182] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.182] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.182] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.182] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.182] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.182] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.182] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.182] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.183] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.183] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.183] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.183] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.183] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.183] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.183] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.183] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.183] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.183] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.183] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.183] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.183] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.183] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.183] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.183] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.183] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.184] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.184] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.184] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.184] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.184] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.184] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.184] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.184] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.184] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.184] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.184] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.184] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.184] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.184] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.184] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.184] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.185] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.185] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.185] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.185] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.185] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.185] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.185] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.185] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.185] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.185] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.185] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.185] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.185] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.185] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.185] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.185] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.185] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.186] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.186] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.186] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.186] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.186] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.186] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.186] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.186] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.186] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.186] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.186] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.186] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.186] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.186] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.186] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.186] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.186] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.187] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.187] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.187] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.187] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.187] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.187] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.187] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.187] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.187] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.187] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.187] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.187] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.187] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.187] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.187] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.187] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.188] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.188] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.188] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.188] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.188] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.188] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.188] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.188] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.188] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.188] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.188] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.188] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.188] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.188] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.188] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.188] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.188] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.189] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.189] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.189] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.189] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.189] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.189] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.189] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.189] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.189] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.189] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.189] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.189] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.189] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.189] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.189] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.189] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.189] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.190] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.190] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.190] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.190] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.190] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.190] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.190] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.190] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.190] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.190] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.199] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.199] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.199] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.199] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.199] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.199] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.199] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.199] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.199] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.199] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.199] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.199] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.199] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.200] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.200] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.200] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.200] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.200] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.200] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.200] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.200] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.200] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.200] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.200] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.200] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.200] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.818] lstrlenW (lpString="") returned 0
	[0150.818] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.859] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.859] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.859] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.859] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.859] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.859] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.859] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.859] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.859] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.859] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.860] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.860] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.860] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.860] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.860] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.860] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.860] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.860] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.860] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.860] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.860] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.860] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.860] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.860] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.860] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.860] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.860] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.861] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.861] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.861] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.861] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.861] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.861] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.861] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.861] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.861] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.861] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.861] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.861] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.861] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.861] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.861] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.862] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.862] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.862] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.862] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.862] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.862] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.862] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.862] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.862] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.862] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.862] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.862] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.862] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.862] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.862] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.863] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.863] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.863] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.863] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.863] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.863] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.863] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.863] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.863] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.863] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.863] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.863] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.863] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.863] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.863] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.863] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.864] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.864] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.864] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.864] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.864] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.864] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.864] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.864] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.864] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.864] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.864] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.864] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.864] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.864] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.864] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.864] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.865] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.865] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.865] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.865] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.865] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.865] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.865] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.865] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.865] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.865] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.865] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.865] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.865] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.865] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.865] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.865] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.865] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.866] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.866] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.866] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.866] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.866] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.866] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.866] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.866] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.866] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.866] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.866] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.866] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.866] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.866] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.866] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.866] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.867] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.867] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.867] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.867] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.867] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.867] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.867] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.867] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.867] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.867] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.867] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.867] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.867] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.867] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.867] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.867] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.868] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.868] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.868] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.868] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.868] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.868] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.868] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.868] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.868] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.868] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.868] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.868] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.868] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.868] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.868] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.868] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.868] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.869] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.869] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.869] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.869] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.869] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.869] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.869] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.869] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.869] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.869] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.869] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.869] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.869] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.869] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.869] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.870] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.870] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.870] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.870] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.870] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.870] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.870] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.870] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.870] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.870] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.870] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.870] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.870] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.870] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.870] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.870] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.871] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.871] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.871] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.871] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.871] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.871] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.871] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.871] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.871] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.871] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.871] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.871] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.871] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.871] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.871] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.872] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.872] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.872] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.872] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.872] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.872] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.872] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.872] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.872] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.872] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.872] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.872] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.872] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.872] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.873] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.873] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.873] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.873] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.873] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.873] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.873] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.873] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.873] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.873] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.873] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.873] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.873] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.873] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.873] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.873] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.874] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.874] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.874] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.874] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.874] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.874] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.874] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.874] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.874] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.874] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.874] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.874] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.874] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.874] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.874] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.874] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.875] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.875] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.875] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.875] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.875] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.875] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.875] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.875] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.875] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.875] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.875] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.875] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.875] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.875] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.875] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.875] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.875] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.876] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.876] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.876] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.876] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.876] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.876] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.876] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.876] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.876] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.876] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.876] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.876] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.876] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.876] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.876] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.876] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.877] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.877] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.877] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.877] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.877] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.877] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.877] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.877] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.877] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.877] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.877] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.877] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.877] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.877] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.877] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.877] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.878] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.878] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.878] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.878] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.878] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.878] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.878] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.878] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.878] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.878] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.878] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.878] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.878] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.878] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.878] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.878] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.879] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.879] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.879] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.879] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.879] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.879] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.879] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.879] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.879] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.879] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.879] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.879] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.879] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.879] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.879] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.879] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.880] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.880] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.880] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.880] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.880] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.880] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.880] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.880] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.880] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.880] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.880] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.880] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.880] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.880] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.880] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.880] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.881] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.881] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.881] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.881] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.881] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.881] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.881] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.881] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.881] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.881] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.881] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.881] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.881] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.881] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.881] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.881] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.882] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.882] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.882] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.882] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.882] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.882] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.882] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.882] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.882] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.882] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.882] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.882] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.882] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.882] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.882] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.882] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.883] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.883] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.883] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.883] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.883] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.883] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.883] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.883] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.883] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.883] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.883] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.883] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.883] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.883] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.884] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.884] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.884] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.884] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.884] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.884] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.884] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.884] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.884] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.884] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.884] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.884] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.884] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.884] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.884] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.884] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.885] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.885] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.885] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.885] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.885] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.885] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.885] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.885] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.885] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.885] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.885] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.885] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.885] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.885] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.885] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.885] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.885] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.886] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.886] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.886] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.886] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.886] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.886] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.886] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.886] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.886] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.886] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.886] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.886] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.886] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.886] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.886] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.886] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.886] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.887] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.887] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.887] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.887] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.887] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.887] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.887] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.887] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.887] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.887] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.887] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.887] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.887] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.887] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.887] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.888] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.888] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.888] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.888] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.888] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.888] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.888] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.888] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.888] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.888] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.888] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.888] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.888] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.888] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.888] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.888] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.889] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.889] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.889] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.889] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.889] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.889] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.889] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.889] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.889] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.889] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.889] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.889] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.889] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.889] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.889] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.889] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.890] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.890] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.890] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.890] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.890] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.890] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.890] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.890] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.890] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0150.890] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0150.980] VirtualProtect (in: lpAddress=0x4d28a0, dwSize=0x13b5f, flNewProtect=0x40, lpflOldProtect=0x19d2c0 | out: lpflOldProtect=0x19d2c0*=0x4) returned 1
	[0150.996] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x760c0000
	[0150.996] GetProcAddress (hModule=0x760c0000, lpProcName="GlobalAlloc") returned 0x760d5750
	[0150.996] GetProcAddress (hModule=0x760c0000, lpProcName="GetLastError") returned 0x760d5010
	[0150.996] GetProcAddress (hModule=0x760c0000, lpProcName="Sleep") returned 0x760d6760
	[0150.997] GetProcAddress (hModule=0x760c0000, lpProcName="VirtualAlloc") returned 0x760d6970
	[0150.997] GetProcAddress (hModule=0x760c0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7610edc0
	[0151.046] GetProcAddress (hModule=0x760c0000, lpProcName="Module32First") returned 0x7610fc90
	[0151.046] GetProcAddress (hModule=0x760c0000, lpProcName="CloseHandle") returned 0x7612eab0
	[0151.046] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0xe4
	[0151.048] Module32First (hSnapshot=0xe4, lpme=0x19cbe8) returned 1
	[0151.049] VirtualAlloc (lpAddress=0x0, dwSize=0x18050, flAllocationType=0x1000, flProtect=0x40) returned 0x1c0000
	[0151.053] GetProcAddress (hModule=0x760c0000, lpProcName="LoadLibraryA") returned 0x760d5a80
	[0151.053] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x760c0000
	[0151.053] GetProcAddress (hModule=0x760c0000, lpProcName="VirtualAlloc") returned 0x760d6970
	[0151.053] GetProcAddress (hModule=0x760c0000, lpProcName="VirtualProtect") returned 0x760d6a30
	[0151.053] GetProcAddress (hModule=0x760c0000, lpProcName="VirtualFree") returned 0x760d69d0
	[0151.053] GetProcAddress (hModule=0x760c0000, lpProcName="GetVersionExA") returned 0x760d56d0
	[0151.053] GetProcAddress (hModule=0x760c0000, lpProcName="TerminateProcess") returned 0x760d67e0
	[0151.053] GetProcAddress (hModule=0x760c0000, lpProcName="ExitProcess") returned 0x760d3cb0
	[0151.053] GetProcAddress (hModule=0x760c0000, lpProcName="SetErrorMode") returned 0x760d6500
	[0151.053] SetErrorMode (uMode=0x400) returned 0x0
	[0151.053] SetErrorMode (uMode=0x0) returned 0x400
	[0151.053] GetVersionExA (in: lpVersionInformation=0x19bb18*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x4ca958, dwBuildNumber=0x4cadc8, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19bb18*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0151.054] VirtualAlloc (lpAddress=0x0, dwSize=0x17200, flAllocationType=0x1000, flProtect=0x4) returned 0x490000
	[0151.055] VirtualProtect (in: lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x40, lpflOldProtect=0x19cba0 | out: lpflOldProtect=0x19cba0*=0x2) returned 1
	[0151.062] VirtualFree (lpAddress=0x490000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0151.062] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x760c0000
	[0151.063] GetProcAddress (hModule=0x760c0000, lpProcName="GetProcAddress") returned 0x760d51b0
	[0151.063] GetProcAddress (hModule=0x760c0000, lpProcName="LoadLibraryA") returned 0x760d5a80
	[0151.063] GetProcAddress (hModule=0x760c0000, lpProcName="WaitForSingleObject") returned 0x7612eca0
	[0151.063] GetProcAddress (hModule=0x760c0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7612ebb0
	[0151.063] GetProcAddress (hModule=0x760c0000, lpProcName="LeaveCriticalSection") returned 0x77a3b250
	[0151.063] GetProcAddress (hModule=0x760c0000, lpProcName="GetLastError") returned 0x760d5010
	[0151.063] GetProcAddress (hModule=0x760c0000, lpProcName="EnterCriticalSection") returned 0x77a3b2d0
	[0151.063] GetProcAddress (hModule=0x760c0000, lpProcName="ReleaseMutex") returned 0x7612ec20
	[0151.063] GetProcAddress (hModule=0x760c0000, lpProcName="CloseHandle") returned 0x7612eab0
	[0151.063] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74350000
	[0151.142] GetProcAddress (hModule=0x74350000, lpProcName="atexit") returned 0x7436c544
	[0151.142] atexit (param_1=0x1c0920) returned 0
	[0151.143] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x760c0000
	[0151.143] GetProcAddress (hModule=0x760c0000, lpProcName="GetProcAddress") returned 0x760d51b0
	[0151.143] GetProcAddress (hModule=0x760c0000, lpProcName="GetModuleHandleW") returned 0x760d50d0
	[0151.143] GetProcAddress (hModule=0x760c0000, lpProcName="FindNextFileW") returned 0x7612ee40
	[0151.143] GetProcAddress (hModule=0x760c0000, lpProcName="FindClose") returned 0x7612ed70
	[0151.143] GetProcAddress (hModule=0x760c0000, lpProcName="MoveFileW") returned 0x7610e500
	[0151.143] GetProcAddress (hModule=0x760c0000, lpProcName="GetFileSizeEx") returned 0x7612ef40
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="GetModuleFileNameW") returned 0x760d5090
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="GetFileAttributesW") returned 0x7612ef10
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="ExitProcess") returned 0x760d3cb0
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="GetCommandLineW") returned 0x760d4cc0
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="GetComputerNameW") returned 0x761032c0
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="GetComputerNameA") returned 0x76103780
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="CreateMutexW") returned 0x7612eb70
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="lstrlenW") returned 0x760d6c70
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="lstrlenA") returned 0x760d6c50
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="GetCurrentProcess") returned 0x7612ea10
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="WaitForSingleObject") returned 0x7612eca0
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="GetLogicalDrives") returned 0x760d0d20
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="GetTickCount") returned 0x7612dd50
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="DeleteFileW") returned 0x7612ed40
	[0151.144] GetProcAddress (hModule=0x760c0000, lpProcName="WideCharToMultiByte") returned 0x760d6b10
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7612ebb0
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="Sleep") returned 0x760d6760
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="LeaveCriticalSection") returned 0x77a3b250
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="ReadFile") returned 0x7612f090
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="CreateFileW") returned 0x7612ed10
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="OpenMutexW") returned 0x7612ebf0
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="EnterCriticalSection") returned 0x77a3b2d0
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="WaitForMultipleObjects") returned 0x7612ec80
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="lstrcmpiW") returned 0x760d6bf0
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="lstrcmpiA") returned 0x760d6bd0
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="DeleteCriticalSection") returned 0x77a1fb90
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="ReleaseMutex") returned 0x7612ec20
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="CloseHandle") returned 0x7612eab0
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="GetVersion") returned 0x760d56c0
	[0151.145] GetProcAddress (hModule=0x760c0000, lpProcName="CreateThread") returned 0x760d46b0
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="ExpandEnvironmentStringsW") returned 0x760d4a40
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="QueryPerformanceCounter") returned 0x760d5da0
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="QueryPerformanceFrequency") returned 0x760d5dc0
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="GetCurrentProcessId") returned 0x7612ea20
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="SetFileAttributesW") returned 0x7612f100
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="GetVolumeInformationW") returned 0x7612f020
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="WriteFile") returned 0x7612f180
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="SetFilePointerEx") returned 0x7612f130
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="SetEndOfFile") returned 0x7612f0e0
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="FindFirstFileW") returned 0x7612edf0
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="GetProcessHeap") returned 0x760d51f0
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="HeapReAlloc") returned 0x77a2f630
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="HeapAlloc") returned 0x77a32dc0
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="HeapFree") returned 0x760d57f0
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="CreatePipe") returned 0x760d4590
	[0151.146] GetProcAddress (hModule=0x760c0000, lpProcName="SetHandleInformation") returned 0x7612eae0
	[0151.147] GetProcAddress (hModule=0x760c0000, lpProcName="CreateProcessW") returned 0x760d4610
	[0151.147] GetProcAddress (hModule=0x760c0000, lpProcName="CompareStringW") returned 0x760d4430
	[0151.147] GetProcAddress (hModule=0x760c0000, lpProcName="CompareStringA") returned 0x760d4410
	[0151.147] GetProcAddress (hModule=0x760c0000, lpProcName="OpenProcess") returned 0x760d5cc0
	[0151.147] GetProcAddress (hModule=0x760c0000, lpProcName="TerminateProcess") returned 0x760d67e0
	[0151.147] GetProcAddress (hModule=0x760c0000, lpProcName="GetSystemTime") returned 0x760d54e0
	[0151.147] GetProcAddress (hModule=0x760c0000, lpProcName="SystemTimeToFileTime") returned 0x760d67a0
	[0151.147] GetProcAddress (hModule=0x760c0000, lpProcName="GetLastError") returned 0x760d5010
	[0151.147] GetProcAddress (hModule=0x760c0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7610edc0
	[0151.147] GetProcAddress (hModule=0x760c0000, lpProcName="Process32NextW") returned 0x7610f8f0
	[0151.147] GetProcAddress (hModule=0x760c0000, lpProcName="Process32FirstW") returned 0x7610f750
	[0151.147] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x774c0000
	[0151.147] GetProcAddress (hModule=0x774c0000, lpProcName="RegOpenKeyExW") returned 0x774de580
	[0151.147] GetProcAddress (hModule=0x774c0000, lpProcName="RegQueryValueExW") returned 0x774de5a0
	[0151.147] GetProcAddress (hModule=0x774c0000, lpProcName="RegSetValueExW") returned 0x774df530
	[0151.148] GetProcAddress (hModule=0x774c0000, lpProcName="RegCloseKey") returned 0x774ded60
	[0151.148] GetProcAddress (hModule=0x774c0000, lpProcName="OpenProcessToken") returned 0x774defb0
	[0151.148] GetProcAddress (hModule=0x774c0000, lpProcName="GetTokenInformation") returned 0x774dee90
	[0151.148] GetProcAddress (hModule=0x774c0000, lpProcName="OpenSCManagerW") returned 0x774e0540
	[0151.148] GetProcAddress (hModule=0x774c0000, lpProcName="OpenServiceW") returned 0x774dfa20
	[0151.148] GetProcAddress (hModule=0x774c0000, lpProcName="CloseServiceHandle") returned 0x774dfc00
	[0151.148] GetProcAddress (hModule=0x774c0000, lpProcName="ControlService") returned 0x774f26d0
	[0151.148] GetProcAddress (hModule=0x774c0000, lpProcName="QueryServiceStatus") returned 0x774e2380
	[0151.148] GetProcAddress (hModule=0x774c0000, lpProcName="EnumDependentServicesW") returned 0x774f2f70
	[0151.148] GetProcAddress (hModule=0x774c0000, lpProcName="EnumServicesStatusExW") returned 0x774dfc80
	[0151.148] LoadLibraryA (lpLibFileName="user32.dll") returned 0x775a0000
	[0151.817] GetProcAddress (hModule=0x775a0000, lpProcName="SystemParametersInfoW") returned 0x775cf210
	[0151.817] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x74b50000
	[0152.556] GetProcAddress (hModule=0x74b50000, lpProcName="ShellExecuteExW") returned 0x74cb4730
	[0152.556] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x779f0000
	[0152.556] GetProcAddress (hModule=0x779f0000, lpProcName="NtQuerySystemInformation") returned 0x77a62070
	[0152.556] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74330000
	[0152.568] GetProcAddress (hModule=0x74330000, lpProcName="WNetCloseEnum") returned 0x74332640
	[0152.568] GetProcAddress (hModule=0x74330000, lpProcName="WNetOpenEnumW") returned 0x74332790
	[0152.568] GetProcAddress (hModule=0x74330000, lpProcName="WNetEnumResourceW") returned 0x74332410
	[0152.568] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x778f0000
	[0152.586] GetProcAddress (hModule=0x778f0000, lpProcName="WSAStartup") returned 0x778f5b40
	[0152.587] GetProcAddress (hModule=0x778f0000, lpProcName="socket") returned 0x77904510
	[0152.587] GetProcAddress (hModule=0x778f0000, lpProcName="send") returned 0x778f5030
	[0152.587] GetProcAddress (hModule=0x778f0000, lpProcName="recv") returned 0x77900c50
	[0152.587] GetProcAddress (hModule=0x778f0000, lpProcName="connect") returned 0x778f5410
	[0152.587] GetProcAddress (hModule=0x778f0000, lpProcName="closesocket") returned 0x77900910
	[0152.587] GetProcAddress (hModule=0x778f0000, lpProcName="gethostbyname") returned 0x77926cb0
	[0152.587] GetProcAddress (hModule=0x778f0000, lpProcName="inet_addr") returned 0x77909160
	[0152.587] GetProcAddress (hModule=0x778f0000, lpProcName="ntohl") returned 0x778f49d0
	[0152.587] GetProcAddress (hModule=0x778f0000, lpProcName="htonl") returned 0x778f49d0
	[0152.587] GetProcAddress (hModule=0x778f0000, lpProcName="htons") returned 0x77908ff0
	[0152.587] GetProcessHeap () returned 0x4c0000
	[0152.588] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x4cb110
	[0152.588] QueryPerformanceCounter (in: lpPerformanceCount=0x19c9f0 | out: lpPerformanceCount=0x19c9f0*=6319629084) returned 1
	[0152.588] GetTickCount () returned 0x1139f34
	[0152.588] GetCurrentProcessId () returned 0xdb4
	[0152.589] GetTickCount () returned 0x1139f34
	[0152.589] GetTickCount () returned 0x1139f34
	[0152.589] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x4f25a0
	[0152.590] GetVersion () returned 0x23f00206
	[0152.590] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x7) returned 0x4eb198
	[0152.590] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4ec210
	[0152.590] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec210, Size=0x20) returned 0x4f23c0
	[0152.590] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f23c0, Size=0x40) returned 0x4ebe58
	[0152.590] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4f28c8
	[0152.601] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_B93J12A") returned 0x0
	[0152.601] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_B93J12A") returned 0x1f0
	[0152.601] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4eb198 | out: hHeap=0x4c0000) returned 1
	[0152.601] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0152.601] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ebe58 | out: hHeap=0x4c0000) returned 1
	[0152.601] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x7) returned 0x4eb198
	[0152.601] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4ec180
	[0152.601] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec180, Size=0x20) returned 0x4f23e8
	[0152.601] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f23e8, Size=0x40) returned 0x4ebdc8
	[0152.601] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x5028d0
	[0152.601] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_B93J12U") returned 0x0
	[0152.601] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_B93J12U") returned 0x1f4
	[0152.601] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4eb198 | out: hHeap=0x4c0000) returned 1
	[0152.601] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0152.601] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ebdc8 | out: hHeap=0x4c0000) returned 1
	[0152.602] GetVersion () returned 0x23f00206
	[0152.602] GetCurrentProcess () returned 0xffffffff
	[0152.602] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19c9dc | out: TokenHandle=0x19c9dc*=0x1f8) returned 1
	[0152.602] GetTokenInformation (in: TokenHandle=0x1f8, TokenInformationClass=0x14, TokenInformation=0x19c9d8, TokenInformationLength=0x4, ReturnLength=0x19c9e4 | out: TokenInformation=0x19c9d8, ReturnLength=0x19c9e4) returned 1
	[0152.602] CloseHandle (hObject=0x1f8) returned 1
	[0152.602] WaitForSingleObject (hHandle=0x1f4, dwMilliseconds=0x0) returned 0x0
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4ea8d0
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4ec378
	[0152.602] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec378, Size=0x20) returned 0x4f22f8
	[0152.602] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f22f8, Size=0x40) returned 0x4ebdc8
	[0152.602] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ebdc8, Size=0x80) returned 0x513070
	[0152.602] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x513070, Size=0x100) returned 0x4ebfc0
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x34) returned 0x4eec50
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4eb198
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4eb068
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4eb088
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4ec2b8
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4eb008
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4ec2d0
	[0152.602] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb008, Size=0x8) returned 0x4eb078
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4ec378
	[0152.602] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb078, Size=0x10) returned 0x4ec2a0
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4ec390
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4ec300
	[0152.602] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec2a0, Size=0x20) returned 0x4f2230
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4ec210
	[0152.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4ec168
	[0152.603] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb198, Size=0x8) returned 0x4eb008
	[0152.603] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb068, Size=0x8) returned 0x4eb0b8
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4eb198
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4ec2a0
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4eb0a8
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4ec318
	[0152.603] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb0a8, Size=0x8) returned 0x4eb068
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4ec3c0
	[0152.603] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb068, Size=0x10) returned 0x4ec180
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4ec3d8
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4eb068
	[0152.603] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec180, Size=0x20) returned 0x4f2398
	[0152.603] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb008, Size=0x10) returned 0x4ec228
	[0152.603] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb0b8, Size=0x10) returned 0x4ec330
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4eb008
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4ec120
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4eb078
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4ec180
	[0152.603] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb078, Size=0x8) returned 0x4eb0a8
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4eb078
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4ec198
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4eb0b8
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4ec4c8
	[0152.603] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb0b8, Size=0x8) returned 0x4ec668
	[0152.603] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec228, Size=0x20) returned 0x4f22a8
	[0152.603] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec330, Size=0x20) returned 0x4f2280
	[0152.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec708
	[0152.604] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4ec330
	[0152.604] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec6c8
	[0152.604] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4ec228
	[0152.604] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec6c8, Size=0x8) returned 0x4ec568
	[0152.604] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4ea7b0
	[0152.604] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4eaa90
	[0152.604] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0152.604] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ebfc0 | out: hHeap=0x4c0000) returned 1
	[0152.604] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19ca28 | out: lpWSAData=0x19ca28) returned 0
	[0152.608] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4ec4e0
	[0152.608] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec4e0, Size=0x20) returned 0x4f2258
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2258, Size=0x40) returned 0x4ebea0
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ebea0, Size=0x80) returned 0x512d40
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x512d40, Size=0x100) returned 0x4ebfc0
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4ec420
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec420, Size=0x20) returned 0x4f2208
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2208, Size=0x40) returned 0x4eb828
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb828, Size=0x80) returned 0x513318
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x513318, Size=0x100) returned 0x517fd0
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4ec4e0
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec548
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4ec438
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec548, Size=0x8) returned 0x4ec588
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4eaab0
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec588, Size=0x10) returned 0x4ec480
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x18) returned 0x4ea850
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1a) returned 0x4f22d0
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec480, Size=0x20) returned 0x4f2348
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c) returned 0x4f2168
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x16) returned 0x4ea8f0
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1a) returned 0x4f25c8
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4ec4b0
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec678
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40) returned 0x4ebdc8
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec678, Size=0x8) returned 0x4ec5d8
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x3c) returned 0x4eb870
	[0152.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec5d8, Size=0x10) returned 0x4ec450
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4eaad0
	[0152.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x18) returned 0x4ea9d0
	[0152.610] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec450, Size=0x20) returned 0x4f2258
	[0152.610] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x24) returned 0x4eabf0
	[0152.610] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0152.610] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ebfc0 | out: hHeap=0x4c0000) returned 1
	[0152.610] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0152.610] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x517fd0 | out: hHeap=0x4c0000) returned 1
	[0152.610] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4f23c0
	[0152.679] EnumServicesStatusExW (in: hSCManager=0x4f23c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19c9c4, lpServicesReturned=0x19c9dc, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19c9c4, lpServicesReturned=0x19c9dc, lpResumeHandle=0x0) returned 0
	[0152.686] GetLastError () returned 0xea
	[0152.686] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1bb2) returned 0x51a650
	[0152.686] EnumServicesStatusExW (in: hSCManager=0x4f23c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x51a650, cbBufSize=0x1bb2, pcbBytesNeeded=0x19c9c4, lpServicesReturned=0x19c9dc, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x51a650, pcbBytesNeeded=0x19c9c4, lpServicesReturned=0x19c9dc, lpResumeHandle=0x0) returned 1
	[0152.687] CloseServiceHandle (hSCObject=0x4f23c0) returned 1
	[0152.687] lstrlenW (lpString="AppXSvc") returned 7
	[0152.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0152.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0152.697] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0152.697] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0152.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0152.697] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0152.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0152.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0152.697] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0152.697] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0152.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0152.697] lstrlenW (lpString="Audiosrv") returned 8
	[0152.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0152.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0152.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0152.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0152.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0152.697] lstrlenW (lpString="BFE") returned 3
	[0152.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0152.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0152.697] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0152.698] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0152.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0152.698] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0152.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0152.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0152.698] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0152.698] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0152.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0152.698] lstrlenW (lpString="CDPSvc") returned 6
	[0152.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0152.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0152.698] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0152.698] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0152.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0152.698] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0152.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0152.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0152.698] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0152.698] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0152.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0152.698] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0152.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0152.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0152.698] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0152.698] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0152.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0152.698] lstrlenW (lpString="CryptSvc") returned 8
	[0152.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0152.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0152.698] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0152.699] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0152.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0152.699] lstrlenW (lpString="DcomLaunch") returned 10
	[0152.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0152.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0152.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0152.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0152.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0152.699] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0152.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0152.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0152.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0152.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0152.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0152.699] lstrlenW (lpString="Dhcp") returned 4
	[0152.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0152.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0152.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0152.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0152.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0152.699] lstrlenW (lpString="Dnscache") returned 8
	[0152.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0152.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0152.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0152.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0152.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0152.699] lstrlenW (lpString="DPS") returned 3
	[0152.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0152.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0152.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0152.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0152.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0152.699] lstrlenW (lpString="DsmSvc") returned 6
	[0152.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0152.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0152.700] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0152.700] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0152.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0152.700] lstrlenW (lpString="DusmSvc") returned 7
	[0152.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0152.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0152.700] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0152.700] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0152.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0152.700] lstrlenW (lpString="EventLog") returned 8
	[0152.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0152.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0152.700] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0152.700] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0152.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0152.700] lstrlenW (lpString="EventSystem") returned 11
	[0152.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0152.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0152.700] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0152.700] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0152.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0152.700] lstrlenW (lpString="FontCache") returned 9
	[0152.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0152.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0152.700] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0152.700] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0152.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0152.700] lstrlenW (lpString="gpsvc") returned 5
	[0152.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0152.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0152.701] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0152.701] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0152.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0152.701] lstrlenW (lpString="iphlpsvc") returned 8
	[0152.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0152.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0152.701] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0152.701] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0152.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0152.701] lstrlenW (lpString="KeyIso") returned 6
	[0152.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0152.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0152.701] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0152.701] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0152.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0152.701] lstrlenW (lpString="LanmanServer") returned 12
	[0152.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0152.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0152.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0152.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0152.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0152.701] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0152.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0152.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0152.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0152.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0152.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0152.701] lstrlenW (lpString="lfsvc") returned 5
	[0152.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0152.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0152.701] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0152.702] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0152.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0152.702] lstrlenW (lpString="lmhosts") returned 7
	[0152.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0152.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0152.702] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0152.702] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0152.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0152.702] lstrlenW (lpString="LSM") returned 3
	[0152.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0152.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0152.702] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0152.702] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0152.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0152.702] lstrlenW (lpString="MpsSvc") returned 6
	[0152.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0152.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0152.702] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0152.702] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0152.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0152.702] lstrlenW (lpString="NcbService") returned 10
	[0152.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0152.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0152.702] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0152.702] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0152.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0152.702] lstrlenW (lpString="netprofm") returned 8
	[0152.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0152.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0152.702] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0152.702] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0152.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0152.702] lstrlenW (lpString="NgcSvc") returned 6
	[0152.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0152.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0152.703] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0152.703] lstrlenW (lpString="NlaSvc") returned 6
	[0152.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0152.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0152.703] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0152.703] lstrlenW (lpString="nsi") returned 3
	[0152.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0152.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0152.703] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0152.703] lstrlenW (lpString="PcaSvc") returned 6
	[0152.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0152.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0152.703] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0152.703] lstrlenW (lpString="PlugPlay") returned 8
	[0152.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0152.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0152.703] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0152.703] lstrlenW (lpString="Power") returned 5
	[0152.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0152.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0152.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0152.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0152.703] lstrlenW (lpString="ProfSvc") returned 7
	[0152.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0152.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0152.704] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0152.704] lstrlenW (lpString="RpcEptMapper") returned 12
	[0152.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0152.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0152.704] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0152.704] lstrlenW (lpString="RpcSs") returned 5
	[0152.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0152.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0152.704] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0152.704] lstrlenW (lpString="SamSs") returned 5
	[0152.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0152.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0152.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0152.704] lstrlenW (lpString="Schedule") returned 8
	[0152.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0152.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0152.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0152.704] lstrlenW (lpString="SecurityHealthService") returned 21
	[0152.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0152.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0152.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0152.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0152.705] lstrlenW (lpString="SENS") returned 4
	[0152.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0152.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0152.705] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0152.705] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0152.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0152.705] lstrlenW (lpString="ShellHWDetection") returned 16
	[0152.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0152.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0152.705] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0152.705] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0152.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0152.705] lstrlenW (lpString="Spooler") returned 7
	[0152.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0152.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0152.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0152.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0152.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0152.705] lstrlenW (lpString="StateRepository") returned 15
	[0152.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0152.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0152.705] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0152.705] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0152.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0152.705] lstrlenW (lpString="SysMain") returned 7
	[0152.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0152.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0152.705] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0152.705] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0152.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0152.705] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0152.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0152.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0152.706] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0152.706] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0152.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0152.706] lstrlenW (lpString="Themes") returned 6
	[0152.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0152.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0152.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0152.706] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0152.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0152.706] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0152.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0152.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0152.706] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0152.706] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0152.706] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51a650 | out: hHeap=0x4c0000) returned 1
	[0152.706] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x244
	[0152.714] Process32FirstW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0152.714] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0152.715] lstrlenW (lpString="System") returned 6
	[0152.715] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0152.715] lstrlenW (lpString="smss.exe") returned 8
	[0152.715] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0152.716] lstrlenW (lpString="csrss.exe") returned 9
	[0152.716] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0152.716] lstrlenW (lpString="wininit.exe") returned 11
	[0152.716] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0152.716] lstrlenW (lpString="csrss.exe") returned 9
	[0152.717] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0152.717] lstrlenW (lpString="winlogon.exe") returned 12
	[0152.717] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0152.717] lstrlenW (lpString="services.exe") returned 12
	[0152.717] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0152.718] lstrlenW (lpString="lsass.exe") returned 9
	[0152.718] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0152.718] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0152.718] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0152.718] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0152.719] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.719] lstrlenW (lpString="svchost.exe") returned 11
	[0152.719] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.719] lstrlenW (lpString="svchost.exe") returned 11
	[0152.719] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0152.720] lstrlenW (lpString="dwm.exe") returned 7
	[0152.720] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.720] lstrlenW (lpString="svchost.exe") returned 11
	[0152.720] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.721] lstrlenW (lpString="svchost.exe") returned 11
	[0152.721] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.721] lstrlenW (lpString="svchost.exe") returned 11
	[0152.721] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.721] lstrlenW (lpString="svchost.exe") returned 11
	[0152.721] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.722] lstrlenW (lpString="svchost.exe") returned 11
	[0152.722] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.722] lstrlenW (lpString="svchost.exe") returned 11
	[0152.722] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.723] lstrlenW (lpString="svchost.exe") returned 11
	[0152.723] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.723] lstrlenW (lpString="svchost.exe") returned 11
	[0152.723] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.723] lstrlenW (lpString="svchost.exe") returned 11
	[0152.723] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.724] lstrlenW (lpString="svchost.exe") returned 11
	[0152.724] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0152.724] lstrlenW (lpString="spoolsv.exe") returned 11
	[0152.724] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.725] lstrlenW (lpString="svchost.exe") returned 11
	[0152.725] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0152.725] lstrlenW (lpString="audiodg.exe") returned 11
	[0152.725] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0152.725] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0152.725] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0152.726] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0152.726] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0152.726] lstrlenW (lpString="sihost.exe") returned 10
	[0152.726] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0152.727] lstrlenW (lpString="Memory Compression") returned 18
	[0152.727] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0152.727] lstrlenW (lpString="svchost.exe") returned 11
	[0152.727] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0152.727] lstrlenW (lpString="msoia.exe") returned 9
	[0152.727] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0152.728] lstrlenW (lpString="taskhostw.exe") returned 13
	[0152.728] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0152.728] lstrlenW (lpString="explorer.exe") returned 12
	[0152.728] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0152.729] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0152.729] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0152.729] lstrlenW (lpString="SearchUI.exe") returned 12
	[0152.729] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0152.730] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0152.730] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0152.730] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0152.730] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0152.730] lstrlenW (lpString="d2.exe") returned 6
	[0152.730] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0152.731] lstrlenW (lpString="d2.exe") returned 6
	[0152.731] Process32NextW (in: hSnapshot=0x244, lppe=0x19c7b4 | out: lppe=0x19c7b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0152.763] CloseHandle (hObject=0x244) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ebdc8 | out: hHeap=0x4c0000) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4eb870 | out: hHeap=0x4c0000) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4eaad0 | out: hHeap=0x4c0000) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ea9d0 | out: hHeap=0x4c0000) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4eabf0 | out: hHeap=0x4c0000) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ec438 | out: hHeap=0x4c0000) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4eaab0 | out: hHeap=0x4c0000) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ea850 | out: hHeap=0x4c0000) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f22d0 | out: hHeap=0x4c0000) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2168 | out: hHeap=0x4c0000) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ea8f0 | out: hHeap=0x4c0000) returned 1
	[0152.764] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f25c8 | out: hHeap=0x4c0000) returned 1
	[0152.764] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x51a5e8
	[0152.764] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x52a5f0
	[0152.765] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5188e8
	[0152.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5188e8, Size=0x20) returned 0x4f2208
	[0152.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2208, Size=0x40) returned 0x4eb828
	[0152.765] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5187c8
	[0152.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5187c8, Size=0x20) returned 0x4f2528
	[0152.765] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518948
	[0152.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518948, Size=0x20) returned 0x4f23c0
	[0152.765] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518888
	[0152.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518888, Size=0x20) returned 0x4f23e8
	[0152.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f23e8, Size=0x40) returned 0x4eb870
	[0152.765] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x52a5f0, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe")) returned 0x43
	[0152.765] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x53a5f8
	[0152.765] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x54a600
	[0152.766] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518a38
	[0152.766] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518a38, Size=0x20) returned 0x4f23e8
	[0152.766] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f23e8, Size=0x40) returned 0x4ebdc8
	[0152.766] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ebdc8, Size=0x80) returned 0x5133a0
	[0152.766] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5133a0, Size=0x100) returned 0x5185d0
	[0152.766] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0152.766] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5185d0 | out: hHeap=0x4c0000) returned 1
	[0152.766] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\d2.exe", lpDst=0x53a5f8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\d2.exe") returned 0x1b
	[0152.766] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54a600 | out: hHeap=0x4c0000) returned 1
	[0152.766] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53a5f8 | out: hHeap=0x4c0000) returned 1
	[0152.767] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x25a3020
	[0152.769] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518900
	[0152.769] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518900, Size=0x20) returned 0x4f23e8
	[0152.770] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518870
	[0152.770] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518870, Size=0x20) returned 0x4f2460
	[0152.770] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0152.770] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0152.770] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x0) returned 1
	[0152.770] lstrlenW (lpString="kernel32.dll") returned 12
	[0152.770] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f23e8 | out: hHeap=0x4c0000) returned 1
	[0152.770] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0152.770] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2460 | out: hHeap=0x4c0000) returned 1
	[0152.770] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0152.770] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\d2.exe" (normalized: "c:\\windows\\system32\\d2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0152.771] CloseHandle (hObject=0x244) returned 1
	[0152.771] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5189f0
	[0152.771] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5189f0, Size=0x20) returned 0x4f2410
	[0152.771] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518888
	[0152.771] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518888, Size=0x20) returned 0x4f22d0
	[0152.771] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0152.771] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0152.772] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0152.772] lstrlenW (lpString="kernel32.dll") returned 12
	[0152.772] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f22d0 | out: hHeap=0x4c0000) returned 1
	[0152.772] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0152.772] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2410 | out: hHeap=0x4c0000) returned 1
	[0152.772] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x25a3020 | out: hHeap=0x4c0000) returned 1
	[0152.774] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x53a5f8
	[0152.774] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x54a600
	[0152.775] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518a50
	[0152.775] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518a50, Size=0x20) returned 0x4f23e8
	[0152.775] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f23e8, Size=0x40) returned 0x4eb8b8
	[0152.775] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb8b8, Size=0x80) returned 0x512a10
	[0152.775] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x512a10, Size=0x100) returned 0x5185d0
	[0152.775] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0152.775] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5185d0 | out: hHeap=0x4c0000) returned 1
	[0152.775] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\d2.exe", lpDst=0x53a5f8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\d2.exe") returned 0x27
	[0152.775] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54a600 | out: hHeap=0x4c0000) returned 1
	[0152.775] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53a5f8 | out: hHeap=0x4c0000) returned 1
	[0152.776] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x25a4020
	[0152.779] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518828
	[0152.779] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518828, Size=0x20) returned 0x4f2190
	[0152.779] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518a38
	[0152.779] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518a38, Size=0x20) returned 0x4f21e0
	[0152.779] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0152.779] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0152.779] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0152.779] lstrlenW (lpString="kernel32.dll") returned 12
	[0152.779] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2190 | out: hHeap=0x4c0000) returned 1
	[0152.779] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0152.779] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f21e0 | out: hHeap=0x4c0000) returned 1
	[0152.779] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0152.780] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\d2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\d2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0152.789] ReadFile (in: hFile=0x244, lpBuffer=0x25a4020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x25a4020*, lpNumberOfBytesRead=0x19c9d0*=0x3ee00, lpOverlapped=0x0) returned 1
	[0152.946] WriteFile (in: hFile=0x248, lpBuffer=0x25a4020*, nNumberOfBytesToWrite=0x3ee00, lpNumberOfBytesWritten=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x25a4020*, lpNumberOfBytesWritten=0x19c9d0*=0x3ee00, lpOverlapped=0x0) returned 1
	[0152.970] ReadFile (in: hFile=0x244, lpBuffer=0x25a4020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19c9d0, lpOverlapped=0x0 | out: lpBuffer=0x25a4020*, lpNumberOfBytesRead=0x19c9d0*=0x0, lpOverlapped=0x0) returned 1
	[0152.970] CloseHandle (hObject=0x248) returned 1
	[0152.970] CloseHandle (hObject=0x244) returned 1
	[0152.970] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5188e8
	[0152.970] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5188e8, Size=0x20) returned 0x4f2460
	[0152.970] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518828
	[0152.970] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518828, Size=0x20) returned 0x4f2320
	[0152.970] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0152.971] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0152.971] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0152.971] lstrlenW (lpString="kernel32.dll") returned 12
	[0152.971] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2320 | out: hHeap=0x4c0000) returned 1
	[0152.971] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0152.971] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2460 | out: hHeap=0x4c0000) returned 1
	[0152.971] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x25a4020 | out: hHeap=0x4c0000) returned 1
	[0152.975] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5187b0
	[0152.975] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5187b0, Size=0x20) returned 0x4f2320
	[0152.975] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2320, Size=0x40) returned 0x4ebdc8
	[0152.975] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ebdc8, Size=0x80) returned 0x5134b0
	[0152.975] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\d2.exe") returned 38
	[0152.975] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0152.976] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x5c) returned 0x5185d0
	[0152.976] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19c9a4 | out: phkResult=0x19c9a4*=0x244) returned 0x0
	[0152.976] RegSetValueExW (hKey=0x244, lpValueName="d2.exe", Reserved=0x0, dwType=0x1, lpData=0x51a5e8, cbData=0x4c) returned 0x5
	[0152.976] RegCloseKey (hKey=0x244) returned 0x0
	[0152.976] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5185d0 | out: hHeap=0x4c0000) returned 1
	[0152.976] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\d2.exe") returned 38
	[0152.976] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0152.976] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x5c) returned 0x5185d0
	[0152.976] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19c9a4 | out: phkResult=0x19c9a4*=0x248) returned 0x0
	[0152.977] RegSetValueExW (in: hKey=0x248, lpValueName="d2.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\d2.exe", cbData=0x4c | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\d2.exe") returned 0x0
	[0152.977] RegCloseKey (hKey=0x248) returned 0x0
	[0152.977] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5185d0 | out: hHeap=0x4c0000) returned 1
	[0152.977] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0152.977] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5134b0 | out: hHeap=0x4c0000) returned 1
	[0152.977] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x53a5f8
	[0152.978] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x54a600
	[0152.978] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518858
	[0152.978] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518858, Size=0x20) returned 0x4f2320
	[0152.978] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2320, Size=0x40) returned 0x4eb8b8
	[0152.978] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb8b8, Size=0x80) returned 0x513538
	[0152.978] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x513538, Size=0x100) returned 0x5185d0
	[0152.978] lstrlenW (lpString="") returned 0
	[0152.978] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0152.978] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8c) returned 0x518fe8
	[0152.978] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19c950 | out: phkResult=0x19c950*=0x248) returned 0x0
	[0152.978] RegQueryValueExW (in: hKey=0x248, lpValueName="Startup", lpReserved=0x0, lpType=0x19c95c, lpData=0x54a600, lpcbData=0x19c988*=0x7fff | out: lpType=0x19c95c*=0x0, lpData=0x54a600*=0x53, lpcbData=0x19c988*=0x7fff) returned 0x2
	[0152.978] RegCloseKey (hKey=0x248) returned 0x0
	[0152.978] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x518fe8 | out: hHeap=0x4c0000) returned 1
	[0152.978] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0152.978] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8c) returned 0x518fe8
	[0152.978] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19c950 | out: phkResult=0x19c950*=0x248) returned 0x0
	[0152.979] RegQueryValueExW (in: hKey=0x248, lpValueName="Startup", lpReserved=0x0, lpType=0x19c95c, lpData=0x54a600, lpcbData=0x19c988*=0x7fff | out: lpType=0x19c95c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19c988*=0x98) returned 0x0
	[0152.979] RegCloseKey (hKey=0x248) returned 0x0
	[0152.979] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x518fe8 | out: hHeap=0x4c0000) returned 1
	[0152.979] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0152.979] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0152.979] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5185d0 | out: hHeap=0x4c0000) returned 1
	[0152.979] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", lpDst=0x53a5f8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe") returned 0x55
	[0152.979] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54a600 | out: hHeap=0x4c0000) returned 1
	[0152.979] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53a5f8 | out: hHeap=0x4c0000) returned 1
	[0152.980] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x25af020
	[0152.982] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518a50
	[0152.983] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518a50, Size=0x20) returned 0x4f25c8
	[0152.983] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518798
	[0152.983] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518798, Size=0x20) returned 0x4f2460
	[0152.983] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0152.983] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0152.983] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0152.983] lstrlenW (lpString="kernel32.dll") returned 12
	[0152.983] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f25c8 | out: hHeap=0x4c0000) returned 1
	[0152.983] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0152.983] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2460 | out: hHeap=0x4c0000) returned 1
	[0152.983] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0152.983] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0152.983] CloseHandle (hObject=0x248) returned 1
	[0152.983] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518780
	[0152.983] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518780, Size=0x20) returned 0x4f2140
	[0152.983] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518a50
	[0152.983] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518a50, Size=0x20) returned 0x4f20f0
	[0152.983] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0152.984] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0152.984] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0152.984] lstrlenW (lpString="kernel32.dll") returned 12
	[0152.984] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f20f0 | out: hHeap=0x4c0000) returned 1
	[0152.984] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0152.984] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2140 | out: hHeap=0x4c0000) returned 1
	[0152.984] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x25af020 | out: hHeap=0x4c0000) returned 1
	[0152.986] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x53a5f8
	[0152.986] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x54a600
	[0152.987] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518a38
	[0152.987] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518a38, Size=0x20) returned 0x4f2140
	[0152.987] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2140, Size=0x40) returned 0x4ebea0
	[0152.987] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ebea0, Size=0x80) returned 0x512900
	[0152.987] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x512900, Size=0x100) returned 0x5185d0
	[0152.987] lstrlenW (lpString="") returned 0
	[0152.987] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0152.987] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8c) returned 0x518fe8
	[0152.987] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19c950 | out: phkResult=0x19c950*=0x248) returned 0x0
	[0152.987] RegQueryValueExW (in: hKey=0x248, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19c95c, lpData=0x54a600, lpcbData=0x19c988*=0x7fff | out: lpType=0x19c95c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19c988*=0x78) returned 0x0
	[0152.987] RegCloseKey (hKey=0x248) returned 0x0
	[0152.987] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x518fe8 | out: hHeap=0x4c0000) returned 1
	[0152.987] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0152.987] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0152.987] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5185d0 | out: hHeap=0x4c0000) returned 1
	[0152.987] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", lpDst=0x53a5f8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe") returned 0x44
	[0152.987] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54a600 | out: hHeap=0x4c0000) returned 1
	[0152.987] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53a5f8 | out: hHeap=0x4c0000) returned 1
	[0152.988] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x25ae020
	[0152.990] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518828
	[0152.991] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518828, Size=0x20) returned 0x4f2118
	[0152.991] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518a20
	[0152.991] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518a20, Size=0x20) returned 0x4f22d0
	[0152.991] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0152.991] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0152.991] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0152.991] lstrlenW (lpString="kernel32.dll") returned 12
	[0152.991] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2118 | out: hHeap=0x4c0000) returned 1
	[0152.991] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0152.991] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f22d0 | out: hHeap=0x4c0000) returned 1
	[0152.991] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0152.991] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0152.991] CloseHandle (hObject=0x248) returned 1
	[0152.991] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5189c0
	[0152.991] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5189c0, Size=0x20) returned 0x4f23e8
	[0152.991] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518918
	[0152.991] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518918, Size=0x20) returned 0x4f22d0
	[0152.991] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0152.992] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0152.992] Wow64DisableWow64FsRedirection (in: OldValue=0x19c9d4 | out: OldValue=0x19c9d4*=0x1) returned 1
	[0152.992] lstrlenW (lpString="kernel32.dll") returned 12
	[0152.992] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f22d0 | out: hHeap=0x4c0000) returned 1
	[0152.992] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0152.992] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f23e8 | out: hHeap=0x4c0000) returned 1
	[0152.992] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x25ae020 | out: hHeap=0x4c0000) returned 1
	[0152.994] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51a5e8 | out: hHeap=0x4c0000) returned 1
	[0152.994] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52a5f0 | out: hHeap=0x4c0000) returned 1
	[0152.996] lstrlenW (lpString="%windir%\\System32") returned 17
	[0152.996] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4eb828 | out: hHeap=0x4c0000) returned 1
	[0152.996] lstrlenW (lpString="%appdata%") returned 9
	[0152.996] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2528 | out: hHeap=0x4c0000) returned 1
	[0152.996] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0152.996] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f23c0 | out: hHeap=0x4c0000) returned 1
	[0152.996] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0152.996] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4eb870 | out: hHeap=0x4c0000) returned 1
	[0152.996] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5189d8
	[0152.996] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5189d8, Size=0x20) returned 0x4f22d0
	[0152.996] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f22d0, Size=0x40) returned 0x4ebdc8
	[0152.996] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ebdc8, Size=0x80) returned 0x513318
	[0152.996] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518828
	[0152.996] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518828, Size=0x20) returned 0x4f23c0
	[0152.996] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1fffc) returned 0x51a5e8
	[0153.002] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x53a5f0
	[0153.002] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x54a5f8
	[0153.002] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5189d8
	[0153.002] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5189d8, Size=0x20) returned 0x4f25c8
	[0153.002] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f25c8, Size=0x40) returned 0x4eba20
	[0153.002] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eba20, Size=0x80) returned 0x512ba8
	[0153.002] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x512ba8, Size=0x100) returned 0x5185d0
	[0153.002] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0153.002] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5185d0 | out: hHeap=0x4c0000) returned 1
	[0153.002] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x53a5f0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0153.002] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54a5f8 | out: hHeap=0x4c0000) returned 1
	[0153.003] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53a5f0 | out: hHeap=0x4c0000) returned 1
	[0153.004] CreatePipe (in: hReadPipe=0x19c990, hWritePipe=0x19c994, lpPipeAttributes=0x19c980, nSize=0x0 | out: hReadPipe=0x19c990*=0x24c, hWritePipe=0x19c994*=0x250) returned 1
	[0153.005] CreatePipe (in: hReadPipe=0x19ca00, hWritePipe=0x19ca04, lpPipeAttributes=0x19c980, nSize=0x0 | out: hReadPipe=0x19ca00*=0x254, hWritePipe=0x19ca04*=0x258) returned 1
	[0153.005] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1
	[0153.006] SetHandleInformation (hObject=0x254, dwMask=0x1, dwFlags=0x0) returned 1
	[0153.006] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19c9a0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x24c, hStdOutput=0x258, hStdError=0x258), lpProcessInformation=0x19c9f0 | out: lpCommandLine=0x0, lpProcessInformation=0x19c9f0*(hProcess=0x260, hThread=0x25c, dwProcessId=0xde0, dwThreadId=0xde4)) returned 1
	[0153.063] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0153.063] WriteFile (in: hFile=0x250, lpBuffer=0x513318*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19c99c, lpOverlapped=0x0 | out: lpBuffer=0x513318*, lpNumberOfBytesWritten=0x19c99c*=0x41, lpOverlapped=0x0) returned 1
	[0153.063] CloseHandle (hObject=0x260) returned 1
	[0153.063] CloseHandle (hObject=0x25c) returned 1
	[0153.064] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51a5e8 | out: hHeap=0x4c0000) returned 1
	[0153.064] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0153.064] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x513318 | out: hHeap=0x4c0000) returned 1
	[0153.064] lstrlenW (lpString="%comspec%") returned 9
	[0153.064] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f23c0 | out: hHeap=0x4c0000) returned 1
	[0153.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0153.064] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x5188a0
	[0153.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5188a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260
	[0153.065] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec548
	[0153.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x4ec548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268
	[0153.066] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518798
	[0153.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518798, Size=0x20) returned 0x4f23c0
	[0153.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f23c0, Size=0x40) returned 0x4eb828
	[0153.066] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0153.066] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xd0) returned 0x4f02b8
	[0153.066] GetLogicalDrives () returned 0x4
	[0153.066] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10014) returned 0x51a5e8
	[0153.066] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518918
	[0153.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518918, Size=0x20) returned 0x4f23c0
	[0153.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f23c0, Size=0x40) returned 0x4eba20
	[0153.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eba20, Size=0x80) returned 0x5135c0
	[0153.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5135c0, Size=0x100) returned 0x518fe8
	[0153.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518fe8, Size=0x200) returned 0x518fe8
	[0153.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518fe8, Size=0x400) returned 0x52a608
	[0153.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52a608, Size=0x800) returned 0x52a608
	[0153.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52a608, Size=0x1000) returned 0x52a608
	[0153.066] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x52b610
	[0153.066] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x518900
	[0153.066] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x518930
	[0153.066] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec6f8
	[0153.066] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x5188b8
	[0153.066] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec528
	[0153.066] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518948
	[0153.067] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec528, Size=0x8) returned 0x4ec618
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518798
	[0153.067] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec618, Size=0x10) returned 0x5187b0
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518960
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5189c0
	[0153.067] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5187b0, Size=0x20) returned 0x4f22d0
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518a20
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec588
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x518978
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x518990
	[0153.067] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f22d0, Size=0x40) returned 0x4eb900
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x518858
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x5187b0
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x518828
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x518870
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5188d0
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5188e8
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec6d8
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5189d8
	[0153.067] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eb900, Size=0x80) returned 0x512cb8
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518918
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518a68
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518780
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5189f0
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5189a8
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x518a08
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5187c8
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec688
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518a38
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518a50
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x518ab0
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518ac8
	[0153.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x518ae0
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518af8
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x518b10
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518b28
	[0153.068] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x512cb8, Size=0x100) returned 0x518fe8
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518b40
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518a80
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x518a98
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4ec438
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4ec468
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bbb8
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec5e8
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bbd0
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bac8
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bc00
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x4ec558
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b9a8
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bb10
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec608
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bb28
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bae0
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53bbe8
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bc18
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b9c0
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53ba38
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53bb58
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b960
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53bba0
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b948
	[0153.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53baf8
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bc30
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53ba08
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec6e8
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53ba20
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b978
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b9f0
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b990
	[0153.069] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518fe8, Size=0x200) returned 0x518fe8
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bb40
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec718
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b9d8
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53ba50
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53ba68
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53ba80
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bb70
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53ba98
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bab0
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bb88
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bc78
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53bcc0
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53bdf8
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bd98
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bd68
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53bd38
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53bcd8
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bc48
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53bcf0
	[0153.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53bc60
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bdc8
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bd08
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bd20
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec528
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bc90
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bd80
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bd50
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec578
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bdb0
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53bde0
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53bca8
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b7e0
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b8d0
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b918
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b690
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b798
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53b750
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53b738
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b840
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b708
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b7c8
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53b7f8
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b678
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b930
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b780
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b810
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b768
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b828
	[0153.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b8b8
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec5a8
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x4ec5d8
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b660
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b7b0
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b648
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b858
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b720
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53b870
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b888
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b8a0
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b8e8
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b900
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53b6a8
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b6c0
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b6d8
	[0153.071] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x518fe8, Size=0x400) returned 0x53be20
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53b6f0
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c960
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53c930
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c8e8
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c9f0
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c870
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53c8d0
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c948
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c978
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c990
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec5f8
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c9a8
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53c900
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c9c0
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c918
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c9d8
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53ca08
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53c888
	[0153.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c858
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c8a0
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c8b8
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c3c0
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c2b8
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c3d8
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c300
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c4e0
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec618
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c4f8
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c420
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c3f0
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c360
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c408
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c258
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c510
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c438
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c450
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53c468
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c480
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53c498
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c348
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c4b0
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c288
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c4c8
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c528
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53c378
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c390
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c540
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c270
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c2a0
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c2d0
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c2e8
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c318
	[0153.072] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c330
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c3a8
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c6c0
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c768
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c600
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c6a8
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c588
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c6d8
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c6f0
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c7b0
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53c660
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x12) returned 0x4ea850
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c708
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c810
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c7c8
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c630
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c828
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c840
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c570
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c780
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c558
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c5a0
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c5b8
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c5d0
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c5e8
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c618
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c798
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c648
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c678
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c690
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c7f8
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53c720
	[0153.073] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53c7e0
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53c738
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53c750
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53cd00
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53cb08
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec628
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53cc28
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec638
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53ccb8
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53cd30
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53cb20
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53caf0
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53cc88
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53cca0
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53cd48
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53cac0
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53cb80
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53cbc8
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53cb98
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53ca90
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53ca78
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53cbe0
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec648
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53cb50
	[0153.074] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53cbf8
	[0153.074] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53be20, Size=0x800) returned 0x53d238
	[0153.210] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52a608 | out: hHeap=0x4c0000) returned 1
	[0153.223] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53ded8 | out: hHeap=0x4c0000) returned 1
	[0153.228] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec6f8, Size=0x8) returned 0x4ec828
	[0153.228] lstrlenW (lpString=".money") returned 6
	[0153.235] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53df08 | out: hHeap=0x4c0000) returned 1
	[0153.238] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53ddb8, Size=0x20) returned 0x4f23e8
	[0153.238] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f23e8, Size=0x40) returned 0x4ebc18
	[0153.243] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ebc18, Size=0x80) returned 0x512dc8
	[0153.246] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec6f8, Size=0x8) returned 0x4ec7c8
	[0153.246] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec7c8, Size=0x10) returned 0x53df20
	[0153.246] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53df20, Size=0x20) returned 0x4f2410
	[0153.246] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x512dc8 | out: hHeap=0x4c0000) returned 1
	[0153.246] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53de78, Size=0x20) returned 0x4f2488
	[0153.246] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2488, Size=0x40) returned 0x4eb990
	[0153.246] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0153.246] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4eb990 | out: hHeap=0x4c0000) returned 1
	[0153.246] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53dd88, Size=0x20) returned 0x4f2118
	[0153.246] lstrlenW (lpString="Info.hta") returned 8
	[0153.246] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2118 | out: hHeap=0x4c0000) returned 1
	[0153.247] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x551a20, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe")) returned 0x43
	[0153.247] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x551a20 | out: hHeap=0x4c0000) returned 1
	[0153.247] lstrlenW (lpString="d2.exe") returned 6
	[0153.247] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2410, Size=0x40) returned 0x4eb990
	[0153.247] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53de30, Size=0x20) returned 0x4f2410
	[0153.247] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53dfb0, Size=0x20) returned 0x4f2488
	[0153.247] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2488, Size=0x40) returned 0x4eba20
	[0153.247] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eba20, Size=0x80) returned 0x513290
	[0153.247] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x513290, Size=0x100) returned 0x53c030
	[0153.247] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0153.247] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53c030 | out: hHeap=0x4c0000) returned 1
	[0153.247] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x551a20, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0153.248] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x561a28 | out: hHeap=0x4c0000) returned 1
	[0153.248] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x551a20 | out: hHeap=0x4c0000) returned 1
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53dd70
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec7c8
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x16) returned 0x4eaad0
	[0153.249] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec7c8, Size=0x8) returned 0x4ec888
	[0153.249] lstrlenW (lpString="%windir%;") returned 9
	[0153.249] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2410 | out: hHeap=0x4c0000) returned 1
	[0153.249] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0153.249] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52b610 | out: hHeap=0x4c0000) returned 1
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53dfb0
	[0153.249] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53dfb0, Size=0x20) returned 0x4f2410
	[0153.249] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2410, Size=0x40) returned 0x4eba20
	[0153.249] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eba20, Size=0x80) returned 0x512fe8
	[0153.249] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x512fe8, Size=0x100) returned 0x53c030
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x34) returned 0x4ef1d0
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec8e8
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec748
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec7c8
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53df20
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec838
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53df38
	[0153.249] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec838, Size=0x8) returned 0x4ec738
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53dfe0
	[0153.249] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec738, Size=0x10) returned 0x53dea8
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e010
	[0153.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53dec0
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53dea8, Size=0x20) returned 0x4f2410
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53de30
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53ddb8
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec8e8, Size=0x8) returned 0x4ec878
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec748, Size=0x8) returned 0x4ec788
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec798
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53ded8
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec7f8
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53df50
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec7f8, Size=0x8) returned 0x4ec808
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e028
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec808, Size=0x10) returned 0x53ddd0
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e058
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec848
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53ddd0, Size=0x20) returned 0x4f2488
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec878, Size=0x10) returned 0x53de78
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec788, Size=0x10) returned 0x53df68
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec738
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53dd88
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec858
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53dfb0
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec858, Size=0x8) returned 0x4ec898
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec838
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53ddd0
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec7f8
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53dde8
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec7f8, Size=0x8) returned 0x4ec768
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53de78, Size=0x20) returned 0x4f2500
	[0153.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53df68, Size=0x20) returned 0x4f24b0
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec7f8
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53de60
	[0153.250] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec748
	[0153.251] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53df68
	[0153.251] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec748, Size=0x8) returned 0x4ec8d8
	[0153.251] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4ea9b0
	[0153.251] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4ea3b0
	[0153.251] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0153.251] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53c030 | out: hHeap=0x4c0000) returned 1
	[0153.251] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x80) returned 0x512b20
	[0153.251] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec8e8
	[0153.251] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53de00
	[0153.251] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53de00, Size=0x20) returned 0x4f2528
	[0153.251] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xd0) returned 0x4f06f0
	[0153.251] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x52a860
	[0153.251] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x52a860, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0153.251] lstrlenW (lpString="C:\\") returned 3
	[0153.251] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19c8e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19c8e4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0153.252] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52a860 | out: hHeap=0x4c0000) returned 1
	[0153.252] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4ead40
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53de00
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec808
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4ea510
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53de18
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x80) returned 0x512e50
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53de48
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x82) returned 0x53c030
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53de78
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec748
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53de90
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x80) returned 0x512d40
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53dea8
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x2) returned 0x4ec758
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec818
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53e1a8
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x80) returned 0x512900
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53e088
	[0153.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec788
	[0153.253] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec758, Size=0x82) returned 0x53c0c0
	[0153.253] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec788, Size=0x100) returned 0x52a860
	[0153.254] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53e070
	[0153.254] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x82) returned 0x53c150
	[0153.254] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53e0a0
	[0153.254] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x82) returned 0x52a968
	[0153.254] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53c0c0, Size=0x104) returned 0x52a9f8
	[0153.254] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52a860, Size=0x200) returned 0x52ab08
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ec818 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52ab08 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53e088 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x512d40 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53de90 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x512900 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53e1a8 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52a9f8 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53dea8 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53c150 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53e070 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52a968 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53e0a0 | out: hHeap=0x4c0000) returned 1
	[0153.255] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x4ec788
	[0153.255] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53e1a8
	[0153.255] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53e1a8, Size=0x20) returned 0x4f2118
	[0153.255] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2118, Size=0x40) returned 0x4ebc18
	[0153.255] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53e070
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ec808 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53de00 | out: hHeap=0x4c0000) returned 1
	[0153.255] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53c030 | out: hHeap=0x4c0000) returned 1
	[0153.256] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53de48 | out: hHeap=0x4c0000) returned 1
	[0153.256] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x512e50 | out: hHeap=0x4c0000) returned 1
	[0153.256] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53de18 | out: hHeap=0x4c0000) returned 1
	[0153.256] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ec748 | out: hHeap=0x4c0000) returned 1
	[0153.256] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53de78 | out: hHeap=0x4c0000) returned 1
	[0153.256] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ead40 | out: hHeap=0x4c0000) returned 1
	[0153.256] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ea510 | out: hHeap=0x4c0000) returned 1
	[0153.256] lstrlenW (lpString="%systemdrive%") returned 13
	[0153.256] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2528 | out: hHeap=0x4c0000) returned 1
	[0153.256] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x512b20 | out: hHeap=0x4c0000) returned 1
	[0153.256] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ec8e8 | out: hHeap=0x4c0000) returned 1
	[0153.256] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x2c) returned 0x4f1f08
	[0153.256] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x2000) returned 0x52a860
	[0153.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x51a5e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c
	[0153.256] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10014) returned 0x551a20
	[0153.257] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53de78
	[0153.257] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53de78, Size=0x20) returned 0x4f2528
	[0153.257] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2528, Size=0x40) returned 0x4eba20
	[0153.257] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eba20, Size=0x80) returned 0x513290
	[0153.257] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x513290, Size=0x100) returned 0x53c030
	[0153.257] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53c030, Size=0x200) returned 0x52c868
	[0153.257] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52c868, Size=0x400) returned 0x52c868
	[0153.257] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52c868, Size=0x800) returned 0x52c868
	[0153.257] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52c868, Size=0x1000) returned 0x52c868
	[0153.257] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x561a40
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53de48
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53de00
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec8e8
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53de18
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec8a8
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53de78
	[0153.258] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec8e8, Size=0x8) returned 0x4ec858
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53de90
	[0153.258] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec858, Size=0x10) returned 0x53dea8
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e0e8
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e0d0
	[0153.258] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53dea8, Size=0x20) returned 0x4f2528
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53dea8
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec748
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53e0b8
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53e130
	[0153.258] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2528, Size=0x40) returned 0x4eba20
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53e148
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53e0a0
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53e100
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53e160
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e208
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e118
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec858
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e178
	[0153.258] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eba20, Size=0x80) returned 0x512ba8
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e1f0
	[0153.258] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e190
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e1a8
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e220
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e1c0
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53e088
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53e1d8
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec878
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551260
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551278
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x551410
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5514a0
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x551368
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551290
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x5514e8
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551518
	[0153.259] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x512ba8, Size=0x100) returned 0x53c030
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551500
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551530
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551248
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5512a8
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5512c0
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551308
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec818
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551320
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5512d8
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5512f0
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x4ec808
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551350
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551338
	[0153.259] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec758
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551380
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551398
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x5513b0
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5513c8
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551458
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5513e0
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x5513f8
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551428
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x551440
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551470
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5515f0
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551740
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5516f8
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec8b8
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5517b8
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551758
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551548
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5517a0
	[0153.260] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53c030, Size=0x200) returned 0x571a48
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5517d0
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec8c8
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5517e8
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551668
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551800
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5516c8
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551818
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551590
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5515a8
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551710
	[0153.260] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551698
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x551728
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x5516e0
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551830
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551560
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x5515c0
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x551638
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551770
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x551578
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x5515d8
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551608
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551788
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551620
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec8e8
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551650
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551680
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5516b0
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4ec6f8
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551848
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x551980
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5519e0
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551878
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5518a8
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5518c0
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5519f8
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551950
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x5518d8
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x5518f0
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551938
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551890
	[0153.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551908
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x551860
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551920
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551968
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x551998
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5519b0
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x5519c8
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f240
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f420
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4eb0b8
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x571dc0
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f438
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f2d0
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f228
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f3a8
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f2b8
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53f2e8
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f360
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f318
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f3f0
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f150
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53f198
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f2a0
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f258
	[0153.262] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571a48, Size=0x400) returned 0x572058
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f288
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f348
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53f210
	[0153.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f330
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f378
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f180
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53f168
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f390
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f408
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f1c8
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x571d80
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f1e0
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53f1f8
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f468
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f480
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f588
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f720
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53f5b8
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f510
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f600
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f690
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f660
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f5d0
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f630
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f450
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f528
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x571ca0
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f678
	[0153.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f6a8
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f618
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f648
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f5e8
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f558
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f738
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f498
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f540
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53f6c0
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f6d8
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x53f6f0
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f4b0
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f708
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f5a0
	[0153.264] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x53f4c8
	[0153.264] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x572058, Size=0x800) returned 0x572058
	[0153.265] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52c868 | out: hHeap=0x4c0000) returned 1
	[0153.265] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52dd60 | out: hHeap=0x4c0000) returned 1
	[0153.265] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52dd18 | out: hHeap=0x4c0000) returned 1
	[0153.265] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52dd18, Size=0x20) returned 0x4f21b8
	[0153.265] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f21b8, Size=0x40) returned 0x4eba20
	[0153.265] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eba20, Size=0x80) returned 0x513758
	[0153.265] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571e30, Size=0x8) returned 0x571d00
	[0153.265] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571d00, Size=0x10) returned 0x52dd18
	[0153.265] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52dd18, Size=0x20) returned 0x4f20f0
	[0153.265] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x513758 | out: hHeap=0x4c0000) returned 1
	[0153.265] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e090, Size=0x20) returned 0x4f2578
	[0153.265] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2578, Size=0x40) returned 0x4eba20
	[0153.265] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0153.265] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4eba20 | out: hHeap=0x4c0000) returned 1
	[0153.265] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e0c0, Size=0x20) returned 0x4f2208
	[0153.265] lstrlenW (lpString="Info.hta") returned 8
	[0153.266] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2208 | out: hHeap=0x4c0000) returned 1
	[0153.267] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x572860, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe")) returned 0x43
	[0153.267] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x572860 | out: hHeap=0x4c0000) returned 1
	[0153.267] lstrlenW (lpString="d2.exe") returned 6
	[0153.267] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f20f0, Size=0x40) returned 0x4eba20
	[0153.267] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e090, Size=0x20) returned 0x4f20f0
	[0153.268] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e030, Size=0x20) returned 0x4f2578
	[0153.268] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2578, Size=0x40) returned 0x4eba68
	[0153.268] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eba68, Size=0x80) returned 0x513070
	[0153.268] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x513070, Size=0x100) returned 0x53c030
	[0153.268] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0153.268] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53c030 | out: hHeap=0x4c0000) returned 1
	[0153.268] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x572860, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0153.268] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x582868 | out: hHeap=0x4c0000) returned 1
	[0153.269] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x572860 | out: hHeap=0x4c0000) returned 1
	[0153.269] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571de0, Size=0x8) returned 0x571e30
	[0153.269] lstrlenW (lpString="%windir%;") returned 9
	[0153.269] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f20f0 | out: hHeap=0x4c0000) returned 1
	[0153.270] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0153.270] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x561a40 | out: hHeap=0x4c0000) returned 1
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e180, Size=0x20) returned 0x4f2168
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2168, Size=0x40) returned 0x4eba68
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eba68, Size=0x80) returned 0x512e50
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x512e50, Size=0x100) returned 0x52cba8
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571de0, Size=0x8) returned 0x571e00
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571e00, Size=0x10) returned 0x52df10
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52df10, Size=0x20) returned 0x4f2578
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571db0, Size=0x8) returned 0x571d00
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571cc0, Size=0x8) returned 0x571db0
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571de0, Size=0x8) returned 0x571c80
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571c80, Size=0x10) returned 0x52df10
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52df10, Size=0x20) returned 0x4f20f0
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571d00, Size=0x10) returned 0x52e078
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571db0, Size=0x10) returned 0x52e060
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571cc0, Size=0x8) returned 0x571db0
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571c80, Size=0x8) returned 0x571d60
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e078, Size=0x20) returned 0x4f2118
	[0153.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e060, Size=0x20) returned 0x4f2140
	[0153.271] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571cc0, Size=0x8) returned 0x571cd0
	[0153.271] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0153.271] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52cba8 | out: hHeap=0x4c0000) returned 1
	[0153.271] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52df58, Size=0x20) returned 0x4f2168
	[0153.271] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x561a40, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0153.271] lstrlenW (lpString="C:\\") returned 3
	[0153.271] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19c8e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19c8e4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0153.271] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x561a40 | out: hHeap=0x4c0000) returned 1
	[0153.271] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571e60, Size=0x82) returned 0x53c0c0
	[0153.272] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x571d20, Size=0x100) returned 0x52d700
	[0153.272] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53c0c0, Size=0x104) returned 0x52e908
	[0153.272] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52d700, Size=0x200) returned 0x52ea18
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x571cc0 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52ea18 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52e000 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x513180 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52e150 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x513290 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52e168 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52e908 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52dfd0 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53c150 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52df10 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52e878 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52df28 | out: hHeap=0x4c0000) returned 1
	[0153.273] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52df10, Size=0x20) returned 0x4f2190
	[0153.273] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2190, Size=0x40) returned 0x4eba68
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x571e40 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52e060 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53c030 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52e078 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5136d0 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52deb0 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x571e50 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52e138 | out: hHeap=0x4c0000) returned 1
	[0153.273] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ead70 | out: hHeap=0x4c0000) returned 1
	[0153.274] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ea530 | out: hHeap=0x4c0000) returned 1
	[0153.274] lstrlenW (lpString="%systemdrive%") returned 13
	[0153.274] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2168 | out: hHeap=0x4c0000) returned 1
	[0153.274] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x512b20 | out: hHeap=0x4c0000) returned 1
	[0153.274] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x571e20 | out: hHeap=0x4c0000) returned 1
	[0153.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x551a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278
	[0153.274] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4f02b8*=0x27c, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 30
	os_tid = 0xdbc


Thread:
	id = 34
	os_tid = 0xde8

	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53e488
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53e488, Size=0x20) returned 0x4f2320
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f2320, Size=0x40) returned 0x4eba68
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4eba68, Size=0x80) returned 0x512f60
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x512f60, Size=0x100) returned 0x5191f8
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53e350
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53e350, Size=0x20) returned 0x4f24d8
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f24d8, Size=0x40) returned 0x4ebea0
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ebea0, Size=0x80) returned 0x512cb8
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x512cb8, Size=0x100) returned 0x53be20
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53e380
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec738
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53e278
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec738, Size=0x8) returned 0x4ec8a8
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4ea810
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec8a8, Size=0x10) returned 0x53e518
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x18) returned 0x4ea8f0
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1a) returned 0x4f2460
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53e518, Size=0x20) returned 0x4f2320
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c) returned 0x4f23c0
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x16) returned 0x4ea930
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1a) returned 0x4f22d0
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x53e3e0
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4ec798
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40) returned 0x4ebdc8
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec798, Size=0x8) returned 0x4ec838
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x3c) returned 0x4eb870
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ec838, Size=0x10) returned 0x53e518
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4ea9f0
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x18) returned 0x4ea730
	[0153.185] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53e518, Size=0x20) returned 0x4f24d8
	[0153.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x24) returned 0x4eabc0
	[0153.186] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0153.186] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5191f8 | out: hHeap=0x4c0000) returned 1
	[0153.186] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0153.186] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53be20 | out: hHeap=0x4c0000) returned 1
	[0153.186] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4f2500
	[0153.186] EnumServicesStatusExW (in: hSCManager=0x4f2500, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0153.187] GetLastError () returned 0xea
	[0153.187] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1bb2) returned 0x53f338
	[0153.187] EnumServicesStatusExW (in: hSCManager=0x4f2500, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x53f338, cbBufSize=0x1bb2, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x53f338, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0153.187] CloseServiceHandle (hSCObject=0x4f2500) returned 1
	[0153.188] lstrlenW (lpString="AppXSvc") returned 7
	[0153.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0153.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0153.188] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0153.188] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0153.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0153.188] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0153.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0153.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0153.188] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0153.188] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0153.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0153.188] lstrlenW (lpString="Audiosrv") returned 8
	[0153.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0153.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0153.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0153.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0153.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0153.188] lstrlenW (lpString="BFE") returned 3
	[0153.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0153.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0153.188] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0153.188] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0153.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0153.188] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0153.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0153.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0153.188] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0153.189] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0153.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0153.189] lstrlenW (lpString="CDPSvc") returned 6
	[0153.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0153.189] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0153.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0153.189] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0153.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0153.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0153.189] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0153.189] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0153.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0153.189] lstrlenW (lpString="CryptSvc") returned 8
	[0153.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0153.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0153.189] lstrlenW (lpString="DcomLaunch") returned 10
	[0153.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0153.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0153.189] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0153.189] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0153.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0153.190] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0153.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0153.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0153.190] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0153.190] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0153.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0153.190] lstrlenW (lpString="Dhcp") returned 4
	[0153.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0153.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0153.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0153.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0153.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0153.190] lstrlenW (lpString="Dnscache") returned 8
	[0153.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0153.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0153.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0153.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0153.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0153.190] lstrlenW (lpString="DPS") returned 3
	[0153.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0153.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0153.190] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0153.190] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0153.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0153.190] lstrlenW (lpString="DsmSvc") returned 6
	[0153.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0153.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0153.190] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0153.190] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0153.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0153.190] lstrlenW (lpString="DusmSvc") returned 7
	[0153.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0153.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0153.191] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0153.191] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0153.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0153.191] lstrlenW (lpString="EventLog") returned 8
	[0153.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0153.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0153.191] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0153.191] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0153.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0153.191] lstrlenW (lpString="EventSystem") returned 11
	[0153.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0153.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0153.191] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0153.191] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0153.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0153.191] lstrlenW (lpString="FontCache") returned 9
	[0153.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0153.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0153.191] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0153.191] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0153.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0153.191] lstrlenW (lpString="gpsvc") returned 5
	[0153.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0153.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0153.191] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0153.191] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0153.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0153.191] lstrlenW (lpString="iphlpsvc") returned 8
	[0153.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0153.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0153.191] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0153.191] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0153.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0153.192] lstrlenW (lpString="KeyIso") returned 6
	[0153.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0153.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0153.192] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0153.192] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0153.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0153.192] lstrlenW (lpString="LanmanServer") returned 12
	[0153.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0153.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0153.192] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0153.192] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0153.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0153.192] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0153.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0153.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0153.192] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0153.192] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0153.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0153.192] lstrlenW (lpString="lfsvc") returned 5
	[0153.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0153.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0153.192] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0153.192] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0153.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0153.192] lstrlenW (lpString="lmhosts") returned 7
	[0153.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0153.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0153.192] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0153.192] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0153.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0153.192] lstrlenW (lpString="LSM") returned 3
	[0153.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0153.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0153.193] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0153.193] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0153.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0153.193] lstrlenW (lpString="MpsSvc") returned 6
	[0153.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0153.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0153.193] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0153.193] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0153.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0153.193] lstrlenW (lpString="NcbService") returned 10
	[0153.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0153.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0153.193] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0153.193] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0153.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0153.193] lstrlenW (lpString="netprofm") returned 8
	[0153.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0153.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0153.193] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0153.193] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0153.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0153.193] lstrlenW (lpString="NgcSvc") returned 6
	[0153.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0153.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0153.193] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0153.193] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0153.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0153.193] lstrlenW (lpString="NlaSvc") returned 6
	[0153.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0153.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0153.193] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0153.193] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0153.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0153.194] lstrlenW (lpString="nsi") returned 3
	[0153.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0153.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0153.194] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0153.194] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0153.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0153.194] lstrlenW (lpString="PcaSvc") returned 6
	[0153.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0153.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0153.194] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0153.194] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0153.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0153.194] lstrlenW (lpString="PlugPlay") returned 8
	[0153.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0153.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0153.194] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0153.194] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0153.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0153.194] lstrlenW (lpString="Power") returned 5
	[0153.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0153.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0153.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0153.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0153.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0153.194] lstrlenW (lpString="ProfSvc") returned 7
	[0153.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0153.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0153.194] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0153.194] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0153.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0153.194] lstrlenW (lpString="RpcEptMapper") returned 12
	[0153.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0153.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0153.195] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0153.195] lstrlenW (lpString="RpcSs") returned 5
	[0153.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0153.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0153.195] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0153.195] lstrlenW (lpString="SamSs") returned 5
	[0153.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0153.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0153.195] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0153.195] lstrlenW (lpString="Schedule") returned 8
	[0153.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0153.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0153.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0153.195] lstrlenW (lpString="SecurityHealthService") returned 21
	[0153.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0153.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0153.195] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0153.195] lstrlenW (lpString="SENS") returned 4
	[0153.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0153.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0153.195] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0153.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0153.195] lstrlenW (lpString="ShellHWDetection") returned 16
	[0153.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0153.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0153.196] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0153.196] lstrlenW (lpString="Spooler") returned 7
	[0153.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0153.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0153.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0153.196] lstrlenW (lpString="StateRepository") returned 15
	[0153.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0153.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0153.196] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0153.196] lstrlenW (lpString="SysMain") returned 7
	[0153.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0153.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0153.196] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0153.196] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0153.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0153.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0153.196] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0153.196] lstrlenW (lpString="Themes") returned 6
	[0153.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0153.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0153.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0153.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0153.197] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0153.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0153.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0153.197] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0153.197] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0153.197] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53f338 | out: hHeap=0x4c0000) returned 1
	[0153.197] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280
	[0153.385] Process32FirstW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0153.385] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0153.385] lstrlenW (lpString="System") returned 6
	[0153.386] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0153.386] lstrlenW (lpString="smss.exe") returned 8
	[0153.386] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0153.386] lstrlenW (lpString="csrss.exe") returned 9
	[0153.386] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0153.387] lstrlenW (lpString="wininit.exe") returned 11
	[0153.387] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0153.387] lstrlenW (lpString="csrss.exe") returned 9
	[0153.387] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0153.388] lstrlenW (lpString="winlogon.exe") returned 12
	[0153.388] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0153.388] lstrlenW (lpString="services.exe") returned 12
	[0153.388] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0153.389] lstrlenW (lpString="lsass.exe") returned 9
	[0153.389] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0153.389] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0153.389] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0153.389] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0153.390] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.390] lstrlenW (lpString="svchost.exe") returned 11
	[0153.390] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.390] lstrlenW (lpString="svchost.exe") returned 11
	[0153.390] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0153.391] lstrlenW (lpString="dwm.exe") returned 7
	[0153.391] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.391] lstrlenW (lpString="svchost.exe") returned 11
	[0153.391] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.391] lstrlenW (lpString="svchost.exe") returned 11
	[0153.392] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.392] lstrlenW (lpString="svchost.exe") returned 11
	[0153.392] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.392] lstrlenW (lpString="svchost.exe") returned 11
	[0153.392] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.393] lstrlenW (lpString="svchost.exe") returned 11
	[0153.393] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.393] lstrlenW (lpString="svchost.exe") returned 11
	[0153.393] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.394] lstrlenW (lpString="svchost.exe") returned 11
	[0153.394] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.394] lstrlenW (lpString="svchost.exe") returned 11
	[0153.394] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.394] lstrlenW (lpString="svchost.exe") returned 11
	[0153.394] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.395] lstrlenW (lpString="svchost.exe") returned 11
	[0153.395] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0153.395] lstrlenW (lpString="spoolsv.exe") returned 11
	[0153.395] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.396] lstrlenW (lpString="svchost.exe") returned 11
	[0153.396] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0153.396] lstrlenW (lpString="audiodg.exe") returned 11
	[0153.396] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0153.396] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0153.396] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0153.397] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0153.397] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0153.397] lstrlenW (lpString="sihost.exe") returned 10
	[0153.397] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0153.398] lstrlenW (lpString="Memory Compression") returned 18
	[0153.398] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.398] lstrlenW (lpString="svchost.exe") returned 11
	[0153.398] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0153.398] lstrlenW (lpString="msoia.exe") returned 9
	[0153.399] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0153.399] lstrlenW (lpString="taskhostw.exe") returned 13
	[0153.399] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0153.399] lstrlenW (lpString="explorer.exe") returned 12
	[0153.399] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0153.400] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0153.400] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0153.400] lstrlenW (lpString="SearchUI.exe") returned 12
	[0153.400] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0153.401] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0153.401] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0153.401] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0153.401] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0153.401] lstrlenW (lpString="d2.exe") returned 6
	[0153.401] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0153.402] lstrlenW (lpString="cmd.exe") returned 7
	[0153.402] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0153.402] lstrlenW (lpString="conhost.exe") returned 11
	[0153.402] Process32NextW (in: hSnapshot=0x280, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0153.403] CloseHandle (hObject=0x280) returned 1
	[0153.403] Sleep (dwMilliseconds=0x1f4) 
	[0154.211] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4f26e0
	[0154.211] EnumServicesStatusExW (in: hSCManager=0x4f26e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0154.212] GetLastError () returned 0xea
	[0154.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c28) returned 0x4493348
	[0154.212] EnumServicesStatusExW (in: hSCManager=0x4f26e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4493348, cbBufSize=0x1c28, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4493348, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0154.212] CloseServiceHandle (hSCObject=0x4f26e0) returned 1
	[0154.213] lstrlenW (lpString="AppXSvc") returned 7
	[0154.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0154.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0154.213] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0154.213] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0154.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0154.213] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0154.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0154.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0154.213] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0154.213] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0154.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0154.213] lstrlenW (lpString="Audiosrv") returned 8
	[0154.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0154.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0154.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0154.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0154.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0154.213] lstrlenW (lpString="BFE") returned 3
	[0154.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0154.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0154.213] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0154.213] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0154.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0154.213] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0154.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0154.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0154.214] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0154.214] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0154.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0154.214] lstrlenW (lpString="CDPSvc") returned 6
	[0154.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0154.214] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0154.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0154.214] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0154.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0154.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0154.214] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0154.214] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0154.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0154.214] lstrlenW (lpString="CryptSvc") returned 8
	[0154.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0154.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0154.214] lstrlenW (lpString="DcomLaunch") returned 10
	[0154.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0154.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0154.215] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0154.215] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0154.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0154.215] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0154.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0154.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0154.215] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0154.215] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0154.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0154.215] lstrlenW (lpString="Dhcp") returned 4
	[0154.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0154.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0154.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0154.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0154.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0154.215] lstrlenW (lpString="Dnscache") returned 8
	[0154.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0154.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0154.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0154.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0154.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0154.215] lstrlenW (lpString="DPS") returned 3
	[0154.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0154.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0154.215] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0154.215] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0154.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0154.222] lstrlenW (lpString="DsmSvc") returned 6
	[0154.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0154.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0154.223] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0154.223] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0154.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0154.223] lstrlenW (lpString="DusmSvc") returned 7
	[0154.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0154.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0154.223] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0154.223] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0154.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0154.223] lstrlenW (lpString="EventLog") returned 8
	[0154.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0154.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0154.223] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0154.223] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0154.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0154.223] lstrlenW (lpString="EventSystem") returned 11
	[0154.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0154.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0154.223] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0154.223] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0154.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0154.223] lstrlenW (lpString="FontCache") returned 9
	[0154.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0154.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0154.223] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0154.223] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0154.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0154.223] lstrlenW (lpString="gpsvc") returned 5
	[0154.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0154.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0154.224] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0154.224] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0154.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0154.224] lstrlenW (lpString="iphlpsvc") returned 8
	[0154.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0154.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0154.224] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0154.224] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0154.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0154.224] lstrlenW (lpString="KeyIso") returned 6
	[0154.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0154.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0154.224] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0154.224] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0154.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0154.224] lstrlenW (lpString="LanmanServer") returned 12
	[0154.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0154.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0154.224] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0154.224] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0154.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0154.224] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0154.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0154.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0154.224] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0154.224] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0154.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0154.225] lstrlenW (lpString="lfsvc") returned 5
	[0154.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0154.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0154.225] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0154.225] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0154.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0154.225] lstrlenW (lpString="lmhosts") returned 7
	[0154.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0154.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0154.225] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0154.225] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0154.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0154.225] lstrlenW (lpString="LSM") returned 3
	[0154.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0154.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0154.225] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0154.225] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0154.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0154.225] lstrlenW (lpString="MpsSvc") returned 6
	[0154.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0154.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0154.225] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0154.225] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0154.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0154.225] lstrlenW (lpString="NcbService") returned 10
	[0154.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0154.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0154.225] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0154.226] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0154.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0154.226] lstrlenW (lpString="netprofm") returned 8
	[0154.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0154.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0154.226] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0154.226] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0154.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0154.226] lstrlenW (lpString="NgcSvc") returned 6
	[0154.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0154.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0154.226] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0154.226] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0154.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0154.226] lstrlenW (lpString="NlaSvc") returned 6
	[0154.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0154.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0154.226] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0154.226] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0154.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0154.226] lstrlenW (lpString="nsi") returned 3
	[0154.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0154.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0154.226] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0154.226] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0154.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0154.226] lstrlenW (lpString="PcaSvc") returned 6
	[0154.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0154.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0154.227] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0154.227] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0154.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0154.227] lstrlenW (lpString="PlugPlay") returned 8
	[0154.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0154.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0154.227] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0154.227] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0154.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0154.227] lstrlenW (lpString="Power") returned 5
	[0154.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0154.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0154.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0154.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0154.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0154.227] lstrlenW (lpString="ProfSvc") returned 7
	[0154.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0154.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0154.227] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0154.227] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0154.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0154.227] lstrlenW (lpString="RpcEptMapper") returned 12
	[0154.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0154.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0154.227] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0154.227] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0154.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0154.227] lstrlenW (lpString="RpcSs") returned 5
	[0154.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0154.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0154.228] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0154.228] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0154.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0154.228] lstrlenW (lpString="SamSs") returned 5
	[0154.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0154.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0154.228] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0154.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0154.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0154.228] lstrlenW (lpString="Schedule") returned 8
	[0154.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0154.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0154.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0154.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0154.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0154.228] lstrlenW (lpString="SecurityHealthService") returned 21
	[0154.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0154.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0154.228] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0154.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0154.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0154.228] lstrlenW (lpString="SENS") returned 4
	[0154.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0154.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0154.228] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0154.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0154.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0154.229] lstrlenW (lpString="ShellHWDetection") returned 16
	[0154.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0154.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0154.229] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0154.229] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0154.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0154.229] lstrlenW (lpString="Spooler") returned 7
	[0154.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0154.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0154.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0154.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0154.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0154.229] lstrlenW (lpString="StateRepository") returned 15
	[0154.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0154.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0154.229] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0154.229] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0154.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0154.229] lstrlenW (lpString="SysMain") returned 7
	[0154.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0154.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0154.229] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0154.229] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0154.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0154.229] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0154.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0154.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0154.229] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0154.229] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0154.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0154.230] lstrlenW (lpString="Themes") returned 6
	[0154.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0154.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0154.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0154.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0154.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0154.230] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0154.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0154.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0154.230] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0154.230] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0154.230] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4493348 | out: hHeap=0x4c0000) returned 1
	[0154.230] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374
	[0154.380] Process32FirstW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0154.381] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0154.381] lstrlenW (lpString="System") returned 6
	[0154.381] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0154.382] lstrlenW (lpString="smss.exe") returned 8
	[0154.382] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0154.382] lstrlenW (lpString="csrss.exe") returned 9
	[0154.382] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0154.382] lstrlenW (lpString="wininit.exe") returned 11
	[0154.382] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0154.383] lstrlenW (lpString="csrss.exe") returned 9
	[0154.383] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0154.383] lstrlenW (lpString="winlogon.exe") returned 12
	[0154.383] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0154.384] lstrlenW (lpString="services.exe") returned 12
	[0154.384] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0154.384] lstrlenW (lpString="lsass.exe") returned 9
	[0154.384] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0154.384] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0154.384] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0154.385] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0154.385] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.385] lstrlenW (lpString="svchost.exe") returned 11
	[0154.385] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.386] lstrlenW (lpString="svchost.exe") returned 11
	[0154.386] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0154.386] lstrlenW (lpString="dwm.exe") returned 7
	[0154.386] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.386] lstrlenW (lpString="svchost.exe") returned 11
	[0154.386] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.387] lstrlenW (lpString="svchost.exe") returned 11
	[0154.387] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.387] lstrlenW (lpString="svchost.exe") returned 11
	[0154.387] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.388] lstrlenW (lpString="svchost.exe") returned 11
	[0154.388] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.388] lstrlenW (lpString="svchost.exe") returned 11
	[0154.388] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.388] lstrlenW (lpString="svchost.exe") returned 11
	[0154.389] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.389] lstrlenW (lpString="svchost.exe") returned 11
	[0154.389] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.389] lstrlenW (lpString="svchost.exe") returned 11
	[0154.389] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.390] lstrlenW (lpString="svchost.exe") returned 11
	[0154.390] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.390] lstrlenW (lpString="svchost.exe") returned 11
	[0154.390] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0154.391] lstrlenW (lpString="spoolsv.exe") returned 11
	[0154.391] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.391] lstrlenW (lpString="svchost.exe") returned 11
	[0154.391] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0154.391] lstrlenW (lpString="audiodg.exe") returned 11
	[0154.391] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0154.392] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0154.392] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0154.392] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0154.392] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0154.393] lstrlenW (lpString="sihost.exe") returned 10
	[0154.393] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0154.393] lstrlenW (lpString="Memory Compression") returned 18
	[0154.393] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.393] lstrlenW (lpString="svchost.exe") returned 11
	[0154.393] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0154.394] lstrlenW (lpString="msoia.exe") returned 9
	[0154.394] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0154.394] lstrlenW (lpString="taskhostw.exe") returned 13
	[0154.394] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0154.395] lstrlenW (lpString="explorer.exe") returned 12
	[0154.395] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0154.395] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0154.395] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0154.395] lstrlenW (lpString="SearchUI.exe") returned 12
	[0154.395] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0154.396] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0154.396] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0154.396] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0154.396] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0154.397] lstrlenW (lpString="d2.exe") returned 6
	[0154.397] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0154.397] lstrlenW (lpString="cmd.exe") returned 7
	[0154.397] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0154.398] lstrlenW (lpString="conhost.exe") returned 11
	[0154.398] Process32NextW (in: hSnapshot=0x374, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0154.398] CloseHandle (hObject=0x374) returned 1
	[0154.398] Sleep (dwMilliseconds=0x1f4) 
	[0155.162] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4f2730
	[0155.171] EnumServicesStatusExW (in: hSCManager=0x4f2730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0155.173] GetLastError () returned 0xea
	[0155.173] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c28) returned 0x5b6fd0
	[0155.173] EnumServicesStatusExW (in: hSCManager=0x4f2730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5b6fd0, cbBufSize=0x1c28, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5b6fd0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0155.200] CloseServiceHandle (hSCObject=0x4f2730) returned 1
	[0155.201] lstrlenW (lpString="AppXSvc") returned 7
	[0155.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0155.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0155.201] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0155.201] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0155.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0155.201] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0155.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0155.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0155.201] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0155.201] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0155.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0155.201] lstrlenW (lpString="Audiosrv") returned 8
	[0155.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0155.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0155.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0155.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0155.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0155.201] lstrlenW (lpString="BFE") returned 3
	[0155.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0155.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0155.201] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0155.201] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0155.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0155.202] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0155.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0155.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0155.202] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0155.202] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0155.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0155.202] lstrlenW (lpString="CDPSvc") returned 6
	[0155.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0155.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0155.202] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0155.202] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0155.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0155.202] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0155.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0155.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0155.202] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0155.202] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0155.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0155.202] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0155.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0155.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0155.202] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0155.202] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0155.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0155.202] lstrlenW (lpString="CryptSvc") returned 8
	[0155.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0155.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0155.203] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0155.203] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0155.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0155.203] lstrlenW (lpString="DcomLaunch") returned 10
	[0155.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0155.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0155.203] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0155.203] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0155.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0155.203] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0155.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0155.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0155.203] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0155.203] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0155.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0155.203] lstrlenW (lpString="Dhcp") returned 4
	[0155.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0155.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0155.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0155.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0155.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0155.203] lstrlenW (lpString="Dnscache") returned 8
	[0155.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0155.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0155.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0155.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0155.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0155.203] lstrlenW (lpString="DPS") returned 3
	[0155.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0155.204] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0155.204] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0155.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0155.204] lstrlenW (lpString="DsmSvc") returned 6
	[0155.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0155.204] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0155.204] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0155.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0155.204] lstrlenW (lpString="DusmSvc") returned 7
	[0155.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0155.204] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0155.204] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0155.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0155.204] lstrlenW (lpString="EventLog") returned 8
	[0155.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0155.204] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0155.204] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0155.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0155.204] lstrlenW (lpString="EventSystem") returned 11
	[0155.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0155.204] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0155.205] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0155.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0155.205] lstrlenW (lpString="FontCache") returned 9
	[0155.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0155.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0155.205] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0155.205] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0155.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0155.205] lstrlenW (lpString="gpsvc") returned 5
	[0155.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0155.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0155.205] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0155.205] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0155.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0155.205] lstrlenW (lpString="iphlpsvc") returned 8
	[0155.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0155.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0155.205] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0155.205] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0155.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0155.205] lstrlenW (lpString="KeyIso") returned 6
	[0155.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0155.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0155.205] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0155.205] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0155.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0155.205] lstrlenW (lpString="LanmanServer") returned 12
	[0155.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0155.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0155.206] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0155.206] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0155.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0155.206] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0155.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0155.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0155.206] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0155.206] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0155.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0155.206] lstrlenW (lpString="lfsvc") returned 5
	[0155.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0155.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0155.206] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0155.206] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0155.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0155.206] lstrlenW (lpString="lmhosts") returned 7
	[0155.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0155.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0155.206] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0155.206] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0155.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0155.206] lstrlenW (lpString="LSM") returned 3
	[0155.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0155.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0155.206] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0155.206] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0155.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0155.207] lstrlenW (lpString="MpsSvc") returned 6
	[0155.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0155.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0155.207] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0155.207] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0155.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0155.207] lstrlenW (lpString="NcbService") returned 10
	[0155.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0155.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0155.207] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0155.207] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0155.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0155.207] lstrlenW (lpString="netprofm") returned 8
	[0155.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0155.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0155.207] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0155.207] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0155.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0155.207] lstrlenW (lpString="NgcSvc") returned 6
	[0155.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0155.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0155.207] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0155.207] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0155.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0155.208] lstrlenW (lpString="NlaSvc") returned 6
	[0155.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0155.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0155.208] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0155.208] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0155.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0155.208] lstrlenW (lpString="nsi") returned 3
	[0155.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0155.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0155.208] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0155.208] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0155.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0155.208] lstrlenW (lpString="PcaSvc") returned 6
	[0155.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0155.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0155.208] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0155.208] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0155.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0155.208] lstrlenW (lpString="PlugPlay") returned 8
	[0155.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0155.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0155.208] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0155.208] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0155.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0155.208] lstrlenW (lpString="Power") returned 5
	[0155.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0155.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0155.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0155.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0155.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0155.209] lstrlenW (lpString="ProfSvc") returned 7
	[0155.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0155.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0155.209] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0155.209] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0155.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0155.209] lstrlenW (lpString="RpcEptMapper") returned 12
	[0155.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0155.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0155.209] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0155.209] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0155.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0155.209] lstrlenW (lpString="RpcSs") returned 5
	[0155.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0155.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0155.209] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0155.209] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0155.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0155.209] lstrlenW (lpString="SamSs") returned 5
	[0155.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0155.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0155.209] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0155.209] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0155.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0155.209] lstrlenW (lpString="Schedule") returned 8
	[0155.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0155.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0155.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0155.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0155.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0155.210] lstrlenW (lpString="SecurityHealthService") returned 21
	[0155.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0155.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0155.210] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0155.210] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0155.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0155.210] lstrlenW (lpString="SENS") returned 4
	[0155.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0155.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0155.210] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0155.210] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0155.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0155.210] lstrlenW (lpString="ShellHWDetection") returned 16
	[0155.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0155.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0155.210] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0155.210] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0155.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0155.210] lstrlenW (lpString="Spooler") returned 7
	[0155.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0155.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0155.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0155.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0155.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0155.210] lstrlenW (lpString="StateRepository") returned 15
	[0155.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0155.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0155.211] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0155.211] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0155.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0155.211] lstrlenW (lpString="SysMain") returned 7
	[0155.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0155.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0155.211] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0155.211] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0155.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0155.211] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0155.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0155.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0155.211] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0155.211] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0155.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0155.211] lstrlenW (lpString="Themes") returned 6
	[0155.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0155.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0155.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0155.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0155.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0155.211] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0155.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0155.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0155.211] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0155.211] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0155.211] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x4c0000) returned 1
	[0155.211] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c
	[0155.217] Process32FirstW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0155.217] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0155.217] lstrlenW (lpString="System") returned 6
	[0155.217] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0155.218] lstrlenW (lpString="smss.exe") returned 8
	[0155.218] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0155.218] lstrlenW (lpString="csrss.exe") returned 9
	[0155.218] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0155.219] lstrlenW (lpString="wininit.exe") returned 11
	[0155.219] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0155.219] lstrlenW (lpString="csrss.exe") returned 9
	[0155.219] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0155.219] lstrlenW (lpString="winlogon.exe") returned 12
	[0155.220] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0155.220] lstrlenW (lpString="services.exe") returned 12
	[0155.220] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0155.220] lstrlenW (lpString="lsass.exe") returned 9
	[0155.220] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0155.221] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0155.221] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0155.221] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0155.221] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.222] lstrlenW (lpString="svchost.exe") returned 11
	[0155.222] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.222] lstrlenW (lpString="svchost.exe") returned 11
	[0155.222] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0155.222] lstrlenW (lpString="dwm.exe") returned 7
	[0155.222] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.223] lstrlenW (lpString="svchost.exe") returned 11
	[0155.223] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.223] lstrlenW (lpString="svchost.exe") returned 11
	[0155.231] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.231] lstrlenW (lpString="svchost.exe") returned 11
	[0155.231] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.232] lstrlenW (lpString="svchost.exe") returned 11
	[0155.232] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.232] lstrlenW (lpString="svchost.exe") returned 11
	[0155.232] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.232] lstrlenW (lpString="svchost.exe") returned 11
	[0155.232] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.233] lstrlenW (lpString="svchost.exe") returned 11
	[0155.233] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.233] lstrlenW (lpString="svchost.exe") returned 11
	[0155.233] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.234] lstrlenW (lpString="svchost.exe") returned 11
	[0155.234] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.234] lstrlenW (lpString="svchost.exe") returned 11
	[0155.234] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0155.235] lstrlenW (lpString="spoolsv.exe") returned 11
	[0155.235] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.235] lstrlenW (lpString="svchost.exe") returned 11
	[0155.235] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0155.235] lstrlenW (lpString="audiodg.exe") returned 11
	[0155.235] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0155.236] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0155.236] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0155.236] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0155.236] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0155.237] lstrlenW (lpString="sihost.exe") returned 10
	[0155.237] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0155.237] lstrlenW (lpString="Memory Compression") returned 18
	[0155.237] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0155.237] lstrlenW (lpString="svchost.exe") returned 11
	[0155.238] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0155.238] lstrlenW (lpString="msoia.exe") returned 9
	[0155.238] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0155.238] lstrlenW (lpString="taskhostw.exe") returned 13
	[0155.238] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0155.239] lstrlenW (lpString="explorer.exe") returned 12
	[0155.239] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0155.242] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0155.242] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0155.242] lstrlenW (lpString="SearchUI.exe") returned 12
	[0155.242] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0155.242] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0155.242] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0155.243] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0155.243] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0155.243] lstrlenW (lpString="d2.exe") returned 6
	[0155.243] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0155.244] lstrlenW (lpString="cmd.exe") returned 7
	[0155.244] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0155.244] lstrlenW (lpString="conhost.exe") returned 11
	[0155.244] Process32NextW (in: hSnapshot=0x38c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0155.244] CloseHandle (hObject=0x38c) returned 1
	[0155.245] Sleep (dwMilliseconds=0x1f4) 
	[0155.883] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3eee6d8
	[0155.883] EnumServicesStatusExW (in: hSCManager=0x3eee6d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0155.884] GetLastError () returned 0xea
	[0155.884] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c28) returned 0x4494fe8
	[0155.884] EnumServicesStatusExW (in: hSCManager=0x3eee6d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4494fe8, cbBufSize=0x1c28, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4494fe8, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0155.885] CloseServiceHandle (hSCObject=0x3eee6d8) returned 1
	[0155.886] lstrlenW (lpString="AppXSvc") returned 7
	[0155.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0155.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0155.886] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0155.886] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0155.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0155.886] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0155.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0155.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0155.886] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0155.886] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0155.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0155.886] lstrlenW (lpString="Audiosrv") returned 8
	[0155.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0155.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0155.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0155.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0155.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0155.886] lstrlenW (lpString="BFE") returned 3
	[0155.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0155.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0155.886] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0155.886] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0155.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0155.886] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0155.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0155.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0155.886] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0155.886] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0155.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0155.887] lstrlenW (lpString="CDPSvc") returned 6
	[0155.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0155.887] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0155.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0155.887] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0155.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0155.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0155.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0155.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0155.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0155.887] lstrlenW (lpString="CryptSvc") returned 8
	[0155.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0155.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0155.887] lstrlenW (lpString="DcomLaunch") returned 10
	[0155.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0155.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0155.887] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0155.887] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0155.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0155.887] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0155.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0155.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0155.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0155.888] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0155.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0155.888] lstrlenW (lpString="Dhcp") returned 4
	[0155.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0155.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0155.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0155.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0155.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0155.888] lstrlenW (lpString="Dnscache") returned 8
	[0155.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0155.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0155.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0155.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0155.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0155.888] lstrlenW (lpString="DPS") returned 3
	[0155.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0155.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0155.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0155.888] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0155.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0155.888] lstrlenW (lpString="DsmSvc") returned 6
	[0155.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0155.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0155.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0155.888] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0155.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0155.888] lstrlenW (lpString="DusmSvc") returned 7
	[0155.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0155.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0155.889] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0155.889] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0155.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0155.889] lstrlenW (lpString="EventLog") returned 8
	[0155.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0155.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0155.889] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0155.889] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0155.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0155.889] lstrlenW (lpString="EventSystem") returned 11
	[0155.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0155.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0155.889] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0155.889] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0155.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0155.889] lstrlenW (lpString="FontCache") returned 9
	[0155.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0155.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0155.889] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0155.889] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0155.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0155.889] lstrlenW (lpString="gpsvc") returned 5
	[0155.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0155.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0155.889] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0155.889] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0155.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0155.889] lstrlenW (lpString="iphlpsvc") returned 8
	[0155.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0155.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0155.890] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0155.890] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0155.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0155.890] lstrlenW (lpString="KeyIso") returned 6
	[0155.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0155.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0155.890] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0155.890] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0155.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0155.890] lstrlenW (lpString="LanmanServer") returned 12
	[0155.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0155.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0155.890] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0155.890] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0155.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0155.890] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0155.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0155.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0155.890] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0155.890] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0155.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0155.890] lstrlenW (lpString="lfsvc") returned 5
	[0155.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0155.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0155.890] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0155.890] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0155.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0155.890] lstrlenW (lpString="lmhosts") returned 7
	[0155.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0155.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0155.890] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0155.891] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0155.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0155.891] lstrlenW (lpString="LSM") returned 3
	[0155.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0155.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0155.891] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0155.891] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0155.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0155.891] lstrlenW (lpString="MpsSvc") returned 6
	[0155.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0155.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0155.891] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0155.891] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0155.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0155.891] lstrlenW (lpString="NcbService") returned 10
	[0155.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0155.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0155.891] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0155.891] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0155.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0155.891] lstrlenW (lpString="netprofm") returned 8
	[0155.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0155.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0155.891] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0155.891] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0155.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0155.891] lstrlenW (lpString="NgcSvc") returned 6
	[0155.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0155.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0155.891] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0155.891] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0155.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0155.892] lstrlenW (lpString="NlaSvc") returned 6
	[0155.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0155.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0155.892] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0155.892] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0155.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0155.892] lstrlenW (lpString="nsi") returned 3
	[0155.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0155.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0155.892] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0155.892] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0155.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0155.892] lstrlenW (lpString="PcaSvc") returned 6
	[0155.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0155.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0155.892] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0155.892] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0155.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0155.892] lstrlenW (lpString="PlugPlay") returned 8
	[0155.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0155.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0155.892] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0155.892] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0155.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0155.892] lstrlenW (lpString="Power") returned 5
	[0155.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0155.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0155.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0155.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0155.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0155.893] lstrlenW (lpString="ProfSvc") returned 7
	[0155.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0155.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0155.893] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0155.893] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0155.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0155.893] lstrlenW (lpString="RpcEptMapper") returned 12
	[0155.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0155.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0155.893] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0155.893] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0155.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0155.893] lstrlenW (lpString="RpcSs") returned 5
	[0155.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0155.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0155.893] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0155.893] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0155.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0155.893] lstrlenW (lpString="SamSs") returned 5
	[0155.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0155.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0155.893] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0155.893] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0155.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0155.893] lstrlenW (lpString="Schedule") returned 8
	[0155.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0155.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0155.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0155.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0155.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0155.894] lstrlenW (lpString="SecurityHealthService") returned 21
	[0155.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0155.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0155.894] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0155.894] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0155.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0155.894] lstrlenW (lpString="SENS") returned 4
	[0155.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0155.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0155.894] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0155.894] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0155.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0155.894] lstrlenW (lpString="ShellHWDetection") returned 16
	[0155.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0155.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0155.894] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0155.894] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0155.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0155.894] lstrlenW (lpString="Spooler") returned 7
	[0155.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0155.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0155.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0155.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0155.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0155.894] lstrlenW (lpString="StateRepository") returned 15
	[0155.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0155.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0155.894] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0155.894] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0155.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0155.894] lstrlenW (lpString="SysMain") returned 7
	[0155.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0155.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0155.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0155.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0155.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0155.895] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0155.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0155.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0155.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0155.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0155.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0155.895] lstrlenW (lpString="Themes") returned 6
	[0155.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0155.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0155.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0155.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0155.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0155.895] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0155.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0155.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0155.895] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0155.895] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0155.895] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.895] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384
	[0155.901] Process32FirstW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0156.048] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0156.048] lstrlenW (lpString="System") returned 6
	[0156.049] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0156.049] lstrlenW (lpString="smss.exe") returned 8
	[0156.049] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0156.049] lstrlenW (lpString="csrss.exe") returned 9
	[0156.049] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0156.050] lstrlenW (lpString="wininit.exe") returned 11
	[0156.050] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0156.050] lstrlenW (lpString="csrss.exe") returned 9
	[0156.050] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0156.051] lstrlenW (lpString="winlogon.exe") returned 12
	[0156.051] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0156.051] lstrlenW (lpString="services.exe") returned 12
	[0156.051] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0156.051] lstrlenW (lpString="lsass.exe") returned 9
	[0156.051] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0156.052] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0156.052] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0156.052] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0156.052] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.053] lstrlenW (lpString="svchost.exe") returned 11
	[0156.053] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.053] lstrlenW (lpString="svchost.exe") returned 11
	[0156.053] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0156.054] lstrlenW (lpString="dwm.exe") returned 7
	[0156.054] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.054] lstrlenW (lpString="svchost.exe") returned 11
	[0156.054] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.054] lstrlenW (lpString="svchost.exe") returned 11
	[0156.055] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.055] lstrlenW (lpString="svchost.exe") returned 11
	[0156.055] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.055] lstrlenW (lpString="svchost.exe") returned 11
	[0156.055] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.056] lstrlenW (lpString="svchost.exe") returned 11
	[0156.056] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.056] lstrlenW (lpString="svchost.exe") returned 11
	[0156.056] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.057] lstrlenW (lpString="svchost.exe") returned 11
	[0156.057] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.057] lstrlenW (lpString="svchost.exe") returned 11
	[0156.057] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.058] lstrlenW (lpString="svchost.exe") returned 11
	[0156.058] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.058] lstrlenW (lpString="svchost.exe") returned 11
	[0156.058] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0156.058] lstrlenW (lpString="spoolsv.exe") returned 11
	[0156.058] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.059] lstrlenW (lpString="svchost.exe") returned 11
	[0156.059] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0156.059] lstrlenW (lpString="audiodg.exe") returned 11
	[0156.059] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0156.060] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0156.060] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0156.060] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0156.060] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0156.060] lstrlenW (lpString="sihost.exe") returned 10
	[0156.061] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0156.061] lstrlenW (lpString="Memory Compression") returned 18
	[0156.061] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.061] lstrlenW (lpString="svchost.exe") returned 11
	[0156.061] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0156.062] lstrlenW (lpString="msoia.exe") returned 9
	[0156.062] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0156.062] lstrlenW (lpString="taskhostw.exe") returned 13
	[0156.062] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0156.063] lstrlenW (lpString="explorer.exe") returned 12
	[0156.063] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0156.063] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0156.063] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0156.063] lstrlenW (lpString="SearchUI.exe") returned 12
	[0156.063] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0156.064] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0156.064] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0156.064] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0156.064] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0156.065] lstrlenW (lpString="d2.exe") returned 6
	[0156.065] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0156.065] lstrlenW (lpString="cmd.exe") returned 7
	[0156.065] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0156.066] lstrlenW (lpString="conhost.exe") returned 11
	[0156.066] Process32NextW (in: hSnapshot=0x384, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0156.066] CloseHandle (hObject=0x384) returned 1
	[0156.066] Sleep (dwMilliseconds=0x1f4) 
	[0156.730] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ec90
	[0156.739] EnumServicesStatusExW (in: hSCManager=0x52ec90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0156.740] GetLastError () returned 0xea
	[0156.740] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c28) returned 0x44c5fd0
	[0156.740] EnumServicesStatusExW (in: hSCManager=0x52ec90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44c5fd0, cbBufSize=0x1c28, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44c5fd0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0156.743] CloseServiceHandle (hSCObject=0x52ec90) returned 1
	[0156.744] lstrlenW (lpString="AppXSvc") returned 7
	[0156.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0156.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0156.744] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0156.744] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0156.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0156.744] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0156.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0156.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0156.744] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0156.744] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0156.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0156.744] lstrlenW (lpString="Audiosrv") returned 8
	[0156.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0156.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0156.744] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0156.744] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0156.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0156.744] lstrlenW (lpString="BFE") returned 3
	[0156.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0156.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0156.744] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0156.745] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0156.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0156.745] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0156.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0156.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0156.745] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0156.745] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0156.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0156.745] lstrlenW (lpString="CDPSvc") returned 6
	[0156.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0156.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0156.745] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0156.745] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0156.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0156.745] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0156.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0156.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0156.745] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0156.745] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0156.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0156.745] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0156.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0156.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0156.745] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0156.745] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0156.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0156.745] lstrlenW (lpString="CryptSvc") returned 8
	[0156.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0156.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0156.745] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0156.746] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0156.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0156.746] lstrlenW (lpString="DcomLaunch") returned 10
	[0156.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0156.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0156.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0156.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0156.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0156.746] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0156.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0156.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0156.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0156.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0156.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0156.746] lstrlenW (lpString="Dhcp") returned 4
	[0156.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0156.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0156.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0156.746] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0156.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0156.746] lstrlenW (lpString="Dnscache") returned 8
	[0156.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0156.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0156.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0156.746] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0156.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0156.746] lstrlenW (lpString="DPS") returned 3
	[0156.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0156.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0156.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0156.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0156.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0156.747] lstrlenW (lpString="DsmSvc") returned 6
	[0156.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0156.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0156.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0156.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0156.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0156.747] lstrlenW (lpString="DusmSvc") returned 7
	[0156.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0156.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0156.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0156.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0156.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0156.747] lstrlenW (lpString="EventLog") returned 8
	[0156.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0156.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0156.747] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0156.747] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0156.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0156.747] lstrlenW (lpString="EventSystem") returned 11
	[0156.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0156.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0156.747] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0156.747] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0156.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0156.747] lstrlenW (lpString="FontCache") returned 9
	[0156.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0156.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0156.747] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0156.747] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0156.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0156.748] lstrlenW (lpString="gpsvc") returned 5
	[0156.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0156.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0156.748] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0156.748] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0156.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0156.748] lstrlenW (lpString="iphlpsvc") returned 8
	[0156.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0156.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0156.748] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0156.748] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0156.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0156.748] lstrlenW (lpString="KeyIso") returned 6
	[0156.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0156.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0156.748] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0156.748] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0156.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0156.748] lstrlenW (lpString="LanmanServer") returned 12
	[0156.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0156.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0156.748] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0156.748] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0156.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0156.748] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0156.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0156.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0156.748] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0156.748] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0156.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0156.749] lstrlenW (lpString="lfsvc") returned 5
	[0156.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0156.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0156.749] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0156.749] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0156.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0156.749] lstrlenW (lpString="lmhosts") returned 7
	[0156.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0156.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0156.749] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0156.749] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0156.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0156.749] lstrlenW (lpString="LSM") returned 3
	[0156.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0156.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0156.749] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0156.749] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0156.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0156.749] lstrlenW (lpString="MpsSvc") returned 6
	[0156.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0156.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0156.749] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0156.749] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0156.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0156.749] lstrlenW (lpString="NcbService") returned 10
	[0156.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0156.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0156.749] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0156.749] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0156.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0156.750] lstrlenW (lpString="netprofm") returned 8
	[0156.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0156.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0156.750] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0156.750] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0156.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0156.750] lstrlenW (lpString="NgcSvc") returned 6
	[0156.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0156.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0156.750] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0156.750] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0156.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0156.750] lstrlenW (lpString="NlaSvc") returned 6
	[0156.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0156.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0156.750] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0156.750] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0156.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0156.750] lstrlenW (lpString="nsi") returned 3
	[0156.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0156.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0156.750] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0156.750] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0156.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0156.750] lstrlenW (lpString="PcaSvc") returned 6
	[0156.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0156.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0156.750] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0156.750] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0156.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0156.751] lstrlenW (lpString="PlugPlay") returned 8
	[0156.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0156.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0156.751] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0156.751] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0156.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0156.751] lstrlenW (lpString="Power") returned 5
	[0156.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0156.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0156.751] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0156.751] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0156.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0156.751] lstrlenW (lpString="ProfSvc") returned 7
	[0156.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0156.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0156.751] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0156.751] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0156.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0156.751] lstrlenW (lpString="RpcEptMapper") returned 12
	[0156.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0156.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0156.751] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0156.751] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0156.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0156.751] lstrlenW (lpString="RpcSs") returned 5
	[0156.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0156.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0156.751] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0156.751] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0156.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0156.751] lstrlenW (lpString="SamSs") returned 5
	[0156.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0156.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0156.752] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0156.752] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0156.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0156.752] lstrlenW (lpString="Schedule") returned 8
	[0156.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0156.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0156.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0156.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0156.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0156.752] lstrlenW (lpString="SecurityHealthService") returned 21
	[0156.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0156.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0156.752] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0156.752] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0156.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0156.752] lstrlenW (lpString="SENS") returned 4
	[0156.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0156.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0156.752] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0156.752] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0156.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0156.752] lstrlenW (lpString="ShellHWDetection") returned 16
	[0156.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0156.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0156.752] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0156.752] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0156.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0156.752] lstrlenW (lpString="Spooler") returned 7
	[0156.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0156.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0156.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0156.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0156.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0156.753] lstrlenW (lpString="StateRepository") returned 15
	[0156.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0156.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0156.753] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0156.753] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0156.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0156.753] lstrlenW (lpString="SysMain") returned 7
	[0156.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0156.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0156.753] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0156.753] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0156.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0156.753] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0156.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0156.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0156.753] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0156.753] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0156.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0156.753] lstrlenW (lpString="Themes") returned 6
	[0156.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0156.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0156.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0156.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0156.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0156.753] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0156.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0156.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0156.754] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0156.754] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0156.754] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c5fd0 | out: hHeap=0x4c0000) returned 1
	[0156.754] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4a0
	[0156.760] Process32FirstW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0156.760] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0156.955] lstrlenW (lpString="System") returned 6
	[0156.955] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0156.955] lstrlenW (lpString="smss.exe") returned 8
	[0156.955] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0156.956] lstrlenW (lpString="csrss.exe") returned 9
	[0156.956] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0156.956] lstrlenW (lpString="wininit.exe") returned 11
	[0156.956] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0156.956] lstrlenW (lpString="csrss.exe") returned 9
	[0156.956] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0156.957] lstrlenW (lpString="winlogon.exe") returned 12
	[0156.957] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0156.957] lstrlenW (lpString="services.exe") returned 12
	[0156.957] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0156.958] lstrlenW (lpString="lsass.exe") returned 9
	[0156.958] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0156.958] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0156.958] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0156.958] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0156.959] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.959] lstrlenW (lpString="svchost.exe") returned 11
	[0156.959] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.959] lstrlenW (lpString="svchost.exe") returned 11
	[0156.959] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0156.960] lstrlenW (lpString="dwm.exe") returned 7
	[0156.960] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.960] lstrlenW (lpString="svchost.exe") returned 11
	[0156.960] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.961] lstrlenW (lpString="svchost.exe") returned 11
	[0156.961] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.961] lstrlenW (lpString="svchost.exe") returned 11
	[0156.961] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.961] lstrlenW (lpString="svchost.exe") returned 11
	[0156.961] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.962] lstrlenW (lpString="svchost.exe") returned 11
	[0156.962] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.962] lstrlenW (lpString="svchost.exe") returned 11
	[0156.962] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.963] lstrlenW (lpString="svchost.exe") returned 11
	[0156.963] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.963] lstrlenW (lpString="svchost.exe") returned 11
	[0156.963] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.964] lstrlenW (lpString="svchost.exe") returned 11
	[0156.964] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.964] lstrlenW (lpString="svchost.exe") returned 11
	[0156.964] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0156.965] lstrlenW (lpString="spoolsv.exe") returned 11
	[0156.965] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.965] lstrlenW (lpString="svchost.exe") returned 11
	[0156.965] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0156.965] lstrlenW (lpString="audiodg.exe") returned 11
	[0156.965] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0156.966] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0156.966] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0156.966] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0156.966] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0156.967] lstrlenW (lpString="sihost.exe") returned 10
	[0156.967] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0156.967] lstrlenW (lpString="Memory Compression") returned 18
	[0156.967] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.968] lstrlenW (lpString="svchost.exe") returned 11
	[0156.968] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0156.968] lstrlenW (lpString="msoia.exe") returned 9
	[0156.968] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0156.968] lstrlenW (lpString="taskhostw.exe") returned 13
	[0156.968] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0156.969] lstrlenW (lpString="explorer.exe") returned 12
	[0156.969] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0156.969] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0156.969] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0156.970] lstrlenW (lpString="SearchUI.exe") returned 12
	[0156.970] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0156.970] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0156.970] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0156.970] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0156.971] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0156.971] lstrlenW (lpString="d2.exe") returned 6
	[0156.971] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0156.971] lstrlenW (lpString="cmd.exe") returned 7
	[0156.971] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0156.972] lstrlenW (lpString="conhost.exe") returned 11
	[0156.972] Process32NextW (in: hSnapshot=0x4a0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0156.972] CloseHandle (hObject=0x4a0) returned 1
	[0156.972] Sleep (dwMilliseconds=0x1f4) 
	[0157.634] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52eba0
	[0157.635] EnumServicesStatusExW (in: hSCManager=0x52eba0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0157.635] GetLastError () returned 0xea
	[0157.636] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c28) returned 0x3e62088
	[0157.636] EnumServicesStatusExW (in: hSCManager=0x52eba0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e62088, cbBufSize=0x1c28, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e62088, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0157.637] CloseServiceHandle (hSCObject=0x52eba0) returned 1
	[0157.637] lstrlenW (lpString="AppXSvc") returned 7
	[0157.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0157.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0157.637] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0157.637] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0157.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0157.637] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0157.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0157.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0157.637] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0157.637] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0157.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0157.637] lstrlenW (lpString="Audiosrv") returned 8
	[0157.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0157.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0157.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0157.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0157.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0157.637] lstrlenW (lpString="BFE") returned 3
	[0157.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0157.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0157.638] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0157.638] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0157.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0157.638] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0157.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0157.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0157.638] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0157.638] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0157.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0157.638] lstrlenW (lpString="CDPSvc") returned 6
	[0157.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0157.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0157.638] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0157.638] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0157.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0157.638] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0157.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0157.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0157.638] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0157.638] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0157.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0157.638] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0157.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0157.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0157.638] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0157.638] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0157.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0157.638] lstrlenW (lpString="CryptSvc") returned 8
	[0157.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0157.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0157.639] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0157.639] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0157.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0157.639] lstrlenW (lpString="DcomLaunch") returned 10
	[0157.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0157.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0157.639] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0157.639] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0157.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0157.639] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0157.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0157.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0157.639] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0157.639] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0157.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0157.639] lstrlenW (lpString="Dhcp") returned 4
	[0157.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0157.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0157.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0157.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0157.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0157.639] lstrlenW (lpString="Dnscache") returned 8
	[0157.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0157.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0157.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0157.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0157.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0157.640] lstrlenW (lpString="DPS") returned 3
	[0157.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0157.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0157.640] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0157.640] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0157.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0157.640] lstrlenW (lpString="DsmSvc") returned 6
	[0157.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0157.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0157.640] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0157.640] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0157.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0157.640] lstrlenW (lpString="DusmSvc") returned 7
	[0157.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0157.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0157.640] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0157.640] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0157.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0157.640] lstrlenW (lpString="EventLog") returned 8
	[0157.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0157.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0157.640] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0157.640] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0157.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0157.640] lstrlenW (lpString="EventSystem") returned 11
	[0157.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0157.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0157.641] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0157.641] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0157.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0157.641] lstrlenW (lpString="FontCache") returned 9
	[0157.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0157.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0157.641] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0157.641] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0157.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0157.641] lstrlenW (lpString="gpsvc") returned 5
	[0157.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0157.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0157.641] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0157.641] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0157.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0157.641] lstrlenW (lpString="iphlpsvc") returned 8
	[0157.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0157.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0157.641] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0157.641] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0157.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0157.641] lstrlenW (lpString="KeyIso") returned 6
	[0157.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0157.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0157.641] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0157.641] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0157.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0157.641] lstrlenW (lpString="LanmanServer") returned 12
	[0157.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0157.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0157.642] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0157.642] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0157.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0157.642] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0157.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0157.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0157.642] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0157.642] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0157.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0157.642] lstrlenW (lpString="lfsvc") returned 5
	[0157.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0157.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0157.642] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0157.642] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0157.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0157.642] lstrlenW (lpString="lmhosts") returned 7
	[0157.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0157.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0157.642] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0157.642] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0157.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0157.642] lstrlenW (lpString="LSM") returned 3
	[0157.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0157.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0157.642] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0157.642] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0157.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0157.642] lstrlenW (lpString="MpsSvc") returned 6
	[0157.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0157.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0157.642] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0157.643] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0157.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0157.643] lstrlenW (lpString="NcbService") returned 10
	[0157.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0157.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0157.643] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0157.643] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0157.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0157.643] lstrlenW (lpString="netprofm") returned 8
	[0157.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0157.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0157.643] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0157.643] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0157.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0157.643] lstrlenW (lpString="NgcSvc") returned 6
	[0157.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0157.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0157.643] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0157.643] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0157.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0157.643] lstrlenW (lpString="NlaSvc") returned 6
	[0157.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0157.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0157.643] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0157.643] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0157.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0157.643] lstrlenW (lpString="nsi") returned 3
	[0157.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0157.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0157.643] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0157.643] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0157.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0157.644] lstrlenW (lpString="PcaSvc") returned 6
	[0157.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0157.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0157.644] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0157.644] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0157.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0157.644] lstrlenW (lpString="PlugPlay") returned 8
	[0157.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0157.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0157.644] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0157.644] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0157.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0157.644] lstrlenW (lpString="Power") returned 5
	[0157.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0157.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0157.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0157.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0157.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0157.644] lstrlenW (lpString="ProfSvc") returned 7
	[0157.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0157.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0157.644] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0157.644] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0157.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0157.644] lstrlenW (lpString="RpcEptMapper") returned 12
	[0157.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0157.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0157.644] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0157.644] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0157.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0157.645] lstrlenW (lpString="RpcSs") returned 5
	[0157.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0157.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0157.645] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0157.645] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0157.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0157.645] lstrlenW (lpString="SamSs") returned 5
	[0157.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0157.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0157.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0157.645] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0157.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0157.645] lstrlenW (lpString="Schedule") returned 8
	[0157.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0157.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0157.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0157.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0157.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0157.645] lstrlenW (lpString="SecurityHealthService") returned 21
	[0157.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0157.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0157.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0157.645] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0157.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0157.645] lstrlenW (lpString="SENS") returned 4
	[0157.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0157.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0157.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0157.645] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0157.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0157.645] lstrlenW (lpString="ShellHWDetection") returned 16
	[0157.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0157.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0157.646] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0157.646] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0157.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0157.646] lstrlenW (lpString="Spooler") returned 7
	[0157.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0157.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0157.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0157.646] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0157.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0157.646] lstrlenW (lpString="StateRepository") returned 15
	[0157.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0157.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0157.646] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0157.646] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0157.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0157.646] lstrlenW (lpString="SysMain") returned 7
	[0157.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0157.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0157.646] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0157.646] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0157.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0157.646] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0157.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0157.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0157.646] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0157.646] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0157.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0157.646] lstrlenW (lpString="Themes") returned 6
	[0157.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0157.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0157.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0157.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0157.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0157.647] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0157.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0157.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0157.647] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0157.647] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0157.647] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e62088 | out: hHeap=0x4c0000) returned 1
	[0157.647] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x40c
	[0158.036] Process32FirstW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0158.036] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0158.036] lstrlenW (lpString="System") returned 6
	[0158.036] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0158.037] lstrlenW (lpString="smss.exe") returned 8
	[0158.037] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0158.037] lstrlenW (lpString="csrss.exe") returned 9
	[0158.037] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0158.038] lstrlenW (lpString="wininit.exe") returned 11
	[0158.038] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0158.038] lstrlenW (lpString="csrss.exe") returned 9
	[0158.038] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0158.039] lstrlenW (lpString="winlogon.exe") returned 12
	[0158.039] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0158.039] lstrlenW (lpString="services.exe") returned 12
	[0158.039] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0158.039] lstrlenW (lpString="lsass.exe") returned 9
	[0158.040] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0158.040] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0158.040] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0158.040] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0158.040] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.041] lstrlenW (lpString="svchost.exe") returned 11
	[0158.041] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.041] lstrlenW (lpString="svchost.exe") returned 11
	[0158.041] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0158.042] lstrlenW (lpString="dwm.exe") returned 7
	[0158.042] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.042] lstrlenW (lpString="svchost.exe") returned 11
	[0158.042] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.043] lstrlenW (lpString="svchost.exe") returned 11
	[0158.043] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.043] lstrlenW (lpString="svchost.exe") returned 11
	[0158.043] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.044] lstrlenW (lpString="svchost.exe") returned 11
	[0158.044] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.044] lstrlenW (lpString="svchost.exe") returned 11
	[0158.044] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.044] lstrlenW (lpString="svchost.exe") returned 11
	[0158.045] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.045] lstrlenW (lpString="svchost.exe") returned 11
	[0158.045] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.045] lstrlenW (lpString="svchost.exe") returned 11
	[0158.045] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.046] lstrlenW (lpString="svchost.exe") returned 11
	[0158.046] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.046] lstrlenW (lpString="svchost.exe") returned 11
	[0158.046] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0158.047] lstrlenW (lpString="spoolsv.exe") returned 11
	[0158.047] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.047] lstrlenW (lpString="svchost.exe") returned 11
	[0158.047] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0158.048] lstrlenW (lpString="audiodg.exe") returned 11
	[0158.048] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0158.048] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0158.048] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0158.049] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0158.049] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0158.049] lstrlenW (lpString="sihost.exe") returned 10
	[0158.049] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0158.050] lstrlenW (lpString="Memory Compression") returned 18
	[0158.050] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.050] lstrlenW (lpString="svchost.exe") returned 11
	[0158.050] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0158.051] lstrlenW (lpString="msoia.exe") returned 9
	[0158.051] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0158.051] lstrlenW (lpString="taskhostw.exe") returned 13
	[0158.051] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0158.051] lstrlenW (lpString="explorer.exe") returned 12
	[0158.052] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0158.052] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0158.052] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0158.052] lstrlenW (lpString="SearchUI.exe") returned 12
	[0158.052] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0158.053] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0158.053] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0158.053] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0158.053] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0158.054] lstrlenW (lpString="d2.exe") returned 6
	[0158.054] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0158.054] lstrlenW (lpString="cmd.exe") returned 7
	[0158.054] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0158.054] lstrlenW (lpString="conhost.exe") returned 11
	[0158.055] Process32NextW (in: hSnapshot=0x40c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0158.055] CloseHandle (hObject=0x40c) returned 1
	[0158.055] Sleep (dwMilliseconds=0x1f4) 
	[0158.761] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52eda8
	[0158.788] EnumServicesStatusExW (in: hSCManager=0x52eda8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0158.789] GetLastError () returned 0xea
	[0158.789] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c28) returned 0x458e378
	[0158.789] EnumServicesStatusExW (in: hSCManager=0x52eda8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x458e378, cbBufSize=0x1c28, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x458e378, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0158.790] CloseServiceHandle (hSCObject=0x52eda8) returned 1
	[0158.790] lstrlenW (lpString="AppXSvc") returned 7
	[0158.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0158.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0158.790] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0158.790] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0158.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0158.790] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0158.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0158.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0158.790] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0158.790] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0158.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0158.790] lstrlenW (lpString="Audiosrv") returned 8
	[0158.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0158.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0158.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0158.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0158.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0158.790] lstrlenW (lpString="BFE") returned 3
	[0158.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0158.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0158.790] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0158.790] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0158.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0158.791] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0158.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0158.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0158.791] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0158.791] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0158.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0158.791] lstrlenW (lpString="CDPSvc") returned 6
	[0158.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0158.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0158.791] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0158.791] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0158.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0158.791] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0158.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0158.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0158.791] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0158.791] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0158.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0158.791] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0158.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0158.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0158.791] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0158.791] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0158.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0158.791] lstrlenW (lpString="CryptSvc") returned 8
	[0158.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0158.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0158.793] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0158.793] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0158.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0158.793] lstrlenW (lpString="DcomLaunch") returned 10
	[0158.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0158.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0158.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0158.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0158.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0158.793] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0158.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0158.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0158.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0158.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0158.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0158.793] lstrlenW (lpString="Dhcp") returned 4
	[0158.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0158.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0158.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0158.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0158.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0158.793] lstrlenW (lpString="Dnscache") returned 8
	[0158.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0158.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0158.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0158.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0158.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0158.793] lstrlenW (lpString="DPS") returned 3
	[0158.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0158.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0158.794] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0158.794] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0158.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0158.794] lstrlenW (lpString="DsmSvc") returned 6
	[0158.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0158.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0158.794] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0158.794] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0158.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0158.794] lstrlenW (lpString="DusmSvc") returned 7
	[0158.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0158.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0158.794] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0158.794] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0158.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0158.794] lstrlenW (lpString="EventLog") returned 8
	[0158.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0158.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0158.794] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0158.794] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0158.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0158.794] lstrlenW (lpString="EventSystem") returned 11
	[0158.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0158.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0158.794] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0158.794] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0158.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0158.794] lstrlenW (lpString="FontCache") returned 9
	[0158.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0158.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0158.794] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0158.795] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0158.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0158.795] lstrlenW (lpString="gpsvc") returned 5
	[0158.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0158.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0158.795] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0158.795] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0158.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0158.795] lstrlenW (lpString="iphlpsvc") returned 8
	[0158.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0158.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0158.795] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0158.795] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0158.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0158.795] lstrlenW (lpString="KeyIso") returned 6
	[0158.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0158.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0158.795] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0158.795] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0158.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0158.795] lstrlenW (lpString="LanmanServer") returned 12
	[0158.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0158.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0158.795] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0158.795] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0158.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0158.795] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0158.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0158.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0158.795] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0158.795] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0158.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0158.796] lstrlenW (lpString="lfsvc") returned 5
	[0158.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0158.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0158.796] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0158.796] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0158.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0158.796] lstrlenW (lpString="lmhosts") returned 7
	[0158.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0158.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0158.796] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0158.796] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0158.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0158.796] lstrlenW (lpString="LSM") returned 3
	[0158.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0158.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0158.796] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0158.796] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0158.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0158.796] lstrlenW (lpString="MpsSvc") returned 6
	[0158.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0158.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0158.796] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0158.796] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0158.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0158.796] lstrlenW (lpString="NcbService") returned 10
	[0158.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0158.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0158.796] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0158.796] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0158.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0158.797] lstrlenW (lpString="netprofm") returned 8
	[0158.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0158.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0158.797] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0158.797] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0158.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0158.797] lstrlenW (lpString="NgcSvc") returned 6
	[0158.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0158.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0158.797] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0158.797] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0158.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0158.797] lstrlenW (lpString="NlaSvc") returned 6
	[0158.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0158.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0158.797] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0158.797] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0158.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0158.797] lstrlenW (lpString="nsi") returned 3
	[0158.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0158.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0158.797] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0158.797] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0158.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0158.797] lstrlenW (lpString="PcaSvc") returned 6
	[0158.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0158.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0158.797] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0158.797] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0158.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0158.797] lstrlenW (lpString="PlugPlay") returned 8
	[0158.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0158.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0158.798] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0158.798] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0158.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0158.798] lstrlenW (lpString="Power") returned 5
	[0158.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0158.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0158.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0158.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0158.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0158.798] lstrlenW (lpString="ProfSvc") returned 7
	[0158.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0158.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0158.798] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0158.798] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0158.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0158.798] lstrlenW (lpString="RpcEptMapper") returned 12
	[0158.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0158.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0158.798] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0158.798] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0158.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0158.798] lstrlenW (lpString="RpcSs") returned 5
	[0158.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0158.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0158.798] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0158.798] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0158.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0158.798] lstrlenW (lpString="SamSs") returned 5
	[0158.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0158.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0158.799] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0158.799] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0158.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0158.799] lstrlenW (lpString="Schedule") returned 8
	[0158.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0158.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0158.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0158.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0158.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0158.799] lstrlenW (lpString="SecurityHealthService") returned 21
	[0158.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0158.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0158.799] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0158.799] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0158.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0158.799] lstrlenW (lpString="SENS") returned 4
	[0158.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0158.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0158.799] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0158.799] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0158.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0158.799] lstrlenW (lpString="ShellHWDetection") returned 16
	[0158.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0158.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0158.799] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0158.799] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0158.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0158.799] lstrlenW (lpString="Spooler") returned 7
	[0158.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0158.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0158.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0158.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0158.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0158.800] lstrlenW (lpString="StateRepository") returned 15
	[0158.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0158.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0158.800] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0158.800] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0158.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0158.800] lstrlenW (lpString="SysMain") returned 7
	[0158.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0158.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0158.800] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0158.800] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0158.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0158.800] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0158.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0158.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0158.800] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0158.800] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0158.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0158.800] lstrlenW (lpString="Themes") returned 6
	[0158.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0158.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0158.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0158.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0158.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0158.800] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0158.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0158.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0158.800] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0158.800] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0158.801] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e378 | out: hHeap=0x4c0000) returned 1
	[0158.801] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x528
	[0159.113] Process32FirstW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0159.114] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0159.114] lstrlenW (lpString="System") returned 6
	[0159.114] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0159.114] lstrlenW (lpString="smss.exe") returned 8
	[0159.114] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0159.115] lstrlenW (lpString="csrss.exe") returned 9
	[0159.115] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0159.115] lstrlenW (lpString="wininit.exe") returned 11
	[0159.115] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0159.116] lstrlenW (lpString="csrss.exe") returned 9
	[0159.116] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0159.116] lstrlenW (lpString="winlogon.exe") returned 12
	[0159.116] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0159.117] lstrlenW (lpString="services.exe") returned 12
	[0159.117] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0159.117] lstrlenW (lpString="lsass.exe") returned 9
	[0159.117] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0159.118] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0159.118] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0159.118] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0159.118] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.118] lstrlenW (lpString="svchost.exe") returned 11
	[0159.118] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.119] lstrlenW (lpString="svchost.exe") returned 11
	[0159.119] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0159.119] lstrlenW (lpString="dwm.exe") returned 7
	[0159.119] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.120] lstrlenW (lpString="svchost.exe") returned 11
	[0159.120] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.121] lstrlenW (lpString="svchost.exe") returned 11
	[0159.121] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.121] lstrlenW (lpString="svchost.exe") returned 11
	[0159.121] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.122] lstrlenW (lpString="svchost.exe") returned 11
	[0159.122] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.122] lstrlenW (lpString="svchost.exe") returned 11
	[0159.122] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.122] lstrlenW (lpString="svchost.exe") returned 11
	[0159.123] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.123] lstrlenW (lpString="svchost.exe") returned 11
	[0159.123] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.123] lstrlenW (lpString="svchost.exe") returned 11
	[0159.123] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.124] lstrlenW (lpString="svchost.exe") returned 11
	[0159.124] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.124] lstrlenW (lpString="svchost.exe") returned 11
	[0159.124] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0159.125] lstrlenW (lpString="spoolsv.exe") returned 11
	[0159.125] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.125] lstrlenW (lpString="svchost.exe") returned 11
	[0159.125] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0159.126] lstrlenW (lpString="audiodg.exe") returned 11
	[0159.126] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0159.126] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0159.126] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0159.126] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0159.127] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0159.127] lstrlenW (lpString="sihost.exe") returned 10
	[0159.127] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0159.127] lstrlenW (lpString="Memory Compression") returned 18
	[0159.127] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.128] lstrlenW (lpString="svchost.exe") returned 11
	[0159.128] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0159.128] lstrlenW (lpString="msoia.exe") returned 9
	[0159.128] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0159.129] lstrlenW (lpString="taskhostw.exe") returned 13
	[0159.129] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0159.129] lstrlenW (lpString="explorer.exe") returned 12
	[0159.129] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0159.129] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0159.130] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0159.130] lstrlenW (lpString="SearchUI.exe") returned 12
	[0159.130] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0159.130] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0159.130] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0159.131] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0159.131] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0159.131] lstrlenW (lpString="d2.exe") returned 6
	[0159.131] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0159.132] lstrlenW (lpString="cmd.exe") returned 7
	[0159.132] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0159.132] lstrlenW (lpString="conhost.exe") returned 11
	[0159.132] Process32NextW (in: hSnapshot=0x528, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0159.133] CloseHandle (hObject=0x528) returned 1
	[0159.133] Sleep (dwMilliseconds=0x1f4) 
	[0159.802] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52efb0
	[0159.803] EnumServicesStatusExW (in: hSCManager=0x52efb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0159.803] GetLastError () returned 0xea
	[0159.803] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x45184c8
	[0159.803] EnumServicesStatusExW (in: hSCManager=0x52efb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45184c8, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45184c8, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0159.804] CloseServiceHandle (hSCObject=0x52efb0) returned 1
	[0159.804] lstrlenW (lpString="Appinfo") returned 7
	[0159.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0159.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0159.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0159.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0159.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0159.805] lstrlenW (lpString="AppXSvc") returned 7
	[0159.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0159.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0159.805] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0159.805] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0159.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0159.805] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0159.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0159.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0159.805] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0159.805] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0159.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0159.805] lstrlenW (lpString="Audiosrv") returned 8
	[0159.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0159.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0159.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0159.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0159.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0159.805] lstrlenW (lpString="BFE") returned 3
	[0159.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0159.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0159.805] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0159.805] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0159.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0159.805] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0159.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0159.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0159.805] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0159.805] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0159.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0159.806] lstrlenW (lpString="CDPSvc") returned 6
	[0159.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0159.806] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0159.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0159.806] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0159.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0159.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0159.806] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0159.806] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0159.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0159.806] lstrlenW (lpString="CryptSvc") returned 8
	[0159.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0159.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0159.806] lstrlenW (lpString="DcomLaunch") returned 10
	[0159.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0159.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0159.806] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0159.806] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0159.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0159.806] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0159.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0159.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0159.807] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0159.807] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0159.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0159.807] lstrlenW (lpString="Dhcp") returned 4
	[0159.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0159.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0159.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0159.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0159.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0159.807] lstrlenW (lpString="Dnscache") returned 8
	[0159.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0159.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0159.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0159.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0159.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0159.807] lstrlenW (lpString="DPS") returned 3
	[0159.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0159.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0159.807] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0159.807] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0159.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0159.807] lstrlenW (lpString="DsmSvc") returned 6
	[0159.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0159.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0159.807] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0159.807] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0159.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0159.807] lstrlenW (lpString="DusmSvc") returned 7
	[0159.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0159.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0159.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0159.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0159.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0159.808] lstrlenW (lpString="EventLog") returned 8
	[0159.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0159.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0159.808] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0159.808] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0159.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0159.808] lstrlenW (lpString="EventSystem") returned 11
	[0159.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0159.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0159.808] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0159.808] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0159.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0159.808] lstrlenW (lpString="FontCache") returned 9
	[0159.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0159.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0159.808] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0159.808] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0159.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0159.808] lstrlenW (lpString="gpsvc") returned 5
	[0159.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0159.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0159.808] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0159.808] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0159.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0159.808] lstrlenW (lpString="iphlpsvc") returned 8
	[0159.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0159.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0159.809] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0159.809] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0159.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0159.809] lstrlenW (lpString="KeyIso") returned 6
	[0159.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0159.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0159.809] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0159.809] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0159.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0159.809] lstrlenW (lpString="LanmanServer") returned 12
	[0159.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0159.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0159.809] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0159.809] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0159.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0159.809] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0159.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0159.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0159.809] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0159.809] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0159.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0159.809] lstrlenW (lpString="lfsvc") returned 5
	[0159.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0159.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0159.809] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0159.809] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0159.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0159.809] lstrlenW (lpString="lmhosts") returned 7
	[0159.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0159.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0159.810] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0159.810] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0159.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0159.810] lstrlenW (lpString="LSM") returned 3
	[0159.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0159.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0159.810] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0159.810] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0159.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0159.810] lstrlenW (lpString="MpsSvc") returned 6
	[0159.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0159.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0159.810] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0159.810] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0159.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0159.810] lstrlenW (lpString="NcbService") returned 10
	[0159.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0159.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0159.810] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0159.810] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0159.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0159.810] lstrlenW (lpString="netprofm") returned 8
	[0159.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0159.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0159.810] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0159.810] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0159.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0159.810] lstrlenW (lpString="NgcSvc") returned 6
	[0159.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0159.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0159.810] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0159.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0159.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0159.811] lstrlenW (lpString="NlaSvc") returned 6
	[0159.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0159.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0159.811] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0159.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0159.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0159.811] lstrlenW (lpString="nsi") returned 3
	[0159.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0159.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0159.811] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0159.811] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0159.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0159.811] lstrlenW (lpString="PcaSvc") returned 6
	[0159.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0159.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0159.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0159.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0159.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0159.811] lstrlenW (lpString="PlugPlay") returned 8
	[0159.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0159.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0159.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0159.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0159.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0159.811] lstrlenW (lpString="Power") returned 5
	[0159.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0159.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0159.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0159.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0159.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0159.812] lstrlenW (lpString="ProfSvc") returned 7
	[0159.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0159.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0159.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0159.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0159.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0159.812] lstrlenW (lpString="RpcEptMapper") returned 12
	[0159.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0159.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0159.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0159.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0159.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0159.812] lstrlenW (lpString="RpcSs") returned 5
	[0159.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0159.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0159.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0159.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0159.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0159.812] lstrlenW (lpString="SamSs") returned 5
	[0159.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0159.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0159.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0159.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0159.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0159.812] lstrlenW (lpString="Schedule") returned 8
	[0159.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0159.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0159.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0159.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0159.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0159.812] lstrlenW (lpString="SecurityHealthService") returned 21
	[0159.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0159.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0159.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0159.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0159.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0159.813] lstrlenW (lpString="SENS") returned 4
	[0159.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0159.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0159.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0159.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0159.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0159.813] lstrlenW (lpString="ShellHWDetection") returned 16
	[0159.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0159.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0159.813] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0159.813] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0159.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0159.813] lstrlenW (lpString="Spooler") returned 7
	[0159.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0159.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0159.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0159.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0159.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0159.813] lstrlenW (lpString="StateRepository") returned 15
	[0159.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0159.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0159.813] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0159.813] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0159.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0159.813] lstrlenW (lpString="SysMain") returned 7
	[0159.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0159.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0159.814] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0159.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0159.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0159.814] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0159.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0159.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0159.814] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0159.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0159.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0159.814] lstrlenW (lpString="Themes") returned 6
	[0159.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0159.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0159.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0159.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0159.814] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45184c8 | out: hHeap=0x4c0000) returned 1
	[0159.814] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x514
	[0160.203] Process32FirstW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0160.204] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0160.204] lstrlenW (lpString="System") returned 6
	[0160.204] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0160.204] lstrlenW (lpString="smss.exe") returned 8
	[0160.204] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0160.205] lstrlenW (lpString="csrss.exe") returned 9
	[0160.205] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0160.205] lstrlenW (lpString="wininit.exe") returned 11
	[0160.205] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0160.206] lstrlenW (lpString="csrss.exe") returned 9
	[0160.206] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0160.206] lstrlenW (lpString="winlogon.exe") returned 12
	[0160.206] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0160.207] lstrlenW (lpString="services.exe") returned 12
	[0160.207] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0160.207] lstrlenW (lpString="lsass.exe") returned 9
	[0160.207] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0160.207] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0160.208] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0160.208] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0160.208] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.208] lstrlenW (lpString="svchost.exe") returned 11
	[0160.208] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.209] lstrlenW (lpString="svchost.exe") returned 11
	[0160.209] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0160.209] lstrlenW (lpString="dwm.exe") returned 7
	[0160.209] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.210] lstrlenW (lpString="svchost.exe") returned 11
	[0160.210] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.210] lstrlenW (lpString="svchost.exe") returned 11
	[0160.210] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.210] lstrlenW (lpString="svchost.exe") returned 11
	[0160.210] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.211] lstrlenW (lpString="svchost.exe") returned 11
	[0160.211] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.211] lstrlenW (lpString="svchost.exe") returned 11
	[0160.211] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.212] lstrlenW (lpString="svchost.exe") returned 11
	[0160.212] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.212] lstrlenW (lpString="svchost.exe") returned 11
	[0160.212] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.213] lstrlenW (lpString="svchost.exe") returned 11
	[0160.213] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.213] lstrlenW (lpString="svchost.exe") returned 11
	[0160.213] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.213] lstrlenW (lpString="svchost.exe") returned 11
	[0160.213] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0160.214] lstrlenW (lpString="spoolsv.exe") returned 11
	[0160.214] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.214] lstrlenW (lpString="svchost.exe") returned 11
	[0160.214] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0160.215] lstrlenW (lpString="audiodg.exe") returned 11
	[0160.215] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0160.215] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0160.215] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0160.216] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0160.216] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0160.216] lstrlenW (lpString="sihost.exe") returned 10
	[0160.216] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0160.216] lstrlenW (lpString="Memory Compression") returned 18
	[0160.216] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.217] lstrlenW (lpString="svchost.exe") returned 11
	[0160.217] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0160.217] lstrlenW (lpString="msoia.exe") returned 9
	[0160.217] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0160.218] lstrlenW (lpString="taskhostw.exe") returned 13
	[0160.218] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0160.218] lstrlenW (lpString="explorer.exe") returned 12
	[0160.218] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0160.218] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0160.218] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0160.219] lstrlenW (lpString="SearchUI.exe") returned 12
	[0160.219] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0160.219] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0160.219] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0160.220] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0160.220] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0160.220] lstrlenW (lpString="d2.exe") returned 6
	[0160.220] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0160.221] lstrlenW (lpString="cmd.exe") returned 7
	[0160.221] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0160.221] lstrlenW (lpString="conhost.exe") returned 11
	[0160.221] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0160.222] lstrlenW (lpString="mode.com") returned 8
	[0160.222] Process32NextW (in: hSnapshot=0x514, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0160.222] CloseHandle (hObject=0x514) returned 1
	[0160.222] Sleep (dwMilliseconds=0x1f4) 
	[0160.757] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ee20
	[0160.758] EnumServicesStatusExW (in: hSCManager=0x52ee20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0160.758] GetLastError () returned 0xea
	[0160.758] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x4519268
	[0160.758] EnumServicesStatusExW (in: hSCManager=0x52ee20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4519268, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4519268, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0160.759] CloseServiceHandle (hSCObject=0x52ee20) returned 1
	[0160.759] lstrlenW (lpString="Appinfo") returned 7
	[0160.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0160.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0160.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0160.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0160.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0160.759] lstrlenW (lpString="AppXSvc") returned 7
	[0160.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0160.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0160.759] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0160.759] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0160.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0160.760] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0160.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0160.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0160.760] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0160.760] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0160.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0160.760] lstrlenW (lpString="Audiosrv") returned 8
	[0160.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0160.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0160.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0160.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0160.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0160.760] lstrlenW (lpString="BFE") returned 3
	[0160.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0160.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0160.760] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0160.760] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0160.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0160.760] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0160.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0160.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0160.760] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0160.760] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0160.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0160.760] lstrlenW (lpString="CDPSvc") returned 6
	[0160.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0160.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0160.760] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0160.760] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0160.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0160.760] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0160.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0160.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0160.761] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0160.761] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0160.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0160.761] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0160.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0160.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0160.761] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0160.761] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0160.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0160.761] lstrlenW (lpString="CryptSvc") returned 8
	[0160.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0160.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0160.761] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0160.761] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0160.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0160.761] lstrlenW (lpString="DcomLaunch") returned 10
	[0160.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0160.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0160.761] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0160.761] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0160.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0160.761] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0160.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0160.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0160.761] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0160.761] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0160.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0160.761] lstrlenW (lpString="Dhcp") returned 4
	[0160.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0160.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0160.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0160.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0160.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0160.762] lstrlenW (lpString="Dnscache") returned 8
	[0160.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0160.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0160.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0160.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0160.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0160.762] lstrlenW (lpString="DPS") returned 3
	[0160.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0160.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0160.762] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0160.762] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0160.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0160.762] lstrlenW (lpString="DsmSvc") returned 6
	[0160.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0160.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0160.762] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0160.762] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0160.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0160.762] lstrlenW (lpString="DusmSvc") returned 7
	[0160.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0160.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0160.762] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0160.762] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0160.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0160.762] lstrlenW (lpString="EventLog") returned 8
	[0160.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0160.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0160.762] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0160.762] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0160.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0160.763] lstrlenW (lpString="EventSystem") returned 11
	[0160.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0160.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0160.763] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0160.763] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0160.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0160.763] lstrlenW (lpString="FontCache") returned 9
	[0160.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0160.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0160.763] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0160.763] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0160.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0160.763] lstrlenW (lpString="gpsvc") returned 5
	[0160.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0160.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0160.763] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0160.763] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0160.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0160.763] lstrlenW (lpString="iphlpsvc") returned 8
	[0160.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0160.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0160.763] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0160.763] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0160.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0160.763] lstrlenW (lpString="KeyIso") returned 6
	[0160.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0160.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0160.763] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0160.763] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0160.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0160.763] lstrlenW (lpString="LanmanServer") returned 12
	[0160.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0160.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0160.764] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0160.764] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0160.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0160.764] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0160.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0160.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0160.764] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0160.764] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0160.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0160.764] lstrlenW (lpString="lfsvc") returned 5
	[0160.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0160.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0160.764] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0160.764] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0160.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0160.764] lstrlenW (lpString="lmhosts") returned 7
	[0160.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0160.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0160.764] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0160.764] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0160.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0160.764] lstrlenW (lpString="LSM") returned 3
	[0160.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0160.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0160.764] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0160.764] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0160.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0160.764] lstrlenW (lpString="MpsSvc") returned 6
	[0160.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0160.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0160.764] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0160.765] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0160.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0160.765] lstrlenW (lpString="NcbService") returned 10
	[0160.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0160.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0160.765] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0160.765] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0160.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0160.765] lstrlenW (lpString="netprofm") returned 8
	[0160.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0160.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0160.765] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0160.765] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0160.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0160.765] lstrlenW (lpString="NgcSvc") returned 6
	[0160.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0160.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0160.765] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0160.765] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0160.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0160.765] lstrlenW (lpString="NlaSvc") returned 6
	[0160.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0160.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0160.765] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0160.765] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0160.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0160.765] lstrlenW (lpString="nsi") returned 3
	[0160.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0160.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0160.765] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0160.765] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0160.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0160.766] lstrlenW (lpString="PcaSvc") returned 6
	[0160.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0160.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0160.767] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0160.767] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0160.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0160.767] lstrlenW (lpString="PlugPlay") returned 8
	[0160.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0160.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0160.767] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0160.767] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0160.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0160.767] lstrlenW (lpString="Power") returned 5
	[0160.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0160.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0160.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0160.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0160.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0160.767] lstrlenW (lpString="ProfSvc") returned 7
	[0160.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0160.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0160.767] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0160.767] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0160.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0160.767] lstrlenW (lpString="RpcEptMapper") returned 12
	[0160.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0160.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0160.846] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0160.846] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0160.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0160.846] lstrlenW (lpString="RpcSs") returned 5
	[0160.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0160.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0160.846] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0160.846] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0160.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0160.846] lstrlenW (lpString="SamSs") returned 5
	[0160.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0160.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0160.846] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0160.846] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0160.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0160.846] lstrlenW (lpString="Schedule") returned 8
	[0160.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0160.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0160.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0160.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0160.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0160.846] lstrlenW (lpString="SecurityHealthService") returned 21
	[0160.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0160.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0160.847] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0160.847] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0160.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0160.847] lstrlenW (lpString="SENS") returned 4
	[0160.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0160.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0160.847] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0160.847] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0160.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0160.847] lstrlenW (lpString="ShellHWDetection") returned 16
	[0160.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0160.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0160.847] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0160.847] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0160.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0160.847] lstrlenW (lpString="Spooler") returned 7
	[0160.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0160.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0160.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0160.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0160.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0160.847] lstrlenW (lpString="StateRepository") returned 15
	[0160.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0160.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0160.847] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0160.847] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0160.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0160.847] lstrlenW (lpString="SysMain") returned 7
	[0160.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0160.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0160.848] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0160.848] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0160.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0160.848] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0160.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0160.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0160.848] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0160.848] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0160.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0160.848] lstrlenW (lpString="Themes") returned 6
	[0160.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0160.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0160.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0160.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0160.848] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4519268 | out: hHeap=0x4c0000) returned 1
	[0160.848] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x44c
	[0160.852] Process32FirstW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0160.852] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0160.853] lstrlenW (lpString="System") returned 6
	[0160.853] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0160.853] lstrlenW (lpString="smss.exe") returned 8
	[0160.853] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0160.854] lstrlenW (lpString="csrss.exe") returned 9
	[0160.854] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0160.854] lstrlenW (lpString="wininit.exe") returned 11
	[0160.854] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0160.855] lstrlenW (lpString="csrss.exe") returned 9
	[0160.855] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0160.855] lstrlenW (lpString="winlogon.exe") returned 12
	[0160.855] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0160.855] lstrlenW (lpString="services.exe") returned 12
	[0160.856] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0160.856] lstrlenW (lpString="lsass.exe") returned 9
	[0160.856] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0160.856] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0160.856] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0160.857] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0160.857] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.857] lstrlenW (lpString="svchost.exe") returned 11
	[0160.857] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.858] lstrlenW (lpString="svchost.exe") returned 11
	[0160.858] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0160.858] lstrlenW (lpString="dwm.exe") returned 7
	[0160.858] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.858] lstrlenW (lpString="svchost.exe") returned 11
	[0160.859] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.859] lstrlenW (lpString="svchost.exe") returned 11
	[0160.859] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.859] lstrlenW (lpString="svchost.exe") returned 11
	[0160.859] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.860] lstrlenW (lpString="svchost.exe") returned 11
	[0160.860] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.860] lstrlenW (lpString="svchost.exe") returned 11
	[0160.860] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.861] lstrlenW (lpString="svchost.exe") returned 11
	[0160.861] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.861] lstrlenW (lpString="svchost.exe") returned 11
	[0160.861] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.862] lstrlenW (lpString="svchost.exe") returned 11
	[0160.862] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.862] lstrlenW (lpString="svchost.exe") returned 11
	[0160.862] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.863] lstrlenW (lpString="svchost.exe") returned 11
	[0160.863] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0160.863] lstrlenW (lpString="spoolsv.exe") returned 11
	[0160.863] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.864] lstrlenW (lpString="svchost.exe") returned 11
	[0160.864] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0160.864] lstrlenW (lpString="audiodg.exe") returned 11
	[0160.864] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0160.864] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0160.864] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0160.865] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0160.865] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0160.865] lstrlenW (lpString="sihost.exe") returned 10
	[0160.865] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0160.866] lstrlenW (lpString="Memory Compression") returned 18
	[0160.866] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.866] lstrlenW (lpString="svchost.exe") returned 11
	[0160.866] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0160.867] lstrlenW (lpString="msoia.exe") returned 9
	[0160.867] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0160.867] lstrlenW (lpString="taskhostw.exe") returned 13
	[0160.867] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0160.867] lstrlenW (lpString="explorer.exe") returned 12
	[0160.867] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0160.868] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0160.868] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0160.868] lstrlenW (lpString="SearchUI.exe") returned 12
	[0160.868] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0160.869] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0160.869] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0160.869] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0160.869] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0160.870] lstrlenW (lpString="d2.exe") returned 6
	[0160.870] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0160.870] lstrlenW (lpString="cmd.exe") returned 7
	[0160.870] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0160.870] lstrlenW (lpString="conhost.exe") returned 11
	[0160.870] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0160.871] lstrlenW (lpString="mode.com") returned 8
	[0160.871] Process32NextW (in: hSnapshot=0x44c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0160.871] CloseHandle (hObject=0x44c) returned 1
	[0160.871] Sleep (dwMilliseconds=0x1f4) 
	[0161.540] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ef38
	[0161.541] EnumServicesStatusExW (in: hSCManager=0x52ef38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0161.541] GetLastError () returned 0xea
	[0161.541] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x44b2a98
	[0161.542] EnumServicesStatusExW (in: hSCManager=0x52ef38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44b2a98, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44b2a98, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0161.543] CloseServiceHandle (hSCObject=0x52ef38) returned 1
	[0161.543] lstrlenW (lpString="Appinfo") returned 7
	[0161.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0161.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0161.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0161.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0161.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0161.543] lstrlenW (lpString="AppXSvc") returned 7
	[0161.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0161.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0161.543] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0161.543] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0161.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0161.543] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0161.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0161.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0161.543] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0161.543] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0161.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0161.543] lstrlenW (lpString="Audiosrv") returned 8
	[0161.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0161.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0161.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0161.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0161.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0161.544] lstrlenW (lpString="BFE") returned 3
	[0161.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0161.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0161.544] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0161.544] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0161.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0161.544] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0161.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0161.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0161.544] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0161.544] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0161.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0161.544] lstrlenW (lpString="CDPSvc") returned 6
	[0161.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0161.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0161.544] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0161.544] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0161.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0161.544] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0161.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0161.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0161.544] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0161.544] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0161.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0161.544] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0161.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0161.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0161.544] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0161.545] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0161.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0161.545] lstrlenW (lpString="CryptSvc") returned 8
	[0161.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0161.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0161.545] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0161.545] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0161.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0161.545] lstrlenW (lpString="DcomLaunch") returned 10
	[0161.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0161.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0161.545] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0161.545] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0161.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0161.545] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0161.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0161.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0161.545] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0161.545] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0161.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0161.545] lstrlenW (lpString="Dhcp") returned 4
	[0161.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0161.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0161.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0161.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0161.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0161.545] lstrlenW (lpString="Dnscache") returned 8
	[0161.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0161.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0161.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0161.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0161.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0161.546] lstrlenW (lpString="DPS") returned 3
	[0161.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0161.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0161.546] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0161.546] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0161.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0161.546] lstrlenW (lpString="DsmSvc") returned 6
	[0161.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0161.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0161.546] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0161.546] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0161.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0161.546] lstrlenW (lpString="DusmSvc") returned 7
	[0161.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0161.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0161.546] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0161.546] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0161.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0161.546] lstrlenW (lpString="EventLog") returned 8
	[0161.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0161.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0161.546] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0161.546] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0161.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0161.546] lstrlenW (lpString="EventSystem") returned 11
	[0161.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0161.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0161.546] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0161.546] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0161.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0161.547] lstrlenW (lpString="FontCache") returned 9
	[0161.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0161.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0161.547] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0161.547] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0161.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0161.547] lstrlenW (lpString="gpsvc") returned 5
	[0161.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0161.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0161.547] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0161.547] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0161.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0161.547] lstrlenW (lpString="iphlpsvc") returned 8
	[0161.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0161.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0161.547] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0161.547] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0161.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0161.547] lstrlenW (lpString="KeyIso") returned 6
	[0161.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0161.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0161.547] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0161.547] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0161.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0161.547] lstrlenW (lpString="LanmanServer") returned 12
	[0161.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0161.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0161.547] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0161.547] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0161.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0161.547] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0161.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0161.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0161.548] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0161.548] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0161.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0161.548] lstrlenW (lpString="lfsvc") returned 5
	[0161.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0161.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0161.548] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0161.548] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0161.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0161.548] lstrlenW (lpString="lmhosts") returned 7
	[0161.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0161.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0161.548] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0161.548] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0161.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0161.548] lstrlenW (lpString="LSM") returned 3
	[0161.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0161.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0161.548] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0161.548] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0161.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0161.548] lstrlenW (lpString="MpsSvc") returned 6
	[0161.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0161.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0161.548] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0161.548] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0161.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0161.548] lstrlenW (lpString="NcbService") returned 10
	[0161.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0161.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0161.595] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0161.595] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0161.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0161.595] lstrlenW (lpString="netprofm") returned 8
	[0161.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0161.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0161.595] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0161.595] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0161.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0161.596] lstrlenW (lpString="NgcSvc") returned 6
	[0161.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0161.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0161.596] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0161.596] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0161.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0161.596] lstrlenW (lpString="NlaSvc") returned 6
	[0161.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0161.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0161.596] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0161.596] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0161.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0161.596] lstrlenW (lpString="nsi") returned 3
	[0161.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0161.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0161.596] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0161.596] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0161.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0161.596] lstrlenW (lpString="PcaSvc") returned 6
	[0161.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0161.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0161.596] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0161.596] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0161.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0161.596] lstrlenW (lpString="PlugPlay") returned 8
	[0161.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0161.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0161.596] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0161.597] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0161.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0161.597] lstrlenW (lpString="Power") returned 5
	[0161.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0161.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0161.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0161.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0161.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0161.597] lstrlenW (lpString="ProfSvc") returned 7
	[0161.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0161.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0161.597] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0161.597] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0161.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0161.597] lstrlenW (lpString="RpcEptMapper") returned 12
	[0161.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0161.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0161.597] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0161.597] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0161.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0161.597] lstrlenW (lpString="RpcSs") returned 5
	[0161.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0161.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0161.597] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0161.597] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0161.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0161.597] lstrlenW (lpString="SamSs") returned 5
	[0161.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0161.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0161.597] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0161.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0161.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0161.598] lstrlenW (lpString="Schedule") returned 8
	[0161.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0161.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0161.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0161.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0161.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0161.598] lstrlenW (lpString="SecurityHealthService") returned 21
	[0161.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0161.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0161.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0161.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0161.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0161.598] lstrlenW (lpString="SENS") returned 4
	[0161.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0161.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0161.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0161.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0161.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0161.598] lstrlenW (lpString="ShellHWDetection") returned 16
	[0161.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0161.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0161.598] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0161.598] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0161.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0161.598] lstrlenW (lpString="Spooler") returned 7
	[0161.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0161.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0161.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0161.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0161.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0161.599] lstrlenW (lpString="StateRepository") returned 15
	[0161.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0161.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0161.599] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0161.599] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0161.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0161.599] lstrlenW (lpString="SysMain") returned 7
	[0161.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0161.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0161.599] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0161.599] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0161.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0161.599] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0161.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0161.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0161.599] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0161.599] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0161.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0161.599] lstrlenW (lpString="Themes") returned 6
	[0161.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0161.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0161.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0161.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0161.599] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0161.599] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b8
	[0161.604] Process32FirstW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0161.604] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0161.604] lstrlenW (lpString="System") returned 6
	[0161.604] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0161.605] lstrlenW (lpString="smss.exe") returned 8
	[0161.605] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0161.605] lstrlenW (lpString="csrss.exe") returned 9
	[0161.605] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0161.606] lstrlenW (lpString="wininit.exe") returned 11
	[0161.606] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0161.606] lstrlenW (lpString="csrss.exe") returned 9
	[0161.606] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0161.606] lstrlenW (lpString="winlogon.exe") returned 12
	[0161.606] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0161.607] lstrlenW (lpString="services.exe") returned 12
	[0161.607] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0161.607] lstrlenW (lpString="lsass.exe") returned 9
	[0161.607] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0161.608] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0161.608] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0161.608] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0161.608] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.609] lstrlenW (lpString="svchost.exe") returned 11
	[0161.609] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.609] lstrlenW (lpString="svchost.exe") returned 11
	[0161.609] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0161.609] lstrlenW (lpString="dwm.exe") returned 7
	[0161.609] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.610] lstrlenW (lpString="svchost.exe") returned 11
	[0161.610] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.610] lstrlenW (lpString="svchost.exe") returned 11
	[0161.610] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.611] lstrlenW (lpString="svchost.exe") returned 11
	[0161.611] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.611] lstrlenW (lpString="svchost.exe") returned 11
	[0161.611] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.612] lstrlenW (lpString="svchost.exe") returned 11
	[0161.612] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.612] lstrlenW (lpString="svchost.exe") returned 11
	[0161.612] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.613] lstrlenW (lpString="svchost.exe") returned 11
	[0161.613] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.613] lstrlenW (lpString="svchost.exe") returned 11
	[0161.613] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.614] lstrlenW (lpString="svchost.exe") returned 11
	[0161.614] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.614] lstrlenW (lpString="svchost.exe") returned 11
	[0161.614] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0161.614] lstrlenW (lpString="spoolsv.exe") returned 11
	[0161.614] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.615] lstrlenW (lpString="svchost.exe") returned 11
	[0161.615] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0161.615] lstrlenW (lpString="audiodg.exe") returned 11
	[0161.615] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0161.616] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0161.616] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0161.616] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0161.616] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0161.616] lstrlenW (lpString="sihost.exe") returned 10
	[0161.617] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0161.617] lstrlenW (lpString="Memory Compression") returned 18
	[0161.617] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.617] lstrlenW (lpString="svchost.exe") returned 11
	[0161.617] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0161.618] lstrlenW (lpString="msoia.exe") returned 9
	[0161.618] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0161.618] lstrlenW (lpString="taskhostw.exe") returned 13
	[0161.618] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0161.619] lstrlenW (lpString="explorer.exe") returned 12
	[0161.619] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0161.619] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0161.619] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0161.619] lstrlenW (lpString="SearchUI.exe") returned 12
	[0161.619] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0161.620] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0161.620] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0161.620] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0161.620] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0161.621] lstrlenW (lpString="d2.exe") returned 6
	[0161.621] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0161.621] lstrlenW (lpString="cmd.exe") returned 7
	[0161.621] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0161.621] lstrlenW (lpString="conhost.exe") returned 11
	[0161.622] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0161.625] lstrlenW (lpString="mode.com") returned 8
	[0161.625] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0161.625] lstrlenW (lpString="consent.exe") returned 11
	[0161.625] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0161.626] CloseHandle (hObject=0x4b8) returned 1
	[0161.626] Sleep (dwMilliseconds=0x1f4) 
	[0162.493] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ef38
	[0162.515] EnumServicesStatusExW (in: hSCManager=0x52ef38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0162.516] GetLastError () returned 0xea
	[0162.516] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x4519518
	[0162.516] EnumServicesStatusExW (in: hSCManager=0x52ef38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4519518, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4519518, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0162.516] CloseServiceHandle (hSCObject=0x52ef38) returned 1
	[0162.517] lstrlenW (lpString="Appinfo") returned 7
	[0162.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0162.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0162.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0162.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0162.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0162.517] lstrlenW (lpString="AppXSvc") returned 7
	[0162.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0162.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0162.517] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0162.517] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0162.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0162.517] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0162.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0162.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0162.517] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0162.517] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0162.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0162.517] lstrlenW (lpString="Audiosrv") returned 8
	[0162.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0162.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0162.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0162.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0162.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0162.518] lstrlenW (lpString="BFE") returned 3
	[0162.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0162.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0162.518] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0162.518] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0162.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0162.518] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0162.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0162.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0162.518] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0162.518] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0162.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0162.518] lstrlenW (lpString="CDPSvc") returned 6
	[0162.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0162.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0162.518] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0162.518] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0162.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0162.518] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0162.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0162.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0162.519] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0162.519] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0162.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0162.519] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0162.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0162.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0162.519] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0162.519] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0162.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0162.519] lstrlenW (lpString="CryptSvc") returned 8
	[0162.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0162.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0162.519] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0162.519] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0162.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0162.519] lstrlenW (lpString="DcomLaunch") returned 10
	[0162.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0162.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0162.519] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0162.519] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0162.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0162.519] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0162.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0162.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0162.519] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0162.519] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0162.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0162.519] lstrlenW (lpString="Dhcp") returned 4
	[0162.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0162.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0162.519] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0162.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0162.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0162.520] lstrlenW (lpString="Dnscache") returned 8
	[0162.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0162.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0162.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0162.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0162.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0162.520] lstrlenW (lpString="DPS") returned 3
	[0162.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0162.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0162.520] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0162.520] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0162.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0162.520] lstrlenW (lpString="DsmSvc") returned 6
	[0162.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0162.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0162.520] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0162.520] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0162.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0162.520] lstrlenW (lpString="DusmSvc") returned 7
	[0162.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0162.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0162.520] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0162.520] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0162.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0162.520] lstrlenW (lpString="EventLog") returned 8
	[0162.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0162.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0162.520] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0162.521] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0162.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0162.521] lstrlenW (lpString="EventSystem") returned 11
	[0162.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0162.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0162.521] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0162.521] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0162.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0162.521] lstrlenW (lpString="FontCache") returned 9
	[0162.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0162.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0162.521] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0162.521] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0162.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0162.521] lstrlenW (lpString="gpsvc") returned 5
	[0162.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0162.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0162.521] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0162.521] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0162.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0162.521] lstrlenW (lpString="iphlpsvc") returned 8
	[0162.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0162.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0162.521] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0162.521] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0162.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0162.521] lstrlenW (lpString="KeyIso") returned 6
	[0162.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0162.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0162.521] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0162.521] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0162.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0162.522] lstrlenW (lpString="LanmanServer") returned 12
	[0162.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0162.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0162.522] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0162.522] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0162.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0162.522] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0162.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0162.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0162.522] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0162.522] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0162.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0162.522] lstrlenW (lpString="lfsvc") returned 5
	[0162.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0162.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0162.522] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0162.522] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0162.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0162.522] lstrlenW (lpString="lmhosts") returned 7
	[0162.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0162.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0162.522] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0162.522] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0162.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0162.522] lstrlenW (lpString="LSM") returned 3
	[0162.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0162.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0162.522] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0162.522] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0162.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0162.523] lstrlenW (lpString="MpsSvc") returned 6
	[0162.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0162.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0162.523] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0162.523] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0162.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0162.523] lstrlenW (lpString="NcbService") returned 10
	[0162.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0162.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0162.523] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0162.523] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0162.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0162.523] lstrlenW (lpString="netprofm") returned 8
	[0162.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0162.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0162.523] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0162.523] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0162.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0162.523] lstrlenW (lpString="NgcSvc") returned 6
	[0162.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0162.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0162.523] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0162.523] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0162.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0162.523] lstrlenW (lpString="NlaSvc") returned 6
	[0162.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0162.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0162.523] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0162.523] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0162.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0162.523] lstrlenW (lpString="nsi") returned 3
	[0162.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0162.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0162.524] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0162.524] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0162.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0162.524] lstrlenW (lpString="PcaSvc") returned 6
	[0162.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0162.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0162.524] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0162.524] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0162.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0162.524] lstrlenW (lpString="PlugPlay") returned 8
	[0162.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0162.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0162.524] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0162.524] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0162.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0162.524] lstrlenW (lpString="Power") returned 5
	[0162.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0162.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0162.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0162.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0162.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0162.524] lstrlenW (lpString="ProfSvc") returned 7
	[0162.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0162.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0162.524] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0162.524] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0162.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0162.524] lstrlenW (lpString="RpcEptMapper") returned 12
	[0162.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0162.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0162.525] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0162.525] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0162.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0162.525] lstrlenW (lpString="RpcSs") returned 5
	[0162.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0162.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0162.525] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0162.525] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0162.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0162.525] lstrlenW (lpString="SamSs") returned 5
	[0162.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0162.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0162.525] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0162.525] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0162.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0162.525] lstrlenW (lpString="Schedule") returned 8
	[0162.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0162.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0162.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0162.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0162.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0162.525] lstrlenW (lpString="SecurityHealthService") returned 21
	[0162.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0162.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0162.525] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0162.525] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0162.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0162.525] lstrlenW (lpString="SENS") returned 4
	[0162.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0162.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0162.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0162.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0162.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0162.526] lstrlenW (lpString="ShellHWDetection") returned 16
	[0162.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0162.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0162.526] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0162.526] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0162.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0162.526] lstrlenW (lpString="Spooler") returned 7
	[0162.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0162.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0162.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0162.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0162.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0162.526] lstrlenW (lpString="StateRepository") returned 15
	[0162.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0162.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0162.526] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0162.526] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0162.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0162.526] lstrlenW (lpString="SysMain") returned 7
	[0162.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0162.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0162.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0162.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0162.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0162.526] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0162.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0162.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0162.527] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0162.527] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0162.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0162.527] lstrlenW (lpString="Themes") returned 6
	[0162.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0162.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0162.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0162.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0162.527] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4519518 | out: hHeap=0x4c0000) returned 1
	[0162.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x558
	[0162.531] Process32FirstW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0162.531] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0162.532] lstrlenW (lpString="System") returned 6
	[0162.532] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0162.532] lstrlenW (lpString="smss.exe") returned 8
	[0162.532] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0162.533] lstrlenW (lpString="csrss.exe") returned 9
	[0162.533] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0162.533] lstrlenW (lpString="wininit.exe") returned 11
	[0162.533] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0162.533] lstrlenW (lpString="csrss.exe") returned 9
	[0162.533] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0162.534] lstrlenW (lpString="winlogon.exe") returned 12
	[0162.534] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0162.534] lstrlenW (lpString="services.exe") returned 12
	[0162.534] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0162.535] lstrlenW (lpString="lsass.exe") returned 9
	[0162.535] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0162.829] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0162.829] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0162.830] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0162.830] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.830] lstrlenW (lpString="svchost.exe") returned 11
	[0162.830] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.831] lstrlenW (lpString="svchost.exe") returned 11
	[0162.831] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0162.831] lstrlenW (lpString="dwm.exe") returned 7
	[0162.831] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.832] lstrlenW (lpString="svchost.exe") returned 11
	[0162.832] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.832] lstrlenW (lpString="svchost.exe") returned 11
	[0162.832] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.833] lstrlenW (lpString="svchost.exe") returned 11
	[0162.833] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.833] lstrlenW (lpString="svchost.exe") returned 11
	[0162.833] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.833] lstrlenW (lpString="svchost.exe") returned 11
	[0162.833] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.834] lstrlenW (lpString="svchost.exe") returned 11
	[0162.834] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.834] lstrlenW (lpString="svchost.exe") returned 11
	[0162.834] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.835] lstrlenW (lpString="svchost.exe") returned 11
	[0162.835] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.835] lstrlenW (lpString="svchost.exe") returned 11
	[0162.835] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.836] lstrlenW (lpString="svchost.exe") returned 11
	[0162.836] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0162.836] lstrlenW (lpString="spoolsv.exe") returned 11
	[0162.836] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.836] lstrlenW (lpString="svchost.exe") returned 11
	[0162.837] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0162.837] lstrlenW (lpString="audiodg.exe") returned 11
	[0162.837] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0162.837] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0162.837] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0162.838] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0162.838] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0162.838] lstrlenW (lpString="sihost.exe") returned 10
	[0162.838] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0162.839] lstrlenW (lpString="Memory Compression") returned 18
	[0162.839] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0162.839] lstrlenW (lpString="svchost.exe") returned 11
	[0162.839] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0162.839] lstrlenW (lpString="msoia.exe") returned 9
	[0162.840] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0162.840] lstrlenW (lpString="taskhostw.exe") returned 13
	[0162.840] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0162.840] lstrlenW (lpString="explorer.exe") returned 12
	[0162.840] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0162.841] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0162.841] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0162.841] lstrlenW (lpString="SearchUI.exe") returned 12
	[0162.841] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0162.842] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0162.842] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0162.842] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0162.842] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0162.842] lstrlenW (lpString="d2.exe") returned 6
	[0162.842] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0162.843] lstrlenW (lpString="cmd.exe") returned 7
	[0162.843] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0162.843] lstrlenW (lpString="conhost.exe") returned 11
	[0162.843] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0162.844] lstrlenW (lpString="mode.com") returned 8
	[0162.844] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0162.844] lstrlenW (lpString="consent.exe") returned 11
	[0162.844] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0162.845] CloseHandle (hObject=0x558) returned 1
	[0162.845] Sleep (dwMilliseconds=0x1f4) 
	[0163.714] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ef88
	[0163.730] EnumServicesStatusExW (in: hSCManager=0x52ef88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0163.731] GetLastError () returned 0xea
	[0163.731] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x44b2a98
	[0163.732] EnumServicesStatusExW (in: hSCManager=0x52ef88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44b2a98, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44b2a98, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0163.734] CloseServiceHandle (hSCObject=0x52ef88) returned 1
	[0163.735] lstrlenW (lpString="Appinfo") returned 7
	[0163.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0163.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0163.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0163.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0163.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0163.735] lstrlenW (lpString="AppXSvc") returned 7
	[0163.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0163.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0163.735] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0163.735] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0163.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0163.735] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0163.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0163.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0163.735] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0163.735] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0163.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0163.735] lstrlenW (lpString="Audiosrv") returned 8
	[0163.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0163.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0163.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0163.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0163.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0163.735] lstrlenW (lpString="BFE") returned 3
	[0163.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0163.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0163.736] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0163.736] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0163.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0163.736] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0163.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0163.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0163.736] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0163.736] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0163.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0163.736] lstrlenW (lpString="CDPSvc") returned 6
	[0163.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0163.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0163.736] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0163.736] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0163.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0163.736] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0163.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0163.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0163.736] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0163.737] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0163.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0163.737] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0163.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0163.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0163.737] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0163.737] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0163.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0163.737] lstrlenW (lpString="CryptSvc") returned 8
	[0163.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0163.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0163.737] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0163.737] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0163.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0163.737] lstrlenW (lpString="DcomLaunch") returned 10
	[0163.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0163.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0163.737] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0163.737] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0163.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0163.737] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0163.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0163.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0163.737] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0163.737] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0163.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0163.737] lstrlenW (lpString="Dhcp") returned 4
	[0163.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0163.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0163.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0163.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0163.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0163.738] lstrlenW (lpString="Dnscache") returned 8
	[0163.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0163.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0163.738] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0163.738] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0163.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0163.738] lstrlenW (lpString="DPS") returned 3
	[0163.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0163.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0163.738] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0163.738] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0163.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0163.738] lstrlenW (lpString="DsmSvc") returned 6
	[0163.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0163.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0163.738] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0163.738] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0163.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0163.738] lstrlenW (lpString="DusmSvc") returned 7
	[0163.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0163.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0163.738] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0163.738] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0163.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0163.738] lstrlenW (lpString="EventLog") returned 8
	[0163.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0163.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0163.738] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0163.738] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0163.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0163.739] lstrlenW (lpString="EventSystem") returned 11
	[0163.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0163.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0163.739] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0163.739] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0163.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0163.739] lstrlenW (lpString="FontCache") returned 9
	[0163.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0163.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0163.739] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0163.739] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0163.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0163.739] lstrlenW (lpString="gpsvc") returned 5
	[0163.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0163.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0163.739] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0163.739] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0163.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0163.739] lstrlenW (lpString="iphlpsvc") returned 8
	[0163.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0163.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0163.739] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0163.739] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0163.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0163.739] lstrlenW (lpString="KeyIso") returned 6
	[0163.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0163.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0163.739] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0163.739] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0163.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0163.739] lstrlenW (lpString="LanmanServer") returned 12
	[0163.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0163.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0163.740] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0163.740] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0163.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0163.740] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0163.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0163.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0163.740] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0163.740] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0163.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0163.740] lstrlenW (lpString="lfsvc") returned 5
	[0163.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0163.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0163.740] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0163.740] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0163.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0163.740] lstrlenW (lpString="lmhosts") returned 7
	[0163.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0163.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0163.740] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0163.740] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0163.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0163.740] lstrlenW (lpString="LSM") returned 3
	[0163.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0163.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0163.740] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0163.740] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0163.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0163.740] lstrlenW (lpString="MpsSvc") returned 6
	[0163.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0163.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0163.741] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0163.741] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0163.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0163.741] lstrlenW (lpString="NcbService") returned 10
	[0163.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0163.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0163.741] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0163.741] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0163.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0163.741] lstrlenW (lpString="netprofm") returned 8
	[0163.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0163.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0163.741] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0163.741] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0163.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0163.741] lstrlenW (lpString="NgcSvc") returned 6
	[0163.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0163.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0163.741] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0163.741] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0163.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0163.741] lstrlenW (lpString="NlaSvc") returned 6
	[0163.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0163.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0163.741] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0163.741] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0163.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0163.741] lstrlenW (lpString="nsi") returned 3
	[0163.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0163.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0163.742] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0163.742] lstrlenW (lpString="PcaSvc") returned 6
	[0163.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0163.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0163.742] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0163.742] lstrlenW (lpString="PlugPlay") returned 8
	[0163.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0163.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0163.742] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0163.742] lstrlenW (lpString="Power") returned 5
	[0163.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0163.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0163.742] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0163.742] lstrlenW (lpString="ProfSvc") returned 7
	[0163.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0163.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0163.742] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0163.742] lstrlenW (lpString="RpcEptMapper") returned 12
	[0163.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0163.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0163.742] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0163.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0163.743] lstrlenW (lpString="RpcSs") returned 5
	[0163.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0163.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0163.743] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0163.743] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0163.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0163.743] lstrlenW (lpString="SamSs") returned 5
	[0163.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0163.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0163.743] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0163.743] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0163.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0163.743] lstrlenW (lpString="Schedule") returned 8
	[0163.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0163.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0163.743] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0163.743] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0163.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0163.743] lstrlenW (lpString="SecurityHealthService") returned 21
	[0163.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0163.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0163.743] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0163.743] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0163.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0163.743] lstrlenW (lpString="SENS") returned 4
	[0163.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0163.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0163.743] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0163.743] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0163.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0163.743] lstrlenW (lpString="ShellHWDetection") returned 16
	[0163.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0163.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0163.744] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0163.744] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0163.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0163.744] lstrlenW (lpString="Spooler") returned 7
	[0163.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0163.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0163.744] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0163.744] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0163.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0163.744] lstrlenW (lpString="StateRepository") returned 15
	[0163.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0163.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0163.744] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0163.744] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0163.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0163.744] lstrlenW (lpString="SysMain") returned 7
	[0163.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0163.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0163.744] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0163.744] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0163.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0163.744] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0163.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0163.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0163.744] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0163.744] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0163.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0163.744] lstrlenW (lpString="Themes") returned 6
	[0163.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0163.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0163.745] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0163.745] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0163.745] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0163.745] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b8
	[0163.749] Process32FirstW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0163.749] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0163.750] lstrlenW (lpString="System") returned 6
	[0163.750] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0163.750] lstrlenW (lpString="smss.exe") returned 8
	[0163.750] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0163.750] lstrlenW (lpString="csrss.exe") returned 9
	[0163.751] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0163.751] lstrlenW (lpString="wininit.exe") returned 11
	[0163.751] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0163.751] lstrlenW (lpString="csrss.exe") returned 9
	[0163.751] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0164.029] lstrlenW (lpString="winlogon.exe") returned 12
	[0164.029] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0164.041] lstrlenW (lpString="services.exe") returned 12
	[0164.041] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0164.042] lstrlenW (lpString="lsass.exe") returned 9
	[0164.042] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0164.042] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0164.042] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0164.042] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0164.043] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.043] lstrlenW (lpString="svchost.exe") returned 11
	[0164.043] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.043] lstrlenW (lpString="svchost.exe") returned 11
	[0164.043] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0164.044] lstrlenW (lpString="dwm.exe") returned 7
	[0164.044] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.044] lstrlenW (lpString="svchost.exe") returned 11
	[0164.044] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.045] lstrlenW (lpString="svchost.exe") returned 11
	[0164.045] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.045] lstrlenW (lpString="svchost.exe") returned 11
	[0164.045] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.045] lstrlenW (lpString="svchost.exe") returned 11
	[0164.045] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.046] lstrlenW (lpString="svchost.exe") returned 11
	[0164.046] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.046] lstrlenW (lpString="svchost.exe") returned 11
	[0164.046] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.047] lstrlenW (lpString="svchost.exe") returned 11
	[0164.047] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.047] lstrlenW (lpString="svchost.exe") returned 11
	[0164.047] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.048] lstrlenW (lpString="svchost.exe") returned 11
	[0164.048] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.048] lstrlenW (lpString="svchost.exe") returned 11
	[0164.048] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0164.048] lstrlenW (lpString="spoolsv.exe") returned 11
	[0164.048] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.049] lstrlenW (lpString="svchost.exe") returned 11
	[0164.049] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0164.049] lstrlenW (lpString="audiodg.exe") returned 11
	[0164.049] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0164.050] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0164.050] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0164.050] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0164.050] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0164.051] lstrlenW (lpString="sihost.exe") returned 10
	[0164.051] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0164.051] lstrlenW (lpString="Memory Compression") returned 18
	[0164.051] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.051] lstrlenW (lpString="svchost.exe") returned 11
	[0164.051] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0164.052] lstrlenW (lpString="msoia.exe") returned 9
	[0164.052] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0164.052] lstrlenW (lpString="taskhostw.exe") returned 13
	[0164.052] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0164.053] lstrlenW (lpString="explorer.exe") returned 12
	[0164.053] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0164.053] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0164.053] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0164.054] lstrlenW (lpString="SearchUI.exe") returned 12
	[0164.054] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0164.054] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0164.054] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0164.054] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0164.054] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0164.055] lstrlenW (lpString="d2.exe") returned 6
	[0164.055] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0164.055] lstrlenW (lpString="cmd.exe") returned 7
	[0164.055] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0164.056] lstrlenW (lpString="conhost.exe") returned 11
	[0164.056] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0164.056] lstrlenW (lpString="mode.com") returned 8
	[0164.056] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0164.056] lstrlenW (lpString="consent.exe") returned 11
	[0164.056] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0164.057] CloseHandle (hObject=0x4b8) returned 1
	[0164.057] Sleep (dwMilliseconds=0x1f4) 
	[0164.604] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ee70
	[0164.604] EnumServicesStatusExW (in: hSCManager=0x52ee70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0164.605] GetLastError () returned 0xea
	[0164.605] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x44b2a98
	[0164.605] EnumServicesStatusExW (in: hSCManager=0x52ee70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44b2a98, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44b2a98, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0164.606] CloseServiceHandle (hSCObject=0x52ee70) returned 1
	[0164.606] lstrlenW (lpString="Appinfo") returned 7
	[0164.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0164.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0164.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0164.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0164.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0164.606] lstrlenW (lpString="AppXSvc") returned 7
	[0164.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0164.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0164.606] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0164.606] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0164.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0164.606] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0164.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0164.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0164.607] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0164.607] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0164.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0164.607] lstrlenW (lpString="Audiosrv") returned 8
	[0164.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0164.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0164.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0164.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0164.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0164.607] lstrlenW (lpString="BFE") returned 3
	[0164.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0164.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0164.607] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0164.607] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0164.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0164.607] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0164.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0164.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0164.607] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0164.607] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0164.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0164.607] lstrlenW (lpString="CDPSvc") returned 6
	[0164.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0164.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0164.607] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0164.607] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0164.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0164.607] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0164.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0164.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0164.607] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0164.608] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0164.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0164.608] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0164.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0164.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0164.608] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0164.608] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0164.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0164.608] lstrlenW (lpString="CryptSvc") returned 8
	[0164.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0164.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0164.608] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0164.608] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0164.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0164.608] lstrlenW (lpString="DcomLaunch") returned 10
	[0164.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0164.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0164.608] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0164.608] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0164.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0164.608] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0164.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0164.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0164.608] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0164.608] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0164.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0164.608] lstrlenW (lpString="Dhcp") returned 4
	[0164.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0164.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0164.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0164.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0164.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0164.609] lstrlenW (lpString="Dnscache") returned 8
	[0164.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0164.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0164.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0164.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0164.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0164.609] lstrlenW (lpString="DPS") returned 3
	[0164.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0164.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0164.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0164.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0164.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0164.609] lstrlenW (lpString="DsmSvc") returned 6
	[0164.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0164.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0164.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0164.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0164.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0164.609] lstrlenW (lpString="DusmSvc") returned 7
	[0164.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0164.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0164.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0164.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0164.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0164.609] lstrlenW (lpString="EventLog") returned 8
	[0164.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0164.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0164.609] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0164.609] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0164.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0164.610] lstrlenW (lpString="EventSystem") returned 11
	[0164.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0164.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0164.610] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0164.610] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0164.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0164.610] lstrlenW (lpString="FontCache") returned 9
	[0164.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0164.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0164.610] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0164.610] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0164.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0164.610] lstrlenW (lpString="gpsvc") returned 5
	[0164.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0164.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0164.610] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0164.610] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0164.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0164.610] lstrlenW (lpString="iphlpsvc") returned 8
	[0164.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0164.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0164.610] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0164.610] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0164.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0164.610] lstrlenW (lpString="KeyIso") returned 6
	[0164.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0164.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0164.610] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0164.610] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0164.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0164.610] lstrlenW (lpString="LanmanServer") returned 12
	[0164.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0164.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0164.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0164.611] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0164.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0164.611] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0164.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0164.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0164.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0164.611] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0164.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0164.611] lstrlenW (lpString="lfsvc") returned 5
	[0164.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0164.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0164.611] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0164.611] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0164.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0164.611] lstrlenW (lpString="lmhosts") returned 7
	[0164.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0164.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0164.611] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0164.611] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0164.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0164.611] lstrlenW (lpString="LSM") returned 3
	[0164.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0164.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0164.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0164.611] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0164.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0164.611] lstrlenW (lpString="MpsSvc") returned 6
	[0164.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0164.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0164.612] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0164.612] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0164.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0164.612] lstrlenW (lpString="NcbService") returned 10
	[0164.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0164.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0164.612] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0164.612] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0164.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0164.612] lstrlenW (lpString="netprofm") returned 8
	[0164.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0164.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0164.612] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0164.612] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0164.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0164.612] lstrlenW (lpString="NgcSvc") returned 6
	[0164.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0164.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0164.612] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0164.612] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0164.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0164.612] lstrlenW (lpString="NlaSvc") returned 6
	[0164.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0164.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0164.612] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0164.612] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0164.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0164.612] lstrlenW (lpString="nsi") returned 3
	[0164.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0164.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0164.613] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0164.613] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0164.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0164.613] lstrlenW (lpString="PcaSvc") returned 6
	[0164.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0164.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0164.613] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0164.613] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0164.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0164.613] lstrlenW (lpString="PlugPlay") returned 8
	[0164.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0164.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0164.613] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0164.613] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0164.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0164.613] lstrlenW (lpString="Power") returned 5
	[0164.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0164.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0164.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0164.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0164.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0164.613] lstrlenW (lpString="ProfSvc") returned 7
	[0164.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0164.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0164.613] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0164.613] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0164.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0164.613] lstrlenW (lpString="RpcEptMapper") returned 12
	[0164.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0164.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0164.614] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0164.614] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0164.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0164.614] lstrlenW (lpString="RpcSs") returned 5
	[0164.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0164.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0164.614] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0164.614] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0164.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0164.614] lstrlenW (lpString="SamSs") returned 5
	[0164.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0164.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0164.614] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0164.614] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0164.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0164.614] lstrlenW (lpString="Schedule") returned 8
	[0164.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0164.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0164.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0164.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0164.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0164.614] lstrlenW (lpString="SecurityHealthService") returned 21
	[0164.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0164.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0164.614] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0164.614] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0164.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0164.614] lstrlenW (lpString="SENS") returned 4
	[0164.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0164.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0164.646] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0164.646] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0164.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0164.646] lstrlenW (lpString="ShellHWDetection") returned 16
	[0164.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0164.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0164.646] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0164.646] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0164.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0164.646] lstrlenW (lpString="Spooler") returned 7
	[0164.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0164.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0164.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0164.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0164.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0164.647] lstrlenW (lpString="StateRepository") returned 15
	[0164.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0164.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0164.647] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0164.647] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0164.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0164.647] lstrlenW (lpString="SysMain") returned 7
	[0164.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0164.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0164.647] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0164.647] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0164.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0164.647] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0164.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0164.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0164.647] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0164.647] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0164.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0164.647] lstrlenW (lpString="Themes") returned 6
	[0164.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0164.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0164.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0164.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0164.648] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0164.648] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b8
	[0164.652] Process32FirstW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0164.653] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0164.653] lstrlenW (lpString="System") returned 6
	[0164.653] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0164.654] lstrlenW (lpString="smss.exe") returned 8
	[0164.654] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0164.654] lstrlenW (lpString="csrss.exe") returned 9
	[0164.654] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0164.654] lstrlenW (lpString="wininit.exe") returned 11
	[0164.655] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0164.655] lstrlenW (lpString="csrss.exe") returned 9
	[0164.655] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0164.655] lstrlenW (lpString="winlogon.exe") returned 12
	[0164.655] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0164.656] lstrlenW (lpString="services.exe") returned 12
	[0164.656] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0164.656] lstrlenW (lpString="lsass.exe") returned 9
	[0164.656] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0164.657] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0164.657] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0164.657] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0164.657] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.658] lstrlenW (lpString="svchost.exe") returned 11
	[0164.658] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.658] lstrlenW (lpString="svchost.exe") returned 11
	[0164.658] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0164.658] lstrlenW (lpString="dwm.exe") returned 7
	[0164.658] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.659] lstrlenW (lpString="svchost.exe") returned 11
	[0164.659] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.659] lstrlenW (lpString="svchost.exe") returned 11
	[0164.659] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.660] lstrlenW (lpString="svchost.exe") returned 11
	[0164.660] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.660] lstrlenW (lpString="svchost.exe") returned 11
	[0164.660] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.661] lstrlenW (lpString="svchost.exe") returned 11
	[0164.661] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.661] lstrlenW (lpString="svchost.exe") returned 11
	[0164.661] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.662] lstrlenW (lpString="svchost.exe") returned 11
	[0164.662] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.662] lstrlenW (lpString="svchost.exe") returned 11
	[0164.662] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.663] lstrlenW (lpString="svchost.exe") returned 11
	[0164.663] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.663] lstrlenW (lpString="svchost.exe") returned 11
	[0164.663] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0164.664] lstrlenW (lpString="spoolsv.exe") returned 11
	[0164.664] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.664] lstrlenW (lpString="svchost.exe") returned 11
	[0164.664] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0164.665] lstrlenW (lpString="audiodg.exe") returned 11
	[0164.665] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0164.665] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0164.665] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0164.665] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0164.665] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0164.667] lstrlenW (lpString="sihost.exe") returned 10
	[0164.667] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0164.668] lstrlenW (lpString="Memory Compression") returned 18
	[0164.668] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.668] lstrlenW (lpString="svchost.exe") returned 11
	[0164.668] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0164.669] lstrlenW (lpString="msoia.exe") returned 9
	[0164.669] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0164.669] lstrlenW (lpString="taskhostw.exe") returned 13
	[0164.669] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0164.669] lstrlenW (lpString="explorer.exe") returned 12
	[0164.669] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0164.670] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0164.670] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0164.670] lstrlenW (lpString="SearchUI.exe") returned 12
	[0164.670] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0164.671] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0164.671] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0164.671] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0164.671] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0164.672] lstrlenW (lpString="d2.exe") returned 6
	[0164.672] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0164.672] lstrlenW (lpString="cmd.exe") returned 7
	[0164.672] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0164.672] lstrlenW (lpString="conhost.exe") returned 11
	[0164.672] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0164.673] lstrlenW (lpString="mode.com") returned 8
	[0164.673] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0164.673] lstrlenW (lpString="consent.exe") returned 11
	[0164.673] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0164.674] CloseHandle (hObject=0x4b8) returned 1
	[0164.674] Sleep (dwMilliseconds=0x1f4) 
	[0165.639] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ee48
	[0165.639] EnumServicesStatusExW (in: hSCManager=0x52ee48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0165.639] GetLastError () returned 0xea
	[0165.639] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x44b2a98
	[0165.640] EnumServicesStatusExW (in: hSCManager=0x52ee48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44b2a98, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44b2a98, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0165.641] CloseServiceHandle (hSCObject=0x52ee48) returned 1
	[0165.641] lstrlenW (lpString="Appinfo") returned 7
	[0165.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0165.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0165.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0165.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0165.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0165.641] lstrlenW (lpString="AppXSvc") returned 7
	[0165.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0165.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0165.641] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0165.641] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0165.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0165.641] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0165.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0165.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0165.641] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0165.641] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0165.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0165.641] lstrlenW (lpString="Audiosrv") returned 8
	[0165.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0165.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0165.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0165.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0165.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0165.642] lstrlenW (lpString="BFE") returned 3
	[0165.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0165.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0165.642] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0165.642] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0165.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0165.642] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0165.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0165.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0165.642] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0165.642] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0165.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0165.642] lstrlenW (lpString="CDPSvc") returned 6
	[0165.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0165.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0165.642] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0165.642] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0165.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0165.642] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0165.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0165.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0165.642] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0165.642] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0165.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0165.642] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0165.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0165.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0165.642] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0165.643] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0165.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0165.643] lstrlenW (lpString="CryptSvc") returned 8
	[0165.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0165.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0165.643] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0165.643] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0165.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0165.643] lstrlenW (lpString="DcomLaunch") returned 10
	[0165.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0165.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0165.643] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0165.643] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0165.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0165.643] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0165.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0165.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0165.643] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0165.643] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0165.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0165.643] lstrlenW (lpString="Dhcp") returned 4
	[0165.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0165.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0165.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0165.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0165.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0165.644] lstrlenW (lpString="Dnscache") returned 8
	[0165.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0165.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0165.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0165.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0165.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0165.644] lstrlenW (lpString="DPS") returned 3
	[0165.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0165.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0165.644] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0165.644] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0165.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0165.644] lstrlenW (lpString="DsmSvc") returned 6
	[0165.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0165.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0165.645] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0165.645] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0165.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0165.645] lstrlenW (lpString="DusmSvc") returned 7
	[0165.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0165.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0165.645] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0165.645] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0165.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0165.645] lstrlenW (lpString="EventLog") returned 8
	[0165.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0165.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0165.645] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0165.645] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0165.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0165.645] lstrlenW (lpString="EventSystem") returned 11
	[0165.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0165.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0165.645] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0165.645] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0165.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0165.645] lstrlenW (lpString="FontCache") returned 9
	[0165.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0165.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0165.645] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0165.645] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0165.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0165.645] lstrlenW (lpString="gpsvc") returned 5
	[0165.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0165.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0165.645] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0165.646] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0165.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0165.646] lstrlenW (lpString="iphlpsvc") returned 8
	[0165.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0165.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0165.646] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0165.646] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0165.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0165.646] lstrlenW (lpString="KeyIso") returned 6
	[0165.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0165.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0165.646] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0165.646] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0165.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0165.646] lstrlenW (lpString="LanmanServer") returned 12
	[0165.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0165.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0165.646] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0165.646] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0165.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0165.646] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0165.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0165.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0165.646] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0165.646] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0165.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0165.646] lstrlenW (lpString="lfsvc") returned 5
	[0165.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0165.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0165.646] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0165.646] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0165.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0165.647] lstrlenW (lpString="lmhosts") returned 7
	[0165.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0165.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0165.647] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0165.647] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0165.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0165.647] lstrlenW (lpString="LSM") returned 3
	[0165.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0165.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0165.647] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0165.647] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0165.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0165.647] lstrlenW (lpString="MpsSvc") returned 6
	[0165.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0165.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0165.647] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0165.647] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0165.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0165.647] lstrlenW (lpString="NcbService") returned 10
	[0165.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0165.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0165.647] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0165.647] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0165.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0165.647] lstrlenW (lpString="netprofm") returned 8
	[0165.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0165.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0165.647] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0165.647] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0165.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0165.648] lstrlenW (lpString="NgcSvc") returned 6
	[0165.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0165.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0165.648] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0165.648] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0165.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0165.648] lstrlenW (lpString="NlaSvc") returned 6
	[0165.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0165.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0165.648] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0165.648] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0165.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0165.648] lstrlenW (lpString="nsi") returned 3
	[0165.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0165.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0165.648] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0165.648] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0165.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0165.648] lstrlenW (lpString="PcaSvc") returned 6
	[0165.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0165.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0165.648] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0165.648] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0165.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0165.648] lstrlenW (lpString="PlugPlay") returned 8
	[0165.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0165.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0165.648] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0165.648] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0165.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0165.649] lstrlenW (lpString="Power") returned 5
	[0165.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0165.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0165.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0165.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0165.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0165.649] lstrlenW (lpString="ProfSvc") returned 7
	[0165.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0165.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0165.649] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0165.649] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0165.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0165.649] lstrlenW (lpString="RpcEptMapper") returned 12
	[0165.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0165.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0165.649] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0165.649] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0165.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0165.649] lstrlenW (lpString="RpcSs") returned 5
	[0165.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0165.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0165.649] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0165.649] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0165.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0165.649] lstrlenW (lpString="SamSs") returned 5
	[0165.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0165.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0165.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0165.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0165.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0165.649] lstrlenW (lpString="Schedule") returned 8
	[0165.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0165.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0165.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0165.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0165.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0165.650] lstrlenW (lpString="SecurityHealthService") returned 21
	[0165.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0165.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0165.650] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0165.650] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0165.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0165.650] lstrlenW (lpString="SENS") returned 4
	[0165.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0165.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0165.650] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0165.650] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0165.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0165.650] lstrlenW (lpString="ShellHWDetection") returned 16
	[0165.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0165.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0165.650] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0165.650] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0165.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0165.650] lstrlenW (lpString="Spooler") returned 7
	[0165.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0165.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0165.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0165.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0165.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0165.650] lstrlenW (lpString="StateRepository") returned 15
	[0165.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0165.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0165.651] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0165.651] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0165.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0165.651] lstrlenW (lpString="SysMain") returned 7
	[0165.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0165.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0165.651] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0165.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0165.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0165.651] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0165.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0165.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0165.651] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0165.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0165.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0165.651] lstrlenW (lpString="Themes") returned 6
	[0165.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0165.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0165.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0165.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0165.651] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0165.651] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550
	[0165.655] Process32FirstW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0165.656] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0165.656] lstrlenW (lpString="System") returned 6
	[0165.656] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0165.657] lstrlenW (lpString="smss.exe") returned 8
	[0165.657] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0165.657] lstrlenW (lpString="csrss.exe") returned 9
	[0165.657] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0165.657] lstrlenW (lpString="wininit.exe") returned 11
	[0165.658] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0165.658] lstrlenW (lpString="csrss.exe") returned 9
	[0165.658] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0165.658] lstrlenW (lpString="winlogon.exe") returned 12
	[0165.658] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0165.659] lstrlenW (lpString="services.exe") returned 12
	[0165.659] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0166.037] lstrlenW (lpString="lsass.exe") returned 9
	[0166.037] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0166.037] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0166.037] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0166.038] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0166.038] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.038] lstrlenW (lpString="svchost.exe") returned 11
	[0166.038] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.039] lstrlenW (lpString="svchost.exe") returned 11
	[0166.039] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0166.039] lstrlenW (lpString="dwm.exe") returned 7
	[0166.039] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.040] lstrlenW (lpString="svchost.exe") returned 11
	[0166.040] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.040] lstrlenW (lpString="svchost.exe") returned 11
	[0166.040] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.041] lstrlenW (lpString="svchost.exe") returned 11
	[0166.041] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.041] lstrlenW (lpString="svchost.exe") returned 11
	[0166.041] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.042] lstrlenW (lpString="svchost.exe") returned 11
	[0166.042] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.042] lstrlenW (lpString="svchost.exe") returned 11
	[0166.042] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.043] lstrlenW (lpString="svchost.exe") returned 11
	[0166.043] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.043] lstrlenW (lpString="svchost.exe") returned 11
	[0166.043] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.044] lstrlenW (lpString="svchost.exe") returned 11
	[0166.044] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.044] lstrlenW (lpString="svchost.exe") returned 11
	[0166.044] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0166.045] lstrlenW (lpString="spoolsv.exe") returned 11
	[0166.045] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.045] lstrlenW (lpString="svchost.exe") returned 11
	[0166.045] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0166.046] lstrlenW (lpString="audiodg.exe") returned 11
	[0166.046] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0166.046] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0166.046] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0166.047] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0166.047] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0166.047] lstrlenW (lpString="sihost.exe") returned 10
	[0166.047] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0166.048] lstrlenW (lpString="Memory Compression") returned 18
	[0166.048] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.048] lstrlenW (lpString="svchost.exe") returned 11
	[0166.048] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0166.049] lstrlenW (lpString="msoia.exe") returned 9
	[0166.049] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0166.049] lstrlenW (lpString="taskhostw.exe") returned 13
	[0166.049] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0166.049] lstrlenW (lpString="explorer.exe") returned 12
	[0166.050] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0166.050] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0166.050] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0166.051] lstrlenW (lpString="SearchUI.exe") returned 12
	[0166.051] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0166.051] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0166.051] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0166.052] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0166.052] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0166.052] lstrlenW (lpString="d2.exe") returned 6
	[0166.054] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0166.055] lstrlenW (lpString="cmd.exe") returned 7
	[0166.055] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0166.055] lstrlenW (lpString="conhost.exe") returned 11
	[0166.055] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0166.056] lstrlenW (lpString="mode.com") returned 8
	[0166.056] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0166.056] lstrlenW (lpString="consent.exe") returned 11
	[0166.056] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0166.057] CloseHandle (hObject=0x550) returned 1
	[0166.057] Sleep (dwMilliseconds=0x1f4) 
	[0166.577] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52f000
	[0166.577] EnumServicesStatusExW (in: hSCManager=0x52f000, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0166.578] GetLastError () returned 0xea
	[0166.578] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x44a5fc0
	[0166.578] EnumServicesStatusExW (in: hSCManager=0x52f000, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44a5fc0, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44a5fc0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0166.579] CloseServiceHandle (hSCObject=0x52f000) returned 1
	[0166.580] lstrlenW (lpString="Appinfo") returned 7
	[0166.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0166.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0166.580] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0166.580] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0166.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0166.580] lstrlenW (lpString="AppXSvc") returned 7
	[0166.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0166.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0166.580] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0166.580] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0166.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0166.580] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0166.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0166.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0166.580] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0166.580] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0166.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0166.580] lstrlenW (lpString="Audiosrv") returned 8
	[0166.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0166.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0166.580] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0166.580] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0166.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0166.580] lstrlenW (lpString="BFE") returned 3
	[0166.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0166.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0166.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0166.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0166.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0166.581] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0166.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0166.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0166.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0166.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0166.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0166.581] lstrlenW (lpString="CDPSvc") returned 6
	[0166.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0166.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0166.581] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0166.581] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0166.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0166.581] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0166.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0166.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0166.581] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0166.581] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0166.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0166.581] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0166.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0166.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0166.581] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0166.582] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0166.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0166.582] lstrlenW (lpString="CryptSvc") returned 8
	[0166.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0166.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0166.582] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0166.582] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0166.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0166.582] lstrlenW (lpString="DcomLaunch") returned 10
	[0166.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0166.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0166.582] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0166.582] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0166.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0166.582] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0166.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0166.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0166.582] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0166.582] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0166.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0166.582] lstrlenW (lpString="Dhcp") returned 4
	[0166.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0166.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0166.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0166.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0166.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0166.583] lstrlenW (lpString="Dnscache") returned 8
	[0166.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0166.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0166.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0166.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0166.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0166.583] lstrlenW (lpString="DPS") returned 3
	[0166.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0166.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0166.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0166.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0166.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0166.583] lstrlenW (lpString="DsmSvc") returned 6
	[0166.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0166.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0166.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0166.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0166.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0166.583] lstrlenW (lpString="DusmSvc") returned 7
	[0166.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0166.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0166.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0166.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0166.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0166.583] lstrlenW (lpString="EventLog") returned 8
	[0166.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0166.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0166.584] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0166.584] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0166.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0166.584] lstrlenW (lpString="EventSystem") returned 11
	[0166.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0166.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0166.584] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0166.584] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0166.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0166.584] lstrlenW (lpString="FontCache") returned 9
	[0166.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0166.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0166.584] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0166.584] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0166.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0166.584] lstrlenW (lpString="gpsvc") returned 5
	[0166.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0166.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0166.584] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0166.584] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0166.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0166.584] lstrlenW (lpString="iphlpsvc") returned 8
	[0166.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0166.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0166.585] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0166.585] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0166.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0166.585] lstrlenW (lpString="KeyIso") returned 6
	[0166.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0166.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0166.585] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0166.585] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0166.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0166.585] lstrlenW (lpString="LanmanServer") returned 12
	[0166.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0166.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0166.585] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0166.585] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0166.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0166.585] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0166.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0166.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0166.585] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0166.585] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0166.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0166.585] lstrlenW (lpString="lfsvc") returned 5
	[0166.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0166.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0166.585] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0166.585] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0166.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0166.585] lstrlenW (lpString="lmhosts") returned 7
	[0166.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0166.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0166.586] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0166.586] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0166.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0166.635] lstrlenW (lpString="LSM") returned 3
	[0166.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0166.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0166.635] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0166.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0166.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0166.636] lstrlenW (lpString="MpsSvc") returned 6
	[0166.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0166.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0166.636] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0166.636] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0166.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0166.636] lstrlenW (lpString="NcbService") returned 10
	[0166.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0166.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0166.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0166.636] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0166.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0166.636] lstrlenW (lpString="netprofm") returned 8
	[0166.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0166.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0166.636] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0166.636] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0166.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0166.636] lstrlenW (lpString="NgcSvc") returned 6
	[0166.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0166.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0166.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0166.637] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0166.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0166.637] lstrlenW (lpString="NlaSvc") returned 6
	[0166.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0166.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0166.637] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0166.637] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0166.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0166.637] lstrlenW (lpString="nsi") returned 3
	[0166.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0166.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0166.637] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0166.637] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0166.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0166.637] lstrlenW (lpString="PcaSvc") returned 6
	[0166.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0166.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0166.637] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0166.637] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0166.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0166.637] lstrlenW (lpString="PlugPlay") returned 8
	[0166.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0166.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0166.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0166.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0166.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0166.638] lstrlenW (lpString="Power") returned 5
	[0166.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0166.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0166.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0166.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0166.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0166.638] lstrlenW (lpString="ProfSvc") returned 7
	[0166.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0166.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0166.638] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0166.638] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0166.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0166.638] lstrlenW (lpString="RpcEptMapper") returned 12
	[0166.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0166.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0166.638] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0166.638] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0166.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0166.638] lstrlenW (lpString="RpcSs") returned 5
	[0166.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0166.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0166.638] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0166.638] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0166.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0166.639] lstrlenW (lpString="SamSs") returned 5
	[0166.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0166.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0166.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0166.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0166.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0166.639] lstrlenW (lpString="Schedule") returned 8
	[0166.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0166.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0166.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0166.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0166.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0166.639] lstrlenW (lpString="SecurityHealthService") returned 21
	[0166.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0166.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0166.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0166.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0166.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0166.639] lstrlenW (lpString="SENS") returned 4
	[0166.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0166.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0166.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0166.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0166.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0166.639] lstrlenW (lpString="ShellHWDetection") returned 16
	[0166.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0166.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0166.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0166.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0166.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0166.640] lstrlenW (lpString="Spooler") returned 7
	[0166.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0166.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0166.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0166.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0166.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0166.640] lstrlenW (lpString="StateRepository") returned 15
	[0166.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0166.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0166.640] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0166.640] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0166.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0166.640] lstrlenW (lpString="SysMain") returned 7
	[0166.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0166.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0166.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0166.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0166.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0166.640] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0166.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0166.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0166.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0166.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0166.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0166.640] lstrlenW (lpString="Themes") returned 6
	[0166.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0166.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0166.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0166.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0166.641] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0166.641] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x538
	[0166.645] Process32FirstW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0166.646] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0166.646] lstrlenW (lpString="System") returned 6
	[0166.647] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0166.647] lstrlenW (lpString="smss.exe") returned 8
	[0166.647] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0166.647] lstrlenW (lpString="csrss.exe") returned 9
	[0166.647] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0166.648] lstrlenW (lpString="wininit.exe") returned 11
	[0166.648] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0166.648] lstrlenW (lpString="csrss.exe") returned 9
	[0166.648] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0166.649] lstrlenW (lpString="winlogon.exe") returned 12
	[0166.649] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0166.649] lstrlenW (lpString="services.exe") returned 12
	[0166.649] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0166.650] lstrlenW (lpString="lsass.exe") returned 9
	[0166.650] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0166.650] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0166.650] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0166.651] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0166.651] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.651] lstrlenW (lpString="svchost.exe") returned 11
	[0166.651] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.652] lstrlenW (lpString="svchost.exe") returned 11
	[0166.652] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0166.652] lstrlenW (lpString="dwm.exe") returned 7
	[0166.652] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.653] lstrlenW (lpString="svchost.exe") returned 11
	[0166.653] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.653] lstrlenW (lpString="svchost.exe") returned 11
	[0166.653] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.654] lstrlenW (lpString="svchost.exe") returned 11
	[0166.654] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.654] lstrlenW (lpString="svchost.exe") returned 11
	[0166.654] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.655] lstrlenW (lpString="svchost.exe") returned 11
	[0166.655] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.655] lstrlenW (lpString="svchost.exe") returned 11
	[0166.655] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.656] lstrlenW (lpString="svchost.exe") returned 11
	[0166.656] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.656] lstrlenW (lpString="svchost.exe") returned 11
	[0166.656] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.657] lstrlenW (lpString="svchost.exe") returned 11
	[0166.657] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.657] lstrlenW (lpString="svchost.exe") returned 11
	[0166.657] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0166.658] lstrlenW (lpString="spoolsv.exe") returned 11
	[0166.658] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.658] lstrlenW (lpString="svchost.exe") returned 11
	[0166.658] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0166.659] lstrlenW (lpString="audiodg.exe") returned 11
	[0166.659] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0166.659] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0166.659] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0166.660] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0166.660] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0166.660] lstrlenW (lpString="sihost.exe") returned 10
	[0166.660] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0166.661] lstrlenW (lpString="Memory Compression") returned 18
	[0166.661] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.661] lstrlenW (lpString="svchost.exe") returned 11
	[0166.661] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0166.662] lstrlenW (lpString="msoia.exe") returned 9
	[0166.662] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0166.662] lstrlenW (lpString="taskhostw.exe") returned 13
	[0166.662] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0166.663] lstrlenW (lpString="explorer.exe") returned 12
	[0166.663] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0166.663] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0166.663] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0166.663] lstrlenW (lpString="SearchUI.exe") returned 12
	[0166.664] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0166.664] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0166.664] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0166.664] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0166.665] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0166.665] lstrlenW (lpString="d2.exe") returned 6
	[0166.665] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0166.667] lstrlenW (lpString="cmd.exe") returned 7
	[0166.667] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0166.667] lstrlenW (lpString="conhost.exe") returned 11
	[0166.667] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0166.668] lstrlenW (lpString="mode.com") returned 8
	[0166.668] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0166.668] lstrlenW (lpString="consent.exe") returned 11
	[0166.668] Process32NextW (in: hSnapshot=0x538, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0166.669] CloseHandle (hObject=0x538) returned 1
	[0166.669] Sleep (dwMilliseconds=0x1f4) 
	[0167.320] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ee20
	[0167.323] EnumServicesStatusExW (in: hSCManager=0x52ee20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0167.323] GetLastError () returned 0xea
	[0167.323] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x44c3aa8
	[0167.323] EnumServicesStatusExW (in: hSCManager=0x52ee20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44c3aa8, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44c3aa8, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0167.324] CloseServiceHandle (hSCObject=0x52ee20) returned 1
	[0167.324] lstrlenW (lpString="Appinfo") returned 7
	[0167.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0167.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0167.325] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0167.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0167.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0167.325] lstrlenW (lpString="AppXSvc") returned 7
	[0167.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0167.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0167.325] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0167.325] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0167.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0167.325] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0167.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0167.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0167.325] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0167.325] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0167.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0167.325] lstrlenW (lpString="Audiosrv") returned 8
	[0167.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0167.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0167.325] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0167.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0167.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0167.325] lstrlenW (lpString="BFE") returned 3
	[0167.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0167.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0167.326] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0167.326] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0167.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0167.326] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0167.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0167.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0167.326] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0167.326] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0167.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0167.326] lstrlenW (lpString="CDPSvc") returned 6
	[0167.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0167.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0167.326] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0167.326] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0167.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0167.326] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0167.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0167.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0167.326] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0167.326] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0167.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0167.326] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0167.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0167.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0167.326] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0167.326] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0167.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0167.326] lstrlenW (lpString="CryptSvc") returned 8
	[0167.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0167.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0167.327] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0167.327] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0167.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0167.327] lstrlenW (lpString="DcomLaunch") returned 10
	[0167.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0167.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0167.327] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0167.327] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0167.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0167.327] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0167.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0167.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0167.327] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0167.327] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0167.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0167.327] lstrlenW (lpString="Dhcp") returned 4
	[0167.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0167.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0167.327] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0167.327] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0167.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0167.327] lstrlenW (lpString="Dnscache") returned 8
	[0167.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0167.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0167.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0167.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0167.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0167.328] lstrlenW (lpString="DPS") returned 3
	[0167.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0167.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0167.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0167.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0167.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0167.328] lstrlenW (lpString="DsmSvc") returned 6
	[0167.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0167.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0167.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0167.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0167.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0167.328] lstrlenW (lpString="DusmSvc") returned 7
	[0167.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0167.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0167.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0167.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0167.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0167.328] lstrlenW (lpString="EventLog") returned 8
	[0167.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0167.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0167.328] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0167.328] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0167.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0167.328] lstrlenW (lpString="EventSystem") returned 11
	[0167.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0167.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0167.329] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0167.329] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0167.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0167.329] lstrlenW (lpString="FontCache") returned 9
	[0167.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0167.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0167.329] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0167.329] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0167.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0167.329] lstrlenW (lpString="gpsvc") returned 5
	[0167.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0167.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0167.329] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0167.329] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0167.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0167.329] lstrlenW (lpString="iphlpsvc") returned 8
	[0167.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0167.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0167.329] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0167.329] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0167.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0167.329] lstrlenW (lpString="KeyIso") returned 6
	[0167.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0167.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0167.330] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0167.330] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0167.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0167.330] lstrlenW (lpString="LanmanServer") returned 12
	[0167.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0167.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0167.330] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0167.330] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0167.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0167.330] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0167.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0167.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0167.330] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0167.330] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0167.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0167.330] lstrlenW (lpString="lfsvc") returned 5
	[0167.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0167.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0167.353] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0167.353] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0167.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0167.353] lstrlenW (lpString="lmhosts") returned 7
	[0167.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0167.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0167.353] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0167.353] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0167.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0167.353] lstrlenW (lpString="LSM") returned 3
	[0167.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0167.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0167.353] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0167.353] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0167.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0167.353] lstrlenW (lpString="MpsSvc") returned 6
	[0167.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0167.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0167.354] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0167.354] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0167.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0167.354] lstrlenW (lpString="NcbService") returned 10
	[0167.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0167.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0167.354] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0167.354] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0167.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0167.354] lstrlenW (lpString="netprofm") returned 8
	[0167.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0167.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0167.354] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0167.354] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0167.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0167.354] lstrlenW (lpString="NgcSvc") returned 6
	[0167.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0167.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0167.354] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0167.354] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0167.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0167.354] lstrlenW (lpString="NlaSvc") returned 6
	[0167.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0167.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0167.354] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0167.354] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0167.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0167.354] lstrlenW (lpString="nsi") returned 3
	[0167.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0167.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0167.355] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0167.355] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0167.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0167.355] lstrlenW (lpString="PcaSvc") returned 6
	[0167.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0167.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0167.355] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0167.355] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0167.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0167.355] lstrlenW (lpString="PlugPlay") returned 8
	[0167.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0167.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0167.355] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0167.355] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0167.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0167.355] lstrlenW (lpString="Power") returned 5
	[0167.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0167.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0167.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0167.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0167.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0167.355] lstrlenW (lpString="ProfSvc") returned 7
	[0167.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0167.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0167.355] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0167.355] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0167.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0167.356] lstrlenW (lpString="RpcEptMapper") returned 12
	[0167.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0167.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0167.356] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0167.356] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0167.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0167.356] lstrlenW (lpString="RpcSs") returned 5
	[0167.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0167.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0167.356] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0167.356] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0167.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0167.356] lstrlenW (lpString="SamSs") returned 5
	[0167.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0167.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0167.356] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0167.356] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0167.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0167.356] lstrlenW (lpString="Schedule") returned 8
	[0167.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0167.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0167.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0167.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0167.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0167.356] lstrlenW (lpString="SecurityHealthService") returned 21
	[0167.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0167.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0167.357] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0167.357] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0167.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0167.357] lstrlenW (lpString="SENS") returned 4
	[0167.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0167.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0167.357] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0167.357] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0167.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0167.357] lstrlenW (lpString="ShellHWDetection") returned 16
	[0167.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0167.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0167.357] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0167.357] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0167.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0167.357] lstrlenW (lpString="Spooler") returned 7
	[0167.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0167.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0167.357] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0167.357] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0167.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0167.357] lstrlenW (lpString="StateRepository") returned 15
	[0167.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0167.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0167.357] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0167.357] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0167.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0167.357] lstrlenW (lpString="SysMain") returned 7
	[0167.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0167.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0167.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0167.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0167.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0167.358] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0167.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0167.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0167.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0167.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0167.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0167.358] lstrlenW (lpString="Themes") returned 6
	[0167.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0167.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0167.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0167.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0167.358] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c3aa8 | out: hHeap=0x4c0000) returned 1
	[0167.358] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f0
	[0167.363] Process32FirstW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0167.363] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0167.364] lstrlenW (lpString="System") returned 6
	[0167.364] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0167.364] lstrlenW (lpString="smss.exe") returned 8
	[0167.365] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0167.365] lstrlenW (lpString="csrss.exe") returned 9
	[0167.365] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0167.365] lstrlenW (lpString="wininit.exe") returned 11
	[0167.365] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0167.366] lstrlenW (lpString="csrss.exe") returned 9
	[0167.366] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0167.366] lstrlenW (lpString="winlogon.exe") returned 12
	[0167.366] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0167.367] lstrlenW (lpString="services.exe") returned 12
	[0167.367] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0167.367] lstrlenW (lpString="lsass.exe") returned 9
	[0167.367] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0167.368] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0167.368] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0167.368] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0167.368] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.369] lstrlenW (lpString="svchost.exe") returned 11
	[0167.369] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.369] lstrlenW (lpString="svchost.exe") returned 11
	[0167.369] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0167.370] lstrlenW (lpString="dwm.exe") returned 7
	[0167.370] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.370] lstrlenW (lpString="svchost.exe") returned 11
	[0167.370] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.371] lstrlenW (lpString="svchost.exe") returned 11
	[0167.371] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.371] lstrlenW (lpString="svchost.exe") returned 11
	[0167.371] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.381] lstrlenW (lpString="svchost.exe") returned 11
	[0167.381] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.382] lstrlenW (lpString="svchost.exe") returned 11
	[0167.382] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.382] lstrlenW (lpString="svchost.exe") returned 11
	[0167.382] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.383] lstrlenW (lpString="svchost.exe") returned 11
	[0167.383] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.383] lstrlenW (lpString="svchost.exe") returned 11
	[0167.383] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.384] lstrlenW (lpString="svchost.exe") returned 11
	[0167.384] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.384] lstrlenW (lpString="svchost.exe") returned 11
	[0167.384] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0167.385] lstrlenW (lpString="spoolsv.exe") returned 11
	[0167.385] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.385] lstrlenW (lpString="svchost.exe") returned 11
	[0167.385] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0167.386] lstrlenW (lpString="audiodg.exe") returned 11
	[0167.386] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0167.386] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0167.386] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0167.387] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0167.387] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0167.387] lstrlenW (lpString="sihost.exe") returned 10
	[0167.387] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0167.388] lstrlenW (lpString="Memory Compression") returned 18
	[0167.388] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.388] lstrlenW (lpString="svchost.exe") returned 11
	[0167.389] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0167.389] lstrlenW (lpString="msoia.exe") returned 9
	[0167.389] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0167.390] lstrlenW (lpString="taskhostw.exe") returned 13
	[0167.390] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0167.390] lstrlenW (lpString="explorer.exe") returned 12
	[0167.390] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0167.391] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0167.391] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0167.391] lstrlenW (lpString="SearchUI.exe") returned 12
	[0167.391] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0167.392] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0167.392] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0167.392] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0167.392] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0167.393] lstrlenW (lpString="d2.exe") returned 6
	[0167.393] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0167.393] lstrlenW (lpString="cmd.exe") returned 7
	[0167.393] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0167.394] lstrlenW (lpString="conhost.exe") returned 11
	[0167.394] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0167.394] lstrlenW (lpString="consent.exe") returned 11
	[0167.394] Process32NextW (in: hSnapshot=0x4f0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0167.394] CloseHandle (hObject=0x4f0) returned 1
	[0167.395] Sleep (dwMilliseconds=0x1f4) 
	[0168.492] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ee20
	[0168.492] EnumServicesStatusExW (in: hSCManager=0x52ee20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0168.493] GetLastError () returned 0xea
	[0168.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x44c3aa8
	[0168.494] EnumServicesStatusExW (in: hSCManager=0x52ee20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44c3aa8, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44c3aa8, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0168.494] CloseServiceHandle (hSCObject=0x52ee20) returned 1
	[0168.495] lstrlenW (lpString="Appinfo") returned 7
	[0168.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0168.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0168.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0168.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0168.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0168.495] lstrlenW (lpString="AppXSvc") returned 7
	[0168.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0168.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0168.495] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0168.495] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0168.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0168.495] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0168.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0168.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0168.495] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0168.495] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0168.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0168.495] lstrlenW (lpString="Audiosrv") returned 8
	[0168.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0168.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0168.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0168.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0168.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0168.495] lstrlenW (lpString="BFE") returned 3
	[0168.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0168.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0168.496] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0168.496] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0168.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0168.496] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0168.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0168.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0168.496] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0168.496] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0168.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0168.496] lstrlenW (lpString="CDPSvc") returned 6
	[0168.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0168.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0168.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0168.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0168.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0168.496] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0168.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0168.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0168.496] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0168.496] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0168.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0168.496] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0168.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0168.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0168.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0168.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0168.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0168.497] lstrlenW (lpString="CryptSvc") returned 8
	[0168.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0168.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0168.497] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0168.497] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0168.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0168.497] lstrlenW (lpString="DcomLaunch") returned 10
	[0168.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0168.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0168.497] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0168.497] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0168.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0168.497] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0168.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0168.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0168.497] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0168.497] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0168.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0168.497] lstrlenW (lpString="Dhcp") returned 4
	[0168.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0168.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0168.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0168.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0168.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0168.497] lstrlenW (lpString="Dnscache") returned 8
	[0168.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0168.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0168.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0168.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0168.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0168.498] lstrlenW (lpString="DPS") returned 3
	[0168.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0168.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0168.498] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0168.498] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0168.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0168.498] lstrlenW (lpString="DsmSvc") returned 6
	[0168.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0168.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0168.498] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0168.498] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0168.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0168.498] lstrlenW (lpString="DusmSvc") returned 7
	[0168.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0168.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0168.498] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0168.498] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0168.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0168.498] lstrlenW (lpString="EventLog") returned 8
	[0168.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0168.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0168.498] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0168.498] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0168.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0168.498] lstrlenW (lpString="EventSystem") returned 11
	[0168.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0168.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0168.499] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0168.499] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0168.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0168.499] lstrlenW (lpString="FontCache") returned 9
	[0168.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0168.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0168.499] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0168.499] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0168.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0168.499] lstrlenW (lpString="gpsvc") returned 5
	[0168.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0168.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0168.499] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0168.499] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0168.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0168.499] lstrlenW (lpString="iphlpsvc") returned 8
	[0168.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0168.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0168.499] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0168.499] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0168.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0168.499] lstrlenW (lpString="KeyIso") returned 6
	[0168.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0168.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0168.499] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0168.499] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0168.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0168.500] lstrlenW (lpString="LanmanServer") returned 12
	[0168.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0168.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0168.500] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0168.500] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0168.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0168.500] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0168.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0168.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0168.500] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0168.500] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0168.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0168.500] lstrlenW (lpString="lfsvc") returned 5
	[0168.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0168.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0168.500] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0168.500] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0168.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0168.500] lstrlenW (lpString="lmhosts") returned 7
	[0168.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0168.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0168.500] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0168.500] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0168.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0168.500] lstrlenW (lpString="LSM") returned 3
	[0168.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0168.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0168.587] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0168.587] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0168.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0168.587] lstrlenW (lpString="MpsSvc") returned 6
	[0168.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0168.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0168.587] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0168.587] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0168.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0168.587] lstrlenW (lpString="NcbService") returned 10
	[0168.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0168.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0168.587] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0168.588] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0168.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0168.588] lstrlenW (lpString="netprofm") returned 8
	[0168.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0168.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0168.588] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0168.588] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0168.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0168.588] lstrlenW (lpString="NgcSvc") returned 6
	[0168.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0168.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0168.588] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0168.588] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0168.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0168.588] lstrlenW (lpString="NlaSvc") returned 6
	[0168.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0168.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0168.588] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0168.588] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0168.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0168.588] lstrlenW (lpString="nsi") returned 3
	[0168.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0168.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0168.588] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0168.588] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0168.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0168.588] lstrlenW (lpString="PcaSvc") returned 6
	[0168.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0168.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0168.589] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0168.589] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0168.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0168.589] lstrlenW (lpString="PlugPlay") returned 8
	[0168.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0168.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0168.589] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0168.589] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0168.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0168.589] lstrlenW (lpString="Power") returned 5
	[0168.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0168.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0168.589] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0168.589] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0168.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0168.589] lstrlenW (lpString="ProfSvc") returned 7
	[0168.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0168.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0168.589] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0168.589] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0168.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0168.589] lstrlenW (lpString="RpcEptMapper") returned 12
	[0168.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0168.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0168.589] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0168.589] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0168.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0168.590] lstrlenW (lpString="RpcSs") returned 5
	[0168.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0168.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0168.590] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0168.590] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0168.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0168.590] lstrlenW (lpString="SamSs") returned 5
	[0168.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0168.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0168.590] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0168.590] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0168.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0168.590] lstrlenW (lpString="Schedule") returned 8
	[0168.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0168.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0168.590] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0168.590] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0168.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0168.590] lstrlenW (lpString="SecurityHealthService") returned 21
	[0168.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0168.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0168.590] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0168.590] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0168.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0168.590] lstrlenW (lpString="SENS") returned 4
	[0168.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0168.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0168.591] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0168.591] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0168.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0168.591] lstrlenW (lpString="ShellHWDetection") returned 16
	[0168.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0168.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0168.591] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0168.591] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0168.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0168.591] lstrlenW (lpString="Spooler") returned 7
	[0168.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0168.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0168.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0168.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0168.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0168.591] lstrlenW (lpString="StateRepository") returned 15
	[0168.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0168.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0168.591] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0168.591] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0168.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0168.591] lstrlenW (lpString="SysMain") returned 7
	[0168.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0168.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0168.591] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0168.591] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0168.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0168.592] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0168.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0168.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0168.592] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0168.592] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0168.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0168.592] lstrlenW (lpString="Themes") returned 6
	[0168.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0168.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0168.592] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0168.592] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0168.592] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c3aa8 | out: hHeap=0x4c0000) returned 1
	[0168.592] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x55c
	[0168.599] Process32FirstW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0168.599] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0168.599] lstrlenW (lpString="System") returned 6
	[0168.599] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0168.600] lstrlenW (lpString="smss.exe") returned 8
	[0168.600] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0168.600] lstrlenW (lpString="csrss.exe") returned 9
	[0168.600] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0168.601] lstrlenW (lpString="wininit.exe") returned 11
	[0168.601] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0168.601] lstrlenW (lpString="csrss.exe") returned 9
	[0168.601] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0168.602] lstrlenW (lpString="winlogon.exe") returned 12
	[0168.602] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0168.602] lstrlenW (lpString="services.exe") returned 12
	[0168.602] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0168.603] lstrlenW (lpString="lsass.exe") returned 9
	[0168.603] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0168.603] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0168.603] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0168.604] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0168.604] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.604] lstrlenW (lpString="svchost.exe") returned 11
	[0168.604] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.605] lstrlenW (lpString="svchost.exe") returned 11
	[0168.605] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0168.605] lstrlenW (lpString="dwm.exe") returned 7
	[0168.605] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.605] lstrlenW (lpString="svchost.exe") returned 11
	[0168.606] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.606] lstrlenW (lpString="svchost.exe") returned 11
	[0168.606] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.606] lstrlenW (lpString="svchost.exe") returned 11
	[0168.606] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.607] lstrlenW (lpString="svchost.exe") returned 11
	[0168.607] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.607] lstrlenW (lpString="svchost.exe") returned 11
	[0168.607] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.608] lstrlenW (lpString="svchost.exe") returned 11
	[0168.608] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.608] lstrlenW (lpString="svchost.exe") returned 11
	[0168.608] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.609] lstrlenW (lpString="svchost.exe") returned 11
	[0168.609] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.609] lstrlenW (lpString="svchost.exe") returned 11
	[0168.609] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.610] lstrlenW (lpString="svchost.exe") returned 11
	[0168.610] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0168.610] lstrlenW (lpString="spoolsv.exe") returned 11
	[0168.610] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.611] lstrlenW (lpString="svchost.exe") returned 11
	[0168.611] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0168.611] lstrlenW (lpString="audiodg.exe") returned 11
	[0168.611] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0168.611] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0168.612] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0168.612] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0168.612] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0168.612] lstrlenW (lpString="sihost.exe") returned 10
	[0168.613] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0168.613] lstrlenW (lpString="Memory Compression") returned 18
	[0168.613] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.613] lstrlenW (lpString="svchost.exe") returned 11
	[0168.613] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0168.614] lstrlenW (lpString="msoia.exe") returned 9
	[0168.614] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0168.614] lstrlenW (lpString="taskhostw.exe") returned 13
	[0168.614] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0168.615] lstrlenW (lpString="explorer.exe") returned 12
	[0168.615] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0168.615] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0168.615] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0168.616] lstrlenW (lpString="SearchUI.exe") returned 12
	[0168.617] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0168.617] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0168.617] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0168.617] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0168.617] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0168.618] lstrlenW (lpString="d2.exe") returned 6
	[0168.618] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0168.618] lstrlenW (lpString="cmd.exe") returned 7
	[0168.619] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0168.619] lstrlenW (lpString="conhost.exe") returned 11
	[0168.619] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0168.619] lstrlenW (lpString="consent.exe") returned 11
	[0168.619] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0168.620] CloseHandle (hObject=0x55c) returned 1
	[0168.620] Sleep (dwMilliseconds=0x1f4) 
	[0169.261] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52edd0
	[0169.262] EnumServicesStatusExW (in: hSCManager=0x52edd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0169.262] GetLastError () returned 0xea
	[0169.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x3eeb2f8
	[0169.263] EnumServicesStatusExW (in: hSCManager=0x52edd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3eeb2f8, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3eeb2f8, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0169.264] CloseServiceHandle (hSCObject=0x52edd0) returned 1
	[0169.264] lstrlenW (lpString="Appinfo") returned 7
	[0169.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0169.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0169.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0169.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0169.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0169.264] lstrlenW (lpString="AppXSvc") returned 7
	[0169.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0169.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0169.264] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0169.264] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0169.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0169.264] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0169.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0169.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0169.265] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0169.265] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0169.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0169.265] lstrlenW (lpString="Audiosrv") returned 8
	[0169.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0169.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0169.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0169.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0169.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0169.265] lstrlenW (lpString="BFE") returned 3
	[0169.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0169.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0169.265] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0169.265] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0169.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0169.265] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0169.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0169.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0169.265] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0169.265] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0169.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0169.265] lstrlenW (lpString="CDPSvc") returned 6
	[0169.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0169.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0169.265] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0169.265] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0169.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0169.265] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0169.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0169.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0169.266] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0169.266] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0169.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0169.266] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0169.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0169.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0169.266] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0169.266] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0169.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0169.266] lstrlenW (lpString="CryptSvc") returned 8
	[0169.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0169.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0169.266] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0169.266] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0169.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0169.266] lstrlenW (lpString="DcomLaunch") returned 10
	[0169.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0169.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0169.266] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0169.266] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0169.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0169.266] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0169.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0169.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0169.266] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0169.266] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0169.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0169.266] lstrlenW (lpString="Dhcp") returned 4
	[0169.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0169.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0169.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0169.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0169.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0169.267] lstrlenW (lpString="Dnscache") returned 8
	[0169.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0169.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0169.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0169.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0169.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0169.267] lstrlenW (lpString="DPS") returned 3
	[0169.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0169.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0169.267] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0169.267] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0169.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0169.267] lstrlenW (lpString="DsmSvc") returned 6
	[0169.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0169.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0169.267] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0169.267] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0169.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0169.267] lstrlenW (lpString="DusmSvc") returned 7
	[0169.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0169.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0169.268] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0169.268] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0169.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0169.268] lstrlenW (lpString="EventLog") returned 8
	[0169.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0169.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0169.268] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0169.268] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0169.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0169.268] lstrlenW (lpString="EventSystem") returned 11
	[0169.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0169.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0169.268] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0169.268] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0169.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0169.268] lstrlenW (lpString="FontCache") returned 9
	[0169.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0169.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0169.268] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0169.268] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0169.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0169.268] lstrlenW (lpString="gpsvc") returned 5
	[0169.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0169.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0169.268] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0169.268] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0169.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0169.268] lstrlenW (lpString="iphlpsvc") returned 8
	[0169.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0169.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0169.269] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0169.269] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0169.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0169.269] lstrlenW (lpString="KeyIso") returned 6
	[0169.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0169.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0169.269] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0169.269] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0169.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0169.269] lstrlenW (lpString="LanmanServer") returned 12
	[0169.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0169.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0169.269] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0169.269] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0169.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0169.269] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0169.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0169.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0169.269] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0169.269] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0169.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0169.269] lstrlenW (lpString="lfsvc") returned 5
	[0169.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0169.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0169.269] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0169.269] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0169.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0169.270] lstrlenW (lpString="lmhosts") returned 7
	[0169.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0169.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0169.478] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0169.478] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0169.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0169.478] lstrlenW (lpString="LSM") returned 3
	[0169.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0169.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0169.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0169.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0169.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0169.478] lstrlenW (lpString="MpsSvc") returned 6
	[0169.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0169.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0169.478] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0169.479] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0169.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0169.479] lstrlenW (lpString="NcbService") returned 10
	[0169.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0169.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0169.479] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0169.479] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0169.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0169.479] lstrlenW (lpString="netprofm") returned 8
	[0169.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0169.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0169.479] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0169.479] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0169.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0169.479] lstrlenW (lpString="NgcSvc") returned 6
	[0169.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0169.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0169.479] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0169.479] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0169.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0169.479] lstrlenW (lpString="NlaSvc") returned 6
	[0169.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0169.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0169.479] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0169.479] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0169.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0169.479] lstrlenW (lpString="nsi") returned 3
	[0169.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0169.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0169.480] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0169.480] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0169.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0169.480] lstrlenW (lpString="PcaSvc") returned 6
	[0169.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0169.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0169.480] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0169.480] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0169.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0169.480] lstrlenW (lpString="PlugPlay") returned 8
	[0169.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0169.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0169.480] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0169.480] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0169.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0169.480] lstrlenW (lpString="Power") returned 5
	[0169.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0169.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0169.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0169.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0169.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0169.481] lstrlenW (lpString="ProfSvc") returned 7
	[0169.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0169.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0169.481] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0169.481] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0169.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0169.481] lstrlenW (lpString="RpcEptMapper") returned 12
	[0169.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0169.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0169.481] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0169.481] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0169.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0169.481] lstrlenW (lpString="RpcSs") returned 5
	[0169.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0169.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0169.481] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0169.481] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0169.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0169.481] lstrlenW (lpString="SamSs") returned 5
	[0169.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0169.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0169.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0169.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0169.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0169.481] lstrlenW (lpString="Schedule") returned 8
	[0169.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0169.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0169.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0169.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0169.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0169.482] lstrlenW (lpString="SecurityHealthService") returned 21
	[0169.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0169.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0169.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0169.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0169.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0169.482] lstrlenW (lpString="SENS") returned 4
	[0169.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0169.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0169.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0169.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0169.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0169.482] lstrlenW (lpString="ShellHWDetection") returned 16
	[0169.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0169.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0169.482] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0169.482] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0169.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0169.482] lstrlenW (lpString="Spooler") returned 7
	[0169.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0169.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0169.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0169.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0169.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0169.483] lstrlenW (lpString="StateRepository") returned 15
	[0169.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0169.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0169.483] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0169.483] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0169.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0169.483] lstrlenW (lpString="SysMain") returned 7
	[0169.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0169.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0169.483] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0169.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0169.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0169.483] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0169.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0169.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0169.483] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0169.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0169.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0169.483] lstrlenW (lpString="Themes") returned 6
	[0169.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0169.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0169.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0169.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0169.484] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3eeb2f8 | out: hHeap=0x4c0000) returned 1
	[0169.484] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x534
	[0169.488] Process32FirstW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0169.488] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0169.489] lstrlenW (lpString="System") returned 6
	[0169.489] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0169.489] lstrlenW (lpString="smss.exe") returned 8
	[0169.489] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0169.490] lstrlenW (lpString="csrss.exe") returned 9
	[0169.490] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0169.490] lstrlenW (lpString="wininit.exe") returned 11
	[0169.490] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0169.491] lstrlenW (lpString="csrss.exe") returned 9
	[0169.491] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0169.491] lstrlenW (lpString="winlogon.exe") returned 12
	[0169.491] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0169.492] lstrlenW (lpString="services.exe") returned 12
	[0169.492] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0169.492] lstrlenW (lpString="lsass.exe") returned 9
	[0169.492] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0169.493] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0169.493] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0169.493] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0169.493] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.494] lstrlenW (lpString="svchost.exe") returned 11
	[0169.494] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.494] lstrlenW (lpString="svchost.exe") returned 11
	[0169.494] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0169.495] lstrlenW (lpString="dwm.exe") returned 7
	[0169.495] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.495] lstrlenW (lpString="svchost.exe") returned 11
	[0169.495] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.496] lstrlenW (lpString="svchost.exe") returned 11
	[0169.496] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.496] lstrlenW (lpString="svchost.exe") returned 11
	[0169.496] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.496] lstrlenW (lpString="svchost.exe") returned 11
	[0169.496] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.497] lstrlenW (lpString="svchost.exe") returned 11
	[0169.497] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.497] lstrlenW (lpString="svchost.exe") returned 11
	[0169.497] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.498] lstrlenW (lpString="svchost.exe") returned 11
	[0169.498] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.498] lstrlenW (lpString="svchost.exe") returned 11
	[0169.498] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.499] lstrlenW (lpString="svchost.exe") returned 11
	[0169.499] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.499] lstrlenW (lpString="svchost.exe") returned 11
	[0169.499] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0169.500] lstrlenW (lpString="spoolsv.exe") returned 11
	[0169.500] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.500] lstrlenW (lpString="svchost.exe") returned 11
	[0169.500] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0169.501] lstrlenW (lpString="audiodg.exe") returned 11
	[0169.501] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0169.501] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0169.501] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0169.502] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0169.502] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0169.502] lstrlenW (lpString="sihost.exe") returned 10
	[0169.502] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0169.503] lstrlenW (lpString="Memory Compression") returned 18
	[0169.503] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.503] lstrlenW (lpString="svchost.exe") returned 11
	[0169.503] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0169.504] lstrlenW (lpString="msoia.exe") returned 9
	[0169.504] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0169.504] lstrlenW (lpString="taskhostw.exe") returned 13
	[0169.504] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0169.504] lstrlenW (lpString="explorer.exe") returned 12
	[0169.505] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0169.505] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0169.505] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0169.505] lstrlenW (lpString="SearchUI.exe") returned 12
	[0169.505] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0169.506] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0169.506] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0169.506] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0169.506] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0169.507] lstrlenW (lpString="d2.exe") returned 6
	[0169.507] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0169.508] lstrlenW (lpString="cmd.exe") returned 7
	[0169.508] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0169.509] lstrlenW (lpString="conhost.exe") returned 11
	[0169.509] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0169.509] lstrlenW (lpString="consent.exe") returned 11
	[0169.509] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0169.510] lstrlenW (lpString="dllhost.exe") returned 11
	[0169.510] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0169.510] CloseHandle (hObject=0x534) returned 1
	[0169.510] Sleep (dwMilliseconds=0x1f4) 
	[0170.144] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52edd0
	[0170.182] EnumServicesStatusExW (in: hSCManager=0x52edd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0170.182] GetLastError () returned 0xea
	[0170.182] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x3eeb2f8
	[0170.182] EnumServicesStatusExW (in: hSCManager=0x52edd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3eeb2f8, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3eeb2f8, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0170.183] CloseServiceHandle (hSCObject=0x52edd0) returned 1
	[0170.184] lstrlenW (lpString="Appinfo") returned 7
	[0170.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0170.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0170.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0170.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0170.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0170.184] lstrlenW (lpString="AppXSvc") returned 7
	[0170.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0170.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0170.184] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0170.184] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0170.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0170.184] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0170.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0170.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0170.184] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0170.184] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0170.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0170.184] lstrlenW (lpString="Audiosrv") returned 8
	[0170.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0170.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0170.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0170.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0170.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0170.185] lstrlenW (lpString="BFE") returned 3
	[0170.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0170.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0170.185] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0170.185] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0170.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0170.185] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0170.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0170.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0170.185] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0170.185] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0170.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0170.185] lstrlenW (lpString="CDPSvc") returned 6
	[0170.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0170.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0170.185] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0170.185] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0170.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0170.185] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0170.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0170.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0170.185] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0170.185] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0170.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0170.185] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0170.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0170.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0170.186] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0170.186] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0170.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0170.186] lstrlenW (lpString="CryptSvc") returned 8
	[0170.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0170.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0170.186] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0170.186] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0170.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0170.186] lstrlenW (lpString="DcomLaunch") returned 10
	[0170.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0170.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0170.186] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0170.186] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0170.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0170.186] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0170.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0170.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0170.186] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0170.186] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0170.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0170.186] lstrlenW (lpString="Dhcp") returned 4
	[0170.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0170.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0170.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0170.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0170.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0170.187] lstrlenW (lpString="Dnscache") returned 8
	[0170.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0170.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0170.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0170.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0170.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0170.187] lstrlenW (lpString="DPS") returned 3
	[0170.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0170.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0170.187] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0170.187] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0170.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0170.187] lstrlenW (lpString="DsmSvc") returned 6
	[0170.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0170.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0170.187] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0170.187] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0170.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0170.187] lstrlenW (lpString="DusmSvc") returned 7
	[0170.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0170.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0170.187] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0170.187] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0170.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0170.187] lstrlenW (lpString="EventLog") returned 8
	[0170.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0170.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0170.188] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0170.188] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0170.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0170.188] lstrlenW (lpString="EventSystem") returned 11
	[0170.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0170.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0170.188] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0170.188] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0170.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0170.188] lstrlenW (lpString="FontCache") returned 9
	[0170.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0170.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0170.188] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0170.188] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0170.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0170.188] lstrlenW (lpString="gpsvc") returned 5
	[0170.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0170.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0170.188] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0170.188] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0170.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0170.188] lstrlenW (lpString="iphlpsvc") returned 8
	[0170.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0170.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0170.188] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0170.188] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0170.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0170.188] lstrlenW (lpString="KeyIso") returned 6
	[0170.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0170.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0170.189] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0170.189] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0170.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0170.189] lstrlenW (lpString="LanmanServer") returned 12
	[0170.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0170.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0170.189] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0170.189] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0170.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0170.189] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0170.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0170.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0170.189] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0170.189] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0170.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0170.189] lstrlenW (lpString="lfsvc") returned 5
	[0170.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0170.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0170.189] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0170.189] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0170.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0170.189] lstrlenW (lpString="lmhosts") returned 7
	[0170.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0170.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0170.412] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0170.412] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0170.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0170.413] lstrlenW (lpString="LSM") returned 3
	[0170.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0170.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0170.413] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0170.413] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0170.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0170.413] lstrlenW (lpString="MpsSvc") returned 6
	[0170.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0170.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0170.413] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0170.413] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0170.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0170.413] lstrlenW (lpString="NcbService") returned 10
	[0170.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0170.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0170.413] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0170.413] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0170.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0170.413] lstrlenW (lpString="netprofm") returned 8
	[0170.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0170.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0170.413] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0170.413] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0170.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0170.413] lstrlenW (lpString="NgcSvc") returned 6
	[0170.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0170.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0170.414] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0170.414] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0170.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0170.414] lstrlenW (lpString="NlaSvc") returned 6
	[0170.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0170.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0170.414] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0170.414] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0170.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0170.414] lstrlenW (lpString="nsi") returned 3
	[0170.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0170.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0170.414] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0170.414] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0170.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0170.414] lstrlenW (lpString="PcaSvc") returned 6
	[0170.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0170.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0170.414] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0170.414] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0170.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0170.414] lstrlenW (lpString="PlugPlay") returned 8
	[0170.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0170.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0170.415] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0170.415] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0170.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0170.415] lstrlenW (lpString="Power") returned 5
	[0170.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0170.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0170.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0170.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0170.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0170.415] lstrlenW (lpString="ProfSvc") returned 7
	[0170.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0170.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0170.415] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0170.415] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0170.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0170.415] lstrlenW (lpString="RpcEptMapper") returned 12
	[0170.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0170.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0170.415] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0170.415] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0170.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0170.416] lstrlenW (lpString="RpcSs") returned 5
	[0170.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0170.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0170.416] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0170.416] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0170.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0170.416] lstrlenW (lpString="SamSs") returned 5
	[0170.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0170.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0170.416] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0170.416] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0170.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0170.416] lstrlenW (lpString="Schedule") returned 8
	[0170.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0170.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0170.416] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0170.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0170.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0170.416] lstrlenW (lpString="SecurityHealthService") returned 21
	[0170.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0170.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0170.416] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0170.416] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0170.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0170.416] lstrlenW (lpString="SENS") returned 4
	[0170.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0170.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0170.417] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0170.417] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0170.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0170.417] lstrlenW (lpString="ShellHWDetection") returned 16
	[0170.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0170.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0170.417] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0170.417] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0170.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0170.417] lstrlenW (lpString="Spooler") returned 7
	[0170.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0170.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0170.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0170.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0170.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0170.417] lstrlenW (lpString="StateRepository") returned 15
	[0170.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0170.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0170.417] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0170.417] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0170.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0170.417] lstrlenW (lpString="SysMain") returned 7
	[0170.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0170.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0170.417] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0170.418] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0170.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0170.418] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0170.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0170.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0170.418] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0170.418] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0170.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0170.418] lstrlenW (lpString="Themes") returned 6
	[0170.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0170.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0170.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0170.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0170.418] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3eeb2f8 | out: hHeap=0x4c0000) returned 1
	[0170.418] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550
	[0170.423] Process32FirstW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0170.423] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0170.423] lstrlenW (lpString="System") returned 6
	[0170.423] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0170.424] lstrlenW (lpString="smss.exe") returned 8
	[0170.424] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0170.424] lstrlenW (lpString="csrss.exe") returned 9
	[0170.424] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0170.425] lstrlenW (lpString="wininit.exe") returned 11
	[0170.425] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0170.425] lstrlenW (lpString="csrss.exe") returned 9
	[0170.425] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0170.426] lstrlenW (lpString="winlogon.exe") returned 12
	[0170.426] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0170.426] lstrlenW (lpString="services.exe") returned 12
	[0170.426] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0170.427] lstrlenW (lpString="lsass.exe") returned 9
	[0170.427] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0170.427] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0170.427] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0170.428] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0170.428] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.428] lstrlenW (lpString="svchost.exe") returned 11
	[0170.428] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.429] lstrlenW (lpString="svchost.exe") returned 11
	[0170.429] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0170.429] lstrlenW (lpString="dwm.exe") returned 7
	[0170.429] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.430] lstrlenW (lpString="svchost.exe") returned 11
	[0170.430] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.430] lstrlenW (lpString="svchost.exe") returned 11
	[0170.430] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.431] lstrlenW (lpString="svchost.exe") returned 11
	[0170.431] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.431] lstrlenW (lpString="svchost.exe") returned 11
	[0170.431] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.432] lstrlenW (lpString="svchost.exe") returned 11
	[0170.432] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.432] lstrlenW (lpString="svchost.exe") returned 11
	[0170.432] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.432] lstrlenW (lpString="svchost.exe") returned 11
	[0170.433] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.433] lstrlenW (lpString="svchost.exe") returned 11
	[0170.433] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.433] lstrlenW (lpString="svchost.exe") returned 11
	[0170.433] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.434] lstrlenW (lpString="svchost.exe") returned 11
	[0170.434] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0170.434] lstrlenW (lpString="spoolsv.exe") returned 11
	[0170.434] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.435] lstrlenW (lpString="svchost.exe") returned 11
	[0170.435] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0170.435] lstrlenW (lpString="audiodg.exe") returned 11
	[0170.435] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0170.436] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0170.436] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0170.436] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0170.436] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0170.437] lstrlenW (lpString="sihost.exe") returned 10
	[0170.437] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0170.437] lstrlenW (lpString="Memory Compression") returned 18
	[0170.438] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.438] lstrlenW (lpString="svchost.exe") returned 11
	[0170.438] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0170.438] lstrlenW (lpString="msoia.exe") returned 9
	[0170.438] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0170.439] lstrlenW (lpString="taskhostw.exe") returned 13
	[0170.439] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0170.439] lstrlenW (lpString="explorer.exe") returned 12
	[0170.439] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0170.440] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0170.440] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0170.440] lstrlenW (lpString="SearchUI.exe") returned 12
	[0170.440] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0170.441] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0170.441] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0170.441] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0170.441] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0170.442] lstrlenW (lpString="d2.exe") returned 6
	[0170.442] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0170.442] lstrlenW (lpString="cmd.exe") returned 7
	[0170.442] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0170.443] lstrlenW (lpString="conhost.exe") returned 11
	[0170.443] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0170.443] lstrlenW (lpString="consent.exe") returned 11
	[0170.443] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0170.443] lstrlenW (lpString="dllhost.exe") returned 11
	[0170.444] Process32NextW (in: hSnapshot=0x550, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0170.444] CloseHandle (hObject=0x550) returned 1
	[0170.444] Sleep (dwMilliseconds=0x1f4) 
	[0171.101] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52f050
	[0171.142] EnumServicesStatusExW (in: hSCManager=0x52f050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0171.143] GetLastError () returned 0xea
	[0171.143] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x44c3aa8
	[0171.144] EnumServicesStatusExW (in: hSCManager=0x52f050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44c3aa8, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44c3aa8, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0171.144] CloseServiceHandle (hSCObject=0x52f050) returned 1
	[0171.145] lstrlenW (lpString="Appinfo") returned 7
	[0171.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0171.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0171.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0171.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0171.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0171.145] lstrlenW (lpString="AppXSvc") returned 7
	[0171.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0171.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0171.145] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0171.145] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0171.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0171.145] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0171.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0171.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0171.145] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0171.145] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0171.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0171.145] lstrlenW (lpString="Audiosrv") returned 8
	[0171.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0171.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0171.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0171.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0171.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0171.145] lstrlenW (lpString="BFE") returned 3
	[0171.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0171.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0171.146] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0171.146] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0171.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0171.146] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0171.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0171.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0171.146] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0171.146] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0171.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0171.146] lstrlenW (lpString="CDPSvc") returned 6
	[0171.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0171.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0171.146] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0171.146] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0171.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0171.146] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0171.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0171.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0171.146] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0171.146] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0171.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0171.146] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0171.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0171.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0171.146] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0171.146] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0171.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0171.147] lstrlenW (lpString="CryptSvc") returned 8
	[0171.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0171.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0171.147] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0171.147] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0171.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0171.147] lstrlenW (lpString="DcomLaunch") returned 10
	[0171.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0171.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0171.147] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0171.147] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0171.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0171.147] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0171.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0171.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0171.147] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0171.147] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0171.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0171.147] lstrlenW (lpString="Dhcp") returned 4
	[0171.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0171.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0171.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0171.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0171.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0171.147] lstrlenW (lpString="Dnscache") returned 8
	[0171.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0171.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0171.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0171.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0171.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0171.148] lstrlenW (lpString="DPS") returned 3
	[0171.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0171.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0171.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0171.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0171.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0171.148] lstrlenW (lpString="DsmSvc") returned 6
	[0171.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0171.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0171.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0171.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0171.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0171.148] lstrlenW (lpString="DusmSvc") returned 7
	[0171.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0171.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0171.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0171.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0171.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0171.148] lstrlenW (lpString="EventLog") returned 8
	[0171.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0171.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0171.149] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0171.149] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0171.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0171.149] lstrlenW (lpString="EventSystem") returned 11
	[0171.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0171.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0171.149] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0171.149] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0171.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0171.149] lstrlenW (lpString="FontCache") returned 9
	[0171.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0171.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0171.149] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0171.149] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0171.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0171.149] lstrlenW (lpString="gpsvc") returned 5
	[0171.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0171.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0171.149] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0171.149] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0171.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0171.149] lstrlenW (lpString="iphlpsvc") returned 8
	[0171.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0171.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0171.150] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0171.150] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0171.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0171.150] lstrlenW (lpString="KeyIso") returned 6
	[0171.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0171.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0171.150] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0171.150] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0171.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0171.150] lstrlenW (lpString="LanmanServer") returned 12
	[0171.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0171.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0171.150] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0171.150] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0171.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0171.150] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0171.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0171.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0171.150] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0171.150] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0171.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0171.150] lstrlenW (lpString="lfsvc") returned 5
	[0171.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0171.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0171.150] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0171.150] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0171.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0171.150] lstrlenW (lpString="lmhosts") returned 7
	[0171.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0171.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0171.467] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0171.467] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0171.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0171.467] lstrlenW (lpString="LSM") returned 3
	[0171.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0171.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0171.467] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0171.467] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0171.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0171.467] lstrlenW (lpString="MpsSvc") returned 6
	[0171.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0171.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0171.467] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0171.467] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0171.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0171.467] lstrlenW (lpString="NcbService") returned 10
	[0171.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0171.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0171.468] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0171.468] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0171.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0171.468] lstrlenW (lpString="netprofm") returned 8
	[0171.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0171.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0171.468] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0171.468] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0171.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0171.468] lstrlenW (lpString="NgcSvc") returned 6
	[0171.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0171.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0171.468] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0171.468] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0171.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0171.468] lstrlenW (lpString="NlaSvc") returned 6
	[0171.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0171.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0171.468] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0171.468] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0171.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0171.468] lstrlenW (lpString="nsi") returned 3
	[0171.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0171.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0171.468] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0171.468] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0171.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0171.468] lstrlenW (lpString="PcaSvc") returned 6
	[0171.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0171.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0171.469] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0171.469] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0171.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0171.469] lstrlenW (lpString="PlugPlay") returned 8
	[0171.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0171.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0171.469] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0171.469] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0171.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0171.469] lstrlenW (lpString="Power") returned 5
	[0171.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0171.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0171.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0171.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0171.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0171.469] lstrlenW (lpString="ProfSvc") returned 7
	[0171.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0171.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0171.469] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0171.469] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0171.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0171.469] lstrlenW (lpString="RpcEptMapper") returned 12
	[0171.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0171.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0171.469] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0171.469] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0171.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0171.470] lstrlenW (lpString="RpcSs") returned 5
	[0171.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0171.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0171.470] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0171.470] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0171.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0171.470] lstrlenW (lpString="SamSs") returned 5
	[0171.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0171.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0171.470] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0171.470] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0171.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0171.470] lstrlenW (lpString="Schedule") returned 8
	[0171.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0171.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0171.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0171.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0171.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0171.470] lstrlenW (lpString="SecurityHealthService") returned 21
	[0171.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0171.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0171.470] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0171.470] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0171.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0171.470] lstrlenW (lpString="SENS") returned 4
	[0171.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0171.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0171.470] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0171.471] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0171.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0171.471] lstrlenW (lpString="ShellHWDetection") returned 16
	[0171.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0171.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0171.471] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0171.471] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0171.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0171.471] lstrlenW (lpString="Spooler") returned 7
	[0171.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0171.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0171.471] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0171.471] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0171.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0171.471] lstrlenW (lpString="StateRepository") returned 15
	[0171.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0171.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0171.471] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0171.471] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0171.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0171.471] lstrlenW (lpString="SysMain") returned 7
	[0171.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0171.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0171.471] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0171.471] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0171.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0171.472] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0171.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0171.472] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0171.472] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0171.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0171.472] lstrlenW (lpString="Themes") returned 6
	[0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0171.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0171.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0171.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0171.472] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c3aa8 | out: hHeap=0x4c0000) returned 1
	[0171.472] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c
	[0171.477] Process32FirstW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0171.477] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0171.478] lstrlenW (lpString="System") returned 6
	[0171.478] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0171.478] lstrlenW (lpString="smss.exe") returned 8
	[0171.478] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0171.479] lstrlenW (lpString="csrss.exe") returned 9
	[0171.479] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0171.479] lstrlenW (lpString="wininit.exe") returned 11
	[0171.479] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0171.480] lstrlenW (lpString="csrss.exe") returned 9
	[0171.480] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0171.480] lstrlenW (lpString="winlogon.exe") returned 12
	[0171.480] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0171.481] lstrlenW (lpString="services.exe") returned 12
	[0171.481] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0171.481] lstrlenW (lpString="lsass.exe") returned 9
	[0171.482] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0171.482] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0171.482] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0171.482] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0171.483] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.483] lstrlenW (lpString="svchost.exe") returned 11
	[0171.483] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.484] lstrlenW (lpString="svchost.exe") returned 11
	[0171.484] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0171.484] lstrlenW (lpString="dwm.exe") returned 7
	[0171.484] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.485] lstrlenW (lpString="svchost.exe") returned 11
	[0171.485] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.485] lstrlenW (lpString="svchost.exe") returned 11
	[0171.485] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.486] lstrlenW (lpString="svchost.exe") returned 11
	[0171.486] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.486] lstrlenW (lpString="svchost.exe") returned 11
	[0171.486] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.487] lstrlenW (lpString="svchost.exe") returned 11
	[0171.487] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.487] lstrlenW (lpString="svchost.exe") returned 11
	[0171.487] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.488] lstrlenW (lpString="svchost.exe") returned 11
	[0171.488] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.488] lstrlenW (lpString="svchost.exe") returned 11
	[0171.488] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.489] lstrlenW (lpString="svchost.exe") returned 11
	[0171.489] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.489] lstrlenW (lpString="svchost.exe") returned 11
	[0171.489] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0171.490] lstrlenW (lpString="spoolsv.exe") returned 11
	[0171.490] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.490] lstrlenW (lpString="svchost.exe") returned 11
	[0171.490] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0171.491] lstrlenW (lpString="audiodg.exe") returned 11
	[0171.491] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0171.492] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0171.492] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0171.492] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0171.492] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0171.493] lstrlenW (lpString="sihost.exe") returned 10
	[0171.493] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0171.493] lstrlenW (lpString="Memory Compression") returned 18
	[0171.493] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.494] lstrlenW (lpString="svchost.exe") returned 11
	[0171.494] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0171.494] lstrlenW (lpString="msoia.exe") returned 9
	[0171.494] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0171.495] lstrlenW (lpString="taskhostw.exe") returned 13
	[0171.495] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0171.495] lstrlenW (lpString="explorer.exe") returned 12
	[0171.495] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0171.496] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0171.496] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0171.496] lstrlenW (lpString="SearchUI.exe") returned 12
	[0171.496] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0171.497] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0171.497] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0171.497] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0171.497] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0171.498] lstrlenW (lpString="d2.exe") returned 6
	[0171.498] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0171.498] lstrlenW (lpString="cmd.exe") returned 7
	[0171.499] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0171.499] lstrlenW (lpString="conhost.exe") returned 11
	[0171.499] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0171.499] lstrlenW (lpString="consent.exe") returned 11
	[0171.499] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0171.500] lstrlenW (lpString="dllhost.exe") returned 11
	[0171.500] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0171.500] lstrlenW (lpString="vssadmin.exe") returned 12
	[0171.501] Process32NextW (in: hSnapshot=0x36c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0171.683] CloseHandle (hObject=0x36c) returned 1
	[0171.683] Sleep (dwMilliseconds=0x1f4) 
	[0172.217] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ee20
	[0172.217] EnumServicesStatusExW (in: hSCManager=0x52ee20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0172.218] GetLastError () returned 0xea
	[0172.218] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x44c3aa8
	[0172.218] EnumServicesStatusExW (in: hSCManager=0x52ee20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44c3aa8, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44c3aa8, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0172.219] CloseServiceHandle (hSCObject=0x52ee20) returned 1
	[0172.219] lstrlenW (lpString="Appinfo") returned 7
	[0172.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0172.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0172.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0172.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0172.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0172.220] lstrlenW (lpString="AppXSvc") returned 7
	[0172.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0172.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0172.220] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0172.220] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0172.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0172.220] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0172.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0172.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0172.220] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0172.220] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0172.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0172.220] lstrlenW (lpString="Audiosrv") returned 8
	[0172.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0172.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0172.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0172.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0172.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0172.220] lstrlenW (lpString="BFE") returned 3
	[0172.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0172.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0172.221] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0172.221] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0172.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0172.221] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0172.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0172.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0172.221] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0172.221] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0172.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0172.221] lstrlenW (lpString="CDPSvc") returned 6
	[0172.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0172.222] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0172.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0172.222] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0172.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0172.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0172.222] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0172.222] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0172.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0172.222] lstrlenW (lpString="CryptSvc") returned 8
	[0172.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0172.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0172.222] lstrlenW (lpString="DcomLaunch") returned 10
	[0172.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0172.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0172.222] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0172.222] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0172.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0172.223] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0172.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0172.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0172.223] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0172.223] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0172.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0172.223] lstrlenW (lpString="Dhcp") returned 4
	[0172.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0172.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0172.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0172.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0172.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0172.223] lstrlenW (lpString="Dnscache") returned 8
	[0172.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0172.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0172.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0172.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0172.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0172.223] lstrlenW (lpString="DPS") returned 3
	[0172.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0172.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0172.223] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0172.223] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0172.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0172.223] lstrlenW (lpString="DsmSvc") returned 6
	[0172.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0172.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0172.224] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0172.224] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0172.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0172.224] lstrlenW (lpString="DusmSvc") returned 7
	[0172.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0172.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0172.224] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0172.224] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0172.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0172.224] lstrlenW (lpString="EventLog") returned 8
	[0172.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0172.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0172.224] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0172.224] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0172.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0172.224] lstrlenW (lpString="EventSystem") returned 11
	[0172.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0172.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0172.224] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0172.224] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0172.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0172.224] lstrlenW (lpString="FontCache") returned 9
	[0172.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0172.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0172.224] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0172.224] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0172.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0172.225] lstrlenW (lpString="gpsvc") returned 5
	[0172.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0172.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0172.225] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0172.225] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0172.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0172.225] lstrlenW (lpString="iphlpsvc") returned 8
	[0172.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0172.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0172.225] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0172.225] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0172.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0172.225] lstrlenW (lpString="KeyIso") returned 6
	[0172.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0172.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0172.225] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0172.225] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0172.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0172.225] lstrlenW (lpString="LanmanServer") returned 12
	[0172.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0172.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0172.226] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0172.226] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0172.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0172.226] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0172.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0172.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0172.226] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0172.226] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0172.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0172.226] lstrlenW (lpString="lfsvc") returned 5
	[0172.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0172.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0172.319] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0172.320] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0172.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0172.320] lstrlenW (lpString="lmhosts") returned 7
	[0172.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0172.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0172.320] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0172.320] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0172.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0172.320] lstrlenW (lpString="LSM") returned 3
	[0172.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0172.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0172.320] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0172.320] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0172.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0172.320] lstrlenW (lpString="MpsSvc") returned 6
	[0172.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0172.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0172.320] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0172.320] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0172.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0172.320] lstrlenW (lpString="NcbService") returned 10
	[0172.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0172.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0172.320] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0172.320] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0172.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0172.320] lstrlenW (lpString="netprofm") returned 8
	[0172.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0172.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0172.321] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0172.321] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0172.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0172.321] lstrlenW (lpString="NgcSvc") returned 6
	[0172.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0172.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0172.321] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0172.321] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0172.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0172.321] lstrlenW (lpString="NlaSvc") returned 6
	[0172.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0172.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0172.322] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0172.322] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0172.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0172.322] lstrlenW (lpString="nsi") returned 3
	[0172.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0172.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0172.322] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0172.322] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0172.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0172.322] lstrlenW (lpString="PcaSvc") returned 6
	[0172.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0172.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0172.322] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0172.322] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0172.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0172.322] lstrlenW (lpString="PlugPlay") returned 8
	[0172.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0172.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0172.322] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0172.322] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0172.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0172.322] lstrlenW (lpString="Power") returned 5
	[0172.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0172.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0172.322] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0172.322] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0172.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0172.326] lstrlenW (lpString="ProfSvc") returned 7
	[0172.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0172.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0172.326] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0172.326] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0172.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0172.326] lstrlenW (lpString="RpcEptMapper") returned 12
	[0172.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0172.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0172.327] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0172.327] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0172.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0172.327] lstrlenW (lpString="RpcSs") returned 5
	[0172.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0172.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0172.327] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0172.327] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0172.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0172.327] lstrlenW (lpString="SamSs") returned 5
	[0172.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0172.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0172.327] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0172.327] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0172.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0172.327] lstrlenW (lpString="Schedule") returned 8
	[0172.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0172.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0172.327] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0172.327] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0172.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0172.327] lstrlenW (lpString="SecurityHealthService") returned 21
	[0172.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0172.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0172.327] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0172.328] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0172.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0172.328] lstrlenW (lpString="SENS") returned 4
	[0172.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0172.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0172.328] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0172.328] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0172.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0172.328] lstrlenW (lpString="ShellHWDetection") returned 16
	[0172.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0172.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0172.328] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0172.328] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0172.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0172.328] lstrlenW (lpString="Spooler") returned 7
	[0172.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0172.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0172.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0172.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0172.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0172.328] lstrlenW (lpString="StateRepository") returned 15
	[0172.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0172.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0172.328] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0172.328] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0172.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0172.329] lstrlenW (lpString="SysMain") returned 7
	[0172.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0172.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0172.329] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0172.329] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0172.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0172.329] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0172.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0172.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0172.329] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0172.329] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0172.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0172.329] lstrlenW (lpString="Themes") returned 6
	[0172.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0172.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0172.329] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0172.329] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0172.329] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c3aa8 | out: hHeap=0x4c0000) returned 1
	[0172.329] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x55c
	[0172.335] Process32FirstW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0172.335] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0172.336] lstrlenW (lpString="System") returned 6
	[0172.336] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0172.336] lstrlenW (lpString="smss.exe") returned 8
	[0172.336] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0172.337] lstrlenW (lpString="csrss.exe") returned 9
	[0172.337] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0172.337] lstrlenW (lpString="wininit.exe") returned 11
	[0172.337] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0172.338] lstrlenW (lpString="csrss.exe") returned 9
	[0172.338] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0172.338] lstrlenW (lpString="winlogon.exe") returned 12
	[0172.339] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0172.339] lstrlenW (lpString="services.exe") returned 12
	[0172.339] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0172.340] lstrlenW (lpString="lsass.exe") returned 9
	[0172.340] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0172.340] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0172.340] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0172.341] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0172.341] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.341] lstrlenW (lpString="svchost.exe") returned 11
	[0172.341] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.345] lstrlenW (lpString="svchost.exe") returned 11
	[0172.345] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0172.346] lstrlenW (lpString="dwm.exe") returned 7
	[0172.346] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.346] lstrlenW (lpString="svchost.exe") returned 11
	[0172.346] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.347] lstrlenW (lpString="svchost.exe") returned 11
	[0172.347] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.347] lstrlenW (lpString="svchost.exe") returned 11
	[0172.347] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.348] lstrlenW (lpString="svchost.exe") returned 11
	[0172.348] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.348] lstrlenW (lpString="svchost.exe") returned 11
	[0172.348] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.349] lstrlenW (lpString="svchost.exe") returned 11
	[0172.349] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.349] lstrlenW (lpString="svchost.exe") returned 11
	[0172.349] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.350] lstrlenW (lpString="svchost.exe") returned 11
	[0172.350] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.350] lstrlenW (lpString="svchost.exe") returned 11
	[0172.351] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0172.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0172.351] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0172.351] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0172.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0172.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0172.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0172.351] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.351] lstrlenW (lpString="svchost.exe") returned 11
	[0172.352] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0172.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0172.352] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0172.352] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0172.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0172.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0172.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0172.352] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0172.353] lstrlenW (lpString="spoolsv.exe") returned 11
	[0172.353] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1
	[0172.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1
	[0172.353] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1
	[0172.353] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1
	[0172.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1
	[0172.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1
	[0172.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1
	[0172.353] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.367] lstrlenW (lpString="svchost.exe") returned 11
	[0172.367] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0172.367] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0172.367] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0172.367] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0172.367] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0172.367] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0172.367] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0172.367] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0172.368] lstrlenW (lpString="audiodg.exe") returned 11
	[0172.368] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0172.368] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0172.368] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0172.368] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0172.368] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0172.368] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0172.368] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0172.368] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0172.368] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0172.368] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0172.368] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0172.368] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeClickToRun.exe") returned 1
	[0172.368] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeClickToRun.exe") returned 1
	[0172.368] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0172.369] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0172.369] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeClickToRun.exe") returned 1
	[0172.369] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0172.369] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0172.369] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1
	[0172.369] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1
	[0172.369] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1
	[0172.369] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1
	[0172.369] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1
	[0172.369] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1
	[0172.370] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1
	[0172.370] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0172.370] lstrlenW (lpString="sihost.exe") returned 10
	[0172.370] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1
	[0172.370] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1
	[0172.370] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1
	[0172.370] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1
	[0172.370] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1
	[0172.370] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1
	[0172.370] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1
	[0172.370] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0172.371] lstrlenW (lpString="Memory Compression") returned 18
	[0172.371] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1
	[0172.371] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1
	[0172.371] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1
	[0172.371] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1
	[0172.371] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1
	[0172.371] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1
	[0172.371] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1
	[0172.371] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.372] lstrlenW (lpString="svchost.exe") returned 11
	[0172.372] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0172.372] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0172.372] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0172.372] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0172.372] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0172.372] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0172.372] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0172.372] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0172.373] lstrlenW (lpString="msoia.exe") returned 9
	[0172.373] lstrcmpiW (lpString1="1c8.exe", lpString2="msoia.exe") returned -1
	[0172.373] lstrcmpiW (lpString1="1cv77.exe", lpString2="msoia.exe") returned -1
	[0172.373] lstrcmpiW (lpString1="outlook.exe", lpString2="msoia.exe") returned 1
	[0172.373] lstrcmpiW (lpString1="postgres.exe", lpString2="msoia.exe") returned 1
	[0172.373] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="msoia.exe") returned 1
	[0172.373] lstrcmpiW (lpString1="mysqld.exe", lpString2="msoia.exe") returned 1
	[0172.373] lstrcmpiW (lpString1="sqlservr.exe", lpString2="msoia.exe") returned 1
	[0172.373] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0172.374] lstrlenW (lpString="taskhostw.exe") returned 13
	[0172.374] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1
	[0172.374] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1
	[0172.374] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1
	[0172.374] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1
	[0172.374] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1
	[0172.374] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1
	[0172.374] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1
	[0172.374] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0172.374] lstrlenW (lpString="explorer.exe") returned 12
	[0172.375] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1
	[0172.375] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1
	[0172.375] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1
	[0172.375] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1
	[0172.375] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1
	[0172.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1
	[0172.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1
	[0172.375] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0172.375] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0172.375] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0172.375] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0172.375] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0172.375] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0172.375] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0172.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0172.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1
	[0172.534] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0172.534] lstrlenW (lpString="SearchUI.exe") returned 12
	[0172.534] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1
	[0172.534] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1
	[0172.534] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1
	[0172.534] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1
	[0172.534] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1
	[0172.534] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1
	[0172.534] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1
	[0172.535] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0172.535] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0172.535] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1
	[0172.535] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1
	[0172.535] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1
	[0172.535] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1
	[0172.535] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1
	[0172.535] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1
	[0172.535] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1
	[0172.535] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0172.536] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0172.536] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1
	[0172.536] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1
	[0172.536] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1
	[0172.536] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1
	[0172.536] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1
	[0172.536] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1
	[0172.536] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1
	[0172.536] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0172.537] lstrlenW (lpString="d2.exe") returned 6
	[0172.537] lstrcmpiW (lpString1="1c8.exe", lpString2="d2.exe") returned -1
	[0172.537] lstrcmpiW (lpString1="1cv77.exe", lpString2="d2.exe") returned -1
	[0172.537] lstrcmpiW (lpString1="outlook.exe", lpString2="d2.exe") returned 1
	[0172.537] lstrcmpiW (lpString1="postgres.exe", lpString2="d2.exe") returned 1
	[0172.537] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="d2.exe") returned 1
	[0172.537] lstrcmpiW (lpString1="mysqld.exe", lpString2="d2.exe") returned 1
	[0172.537] lstrcmpiW (lpString1="sqlservr.exe", lpString2="d2.exe") returned 1
	[0172.537] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0172.538] lstrlenW (lpString="cmd.exe") returned 7
	[0172.538] lstrcmpiW (lpString1="1c8.exe", lpString2="cmd.exe") returned -1
	[0172.538] lstrcmpiW (lpString1="1cv77.exe", lpString2="cmd.exe") returned -1
	[0172.538] lstrcmpiW (lpString1="outlook.exe", lpString2="cmd.exe") returned 1
	[0172.538] lstrcmpiW (lpString1="postgres.exe", lpString2="cmd.exe") returned 1
	[0172.538] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cmd.exe") returned 1
	[0172.538] lstrcmpiW (lpString1="mysqld.exe", lpString2="cmd.exe") returned 1
	[0172.538] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cmd.exe") returned 1
	[0172.538] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0172.539] lstrlenW (lpString="conhost.exe") returned 11
	[0172.539] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1
	[0172.539] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1
	[0172.539] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1
	[0172.539] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1
	[0172.539] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1
	[0172.539] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1
	[0172.539] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1
	[0172.539] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x198, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0172.540] lstrlenW (lpString="consent.exe") returned 11
	[0172.540] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1
	[0172.540] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1
	[0172.540] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1
	[0172.540] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1
	[0172.540] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1
	[0172.540] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1
	[0172.540] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1
	[0172.540] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0172.541] lstrlenW (lpString="dllhost.exe") returned 11
	[0172.541] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1
	[0172.541] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1
	[0172.541] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1
	[0172.541] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1
	[0172.541] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1
	[0172.541] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1
	[0172.542] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1
	[0172.542] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0172.543] lstrlenW (lpString="vssadmin.exe") returned 12
	[0172.543] lstrcmpiW (lpString1="1c8.exe", lpString2="vssadmin.exe") returned -1
	[0172.543] lstrcmpiW (lpString1="1cv77.exe", lpString2="vssadmin.exe") returned -1
	[0172.543] lstrcmpiW (lpString1="outlook.exe", lpString2="vssadmin.exe") returned -1
	[0172.543] lstrcmpiW (lpString1="postgres.exe", lpString2="vssadmin.exe") returned -1
	[0172.543] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="vssadmin.exe") returned -1
	[0172.543] lstrcmpiW (lpString1="mysqld.exe", lpString2="vssadmin.exe") returned -1
	[0172.543] lstrcmpiW (lpString1="sqlservr.exe", lpString2="vssadmin.exe") returned -1
	[0172.543] Process32NextW (in: hSnapshot=0x55c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0172.544] CloseHandle (hObject=0x55c) returned 1
	[0172.544] Sleep (dwMilliseconds=0x1f4) 
	[0173.393] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52efb0
	[0173.393] EnumServicesStatusExW (in: hSCManager=0x52efb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0173.394] GetLastError () returned 0xea
	[0173.394] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c94) returned 0x44c3aa8
	[0173.394] EnumServicesStatusExW (in: hSCManager=0x52efb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44c3aa8, cbBufSize=0x1c94, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44c3aa8, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0173.395] CloseServiceHandle (hSCObject=0x52efb0) returned 1
	[0173.395] lstrlenW (lpString="Appinfo") returned 7
	[0173.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0173.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0173.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0173.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0173.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0173.395] lstrlenW (lpString="AppXSvc") returned 7
	[0173.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0173.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0173.395] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0173.395] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0173.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0173.395] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0173.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0173.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0173.396] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0173.396] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0173.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0173.396] lstrlenW (lpString="Audiosrv") returned 8
	[0173.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0173.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0173.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0173.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0173.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0173.396] lstrlenW (lpString="BFE") returned 3
	[0173.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0173.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0173.396] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0173.396] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0173.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0173.396] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0173.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0173.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0173.396] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0173.396] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0173.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0173.396] lstrlenW (lpString="CDPSvc") returned 6
	[0173.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0173.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0173.396] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0173.396] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0173.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0173.396] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0173.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0173.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0173.397] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0173.397] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0173.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0173.397] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0173.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0173.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0173.397] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0173.397] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0173.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0173.397] lstrlenW (lpString="CryptSvc") returned 8
	[0173.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0173.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0173.397] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0173.397] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0173.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0173.397] lstrlenW (lpString="DcomLaunch") returned 10
	[0173.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0173.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0173.397] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0173.397] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0173.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0173.397] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0173.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0173.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0173.397] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0173.397] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0173.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0173.397] lstrlenW (lpString="Dhcp") returned 4
	[0173.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0173.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0173.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0173.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0173.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0173.398] lstrlenW (lpString="Dnscache") returned 8
	[0173.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0173.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0173.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0173.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0173.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0173.398] lstrlenW (lpString="DPS") returned 3
	[0173.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0173.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0173.398] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0173.398] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0173.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0173.398] lstrlenW (lpString="DsmSvc") returned 6
	[0173.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0173.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0173.398] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0173.398] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0173.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0173.398] lstrlenW (lpString="DusmSvc") returned 7
	[0173.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0173.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0173.398] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0173.398] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0173.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0173.398] lstrlenW (lpString="EventLog") returned 8
	[0173.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0173.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0173.399] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0173.399] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0173.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0173.399] lstrlenW (lpString="EventSystem") returned 11
	[0173.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0173.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0173.399] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0173.399] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0173.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0173.399] lstrlenW (lpString="FontCache") returned 9
	[0173.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0173.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0173.399] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0173.399] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0173.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0173.399] lstrlenW (lpString="gpsvc") returned 5
	[0173.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0173.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0173.399] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0173.399] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0173.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0173.399] lstrlenW (lpString="iphlpsvc") returned 8
	[0173.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0173.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0173.399] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0173.399] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0173.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0173.399] lstrlenW (lpString="KeyIso") returned 6
	[0173.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0173.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0173.400] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0173.400] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0173.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0173.400] lstrlenW (lpString="LanmanServer") returned 12
	[0173.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0173.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0173.400] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0173.400] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0173.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0173.400] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0173.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0173.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0173.400] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0173.400] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0173.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0173.400] lstrlenW (lpString="lfsvc") returned 5
	[0173.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0173.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0173.400] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0173.400] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0173.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0173.400] lstrlenW (lpString="lmhosts") returned 7
	[0173.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0173.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0173.400] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0173.400] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0173.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0173.400] lstrlenW (lpString="LSM") returned 3
	[0173.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0173.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0173.401] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0173.401] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0173.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0173.401] lstrlenW (lpString="MpsSvc") returned 6
	[0173.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0173.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0173.401] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0173.401] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0173.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0173.401] lstrlenW (lpString="NcbService") returned 10
	[0173.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0173.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0173.401] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0173.401] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0173.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0173.401] lstrlenW (lpString="netprofm") returned 8
	[0173.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0173.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0173.401] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0173.401] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0173.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0173.401] lstrlenW (lpString="NgcSvc") returned 6
	[0173.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0173.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0173.401] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0173.401] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0173.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0173.401] lstrlenW (lpString="NlaSvc") returned 6
	[0173.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0173.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0173.402] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0173.402] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0173.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0173.402] lstrlenW (lpString="nsi") returned 3
	[0173.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0173.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0173.402] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0173.402] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0173.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0173.402] lstrlenW (lpString="PcaSvc") returned 6
	[0173.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0173.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0173.402] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0173.402] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0173.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0173.402] lstrlenW (lpString="PlugPlay") returned 8
	[0173.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0173.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0173.402] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0173.402] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0173.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0173.402] lstrlenW (lpString="Power") returned 5
	[0173.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0173.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0173.402] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0173.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0173.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0173.402] lstrlenW (lpString="ProfSvc") returned 7
	[0173.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0173.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0173.402] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0173.402] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0173.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0173.403] lstrlenW (lpString="RpcEptMapper") returned 12
	[0173.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0173.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0173.403] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0173.403] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0173.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0173.403] lstrlenW (lpString="RpcSs") returned 5
	[0173.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0173.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0173.403] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0173.403] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0173.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0173.403] lstrlenW (lpString="SamSs") returned 5
	[0173.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0173.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0173.403] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0173.403] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0173.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0173.403] lstrlenW (lpString="Schedule") returned 8
	[0173.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0173.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0173.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0173.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0173.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0173.403] lstrlenW (lpString="SecurityHealthService") returned 21
	[0173.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0173.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0173.403] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0173.403] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0173.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0173.404] lstrlenW (lpString="SENS") returned 4
	[0173.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0173.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0173.404] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0173.404] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0173.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0173.404] lstrlenW (lpString="ShellHWDetection") returned 16
	[0173.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0173.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0173.404] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0173.404] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0173.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0173.404] lstrlenW (lpString="Spooler") returned 7
	[0173.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0173.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0173.404] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0173.404] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0173.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0173.404] lstrlenW (lpString="StateRepository") returned 15
	[0173.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0173.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0173.404] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0173.404] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0173.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0173.404] lstrlenW (lpString="SysMain") returned 7
	[0173.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0173.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0173.404] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0173.404] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0173.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0173.405] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0173.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0173.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0173.405] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0173.405] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0173.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0173.405] lstrlenW (lpString="Themes") returned 6
	[0173.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0173.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0173.405] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0173.405] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0173.405] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c3aa8 | out: hHeap=0x4c0000) returned 1
	[0173.405] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370
	[0173.596] Process32FirstW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0173.596] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0173.596] lstrlenW (lpString="System") returned 6
	[0173.597] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0173.597] lstrlenW (lpString="smss.exe") returned 8
	[0173.597] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0173.597] lstrlenW (lpString="csrss.exe") returned 9
	[0173.598] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0173.598] lstrlenW (lpString="wininit.exe") returned 11
	[0173.598] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0173.598] lstrlenW (lpString="csrss.exe") returned 9
	[0173.598] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0173.599] lstrlenW (lpString="winlogon.exe") returned 12
	[0173.599] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0173.599] lstrlenW (lpString="services.exe") returned 12
	[0173.599] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0173.600] lstrlenW (lpString="lsass.exe") returned 9
	[0173.600] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0173.600] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0173.600] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0173.601] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0173.601] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.601] lstrlenW (lpString="svchost.exe") returned 11
	[0173.601] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.602] lstrlenW (lpString="svchost.exe") returned 11
	[0173.602] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0173.602] lstrlenW (lpString="dwm.exe") returned 7
	[0173.602] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.603] lstrlenW (lpString="svchost.exe") returned 11
	[0173.603] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.603] lstrlenW (lpString="svchost.exe") returned 11
	[0173.603] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.603] lstrlenW (lpString="svchost.exe") returned 11
	[0173.604] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.604] lstrlenW (lpString="svchost.exe") returned 11
	[0173.604] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.604] lstrlenW (lpString="svchost.exe") returned 11
	[0173.604] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.605] lstrlenW (lpString="svchost.exe") returned 11
	[0173.605] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.605] lstrlenW (lpString="svchost.exe") returned 11
	[0173.605] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.606] lstrlenW (lpString="svchost.exe") returned 11
	[0173.606] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.606] lstrlenW (lpString="svchost.exe") returned 11
	[0173.606] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.607] lstrlenW (lpString="svchost.exe") returned 11
	[0173.607] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0173.607] lstrlenW (lpString="spoolsv.exe") returned 11
	[0173.607] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.608] lstrlenW (lpString="svchost.exe") returned 11
	[0173.608] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0173.608] lstrlenW (lpString="audiodg.exe") returned 11
	[0173.608] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0173.609] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0173.609] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0173.609] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0173.609] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0173.610] lstrlenW (lpString="sihost.exe") returned 10
	[0173.610] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0173.610] lstrlenW (lpString="Memory Compression") returned 18
	[0173.610] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.611] lstrlenW (lpString="svchost.exe") returned 11
	[0173.611] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0173.611] lstrlenW (lpString="msoia.exe") returned 9
	[0173.611] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0173.612] lstrlenW (lpString="taskhostw.exe") returned 13
	[0173.612] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0173.612] lstrlenW (lpString="explorer.exe") returned 12
	[0173.612] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0173.613] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0173.613] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0173.613] lstrlenW (lpString="SearchUI.exe") returned 12
	[0173.613] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0173.614] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0173.614] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0173.614] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0173.614] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0173.615] lstrlenW (lpString="d2.exe") returned 6
	[0173.615] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0173.615] lstrlenW (lpString="cmd.exe") returned 7
	[0173.615] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.615] lstrlenW (lpString="conhost.exe") returned 11
	[0173.616] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0173.616] lstrlenW (lpString="dllhost.exe") returned 11
	[0173.616] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0173.616] lstrlenW (lpString="vssadmin.exe") returned 12
	[0173.616] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0173.617] lstrlenW (lpString="dllhost.exe") returned 11
	[0173.617] Process32NextW (in: hSnapshot=0x370, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0173.617] CloseHandle (hObject=0x370) returned 1
	[0173.617] Sleep (dwMilliseconds=0x1f4) 
	[0174.243] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ef88
	[0174.244] EnumServicesStatusExW (in: hSCManager=0x52ef88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0174.244] GetLastError () returned 0xea
	[0174.244] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x54e0050
	[0174.244] EnumServicesStatusExW (in: hSCManager=0x52ef88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x54e0050, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x54e0050, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0174.245] CloseServiceHandle (hSCObject=0x52ef88) returned 1
	[0174.245] lstrlenW (lpString="Appinfo") returned 7
	[0174.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0174.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0174.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0174.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0174.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0174.245] lstrlenW (lpString="AppXSvc") returned 7
	[0174.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0174.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0174.245] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0174.245] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0174.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0174.245] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0174.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0174.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0174.245] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0174.245] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0174.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0174.246] lstrlenW (lpString="Audiosrv") returned 8
	[0174.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0174.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0174.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0174.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0174.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0174.246] lstrlenW (lpString="BFE") returned 3
	[0174.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0174.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0174.246] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0174.246] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0174.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0174.246] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0174.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0174.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0174.246] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0174.246] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0174.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0174.246] lstrlenW (lpString="CDPSvc") returned 6
	[0174.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0174.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0174.246] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0174.246] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0174.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0174.246] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0174.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0174.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0174.246] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0174.246] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0174.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0174.246] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0174.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0174.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0174.247] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0174.247] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0174.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0174.247] lstrlenW (lpString="CryptSvc") returned 8
	[0174.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0174.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0174.247] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0174.247] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0174.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0174.247] lstrlenW (lpString="DcomLaunch") returned 10
	[0174.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0174.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0174.247] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0174.247] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0174.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0174.247] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0174.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0174.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0174.247] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0174.247] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0174.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0174.247] lstrlenW (lpString="Dhcp") returned 4
	[0174.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0174.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0174.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0174.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0174.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0174.247] lstrlenW (lpString="Dnscache") returned 8
	[0174.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0174.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0174.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0174.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0174.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0174.248] lstrlenW (lpString="DPS") returned 3
	[0174.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0174.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0174.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0174.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0174.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0174.248] lstrlenW (lpString="DusmSvc") returned 7
	[0174.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0174.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0174.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0174.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0174.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0174.248] lstrlenW (lpString="EventLog") returned 8
	[0174.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0174.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0174.248] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0174.248] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0174.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0174.248] lstrlenW (lpString="EventSystem") returned 11
	[0174.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0174.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0174.248] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0174.248] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0174.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0174.248] lstrlenW (lpString="FontCache") returned 9
	[0174.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0174.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0174.248] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0174.249] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0174.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0174.249] lstrlenW (lpString="gpsvc") returned 5
	[0174.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0174.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0174.249] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0174.249] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0174.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0174.249] lstrlenW (lpString="iphlpsvc") returned 8
	[0174.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0174.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0174.249] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0174.249] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0174.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0174.249] lstrlenW (lpString="KeyIso") returned 6
	[0174.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0174.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0174.249] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0174.268] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0174.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0174.269] lstrlenW (lpString="LanmanServer") returned 12
	[0174.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0174.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0174.269] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0174.269] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0174.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0174.269] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0174.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0174.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0174.269] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0174.269] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0174.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0174.269] lstrlenW (lpString="lfsvc") returned 5
	[0174.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0174.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0174.269] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0174.269] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0174.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0174.269] lstrlenW (lpString="lmhosts") returned 7
	[0174.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0174.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0174.269] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0174.269] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0174.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0174.269] lstrlenW (lpString="LSM") returned 3
	[0174.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0174.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0174.269] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0174.269] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0174.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0174.269] lstrlenW (lpString="MpsSvc") returned 6
	[0174.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0174.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0174.270] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0174.270] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0174.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0174.270] lstrlenW (lpString="NcbService") returned 10
	[0174.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0174.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0174.270] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0174.270] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0174.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0174.270] lstrlenW (lpString="netprofm") returned 8
	[0174.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0174.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0174.270] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0174.270] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0174.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0174.270] lstrlenW (lpString="NgcSvc") returned 6
	[0174.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0174.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0174.270] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0174.270] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0174.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0174.270] lstrlenW (lpString="NlaSvc") returned 6
	[0174.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0174.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0174.270] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0174.270] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0174.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0174.270] lstrlenW (lpString="nsi") returned 3
	[0174.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0174.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0174.270] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0174.271] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0174.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0174.271] lstrlenW (lpString="PcaSvc") returned 6
	[0174.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0174.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0174.271] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0174.271] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0174.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0174.271] lstrlenW (lpString="PlugPlay") returned 8
	[0174.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0174.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0174.271] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0174.271] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0174.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0174.271] lstrlenW (lpString="Power") returned 5
	[0174.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0174.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0174.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0174.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0174.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0174.271] lstrlenW (lpString="ProfSvc") returned 7
	[0174.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0174.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0174.271] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0174.271] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0174.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0174.271] lstrlenW (lpString="RpcEptMapper") returned 12
	[0174.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0174.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0174.271] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0174.271] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0174.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0174.272] lstrlenW (lpString="RpcSs") returned 5
	[0174.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0174.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0174.272] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0174.272] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0174.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0174.272] lstrlenW (lpString="SamSs") returned 5
	[0174.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0174.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0174.272] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0174.272] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0174.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0174.272] lstrlenW (lpString="Schedule") returned 8
	[0174.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0174.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0174.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0174.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0174.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0174.272] lstrlenW (lpString="SecurityHealthService") returned 21
	[0174.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0174.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0174.272] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0174.272] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0174.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0174.272] lstrlenW (lpString="SENS") returned 4
	[0174.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0174.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0174.272] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0174.272] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0174.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0174.272] lstrlenW (lpString="ShellHWDetection") returned 16
	[0174.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0174.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0174.273] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0174.273] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0174.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0174.273] lstrlenW (lpString="Spooler") returned 7
	[0174.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0174.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0174.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0174.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0174.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0174.273] lstrlenW (lpString="StateRepository") returned 15
	[0174.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0174.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0174.273] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0174.273] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0174.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0174.273] lstrlenW (lpString="SysMain") returned 7
	[0174.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0174.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0174.273] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0174.273] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0174.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0174.273] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0174.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0174.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0174.273] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0174.273] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0174.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0174.273] lstrlenW (lpString="Themes") returned 6
	[0174.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0174.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0174.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0174.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0174.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0174.274] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0174.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0174.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0174.274] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0174.274] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0174.274] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x520
	[0174.278] Process32FirstW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0174.278] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0174.279] lstrlenW (lpString="System") returned 6
	[0174.279] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0174.279] lstrlenW (lpString="smss.exe") returned 8
	[0174.279] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0174.279] lstrlenW (lpString="csrss.exe") returned 9
	[0174.279] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0174.280] lstrlenW (lpString="wininit.exe") returned 11
	[0174.280] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0174.465] lstrlenW (lpString="csrss.exe") returned 9
	[0174.465] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0174.465] lstrlenW (lpString="winlogon.exe") returned 12
	[0174.465] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0174.466] lstrlenW (lpString="services.exe") returned 12
	[0174.466] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0174.466] lstrlenW (lpString="lsass.exe") returned 9
	[0174.466] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0174.467] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0174.467] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0174.467] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0174.467] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.468] lstrlenW (lpString="svchost.exe") returned 11
	[0174.468] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.468] lstrlenW (lpString="svchost.exe") returned 11
	[0174.468] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0174.469] lstrlenW (lpString="dwm.exe") returned 7
	[0174.469] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.469] lstrlenW (lpString="svchost.exe") returned 11
	[0174.469] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.470] lstrlenW (lpString="svchost.exe") returned 11
	[0174.470] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.470] lstrlenW (lpString="svchost.exe") returned 11
	[0174.470] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.471] lstrlenW (lpString="svchost.exe") returned 11
	[0174.471] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.471] lstrlenW (lpString="svchost.exe") returned 11
	[0174.471] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.472] lstrlenW (lpString="svchost.exe") returned 11
	[0174.472] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.472] lstrlenW (lpString="svchost.exe") returned 11
	[0174.472] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.473] lstrlenW (lpString="svchost.exe") returned 11
	[0174.473] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.473] lstrlenW (lpString="svchost.exe") returned 11
	[0174.473] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.474] lstrlenW (lpString="svchost.exe") returned 11
	[0174.474] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0174.474] lstrlenW (lpString="spoolsv.exe") returned 11
	[0174.474] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.475] lstrlenW (lpString="svchost.exe") returned 11
	[0174.475] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0174.475] lstrlenW (lpString="audiodg.exe") returned 11
	[0174.475] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0174.475] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0174.476] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0174.476] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0174.476] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0174.476] lstrlenW (lpString="sihost.exe") returned 10
	[0174.476] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0174.477] lstrlenW (lpString="Memory Compression") returned 18
	[0174.477] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.477] lstrlenW (lpString="svchost.exe") returned 11
	[0174.477] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0174.478] lstrlenW (lpString="msoia.exe") returned 9
	[0174.478] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0174.478] lstrlenW (lpString="taskhostw.exe") returned 13
	[0174.478] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0174.479] lstrlenW (lpString="explorer.exe") returned 12
	[0174.479] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0174.479] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0174.479] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0174.480] lstrlenW (lpString="SearchUI.exe") returned 12
	[0174.480] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0174.480] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0174.480] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0174.481] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0174.481] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0174.481] lstrlenW (lpString="d2.exe") returned 6
	[0174.481] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0174.482] lstrlenW (lpString="cmd.exe") returned 7
	[0174.482] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0174.482] lstrlenW (lpString="conhost.exe") returned 11
	[0174.482] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0174.482] lstrlenW (lpString="dllhost.exe") returned 11
	[0174.482] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0174.483] lstrlenW (lpString="vssadmin.exe") returned 12
	[0174.483] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0174.483] lstrlenW (lpString="dllhost.exe") returned 11
	[0174.483] Process32NextW (in: hSnapshot=0x520, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0174.484] CloseHandle (hObject=0x520) returned 1
	[0174.484] Sleep (dwMilliseconds=0x1f4) 
	[0175.069] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ea38
	[0175.070] EnumServicesStatusExW (in: hSCManager=0x52ea38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0175.070] GetLastError () returned 0xea
	[0175.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0175.070] EnumServicesStatusExW (in: hSCManager=0x52ea38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0175.071] CloseServiceHandle (hSCObject=0x52ea38) returned 1
	[0175.071] lstrlenW (lpString="Appinfo") returned 7
	[0175.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0175.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0175.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0175.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0175.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0175.072] lstrlenW (lpString="AppXSvc") returned 7
	[0175.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0175.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0175.072] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0175.072] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0175.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0175.072] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0175.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0175.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0175.072] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0175.072] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0175.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0175.072] lstrlenW (lpString="Audiosrv") returned 8
	[0175.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0175.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0175.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0175.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0175.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0175.072] lstrlenW (lpString="BFE") returned 3
	[0175.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0175.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0175.072] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0175.072] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0175.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0175.072] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0175.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0175.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0175.073] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0175.073] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0175.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0175.073] lstrlenW (lpString="CDPSvc") returned 6
	[0175.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0175.073] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0175.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0175.073] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0175.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0175.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0175.073] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0175.073] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0175.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0175.073] lstrlenW (lpString="CryptSvc") returned 8
	[0175.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0175.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0175.073] lstrlenW (lpString="DcomLaunch") returned 10
	[0175.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0175.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0175.074] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0175.074] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0175.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0175.074] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0175.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0175.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0175.074] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0175.074] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0175.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0175.074] lstrlenW (lpString="Dhcp") returned 4
	[0175.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0175.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0175.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0175.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0175.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0175.074] lstrlenW (lpString="Dnscache") returned 8
	[0175.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0175.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0175.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0175.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0175.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0175.074] lstrlenW (lpString="DPS") returned 3
	[0175.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0175.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0175.074] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0175.074] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0175.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0175.074] lstrlenW (lpString="DusmSvc") returned 7
	[0175.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0175.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0175.075] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0175.075] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0175.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0175.075] lstrlenW (lpString="EventLog") returned 8
	[0175.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0175.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0175.075] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0175.075] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0175.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0175.075] lstrlenW (lpString="EventSystem") returned 11
	[0175.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0175.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0175.075] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0175.075] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0175.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0175.075] lstrlenW (lpString="FontCache") returned 9
	[0175.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0175.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0175.075] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0175.075] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0175.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0175.075] lstrlenW (lpString="gpsvc") returned 5
	[0175.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0175.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0175.075] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0175.075] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0175.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0175.075] lstrlenW (lpString="iphlpsvc") returned 8
	[0175.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0175.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0175.076] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0175.076] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0175.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0175.076] lstrlenW (lpString="KeyIso") returned 6
	[0175.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0175.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0175.076] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0175.076] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0175.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0175.076] lstrlenW (lpString="LanmanServer") returned 12
	[0175.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0175.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0175.076] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0175.076] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0175.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0175.076] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0175.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0175.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0175.076] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0175.076] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0175.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0175.076] lstrlenW (lpString="lfsvc") returned 5
	[0175.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0175.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0175.076] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0175.076] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0175.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0175.076] lstrlenW (lpString="lmhosts") returned 7
	[0175.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0175.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0175.077] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0175.077] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0175.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0175.077] lstrlenW (lpString="LSM") returned 3
	[0175.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0175.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0175.077] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0175.077] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0175.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0175.077] lstrlenW (lpString="MpsSvc") returned 6
	[0175.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0175.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0175.077] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0175.077] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0175.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0175.077] lstrlenW (lpString="NcbService") returned 10
	[0175.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0175.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0175.077] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0175.166] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0175.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0175.166] lstrlenW (lpString="netprofm") returned 8
	[0175.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0175.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0175.166] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0175.166] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0175.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0175.166] lstrlenW (lpString="NgcSvc") returned 6
	[0175.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0175.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0175.166] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0175.167] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0175.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0175.167] lstrlenW (lpString="NlaSvc") returned 6
	[0175.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0175.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0175.167] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0175.167] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0175.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0175.167] lstrlenW (lpString="nsi") returned 3
	[0175.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0175.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0175.167] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0175.167] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0175.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0175.167] lstrlenW (lpString="PcaSvc") returned 6
	[0175.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0175.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0175.167] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0175.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0175.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0175.167] lstrlenW (lpString="PlugPlay") returned 8
	[0175.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0175.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0175.167] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0175.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0175.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0175.167] lstrlenW (lpString="Power") returned 5
	[0175.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0175.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0175.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0175.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0175.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0175.168] lstrlenW (lpString="ProfSvc") returned 7
	[0175.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0175.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0175.168] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0175.168] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0175.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0175.168] lstrlenW (lpString="RpcEptMapper") returned 12
	[0175.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0175.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0175.168] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0175.168] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0175.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0175.168] lstrlenW (lpString="RpcSs") returned 5
	[0175.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0175.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0175.168] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0175.168] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0175.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0175.168] lstrlenW (lpString="SamSs") returned 5
	[0175.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0175.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0175.168] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0175.168] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0175.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0175.168] lstrlenW (lpString="Schedule") returned 8
	[0175.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0175.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0175.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0175.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0175.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0175.169] lstrlenW (lpString="SecurityHealthService") returned 21
	[0175.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0175.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0175.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0175.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0175.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0175.169] lstrlenW (lpString="SENS") returned 4
	[0175.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0175.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0175.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0175.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0175.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0175.169] lstrlenW (lpString="ShellHWDetection") returned 16
	[0175.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0175.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0175.169] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0175.169] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0175.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0175.169] lstrlenW (lpString="Spooler") returned 7
	[0175.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0175.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0175.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0175.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0175.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0175.169] lstrlenW (lpString="StateRepository") returned 15
	[0175.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0175.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0175.169] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0175.169] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0175.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0175.170] lstrlenW (lpString="SysMain") returned 7
	[0175.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0175.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0175.170] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0175.170] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0175.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0175.170] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0175.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0175.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0175.170] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0175.170] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0175.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0175.170] lstrlenW (lpString="Themes") returned 6
	[0175.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0175.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0175.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0175.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0175.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0175.170] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0175.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0175.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0175.170] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0175.170] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0175.170] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3e8
	[0175.176] Process32FirstW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0175.177] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0175.177] lstrlenW (lpString="System") returned 6
	[0175.177] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0175.178] lstrlenW (lpString="smss.exe") returned 8
	[0175.178] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0175.178] lstrlenW (lpString="csrss.exe") returned 9
	[0175.178] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0175.179] lstrlenW (lpString="wininit.exe") returned 11
	[0175.179] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0175.179] lstrlenW (lpString="csrss.exe") returned 9
	[0175.179] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0175.180] lstrlenW (lpString="winlogon.exe") returned 12
	[0175.180] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0175.180] lstrlenW (lpString="services.exe") returned 12
	[0175.180] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0175.181] lstrlenW (lpString="lsass.exe") returned 9
	[0175.181] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0175.181] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0175.181] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0175.181] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0175.182] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.182] lstrlenW (lpString="svchost.exe") returned 11
	[0175.182] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.182] lstrlenW (lpString="svchost.exe") returned 11
	[0175.182] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0175.183] lstrlenW (lpString="dwm.exe") returned 7
	[0175.183] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.183] lstrlenW (lpString="svchost.exe") returned 11
	[0175.183] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.184] lstrlenW (lpString="svchost.exe") returned 11
	[0175.184] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.184] lstrlenW (lpString="svchost.exe") returned 11
	[0175.184] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.185] lstrlenW (lpString="svchost.exe") returned 11
	[0175.185] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.185] lstrlenW (lpString="svchost.exe") returned 11
	[0175.185] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.186] lstrlenW (lpString="svchost.exe") returned 11
	[0175.186] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.186] lstrlenW (lpString="svchost.exe") returned 11
	[0175.186] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.187] lstrlenW (lpString="svchost.exe") returned 11
	[0175.187] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.187] lstrlenW (lpString="svchost.exe") returned 11
	[0175.187] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.188] lstrlenW (lpString="svchost.exe") returned 11
	[0175.188] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0175.188] lstrlenW (lpString="spoolsv.exe") returned 11
	[0175.188] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.189] lstrlenW (lpString="svchost.exe") returned 11
	[0175.189] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0175.189] lstrlenW (lpString="audiodg.exe") returned 11
	[0175.189] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0175.190] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0175.190] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0175.190] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0175.190] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0175.191] lstrlenW (lpString="sihost.exe") returned 10
	[0175.191] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0175.191] lstrlenW (lpString="Memory Compression") returned 18
	[0175.191] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.192] lstrlenW (lpString="svchost.exe") returned 11
	[0175.192] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0175.192] lstrlenW (lpString="msoia.exe") returned 9
	[0175.192] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0175.193] lstrlenW (lpString="taskhostw.exe") returned 13
	[0175.193] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0175.193] lstrlenW (lpString="explorer.exe") returned 12
	[0175.193] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0175.194] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0175.194] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0175.194] lstrlenW (lpString="SearchUI.exe") returned 12
	[0175.194] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0175.195] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0175.195] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0175.195] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0175.195] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0175.195] lstrlenW (lpString="d2.exe") returned 6
	[0175.195] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0175.196] lstrlenW (lpString="cmd.exe") returned 7
	[0175.196] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0175.196] lstrlenW (lpString="conhost.exe") returned 11
	[0175.196] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0175.197] lstrlenW (lpString="dllhost.exe") returned 11
	[0175.197] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0175.197] lstrlenW (lpString="vssadmin.exe") returned 12
	[0175.197] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0175.198] lstrlenW (lpString="dllhost.exe") returned 11
	[0175.198] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0175.198] lstrlenW (lpString="d2.exe") returned 6
	[0175.198] Process32NextW (in: hSnapshot=0x3e8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0175.199] CloseHandle (hObject=0x3e8) returned 1
	[0175.199] Sleep (dwMilliseconds=0x1f4) 
	[0175.862] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ee48
	[0175.863] EnumServicesStatusExW (in: hSCManager=0x52ee48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0175.863] GetLastError () returned 0xea
	[0175.863] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0175.864] EnumServicesStatusExW (in: hSCManager=0x52ee48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0175.864] CloseServiceHandle (hSCObject=0x52ee48) returned 1
	[0175.865] lstrlenW (lpString="Appinfo") returned 7
	[0175.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0175.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0175.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0175.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0175.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0175.865] lstrlenW (lpString="AppXSvc") returned 7
	[0175.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0175.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0175.865] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0175.865] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0175.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0175.865] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0175.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0175.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0175.865] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0175.865] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0175.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0175.865] lstrlenW (lpString="Audiosrv") returned 8
	[0175.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0175.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0175.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0175.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0175.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0175.865] lstrlenW (lpString="BFE") returned 3
	[0175.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0175.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0175.866] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0175.866] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0175.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0175.866] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0175.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0175.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0175.866] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0175.866] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0175.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0175.866] lstrlenW (lpString="CDPSvc") returned 6
	[0175.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0175.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0175.866] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0175.866] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0175.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0175.866] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0175.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0175.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0175.866] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0175.866] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0175.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0175.866] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0175.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0175.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0175.866] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0175.866] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0175.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0175.866] lstrlenW (lpString="CryptSvc") returned 8
	[0175.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0175.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0175.867] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0175.867] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0175.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0175.867] lstrlenW (lpString="DcomLaunch") returned 10
	[0175.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0175.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0175.867] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0175.867] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0175.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0175.867] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0175.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0175.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0175.867] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0175.867] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0175.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0175.867] lstrlenW (lpString="Dhcp") returned 4
	[0175.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0175.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0175.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0175.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0175.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0175.867] lstrlenW (lpString="Dnscache") returned 8
	[0175.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0175.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0175.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0175.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0175.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0175.867] lstrlenW (lpString="DPS") returned 3
	[0175.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0175.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0175.868] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0175.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0175.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0175.868] lstrlenW (lpString="DusmSvc") returned 7
	[0175.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0175.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0175.868] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0175.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0175.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0175.868] lstrlenW (lpString="EventLog") returned 8
	[0175.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0175.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0175.868] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0175.868] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0175.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0175.868] lstrlenW (lpString="EventSystem") returned 11
	[0175.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0175.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0175.868] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0175.868] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0175.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0175.868] lstrlenW (lpString="FontCache") returned 9
	[0175.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0175.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0175.868] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0175.868] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0175.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0175.868] lstrlenW (lpString="gpsvc") returned 5
	[0175.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0175.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0175.869] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0175.869] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0175.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0175.869] lstrlenW (lpString="iphlpsvc") returned 8
	[0175.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0175.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0175.869] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0175.869] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0175.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0175.869] lstrlenW (lpString="KeyIso") returned 6
	[0175.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0175.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0175.869] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0175.869] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0175.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0175.869] lstrlenW (lpString="LanmanServer") returned 12
	[0175.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0175.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0175.869] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0175.869] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0175.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0175.869] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0175.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0175.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0175.869] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0175.869] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0175.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0175.869] lstrlenW (lpString="lfsvc") returned 5
	[0175.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0175.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0175.870] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0175.870] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0175.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0175.870] lstrlenW (lpString="lmhosts") returned 7
	[0175.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0175.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0175.870] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0175.870] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0175.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0175.870] lstrlenW (lpString="LSM") returned 3
	[0175.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0175.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0175.870] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0175.870] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0175.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0175.870] lstrlenW (lpString="MpsSvc") returned 6
	[0175.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0175.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0175.870] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0175.870] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0175.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0175.870] lstrlenW (lpString="NcbService") returned 10
	[0175.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0175.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0175.870] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0175.870] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0175.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0175.870] lstrlenW (lpString="netprofm") returned 8
	[0175.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0175.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0175.870] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0175.871] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0175.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0175.871] lstrlenW (lpString="NgcSvc") returned 6
	[0175.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0175.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0175.871] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0175.871] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0175.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0175.871] lstrlenW (lpString="NlaSvc") returned 6
	[0175.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0175.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0175.871] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0175.871] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0175.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0175.871] lstrlenW (lpString="nsi") returned 3
	[0175.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0175.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0175.871] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0175.871] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0175.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0175.871] lstrlenW (lpString="PcaSvc") returned 6
	[0175.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0175.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0175.871] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0175.871] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0175.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0175.871] lstrlenW (lpString="PlugPlay") returned 8
	[0175.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0175.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0175.871] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0175.872] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0175.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0175.872] lstrlenW (lpString="Power") returned 5
	[0175.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0175.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0175.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0175.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0175.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0175.872] lstrlenW (lpString="ProfSvc") returned 7
	[0175.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0175.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0175.872] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0175.872] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0175.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0175.872] lstrlenW (lpString="RpcEptMapper") returned 12
	[0175.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0175.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0175.872] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0175.872] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0175.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0175.872] lstrlenW (lpString="RpcSs") returned 5
	[0175.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0175.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0175.872] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0175.872] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0175.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0175.872] lstrlenW (lpString="SamSs") returned 5
	[0175.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0175.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0175.872] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0175.872] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0175.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0175.873] lstrlenW (lpString="Schedule") returned 8
	[0175.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0175.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0175.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0175.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0175.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0175.873] lstrlenW (lpString="SecurityHealthService") returned 21
	[0175.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0175.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0175.873] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0175.873] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0175.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0175.873] lstrlenW (lpString="SENS") returned 4
	[0175.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0175.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0175.873] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0175.873] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0175.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0175.873] lstrlenW (lpString="ShellHWDetection") returned 16
	[0175.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0175.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0175.873] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0175.873] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0175.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0175.873] lstrlenW (lpString="Spooler") returned 7
	[0175.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0175.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0175.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0175.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0175.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0175.874] lstrlenW (lpString="StateRepository") returned 15
	[0175.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0175.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0175.874] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0175.874] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0175.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0175.874] lstrlenW (lpString="SysMain") returned 7
	[0175.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0175.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0175.874] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0175.874] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0175.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0175.874] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0175.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0175.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0175.874] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0175.874] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0175.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0176.001] lstrlenW (lpString="Themes") returned 6
	[0176.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0176.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0176.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0176.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0176.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0176.028] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0176.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0176.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0176.028] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0176.028] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0176.028] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324
	[0176.033] Process32FirstW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0176.033] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0176.033] lstrlenW (lpString="System") returned 6
	[0176.034] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0176.034] lstrlenW (lpString="smss.exe") returned 8
	[0176.034] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0176.034] lstrlenW (lpString="csrss.exe") returned 9
	[0176.034] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0176.035] lstrlenW (lpString="wininit.exe") returned 11
	[0176.035] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0176.035] lstrlenW (lpString="csrss.exe") returned 9
	[0176.035] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0176.036] lstrlenW (lpString="winlogon.exe") returned 12
	[0176.036] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0176.036] lstrlenW (lpString="services.exe") returned 12
	[0176.036] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0176.037] lstrlenW (lpString="lsass.exe") returned 9
	[0176.037] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0176.037] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0176.037] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0176.037] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0176.037] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.038] lstrlenW (lpString="svchost.exe") returned 11
	[0176.038] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.038] lstrlenW (lpString="svchost.exe") returned 11
	[0176.038] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0176.039] lstrlenW (lpString="dwm.exe") returned 7
	[0176.039] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.039] lstrlenW (lpString="svchost.exe") returned 11
	[0176.039] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.040] lstrlenW (lpString="svchost.exe") returned 11
	[0176.040] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.040] lstrlenW (lpString="svchost.exe") returned 11
	[0176.040] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.040] lstrlenW (lpString="svchost.exe") returned 11
	[0176.040] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.041] lstrlenW (lpString="svchost.exe") returned 11
	[0176.041] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.041] lstrlenW (lpString="svchost.exe") returned 11
	[0176.041] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.042] lstrlenW (lpString="svchost.exe") returned 11
	[0176.042] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.042] lstrlenW (lpString="svchost.exe") returned 11
	[0176.042] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.042] lstrlenW (lpString="svchost.exe") returned 11
	[0176.043] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.043] lstrlenW (lpString="svchost.exe") returned 11
	[0176.043] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0176.043] lstrlenW (lpString="spoolsv.exe") returned 11
	[0176.043] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.044] lstrlenW (lpString="svchost.exe") returned 11
	[0176.044] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0176.044] lstrlenW (lpString="audiodg.exe") returned 11
	[0176.044] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0176.045] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0176.045] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0176.045] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0176.045] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0176.045] lstrlenW (lpString="sihost.exe") returned 10
	[0176.046] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0176.046] lstrlenW (lpString="Memory Compression") returned 18
	[0176.046] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.047] lstrlenW (lpString="svchost.exe") returned 11
	[0176.047] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0176.047] lstrlenW (lpString="msoia.exe") returned 9
	[0176.047] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0176.047] lstrlenW (lpString="taskhostw.exe") returned 13
	[0176.047] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0176.048] lstrlenW (lpString="explorer.exe") returned 12
	[0176.048] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0176.048] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0176.048] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0176.049] lstrlenW (lpString="SearchUI.exe") returned 12
	[0176.049] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0176.049] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0176.049] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0176.050] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0176.050] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0176.050] lstrlenW (lpString="d2.exe") returned 6
	[0176.050] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0176.050] lstrlenW (lpString="cmd.exe") returned 7
	[0176.050] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0176.051] lstrlenW (lpString="conhost.exe") returned 11
	[0176.051] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0176.051] lstrlenW (lpString="dllhost.exe") returned 11
	[0176.051] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0176.052] lstrlenW (lpString="dllhost.exe") returned 11
	[0176.052] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0176.052] lstrlenW (lpString="d2.exe") returned 6
	[0176.052] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0176.053] CloseHandle (hObject=0x324) returned 1
	[0176.053] Sleep (dwMilliseconds=0x1f4) 
	[0176.739] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ee48
	[0176.739] EnumServicesStatusExW (in: hSCManager=0x52ee48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0176.740] GetLastError () returned 0xea
	[0176.740] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0176.740] EnumServicesStatusExW (in: hSCManager=0x52ee48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0176.741] CloseServiceHandle (hSCObject=0x52ee48) returned 1
	[0176.741] lstrlenW (lpString="Appinfo") returned 7
	[0176.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0176.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0176.741] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0176.741] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0176.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0176.741] lstrlenW (lpString="AppXSvc") returned 7
	[0176.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0176.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0176.741] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0176.741] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0176.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0176.741] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0176.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0176.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0176.741] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0176.742] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0176.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0176.742] lstrlenW (lpString="Audiosrv") returned 8
	[0176.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0176.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0176.742] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0176.742] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0176.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0176.742] lstrlenW (lpString="BFE") returned 3
	[0176.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0176.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0176.742] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0176.742] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0176.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0176.742] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0176.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0176.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0176.742] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0176.742] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0176.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0176.742] lstrlenW (lpString="CDPSvc") returned 6
	[0176.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0176.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0176.742] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0176.742] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0176.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0176.742] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0176.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0176.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0176.742] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0176.742] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0176.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0176.743] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0176.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0176.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0176.743] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0176.743] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0176.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0176.743] lstrlenW (lpString="CryptSvc") returned 8
	[0176.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0176.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0176.743] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0176.743] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0176.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0176.743] lstrlenW (lpString="DcomLaunch") returned 10
	[0176.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0176.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0176.743] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0176.743] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0176.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0176.743] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0176.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0176.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0176.743] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0176.743] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0176.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0176.743] lstrlenW (lpString="Dhcp") returned 4
	[0176.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0176.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0176.743] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0176.743] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0176.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0176.743] lstrlenW (lpString="Dnscache") returned 8
	[0176.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0176.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0176.744] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0176.744] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0176.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0176.744] lstrlenW (lpString="DPS") returned 3
	[0176.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0176.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0176.744] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0176.744] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0176.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0176.744] lstrlenW (lpString="DusmSvc") returned 7
	[0176.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0176.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0176.744] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0176.744] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0176.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0176.744] lstrlenW (lpString="EventLog") returned 8
	[0176.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0176.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0176.744] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0176.744] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0176.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0176.744] lstrlenW (lpString="EventSystem") returned 11
	[0176.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0176.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0176.744] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0176.744] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0176.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0176.744] lstrlenW (lpString="FontCache") returned 9
	[0176.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0176.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0176.745] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0176.745] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0176.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0176.745] lstrlenW (lpString="gpsvc") returned 5
	[0176.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0176.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0176.745] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0176.745] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0176.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0176.745] lstrlenW (lpString="iphlpsvc") returned 8
	[0176.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0176.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0176.745] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0176.745] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0176.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0176.745] lstrlenW (lpString="KeyIso") returned 6
	[0176.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0176.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0176.745] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0176.745] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0176.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0176.745] lstrlenW (lpString="LanmanServer") returned 12
	[0176.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0176.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0176.745] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0176.745] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0176.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0176.745] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0176.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0176.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0176.745] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0176.745] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0176.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0176.746] lstrlenW (lpString="lfsvc") returned 5
	[0176.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0176.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0176.746] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0176.746] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0176.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0176.746] lstrlenW (lpString="lmhosts") returned 7
	[0176.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0176.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0176.746] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0176.746] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0176.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0176.746] lstrlenW (lpString="LSM") returned 3
	[0176.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0176.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0176.746] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0176.746] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0176.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0176.746] lstrlenW (lpString="MpsSvc") returned 6
	[0176.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0176.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0176.746] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0176.746] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0176.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0176.746] lstrlenW (lpString="NcbService") returned 10
	[0176.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0176.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0176.746] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0176.746] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0176.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0176.746] lstrlenW (lpString="netprofm") returned 8
	[0176.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0176.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0176.747] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0176.747] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0176.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0176.747] lstrlenW (lpString="NgcSvc") returned 6
	[0176.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0176.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0176.747] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0176.747] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0176.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0176.747] lstrlenW (lpString="NlaSvc") returned 6
	[0176.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0176.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0176.747] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0176.747] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0176.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0176.747] lstrlenW (lpString="nsi") returned 3
	[0176.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0176.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0176.747] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0176.747] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0176.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0176.747] lstrlenW (lpString="PcaSvc") returned 6
	[0176.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0176.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0176.747] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0176.747] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0176.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0176.747] lstrlenW (lpString="PlugPlay") returned 8
	[0176.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0176.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0176.747] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0176.747] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0176.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0176.748] lstrlenW (lpString="Power") returned 5
	[0176.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0176.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0176.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0176.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0176.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0176.748] lstrlenW (lpString="ProfSvc") returned 7
	[0176.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0176.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0176.748] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0176.748] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0176.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0176.748] lstrlenW (lpString="RpcEptMapper") returned 12
	[0176.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0176.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0176.748] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0176.748] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0176.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0176.748] lstrlenW (lpString="RpcSs") returned 5
	[0176.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0176.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0176.748] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0176.748] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0176.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0176.748] lstrlenW (lpString="SamSs") returned 5
	[0176.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0176.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0176.748] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0176.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0176.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0176.748] lstrlenW (lpString="Schedule") returned 8
	[0176.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0176.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0176.749] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0176.749] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0176.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0176.749] lstrlenW (lpString="SecurityHealthService") returned 21
	[0176.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0176.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0176.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0176.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0176.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0176.749] lstrlenW (lpString="SENS") returned 4
	[0176.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0176.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0176.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0176.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0176.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0176.749] lstrlenW (lpString="ShellHWDetection") returned 16
	[0176.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0176.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0176.855] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0176.855] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0176.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0176.856] lstrlenW (lpString="Spooler") returned 7
	[0176.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0176.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0176.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0176.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0176.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0176.856] lstrlenW (lpString="StateRepository") returned 15
	[0176.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0176.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0176.856] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0176.856] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0176.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0176.856] lstrlenW (lpString="SysMain") returned 7
	[0176.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0176.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0176.856] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0176.856] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0176.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0176.856] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0176.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0176.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0176.856] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0176.856] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0176.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0176.856] lstrlenW (lpString="Themes") returned 6
	[0176.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0176.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0176.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0176.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0176.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0176.857] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0176.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0176.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0176.857] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0176.857] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0176.857] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x524
	[0176.861] Process32FirstW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0176.862] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0176.862] lstrlenW (lpString="System") returned 6
	[0176.862] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0176.862] lstrlenW (lpString="smss.exe") returned 8
	[0176.863] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0176.863] lstrlenW (lpString="csrss.exe") returned 9
	[0176.863] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0176.863] lstrlenW (lpString="wininit.exe") returned 11
	[0176.863] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0176.864] lstrlenW (lpString="csrss.exe") returned 9
	[0176.864] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0176.864] lstrlenW (lpString="winlogon.exe") returned 12
	[0176.864] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0176.865] lstrlenW (lpString="services.exe") returned 12
	[0176.865] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0176.865] lstrlenW (lpString="lsass.exe") returned 9
	[0176.865] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0176.866] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0176.866] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0176.866] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0176.866] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.867] lstrlenW (lpString="svchost.exe") returned 11
	[0176.867] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.867] lstrlenW (lpString="svchost.exe") returned 11
	[0176.867] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0176.868] lstrlenW (lpString="dwm.exe") returned 7
	[0176.868] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.868] lstrlenW (lpString="svchost.exe") returned 11
	[0176.868] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.868] lstrlenW (lpString="svchost.exe") returned 11
	[0176.868] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.869] lstrlenW (lpString="svchost.exe") returned 11
	[0176.869] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.869] lstrlenW (lpString="svchost.exe") returned 11
	[0176.869] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.870] lstrlenW (lpString="svchost.exe") returned 11
	[0176.870] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.870] lstrlenW (lpString="svchost.exe") returned 11
	[0176.870] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.871] lstrlenW (lpString="svchost.exe") returned 11
	[0176.871] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.871] lstrlenW (lpString="svchost.exe") returned 11
	[0176.871] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.873] lstrlenW (lpString="svchost.exe") returned 11
	[0176.873] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.873] lstrlenW (lpString="svchost.exe") returned 11
	[0176.873] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0176.874] lstrlenW (lpString="spoolsv.exe") returned 11
	[0176.874] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.874] lstrlenW (lpString="svchost.exe") returned 11
	[0176.874] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0176.875] lstrlenW (lpString="audiodg.exe") returned 11
	[0176.875] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0176.875] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0176.875] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0176.876] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0176.876] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0176.876] lstrlenW (lpString="sihost.exe") returned 10
	[0176.876] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0176.877] lstrlenW (lpString="Memory Compression") returned 18
	[0176.877] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.877] lstrlenW (lpString="svchost.exe") returned 11
	[0176.877] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0176.877] lstrlenW (lpString="msoia.exe") returned 9
	[0176.878] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0176.878] lstrlenW (lpString="taskhostw.exe") returned 13
	[0176.878] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0176.878] lstrlenW (lpString="explorer.exe") returned 12
	[0176.878] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0176.879] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0176.879] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0176.879] lstrlenW (lpString="SearchUI.exe") returned 12
	[0176.879] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0176.880] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0176.880] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0176.880] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0176.880] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0176.881] lstrlenW (lpString="d2.exe") returned 6
	[0176.881] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0176.881] lstrlenW (lpString="cmd.exe") returned 7
	[0176.881] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0176.882] lstrlenW (lpString="conhost.exe") returned 11
	[0176.882] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0176.882] lstrlenW (lpString="dllhost.exe") returned 11
	[0176.882] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0176.883] lstrlenW (lpString="dllhost.exe") returned 11
	[0176.884] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0176.884] lstrlenW (lpString="d2.exe") returned 6
	[0176.884] Process32NextW (in: hSnapshot=0x524, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0176.884] CloseHandle (hObject=0x524) returned 1
	[0176.885] Sleep (dwMilliseconds=0x1f4) 
	[0177.485] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52edd0
	[0177.486] EnumServicesStatusExW (in: hSCManager=0x52edd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0177.486] GetLastError () returned 0xea
	[0177.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0177.487] EnumServicesStatusExW (in: hSCManager=0x52edd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0177.487] CloseServiceHandle (hSCObject=0x52edd0) returned 1
	[0177.488] lstrlenW (lpString="Appinfo") returned 7
	[0177.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0177.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0177.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0177.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0177.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0177.488] lstrlenW (lpString="AppXSvc") returned 7
	[0177.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0177.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0177.488] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0177.488] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0177.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0177.488] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0177.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0177.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0177.488] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0177.488] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0177.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0177.488] lstrlenW (lpString="Audiosrv") returned 8
	[0177.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0177.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0177.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0177.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0177.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0177.488] lstrlenW (lpString="BFE") returned 3
	[0177.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0177.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0177.488] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0177.489] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0177.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0177.489] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0177.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0177.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0177.489] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0177.489] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0177.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0177.489] lstrlenW (lpString="CDPSvc") returned 6
	[0177.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0177.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0177.489] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0177.489] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0177.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0177.489] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0177.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0177.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0177.489] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0177.489] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0177.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0177.489] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0177.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0177.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0177.489] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0177.489] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0177.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0177.489] lstrlenW (lpString="CryptSvc") returned 8
	[0177.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0177.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0177.489] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0177.489] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0177.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0177.490] lstrlenW (lpString="DcomLaunch") returned 10
	[0177.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0177.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0177.490] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0177.490] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0177.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0177.490] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0177.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0177.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0177.490] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0177.490] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0177.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0177.490] lstrlenW (lpString="Dhcp") returned 4
	[0177.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0177.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0177.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0177.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0177.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0177.490] lstrlenW (lpString="Dnscache") returned 8
	[0177.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0177.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0177.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0177.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0177.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0177.490] lstrlenW (lpString="DPS") returned 3
	[0177.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0177.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0177.490] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0177.490] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0177.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0177.491] lstrlenW (lpString="DusmSvc") returned 7
	[0177.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0177.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0177.491] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0177.491] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0177.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0177.491] lstrlenW (lpString="EventLog") returned 8
	[0177.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0177.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0177.491] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0177.491] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0177.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0177.491] lstrlenW (lpString="EventSystem") returned 11
	[0177.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0177.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0177.491] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0177.491] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0177.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0177.491] lstrlenW (lpString="FontCache") returned 9
	[0177.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0177.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0177.491] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0177.491] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0177.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0177.491] lstrlenW (lpString="gpsvc") returned 5
	[0177.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0177.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0177.491] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0177.491] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0177.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0177.492] lstrlenW (lpString="iphlpsvc") returned 8
	[0177.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0177.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0177.492] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0177.492] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0177.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0177.492] lstrlenW (lpString="KeyIso") returned 6
	[0177.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0177.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0177.492] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0177.492] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0177.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0177.492] lstrlenW (lpString="LanmanServer") returned 12
	[0177.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0177.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0177.492] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0177.492] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0177.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0177.492] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0177.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0177.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0177.492] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0177.492] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0177.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0177.492] lstrlenW (lpString="lfsvc") returned 5
	[0177.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0177.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0177.492] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0177.494] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0177.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0177.494] lstrlenW (lpString="lmhosts") returned 7
	[0177.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0177.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0177.494] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0177.494] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0177.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0177.494] lstrlenW (lpString="LSM") returned 3
	[0177.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0177.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0177.495] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0177.495] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0177.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0177.495] lstrlenW (lpString="MpsSvc") returned 6
	[0177.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0177.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0177.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0177.495] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0177.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0177.495] lstrlenW (lpString="NcbService") returned 10
	[0177.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0177.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0177.495] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0177.495] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0177.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0177.495] lstrlenW (lpString="netprofm") returned 8
	[0177.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0177.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0177.495] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0177.495] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0177.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0177.495] lstrlenW (lpString="NgcSvc") returned 6
	[0177.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0177.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0177.495] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0177.495] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0177.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0177.495] lstrlenW (lpString="NlaSvc") returned 6
	[0177.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0177.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0177.496] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0177.496] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0177.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0177.496] lstrlenW (lpString="nsi") returned 3
	[0177.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0177.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0177.496] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0177.496] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0177.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0177.496] lstrlenW (lpString="PcaSvc") returned 6
	[0177.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0177.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0177.496] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0177.496] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0177.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0177.496] lstrlenW (lpString="PlugPlay") returned 8
	[0177.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0177.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0177.496] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0177.496] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0177.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0177.496] lstrlenW (lpString="Power") returned 5
	[0177.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0177.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0177.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0177.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0177.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0177.496] lstrlenW (lpString="ProfSvc") returned 7
	[0177.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0177.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0177.497] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0177.497] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0177.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0177.497] lstrlenW (lpString="RpcEptMapper") returned 12
	[0177.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0177.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0177.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0177.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0177.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0177.497] lstrlenW (lpString="RpcSs") returned 5
	[0177.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0177.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0177.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0177.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0177.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0177.497] lstrlenW (lpString="SamSs") returned 5
	[0177.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0177.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0177.497] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0177.497] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0177.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0177.497] lstrlenW (lpString="Schedule") returned 8
	[0177.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0177.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0177.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0177.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0177.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0177.497] lstrlenW (lpString="SecurityHealthService") returned 21
	[0177.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0177.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0177.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0177.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0177.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0177.498] lstrlenW (lpString="SENS") returned 4
	[0177.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0177.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0177.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0177.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0177.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0177.498] lstrlenW (lpString="ShellHWDetection") returned 16
	[0177.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0177.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0177.498] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0177.498] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0177.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0177.498] lstrlenW (lpString="Spooler") returned 7
	[0177.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0177.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0177.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0177.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0177.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0177.498] lstrlenW (lpString="StateRepository") returned 15
	[0177.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0177.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0177.498] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0177.498] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0177.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0177.498] lstrlenW (lpString="SysMain") returned 7
	[0177.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0177.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0177.499] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0177.499] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0177.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0177.499] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0177.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0177.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0177.499] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0177.499] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0177.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0177.499] lstrlenW (lpString="Themes") returned 6
	[0177.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0177.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0177.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0177.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0177.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0177.499] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0177.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0177.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0177.499] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0177.499] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0177.499] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x534
	[0177.503] Process32FirstW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0177.504] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0177.504] lstrlenW (lpString="System") returned 6
	[0177.504] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0177.505] lstrlenW (lpString="smss.exe") returned 8
	[0177.505] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0177.505] lstrlenW (lpString="csrss.exe") returned 9
	[0177.505] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0177.505] lstrlenW (lpString="wininit.exe") returned 11
	[0177.505] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0177.506] lstrlenW (lpString="csrss.exe") returned 9
	[0177.506] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0177.506] lstrlenW (lpString="winlogon.exe") returned 12
	[0177.506] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0177.507] lstrlenW (lpString="services.exe") returned 12
	[0177.507] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0177.507] lstrlenW (lpString="lsass.exe") returned 9
	[0177.507] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0177.508] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0177.508] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0177.971] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0177.972] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.972] lstrlenW (lpString="svchost.exe") returned 11
	[0177.972] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.972] lstrlenW (lpString="svchost.exe") returned 11
	[0177.973] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0177.973] lstrlenW (lpString="dwm.exe") returned 7
	[0177.973] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.973] lstrlenW (lpString="svchost.exe") returned 11
	[0177.973] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.974] lstrlenW (lpString="svchost.exe") returned 11
	[0177.974] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.974] lstrlenW (lpString="svchost.exe") returned 11
	[0177.974] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.975] lstrlenW (lpString="svchost.exe") returned 11
	[0177.975] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.975] lstrlenW (lpString="svchost.exe") returned 11
	[0177.975] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.975] lstrlenW (lpString="svchost.exe") returned 11
	[0177.976] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.976] lstrlenW (lpString="svchost.exe") returned 11
	[0177.976] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.976] lstrlenW (lpString="svchost.exe") returned 11
	[0177.976] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.977] lstrlenW (lpString="svchost.exe") returned 11
	[0177.977] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.978] lstrlenW (lpString="svchost.exe") returned 11
	[0177.978] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0177.978] lstrlenW (lpString="spoolsv.exe") returned 11
	[0177.978] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.978] lstrlenW (lpString="svchost.exe") returned 11
	[0177.979] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0177.979] lstrlenW (lpString="audiodg.exe") returned 11
	[0177.979] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0177.979] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0177.979] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0177.980] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0177.980] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0177.980] lstrlenW (lpString="sihost.exe") returned 10
	[0177.980] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0177.981] lstrlenW (lpString="Memory Compression") returned 18
	[0177.981] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.981] lstrlenW (lpString="svchost.exe") returned 11
	[0177.981] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0177.981] lstrlenW (lpString="msoia.exe") returned 9
	[0177.982] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0177.982] lstrlenW (lpString="taskhostw.exe") returned 13
	[0177.982] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0177.982] lstrlenW (lpString="explorer.exe") returned 12
	[0177.982] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0177.983] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0177.983] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0177.983] lstrlenW (lpString="SearchUI.exe") returned 12
	[0177.983] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0177.984] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0177.984] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0177.984] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0177.984] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0177.984] lstrlenW (lpString="d2.exe") returned 6
	[0177.985] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0177.985] lstrlenW (lpString="cmd.exe") returned 7
	[0177.985] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0177.985] lstrlenW (lpString="conhost.exe") returned 11
	[0177.985] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0177.986] lstrlenW (lpString="dllhost.exe") returned 11
	[0177.986] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0177.986] lstrlenW (lpString="dllhost.exe") returned 11
	[0177.986] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0177.987] lstrlenW (lpString="d2.exe") returned 6
	[0177.987] Process32NextW (in: hSnapshot=0x534, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0177.987] CloseHandle (hObject=0x534) returned 1
	[0177.988] Sleep (dwMilliseconds=0x1f4) 
	[0178.616] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52f028
	[0178.616] EnumServicesStatusExW (in: hSCManager=0x52f028, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0178.617] GetLastError () returned 0xea
	[0178.617] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0178.617] EnumServicesStatusExW (in: hSCManager=0x52f028, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0178.618] CloseServiceHandle (hSCObject=0x52f028) returned 1
	[0178.618] lstrlenW (lpString="Appinfo") returned 7
	[0178.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0178.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0178.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0178.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0178.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0178.619] lstrlenW (lpString="AppXSvc") returned 7
	[0178.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0178.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0178.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0178.619] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0178.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0178.619] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0178.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0178.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0178.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0178.619] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0178.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0178.619] lstrlenW (lpString="Audiosrv") returned 8
	[0178.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0178.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0178.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0178.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0178.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0178.619] lstrlenW (lpString="BFE") returned 3
	[0178.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0178.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0178.619] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0178.619] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0178.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0178.619] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0178.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0178.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0178.619] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0178.619] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0178.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0178.620] lstrlenW (lpString="CDPSvc") returned 6
	[0178.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0178.620] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0178.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0178.620] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0178.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0178.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0178.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0178.620] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0178.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0178.620] lstrlenW (lpString="CryptSvc") returned 8
	[0178.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0178.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0178.620] lstrlenW (lpString="DcomLaunch") returned 10
	[0178.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0178.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0178.620] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0178.620] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0178.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0178.621] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0178.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0178.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0178.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0178.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0178.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0178.621] lstrlenW (lpString="Dhcp") returned 4
	[0178.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0178.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0178.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0178.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0178.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0178.621] lstrlenW (lpString="Dnscache") returned 8
	[0178.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0178.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0178.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0178.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0178.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0178.621] lstrlenW (lpString="DPS") returned 3
	[0178.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0178.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0178.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0178.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0178.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0178.621] lstrlenW (lpString="DusmSvc") returned 7
	[0178.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0178.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0178.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0178.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0178.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0178.622] lstrlenW (lpString="EventLog") returned 8
	[0178.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0178.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0178.622] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0178.622] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0178.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0178.622] lstrlenW (lpString="EventSystem") returned 11
	[0178.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0178.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0178.622] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0178.622] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0178.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0178.622] lstrlenW (lpString="FontCache") returned 9
	[0178.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0178.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0178.622] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0178.622] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0178.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0178.622] lstrlenW (lpString="gpsvc") returned 5
	[0178.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0178.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0178.622] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0178.622] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0178.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0178.622] lstrlenW (lpString="iphlpsvc") returned 8
	[0178.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0178.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0178.622] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0178.622] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0178.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0178.622] lstrlenW (lpString="KeyIso") returned 6
	[0178.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0178.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0178.623] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0178.623] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0178.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0178.623] lstrlenW (lpString="LanmanServer") returned 12
	[0178.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0178.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0178.623] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0178.623] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0178.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0178.623] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0178.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0178.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0178.623] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0178.623] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0178.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0178.623] lstrlenW (lpString="lfsvc") returned 5
	[0178.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0178.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0178.623] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0178.623] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0178.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0178.623] lstrlenW (lpString="lmhosts") returned 7
	[0178.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0178.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0178.623] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0178.623] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0178.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0178.623] lstrlenW (lpString="LSM") returned 3
	[0178.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0178.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0178.624] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0178.624] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0178.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0178.624] lstrlenW (lpString="MpsSvc") returned 6
	[0178.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0178.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0178.624] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0178.624] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0178.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0178.624] lstrlenW (lpString="NcbService") returned 10
	[0178.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0178.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0178.624] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0178.624] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0178.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0178.624] lstrlenW (lpString="netprofm") returned 8
	[0178.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0178.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0178.624] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0178.624] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0178.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0178.624] lstrlenW (lpString="NgcSvc") returned 6
	[0178.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0178.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0178.624] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0178.624] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0178.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0178.624] lstrlenW (lpString="NlaSvc") returned 6
	[0178.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0178.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0178.625] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0178.625] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0178.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0178.625] lstrlenW (lpString="nsi") returned 3
	[0178.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0178.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0178.625] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0178.625] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0178.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0178.625] lstrlenW (lpString="PcaSvc") returned 6
	[0178.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0178.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0178.625] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0178.625] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0178.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0178.625] lstrlenW (lpString="PlugPlay") returned 8
	[0178.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0178.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0178.625] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0178.625] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0178.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0178.625] lstrlenW (lpString="Power") returned 5
	[0178.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0178.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0178.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0178.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0178.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0178.625] lstrlenW (lpString="ProfSvc") returned 7
	[0178.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0178.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0178.626] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0178.626] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0178.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0178.626] lstrlenW (lpString="RpcEptMapper") returned 12
	[0178.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0178.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0178.626] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0178.626] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0178.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0178.626] lstrlenW (lpString="RpcSs") returned 5
	[0178.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0178.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0178.626] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0178.626] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0178.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0178.626] lstrlenW (lpString="SamSs") returned 5
	[0178.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0178.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0178.626] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0178.626] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0178.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0178.626] lstrlenW (lpString="Schedule") returned 8
	[0178.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0178.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0178.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0178.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0178.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0178.626] lstrlenW (lpString="SecurityHealthService") returned 21
	[0178.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0178.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0178.626] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0178.627] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0178.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0178.627] lstrlenW (lpString="SENS") returned 4
	[0178.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0178.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0178.627] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0178.627] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0178.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0178.627] lstrlenW (lpString="ShellHWDetection") returned 16
	[0178.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0178.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0178.627] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0178.627] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0178.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0178.627] lstrlenW (lpString="Spooler") returned 7
	[0178.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0178.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0178.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0178.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0178.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0178.627] lstrlenW (lpString="StateRepository") returned 15
	[0178.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0178.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0178.627] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0178.627] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0178.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0178.627] lstrlenW (lpString="SysMain") returned 7
	[0178.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0178.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0178.627] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0178.627] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0178.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0178.628] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0178.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0178.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0178.628] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0178.628] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0178.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0178.628] lstrlenW (lpString="Themes") returned 6
	[0178.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0178.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0178.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0178.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0178.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0178.628] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0178.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0178.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0178.628] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0178.628] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0178.628] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x548
	[0178.632] Process32FirstW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0178.633] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0178.756] lstrlenW (lpString="System") returned 6
	[0178.756] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0178.757] lstrlenW (lpString="smss.exe") returned 8
	[0178.757] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0178.757] lstrlenW (lpString="csrss.exe") returned 9
	[0178.757] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0178.758] lstrlenW (lpString="wininit.exe") returned 11
	[0178.758] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0178.759] lstrlenW (lpString="csrss.exe") returned 9
	[0178.759] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0178.759] lstrlenW (lpString="winlogon.exe") returned 12
	[0178.759] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0178.759] lstrlenW (lpString="services.exe") returned 12
	[0178.759] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0178.760] lstrlenW (lpString="lsass.exe") returned 9
	[0178.760] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0178.760] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0178.760] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0178.761] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0178.761] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.761] lstrlenW (lpString="svchost.exe") returned 11
	[0178.761] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.762] lstrlenW (lpString="svchost.exe") returned 11
	[0178.762] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0178.762] lstrlenW (lpString="dwm.exe") returned 7
	[0178.762] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.762] lstrlenW (lpString="svchost.exe") returned 11
	[0178.762] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.763] lstrlenW (lpString="svchost.exe") returned 11
	[0178.763] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.763] lstrlenW (lpString="svchost.exe") returned 11
	[0178.763] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.764] lstrlenW (lpString="svchost.exe") returned 11
	[0178.764] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.764] lstrlenW (lpString="svchost.exe") returned 11
	[0178.764] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.765] lstrlenW (lpString="svchost.exe") returned 11
	[0178.765] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.765] lstrlenW (lpString="svchost.exe") returned 11
	[0178.765] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.765] lstrlenW (lpString="svchost.exe") returned 11
	[0178.765] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.766] lstrlenW (lpString="svchost.exe") returned 11
	[0178.766] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.766] lstrlenW (lpString="svchost.exe") returned 11
	[0178.766] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0178.767] lstrlenW (lpString="spoolsv.exe") returned 11
	[0178.767] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.767] lstrlenW (lpString="svchost.exe") returned 11
	[0178.767] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0178.767] lstrlenW (lpString="audiodg.exe") returned 11
	[0178.768] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0178.768] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0178.768] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0178.768] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0178.768] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0178.769] lstrlenW (lpString="sihost.exe") returned 10
	[0178.769] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0178.769] lstrlenW (lpString="Memory Compression") returned 18
	[0178.769] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.770] lstrlenW (lpString="svchost.exe") returned 11
	[0178.770] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0178.770] lstrlenW (lpString="msoia.exe") returned 9
	[0178.770] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0178.770] lstrlenW (lpString="taskhostw.exe") returned 13
	[0178.770] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0178.771] lstrlenW (lpString="explorer.exe") returned 12
	[0178.771] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0178.771] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0178.771] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0178.772] lstrlenW (lpString="SearchUI.exe") returned 12
	[0178.772] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0178.772] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0178.772] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0178.773] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0178.773] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0178.773] lstrlenW (lpString="d2.exe") returned 6
	[0178.773] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0178.773] lstrlenW (lpString="cmd.exe") returned 7
	[0178.773] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0178.774] lstrlenW (lpString="conhost.exe") returned 11
	[0178.774] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0178.774] lstrlenW (lpString="dllhost.exe") returned 11
	[0178.774] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0178.775] lstrlenW (lpString="dllhost.exe") returned 11
	[0178.775] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0178.775] lstrlenW (lpString="d2.exe") returned 6
	[0178.775] Process32NextW (in: hSnapshot=0x548, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0178.777] CloseHandle (hObject=0x548) returned 1
	[0178.783] Sleep (dwMilliseconds=0x1f4) 
	[0179.422] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ef10
	[0179.422] EnumServicesStatusExW (in: hSCManager=0x52ef10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0179.423] GetLastError () returned 0xea
	[0179.423] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0179.423] EnumServicesStatusExW (in: hSCManager=0x52ef10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0179.424] CloseServiceHandle (hSCObject=0x52ef10) returned 1
	[0179.424] lstrlenW (lpString="Appinfo") returned 7
	[0179.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0179.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0179.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0179.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0179.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0179.424] lstrlenW (lpString="AppXSvc") returned 7
	[0179.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0179.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0179.425] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0179.425] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0179.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0179.425] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0179.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0179.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0179.425] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0179.425] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0179.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0179.425] lstrlenW (lpString="Audiosrv") returned 8
	[0179.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0179.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0179.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0179.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0179.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0179.425] lstrlenW (lpString="BFE") returned 3
	[0179.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0179.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0179.425] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0179.425] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0179.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0179.425] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0179.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0179.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0179.425] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0179.425] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0179.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0179.425] lstrlenW (lpString="CDPSvc") returned 6
	[0179.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0179.426] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0179.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0179.426] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0179.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0179.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0179.426] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0179.426] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0179.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0179.426] lstrlenW (lpString="CryptSvc") returned 8
	[0179.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0179.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0179.426] lstrlenW (lpString="DcomLaunch") returned 10
	[0179.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0179.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0179.426] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0179.426] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0179.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0179.426] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0179.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0179.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0179.426] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0179.427] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0179.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0179.427] lstrlenW (lpString="Dhcp") returned 4
	[0179.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0179.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0179.427] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0179.427] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0179.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0179.427] lstrlenW (lpString="Dnscache") returned 8
	[0179.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0179.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0179.427] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0179.427] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0179.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0179.427] lstrlenW (lpString="DPS") returned 3
	[0179.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0179.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0179.427] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0179.427] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0179.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0179.427] lstrlenW (lpString="DusmSvc") returned 7
	[0179.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0179.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0179.427] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0179.427] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0179.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0179.427] lstrlenW (lpString="EventLog") returned 8
	[0179.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0179.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0179.427] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0179.427] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0179.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0179.428] lstrlenW (lpString="EventSystem") returned 11
	[0179.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0179.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0179.428] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0179.428] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0179.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0179.428] lstrlenW (lpString="FontCache") returned 9
	[0179.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0179.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0179.428] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0179.428] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0179.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0179.428] lstrlenW (lpString="gpsvc") returned 5
	[0179.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0179.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0179.428] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0179.428] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0179.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0179.428] lstrlenW (lpString="iphlpsvc") returned 8
	[0179.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0179.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0179.428] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0179.428] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0179.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0179.428] lstrlenW (lpString="KeyIso") returned 6
	[0179.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0179.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0179.428] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0179.428] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0179.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0179.429] lstrlenW (lpString="LanmanServer") returned 12
	[0179.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0179.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0179.429] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0179.429] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0179.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0179.429] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0179.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0179.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0179.429] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0179.429] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0179.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0179.429] lstrlenW (lpString="lfsvc") returned 5
	[0179.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0179.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0179.429] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0179.429] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0179.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0179.429] lstrlenW (lpString="lmhosts") returned 7
	[0179.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0179.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0179.429] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0179.429] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0179.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0179.429] lstrlenW (lpString="LSM") returned 3
	[0179.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0179.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0179.429] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0179.429] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0179.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0179.430] lstrlenW (lpString="MpsSvc") returned 6
	[0179.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0179.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0179.430] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0179.430] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0179.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0179.430] lstrlenW (lpString="NcbService") returned 10
	[0179.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0179.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0179.430] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0179.430] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0179.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0179.430] lstrlenW (lpString="netprofm") returned 8
	[0179.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0179.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0179.480] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0179.480] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0179.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0179.480] lstrlenW (lpString="NgcSvc") returned 6
	[0179.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0179.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0179.481] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0179.481] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0179.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0179.481] lstrlenW (lpString="NlaSvc") returned 6
	[0179.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0179.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0179.481] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0179.481] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0179.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0179.481] lstrlenW (lpString="nsi") returned 3
	[0179.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0179.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0179.481] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0179.481] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0179.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0179.481] lstrlenW (lpString="PcaSvc") returned 6
	[0179.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0179.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0179.481] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0179.481] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0179.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0179.481] lstrlenW (lpString="PlugPlay") returned 8
	[0179.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0179.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0179.481] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0179.481] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0179.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0179.481] lstrlenW (lpString="Power") returned 5
	[0179.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0179.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0179.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0179.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0179.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0179.482] lstrlenW (lpString="ProfSvc") returned 7
	[0179.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0179.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0179.482] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0179.482] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0179.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0179.482] lstrlenW (lpString="RpcEptMapper") returned 12
	[0179.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0179.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0179.482] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0179.482] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0179.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0179.482] lstrlenW (lpString="RpcSs") returned 5
	[0179.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0179.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0179.482] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0179.482] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0179.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0179.482] lstrlenW (lpString="SamSs") returned 5
	[0179.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0179.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0179.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0179.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0179.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0179.482] lstrlenW (lpString="Schedule") returned 8
	[0179.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0179.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0179.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0179.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0179.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0179.483] lstrlenW (lpString="SecurityHealthService") returned 21
	[0179.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0179.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0179.483] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0179.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0179.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0179.483] lstrlenW (lpString="SENS") returned 4
	[0179.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0179.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0179.483] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0179.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0179.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0179.483] lstrlenW (lpString="ShellHWDetection") returned 16
	[0179.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0179.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0179.483] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0179.483] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0179.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0179.483] lstrlenW (lpString="Spooler") returned 7
	[0179.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0179.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0179.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0179.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0179.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0179.483] lstrlenW (lpString="StateRepository") returned 15
	[0179.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0179.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0179.483] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0179.483] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0179.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0179.484] lstrlenW (lpString="SysMain") returned 7
	[0179.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0179.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0179.484] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0179.484] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0179.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0179.484] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0179.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0179.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0179.484] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0179.484] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0179.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0179.484] lstrlenW (lpString="Themes") returned 6
	[0179.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0179.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0179.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0179.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0179.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0179.484] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0179.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0179.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0179.484] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0179.484] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0179.484] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4e4
	[0179.489] Process32FirstW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0179.489] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0179.489] lstrlenW (lpString="System") returned 6
	[0179.489] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0179.490] lstrlenW (lpString="smss.exe") returned 8
	[0179.490] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0179.490] lstrlenW (lpString="csrss.exe") returned 9
	[0179.490] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0179.491] lstrlenW (lpString="wininit.exe") returned 11
	[0179.491] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0179.491] lstrlenW (lpString="csrss.exe") returned 9
	[0179.491] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0179.491] lstrlenW (lpString="winlogon.exe") returned 12
	[0179.492] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0179.492] lstrlenW (lpString="services.exe") returned 12
	[0179.492] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0179.492] lstrlenW (lpString="lsass.exe") returned 9
	[0179.492] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0179.493] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0179.493] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0179.493] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0179.493] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.494] lstrlenW (lpString="svchost.exe") returned 11
	[0179.494] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.494] lstrlenW (lpString="svchost.exe") returned 11
	[0179.494] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0179.495] lstrlenW (lpString="dwm.exe") returned 7
	[0179.495] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.495] lstrlenW (lpString="svchost.exe") returned 11
	[0179.495] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.495] lstrlenW (lpString="svchost.exe") returned 11
	[0179.495] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.496] lstrlenW (lpString="svchost.exe") returned 11
	[0179.496] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.496] lstrlenW (lpString="svchost.exe") returned 11
	[0179.496] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.497] lstrlenW (lpString="svchost.exe") returned 11
	[0179.497] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.497] lstrlenW (lpString="svchost.exe") returned 11
	[0179.497] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.498] lstrlenW (lpString="svchost.exe") returned 11
	[0179.498] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.498] lstrlenW (lpString="svchost.exe") returned 11
	[0179.498] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.498] lstrlenW (lpString="svchost.exe") returned 11
	[0179.498] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.499] lstrlenW (lpString="svchost.exe") returned 11
	[0179.499] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0179.499] lstrlenW (lpString="spoolsv.exe") returned 11
	[0179.499] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.500] lstrlenW (lpString="svchost.exe") returned 11
	[0179.500] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0179.500] lstrlenW (lpString="audiodg.exe") returned 11
	[0179.500] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0179.500] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0179.501] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0179.501] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0179.501] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0179.501] lstrlenW (lpString="sihost.exe") returned 10
	[0179.501] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0179.502] lstrlenW (lpString="Memory Compression") returned 18
	[0179.502] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.502] lstrlenW (lpString="svchost.exe") returned 11
	[0179.502] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0179.503] lstrlenW (lpString="msoia.exe") returned 9
	[0179.503] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0179.503] lstrlenW (lpString="taskhostw.exe") returned 13
	[0179.503] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0179.503] lstrlenW (lpString="explorer.exe") returned 12
	[0179.503] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0179.504] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0179.504] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0179.504] lstrlenW (lpString="SearchUI.exe") returned 12
	[0179.504] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0179.505] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0179.505] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0179.505] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0179.505] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0179.506] lstrlenW (lpString="d2.exe") returned 6
	[0179.506] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0179.506] lstrlenW (lpString="cmd.exe") returned 7
	[0179.506] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0179.506] lstrlenW (lpString="conhost.exe") returned 11
	[0179.506] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0179.507] lstrlenW (lpString="dllhost.exe") returned 11
	[0179.507] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0179.507] lstrlenW (lpString="d2.exe") returned 6
	[0179.507] Process32NextW (in: hSnapshot=0x4e4, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0179.508] CloseHandle (hObject=0x4e4) returned 1
	[0179.508] Sleep (dwMilliseconds=0x1f4) 
	[0180.368] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52efd8
	[0180.368] EnumServicesStatusExW (in: hSCManager=0x52efd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0180.369] GetLastError () returned 0xea
	[0180.369] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0180.369] EnumServicesStatusExW (in: hSCManager=0x52efd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0180.370] CloseServiceHandle (hSCObject=0x52efd8) returned 1
	[0180.370] lstrlenW (lpString="Appinfo") returned 7
	[0180.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0180.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0180.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0180.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0180.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0180.371] lstrlenW (lpString="AppXSvc") returned 7
	[0180.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0180.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0180.371] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0180.371] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0180.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0180.371] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0180.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0180.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0180.371] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0180.371] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0180.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0180.371] lstrlenW (lpString="Audiosrv") returned 8
	[0180.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0180.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0180.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0180.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0180.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0180.371] lstrlenW (lpString="BFE") returned 3
	[0180.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0180.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0180.371] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0180.371] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0180.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0180.371] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0180.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0180.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0180.371] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0180.372] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0180.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0180.372] lstrlenW (lpString="CDPSvc") returned 6
	[0180.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0180.372] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0180.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0180.372] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0180.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0180.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0180.372] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0180.372] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0180.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0180.372] lstrlenW (lpString="CryptSvc") returned 8
	[0180.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0180.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0180.372] lstrlenW (lpString="DcomLaunch") returned 10
	[0180.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0180.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0180.372] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0180.373] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0180.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0180.373] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0180.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0180.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0180.373] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0180.373] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0180.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0180.373] lstrlenW (lpString="Dhcp") returned 4
	[0180.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0180.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0180.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0180.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0180.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0180.373] lstrlenW (lpString="Dnscache") returned 8
	[0180.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0180.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0180.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0180.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0180.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0180.373] lstrlenW (lpString="DPS") returned 3
	[0180.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0180.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0180.373] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0180.373] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0180.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0180.373] lstrlenW (lpString="DusmSvc") returned 7
	[0180.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0180.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0180.373] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0180.373] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0180.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0180.374] lstrlenW (lpString="EventLog") returned 8
	[0180.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0180.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0180.374] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0180.374] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0180.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0180.374] lstrlenW (lpString="EventSystem") returned 11
	[0180.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0180.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0180.374] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0180.374] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0180.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0180.374] lstrlenW (lpString="FontCache") returned 9
	[0180.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0180.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0180.374] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0180.374] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0180.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0180.374] lstrlenW (lpString="gpsvc") returned 5
	[0180.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0180.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0180.374] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0180.374] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0180.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0180.374] lstrlenW (lpString="iphlpsvc") returned 8
	[0180.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0180.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0180.374] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0180.374] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0180.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0180.374] lstrlenW (lpString="KeyIso") returned 6
	[0180.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0180.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0180.375] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0180.375] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0180.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0180.375] lstrlenW (lpString="LanmanServer") returned 12
	[0180.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0180.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0180.375] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0180.375] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0180.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0180.375] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0180.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0180.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0180.375] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0180.375] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0180.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0180.375] lstrlenW (lpString="lfsvc") returned 5
	[0180.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0180.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0180.375] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0180.375] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0180.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0180.375] lstrlenW (lpString="lmhosts") returned 7
	[0180.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0180.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0180.375] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0180.375] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0180.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0180.375] lstrlenW (lpString="LSM") returned 3
	[0180.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0180.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0180.375] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0180.376] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0180.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0180.376] lstrlenW (lpString="MpsSvc") returned 6
	[0180.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0180.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0180.376] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0180.376] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0180.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0180.376] lstrlenW (lpString="NcbService") returned 10
	[0180.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0180.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0180.376] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0180.376] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0180.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0180.376] lstrlenW (lpString="netprofm") returned 8
	[0180.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0180.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0180.376] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0180.376] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0180.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0180.376] lstrlenW (lpString="NgcSvc") returned 6
	[0180.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0180.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0180.376] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0180.376] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0180.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0180.376] lstrlenW (lpString="NlaSvc") returned 6
	[0180.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0180.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0180.376] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0180.376] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0180.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0180.377] lstrlenW (lpString="nsi") returned 3
	[0180.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0180.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0180.377] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0180.377] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0180.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0180.377] lstrlenW (lpString="PcaSvc") returned 6
	[0180.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0180.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0180.377] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0180.377] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0180.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0180.377] lstrlenW (lpString="PlugPlay") returned 8
	[0180.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0180.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0180.377] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0180.377] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0180.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0180.377] lstrlenW (lpString="Power") returned 5
	[0180.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0180.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0180.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0180.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0180.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0180.377] lstrlenW (lpString="ProfSvc") returned 7
	[0180.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0180.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0180.377] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0180.377] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0180.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0180.378] lstrlenW (lpString="RpcEptMapper") returned 12
	[0180.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0180.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0180.378] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0180.378] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0180.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0180.378] lstrlenW (lpString="RpcSs") returned 5
	[0180.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0180.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0180.378] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0180.378] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0180.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0180.378] lstrlenW (lpString="SamSs") returned 5
	[0180.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0180.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0180.378] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0180.378] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0180.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0180.378] lstrlenW (lpString="Schedule") returned 8
	[0180.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0180.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0180.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0180.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0180.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0180.378] lstrlenW (lpString="SecurityHealthService") returned 21
	[0180.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0180.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0180.378] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0180.378] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0180.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0180.378] lstrlenW (lpString="SENS") returned 4
	[0180.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0180.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0180.379] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0180.379] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0180.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0180.379] lstrlenW (lpString="ShellHWDetection") returned 16
	[0180.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0180.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0180.379] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0180.379] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0180.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0180.379] lstrlenW (lpString="Spooler") returned 7
	[0180.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0180.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0180.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0180.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0180.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0180.379] lstrlenW (lpString="StateRepository") returned 15
	[0180.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0180.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0180.379] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0180.379] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0180.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0180.379] lstrlenW (lpString="SysMain") returned 7
	[0180.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0180.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0180.379] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0180.379] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0180.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0180.379] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0180.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0180.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0180.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0180.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0180.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0180.380] lstrlenW (lpString="Themes") returned 6
	[0180.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0180.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0180.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0180.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0180.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0180.380] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0180.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0180.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0180.380] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0180.380] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0180.380] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4e0
	[0180.534] Process32FirstW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0180.535] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0180.535] lstrlenW (lpString="System") returned 6
	[0180.535] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0180.536] lstrlenW (lpString="smss.exe") returned 8
	[0180.536] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0180.536] lstrlenW (lpString="csrss.exe") returned 9
	[0180.536] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0180.537] lstrlenW (lpString="wininit.exe") returned 11
	[0180.537] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0180.537] lstrlenW (lpString="csrss.exe") returned 9
	[0180.537] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0180.537] lstrlenW (lpString="winlogon.exe") returned 12
	[0180.537] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0180.538] lstrlenW (lpString="services.exe") returned 12
	[0180.538] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0180.538] lstrlenW (lpString="lsass.exe") returned 9
	[0180.538] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0180.539] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0180.539] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0180.539] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0180.539] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.540] lstrlenW (lpString="svchost.exe") returned 11
	[0180.540] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.540] lstrlenW (lpString="svchost.exe") returned 11
	[0180.540] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0180.541] lstrlenW (lpString="dwm.exe") returned 7
	[0180.541] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.541] lstrlenW (lpString="svchost.exe") returned 11
	[0180.541] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.541] lstrlenW (lpString="svchost.exe") returned 11
	[0180.542] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.542] lstrlenW (lpString="svchost.exe") returned 11
	[0180.542] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.542] lstrlenW (lpString="svchost.exe") returned 11
	[0180.542] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.543] lstrlenW (lpString="svchost.exe") returned 11
	[0180.543] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.543] lstrlenW (lpString="svchost.exe") returned 11
	[0180.543] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.544] lstrlenW (lpString="svchost.exe") returned 11
	[0180.544] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.544] lstrlenW (lpString="svchost.exe") returned 11
	[0180.544] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.544] lstrlenW (lpString="svchost.exe") returned 11
	[0180.544] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.545] lstrlenW (lpString="svchost.exe") returned 11
	[0180.545] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0180.545] lstrlenW (lpString="spoolsv.exe") returned 11
	[0180.545] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.546] lstrlenW (lpString="svchost.exe") returned 11
	[0180.546] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0180.546] lstrlenW (lpString="audiodg.exe") returned 11
	[0180.546] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0180.547] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0180.547] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0180.547] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0180.547] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0180.547] lstrlenW (lpString="sihost.exe") returned 10
	[0180.547] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0180.548] lstrlenW (lpString="Memory Compression") returned 18
	[0180.548] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.548] lstrlenW (lpString="svchost.exe") returned 11
	[0180.548] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0180.549] lstrlenW (lpString="msoia.exe") returned 9
	[0180.549] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0180.549] lstrlenW (lpString="taskhostw.exe") returned 13
	[0180.549] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0180.550] lstrlenW (lpString="explorer.exe") returned 12
	[0180.550] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0180.550] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0180.550] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0180.550] lstrlenW (lpString="SearchUI.exe") returned 12
	[0180.550] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0180.551] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0180.551] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0180.551] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0180.551] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0180.552] lstrlenW (lpString="d2.exe") returned 6
	[0180.552] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xde0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0180.552] lstrlenW (lpString="conhost.exe") returned 11
	[0180.552] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0180.552] lstrlenW (lpString="dllhost.exe") returned 11
	[0180.552] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0180.553] lstrlenW (lpString="d2.exe") returned 6
	[0180.553] Process32NextW (in: hSnapshot=0x4e0, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0180.553] CloseHandle (hObject=0x4e0) returned 1
	[0180.553] Sleep (dwMilliseconds=0x1f4) 
	[0181.165] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52f050
	[0181.165] EnumServicesStatusExW (in: hSCManager=0x52f050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0181.166] GetLastError () returned 0xea
	[0181.166] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0181.166] EnumServicesStatusExW (in: hSCManager=0x52f050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0181.167] CloseServiceHandle (hSCObject=0x52f050) returned 1
	[0181.167] lstrlenW (lpString="Appinfo") returned 7
	[0181.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0181.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0181.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0181.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0181.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0181.167] lstrlenW (lpString="AppXSvc") returned 7
	[0181.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0181.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0181.167] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0181.167] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0181.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0181.168] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0181.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0181.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0181.168] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0181.168] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0181.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0181.168] lstrlenW (lpString="Audiosrv") returned 8
	[0181.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0181.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0181.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0181.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0181.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0181.168] lstrlenW (lpString="BFE") returned 3
	[0181.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0181.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0181.168] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0181.168] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0181.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0181.168] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0181.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0181.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0181.168] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0181.168] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0181.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0181.168] lstrlenW (lpString="CDPSvc") returned 6
	[0181.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0181.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0181.168] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0181.168] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0181.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0181.168] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0181.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0181.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0181.169] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0181.169] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0181.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0181.169] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0181.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0181.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0181.169] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0181.169] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0181.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0181.169] lstrlenW (lpString="CryptSvc") returned 8
	[0181.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0181.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0181.169] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0181.169] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0181.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0181.169] lstrlenW (lpString="DcomLaunch") returned 10
	[0181.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0181.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0181.169] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0181.169] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0181.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0181.169] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0181.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0181.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0181.169] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0181.169] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0181.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0181.169] lstrlenW (lpString="Dhcp") returned 4
	[0181.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0181.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0181.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0181.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0181.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0181.170] lstrlenW (lpString="Dnscache") returned 8
	[0181.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0181.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0181.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0181.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0181.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0181.170] lstrlenW (lpString="DPS") returned 3
	[0181.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0181.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0181.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0181.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0181.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0181.170] lstrlenW (lpString="DusmSvc") returned 7
	[0181.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0181.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0181.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0181.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0181.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0181.170] lstrlenW (lpString="EventLog") returned 8
	[0181.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0181.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0181.170] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0181.170] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0181.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0181.170] lstrlenW (lpString="EventSystem") returned 11
	[0181.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0181.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0181.171] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0181.171] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0181.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0181.171] lstrlenW (lpString="FontCache") returned 9
	[0181.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0181.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0181.171] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0181.171] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0181.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0181.171] lstrlenW (lpString="gpsvc") returned 5
	[0181.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0181.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0181.171] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0181.171] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0181.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0181.171] lstrlenW (lpString="iphlpsvc") returned 8
	[0181.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0181.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0181.171] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0181.171] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0181.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0181.171] lstrlenW (lpString="KeyIso") returned 6
	[0181.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0181.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0181.171] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0181.171] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0181.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0181.171] lstrlenW (lpString="LanmanServer") returned 12
	[0181.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0181.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0181.171] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0181.171] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0181.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0181.172] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0181.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0181.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0181.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0181.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0181.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0181.172] lstrlenW (lpString="lfsvc") returned 5
	[0181.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0181.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0181.172] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0181.172] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0181.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0181.172] lstrlenW (lpString="lmhosts") returned 7
	[0181.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0181.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0181.172] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0181.172] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0181.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0181.172] lstrlenW (lpString="LSM") returned 3
	[0181.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0181.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0181.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0181.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0181.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0181.172] lstrlenW (lpString="MpsSvc") returned 6
	[0181.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0181.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0181.172] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0181.172] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0181.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0181.172] lstrlenW (lpString="NcbService") returned 10
	[0181.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0181.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0181.173] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0181.173] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0181.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0181.173] lstrlenW (lpString="netprofm") returned 8
	[0181.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0181.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0181.173] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0181.173] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0181.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0181.173] lstrlenW (lpString="NgcSvc") returned 6
	[0181.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0181.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0181.173] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0181.173] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0181.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0181.173] lstrlenW (lpString="NlaSvc") returned 6
	[0181.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0181.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0181.173] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0181.173] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0181.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0181.173] lstrlenW (lpString="nsi") returned 3
	[0181.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0181.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0181.173] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0181.173] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0181.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0181.173] lstrlenW (lpString="PcaSvc") returned 6
	[0181.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0181.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0181.174] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0181.174] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0181.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0181.174] lstrlenW (lpString="PlugPlay") returned 8
	[0181.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0181.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0181.174] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0181.174] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0181.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0181.174] lstrlenW (lpString="Power") returned 5
	[0181.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0181.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0181.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0181.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0181.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0181.174] lstrlenW (lpString="ProfSvc") returned 7
	[0181.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0181.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0181.174] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0181.174] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0181.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0181.174] lstrlenW (lpString="RpcEptMapper") returned 12
	[0181.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0181.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0181.174] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0181.174] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0181.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0181.174] lstrlenW (lpString="RpcSs") returned 5
	[0181.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0181.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0181.174] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0181.175] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0181.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0181.175] lstrlenW (lpString="SamSs") returned 5
	[0181.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0181.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0181.175] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0181.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0181.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0181.175] lstrlenW (lpString="Schedule") returned 8
	[0181.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0181.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0181.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0181.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0181.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0181.175] lstrlenW (lpString="SecurityHealthService") returned 21
	[0181.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0181.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0181.175] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0181.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0181.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0181.175] lstrlenW (lpString="SENS") returned 4
	[0181.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0181.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0181.175] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0181.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0181.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0181.175] lstrlenW (lpString="ShellHWDetection") returned 16
	[0181.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0181.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0181.175] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0181.175] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0181.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0181.176] lstrlenW (lpString="Spooler") returned 7
	[0181.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0181.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0181.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0181.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0181.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0181.176] lstrlenW (lpString="StateRepository") returned 15
	[0181.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0181.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0181.176] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0181.176] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0181.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0181.176] lstrlenW (lpString="SysMain") returned 7
	[0181.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0181.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0181.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0181.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0181.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0181.176] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0181.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0181.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0181.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0181.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0181.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0181.176] lstrlenW (lpString="Themes") returned 6
	[0181.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0181.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0181.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0181.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0181.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0181.176] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0181.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0181.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0181.177] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0181.177] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0181.177] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x51c
	[0181.259] Process32FirstW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0181.259] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0181.260] lstrlenW (lpString="System") returned 6
	[0181.260] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0181.260] lstrlenW (lpString="smss.exe") returned 8
	[0181.260] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0181.261] lstrlenW (lpString="csrss.exe") returned 9
	[0181.261] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0181.261] lstrlenW (lpString="wininit.exe") returned 11
	[0181.261] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0181.262] lstrlenW (lpString="csrss.exe") returned 9
	[0181.262] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0181.262] lstrlenW (lpString="winlogon.exe") returned 12
	[0181.262] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0181.262] lstrlenW (lpString="services.exe") returned 12
	[0181.262] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0181.263] lstrlenW (lpString="lsass.exe") returned 9
	[0181.263] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0181.263] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0181.263] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0181.264] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0181.264] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.264] lstrlenW (lpString="svchost.exe") returned 11
	[0181.264] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.265] lstrlenW (lpString="svchost.exe") returned 11
	[0181.265] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0181.265] lstrlenW (lpString="dwm.exe") returned 7
	[0181.265] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.265] lstrlenW (lpString="svchost.exe") returned 11
	[0181.265] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.266] lstrlenW (lpString="svchost.exe") returned 11
	[0181.266] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.266] lstrlenW (lpString="svchost.exe") returned 11
	[0181.266] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.267] lstrlenW (lpString="svchost.exe") returned 11
	[0181.267] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.267] lstrlenW (lpString="svchost.exe") returned 11
	[0181.267] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.267] lstrlenW (lpString="svchost.exe") returned 11
	[0181.267] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.268] lstrlenW (lpString="svchost.exe") returned 11
	[0181.268] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.268] lstrlenW (lpString="svchost.exe") returned 11
	[0181.268] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.269] lstrlenW (lpString="svchost.exe") returned 11
	[0181.269] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.269] lstrlenW (lpString="svchost.exe") returned 11
	[0181.269] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0181.270] lstrlenW (lpString="spoolsv.exe") returned 11
	[0181.270] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.270] lstrlenW (lpString="svchost.exe") returned 11
	[0181.270] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0181.270] lstrlenW (lpString="audiodg.exe") returned 11
	[0181.270] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0181.271] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0181.271] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0181.271] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0181.271] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0181.272] lstrlenW (lpString="sihost.exe") returned 10
	[0181.272] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0181.272] lstrlenW (lpString="Memory Compression") returned 18
	[0181.272] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.272] lstrlenW (lpString="svchost.exe") returned 11
	[0181.272] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0181.273] lstrlenW (lpString="msoia.exe") returned 9
	[0181.273] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0181.273] lstrlenW (lpString="taskhostw.exe") returned 13
	[0181.273] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0181.274] lstrlenW (lpString="explorer.exe") returned 12
	[0181.274] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0181.274] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0181.274] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0181.275] lstrlenW (lpString="SearchUI.exe") returned 12
	[0181.275] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0181.275] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0181.275] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0181.276] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0181.276] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0181.276] lstrlenW (lpString="d2.exe") returned 6
	[0181.276] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0181.276] lstrlenW (lpString="d2.exe") returned 6
	[0181.276] Process32NextW (in: hSnapshot=0x51c, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0181.277] CloseHandle (hObject=0x51c) returned 1
	[0181.277] Sleep (dwMilliseconds=0x1f4) 
	[0182.134] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ef60
	[0182.135] EnumServicesStatusExW (in: hSCManager=0x52ef60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0182.135] GetLastError () returned 0xea
	[0182.135] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0182.136] EnumServicesStatusExW (in: hSCManager=0x52ef60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0182.137] CloseServiceHandle (hSCObject=0x52ef60) returned 1
	[0182.137] lstrlenW (lpString="Appinfo") returned 7
	[0182.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0182.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0182.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0182.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0182.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0182.137] lstrlenW (lpString="AppXSvc") returned 7
	[0182.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0182.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0182.138] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0182.138] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0182.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0182.138] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0182.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0182.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0182.138] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0182.138] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0182.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0182.138] lstrlenW (lpString="Audiosrv") returned 8
	[0182.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0182.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0182.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0182.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0182.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0182.138] lstrlenW (lpString="BFE") returned 3
	[0182.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0182.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0182.138] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0182.138] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0182.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0182.138] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0182.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0182.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0182.138] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0182.138] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0182.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0182.138] lstrlenW (lpString="CDPSvc") returned 6
	[0182.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0182.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0182.138] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0182.138] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0182.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0182.139] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0182.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0182.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0182.139] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0182.139] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0182.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0182.139] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0182.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0182.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0182.139] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0182.139] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0182.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0182.139] lstrlenW (lpString="CryptSvc") returned 8
	[0182.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0182.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0182.139] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0182.139] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0182.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0182.139] lstrlenW (lpString="DcomLaunch") returned 10
	[0182.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0182.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0182.139] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0182.139] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0182.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0182.139] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0182.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0182.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0182.139] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0182.139] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0182.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0182.139] lstrlenW (lpString="Dhcp") returned 4
	[0182.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0182.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0182.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0182.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0182.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0182.140] lstrlenW (lpString="Dnscache") returned 8
	[0182.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0182.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0182.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0182.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0182.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0182.140] lstrlenW (lpString="DPS") returned 3
	[0182.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0182.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0182.140] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0182.140] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0182.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0182.140] lstrlenW (lpString="DusmSvc") returned 7
	[0182.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0182.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0182.140] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0182.140] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0182.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0182.140] lstrlenW (lpString="EventLog") returned 8
	[0182.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0182.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0182.140] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0182.140] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0182.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0182.140] lstrlenW (lpString="EventSystem") returned 11
	[0182.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0182.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0182.141] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0182.141] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0182.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0182.141] lstrlenW (lpString="FontCache") returned 9
	[0182.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0182.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0182.141] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0182.141] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0182.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0182.141] lstrlenW (lpString="gpsvc") returned 5
	[0182.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0182.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0182.141] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0182.141] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0182.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0182.141] lstrlenW (lpString="iphlpsvc") returned 8
	[0182.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0182.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0182.141] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0182.141] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0182.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0182.141] lstrlenW (lpString="KeyIso") returned 6
	[0182.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0182.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0182.141] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0182.141] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0182.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0182.141] lstrlenW (lpString="LanmanServer") returned 12
	[0182.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0182.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0182.142] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0182.142] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0182.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0182.142] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0182.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0182.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0182.142] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0182.142] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0182.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0182.142] lstrlenW (lpString="lfsvc") returned 5
	[0182.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0182.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0182.142] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0182.142] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0182.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0182.142] lstrlenW (lpString="lmhosts") returned 7
	[0182.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0182.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0182.142] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0182.142] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0182.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0182.142] lstrlenW (lpString="LSM") returned 3
	[0182.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0182.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0182.142] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0182.142] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0182.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0182.142] lstrlenW (lpString="MpsSvc") returned 6
	[0182.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0182.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0182.142] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0182.142] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0182.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0182.143] lstrlenW (lpString="NcbService") returned 10
	[0182.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0182.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0182.143] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0182.143] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0182.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0182.143] lstrlenW (lpString="netprofm") returned 8
	[0182.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0182.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0182.143] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0182.143] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0182.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0182.143] lstrlenW (lpString="NgcSvc") returned 6
	[0182.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0182.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0182.143] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0182.143] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0182.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0182.143] lstrlenW (lpString="NlaSvc") returned 6
	[0182.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0182.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0182.143] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0182.143] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0182.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0182.143] lstrlenW (lpString="nsi") returned 3
	[0182.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0182.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0182.143] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0182.143] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0182.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0182.143] lstrlenW (lpString="PcaSvc") returned 6
	[0182.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0182.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0182.144] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0182.144] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0182.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0182.144] lstrlenW (lpString="PlugPlay") returned 8
	[0182.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0182.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0182.144] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0182.144] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0182.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0182.144] lstrlenW (lpString="Power") returned 5
	[0182.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0182.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0182.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0182.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0182.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0182.144] lstrlenW (lpString="ProfSvc") returned 7
	[0182.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0182.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0182.144] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0182.144] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0182.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0182.144] lstrlenW (lpString="RpcEptMapper") returned 12
	[0182.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0182.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0182.144] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0182.144] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0182.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0182.144] lstrlenW (lpString="RpcSs") returned 5
	[0182.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0182.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0182.145] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0182.145] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0182.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0182.145] lstrlenW (lpString="SamSs") returned 5
	[0182.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0182.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0182.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0182.145] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0182.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0182.145] lstrlenW (lpString="Schedule") returned 8
	[0182.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0182.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0182.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0182.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0182.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0182.145] lstrlenW (lpString="SecurityHealthService") returned 21
	[0182.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0182.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0182.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0182.145] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0182.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0182.145] lstrlenW (lpString="SENS") returned 4
	[0182.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0182.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0182.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0182.145] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0182.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0182.145] lstrlenW (lpString="ShellHWDetection") returned 16
	[0182.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0182.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0182.145] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0182.145] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0182.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0182.146] lstrlenW (lpString="Spooler") returned 7
	[0182.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0182.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0182.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0182.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0182.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0182.146] lstrlenW (lpString="StateRepository") returned 15
	[0182.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0182.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0182.146] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0182.146] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0182.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0182.146] lstrlenW (lpString="SysMain") returned 7
	[0182.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0182.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0182.146] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0182.146] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0182.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0182.146] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0182.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0182.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0182.146] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0182.146] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0182.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0182.146] lstrlenW (lpString="Themes") returned 6
	[0182.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0182.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0182.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0182.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0182.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0182.147] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0182.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0182.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0182.147] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0182.147] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0182.147] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x504
	[0182.386] Process32FirstW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0182.386] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0182.387] lstrlenW (lpString="System") returned 6
	[0182.387] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0182.387] lstrlenW (lpString="smss.exe") returned 8
	[0182.387] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0182.388] lstrlenW (lpString="csrss.exe") returned 9
	[0182.388] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0182.388] lstrlenW (lpString="wininit.exe") returned 11
	[0182.388] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0182.389] lstrlenW (lpString="csrss.exe") returned 9
	[0182.389] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0182.389] lstrlenW (lpString="winlogon.exe") returned 12
	[0182.389] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0182.389] lstrlenW (lpString="services.exe") returned 12
	[0182.390] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0182.390] lstrlenW (lpString="lsass.exe") returned 9
	[0182.390] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0182.390] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0182.390] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0182.391] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0182.391] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.391] lstrlenW (lpString="svchost.exe") returned 11
	[0182.391] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.392] lstrlenW (lpString="svchost.exe") returned 11
	[0182.392] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0182.392] lstrlenW (lpString="dwm.exe") returned 7
	[0182.392] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.392] lstrlenW (lpString="svchost.exe") returned 11
	[0182.392] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.393] lstrlenW (lpString="svchost.exe") returned 11
	[0182.393] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.393] lstrlenW (lpString="svchost.exe") returned 11
	[0182.393] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.394] lstrlenW (lpString="svchost.exe") returned 11
	[0182.394] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.394] lstrlenW (lpString="svchost.exe") returned 11
	[0182.394] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.394] lstrlenW (lpString="svchost.exe") returned 11
	[0182.395] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.395] lstrlenW (lpString="svchost.exe") returned 11
	[0182.395] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.395] lstrlenW (lpString="svchost.exe") returned 11
	[0182.395] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.396] lstrlenW (lpString="svchost.exe") returned 11
	[0182.396] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.396] lstrlenW (lpString="svchost.exe") returned 11
	[0182.396] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0182.397] lstrlenW (lpString="spoolsv.exe") returned 11
	[0182.397] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.397] lstrlenW (lpString="svchost.exe") returned 11
	[0182.397] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0182.397] lstrlenW (lpString="audiodg.exe") returned 11
	[0182.398] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0182.398] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0182.398] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0182.398] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0182.398] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0182.399] lstrlenW (lpString="sihost.exe") returned 10
	[0182.399] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0182.399] lstrlenW (lpString="Memory Compression") returned 18
	[0182.399] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0182.400] lstrlenW (lpString="svchost.exe") returned 11
	[0182.400] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0182.400] lstrlenW (lpString="msoia.exe") returned 9
	[0182.400] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0182.401] lstrlenW (lpString="taskhostw.exe") returned 13
	[0182.401] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0182.401] lstrlenW (lpString="explorer.exe") returned 12
	[0182.401] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0182.401] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0182.401] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0182.402] lstrlenW (lpString="SearchUI.exe") returned 12
	[0182.402] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0182.402] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0182.402] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0182.403] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0182.403] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0182.403] lstrlenW (lpString="d2.exe") returned 6
	[0182.403] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0182.404] lstrlenW (lpString="d2.exe") returned 6
	[0182.404] Process32NextW (in: hSnapshot=0x504, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0182.404] CloseHandle (hObject=0x504) returned 1
	[0182.404] Sleep (dwMilliseconds=0x1f4) 
	[0183.279] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ee20
	[0183.279] EnumServicesStatusExW (in: hSCManager=0x52ee20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0183.280] GetLastError () returned 0xea
	[0183.280] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0183.280] EnumServicesStatusExW (in: hSCManager=0x52ee20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0183.281] CloseServiceHandle (hSCObject=0x52ee20) returned 1
	[0183.281] lstrlenW (lpString="Appinfo") returned 7
	[0183.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0183.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0183.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0183.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0183.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0183.281] lstrlenW (lpString="AppXSvc") returned 7
	[0183.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0183.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0183.281] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0183.281] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0183.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0183.281] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0183.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0183.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0183.282] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0183.282] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0183.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0183.282] lstrlenW (lpString="Audiosrv") returned 8
	[0183.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0183.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0183.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0183.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0183.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0183.282] lstrlenW (lpString="BFE") returned 3
	[0183.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0183.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0183.282] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0183.282] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0183.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0183.282] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0183.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0183.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0183.282] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0183.282] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0183.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0183.282] lstrlenW (lpString="CDPSvc") returned 6
	[0183.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0183.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0183.282] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0183.282] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0183.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0183.282] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0183.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0183.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0183.282] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0183.283] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0183.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0183.283] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0183.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0183.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0183.283] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0183.283] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0183.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0183.283] lstrlenW (lpString="CryptSvc") returned 8
	[0183.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0183.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0183.283] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0183.283] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0183.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0183.283] lstrlenW (lpString="DcomLaunch") returned 10
	[0183.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0183.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0183.283] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0183.283] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0183.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0183.283] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0183.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0183.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0183.283] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0183.283] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0183.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0183.283] lstrlenW (lpString="Dhcp") returned 4
	[0183.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0183.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0183.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0183.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0183.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0183.284] lstrlenW (lpString="Dnscache") returned 8
	[0183.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0183.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0183.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0183.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0183.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0183.284] lstrlenW (lpString="DPS") returned 3
	[0183.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0183.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0183.284] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0183.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0183.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0183.284] lstrlenW (lpString="DusmSvc") returned 7
	[0183.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0183.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0183.284] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0183.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0183.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0183.284] lstrlenW (lpString="EventLog") returned 8
	[0183.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0183.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0183.284] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0183.284] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0183.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0183.284] lstrlenW (lpString="EventSystem") returned 11
	[0183.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0183.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0183.284] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0183.284] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0183.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0183.285] lstrlenW (lpString="FontCache") returned 9
	[0183.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0183.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0183.285] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0183.285] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0183.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0183.285] lstrlenW (lpString="gpsvc") returned 5
	[0183.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0183.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0183.285] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0183.285] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0183.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0183.285] lstrlenW (lpString="iphlpsvc") returned 8
	[0183.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0183.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0183.285] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0183.285] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0183.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0183.285] lstrlenW (lpString="KeyIso") returned 6
	[0183.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0183.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0183.285] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0183.285] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0183.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0183.285] lstrlenW (lpString="LanmanServer") returned 12
	[0183.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0183.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0183.285] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0183.285] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0183.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0183.285] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0183.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0183.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0183.286] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0183.286] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0183.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0183.286] lstrlenW (lpString="lfsvc") returned 5
	[0183.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0183.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0183.286] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0183.286] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0183.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0183.286] lstrlenW (lpString="lmhosts") returned 7
	[0183.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0183.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0183.286] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0183.286] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0183.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0183.286] lstrlenW (lpString="LSM") returned 3
	[0183.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0183.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0183.286] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0183.286] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0183.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0183.286] lstrlenW (lpString="MpsSvc") returned 6
	[0183.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0183.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0183.286] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0183.286] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0183.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0183.286] lstrlenW (lpString="NcbService") returned 10
	[0183.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0183.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0183.287] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0183.287] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0183.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0183.287] lstrlenW (lpString="netprofm") returned 8
	[0183.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0183.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0183.287] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0183.287] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0183.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0183.287] lstrlenW (lpString="NgcSvc") returned 6
	[0183.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0183.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0183.287] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0183.287] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0183.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0183.287] lstrlenW (lpString="NlaSvc") returned 6
	[0183.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0183.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0183.287] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0183.287] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0183.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0183.287] lstrlenW (lpString="nsi") returned 3
	[0183.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0183.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0183.287] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0183.287] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0183.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0183.287] lstrlenW (lpString="PcaSvc") returned 6
	[0183.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0183.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0183.287] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0183.287] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0183.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0183.288] lstrlenW (lpString="PlugPlay") returned 8
	[0183.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0183.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0183.288] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0183.288] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0183.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0183.288] lstrlenW (lpString="Power") returned 5
	[0183.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0183.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0183.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0183.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0183.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0183.288] lstrlenW (lpString="ProfSvc") returned 7
	[0183.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0183.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0183.288] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0183.288] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0183.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0183.288] lstrlenW (lpString="RpcEptMapper") returned 12
	[0183.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0183.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0183.288] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0183.288] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0183.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0183.288] lstrlenW (lpString="RpcSs") returned 5
	[0183.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0183.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0183.288] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0183.288] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0183.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0183.289] lstrlenW (lpString="SamSs") returned 5
	[0183.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0183.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0183.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0183.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0183.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0183.289] lstrlenW (lpString="Schedule") returned 8
	[0183.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0183.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0183.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0183.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0183.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0183.289] lstrlenW (lpString="SecurityHealthService") returned 21
	[0183.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0183.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0183.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0183.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0183.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0183.289] lstrlenW (lpString="SENS") returned 4
	[0183.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0183.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0183.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0183.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0183.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0183.289] lstrlenW (lpString="ShellHWDetection") returned 16
	[0183.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0183.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0183.289] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0183.289] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0183.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0183.289] lstrlenW (lpString="Spooler") returned 7
	[0183.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0183.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0183.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0183.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0183.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0183.290] lstrlenW (lpString="StateRepository") returned 15
	[0183.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0183.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0183.290] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0183.290] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0183.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0183.290] lstrlenW (lpString="SysMain") returned 7
	[0183.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0183.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0183.290] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0183.290] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0183.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0183.290] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0183.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0183.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0183.290] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0183.290] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0183.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0183.290] lstrlenW (lpString="Themes") returned 6
	[0183.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0183.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0183.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0183.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0183.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0183.290] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0183.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0183.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0183.291] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0183.291] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0183.291] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b8
	[0183.450] Process32FirstW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0183.451] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0183.451] lstrlenW (lpString="System") returned 6
	[0183.451] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0183.452] lstrlenW (lpString="smss.exe") returned 8
	[0183.452] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0183.452] lstrlenW (lpString="csrss.exe") returned 9
	[0183.452] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0183.453] lstrlenW (lpString="wininit.exe") returned 11
	[0183.453] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0183.453] lstrlenW (lpString="csrss.exe") returned 9
	[0183.453] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0183.453] lstrlenW (lpString="winlogon.exe") returned 12
	[0183.453] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0183.454] lstrlenW (lpString="services.exe") returned 12
	[0183.454] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0183.454] lstrlenW (lpString="lsass.exe") returned 9
	[0183.454] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0183.455] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0183.455] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0183.455] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0183.455] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.456] lstrlenW (lpString="svchost.exe") returned 11
	[0183.456] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.456] lstrlenW (lpString="svchost.exe") returned 11
	[0183.456] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0183.456] lstrlenW (lpString="dwm.exe") returned 7
	[0183.456] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.457] lstrlenW (lpString="svchost.exe") returned 11
	[0183.457] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.457] lstrlenW (lpString="svchost.exe") returned 11
	[0183.457] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.458] lstrlenW (lpString="svchost.exe") returned 11
	[0183.458] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.458] lstrlenW (lpString="svchost.exe") returned 11
	[0183.458] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.459] lstrlenW (lpString="svchost.exe") returned 11
	[0183.459] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.459] lstrlenW (lpString="svchost.exe") returned 11
	[0183.459] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.459] lstrlenW (lpString="svchost.exe") returned 11
	[0183.459] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.460] lstrlenW (lpString="svchost.exe") returned 11
	[0183.460] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.460] lstrlenW (lpString="svchost.exe") returned 11
	[0183.460] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.461] lstrlenW (lpString="svchost.exe") returned 11
	[0183.461] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0183.461] lstrlenW (lpString="spoolsv.exe") returned 11
	[0183.461] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.462] lstrlenW (lpString="svchost.exe") returned 11
	[0183.462] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0183.462] lstrlenW (lpString="audiodg.exe") returned 11
	[0183.462] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0183.462] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0183.462] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0183.463] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0183.463] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0183.463] lstrlenW (lpString="sihost.exe") returned 10
	[0183.463] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0183.464] lstrlenW (lpString="Memory Compression") returned 18
	[0183.464] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.464] lstrlenW (lpString="svchost.exe") returned 11
	[0183.464] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0183.465] lstrlenW (lpString="msoia.exe") returned 9
	[0183.465] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0183.465] lstrlenW (lpString="taskhostw.exe") returned 13
	[0183.465] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0183.466] lstrlenW (lpString="explorer.exe") returned 12
	[0183.466] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0183.466] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0183.466] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0183.467] lstrlenW (lpString="SearchUI.exe") returned 12
	[0183.467] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0183.467] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0183.467] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0183.467] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0183.468] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0183.468] lstrlenW (lpString="d2.exe") returned 6
	[0183.468] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0183.468] lstrlenW (lpString="d2.exe") returned 6
	[0183.468] Process32NextW (in: hSnapshot=0x4b8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0183.469] CloseHandle (hObject=0x4b8) returned 1
	[0183.469] Sleep (dwMilliseconds=0x1f4) 
	[0184.359] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52eda8
	[0184.364] EnumServicesStatusExW (in: hSCManager=0x52eda8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0184.366] GetLastError () returned 0xea
	[0184.367] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0184.368] EnumServicesStatusExW (in: hSCManager=0x52eda8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0184.369] CloseServiceHandle (hSCObject=0x52eda8) returned 1
	[0184.369] lstrlenW (lpString="Appinfo") returned 7
	[0184.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0184.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0184.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0184.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0184.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0184.369] lstrlenW (lpString="AppXSvc") returned 7
	[0184.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0184.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0184.369] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0184.369] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0184.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0184.369] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0184.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0184.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0184.369] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0184.370] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0184.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0184.370] lstrlenW (lpString="Audiosrv") returned 8
	[0184.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0184.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0184.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0184.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0184.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0184.370] lstrlenW (lpString="BFE") returned 3
	[0184.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0184.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0184.370] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0184.370] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0184.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0184.370] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0184.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0184.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0184.370] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0184.370] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0184.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0184.370] lstrlenW (lpString="CDPSvc") returned 6
	[0184.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0184.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0184.370] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0184.370] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0184.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0184.370] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0184.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0184.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0184.370] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0184.370] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0184.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0184.371] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0184.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0184.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0184.371] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0184.371] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0184.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0184.371] lstrlenW (lpString="CryptSvc") returned 8
	[0184.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0184.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0184.371] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0184.371] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0184.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0184.371] lstrlenW (lpString="DcomLaunch") returned 10
	[0184.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0184.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0184.371] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0184.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0184.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0184.371] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0184.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0184.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0184.371] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0184.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0184.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0184.372] lstrlenW (lpString="Dhcp") returned 4
	[0184.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0184.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0184.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0184.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0184.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0184.372] lstrlenW (lpString="Dnscache") returned 8
	[0184.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0184.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0184.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0184.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0184.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0184.372] lstrlenW (lpString="DPS") returned 3
	[0184.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0184.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0184.372] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0184.372] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0184.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0184.372] lstrlenW (lpString="DusmSvc") returned 7
	[0184.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0184.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0184.372] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0184.372] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0184.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0184.372] lstrlenW (lpString="EventLog") returned 8
	[0184.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0184.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0184.372] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0184.372] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0184.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0184.373] lstrlenW (lpString="EventSystem") returned 11
	[0184.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0184.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0184.373] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0184.373] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0184.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0184.373] lstrlenW (lpString="FontCache") returned 9
	[0184.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0184.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0184.373] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0184.373] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0184.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0184.373] lstrlenW (lpString="gpsvc") returned 5
	[0184.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0184.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0184.373] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0184.373] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0184.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0184.373] lstrlenW (lpString="iphlpsvc") returned 8
	[0184.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0184.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0184.373] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0184.373] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0184.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0184.373] lstrlenW (lpString="KeyIso") returned 6
	[0184.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0184.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0184.373] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0184.373] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0184.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0184.373] lstrlenW (lpString="LanmanServer") returned 12
	[0184.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0184.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0184.374] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0184.374] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0184.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0184.374] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0184.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0184.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0184.374] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0184.374] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0184.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0184.374] lstrlenW (lpString="lfsvc") returned 5
	[0184.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0184.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0184.374] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0184.374] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0184.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0184.374] lstrlenW (lpString="lmhosts") returned 7
	[0184.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0184.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0184.374] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0184.374] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0184.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0184.374] lstrlenW (lpString="LSM") returned 3
	[0184.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0184.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0184.374] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0184.374] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0184.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0184.374] lstrlenW (lpString="MpsSvc") returned 6
	[0184.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0184.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0184.375] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0184.375] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0184.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0184.375] lstrlenW (lpString="NcbService") returned 10
	[0184.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0184.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0184.375] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0184.375] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0184.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0184.692] lstrlenW (lpString="netprofm") returned 8
	[0184.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0184.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0184.692] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0184.693] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0184.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0184.693] lstrlenW (lpString="NgcSvc") returned 6
	[0184.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0184.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0184.693] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0184.693] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0184.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0184.693] lstrlenW (lpString="NlaSvc") returned 6
	[0184.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0184.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0184.693] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0184.693] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0184.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0184.693] lstrlenW (lpString="nsi") returned 3
	[0184.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0184.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0184.693] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0184.693] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0184.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0184.695] lstrlenW (lpString="PcaSvc") returned 6
	[0184.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0184.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0184.695] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0184.695] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0184.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0184.696] lstrlenW (lpString="PlugPlay") returned 8
	[0184.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0184.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0184.696] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0184.696] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0184.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0184.696] lstrlenW (lpString="Power") returned 5
	[0184.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0184.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0184.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0184.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0184.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0184.696] lstrlenW (lpString="ProfSvc") returned 7
	[0184.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0184.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0184.696] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0184.696] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0184.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0184.696] lstrlenW (lpString="RpcEptMapper") returned 12
	[0184.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0184.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0184.696] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0184.696] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0184.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0184.696] lstrlenW (lpString="RpcSs") returned 5
	[0184.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0184.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0184.696] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0184.696] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0184.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0184.696] lstrlenW (lpString="SamSs") returned 5
	[0184.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0184.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0184.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0184.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0184.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0184.697] lstrlenW (lpString="Schedule") returned 8
	[0184.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0184.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0184.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0184.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0184.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0184.697] lstrlenW (lpString="SecurityHealthService") returned 21
	[0184.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0184.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0184.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0184.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0184.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0184.697] lstrlenW (lpString="SENS") returned 4
	[0184.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0184.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0184.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0184.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0184.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0184.697] lstrlenW (lpString="ShellHWDetection") returned 16
	[0184.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0184.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0184.697] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0184.697] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0184.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0184.697] lstrlenW (lpString="Spooler") returned 7
	[0184.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0184.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0184.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0184.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0184.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0184.698] lstrlenW (lpString="StateRepository") returned 15
	[0184.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0184.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0184.698] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0184.698] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0184.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0184.698] lstrlenW (lpString="SysMain") returned 7
	[0184.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0184.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0184.698] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0184.698] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0184.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0184.698] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0184.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0184.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0184.698] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0184.698] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0184.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0184.698] lstrlenW (lpString="Themes") returned 6
	[0184.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0184.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0184.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0184.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0184.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0184.698] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0184.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0184.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0184.699] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0184.699] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0184.699] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x444
	[0184.703] Process32FirstW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0184.703] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0184.703] lstrlenW (lpString="System") returned 6
	[0184.703] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0184.704] lstrlenW (lpString="smss.exe") returned 8
	[0184.704] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0184.704] lstrlenW (lpString="csrss.exe") returned 9
	[0184.704] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0184.705] lstrlenW (lpString="wininit.exe") returned 11
	[0184.705] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0184.705] lstrlenW (lpString="csrss.exe") returned 9
	[0184.705] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0184.706] lstrlenW (lpString="winlogon.exe") returned 12
	[0184.706] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0184.706] lstrlenW (lpString="services.exe") returned 12
	[0184.706] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0184.706] lstrlenW (lpString="lsass.exe") returned 9
	[0184.706] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0184.707] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0184.707] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0184.707] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0184.707] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.708] lstrlenW (lpString="svchost.exe") returned 11
	[0184.708] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.708] lstrlenW (lpString="svchost.exe") returned 11
	[0184.708] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0184.709] lstrlenW (lpString="dwm.exe") returned 7
	[0184.709] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.709] lstrlenW (lpString="svchost.exe") returned 11
	[0184.709] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.709] lstrlenW (lpString="svchost.exe") returned 11
	[0184.709] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.710] lstrlenW (lpString="svchost.exe") returned 11
	[0184.710] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.710] lstrlenW (lpString="svchost.exe") returned 11
	[0184.710] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.711] lstrlenW (lpString="svchost.exe") returned 11
	[0184.711] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.711] lstrlenW (lpString="svchost.exe") returned 11
	[0184.711] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.712] lstrlenW (lpString="svchost.exe") returned 11
	[0184.712] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.712] lstrlenW (lpString="svchost.exe") returned 11
	[0184.712] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.712] lstrlenW (lpString="svchost.exe") returned 11
	[0184.712] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.713] lstrlenW (lpString="svchost.exe") returned 11
	[0184.713] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0184.713] lstrlenW (lpString="spoolsv.exe") returned 11
	[0184.713] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.714] lstrlenW (lpString="svchost.exe") returned 11
	[0184.714] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0184.714] lstrlenW (lpString="audiodg.exe") returned 11
	[0184.714] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0184.715] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0184.715] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0184.715] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0184.715] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0184.716] lstrlenW (lpString="sihost.exe") returned 10
	[0184.716] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0184.716] lstrlenW (lpString="Memory Compression") returned 18
	[0184.716] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.717] lstrlenW (lpString="svchost.exe") returned 11
	[0184.717] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0184.717] lstrlenW (lpString="msoia.exe") returned 9
	[0184.717] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0184.717] lstrlenW (lpString="taskhostw.exe") returned 13
	[0184.717] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0184.718] lstrlenW (lpString="explorer.exe") returned 12
	[0184.718] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0184.718] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0184.718] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0184.719] lstrlenW (lpString="SearchUI.exe") returned 12
	[0184.719] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0184.719] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0184.719] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0184.719] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0184.719] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0184.720] lstrlenW (lpString="d2.exe") returned 6
	[0184.720] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0184.720] lstrlenW (lpString="d2.exe") returned 6
	[0184.720] Process32NextW (in: hSnapshot=0x444, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0184.721] CloseHandle (hObject=0x444) returned 1
	[0184.721] Sleep (dwMilliseconds=0x1f4) 
	[0185.239] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52efd8
	[0185.240] EnumServicesStatusExW (in: hSCManager=0x52efd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0185.240] GetLastError () returned 0xea
	[0185.240] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0185.241] EnumServicesStatusExW (in: hSCManager=0x52efd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0185.241] CloseServiceHandle (hSCObject=0x52efd8) returned 1
	[0185.242] lstrlenW (lpString="Appinfo") returned 7
	[0185.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0185.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0185.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0185.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0185.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0185.242] lstrlenW (lpString="AppXSvc") returned 7
	[0185.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0185.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0185.242] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0185.242] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0185.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0185.242] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0185.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0185.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0185.242] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0185.242] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0185.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0185.242] lstrlenW (lpString="Audiosrv") returned 8
	[0185.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0185.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0185.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0185.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0185.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0185.242] lstrlenW (lpString="BFE") returned 3
	[0185.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0185.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0185.243] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0185.243] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0185.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0185.243] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0185.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0185.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0185.243] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0185.243] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0185.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0185.243] lstrlenW (lpString="CDPSvc") returned 6
	[0185.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0185.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0185.243] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0185.243] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0185.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0185.243] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0185.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0185.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0185.243] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0185.243] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0185.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0185.243] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0185.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0185.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0185.243] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0185.243] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0185.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0185.243] lstrlenW (lpString="CryptSvc") returned 8
	[0185.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0185.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0185.244] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0185.244] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0185.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0185.244] lstrlenW (lpString="DcomLaunch") returned 10
	[0185.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0185.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0185.244] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0185.244] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0185.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0185.244] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0185.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0185.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0185.244] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0185.244] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0185.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0185.244] lstrlenW (lpString="Dhcp") returned 4
	[0185.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0185.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0185.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0185.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0185.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0185.244] lstrlenW (lpString="Dnscache") returned 8
	[0185.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0185.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0185.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0185.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0185.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0185.244] lstrlenW (lpString="DPS") returned 3
	[0185.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0185.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0185.245] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0185.245] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0185.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0185.245] lstrlenW (lpString="DusmSvc") returned 7
	[0185.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0185.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0185.245] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0185.245] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0185.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0185.245] lstrlenW (lpString="EventLog") returned 8
	[0185.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0185.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0185.245] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0185.245] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0185.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0185.245] lstrlenW (lpString="EventSystem") returned 11
	[0185.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0185.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0185.245] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0185.245] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0185.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0185.245] lstrlenW (lpString="FontCache") returned 9
	[0185.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0185.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0185.245] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0185.245] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0185.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0185.245] lstrlenW (lpString="gpsvc") returned 5
	[0185.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0185.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0185.246] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0185.246] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0185.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0185.246] lstrlenW (lpString="iphlpsvc") returned 8
	[0185.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0185.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0185.253] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0185.253] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0185.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0185.253] lstrlenW (lpString="KeyIso") returned 6
	[0185.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0185.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0185.253] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0185.253] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0185.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0185.253] lstrlenW (lpString="LanmanServer") returned 12
	[0185.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0185.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0185.253] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0185.253] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0185.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0185.253] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0185.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0185.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0185.253] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0185.253] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0185.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0185.253] lstrlenW (lpString="lfsvc") returned 5
	[0185.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0185.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0185.253] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0185.253] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0185.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0185.253] lstrlenW (lpString="lmhosts") returned 7
	[0185.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0185.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0185.254] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0185.254] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0185.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0185.254] lstrlenW (lpString="LSM") returned 3
	[0185.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0185.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0185.254] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0185.254] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0185.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0185.254] lstrlenW (lpString="MpsSvc") returned 6
	[0185.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0185.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0185.254] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0185.254] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0185.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0185.254] lstrlenW (lpString="NcbService") returned 10
	[0185.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0185.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0185.254] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0185.254] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0185.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0185.254] lstrlenW (lpString="netprofm") returned 8
	[0185.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0185.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0185.254] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0185.254] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0185.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0185.254] lstrlenW (lpString="NgcSvc") returned 6
	[0185.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0185.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0185.255] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0185.255] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0185.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0185.255] lstrlenW (lpString="NlaSvc") returned 6
	[0185.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0185.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0185.255] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0185.255] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0185.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0185.255] lstrlenW (lpString="nsi") returned 3
	[0185.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0185.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0185.255] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0185.255] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0185.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0185.255] lstrlenW (lpString="PcaSvc") returned 6
	[0185.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0185.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0185.255] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0185.255] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0185.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0185.255] lstrlenW (lpString="PlugPlay") returned 8
	[0185.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0185.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0185.255] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0185.255] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0185.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0185.255] lstrlenW (lpString="Power") returned 5
	[0185.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0185.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0185.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0185.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0185.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0185.256] lstrlenW (lpString="ProfSvc") returned 7
	[0185.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0185.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0185.256] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0185.256] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0185.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0185.256] lstrlenW (lpString="RpcEptMapper") returned 12
	[0185.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0185.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0185.256] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0185.256] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0185.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0185.256] lstrlenW (lpString="RpcSs") returned 5
	[0185.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0185.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0185.256] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0185.256] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0185.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0185.256] lstrlenW (lpString="SamSs") returned 5
	[0185.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0185.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0185.256] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0185.256] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0185.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0185.256] lstrlenW (lpString="Schedule") returned 8
	[0185.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0185.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0185.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0185.257] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0185.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0185.257] lstrlenW (lpString="SecurityHealthService") returned 21
	[0185.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0185.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0185.257] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0185.257] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0185.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0185.257] lstrlenW (lpString="SENS") returned 4
	[0185.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0185.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0185.257] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0185.257] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0185.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0185.257] lstrlenW (lpString="ShellHWDetection") returned 16
	[0185.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0185.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0185.257] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0185.257] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0185.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0185.257] lstrlenW (lpString="Spooler") returned 7
	[0185.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0185.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0185.257] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0185.257] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0185.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0185.257] lstrlenW (lpString="StateRepository") returned 15
	[0185.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0185.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0185.257] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0185.257] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0185.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0185.258] lstrlenW (lpString="SysMain") returned 7
	[0185.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0185.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0185.258] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0185.258] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0185.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0185.258] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0185.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0185.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0185.258] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0185.258] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0185.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0185.258] lstrlenW (lpString="Themes") returned 6
	[0185.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0185.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0185.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0185.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0185.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0185.258] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0185.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0185.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0185.258] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0185.258] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0185.258] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324
	[0185.311] Process32FirstW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0185.311] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0185.311] lstrlenW (lpString="System") returned 6
	[0185.311] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0185.312] lstrlenW (lpString="smss.exe") returned 8
	[0185.312] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0185.312] lstrlenW (lpString="csrss.exe") returned 9
	[0185.312] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0185.313] lstrlenW (lpString="wininit.exe") returned 11
	[0185.313] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0185.313] lstrlenW (lpString="csrss.exe") returned 9
	[0185.313] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0185.314] lstrlenW (lpString="winlogon.exe") returned 12
	[0185.314] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0185.314] lstrlenW (lpString="services.exe") returned 12
	[0185.314] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0185.314] lstrlenW (lpString="lsass.exe") returned 9
	[0185.314] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0185.315] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0185.315] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0185.315] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0185.315] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.316] lstrlenW (lpString="svchost.exe") returned 11
	[0185.316] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.316] lstrlenW (lpString="svchost.exe") returned 11
	[0185.316] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0185.316] lstrlenW (lpString="dwm.exe") returned 7
	[0185.317] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.317] lstrlenW (lpString="svchost.exe") returned 11
	[0185.317] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.317] lstrlenW (lpString="svchost.exe") returned 11
	[0185.317] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.322] lstrlenW (lpString="svchost.exe") returned 11
	[0185.322] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.322] lstrlenW (lpString="svchost.exe") returned 11
	[0185.322] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.323] lstrlenW (lpString="svchost.exe") returned 11
	[0185.323] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.323] lstrlenW (lpString="svchost.exe") returned 11
	[0185.323] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.323] lstrlenW (lpString="svchost.exe") returned 11
	[0185.323] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.324] lstrlenW (lpString="svchost.exe") returned 11
	[0185.324] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.324] lstrlenW (lpString="svchost.exe") returned 11
	[0185.324] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.325] lstrlenW (lpString="svchost.exe") returned 11
	[0185.325] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0185.325] lstrlenW (lpString="spoolsv.exe") returned 11
	[0185.325] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.326] lstrlenW (lpString="svchost.exe") returned 11
	[0185.326] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0185.326] lstrlenW (lpString="audiodg.exe") returned 11
	[0185.326] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0185.326] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0185.327] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0185.327] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0185.327] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0185.327] lstrlenW (lpString="sihost.exe") returned 10
	[0185.327] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0185.328] lstrlenW (lpString="Memory Compression") returned 18
	[0185.328] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.328] lstrlenW (lpString="svchost.exe") returned 11
	[0185.328] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0185.329] lstrlenW (lpString="msoia.exe") returned 9
	[0185.329] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0185.329] lstrlenW (lpString="taskhostw.exe") returned 13
	[0185.329] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0185.329] lstrlenW (lpString="explorer.exe") returned 12
	[0185.330] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0185.330] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0185.330] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0185.330] lstrlenW (lpString="SearchUI.exe") returned 12
	[0185.330] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0185.331] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0185.331] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0185.331] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0185.331] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0185.332] lstrlenW (lpString="d2.exe") returned 6
	[0185.332] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0185.332] lstrlenW (lpString="d2.exe") returned 6
	[0185.332] Process32NextW (in: hSnapshot=0x324, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0185.332] CloseHandle (hObject=0x324) returned 1
	[0185.332] Sleep (dwMilliseconds=0x1f4) 
	[0185.874] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52f050
	[0185.894] EnumServicesStatusExW (in: hSCManager=0x52f050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0185.895] GetLastError () returned 0xea
	[0185.895] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x531160
	[0185.895] EnumServicesStatusExW (in: hSCManager=0x52f050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x531160, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x531160, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0185.897] CloseServiceHandle (hSCObject=0x52f050) returned 1
	[0185.899] lstrlenW (lpString="Appinfo") returned 7
	[0185.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0185.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0185.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0185.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0185.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0185.899] lstrlenW (lpString="AppXSvc") returned 7
	[0185.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0185.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0185.899] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0185.899] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0185.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0185.899] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0185.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0185.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0185.899] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0185.899] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0185.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0185.899] lstrlenW (lpString="Audiosrv") returned 8
	[0185.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0185.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0185.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0185.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0185.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0185.899] lstrlenW (lpString="BFE") returned 3
	[0185.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0185.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0185.900] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0185.900] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0185.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0185.900] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0185.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0185.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0185.900] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0185.900] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0185.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0185.900] lstrlenW (lpString="CDPSvc") returned 6
	[0185.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0185.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0185.900] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0185.900] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0185.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0185.900] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0185.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0185.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0185.900] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0185.900] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0185.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0185.900] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0185.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0185.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0185.900] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0185.900] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0185.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0185.900] lstrlenW (lpString="CryptSvc") returned 8
	[0185.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0185.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0185.901] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0185.901] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0185.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0185.901] lstrlenW (lpString="DcomLaunch") returned 10
	[0185.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0185.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0185.901] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0185.901] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0185.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0185.901] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0185.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0185.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0185.901] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0185.901] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0185.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0185.901] lstrlenW (lpString="Dhcp") returned 4
	[0185.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0185.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0185.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0185.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0185.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0185.901] lstrlenW (lpString="Dnscache") returned 8
	[0185.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0185.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0185.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0185.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0185.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0185.901] lstrlenW (lpString="DPS") returned 3
	[0185.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0185.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0185.901] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0185.902] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0185.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0185.902] lstrlenW (lpString="DusmSvc") returned 7
	[0185.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0185.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0185.902] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0185.902] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0185.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0185.902] lstrlenW (lpString="EventLog") returned 8
	[0185.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0185.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0185.902] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0185.902] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0185.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0185.902] lstrlenW (lpString="EventSystem") returned 11
	[0185.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0185.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0185.902] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0185.902] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0185.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0185.902] lstrlenW (lpString="FontCache") returned 9
	[0185.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0185.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0185.902] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0185.902] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0185.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0185.903] lstrlenW (lpString="gpsvc") returned 5
	[0185.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0185.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0185.903] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0185.903] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0185.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0185.903] lstrlenW (lpString="iphlpsvc") returned 8
	[0185.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0185.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0185.903] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0185.903] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0185.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0185.903] lstrlenW (lpString="KeyIso") returned 6
	[0185.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0185.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0185.903] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0185.903] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0185.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0185.903] lstrlenW (lpString="LanmanServer") returned 12
	[0185.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0185.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0185.903] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0185.903] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0185.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0185.903] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0185.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0185.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0185.903] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0185.903] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0185.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0185.903] lstrlenW (lpString="lfsvc") returned 5
	[0185.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0185.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0185.904] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0185.904] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0185.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0185.904] lstrlenW (lpString="lmhosts") returned 7
	[0185.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0185.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0185.904] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0185.904] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0185.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0185.904] lstrlenW (lpString="LSM") returned 3
	[0185.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0185.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0185.904] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0185.904] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0185.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0185.904] lstrlenW (lpString="MpsSvc") returned 6
	[0185.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0185.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0185.904] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0185.904] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0185.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0185.904] lstrlenW (lpString="NcbService") returned 10
	[0185.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0185.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0185.904] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0185.904] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0185.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0185.904] lstrlenW (lpString="netprofm") returned 8
	[0185.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0185.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0185.904] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0185.905] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0185.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0185.905] lstrlenW (lpString="NgcSvc") returned 6
	[0185.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0185.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0185.905] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0185.905] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0185.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0185.905] lstrlenW (lpString="NlaSvc") returned 6
	[0185.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0185.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0185.905] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0185.905] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0185.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0185.905] lstrlenW (lpString="nsi") returned 3
	[0185.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0185.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0185.905] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0185.905] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0185.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0185.905] lstrlenW (lpString="PcaSvc") returned 6
	[0185.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0185.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0185.905] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0185.905] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0185.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0185.905] lstrlenW (lpString="PlugPlay") returned 8
	[0185.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0185.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0185.905] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0185.905] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0185.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0185.906] lstrlenW (lpString="Power") returned 5
	[0185.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0185.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0185.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0185.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0185.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0185.906] lstrlenW (lpString="ProfSvc") returned 7
	[0185.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0185.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0185.906] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0185.906] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0185.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0185.906] lstrlenW (lpString="RpcEptMapper") returned 12
	[0185.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0185.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0185.906] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0185.906] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0185.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0185.906] lstrlenW (lpString="RpcSs") returned 5
	[0185.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0185.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0185.906] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0185.906] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0185.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0185.906] lstrlenW (lpString="SamSs") returned 5
	[0185.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0185.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0185.906] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0185.906] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0185.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0185.907] lstrlenW (lpString="Schedule") returned 8
	[0185.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0185.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0185.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0185.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0185.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0185.907] lstrlenW (lpString="SecurityHealthService") returned 21
	[0185.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0185.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0185.907] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0185.907] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0185.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0185.907] lstrlenW (lpString="SENS") returned 4
	[0185.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0185.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0185.907] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0185.907] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0185.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0185.907] lstrlenW (lpString="ShellHWDetection") returned 16
	[0185.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0185.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0185.907] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0185.907] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0185.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0185.907] lstrlenW (lpString="Spooler") returned 7
	[0185.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0185.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0185.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0185.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0185.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0185.907] lstrlenW (lpString="StateRepository") returned 15
	[0185.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0185.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0185.908] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0185.908] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0185.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0185.908] lstrlenW (lpString="SysMain") returned 7
	[0185.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0185.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0185.908] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0185.908] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0185.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0185.908] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0185.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0185.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0185.908] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0185.908] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0185.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0185.908] lstrlenW (lpString="Themes") returned 6
	[0185.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0185.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0185.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0185.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0185.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0185.908] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0185.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0185.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0185.908] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0185.908] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0185.909] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x558
	[0185.912] Process32FirstW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0185.913] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0185.913] lstrlenW (lpString="System") returned 6
	[0185.913] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0185.914] lstrlenW (lpString="smss.exe") returned 8
	[0185.914] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0185.914] lstrlenW (lpString="csrss.exe") returned 9
	[0185.914] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0185.914] lstrlenW (lpString="wininit.exe") returned 11
	[0185.914] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0185.915] lstrlenW (lpString="csrss.exe") returned 9
	[0185.915] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0185.915] lstrlenW (lpString="winlogon.exe") returned 12
	[0185.915] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0185.916] lstrlenW (lpString="services.exe") returned 12
	[0185.916] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0185.916] lstrlenW (lpString="lsass.exe") returned 9
	[0185.916] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0185.917] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0185.917] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0185.917] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0185.917] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0185.917] lstrlenW (lpString="svchost.exe") returned 11
	[0185.917] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.031] lstrlenW (lpString="svchost.exe") returned 11
	[0186.031] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0186.032] lstrlenW (lpString="dwm.exe") returned 7
	[0186.032] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.032] lstrlenW (lpString="svchost.exe") returned 11
	[0186.032] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.033] lstrlenW (lpString="svchost.exe") returned 11
	[0186.033] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.033] lstrlenW (lpString="svchost.exe") returned 11
	[0186.033] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.034] lstrlenW (lpString="svchost.exe") returned 11
	[0186.034] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.034] lstrlenW (lpString="svchost.exe") returned 11
	[0186.034] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.035] lstrlenW (lpString="svchost.exe") returned 11
	[0186.035] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.035] lstrlenW (lpString="svchost.exe") returned 11
	[0186.035] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.035] lstrlenW (lpString="svchost.exe") returned 11
	[0186.035] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.036] lstrlenW (lpString="svchost.exe") returned 11
	[0186.036] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.036] lstrlenW (lpString="svchost.exe") returned 11
	[0186.036] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0186.037] lstrlenW (lpString="spoolsv.exe") returned 11
	[0186.037] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.037] lstrlenW (lpString="svchost.exe") returned 11
	[0186.037] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0186.038] lstrlenW (lpString="audiodg.exe") returned 11
	[0186.038] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0186.038] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0186.038] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0186.038] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0186.038] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0186.039] lstrlenW (lpString="sihost.exe") returned 10
	[0186.039] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0186.039] lstrlenW (lpString="Memory Compression") returned 18
	[0186.039] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.040] lstrlenW (lpString="svchost.exe") returned 11
	[0186.040] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0186.040] lstrlenW (lpString="msoia.exe") returned 9
	[0186.040] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0186.041] lstrlenW (lpString="taskhostw.exe") returned 13
	[0186.041] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0186.041] lstrlenW (lpString="explorer.exe") returned 12
	[0186.041] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0186.041] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0186.042] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0186.042] lstrlenW (lpString="SearchUI.exe") returned 12
	[0186.042] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0186.042] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0186.042] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0186.043] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0186.043] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0186.043] lstrlenW (lpString="d2.exe") returned 6
	[0186.043] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0186.044] lstrlenW (lpString="d2.exe") returned 6
	[0186.044] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0186.044] CloseHandle (hObject=0x558) returned 1
	[0186.044] Sleep (dwMilliseconds=0x1f4) 
	[0186.639] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52eda8
	[0186.640] EnumServicesStatusExW (in: hSCManager=0x52eda8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0186.640] GetLastError () returned 0xea
	[0186.640] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x44a6fc8
	[0186.640] EnumServicesStatusExW (in: hSCManager=0x52eda8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44a6fc8, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44a6fc8, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0186.641] CloseServiceHandle (hSCObject=0x52eda8) returned 1
	[0186.642] lstrlenW (lpString="Appinfo") returned 7
	[0186.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0186.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0186.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0186.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0186.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0186.642] lstrlenW (lpString="AppXSvc") returned 7
	[0186.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0186.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0186.642] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0186.642] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0186.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0186.642] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0186.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0186.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0186.642] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0186.642] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0186.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0186.642] lstrlenW (lpString="Audiosrv") returned 8
	[0186.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0186.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0186.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0186.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0186.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0186.642] lstrlenW (lpString="BFE") returned 3
	[0186.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0186.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0186.642] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0186.642] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0186.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0186.642] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0186.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0186.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0186.643] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0186.643] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0186.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0186.643] lstrlenW (lpString="CDPSvc") returned 6
	[0186.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0186.643] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0186.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0186.643] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0186.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0186.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0186.643] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0186.643] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0186.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0186.643] lstrlenW (lpString="CryptSvc") returned 8
	[0186.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0186.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0186.643] lstrlenW (lpString="DcomLaunch") returned 10
	[0186.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0186.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0186.644] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0186.644] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0186.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0186.644] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0186.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0186.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0186.644] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0186.644] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0186.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0186.644] lstrlenW (lpString="Dhcp") returned 4
	[0186.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0186.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0186.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0186.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0186.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0186.644] lstrlenW (lpString="Dnscache") returned 8
	[0186.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0186.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0186.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0186.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0186.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0186.644] lstrlenW (lpString="DPS") returned 3
	[0186.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0186.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0186.644] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0186.644] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0186.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0186.644] lstrlenW (lpString="DusmSvc") returned 7
	[0186.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0186.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0186.644] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0186.645] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0186.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0186.645] lstrlenW (lpString="EventLog") returned 8
	[0186.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0186.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0186.645] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0186.645] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0186.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0186.645] lstrlenW (lpString="EventSystem") returned 11
	[0186.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0186.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0186.645] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0186.645] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0186.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0186.645] lstrlenW (lpString="FontCache") returned 9
	[0186.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0186.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0186.645] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0186.645] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0186.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0186.645] lstrlenW (lpString="gpsvc") returned 5
	[0186.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0186.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0186.645] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0186.645] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0186.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0186.645] lstrlenW (lpString="iphlpsvc") returned 8
	[0186.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0186.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0186.645] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0186.645] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0186.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0186.646] lstrlenW (lpString="KeyIso") returned 6
	[0186.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0186.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0186.646] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0186.646] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0186.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0186.646] lstrlenW (lpString="LanmanServer") returned 12
	[0186.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0186.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0186.646] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0186.646] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0186.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0186.646] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0186.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0186.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0186.646] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0186.646] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0186.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0186.646] lstrlenW (lpString="lfsvc") returned 5
	[0186.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0186.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0186.646] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0186.646] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0186.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0186.646] lstrlenW (lpString="lmhosts") returned 7
	[0186.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0186.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0186.646] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0186.646] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0186.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0186.646] lstrlenW (lpString="LSM") returned 3
	[0186.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0186.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0186.647] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0186.647] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0186.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0186.647] lstrlenW (lpString="MpsSvc") returned 6
	[0186.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0186.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0186.647] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0186.647] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0186.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0186.647] lstrlenW (lpString="NcbService") returned 10
	[0186.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0186.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0186.647] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0186.647] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0186.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0186.647] lstrlenW (lpString="netprofm") returned 8
	[0186.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0186.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0186.647] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0186.647] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0186.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0186.647] lstrlenW (lpString="NgcSvc") returned 6
	[0186.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0186.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0186.647] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0186.647] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0186.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0186.647] lstrlenW (lpString="NlaSvc") returned 6
	[0186.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0186.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0186.648] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0186.648] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0186.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0186.648] lstrlenW (lpString="nsi") returned 3
	[0186.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0186.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0186.648] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0186.648] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0186.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0186.648] lstrlenW (lpString="PcaSvc") returned 6
	[0186.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0186.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0186.648] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0186.648] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0186.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0186.648] lstrlenW (lpString="PlugPlay") returned 8
	[0186.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0186.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0186.648] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0186.648] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0186.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0186.648] lstrlenW (lpString="Power") returned 5
	[0186.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0186.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0186.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0186.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0186.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0186.648] lstrlenW (lpString="ProfSvc") returned 7
	[0186.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0186.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0186.648] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0186.649] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0186.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0186.649] lstrlenW (lpString="RpcEptMapper") returned 12
	[0186.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0186.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0186.649] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0186.649] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0186.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0186.649] lstrlenW (lpString="RpcSs") returned 5
	[0186.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0186.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0186.649] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0186.649] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0186.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0186.649] lstrlenW (lpString="SamSs") returned 5
	[0186.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0186.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0186.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0186.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0186.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0186.649] lstrlenW (lpString="Schedule") returned 8
	[0186.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0186.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0186.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0186.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0186.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0186.649] lstrlenW (lpString="SecurityHealthService") returned 21
	[0186.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0186.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0186.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0186.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0186.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0186.650] lstrlenW (lpString="SENS") returned 4
	[0186.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0186.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0186.650] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0186.650] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0186.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0186.650] lstrlenW (lpString="ShellHWDetection") returned 16
	[0186.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0186.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0186.650] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0186.650] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0186.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0186.650] lstrlenW (lpString="Spooler") returned 7
	[0186.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0186.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0186.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0186.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0186.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0186.650] lstrlenW (lpString="StateRepository") returned 15
	[0186.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0186.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0186.650] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0186.650] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0186.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0186.650] lstrlenW (lpString="SysMain") returned 7
	[0186.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0186.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0186.650] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0186.650] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0186.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0186.650] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0186.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0186.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0186.651] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0186.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0186.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0186.651] lstrlenW (lpString="Themes") returned 6
	[0186.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0186.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0186.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0186.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0186.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0186.651] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0186.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0186.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0186.651] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0186.651] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0186.651] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x558
	[0186.779] Process32FirstW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0186.780] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0186.780] lstrlenW (lpString="System") returned 6
	[0186.780] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0186.781] lstrlenW (lpString="smss.exe") returned 8
	[0186.781] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0186.781] lstrlenW (lpString="csrss.exe") returned 9
	[0186.781] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0186.781] lstrlenW (lpString="wininit.exe") returned 11
	[0186.782] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0186.782] lstrlenW (lpString="csrss.exe") returned 9
	[0186.782] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0186.782] lstrlenW (lpString="winlogon.exe") returned 12
	[0186.782] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0186.783] lstrlenW (lpString="services.exe") returned 12
	[0186.783] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0186.783] lstrlenW (lpString="lsass.exe") returned 9
	[0186.783] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0186.784] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0186.784] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0186.784] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0186.784] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.784] lstrlenW (lpString="svchost.exe") returned 11
	[0186.785] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.785] lstrlenW (lpString="svchost.exe") returned 11
	[0186.785] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0186.785] lstrlenW (lpString="dwm.exe") returned 7
	[0186.785] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.786] lstrlenW (lpString="svchost.exe") returned 11
	[0186.786] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.786] lstrlenW (lpString="svchost.exe") returned 11
	[0186.786] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.787] lstrlenW (lpString="svchost.exe") returned 11
	[0186.787] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.787] lstrlenW (lpString="svchost.exe") returned 11
	[0186.787] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.787] lstrlenW (lpString="svchost.exe") returned 11
	[0186.787] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.788] lstrlenW (lpString="svchost.exe") returned 11
	[0186.788] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.788] lstrlenW (lpString="svchost.exe") returned 11
	[0186.788] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.789] lstrlenW (lpString="svchost.exe") returned 11
	[0186.789] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.789] lstrlenW (lpString="svchost.exe") returned 11
	[0186.789] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.790] lstrlenW (lpString="svchost.exe") returned 11
	[0186.790] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0186.790] lstrlenW (lpString="spoolsv.exe") returned 11
	[0186.790] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.790] lstrlenW (lpString="svchost.exe") returned 11
	[0186.790] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0186.791] lstrlenW (lpString="audiodg.exe") returned 11
	[0186.791] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0186.791] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0186.791] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0186.792] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0186.792] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0186.792] lstrlenW (lpString="sihost.exe") returned 10
	[0186.792] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0186.792] lstrlenW (lpString="Memory Compression") returned 18
	[0186.793] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0186.793] lstrlenW (lpString="svchost.exe") returned 11
	[0186.793] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0186.793] lstrlenW (lpString="msoia.exe") returned 9
	[0186.793] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0186.794] lstrlenW (lpString="taskhostw.exe") returned 13
	[0186.794] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0186.794] lstrlenW (lpString="explorer.exe") returned 12
	[0186.794] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0186.795] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0186.795] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0186.795] lstrlenW (lpString="SearchUI.exe") returned 12
	[0186.795] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0186.795] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0186.796] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0186.796] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0186.796] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0186.796] lstrlenW (lpString="d2.exe") returned 6
	[0186.796] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0186.797] lstrlenW (lpString="d2.exe") returned 6
	[0186.797] Process32NextW (in: hSnapshot=0x558, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0186.797] CloseHandle (hObject=0x558) returned 1
	[0186.797] Sleep (dwMilliseconds=0x1f4) 
	[0187.626] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52f050
	[0187.627] EnumServicesStatusExW (in: hSCManager=0x52f050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 0
	[0187.627] GetLastError () returned 0xea
	[0187.627] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c30) returned 0x44a6fc8
	[0187.628] EnumServicesStatusExW (in: hSCManager=0x52f050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44a6fc8, cbBufSize=0x1c30, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44a6fc8, pcbBytesNeeded=0x269ff3c, lpServicesReturned=0x269ff54, lpResumeHandle=0x0) returned 1
	[0187.628] CloseServiceHandle (hSCObject=0x52f050) returned 1
	[0187.629] lstrlenW (lpString="Appinfo") returned 7
	[0187.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0187.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0187.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0187.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0187.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0187.629] lstrlenW (lpString="AppXSvc") returned 7
	[0187.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0187.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0187.629] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0187.629] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0187.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0187.629] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0187.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0187.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0187.629] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0187.629] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0187.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0187.629] lstrlenW (lpString="Audiosrv") returned 8
	[0187.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0187.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0187.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0187.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0187.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0187.629] lstrlenW (lpString="BFE") returned 3
	[0187.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0187.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0187.630] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0187.630] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0187.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0187.630] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0187.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0187.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0187.630] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0187.630] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0187.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0187.630] lstrlenW (lpString="CDPSvc") returned 6
	[0187.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0187.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0187.630] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0187.630] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0187.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0187.630] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0187.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0187.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0187.630] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0187.630] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0187.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0187.630] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0187.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0187.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0187.630] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0187.630] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0187.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0187.630] lstrlenW (lpString="CryptSvc") returned 8
	[0187.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0187.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0187.631] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0187.631] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0187.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0187.631] lstrlenW (lpString="DcomLaunch") returned 10
	[0187.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0187.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0187.631] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0187.631] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0187.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0187.631] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0187.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0187.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0187.631] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0187.631] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0187.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0187.631] lstrlenW (lpString="Dhcp") returned 4
	[0187.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0187.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0187.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0187.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0187.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0187.631] lstrlenW (lpString="Dnscache") returned 8
	[0187.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0187.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0187.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0187.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0187.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0187.631] lstrlenW (lpString="DPS") returned 3
	[0187.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0187.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0187.632] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0187.632] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0187.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0187.632] lstrlenW (lpString="DusmSvc") returned 7
	[0187.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0187.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0187.632] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0187.632] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0187.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0187.632] lstrlenW (lpString="EventLog") returned 8
	[0187.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0187.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0187.632] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0187.632] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0187.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0187.632] lstrlenW (lpString="EventSystem") returned 11
	[0187.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0187.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0187.632] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0187.632] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0187.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0187.632] lstrlenW (lpString="FontCache") returned 9
	[0187.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0187.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0187.632] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0187.632] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0187.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0187.632] lstrlenW (lpString="gpsvc") returned 5
	[0187.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0187.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0187.632] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0187.633] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0187.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0187.633] lstrlenW (lpString="iphlpsvc") returned 8
	[0187.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0187.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0187.633] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0187.633] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0187.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0187.633] lstrlenW (lpString="KeyIso") returned 6
	[0187.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0187.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0187.633] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0187.633] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0187.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0187.633] lstrlenW (lpString="LanmanServer") returned 12
	[0187.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0187.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0187.633] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0187.633] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0187.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0187.633] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0187.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0187.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0187.633] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0187.633] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0187.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0187.633] lstrlenW (lpString="lfsvc") returned 5
	[0187.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0187.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0187.633] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0187.633] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0187.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0187.634] lstrlenW (lpString="lmhosts") returned 7
	[0187.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0187.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0187.634] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0187.634] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0187.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0187.634] lstrlenW (lpString="LSM") returned 3
	[0187.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0187.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0187.634] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0187.634] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0187.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0187.634] lstrlenW (lpString="MpsSvc") returned 6
	[0187.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0187.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0187.634] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0187.634] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0187.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0187.634] lstrlenW (lpString="NcbService") returned 10
	[0187.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0187.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0187.634] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0187.634] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0187.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0187.634] lstrlenW (lpString="netprofm") returned 8
	[0187.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0187.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0187.634] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0187.634] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0187.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0187.634] lstrlenW (lpString="NgcSvc") returned 6
	[0187.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0187.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0187.635] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0187.635] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0187.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0187.635] lstrlenW (lpString="NlaSvc") returned 6
	[0187.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0187.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0187.635] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0187.635] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0187.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0187.635] lstrlenW (lpString="nsi") returned 3
	[0187.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0187.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0187.635] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0187.635] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0187.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0187.635] lstrlenW (lpString="PcaSvc") returned 6
	[0187.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0187.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0187.635] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0187.635] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0187.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0187.635] lstrlenW (lpString="PlugPlay") returned 8
	[0187.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0187.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0187.635] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0187.635] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0187.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0187.635] lstrlenW (lpString="Power") returned 5
	[0187.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0187.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0187.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0187.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0187.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0187.636] lstrlenW (lpString="ProfSvc") returned 7
	[0187.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0187.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0187.636] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0187.636] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0187.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0187.636] lstrlenW (lpString="RpcEptMapper") returned 12
	[0187.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0187.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0187.636] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0187.636] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0187.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0187.636] lstrlenW (lpString="RpcSs") returned 5
	[0187.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0187.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0187.636] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0187.636] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0187.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0187.636] lstrlenW (lpString="SamSs") returned 5
	[0187.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0187.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0187.636] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0187.636] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0187.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0187.636] lstrlenW (lpString="Schedule") returned 8
	[0187.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0187.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0187.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0187.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0187.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0187.637] lstrlenW (lpString="SecurityHealthService") returned 21
	[0187.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0187.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0187.637] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0187.637] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0187.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0187.637] lstrlenW (lpString="SENS") returned 4
	[0187.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0187.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0187.637] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0187.637] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0187.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0187.637] lstrlenW (lpString="ShellHWDetection") returned 16
	[0187.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0187.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0187.637] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0187.637] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0187.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0187.637] lstrlenW (lpString="Spooler") returned 7
	[0187.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0187.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0187.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0187.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0187.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0187.637] lstrlenW (lpString="StateRepository") returned 15
	[0187.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0187.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0187.638] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0187.638] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0187.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0187.638] lstrlenW (lpString="SysMain") returned 7
	[0187.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0187.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0187.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0187.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0187.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0187.638] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0187.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0187.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0187.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0187.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0187.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0187.638] lstrlenW (lpString="Themes") returned 6
	[0187.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0187.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0187.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0187.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0187.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0187.638] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0187.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0187.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0187.638] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0187.638] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0187.638] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d8
	[0187.988] Process32FirstW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0187.989] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0187.989] lstrlenW (lpString="System") returned 6
	[0187.989] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0187.990] lstrlenW (lpString="smss.exe") returned 8
	[0187.990] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0187.990] lstrlenW (lpString="csrss.exe") returned 9
	[0187.990] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0187.991] lstrlenW (lpString="wininit.exe") returned 11
	[0187.991] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0187.991] lstrlenW (lpString="csrss.exe") returned 9
	[0187.991] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0187.991] lstrlenW (lpString="winlogon.exe") returned 12
	[0187.991] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0187.992] lstrlenW (lpString="services.exe") returned 12
	[0187.992] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1f0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0187.992] lstrlenW (lpString="lsass.exe") returned 9
	[0187.992] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0187.993] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0187.993] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0187.993] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0187.993] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.994] lstrlenW (lpString="svchost.exe") returned 11
	[0187.994] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.994] lstrlenW (lpString="svchost.exe") returned 11
	[0187.994] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0187.994] lstrlenW (lpString="dwm.exe") returned 7
	[0187.994] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.995] lstrlenW (lpString="svchost.exe") returned 11
	[0187.995] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.995] lstrlenW (lpString="svchost.exe") returned 11
	[0187.995] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.996] lstrlenW (lpString="svchost.exe") returned 11
	[0187.996] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.996] lstrlenW (lpString="svchost.exe") returned 11
	[0187.996] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x300, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.997] lstrlenW (lpString="svchost.exe") returned 11
	[0187.997] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.997] lstrlenW (lpString="svchost.exe") returned 11
	[0187.997] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.997] lstrlenW (lpString="svchost.exe") returned 11
	[0187.997] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.998] lstrlenW (lpString="svchost.exe") returned 11
	[0187.998] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.998] lstrlenW (lpString="svchost.exe") returned 11
	[0187.998] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.999] lstrlenW (lpString="svchost.exe") returned 11
	[0187.999] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0187.999] lstrlenW (lpString="spoolsv.exe") returned 11
	[0187.999] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.000] lstrlenW (lpString="svchost.exe") returned 11
	[0188.000] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0188.000] lstrlenW (lpString="audiodg.exe") returned 11
	[0188.000] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0188.001] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0188.001] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0188.001] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0188.001] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0188.002] lstrlenW (lpString="sihost.exe") returned 10
	[0188.002] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0188.002] lstrlenW (lpString="Memory Compression") returned 18
	[0188.002] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.002] lstrlenW (lpString="svchost.exe") returned 11
	[0188.002] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x198, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0188.003] lstrlenW (lpString="msoia.exe") returned 9
	[0188.003] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x198, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0188.003] lstrlenW (lpString="taskhostw.exe") returned 13
	[0188.003] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0188.004] lstrlenW (lpString="explorer.exe") returned 12
	[0188.004] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0188.004] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0188.004] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0188.005] lstrlenW (lpString="SearchUI.exe") returned 12
	[0188.005] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0188.005] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0188.005] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0188.005] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0188.006] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0188.006] lstrlenW (lpString="d2.exe") returned 6
	[0188.006] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 1
	[0188.006] lstrlenW (lpString="d2.exe") returned 6
	[0188.006] Process32NextW (in: hSnapshot=0x3d8, lppe=0x269fd2c | out: lppe=0x269fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="d2.exe")) returned 0
	[0188.007] CloseHandle (hObject=0x3d8) returned 1
	[0188.007] Sleep (dwMilliseconds=0x1f4) 

Thread:
	id = 35
	os_tid = 0xdec

	[0153.405] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e138
	[0153.405] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x561a40
	[0153.406] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e150
	[0153.406] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e150, Size=0x20) returned 0x4f2168
	[0153.406] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e000
	[0153.406] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e000, Size=0x20) returned 0x4f2190
	[0153.406] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0153.406] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0153.406] Wow64DisableWow64FsRedirection (in: OldValue=0x279ff20 | out: OldValue=0x279ff20*=0x0) returned 1
	[0153.406] lstrlenW (lpString="kernel32.dll") returned 12
	[0153.406] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2168 | out: hHeap=0x4c0000) returned 1
	[0153.406] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0153.406] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2190 | out: hHeap=0x4c0000) returned 1
	[0153.406] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x561a40, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe")) returned 0x43
	[0153.406] ShellExecuteExW (in: pExecInfo=0x279ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x279ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0174.965] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x3e6f538
	[0174.965] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x3e6f538, Size=0x20) returned 0x52ec68
	[0174.965] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x3e6f760
	[0174.965] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x3e6f760, Size=0x20) returned 0x52ef10
	[0174.966] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0174.966] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0174.966] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0
	[0174.971] lstrlenW (lpString="kernel32.dll") returned 12
	[0174.971] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52ef10 | out: hHeap=0x4c0000) returned 1
	[0174.971] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0174.971] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52ec68 | out: hHeap=0x4c0000) returned 1
	[0174.971] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x561a40 | out: hHeap=0x4c0000) returned 1
	[0174.971] lstrlenW (lpString="runas") returned 5
	[0174.971] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52e138 | out: hHeap=0x4c0000) returned 1
	[0174.971] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0174.971] ReleaseMutex (hMutex=0x1f0) returned 1
	[0174.971] Sleep (dwMilliseconds=0x1f4) 
	[0175.721] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0175.721] ReleaseMutex (hMutex=0x1f0) returned 1
	[0175.722] Sleep (dwMilliseconds=0x1f4) 
	[0176.485] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0176.485] ReleaseMutex (hMutex=0x1f0) returned 1
	[0176.485] Sleep (dwMilliseconds=0x1f4) 
	[0177.096] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0177.096] ReleaseMutex (hMutex=0x1f0) returned 1
	[0177.096] Sleep (dwMilliseconds=0x1f4) 
	[0178.034] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0178.034] ReleaseMutex (hMutex=0x1f0) returned 1
	[0178.034] Sleep (dwMilliseconds=0x1f4) 
	[0178.635] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0178.635] ReleaseMutex (hMutex=0x1f0) returned 1
	[0178.635] Sleep (dwMilliseconds=0x1f4) 
	[0179.411] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0179.411] ReleaseMutex (hMutex=0x1f0) returned 1
	[0179.411] Sleep (dwMilliseconds=0x1f4) 
	[0180.325] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0180.325] ReleaseMutex (hMutex=0x1f0) returned 1
	[0180.325] Sleep (dwMilliseconds=0x1f4) 
	[0180.886] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0180.886] ReleaseMutex (hMutex=0x1f0) returned 1
	[0180.886] Sleep (dwMilliseconds=0x1f4) 
	[0181.651] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0181.651] ReleaseMutex (hMutex=0x1f0) returned 1
	[0181.651] Sleep (dwMilliseconds=0x1f4) 
	[0182.404] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0182.405] ReleaseMutex (hMutex=0x1f0) returned 1
	[0182.405] Sleep (dwMilliseconds=0x1f4) 
	[0183.278] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0183.278] ReleaseMutex (hMutex=0x1f0) returned 1
	[0183.279] Sleep (dwMilliseconds=0x1f4) 
	[0183.841] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0183.841] ReleaseMutex (hMutex=0x1f0) returned 1
	[0183.841] Sleep (dwMilliseconds=0x1f4) 
	[0184.692] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0184.692] ReleaseMutex (hMutex=0x1f0) returned 1
	[0184.692] Sleep (dwMilliseconds=0x1f4) 
	[0185.233] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0185.233] ReleaseMutex (hMutex=0x1f0) returned 1
	[0185.233] Sleep (dwMilliseconds=0x1f4) 
	[0185.817] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0185.817] ReleaseMutex (hMutex=0x1f0) returned 1
	[0185.818] Sleep (dwMilliseconds=0x1f4) 
	[0186.496] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0186.496] ReleaseMutex (hMutex=0x1f0) returned 1
	[0186.496] Sleep (dwMilliseconds=0x1f4) 
	[0187.230] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0187.230] ReleaseMutex (hMutex=0x1f0) returned 1
	[0187.230] Sleep (dwMilliseconds=0x1f4) 
	[0188.059] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0188.059] ReleaseMutex (hMutex=0x1f0) returned 1
	[0188.059] Sleep (dwMilliseconds=0x1f4) 

Thread:
	id = 36
	os_tid = 0xdf0

	[0153.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x53f210
	[0153.200] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x53f210, Size=0x20) returned 0x4f21e0
	[0153.200] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f21e0, Size=0x40) returned 0x4ebb40
	[0153.200] GetLogicalDrives () returned 0x4
	[0153.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x53fff8
	[0153.201] GetComputerNameW (in: lpBuffer=0x53fffc, nSize=0x289ff64 | out: lpBuffer="NQDPDE", nSize=0x289ff64) returned 1
	[0153.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1000) returned 0x550000
	[0153.201] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x289ff34 | out: lphEnum=0x289ff34*=0x4eaad0) returned 0x0
	[0153.201] WNetEnumResourceW (in: hEnum=0x4eaad0, lpcCount=0x289ff30, lpBuffer=0x550000, lpBufferSize=0x289ff38 | out: lpcCount=0x289ff30, lpBuffer=0x550000, lpBufferSize=0x289ff38) returned 0x103
	[0153.201] WNetCloseEnum (hEnum=0x4eaad0) returned 0x0
	[0153.201] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x289ff34 | out: lphEnum=0x289ff34*=0x4ef310) returned 0x0
	[0153.507] WNetEnumResourceW (in: hEnum=0x4ef310, lpcCount=0x289ff30, lpBuffer=0x550000, lpBufferSize=0x289ff38 | out: lpcCount=0x289ff30, lpBuffer=0x550000, lpBufferSize=0x289ff38) returned 0x0
	[0153.507] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1000) returned 0x534d70
	[0153.507] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x550000, lphEnum=0x289ff08 | out: lphEnum=0x289ff08*=0x4ea450) returned 0x0
	[0153.512] WNetEnumResourceW (in: hEnum=0x4ea450, lpcCount=0x289ff04, lpBuffer=0x534d70, lpBufferSize=0x289ff0c | out: lpcCount=0x289ff04, lpBuffer=0x534d70, lpBufferSize=0x289ff0c) returned 0x103
	[0153.513] WNetCloseEnum (hEnum=0x4ea450) returned 0x0
	[0153.513] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1000) returned 0x537498
	[0153.513] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x550020, lphEnum=0x289ff08 | out: lphEnum=0x289ff08*=0x0) returned 0x4b8
	[0168.522] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1000) returned 0x4547070
	[0168.522] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x550040, lphEnum=0x289ff08 | out: lphEnum=0x289ff08*=0x0) returned 0x4c6
	[0168.528] WNetEnumResourceW (in: hEnum=0x4ef310, lpcCount=0x289ff30, lpBuffer=0x550000, lpBufferSize=0x289ff38 | out: lpcCount=0x289ff30, lpBuffer=0x550000, lpBufferSize=0x289ff38) returned 0x103
	[0168.528] WNetCloseEnum (hEnum=0x4ef310) returned 0x0
	[0168.528] GetLogicalDrives () returned 0x4
	[0168.528] Sleep (dwMilliseconds=0x64) 
	[0168.913] GetLogicalDrives () returned 0x4
	[0168.913] Sleep (dwMilliseconds=0x64) 
	[0169.120] GetLogicalDrives () returned 0x4
	[0169.120] Sleep (dwMilliseconds=0x64) 
	[0169.477] GetLogicalDrives () returned 0x4
	[0169.477] Sleep (dwMilliseconds=0x64) 
	[0169.683] GetLogicalDrives () returned 0x4
	[0169.683] Sleep (dwMilliseconds=0x64) 
	[0169.973] GetLogicalDrives () returned 0x4
	[0169.974] Sleep (dwMilliseconds=0x64) 
	[0170.335] GetLogicalDrives () returned 0x4
	[0170.335] Sleep (dwMilliseconds=0x64) 
	[0170.960] GetLogicalDrives () returned 0x4
	[0170.960] Sleep (dwMilliseconds=0x64) 
	[0171.323] GetLogicalDrives () returned 0x4
	[0171.323] Sleep (dwMilliseconds=0x64) 
	[0171.661] GetLogicalDrives () returned 0x4
	[0171.661] Sleep (dwMilliseconds=0x64) 
	[0172.028] GetLogicalDrives () returned 0x4
	[0172.028] Sleep (dwMilliseconds=0x64) 
	[0172.196] GetLogicalDrives () returned 0x4
	[0172.196] Sleep (dwMilliseconds=0x64) 
	[0172.455] GetLogicalDrives () returned 0x4
	[0172.455] Sleep (dwMilliseconds=0x64) 
	[0172.600] GetLogicalDrives () returned 0x4
	[0172.600] Sleep (dwMilliseconds=0x64) 
	[0172.986] GetLogicalDrives () returned 0x4
	[0172.986] Sleep (dwMilliseconds=0x64) 
	[0173.410] GetLogicalDrives () returned 0x4
	[0173.410] Sleep (dwMilliseconds=0x64) 
	[0173.853] GetLogicalDrives () returned 0x4
	[0173.853] Sleep (dwMilliseconds=0x64) 
	[0174.065] GetLogicalDrives () returned 0x4
	[0174.065] Sleep (dwMilliseconds=0x64) 
	[0174.322] GetLogicalDrives () returned 0x4
	[0174.322] Sleep (dwMilliseconds=0x64) 
	[0174.571] GetLogicalDrives () returned 0x4
	[0174.571] Sleep (dwMilliseconds=0x64) 
	[0174.800] GetLogicalDrives () returned 0x4
	[0174.800] Sleep (dwMilliseconds=0x64) 
	[0174.971] GetLogicalDrives () returned 0x4
	[0174.971] Sleep (dwMilliseconds=0x64) 
	[0175.166] GetLogicalDrives () returned 0x4
	[0175.166] Sleep (dwMilliseconds=0x64) 
	[0175.400] GetLogicalDrives () returned 0x4
	[0175.400] Sleep (dwMilliseconds=0x64) 
	[0175.727] GetLogicalDrives () returned 0x4
	[0175.727] Sleep (dwMilliseconds=0x64) 
	[0175.982] GetLogicalDrives () returned 0x4
	[0175.982] Sleep (dwMilliseconds=0x64) 
	[0176.348] GetLogicalDrives () returned 0x4
	[0176.348] Sleep (dwMilliseconds=0x64) 
	[0176.679] GetLogicalDrives () returned 0x4
	[0176.679] Sleep (dwMilliseconds=0x64) 
	[0176.885] GetLogicalDrives () returned 0x4
	[0176.886] Sleep (dwMilliseconds=0x64) 
	[0177.095] GetLogicalDrives () returned 0x4
	[0177.095] Sleep (dwMilliseconds=0x64) 
	[0177.369] GetLogicalDrives () returned 0x4
	[0177.369] Sleep (dwMilliseconds=0x64) 
	[0177.965] GetLogicalDrives () returned 0x4
	[0177.965] Sleep (dwMilliseconds=0x64) 
	[0178.307] GetLogicalDrives () returned 0x4
	[0178.308] Sleep (dwMilliseconds=0x64) 
	[0178.550] GetLogicalDrives () returned 0x4
	[0178.550] Sleep (dwMilliseconds=0x64) 
	[0178.785] GetLogicalDrives () returned 0x4
	[0178.785] Sleep (dwMilliseconds=0x64) 
	[0179.306] GetLogicalDrives () returned 0x4
	[0179.306] Sleep (dwMilliseconds=0x64) 
	[0179.480] GetLogicalDrives () returned 0x4
	[0179.480] Sleep (dwMilliseconds=0x64) 
	[0179.604] GetLogicalDrives () returned 0x4
	[0179.604] Sleep (dwMilliseconds=0x64) 
	[0180.000] GetLogicalDrives () returned 0x4
	[0180.013] Sleep (dwMilliseconds=0x64) 
	[0180.435] GetLogicalDrives () returned 0x4
	[0180.435] Sleep (dwMilliseconds=0x64) 
	[0180.727] GetLogicalDrives () returned 0x4
	[0180.727] Sleep (dwMilliseconds=0x64) 
	[0180.886] GetLogicalDrives () returned 0x4
	[0180.886] Sleep (dwMilliseconds=0x64) 
	[0181.116] GetLogicalDrives () returned 0x4
	[0181.116] Sleep (dwMilliseconds=0x64) 
	[0181.286] GetLogicalDrives () returned 0x4
	[0181.286] Sleep (dwMilliseconds=0x64) 
	[0181.652] GetLogicalDrives () returned 0x4
	[0181.652] Sleep (dwMilliseconds=0x64) 
	[0182.134] GetLogicalDrives () returned 0x4
	[0182.134] Sleep (dwMilliseconds=0x64) 
	[0182.493] GetLogicalDrives () returned 0x4
	[0182.493] Sleep (dwMilliseconds=0x64) 
	[0182.639] GetLogicalDrives () returned 0x4
	[0182.639] Sleep (dwMilliseconds=0x64) 
	[0182.957] GetLogicalDrives () returned 0x4
	[0182.957] Sleep (dwMilliseconds=0x64) 
	[0183.388] GetLogicalDrives () returned 0x4
	[0183.388] Sleep (dwMilliseconds=0x64) 
	[0183.514] GetLogicalDrives () returned 0x4
	[0183.514] Sleep (dwMilliseconds=0x64) 
	[0183.663] GetLogicalDrives () returned 0x4
	[0183.663] Sleep (dwMilliseconds=0x64) 
	[0183.841] GetLogicalDrives () returned 0x4
	[0183.841] Sleep (dwMilliseconds=0x64) 
	[0184.331] GetLogicalDrives () returned 0x4
	[0184.350] Sleep (dwMilliseconds=0x64) 
	[0184.723] GetLogicalDrives () returned 0x4
	[0184.723] Sleep (dwMilliseconds=0x64) 
	[0185.045] GetLogicalDrives () returned 0x4
	[0185.045] Sleep (dwMilliseconds=0x64) 
	[0185.184] GetLogicalDrives () returned 0x4
	[0185.184] Sleep (dwMilliseconds=0x64) 
	[0185.333] GetLogicalDrives () returned 0x4
	[0185.333] Sleep (dwMilliseconds=0x64) 
	[0185.594] GetLogicalDrives () returned 0x4
	[0185.594] Sleep (dwMilliseconds=0x64) 
	[0185.814] GetLogicalDrives () returned 0x4
	[0185.814] Sleep (dwMilliseconds=0x64) 
	[0186.030] GetLogicalDrives () returned 0x4
	[0186.030] Sleep (dwMilliseconds=0x64) 
	[0186.398] GetLogicalDrives () returned 0x4
	[0186.398] Sleep (dwMilliseconds=0x64) 
	[0186.545] GetLogicalDrives () returned 0x4
	[0186.545] Sleep (dwMilliseconds=0x64) 
	[0186.764] GetLogicalDrives () returned 0x4
	[0186.775] Sleep (dwMilliseconds=0x64) 
	[0187.157] GetLogicalDrives () returned 0x4
	[0187.157] Sleep (dwMilliseconds=0x64) 
	[0187.585] GetLogicalDrives () returned 0x4
	[0187.585] Sleep (dwMilliseconds=0x64) 
	[0188.022] GetLogicalDrives () returned 0x4
	[0188.022] Sleep (dwMilliseconds=0x64) 

Thread:
	id = 38
	os_tid = 0xdfc

	[0153.509] GetTickCount () returned 0x113a2ce
	[0153.509] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x24) returned 0x5366e0
	[0153.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5366e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0
	[0153.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5366e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4
	[0153.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5366e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8
	[0153.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5366e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc
	[0153.511] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e1b0
	[0153.511] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e1b0, Size=0x20) returned 0x4f2780
	[0153.511] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e468
	[0153.511] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e468, Size=0x20) returned 0x4f2870
	[0153.512] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0153.512] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0153.512] Wow64DisableWow64FsRedirection (in: OldValue=0x2d9ff7c | out: OldValue=0x2d9ff7c*=0x0) returned 1
	[0153.512] lstrlenW (lpString="kernel32.dll") returned 12
	[0153.512] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2780 | out: hHeap=0x4c0000) returned 1
	[0153.512] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0153.512] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2870 | out: hHeap=0x4c0000) returned 1
	[0153.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x51a5e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0
	[0153.512] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0153.840] GetTickCount () returned 0x113a416
	[0153.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0154.233] GetTickCount () returned 0x113a5ac
	[0154.233] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0154.436] GetTickCount () returned 0x113a668
	[0154.436] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0154.722] GetTickCount () returned 0x113a781
	[0154.722] GetTickCount () returned 0x113a781
	[0154.722] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0154.935] GetTickCount () returned 0x113a85c
	[0154.935] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0155.359] GetTickCount () returned 0x113aa11
	[0155.359] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0155.573] GetTickCount () returned 0x113aaec
	[0155.573] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0155.799] GetTickCount () returned 0x113abc7
	[0155.799] GetTickCount () returned 0x113abc7
	[0155.799] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0156.047] GetTickCount () returned 0x113acc1
	[0156.047] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0156.211] GetTickCount () returned 0x113ad5d
	[0156.211] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0156.630] GetTickCount () returned 0x113af03
	[0156.630] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0156.953] GetTickCount () returned 0x113b04b
	[0156.953] GetTickCount () returned 0x113b04b
	[0156.953] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0157.196] GetTickCount () returned 0x113b135
	[0157.196] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0157.460] GetTickCount () returned 0x113b23f
	[0157.461] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0157.679] GetTickCount () returned 0x113b31a
	[0157.682] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0158.035] GetTickCount () returned 0x113b481
	[0158.035] GetTickCount () returned 0x113b481
	[0158.035] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0158.253] GetTickCount () returned 0x113b55c
	[0158.253] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0158.462] GetTickCount () returned 0x113b627
	[0158.462] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0158.807] GetTickCount () returned 0x113b78e
	[0158.807] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0159.183] GetTickCount () returned 0x113b8f6
	[0159.183] GetTickCount () returned 0x113b8f6
	[0159.183] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0159.475] GetTickCount () returned 0x113ba1e
	[0159.475] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0159.798] GetTickCount () returned 0x113bb57
	[0159.798] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0160.284] GetTickCount () returned 0x113bd4b
	[0160.284] GetTickCount () returned 0x113bd4b
	[0160.284] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0160.461] GetTickCount () returned 0x113bdf7
	[0160.461] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0160.704] GetTickCount () returned 0x113bee1
	[0160.704] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0160.878] GetTickCount () returned 0x113bf9d
	[0160.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0161.094] GetTickCount () returned 0x113c068
	[0161.094] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0161.457] GetTickCount () returned 0x113c1df
	[0161.457] GetTickCount () returned 0x113c1df
	[0161.457] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0161.706] GetTickCount () returned 0x113c2d9
	[0161.706] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0162.228] GetTickCount () returned 0x113c4dc
	[0162.228] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0162.724] GetTickCount () returned 0x113c6d0
	[0162.724] GetTickCount () returned 0x113c6d0
	[0162.724] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0162.999] GetTickCount () returned 0x113c7da
	[0162.999] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0163.538] GetTickCount () returned 0x113c9fd
	[0163.538] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0163.944] GetTickCount () returned 0x113cb93
	[0163.944] GetTickCount () returned 0x113cb93
	[0163.944] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0164.396] GetTickCount () returned 0x113cd58
	[0164.396] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0164.536] GetTickCount () returned 0x113cdd5
	[0164.536] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0164.675] GetTickCount () returned 0x113ce62
	[0164.675] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0165.274] GetTickCount () returned 0x113d0c3
	[0165.274] GetTickCount () returned 0x113d0c3
	[0165.274] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0165.911] GetTickCount () returned 0x113d344
	[0165.911] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0166.108] GetTickCount () returned 0x113d40f
	[0166.108] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0166.411] GetTickCount () returned 0x113d538
	[0166.411] GetTickCount () returned 0x113d538
	[0166.411] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0166.523] GetTickCount () returned 0x113d5b5
	[0166.523] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0166.886] GetTickCount () returned 0x113d71c
	[0166.886] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0167.262] GetTickCount () returned 0x113d893
	[0167.262] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0167.538] GetTickCount () returned 0x113d9ad
	[0167.538] GetTickCount () returned 0x113d9ad
	[0167.538] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0168.448] GetTickCount () returned 0x113dd37
	[0168.449] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0168.635] GetTickCount () returned 0x113ddf2
	[0168.635] GetTickCount () returned 0x113ddf2
	[0168.635] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0169.094] GetTickCount () returned 0x113dfb7
	[0169.094] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0169.474] GetTickCount () returned 0x113e12e
	[0169.474] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0169.612] GetTickCount () returned 0x113e1bb
	[0169.612] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0169.848] GetTickCount () returned 0x113e2a5
	[0169.848] GetTickCount () returned 0x113e2a5
	[0169.848] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0170.034] GetTickCount () returned 0x113e361
	[0170.034] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0170.377] GetTickCount () returned 0x113e4b9
	[0170.377] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0170.960] GetTickCount () returned 0x113e70a
	[0170.961] GetTickCount () returned 0x113e70a
	[0170.961] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0171.323] GetTickCount () returned 0x113e872
	[0171.323] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0171.662] GetTickCount () returned 0x113e9ba
	[0171.662] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0172.029] GetTickCount () returned 0x113eb31
	[0172.029] GetTickCount () returned 0x113eb31
	[0172.029] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0172.196] GetTickCount () returned 0x113ebdd
	[0172.196] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0172.455] GetTickCount () returned 0x113ecd7
	[0172.455] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0172.600] GetTickCount () returned 0x113ed63
	[0172.600] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0172.987] GetTickCount () returned 0x113eeea
	[0172.987] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0173.410] GetTickCount () returned 0x113f090
	[0173.410] GetTickCount () returned 0x113f090
	[0173.410] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0173.854] GetTickCount () returned 0x113f245
	[0173.854] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0174.064] GetTickCount () returned 0x113f320
	[0174.064] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0174.322] GetTickCount () returned 0x113f41a
	[0174.322] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0174.561] GetTickCount () returned 0x113f505
	[0174.561] GetTickCount () returned 0x113f505
	[0174.561] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0174.799] GetTickCount () returned 0x113f5ff
	[0174.800] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0174.972] GetTickCount () returned 0x113f6aa
	[0174.972] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0175.166] GetTickCount () returned 0x113f766
	[0175.166] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0175.361] GetTickCount () returned 0x113f831
	[0175.361] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0175.698] GetTickCount () returned 0x113f989
	[0175.708] GetTickCount () returned 0x113f989
	[0175.718] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0175.980] GetTickCount () returned 0x113fa92
	[0175.980] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0176.348] GetTickCount () returned 0x113fc09
	[0176.348] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0176.680] GetTickCount () returned 0x113fd52
	[0176.680] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0176.886] GetTickCount () returned 0x113fe2c
	[0176.886] GetTickCount () returned 0x113fe2c
	[0176.886] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0177.096] GetTickCount () returned 0x113fef7
	[0177.096] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0177.369] GetTickCount () returned 0x1140011
	[0177.369] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0177.965] GetTickCount () returned 0x1140262
	[0177.965] GetTickCount () returned 0x1140262
	[0177.965] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0178.308] GetTickCount () returned 0x11403ba
	[0178.308] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0178.551] GetTickCount () returned 0x11404a5
	[0178.551] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0178.785] GetTickCount () returned 0x114058f
	[0178.785] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0179.305] GetTickCount () returned 0x1140793
	[0179.305] GetTickCount () returned 0x1140793
	[0179.305] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0179.479] GetTickCount () returned 0x114084e
	[0179.479] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0179.604] GetTickCount () returned 0x11408cb
	[0179.604] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0180.024] GetTickCount () returned 0x1140a71
	[0180.024] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0180.435] GetTickCount () returned 0x1140c07
	[0180.435] GetTickCount () returned 0x1140c07
	[0180.435] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0180.728] GetTickCount () returned 0x1140d30
	[0180.728] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0180.886] GetTickCount () returned 0x1140dcc
	[0180.886] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0181.117] GetTickCount () returned 0x1140ea7
	[0181.117] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0181.286] GetTickCount () returned 0x1140f53
	[0181.286] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0181.646] GetTickCount () returned 0x11410ba
	[0181.646] GetTickCount () returned 0x11410ba
	[0181.646] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0182.134] GetTickCount () returned 0x11412ae
	[0182.134] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0182.493] GetTickCount () returned 0x1141416
	[0182.493] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0182.639] GetTickCount () returned 0x11414a2
	[0182.639] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0182.956] GetTickCount () returned 0x11415db
	[0182.956] GetTickCount () returned 0x11415db
	[0182.957] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0183.389] GetTickCount () returned 0x1141790
	[0183.389] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0183.514] GetTickCount () returned 0x114180d
	[0183.514] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0183.663] GetTickCount () returned 0x114189a
	[0183.663] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0183.841] GetTickCount () returned 0x1141955
	[0183.841] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0184.355] GetTickCount () returned 0x1141b49
	[0184.355] GetTickCount () returned 0x1141b49
	[0184.355] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0184.722] GetTickCount () returned 0x1141cc0
	[0184.722] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0185.045] GetTickCount () returned 0x1141e09
	[0185.045] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0185.185] GetTickCount () returned 0x1141e95
	[0185.185] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0185.333] GetTickCount () returned 0x1141f22
	[0185.333] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0185.594] GetTickCount () returned 0x114202b
	[0185.594] GetTickCount () returned 0x114202b
	[0185.594] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0185.814] GetTickCount () returned 0x1142106
	[0185.814] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0186.030] GetTickCount () returned 0x11421e1
	[0186.030] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0186.398] GetTickCount () returned 0x1142348
	[0186.398] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0186.543] GetTickCount () returned 0x11423e5
	[0186.544] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0186.775] GetTickCount () returned 0x11424bf
	[0186.775] GetTickCount () returned 0x11424bf
	[0186.775] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0187.016] GetTickCount () returned 0x11425b9
	[0187.016] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0187.364] GetTickCount () returned 0x1142721
	[0187.388] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) returned 0x102
	[0187.874] GetTickCount () returned 0x1142905
	[0187.874] GetTickCount () returned 0x1142905
	[0187.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x64) 

Thread:
	id = 39
	os_tid = 0xe00

	[0153.612] GetTickCount () returned 0x113a33b
	[0153.612] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x24) returned 0x5365c0
	[0153.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5365c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8
	[0153.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5365c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc
	[0153.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5365c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300
	[0153.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5365c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304
	[0153.614] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e3a8
	[0153.614] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e3a8, Size=0x20) returned 0x4f27f8
	[0153.614] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e390
	[0153.614] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e390, Size=0x20) returned 0x4f2848
	[0153.615] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0153.615] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0153.615] Wow64DisableWow64FsRedirection (in: OldValue=0x2e9ff7c | out: OldValue=0x2e9ff7c*=0x0) returned 1
	[0153.615] lstrlenW (lpString="kernel32.dll") returned 12
	[0153.615] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f27f8 | out: hHeap=0x4c0000) returned 1
	[0153.615] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0153.615] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2848 | out: hHeap=0x4c0000) returned 1
	[0153.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x551a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308
	[0153.616] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0153.841] GetTickCount () returned 0x113a425
	[0153.841] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0154.233] GetTickCount () returned 0x113a5ac
	[0154.233] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0154.436] GetTickCount () returned 0x113a668
	[0154.436] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0154.722] GetTickCount () returned 0x113a781
	[0154.722] GetTickCount () returned 0x113a781
	[0154.722] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0154.935] GetTickCount () returned 0x113a85c
	[0154.935] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0155.360] GetTickCount () returned 0x113aa11
	[0155.360] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0155.573] GetTickCount () returned 0x113aaec
	[0155.573] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0155.799] GetTickCount () returned 0x113abc7
	[0155.799] GetTickCount () returned 0x113abc7
	[0155.799] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0156.047] GetTickCount () returned 0x113acc1
	[0156.047] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0156.211] GetTickCount () returned 0x113ad5d
	[0156.211] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0156.630] GetTickCount () returned 0x113af03
	[0156.630] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0156.953] GetTickCount () returned 0x113b04b
	[0156.953] GetTickCount () returned 0x113b04b
	[0156.953] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0157.196] GetTickCount () returned 0x113b135
	[0157.196] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0157.462] GetTickCount () returned 0x113b23f
	[0157.462] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0157.698] GetTickCount () returned 0x113b339
	[0157.698] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0158.035] GetTickCount () returned 0x113b481
	[0158.035] GetTickCount () returned 0x113b481
	[0158.035] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0158.253] GetTickCount () returned 0x113b55c
	[0158.253] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0158.463] GetTickCount () returned 0x113b627
	[0158.463] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0158.807] GetTickCount () returned 0x113b78e
	[0158.807] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0159.181] GetTickCount () returned 0x113b8f6
	[0159.183] GetTickCount () returned 0x113b8f6
	[0159.183] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0159.458] GetTickCount () returned 0x113ba0f
	[0159.475] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0159.798] GetTickCount () returned 0x113bb57
	[0159.798] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0160.284] GetTickCount () returned 0x113bd4b
	[0160.284] GetTickCount () returned 0x113bd4b
	[0160.284] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0160.461] GetTickCount () returned 0x113bdf7
	[0160.461] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0160.704] GetTickCount () returned 0x113bee1
	[0160.704] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0160.878] GetTickCount () returned 0x113bf9d
	[0160.878] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0161.095] GetTickCount () returned 0x113c068
	[0161.095] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0161.456] GetTickCount () returned 0x113c1df
	[0161.456] GetTickCount () returned 0x113c1df
	[0161.456] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0161.706] GetTickCount () returned 0x113c2d9
	[0161.706] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0162.228] GetTickCount () returned 0x113c4dc
	[0162.228] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0162.725] GetTickCount () returned 0x113c6d0
	[0162.725] GetTickCount () returned 0x113c6d0
	[0162.725] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0162.999] GetTickCount () returned 0x113c7da
	[0162.999] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0163.538] GetTickCount () returned 0x113c9fd
	[0163.538] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0163.944] GetTickCount () returned 0x113cb93
	[0163.944] GetTickCount () returned 0x113cb93
	[0163.944] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0164.396] GetTickCount () returned 0x113cd58
	[0164.397] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0164.536] GetTickCount () returned 0x113cdd5
	[0164.536] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0165.270] GetTickCount () returned 0x113d0c3
	[0165.270] GetTickCount () returned 0x113d0c3
	[0165.270] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0165.911] GetTickCount () returned 0x113d344
	[0165.911] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0166.108] GetTickCount () returned 0x113d40f
	[0166.108] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0166.410] GetTickCount () returned 0x113d538
	[0166.410] GetTickCount () returned 0x113d538
	[0166.410] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0166.523] GetTickCount () returned 0x113d5b5
	[0166.523] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0166.886] GetTickCount () returned 0x113d71c
	[0166.886] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0167.262] GetTickCount () returned 0x113d893
	[0167.262] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0167.538] GetTickCount () returned 0x113d9ad
	[0167.538] GetTickCount () returned 0x113d9ad
	[0167.538] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0168.449] GetTickCount () returned 0x113dd37
	[0168.449] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0168.635] GetTickCount () returned 0x113ddf2
	[0168.635] GetTickCount () returned 0x113ddf2
	[0168.635] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0169.095] GetTickCount () returned 0x113dfb7
	[0169.095] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0169.474] GetTickCount () returned 0x113e13e
	[0169.474] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0169.612] GetTickCount () returned 0x113e1bb
	[0169.612] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0169.847] GetTickCount () returned 0x113e2a5
	[0169.847] GetTickCount () returned 0x113e2a5
	[0169.847] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0170.034] GetTickCount () returned 0x113e361
	[0170.034] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0170.377] GetTickCount () returned 0x113e4b9
	[0170.377] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0170.960] GetTickCount () returned 0x113e70a
	[0170.960] GetTickCount () returned 0x113e70a
	[0170.960] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0171.323] GetTickCount () returned 0x113e872
	[0171.323] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0171.661] GetTickCount () returned 0x113e9ba
	[0171.661] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0172.027] GetTickCount () returned 0x113eb31
	[0172.027] GetTickCount () returned 0x113eb31
	[0172.027] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0172.196] GetTickCount () returned 0x113ebdd
	[0172.196] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0172.455] GetTickCount () returned 0x113ecd7
	[0172.455] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0172.600] GetTickCount () returned 0x113ed63
	[0172.600] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0172.987] GetTickCount () returned 0x113eeea
	[0172.987] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0173.410] GetTickCount () returned 0x113f090
	[0173.410] GetTickCount () returned 0x113f090
	[0173.410] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0173.854] GetTickCount () returned 0x113f245
	[0173.854] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0174.064] GetTickCount () returned 0x113f320
	[0174.064] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0174.322] GetTickCount () returned 0x113f41a
	[0174.322] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0174.561] GetTickCount () returned 0x113f505
	[0174.561] GetTickCount () returned 0x113f505
	[0174.561] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0174.660] GetTickCount () returned 0x113f572
	[0174.660] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0174.808] GetTickCount () returned 0x113f5ff
	[0174.808] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0174.972] GetTickCount () returned 0x113f6aa
	[0174.972] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0175.166] GetTickCount () returned 0x113f766
	[0175.166] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0175.362] GetTickCount () returned 0x113f831
	[0175.362] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0175.718] GetTickCount () returned 0x113f998
	[0175.718] GetTickCount () returned 0x113f998
	[0175.718] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0175.980] GetTickCount () returned 0x113fa92
	[0175.980] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0176.348] GetTickCount () returned 0x113fc09
	[0176.348] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0176.679] GetTickCount () returned 0x113fd52
	[0176.679] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0176.886] GetTickCount () returned 0x113fe2c
	[0176.886] GetTickCount () returned 0x113fe2c
	[0176.886] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0177.096] GetTickCount () returned 0x113fef7
	[0177.096] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0177.369] GetTickCount () returned 0x1140011
	[0177.369] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0177.965] GetTickCount () returned 0x1140262
	[0177.965] GetTickCount () returned 0x1140262
	[0177.965] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0178.308] GetTickCount () returned 0x11403ba
	[0178.308] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0178.551] GetTickCount () returned 0x11404a5
	[0178.551] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0178.785] GetTickCount () returned 0x114058f
	[0178.785] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0179.305] GetTickCount () returned 0x11407a2
	[0179.305] GetTickCount () returned 0x11407a2
	[0179.305] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0179.480] GetTickCount () returned 0x114084e
	[0179.480] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0179.605] GetTickCount () returned 0x11408cb
	[0179.605] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0180.024] GetTickCount () returned 0x1140a71
	[0180.024] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0180.435] GetTickCount () returned 0x1140c07
	[0180.435] GetTickCount () returned 0x1140c07
	[0180.435] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0180.727] GetTickCount () returned 0x1140d30
	[0180.727] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0180.886] GetTickCount () returned 0x1140dcc
	[0180.886] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0181.116] GetTickCount () returned 0x1140ea7
	[0181.117] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0181.286] GetTickCount () returned 0x1140f53
	[0181.286] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0181.643] GetTickCount () returned 0x11410ba
	[0181.646] GetTickCount () returned 0x11410ba
	[0181.646] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0182.134] GetTickCount () returned 0x11412ae
	[0182.134] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0182.493] GetTickCount () returned 0x1141416
	[0182.493] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0182.639] GetTickCount () returned 0x11414a2
	[0182.639] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0182.957] GetTickCount () returned 0x11415db
	[0182.957] GetTickCount () returned 0x11415db
	[0182.957] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0183.389] GetTickCount () returned 0x1141790
	[0183.389] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0183.514] GetTickCount () returned 0x114180d
	[0183.514] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0183.663] GetTickCount () returned 0x114189a
	[0183.663] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0183.841] GetTickCount () returned 0x1141955
	[0183.841] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0184.355] GetTickCount () returned 0x1141b49
	[0184.355] GetTickCount () returned 0x1141b49
	[0184.355] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0184.723] GetTickCount () returned 0x1141cc0
	[0184.723] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0185.046] GetTickCount () returned 0x1141e09
	[0185.046] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0185.185] GetTickCount () returned 0x1141e95
	[0185.185] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0185.333] GetTickCount () returned 0x1141f22
	[0185.333] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0185.594] GetTickCount () returned 0x114202b
	[0185.594] GetTickCount () returned 0x114202b
	[0185.594] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0185.814] GetTickCount () returned 0x1142106
	[0185.814] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0186.030] GetTickCount () returned 0x11421e1
	[0186.030] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0186.398] GetTickCount () returned 0x1142348
	[0186.398] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0186.544] GetTickCount () returned 0x11423e5
	[0186.544] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0186.775] GetTickCount () returned 0x11424bf
	[0186.775] GetTickCount () returned 0x11424bf
	[0186.775] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0187.017] GetTickCount () returned 0x11425b9
	[0187.017] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0187.388] GetTickCount () returned 0x1142721
	[0187.388] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) returned 0x102
	[0187.840] GetTickCount () returned 0x1142905
	[0187.874] GetTickCount () returned 0x1142905
	[0187.874] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x64) 

Thread:
	id = 40
	os_tid = 0xe04


Thread:
	id = 41
	os_tid = 0xe08

	[0153.939] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3e40068
	[0153.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3e50070
	[0153.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e690
	[0153.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x571cf0
	[0153.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e6c0
	[0153.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x4011020
	[0153.943] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e540
	[0153.943] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e540, Size=0x20) returned 0x4f27f8
	[0153.943] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e6d8
	[0153.943] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e6d8, Size=0x20) returned 0x4f2668
	[0153.943] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0153.943] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0153.943] Wow64DisableWow64FsRedirection (in: OldValue=0x309ff50 | out: OldValue=0x309ff50*=0x0) returned 1
	[0153.943] lstrlenW (lpString="kernel32.dll") returned 12
	[0153.943] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f27f8 | out: hHeap=0x4c0000) returned 1
	[0153.943] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0153.943] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2668 | out: hHeap=0x4c0000) returned 1
	[0153.943] Sleep (dwMilliseconds=0x64) 
	[0154.255] Sleep (dwMilliseconds=0x64) 
	[0154.437] Sleep (dwMilliseconds=0x64) 
	[0154.723] Sleep (dwMilliseconds=0x64) 
	[0155.028] Sleep (dwMilliseconds=0x64) 
	[0155.391] Sleep (dwMilliseconds=0x64) 
	[0155.638] Sleep (dwMilliseconds=0x64) 
	[0155.854] Sleep (dwMilliseconds=0x64) 
	[0156.137] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.137] lstrlenW (lpString="Alphabet.xml") returned 12
	[0156.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.138] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=791421) returned 1
	[0156.138] CloseHandle (hObject=0x438) returned 1
	[0156.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0156.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.138] lstrlenW (lpString=".doc") returned 4
	[0156.138] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.138] lstrlenW (lpString=".docx") returned 5
	[0156.138] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0156.138] lstrlenW (lpString=".pdf") returned 4
	[0156.139] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.139] lstrlenW (lpString=".xls") returned 4
	[0156.139] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.139] lstrlenW (lpString=".xlsx") returned 5
	[0156.139] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0156.139] lstrlenW (lpString=".ppt") returned 4
	[0156.139] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.139] lstrlenW (lpString=".zip") returned 4
	[0156.139] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.139] lstrlenW (lpString=".rar") returned 4
	[0156.139] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.139] lstrlenW (lpString=".bz2") returned 4
	[0156.139] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.139] lstrlenW (lpString=".7z") returned 3
	[0156.139] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.139] lstrlenW (lpString=".dbf") returned 4
	[0156.139] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.139] lstrlenW (lpString=".1cd") returned 4
	[0156.139] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.139] lstrlenW (lpString=".jpg") returned 4
	[0156.139] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.139] lstrlenW (lpString=".doc") returned 4
	[0156.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.139] lstrlenW (lpString=".docx") returned 5
	[0156.140] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0156.140] lstrlenW (lpString=".pdf") returned 4
	[0156.140] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.140] lstrlenW (lpString=".xls") returned 4
	[0156.140] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.140] lstrlenW (lpString=".xlsx") returned 5
	[0156.140] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0156.140] lstrlenW (lpString=".ppt") returned 4
	[0156.140] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.140] lstrlenW (lpString=".zip") returned 4
	[0156.140] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.140] lstrlenW (lpString=".rar") returned 4
	[0156.140] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.140] lstrlenW (lpString=".bz2") returned 4
	[0156.140] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.140] lstrlenW (lpString=".7z") returned 3
	[0156.140] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.140] lstrlenW (lpString=".dbf") returned 4
	[0156.140] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.140] lstrlenW (lpString=".1cd") returned 4
	[0156.140] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0156.140] lstrlenW (lpString=".jpg") returned 4
	[0156.140] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.141] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.141] lstrlenW (lpString="Content.xml") returned 11
	[0156.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.141] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=27045) returned 1
	[0156.142] CloseHandle (hObject=0x438) returned 1
	[0156.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0156.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.142] lstrlenW (lpString=".doc") returned 4
	[0156.142] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.142] lstrlenW (lpString=".docx") returned 5
	[0156.142] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0156.142] lstrlenW (lpString=".pdf") returned 4
	[0156.142] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.142] lstrlenW (lpString=".xls") returned 4
	[0156.142] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.142] lstrlenW (lpString=".xlsx") returned 5
	[0156.142] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0156.142] lstrlenW (lpString=".ppt") returned 4
	[0156.142] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.142] lstrlenW (lpString=".zip") returned 4
	[0156.142] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.142] lstrlenW (lpString=".rar") returned 4
	[0156.142] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.142] lstrlenW (lpString=".bz2") returned 4
	[0156.142] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.143] lstrlenW (lpString=".7z") returned 3
	[0156.143] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.143] lstrlenW (lpString=".dbf") returned 4
	[0156.143] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.143] lstrlenW (lpString=".1cd") returned 4
	[0156.143] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.143] lstrlenW (lpString=".jpg") returned 4
	[0156.143] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.143] lstrlenW (lpString=".doc") returned 4
	[0156.143] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.143] lstrlenW (lpString=".docx") returned 5
	[0156.143] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0156.143] lstrlenW (lpString=".pdf") returned 4
	[0156.143] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.143] lstrlenW (lpString=".xls") returned 4
	[0156.143] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.143] lstrlenW (lpString=".xlsx") returned 5
	[0156.143] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0156.143] lstrlenW (lpString=".ppt") returned 4
	[0156.143] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.143] lstrlenW (lpString=".zip") returned 4
	[0156.143] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.143] lstrlenW (lpString=".rar") returned 4
	[0156.143] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.143] lstrlenW (lpString=".bz2") returned 4
	[0156.143] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.144] lstrlenW (lpString=".7z") returned 3
	[0156.144] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.144] lstrlenW (lpString=".dbf") returned 4
	[0156.144] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.144] lstrlenW (lpString=".1cd") returned 4
	[0156.144] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0156.144] lstrlenW (lpString=".jpg") returned 4
	[0156.144] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.144] lstrcmpiW (lpString1=".avi", lpString2=".money") returned -1
	[0156.144] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0156.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.145] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=111320) returned 1
	[0156.145] CloseHandle (hObject=0x438) returned 1
	[0156.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0156.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.145] lstrlenW (lpString=".doc") returned 4
	[0156.145] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0156.145] lstrlenW (lpString=".docx") returned 5
	[0156.145] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0156.145] lstrlenW (lpString=".pdf") returned 4
	[0156.145] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0156.146] lstrlenW (lpString=".xls") returned 4
	[0156.146] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0156.146] lstrlenW (lpString=".xlsx") returned 5
	[0156.146] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0156.146] lstrlenW (lpString=".ppt") returned 4
	[0156.146] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0156.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.146] lstrlenW (lpString=".zip") returned 4
	[0156.146] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0156.146] lstrlenW (lpString=".rar") returned 4
	[0156.146] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0156.146] lstrlenW (lpString=".bz2") returned 4
	[0156.146] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0156.146] lstrlenW (lpString=".7z") returned 3
	[0156.146] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0156.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.146] lstrlenW (lpString=".dbf") returned 4
	[0156.146] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0156.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.146] lstrlenW (lpString=".1cd") returned 4
	[0156.146] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0156.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.146] lstrlenW (lpString=".jpg") returned 4
	[0156.146] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0156.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.146] lstrlenW (lpString=".doc") returned 4
	[0156.146] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0156.146] lstrlenW (lpString=".docx") returned 5
	[0156.146] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0156.147] lstrlenW (lpString=".pdf") returned 4
	[0156.147] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0156.147] lstrlenW (lpString=".xls") returned 4
	[0156.147] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0156.147] lstrlenW (lpString=".xlsx") returned 5
	[0156.147] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0156.147] lstrlenW (lpString=".ppt") returned 4
	[0156.147] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0156.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.147] lstrlenW (lpString=".zip") returned 4
	[0156.147] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0156.147] lstrlenW (lpString=".rar") returned 4
	[0156.147] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0156.147] lstrlenW (lpString=".bz2") returned 4
	[0156.147] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0156.147] lstrlenW (lpString=".7z") returned 3
	[0156.147] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0156.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.147] lstrlenW (lpString=".dbf") returned 4
	[0156.147] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0156.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.147] lstrlenW (lpString=".1cd") returned 4
	[0156.147] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0156.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0156.147] lstrlenW (lpString=".jpg") returned 4
	[0156.147] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0156.147] lstrcmpiW (lpString1=".avi", lpString2=".money") returned -1
	[0156.148] lstrlenW (lpString="boxed-join.avi") returned 14
	[0156.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.148] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=46622) returned 1
	[0156.149] CloseHandle (hObject=0x438) returned 1
	[0156.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0156.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.149] lstrlenW (lpString=".doc") returned 4
	[0156.149] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0156.149] lstrlenW (lpString=".docx") returned 5
	[0156.149] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0156.149] lstrlenW (lpString=".pdf") returned 4
	[0156.149] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0156.149] lstrlenW (lpString=".xls") returned 4
	[0156.149] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0156.149] lstrlenW (lpString=".xlsx") returned 5
	[0156.149] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0156.149] lstrlenW (lpString=".ppt") returned 4
	[0156.149] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0156.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.149] lstrlenW (lpString=".zip") returned 4
	[0156.149] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0156.149] lstrlenW (lpString=".rar") returned 4
	[0156.149] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0156.149] lstrlenW (lpString=".bz2") returned 4
	[0156.149] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0156.149] lstrlenW (lpString=".7z") returned 3
	[0156.150] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0156.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.150] lstrlenW (lpString=".dbf") returned 4
	[0156.150] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0156.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.150] lstrlenW (lpString=".1cd") returned 4
	[0156.150] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0156.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.150] lstrlenW (lpString=".jpg") returned 4
	[0156.150] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0156.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.150] lstrlenW (lpString=".doc") returned 4
	[0156.150] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0156.150] lstrlenW (lpString=".docx") returned 5
	[0156.150] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0156.150] lstrlenW (lpString=".pdf") returned 4
	[0156.150] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0156.150] lstrlenW (lpString=".xls") returned 4
	[0156.150] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0156.150] lstrlenW (lpString=".xlsx") returned 5
	[0156.150] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0156.150] lstrlenW (lpString=".ppt") returned 4
	[0156.150] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0156.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.150] lstrlenW (lpString=".zip") returned 4
	[0156.150] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0156.150] lstrlenW (lpString=".rar") returned 4
	[0156.150] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0156.151] lstrlenW (lpString=".bz2") returned 4
	[0156.151] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0156.151] lstrlenW (lpString=".7z") returned 3
	[0156.151] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0156.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.151] lstrlenW (lpString=".dbf") returned 4
	[0156.151] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0156.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.151] lstrlenW (lpString=".1cd") returned 4
	[0156.151] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0156.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0156.151] lstrlenW (lpString=".jpg") returned 4
	[0156.151] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0156.151] lstrcmpiW (lpString1=".avi", lpString2=".money") returned -1
	[0156.151] lstrlenW (lpString="boxed-split.avi") returned 15
	[0156.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.152] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=84190) returned 1
	[0156.152] CloseHandle (hObject=0x438) returned 1
	[0156.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0156.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.152] lstrlenW (lpString=".doc") returned 4
	[0156.152] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0156.152] lstrlenW (lpString=".docx") returned 5
	[0156.152] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0156.152] lstrlenW (lpString=".pdf") returned 4
	[0156.152] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0156.152] lstrlenW (lpString=".xls") returned 4
	[0156.152] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0156.152] lstrlenW (lpString=".xlsx") returned 5
	[0156.152] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0156.152] lstrlenW (lpString=".ppt") returned 4
	[0156.152] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0156.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.152] lstrlenW (lpString=".zip") returned 4
	[0156.152] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0156.153] lstrlenW (lpString=".rar") returned 4
	[0156.153] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0156.153] lstrlenW (lpString=".bz2") returned 4
	[0156.153] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0156.153] lstrlenW (lpString=".7z") returned 3
	[0156.153] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0156.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.153] lstrlenW (lpString=".dbf") returned 4
	[0156.153] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0156.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.153] lstrlenW (lpString=".1cd") returned 4
	[0156.153] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0156.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.153] lstrlenW (lpString=".jpg") returned 4
	[0156.153] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0156.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.153] lstrlenW (lpString=".doc") returned 4
	[0156.153] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0156.153] lstrlenW (lpString=".docx") returned 5
	[0156.153] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0156.153] lstrlenW (lpString=".pdf") returned 4
	[0156.153] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0156.153] lstrlenW (lpString=".xls") returned 4
	[0156.153] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0156.153] lstrlenW (lpString=".xlsx") returned 5
	[0156.153] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0156.153] lstrlenW (lpString=".ppt") returned 4
	[0156.153] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0156.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.153] lstrlenW (lpString=".zip") returned 4
	[0156.154] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0156.154] lstrlenW (lpString=".rar") returned 4
	[0156.154] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0156.154] lstrlenW (lpString=".bz2") returned 4
	[0156.154] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0156.154] lstrlenW (lpString=".7z") returned 3
	[0156.154] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0156.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.154] lstrlenW (lpString=".dbf") returned 4
	[0156.154] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0156.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.154] lstrlenW (lpString=".1cd") returned 4
	[0156.154] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0156.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0156.154] lstrlenW (lpString=".jpg") returned 4
	[0156.154] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0156.154] lstrcmpiW (lpString1=".avi", lpString2=".money") returned -1
	[0156.154] lstrlenW (lpString="correct.avi") returned 11
	[0156.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.155] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=180172) returned 1
	[0156.155] CloseHandle (hObject=0x438) returned 1
	[0156.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20
	[0156.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.155] lstrlenW (lpString=".doc") returned 4
	[0156.155] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0156.155] lstrlenW (lpString=".docx") returned 5
	[0156.155] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0156.155] lstrlenW (lpString=".pdf") returned 4
	[0156.155] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0156.155] lstrlenW (lpString=".xls") returned 4
	[0156.155] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0156.155] lstrlenW (lpString=".xlsx") returned 5
	[0156.155] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0156.155] lstrlenW (lpString=".ppt") returned 4
	[0156.155] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0156.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.155] lstrlenW (lpString=".zip") returned 4
	[0156.155] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0156.156] lstrlenW (lpString=".rar") returned 4
	[0156.156] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0156.156] lstrlenW (lpString=".bz2") returned 4
	[0156.156] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0156.156] lstrlenW (lpString=".7z") returned 3
	[0156.156] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0156.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.156] lstrlenW (lpString=".dbf") returned 4
	[0156.156] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0156.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.156] lstrlenW (lpString=".1cd") returned 4
	[0156.156] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0156.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.156] lstrlenW (lpString=".jpg") returned 4
	[0156.156] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0156.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.156] lstrlenW (lpString=".doc") returned 4
	[0156.156] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0156.156] lstrlenW (lpString=".docx") returned 5
	[0156.156] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0156.156] lstrlenW (lpString=".pdf") returned 4
	[0156.156] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0156.156] lstrlenW (lpString=".xls") returned 4
	[0156.156] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0156.156] lstrlenW (lpString=".xlsx") returned 5
	[0156.156] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0156.156] lstrlenW (lpString=".ppt") returned 4
	[0156.156] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0156.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.156] lstrlenW (lpString=".zip") returned 4
	[0156.157] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0156.157] lstrlenW (lpString=".rar") returned 4
	[0156.157] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0156.157] lstrlenW (lpString=".bz2") returned 4
	[0156.157] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0156.157] lstrlenW (lpString=".7z") returned 3
	[0156.157] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0156.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.157] lstrlenW (lpString=".dbf") returned 4
	[0156.157] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0156.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.157] lstrlenW (lpString=".1cd") returned 4
	[0156.157] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0156.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0156.157] lstrlenW (lpString=".jpg") returned 4
	[0156.157] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0156.157] lstrcmpiW (lpString1=".avi", lpString2=".money") returned -1
	[0156.157] lstrlenW (lpString="delete.avi") returned 10
	[0156.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.158] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=208408) returned 1
	[0156.158] CloseHandle (hObject=0x438) returned 1
	[0156.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20
	[0156.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0156.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0156.158] lstrlenW (lpString=".doc") returned 4
	[0156.158] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0156.158] lstrlenW (lpString=".docx") returned 5
	[0156.158] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0156.158] lstrlenW (lpString=".pdf") returned 4
	[0156.158] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0156.158] lstrlenW (lpString=".xls") returned 4
	[0156.158] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0156.158] lstrlenW (lpString=".xlsx") returned 5
	[0156.158] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0156.158] lstrlenW (lpString=".ppt") returned 4
	[0156.158] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0156.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0156.158] lstrlenW (lpString=".zip") returned 4
	[0156.159] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0156.159] lstrlenW (lpString=".rar") returned 4
	[0156.159] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0156.159] lstrlenW (lpString=".bz2") returned 4
	[0156.159] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0156.159] lstrlenW (lpString=".7z") returned 3
	[0156.159] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0156.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0156.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[admin@stex777.com].money")) returned 0
	[0158.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0158.488] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.488] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0158.490] GetLastError () returned 0x0
	[0158.490] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xb80, lpOverlapped=0x0) returned 1
	[0158.510] WriteFile (in: hFile=0x504, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xb90, lpOverlapped=0x0) returned 1
	[0158.511] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.511] WriteFile (in: hFile=0x504, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.511] SetEndOfFile (hFile=0x504) returned 1
	[0158.512] CloseHandle (hObject=0x504) returned 1
	[0158.512] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.512] SetEndOfFile (hFile=0x500) returned 1
	[0158.514] CloseHandle (hObject=0x500) returned 1
	[0158.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1
	[0158.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.515] lstrlenW (lpString=".doc") returned 4
	[0158.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.515] lstrlenW (lpString=".docx") returned 5
	[0158.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0158.515] lstrlenW (lpString=".pdf") returned 4
	[0158.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.515] lstrlenW (lpString=".xls") returned 4
	[0158.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.515] lstrlenW (lpString=".xlsx") returned 5
	[0158.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0158.516] lstrlenW (lpString=".ppt") returned 4
	[0158.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.516] lstrlenW (lpString=".zip") returned 4
	[0158.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.516] lstrlenW (lpString=".rar") returned 4
	[0158.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.516] lstrlenW (lpString=".bz2") returned 4
	[0158.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.516] lstrlenW (lpString=".7z") returned 3
	[0158.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.516] lstrlenW (lpString=".dbf") returned 4
	[0158.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.516] lstrlenW (lpString=".1cd") returned 4
	[0158.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.516] lstrlenW (lpString=".jpg") returned 4
	[0158.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.516] lstrlenW (lpString=".doc") returned 4
	[0158.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.516] lstrlenW (lpString=".docx") returned 5
	[0158.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0158.516] lstrlenW (lpString=".pdf") returned 4
	[0158.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.517] lstrlenW (lpString=".xls") returned 4
	[0158.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.517] lstrlenW (lpString=".xlsx") returned 5
	[0158.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0158.517] lstrlenW (lpString=".ppt") returned 4
	[0158.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.517] lstrlenW (lpString=".zip") returned 4
	[0158.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.517] lstrlenW (lpString=".rar") returned 4
	[0158.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.517] lstrlenW (lpString=".bz2") returned 4
	[0158.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.517] lstrlenW (lpString=".7z") returned 3
	[0158.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.517] lstrlenW (lpString=".dbf") returned 4
	[0158.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.517] lstrlenW (lpString=".1cd") returned 4
	[0158.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0158.517] lstrlenW (lpString=".jpg") returned 4
	[0158.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.517] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.517] lstrlenW (lpString="J0086420.WMF") returned 12
	[0158.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0158.518] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=9596) returned 1
	[0158.518] CloseHandle (hObject=0x500) returned 1
	[0158.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220
	[0158.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0158.519] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.519] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0158.519] GetLastError () returned 0x0
	[0158.519] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x257c, lpOverlapped=0x0) returned 1
	[0158.747] WriteFile (in: hFile=0x504, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2580, lpOverlapped=0x0) returned 1
	[0158.749] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.749] WriteFile (in: hFile=0x504, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.749] SetEndOfFile (hFile=0x504) returned 1
	[0158.749] CloseHandle (hObject=0x504) returned 1
	[0158.749] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.749] SetEndOfFile (hFile=0x500) returned 1
	[0158.752] CloseHandle (hObject=0x500) returned 1
	[0158.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1
	[0158.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.755] lstrlenW (lpString=".doc") returned 4
	[0158.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.755] lstrlenW (lpString=".docx") returned 5
	[0158.755] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0158.755] lstrlenW (lpString=".pdf") returned 4
	[0158.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.756] lstrlenW (lpString=".xls") returned 4
	[0158.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.756] lstrlenW (lpString=".xlsx") returned 5
	[0158.756] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0158.756] lstrlenW (lpString=".ppt") returned 4
	[0158.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.756] lstrlenW (lpString=".zip") returned 4
	[0158.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.756] lstrlenW (lpString=".rar") returned 4
	[0158.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.756] lstrlenW (lpString=".bz2") returned 4
	[0158.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.756] lstrlenW (lpString=".7z") returned 3
	[0158.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.756] lstrlenW (lpString=".dbf") returned 4
	[0158.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.756] lstrlenW (lpString=".1cd") returned 4
	[0158.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.756] lstrlenW (lpString=".jpg") returned 4
	[0158.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.756] lstrlenW (lpString=".doc") returned 4
	[0158.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.756] lstrlenW (lpString=".docx") returned 5
	[0158.757] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0158.757] lstrlenW (lpString=".pdf") returned 4
	[0158.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.757] lstrlenW (lpString=".xls") returned 4
	[0158.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.757] lstrlenW (lpString=".xlsx") returned 5
	[0158.757] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0158.757] lstrlenW (lpString=".ppt") returned 4
	[0158.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.757] lstrlenW (lpString=".zip") returned 4
	[0158.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.757] lstrlenW (lpString=".rar") returned 4
	[0158.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.757] lstrlenW (lpString=".bz2") returned 4
	[0158.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.757] lstrlenW (lpString=".7z") returned 3
	[0158.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.757] lstrlenW (lpString=".dbf") returned 4
	[0158.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.757] lstrlenW (lpString=".1cd") returned 4
	[0158.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0158.757] lstrlenW (lpString=".jpg") returned 4
	[0158.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.758] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.758] lstrlenW (lpString="J0089945.WMF") returned 12
	[0158.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0158.758] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=19898) returned 1
	[0158.758] CloseHandle (hObject=0x500) returned 1
	[0158.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220
	[0158.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0158.759] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.759] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0158.759] GetLastError () returned 0x0
	[0158.759] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4dba, lpOverlapped=0x0) returned 1
	[0158.762] WriteFile (in: hFile=0x504, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4dc0, lpOverlapped=0x0) returned 1
	[0158.763] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.763] WriteFile (in: hFile=0x504, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.763] SetEndOfFile (hFile=0x504) returned 1
	[0158.763] CloseHandle (hObject=0x504) returned 1
	[0158.763] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.763] SetEndOfFile (hFile=0x500) returned 1
	[0158.766] CloseHandle (hObject=0x500) returned 1
	[0158.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1
	[0158.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.767] lstrlenW (lpString=".doc") returned 4
	[0158.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.767] lstrlenW (lpString=".docx") returned 5
	[0158.767] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0158.767] lstrlenW (lpString=".pdf") returned 4
	[0158.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.767] lstrlenW (lpString=".xls") returned 4
	[0158.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.767] lstrlenW (lpString=".xlsx") returned 5
	[0158.767] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0158.767] lstrlenW (lpString=".ppt") returned 4
	[0158.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.768] lstrlenW (lpString=".zip") returned 4
	[0158.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.768] lstrlenW (lpString=".rar") returned 4
	[0158.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.768] lstrlenW (lpString=".bz2") returned 4
	[0158.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.768] lstrlenW (lpString=".7z") returned 3
	[0158.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.768] lstrlenW (lpString=".dbf") returned 4
	[0158.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.768] lstrlenW (lpString=".1cd") returned 4
	[0158.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.768] lstrlenW (lpString=".jpg") returned 4
	[0158.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.768] lstrlenW (lpString=".doc") returned 4
	[0158.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.768] lstrlenW (lpString=".docx") returned 5
	[0158.768] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0158.768] lstrlenW (lpString=".pdf") returned 4
	[0158.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.768] lstrlenW (lpString=".xls") returned 4
	[0158.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.768] lstrlenW (lpString=".xlsx") returned 5
	[0158.768] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0158.769] lstrlenW (lpString=".ppt") returned 4
	[0158.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.769] lstrlenW (lpString=".zip") returned 4
	[0158.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.769] lstrlenW (lpString=".rar") returned 4
	[0158.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.769] lstrlenW (lpString=".bz2") returned 4
	[0158.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.769] lstrlenW (lpString=".7z") returned 3
	[0158.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.769] lstrlenW (lpString=".dbf") returned 4
	[0158.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.769] lstrlenW (lpString=".1cd") returned 4
	[0158.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0158.769] lstrlenW (lpString=".jpg") returned 4
	[0158.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.769] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.769] lstrlenW (lpString="J0089992.WMF") returned 12
	[0158.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0158.770] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=15680) returned 1
	[0158.770] CloseHandle (hObject=0x500) returned 1
	[0158.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220
	[0158.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0158.771] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.771] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0158.771] GetLastError () returned 0x0
	[0158.771] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x3d40, lpOverlapped=0x0) returned 1
	[0158.773] WriteFile (in: hFile=0x504, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x3d50, lpOverlapped=0x0) returned 1
	[0158.774] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.774] WriteFile (in: hFile=0x504, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.774] SetEndOfFile (hFile=0x504) returned 1
	[0158.774] CloseHandle (hObject=0x504) returned 1
	[0158.774] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.774] SetEndOfFile (hFile=0x500) returned 1
	[0158.781] CloseHandle (hObject=0x500) returned 1
	[0158.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1
	[0158.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.782] lstrlenW (lpString=".doc") returned 4
	[0158.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.782] lstrlenW (lpString=".docx") returned 5
	[0158.782] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0158.782] lstrlenW (lpString=".pdf") returned 4
	[0158.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.782] lstrlenW (lpString=".xls") returned 4
	[0158.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.782] lstrlenW (lpString=".xlsx") returned 5
	[0158.782] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0158.782] lstrlenW (lpString=".ppt") returned 4
	[0158.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.782] lstrlenW (lpString=".zip") returned 4
	[0158.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.782] lstrlenW (lpString=".rar") returned 4
	[0158.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.783] lstrlenW (lpString=".bz2") returned 4
	[0158.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.783] lstrlenW (lpString=".7z") returned 3
	[0158.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.783] lstrlenW (lpString=".dbf") returned 4
	[0158.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.783] lstrlenW (lpString=".1cd") returned 4
	[0158.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.783] lstrlenW (lpString=".jpg") returned 4
	[0158.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.783] lstrlenW (lpString=".doc") returned 4
	[0158.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.783] lstrlenW (lpString=".docx") returned 5
	[0158.783] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0158.783] lstrlenW (lpString=".pdf") returned 4
	[0158.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.783] lstrlenW (lpString=".xls") returned 4
	[0158.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.783] lstrlenW (lpString=".xlsx") returned 5
	[0158.783] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0158.783] lstrlenW (lpString=".ppt") returned 4
	[0158.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.783] lstrlenW (lpString=".zip") returned 4
	[0158.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.784] lstrlenW (lpString=".rar") returned 4
	[0158.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.784] lstrlenW (lpString=".bz2") returned 4
	[0158.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.784] lstrlenW (lpString=".7z") returned 3
	[0158.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.784] lstrlenW (lpString=".dbf") returned 4
	[0158.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.784] lstrlenW (lpString=".1cd") returned 4
	[0158.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0158.784] lstrlenW (lpString=".jpg") returned 4
	[0158.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.784] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.784] lstrlenW (lpString="J0090027.WMF") returned 12
	[0158.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0158.785] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=21268) returned 1
	[0158.785] CloseHandle (hObject=0x500) returned 1
	[0158.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220
	[0158.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0158.785] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.785] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0158.786] GetLastError () returned 0x0
	[0158.786] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x5314, lpOverlapped=0x0) returned 1
	[0159.052] WriteFile (in: hFile=0x51c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x5320, lpOverlapped=0x0) returned 1
	[0159.054] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.054] WriteFile (in: hFile=0x51c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.054] SetEndOfFile (hFile=0x51c) returned 1
	[0159.054] CloseHandle (hObject=0x51c) returned 1
	[0159.054] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.054] SetEndOfFile (hFile=0x500) returned 1
	[0159.078] CloseHandle (hObject=0x500) returned 1
	[0159.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1
	[0159.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.079] lstrlenW (lpString=".doc") returned 4
	[0159.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.079] lstrlenW (lpString=".docx") returned 5
	[0159.080] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0159.080] lstrlenW (lpString=".pdf") returned 4
	[0159.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.080] lstrlenW (lpString=".xls") returned 4
	[0159.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.080] lstrlenW (lpString=".xlsx") returned 5
	[0159.080] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0159.080] lstrlenW (lpString=".ppt") returned 4
	[0159.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.080] lstrlenW (lpString=".zip") returned 4
	[0159.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.080] lstrlenW (lpString=".rar") returned 4
	[0159.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.080] lstrlenW (lpString=".bz2") returned 4
	[0159.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.080] lstrlenW (lpString=".7z") returned 3
	[0159.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.080] lstrlenW (lpString=".dbf") returned 4
	[0159.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.080] lstrlenW (lpString=".1cd") returned 4
	[0159.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.080] lstrlenW (lpString=".jpg") returned 4
	[0159.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.081] lstrlenW (lpString=".doc") returned 4
	[0159.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.081] lstrlenW (lpString=".docx") returned 5
	[0159.081] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0159.081] lstrlenW (lpString=".pdf") returned 4
	[0159.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.081] lstrlenW (lpString=".xls") returned 4
	[0159.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.081] lstrlenW (lpString=".xlsx") returned 5
	[0159.081] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0159.081] lstrlenW (lpString=".ppt") returned 4
	[0159.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.081] lstrlenW (lpString=".zip") returned 4
	[0159.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.081] lstrlenW (lpString=".rar") returned 4
	[0159.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.081] lstrlenW (lpString=".bz2") returned 4
	[0159.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.081] lstrlenW (lpString=".7z") returned 3
	[0159.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.081] lstrlenW (lpString=".dbf") returned 4
	[0159.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.081] lstrlenW (lpString=".1cd") returned 4
	[0159.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0159.081] lstrlenW (lpString=".jpg") returned 4
	[0159.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.082] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.082] lstrlenW (lpString="J0098497.WMF") returned 12
	[0159.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.082] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=4970) returned 1
	[0159.082] CloseHandle (hObject=0x500) returned 1
	[0159.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220
	[0159.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.083] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.083] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.084] GetLastError () returned 0x0
	[0159.084] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x136a, lpOverlapped=0x0) returned 1
	[0159.085] WriteFile (in: hFile=0x51c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0159.086] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.086] WriteFile (in: hFile=0x51c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.086] SetEndOfFile (hFile=0x51c) returned 1
	[0159.087] CloseHandle (hObject=0x51c) returned 1
	[0159.087] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.087] SetEndOfFile (hFile=0x500) returned 1
	[0159.089] CloseHandle (hObject=0x500) returned 1
	[0159.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1
	[0159.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.090] lstrlenW (lpString=".doc") returned 4
	[0159.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.090] lstrlenW (lpString=".docx") returned 5
	[0159.090] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0159.090] lstrlenW (lpString=".pdf") returned 4
	[0159.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.091] lstrlenW (lpString=".xls") returned 4
	[0159.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.091] lstrlenW (lpString=".xlsx") returned 5
	[0159.091] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0159.091] lstrlenW (lpString=".ppt") returned 4
	[0159.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.091] lstrlenW (lpString=".zip") returned 4
	[0159.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.091] lstrlenW (lpString=".rar") returned 4
	[0159.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.091] lstrlenW (lpString=".bz2") returned 4
	[0159.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.091] lstrlenW (lpString=".7z") returned 3
	[0159.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.091] lstrlenW (lpString=".dbf") returned 4
	[0159.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.091] lstrlenW (lpString=".1cd") returned 4
	[0159.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.091] lstrlenW (lpString=".jpg") returned 4
	[0159.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.091] lstrlenW (lpString=".doc") returned 4
	[0159.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.091] lstrlenW (lpString=".docx") returned 5
	[0159.091] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0159.092] lstrlenW (lpString=".pdf") returned 4
	[0159.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.092] lstrlenW (lpString=".xls") returned 4
	[0159.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.092] lstrlenW (lpString=".xlsx") returned 5
	[0159.092] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0159.092] lstrlenW (lpString=".ppt") returned 4
	[0159.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.092] lstrlenW (lpString=".zip") returned 4
	[0159.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.092] lstrlenW (lpString=".rar") returned 4
	[0159.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.092] lstrlenW (lpString=".bz2") returned 4
	[0159.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.092] lstrlenW (lpString=".7z") returned 3
	[0159.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.092] lstrlenW (lpString=".dbf") returned 4
	[0159.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.092] lstrlenW (lpString=".1cd") returned 4
	[0159.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0159.092] lstrlenW (lpString=".jpg") returned 4
	[0159.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.092] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.093] lstrlenW (lpString="J0099145.JPG") returned 12
	[0159.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.096] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=24759) returned 1
	[0159.096] CloseHandle (hObject=0x500) returned 1
	[0159.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220
	[0159.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.097] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.097] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.097] GetLastError () returned 0x0
	[0159.097] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x60b7, lpOverlapped=0x0) returned 1
	[0159.099] WriteFile (in: hFile=0x51c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x60c0, lpOverlapped=0x0) returned 1
	[0159.101] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.101] WriteFile (in: hFile=0x51c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.101] SetEndOfFile (hFile=0x51c) returned 1
	[0159.101] CloseHandle (hObject=0x51c) returned 1
	[0159.101] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.101] SetEndOfFile (hFile=0x500) returned 1
	[0159.104] CloseHandle (hObject=0x500) returned 1
	[0159.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1
	[0159.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.105] lstrlenW (lpString=".doc") returned 4
	[0159.105] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.105] lstrlenW (lpString=".docx") returned 5
	[0159.105] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0159.105] lstrlenW (lpString=".pdf") returned 4
	[0159.105] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.106] lstrlenW (lpString=".xls") returned 4
	[0159.106] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.106] lstrlenW (lpString=".xlsx") returned 5
	[0159.106] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0159.106] lstrlenW (lpString=".ppt") returned 4
	[0159.106] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.106] lstrlenW (lpString=".zip") returned 4
	[0159.106] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.106] lstrlenW (lpString=".rar") returned 4
	[0159.106] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.106] lstrlenW (lpString=".bz2") returned 4
	[0159.106] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.106] lstrlenW (lpString=".7z") returned 3
	[0159.106] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.106] lstrlenW (lpString=".dbf") returned 4
	[0159.106] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.106] lstrlenW (lpString=".1cd") returned 4
	[0159.106] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.106] lstrlenW (lpString=".jpg") returned 4
	[0159.106] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.106] lstrlenW (lpString=".doc") returned 4
	[0159.106] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.106] lstrlenW (lpString=".docx") returned 5
	[0159.106] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0159.107] lstrlenW (lpString=".pdf") returned 4
	[0159.107] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.107] lstrlenW (lpString=".xls") returned 4
	[0159.107] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.107] lstrlenW (lpString=".xlsx") returned 5
	[0159.107] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0159.107] lstrlenW (lpString=".ppt") returned 4
	[0159.107] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.107] lstrlenW (lpString=".zip") returned 4
	[0159.107] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.107] lstrlenW (lpString=".rar") returned 4
	[0159.107] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.107] lstrlenW (lpString=".bz2") returned 4
	[0159.107] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.107] lstrlenW (lpString=".7z") returned 3
	[0159.107] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.107] lstrlenW (lpString=".dbf") returned 4
	[0159.107] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.107] lstrlenW (lpString=".1cd") returned 4
	[0159.107] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0159.107] lstrlenW (lpString=".jpg") returned 4
	[0159.107] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.107] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.107] lstrlenW (lpString="J0099146.WMF") returned 12
	[0159.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.108] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=16596) returned 1
	[0159.108] CloseHandle (hObject=0x500) returned 1
	[0159.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220
	[0159.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.109] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.109] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.109] GetLastError () returned 0x0
	[0159.109] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x40d4, lpOverlapped=0x0) returned 1
	[0159.290] WriteFile (in: hFile=0x51c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x40e0, lpOverlapped=0x0) returned 1
	[0159.291] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.291] WriteFile (in: hFile=0x51c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.291] SetEndOfFile (hFile=0x51c) returned 1
	[0159.332] CloseHandle (hObject=0x51c) returned 1
	[0159.360] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.360] SetEndOfFile (hFile=0x500) returned 1
	[0159.761] CloseHandle (hObject=0x500) returned 1
	[0159.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1
	[0159.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.762] lstrlenW (lpString=".doc") returned 4
	[0159.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.762] lstrlenW (lpString=".docx") returned 5
	[0159.762] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0159.762] lstrlenW (lpString=".pdf") returned 4
	[0159.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.762] lstrlenW (lpString=".xls") returned 4
	[0159.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.762] lstrlenW (lpString=".xlsx") returned 5
	[0159.762] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0159.763] lstrlenW (lpString=".ppt") returned 4
	[0159.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.763] lstrlenW (lpString=".zip") returned 4
	[0159.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.763] lstrlenW (lpString=".rar") returned 4
	[0159.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.763] lstrlenW (lpString=".bz2") returned 4
	[0159.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.763] lstrlenW (lpString=".7z") returned 3
	[0159.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.763] lstrlenW (lpString=".dbf") returned 4
	[0159.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.763] lstrlenW (lpString=".1cd") returned 4
	[0159.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.763] lstrlenW (lpString=".jpg") returned 4
	[0159.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.763] lstrlenW (lpString=".doc") returned 4
	[0159.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.763] lstrlenW (lpString=".docx") returned 5
	[0159.763] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0159.763] lstrlenW (lpString=".pdf") returned 4
	[0159.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.763] lstrlenW (lpString=".xls") returned 4
	[0159.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.763] lstrlenW (lpString=".xlsx") returned 5
	[0159.763] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0159.764] lstrlenW (lpString=".ppt") returned 4
	[0159.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.764] lstrlenW (lpString=".zip") returned 4
	[0159.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.764] lstrlenW (lpString=".rar") returned 4
	[0159.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.764] lstrlenW (lpString=".bz2") returned 4
	[0159.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.764] lstrlenW (lpString=".7z") returned 3
	[0159.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.764] lstrlenW (lpString=".dbf") returned 4
	[0159.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.764] lstrlenW (lpString=".1cd") returned 4
	[0159.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0159.764] lstrlenW (lpString=".jpg") returned 4
	[0159.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.764] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.764] lstrlenW (lpString="J0099161.JPG") returned 12
	[0159.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.766] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=7154) returned 1
	[0159.766] CloseHandle (hObject=0x500) returned 1
	[0159.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220
	[0159.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.767] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.767] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0159.768] GetLastError () returned 0x0
	[0159.768] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1bf2, lpOverlapped=0x0) returned 1
	[0159.769] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1c00, lpOverlapped=0x0) returned 1
	[0159.770] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.770] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.770] SetEndOfFile (hFile=0x530) returned 1
	[0159.771] CloseHandle (hObject=0x530) returned 1
	[0159.771] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.771] SetEndOfFile (hFile=0x500) returned 1
	[0159.773] CloseHandle (hObject=0x500) returned 1
	[0159.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1
	[0159.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.774] lstrlenW (lpString=".doc") returned 4
	[0159.774] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.774] lstrlenW (lpString=".docx") returned 5
	[0159.774] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0159.774] lstrlenW (lpString=".pdf") returned 4
	[0159.774] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.774] lstrlenW (lpString=".xls") returned 4
	[0159.774] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.774] lstrlenW (lpString=".xlsx") returned 5
	[0159.774] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0159.774] lstrlenW (lpString=".ppt") returned 4
	[0159.775] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.775] lstrlenW (lpString=".zip") returned 4
	[0159.775] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.775] lstrlenW (lpString=".rar") returned 4
	[0159.775] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.775] lstrlenW (lpString=".bz2") returned 4
	[0159.775] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.775] lstrlenW (lpString=".7z") returned 3
	[0159.775] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.775] lstrlenW (lpString=".dbf") returned 4
	[0159.775] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.775] lstrlenW (lpString=".1cd") returned 4
	[0159.775] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.775] lstrlenW (lpString=".jpg") returned 4
	[0159.775] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.775] lstrlenW (lpString=".doc") returned 4
	[0159.775] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.775] lstrlenW (lpString=".docx") returned 5
	[0159.775] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0159.775] lstrlenW (lpString=".pdf") returned 4
	[0159.775] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.775] lstrlenW (lpString=".xls") returned 4
	[0159.775] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.775] lstrlenW (lpString=".xlsx") returned 5
	[0159.775] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0159.776] lstrlenW (lpString=".ppt") returned 4
	[0159.776] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.776] lstrlenW (lpString=".zip") returned 4
	[0159.776] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.776] lstrlenW (lpString=".rar") returned 4
	[0159.776] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.776] lstrlenW (lpString=".bz2") returned 4
	[0159.776] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.776] lstrlenW (lpString=".7z") returned 3
	[0159.776] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.776] lstrlenW (lpString=".dbf") returned 4
	[0159.776] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.776] lstrlenW (lpString=".1cd") returned 4
	[0159.776] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0159.776] lstrlenW (lpString=".jpg") returned 4
	[0159.776] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.776] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.776] lstrlenW (lpString="J0099162.JPG") returned 12
	[0159.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.777] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=19656) returned 1
	[0159.777] CloseHandle (hObject=0x500) returned 1
	[0159.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220
	[0159.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.777] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.777] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0159.778] GetLastError () returned 0x0
	[0159.778] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4cc8, lpOverlapped=0x0) returned 1
	[0159.780] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0159.781] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.781] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.781] SetEndOfFile (hFile=0x530) returned 1
	[0159.782] CloseHandle (hObject=0x530) returned 1
	[0159.782] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.782] SetEndOfFile (hFile=0x500) returned 1
	[0159.784] CloseHandle (hObject=0x500) returned 1
	[0159.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1
	[0159.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.785] lstrlenW (lpString=".doc") returned 4
	[0159.785] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.785] lstrlenW (lpString=".docx") returned 5
	[0159.785] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0159.786] lstrlenW (lpString=".pdf") returned 4
	[0159.786] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.786] lstrlenW (lpString=".xls") returned 4
	[0159.786] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.786] lstrlenW (lpString=".xlsx") returned 5
	[0159.786] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0159.786] lstrlenW (lpString=".ppt") returned 4
	[0159.786] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.786] lstrlenW (lpString=".zip") returned 4
	[0159.786] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.786] lstrlenW (lpString=".rar") returned 4
	[0159.786] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.786] lstrlenW (lpString=".bz2") returned 4
	[0159.786] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.786] lstrlenW (lpString=".7z") returned 3
	[0159.786] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.786] lstrlenW (lpString=".dbf") returned 4
	[0159.786] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.786] lstrlenW (lpString=".1cd") returned 4
	[0159.786] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.786] lstrlenW (lpString=".jpg") returned 4
	[0159.786] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.786] lstrlenW (lpString=".doc") returned 4
	[0159.786] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.786] lstrlenW (lpString=".docx") returned 5
	[0159.786] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0159.787] lstrlenW (lpString=".pdf") returned 4
	[0159.787] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.787] lstrlenW (lpString=".xls") returned 4
	[0159.787] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.787] lstrlenW (lpString=".xlsx") returned 5
	[0159.787] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0159.787] lstrlenW (lpString=".ppt") returned 4
	[0159.787] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.787] lstrlenW (lpString=".zip") returned 4
	[0159.787] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.787] lstrlenW (lpString=".rar") returned 4
	[0159.787] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.787] lstrlenW (lpString=".bz2") returned 4
	[0159.787] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.787] lstrlenW (lpString=".7z") returned 3
	[0159.787] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.787] lstrlenW (lpString=".dbf") returned 4
	[0159.787] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.787] lstrlenW (lpString=".1cd") returned 4
	[0159.787] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0159.787] lstrlenW (lpString=".jpg") returned 4
	[0159.787] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.787] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.787] lstrlenW (lpString="J0099163.WMF") returned 12
	[0159.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.788] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=22356) returned 1
	[0159.788] CloseHandle (hObject=0x500) returned 1
	[0159.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220
	[0159.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0159.789] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.789] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0160.026] GetLastError () returned 0x0
	[0160.026] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x5754, lpOverlapped=0x0) returned 1
	[0160.028] WriteFile (in: hFile=0x4fc, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x5760, lpOverlapped=0x0) returned 1
	[0160.030] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.030] WriteFile (in: hFile=0x4fc, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.030] SetEndOfFile (hFile=0x4fc) returned 1
	[0160.030] CloseHandle (hObject=0x4fc) returned 1
	[0160.030] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.030] SetEndOfFile (hFile=0x500) returned 1
	[0160.033] CloseHandle (hObject=0x500) returned 1
	[0160.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0160.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1
	[0160.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.036] lstrlenW (lpString=".doc") returned 4
	[0160.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.036] lstrlenW (lpString=".docx") returned 5
	[0160.036] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0160.036] lstrlenW (lpString=".pdf") returned 4
	[0160.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.036] lstrlenW (lpString=".xls") returned 4
	[0160.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.036] lstrlenW (lpString=".xlsx") returned 5
	[0160.036] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0160.036] lstrlenW (lpString=".ppt") returned 4
	[0160.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.036] lstrlenW (lpString=".zip") returned 4
	[0160.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.036] lstrlenW (lpString=".rar") returned 4
	[0160.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.036] lstrlenW (lpString=".bz2") returned 4
	[0160.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.036] lstrlenW (lpString=".7z") returned 3
	[0160.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.036] lstrlenW (lpString=".dbf") returned 4
	[0160.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.036] lstrlenW (lpString=".1cd") returned 4
	[0160.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.037] lstrlenW (lpString=".jpg") returned 4
	[0160.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.037] lstrlenW (lpString=".doc") returned 4
	[0160.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.037] lstrlenW (lpString=".docx") returned 5
	[0160.037] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0160.037] lstrlenW (lpString=".pdf") returned 4
	[0160.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.037] lstrlenW (lpString=".xls") returned 4
	[0160.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.037] lstrlenW (lpString=".xlsx") returned 5
	[0160.037] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0160.037] lstrlenW (lpString=".ppt") returned 4
	[0160.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.037] lstrlenW (lpString=".zip") returned 4
	[0160.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.037] lstrlenW (lpString=".rar") returned 4
	[0160.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.037] lstrlenW (lpString=".bz2") returned 4
	[0160.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.037] lstrlenW (lpString=".7z") returned 3
	[0160.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.037] lstrlenW (lpString=".dbf") returned 4
	[0160.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.038] lstrlenW (lpString=".1cd") returned 4
	[0160.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0160.038] lstrlenW (lpString=".jpg") returned 4
	[0160.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.038] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0160.038] lstrlenW (lpString="J0099167.JPG") returned 12
	[0160.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0160.039] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=43949) returned 1
	[0160.039] CloseHandle (hObject=0x500) returned 1
	[0160.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220
	[0160.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0160.040] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.040] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0160.040] GetLastError () returned 0x0
	[0160.040] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xabad, lpOverlapped=0x0) returned 1
	[0160.043] WriteFile (in: hFile=0x4fc, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xabb0, lpOverlapped=0x0) returned 1
	[0160.047] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.047] WriteFile (in: hFile=0x4fc, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.047] SetEndOfFile (hFile=0x4fc) returned 1
	[0160.047] CloseHandle (hObject=0x4fc) returned 1
	[0160.047] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.047] SetEndOfFile (hFile=0x500) returned 1
	[0160.051] CloseHandle (hObject=0x500) returned 1
	[0160.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0160.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1
	[0160.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.052] lstrlenW (lpString=".doc") returned 4
	[0160.052] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.052] lstrlenW (lpString=".docx") returned 5
	[0160.052] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0160.052] lstrlenW (lpString=".pdf") returned 4
	[0160.052] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.052] lstrlenW (lpString=".xls") returned 4
	[0160.052] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.052] lstrlenW (lpString=".xlsx") returned 5
	[0160.052] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0160.052] lstrlenW (lpString=".ppt") returned 4
	[0160.052] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.052] lstrlenW (lpString=".zip") returned 4
	[0160.052] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.052] lstrlenW (lpString=".rar") returned 4
	[0160.052] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.052] lstrlenW (lpString=".bz2") returned 4
	[0160.052] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.052] lstrlenW (lpString=".7z") returned 3
	[0160.052] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.052] lstrlenW (lpString=".dbf") returned 4
	[0160.053] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.053] lstrlenW (lpString=".1cd") returned 4
	[0160.053] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.053] lstrlenW (lpString=".jpg") returned 4
	[0160.053] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.053] lstrlenW (lpString=".doc") returned 4
	[0160.053] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.053] lstrlenW (lpString=".docx") returned 5
	[0160.053] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0160.053] lstrlenW (lpString=".pdf") returned 4
	[0160.053] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.053] lstrlenW (lpString=".xls") returned 4
	[0160.053] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.053] lstrlenW (lpString=".xlsx") returned 5
	[0160.053] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0160.053] lstrlenW (lpString=".ppt") returned 4
	[0160.053] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.053] lstrlenW (lpString=".zip") returned 4
	[0160.053] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.053] lstrlenW (lpString=".rar") returned 4
	[0160.053] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.053] lstrlenW (lpString=".bz2") returned 4
	[0160.053] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.053] lstrlenW (lpString=".7z") returned 3
	[0160.053] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.054] lstrlenW (lpString=".dbf") returned 4
	[0160.054] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.054] lstrlenW (lpString=".1cd") returned 4
	[0160.054] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0160.054] lstrlenW (lpString=".jpg") returned 4
	[0160.054] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.054] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0160.054] lstrlenW (lpString="J0099168.JPG") returned 12
	[0160.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0160.054] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=20179) returned 1
	[0160.055] CloseHandle (hObject=0x500) returned 1
	[0160.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220
	[0160.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0160.055] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.055] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0160.056] GetLastError () returned 0x0
	[0160.056] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4ed3, lpOverlapped=0x0) returned 1
	[0160.058] WriteFile (in: hFile=0x4fc, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4ee0, lpOverlapped=0x0) returned 1
	[0160.059] ReadFile (in: hFile=0x500, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.059] WriteFile (in: hFile=0x4fc, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.059] SetEndOfFile (hFile=0x4fc) returned 1
	[0160.059] CloseHandle (hObject=0x4fc) returned 1
	[0160.059] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.059] SetEndOfFile (hFile=0x500) returned 1
	[0160.062] CloseHandle (hObject=0x500) returned 1
	[0160.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0160.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1
	[0160.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.064] lstrlenW (lpString=".doc") returned 4
	[0160.064] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.064] lstrlenW (lpString=".docx") returned 5
	[0160.064] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0160.064] lstrlenW (lpString=".pdf") returned 4
	[0160.064] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.064] lstrlenW (lpString=".xls") returned 4
	[0160.064] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.064] lstrlenW (lpString=".xlsx") returned 5
	[0160.410] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0160.411] lstrlenW (lpString=".ppt") returned 4
	[0160.411] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.411] lstrlenW (lpString=".zip") returned 4
	[0160.411] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.411] lstrlenW (lpString=".rar") returned 4
	[0160.411] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.411] lstrlenW (lpString=".bz2") returned 4
	[0160.411] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.411] lstrlenW (lpString=".7z") returned 3
	[0160.411] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.411] lstrlenW (lpString=".dbf") returned 4
	[0160.411] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.411] lstrlenW (lpString=".1cd") returned 4
	[0160.411] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.411] lstrlenW (lpString=".jpg") returned 4
	[0160.411] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.411] lstrlenW (lpString=".doc") returned 4
	[0160.411] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.411] lstrlenW (lpString=".docx") returned 5
	[0160.411] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0160.411] lstrlenW (lpString=".pdf") returned 4
	[0160.411] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.411] lstrlenW (lpString=".xls") returned 4
	[0160.412] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.412] lstrlenW (lpString=".xlsx") returned 5
	[0160.412] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0160.412] lstrlenW (lpString=".ppt") returned 4
	[0160.412] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.412] lstrlenW (lpString=".zip") returned 4
	[0160.412] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.412] lstrlenW (lpString=".rar") returned 4
	[0160.412] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.412] lstrlenW (lpString=".bz2") returned 4
	[0160.412] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.412] lstrlenW (lpString=".7z") returned 3
	[0160.412] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.412] lstrlenW (lpString=".dbf") returned 4
	[0160.412] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.412] lstrlenW (lpString=".1cd") returned 4
	[0160.412] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0160.412] lstrlenW (lpString=".jpg") returned 4
	[0160.412] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.412] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0160.412] lstrlenW (lpString="J0099169.WMF") returned 12
	[0160.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0160.520] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=10192) returned 1
	[0160.520] CloseHandle (hObject=0x514) returned 1
	[0160.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220
	[0160.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0160.520] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.520] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0160.523] GetLastError () returned 0x0
	[0160.523] ReadFile (in: hFile=0x514, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x27d0, lpOverlapped=0x0) returned 1
	[0160.526] WriteFile (in: hFile=0x52c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x27e0, lpOverlapped=0x0) returned 1
	[0160.527] ReadFile (in: hFile=0x514, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.528] WriteFile (in: hFile=0x52c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.528] SetEndOfFile (hFile=0x52c) returned 1
	[0160.528] CloseHandle (hObject=0x52c) returned 1
	[0160.528] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.528] SetEndOfFile (hFile=0x514) returned 1
	[0160.530] CloseHandle (hObject=0x514) returned 1
	[0160.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0160.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1
	[0160.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.532] lstrlenW (lpString=".doc") returned 4
	[0160.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.532] lstrlenW (lpString=".docx") returned 5
	[0160.532] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0160.532] lstrlenW (lpString=".pdf") returned 4
	[0160.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.532] lstrlenW (lpString=".xls") returned 4
	[0160.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.533] lstrlenW (lpString=".xlsx") returned 5
	[0160.533] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0160.533] lstrlenW (lpString=".ppt") returned 4
	[0160.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.533] lstrlenW (lpString=".zip") returned 4
	[0160.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.533] lstrlenW (lpString=".rar") returned 4
	[0160.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.533] lstrlenW (lpString=".bz2") returned 4
	[0160.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.533] lstrlenW (lpString=".7z") returned 3
	[0160.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.533] lstrlenW (lpString=".dbf") returned 4
	[0160.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.533] lstrlenW (lpString=".1cd") returned 4
	[0160.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.533] lstrlenW (lpString=".jpg") returned 4
	[0160.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.533] lstrlenW (lpString=".doc") returned 4
	[0160.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.534] lstrlenW (lpString=".docx") returned 5
	[0160.534] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0160.534] lstrlenW (lpString=".pdf") returned 4
	[0160.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.534] lstrlenW (lpString=".xls") returned 4
	[0160.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.534] lstrlenW (lpString=".xlsx") returned 5
	[0160.534] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0160.534] lstrlenW (lpString=".ppt") returned 4
	[0160.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.534] lstrlenW (lpString=".zip") returned 4
	[0160.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.534] lstrlenW (lpString=".rar") returned 4
	[0160.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.534] lstrlenW (lpString=".bz2") returned 4
	[0160.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.534] lstrlenW (lpString=".7z") returned 3
	[0160.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.534] lstrlenW (lpString=".dbf") returned 4
	[0160.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.534] lstrlenW (lpString=".1cd") returned 4
	[0160.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0160.534] lstrlenW (lpString=".jpg") returned 4
	[0160.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.535] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0160.535] lstrlenW (lpString="J0099170.WMF") returned 12
	[0160.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0160.536] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=24292) returned 1
	[0160.536] CloseHandle (hObject=0x514) returned 1
	[0160.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220
	[0160.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0160.540] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.540] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0160.540] GetLastError () returned 0x0
	[0160.540] ReadFile (in: hFile=0x514, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x5ee4, lpOverlapped=0x0) returned 1
	[0160.543] WriteFile (in: hFile=0x52c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x5ef0, lpOverlapped=0x0) returned 1
	[0160.544] ReadFile (in: hFile=0x514, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.544] WriteFile (in: hFile=0x52c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.545] SetEndOfFile (hFile=0x52c) returned 1
	[0160.545] CloseHandle (hObject=0x52c) returned 1
	[0160.545] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.545] SetEndOfFile (hFile=0x514) returned 1
	[0160.549] CloseHandle (hObject=0x514) returned 1
	[0160.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0160.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1
	[0160.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.550] lstrlenW (lpString=".doc") returned 4
	[0160.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.550] lstrlenW (lpString=".docx") returned 5
	[0160.550] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0160.550] lstrlenW (lpString=".pdf") returned 4
	[0160.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.550] lstrlenW (lpString=".xls") returned 4
	[0160.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.551] lstrlenW (lpString=".xlsx") returned 5
	[0160.551] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0160.551] lstrlenW (lpString=".ppt") returned 4
	[0160.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.551] lstrlenW (lpString=".zip") returned 4
	[0160.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.551] lstrlenW (lpString=".rar") returned 4
	[0160.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.551] lstrlenW (lpString=".bz2") returned 4
	[0160.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.551] lstrlenW (lpString=".7z") returned 3
	[0160.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.551] lstrlenW (lpString=".dbf") returned 4
	[0160.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.551] lstrlenW (lpString=".1cd") returned 4
	[0160.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.551] lstrlenW (lpString=".jpg") returned 4
	[0160.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.551] lstrlenW (lpString=".doc") returned 4
	[0160.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.551] lstrlenW (lpString=".docx") returned 5
	[0160.551] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0160.551] lstrlenW (lpString=".pdf") returned 4
	[0160.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.552] lstrlenW (lpString=".xls") returned 4
	[0160.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.552] lstrlenW (lpString=".xlsx") returned 5
	[0160.552] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0160.552] lstrlenW (lpString=".ppt") returned 4
	[0160.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.552] lstrlenW (lpString=".zip") returned 4
	[0160.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.552] lstrlenW (lpString=".rar") returned 4
	[0160.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.552] lstrlenW (lpString=".bz2") returned 4
	[0160.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.552] lstrlenW (lpString=".7z") returned 3
	[0160.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.552] lstrlenW (lpString=".dbf") returned 4
	[0160.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.552] lstrlenW (lpString=".1cd") returned 4
	[0160.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0160.552] lstrlenW (lpString=".jpg") returned 4
	[0160.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.552] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0160.553] lstrlenW (lpString="J0099171.WMF") returned 12
	[0160.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0160.553] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=8754) returned 1
	[0160.553] CloseHandle (hObject=0x514) returned 1
	[0160.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220
	[0160.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0160.554] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.554] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0160.554] GetLastError () returned 0x0
	[0160.554] ReadFile (in: hFile=0x514, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2232, lpOverlapped=0x0) returned 1
	[0160.557] WriteFile (in: hFile=0x52c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2240, lpOverlapped=0x0) returned 1
	[0160.558] ReadFile (in: hFile=0x514, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.558] WriteFile (in: hFile=0x52c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.558] SetEndOfFile (hFile=0x52c) returned 1
	[0160.558] CloseHandle (hObject=0x52c) returned 1
	[0160.558] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.558] SetEndOfFile (hFile=0x514) returned 1
	[0160.561] CloseHandle (hObject=0x514) returned 1
	[0160.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0160.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1
	[0160.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.562] lstrlenW (lpString=".doc") returned 4
	[0160.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.562] lstrlenW (lpString=".docx") returned 5
	[0160.562] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0160.562] lstrlenW (lpString=".pdf") returned 4
	[0160.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.562] lstrlenW (lpString=".xls") returned 4
	[0160.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.562] lstrlenW (lpString=".xlsx") returned 5
	[0160.562] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0160.562] lstrlenW (lpString=".ppt") returned 4
	[0160.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.563] lstrlenW (lpString=".zip") returned 4
	[0160.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.563] lstrlenW (lpString=".rar") returned 4
	[0160.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.563] lstrlenW (lpString=".bz2") returned 4
	[0160.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.563] lstrlenW (lpString=".7z") returned 3
	[0160.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.563] lstrlenW (lpString=".dbf") returned 4
	[0160.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.563] lstrlenW (lpString=".1cd") returned 4
	[0160.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.563] lstrlenW (lpString=".jpg") returned 4
	[0160.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.563] lstrlenW (lpString=".doc") returned 4
	[0160.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.563] lstrlenW (lpString=".docx") returned 5
	[0160.563] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0160.563] lstrlenW (lpString=".pdf") returned 4
	[0160.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.563] lstrlenW (lpString=".xls") returned 4
	[0160.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.563] lstrlenW (lpString=".xlsx") returned 5
	[0160.563] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0160.564] lstrlenW (lpString=".ppt") returned 4
	[0160.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.564] lstrlenW (lpString=".zip") returned 4
	[0160.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.564] lstrlenW (lpString=".rar") returned 4
	[0160.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.564] lstrlenW (lpString=".bz2") returned 4
	[0160.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.564] lstrlenW (lpString=".7z") returned 3
	[0160.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.564] lstrlenW (lpString=".dbf") returned 4
	[0160.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.564] lstrlenW (lpString=".1cd") returned 4
	[0160.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0160.564] lstrlenW (lpString=".jpg") returned 4
	[0160.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.705] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0160.705] lstrlenW (lpString="J0099173.WMF") returned 12
	[0160.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0160.873] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=37140) returned 1
	[0160.873] CloseHandle (hObject=0x44c) returned 1
	[0160.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220
	[0160.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.457] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.457] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.876] GetLastError () returned 0x0
	[0161.876] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x9114, lpOverlapped=0x0) returned 1
	[0161.891] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x9120, lpOverlapped=0x0) returned 1
	[0161.893] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.893] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.893] SetEndOfFile (hFile=0x544) returned 1
	[0161.893] CloseHandle (hObject=0x544) returned 1
	[0161.893] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.893] SetEndOfFile (hFile=0x51c) returned 1
	[0161.896] CloseHandle (hObject=0x51c) returned 1
	[0161.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1
	[0161.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.897] lstrlenW (lpString=".doc") returned 4
	[0161.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.897] lstrlenW (lpString=".docx") returned 5
	[0161.897] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0161.897] lstrlenW (lpString=".pdf") returned 4
	[0161.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.897] lstrlenW (lpString=".xls") returned 4
	[0161.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.897] lstrlenW (lpString=".xlsx") returned 5
	[0161.897] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0161.897] lstrlenW (lpString=".ppt") returned 4
	[0161.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.898] lstrlenW (lpString=".zip") returned 4
	[0161.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.898] lstrlenW (lpString=".rar") returned 4
	[0161.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.898] lstrlenW (lpString=".bz2") returned 4
	[0161.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.898] lstrlenW (lpString=".7z") returned 3
	[0161.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.898] lstrlenW (lpString=".dbf") returned 4
	[0161.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.898] lstrlenW (lpString=".1cd") returned 4
	[0161.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.898] lstrlenW (lpString=".jpg") returned 4
	[0161.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.898] lstrlenW (lpString=".doc") returned 4
	[0161.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.898] lstrlenW (lpString=".docx") returned 5
	[0161.898] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0161.898] lstrlenW (lpString=".pdf") returned 4
	[0161.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.898] lstrlenW (lpString=".xls") returned 4
	[0161.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.898] lstrlenW (lpString=".xlsx") returned 5
	[0161.898] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0161.898] lstrlenW (lpString=".ppt") returned 4
	[0161.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.899] lstrlenW (lpString=".zip") returned 4
	[0161.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.899] lstrlenW (lpString=".rar") returned 4
	[0161.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.899] lstrlenW (lpString=".bz2") returned 4
	[0161.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.899] lstrlenW (lpString=".7z") returned 3
	[0161.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.899] lstrlenW (lpString=".dbf") returned 4
	[0161.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.899] lstrlenW (lpString=".1cd") returned 4
	[0161.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0161.899] lstrlenW (lpString=".jpg") returned 4
	[0161.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.899] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0161.899] lstrlenW (lpString="J0099184.WMF") returned 12
	[0161.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.900] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=4118) returned 1
	[0161.900] CloseHandle (hObject=0x51c) returned 1
	[0161.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220
	[0161.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.900] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.900] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.901] GetLastError () returned 0x0
	[0161.901] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1016, lpOverlapped=0x0) returned 1
	[0161.902] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0161.903] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.903] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.904] SetEndOfFile (hFile=0x544) returned 1
	[0161.904] CloseHandle (hObject=0x544) returned 1
	[0161.904] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.904] SetEndOfFile (hFile=0x51c) returned 1
	[0161.907] CloseHandle (hObject=0x51c) returned 1
	[0161.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1
	[0161.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.908] lstrlenW (lpString=".doc") returned 4
	[0161.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.908] lstrlenW (lpString=".docx") returned 5
	[0161.908] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0161.908] lstrlenW (lpString=".pdf") returned 4
	[0161.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.908] lstrlenW (lpString=".xls") returned 4
	[0161.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.908] lstrlenW (lpString=".xlsx") returned 5
	[0161.908] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0161.908] lstrlenW (lpString=".ppt") returned 4
	[0161.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.909] lstrlenW (lpString=".zip") returned 4
	[0161.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.909] lstrlenW (lpString=".rar") returned 4
	[0161.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.909] lstrlenW (lpString=".bz2") returned 4
	[0161.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.909] lstrlenW (lpString=".7z") returned 3
	[0161.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.909] lstrlenW (lpString=".dbf") returned 4
	[0161.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.909] lstrlenW (lpString=".1cd") returned 4
	[0161.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.909] lstrlenW (lpString=".jpg") returned 4
	[0161.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.909] lstrlenW (lpString=".doc") returned 4
	[0161.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.909] lstrlenW (lpString=".docx") returned 5
	[0161.909] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0161.909] lstrlenW (lpString=".pdf") returned 4
	[0161.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.909] lstrlenW (lpString=".xls") returned 4
	[0161.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.909] lstrlenW (lpString=".xlsx") returned 5
	[0161.909] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0161.910] lstrlenW (lpString=".ppt") returned 4
	[0161.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.910] lstrlenW (lpString=".zip") returned 4
	[0161.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.910] lstrlenW (lpString=".rar") returned 4
	[0161.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.910] lstrlenW (lpString=".bz2") returned 4
	[0161.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.910] lstrlenW (lpString=".7z") returned 3
	[0161.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.910] lstrlenW (lpString=".dbf") returned 4
	[0161.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.910] lstrlenW (lpString=".1cd") returned 4
	[0161.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0161.910] lstrlenW (lpString=".jpg") returned 4
	[0161.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.910] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0161.910] lstrlenW (lpString="J0099185.JPG") returned 12
	[0161.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.911] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=3282) returned 1
	[0161.911] CloseHandle (hObject=0x51c) returned 1
	[0161.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220
	[0161.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.912] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.912] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.913] GetLastError () returned 0x0
	[0161.913] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xcd2, lpOverlapped=0x0) returned 1
	[0161.914] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xce0, lpOverlapped=0x0) returned 1
	[0161.915] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.915] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.915] SetEndOfFile (hFile=0x544) returned 1
	[0161.915] CloseHandle (hObject=0x544) returned 1
	[0161.915] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.915] SetEndOfFile (hFile=0x51c) returned 1
	[0161.918] CloseHandle (hObject=0x51c) returned 1
	[0161.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1
	[0161.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.919] lstrlenW (lpString=".doc") returned 4
	[0161.919] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0161.919] lstrlenW (lpString=".docx") returned 5
	[0161.919] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0161.919] lstrlenW (lpString=".pdf") returned 4
	[0161.919] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0161.919] lstrlenW (lpString=".xls") returned 4
	[0161.919] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0161.919] lstrlenW (lpString=".xlsx") returned 5
	[0161.919] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0161.919] lstrlenW (lpString=".ppt") returned 4
	[0161.919] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0161.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.919] lstrlenW (lpString=".zip") returned 4
	[0161.919] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0161.919] lstrlenW (lpString=".rar") returned 4
	[0161.919] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0161.919] lstrlenW (lpString=".bz2") returned 4
	[0161.919] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0161.919] lstrlenW (lpString=".7z") returned 3
	[0161.920] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0161.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.920] lstrlenW (lpString=".dbf") returned 4
	[0161.920] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0161.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.920] lstrlenW (lpString=".1cd") returned 4
	[0161.920] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0161.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.920] lstrlenW (lpString=".jpg") returned 4
	[0161.920] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0161.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.920] lstrlenW (lpString=".doc") returned 4
	[0161.920] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0161.920] lstrlenW (lpString=".docx") returned 5
	[0161.920] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0161.920] lstrlenW (lpString=".pdf") returned 4
	[0161.920] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0161.920] lstrlenW (lpString=".xls") returned 4
	[0161.920] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0161.920] lstrlenW (lpString=".xlsx") returned 5
	[0161.920] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0161.920] lstrlenW (lpString=".ppt") returned 4
	[0161.920] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0161.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.920] lstrlenW (lpString=".zip") returned 4
	[0161.920] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0161.920] lstrlenW (lpString=".rar") returned 4
	[0161.920] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0161.920] lstrlenW (lpString=".bz2") returned 4
	[0161.921] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0161.921] lstrlenW (lpString=".7z") returned 3
	[0161.921] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0161.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.921] lstrlenW (lpString=".dbf") returned 4
	[0161.921] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0161.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.921] lstrlenW (lpString=".1cd") returned 4
	[0161.921] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0161.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0161.921] lstrlenW (lpString=".jpg") returned 4
	[0161.921] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0161.921] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0161.921] lstrlenW (lpString="J0099186.JPG") returned 12
	[0161.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.921] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=16738) returned 1
	[0161.922] CloseHandle (hObject=0x51c) returned 1
	[0161.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220
	[0161.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.922] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.922] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.923] GetLastError () returned 0x0
	[0161.923] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4162, lpOverlapped=0x0) returned 1
	[0162.347] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4170, lpOverlapped=0x0) returned 1
	[0162.348] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.348] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.348] SetEndOfFile (hFile=0x544) returned 1
	[0162.348] CloseHandle (hObject=0x544) returned 1
	[0162.348] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.348] SetEndOfFile (hFile=0x51c) returned 1
	[0162.351] CloseHandle (hObject=0x51c) returned 1
	[0162.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1
	[0162.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.352] lstrlenW (lpString=".doc") returned 4
	[0162.352] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.352] lstrlenW (lpString=".docx") returned 5
	[0162.352] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0162.352] lstrlenW (lpString=".pdf") returned 4
	[0162.352] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.352] lstrlenW (lpString=".xls") returned 4
	[0162.352] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.352] lstrlenW (lpString=".xlsx") returned 5
	[0162.352] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0162.352] lstrlenW (lpString=".ppt") returned 4
	[0162.352] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.352] lstrlenW (lpString=".zip") returned 4
	[0162.352] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.352] lstrlenW (lpString=".rar") returned 4
	[0162.352] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.352] lstrlenW (lpString=".bz2") returned 4
	[0162.352] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.352] lstrlenW (lpString=".7z") returned 3
	[0162.353] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.353] lstrlenW (lpString=".dbf") returned 4
	[0162.353] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.353] lstrlenW (lpString=".1cd") returned 4
	[0162.353] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.353] lstrlenW (lpString=".jpg") returned 4
	[0162.353] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.353] lstrlenW (lpString=".doc") returned 4
	[0162.353] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.353] lstrlenW (lpString=".docx") returned 5
	[0162.353] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0162.353] lstrlenW (lpString=".pdf") returned 4
	[0162.353] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.353] lstrlenW (lpString=".xls") returned 4
	[0162.353] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.353] lstrlenW (lpString=".xlsx") returned 5
	[0162.353] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0162.353] lstrlenW (lpString=".ppt") returned 4
	[0162.353] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.353] lstrlenW (lpString=".zip") returned 4
	[0162.353] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.353] lstrlenW (lpString=".rar") returned 4
	[0162.353] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.353] lstrlenW (lpString=".bz2") returned 4
	[0162.353] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.353] lstrlenW (lpString=".7z") returned 3
	[0162.354] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.354] lstrlenW (lpString=".dbf") returned 4
	[0162.354] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.354] lstrlenW (lpString=".1cd") returned 4
	[0162.354] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0162.354] lstrlenW (lpString=".jpg") returned 4
	[0162.354] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.354] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.354] lstrlenW (lpString="J0099195.GIF") returned 12
	[0162.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0162.355] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=19923) returned 1
	[0162.355] CloseHandle (hObject=0x51c) returned 1
	[0162.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220
	[0162.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0162.356] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.356] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.356] GetLastError () returned 0x0
	[0162.356] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4dd3, lpOverlapped=0x0) returned 1
	[0162.358] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0162.359] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.360] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.360] SetEndOfFile (hFile=0x544) returned 1
	[0162.360] CloseHandle (hObject=0x544) returned 1
	[0162.360] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.360] SetEndOfFile (hFile=0x51c) returned 1
	[0162.363] CloseHandle (hObject=0x51c) returned 1
	[0162.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1
	[0162.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.364] lstrlenW (lpString=".doc") returned 4
	[0162.364] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.364] lstrlenW (lpString=".docx") returned 5
	[0162.364] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1
	[0162.364] lstrlenW (lpString=".pdf") returned 4
	[0162.364] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.364] lstrlenW (lpString=".xls") returned 4
	[0162.364] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.364] lstrlenW (lpString=".xlsx") returned 5
	[0162.364] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1
	[0162.364] lstrlenW (lpString=".ppt") returned 4
	[0162.364] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.365] lstrlenW (lpString=".zip") returned 4
	[0162.365] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.365] lstrlenW (lpString=".rar") returned 4
	[0162.365] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.365] lstrlenW (lpString=".bz2") returned 4
	[0162.365] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.365] lstrlenW (lpString=".7z") returned 3
	[0162.365] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.365] lstrlenW (lpString=".dbf") returned 4
	[0162.365] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.365] lstrlenW (lpString=".1cd") returned 4
	[0162.365] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.365] lstrlenW (lpString=".jpg") returned 4
	[0162.365] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.365] lstrlenW (lpString=".doc") returned 4
	[0162.365] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.365] lstrlenW (lpString=".docx") returned 5
	[0162.365] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1
	[0162.365] lstrlenW (lpString=".pdf") returned 4
	[0162.365] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.365] lstrlenW (lpString=".xls") returned 4
	[0162.365] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.365] lstrlenW (lpString=".xlsx") returned 5
	[0162.365] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1
	[0162.365] lstrlenW (lpString=".ppt") returned 4
	[0162.365] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.366] lstrlenW (lpString=".zip") returned 4
	[0162.366] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.366] lstrlenW (lpString=".rar") returned 4
	[0162.366] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.366] lstrlenW (lpString=".bz2") returned 4
	[0162.366] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.366] lstrlenW (lpString=".7z") returned 3
	[0162.366] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.366] lstrlenW (lpString=".dbf") returned 4
	[0162.366] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.366] lstrlenW (lpString=".1cd") returned 4
	[0162.366] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0162.366] lstrlenW (lpString=".jpg") returned 4
	[0162.366] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.366] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.366] lstrlenW (lpString="J0099196.GIF") returned 12
	[0162.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0162.367] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=14337) returned 1
	[0162.367] CloseHandle (hObject=0x51c) returned 1
	[0162.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220
	[0162.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0162.367] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.367] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.369] GetLastError () returned 0x0
	[0162.369] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x3801, lpOverlapped=0x0) returned 1
	[0162.371] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x3810, lpOverlapped=0x0) returned 1
	[0162.372] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.372] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.372] SetEndOfFile (hFile=0x544) returned 1
	[0162.372] CloseHandle (hObject=0x544) returned 1
	[0162.372] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.373] SetEndOfFile (hFile=0x51c) returned 1
	[0162.375] CloseHandle (hObject=0x51c) returned 1
	[0162.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1
	[0162.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.377] lstrlenW (lpString=".doc") returned 4
	[0162.377] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.377] lstrlenW (lpString=".docx") returned 5
	[0162.377] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1
	[0162.377] lstrlenW (lpString=".pdf") returned 4
	[0162.377] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.377] lstrlenW (lpString=".xls") returned 4
	[0162.377] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.377] lstrlenW (lpString=".xlsx") returned 5
	[0162.377] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1
	[0162.377] lstrlenW (lpString=".ppt") returned 4
	[0162.377] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.377] lstrlenW (lpString=".zip") returned 4
	[0162.377] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.377] lstrlenW (lpString=".rar") returned 4
	[0162.377] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.377] lstrlenW (lpString=".bz2") returned 4
	[0162.377] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.377] lstrlenW (lpString=".7z") returned 3
	[0162.377] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.377] lstrlenW (lpString=".dbf") returned 4
	[0162.377] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.377] lstrlenW (lpString=".1cd") returned 4
	[0162.377] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.377] lstrlenW (lpString=".jpg") returned 4
	[0162.377] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.378] lstrlenW (lpString=".doc") returned 4
	[0162.378] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.378] lstrlenW (lpString=".docx") returned 5
	[0162.378] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1
	[0162.378] lstrlenW (lpString=".pdf") returned 4
	[0162.378] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.378] lstrlenW (lpString=".xls") returned 4
	[0162.378] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.378] lstrlenW (lpString=".xlsx") returned 5
	[0162.378] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1
	[0162.378] lstrlenW (lpString=".ppt") returned 4
	[0162.378] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.378] lstrlenW (lpString=".zip") returned 4
	[0162.378] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.378] lstrlenW (lpString=".rar") returned 4
	[0162.378] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.378] lstrlenW (lpString=".bz2") returned 4
	[0162.378] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.378] lstrlenW (lpString=".7z") returned 3
	[0162.378] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.378] lstrlenW (lpString=".dbf") returned 4
	[0162.378] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.378] lstrlenW (lpString=".1cd") returned 4
	[0162.378] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.378] lstrlenW (lpString=".jpg") returned 4
	[0162.378] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.379] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.379] lstrlenW (lpString="J0099197.GIF") returned 12
	[0162.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0162.379] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=10898) returned 1
	[0162.379] CloseHandle (hObject=0x51c) returned 1
	[0162.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220
	[0162.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0162.380] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.380] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.380] GetLastError () returned 0x0
	[0162.380] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2a92, lpOverlapped=0x0) returned 1
	[0162.774] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2aa0, lpOverlapped=0x0) returned 1
	[0162.775] ReadFile (in: hFile=0x51c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.775] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.775] SetEndOfFile (hFile=0x544) returned 1
	[0162.776] CloseHandle (hObject=0x544) returned 1
	[0162.776] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.776] SetEndOfFile (hFile=0x51c) returned 1
	[0162.778] CloseHandle (hObject=0x51c) returned 1
	[0162.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1
	[0162.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.780] lstrlenW (lpString=".doc") returned 4
	[0162.780] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.780] lstrlenW (lpString=".docx") returned 5
	[0162.780] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1
	[0162.780] lstrlenW (lpString=".pdf") returned 4
	[0162.780] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.780] lstrlenW (lpString=".xls") returned 4
	[0162.780] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.780] lstrlenW (lpString=".xlsx") returned 5
	[0162.780] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1
	[0162.780] lstrlenW (lpString=".ppt") returned 4
	[0162.780] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.780] lstrlenW (lpString=".zip") returned 4
	[0162.780] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.780] lstrlenW (lpString=".rar") returned 4
	[0162.780] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.780] lstrlenW (lpString=".bz2") returned 4
	[0162.780] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.780] lstrlenW (lpString=".7z") returned 3
	[0162.780] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.780] lstrlenW (lpString=".dbf") returned 4
	[0162.780] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.780] lstrlenW (lpString=".1cd") returned 4
	[0162.780] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.780] lstrlenW (lpString=".jpg") returned 4
	[0162.780] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.781] lstrlenW (lpString=".doc") returned 4
	[0162.781] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.781] lstrlenW (lpString=".docx") returned 5
	[0162.781] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1
	[0162.781] lstrlenW (lpString=".pdf") returned 4
	[0162.781] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.781] lstrlenW (lpString=".xls") returned 4
	[0162.781] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.781] lstrlenW (lpString=".xlsx") returned 5
	[0162.781] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1
	[0162.781] lstrlenW (lpString=".ppt") returned 4
	[0162.781] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.781] lstrlenW (lpString=".zip") returned 4
	[0162.781] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.781] lstrlenW (lpString=".rar") returned 4
	[0162.781] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.781] lstrlenW (lpString=".bz2") returned 4
	[0162.781] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.781] lstrlenW (lpString=".7z") returned 3
	[0162.781] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.781] lstrlenW (lpString=".dbf") returned 4
	[0162.781] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.781] lstrlenW (lpString=".1cd") returned 4
	[0162.781] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0162.781] lstrlenW (lpString=".jpg") returned 4
	[0162.782] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.782] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0162.782] lstrlenW (lpString="J0101858.BMP") returned 12
	[0162.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0162.895] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=32184) returned 1
	[0162.895] CloseHandle (hObject=0x4e4) returned 1
	[0162.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220
	[0162.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0162.896] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.896] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0162.910] GetLastError () returned 0x0
	[0162.910] ReadFile (in: hFile=0x4e4, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0162.912] WriteFile (in: hFile=0x54c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0162.914] ReadFile (in: hFile=0x4e4, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.914] WriteFile (in: hFile=0x54c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.914] SetEndOfFile (hFile=0x54c) returned 1
	[0162.914] CloseHandle (hObject=0x54c) returned 1
	[0162.914] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.914] SetEndOfFile (hFile=0x4e4) returned 1
	[0162.917] CloseHandle (hObject=0x4e4) returned 1
	[0162.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1
	[0162.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.918] lstrlenW (lpString=".doc") returned 4
	[0162.918] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.918] lstrlenW (lpString=".docx") returned 5
	[0162.918] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1
	[0162.918] lstrlenW (lpString=".pdf") returned 4
	[0162.918] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.918] lstrlenW (lpString=".xls") returned 4
	[0162.918] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.919] lstrlenW (lpString=".xlsx") returned 5
	[0162.919] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1
	[0162.919] lstrlenW (lpString=".ppt") returned 4
	[0162.919] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.919] lstrlenW (lpString=".zip") returned 4
	[0162.919] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.919] lstrlenW (lpString=".rar") returned 4
	[0162.919] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.919] lstrlenW (lpString=".bz2") returned 4
	[0162.919] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.919] lstrlenW (lpString=".7z") returned 3
	[0162.919] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.919] lstrlenW (lpString=".dbf") returned 4
	[0162.919] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.919] lstrlenW (lpString=".1cd") returned 4
	[0162.919] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.919] lstrlenW (lpString=".jpg") returned 4
	[0162.919] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.919] lstrlenW (lpString=".doc") returned 4
	[0162.919] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.919] lstrlenW (lpString=".docx") returned 5
	[0162.919] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1
	[0162.919] lstrlenW (lpString=".pdf") returned 4
	[0162.919] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.920] lstrlenW (lpString=".xls") returned 4
	[0162.920] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.920] lstrlenW (lpString=".xlsx") returned 5
	[0162.920] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1
	[0162.920] lstrlenW (lpString=".ppt") returned 4
	[0162.920] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.920] lstrlenW (lpString=".zip") returned 4
	[0162.920] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.920] lstrlenW (lpString=".rar") returned 4
	[0162.920] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.920] lstrlenW (lpString=".bz2") returned 4
	[0162.920] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.920] lstrlenW (lpString=".7z") returned 3
	[0162.920] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.920] lstrlenW (lpString=".dbf") returned 4
	[0162.920] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.920] lstrlenW (lpString=".1cd") returned 4
	[0162.920] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.920] lstrlenW (lpString=".jpg") returned 4
	[0162.920] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.920] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0162.920] lstrlenW (lpString="J0101859.BMP") returned 12
	[0162.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0162.921] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=31968) returned 1
	[0162.921] CloseHandle (hObject=0x4e4) returned 1
	[0162.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220
	[0162.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0162.922] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.922] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0162.922] GetLastError () returned 0x0
	[0162.922] ReadFile (in: hFile=0x4e4, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x7ce0, lpOverlapped=0x0) returned 1
	[0162.925] WriteFile (in: hFile=0x54c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x7cf0, lpOverlapped=0x0) returned 1
	[0162.927] ReadFile (in: hFile=0x4e4, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.927] WriteFile (in: hFile=0x54c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.927] SetEndOfFile (hFile=0x54c) returned 1
	[0162.927] CloseHandle (hObject=0x54c) returned 1
	[0162.927] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.927] SetEndOfFile (hFile=0x4e4) returned 1
	[0162.930] CloseHandle (hObject=0x4e4) returned 1
	[0162.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1
	[0162.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.931] lstrlenW (lpString=".doc") returned 4
	[0162.931] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.931] lstrlenW (lpString=".docx") returned 5
	[0162.931] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1
	[0162.931] lstrlenW (lpString=".pdf") returned 4
	[0162.931] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.931] lstrlenW (lpString=".xls") returned 4
	[0162.931] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.931] lstrlenW (lpString=".xlsx") returned 5
	[0162.931] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1
	[0162.931] lstrlenW (lpString=".ppt") returned 4
	[0162.931] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.932] lstrlenW (lpString=".zip") returned 4
	[0162.932] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.932] lstrlenW (lpString=".rar") returned 4
	[0162.932] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.932] lstrlenW (lpString=".bz2") returned 4
	[0162.932] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.932] lstrlenW (lpString=".7z") returned 3
	[0162.932] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.932] lstrlenW (lpString=".dbf") returned 4
	[0162.932] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.932] lstrlenW (lpString=".1cd") returned 4
	[0162.932] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.932] lstrlenW (lpString=".jpg") returned 4
	[0162.932] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.932] lstrlenW (lpString=".doc") returned 4
	[0162.932] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.932] lstrlenW (lpString=".docx") returned 5
	[0162.932] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1
	[0162.932] lstrlenW (lpString=".pdf") returned 4
	[0162.932] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.932] lstrlenW (lpString=".xls") returned 4
	[0162.932] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.932] lstrlenW (lpString=".xlsx") returned 5
	[0162.932] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1
	[0162.932] lstrlenW (lpString=".ppt") returned 4
	[0162.933] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.933] lstrlenW (lpString=".zip") returned 4
	[0162.933] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.933] lstrlenW (lpString=".rar") returned 4
	[0162.933] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.933] lstrlenW (lpString=".bz2") returned 4
	[0162.933] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.933] lstrlenW (lpString=".7z") returned 3
	[0162.933] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.933] lstrlenW (lpString=".dbf") returned 4
	[0162.933] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.933] lstrlenW (lpString=".1cd") returned 4
	[0162.933] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.933] lstrlenW (lpString=".jpg") returned 4
	[0162.933] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.933] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0162.933] lstrlenW (lpString="J0101860.BMP") returned 12
	[0162.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0163.025] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=32184) returned 1
	[0163.025] CloseHandle (hObject=0x55c) returned 1
	[0163.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220
	[0163.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.044] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.044] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.209] GetLastError () returned 0x0
	[0163.209] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0163.211] WriteFile (in: hFile=0x554, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0163.212] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.212] WriteFile (in: hFile=0x554, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.212] SetEndOfFile (hFile=0x554) returned 1
	[0163.213] CloseHandle (hObject=0x554) returned 1
	[0163.213] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.213] SetEndOfFile (hFile=0x534) returned 1
	[0163.215] CloseHandle (hObject=0x534) returned 1
	[0163.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1
	[0163.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.217] lstrlenW (lpString=".doc") returned 4
	[0163.217] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.217] lstrlenW (lpString=".docx") returned 5
	[0163.217] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1
	[0163.217] lstrlenW (lpString=".pdf") returned 4
	[0163.217] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.217] lstrlenW (lpString=".xls") returned 4
	[0163.217] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.217] lstrlenW (lpString=".xlsx") returned 5
	[0163.217] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1
	[0163.217] lstrlenW (lpString=".ppt") returned 4
	[0163.217] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.217] lstrlenW (lpString=".zip") returned 4
	[0163.217] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.217] lstrlenW (lpString=".rar") returned 4
	[0163.217] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.217] lstrlenW (lpString=".bz2") returned 4
	[0163.217] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.217] lstrlenW (lpString=".7z") returned 3
	[0163.217] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.217] lstrlenW (lpString=".dbf") returned 4
	[0163.217] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.217] lstrlenW (lpString=".1cd") returned 4
	[0163.217] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.217] lstrlenW (lpString=".jpg") returned 4
	[0163.218] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.218] lstrlenW (lpString=".doc") returned 4
	[0163.218] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.218] lstrlenW (lpString=".docx") returned 5
	[0163.218] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1
	[0163.218] lstrlenW (lpString=".pdf") returned 4
	[0163.218] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.218] lstrlenW (lpString=".xls") returned 4
	[0163.218] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.218] lstrlenW (lpString=".xlsx") returned 5
	[0163.218] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1
	[0163.218] lstrlenW (lpString=".ppt") returned 4
	[0163.218] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.218] lstrlenW (lpString=".zip") returned 4
	[0163.218] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.218] lstrlenW (lpString=".rar") returned 4
	[0163.218] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.218] lstrlenW (lpString=".bz2") returned 4
	[0163.218] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.218] lstrlenW (lpString=".7z") returned 3
	[0163.218] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.218] lstrlenW (lpString=".dbf") returned 4
	[0163.218] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.218] lstrlenW (lpString=".1cd") returned 4
	[0163.218] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0163.219] lstrlenW (lpString=".jpg") returned 4
	[0163.219] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.219] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0163.219] lstrlenW (lpString="J0101862.BMP") returned 12
	[0163.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.219] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=32184) returned 1
	[0163.219] CloseHandle (hObject=0x534) returned 1
	[0163.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220
	[0163.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.220] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.220] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.221] GetLastError () returned 0x0
	[0163.221] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0163.223] WriteFile (in: hFile=0x554, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0163.225] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.225] WriteFile (in: hFile=0x554, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.225] SetEndOfFile (hFile=0x554) returned 1
	[0163.225] CloseHandle (hObject=0x554) returned 1
	[0163.225] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.225] SetEndOfFile (hFile=0x534) returned 1
	[0163.228] CloseHandle (hObject=0x534) returned 1
	[0163.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1
	[0163.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.229] lstrlenW (lpString=".doc") returned 4
	[0163.229] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.229] lstrlenW (lpString=".docx") returned 5
	[0163.229] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1
	[0163.229] lstrlenW (lpString=".pdf") returned 4
	[0163.229] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.229] lstrlenW (lpString=".xls") returned 4
	[0163.229] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.229] lstrlenW (lpString=".xlsx") returned 5
	[0163.229] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1
	[0163.229] lstrlenW (lpString=".ppt") returned 4
	[0163.229] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.229] lstrlenW (lpString=".zip") returned 4
	[0163.229] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.229] lstrlenW (lpString=".rar") returned 4
	[0163.229] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.229] lstrlenW (lpString=".bz2") returned 4
	[0163.229] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.230] lstrlenW (lpString=".7z") returned 3
	[0163.230] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.230] lstrlenW (lpString=".dbf") returned 4
	[0163.230] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.230] lstrlenW (lpString=".1cd") returned 4
	[0163.230] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.230] lstrlenW (lpString=".jpg") returned 4
	[0163.230] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.230] lstrlenW (lpString=".doc") returned 4
	[0163.230] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.230] lstrlenW (lpString=".docx") returned 5
	[0163.230] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1
	[0163.230] lstrlenW (lpString=".pdf") returned 4
	[0163.230] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.230] lstrlenW (lpString=".xls") returned 4
	[0163.230] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.230] lstrlenW (lpString=".xlsx") returned 5
	[0163.230] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1
	[0163.230] lstrlenW (lpString=".ppt") returned 4
	[0163.230] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.230] lstrlenW (lpString=".zip") returned 4
	[0163.230] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.230] lstrlenW (lpString=".rar") returned 4
	[0163.230] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.230] lstrlenW (lpString=".bz2") returned 4
	[0163.231] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.231] lstrlenW (lpString=".7z") returned 3
	[0163.231] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.231] lstrlenW (lpString=".dbf") returned 4
	[0163.231] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.231] lstrlenW (lpString=".1cd") returned 4
	[0163.231] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.231] lstrlenW (lpString=".jpg") returned 4
	[0163.231] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.231] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0163.231] lstrlenW (lpString="J0101863.BMP") returned 12
	[0163.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.231] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=32184) returned 1
	[0163.231] CloseHandle (hObject=0x534) returned 1
	[0163.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220
	[0163.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.232] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.232] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.233] GetLastError () returned 0x0
	[0163.233] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0163.235] WriteFile (in: hFile=0x554, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0163.244] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.244] WriteFile (in: hFile=0x554, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.244] SetEndOfFile (hFile=0x554) returned 1
	[0163.244] CloseHandle (hObject=0x554) returned 1
	[0163.244] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.244] SetEndOfFile (hFile=0x534) returned 1
	[0163.599] CloseHandle (hObject=0x534) returned 1
	[0163.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1
	[0163.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.601] lstrlenW (lpString=".doc") returned 4
	[0163.601] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.601] lstrlenW (lpString=".docx") returned 5
	[0163.601] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1
	[0163.601] lstrlenW (lpString=".pdf") returned 4
	[0163.601] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.601] lstrlenW (lpString=".xls") returned 4
	[0163.601] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.601] lstrlenW (lpString=".xlsx") returned 5
	[0163.601] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1
	[0163.601] lstrlenW (lpString=".ppt") returned 4
	[0163.601] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.601] lstrlenW (lpString=".zip") returned 4
	[0163.601] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.602] lstrlenW (lpString=".rar") returned 4
	[0163.602] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.602] lstrlenW (lpString=".bz2") returned 4
	[0163.602] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.602] lstrlenW (lpString=".7z") returned 3
	[0163.602] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.602] lstrlenW (lpString=".dbf") returned 4
	[0163.602] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.602] lstrlenW (lpString=".1cd") returned 4
	[0163.602] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.602] lstrlenW (lpString=".jpg") returned 4
	[0163.602] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.602] lstrlenW (lpString=".doc") returned 4
	[0163.602] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.602] lstrlenW (lpString=".docx") returned 5
	[0163.602] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1
	[0163.602] lstrlenW (lpString=".pdf") returned 4
	[0163.602] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.602] lstrlenW (lpString=".xls") returned 4
	[0163.602] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.602] lstrlenW (lpString=".xlsx") returned 5
	[0163.602] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1
	[0163.602] lstrlenW (lpString=".ppt") returned 4
	[0163.602] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.602] lstrlenW (lpString=".zip") returned 4
	[0163.603] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.603] lstrlenW (lpString=".rar") returned 4
	[0163.603] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.603] lstrlenW (lpString=".bz2") returned 4
	[0163.603] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.603] lstrlenW (lpString=".7z") returned 3
	[0163.603] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.603] lstrlenW (lpString=".dbf") returned 4
	[0163.603] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.603] lstrlenW (lpString=".1cd") returned 4
	[0163.603] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.603] lstrlenW (lpString=".jpg") returned 4
	[0163.603] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.603] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.603] lstrlenW (lpString="J0102002.WMF") returned 12
	[0163.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.604] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=15988) returned 1
	[0163.604] CloseHandle (hObject=0x534) returned 1
	[0163.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220
	[0163.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.605] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.605] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.606] GetLastError () returned 0x0
	[0163.606] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x3e74, lpOverlapped=0x0) returned 1
	[0163.608] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x3e80, lpOverlapped=0x0) returned 1
	[0163.609] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.609] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.609] SetEndOfFile (hFile=0x520) returned 1
	[0163.609] CloseHandle (hObject=0x520) returned 1
	[0163.609] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.609] SetEndOfFile (hFile=0x534) returned 1
	[0163.612] CloseHandle (hObject=0x534) returned 1
	[0163.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1
	[0163.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.613] lstrlenW (lpString=".doc") returned 4
	[0163.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.613] lstrlenW (lpString=".docx") returned 5
	[0163.613] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.613] lstrlenW (lpString=".pdf") returned 4
	[0163.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.613] lstrlenW (lpString=".xls") returned 4
	[0163.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.614] lstrlenW (lpString=".xlsx") returned 5
	[0163.614] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.614] lstrlenW (lpString=".ppt") returned 4
	[0163.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.614] lstrlenW (lpString=".zip") returned 4
	[0163.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.614] lstrlenW (lpString=".rar") returned 4
	[0163.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.614] lstrlenW (lpString=".bz2") returned 4
	[0163.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.614] lstrlenW (lpString=".7z") returned 3
	[0163.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.614] lstrlenW (lpString=".dbf") returned 4
	[0163.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.614] lstrlenW (lpString=".1cd") returned 4
	[0163.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.614] lstrlenW (lpString=".jpg") returned 4
	[0163.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.614] lstrlenW (lpString=".doc") returned 4
	[0163.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.614] lstrlenW (lpString=".docx") returned 5
	[0163.614] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.614] lstrlenW (lpString=".pdf") returned 4
	[0163.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.615] lstrlenW (lpString=".xls") returned 4
	[0163.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.615] lstrlenW (lpString=".xlsx") returned 5
	[0163.615] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.615] lstrlenW (lpString=".ppt") returned 4
	[0163.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.615] lstrlenW (lpString=".zip") returned 4
	[0163.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.615] lstrlenW (lpString=".rar") returned 4
	[0163.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.615] lstrlenW (lpString=".bz2") returned 4
	[0163.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.615] lstrlenW (lpString=".7z") returned 3
	[0163.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.615] lstrlenW (lpString=".dbf") returned 4
	[0163.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.615] lstrlenW (lpString=".1cd") returned 4
	[0163.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.615] lstrlenW (lpString=".jpg") returned 4
	[0163.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.615] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.616] lstrlenW (lpString="J0102594.WMF") returned 12
	[0163.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.616] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=27000) returned 1
	[0163.616] CloseHandle (hObject=0x534) returned 1
	[0163.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220
	[0163.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.617] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.617] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.617] GetLastError () returned 0x0
	[0163.618] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x6978, lpOverlapped=0x0) returned 1
	[0163.620] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x6980, lpOverlapped=0x0) returned 1
	[0163.621] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.621] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.621] SetEndOfFile (hFile=0x520) returned 1
	[0163.621] CloseHandle (hObject=0x520) returned 1
	[0163.621] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.621] SetEndOfFile (hFile=0x534) returned 1
	[0163.624] CloseHandle (hObject=0x534) returned 1
	[0163.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1
	[0163.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.625] lstrlenW (lpString=".doc") returned 4
	[0163.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.625] lstrlenW (lpString=".docx") returned 5
	[0163.626] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0163.626] lstrlenW (lpString=".pdf") returned 4
	[0163.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.626] lstrlenW (lpString=".xls") returned 4
	[0163.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.626] lstrlenW (lpString=".xlsx") returned 5
	[0163.626] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0163.626] lstrlenW (lpString=".ppt") returned 4
	[0163.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.626] lstrlenW (lpString=".zip") returned 4
	[0163.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.626] lstrlenW (lpString=".rar") returned 4
	[0163.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.626] lstrlenW (lpString=".bz2") returned 4
	[0163.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.626] lstrlenW (lpString=".7z") returned 3
	[0163.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.626] lstrlenW (lpString=".dbf") returned 4
	[0163.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.626] lstrlenW (lpString=".1cd") returned 4
	[0163.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.626] lstrlenW (lpString=".jpg") returned 4
	[0163.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.626] lstrlenW (lpString=".doc") returned 4
	[0163.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.627] lstrlenW (lpString=".docx") returned 5
	[0163.627] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0163.627] lstrlenW (lpString=".pdf") returned 4
	[0163.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.627] lstrlenW (lpString=".xls") returned 4
	[0163.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.628] lstrlenW (lpString=".xlsx") returned 5
	[0163.628] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0163.628] lstrlenW (lpString=".ppt") returned 4
	[0163.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.628] lstrlenW (lpString=".zip") returned 4
	[0163.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.628] lstrlenW (lpString=".rar") returned 4
	[0163.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.628] lstrlenW (lpString=".bz2") returned 4
	[0163.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.628] lstrlenW (lpString=".7z") returned 3
	[0163.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.628] lstrlenW (lpString=".dbf") returned 4
	[0163.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.628] lstrlenW (lpString=".1cd") returned 4
	[0163.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.628] lstrlenW (lpString=".jpg") returned 4
	[0163.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.629] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.629] lstrlenW (lpString="J0102762.WMF") returned 12
	[0163.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.629] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=11216) returned 1
	[0163.629] CloseHandle (hObject=0x534) returned 1
	[0163.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220
	[0163.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.630] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.630] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.630] GetLastError () returned 0x0
	[0163.630] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2bd0, lpOverlapped=0x0) returned 1
	[0163.632] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0163.633] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.633] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.633] SetEndOfFile (hFile=0x520) returned 1
	[0163.633] CloseHandle (hObject=0x520) returned 1
	[0163.633] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.633] SetEndOfFile (hFile=0x534) returned 1
	[0163.636] CloseHandle (hObject=0x534) returned 1
	[0163.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1
	[0163.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.637] lstrlenW (lpString=".doc") returned 4
	[0163.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.637] lstrlenW (lpString=".docx") returned 5
	[0163.637] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.637] lstrlenW (lpString=".pdf") returned 4
	[0163.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.637] lstrlenW (lpString=".xls") returned 4
	[0163.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.637] lstrlenW (lpString=".xlsx") returned 5
	[0163.637] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.637] lstrlenW (lpString=".ppt") returned 4
	[0163.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.637] lstrlenW (lpString=".zip") returned 4
	[0163.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.637] lstrlenW (lpString=".rar") returned 4
	[0163.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.637] lstrlenW (lpString=".bz2") returned 4
	[0163.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.637] lstrlenW (lpString=".7z") returned 3
	[0163.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.637] lstrlenW (lpString=".dbf") returned 4
	[0163.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.637] lstrlenW (lpString=".1cd") returned 4
	[0163.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.638] lstrlenW (lpString=".jpg") returned 4
	[0163.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.638] lstrlenW (lpString=".doc") returned 4
	[0163.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.638] lstrlenW (lpString=".docx") returned 5
	[0163.638] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.638] lstrlenW (lpString=".pdf") returned 4
	[0163.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.638] lstrlenW (lpString=".xls") returned 4
	[0163.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.638] lstrlenW (lpString=".xlsx") returned 5
	[0163.638] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.638] lstrlenW (lpString=".ppt") returned 4
	[0163.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.638] lstrlenW (lpString=".zip") returned 4
	[0163.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.638] lstrlenW (lpString=".rar") returned 4
	[0163.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.638] lstrlenW (lpString=".bz2") returned 4
	[0163.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.638] lstrlenW (lpString=".7z") returned 3
	[0163.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.638] lstrlenW (lpString=".dbf") returned 4
	[0163.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.639] lstrlenW (lpString=".1cd") returned 4
	[0163.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.639] lstrlenW (lpString=".jpg") returned 4
	[0163.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.639] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.639] lstrlenW (lpString="J0102984.WMF") returned 12
	[0163.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.639] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=17040) returned 1
	[0163.639] CloseHandle (hObject=0x534) returned 1
	[0163.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220
	[0163.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.640] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.640] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0163.944] GetLastError () returned 0x0
	[0163.944] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4290, lpOverlapped=0x0) returned 1
	[0163.946] WriteFile (in: hFile=0x4f0, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x42a0, lpOverlapped=0x0) returned 1
	[0163.947] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.947] WriteFile (in: hFile=0x4f0, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.948] SetEndOfFile (hFile=0x4f0) returned 1
	[0163.948] CloseHandle (hObject=0x4f0) returned 1
	[0163.948] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.948] SetEndOfFile (hFile=0x534) returned 1
	[0163.951] CloseHandle (hObject=0x534) returned 1
	[0163.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1
	[0163.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.952] lstrlenW (lpString=".doc") returned 4
	[0163.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.952] lstrlenW (lpString=".docx") returned 5
	[0163.952] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0163.952] lstrlenW (lpString=".pdf") returned 4
	[0163.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.952] lstrlenW (lpString=".xls") returned 4
	[0163.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.952] lstrlenW (lpString=".xlsx") returned 5
	[0163.952] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0163.952] lstrlenW (lpString=".ppt") returned 4
	[0163.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.952] lstrlenW (lpString=".zip") returned 4
	[0163.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.953] lstrlenW (lpString=".rar") returned 4
	[0163.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.953] lstrlenW (lpString=".bz2") returned 4
	[0163.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.953] lstrlenW (lpString=".7z") returned 3
	[0163.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.953] lstrlenW (lpString=".dbf") returned 4
	[0163.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.953] lstrlenW (lpString=".1cd") returned 4
	[0163.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.953] lstrlenW (lpString=".jpg") returned 4
	[0163.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.953] lstrlenW (lpString=".doc") returned 4
	[0163.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.953] lstrlenW (lpString=".docx") returned 5
	[0163.953] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0163.953] lstrlenW (lpString=".pdf") returned 4
	[0163.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.953] lstrlenW (lpString=".xls") returned 4
	[0163.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.953] lstrlenW (lpString=".xlsx") returned 5
	[0163.953] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0163.953] lstrlenW (lpString=".ppt") returned 4
	[0163.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.954] lstrlenW (lpString=".zip") returned 4
	[0163.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.954] lstrlenW (lpString=".rar") returned 4
	[0163.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.954] lstrlenW (lpString=".bz2") returned 4
	[0163.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.954] lstrlenW (lpString=".7z") returned 3
	[0163.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.954] lstrlenW (lpString=".dbf") returned 4
	[0163.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.954] lstrlenW (lpString=".1cd") returned 4
	[0163.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0163.954] lstrlenW (lpString=".jpg") returned 4
	[0163.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.954] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.954] lstrlenW (lpString="J0105240.WMF") returned 12
	[0163.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.956] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=11532) returned 1
	[0163.956] CloseHandle (hObject=0x534) returned 1
	[0163.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220
	[0163.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.957] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.957] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0163.958] GetLastError () returned 0x0
	[0163.958] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2d0c, lpOverlapped=0x0) returned 1
	[0163.960] WriteFile (in: hFile=0x4f0, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2d10, lpOverlapped=0x0) returned 1
	[0163.961] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.961] WriteFile (in: hFile=0x4f0, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.961] SetEndOfFile (hFile=0x4f0) returned 1
	[0163.961] CloseHandle (hObject=0x4f0) returned 1
	[0163.961] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.961] SetEndOfFile (hFile=0x534) returned 1
	[0163.964] CloseHandle (hObject=0x534) returned 1
	[0163.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1
	[0163.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.965] lstrlenW (lpString=".doc") returned 4
	[0163.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.965] lstrlenW (lpString=".docx") returned 5
	[0163.965] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0163.965] lstrlenW (lpString=".pdf") returned 4
	[0163.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.965] lstrlenW (lpString=".xls") returned 4
	[0163.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.965] lstrlenW (lpString=".xlsx") returned 5
	[0163.965] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0163.965] lstrlenW (lpString=".ppt") returned 4
	[0163.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.966] lstrlenW (lpString=".zip") returned 4
	[0163.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.966] lstrlenW (lpString=".rar") returned 4
	[0163.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.966] lstrlenW (lpString=".bz2") returned 4
	[0163.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.966] lstrlenW (lpString=".7z") returned 3
	[0163.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.966] lstrlenW (lpString=".dbf") returned 4
	[0163.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.966] lstrlenW (lpString=".1cd") returned 4
	[0163.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.966] lstrlenW (lpString=".jpg") returned 4
	[0163.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.966] lstrlenW (lpString=".doc") returned 4
	[0163.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.966] lstrlenW (lpString=".docx") returned 5
	[0163.966] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0163.966] lstrlenW (lpString=".pdf") returned 4
	[0163.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.966] lstrlenW (lpString=".xls") returned 4
	[0163.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.966] lstrlenW (lpString=".xlsx") returned 5
	[0163.967] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0163.967] lstrlenW (lpString=".ppt") returned 4
	[0163.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.967] lstrlenW (lpString=".zip") returned 4
	[0163.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.967] lstrlenW (lpString=".rar") returned 4
	[0163.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.967] lstrlenW (lpString=".bz2") returned 4
	[0163.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.967] lstrlenW (lpString=".7z") returned 3
	[0163.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.967] lstrlenW (lpString=".dbf") returned 4
	[0163.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.967] lstrlenW (lpString=".1cd") returned 4
	[0163.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0163.967] lstrlenW (lpString=".jpg") returned 4
	[0163.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.967] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.967] lstrlenW (lpString="J0105244.WMF") returned 12
	[0163.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.970] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=11228) returned 1
	[0163.970] CloseHandle (hObject=0x534) returned 1
	[0163.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220
	[0163.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.971] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.971] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0163.971] GetLastError () returned 0x0
	[0163.971] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2bdc, lpOverlapped=0x0) returned 1
	[0163.973] WriteFile (in: hFile=0x4f0, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0163.974] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.974] WriteFile (in: hFile=0x4f0, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.974] SetEndOfFile (hFile=0x4f0) returned 1
	[0163.974] CloseHandle (hObject=0x4f0) returned 1
	[0163.974] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.975] SetEndOfFile (hFile=0x534) returned 1
	[0163.978] CloseHandle (hObject=0x534) returned 1
	[0163.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1
	[0163.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.979] lstrlenW (lpString=".doc") returned 4
	[0163.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.979] lstrlenW (lpString=".docx") returned 5
	[0163.979] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0163.979] lstrlenW (lpString=".pdf") returned 4
	[0163.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.979] lstrlenW (lpString=".xls") returned 4
	[0163.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.979] lstrlenW (lpString=".xlsx") returned 5
	[0163.979] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0163.979] lstrlenW (lpString=".ppt") returned 4
	[0163.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.979] lstrlenW (lpString=".zip") returned 4
	[0163.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.979] lstrlenW (lpString=".rar") returned 4
	[0163.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.979] lstrlenW (lpString=".bz2") returned 4
	[0163.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.979] lstrlenW (lpString=".7z") returned 3
	[0163.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.979] lstrlenW (lpString=".dbf") returned 4
	[0163.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.979] lstrlenW (lpString=".1cd") returned 4
	[0163.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.980] lstrlenW (lpString=".jpg") returned 4
	[0163.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.980] lstrlenW (lpString=".doc") returned 4
	[0163.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.980] lstrlenW (lpString=".docx") returned 5
	[0163.980] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0163.980] lstrlenW (lpString=".pdf") returned 4
	[0163.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.980] lstrlenW (lpString=".xls") returned 4
	[0163.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.980] lstrlenW (lpString=".xlsx") returned 5
	[0163.980] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0163.980] lstrlenW (lpString=".ppt") returned 4
	[0163.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.980] lstrlenW (lpString=".zip") returned 4
	[0163.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.980] lstrlenW (lpString=".rar") returned 4
	[0163.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.980] lstrlenW (lpString=".bz2") returned 4
	[0163.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.980] lstrlenW (lpString=".7z") returned 3
	[0163.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.980] lstrlenW (lpString=".dbf") returned 4
	[0163.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.981] lstrlenW (lpString=".1cd") returned 4
	[0163.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0163.981] lstrlenW (lpString=".jpg") returned 4
	[0163.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.981] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.981] lstrlenW (lpString="J0105246.WMF") returned 12
	[0163.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.981] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=19328) returned 1
	[0163.982] CloseHandle (hObject=0x534) returned 1
	[0163.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220
	[0163.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0163.982] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.982] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.257] GetLastError () returned 0x0
	[0164.257] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4b80, lpOverlapped=0x0) returned 1
	[0164.259] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4b90, lpOverlapped=0x0) returned 1
	[0164.261] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.261] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.261] SetEndOfFile (hFile=0x500) returned 1
	[0164.273] CloseHandle (hObject=0x500) returned 1
	[0164.297] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.297] SetEndOfFile (hFile=0x534) returned 1
	[0164.300] CloseHandle (hObject=0x534) returned 1
	[0164.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1
	[0164.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.301] lstrlenW (lpString=".doc") returned 4
	[0164.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.301] lstrlenW (lpString=".docx") returned 5
	[0164.301] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0164.301] lstrlenW (lpString=".pdf") returned 4
	[0164.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.301] lstrlenW (lpString=".xls") returned 4
	[0164.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.301] lstrlenW (lpString=".xlsx") returned 5
	[0164.301] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0164.301] lstrlenW (lpString=".ppt") returned 4
	[0164.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.301] lstrlenW (lpString=".zip") returned 4
	[0164.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.301] lstrlenW (lpString=".rar") returned 4
	[0164.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.301] lstrlenW (lpString=".bz2") returned 4
	[0164.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.302] lstrlenW (lpString=".7z") returned 3
	[0164.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.302] lstrlenW (lpString=".dbf") returned 4
	[0164.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.302] lstrlenW (lpString=".1cd") returned 4
	[0164.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.302] lstrlenW (lpString=".jpg") returned 4
	[0164.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.302] lstrlenW (lpString=".doc") returned 4
	[0164.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.302] lstrlenW (lpString=".docx") returned 5
	[0164.302] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0164.302] lstrlenW (lpString=".pdf") returned 4
	[0164.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.302] lstrlenW (lpString=".xls") returned 4
	[0164.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.302] lstrlenW (lpString=".xlsx") returned 5
	[0164.302] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0164.302] lstrlenW (lpString=".ppt") returned 4
	[0164.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.303] lstrlenW (lpString=".zip") returned 4
	[0164.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.303] lstrlenW (lpString=".rar") returned 4
	[0164.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.303] lstrlenW (lpString=".bz2") returned 4
	[0164.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.303] lstrlenW (lpString=".7z") returned 3
	[0164.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.303] lstrlenW (lpString=".dbf") returned 4
	[0164.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.303] lstrlenW (lpString=".1cd") returned 4
	[0164.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0164.303] lstrlenW (lpString=".jpg") returned 4
	[0164.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.303] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.303] lstrlenW (lpString="J0105282.WMF") returned 12
	[0164.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0164.304] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=4796) returned 1
	[0164.304] CloseHandle (hObject=0x534) returned 1
	[0164.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220
	[0164.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0164.304] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.305] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.305] GetLastError () returned 0x0
	[0164.305] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x12bc, lpOverlapped=0x0) returned 1
	[0164.308] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0164.309] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.309] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.309] SetEndOfFile (hFile=0x500) returned 1
	[0164.309] CloseHandle (hObject=0x500) returned 1
	[0164.309] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.309] SetEndOfFile (hFile=0x534) returned 1
	[0164.312] CloseHandle (hObject=0x534) returned 1
	[0164.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1
	[0164.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.313] lstrlenW (lpString=".doc") returned 4
	[0164.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.313] lstrlenW (lpString=".docx") returned 5
	[0164.313] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.313] lstrlenW (lpString=".pdf") returned 4
	[0164.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.313] lstrlenW (lpString=".xls") returned 4
	[0164.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.313] lstrlenW (lpString=".xlsx") returned 5
	[0164.313] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.313] lstrlenW (lpString=".ppt") returned 4
	[0164.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.313] lstrlenW (lpString=".zip") returned 4
	[0164.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.314] lstrlenW (lpString=".rar") returned 4
	[0164.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.314] lstrlenW (lpString=".bz2") returned 4
	[0164.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.314] lstrlenW (lpString=".7z") returned 3
	[0164.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.314] lstrlenW (lpString=".dbf") returned 4
	[0164.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.314] lstrlenW (lpString=".1cd") returned 4
	[0164.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.314] lstrlenW (lpString=".jpg") returned 4
	[0164.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.314] lstrlenW (lpString=".doc") returned 4
	[0164.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.314] lstrlenW (lpString=".docx") returned 5
	[0164.314] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.314] lstrlenW (lpString=".pdf") returned 4
	[0164.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.314] lstrlenW (lpString=".xls") returned 4
	[0164.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.314] lstrlenW (lpString=".xlsx") returned 5
	[0164.314] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.314] lstrlenW (lpString=".ppt") returned 4
	[0164.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.314] lstrlenW (lpString=".zip") returned 4
	[0164.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.315] lstrlenW (lpString=".rar") returned 4
	[0164.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.315] lstrlenW (lpString=".bz2") returned 4
	[0164.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.315] lstrlenW (lpString=".7z") returned 3
	[0164.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.315] lstrlenW (lpString=".dbf") returned 4
	[0164.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.315] lstrlenW (lpString=".1cd") returned 4
	[0164.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0164.315] lstrlenW (lpString=".jpg") returned 4
	[0164.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.315] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.315] lstrlenW (lpString="J0105286.WMF") returned 12
	[0164.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0164.316] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=6568) returned 1
	[0164.316] CloseHandle (hObject=0x534) returned 1
	[0164.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220
	[0164.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0164.316] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.317] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.317] GetLastError () returned 0x0
	[0164.317] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x19a8, lpOverlapped=0x0) returned 1
	[0164.329] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x19b0, lpOverlapped=0x0) returned 1
	[0164.330] ReadFile (in: hFile=0x534, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.330] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.331] SetEndOfFile (hFile=0x500) returned 1
	[0164.331] CloseHandle (hObject=0x500) returned 1
	[0164.331] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.331] SetEndOfFile (hFile=0x534) returned 1
	[0164.449] CloseHandle (hObject=0x534) returned 1
	[0164.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1
	[0164.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.591] lstrlenW (lpString=".doc") returned 4
	[0164.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.591] lstrlenW (lpString=".docx") returned 5
	[0164.591] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0164.591] lstrlenW (lpString=".pdf") returned 4
	[0164.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.591] lstrlenW (lpString=".xls") returned 4
	[0164.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.591] lstrlenW (lpString=".xlsx") returned 5
	[0164.591] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0164.591] lstrlenW (lpString=".ppt") returned 4
	[0164.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.591] lstrlenW (lpString=".zip") returned 4
	[0164.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.592] lstrlenW (lpString=".rar") returned 4
	[0164.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.592] lstrlenW (lpString=".bz2") returned 4
	[0164.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.592] lstrlenW (lpString=".7z") returned 3
	[0164.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.592] lstrlenW (lpString=".dbf") returned 4
	[0164.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.592] lstrlenW (lpString=".1cd") returned 4
	[0164.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.592] lstrlenW (lpString=".jpg") returned 4
	[0164.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.592] lstrlenW (lpString=".doc") returned 4
	[0164.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.592] lstrlenW (lpString=".docx") returned 5
	[0164.592] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0164.592] lstrlenW (lpString=".pdf") returned 4
	[0164.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.592] lstrlenW (lpString=".xls") returned 4
	[0164.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.592] lstrlenW (lpString=".xlsx") returned 5
	[0164.592] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0164.592] lstrlenW (lpString=".ppt") returned 4
	[0164.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.593] lstrlenW (lpString=".zip") returned 4
	[0164.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.593] lstrlenW (lpString=".rar") returned 4
	[0164.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.593] lstrlenW (lpString=".bz2") returned 4
	[0164.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.593] lstrlenW (lpString=".7z") returned 3
	[0164.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.593] lstrlenW (lpString=".dbf") returned 4
	[0164.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.593] lstrlenW (lpString=".1cd") returned 4
	[0164.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0164.593] lstrlenW (lpString=".jpg") returned 4
	[0164.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.593] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.593] lstrlenW (lpString="J0105332.WMF") returned 12
	[0164.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.906] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=10508) returned 1
	[0164.906] CloseHandle (hObject=0x4b8) returned 1
	[0164.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220
	[0164.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.911] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.911] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.912] GetLastError () returned 0x0
	[0164.912] ReadFile (in: hFile=0x4b8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x290c, lpOverlapped=0x0) returned 1
	[0164.914] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2910, lpOverlapped=0x0) returned 1
	[0164.915] ReadFile (in: hFile=0x4b8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.915] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.915] SetEndOfFile (hFile=0x500) returned 1
	[0164.916] CloseHandle (hObject=0x500) returned 1
	[0164.916] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.916] SetEndOfFile (hFile=0x4b8) returned 1
	[0164.919] CloseHandle (hObject=0x4b8) returned 1
	[0164.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1
	[0164.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.920] lstrlenW (lpString=".doc") returned 4
	[0164.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.920] lstrlenW (lpString=".docx") returned 5
	[0164.920] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.920] lstrlenW (lpString=".pdf") returned 4
	[0164.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.920] lstrlenW (lpString=".xls") returned 4
	[0164.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.920] lstrlenW (lpString=".xlsx") returned 5
	[0164.920] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.920] lstrlenW (lpString=".ppt") returned 4
	[0164.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.920] lstrlenW (lpString=".zip") returned 4
	[0164.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.920] lstrlenW (lpString=".rar") returned 4
	[0164.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.920] lstrlenW (lpString=".bz2") returned 4
	[0164.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.920] lstrlenW (lpString=".7z") returned 3
	[0164.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.921] lstrlenW (lpString=".dbf") returned 4
	[0164.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.921] lstrlenW (lpString=".1cd") returned 4
	[0164.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.921] lstrlenW (lpString=".jpg") returned 4
	[0164.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.921] lstrlenW (lpString=".doc") returned 4
	[0164.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.921] lstrlenW (lpString=".docx") returned 5
	[0164.921] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.921] lstrlenW (lpString=".pdf") returned 4
	[0164.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.921] lstrlenW (lpString=".xls") returned 4
	[0164.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.921] lstrlenW (lpString=".xlsx") returned 5
	[0164.921] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.921] lstrlenW (lpString=".ppt") returned 4
	[0164.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.921] lstrlenW (lpString=".zip") returned 4
	[0164.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.921] lstrlenW (lpString=".rar") returned 4
	[0164.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.922] lstrlenW (lpString=".bz2") returned 4
	[0164.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.922] lstrlenW (lpString=".7z") returned 3
	[0164.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.922] lstrlenW (lpString=".dbf") returned 4
	[0164.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.922] lstrlenW (lpString=".1cd") returned 4
	[0164.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0164.922] lstrlenW (lpString=".jpg") returned 4
	[0164.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.922] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.922] lstrlenW (lpString="J0105360.WMF") returned 12
	[0164.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.923] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=8860) returned 1
	[0164.923] CloseHandle (hObject=0x4b8) returned 1
	[0164.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220
	[0164.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.924] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.924] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.925] GetLastError () returned 0x0
	[0164.925] ReadFile (in: hFile=0x4b8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x229c, lpOverlapped=0x0) returned 1
	[0164.927] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x22a0, lpOverlapped=0x0) returned 1
	[0164.928] ReadFile (in: hFile=0x4b8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.928] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.928] SetEndOfFile (hFile=0x500) returned 1
	[0164.929] CloseHandle (hObject=0x500) returned 1
	[0164.929] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.929] SetEndOfFile (hFile=0x4b8) returned 1
	[0164.931] CloseHandle (hObject=0x4b8) returned 1
	[0164.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1
	[0164.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.932] lstrlenW (lpString=".doc") returned 4
	[0164.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.932] lstrlenW (lpString=".docx") returned 5
	[0164.932] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0164.932] lstrlenW (lpString=".pdf") returned 4
	[0164.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.932] lstrlenW (lpString=".xls") returned 4
	[0164.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.933] lstrlenW (lpString=".xlsx") returned 5
	[0164.933] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0164.933] lstrlenW (lpString=".ppt") returned 4
	[0164.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.933] lstrlenW (lpString=".zip") returned 4
	[0164.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.933] lstrlenW (lpString=".rar") returned 4
	[0164.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.933] lstrlenW (lpString=".bz2") returned 4
	[0164.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.933] lstrlenW (lpString=".7z") returned 3
	[0164.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.933] lstrlenW (lpString=".dbf") returned 4
	[0164.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.933] lstrlenW (lpString=".1cd") returned 4
	[0164.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.933] lstrlenW (lpString=".jpg") returned 4
	[0164.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.933] lstrlenW (lpString=".doc") returned 4
	[0164.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.933] lstrlenW (lpString=".docx") returned 5
	[0164.933] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0164.933] lstrlenW (lpString=".pdf") returned 4
	[0164.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.933] lstrlenW (lpString=".xls") returned 4
	[0164.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.934] lstrlenW (lpString=".xlsx") returned 5
	[0164.934] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0164.934] lstrlenW (lpString=".ppt") returned 4
	[0164.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.934] lstrlenW (lpString=".zip") returned 4
	[0164.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.934] lstrlenW (lpString=".rar") returned 4
	[0164.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.934] lstrlenW (lpString=".bz2") returned 4
	[0164.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.934] lstrlenW (lpString=".7z") returned 3
	[0164.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.934] lstrlenW (lpString=".dbf") returned 4
	[0164.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.934] lstrlenW (lpString=".1cd") returned 4
	[0164.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0164.934] lstrlenW (lpString=".jpg") returned 4
	[0164.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.934] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.934] lstrlenW (lpString="J0105368.WMF") returned 12
	[0164.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.935] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=12380) returned 1
	[0164.935] CloseHandle (hObject=0x4b8) returned 1
	[0164.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220
	[0164.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.936] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.936] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.936] GetLastError () returned 0x0
	[0164.936] ReadFile (in: hFile=0x4b8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x305c, lpOverlapped=0x0) returned 1
	[0164.938] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x3060, lpOverlapped=0x0) returned 1
	[0164.939] ReadFile (in: hFile=0x4b8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.939] WriteFile (in: hFile=0x500, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.940] SetEndOfFile (hFile=0x500) returned 1
	[0164.940] CloseHandle (hObject=0x500) returned 1
	[0164.940] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.940] SetEndOfFile (hFile=0x4b8) returned 1
	[0165.126] CloseHandle (hObject=0x4b8) returned 1
	[0165.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0165.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1
	[0165.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.127] lstrlenW (lpString=".doc") returned 4
	[0165.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.127] lstrlenW (lpString=".docx") returned 5
	[0165.127] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0165.127] lstrlenW (lpString=".pdf") returned 4
	[0165.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.127] lstrlenW (lpString=".xls") returned 4
	[0165.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.127] lstrlenW (lpString=".xlsx") returned 5
	[0165.127] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0165.127] lstrlenW (lpString=".ppt") returned 4
	[0165.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.128] lstrlenW (lpString=".zip") returned 4
	[0165.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.636] lstrlenW (lpString=".rar") returned 4
	[0165.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.636] lstrlenW (lpString=".bz2") returned 4
	[0165.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.637] lstrlenW (lpString=".7z") returned 3
	[0165.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.637] lstrlenW (lpString=".dbf") returned 4
	[0165.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.637] lstrlenW (lpString=".1cd") returned 4
	[0165.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.637] lstrlenW (lpString=".jpg") returned 4
	[0165.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.637] lstrlenW (lpString=".doc") returned 4
	[0165.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.637] lstrlenW (lpString=".docx") returned 5
	[0165.637] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0165.637] lstrlenW (lpString=".pdf") returned 4
	[0165.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.637] lstrlenW (lpString=".xls") returned 4
	[0165.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.637] lstrlenW (lpString=".xlsx") returned 5
	[0165.637] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0165.637] lstrlenW (lpString=".ppt") returned 4
	[0165.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.637] lstrlenW (lpString=".zip") returned 4
	[0165.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.638] lstrlenW (lpString=".rar") returned 4
	[0165.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.638] lstrlenW (lpString=".bz2") returned 4
	[0165.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.638] lstrlenW (lpString=".7z") returned 3
	[0165.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.638] lstrlenW (lpString=".dbf") returned 4
	[0165.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.638] lstrlenW (lpString=".1cd") returned 4
	[0165.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0165.638] lstrlenW (lpString=".jpg") returned 4
	[0165.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.638] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0165.638] lstrlenW (lpString="J0105384.WMF") returned 12
	[0165.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0166.094] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=5880) returned 1
	[0166.094] CloseHandle (hObject=0x55c) returned 1
	[0166.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220
	[0166.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0166.669] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.669] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0166.692] GetLastError () returned 0x0
	[0166.692] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x16f8, lpOverlapped=0x0) returned 1
	[0166.694] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1700, lpOverlapped=0x0) returned 1
	[0166.695] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.695] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.695] SetEndOfFile (hFile=0x444) returned 1
	[0166.695] CloseHandle (hObject=0x444) returned 1
	[0166.696] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.696] SetEndOfFile (hFile=0x538) returned 1
	[0166.699] CloseHandle (hObject=0x538) returned 1
	[0166.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0166.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1
	[0166.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.703] lstrlenW (lpString=".doc") returned 4
	[0166.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.703] lstrlenW (lpString=".docx") returned 5
	[0166.703] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0166.703] lstrlenW (lpString=".pdf") returned 4
	[0166.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.703] lstrlenW (lpString=".xls") returned 4
	[0166.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.704] lstrlenW (lpString=".xlsx") returned 5
	[0166.704] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0166.704] lstrlenW (lpString=".ppt") returned 4
	[0166.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.704] lstrlenW (lpString=".zip") returned 4
	[0166.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.704] lstrlenW (lpString=".rar") returned 4
	[0166.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.704] lstrlenW (lpString=".bz2") returned 4
	[0166.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.704] lstrlenW (lpString=".7z") returned 3
	[0166.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.704] lstrlenW (lpString=".dbf") returned 4
	[0166.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.704] lstrlenW (lpString=".1cd") returned 4
	[0166.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.704] lstrlenW (lpString=".jpg") returned 4
	[0166.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.704] lstrlenW (lpString=".doc") returned 4
	[0166.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.704] lstrlenW (lpString=".docx") returned 5
	[0166.705] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0166.705] lstrlenW (lpString=".pdf") returned 4
	[0166.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.705] lstrlenW (lpString=".xls") returned 4
	[0166.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.705] lstrlenW (lpString=".xlsx") returned 5
	[0166.705] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0166.705] lstrlenW (lpString=".ppt") returned 4
	[0166.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.705] lstrlenW (lpString=".zip") returned 4
	[0166.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.705] lstrlenW (lpString=".rar") returned 4
	[0166.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.705] lstrlenW (lpString=".bz2") returned 4
	[0166.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.705] lstrlenW (lpString=".7z") returned 3
	[0166.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.705] lstrlenW (lpString=".dbf") returned 4
	[0166.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.705] lstrlenW (lpString=".1cd") returned 4
	[0166.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0166.706] lstrlenW (lpString=".jpg") returned 4
	[0166.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.706] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0166.706] lstrlenW (lpString="J0105386.WMF") returned 12
	[0166.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0166.707] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=5980) returned 1
	[0166.707] CloseHandle (hObject=0x538) returned 1
	[0166.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220
	[0166.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0166.707] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.708] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0166.708] GetLastError () returned 0x0
	[0166.708] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x175c, lpOverlapped=0x0) returned 1
	[0166.710] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1760, lpOverlapped=0x0) returned 1
	[0166.711] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.711] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.712] SetEndOfFile (hFile=0x444) returned 1
	[0166.712] CloseHandle (hObject=0x444) returned 1
	[0166.712] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.712] SetEndOfFile (hFile=0x538) returned 1
	[0166.733] CloseHandle (hObject=0x538) returned 1
	[0166.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0166.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1
	[0166.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.735] lstrlenW (lpString=".doc") returned 4
	[0166.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.735] lstrlenW (lpString=".docx") returned 5
	[0166.735] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0166.735] lstrlenW (lpString=".pdf") returned 4
	[0166.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.735] lstrlenW (lpString=".xls") returned 4
	[0166.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.735] lstrlenW (lpString=".xlsx") returned 5
	[0166.735] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0166.735] lstrlenW (lpString=".ppt") returned 4
	[0166.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.735] lstrlenW (lpString=".zip") returned 4
	[0166.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.735] lstrlenW (lpString=".rar") returned 4
	[0166.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.735] lstrlenW (lpString=".bz2") returned 4
	[0166.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.736] lstrlenW (lpString=".7z") returned 3
	[0166.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.736] lstrlenW (lpString=".dbf") returned 4
	[0166.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.736] lstrlenW (lpString=".1cd") returned 4
	[0166.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.736] lstrlenW (lpString=".jpg") returned 4
	[0166.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.736] lstrlenW (lpString=".doc") returned 4
	[0166.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.736] lstrlenW (lpString=".docx") returned 5
	[0166.736] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0166.736] lstrlenW (lpString=".pdf") returned 4
	[0166.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.736] lstrlenW (lpString=".xls") returned 4
	[0166.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.736] lstrlenW (lpString=".xlsx") returned 5
	[0166.736] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0166.736] lstrlenW (lpString=".ppt") returned 4
	[0166.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.737] lstrlenW (lpString=".zip") returned 4
	[0166.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.737] lstrlenW (lpString=".rar") returned 4
	[0166.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.737] lstrlenW (lpString=".bz2") returned 4
	[0166.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.737] lstrlenW (lpString=".7z") returned 3
	[0166.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.737] lstrlenW (lpString=".dbf") returned 4
	[0166.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.737] lstrlenW (lpString=".1cd") returned 4
	[0166.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.737] lstrlenW (lpString=".jpg") returned 4
	[0166.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.737] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0166.737] lstrlenW (lpString="J0105388.WMF") returned 12
	[0166.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0166.739] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=8252) returned 1
	[0166.739] CloseHandle (hObject=0x538) returned 1
	[0166.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220
	[0166.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0166.740] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.740] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0166.740] GetLastError () returned 0x0
	[0166.740] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x203c, lpOverlapped=0x0) returned 1
	[0166.742] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2040, lpOverlapped=0x0) returned 1
	[0166.743] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.743] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.743] SetEndOfFile (hFile=0x444) returned 1
	[0166.744] CloseHandle (hObject=0x444) returned 1
	[0166.751] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.751] SetEndOfFile (hFile=0x538) returned 1
	[0166.755] CloseHandle (hObject=0x538) returned 1
	[0166.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0166.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1
	[0166.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.757] lstrlenW (lpString=".doc") returned 4
	[0166.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.757] lstrlenW (lpString=".docx") returned 5
	[0166.757] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0166.757] lstrlenW (lpString=".pdf") returned 4
	[0166.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.757] lstrlenW (lpString=".xls") returned 4
	[0166.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.757] lstrlenW (lpString=".xlsx") returned 5
	[0166.757] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0166.757] lstrlenW (lpString=".ppt") returned 4
	[0166.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.757] lstrlenW (lpString=".zip") returned 4
	[0166.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.758] lstrlenW (lpString=".rar") returned 4
	[0166.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.758] lstrlenW (lpString=".bz2") returned 4
	[0166.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.758] lstrlenW (lpString=".7z") returned 3
	[0166.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.758] lstrlenW (lpString=".dbf") returned 4
	[0166.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.758] lstrlenW (lpString=".1cd") returned 4
	[0166.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.758] lstrlenW (lpString=".jpg") returned 4
	[0166.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.758] lstrlenW (lpString=".doc") returned 4
	[0166.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.758] lstrlenW (lpString=".docx") returned 5
	[0166.758] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0166.758] lstrlenW (lpString=".pdf") returned 4
	[0166.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.758] lstrlenW (lpString=".xls") returned 4
	[0166.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.758] lstrlenW (lpString=".xlsx") returned 5
	[0166.758] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0166.759] lstrlenW (lpString=".ppt") returned 4
	[0166.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.759] lstrlenW (lpString=".zip") returned 4
	[0166.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.759] lstrlenW (lpString=".rar") returned 4
	[0166.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.759] lstrlenW (lpString=".bz2") returned 4
	[0166.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.759] lstrlenW (lpString=".7z") returned 3
	[0166.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.759] lstrlenW (lpString=".dbf") returned 4
	[0166.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.759] lstrlenW (lpString=".1cd") returned 4
	[0166.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0166.759] lstrlenW (lpString=".jpg") returned 4
	[0166.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.759] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0166.759] lstrlenW (lpString="J0105390.WMF") returned 12
	[0166.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0166.760] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=4944) returned 1
	[0166.760] CloseHandle (hObject=0x538) returned 1
	[0166.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220
	[0166.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0166.761] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.761] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0166.762] GetLastError () returned 0x0
	[0166.762] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1350, lpOverlapped=0x0) returned 1
	[0166.764] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1360, lpOverlapped=0x0) returned 1
	[0166.765] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.765] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.765] SetEndOfFile (hFile=0x444) returned 1
	[0166.765] CloseHandle (hObject=0x444) returned 1
	[0166.765] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.765] SetEndOfFile (hFile=0x538) returned 1
	[0166.774] CloseHandle (hObject=0x538) returned 1
	[0166.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0166.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1
	[0166.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.776] lstrlenW (lpString=".doc") returned 4
	[0166.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.776] lstrlenW (lpString=".docx") returned 5
	[0166.776] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0166.776] lstrlenW (lpString=".pdf") returned 4
	[0166.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.776] lstrlenW (lpString=".xls") returned 4
	[0166.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.776] lstrlenW (lpString=".xlsx") returned 5
	[0166.776] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0166.776] lstrlenW (lpString=".ppt") returned 4
	[0166.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.781] lstrlenW (lpString=".zip") returned 4
	[0166.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.781] lstrlenW (lpString=".rar") returned 4
	[0166.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.781] lstrlenW (lpString=".bz2") returned 4
	[0166.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.781] lstrlenW (lpString=".7z") returned 3
	[0166.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.781] lstrlenW (lpString=".dbf") returned 4
	[0166.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.782] lstrlenW (lpString=".1cd") returned 4
	[0166.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.782] lstrlenW (lpString=".jpg") returned 4
	[0166.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.782] lstrlenW (lpString=".doc") returned 4
	[0166.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.782] lstrlenW (lpString=".docx") returned 5
	[0166.782] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0166.782] lstrlenW (lpString=".pdf") returned 4
	[0166.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.782] lstrlenW (lpString=".xls") returned 4
	[0166.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.782] lstrlenW (lpString=".xlsx") returned 5
	[0166.782] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0166.782] lstrlenW (lpString=".ppt") returned 4
	[0166.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.782] lstrlenW (lpString=".zip") returned 4
	[0166.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.782] lstrlenW (lpString=".rar") returned 4
	[0166.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.782] lstrlenW (lpString=".bz2") returned 4
	[0166.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.783] lstrlenW (lpString=".7z") returned 3
	[0166.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.783] lstrlenW (lpString=".dbf") returned 4
	[0166.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.783] lstrlenW (lpString=".1cd") returned 4
	[0166.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0166.783] lstrlenW (lpString=".jpg") returned 4
	[0166.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.783] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0166.783] lstrlenW (lpString="J0105396.WMF") returned 12
	[0166.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0166.784] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=11012) returned 1
	[0166.784] CloseHandle (hObject=0x538) returned 1
	[0166.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220
	[0166.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0166.784] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.785] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0166.786] GetLastError () returned 0x0
	[0166.786] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2b04, lpOverlapped=0x0) returned 1
	[0166.787] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2b10, lpOverlapped=0x0) returned 1
	[0166.788] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.788] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.789] SetEndOfFile (hFile=0x444) returned 1
	[0166.789] CloseHandle (hObject=0x444) returned 1
	[0166.789] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.789] SetEndOfFile (hFile=0x538) returned 1
	[0166.821] CloseHandle (hObject=0x538) returned 1
	[0166.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0166.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1
	[0166.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.822] lstrlenW (lpString=".doc") returned 4
	[0166.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.822] lstrlenW (lpString=".docx") returned 5
	[0166.823] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0166.823] lstrlenW (lpString=".pdf") returned 4
	[0166.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.823] lstrlenW (lpString=".xls") returned 4
	[0166.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.823] lstrlenW (lpString=".xlsx") returned 5
	[0166.823] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0166.823] lstrlenW (lpString=".ppt") returned 4
	[0166.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.823] lstrlenW (lpString=".zip") returned 4
	[0166.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.823] lstrlenW (lpString=".rar") returned 4
	[0166.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.823] lstrlenW (lpString=".bz2") returned 4
	[0166.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.823] lstrlenW (lpString=".7z") returned 3
	[0166.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.823] lstrlenW (lpString=".dbf") returned 4
	[0166.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.824] lstrlenW (lpString=".1cd") returned 4
	[0166.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.824] lstrlenW (lpString=".jpg") returned 4
	[0166.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.824] lstrlenW (lpString=".doc") returned 4
	[0166.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.824] lstrlenW (lpString=".docx") returned 5
	[0166.824] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0166.824] lstrlenW (lpString=".pdf") returned 4
	[0166.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.824] lstrlenW (lpString=".xls") returned 4
	[0166.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.824] lstrlenW (lpString=".xlsx") returned 5
	[0166.824] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0166.824] lstrlenW (lpString=".ppt") returned 4
	[0166.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.824] lstrlenW (lpString=".zip") returned 4
	[0166.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.824] lstrlenW (lpString=".rar") returned 4
	[0166.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.824] lstrlenW (lpString=".bz2") returned 4
	[0166.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.825] lstrlenW (lpString=".7z") returned 3
	[0166.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.825] lstrlenW (lpString=".dbf") returned 4
	[0166.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.825] lstrlenW (lpString=".1cd") returned 4
	[0166.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0166.825] lstrlenW (lpString=".jpg") returned 4
	[0166.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.825] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0166.825] lstrlenW (lpString="J0105398.WMF") returned 12
	[0166.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0166.826] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=3328) returned 1
	[0166.826] CloseHandle (hObject=0x538) returned 1
	[0167.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220
	[0167.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.068] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.068] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.069] GetLastError () returned 0x0
	[0167.069] ReadFile (in: hFile=0x554, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xd00, lpOverlapped=0x0) returned 1
	[0167.072] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xd10, lpOverlapped=0x0) returned 1
	[0167.073] ReadFile (in: hFile=0x554, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.073] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.073] SetEndOfFile (hFile=0x514) returned 1
	[0167.073] CloseHandle (hObject=0x514) returned 1
	[0167.073] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.073] SetEndOfFile (hFile=0x554) returned 1
	[0167.076] CloseHandle (hObject=0x554) returned 1
	[0167.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1
	[0167.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.078] lstrlenW (lpString=".doc") returned 4
	[0167.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.078] lstrlenW (lpString=".docx") returned 5
	[0167.078] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0167.078] lstrlenW (lpString=".pdf") returned 4
	[0167.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.078] lstrlenW (lpString=".xls") returned 4
	[0167.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.078] lstrlenW (lpString=".xlsx") returned 5
	[0167.078] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0167.078] lstrlenW (lpString=".ppt") returned 4
	[0167.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.078] lstrlenW (lpString=".zip") returned 4
	[0167.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.078] lstrlenW (lpString=".rar") returned 4
	[0167.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.078] lstrlenW (lpString=".bz2") returned 4
	[0167.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.078] lstrlenW (lpString=".7z") returned 3
	[0167.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.078] lstrlenW (lpString=".dbf") returned 4
	[0167.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.079] lstrlenW (lpString=".1cd") returned 4
	[0167.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.079] lstrlenW (lpString=".jpg") returned 4
	[0167.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.079] lstrlenW (lpString=".doc") returned 4
	[0167.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.079] lstrlenW (lpString=".docx") returned 5
	[0167.079] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0167.079] lstrlenW (lpString=".pdf") returned 4
	[0167.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.079] lstrlenW (lpString=".xls") returned 4
	[0167.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.079] lstrlenW (lpString=".xlsx") returned 5
	[0167.079] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0167.079] lstrlenW (lpString=".ppt") returned 4
	[0167.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.079] lstrlenW (lpString=".zip") returned 4
	[0167.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.079] lstrlenW (lpString=".rar") returned 4
	[0167.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.079] lstrlenW (lpString=".bz2") returned 4
	[0167.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.079] lstrlenW (lpString=".7z") returned 3
	[0167.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.080] lstrlenW (lpString=".dbf") returned 4
	[0167.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.080] lstrlenW (lpString=".1cd") returned 4
	[0167.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.080] lstrlenW (lpString=".jpg") returned 4
	[0167.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.080] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.080] lstrlenW (lpString="J0105496.WMF") returned 12
	[0167.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.081] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=5156) returned 1
	[0167.081] CloseHandle (hObject=0x554) returned 1
	[0167.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220
	[0167.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.082] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.082] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.083] GetLastError () returned 0x0
	[0167.083] ReadFile (in: hFile=0x554, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1424, lpOverlapped=0x0) returned 1
	[0167.085] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1430, lpOverlapped=0x0) returned 1
	[0167.086] ReadFile (in: hFile=0x554, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.086] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.086] SetEndOfFile (hFile=0x514) returned 1
	[0167.086] CloseHandle (hObject=0x514) returned 1
	[0167.086] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.087] SetEndOfFile (hFile=0x554) returned 1
	[0167.090] CloseHandle (hObject=0x554) returned 1
	[0167.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1
	[0167.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.091] lstrlenW (lpString=".doc") returned 4
	[0167.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.091] lstrlenW (lpString=".docx") returned 5
	[0167.091] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0167.091] lstrlenW (lpString=".pdf") returned 4
	[0167.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.092] lstrlenW (lpString=".xls") returned 4
	[0167.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.092] lstrlenW (lpString=".xlsx") returned 5
	[0167.092] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0167.092] lstrlenW (lpString=".ppt") returned 4
	[0167.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.092] lstrlenW (lpString=".zip") returned 4
	[0167.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.092] lstrlenW (lpString=".rar") returned 4
	[0167.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.092] lstrlenW (lpString=".bz2") returned 4
	[0167.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.092] lstrlenW (lpString=".7z") returned 3
	[0167.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.092] lstrlenW (lpString=".dbf") returned 4
	[0167.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.092] lstrlenW (lpString=".1cd") returned 4
	[0167.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.093] lstrlenW (lpString=".jpg") returned 4
	[0167.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.093] lstrlenW (lpString=".doc") returned 4
	[0167.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.093] lstrlenW (lpString=".docx") returned 5
	[0167.093] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0167.093] lstrlenW (lpString=".pdf") returned 4
	[0167.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.093] lstrlenW (lpString=".xls") returned 4
	[0167.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.093] lstrlenW (lpString=".xlsx") returned 5
	[0167.093] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0167.093] lstrlenW (lpString=".ppt") returned 4
	[0167.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.093] lstrlenW (lpString=".zip") returned 4
	[0167.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.093] lstrlenW (lpString=".rar") returned 4
	[0167.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.093] lstrlenW (lpString=".bz2") returned 4
	[0167.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.093] lstrlenW (lpString=".7z") returned 3
	[0167.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.093] lstrlenW (lpString=".dbf") returned 4
	[0167.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.094] lstrlenW (lpString=".1cd") returned 4
	[0167.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.094] lstrlenW (lpString=".jpg") returned 4
	[0167.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.094] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.094] lstrlenW (lpString="J0105502.WMF") returned 12
	[0167.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.095] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=5472) returned 1
	[0167.095] CloseHandle (hObject=0x554) returned 1
	[0167.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220
	[0167.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.095] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.095] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.096] GetLastError () returned 0x0
	[0167.096] ReadFile (in: hFile=0x554, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1560, lpOverlapped=0x0) returned 1
	[0167.098] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1570, lpOverlapped=0x0) returned 1
	[0167.102] ReadFile (in: hFile=0x554, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.102] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.103] SetEndOfFile (hFile=0x514) returned 1
	[0167.103] CloseHandle (hObject=0x514) returned 1
	[0167.103] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.103] SetEndOfFile (hFile=0x554) returned 1
	[0167.106] CloseHandle (hObject=0x554) returned 1
	[0167.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1
	[0167.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.107] lstrlenW (lpString=".doc") returned 4
	[0167.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.107] lstrlenW (lpString=".docx") returned 5
	[0167.107] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0167.107] lstrlenW (lpString=".pdf") returned 4
	[0167.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.107] lstrlenW (lpString=".xls") returned 4
	[0167.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.307] lstrlenW (lpString=".xlsx") returned 5
	[0167.307] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0167.307] lstrlenW (lpString=".ppt") returned 4
	[0167.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.307] lstrlenW (lpString=".zip") returned 4
	[0167.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.307] lstrlenW (lpString=".rar") returned 4
	[0167.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.308] lstrlenW (lpString=".bz2") returned 4
	[0167.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.308] lstrlenW (lpString=".7z") returned 3
	[0167.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.308] lstrlenW (lpString=".dbf") returned 4
	[0167.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.308] lstrlenW (lpString=".1cd") returned 4
	[0167.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.308] lstrlenW (lpString=".jpg") returned 4
	[0167.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.308] lstrlenW (lpString=".doc") returned 4
	[0167.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.308] lstrlenW (lpString=".docx") returned 5
	[0167.308] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0167.308] lstrlenW (lpString=".pdf") returned 4
	[0167.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.308] lstrlenW (lpString=".xls") returned 4
	[0167.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.308] lstrlenW (lpString=".xlsx") returned 5
	[0167.308] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0167.308] lstrlenW (lpString=".ppt") returned 4
	[0167.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.309] lstrlenW (lpString=".zip") returned 4
	[0167.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.309] lstrlenW (lpString=".rar") returned 4
	[0167.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.309] lstrlenW (lpString=".bz2") returned 4
	[0167.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.309] lstrlenW (lpString=".7z") returned 3
	[0167.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.309] lstrlenW (lpString=".dbf") returned 4
	[0167.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.309] lstrlenW (lpString=".1cd") returned 4
	[0167.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.309] lstrlenW (lpString=".jpg") returned 4
	[0167.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.309] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.310] lstrlenW (lpString="J0105504.WMF") returned 12
	[0167.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.729] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=4148) returned 1
	[0167.729] CloseHandle (hObject=0x53c) returned 1
	[0167.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220
	[0167.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.730] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.730] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0167.731] GetLastError () returned 0x0
	[0167.731] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1034, lpOverlapped=0x0) returned 1
	[0167.732] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1040, lpOverlapped=0x0) returned 1
	[0167.734] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.734] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.734] SetEndOfFile (hFile=0x520) returned 1
	[0167.734] CloseHandle (hObject=0x520) returned 1
	[0167.734] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.734] SetEndOfFile (hFile=0x53c) returned 1
	[0167.739] CloseHandle (hObject=0x53c) returned 1
	[0167.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1
	[0167.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.740] lstrlenW (lpString=".doc") returned 4
	[0167.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.740] lstrlenW (lpString=".docx") returned 5
	[0167.740] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0167.740] lstrlenW (lpString=".pdf") returned 4
	[0167.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.740] lstrlenW (lpString=".xls") returned 4
	[0167.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.740] lstrlenW (lpString=".xlsx") returned 5
	[0167.740] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0167.740] lstrlenW (lpString=".ppt") returned 4
	[0167.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.740] lstrlenW (lpString=".zip") returned 4
	[0167.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.740] lstrlenW (lpString=".rar") returned 4
	[0167.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.740] lstrlenW (lpString=".bz2") returned 4
	[0167.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.740] lstrlenW (lpString=".7z") returned 3
	[0167.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.741] lstrlenW (lpString=".dbf") returned 4
	[0167.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.741] lstrlenW (lpString=".1cd") returned 4
	[0167.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.741] lstrlenW (lpString=".jpg") returned 4
	[0167.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.741] lstrlenW (lpString=".doc") returned 4
	[0167.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.741] lstrlenW (lpString=".docx") returned 5
	[0167.741] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0167.741] lstrlenW (lpString=".pdf") returned 4
	[0167.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.741] lstrlenW (lpString=".xls") returned 4
	[0167.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.741] lstrlenW (lpString=".xlsx") returned 5
	[0167.741] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0167.741] lstrlenW (lpString=".ppt") returned 4
	[0167.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.741] lstrlenW (lpString=".zip") returned 4
	[0167.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.741] lstrlenW (lpString=".rar") returned 4
	[0167.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.742] lstrlenW (lpString=".bz2") returned 4
	[0167.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.742] lstrlenW (lpString=".7z") returned 3
	[0167.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.742] lstrlenW (lpString=".dbf") returned 4
	[0167.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.742] lstrlenW (lpString=".1cd") returned 4
	[0167.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.742] lstrlenW (lpString=".jpg") returned 4
	[0167.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.742] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.742] lstrlenW (lpString="J0105846.WMF") returned 12
	[0167.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.743] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=8240) returned 1
	[0167.743] CloseHandle (hObject=0x53c) returned 1
	[0167.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220
	[0167.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.744] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.745] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0167.745] GetLastError () returned 0x0
	[0167.745] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2030, lpOverlapped=0x0) returned 1
	[0167.747] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2040, lpOverlapped=0x0) returned 1
	[0167.748] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.748] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.749] SetEndOfFile (hFile=0x520) returned 1
	[0167.749] CloseHandle (hObject=0x520) returned 1
	[0167.749] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.749] SetEndOfFile (hFile=0x53c) returned 1
	[0167.752] CloseHandle (hObject=0x53c) returned 1
	[0167.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1
	[0167.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.753] lstrlenW (lpString=".doc") returned 4
	[0167.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.753] lstrlenW (lpString=".docx") returned 5
	[0167.753] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0167.754] lstrlenW (lpString=".pdf") returned 4
	[0167.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.754] lstrlenW (lpString=".xls") returned 4
	[0167.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.754] lstrlenW (lpString=".xlsx") returned 5
	[0167.754] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0167.754] lstrlenW (lpString=".ppt") returned 4
	[0167.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.754] lstrlenW (lpString=".zip") returned 4
	[0167.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.754] lstrlenW (lpString=".rar") returned 4
	[0167.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.754] lstrlenW (lpString=".bz2") returned 4
	[0167.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.754] lstrlenW (lpString=".7z") returned 3
	[0167.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.754] lstrlenW (lpString=".dbf") returned 4
	[0167.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.754] lstrlenW (lpString=".1cd") returned 4
	[0167.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.754] lstrlenW (lpString=".jpg") returned 4
	[0167.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.755] lstrlenW (lpString=".doc") returned 4
	[0167.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.755] lstrlenW (lpString=".docx") returned 5
	[0167.755] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0167.755] lstrlenW (lpString=".pdf") returned 4
	[0167.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.755] lstrlenW (lpString=".xls") returned 4
	[0167.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.755] lstrlenW (lpString=".xlsx") returned 5
	[0167.755] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0167.755] lstrlenW (lpString=".ppt") returned 4
	[0167.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.755] lstrlenW (lpString=".zip") returned 4
	[0167.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.755] lstrlenW (lpString=".rar") returned 4
	[0167.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.755] lstrlenW (lpString=".bz2") returned 4
	[0167.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.755] lstrlenW (lpString=".7z") returned 3
	[0167.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.755] lstrlenW (lpString=".dbf") returned 4
	[0167.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.755] lstrlenW (lpString=".1cd") returned 4
	[0167.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0167.756] lstrlenW (lpString=".jpg") returned 4
	[0167.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.756] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.756] lstrlenW (lpString="J0105912.WMF") returned 12
	[0167.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.757] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=11720) returned 1
	[0167.757] CloseHandle (hObject=0x53c) returned 1
	[0167.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220
	[0167.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.757] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.758] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0167.758] GetLastError () returned 0x0
	[0167.758] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2dc8, lpOverlapped=0x0) returned 1
	[0167.760] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2dd0, lpOverlapped=0x0) returned 1
	[0167.761] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.762] WriteFile (in: hFile=0x520, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.762] SetEndOfFile (hFile=0x520) returned 1
	[0167.762] CloseHandle (hObject=0x520) returned 1
	[0167.762] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.762] SetEndOfFile (hFile=0x53c) returned 1
	[0168.675] CloseHandle (hObject=0x53c) returned 1
	[0168.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1
	[0168.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.698] lstrlenW (lpString=".doc") returned 4
	[0168.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.698] lstrlenW (lpString=".docx") returned 5
	[0168.698] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.698] lstrlenW (lpString=".pdf") returned 4
	[0168.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.698] lstrlenW (lpString=".xls") returned 4
	[0168.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.698] lstrlenW (lpString=".xlsx") returned 5
	[0168.698] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.698] lstrlenW (lpString=".ppt") returned 4
	[0168.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.698] lstrlenW (lpString=".zip") returned 4
	[0168.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.698] lstrlenW (lpString=".rar") returned 4
	[0168.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.698] lstrlenW (lpString=".bz2") returned 4
	[0168.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.698] lstrlenW (lpString=".7z") returned 3
	[0168.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.698] lstrlenW (lpString=".dbf") returned 4
	[0168.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.699] lstrlenW (lpString=".1cd") returned 4
	[0168.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.699] lstrlenW (lpString=".jpg") returned 4
	[0168.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.699] lstrlenW (lpString=".doc") returned 4
	[0168.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.699] lstrlenW (lpString=".docx") returned 5
	[0168.699] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.699] lstrlenW (lpString=".pdf") returned 4
	[0168.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.699] lstrlenW (lpString=".xls") returned 4
	[0168.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.699] lstrlenW (lpString=".xlsx") returned 5
	[0168.699] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.699] lstrlenW (lpString=".ppt") returned 4
	[0168.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.699] lstrlenW (lpString=".zip") returned 4
	[0168.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.699] lstrlenW (lpString=".rar") returned 4
	[0168.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.700] lstrlenW (lpString=".bz2") returned 4
	[0168.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.700] lstrlenW (lpString=".7z") returned 3
	[0168.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.700] lstrlenW (lpString=".dbf") returned 4
	[0168.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.700] lstrlenW (lpString=".1cd") returned 4
	[0168.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.700] lstrlenW (lpString=".jpg") returned 4
	[0168.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.700] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.700] lstrlenW (lpString="J0106222.WMF") returned 12
	[0168.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0168.701] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=19600) returned 1
	[0168.701] CloseHandle (hObject=0x55c) returned 1
	[0168.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220
	[0168.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0168.702] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.702] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0168.703] GetLastError () returned 0x0
	[0168.703] ReadFile (in: hFile=0x55c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4c90, lpOverlapped=0x0) returned 1
	[0168.724] WriteFile (in: hFile=0x36c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4ca0, lpOverlapped=0x0) returned 1
	[0168.725] ReadFile (in: hFile=0x55c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.725] WriteFile (in: hFile=0x36c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.725] SetEndOfFile (hFile=0x36c) returned 1
	[0168.729] CloseHandle (hObject=0x36c) returned 1
	[0168.729] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.729] SetEndOfFile (hFile=0x55c) returned 1
	[0168.734] CloseHandle (hObject=0x55c) returned 1
	[0168.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1
	[0168.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.736] lstrlenW (lpString=".doc") returned 4
	[0168.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.736] lstrlenW (lpString=".docx") returned 5
	[0168.736] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.736] lstrlenW (lpString=".pdf") returned 4
	[0168.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.736] lstrlenW (lpString=".xls") returned 4
	[0168.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.736] lstrlenW (lpString=".xlsx") returned 5
	[0168.736] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.736] lstrlenW (lpString=".ppt") returned 4
	[0168.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.737] lstrlenW (lpString=".zip") returned 4
	[0168.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.737] lstrlenW (lpString=".rar") returned 4
	[0168.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.737] lstrlenW (lpString=".bz2") returned 4
	[0168.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.737] lstrlenW (lpString=".7z") returned 3
	[0168.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.737] lstrlenW (lpString=".dbf") returned 4
	[0168.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.737] lstrlenW (lpString=".1cd") returned 4
	[0168.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.737] lstrlenW (lpString=".jpg") returned 4
	[0168.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.737] lstrlenW (lpString=".doc") returned 4
	[0168.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.737] lstrlenW (lpString=".docx") returned 5
	[0168.737] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.737] lstrlenW (lpString=".pdf") returned 4
	[0168.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.737] lstrlenW (lpString=".xls") returned 4
	[0168.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.738] lstrlenW (lpString=".xlsx") returned 5
	[0168.738] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.738] lstrlenW (lpString=".ppt") returned 4
	[0168.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.738] lstrlenW (lpString=".zip") returned 4
	[0168.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.738] lstrlenW (lpString=".rar") returned 4
	[0168.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.738] lstrlenW (lpString=".bz2") returned 4
	[0168.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.738] lstrlenW (lpString=".7z") returned 3
	[0168.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.738] lstrlenW (lpString=".dbf") returned 4
	[0168.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.738] lstrlenW (lpString=".1cd") returned 4
	[0168.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.738] lstrlenW (lpString=".jpg") returned 4
	[0168.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.738] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.739] lstrlenW (lpString="J0106958.WMF") returned 12
	[0168.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0168.739] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=13784) returned 1
	[0168.739] CloseHandle (hObject=0x55c) returned 1
	[0168.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220
	[0168.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0168.740] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.740] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0168.741] GetLastError () returned 0x0
	[0168.741] ReadFile (in: hFile=0x55c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x35d8, lpOverlapped=0x0) returned 1
	[0168.746] WriteFile (in: hFile=0x36c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x35e0, lpOverlapped=0x0) returned 1
	[0168.747] ReadFile (in: hFile=0x55c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.747] WriteFile (in: hFile=0x36c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.747] SetEndOfFile (hFile=0x36c) returned 1
	[0168.747] CloseHandle (hObject=0x36c) returned 1
	[0168.747] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.748] SetEndOfFile (hFile=0x55c) returned 1
	[0168.750] CloseHandle (hObject=0x55c) returned 1
	[0168.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1
	[0168.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.751] lstrlenW (lpString=".doc") returned 4
	[0168.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.751] lstrlenW (lpString=".docx") returned 5
	[0168.752] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0168.752] lstrlenW (lpString=".pdf") returned 4
	[0168.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.752] lstrlenW (lpString=".xls") returned 4
	[0168.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.752] lstrlenW (lpString=".xlsx") returned 5
	[0168.752] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0168.752] lstrlenW (lpString=".ppt") returned 4
	[0168.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.752] lstrlenW (lpString=".zip") returned 4
	[0168.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.752] lstrlenW (lpString=".rar") returned 4
	[0168.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.752] lstrlenW (lpString=".bz2") returned 4
	[0168.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.752] lstrlenW (lpString=".7z") returned 3
	[0168.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.752] lstrlenW (lpString=".dbf") returned 4
	[0168.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.752] lstrlenW (lpString=".1cd") returned 4
	[0168.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.753] lstrlenW (lpString=".jpg") returned 4
	[0168.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.753] lstrlenW (lpString=".doc") returned 4
	[0168.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.753] lstrlenW (lpString=".docx") returned 5
	[0168.753] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0168.753] lstrlenW (lpString=".pdf") returned 4
	[0168.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.753] lstrlenW (lpString=".xls") returned 4
	[0168.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.753] lstrlenW (lpString=".xlsx") returned 5
	[0168.753] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0168.753] lstrlenW (lpString=".ppt") returned 4
	[0168.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.753] lstrlenW (lpString=".zip") returned 4
	[0168.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.753] lstrlenW (lpString=".rar") returned 4
	[0168.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.753] lstrlenW (lpString=".bz2") returned 4
	[0168.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.753] lstrlenW (lpString=".7z") returned 3
	[0168.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.754] lstrlenW (lpString=".dbf") returned 4
	[0168.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.754] lstrlenW (lpString=".1cd") returned 4
	[0168.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0168.754] lstrlenW (lpString=".jpg") returned 4
	[0168.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.754] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.754] lstrlenW (lpString="J0107024.WMF") returned 12
	[0168.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.808] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=3020) returned 1
	[0168.808] CloseHandle (hObject=0x4e0) returned 1
	[0168.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220
	[0168.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.809] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.809] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0168.810] GetLastError () returned 0x0
	[0168.810] ReadFile (in: hFile=0x4e0, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xbcc, lpOverlapped=0x0) returned 1
	[0168.811] WriteFile (in: hFile=0x55c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0168.812] ReadFile (in: hFile=0x4e0, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.813] WriteFile (in: hFile=0x55c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.813] SetEndOfFile (hFile=0x55c) returned 1
	[0168.813] CloseHandle (hObject=0x55c) returned 1
	[0168.813] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.813] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.816] CloseHandle (hObject=0x4e0) returned 1
	[0168.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1
	[0168.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.817] lstrlenW (lpString=".doc") returned 4
	[0168.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.817] lstrlenW (lpString=".docx") returned 5
	[0168.817] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0168.817] lstrlenW (lpString=".pdf") returned 4
	[0168.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.817] lstrlenW (lpString=".xls") returned 4
	[0168.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.817] lstrlenW (lpString=".xlsx") returned 5
	[0168.817] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0168.817] lstrlenW (lpString=".ppt") returned 4
	[0168.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.817] lstrlenW (lpString=".zip") returned 4
	[0168.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.817] lstrlenW (lpString=".rar") returned 4
	[0168.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.817] lstrlenW (lpString=".bz2") returned 4
	[0168.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.818] lstrlenW (lpString=".7z") returned 3
	[0168.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.818] lstrlenW (lpString=".dbf") returned 4
	[0168.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.818] lstrlenW (lpString=".1cd") returned 4
	[0168.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.818] lstrlenW (lpString=".jpg") returned 4
	[0168.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.818] lstrlenW (lpString=".doc") returned 4
	[0168.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.818] lstrlenW (lpString=".docx") returned 5
	[0168.818] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0168.818] lstrlenW (lpString=".pdf") returned 4
	[0168.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.818] lstrlenW (lpString=".xls") returned 4
	[0168.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.818] lstrlenW (lpString=".xlsx") returned 5
	[0168.818] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0168.819] lstrlenW (lpString=".ppt") returned 4
	[0168.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.819] lstrlenW (lpString=".zip") returned 4
	[0168.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.819] lstrlenW (lpString=".rar") returned 4
	[0168.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.819] lstrlenW (lpString=".bz2") returned 4
	[0168.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.819] lstrlenW (lpString=".7z") returned 3
	[0168.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.819] lstrlenW (lpString=".dbf") returned 4
	[0168.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.819] lstrlenW (lpString=".1cd") returned 4
	[0168.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0168.819] lstrlenW (lpString=".jpg") returned 4
	[0168.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.819] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.819] lstrlenW (lpString="J0107042.WMF") returned 12
	[0168.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.820] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=9048) returned 1
	[0168.820] CloseHandle (hObject=0x4e0) returned 1
	[0168.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220
	[0168.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.825] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.825] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0168.825] GetLastError () returned 0x0
	[0168.825] ReadFile (in: hFile=0x4e0, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2358, lpOverlapped=0x0) returned 1
	[0168.827] WriteFile (in: hFile=0x55c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2360, lpOverlapped=0x0) returned 1
	[0168.828] ReadFile (in: hFile=0x4e0, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.828] WriteFile (in: hFile=0x55c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.829] SetEndOfFile (hFile=0x55c) returned 1
	[0168.829] CloseHandle (hObject=0x55c) returned 1
	[0168.829] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.829] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.832] CloseHandle (hObject=0x4e0) returned 1
	[0168.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 1
	[0168.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.833] lstrlenW (lpString=".doc") returned 4
	[0168.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.833] lstrlenW (lpString=".docx") returned 5
	[0168.833] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.833] lstrlenW (lpString=".pdf") returned 4
	[0168.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.833] lstrlenW (lpString=".xls") returned 4
	[0168.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.833] lstrlenW (lpString=".xlsx") returned 5
	[0168.833] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.833] lstrlenW (lpString=".ppt") returned 4
	[0168.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.833] lstrlenW (lpString=".zip") returned 4
	[0168.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.834] lstrlenW (lpString=".rar") returned 4
	[0168.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.834] lstrlenW (lpString=".bz2") returned 4
	[0168.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.834] lstrlenW (lpString=".7z") returned 3
	[0168.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.834] lstrlenW (lpString=".dbf") returned 4
	[0168.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.834] lstrlenW (lpString=".1cd") returned 4
	[0168.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.834] lstrlenW (lpString=".jpg") returned 4
	[0168.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.834] lstrlenW (lpString=".doc") returned 4
	[0168.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.834] lstrlenW (lpString=".docx") returned 5
	[0168.834] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.834] lstrlenW (lpString=".pdf") returned 4
	[0168.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.835] lstrlenW (lpString=".xls") returned 4
	[0168.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.835] lstrlenW (lpString=".xlsx") returned 5
	[0168.835] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.835] lstrlenW (lpString=".ppt") returned 4
	[0168.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.835] lstrlenW (lpString=".zip") returned 4
	[0168.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.835] lstrlenW (lpString=".rar") returned 4
	[0168.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.835] lstrlenW (lpString=".bz2") returned 4
	[0168.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.835] lstrlenW (lpString=".7z") returned 3
	[0168.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.835] lstrlenW (lpString=".dbf") returned 4
	[0168.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.835] lstrlenW (lpString=".1cd") returned 4
	[0168.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0168.835] lstrlenW (lpString=".jpg") returned 4
	[0168.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.836] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.836] lstrlenW (lpString="J0107090.WMF") returned 12
	[0168.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.836] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=14132) returned 1
	[0168.836] CloseHandle (hObject=0x4e0) returned 1
	[0168.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220
	[0168.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.837] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.837] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0168.838] GetLastError () returned 0x0
	[0168.838] ReadFile (in: hFile=0x4e0, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x3734, lpOverlapped=0x0) returned 1
	[0168.840] WriteFile (in: hFile=0x55c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x3740, lpOverlapped=0x0) returned 1
	[0168.841] ReadFile (in: hFile=0x4e0, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.841] WriteFile (in: hFile=0x55c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.841] SetEndOfFile (hFile=0x55c) returned 1
	[0168.841] CloseHandle (hObject=0x55c) returned 1
	[0168.841] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.841] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.845] CloseHandle (hObject=0x4e0) returned 1
	[0168.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1
	[0168.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0168.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0168.846] lstrlenW (lpString=".doc") returned 4
	[0168.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.846] lstrlenW (lpString=".docx") returned 5
	[0168.846] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.846] lstrlenW (lpString=".pdf") returned 4
	[0168.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.846] lstrlenW (lpString=".xls") returned 4
	[0168.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.846] lstrlenW (lpString=".xlsx") returned 5
	[0168.846] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.846] lstrlenW (lpString=".ppt") returned 4
	[0168.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0168.846] lstrlenW (lpString=".zip") returned 4
	[0168.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.846] lstrlenW (lpString=".rar") returned 4
	[0168.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.846] lstrlenW (lpString=".bz2") returned 4
	[0168.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.846] lstrlenW (lpString=".7z") returned 3
	[0168.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0168.846] lstrlenW (lpString=".dbf") returned 4
	[0168.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0168.847] lstrlenW (lpString=".1cd") returned 4
	[0168.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0168.847] lstrlenW (lpString=".jpg") returned 4
	[0168.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0168.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0168.847] lstrlenW (lpString=".doc") returned 4
	[0168.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.847] lstrlenW (lpString=".docx") returned 5
	[0168.847] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.847] lstrlenW (lpString=".pdf") returned 4
	[0168.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.847] lstrlenW (lpString=".xls") returned 4
	[0168.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.847] lstrlenW (lpString=".xlsx") returned 5
	[0168.847] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.847] lstrlenW (lpString=".ppt") returned 4
	[0168.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0168.847] lstrlenW (lpString=".zip") returned 4
	[0169.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.100] lstrlenW (lpString=".rar") returned 4
	[0169.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.100] lstrlenW (lpString=".bz2") returned 4
	[0169.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.100] lstrlenW (lpString=".7z") returned 3
	[0169.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0169.100] lstrlenW (lpString=".dbf") returned 4
	[0169.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0169.100] lstrlenW (lpString=".1cd") returned 4
	[0169.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0169.100] lstrlenW (lpString=".jpg") returned 4
	[0169.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.100] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.101] lstrlenW (lpString="J0107146.WMF") returned 12
	[0169.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.357] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=14996) returned 1
	[0169.357] CloseHandle (hObject=0x534) returned 1
	[0169.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220
	[0169.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0169.724] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.724] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0169.725] GetLastError () returned 0x0
	[0169.725] ReadFile (in: hFile=0x36c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x3a94, lpOverlapped=0x0) returned 1
	[0169.727] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x3aa0, lpOverlapped=0x0) returned 1
	[0169.728] ReadFile (in: hFile=0x36c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.728] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.728] SetEndOfFile (hFile=0x514) returned 1
	[0169.729] CloseHandle (hObject=0x514) returned 1
	[0169.729] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.729] SetEndOfFile (hFile=0x36c) returned 1
	[0169.732] CloseHandle (hObject=0x36c) returned 1
	[0169.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 1
	[0169.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.733] lstrlenW (lpString=".doc") returned 4
	[0169.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.733] lstrlenW (lpString=".docx") returned 5
	[0169.733] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0169.733] lstrlenW (lpString=".pdf") returned 4
	[0169.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.733] lstrlenW (lpString=".xls") returned 4
	[0169.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.733] lstrlenW (lpString=".xlsx") returned 5
	[0169.733] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0169.733] lstrlenW (lpString=".ppt") returned 4
	[0169.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.733] lstrlenW (lpString=".zip") returned 4
	[0169.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.734] lstrlenW (lpString=".rar") returned 4
	[0169.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.734] lstrlenW (lpString=".bz2") returned 4
	[0169.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.734] lstrlenW (lpString=".7z") returned 3
	[0169.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.734] lstrlenW (lpString=".dbf") returned 4
	[0169.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.734] lstrlenW (lpString=".1cd") returned 4
	[0169.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.734] lstrlenW (lpString=".jpg") returned 4
	[0169.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.734] lstrlenW (lpString=".doc") returned 4
	[0169.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.734] lstrlenW (lpString=".docx") returned 5
	[0169.734] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0169.734] lstrlenW (lpString=".pdf") returned 4
	[0169.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.734] lstrlenW (lpString=".xls") returned 4
	[0169.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.735] lstrlenW (lpString=".xlsx") returned 5
	[0169.735] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0169.735] lstrlenW (lpString=".ppt") returned 4
	[0169.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.735] lstrlenW (lpString=".zip") returned 4
	[0169.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.735] lstrlenW (lpString=".rar") returned 4
	[0169.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.735] lstrlenW (lpString=".bz2") returned 4
	[0169.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.735] lstrlenW (lpString=".7z") returned 3
	[0169.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.735] lstrlenW (lpString=".dbf") returned 4
	[0169.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.735] lstrlenW (lpString=".1cd") returned 4
	[0169.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0169.735] lstrlenW (lpString=".jpg") returned 4
	[0169.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.736] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.736] lstrlenW (lpString="J0107192.WMF") returned 12
	[0169.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0169.736] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=9968) returned 1
	[0169.736] CloseHandle (hObject=0x36c) returned 1
	[0169.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220
	[0169.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0169.737] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.737] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0169.738] GetLastError () returned 0x0
	[0169.738] ReadFile (in: hFile=0x36c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x26f0, lpOverlapped=0x0) returned 1
	[0169.739] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2700, lpOverlapped=0x0) returned 1
	[0169.741] ReadFile (in: hFile=0x36c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.741] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.741] SetEndOfFile (hFile=0x514) returned 1
	[0169.741] CloseHandle (hObject=0x514) returned 1
	[0169.741] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.741] SetEndOfFile (hFile=0x36c) returned 1
	[0169.744] CloseHandle (hObject=0x36c) returned 1
	[0169.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 1
	[0169.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.749] lstrlenW (lpString=".doc") returned 4
	[0169.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.749] lstrlenW (lpString=".docx") returned 5
	[0169.749] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0169.750] lstrlenW (lpString=".pdf") returned 4
	[0169.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.750] lstrlenW (lpString=".xls") returned 4
	[0169.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.750] lstrlenW (lpString=".xlsx") returned 5
	[0169.750] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0169.750] lstrlenW (lpString=".ppt") returned 4
	[0169.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.750] lstrlenW (lpString=".zip") returned 4
	[0169.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.750] lstrlenW (lpString=".rar") returned 4
	[0169.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.750] lstrlenW (lpString=".bz2") returned 4
	[0169.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.750] lstrlenW (lpString=".7z") returned 3
	[0169.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.750] lstrlenW (lpString=".dbf") returned 4
	[0169.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.750] lstrlenW (lpString=".1cd") returned 4
	[0169.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.750] lstrlenW (lpString=".jpg") returned 4
	[0169.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.751] lstrlenW (lpString=".doc") returned 4
	[0169.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.751] lstrlenW (lpString=".docx") returned 5
	[0169.751] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0169.751] lstrlenW (lpString=".pdf") returned 4
	[0169.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.751] lstrlenW (lpString=".xls") returned 4
	[0169.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.751] lstrlenW (lpString=".xlsx") returned 5
	[0169.751] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0169.751] lstrlenW (lpString=".ppt") returned 4
	[0169.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.751] lstrlenW (lpString=".zip") returned 4
	[0169.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.751] lstrlenW (lpString=".rar") returned 4
	[0169.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.751] lstrlenW (lpString=".bz2") returned 4
	[0169.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.751] lstrlenW (lpString=".7z") returned 3
	[0169.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.751] lstrlenW (lpString=".dbf") returned 4
	[0169.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.751] lstrlenW (lpString=".1cd") returned 4
	[0169.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0169.752] lstrlenW (lpString=".jpg") returned 4
	[0169.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.752] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.752] lstrlenW (lpString="J0107254.WMF") returned 12
	[0169.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0169.753] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=20212) returned 1
	[0169.753] CloseHandle (hObject=0x36c) returned 1
	[0169.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220
	[0169.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0169.754] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.754] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0169.754] GetLastError () returned 0x0
	[0169.754] ReadFile (in: hFile=0x36c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4ef4, lpOverlapped=0x0) returned 1
	[0169.757] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4f00, lpOverlapped=0x0) returned 1
	[0169.758] ReadFile (in: hFile=0x36c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.758] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.758] SetEndOfFile (hFile=0x514) returned 1
	[0169.758] CloseHandle (hObject=0x514) returned 1
	[0169.758] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.758] SetEndOfFile (hFile=0x36c) returned 1
	[0170.040] CloseHandle (hObject=0x36c) returned 1
	[0170.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 1
	[0170.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.268] lstrlenW (lpString=".doc") returned 4
	[0170.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.268] lstrlenW (lpString=".docx") returned 5
	[0170.268] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.269] lstrlenW (lpString=".pdf") returned 4
	[0170.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.269] lstrlenW (lpString=".xls") returned 4
	[0170.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.269] lstrlenW (lpString=".xlsx") returned 5
	[0170.269] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.269] lstrlenW (lpString=".ppt") returned 4
	[0170.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.269] lstrlenW (lpString=".zip") returned 4
	[0170.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.269] lstrlenW (lpString=".rar") returned 4
	[0170.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.269] lstrlenW (lpString=".bz2") returned 4
	[0170.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.269] lstrlenW (lpString=".7z") returned 3
	[0170.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.269] lstrlenW (lpString=".dbf") returned 4
	[0170.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.269] lstrlenW (lpString=".1cd") returned 4
	[0170.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.269] lstrlenW (lpString=".jpg") returned 4
	[0170.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.270] lstrlenW (lpString=".doc") returned 4
	[0170.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.270] lstrlenW (lpString=".docx") returned 5
	[0170.270] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.270] lstrlenW (lpString=".pdf") returned 4
	[0170.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.270] lstrlenW (lpString=".xls") returned 4
	[0170.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.270] lstrlenW (lpString=".xlsx") returned 5
	[0170.270] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.270] lstrlenW (lpString=".ppt") returned 4
	[0170.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.270] lstrlenW (lpString=".zip") returned 4
	[0170.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.270] lstrlenW (lpString=".rar") returned 4
	[0170.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.270] lstrlenW (lpString=".bz2") returned 4
	[0170.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.270] lstrlenW (lpString=".7z") returned 3
	[0170.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.270] lstrlenW (lpString=".dbf") returned 4
	[0170.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.270] lstrlenW (lpString=".1cd") returned 4
	[0170.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.271] lstrlenW (lpString=".jpg") returned 4
	[0170.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.271] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.271] lstrlenW (lpString="J0107316.WMF") returned 12
	[0170.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.271] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=11288) returned 1
	[0170.271] CloseHandle (hObject=0x53c) returned 1
	[0170.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0x220
	[0170.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.272] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.272] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0170.273] GetLastError () returned 0x0
	[0170.273] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2c18, lpOverlapped=0x0) returned 1
	[0170.275] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2c20, lpOverlapped=0x0) returned 1
	[0170.276] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.276] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.276] SetEndOfFile (hFile=0x370) returned 1
	[0170.276] CloseHandle (hObject=0x370) returned 1
	[0170.276] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.276] SetEndOfFile (hFile=0x53c) returned 1
	[0170.279] CloseHandle (hObject=0x53c) returned 1
	[0170.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 1
	[0170.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.280] lstrlenW (lpString=".doc") returned 4
	[0170.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.280] lstrlenW (lpString=".docx") returned 5
	[0170.280] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0170.280] lstrlenW (lpString=".pdf") returned 4
	[0170.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.280] lstrlenW (lpString=".xls") returned 4
	[0170.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.281] lstrlenW (lpString=".xlsx") returned 5
	[0170.281] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0170.281] lstrlenW (lpString=".ppt") returned 4
	[0170.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.281] lstrlenW (lpString=".zip") returned 4
	[0170.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.281] lstrlenW (lpString=".rar") returned 4
	[0170.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.281] lstrlenW (lpString=".bz2") returned 4
	[0170.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.281] lstrlenW (lpString=".7z") returned 3
	[0170.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.281] lstrlenW (lpString=".dbf") returned 4
	[0170.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.281] lstrlenW (lpString=".1cd") returned 4
	[0170.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.281] lstrlenW (lpString=".jpg") returned 4
	[0170.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.281] lstrlenW (lpString=".doc") returned 4
	[0170.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.281] lstrlenW (lpString=".docx") returned 5
	[0170.281] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0170.282] lstrlenW (lpString=".pdf") returned 4
	[0170.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.282] lstrlenW (lpString=".xls") returned 4
	[0170.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.282] lstrlenW (lpString=".xlsx") returned 5
	[0170.282] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0170.282] lstrlenW (lpString=".ppt") returned 4
	[0170.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.282] lstrlenW (lpString=".zip") returned 4
	[0170.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.282] lstrlenW (lpString=".rar") returned 4
	[0170.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.282] lstrlenW (lpString=".bz2") returned 4
	[0170.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.282] lstrlenW (lpString=".7z") returned 3
	[0170.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.282] lstrlenW (lpString=".dbf") returned 4
	[0170.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.282] lstrlenW (lpString=".1cd") returned 4
	[0170.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0170.282] lstrlenW (lpString=".jpg") returned 4
	[0170.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.283] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.283] lstrlenW (lpString="J0107328.WMF") returned 12
	[0170.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.283] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=6532) returned 1
	[0170.283] CloseHandle (hObject=0x53c) returned 1
	[0170.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220
	[0170.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.284] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.284] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0170.285] GetLastError () returned 0x0
	[0170.285] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1984, lpOverlapped=0x0) returned 1
	[0170.287] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1990, lpOverlapped=0x0) returned 1
	[0170.288] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.288] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.288] SetEndOfFile (hFile=0x370) returned 1
	[0170.288] CloseHandle (hObject=0x370) returned 1
	[0170.288] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.288] SetEndOfFile (hFile=0x53c) returned 1
	[0170.292] CloseHandle (hObject=0x53c) returned 1
	[0170.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 1
	[0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.294] lstrlenW (lpString=".doc") returned 4
	[0170.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.294] lstrlenW (lpString=".docx") returned 5
	[0170.294] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.294] lstrlenW (lpString=".pdf") returned 4
	[0170.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.294] lstrlenW (lpString=".xls") returned 4
	[0170.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.294] lstrlenW (lpString=".xlsx") returned 5
	[0170.294] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.294] lstrlenW (lpString=".ppt") returned 4
	[0170.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.294] lstrlenW (lpString=".zip") returned 4
	[0170.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.294] lstrlenW (lpString=".rar") returned 4
	[0170.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.294] lstrlenW (lpString=".bz2") returned 4
	[0170.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.294] lstrlenW (lpString=".7z") returned 3
	[0170.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.295] lstrlenW (lpString=".dbf") returned 4
	[0170.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.295] lstrlenW (lpString=".1cd") returned 4
	[0170.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.295] lstrlenW (lpString=".jpg") returned 4
	[0170.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.295] lstrlenW (lpString=".doc") returned 4
	[0170.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.295] lstrlenW (lpString=".docx") returned 5
	[0170.295] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.295] lstrlenW (lpString=".pdf") returned 4
	[0170.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.295] lstrlenW (lpString=".xls") returned 4
	[0170.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.295] lstrlenW (lpString=".xlsx") returned 5
	[0170.295] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.295] lstrlenW (lpString=".ppt") returned 4
	[0170.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.295] lstrlenW (lpString=".zip") returned 4
	[0170.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.295] lstrlenW (lpString=".rar") returned 4
	[0170.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.296] lstrlenW (lpString=".bz2") returned 4
	[0170.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.296] lstrlenW (lpString=".7z") returned 3
	[0170.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.296] lstrlenW (lpString=".dbf") returned 4
	[0170.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.296] lstrlenW (lpString=".1cd") returned 4
	[0170.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0170.296] lstrlenW (lpString=".jpg") returned 4
	[0170.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.296] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.296] lstrlenW (lpString="J0107342.WMF") returned 12
	[0170.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.297] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=4244) returned 1
	[0170.297] CloseHandle (hObject=0x53c) returned 1
	[0170.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220
	[0170.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.298] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.298] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0170.672] GetLastError () returned 0x0
	[0170.695] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1094, lpOverlapped=0x0) returned 1
	[0170.711] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x10a0, lpOverlapped=0x0) returned 1
	[0170.712] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.712] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.712] SetEndOfFile (hFile=0x370) returned 1
	[0170.712] CloseHandle (hObject=0x370) returned 1
	[0170.712] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.712] SetEndOfFile (hFile=0x53c) returned 1
	[0170.715] CloseHandle (hObject=0x53c) returned 1
	[0170.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 1
	[0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.716] lstrlenW (lpString=".doc") returned 4
	[0170.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.716] lstrlenW (lpString=".docx") returned 5
	[0170.716] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.716] lstrlenW (lpString=".pdf") returned 4
	[0170.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.716] lstrlenW (lpString=".xls") returned 4
	[0170.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.716] lstrlenW (lpString=".xlsx") returned 5
	[0170.716] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.716] lstrlenW (lpString=".ppt") returned 4
	[0170.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.717] lstrlenW (lpString=".zip") returned 4
	[0170.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.717] lstrlenW (lpString=".rar") returned 4
	[0170.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.717] lstrlenW (lpString=".bz2") returned 4
	[0170.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.717] lstrlenW (lpString=".7z") returned 3
	[0170.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.717] lstrlenW (lpString=".dbf") returned 4
	[0170.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.717] lstrlenW (lpString=".1cd") returned 4
	[0170.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.717] lstrlenW (lpString=".jpg") returned 4
	[0170.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.717] lstrlenW (lpString=".doc") returned 4
	[0170.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.717] lstrlenW (lpString=".docx") returned 5
	[0170.717] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.717] lstrlenW (lpString=".pdf") returned 4
	[0170.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.717] lstrlenW (lpString=".xls") returned 4
	[0170.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.718] lstrlenW (lpString=".xlsx") returned 5
	[0170.718] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.718] lstrlenW (lpString=".ppt") returned 4
	[0170.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.718] lstrlenW (lpString=".zip") returned 4
	[0170.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.718] lstrlenW (lpString=".rar") returned 4
	[0170.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.718] lstrlenW (lpString=".bz2") returned 4
	[0170.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.718] lstrlenW (lpString=".7z") returned 3
	[0170.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.718] lstrlenW (lpString=".dbf") returned 4
	[0170.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.718] lstrlenW (lpString=".1cd") returned 4
	[0170.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0170.718] lstrlenW (lpString=".jpg") returned 4
	[0170.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.719] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.719] lstrlenW (lpString="J0107456.WMF") returned 12
	[0170.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.719] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=3724) returned 1
	[0170.719] CloseHandle (hObject=0x53c) returned 1
	[0170.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0x220
	[0170.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.720] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.720] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0170.721] GetLastError () returned 0x0
	[0170.721] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xe8c, lpOverlapped=0x0) returned 1
	[0170.722] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xe90, lpOverlapped=0x0) returned 1
	[0170.723] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.723] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.723] SetEndOfFile (hFile=0x370) returned 1
	[0170.724] CloseHandle (hObject=0x370) returned 1
	[0170.724] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.724] SetEndOfFile (hFile=0x53c) returned 1
	[0170.727] CloseHandle (hObject=0x53c) returned 1
	[0170.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 1
	[0170.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.728] lstrlenW (lpString=".doc") returned 4
	[0170.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.728] lstrlenW (lpString=".docx") returned 5
	[0170.728] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0170.728] lstrlenW (lpString=".pdf") returned 4
	[0170.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.728] lstrlenW (lpString=".xls") returned 4
	[0170.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.728] lstrlenW (lpString=".xlsx") returned 5
	[0170.728] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0170.728] lstrlenW (lpString=".ppt") returned 4
	[0170.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.728] lstrlenW (lpString=".zip") returned 4
	[0170.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.728] lstrlenW (lpString=".rar") returned 4
	[0170.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.728] lstrlenW (lpString=".bz2") returned 4
	[0170.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.728] lstrlenW (lpString=".7z") returned 3
	[0170.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.728] lstrlenW (lpString=".dbf") returned 4
	[0170.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.729] lstrlenW (lpString=".1cd") returned 4
	[0170.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.729] lstrlenW (lpString=".jpg") returned 4
	[0170.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.729] lstrlenW (lpString=".doc") returned 4
	[0170.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.729] lstrlenW (lpString=".docx") returned 5
	[0170.729] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0170.729] lstrlenW (lpString=".pdf") returned 4
	[0170.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.729] lstrlenW (lpString=".xls") returned 4
	[0170.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.729] lstrlenW (lpString=".xlsx") returned 5
	[0170.729] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0170.729] lstrlenW (lpString=".ppt") returned 4
	[0170.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.729] lstrlenW (lpString=".zip") returned 4
	[0170.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.730] lstrlenW (lpString=".rar") returned 4
	[0170.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.730] lstrlenW (lpString=".bz2") returned 4
	[0170.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.730] lstrlenW (lpString=".7z") returned 3
	[0170.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.730] lstrlenW (lpString=".dbf") returned 4
	[0170.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.730] lstrlenW (lpString=".1cd") returned 4
	[0170.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0170.730] lstrlenW (lpString=".jpg") returned 4
	[0170.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.730] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.730] lstrlenW (lpString="J0107458.WMF") returned 12
	[0170.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.731] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=3568) returned 1
	[0170.731] CloseHandle (hObject=0x53c) returned 1
	[0170.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 0x220
	[0170.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.731] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.732] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0170.732] GetLastError () returned 0x0
	[0170.732] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xdf0, lpOverlapped=0x0) returned 1
	[0170.734] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xe00, lpOverlapped=0x0) returned 1
	[0170.734] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.735] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.735] SetEndOfFile (hFile=0x370) returned 1
	[0170.735] CloseHandle (hObject=0x370) returned 1
	[0170.735] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.735] SetEndOfFile (hFile=0x53c) returned 1
	[0170.738] CloseHandle (hObject=0x53c) returned 1
	[0170.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 1
	[0170.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.739] lstrlenW (lpString=".doc") returned 4
	[0170.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.739] lstrlenW (lpString=".docx") returned 5
	[0170.739] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.740] lstrlenW (lpString=".pdf") returned 4
	[0170.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.740] lstrlenW (lpString=".xls") returned 4
	[0170.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.740] lstrlenW (lpString=".xlsx") returned 5
	[0170.740] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.740] lstrlenW (lpString=".ppt") returned 4
	[0170.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.740] lstrlenW (lpString=".zip") returned 4
	[0170.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.740] lstrlenW (lpString=".rar") returned 4
	[0170.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.740] lstrlenW (lpString=".bz2") returned 4
	[0170.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.740] lstrlenW (lpString=".7z") returned 3
	[0170.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.740] lstrlenW (lpString=".dbf") returned 4
	[0170.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.740] lstrlenW (lpString=".1cd") returned 4
	[0170.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.740] lstrlenW (lpString=".jpg") returned 4
	[0170.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.741] lstrlenW (lpString=".doc") returned 4
	[0170.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.741] lstrlenW (lpString=".docx") returned 5
	[0170.741] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.741] lstrlenW (lpString=".pdf") returned 4
	[0170.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.741] lstrlenW (lpString=".xls") returned 4
	[0170.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.741] lstrlenW (lpString=".xlsx") returned 5
	[0170.741] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.741] lstrlenW (lpString=".ppt") returned 4
	[0170.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.741] lstrlenW (lpString=".zip") returned 4
	[0170.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.741] lstrlenW (lpString=".rar") returned 4
	[0170.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.741] lstrlenW (lpString=".bz2") returned 4
	[0170.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.741] lstrlenW (lpString=".7z") returned 3
	[0170.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.741] lstrlenW (lpString=".dbf") returned 4
	[0170.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.741] lstrlenW (lpString=".1cd") returned 4
	[0170.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0170.741] lstrlenW (lpString=".jpg") returned 4
	[0170.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.742] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.742] lstrlenW (lpString="J0107468.WMF") returned 12
	[0170.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.742] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=9612) returned 1
	[0170.742] CloseHandle (hObject=0x53c) returned 1
	[0170.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0x220
	[0170.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.743] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.743] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0170.744] GetLastError () returned 0x0
	[0170.744] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x258c, lpOverlapped=0x0) returned 1
	[0171.036] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2590, lpOverlapped=0x0) returned 1
	[0171.038] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.038] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.038] SetEndOfFile (hFile=0x370) returned 1
	[0171.038] CloseHandle (hObject=0x370) returned 1
	[0171.038] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.038] SetEndOfFile (hFile=0x53c) returned 1
	[0171.041] CloseHandle (hObject=0x53c) returned 1
	[0171.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 1
	[0171.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.045] lstrlenW (lpString=".doc") returned 4
	[0171.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.045] lstrlenW (lpString=".docx") returned 5
	[0171.045] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0171.045] lstrlenW (lpString=".pdf") returned 4
	[0171.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.045] lstrlenW (lpString=".xls") returned 4
	[0171.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.045] lstrlenW (lpString=".xlsx") returned 5
	[0171.045] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0171.045] lstrlenW (lpString=".ppt") returned 4
	[0171.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.045] lstrlenW (lpString=".zip") returned 4
	[0171.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.045] lstrlenW (lpString=".rar") returned 4
	[0171.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.045] lstrlenW (lpString=".bz2") returned 4
	[0171.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.045] lstrlenW (lpString=".7z") returned 3
	[0171.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.045] lstrlenW (lpString=".dbf") returned 4
	[0171.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.045] lstrlenW (lpString=".1cd") returned 4
	[0171.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.046] lstrlenW (lpString=".jpg") returned 4
	[0171.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.046] lstrlenW (lpString=".doc") returned 4
	[0171.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.046] lstrlenW (lpString=".docx") returned 5
	[0171.046] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0171.046] lstrlenW (lpString=".pdf") returned 4
	[0171.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.046] lstrlenW (lpString=".xls") returned 4
	[0171.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.046] lstrlenW (lpString=".xlsx") returned 5
	[0171.046] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0171.046] lstrlenW (lpString=".ppt") returned 4
	[0171.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.046] lstrlenW (lpString=".zip") returned 4
	[0171.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.046] lstrlenW (lpString=".rar") returned 4
	[0171.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.047] lstrlenW (lpString=".bz2") returned 4
	[0171.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.047] lstrlenW (lpString=".7z") returned 3
	[0171.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.047] lstrlenW (lpString=".dbf") returned 4
	[0171.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.047] lstrlenW (lpString=".1cd") returned 4
	[0171.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.047] lstrlenW (lpString=".jpg") returned 4
	[0171.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.047] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.047] lstrlenW (lpString="J0107490.WMF") returned 12
	[0171.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.048] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=16468) returned 1
	[0171.048] CloseHandle (hObject=0x53c) returned 1
	[0171.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0x220
	[0171.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.049] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.049] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0171.050] GetLastError () returned 0x0
	[0171.050] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4054, lpOverlapped=0x0) returned 1
	[0171.053] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4060, lpOverlapped=0x0) returned 1
	[0171.054] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.054] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.054] SetEndOfFile (hFile=0x370) returned 1
	[0171.054] CloseHandle (hObject=0x370) returned 1
	[0171.054] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.054] SetEndOfFile (hFile=0x53c) returned 1
	[0171.057] CloseHandle (hObject=0x53c) returned 1
	[0171.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 1
	[0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.059] lstrlenW (lpString=".doc") returned 4
	[0171.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.059] lstrlenW (lpString=".docx") returned 5
	[0171.059] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0171.059] lstrlenW (lpString=".pdf") returned 4
	[0171.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.059] lstrlenW (lpString=".xls") returned 4
	[0171.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.059] lstrlenW (lpString=".xlsx") returned 5
	[0171.059] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0171.059] lstrlenW (lpString=".ppt") returned 4
	[0171.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.060] lstrlenW (lpString=".zip") returned 4
	[0171.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.060] lstrlenW (lpString=".rar") returned 4
	[0171.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.060] lstrlenW (lpString=".bz2") returned 4
	[0171.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.060] lstrlenW (lpString=".7z") returned 3
	[0171.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.060] lstrlenW (lpString=".dbf") returned 4
	[0171.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.060] lstrlenW (lpString=".1cd") returned 4
	[0171.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.060] lstrlenW (lpString=".jpg") returned 4
	[0171.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.061] lstrlenW (lpString=".doc") returned 4
	[0171.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.061] lstrlenW (lpString=".docx") returned 5
	[0171.061] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0171.061] lstrlenW (lpString=".pdf") returned 4
	[0171.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.061] lstrlenW (lpString=".xls") returned 4
	[0171.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.061] lstrlenW (lpString=".xlsx") returned 5
	[0171.061] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0171.061] lstrlenW (lpString=".ppt") returned 4
	[0171.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.061] lstrlenW (lpString=".zip") returned 4
	[0171.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.061] lstrlenW (lpString=".rar") returned 4
	[0171.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.061] lstrlenW (lpString=".bz2") returned 4
	[0171.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.061] lstrlenW (lpString=".7z") returned 3
	[0171.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.061] lstrlenW (lpString=".dbf") returned 4
	[0171.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.061] lstrlenW (lpString=".1cd") returned 4
	[0171.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0171.062] lstrlenW (lpString=".jpg") returned 4
	[0171.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.062] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.062] lstrlenW (lpString="J0107492.WMF") returned 12
	[0171.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.064] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=6860) returned 1
	[0171.064] CloseHandle (hObject=0x53c) returned 1
	[0171.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0x220
	[0171.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.064] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.065] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0171.065] GetLastError () returned 0x0
	[0171.065] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1acc, lpOverlapped=0x0) returned 1
	[0171.067] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1ad0, lpOverlapped=0x0) returned 1
	[0171.068] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.068] WriteFile (in: hFile=0x370, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.068] SetEndOfFile (hFile=0x370) returned 1
	[0171.069] CloseHandle (hObject=0x370) returned 1
	[0171.069] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.069] SetEndOfFile (hFile=0x53c) returned 1
	[0171.203] CloseHandle (hObject=0x53c) returned 1
	[0171.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 1
	[0171.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.204] lstrlenW (lpString=".doc") returned 4
	[0171.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.204] lstrlenW (lpString=".docx") returned 5
	[0171.204] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0171.204] lstrlenW (lpString=".pdf") returned 4
	[0171.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.204] lstrlenW (lpString=".xls") returned 4
	[0171.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.204] lstrlenW (lpString=".xlsx") returned 5
	[0171.204] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0171.204] lstrlenW (lpString=".ppt") returned 4
	[0171.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.204] lstrlenW (lpString=".zip") returned 4
	[0171.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.204] lstrlenW (lpString=".rar") returned 4
	[0171.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.205] lstrlenW (lpString=".bz2") returned 4
	[0171.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.205] lstrlenW (lpString=".7z") returned 3
	[0171.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.205] lstrlenW (lpString=".dbf") returned 4
	[0171.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.205] lstrlenW (lpString=".1cd") returned 4
	[0171.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.205] lstrlenW (lpString=".jpg") returned 4
	[0171.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.205] lstrlenW (lpString=".doc") returned 4
	[0171.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.205] lstrlenW (lpString=".docx") returned 5
	[0171.205] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0171.205] lstrlenW (lpString=".pdf") returned 4
	[0171.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.205] lstrlenW (lpString=".xls") returned 4
	[0171.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.205] lstrlenW (lpString=".xlsx") returned 5
	[0171.205] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0171.205] lstrlenW (lpString=".ppt") returned 4
	[0171.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.206] lstrlenW (lpString=".zip") returned 4
	[0171.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.206] lstrlenW (lpString=".rar") returned 4
	[0171.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.206] lstrlenW (lpString=".bz2") returned 4
	[0171.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.206] lstrlenW (lpString=".7z") returned 3
	[0171.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.206] lstrlenW (lpString=".dbf") returned 4
	[0171.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.206] lstrlenW (lpString=".1cd") returned 4
	[0171.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0171.206] lstrlenW (lpString=".jpg") returned 4
	[0171.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.206] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.206] lstrlenW (lpString="J0107494.WMF") returned 12
	[0171.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.207] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=6424) returned 1
	[0171.207] CloseHandle (hObject=0x53c) returned 1
	[0171.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 0x220
	[0171.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.208] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.208] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.209] GetLastError () returned 0x0
	[0171.209] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1918, lpOverlapped=0x0) returned 1
	[0171.210] WriteFile (in: hFile=0x4e4, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1920, lpOverlapped=0x0) returned 1
	[0171.211] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.211] WriteFile (in: hFile=0x4e4, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.212] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.212] CloseHandle (hObject=0x4e4) returned 1
	[0171.212] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.212] SetEndOfFile (hFile=0x53c) returned 1
	[0171.215] CloseHandle (hObject=0x53c) returned 1
	[0171.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 1
	[0171.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.216] lstrlenW (lpString=".doc") returned 4
	[0171.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.216] lstrlenW (lpString=".docx") returned 5
	[0171.216] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0171.216] lstrlenW (lpString=".pdf") returned 4
	[0171.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.216] lstrlenW (lpString=".xls") returned 4
	[0171.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.217] lstrlenW (lpString=".xlsx") returned 5
	[0171.217] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0171.217] lstrlenW (lpString=".ppt") returned 4
	[0171.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.217] lstrlenW (lpString=".zip") returned 4
	[0171.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.217] lstrlenW (lpString=".rar") returned 4
	[0171.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.217] lstrlenW (lpString=".bz2") returned 4
	[0171.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.217] lstrlenW (lpString=".7z") returned 3
	[0171.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.217] lstrlenW (lpString=".dbf") returned 4
	[0171.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.217] lstrlenW (lpString=".1cd") returned 4
	[0171.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.217] lstrlenW (lpString=".jpg") returned 4
	[0171.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.217] lstrlenW (lpString=".doc") returned 4
	[0171.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.218] lstrlenW (lpString=".docx") returned 5
	[0171.218] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0171.218] lstrlenW (lpString=".pdf") returned 4
	[0171.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.218] lstrlenW (lpString=".xls") returned 4
	[0171.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.218] lstrlenW (lpString=".xlsx") returned 5
	[0171.218] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0171.218] lstrlenW (lpString=".ppt") returned 4
	[0171.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.218] lstrlenW (lpString=".zip") returned 4
	[0171.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.218] lstrlenW (lpString=".rar") returned 4
	[0171.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.218] lstrlenW (lpString=".bz2") returned 4
	[0171.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.218] lstrlenW (lpString=".7z") returned 3
	[0171.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.218] lstrlenW (lpString=".dbf") returned 4
	[0171.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.218] lstrlenW (lpString=".1cd") returned 4
	[0171.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0171.218] lstrlenW (lpString=".jpg") returned 4
	[0171.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.219] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.219] lstrlenW (lpString="J0107496.WMF") returned 12
	[0171.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.220] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=8864) returned 1
	[0171.220] CloseHandle (hObject=0x53c) returned 1
	[0171.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0x220
	[0171.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.221] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.221] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.221] GetLastError () returned 0x0
	[0171.221] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x22a0, lpOverlapped=0x0) returned 1
	[0171.223] WriteFile (in: hFile=0x4e4, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x22b0, lpOverlapped=0x0) returned 1
	[0171.501] ReadFile (in: hFile=0x53c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.501] WriteFile (in: hFile=0x4e4, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.501] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.502] CloseHandle (hObject=0x4e4) returned 1
	[0171.502] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.502] SetEndOfFile (hFile=0x53c) returned 1
	[0171.505] CloseHandle (hObject=0x53c) returned 1
	[0171.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 1
	[0172.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.089] lstrlenW (lpString=".doc") returned 4
	[0172.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.089] lstrlenW (lpString=".docx") returned 5
	[0172.089] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0172.089] lstrlenW (lpString=".pdf") returned 4
	[0172.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.089] lstrlenW (lpString=".xls") returned 4
	[0172.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.089] lstrlenW (lpString=".xlsx") returned 5
	[0172.089] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0172.089] lstrlenW (lpString=".ppt") returned 4
	[0172.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.089] lstrlenW (lpString=".zip") returned 4
	[0172.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.089] lstrlenW (lpString=".rar") returned 4
	[0172.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.090] lstrlenW (lpString=".bz2") returned 4
	[0172.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.090] lstrlenW (lpString=".7z") returned 3
	[0172.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.090] lstrlenW (lpString=".dbf") returned 4
	[0172.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.090] lstrlenW (lpString=".1cd") returned 4
	[0172.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.090] lstrlenW (lpString=".jpg") returned 4
	[0172.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.090] lstrlenW (lpString=".doc") returned 4
	[0172.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.090] lstrlenW (lpString=".docx") returned 5
	[0172.091] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0172.091] lstrlenW (lpString=".pdf") returned 4
	[0172.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.091] lstrlenW (lpString=".xls") returned 4
	[0172.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.091] lstrlenW (lpString=".xlsx") returned 5
	[0172.091] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0172.091] lstrlenW (lpString=".ppt") returned 4
	[0172.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.091] lstrlenW (lpString=".zip") returned 4
	[0172.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.091] lstrlenW (lpString=".rar") returned 4
	[0172.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.091] lstrlenW (lpString=".bz2") returned 4
	[0172.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.091] lstrlenW (lpString=".7z") returned 3
	[0172.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.092] lstrlenW (lpString=".dbf") returned 4
	[0172.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.092] lstrlenW (lpString=".1cd") returned 4
	[0172.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0172.092] lstrlenW (lpString=".jpg") returned 4
	[0172.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.092] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0172.092] lstrlenW (lpString="J0107658.WMF") returned 12
	[0172.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0172.230] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=7072) returned 1
	[0172.230] CloseHandle (hObject=0x370) returned 1
	[0172.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0x220
	[0172.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0172.448] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.448] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0172.857] GetLastError () returned 0x0
	[0172.866] ReadFile (in: hFile=0x530, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1ba0, lpOverlapped=0x0) returned 1
	[0172.876] WriteFile (in: hFile=0x53c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1bb0, lpOverlapped=0x0) returned 1
	[0172.877] ReadFile (in: hFile=0x530, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.877] WriteFile (in: hFile=0x53c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.877] SetEndOfFile (hFile=0x53c) returned 1
	[0172.877] CloseHandle (hObject=0x53c) returned 1
	[0172.877] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.877] SetEndOfFile (hFile=0x530) returned 1
	[0172.879] CloseHandle (hObject=0x530) returned 1
	[0172.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0172.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 1
	[0172.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.880] lstrlenW (lpString=".doc") returned 4
	[0172.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.881] lstrlenW (lpString=".docx") returned 5
	[0172.881] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0172.881] lstrlenW (lpString=".pdf") returned 4
	[0172.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.881] lstrlenW (lpString=".xls") returned 4
	[0172.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.881] lstrlenW (lpString=".xlsx") returned 5
	[0172.881] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0172.881] lstrlenW (lpString=".ppt") returned 4
	[0172.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.881] lstrlenW (lpString=".zip") returned 4
	[0172.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.881] lstrlenW (lpString=".rar") returned 4
	[0172.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.881] lstrlenW (lpString=".bz2") returned 4
	[0172.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.881] lstrlenW (lpString=".7z") returned 3
	[0172.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.881] lstrlenW (lpString=".dbf") returned 4
	[0172.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.881] lstrlenW (lpString=".1cd") returned 4
	[0172.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.881] lstrlenW (lpString=".jpg") returned 4
	[0172.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.882] lstrlenW (lpString=".doc") returned 4
	[0172.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.882] lstrlenW (lpString=".docx") returned 5
	[0172.882] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0172.882] lstrlenW (lpString=".pdf") returned 4
	[0172.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.882] lstrlenW (lpString=".xls") returned 4
	[0172.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.882] lstrlenW (lpString=".xlsx") returned 5
	[0172.882] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0172.882] lstrlenW (lpString=".ppt") returned 4
	[0172.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.882] lstrlenW (lpString=".zip") returned 4
	[0172.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.882] lstrlenW (lpString=".rar") returned 4
	[0172.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.882] lstrlenW (lpString=".bz2") returned 4
	[0172.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.882] lstrlenW (lpString=".7z") returned 3
	[0172.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.882] lstrlenW (lpString=".dbf") returned 4
	[0172.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.882] lstrlenW (lpString=".1cd") returned 4
	[0172.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0172.882] lstrlenW (lpString=".jpg") returned 4
	[0172.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.883] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0172.883] lstrlenW (lpString="J0107734.WMF") returned 12
	[0172.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0172.884] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=3140) returned 1
	[0172.884] CloseHandle (hObject=0x530) returned 1
	[0172.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 0x220
	[0172.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0172.884] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.884] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0172.885] GetLastError () returned 0x0
	[0172.885] ReadFile (in: hFile=0x530, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xc44, lpOverlapped=0x0) returned 1
	[0172.886] WriteFile (in: hFile=0x53c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xc50, lpOverlapped=0x0) returned 1
	[0172.887] ReadFile (in: hFile=0x530, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.887] WriteFile (in: hFile=0x53c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.888] SetEndOfFile (hFile=0x53c) returned 1
	[0172.888] CloseHandle (hObject=0x53c) returned 1
	[0172.888] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.888] SetEndOfFile (hFile=0x530) returned 1
	[0172.891] CloseHandle (hObject=0x530) returned 1
	[0172.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0172.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 1
	[0172.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.892] lstrlenW (lpString=".doc") returned 4
	[0172.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.892] lstrlenW (lpString=".docx") returned 5
	[0172.892] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0172.892] lstrlenW (lpString=".pdf") returned 4
	[0172.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.892] lstrlenW (lpString=".xls") returned 4
	[0172.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.892] lstrlenW (lpString=".xlsx") returned 5
	[0172.892] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0172.892] lstrlenW (lpString=".ppt") returned 4
	[0172.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.892] lstrlenW (lpString=".zip") returned 4
	[0172.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.893] lstrlenW (lpString=".rar") returned 4
	[0172.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.893] lstrlenW (lpString=".bz2") returned 4
	[0172.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.893] lstrlenW (lpString=".7z") returned 3
	[0172.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.893] lstrlenW (lpString=".dbf") returned 4
	[0172.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.893] lstrlenW (lpString=".1cd") returned 4
	[0172.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.893] lstrlenW (lpString=".jpg") returned 4
	[0172.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.893] lstrlenW (lpString=".doc") returned 4
	[0172.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.893] lstrlenW (lpString=".docx") returned 5
	[0172.893] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0172.893] lstrlenW (lpString=".pdf") returned 4
	[0172.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.893] lstrlenW (lpString=".xls") returned 4
	[0172.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.893] lstrlenW (lpString=".xlsx") returned 5
	[0172.893] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0172.893] lstrlenW (lpString=".ppt") returned 4
	[0172.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.893] lstrlenW (lpString=".zip") returned 4
	[0172.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.894] lstrlenW (lpString=".rar") returned 4
	[0172.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.894] lstrlenW (lpString=".bz2") returned 4
	[0172.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.894] lstrlenW (lpString=".7z") returned 3
	[0172.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.894] lstrlenW (lpString=".dbf") returned 4
	[0172.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.894] lstrlenW (lpString=".1cd") returned 4
	[0172.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0172.894] lstrlenW (lpString=".jpg") returned 4
	[0172.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.894] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0172.894] lstrlenW (lpString="J0107742.WMF") returned 12
	[0172.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0172.895] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=3644) returned 1
	[0172.895] CloseHandle (hObject=0x530) returned 1
	[0172.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0x220
	[0172.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0172.896] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.896] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0172.897] GetLastError () returned 0x0
	[0172.897] ReadFile (in: hFile=0x530, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xe3c, lpOverlapped=0x0) returned 1
	[0172.898] WriteFile (in: hFile=0x53c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xe40, lpOverlapped=0x0) returned 1
	[0172.899] ReadFile (in: hFile=0x530, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.899] WriteFile (in: hFile=0x53c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.899] SetEndOfFile (hFile=0x53c) returned 1
	[0172.899] CloseHandle (hObject=0x53c) returned 1
	[0172.899] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.899] SetEndOfFile (hFile=0x530) returned 1
	[0172.902] CloseHandle (hObject=0x530) returned 1
	[0172.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0172.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 1
	[0172.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.903] lstrlenW (lpString=".doc") returned 4
	[0172.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.903] lstrlenW (lpString=".docx") returned 5
	[0172.903] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0172.903] lstrlenW (lpString=".pdf") returned 4
	[0172.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.903] lstrlenW (lpString=".xls") returned 4
	[0172.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.903] lstrlenW (lpString=".xlsx") returned 5
	[0172.903] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0172.903] lstrlenW (lpString=".ppt") returned 4
	[0172.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.903] lstrlenW (lpString=".zip") returned 4
	[0172.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.903] lstrlenW (lpString=".rar") returned 4
	[0172.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.903] lstrlenW (lpString=".bz2") returned 4
	[0172.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.903] lstrlenW (lpString=".7z") returned 3
	[0172.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.903] lstrlenW (lpString=".dbf") returned 4
	[0172.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.903] lstrlenW (lpString=".1cd") returned 4
	[0172.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.903] lstrlenW (lpString=".jpg") returned 4
	[0172.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.904] lstrlenW (lpString=".doc") returned 4
	[0172.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.904] lstrlenW (lpString=".docx") returned 5
	[0172.904] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0172.904] lstrlenW (lpString=".pdf") returned 4
	[0172.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.904] lstrlenW (lpString=".xls") returned 4
	[0172.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.904] lstrlenW (lpString=".xlsx") returned 5
	[0172.904] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0172.904] lstrlenW (lpString=".ppt") returned 4
	[0172.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.904] lstrlenW (lpString=".zip") returned 4
	[0172.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.904] lstrlenW (lpString=".rar") returned 4
	[0172.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.904] lstrlenW (lpString=".bz2") returned 4
	[0172.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.904] lstrlenW (lpString=".7z") returned 3
	[0172.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.904] lstrlenW (lpString=".dbf") returned 4
	[0172.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.905] lstrlenW (lpString=".1cd") returned 4
	[0172.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0172.905] lstrlenW (lpString=".jpg") returned 4
	[0172.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.905] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0172.905] lstrlenW (lpString="J0107744.WMF") returned 12
	[0172.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0172.906] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=5004) returned 1
	[0172.906] CloseHandle (hObject=0x530) returned 1
	[0172.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0x220
	[0172.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0172.907] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.907] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0172.907] GetLastError () returned 0x0
	[0172.907] ReadFile (in: hFile=0x530, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x138c, lpOverlapped=0x0) returned 1
	[0173.039] WriteFile (in: hFile=0x53c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1390, lpOverlapped=0x0) returned 1
	[0173.040] ReadFile (in: hFile=0x530, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.040] WriteFile (in: hFile=0x53c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.040] SetEndOfFile (hFile=0x53c) returned 1
	[0173.067] CloseHandle (hObject=0x53c) returned 1
	[0173.067] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.067] SetEndOfFile (hFile=0x530) returned 1
	[0173.299] CloseHandle (hObject=0x530) returned 1
	[0173.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 1
	[0173.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.300] lstrlenW (lpString=".doc") returned 4
	[0173.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.300] lstrlenW (lpString=".docx") returned 5
	[0173.300] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0173.300] lstrlenW (lpString=".pdf") returned 4
	[0173.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.300] lstrlenW (lpString=".xls") returned 4
	[0173.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.300] lstrlenW (lpString=".xlsx") returned 5
	[0173.301] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0173.301] lstrlenW (lpString=".ppt") returned 4
	[0173.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.301] lstrlenW (lpString=".zip") returned 4
	[0173.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.301] lstrlenW (lpString=".rar") returned 4
	[0173.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.301] lstrlenW (lpString=".bz2") returned 4
	[0173.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.301] lstrlenW (lpString=".7z") returned 3
	[0173.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.301] lstrlenW (lpString=".dbf") returned 4
	[0173.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.301] lstrlenW (lpString=".1cd") returned 4
	[0173.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.301] lstrlenW (lpString=".jpg") returned 4
	[0173.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.301] lstrlenW (lpString=".doc") returned 4
	[0173.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.301] lstrlenW (lpString=".docx") returned 5
	[0173.301] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0173.301] lstrlenW (lpString=".pdf") returned 4
	[0173.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.301] lstrlenW (lpString=".xls") returned 4
	[0173.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.302] lstrlenW (lpString=".xlsx") returned 5
	[0173.302] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0173.302] lstrlenW (lpString=".ppt") returned 4
	[0173.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.302] lstrlenW (lpString=".zip") returned 4
	[0173.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.302] lstrlenW (lpString=".rar") returned 4
	[0173.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.302] lstrlenW (lpString=".bz2") returned 4
	[0173.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.302] lstrlenW (lpString=".7z") returned 3
	[0173.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.302] lstrlenW (lpString=".dbf") returned 4
	[0173.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.302] lstrlenW (lpString=".1cd") returned 4
	[0173.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0173.302] lstrlenW (lpString=".jpg") returned 4
	[0173.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.302] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0173.302] lstrlenW (lpString="J0136865.WMF") returned 12
	[0173.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0173.883] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=16710) returned 1
	[0173.883] CloseHandle (hObject=0x530) returned 1
	[0173.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0x220
	[0173.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0173.884] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.885] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0173.886] GetLastError () returned 0x0
	[0173.886] ReadFile (in: hFile=0x530, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4146, lpOverlapped=0x0) returned 1
	[0173.888] WriteFile (in: hFile=0x4f0, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4150, lpOverlapped=0x0) returned 1
	[0173.889] ReadFile (in: hFile=0x530, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.889] WriteFile (in: hFile=0x4f0, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.889] SetEndOfFile (hFile=0x4f0) returned 1
	[0173.889] CloseHandle (hObject=0x4f0) returned 1
	[0173.889] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.889] SetEndOfFile (hFile=0x530) returned 1
	[0173.950] CloseHandle (hObject=0x530) returned 1
	[0173.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 1
	[0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.068] lstrlenW (lpString=".doc") returned 4
	[0174.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.068] lstrlenW (lpString=".docx") returned 5
	[0174.068] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0174.068] lstrlenW (lpString=".pdf") returned 4
	[0174.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.068] lstrlenW (lpString=".xls") returned 4
	[0174.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.068] lstrlenW (lpString=".xlsx") returned 5
	[0174.068] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0174.068] lstrlenW (lpString=".ppt") returned 4
	[0174.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.068] lstrlenW (lpString=".zip") returned 4
	[0174.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.068] lstrlenW (lpString=".rar") returned 4
	[0174.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.068] lstrlenW (lpString=".bz2") returned 4
	[0174.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.068] lstrlenW (lpString=".7z") returned 3
	[0174.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.068] lstrlenW (lpString=".dbf") returned 4
	[0174.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.069] lstrlenW (lpString=".1cd") returned 4
	[0174.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.069] lstrlenW (lpString=".jpg") returned 4
	[0174.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.069] lstrlenW (lpString=".doc") returned 4
	[0174.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.069] lstrlenW (lpString=".docx") returned 5
	[0174.069] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0174.069] lstrlenW (lpString=".pdf") returned 4
	[0174.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.069] lstrlenW (lpString=".xls") returned 4
	[0174.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.069] lstrlenW (lpString=".xlsx") returned 5
	[0174.069] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0174.069] lstrlenW (lpString=".ppt") returned 4
	[0174.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.069] lstrlenW (lpString=".zip") returned 4
	[0174.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.069] lstrlenW (lpString=".rar") returned 4
	[0174.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.069] lstrlenW (lpString=".bz2") returned 4
	[0174.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.069] lstrlenW (lpString=".7z") returned 3
	[0174.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.070] lstrlenW (lpString=".dbf") returned 4
	[0174.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.070] lstrlenW (lpString=".1cd") returned 4
	[0174.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0174.070] lstrlenW (lpString=".jpg") returned 4
	[0174.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.070] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0174.070] lstrlenW (lpString="J0145810.JPG") returned 12
	[0174.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0174.071] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=36792) returned 1
	[0174.071] CloseHandle (hObject=0x4b8) returned 1
	[0174.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 0x220
	[0174.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0174.072] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.072] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0174.073] GetLastError () returned 0x0
	[0174.073] ReadFile (in: hFile=0x4b8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x8fb8, lpOverlapped=0x0) returned 1
	[0174.075] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x8fc0, lpOverlapped=0x0) returned 1
	[0174.077] ReadFile (in: hFile=0x4b8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.077] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.077] SetEndOfFile (hFile=0x444) returned 1
	[0174.077] CloseHandle (hObject=0x444) returned 1
	[0174.077] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.077] SetEndOfFile (hFile=0x4b8) returned 1
	[0174.080] CloseHandle (hObject=0x4b8) returned 1
	[0174.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 1
	[0174.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.081] lstrlenW (lpString=".doc") returned 4
	[0174.081] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.081] lstrlenW (lpString=".docx") returned 5
	[0174.081] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0174.081] lstrlenW (lpString=".pdf") returned 4
	[0174.081] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.081] lstrlenW (lpString=".xls") returned 4
	[0174.081] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.081] lstrlenW (lpString=".xlsx") returned 5
	[0174.081] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0174.082] lstrlenW (lpString=".ppt") returned 4
	[0174.082] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.082] lstrlenW (lpString=".zip") returned 4
	[0174.082] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.082] lstrlenW (lpString=".rar") returned 4
	[0174.082] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.082] lstrlenW (lpString=".bz2") returned 4
	[0174.082] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.082] lstrlenW (lpString=".7z") returned 3
	[0174.082] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.082] lstrlenW (lpString=".dbf") returned 4
	[0174.082] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.082] lstrlenW (lpString=".1cd") returned 4
	[0174.082] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.082] lstrlenW (lpString=".jpg") returned 4
	[0174.082] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.082] lstrlenW (lpString=".doc") returned 4
	[0174.082] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.082] lstrlenW (lpString=".docx") returned 5
	[0174.082] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0174.082] lstrlenW (lpString=".pdf") returned 4
	[0174.082] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.082] lstrlenW (lpString=".xls") returned 4
	[0174.082] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.082] lstrlenW (lpString=".xlsx") returned 5
	[0174.083] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0174.083] lstrlenW (lpString=".ppt") returned 4
	[0174.083] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.083] lstrlenW (lpString=".zip") returned 4
	[0174.083] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.083] lstrlenW (lpString=".rar") returned 4
	[0174.083] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.083] lstrlenW (lpString=".bz2") returned 4
	[0174.083] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.083] lstrlenW (lpString=".7z") returned 3
	[0174.083] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.083] lstrlenW (lpString=".dbf") returned 4
	[0174.083] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.083] lstrlenW (lpString=".1cd") returned 4
	[0174.083] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.083] lstrlenW (lpString=".jpg") returned 4
	[0174.083] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.083] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0174.083] lstrlenW (lpString="J0145879.JPG") returned 12
	[0174.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0174.085] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=35419) returned 1
	[0174.085] CloseHandle (hObject=0x4b8) returned 1
	[0174.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0x220
	[0174.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0174.085] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.085] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0174.086] GetLastError () returned 0x0
	[0174.086] ReadFile (in: hFile=0x4b8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x8a5b, lpOverlapped=0x0) returned 1
	[0174.088] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x8a60, lpOverlapped=0x0) returned 1
	[0174.092] ReadFile (in: hFile=0x4b8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.092] WriteFile (in: hFile=0x444, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.093] SetEndOfFile (hFile=0x444) returned 1
	[0174.093] CloseHandle (hObject=0x444) returned 1
	[0174.093] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.093] SetEndOfFile (hFile=0x4b8) returned 1
	[0174.096] CloseHandle (hObject=0x4b8) returned 1
	[0174.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 1
	[0174.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.097] lstrlenW (lpString=".doc") returned 4
	[0174.097] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.097] lstrlenW (lpString=".docx") returned 5
	[0174.097] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0174.097] lstrlenW (lpString=".pdf") returned 4
	[0174.097] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.097] lstrlenW (lpString=".xls") returned 4
	[0174.097] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.097] lstrlenW (lpString=".xlsx") returned 5
	[0174.097] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0174.097] lstrlenW (lpString=".ppt") returned 4
	[0174.097] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.097] lstrlenW (lpString=".zip") returned 4
	[0174.097] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.097] lstrlenW (lpString=".rar") returned 4
	[0174.097] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.097] lstrlenW (lpString=".bz2") returned 4
	[0174.097] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.097] lstrlenW (lpString=".7z") returned 3
	[0174.098] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.098] lstrlenW (lpString=".dbf") returned 4
	[0174.098] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.098] lstrlenW (lpString=".1cd") returned 4
	[0174.098] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.098] lstrlenW (lpString=".jpg") returned 4
	[0174.098] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.098] lstrlenW (lpString=".doc") returned 4
	[0174.098] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.098] lstrlenW (lpString=".docx") returned 5
	[0174.098] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0174.098] lstrlenW (lpString=".pdf") returned 4
	[0174.098] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.098] lstrlenW (lpString=".xls") returned 4
	[0174.098] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.098] lstrlenW (lpString=".xlsx") returned 5
	[0174.098] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0174.098] lstrlenW (lpString=".ppt") returned 4
	[0174.098] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.098] lstrlenW (lpString=".zip") returned 4
	[0174.098] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.098] lstrlenW (lpString=".rar") returned 4
	[0174.098] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.098] lstrlenW (lpString=".bz2") returned 4
	[0174.099] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.099] lstrlenW (lpString=".7z") returned 3
	[0174.099] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.099] lstrlenW (lpString=".dbf") returned 4
	[0174.099] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.099] lstrlenW (lpString=".1cd") returned 4
	[0174.099] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0174.099] lstrlenW (lpString=".jpg") returned 4
	[0174.099] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.099] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0174.099] lstrlenW (lpString="J0145895.JPG") returned 12
	[0174.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0174.373] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=33958) returned 1
	[0174.373] CloseHandle (hObject=0x558) returned 1
	[0174.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0x220
	[0174.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0174.375] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.375] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0174.376] GetLastError () returned 0x0
	[0174.376] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x84a6, lpOverlapped=0x0) returned 1
	[0174.378] WriteFile (in: hFile=0x52c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x84b0, lpOverlapped=0x0) returned 1
	[0174.379] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.379] WriteFile (in: hFile=0x52c, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.380] SetEndOfFile (hFile=0x52c) returned 1
	[0174.380] CloseHandle (hObject=0x52c) returned 1
	[0174.380] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.380] SetEndOfFile (hFile=0x558) returned 1
	[0174.383] CloseHandle (hObject=0x558) returned 1
	[0174.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 1
	[0174.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.384] lstrlenW (lpString=".doc") returned 4
	[0174.384] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.384] lstrlenW (lpString=".docx") returned 5
	[0174.384] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0174.384] lstrlenW (lpString=".pdf") returned 4
	[0174.384] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.384] lstrlenW (lpString=".xls") returned 4
	[0174.384] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.384] lstrlenW (lpString=".xlsx") returned 5
	[0174.384] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0174.384] lstrlenW (lpString=".ppt") returned 4
	[0174.384] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.384] lstrlenW (lpString=".zip") returned 4
	[0174.384] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.384] lstrlenW (lpString=".rar") returned 4
	[0174.384] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.384] lstrlenW (lpString=".bz2") returned 4
	[0174.384] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.384] lstrlenW (lpString=".7z") returned 3
	[0174.384] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.384] lstrlenW (lpString=".dbf") returned 4
	[0174.384] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.385] lstrlenW (lpString=".1cd") returned 4
	[0174.385] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.385] lstrlenW (lpString=".jpg") returned 4
	[0174.385] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.385] lstrlenW (lpString=".doc") returned 4
	[0174.385] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.385] lstrlenW (lpString=".docx") returned 5
	[0174.385] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0174.385] lstrlenW (lpString=".pdf") returned 4
	[0174.385] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.385] lstrlenW (lpString=".xls") returned 4
	[0174.385] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.385] lstrlenW (lpString=".xlsx") returned 5
	[0174.385] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0174.385] lstrlenW (lpString=".ppt") returned 4
	[0174.385] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.385] lstrlenW (lpString=".zip") returned 4
	[0174.385] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.385] lstrlenW (lpString=".rar") returned 4
	[0174.385] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.385] lstrlenW (lpString=".bz2") returned 4
	[0174.385] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.385] lstrlenW (lpString=".7z") returned 3
	[0174.385] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.385] lstrlenW (lpString=".dbf") returned 4
	[0174.386] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.386] lstrlenW (lpString=".1cd") returned 4
	[0174.386] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0174.386] lstrlenW (lpString=".jpg") returned 4
	[0174.386] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.386] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0174.386] lstrlenW (lpString="J0148757.JPG") returned 12
	[0174.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0174.388] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=67540) returned 1
	[0174.388] CloseHandle (hObject=0x52c) returned 1
	[0174.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0x220
	[0174.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0174.389] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.389] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0174.392] GetLastError () returned 0x0
	[0174.392] ReadFile (in: hFile=0x52c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x107d4, lpOverlapped=0x0) returned 1
	[0174.398] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x107e0, lpOverlapped=0x0) returned 1
	[0174.399] ReadFile (in: hFile=0x52c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.399] WriteFile (in: hFile=0x544, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.399] SetEndOfFile (hFile=0x544) returned 1
	[0174.400] CloseHandle (hObject=0x544) returned 1
	[0174.403] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.403] SetEndOfFile (hFile=0x52c) returned 1
	[0174.408] CloseHandle (hObject=0x52c) returned 1
	[0174.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 1
	[0174.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.419] lstrlenW (lpString=".doc") returned 4
	[0174.419] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.419] lstrlenW (lpString=".docx") returned 5
	[0174.419] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0174.419] lstrlenW (lpString=".pdf") returned 4
	[0174.419] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.419] lstrlenW (lpString=".xls") returned 4
	[0174.420] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.420] lstrlenW (lpString=".xlsx") returned 5
	[0174.420] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0174.420] lstrlenW (lpString=".ppt") returned 4
	[0174.420] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.420] lstrlenW (lpString=".zip") returned 4
	[0174.420] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.420] lstrlenW (lpString=".rar") returned 4
	[0174.420] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.420] lstrlenW (lpString=".bz2") returned 4
	[0174.420] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.420] lstrlenW (lpString=".7z") returned 3
	[0174.420] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.420] lstrlenW (lpString=".dbf") returned 4
	[0174.420] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.420] lstrlenW (lpString=".1cd") returned 4
	[0174.420] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.420] lstrlenW (lpString=".jpg") returned 4
	[0174.420] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.420] lstrlenW (lpString=".doc") returned 4
	[0174.420] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.420] lstrlenW (lpString=".docx") returned 5
	[0174.420] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0174.421] lstrlenW (lpString=".pdf") returned 4
	[0174.421] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.421] lstrlenW (lpString=".xls") returned 4
	[0174.421] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.421] lstrlenW (lpString=".xlsx") returned 5
	[0174.421] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0174.421] lstrlenW (lpString=".ppt") returned 4
	[0174.421] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.421] lstrlenW (lpString=".zip") returned 4
	[0174.421] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.421] lstrlenW (lpString=".rar") returned 4
	[0174.421] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.570] lstrlenW (lpString=".bz2") returned 4
	[0174.570] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.570] lstrlenW (lpString=".7z") returned 3
	[0174.570] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.570] lstrlenW (lpString=".dbf") returned 4
	[0174.570] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.570] lstrlenW (lpString=".1cd") returned 4
	[0174.570] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0174.570] lstrlenW (lpString=".jpg") returned 4
	[0174.570] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.570] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0174.571] lstrlenW (lpString="J0151045.WMF") returned 12
	[0174.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.658] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=15464) returned 1
	[0174.658] CloseHandle (hObject=0x514) returned 1
	[0174.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0x220
	[0174.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0175.061] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.061] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.828] GetLastError () returned 0x0
	[0175.828] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x3c68, lpOverlapped=0x0) returned 1
	[0175.830] WriteFile (in: hFile=0x324, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x3c70, lpOverlapped=0x0) returned 1
	[0175.831] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.831] WriteFile (in: hFile=0x324, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.831] SetEndOfFile (hFile=0x324) returned 1
	[0175.831] CloseHandle (hObject=0x324) returned 1
	[0175.831] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.831] SetEndOfFile (hFile=0x328) returned 1
	[0175.834] CloseHandle (hObject=0x328) returned 1
	[0175.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 1
	[0175.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.836] lstrlenW (lpString=".doc") returned 4
	[0175.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.836] lstrlenW (lpString=".docx") returned 5
	[0175.836] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0175.836] lstrlenW (lpString=".pdf") returned 4
	[0175.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.836] lstrlenW (lpString=".xls") returned 4
	[0175.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.836] lstrlenW (lpString=".xlsx") returned 5
	[0175.836] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0175.836] lstrlenW (lpString=".ppt") returned 4
	[0175.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.836] lstrlenW (lpString=".zip") returned 4
	[0175.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.836] lstrlenW (lpString=".rar") returned 4
	[0175.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.836] lstrlenW (lpString=".bz2") returned 4
	[0175.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.836] lstrlenW (lpString=".7z") returned 3
	[0175.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.836] lstrlenW (lpString=".dbf") returned 4
	[0175.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.837] lstrlenW (lpString=".1cd") returned 4
	[0175.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.837] lstrlenW (lpString=".jpg") returned 4
	[0175.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.837] lstrlenW (lpString=".doc") returned 4
	[0175.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.837] lstrlenW (lpString=".docx") returned 5
	[0175.837] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0175.837] lstrlenW (lpString=".pdf") returned 4
	[0175.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.837] lstrlenW (lpString=".xls") returned 4
	[0175.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.837] lstrlenW (lpString=".xlsx") returned 5
	[0175.837] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0175.837] lstrlenW (lpString=".ppt") returned 4
	[0175.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.837] lstrlenW (lpString=".zip") returned 4
	[0175.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.837] lstrlenW (lpString=".rar") returned 4
	[0175.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.837] lstrlenW (lpString=".bz2") returned 4
	[0175.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.837] lstrlenW (lpString=".7z") returned 3
	[0175.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.837] lstrlenW (lpString=".dbf") returned 4
	[0175.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.838] lstrlenW (lpString=".1cd") returned 4
	[0175.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0175.838] lstrlenW (lpString=".jpg") returned 4
	[0175.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.838] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0175.838] lstrlenW (lpString="J0151581.WMF") returned 12
	[0175.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0175.839] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=10752) returned 1
	[0175.839] CloseHandle (hObject=0x328) returned 1
	[0175.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 0x220
	[0175.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0175.839] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.839] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.840] GetLastError () returned 0x0
	[0175.840] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2a00, lpOverlapped=0x0) returned 1
	[0175.842] WriteFile (in: hFile=0x324, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2a10, lpOverlapped=0x0) returned 1
	[0175.843] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.843] WriteFile (in: hFile=0x324, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.843] SetEndOfFile (hFile=0x324) returned 1
	[0175.844] CloseHandle (hObject=0x324) returned 1
	[0175.844] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.844] SetEndOfFile (hFile=0x328) returned 1
	[0175.846] CloseHandle (hObject=0x328) returned 1
	[0175.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 1
	[0175.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.847] lstrlenW (lpString=".doc") returned 4
	[0175.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.847] lstrlenW (lpString=".docx") returned 5
	[0175.847] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0175.847] lstrlenW (lpString=".pdf") returned 4
	[0175.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.847] lstrlenW (lpString=".xls") returned 4
	[0175.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.847] lstrlenW (lpString=".xlsx") returned 5
	[0175.847] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0175.848] lstrlenW (lpString=".ppt") returned 4
	[0175.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.848] lstrlenW (lpString=".zip") returned 4
	[0175.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.848] lstrlenW (lpString=".rar") returned 4
	[0175.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.848] lstrlenW (lpString=".bz2") returned 4
	[0175.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.848] lstrlenW (lpString=".7z") returned 3
	[0175.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.848] lstrlenW (lpString=".dbf") returned 4
	[0175.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.848] lstrlenW (lpString=".1cd") returned 4
	[0175.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.848] lstrlenW (lpString=".jpg") returned 4
	[0175.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.848] lstrlenW (lpString=".doc") returned 4
	[0175.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.848] lstrlenW (lpString=".docx") returned 5
	[0175.848] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0175.848] lstrlenW (lpString=".pdf") returned 4
	[0175.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.848] lstrlenW (lpString=".xls") returned 4
	[0175.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.849] lstrlenW (lpString=".xlsx") returned 5
	[0175.849] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0175.849] lstrlenW (lpString=".ppt") returned 4
	[0175.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.849] lstrlenW (lpString=".zip") returned 4
	[0175.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.849] lstrlenW (lpString=".rar") returned 4
	[0175.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.849] lstrlenW (lpString=".bz2") returned 4
	[0175.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.849] lstrlenW (lpString=".7z") returned 3
	[0175.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.849] lstrlenW (lpString=".dbf") returned 4
	[0175.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.849] lstrlenW (lpString=".1cd") returned 4
	[0175.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0175.849] lstrlenW (lpString=".jpg") returned 4
	[0175.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.849] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0175.849] lstrlenW (lpString="J0152414.WMF") returned 12
	[0175.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0175.850] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=24844) returned 1
	[0175.850] CloseHandle (hObject=0x328) returned 1
	[0175.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0x220
	[0175.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0175.851] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.851] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.852] GetLastError () returned 0x0
	[0175.852] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x610c, lpOverlapped=0x0) returned 1
	[0175.854] WriteFile (in: hFile=0x324, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x6110, lpOverlapped=0x0) returned 1
	[0175.855] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.855] WriteFile (in: hFile=0x324, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.855] SetEndOfFile (hFile=0x324) returned 1
	[0175.855] CloseHandle (hObject=0x324) returned 1
	[0175.855] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.855] SetEndOfFile (hFile=0x328) returned 1
	[0175.858] CloseHandle (hObject=0x328) returned 1
	[0175.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 1
	[0175.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.860] lstrlenW (lpString=".doc") returned 4
	[0175.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.860] lstrlenW (lpString=".docx") returned 5
	[0175.860] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0175.860] lstrlenW (lpString=".pdf") returned 4
	[0175.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.860] lstrlenW (lpString=".xls") returned 4
	[0175.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.860] lstrlenW (lpString=".xlsx") returned 5
	[0175.860] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0175.860] lstrlenW (lpString=".ppt") returned 4
	[0175.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.860] lstrlenW (lpString=".zip") returned 4
	[0175.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.860] lstrlenW (lpString=".rar") returned 4
	[0175.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.860] lstrlenW (lpString=".bz2") returned 4
	[0175.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.860] lstrlenW (lpString=".7z") returned 3
	[0175.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.860] lstrlenW (lpString=".dbf") returned 4
	[0175.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.861] lstrlenW (lpString=".1cd") returned 4
	[0175.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.861] lstrlenW (lpString=".jpg") returned 4
	[0175.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.861] lstrlenW (lpString=".doc") returned 4
	[0175.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.861] lstrlenW (lpString=".docx") returned 5
	[0175.861] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0175.861] lstrlenW (lpString=".pdf") returned 4
	[0175.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.861] lstrlenW (lpString=".xls") returned 4
	[0175.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.861] lstrlenW (lpString=".xlsx") returned 5
	[0175.861] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0175.861] lstrlenW (lpString=".ppt") returned 4
	[0175.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.861] lstrlenW (lpString=".zip") returned 4
	[0175.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.861] lstrlenW (lpString=".rar") returned 4
	[0175.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.861] lstrlenW (lpString=".bz2") returned 4
	[0175.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.861] lstrlenW (lpString=".7z") returned 3
	[0175.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.862] lstrlenW (lpString=".dbf") returned 4
	[0175.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.862] lstrlenW (lpString=".1cd") returned 4
	[0175.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0175.862] lstrlenW (lpString=".jpg") returned 4
	[0175.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.862] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0175.862] lstrlenW (lpString="J0152430.WMF") returned 12
	[0175.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0175.984] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=14132) returned 1
	[0175.984] CloseHandle (hObject=0x54c) returned 1
	[0175.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0x220
	[0175.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0175.986] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.986] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0175.987] GetLastError () returned 0x0
	[0175.987] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x3734, lpOverlapped=0x0) returned 1
	[0175.989] WriteFile (in: hFile=0x328, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x3740, lpOverlapped=0x0) returned 1
	[0175.990] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.990] WriteFile (in: hFile=0x328, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.990] SetEndOfFile (hFile=0x328) returned 1
	[0175.991] CloseHandle (hObject=0x328) returned 1
	[0175.991] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.991] SetEndOfFile (hFile=0x54c) returned 1
	[0175.994] CloseHandle (hObject=0x54c) returned 1
	[0175.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 1
	[0175.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.995] lstrlenW (lpString=".doc") returned 4
	[0175.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.995] lstrlenW (lpString=".docx") returned 5
	[0175.995] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0175.995] lstrlenW (lpString=".pdf") returned 4
	[0175.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.995] lstrlenW (lpString=".xls") returned 4
	[0175.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.995] lstrlenW (lpString=".xlsx") returned 5
	[0175.995] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0175.995] lstrlenW (lpString=".ppt") returned 4
	[0175.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.995] lstrlenW (lpString=".zip") returned 4
	[0175.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.995] lstrlenW (lpString=".rar") returned 4
	[0175.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.995] lstrlenW (lpString=".bz2") returned 4
	[0175.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.996] lstrlenW (lpString=".7z") returned 3
	[0175.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.996] lstrlenW (lpString=".dbf") returned 4
	[0175.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.996] lstrlenW (lpString=".1cd") returned 4
	[0175.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.996] lstrlenW (lpString=".jpg") returned 4
	[0175.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.996] lstrlenW (lpString=".doc") returned 4
	[0175.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.996] lstrlenW (lpString=".docx") returned 5
	[0175.996] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0175.996] lstrlenW (lpString=".pdf") returned 4
	[0175.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.996] lstrlenW (lpString=".xls") returned 4
	[0175.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.996] lstrlenW (lpString=".xlsx") returned 5
	[0175.996] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0175.996] lstrlenW (lpString=".ppt") returned 4
	[0175.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.996] lstrlenW (lpString=".zip") returned 4
	[0175.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.996] lstrlenW (lpString=".rar") returned 4
	[0175.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.997] lstrlenW (lpString=".bz2") returned 4
	[0175.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.997] lstrlenW (lpString=".7z") returned 3
	[0175.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.997] lstrlenW (lpString=".dbf") returned 4
	[0175.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.997] lstrlenW (lpString=".1cd") returned 4
	[0175.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0175.997] lstrlenW (lpString=".jpg") returned 4
	[0175.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.997] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0175.997] lstrlenW (lpString="J0152432.WMF") returned 12
	[0175.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0175.998] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=16492) returned 1
	[0175.998] CloseHandle (hObject=0x54c) returned 1
	[0175.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 0x220
	[0175.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0175.999] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.999] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0176.000] GetLastError () returned 0x0
	[0176.000] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x406c, lpOverlapped=0x0) returned 1
	[0176.002] WriteFile (in: hFile=0x328, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4070, lpOverlapped=0x0) returned 1
	[0176.003] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.003] WriteFile (in: hFile=0x328, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.004] SetEndOfFile (hFile=0x328) returned 1
	[0176.004] CloseHandle (hObject=0x328) returned 1
	[0176.004] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.004] SetEndOfFile (hFile=0x54c) returned 1
	[0176.010] CloseHandle (hObject=0x54c) returned 1
	[0176.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 1
	[0176.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.011] lstrlenW (lpString=".doc") returned 4
	[0176.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.011] lstrlenW (lpString=".docx") returned 5
	[0176.011] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0176.011] lstrlenW (lpString=".pdf") returned 4
	[0176.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.011] lstrlenW (lpString=".xls") returned 4
	[0176.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.011] lstrlenW (lpString=".xlsx") returned 5
	[0176.011] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0176.011] lstrlenW (lpString=".ppt") returned 4
	[0176.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.011] lstrlenW (lpString=".zip") returned 4
	[0176.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.011] lstrlenW (lpString=".rar") returned 4
	[0176.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.011] lstrlenW (lpString=".bz2") returned 4
	[0176.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.011] lstrlenW (lpString=".7z") returned 3
	[0176.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.012] lstrlenW (lpString=".dbf") returned 4
	[0176.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.012] lstrlenW (lpString=".1cd") returned 4
	[0176.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.012] lstrlenW (lpString=".jpg") returned 4
	[0176.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.012] lstrlenW (lpString=".doc") returned 4
	[0176.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.012] lstrlenW (lpString=".docx") returned 5
	[0176.012] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0176.012] lstrlenW (lpString=".pdf") returned 4
	[0176.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.012] lstrlenW (lpString=".xls") returned 4
	[0176.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.012] lstrlenW (lpString=".xlsx") returned 5
	[0176.012] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0176.012] lstrlenW (lpString=".ppt") returned 4
	[0176.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.012] lstrlenW (lpString=".zip") returned 4
	[0176.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.012] lstrlenW (lpString=".rar") returned 4
	[0176.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.012] lstrlenW (lpString=".bz2") returned 4
	[0176.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.013] lstrlenW (lpString=".7z") returned 3
	[0176.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.013] lstrlenW (lpString=".dbf") returned 4
	[0176.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.013] lstrlenW (lpString=".1cd") returned 4
	[0176.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0176.013] lstrlenW (lpString=".jpg") returned 4
	[0176.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.013] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.013] lstrlenW (lpString="J0152436.WMF") returned 12
	[0176.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0176.014] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=11340) returned 1
	[0176.014] CloseHandle (hObject=0x54c) returned 1
	[0176.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0x220
	[0176.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0176.015] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.015] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0176.016] GetLastError () returned 0x0
	[0176.016] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2c4c, lpOverlapped=0x0) returned 1
	[0176.017] WriteFile (in: hFile=0x328, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2c50, lpOverlapped=0x0) returned 1
	[0176.018] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.018] WriteFile (in: hFile=0x328, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.019] SetEndOfFile (hFile=0x328) returned 1
	[0176.019] CloseHandle (hObject=0x328) returned 1
	[0176.019] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.019] SetEndOfFile (hFile=0x54c) returned 1
	[0176.021] CloseHandle (hObject=0x54c) returned 1
	[0176.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 1
	[0176.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.023] lstrlenW (lpString=".doc") returned 4
	[0176.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.023] lstrlenW (lpString=".docx") returned 5
	[0176.023] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0176.023] lstrlenW (lpString=".pdf") returned 4
	[0176.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.023] lstrlenW (lpString=".xls") returned 4
	[0176.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.023] lstrlenW (lpString=".xlsx") returned 5
	[0176.023] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0176.023] lstrlenW (lpString=".ppt") returned 4
	[0176.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.023] lstrlenW (lpString=".zip") returned 4
	[0176.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.023] lstrlenW (lpString=".rar") returned 4
	[0176.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.023] lstrlenW (lpString=".bz2") returned 4
	[0176.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.023] lstrlenW (lpString=".7z") returned 3
	[0176.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.023] lstrlenW (lpString=".dbf") returned 4
	[0176.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.023] lstrlenW (lpString=".1cd") returned 4
	[0176.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.023] lstrlenW (lpString=".jpg") returned 4
	[0176.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.024] lstrlenW (lpString=".doc") returned 4
	[0176.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.024] lstrlenW (lpString=".docx") returned 5
	[0176.024] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0176.024] lstrlenW (lpString=".pdf") returned 4
	[0176.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.024] lstrlenW (lpString=".xls") returned 4
	[0176.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.024] lstrlenW (lpString=".xlsx") returned 5
	[0176.024] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0176.024] lstrlenW (lpString=".ppt") returned 4
	[0176.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.024] lstrlenW (lpString=".zip") returned 4
	[0176.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.024] lstrlenW (lpString=".rar") returned 4
	[0176.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.024] lstrlenW (lpString=".bz2") returned 4
	[0176.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.024] lstrlenW (lpString=".7z") returned 3
	[0176.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.024] lstrlenW (lpString=".dbf") returned 4
	[0176.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.024] lstrlenW (lpString=".1cd") returned 4
	[0176.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0176.025] lstrlenW (lpString=".jpg") returned 4
	[0176.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.025] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.025] lstrlenW (lpString="J0152556.WMF") returned 12
	[0176.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0176.025] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=16432) returned 1
	[0176.025] CloseHandle (hObject=0x54c) returned 1
	[0176.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0x220
	[0176.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0176.026] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.026] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0176.027] GetLastError () returned 0x0
	[0176.027] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4030, lpOverlapped=0x0) returned 1
	[0176.323] WriteFile (in: hFile=0x328, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4040, lpOverlapped=0x0) returned 1
	[0176.324] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.343] WriteFile (in: hFile=0x328, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.343] SetEndOfFile (hFile=0x328) returned 1
	[0176.343] CloseHandle (hObject=0x328) returned 1
	[0176.343] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.343] SetEndOfFile (hFile=0x54c) returned 1
	[0176.346] CloseHandle (hObject=0x54c) returned 1
	[0176.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 1
	[0176.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.717] lstrlenW (lpString=".doc") returned 4
	[0176.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.717] lstrlenW (lpString=".docx") returned 5
	[0176.717] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0176.717] lstrlenW (lpString=".pdf") returned 4
	[0176.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.717] lstrlenW (lpString=".xls") returned 4
	[0176.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.717] lstrlenW (lpString=".xlsx") returned 5
	[0176.717] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0176.717] lstrlenW (lpString=".ppt") returned 4
	[0176.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.717] lstrlenW (lpString=".zip") returned 4
	[0176.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.717] lstrlenW (lpString=".rar") returned 4
	[0176.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.717] lstrlenW (lpString=".bz2") returned 4
	[0176.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.717] lstrlenW (lpString=".7z") returned 3
	[0176.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.717] lstrlenW (lpString=".dbf") returned 4
	[0176.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.717] lstrlenW (lpString=".1cd") returned 4
	[0176.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.718] lstrlenW (lpString=".jpg") returned 4
	[0176.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.718] lstrlenW (lpString=".doc") returned 4
	[0176.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.718] lstrlenW (lpString=".docx") returned 5
	[0176.718] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0176.718] lstrlenW (lpString=".pdf") returned 4
	[0176.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.718] lstrlenW (lpString=".xls") returned 4
	[0176.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.718] lstrlenW (lpString=".xlsx") returned 5
	[0176.718] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0176.718] lstrlenW (lpString=".ppt") returned 4
	[0176.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.718] lstrlenW (lpString=".zip") returned 4
	[0176.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.719] lstrlenW (lpString=".rar") returned 4
	[0176.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.719] lstrlenW (lpString=".bz2") returned 4
	[0176.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.719] lstrlenW (lpString=".7z") returned 3
	[0176.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.719] lstrlenW (lpString=".dbf") returned 4
	[0176.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.719] lstrlenW (lpString=".1cd") returned 4
	[0176.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0176.719] lstrlenW (lpString=".jpg") returned 4
	[0176.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.719] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.719] lstrlenW (lpString="J0152622.WMF") returned 12
	[0176.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.814] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=9604) returned 1
	[0176.814] CloseHandle (hObject=0x524) returned 1
	[0176.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0x220
	[0176.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.816] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.816] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.817] GetLastError () returned 0x0
	[0176.817] ReadFile (in: hFile=0x524, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2584, lpOverlapped=0x0) returned 1
	[0176.819] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2590, lpOverlapped=0x0) returned 1
	[0176.820] ReadFile (in: hFile=0x524, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.820] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.820] SetEndOfFile (hFile=0x514) returned 1
	[0176.820] CloseHandle (hObject=0x514) returned 1
	[0176.820] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.820] SetEndOfFile (hFile=0x524) returned 1
	[0176.824] CloseHandle (hObject=0x524) returned 1
	[0176.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 1
	[0176.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.825] lstrlenW (lpString=".doc") returned 4
	[0176.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.825] lstrlenW (lpString=".docx") returned 5
	[0176.825] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0176.825] lstrlenW (lpString=".pdf") returned 4
	[0176.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.825] lstrlenW (lpString=".xls") returned 4
	[0176.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.825] lstrlenW (lpString=".xlsx") returned 5
	[0176.825] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0176.825] lstrlenW (lpString=".ppt") returned 4
	[0176.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.826] lstrlenW (lpString=".zip") returned 4
	[0176.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.826] lstrlenW (lpString=".rar") returned 4
	[0176.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.826] lstrlenW (lpString=".bz2") returned 4
	[0176.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.826] lstrlenW (lpString=".7z") returned 3
	[0176.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.826] lstrlenW (lpString=".dbf") returned 4
	[0176.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.826] lstrlenW (lpString=".1cd") returned 4
	[0176.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.826] lstrlenW (lpString=".jpg") returned 4
	[0176.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.826] lstrlenW (lpString=".doc") returned 4
	[0176.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.826] lstrlenW (lpString=".docx") returned 5
	[0176.826] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0176.826] lstrlenW (lpString=".pdf") returned 4
	[0176.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.826] lstrlenW (lpString=".xls") returned 4
	[0176.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.826] lstrlenW (lpString=".xlsx") returned 5
	[0176.826] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0176.826] lstrlenW (lpString=".ppt") returned 4
	[0176.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.827] lstrlenW (lpString=".zip") returned 4
	[0176.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.827] lstrlenW (lpString=".rar") returned 4
	[0176.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.827] lstrlenW (lpString=".bz2") returned 4
	[0176.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.827] lstrlenW (lpString=".7z") returned 3
	[0176.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.827] lstrlenW (lpString=".dbf") returned 4
	[0176.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.827] lstrlenW (lpString=".1cd") returned 4
	[0176.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0176.827] lstrlenW (lpString=".jpg") returned 4
	[0176.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.827] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.827] lstrlenW (lpString="J0152628.WMF") returned 12
	[0176.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.828] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=30812) returned 1
	[0176.828] CloseHandle (hObject=0x524) returned 1
	[0176.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0x220
	[0176.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.829] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.829] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.830] GetLastError () returned 0x0
	[0176.830] ReadFile (in: hFile=0x524, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x785c, lpOverlapped=0x0) returned 1
	[0176.832] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x7860, lpOverlapped=0x0) returned 1
	[0176.834] ReadFile (in: hFile=0x524, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.834] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.834] SetEndOfFile (hFile=0x514) returned 1
	[0176.834] CloseHandle (hObject=0x514) returned 1
	[0176.834] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.834] SetEndOfFile (hFile=0x524) returned 1
	[0176.837] CloseHandle (hObject=0x524) returned 1
	[0176.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 1
	[0176.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.838] lstrlenW (lpString=".doc") returned 4
	[0176.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.838] lstrlenW (lpString=".docx") returned 5
	[0176.838] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0176.838] lstrlenW (lpString=".pdf") returned 4
	[0176.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.838] lstrlenW (lpString=".xls") returned 4
	[0176.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.838] lstrlenW (lpString=".xlsx") returned 5
	[0176.838] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0176.838] lstrlenW (lpString=".ppt") returned 4
	[0176.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.838] lstrlenW (lpString=".zip") returned 4
	[0176.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.838] lstrlenW (lpString=".rar") returned 4
	[0176.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.838] lstrlenW (lpString=".bz2") returned 4
	[0176.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.839] lstrlenW (lpString=".7z") returned 3
	[0176.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.839] lstrlenW (lpString=".dbf") returned 4
	[0176.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.839] lstrlenW (lpString=".1cd") returned 4
	[0176.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.839] lstrlenW (lpString=".jpg") returned 4
	[0176.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.839] lstrlenW (lpString=".doc") returned 4
	[0176.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.839] lstrlenW (lpString=".docx") returned 5
	[0176.839] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0176.839] lstrlenW (lpString=".pdf") returned 4
	[0176.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.839] lstrlenW (lpString=".xls") returned 4
	[0176.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.839] lstrlenW (lpString=".xlsx") returned 5
	[0176.839] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0176.839] lstrlenW (lpString=".ppt") returned 4
	[0176.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.839] lstrlenW (lpString=".zip") returned 4
	[0176.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.839] lstrlenW (lpString=".rar") returned 4
	[0176.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.840] lstrlenW (lpString=".bz2") returned 4
	[0176.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.840] lstrlenW (lpString=".7z") returned 3
	[0176.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.840] lstrlenW (lpString=".dbf") returned 4
	[0176.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.840] lstrlenW (lpString=".1cd") returned 4
	[0176.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0176.840] lstrlenW (lpString=".jpg") returned 4
	[0176.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.840] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.840] lstrlenW (lpString="J0152688.WMF") returned 12
	[0176.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.842] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=34676) returned 1
	[0176.842] CloseHandle (hObject=0x524) returned 1
	[0176.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 0x220
	[0176.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.843] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.843] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.844] GetLastError () returned 0x0
	[0176.844] ReadFile (in: hFile=0x524, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x8774, lpOverlapped=0x0) returned 1
	[0176.846] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x8780, lpOverlapped=0x0) returned 1
	[0176.848] ReadFile (in: hFile=0x524, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.848] WriteFile (in: hFile=0x514, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.848] SetEndOfFile (hFile=0x514) returned 1
	[0176.848] CloseHandle (hObject=0x514) returned 1
	[0176.848] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.848] SetEndOfFile (hFile=0x524) returned 1
	[0176.851] CloseHandle (hObject=0x524) returned 1
	[0176.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 1
	[0176.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.852] lstrlenW (lpString=".doc") returned 4
	[0176.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.852] lstrlenW (lpString=".docx") returned 5
	[0176.852] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0176.852] lstrlenW (lpString=".pdf") returned 4
	[0176.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.852] lstrlenW (lpString=".xls") returned 4
	[0176.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.852] lstrlenW (lpString=".xlsx") returned 5
	[0176.852] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0176.852] lstrlenW (lpString=".ppt") returned 4
	[0176.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.852] lstrlenW (lpString=".zip") returned 4
	[0176.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.852] lstrlenW (lpString=".rar") returned 4
	[0176.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.852] lstrlenW (lpString=".bz2") returned 4
	[0176.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.852] lstrlenW (lpString=".7z") returned 3
	[0176.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.852] lstrlenW (lpString=".dbf") returned 4
	[0176.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.853] lstrlenW (lpString=".1cd") returned 4
	[0176.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.853] lstrlenW (lpString=".jpg") returned 4
	[0176.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.853] lstrlenW (lpString=".doc") returned 4
	[0176.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.853] lstrlenW (lpString=".docx") returned 5
	[0176.853] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0176.853] lstrlenW (lpString=".pdf") returned 4
	[0176.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.853] lstrlenW (lpString=".xls") returned 4
	[0176.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.853] lstrlenW (lpString=".xlsx") returned 5
	[0176.853] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0176.853] lstrlenW (lpString=".ppt") returned 4
	[0176.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.853] lstrlenW (lpString=".zip") returned 4
	[0176.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.853] lstrlenW (lpString=".rar") returned 4
	[0176.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.853] lstrlenW (lpString=".bz2") returned 4
	[0176.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.853] lstrlenW (lpString=".7z") returned 3
	[0176.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.853] lstrlenW (lpString=".dbf") returned 4
	[0176.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.854] lstrlenW (lpString=".1cd") returned 4
	[0176.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0176.854] lstrlenW (lpString=".jpg") returned 4
	[0176.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.854] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.854] lstrlenW (lpString="J0152690.WMF") returned 12
	[0176.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.966] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=1268) returned 1
	[0176.966] CloseHandle (hObject=0x514) returned 1
	[0176.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 0x220
	[0176.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0177.049] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.049] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0177.050] GetLastError () returned 0x0
	[0177.050] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4f4, lpOverlapped=0x0) returned 1
	[0177.051] WriteFile (in: hFile=0x3d8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x500, lpOverlapped=0x0) returned 1
	[0177.052] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.052] WriteFile (in: hFile=0x3d8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.052] SetEndOfFile (hFile=0x3d8) returned 1
	[0177.053] CloseHandle (hObject=0x3d8) returned 1
	[0177.053] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.053] SetEndOfFile (hFile=0x538) returned 1
	[0177.055] CloseHandle (hObject=0x538) returned 1
	[0177.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 1
	[0177.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.057] lstrlenW (lpString=".doc") returned 4
	[0177.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.057] lstrlenW (lpString=".docx") returned 5
	[0177.057] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0177.057] lstrlenW (lpString=".pdf") returned 4
	[0177.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.057] lstrlenW (lpString=".xls") returned 4
	[0177.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.057] lstrlenW (lpString=".xlsx") returned 5
	[0177.057] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0177.057] lstrlenW (lpString=".ppt") returned 4
	[0177.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.057] lstrlenW (lpString=".zip") returned 4
	[0177.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.057] lstrlenW (lpString=".rar") returned 4
	[0177.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.057] lstrlenW (lpString=".bz2") returned 4
	[0177.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.057] lstrlenW (lpString=".7z") returned 3
	[0177.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.058] lstrlenW (lpString=".dbf") returned 4
	[0177.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.058] lstrlenW (lpString=".1cd") returned 4
	[0177.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.058] lstrlenW (lpString=".jpg") returned 4
	[0177.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.058] lstrlenW (lpString=".doc") returned 4
	[0177.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.058] lstrlenW (lpString=".docx") returned 5
	[0177.058] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0177.058] lstrlenW (lpString=".pdf") returned 4
	[0177.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.058] lstrlenW (lpString=".xls") returned 4
	[0177.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.058] lstrlenW (lpString=".xlsx") returned 5
	[0177.058] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0177.058] lstrlenW (lpString=".ppt") returned 4
	[0177.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.058] lstrlenW (lpString=".zip") returned 4
	[0177.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.058] lstrlenW (lpString=".rar") returned 4
	[0177.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.058] lstrlenW (lpString=".bz2") returned 4
	[0177.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.058] lstrlenW (lpString=".7z") returned 3
	[0177.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.059] lstrlenW (lpString=".dbf") returned 4
	[0177.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.059] lstrlenW (lpString=".1cd") returned 4
	[0177.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0177.059] lstrlenW (lpString=".jpg") returned 4
	[0177.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.059] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0177.059] lstrlenW (lpString="J0152698.WMF") returned 12
	[0177.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0177.060] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=1208) returned 1
	[0177.061] CloseHandle (hObject=0x538) returned 1
	[0177.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 0x220
	[0177.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0177.061] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.061] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0177.062] GetLastError () returned 0x0
	[0177.062] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4b8, lpOverlapped=0x0) returned 1
	[0177.063] WriteFile (in: hFile=0x3d8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4c0, lpOverlapped=0x0) returned 1
	[0177.064] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.064] WriteFile (in: hFile=0x3d8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.064] SetEndOfFile (hFile=0x3d8) returned 1
	[0177.064] CloseHandle (hObject=0x3d8) returned 1
	[0177.065] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.065] SetEndOfFile (hFile=0x538) returned 1
	[0177.068] CloseHandle (hObject=0x538) returned 1
	[0177.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 1
	[0177.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.069] lstrlenW (lpString=".doc") returned 4
	[0177.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.069] lstrlenW (lpString=".docx") returned 5
	[0177.069] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0177.069] lstrlenW (lpString=".pdf") returned 4
	[0177.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.069] lstrlenW (lpString=".xls") returned 4
	[0177.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.069] lstrlenW (lpString=".xlsx") returned 5
	[0177.069] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0177.069] lstrlenW (lpString=".ppt") returned 4
	[0177.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.069] lstrlenW (lpString=".zip") returned 4
	[0177.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.069] lstrlenW (lpString=".rar") returned 4
	[0177.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.069] lstrlenW (lpString=".bz2") returned 4
	[0177.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.069] lstrlenW (lpString=".7z") returned 3
	[0177.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.069] lstrlenW (lpString=".dbf") returned 4
	[0177.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.069] lstrlenW (lpString=".1cd") returned 4
	[0177.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.069] lstrlenW (lpString=".jpg") returned 4
	[0177.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.070] lstrlenW (lpString=".doc") returned 4
	[0177.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.070] lstrlenW (lpString=".docx") returned 5
	[0177.070] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0177.070] lstrlenW (lpString=".pdf") returned 4
	[0177.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.070] lstrlenW (lpString=".xls") returned 4
	[0177.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.070] lstrlenW (lpString=".xlsx") returned 5
	[0177.070] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0177.070] lstrlenW (lpString=".ppt") returned 4
	[0177.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.070] lstrlenW (lpString=".zip") returned 4
	[0177.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.070] lstrlenW (lpString=".rar") returned 4
	[0177.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.070] lstrlenW (lpString=".bz2") returned 4
	[0177.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.070] lstrlenW (lpString=".7z") returned 3
	[0177.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.070] lstrlenW (lpString=".dbf") returned 4
	[0177.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.070] lstrlenW (lpString=".1cd") returned 4
	[0177.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0177.070] lstrlenW (lpString=".jpg") returned 4
	[0177.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.071] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0177.071] lstrlenW (lpString="J0152702.WMF") returned 12
	[0177.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0177.073] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=1208) returned 1
	[0177.073] CloseHandle (hObject=0x538) returned 1
	[0177.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 0x220
	[0177.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0177.073] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.073] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0177.074] GetLastError () returned 0x0
	[0177.074] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4b8, lpOverlapped=0x0) returned 1
	[0177.075] WriteFile (in: hFile=0x524, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4c0, lpOverlapped=0x0) returned 1
	[0177.077] ReadFile (in: hFile=0x538, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.077] WriteFile (in: hFile=0x524, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.077] SetEndOfFile (hFile=0x524) returned 1
	[0177.077] CloseHandle (hObject=0x524) returned 1
	[0177.077] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.077] SetEndOfFile (hFile=0x538) returned 1
	[0177.079] CloseHandle (hObject=0x538) returned 1
	[0177.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 1
	[0177.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.080] lstrlenW (lpString=".doc") returned 4
	[0177.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.080] lstrlenW (lpString=".docx") returned 5
	[0177.081] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0177.081] lstrlenW (lpString=".pdf") returned 4
	[0177.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.081] lstrlenW (lpString=".xls") returned 4
	[0177.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.081] lstrlenW (lpString=".xlsx") returned 5
	[0177.081] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0177.081] lstrlenW (lpString=".ppt") returned 4
	[0177.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.081] lstrlenW (lpString=".zip") returned 4
	[0177.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.081] lstrlenW (lpString=".rar") returned 4
	[0177.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.081] lstrlenW (lpString=".bz2") returned 4
	[0177.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.081] lstrlenW (lpString=".7z") returned 3
	[0177.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.081] lstrlenW (lpString=".dbf") returned 4
	[0177.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.081] lstrlenW (lpString=".1cd") returned 4
	[0177.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.081] lstrlenW (lpString=".jpg") returned 4
	[0177.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.081] lstrlenW (lpString=".doc") returned 4
	[0177.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.082] lstrlenW (lpString=".docx") returned 5
	[0177.082] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0177.082] lstrlenW (lpString=".pdf") returned 4
	[0177.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.082] lstrlenW (lpString=".xls") returned 4
	[0177.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.082] lstrlenW (lpString=".xlsx") returned 5
	[0177.082] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0177.082] lstrlenW (lpString=".ppt") returned 4
	[0177.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.082] lstrlenW (lpString=".zip") returned 4
	[0177.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.082] lstrlenW (lpString=".rar") returned 4
	[0177.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.082] lstrlenW (lpString=".bz2") returned 4
	[0177.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.082] lstrlenW (lpString=".7z") returned 3
	[0177.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.082] lstrlenW (lpString=".dbf") returned 4
	[0177.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.082] lstrlenW (lpString=".1cd") returned 4
	[0177.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0177.082] lstrlenW (lpString=".jpg") returned 4
	[0177.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.083] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0177.083] lstrlenW (lpString="J0152704.WMF") returned 12
	[0177.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0177.325] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=1652) returned 1
	[0177.325] CloseHandle (hObject=0x550) returned 1
	[0177.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 0x220
	[0177.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0178.455] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.455] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0178.457] GetLastError () returned 0x0
	[0178.457] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x674, lpOverlapped=0x0) returned 1
	[0178.458] WriteFile (in: hFile=0x4b8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x680, lpOverlapped=0x0) returned 1
	[0178.459] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.459] WriteFile (in: hFile=0x4b8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.459] SetEndOfFile (hFile=0x4b8) returned 1
	[0178.460] CloseHandle (hObject=0x4b8) returned 1
	[0178.460] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.460] SetEndOfFile (hFile=0x370) returned 1
	[0178.462] CloseHandle (hObject=0x370) returned 1
	[0178.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 1
	[0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.464] lstrlenW (lpString=".doc") returned 4
	[0178.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.464] lstrlenW (lpString=".docx") returned 5
	[0178.464] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0178.464] lstrlenW (lpString=".pdf") returned 4
	[0178.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.464] lstrlenW (lpString=".xls") returned 4
	[0178.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.464] lstrlenW (lpString=".xlsx") returned 5
	[0178.464] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0178.464] lstrlenW (lpString=".ppt") returned 4
	[0178.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.464] lstrlenW (lpString=".zip") returned 4
	[0178.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.464] lstrlenW (lpString=".rar") returned 4
	[0178.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.464] lstrlenW (lpString=".bz2") returned 4
	[0178.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.464] lstrlenW (lpString=".7z") returned 3
	[0178.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.464] lstrlenW (lpString=".dbf") returned 4
	[0178.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.465] lstrlenW (lpString=".1cd") returned 4
	[0178.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.465] lstrlenW (lpString=".jpg") returned 4
	[0178.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.465] lstrlenW (lpString=".doc") returned 4
	[0178.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.465] lstrlenW (lpString=".docx") returned 5
	[0178.465] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0178.465] lstrlenW (lpString=".pdf") returned 4
	[0178.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.465] lstrlenW (lpString=".xls") returned 4
	[0178.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.465] lstrlenW (lpString=".xlsx") returned 5
	[0178.465] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0178.465] lstrlenW (lpString=".ppt") returned 4
	[0178.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.465] lstrlenW (lpString=".zip") returned 4
	[0178.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.465] lstrlenW (lpString=".rar") returned 4
	[0178.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.465] lstrlenW (lpString=".bz2") returned 4
	[0178.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.465] lstrlenW (lpString=".7z") returned 3
	[0178.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.465] lstrlenW (lpString=".dbf") returned 4
	[0178.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.466] lstrlenW (lpString=".1cd") returned 4
	[0178.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0178.466] lstrlenW (lpString=".jpg") returned 4
	[0178.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.466] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0178.466] lstrlenW (lpString="J0153091.WMF") returned 12
	[0178.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0178.467] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=8136) returned 1
	[0178.467] CloseHandle (hObject=0x370) returned 1
	[0178.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 0x220
	[0178.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0178.467] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.468] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0178.468] GetLastError () returned 0x0
	[0178.468] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1fc8, lpOverlapped=0x0) returned 1
	[0178.470] WriteFile (in: hFile=0x4b8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1fd0, lpOverlapped=0x0) returned 1
	[0178.471] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.471] WriteFile (in: hFile=0x4b8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.471] SetEndOfFile (hFile=0x4b8) returned 1
	[0178.471] CloseHandle (hObject=0x4b8) returned 1
	[0178.471] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.472] SetEndOfFile (hFile=0x370) returned 1
	[0178.474] CloseHandle (hObject=0x370) returned 1
	[0178.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 1
	[0178.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.475] lstrlenW (lpString=".doc") returned 4
	[0178.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.475] lstrlenW (lpString=".docx") returned 5
	[0178.475] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0178.475] lstrlenW (lpString=".pdf") returned 4
	[0178.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.475] lstrlenW (lpString=".xls") returned 4
	[0178.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.475] lstrlenW (lpString=".xlsx") returned 5
	[0178.475] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0178.475] lstrlenW (lpString=".ppt") returned 4
	[0178.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.475] lstrlenW (lpString=".zip") returned 4
	[0178.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.476] lstrlenW (lpString=".rar") returned 4
	[0178.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.476] lstrlenW (lpString=".bz2") returned 4
	[0178.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.476] lstrlenW (lpString=".7z") returned 3
	[0178.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.476] lstrlenW (lpString=".dbf") returned 4
	[0178.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.476] lstrlenW (lpString=".1cd") returned 4
	[0178.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.476] lstrlenW (lpString=".jpg") returned 4
	[0178.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.476] lstrlenW (lpString=".doc") returned 4
	[0178.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.476] lstrlenW (lpString=".docx") returned 5
	[0178.476] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0178.476] lstrlenW (lpString=".pdf") returned 4
	[0178.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.476] lstrlenW (lpString=".xls") returned 4
	[0178.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.476] lstrlenW (lpString=".xlsx") returned 5
	[0178.476] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0178.476] lstrlenW (lpString=".ppt") returned 4
	[0178.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.477] lstrlenW (lpString=".zip") returned 4
	[0178.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.477] lstrlenW (lpString=".rar") returned 4
	[0178.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.477] lstrlenW (lpString=".bz2") returned 4
	[0178.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.477] lstrlenW (lpString=".7z") returned 3
	[0178.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.477] lstrlenW (lpString=".dbf") returned 4
	[0178.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.477] lstrlenW (lpString=".1cd") returned 4
	[0178.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0178.477] lstrlenW (lpString=".jpg") returned 4
	[0178.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.478] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0178.478] lstrlenW (lpString="J0153093.WMF") returned 12
	[0178.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0178.481] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=8880) returned 1
	[0178.481] CloseHandle (hObject=0x370) returned 1
	[0178.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 0x220
	[0178.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0178.482] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.482] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0178.483] GetLastError () returned 0x0
	[0178.483] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x22b0, lpOverlapped=0x0) returned 1
	[0178.484] WriteFile (in: hFile=0x4b8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x22c0, lpOverlapped=0x0) returned 1
	[0178.485] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.485] WriteFile (in: hFile=0x4b8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.485] SetEndOfFile (hFile=0x4b8) returned 1
	[0178.485] CloseHandle (hObject=0x4b8) returned 1
	[0178.485] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.486] SetEndOfFile (hFile=0x370) returned 1
	[0178.488] CloseHandle (hObject=0x370) returned 1
	[0178.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 1
	[0179.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.839] lstrlenW (lpString=".doc") returned 4
	[0179.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.839] lstrlenW (lpString=".docx") returned 5
	[0179.839] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0179.839] lstrlenW (lpString=".pdf") returned 4
	[0179.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.839] lstrlenW (lpString=".xls") returned 4
	[0179.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.839] lstrlenW (lpString=".xlsx") returned 5
	[0179.839] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0179.839] lstrlenW (lpString=".ppt") returned 4
	[0179.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.839] lstrlenW (lpString=".zip") returned 4
	[0179.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.839] lstrlenW (lpString=".rar") returned 4
	[0179.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.839] lstrlenW (lpString=".bz2") returned 4
	[0179.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.840] lstrlenW (lpString=".7z") returned 3
	[0179.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.840] lstrlenW (lpString=".dbf") returned 4
	[0179.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.840] lstrlenW (lpString=".1cd") returned 4
	[0179.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.840] lstrlenW (lpString=".jpg") returned 4
	[0179.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.840] lstrlenW (lpString=".doc") returned 4
	[0179.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.840] lstrlenW (lpString=".docx") returned 5
	[0179.840] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0179.840] lstrlenW (lpString=".pdf") returned 4
	[0179.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.840] lstrlenW (lpString=".xls") returned 4
	[0179.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.840] lstrlenW (lpString=".xlsx") returned 5
	[0179.841] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0179.841] lstrlenW (lpString=".ppt") returned 4
	[0179.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.841] lstrlenW (lpString=".zip") returned 4
	[0179.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.841] lstrlenW (lpString=".rar") returned 4
	[0179.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.841] lstrlenW (lpString=".bz2") returned 4
	[0179.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.841] lstrlenW (lpString=".7z") returned 3
	[0179.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.841] lstrlenW (lpString=".dbf") returned 4
	[0179.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.841] lstrlenW (lpString=".1cd") returned 4
	[0179.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0179.841] lstrlenW (lpString=".jpg") returned 4
	[0179.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.842] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.842] lstrlenW (lpString="J0153508.WMF") returned 12
	[0179.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0179.888] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=34256) returned 1
	[0179.888] CloseHandle (hObject=0x54c) returned 1
	[0179.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 0x220
	[0179.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0179.888] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.889] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0179.889] GetLastError () returned 0x0
	[0179.889] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x85d0, lpOverlapped=0x0) returned 1
	[0179.892] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x85e0, lpOverlapped=0x0) returned 1
	[0179.893] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.893] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.893] SetEndOfFile (hFile=0x530) returned 1
	[0179.893] CloseHandle (hObject=0x530) returned 1
	[0179.893] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.893] SetEndOfFile (hFile=0x54c) returned 1
	[0179.896] CloseHandle (hObject=0x54c) returned 1
	[0179.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 1
	[0179.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.897] lstrlenW (lpString=".doc") returned 4
	[0179.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.898] lstrlenW (lpString=".docx") returned 5
	[0179.898] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0179.898] lstrlenW (lpString=".pdf") returned 4
	[0179.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.898] lstrlenW (lpString=".xls") returned 4
	[0179.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.898] lstrlenW (lpString=".xlsx") returned 5
	[0179.898] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0179.898] lstrlenW (lpString=".ppt") returned 4
	[0179.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.898] lstrlenW (lpString=".zip") returned 4
	[0179.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.898] lstrlenW (lpString=".rar") returned 4
	[0179.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.898] lstrlenW (lpString=".bz2") returned 4
	[0179.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.898] lstrlenW (lpString=".7z") returned 3
	[0179.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.898] lstrlenW (lpString=".dbf") returned 4
	[0179.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.898] lstrlenW (lpString=".1cd") returned 4
	[0179.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.898] lstrlenW (lpString=".jpg") returned 4
	[0179.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.899] lstrlenW (lpString=".doc") returned 4
	[0179.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.899] lstrlenW (lpString=".docx") returned 5
	[0179.899] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0179.899] lstrlenW (lpString=".pdf") returned 4
	[0179.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.899] lstrlenW (lpString=".xls") returned 4
	[0179.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.899] lstrlenW (lpString=".xlsx") returned 5
	[0179.899] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0179.899] lstrlenW (lpString=".ppt") returned 4
	[0179.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.899] lstrlenW (lpString=".zip") returned 4
	[0179.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.899] lstrlenW (lpString=".rar") returned 4
	[0179.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.899] lstrlenW (lpString=".bz2") returned 4
	[0179.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.899] lstrlenW (lpString=".7z") returned 3
	[0179.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.899] lstrlenW (lpString=".dbf") returned 4
	[0179.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.899] lstrlenW (lpString=".1cd") returned 4
	[0179.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68
	[0179.899] lstrlenW (lpString=".jpg") returned 4
	[0179.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.900] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.900] lstrlenW (lpString="J0153514.WMF") returned 12
	[0179.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0179.900] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=12752) returned 1
	[0179.900] CloseHandle (hObject=0x54c) returned 1
	[0179.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf")) returned 0x220
	[0179.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0179.901] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.901] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0179.902] GetLastError () returned 0x0
	[0179.902] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x31d0, lpOverlapped=0x0) returned 1
	[0179.904] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x31e0, lpOverlapped=0x0) returned 1
	[0179.905] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.905] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.905] SetEndOfFile (hFile=0x530) returned 1
	[0179.905] CloseHandle (hObject=0x530) returned 1
	[0179.905] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.905] SetEndOfFile (hFile=0x54c) returned 1
	[0179.908] CloseHandle (hObject=0x54c) returned 1
	[0179.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf")) returned 1
	[0179.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.909] lstrlenW (lpString=".doc") returned 4
	[0179.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.909] lstrlenW (lpString=".docx") returned 5
	[0179.909] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0179.909] lstrlenW (lpString=".pdf") returned 4
	[0179.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.909] lstrlenW (lpString=".xls") returned 4
	[0179.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.909] lstrlenW (lpString=".xlsx") returned 5
	[0179.909] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0179.909] lstrlenW (lpString=".ppt") returned 4
	[0179.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.909] lstrlenW (lpString=".zip") returned 4
	[0179.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.909] lstrlenW (lpString=".rar") returned 4
	[0179.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.909] lstrlenW (lpString=".bz2") returned 4
	[0179.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.909] lstrlenW (lpString=".7z") returned 3
	[0179.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.910] lstrlenW (lpString=".dbf") returned 4
	[0179.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.910] lstrlenW (lpString=".1cd") returned 4
	[0179.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.910] lstrlenW (lpString=".jpg") returned 4
	[0179.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.910] lstrlenW (lpString=".doc") returned 4
	[0179.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.910] lstrlenW (lpString=".docx") returned 5
	[0179.910] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0179.910] lstrlenW (lpString=".pdf") returned 4
	[0179.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.910] lstrlenW (lpString=".xls") returned 4
	[0179.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.910] lstrlenW (lpString=".xlsx") returned 5
	[0179.910] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0179.910] lstrlenW (lpString=".ppt") returned 4
	[0179.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.910] lstrlenW (lpString=".zip") returned 4
	[0179.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.910] lstrlenW (lpString=".rar") returned 4
	[0179.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.910] lstrlenW (lpString=".bz2") returned 4
	[0179.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.910] lstrlenW (lpString=".7z") returned 3
	[0179.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.911] lstrlenW (lpString=".dbf") returned 4
	[0179.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.911] lstrlenW (lpString=".1cd") returned 4
	[0179.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68
	[0179.911] lstrlenW (lpString=".jpg") returned 4
	[0179.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.911] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.911] lstrlenW (lpString="J0153516.WMF") returned 12
	[0179.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0179.912] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=7432) returned 1
	[0179.912] CloseHandle (hObject=0x54c) returned 1
	[0179.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 0x220
	[0179.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0179.913] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.913] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0179.913] GetLastError () returned 0x0
	[0179.913] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1d08, lpOverlapped=0x0) returned 1
	[0179.915] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1d10, lpOverlapped=0x0) returned 1
	[0179.916] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.916] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.916] SetEndOfFile (hFile=0x530) returned 1
	[0179.916] CloseHandle (hObject=0x530) returned 1
	[0179.916] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.916] SetEndOfFile (hFile=0x54c) returned 1
	[0179.919] CloseHandle (hObject=0x54c) returned 1
	[0179.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 1
	[0179.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.920] lstrlenW (lpString=".doc") returned 4
	[0179.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.920] lstrlenW (lpString=".docx") returned 5
	[0179.920] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0179.920] lstrlenW (lpString=".pdf") returned 4
	[0179.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.920] lstrlenW (lpString=".xls") returned 4
	[0179.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.920] lstrlenW (lpString=".xlsx") returned 5
	[0179.920] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0179.920] lstrlenW (lpString=".ppt") returned 4
	[0179.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.920] lstrlenW (lpString=".zip") returned 4
	[0179.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.920] lstrlenW (lpString=".rar") returned 4
	[0179.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.920] lstrlenW (lpString=".bz2") returned 4
	[0179.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.920] lstrlenW (lpString=".7z") returned 3
	[0179.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.921] lstrlenW (lpString=".dbf") returned 4
	[0179.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.921] lstrlenW (lpString=".1cd") returned 4
	[0179.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.921] lstrlenW (lpString=".jpg") returned 4
	[0179.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.921] lstrlenW (lpString=".doc") returned 4
	[0179.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.921] lstrlenW (lpString=".docx") returned 5
	[0179.921] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0179.921] lstrlenW (lpString=".pdf") returned 4
	[0179.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.921] lstrlenW (lpString=".xls") returned 4
	[0179.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.921] lstrlenW (lpString=".xlsx") returned 5
	[0179.921] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0179.921] lstrlenW (lpString=".ppt") returned 4
	[0179.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.921] lstrlenW (lpString=".zip") returned 4
	[0179.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.921] lstrlenW (lpString=".rar") returned 4
	[0179.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.921] lstrlenW (lpString=".bz2") returned 4
	[0179.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.922] lstrlenW (lpString=".7z") returned 3
	[0179.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.922] lstrlenW (lpString=".dbf") returned 4
	[0179.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.922] lstrlenW (lpString=".1cd") returned 4
	[0179.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68
	[0179.922] lstrlenW (lpString=".jpg") returned 4
	[0179.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.922] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.922] lstrlenW (lpString="J0153518.WMF") returned 12
	[0179.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0179.923] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=12528) returned 1
	[0179.923] CloseHandle (hObject=0x54c) returned 1
	[0179.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 0x220
	[0179.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0179.923] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.923] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0179.924] GetLastError () returned 0x0
	[0179.924] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x30f0, lpOverlapped=0x0) returned 1
	[0180.325] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x3100, lpOverlapped=0x0) returned 1
	[0180.326] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.326] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.327] SetEndOfFile (hFile=0x530) returned 1
	[0180.327] CloseHandle (hObject=0x530) returned 1
	[0180.327] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.327] SetEndOfFile (hFile=0x54c) returned 1
	[0180.330] CloseHandle (hObject=0x54c) returned 1
	[0180.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 1
	[0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.333] lstrlenW (lpString=".doc") returned 4
	[0180.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString=".docx") returned 5
	[0180.333] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0180.333] lstrlenW (lpString=".pdf") returned 4
	[0180.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString=".xls") returned 4
	[0180.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.333] lstrlenW (lpString=".xlsx") returned 5
	[0180.333] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0180.333] lstrlenW (lpString=".ppt") returned 4
	[0180.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.333] lstrlenW (lpString=".zip") returned 4
	[0180.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.333] lstrlenW (lpString=".rar") returned 4
	[0180.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString=".bz2") returned 4
	[0180.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString=".7z") returned 3
	[0180.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.334] lstrlenW (lpString=".dbf") returned 4
	[0180.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.334] lstrlenW (lpString=".1cd") returned 4
	[0180.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.334] lstrlenW (lpString=".jpg") returned 4
	[0180.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.334] lstrlenW (lpString=".doc") returned 4
	[0180.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.334] lstrlenW (lpString=".docx") returned 5
	[0180.334] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0180.334] lstrlenW (lpString=".pdf") returned 4
	[0180.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.334] lstrlenW (lpString=".xls") returned 4
	[0180.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.334] lstrlenW (lpString=".xlsx") returned 5
	[0180.334] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0180.334] lstrlenW (lpString=".ppt") returned 4
	[0180.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.334] lstrlenW (lpString=".zip") returned 4
	[0180.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.334] lstrlenW (lpString=".rar") returned 4
	[0180.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.334] lstrlenW (lpString=".bz2") returned 4
	[0180.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.335] lstrlenW (lpString=".7z") returned 3
	[0180.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.335] lstrlenW (lpString=".dbf") returned 4
	[0180.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.335] lstrlenW (lpString=".1cd") returned 4
	[0180.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68
	[0180.335] lstrlenW (lpString=".jpg") returned 4
	[0180.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.335] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0180.335] lstrlenW (lpString="J0158477.WMF") returned 12
	[0180.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0180.337] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=17966) returned 1
	[0180.337] CloseHandle (hObject=0x54c) returned 1
	[0180.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 0x220
	[0180.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0180.337] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.337] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0180.338] GetLastError () returned 0x0
	[0180.338] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x462e, lpOverlapped=0x0) returned 1
	[0180.340] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4630, lpOverlapped=0x0) returned 1
	[0180.341] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.341] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.342] SetEndOfFile (hFile=0x530) returned 1
	[0180.342] CloseHandle (hObject=0x530) returned 1
	[0180.342] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.342] SetEndOfFile (hFile=0x54c) returned 1
	[0180.344] CloseHandle (hObject=0x54c) returned 1
	[0180.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 1
	[0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.346] lstrlenW (lpString=".doc") returned 4
	[0180.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString=".docx") returned 5
	[0180.346] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0180.346] lstrlenW (lpString=".pdf") returned 4
	[0180.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString=".xls") returned 4
	[0180.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.346] lstrlenW (lpString=".xlsx") returned 5
	[0180.346] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0180.346] lstrlenW (lpString=".ppt") returned 4
	[0180.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.346] lstrlenW (lpString=".zip") returned 4
	[0180.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.346] lstrlenW (lpString=".rar") returned 4
	[0180.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString=".bz2") returned 4
	[0180.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.347] lstrlenW (lpString=".7z") returned 3
	[0180.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.347] lstrlenW (lpString=".dbf") returned 4
	[0180.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.347] lstrlenW (lpString=".1cd") returned 4
	[0180.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.347] lstrlenW (lpString=".jpg") returned 4
	[0180.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.347] lstrlenW (lpString=".doc") returned 4
	[0180.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.347] lstrlenW (lpString=".docx") returned 5
	[0180.347] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0180.347] lstrlenW (lpString=".pdf") returned 4
	[0180.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.347] lstrlenW (lpString=".xls") returned 4
	[0180.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.347] lstrlenW (lpString=".xlsx") returned 5
	[0180.347] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0180.347] lstrlenW (lpString=".ppt") returned 4
	[0180.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.347] lstrlenW (lpString=".zip") returned 4
	[0180.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.347] lstrlenW (lpString=".rar") returned 4
	[0180.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.347] lstrlenW (lpString=".bz2") returned 4
	[0180.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.348] lstrlenW (lpString=".7z") returned 3
	[0180.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.348] lstrlenW (lpString=".dbf") returned 4
	[0180.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.348] lstrlenW (lpString=".1cd") returned 4
	[0180.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68
	[0180.348] lstrlenW (lpString=".jpg") returned 4
	[0180.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.348] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0180.348] lstrlenW (lpString="J0160590.WMF") returned 12
	[0180.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0180.349] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=29406) returned 1
	[0180.349] CloseHandle (hObject=0x54c) returned 1
	[0180.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 0x220
	[0180.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0180.350] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.350] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0180.351] GetLastError () returned 0x0
	[0180.351] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x72de, lpOverlapped=0x0) returned 1
	[0180.353] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x72e0, lpOverlapped=0x0) returned 1
	[0180.354] ReadFile (in: hFile=0x54c, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.354] WriteFile (in: hFile=0x530, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.355] SetEndOfFile (hFile=0x530) returned 1
	[0180.355] CloseHandle (hObject=0x530) returned 1
	[0180.355] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.355] SetEndOfFile (hFile=0x54c) returned 1
	[0180.357] CloseHandle (hObject=0x54c) returned 1
	[0180.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 1
	[0180.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.358] lstrlenW (lpString=".doc") returned 4
	[0180.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.359] lstrlenW (lpString=".docx") returned 5
	[0180.359] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0180.359] lstrlenW (lpString=".pdf") returned 4
	[0180.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.359] lstrlenW (lpString=".xls") returned 4
	[0180.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.359] lstrlenW (lpString=".xlsx") returned 5
	[0180.359] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0180.359] lstrlenW (lpString=".ppt") returned 4
	[0180.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.359] lstrlenW (lpString=".zip") returned 4
	[0180.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.359] lstrlenW (lpString=".rar") returned 4
	[0180.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.359] lstrlenW (lpString=".bz2") returned 4
	[0180.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.359] lstrlenW (lpString=".7z") returned 3
	[0180.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.359] lstrlenW (lpString=".dbf") returned 4
	[0180.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.359] lstrlenW (lpString=".1cd") returned 4
	[0180.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.359] lstrlenW (lpString=".jpg") returned 4
	[0180.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.360] lstrlenW (lpString=".doc") returned 4
	[0180.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.360] lstrlenW (lpString=".docx") returned 5
	[0180.360] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0180.360] lstrlenW (lpString=".pdf") returned 4
	[0180.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.360] lstrlenW (lpString=".xls") returned 4
	[0180.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.360] lstrlenW (lpString=".xlsx") returned 5
	[0180.360] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0180.360] lstrlenW (lpString=".ppt") returned 4
	[0180.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.360] lstrlenW (lpString=".zip") returned 4
	[0180.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.360] lstrlenW (lpString=".rar") returned 4
	[0180.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.360] lstrlenW (lpString=".bz2") returned 4
	[0180.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.360] lstrlenW (lpString=".7z") returned 3
	[0180.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.360] lstrlenW (lpString=".dbf") returned 4
	[0180.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.360] lstrlenW (lpString=".1cd") returned 4
	[0180.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68
	[0180.360] lstrlenW (lpString=".jpg") returned 4
	[0180.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.361] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0180.361] lstrlenW (lpString="J0164153.JPG") returned 12
	[0180.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0180.533] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=46484) returned 1
	[0180.533] CloseHandle (hObject=0x534) returned 1
	[0180.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 0x220
	[0180.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0181.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0182.639] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.639] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0183.039] GetLastError () returned 0x0
	[0183.039] ReadFile (in: hFile=0x548, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xb594, lpOverlapped=0x0) returned 1
	[0183.042] WriteFile (in: hFile=0x534, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xb5a0, lpOverlapped=0x0) returned 1
	[0183.047] ReadFile (in: hFile=0x548, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.047] WriteFile (in: hFile=0x534, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.047] SetEndOfFile (hFile=0x534) returned 1
	[0183.047] CloseHandle (hObject=0x534) returned 1
	[0183.047] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.047] SetEndOfFile (hFile=0x548) returned 1
	[0183.050] CloseHandle (hObject=0x548) returned 1
	[0183.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 1
	[0183.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.052] lstrlenW (lpString=".doc") returned 4
	[0183.052] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.052] lstrlenW (lpString=".docx") returned 5
	[0183.052] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0183.052] lstrlenW (lpString=".pdf") returned 4
	[0183.052] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.052] lstrlenW (lpString=".xls") returned 4
	[0183.052] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.052] lstrlenW (lpString=".xlsx") returned 5
	[0183.052] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0183.052] lstrlenW (lpString=".ppt") returned 4
	[0183.052] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.052] lstrlenW (lpString=".zip") returned 4
	[0183.052] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.052] lstrlenW (lpString=".rar") returned 4
	[0183.052] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.052] lstrlenW (lpString=".bz2") returned 4
	[0183.052] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.052] lstrlenW (lpString=".7z") returned 3
	[0183.052] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.052] lstrlenW (lpString=".dbf") returned 4
	[0183.052] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.052] lstrlenW (lpString=".1cd") returned 4
	[0183.052] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.052] lstrlenW (lpString=".jpg") returned 4
	[0183.052] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.053] lstrlenW (lpString=".doc") returned 4
	[0183.053] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.053] lstrlenW (lpString=".docx") returned 5
	[0183.053] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0183.053] lstrlenW (lpString=".pdf") returned 4
	[0183.053] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.053] lstrlenW (lpString=".xls") returned 4
	[0183.053] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.053] lstrlenW (lpString=".xlsx") returned 5
	[0183.053] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0183.053] lstrlenW (lpString=".ppt") returned 4
	[0183.053] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.053] lstrlenW (lpString=".zip") returned 4
	[0183.053] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.053] lstrlenW (lpString=".rar") returned 4
	[0183.053] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.053] lstrlenW (lpString=".bz2") returned 4
	[0183.053] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.053] lstrlenW (lpString=".7z") returned 3
	[0183.053] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.053] lstrlenW (lpString=".dbf") returned 4
	[0183.053] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.053] lstrlenW (lpString=".1cd") returned 4
	[0183.053] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68
	[0183.054] lstrlenW (lpString=".jpg") returned 4
	[0183.054] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.054] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0183.054] lstrlenW (lpString="J0182902.WMF") returned 12
	[0183.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0183.055] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=7822) returned 1
	[0183.055] CloseHandle (hObject=0x548) returned 1
	[0183.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 0x220
	[0183.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0183.056] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.056] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0183.056] GetLastError () returned 0x0
	[0183.056] ReadFile (in: hFile=0x548, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1e8e, lpOverlapped=0x0) returned 1
	[0183.058] WriteFile (in: hFile=0x534, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1e90, lpOverlapped=0x0) returned 1
	[0183.059] ReadFile (in: hFile=0x548, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.059] WriteFile (in: hFile=0x534, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.059] SetEndOfFile (hFile=0x534) returned 1
	[0183.059] CloseHandle (hObject=0x534) returned 1
	[0183.060] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.060] SetEndOfFile (hFile=0x548) returned 1
	[0183.062] CloseHandle (hObject=0x548) returned 1
	[0183.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 1
	[0183.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.063] lstrlenW (lpString=".doc") returned 4
	[0183.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.063] lstrlenW (lpString=".docx") returned 5
	[0183.063] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0183.063] lstrlenW (lpString=".pdf") returned 4
	[0183.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.063] lstrlenW (lpString=".xls") returned 4
	[0183.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.063] lstrlenW (lpString=".xlsx") returned 5
	[0183.063] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0183.063] lstrlenW (lpString=".ppt") returned 4
	[0183.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.063] lstrlenW (lpString=".zip") returned 4
	[0183.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.063] lstrlenW (lpString=".rar") returned 4
	[0183.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.063] lstrlenW (lpString=".bz2") returned 4
	[0183.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.063] lstrlenW (lpString=".7z") returned 3
	[0183.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.064] lstrlenW (lpString=".dbf") returned 4
	[0183.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.064] lstrlenW (lpString=".1cd") returned 4
	[0183.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.064] lstrlenW (lpString=".jpg") returned 4
	[0183.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.064] lstrlenW (lpString=".doc") returned 4
	[0183.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.064] lstrlenW (lpString=".docx") returned 5
	[0183.064] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0183.064] lstrlenW (lpString=".pdf") returned 4
	[0183.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.064] lstrlenW (lpString=".xls") returned 4
	[0183.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.064] lstrlenW (lpString=".xlsx") returned 5
	[0183.064] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0183.064] lstrlenW (lpString=".ppt") returned 4
	[0183.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.064] lstrlenW (lpString=".zip") returned 4
	[0183.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.064] lstrlenW (lpString=".rar") returned 4
	[0183.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.064] lstrlenW (lpString=".bz2") returned 4
	[0183.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.065] lstrlenW (lpString=".7z") returned 3
	[0183.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.065] lstrlenW (lpString=".dbf") returned 4
	[0183.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.065] lstrlenW (lpString=".1cd") returned 4
	[0183.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68
	[0183.065] lstrlenW (lpString=".jpg") returned 4
	[0183.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.065] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0183.065] lstrlenW (lpString="J0182946.WMF") returned 12
	[0183.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0183.066] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=16082) returned 1
	[0183.066] CloseHandle (hObject=0x548) returned 1
	[0183.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf")) returned 0x220
	[0183.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0183.066] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.066] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0183.067] GetLastError () returned 0x0
	[0183.067] ReadFile (in: hFile=0x548, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x3ed2, lpOverlapped=0x0) returned 1
	[0183.069] WriteFile (in: hFile=0x534, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x3ee0, lpOverlapped=0x0) returned 1
	[0183.070] ReadFile (in: hFile=0x548, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.070] WriteFile (in: hFile=0x534, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.071] SetEndOfFile (hFile=0x534) returned 1
	[0183.071] CloseHandle (hObject=0x534) returned 1
	[0183.071] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.071] SetEndOfFile (hFile=0x548) returned 1
	[0183.074] CloseHandle (hObject=0x548) returned 1
	[0183.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf")) returned 1
	[0183.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.075] lstrlenW (lpString=".doc") returned 4
	[0183.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.075] lstrlenW (lpString=".docx") returned 5
	[0183.075] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0183.075] lstrlenW (lpString=".pdf") returned 4
	[0183.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.075] lstrlenW (lpString=".xls") returned 4
	[0183.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.075] lstrlenW (lpString=".xlsx") returned 5
	[0183.075] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0183.075] lstrlenW (lpString=".ppt") returned 4
	[0183.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.076] lstrlenW (lpString=".zip") returned 4
	[0183.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.076] lstrlenW (lpString=".rar") returned 4
	[0183.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.076] lstrlenW (lpString=".bz2") returned 4
	[0183.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.076] lstrlenW (lpString=".7z") returned 3
	[0183.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.076] lstrlenW (lpString=".dbf") returned 4
	[0183.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.076] lstrlenW (lpString=".1cd") returned 4
	[0183.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.076] lstrlenW (lpString=".jpg") returned 4
	[0183.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.076] lstrlenW (lpString=".doc") returned 4
	[0183.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.076] lstrlenW (lpString=".docx") returned 5
	[0183.076] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0183.076] lstrlenW (lpString=".pdf") returned 4
	[0183.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.076] lstrlenW (lpString=".xls") returned 4
	[0183.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.076] lstrlenW (lpString=".xlsx") returned 5
	[0183.077] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0183.077] lstrlenW (lpString=".ppt") returned 4
	[0183.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.077] lstrlenW (lpString=".zip") returned 4
	[0183.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.077] lstrlenW (lpString=".rar") returned 4
	[0183.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.077] lstrlenW (lpString=".bz2") returned 4
	[0183.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.077] lstrlenW (lpString=".7z") returned 3
	[0183.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.077] lstrlenW (lpString=".dbf") returned 4
	[0183.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.077] lstrlenW (lpString=".1cd") returned 4
	[0183.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68
	[0183.077] lstrlenW (lpString=".jpg") returned 4
	[0183.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.077] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0183.078] lstrlenW (lpString="J0183172.WMF") returned 12
	[0183.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.392] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=29788) returned 1
	[0183.392] CloseHandle (hObject=0x514) returned 1
	[0183.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 0x220
	[0183.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.842] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.843] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0184.086] GetLastError () returned 0x0
	[0184.094] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x745c, lpOverlapped=0x0) returned 1
	[0184.104] WriteFile (in: hFile=0x550, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x7460, lpOverlapped=0x0) returned 1
	[0184.105] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.105] WriteFile (in: hFile=0x550, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.106] SetEndOfFile (hFile=0x550) returned 1
	[0184.106] CloseHandle (hObject=0x550) returned 1
	[0184.106] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.106] SetEndOfFile (hFile=0x370) returned 1
	[0184.109] CloseHandle (hObject=0x370) returned 1
	[0184.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 1
	[0184.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.110] lstrlenW (lpString=".doc") returned 4
	[0184.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.110] lstrlenW (lpString=".docx") returned 5
	[0184.110] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0184.110] lstrlenW (lpString=".pdf") returned 4
	[0184.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.110] lstrlenW (lpString=".xls") returned 4
	[0184.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.110] lstrlenW (lpString=".xlsx") returned 5
	[0184.110] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0184.110] lstrlenW (lpString=".ppt") returned 4
	[0184.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.110] lstrlenW (lpString=".zip") returned 4
	[0184.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.110] lstrlenW (lpString=".rar") returned 4
	[0184.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.110] lstrlenW (lpString=".bz2") returned 4
	[0184.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString=".7z") returned 3
	[0184.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.111] lstrlenW (lpString=".dbf") returned 4
	[0184.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.111] lstrlenW (lpString=".1cd") returned 4
	[0184.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.111] lstrlenW (lpString=".jpg") returned 4
	[0184.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.111] lstrlenW (lpString=".doc") returned 4
	[0184.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString=".docx") returned 5
	[0184.111] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0184.111] lstrlenW (lpString=".pdf") returned 4
	[0184.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString=".xls") returned 4
	[0184.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.111] lstrlenW (lpString=".xlsx") returned 5
	[0184.111] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0184.111] lstrlenW (lpString=".ppt") returned 4
	[0184.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.111] lstrlenW (lpString=".zip") returned 4
	[0184.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.111] lstrlenW (lpString=".rar") returned 4
	[0184.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString=".bz2") returned 4
	[0184.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.112] lstrlenW (lpString=".7z") returned 3
	[0184.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.112] lstrlenW (lpString=".dbf") returned 4
	[0184.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.112] lstrlenW (lpString=".1cd") returned 4
	[0184.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68
	[0184.112] lstrlenW (lpString=".jpg") returned 4
	[0184.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.112] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0184.112] lstrlenW (lpString="J0185778.WMF") returned 12
	[0184.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0184.113] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=25312) returned 1
	[0184.113] CloseHandle (hObject=0x370) returned 1
	[0184.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf")) returned 0x220
	[0184.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0184.113] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.114] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0184.114] GetLastError () returned 0x0
	[0184.114] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x62e0, lpOverlapped=0x0) returned 1
	[0184.116] WriteFile (in: hFile=0x550, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x62f0, lpOverlapped=0x0) returned 1
	[0184.117] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.118] WriteFile (in: hFile=0x550, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.118] SetEndOfFile (hFile=0x550) returned 1
	[0184.118] CloseHandle (hObject=0x550) returned 1
	[0184.118] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.118] SetEndOfFile (hFile=0x370) returned 1
	[0184.121] CloseHandle (hObject=0x370) returned 1
	[0184.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf")) returned 1
	[0184.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.122] lstrlenW (lpString=".doc") returned 4
	[0184.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.122] lstrlenW (lpString=".docx") returned 5
	[0184.122] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0184.122] lstrlenW (lpString=".pdf") returned 4
	[0184.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.122] lstrlenW (lpString=".xls") returned 4
	[0184.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.122] lstrlenW (lpString=".xlsx") returned 5
	[0184.122] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0184.122] lstrlenW (lpString=".ppt") returned 4
	[0184.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.122] lstrlenW (lpString=".zip") returned 4
	[0184.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.122] lstrlenW (lpString=".rar") returned 4
	[0184.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString=".bz2") returned 4
	[0184.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString=".7z") returned 3
	[0184.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.123] lstrlenW (lpString=".dbf") returned 4
	[0184.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.123] lstrlenW (lpString=".1cd") returned 4
	[0184.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.123] lstrlenW (lpString=".jpg") returned 4
	[0184.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.123] lstrlenW (lpString=".doc") returned 4
	[0184.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString=".docx") returned 5
	[0184.123] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0184.124] lstrlenW (lpString=".pdf") returned 4
	[0184.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.124] lstrlenW (lpString=".xls") returned 4
	[0184.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.125] lstrlenW (lpString=".xlsx") returned 5
	[0184.125] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0184.125] lstrlenW (lpString=".ppt") returned 4
	[0184.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.125] lstrlenW (lpString=".zip") returned 4
	[0184.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.125] lstrlenW (lpString=".rar") returned 4
	[0184.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.125] lstrlenW (lpString=".bz2") returned 4
	[0184.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.125] lstrlenW (lpString=".7z") returned 3
	[0184.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.125] lstrlenW (lpString=".dbf") returned 4
	[0184.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.125] lstrlenW (lpString=".1cd") returned 4
	[0184.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68
	[0184.125] lstrlenW (lpString=".jpg") returned 4
	[0184.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.125] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0184.125] lstrlenW (lpString="J0185780.WMF") returned 12
	[0184.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0184.127] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=59734) returned 1
	[0184.127] CloseHandle (hObject=0x370) returned 1
	[0184.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 0x220
	[0184.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0184.127] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.127] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0184.128] GetLastError () returned 0x0
	[0184.128] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xe956, lpOverlapped=0x0) returned 1
	[0184.131] WriteFile (in: hFile=0x550, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xe960, lpOverlapped=0x0) returned 1
	[0184.133] ReadFile (in: hFile=0x370, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.133] WriteFile (in: hFile=0x550, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.133] SetEndOfFile (hFile=0x550) returned 1
	[0184.133] CloseHandle (hObject=0x550) returned 1
	[0184.133] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.133] SetEndOfFile (hFile=0x370) returned 1
	[0184.578] CloseHandle (hObject=0x370) returned 1
	[0184.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 1
	[0185.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.467] lstrlenW (lpString=".doc") returned 4
	[0185.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0185.467] lstrlenW (lpString=".docx") returned 5
	[0185.467] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0185.467] lstrlenW (lpString=".pdf") returned 4
	[0185.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0185.467] lstrlenW (lpString=".xls") returned 4
	[0185.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0185.467] lstrlenW (lpString=".xlsx") returned 5
	[0185.467] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0185.467] lstrlenW (lpString=".ppt") returned 4
	[0185.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0185.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.467] lstrlenW (lpString=".zip") returned 4
	[0185.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0185.467] lstrlenW (lpString=".rar") returned 4
	[0185.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0185.467] lstrlenW (lpString=".bz2") returned 4
	[0185.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0185.467] lstrlenW (lpString=".7z") returned 3
	[0185.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0185.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.468] lstrlenW (lpString=".dbf") returned 4
	[0185.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0185.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.468] lstrlenW (lpString=".1cd") returned 4
	[0185.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0185.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.468] lstrlenW (lpString=".jpg") returned 4
	[0185.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0185.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.468] lstrlenW (lpString=".doc") returned 4
	[0185.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0185.468] lstrlenW (lpString=".docx") returned 5
	[0185.468] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0185.468] lstrlenW (lpString=".pdf") returned 4
	[0185.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0185.468] lstrlenW (lpString=".xls") returned 4
	[0185.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0185.468] lstrlenW (lpString=".xlsx") returned 5
	[0185.468] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0185.468] lstrlenW (lpString=".ppt") returned 4
	[0185.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0185.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.468] lstrlenW (lpString=".zip") returned 4
	[0185.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0185.468] lstrlenW (lpString=".rar") returned 4
	[0185.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0185.468] lstrlenW (lpString=".bz2") returned 4
	[0185.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0185.469] lstrlenW (lpString=".7z") returned 3
	[0185.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0185.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.469] lstrlenW (lpString=".dbf") returned 4
	[0185.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0185.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.469] lstrlenW (lpString=".1cd") returned 4
	[0185.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0185.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68
	[0185.469] lstrlenW (lpString=".jpg") returned 4
	[0185.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0185.469] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0185.469] lstrlenW (lpString="J0185806.WMF") returned 12
	[0185.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0185.966] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=30522) returned 1
	[0185.967] CloseHandle (hObject=0x290) returned 1
	[0185.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 0x220
	[0185.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0185.970] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.971] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0185.972] GetLastError () returned 0x0
	[0185.972] ReadFile (in: hFile=0x290, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x773a, lpOverlapped=0x0) returned 1
	[0185.974] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x7740, lpOverlapped=0x0) returned 1
	[0185.975] ReadFile (in: hFile=0x290, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.975] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0185.975] SetEndOfFile (hFile=0x3e8) returned 1
	[0185.975] CloseHandle (hObject=0x3e8) returned 1
	[0185.976] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.976] SetEndOfFile (hFile=0x290) returned 1
	[0185.978] CloseHandle (hObject=0x290) returned 1
	[0185.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 1
	[0185.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.980] lstrlenW (lpString=".doc") returned 4
	[0185.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0185.980] lstrlenW (lpString=".docx") returned 5
	[0185.980] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0185.980] lstrlenW (lpString=".pdf") returned 4
	[0185.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0185.980] lstrlenW (lpString=".xls") returned 4
	[0185.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0185.980] lstrlenW (lpString=".xlsx") returned 5
	[0185.980] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0185.980] lstrlenW (lpString=".ppt") returned 4
	[0185.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0185.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.980] lstrlenW (lpString=".zip") returned 4
	[0185.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0185.980] lstrlenW (lpString=".rar") returned 4
	[0185.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0185.980] lstrlenW (lpString=".bz2") returned 4
	[0185.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0185.980] lstrlenW (lpString=".7z") returned 3
	[0185.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0185.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.980] lstrlenW (lpString=".dbf") returned 4
	[0185.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0185.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.980] lstrlenW (lpString=".1cd") returned 4
	[0185.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0185.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.981] lstrlenW (lpString=".jpg") returned 4
	[0185.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0185.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.981] lstrlenW (lpString=".doc") returned 4
	[0185.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0185.981] lstrlenW (lpString=".docx") returned 5
	[0185.981] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0185.981] lstrlenW (lpString=".pdf") returned 4
	[0185.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0185.981] lstrlenW (lpString=".xls") returned 4
	[0185.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0185.981] lstrlenW (lpString=".xlsx") returned 5
	[0185.981] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0185.981] lstrlenW (lpString=".ppt") returned 4
	[0185.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0185.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.981] lstrlenW (lpString=".zip") returned 4
	[0185.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0185.981] lstrlenW (lpString=".rar") returned 4
	[0185.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0185.981] lstrlenW (lpString=".bz2") returned 4
	[0185.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0185.981] lstrlenW (lpString=".7z") returned 3
	[0185.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0185.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.981] lstrlenW (lpString=".dbf") returned 4
	[0185.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0185.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.981] lstrlenW (lpString=".1cd") returned 4
	[0185.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0185.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68
	[0185.982] lstrlenW (lpString=".jpg") returned 4
	[0185.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0185.982] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0185.982] lstrlenW (lpString="J0185828.WMF") returned 12
	[0185.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0185.983] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=7796) returned 1
	[0185.983] CloseHandle (hObject=0x3e8) returned 1
	[0185.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 0x220
	[0185.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0185.984] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.984] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0185.984] GetLastError () returned 0x0
	[0185.984] ReadFile (in: hFile=0x3e8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1e74, lpOverlapped=0x0) returned 1
	[0185.986] WriteFile (in: hFile=0x504, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1e80, lpOverlapped=0x0) returned 1
	[0185.987] ReadFile (in: hFile=0x3e8, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.987] WriteFile (in: hFile=0x504, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0185.987] SetEndOfFile (hFile=0x504) returned 1
	[0185.987] CloseHandle (hObject=0x504) returned 1
	[0185.987] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.987] SetEndOfFile (hFile=0x3e8) returned 1
	[0185.989] CloseHandle (hObject=0x3e8) returned 1
	[0185.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 1
	[0185.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.991] lstrlenW (lpString=".doc") returned 4
	[0185.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0185.991] lstrlenW (lpString=".docx") returned 5
	[0185.991] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0185.991] lstrlenW (lpString=".pdf") returned 4
	[0185.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0185.991] lstrlenW (lpString=".xls") returned 4
	[0185.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0185.991] lstrlenW (lpString=".xlsx") returned 5
	[0185.991] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0185.991] lstrlenW (lpString=".ppt") returned 4
	[0185.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0185.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.991] lstrlenW (lpString=".zip") returned 4
	[0185.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0185.991] lstrlenW (lpString=".rar") returned 4
	[0185.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0185.991] lstrlenW (lpString=".bz2") returned 4
	[0185.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0185.991] lstrlenW (lpString=".7z") returned 3
	[0185.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0185.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.991] lstrlenW (lpString=".dbf") returned 4
	[0185.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0185.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.991] lstrlenW (lpString=".1cd") returned 4
	[0185.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0185.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.991] lstrlenW (lpString=".jpg") returned 4
	[0185.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0185.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.992] lstrlenW (lpString=".doc") returned 4
	[0185.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0185.992] lstrlenW (lpString=".docx") returned 5
	[0185.992] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0185.992] lstrlenW (lpString=".pdf") returned 4
	[0185.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0185.992] lstrlenW (lpString=".xls") returned 4
	[0185.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0185.992] lstrlenW (lpString=".xlsx") returned 5
	[0185.992] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0185.992] lstrlenW (lpString=".ppt") returned 4
	[0185.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0185.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.992] lstrlenW (lpString=".zip") returned 4
	[0185.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0185.992] lstrlenW (lpString=".rar") returned 4
	[0185.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0185.992] lstrlenW (lpString=".bz2") returned 4
	[0185.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0185.992] lstrlenW (lpString=".7z") returned 3
	[0185.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0185.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.992] lstrlenW (lpString=".dbf") returned 4
	[0185.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0185.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.992] lstrlenW (lpString=".1cd") returned 4
	[0185.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0185.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68
	[0185.992] lstrlenW (lpString=".jpg") returned 4
	[0185.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0185.993] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0185.993] lstrlenW (lpString="J0185834.WMF") returned 12
	[0185.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0185.994] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=8578) returned 1
	[0185.994] CloseHandle (hObject=0x504) returned 1
	[0185.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 0x220
	[0185.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0185.994] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.994] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0185.995] GetLastError () returned 0x0
	[0185.995] ReadFile (in: hFile=0x504, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2182, lpOverlapped=0x0) returned 1
	[0185.997] WriteFile (in: hFile=0x290, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2190, lpOverlapped=0x0) returned 1
	[0185.998] ReadFile (in: hFile=0x504, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.998] WriteFile (in: hFile=0x290, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0185.998] SetEndOfFile (hFile=0x290) returned 1
	[0185.998] CloseHandle (hObject=0x290) returned 1
	[0185.998] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.998] SetEndOfFile (hFile=0x504) returned 1
	[0186.001] CloseHandle (hObject=0x504) returned 1
	[0186.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 1
	[0186.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.002] lstrlenW (lpString=".doc") returned 4
	[0186.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.002] lstrlenW (lpString=".docx") returned 5
	[0186.002] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0186.002] lstrlenW (lpString=".pdf") returned 4
	[0186.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.002] lstrlenW (lpString=".xls") returned 4
	[0186.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.002] lstrlenW (lpString=".xlsx") returned 5
	[0186.002] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0186.002] lstrlenW (lpString=".ppt") returned 4
	[0186.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.002] lstrlenW (lpString=".zip") returned 4
	[0186.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.003] lstrlenW (lpString=".rar") returned 4
	[0186.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.003] lstrlenW (lpString=".bz2") returned 4
	[0186.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.003] lstrlenW (lpString=".7z") returned 3
	[0186.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.003] lstrlenW (lpString=".dbf") returned 4
	[0186.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.003] lstrlenW (lpString=".1cd") returned 4
	[0186.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.003] lstrlenW (lpString=".jpg") returned 4
	[0186.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.003] lstrlenW (lpString=".doc") returned 4
	[0186.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.003] lstrlenW (lpString=".docx") returned 5
	[0186.003] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0186.003] lstrlenW (lpString=".pdf") returned 4
	[0186.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.003] lstrlenW (lpString=".xls") returned 4
	[0186.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.003] lstrlenW (lpString=".xlsx") returned 5
	[0186.003] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0186.003] lstrlenW (lpString=".ppt") returned 4
	[0186.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.003] lstrlenW (lpString=".zip") returned 4
	[0186.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.004] lstrlenW (lpString=".rar") returned 4
	[0186.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.004] lstrlenW (lpString=".bz2") returned 4
	[0186.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.004] lstrlenW (lpString=".7z") returned 3
	[0186.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.004] lstrlenW (lpString=".dbf") returned 4
	[0186.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.004] lstrlenW (lpString=".1cd") returned 4
	[0186.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68
	[0186.004] lstrlenW (lpString=".jpg") returned 4
	[0186.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.004] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0186.004] lstrlenW (lpString="J0185842.WMF") returned 12
	[0186.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0186.396] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=14308) returned 1
	[0186.397] CloseHandle (hObject=0x324) returned 1
	[0186.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 0x220
	[0186.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0186.883] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.883] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0186.884] GetLastError () returned 0x0
	[0186.884] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x37e4, lpOverlapped=0x0) returned 1
	[0186.885] WriteFile (in: hFile=0x538, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x37f0, lpOverlapped=0x0) returned 1
	[0186.887] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.887] WriteFile (in: hFile=0x538, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.887] SetEndOfFile (hFile=0x538) returned 1
	[0186.887] CloseHandle (hObject=0x538) returned 1
	[0186.887] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.887] SetEndOfFile (hFile=0x328) returned 1
	[0186.890] CloseHandle (hObject=0x328) returned 1
	[0186.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 1
	[0186.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.891] lstrlenW (lpString=".doc") returned 4
	[0186.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.891] lstrlenW (lpString=".docx") returned 5
	[0186.891] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0186.891] lstrlenW (lpString=".pdf") returned 4
	[0186.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.891] lstrlenW (lpString=".xls") returned 4
	[0186.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.891] lstrlenW (lpString=".xlsx") returned 5
	[0186.891] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0186.891] lstrlenW (lpString=".ppt") returned 4
	[0186.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.891] lstrlenW (lpString=".zip") returned 4
	[0186.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.891] lstrlenW (lpString=".rar") returned 4
	[0186.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.891] lstrlenW (lpString=".bz2") returned 4
	[0186.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.891] lstrlenW (lpString=".7z") returned 3
	[0186.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.891] lstrlenW (lpString=".dbf") returned 4
	[0186.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.891] lstrlenW (lpString=".1cd") returned 4
	[0186.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.891] lstrlenW (lpString=".jpg") returned 4
	[0186.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.892] lstrlenW (lpString=".doc") returned 4
	[0186.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.892] lstrlenW (lpString=".docx") returned 5
	[0186.892] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0186.892] lstrlenW (lpString=".pdf") returned 4
	[0186.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.892] lstrlenW (lpString=".xls") returned 4
	[0186.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.892] lstrlenW (lpString=".xlsx") returned 5
	[0186.892] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0186.892] lstrlenW (lpString=".ppt") returned 4
	[0186.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.892] lstrlenW (lpString=".zip") returned 4
	[0186.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.892] lstrlenW (lpString=".rar") returned 4
	[0186.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.892] lstrlenW (lpString=".bz2") returned 4
	[0186.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.892] lstrlenW (lpString=".7z") returned 3
	[0186.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.892] lstrlenW (lpString=".dbf") returned 4
	[0186.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.892] lstrlenW (lpString=".1cd") returned 4
	[0186.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68
	[0186.892] lstrlenW (lpString=".jpg") returned 4
	[0186.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.893] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0186.893] lstrlenW (lpString="J0186364.WMF") returned 12
	[0186.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0186.893] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=18212) returned 1
	[0186.893] CloseHandle (hObject=0x328) returned 1
	[0186.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 0x220
	[0186.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0186.894] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.894] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0186.895] GetLastError () returned 0x0
	[0186.895] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x4724, lpOverlapped=0x0) returned 1
	[0186.897] WriteFile (in: hFile=0x538, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x4730, lpOverlapped=0x0) returned 1
	[0186.898] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.898] WriteFile (in: hFile=0x538, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.898] SetEndOfFile (hFile=0x538) returned 1
	[0186.898] CloseHandle (hObject=0x538) returned 1
	[0186.898] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.899] SetEndOfFile (hFile=0x328) returned 1
	[0186.902] CloseHandle (hObject=0x328) returned 1
	[0186.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 1
	[0186.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.903] lstrlenW (lpString=".doc") returned 4
	[0186.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.903] lstrlenW (lpString=".docx") returned 5
	[0186.903] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0186.903] lstrlenW (lpString=".pdf") returned 4
	[0186.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.903] lstrlenW (lpString=".xls") returned 4
	[0186.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.903] lstrlenW (lpString=".xlsx") returned 5
	[0186.903] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0186.903] lstrlenW (lpString=".ppt") returned 4
	[0186.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.903] lstrlenW (lpString=".zip") returned 4
	[0186.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.903] lstrlenW (lpString=".rar") returned 4
	[0186.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.903] lstrlenW (lpString=".bz2") returned 4
	[0186.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.904] lstrlenW (lpString=".7z") returned 3
	[0186.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.904] lstrlenW (lpString=".dbf") returned 4
	[0186.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.904] lstrlenW (lpString=".1cd") returned 4
	[0186.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.904] lstrlenW (lpString=".jpg") returned 4
	[0186.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.904] lstrlenW (lpString=".doc") returned 4
	[0186.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.904] lstrlenW (lpString=".docx") returned 5
	[0186.904] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0186.904] lstrlenW (lpString=".pdf") returned 4
	[0186.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.904] lstrlenW (lpString=".xls") returned 4
	[0186.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.904] lstrlenW (lpString=".xlsx") returned 5
	[0186.904] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0186.904] lstrlenW (lpString=".ppt") returned 4
	[0186.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.904] lstrlenW (lpString=".zip") returned 4
	[0186.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.904] lstrlenW (lpString=".rar") returned 4
	[0186.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.905] lstrlenW (lpString=".bz2") returned 4
	[0186.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.905] lstrlenW (lpString=".7z") returned 3
	[0186.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.905] lstrlenW (lpString=".dbf") returned 4
	[0186.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.905] lstrlenW (lpString=".1cd") returned 4
	[0186.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68
	[0186.905] lstrlenW (lpString=".jpg") returned 4
	[0186.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.905] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0186.905] lstrlenW (lpString="J0187647.WMF") returned 12
	[0186.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0186.906] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=6596) returned 1
	[0186.906] CloseHandle (hObject=0x328) returned 1
	[0186.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf")) returned 0x220
	[0186.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0186.906] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.906] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0186.907] GetLastError () returned 0x0
	[0186.907] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x19c4, lpOverlapped=0x0) returned 1
	[0186.909] WriteFile (in: hFile=0x538, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x19d0, lpOverlapped=0x0) returned 1
	[0186.910] ReadFile (in: hFile=0x328, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.910] WriteFile (in: hFile=0x538, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.910] SetEndOfFile (hFile=0x538) returned 1
	[0186.910] CloseHandle (hObject=0x538) returned 1
	[0186.910] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.910] SetEndOfFile (hFile=0x328) returned 1
	[0186.913] CloseHandle (hObject=0x328) returned 1
	[0186.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf")) returned 1
	[0186.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.914] lstrlenW (lpString=".doc") returned 4
	[0186.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.914] lstrlenW (lpString=".docx") returned 5
	[0186.914] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0186.914] lstrlenW (lpString=".pdf") returned 4
	[0186.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.914] lstrlenW (lpString=".xls") returned 4
	[0186.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.914] lstrlenW (lpString=".xlsx") returned 5
	[0186.914] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0186.914] lstrlenW (lpString=".ppt") returned 4
	[0186.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.914] lstrlenW (lpString=".zip") returned 4
	[0186.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.914] lstrlenW (lpString=".rar") returned 4
	[0186.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.914] lstrlenW (lpString=".bz2") returned 4
	[0186.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.914] lstrlenW (lpString=".7z") returned 3
	[0186.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.914] lstrlenW (lpString=".dbf") returned 4
	[0186.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.914] lstrlenW (lpString=".1cd") returned 4
	[0186.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.915] lstrlenW (lpString=".jpg") returned 4
	[0186.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.915] lstrlenW (lpString=".doc") returned 4
	[0186.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.915] lstrlenW (lpString=".docx") returned 5
	[0186.915] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0186.915] lstrlenW (lpString=".pdf") returned 4
	[0186.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.915] lstrlenW (lpString=".xls") returned 4
	[0186.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.915] lstrlenW (lpString=".xlsx") returned 5
	[0186.915] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0186.915] lstrlenW (lpString=".ppt") returned 4
	[0186.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.915] lstrlenW (lpString=".zip") returned 4
	[0186.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.915] lstrlenW (lpString=".rar") returned 4
	[0186.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.915] lstrlenW (lpString=".bz2") returned 4
	[0186.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.915] lstrlenW (lpString=".7z") returned 3
	[0186.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.915] lstrlenW (lpString=".dbf") returned 4
	[0186.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.916] lstrlenW (lpString=".1cd") returned 4
	[0186.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68
	[0186.916] lstrlenW (lpString=".jpg") returned 4
	[0186.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.916] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0186.916] lstrlenW (lpString="J0187815.WMF") returned 12
	[0186.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.425] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=5376) returned 1
	[0187.425] CloseHandle (hObject=0x558) returned 1
	[0187.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 0x220
	[0187.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.426] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.426] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.427] GetLastError () returned 0x0
	[0187.427] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1500, lpOverlapped=0x0) returned 1
	[0187.428] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1510, lpOverlapped=0x0) returned 1
	[0187.429] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.429] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.429] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.429] CloseHandle (hObject=0x3e8) returned 1
	[0187.430] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.430] SetEndOfFile (hFile=0x558) returned 1
	[0187.432] CloseHandle (hObject=0x558) returned 1
	[0187.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 1
	[0187.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.434] lstrlenW (lpString=".doc") returned 4
	[0187.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.434] lstrlenW (lpString=".docx") returned 5
	[0187.434] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0187.434] lstrlenW (lpString=".pdf") returned 4
	[0187.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.434] lstrlenW (lpString=".xls") returned 4
	[0187.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.434] lstrlenW (lpString=".xlsx") returned 5
	[0187.434] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0187.434] lstrlenW (lpString=".ppt") returned 4
	[0187.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.434] lstrlenW (lpString=".zip") returned 4
	[0187.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.434] lstrlenW (lpString=".rar") returned 4
	[0187.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.434] lstrlenW (lpString=".bz2") returned 4
	[0187.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.434] lstrlenW (lpString=".7z") returned 3
	[0187.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.434] lstrlenW (lpString=".dbf") returned 4
	[0187.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.434] lstrlenW (lpString=".1cd") returned 4
	[0187.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.434] lstrlenW (lpString=".jpg") returned 4
	[0187.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.435] lstrlenW (lpString=".doc") returned 4
	[0187.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.435] lstrlenW (lpString=".docx") returned 5
	[0187.435] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0187.435] lstrlenW (lpString=".pdf") returned 4
	[0187.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.435] lstrlenW (lpString=".xls") returned 4
	[0187.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.435] lstrlenW (lpString=".xlsx") returned 5
	[0187.435] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0187.435] lstrlenW (lpString=".ppt") returned 4
	[0187.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.435] lstrlenW (lpString=".zip") returned 4
	[0187.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.435] lstrlenW (lpString=".rar") returned 4
	[0187.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.435] lstrlenW (lpString=".bz2") returned 4
	[0187.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.435] lstrlenW (lpString=".7z") returned 3
	[0187.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.435] lstrlenW (lpString=".dbf") returned 4
	[0187.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.435] lstrlenW (lpString=".1cd") returned 4
	[0187.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68
	[0187.436] lstrlenW (lpString=".jpg") returned 4
	[0187.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.436] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.436] lstrlenW (lpString="J0187819.WMF") returned 12
	[0187.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.436] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=10352) returned 1
	[0187.436] CloseHandle (hObject=0x558) returned 1
	[0187.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 0x220
	[0187.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.437] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.437] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.438] GetLastError () returned 0x0
	[0187.438] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2870, lpOverlapped=0x0) returned 1
	[0187.440] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2880, lpOverlapped=0x0) returned 1
	[0187.441] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.441] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.441] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.441] CloseHandle (hObject=0x3e8) returned 1
	[0187.441] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.441] SetEndOfFile (hFile=0x558) returned 1
	[0187.444] CloseHandle (hObject=0x558) returned 1
	[0187.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 1
	[0187.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.445] lstrlenW (lpString=".doc") returned 4
	[0187.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.445] lstrlenW (lpString=".docx") returned 5
	[0187.445] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0187.445] lstrlenW (lpString=".pdf") returned 4
	[0187.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.445] lstrlenW (lpString=".xls") returned 4
	[0187.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.445] lstrlenW (lpString=".xlsx") returned 5
	[0187.445] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0187.445] lstrlenW (lpString=".ppt") returned 4
	[0187.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.445] lstrlenW (lpString=".zip") returned 4
	[0187.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.445] lstrlenW (lpString=".rar") returned 4
	[0187.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.445] lstrlenW (lpString=".bz2") returned 4
	[0187.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.445] lstrlenW (lpString=".7z") returned 3
	[0187.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.446] lstrlenW (lpString=".dbf") returned 4
	[0187.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.446] lstrlenW (lpString=".1cd") returned 4
	[0187.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.446] lstrlenW (lpString=".jpg") returned 4
	[0187.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.446] lstrlenW (lpString=".doc") returned 4
	[0187.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.446] lstrlenW (lpString=".docx") returned 5
	[0187.446] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0187.446] lstrlenW (lpString=".pdf") returned 4
	[0187.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.446] lstrlenW (lpString=".xls") returned 4
	[0187.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.446] lstrlenW (lpString=".xlsx") returned 5
	[0187.446] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0187.446] lstrlenW (lpString=".ppt") returned 4
	[0187.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.446] lstrlenW (lpString=".zip") returned 4
	[0187.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.446] lstrlenW (lpString=".rar") returned 4
	[0187.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.446] lstrlenW (lpString=".bz2") returned 4
	[0187.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.446] lstrlenW (lpString=".7z") returned 3
	[0187.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.447] lstrlenW (lpString=".dbf") returned 4
	[0187.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.447] lstrlenW (lpString=".1cd") returned 4
	[0187.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68
	[0187.447] lstrlenW (lpString=".jpg") returned 4
	[0187.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.447] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.447] lstrlenW (lpString="J0187825.WMF") returned 12
	[0187.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.448] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=7500) returned 1
	[0187.448] CloseHandle (hObject=0x558) returned 1
	[0187.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf")) returned 0x220
	[0187.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.448] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.448] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.449] GetLastError () returned 0x0
	[0187.449] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x1d4c, lpOverlapped=0x0) returned 1
	[0187.451] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x1d50, lpOverlapped=0x0) returned 1
	[0187.452] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.452] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.452] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.452] CloseHandle (hObject=0x3e8) returned 1
	[0187.452] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.452] SetEndOfFile (hFile=0x558) returned 1
	[0187.455] CloseHandle (hObject=0x558) returned 1
	[0187.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf")) returned 1
	[0187.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.456] lstrlenW (lpString=".doc") returned 4
	[0187.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.457] lstrlenW (lpString=".docx") returned 5
	[0187.457] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0187.457] lstrlenW (lpString=".pdf") returned 4
	[0187.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.457] lstrlenW (lpString=".xls") returned 4
	[0187.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.457] lstrlenW (lpString=".xlsx") returned 5
	[0187.457] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0187.457] lstrlenW (lpString=".ppt") returned 4
	[0187.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.457] lstrlenW (lpString=".zip") returned 4
	[0187.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.457] lstrlenW (lpString=".rar") returned 4
	[0187.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.457] lstrlenW (lpString=".bz2") returned 4
	[0187.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.457] lstrlenW (lpString=".7z") returned 3
	[0187.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.457] lstrlenW (lpString=".dbf") returned 4
	[0187.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.457] lstrlenW (lpString=".1cd") returned 4
	[0187.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.457] lstrlenW (lpString=".jpg") returned 4
	[0187.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.458] lstrlenW (lpString=".doc") returned 4
	[0187.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.458] lstrlenW (lpString=".docx") returned 5
	[0187.458] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0187.458] lstrlenW (lpString=".pdf") returned 4
	[0187.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.458] lstrlenW (lpString=".xls") returned 4
	[0187.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.458] lstrlenW (lpString=".xlsx") returned 5
	[0187.458] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0187.458] lstrlenW (lpString=".ppt") returned 4
	[0187.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.458] lstrlenW (lpString=".zip") returned 4
	[0187.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.458] lstrlenW (lpString=".rar") returned 4
	[0187.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.458] lstrlenW (lpString=".bz2") returned 4
	[0187.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.458] lstrlenW (lpString=".7z") returned 3
	[0187.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.458] lstrlenW (lpString=".dbf") returned 4
	[0187.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.458] lstrlenW (lpString=".1cd") returned 4
	[0187.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68
	[0187.458] lstrlenW (lpString=".jpg") returned 4
	[0187.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.459] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.459] lstrlenW (lpString="J0187829.WMF") returned 12
	[0187.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.459] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=12352) returned 1
	[0187.459] CloseHandle (hObject=0x558) returned 1
	[0187.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 0x220
	[0187.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.460] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.460] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.462] GetLastError () returned 0x0
	[0187.462] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x3040, lpOverlapped=0x0) returned 1
	[0187.797] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x3050, lpOverlapped=0x0) returned 1
	[0187.798] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.799] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.799] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.799] CloseHandle (hObject=0x3e8) returned 1
	[0187.799] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.799] SetEndOfFile (hFile=0x558) returned 1
	[0187.801] CloseHandle (hObject=0x558) returned 1
	[0187.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 1
	[0187.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.803] lstrlenW (lpString=".doc") returned 4
	[0187.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.803] lstrlenW (lpString=".docx") returned 5
	[0187.803] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0187.803] lstrlenW (lpString=".pdf") returned 4
	[0187.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.803] lstrlenW (lpString=".xls") returned 4
	[0187.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.803] lstrlenW (lpString=".xlsx") returned 5
	[0187.803] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0187.803] lstrlenW (lpString=".ppt") returned 4
	[0187.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.803] lstrlenW (lpString=".zip") returned 4
	[0187.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.803] lstrlenW (lpString=".rar") returned 4
	[0187.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.803] lstrlenW (lpString=".bz2") returned 4
	[0187.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.803] lstrlenW (lpString=".7z") returned 3
	[0187.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.803] lstrlenW (lpString=".dbf") returned 4
	[0187.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.803] lstrlenW (lpString=".1cd") returned 4
	[0187.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.804] lstrlenW (lpString=".jpg") returned 4
	[0187.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.804] lstrlenW (lpString=".doc") returned 4
	[0187.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.804] lstrlenW (lpString=".docx") returned 5
	[0187.804] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0187.804] lstrlenW (lpString=".pdf") returned 4
	[0187.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.804] lstrlenW (lpString=".xls") returned 4
	[0187.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.804] lstrlenW (lpString=".xlsx") returned 5
	[0187.804] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0187.804] lstrlenW (lpString=".ppt") returned 4
	[0187.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.804] lstrlenW (lpString=".zip") returned 4
	[0187.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.804] lstrlenW (lpString=".rar") returned 4
	[0187.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.804] lstrlenW (lpString=".bz2") returned 4
	[0187.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.804] lstrlenW (lpString=".7z") returned 3
	[0187.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.804] lstrlenW (lpString=".dbf") returned 4
	[0187.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.804] lstrlenW (lpString=".1cd") returned 4
	[0187.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68
	[0187.805] lstrlenW (lpString=".jpg") returned 4
	[0187.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.805] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.805] lstrlenW (lpString="J0187859.WMF") returned 12
	[0187.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.806] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=2732) returned 1
	[0187.806] CloseHandle (hObject=0x558) returned 1
	[0187.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf")) returned 0x220
	[0187.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.806] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.806] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.808] GetLastError () returned 0x0
	[0187.808] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0xaac, lpOverlapped=0x0) returned 1
	[0187.810] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xab0, lpOverlapped=0x0) returned 1
	[0187.811] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.811] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.811] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.811] CloseHandle (hObject=0x3e8) returned 1
	[0187.811] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.811] SetEndOfFile (hFile=0x558) returned 1
	[0187.817] CloseHandle (hObject=0x558) returned 1
	[0187.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf")) returned 1
	[0187.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.819] lstrlenW (lpString=".doc") returned 4
	[0187.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.819] lstrlenW (lpString=".docx") returned 5
	[0187.819] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0187.819] lstrlenW (lpString=".pdf") returned 4
	[0187.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.819] lstrlenW (lpString=".xls") returned 4
	[0187.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.819] lstrlenW (lpString=".xlsx") returned 5
	[0187.819] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0187.819] lstrlenW (lpString=".ppt") returned 4
	[0187.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.819] lstrlenW (lpString=".zip") returned 4
	[0187.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.819] lstrlenW (lpString=".rar") returned 4
	[0187.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.819] lstrlenW (lpString=".bz2") returned 4
	[0187.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.819] lstrlenW (lpString=".7z") returned 3
	[0187.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.820] lstrlenW (lpString=".dbf") returned 4
	[0187.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.820] lstrlenW (lpString=".1cd") returned 4
	[0187.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.820] lstrlenW (lpString=".jpg") returned 4
	[0187.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.820] lstrlenW (lpString=".doc") returned 4
	[0187.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.820] lstrlenW (lpString=".docx") returned 5
	[0187.820] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0187.820] lstrlenW (lpString=".pdf") returned 4
	[0187.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.820] lstrlenW (lpString=".xls") returned 4
	[0187.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.820] lstrlenW (lpString=".xlsx") returned 5
	[0187.820] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0187.820] lstrlenW (lpString=".ppt") returned 4
	[0187.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.820] lstrlenW (lpString=".zip") returned 4
	[0187.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.820] lstrlenW (lpString=".rar") returned 4
	[0187.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.820] lstrlenW (lpString=".bz2") returned 4
	[0187.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.820] lstrlenW (lpString=".7z") returned 3
	[0187.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.821] lstrlenW (lpString=".dbf") returned 4
	[0187.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.821] lstrlenW (lpString=".1cd") returned 4
	[0187.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68
	[0187.821] lstrlenW (lpString=".jpg") returned 4
	[0187.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.821] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.821] lstrlenW (lpString="J0187861.WMF") returned 12
	[0187.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.822] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=9108) returned 1
	[0187.822] CloseHandle (hObject=0x558) returned 1
	[0187.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 0x220
	[0187.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.822] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.823] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.824] GetLastError () returned 0x0
	[0187.824] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2394, lpOverlapped=0x0) returned 1
	[0187.825] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x23a0, lpOverlapped=0x0) returned 1
	[0187.826] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.826] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.826] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.827] CloseHandle (hObject=0x3e8) returned 1
	[0187.827] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.827] SetEndOfFile (hFile=0x558) returned 1
	[0187.830] CloseHandle (hObject=0x558) returned 1
	[0187.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 1
	[0187.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.831] lstrlenW (lpString=".doc") returned 4
	[0187.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.831] lstrlenW (lpString=".docx") returned 5
	[0187.831] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0187.831] lstrlenW (lpString=".pdf") returned 4
	[0187.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.831] lstrlenW (lpString=".xls") returned 4
	[0187.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.831] lstrlenW (lpString=".xlsx") returned 5
	[0187.831] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0187.831] lstrlenW (lpString=".ppt") returned 4
	[0187.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.832] lstrlenW (lpString=".zip") returned 4
	[0187.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.832] lstrlenW (lpString=".rar") returned 4
	[0187.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.832] lstrlenW (lpString=".bz2") returned 4
	[0187.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.832] lstrlenW (lpString=".7z") returned 3
	[0187.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.832] lstrlenW (lpString=".dbf") returned 4
	[0187.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.832] lstrlenW (lpString=".1cd") returned 4
	[0187.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.832] lstrlenW (lpString=".jpg") returned 4
	[0187.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.832] lstrlenW (lpString=".doc") returned 4
	[0187.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.832] lstrlenW (lpString=".docx") returned 5
	[0187.832] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0187.832] lstrlenW (lpString=".pdf") returned 4
	[0187.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.832] lstrlenW (lpString=".xls") returned 4
	[0187.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.832] lstrlenW (lpString=".xlsx") returned 5
	[0187.832] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0187.833] lstrlenW (lpString=".ppt") returned 4
	[0187.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.833] lstrlenW (lpString=".zip") returned 4
	[0187.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.833] lstrlenW (lpString=".rar") returned 4
	[0187.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.833] lstrlenW (lpString=".bz2") returned 4
	[0187.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.833] lstrlenW (lpString=".7z") returned 3
	[0187.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.833] lstrlenW (lpString=".dbf") returned 4
	[0187.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.833] lstrlenW (lpString=".1cd") returned 4
	[0187.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68
	[0187.833] lstrlenW (lpString=".jpg") returned 4
	[0187.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.833] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.833] lstrlenW (lpString="J0187863.WMF") returned 12
	[0187.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.834] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x309ff14 | out: lpFileSize=0x309ff14*=10820) returned 1
	[0187.834] CloseHandle (hObject=0x558) returned 1
	[0187.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 0x220
	[0187.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.835] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.835] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.836] GetLastError () returned 0x0
	[0187.836] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x2a44, lpOverlapped=0x0) returned 1
	[0188.153] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0x2a50, lpOverlapped=0x0) returned 1
	[0188.154] ReadFile (in: hFile=0x558, lpBuffer=0x4011020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x309fecc, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesRead=0x309fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.154] WriteFile (in: hFile=0x3e8, lpBuffer=0x4011020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x309fc94, lpOverlapped=0x0 | out: lpBuffer=0x4011020*, lpNumberOfBytesWritten=0x309fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.154] SetEndOfFile (hFile=0x3e8) returned 1
	[0188.154] CloseHandle (hObject=0x3e8) returned 1
	[0188.154] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x309fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.154] SetEndOfFile (hFile=0x558) returned 1
	[0188.157] CloseHandle (hObject=0x558) returned 1
	[0188.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) 

Thread:
	id = 42
	os_tid = 0xe0c

	[0153.923] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x574868
	[0153.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x584870
	[0153.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e5a0
	[0153.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x571e50
	[0153.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e630
	[0153.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x3bee020
	[0153.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e540
	[0153.926] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e540, Size=0x20) returned 0x4f27f8
	[0153.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e618
	[0153.926] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e618, Size=0x20) returned 0x4f2668
	[0153.927] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0153.927] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0153.927] Wow64DisableWow64FsRedirection (in: OldValue=0x31dff50 | out: OldValue=0x31dff50*=0x0) returned 1
	[0153.927] lstrlenW (lpString="kernel32.dll") returned 12
	[0153.927] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f27f8 | out: hHeap=0x4c0000) returned 1
	[0153.927] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0153.927] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2668 | out: hHeap=0x4c0000) returned 1
	[0153.927] Sleep (dwMilliseconds=0x64) 
	[0154.249] lstrcmpiW (lpString1=".ini", lpString2=".money") returned -1
	[0154.249] lstrlenW (lpString="desktop.ini") returned 11
	[0154.249] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0154.249] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=129) returned 1
	[0154.249] CloseHandle (hObject=0x330) returned 1
	[0154.250] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26
	[0154.250] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[admin@stex777.com].money")) returned 0x26
	[0154.252] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.252] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.252] lstrlenW (lpString=".doc") returned 4
	[0154.252] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0154.252] lstrlenW (lpString=".docx") returned 5
	[0154.252] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0154.252] lstrlenW (lpString=".pdf") returned 4
	[0154.252] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0154.252] lstrlenW (lpString=".xls") returned 4
	[0154.252] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0154.253] lstrlenW (lpString=".xlsx") returned 5
	[0154.253] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0154.253] lstrlenW (lpString=".ppt") returned 4
	[0154.253] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0154.253] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.253] lstrlenW (lpString=".zip") returned 4
	[0154.253] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0154.253] lstrlenW (lpString=".rar") returned 4
	[0154.253] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0154.253] lstrlenW (lpString=".bz2") returned 4
	[0154.253] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0154.253] lstrlenW (lpString=".7z") returned 3
	[0154.253] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0154.253] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.253] lstrlenW (lpString=".dbf") returned 4
	[0154.253] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0154.253] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.253] lstrlenW (lpString=".1cd") returned 4
	[0154.253] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0154.253] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.253] lstrlenW (lpString=".jpg") returned 4
	[0154.253] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0154.253] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.253] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.253] lstrlenW (lpString=".doc") returned 4
	[0154.253] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0154.253] lstrlenW (lpString=".docx") returned 5
	[0154.254] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0154.254] lstrlenW (lpString=".pdf") returned 4
	[0154.254] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0154.254] lstrlenW (lpString=".xls") returned 4
	[0154.254] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0154.254] lstrlenW (lpString=".xlsx") returned 5
	[0154.254] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0154.254] lstrlenW (lpString=".ppt") returned 4
	[0154.254] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0154.254] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.254] lstrlenW (lpString=".zip") returned 4
	[0154.254] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0154.254] lstrlenW (lpString=".rar") returned 4
	[0154.254] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0154.254] lstrlenW (lpString=".bz2") returned 4
	[0154.254] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0154.254] lstrlenW (lpString=".7z") returned 3
	[0154.254] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0154.254] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.254] lstrlenW (lpString=".dbf") returned 4
	[0154.254] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0154.254] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.255] lstrlenW (lpString=".1cd") returned 4
	[0154.255] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0154.255] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0154.255] lstrlenW (lpString=".jpg") returned 4
	[0154.255] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0154.255] Sleep (dwMilliseconds=0x64) 
	[0154.437] Sleep (dwMilliseconds=0x64) 
	[0154.723] Sleep (dwMilliseconds=0x64) 
	[0155.028] Sleep (dwMilliseconds=0x64) 
	[0155.391] Sleep (dwMilliseconds=0x64) 
	[0155.638] Sleep (dwMilliseconds=0x64) 
	[0155.853] Sleep (dwMilliseconds=0x64) 
	[0156.144] lstrcmpiW (lpString1=".avi", lpString2=".money") returned -1
	[0156.162] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0156.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.162] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=48936) returned 1
	[0156.162] CloseHandle (hObject=0x438) returned 1
	[0156.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0156.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.162] lstrlenW (lpString=".doc") returned 4
	[0156.162] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0156.162] lstrlenW (lpString=".docx") returned 5
	[0156.162] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0156.162] lstrlenW (lpString=".pdf") returned 4
	[0156.162] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0156.162] lstrlenW (lpString=".xls") returned 4
	[0156.162] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0156.163] lstrlenW (lpString=".xlsx") returned 5
	[0156.163] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0156.163] lstrlenW (lpString=".ppt") returned 4
	[0156.163] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0156.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.163] lstrlenW (lpString=".zip") returned 4
	[0156.163] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0156.163] lstrlenW (lpString=".rar") returned 4
	[0156.163] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0156.163] lstrlenW (lpString=".bz2") returned 4
	[0156.163] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0156.163] lstrlenW (lpString=".7z") returned 3
	[0156.163] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0156.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.163] lstrlenW (lpString=".dbf") returned 4
	[0156.163] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0156.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.163] lstrlenW (lpString=".1cd") returned 4
	[0156.163] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0156.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.163] lstrlenW (lpString=".jpg") returned 4
	[0156.163] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0156.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.163] lstrlenW (lpString=".doc") returned 4
	[0156.163] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0156.163] lstrlenW (lpString=".docx") returned 5
	[0156.163] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0156.163] lstrlenW (lpString=".pdf") returned 4
	[0156.163] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0156.164] lstrlenW (lpString=".xls") returned 4
	[0156.164] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0156.164] lstrlenW (lpString=".xlsx") returned 5
	[0156.164] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0156.164] lstrlenW (lpString=".ppt") returned 4
	[0156.164] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0156.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.164] lstrlenW (lpString=".zip") returned 4
	[0156.164] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0156.164] lstrlenW (lpString=".rar") returned 4
	[0156.164] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0156.164] lstrlenW (lpString=".bz2") returned 4
	[0156.164] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0156.164] lstrlenW (lpString=".7z") returned 3
	[0156.164] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0156.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.164] lstrlenW (lpString=".dbf") returned 4
	[0156.164] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0156.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.164] lstrlenW (lpString=".1cd") returned 4
	[0156.164] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0156.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0156.164] lstrlenW (lpString=".jpg") returned 4
	[0156.164] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0156.164] Sleep (dwMilliseconds=0x64) 
	[0156.548] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.548] lstrlenW (lpString="ipsesp.xml") returned 10
	[0156.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c
	[0156.548] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=3024) returned 1
	[0156.549] CloseHandle (hObject=0x45c) returned 1
	[0156.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20
	[0156.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.549] lstrlenW (lpString=".doc") returned 4
	[0156.549] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.549] lstrlenW (lpString=".docx") returned 5
	[0156.549] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0156.549] lstrlenW (lpString=".pdf") returned 4
	[0156.549] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.549] lstrlenW (lpString=".xls") returned 4
	[0156.549] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.549] lstrlenW (lpString=".xlsx") returned 5
	[0156.549] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0156.549] lstrlenW (lpString=".ppt") returned 4
	[0156.549] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.549] lstrlenW (lpString=".zip") returned 4
	[0156.549] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.549] lstrlenW (lpString=".rar") returned 4
	[0156.549] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.549] lstrlenW (lpString=".bz2") returned 4
	[0156.550] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.550] lstrlenW (lpString=".7z") returned 3
	[0156.550] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.550] lstrlenW (lpString=".dbf") returned 4
	[0156.550] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.550] lstrlenW (lpString=".1cd") returned 4
	[0156.550] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.550] lstrlenW (lpString=".jpg") returned 4
	[0156.550] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.550] lstrlenW (lpString=".doc") returned 4
	[0156.550] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.550] lstrlenW (lpString=".docx") returned 5
	[0156.550] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0156.550] lstrlenW (lpString=".pdf") returned 4
	[0156.550] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.550] lstrlenW (lpString=".xls") returned 4
	[0156.550] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.550] lstrlenW (lpString=".xlsx") returned 5
	[0156.550] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0156.550] lstrlenW (lpString=".ppt") returned 4
	[0156.550] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.550] lstrlenW (lpString=".zip") returned 4
	[0156.550] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.550] lstrlenW (lpString=".rar") returned 4
	[0156.550] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.551] lstrlenW (lpString=".bz2") returned 4
	[0156.551] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.551] lstrlenW (lpString=".7z") returned 3
	[0156.551] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.551] lstrlenW (lpString=".dbf") returned 4
	[0156.551] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.551] lstrlenW (lpString=".1cd") returned 4
	[0156.551] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0156.551] lstrlenW (lpString=".jpg") returned 4
	[0156.551] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.551] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.551] lstrlenW (lpString="ipsfra.xml") returned 10
	[0156.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c
	[0156.551] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=2628) returned 1
	[0156.551] CloseHandle (hObject=0x45c) returned 1
	[0156.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20
	[0156.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.552] lstrlenW (lpString=".doc") returned 4
	[0156.552] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.552] lstrlenW (lpString=".docx") returned 5
	[0156.552] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0156.552] lstrlenW (lpString=".pdf") returned 4
	[0156.552] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.552] lstrlenW (lpString=".xls") returned 4
	[0156.552] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.552] lstrlenW (lpString=".xlsx") returned 5
	[0156.552] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0156.552] lstrlenW (lpString=".ppt") returned 4
	[0156.552] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.552] lstrlenW (lpString=".zip") returned 4
	[0156.552] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.552] lstrlenW (lpString=".rar") returned 4
	[0156.552] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.552] lstrlenW (lpString=".bz2") returned 4
	[0156.552] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.553] lstrlenW (lpString=".7z") returned 3
	[0156.553] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.553] lstrlenW (lpString=".dbf") returned 4
	[0156.553] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.553] lstrlenW (lpString=".1cd") returned 4
	[0156.553] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.553] lstrlenW (lpString=".jpg") returned 4
	[0156.553] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.553] lstrlenW (lpString=".doc") returned 4
	[0156.553] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.553] lstrlenW (lpString=".docx") returned 5
	[0156.553] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0156.553] lstrlenW (lpString=".pdf") returned 4
	[0156.553] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.553] lstrlenW (lpString=".xls") returned 4
	[0156.553] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.553] lstrlenW (lpString=".xlsx") returned 5
	[0156.553] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0156.553] lstrlenW (lpString=".ppt") returned 4
	[0156.553] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.553] lstrlenW (lpString=".zip") returned 4
	[0156.553] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.553] lstrlenW (lpString=".rar") returned 4
	[0156.553] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.553] lstrlenW (lpString=".bz2") returned 4
	[0156.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.554] lstrlenW (lpString=".7z") returned 3
	[0156.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.554] lstrlenW (lpString=".dbf") returned 4
	[0156.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.554] lstrlenW (lpString=".1cd") returned 4
	[0156.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0156.554] lstrlenW (lpString=".jpg") returned 4
	[0156.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.554] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.554] lstrlenW (lpString="ipshe.xml") returned 9
	[0156.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c
	[0156.555] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=2532) returned 1
	[0156.555] CloseHandle (hObject=0x45c) returned 1
	[0156.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20
	[0156.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.555] lstrlenW (lpString=".doc") returned 4
	[0156.555] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.555] lstrlenW (lpString=".docx") returned 5
	[0156.555] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0156.556] lstrlenW (lpString=".pdf") returned 4
	[0156.556] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.556] lstrlenW (lpString=".xls") returned 4
	[0156.556] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.556] lstrlenW (lpString=".xlsx") returned 5
	[0156.556] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0156.556] lstrlenW (lpString=".ppt") returned 4
	[0156.556] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.556] lstrlenW (lpString=".zip") returned 4
	[0156.556] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.556] lstrlenW (lpString=".rar") returned 4
	[0156.556] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.556] lstrlenW (lpString=".bz2") returned 4
	[0156.556] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.556] lstrlenW (lpString=".7z") returned 3
	[0156.556] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.556] lstrlenW (lpString=".dbf") returned 4
	[0156.556] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.556] lstrlenW (lpString=".1cd") returned 4
	[0156.556] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.556] lstrlenW (lpString=".jpg") returned 4
	[0156.556] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.556] lstrlenW (lpString=".doc") returned 4
	[0156.556] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.557] lstrlenW (lpString=".docx") returned 5
	[0156.557] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0156.557] lstrlenW (lpString=".pdf") returned 4
	[0156.557] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.557] lstrlenW (lpString=".xls") returned 4
	[0156.557] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.557] lstrlenW (lpString=".xlsx") returned 5
	[0156.557] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0156.557] lstrlenW (lpString=".ppt") returned 4
	[0156.557] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.557] lstrlenW (lpString=".zip") returned 4
	[0156.557] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.557] lstrlenW (lpString=".rar") returned 4
	[0156.557] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.557] lstrlenW (lpString=".bz2") returned 4
	[0156.557] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.557] lstrlenW (lpString=".7z") returned 3
	[0156.557] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.557] lstrlenW (lpString=".dbf") returned 4
	[0156.557] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.557] lstrlenW (lpString=".1cd") returned 4
	[0156.557] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60
	[0156.557] lstrlenW (lpString=".jpg") returned 4
	[0156.557] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.558] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.558] lstrlenW (lpString="ipshi.xml") returned 9
	[0156.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c
	[0156.558] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=2518) returned 1
	[0156.558] CloseHandle (hObject=0x45c) returned 1
	[0156.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20
	[0156.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.558] lstrlenW (lpString=".doc") returned 4
	[0156.558] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.558] lstrlenW (lpString=".docx") returned 5
	[0156.559] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1
	[0156.559] lstrlenW (lpString=".pdf") returned 4
	[0156.559] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.559] lstrlenW (lpString=".xls") returned 4
	[0156.559] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.559] lstrlenW (lpString=".xlsx") returned 5
	[0156.559] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1
	[0156.559] lstrlenW (lpString=".ppt") returned 4
	[0156.559] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.559] lstrlenW (lpString=".zip") returned 4
	[0156.559] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.559] lstrlenW (lpString=".rar") returned 4
	[0156.559] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.559] lstrlenW (lpString=".bz2") returned 4
	[0156.559] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.559] lstrlenW (lpString=".7z") returned 3
	[0156.559] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.559] lstrlenW (lpString=".dbf") returned 4
	[0156.559] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.559] lstrlenW (lpString=".1cd") returned 4
	[0156.559] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.559] lstrlenW (lpString=".jpg") returned 4
	[0156.559] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.560] lstrlenW (lpString=".doc") returned 4
	[0156.560] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.560] lstrlenW (lpString=".docx") returned 5
	[0156.560] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1
	[0156.560] lstrlenW (lpString=".pdf") returned 4
	[0156.560] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.560] lstrlenW (lpString=".xls") returned 4
	[0156.560] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.560] lstrlenW (lpString=".xlsx") returned 5
	[0156.560] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1
	[0156.560] lstrlenW (lpString=".ppt") returned 4
	[0156.560] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.560] lstrlenW (lpString=".zip") returned 4
	[0156.560] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.560] lstrlenW (lpString=".rar") returned 4
	[0156.560] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.560] lstrlenW (lpString=".bz2") returned 4
	[0156.560] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.560] lstrlenW (lpString=".7z") returned 3
	[0156.560] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.560] lstrlenW (lpString=".dbf") returned 4
	[0156.560] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.560] lstrlenW (lpString=".1cd") returned 4
	[0156.560] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60
	[0156.560] lstrlenW (lpString=".jpg") returned 4
	[0156.560] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.561] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.561] lstrlenW (lpString="ipshrv.xml") returned 10
	[0156.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c
	[0156.561] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=2652) returned 1
	[0156.561] CloseHandle (hObject=0x45c) returned 1
	[0156.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20
	[0156.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.562] lstrlenW (lpString=".doc") returned 4
	[0156.562] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.562] lstrlenW (lpString=".docx") returned 5
	[0156.562] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1
	[0156.562] lstrlenW (lpString=".pdf") returned 4
	[0156.562] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.562] lstrlenW (lpString=".xls") returned 4
	[0156.562] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.562] lstrlenW (lpString=".xlsx") returned 5
	[0156.562] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1
	[0156.562] lstrlenW (lpString=".ppt") returned 4
	[0156.562] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.562] lstrlenW (lpString=".zip") returned 4
	[0156.562] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.562] lstrlenW (lpString=".rar") returned 4
	[0156.562] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.562] lstrlenW (lpString=".bz2") returned 4
	[0156.562] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.562] lstrlenW (lpString=".7z") returned 3
	[0156.562] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.562] lstrlenW (lpString=".dbf") returned 4
	[0156.562] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.562] lstrlenW (lpString=".1cd") returned 4
	[0156.562] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.562] lstrlenW (lpString=".jpg") returned 4
	[0156.562] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.563] lstrlenW (lpString=".doc") returned 4
	[0156.563] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.563] lstrlenW (lpString=".docx") returned 5
	[0156.563] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1
	[0156.563] lstrlenW (lpString=".pdf") returned 4
	[0156.563] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.563] lstrlenW (lpString=".xls") returned 4
	[0156.563] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.563] lstrlenW (lpString=".xlsx") returned 5
	[0156.563] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1
	[0156.563] lstrlenW (lpString=".ppt") returned 4
	[0156.563] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.563] lstrlenW (lpString=".zip") returned 4
	[0156.563] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.563] lstrlenW (lpString=".rar") returned 4
	[0156.563] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.563] lstrlenW (lpString=".bz2") returned 4
	[0156.563] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.563] lstrlenW (lpString=".7z") returned 3
	[0156.563] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.563] lstrlenW (lpString=".dbf") returned 4
	[0156.563] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.563] lstrlenW (lpString=".1cd") returned 4
	[0156.563] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61
	[0156.564] lstrlenW (lpString=".jpg") returned 4
	[0156.564] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.564] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.564] lstrlenW (lpString="ipsid.xml") returned 9
	[0156.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c
	[0156.564] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=2570) returned 1
	[0156.564] CloseHandle (hObject=0x45c) returned 1
	[0156.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20
	[0156.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60
	[0156.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60
	[0156.565] lstrlenW (lpString=".doc") returned 4
	[0156.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.565] lstrlenW (lpString=".docx") returned 5
	[0156.565] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0156.565] lstrlenW (lpString=".pdf") returned 4
	[0156.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.565] lstrlenW (lpString=".xls") returned 4
	[0156.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.565] lstrlenW (lpString=".xlsx") returned 5
	[0156.565] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0156.565] lstrlenW (lpString=".ppt") returned 4
	[0156.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60
	[0156.565] lstrlenW (lpString=".zip") returned 4
	[0156.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.565] lstrlenW (lpString=".rar") returned 4
	[0156.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.565] lstrlenW (lpString=".bz2") returned 4
	[0156.565] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.565] lstrlenW (lpString=".7z") returned 3
	[0156.565] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60
	[0156.978] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.978] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0156.982] GetLastError () returned 0x0
	[0156.982] ReadFile (in: hFile=0x454, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x10ca8, lpOverlapped=0x0) returned 1
	[0156.998] WriteFile (in: hFile=0x4a0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x10cb0, lpOverlapped=0x0) returned 1
	[0157.002] ReadFile (in: hFile=0x454, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0157.002] WriteFile (in: hFile=0x4a0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0157.002] SetEndOfFile (hFile=0x4a0) returned 1
	[0157.002] CloseHandle (hObject=0x4a0) returned 1
	[0157.002] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.002] SetEndOfFile (hFile=0x454) returned 1
	[0157.006] CloseHandle (hObject=0x454) returned 1
	[0157.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0157.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1
	[0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.007] lstrlenW (lpString=".doc") returned 4
	[0157.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0157.007] lstrlenW (lpString=".docx") returned 5
	[0157.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0157.007] lstrlenW (lpString=".pdf") returned 4
	[0157.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0157.007] lstrlenW (lpString=".xls") returned 4
	[0157.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0157.008] lstrlenW (lpString=".xlsx") returned 5
	[0157.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0157.008] lstrlenW (lpString=".ppt") returned 4
	[0157.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.008] lstrlenW (lpString=".zip") returned 4
	[0157.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0157.008] lstrlenW (lpString=".rar") returned 4
	[0157.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0157.008] lstrlenW (lpString=".bz2") returned 4
	[0157.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0157.008] lstrlenW (lpString=".7z") returned 3
	[0157.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.008] lstrlenW (lpString=".dbf") returned 4
	[0157.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.008] lstrlenW (lpString=".1cd") returned 4
	[0157.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.008] lstrlenW (lpString=".jpg") returned 4
	[0157.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.008] lstrlenW (lpString=".doc") returned 4
	[0157.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0157.008] lstrlenW (lpString=".docx") returned 5
	[0157.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0157.008] lstrlenW (lpString=".pdf") returned 4
	[0157.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0157.008] lstrlenW (lpString=".xls") returned 4
	[0157.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0157.009] lstrlenW (lpString=".xlsx") returned 5
	[0157.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0157.009] lstrlenW (lpString=".ppt") returned 4
	[0157.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0157.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.009] lstrlenW (lpString=".zip") returned 4
	[0157.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0157.009] lstrlenW (lpString=".rar") returned 4
	[0157.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0157.009] lstrlenW (lpString=".bz2") returned 4
	[0157.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0157.009] lstrlenW (lpString=".7z") returned 3
	[0157.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0157.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.009] lstrlenW (lpString=".dbf") returned 4
	[0157.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0157.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.009] lstrlenW (lpString=".1cd") returned 4
	[0157.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0157.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0157.009] lstrlenW (lpString=".jpg") returned 4
	[0157.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0157.009] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0157.009] lstrlenW (lpString="IN00956_.WMF") returned 12
	[0157.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0157.010] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=1256) returned 1
	[0157.010] CloseHandle (hObject=0x454) returned 1
	[0157.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220
	[0157.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0157.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0158.128] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.128] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c
	[0158.545] GetLastError () returned 0x0
	[0158.545] ReadFile (in: hFile=0x448, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x4e8, lpOverlapped=0x0) returned 1
	[0158.559] WriteFile (in: hFile=0x50c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0158.560] ReadFile (in: hFile=0x448, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.560] WriteFile (in: hFile=0x50c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.560] SetEndOfFile (hFile=0x50c) returned 1
	[0158.560] CloseHandle (hObject=0x50c) returned 1
	[0158.560] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.560] SetEndOfFile (hFile=0x448) returned 1
	[0158.562] CloseHandle (hObject=0x448) returned 1
	[0158.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1
	[0158.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.563] lstrlenW (lpString=".doc") returned 4
	[0158.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.563] lstrlenW (lpString=".docx") returned 5
	[0158.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0158.564] lstrlenW (lpString=".pdf") returned 4
	[0158.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.564] lstrlenW (lpString=".xls") returned 4
	[0158.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.564] lstrlenW (lpString=".xlsx") returned 5
	[0158.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0158.564] lstrlenW (lpString=".ppt") returned 4
	[0158.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.564] lstrlenW (lpString=".zip") returned 4
	[0158.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.564] lstrlenW (lpString=".rar") returned 4
	[0158.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.564] lstrlenW (lpString=".bz2") returned 4
	[0158.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.564] lstrlenW (lpString=".7z") returned 3
	[0158.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.564] lstrlenW (lpString=".dbf") returned 4
	[0158.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.564] lstrlenW (lpString=".1cd") returned 4
	[0158.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.564] lstrlenW (lpString=".jpg") returned 4
	[0158.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.565] lstrlenW (lpString=".doc") returned 4
	[0158.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.565] lstrlenW (lpString=".docx") returned 5
	[0158.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0158.565] lstrlenW (lpString=".pdf") returned 4
	[0158.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.565] lstrlenW (lpString=".xls") returned 4
	[0158.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.565] lstrlenW (lpString=".xlsx") returned 5
	[0158.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0158.565] lstrlenW (lpString=".ppt") returned 4
	[0158.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.565] lstrlenW (lpString=".zip") returned 4
	[0158.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.565] lstrlenW (lpString=".rar") returned 4
	[0158.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.565] lstrlenW (lpString=".bz2") returned 4
	[0158.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.565] lstrlenW (lpString=".7z") returned 3
	[0158.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.565] lstrlenW (lpString=".dbf") returned 4
	[0158.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.565] lstrlenW (lpString=".1cd") returned 4
	[0158.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0158.565] lstrlenW (lpString=".jpg") returned 4
	[0158.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.566] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.566] lstrlenW (lpString="J0086432.WMF") returned 12
	[0158.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0158.567] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=33434) returned 1
	[0158.567] CloseHandle (hObject=0x448) returned 1
	[0158.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220
	[0158.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0158.567] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.567] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c
	[0158.568] GetLastError () returned 0x0
	[0158.568] ReadFile (in: hFile=0x448, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x829a, lpOverlapped=0x0) returned 1
	[0158.571] WriteFile (in: hFile=0x50c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x82a0, lpOverlapped=0x0) returned 1
	[0158.572] ReadFile (in: hFile=0x448, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.572] WriteFile (in: hFile=0x50c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.572] SetEndOfFile (hFile=0x50c) returned 1
	[0158.573] CloseHandle (hObject=0x50c) returned 1
	[0158.573] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.573] SetEndOfFile (hFile=0x448) returned 1
	[0158.576] CloseHandle (hObject=0x448) returned 1
	[0158.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1
	[0158.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.577] lstrlenW (lpString=".doc") returned 4
	[0158.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.577] lstrlenW (lpString=".docx") returned 5
	[0158.577] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0158.577] lstrlenW (lpString=".pdf") returned 4
	[0158.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.577] lstrlenW (lpString=".xls") returned 4
	[0158.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.577] lstrlenW (lpString=".xlsx") returned 5
	[0158.577] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0158.577] lstrlenW (lpString=".ppt") returned 4
	[0158.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.577] lstrlenW (lpString=".zip") returned 4
	[0158.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.577] lstrlenW (lpString=".rar") returned 4
	[0158.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.577] lstrlenW (lpString=".bz2") returned 4
	[0158.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.577] lstrlenW (lpString=".7z") returned 3
	[0158.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.577] lstrlenW (lpString=".dbf") returned 4
	[0158.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.577] lstrlenW (lpString=".1cd") returned 4
	[0158.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.578] lstrlenW (lpString=".jpg") returned 4
	[0158.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.578] lstrlenW (lpString=".doc") returned 4
	[0158.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.578] lstrlenW (lpString=".docx") returned 5
	[0158.578] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0158.578] lstrlenW (lpString=".pdf") returned 4
	[0158.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.578] lstrlenW (lpString=".xls") returned 4
	[0158.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.578] lstrlenW (lpString=".xlsx") returned 5
	[0158.578] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0158.578] lstrlenW (lpString=".ppt") returned 4
	[0158.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.578] lstrlenW (lpString=".zip") returned 4
	[0158.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.578] lstrlenW (lpString=".rar") returned 4
	[0158.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.578] lstrlenW (lpString=".bz2") returned 4
	[0158.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.578] lstrlenW (lpString=".7z") returned 3
	[0158.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.578] lstrlenW (lpString=".dbf") returned 4
	[0158.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.578] lstrlenW (lpString=".1cd") returned 4
	[0158.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0158.579] lstrlenW (lpString=".jpg") returned 4
	[0158.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.579] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.579] lstrlenW (lpString="J0086478.WMF") returned 12
	[0158.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0158.579] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=14174) returned 1
	[0158.579] CloseHandle (hObject=0x448) returned 1
	[0158.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220
	[0158.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0158.580] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.580] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c
	[0158.581] GetLastError () returned 0x0
	[0158.581] ReadFile (in: hFile=0x448, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x375e, lpOverlapped=0x0) returned 1
	[0158.583] WriteFile (in: hFile=0x50c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x3760, lpOverlapped=0x0) returned 1
	[0158.584] ReadFile (in: hFile=0x448, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.584] WriteFile (in: hFile=0x50c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.584] SetEndOfFile (hFile=0x50c) returned 1
	[0158.585] CloseHandle (hObject=0x50c) returned 1
	[0158.585] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.585] SetEndOfFile (hFile=0x448) returned 1
	[0158.588] CloseHandle (hObject=0x448) returned 1
	[0158.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1
	[0158.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.967] lstrlenW (lpString=".doc") returned 4
	[0158.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.967] lstrlenW (lpString=".docx") returned 5
	[0158.968] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0158.968] lstrlenW (lpString=".pdf") returned 4
	[0158.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.968] lstrlenW (lpString=".xls") returned 4
	[0158.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.968] lstrlenW (lpString=".xlsx") returned 5
	[0158.968] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0158.968] lstrlenW (lpString=".ppt") returned 4
	[0158.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.968] lstrlenW (lpString=".zip") returned 4
	[0158.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.968] lstrlenW (lpString=".rar") returned 4
	[0158.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.968] lstrlenW (lpString=".bz2") returned 4
	[0158.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.968] lstrlenW (lpString=".7z") returned 3
	[0158.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.968] lstrlenW (lpString=".dbf") returned 4
	[0158.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.968] lstrlenW (lpString=".1cd") returned 4
	[0158.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.968] lstrlenW (lpString=".jpg") returned 4
	[0158.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.968] lstrlenW (lpString=".doc") returned 4
	[0158.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.969] lstrlenW (lpString=".docx") returned 5
	[0158.969] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0158.969] lstrlenW (lpString=".pdf") returned 4
	[0158.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.969] lstrlenW (lpString=".xls") returned 4
	[0158.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.969] lstrlenW (lpString=".xlsx") returned 5
	[0158.969] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0158.969] lstrlenW (lpString=".ppt") returned 4
	[0158.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.969] lstrlenW (lpString=".zip") returned 4
	[0158.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.969] lstrlenW (lpString=".rar") returned 4
	[0158.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.969] lstrlenW (lpString=".bz2") returned 4
	[0158.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.969] lstrlenW (lpString=".7z") returned 3
	[0158.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.969] lstrlenW (lpString=".dbf") returned 4
	[0158.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.969] lstrlenW (lpString=".1cd") returned 4
	[0158.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0158.969] lstrlenW (lpString=".jpg") returned 4
	[0158.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.970] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.970] lstrlenW (lpString="J0090390.WMF") returned 12
	[0158.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0158.970] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=17638) returned 1
	[0158.970] CloseHandle (hObject=0x504) returned 1
	[0158.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220
	[0158.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0158.971] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.971] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0158.971] GetLastError () returned 0x0
	[0158.972] ReadFile (in: hFile=0x504, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x44e6, lpOverlapped=0x0) returned 1
	[0158.973] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x44f0, lpOverlapped=0x0) returned 1
	[0158.975] ReadFile (in: hFile=0x504, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.975] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.975] SetEndOfFile (hFile=0x520) returned 1
	[0158.975] CloseHandle (hObject=0x520) returned 1
	[0158.975] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.975] SetEndOfFile (hFile=0x504) returned 1
	[0158.978] CloseHandle (hObject=0x504) returned 1
	[0158.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1
	[0158.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.979] lstrlenW (lpString=".doc") returned 4
	[0158.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.979] lstrlenW (lpString=".docx") returned 5
	[0158.979] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0158.979] lstrlenW (lpString=".pdf") returned 4
	[0158.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.979] lstrlenW (lpString=".xls") returned 4
	[0158.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.979] lstrlenW (lpString=".xlsx") returned 5
	[0158.979] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0158.979] lstrlenW (lpString=".ppt") returned 4
	[0158.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.979] lstrlenW (lpString=".zip") returned 4
	[0158.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.980] lstrlenW (lpString=".rar") returned 4
	[0158.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.980] lstrlenW (lpString=".bz2") returned 4
	[0158.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.980] lstrlenW (lpString=".7z") returned 3
	[0158.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.980] lstrlenW (lpString=".dbf") returned 4
	[0158.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.980] lstrlenW (lpString=".1cd") returned 4
	[0158.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.980] lstrlenW (lpString=".jpg") returned 4
	[0158.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.980] lstrlenW (lpString=".doc") returned 4
	[0158.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.980] lstrlenW (lpString=".docx") returned 5
	[0158.980] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0158.980] lstrlenW (lpString=".pdf") returned 4
	[0158.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.980] lstrlenW (lpString=".xls") returned 4
	[0158.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.980] lstrlenW (lpString=".xlsx") returned 5
	[0158.980] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0158.980] lstrlenW (lpString=".ppt") returned 4
	[0158.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.980] lstrlenW (lpString=".zip") returned 4
	[0158.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.981] lstrlenW (lpString=".rar") returned 4
	[0158.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.981] lstrlenW (lpString=".bz2") returned 4
	[0158.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.981] lstrlenW (lpString=".7z") returned 3
	[0158.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.981] lstrlenW (lpString=".dbf") returned 4
	[0158.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.981] lstrlenW (lpString=".1cd") returned 4
	[0158.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0158.981] lstrlenW (lpString=".jpg") returned 4
	[0158.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.981] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.981] lstrlenW (lpString="J0090777.WMF") returned 12
	[0158.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0158.982] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=3332) returned 1
	[0158.982] CloseHandle (hObject=0x504) returned 1
	[0158.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220
	[0158.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0158.983] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.983] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0158.983] GetLastError () returned 0x0
	[0158.983] ReadFile (in: hFile=0x504, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xd04, lpOverlapped=0x0) returned 1
	[0158.985] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xd10, lpOverlapped=0x0) returned 1
	[0158.986] ReadFile (in: hFile=0x504, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.986] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.986] SetEndOfFile (hFile=0x520) returned 1
	[0158.986] CloseHandle (hObject=0x520) returned 1
	[0158.986] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.986] SetEndOfFile (hFile=0x504) returned 1
	[0158.989] CloseHandle (hObject=0x504) returned 1
	[0158.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1
	[0158.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.990] lstrlenW (lpString=".doc") returned 4
	[0158.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.990] lstrlenW (lpString=".docx") returned 5
	[0158.990] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0158.990] lstrlenW (lpString=".pdf") returned 4
	[0158.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.990] lstrlenW (lpString=".xls") returned 4
	[0158.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.990] lstrlenW (lpString=".xlsx") returned 5
	[0158.990] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0158.990] lstrlenW (lpString=".ppt") returned 4
	[0158.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.990] lstrlenW (lpString=".zip") returned 4
	[0158.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.990] lstrlenW (lpString=".rar") returned 4
	[0158.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.990] lstrlenW (lpString=".bz2") returned 4
	[0158.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.990] lstrlenW (lpString=".7z") returned 3
	[0158.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.990] lstrlenW (lpString=".dbf") returned 4
	[0158.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.990] lstrlenW (lpString=".1cd") returned 4
	[0158.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.990] lstrlenW (lpString=".jpg") returned 4
	[0158.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.991] lstrlenW (lpString=".doc") returned 4
	[0158.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.991] lstrlenW (lpString=".docx") returned 5
	[0158.991] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0158.991] lstrlenW (lpString=".pdf") returned 4
	[0158.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.991] lstrlenW (lpString=".xls") returned 4
	[0158.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.991] lstrlenW (lpString=".xlsx") returned 5
	[0158.991] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0158.991] lstrlenW (lpString=".ppt") returned 4
	[0158.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.991] lstrlenW (lpString=".zip") returned 4
	[0158.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.991] lstrlenW (lpString=".rar") returned 4
	[0158.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.991] lstrlenW (lpString=".bz2") returned 4
	[0158.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.991] lstrlenW (lpString=".7z") returned 3
	[0158.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.991] lstrlenW (lpString=".dbf") returned 4
	[0158.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.991] lstrlenW (lpString=".1cd") returned 4
	[0158.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0158.991] lstrlenW (lpString=".jpg") returned 4
	[0158.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.992] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.992] lstrlenW (lpString="J0090779.WMF") returned 12
	[0158.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0158.992] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=1456) returned 1
	[0158.992] CloseHandle (hObject=0x504) returned 1
	[0158.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220
	[0158.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0158.993] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.993] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0158.993] GetLastError () returned 0x0
	[0158.993] ReadFile (in: hFile=0x504, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x5b0, lpOverlapped=0x0) returned 1
	[0158.995] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0158.996] ReadFile (in: hFile=0x504, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.996] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.996] SetEndOfFile (hFile=0x520) returned 1
	[0158.996] CloseHandle (hObject=0x520) returned 1
	[0158.996] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.996] SetEndOfFile (hFile=0x504) returned 1
	[0158.999] CloseHandle (hObject=0x504) returned 1
	[0158.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1
	[0159.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.000] lstrlenW (lpString=".doc") returned 4
	[0159.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.000] lstrlenW (lpString=".docx") returned 5
	[0159.000] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0159.000] lstrlenW (lpString=".pdf") returned 4
	[0159.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.000] lstrlenW (lpString=".xls") returned 4
	[0159.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.001] lstrlenW (lpString=".xlsx") returned 5
	[0159.001] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0159.001] lstrlenW (lpString=".ppt") returned 4
	[0159.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.001] lstrlenW (lpString=".zip") returned 4
	[0159.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.001] lstrlenW (lpString=".rar") returned 4
	[0159.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.001] lstrlenW (lpString=".bz2") returned 4
	[0159.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.001] lstrlenW (lpString=".7z") returned 3
	[0159.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.001] lstrlenW (lpString=".dbf") returned 4
	[0159.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.001] lstrlenW (lpString=".1cd") returned 4
	[0159.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.001] lstrlenW (lpString=".jpg") returned 4
	[0159.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.001] lstrlenW (lpString=".doc") returned 4
	[0159.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.001] lstrlenW (lpString=".docx") returned 5
	[0159.001] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0159.002] lstrlenW (lpString=".pdf") returned 4
	[0159.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.002] lstrlenW (lpString=".xls") returned 4
	[0159.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.002] lstrlenW (lpString=".xlsx") returned 5
	[0159.002] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0159.002] lstrlenW (lpString=".ppt") returned 4
	[0159.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.002] lstrlenW (lpString=".zip") returned 4
	[0159.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.002] lstrlenW (lpString=".rar") returned 4
	[0159.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.002] lstrlenW (lpString=".bz2") returned 4
	[0159.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.002] lstrlenW (lpString=".7z") returned 3
	[0159.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.002] lstrlenW (lpString=".dbf") returned 4
	[0159.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.002] lstrlenW (lpString=".1cd") returned 4
	[0159.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0159.002] lstrlenW (lpString=".jpg") returned 4
	[0159.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.002] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.003] lstrlenW (lpString="J0090781.WMF") returned 12
	[0159.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0159.003] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=5314) returned 1
	[0159.003] CloseHandle (hObject=0x504) returned 1
	[0159.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220
	[0159.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.485] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.485] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.485] GetLastError () returned 0x0
	[0159.485] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x14c2, lpOverlapped=0x0) returned 1
	[0159.487] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x14d0, lpOverlapped=0x0) returned 1
	[0159.488] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.488] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.488] SetEndOfFile (hFile=0x4bc) returned 1
	[0159.488] CloseHandle (hObject=0x4bc) returned 1
	[0159.488] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.489] SetEndOfFile (hFile=0x51c) returned 1
	[0159.491] CloseHandle (hObject=0x51c) returned 1
	[0159.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1
	[0159.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.492] lstrlenW (lpString=".doc") returned 4
	[0159.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.492] lstrlenW (lpString=".docx") returned 5
	[0159.492] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0159.492] lstrlenW (lpString=".pdf") returned 4
	[0159.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.492] lstrlenW (lpString=".xls") returned 4
	[0159.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.493] lstrlenW (lpString=".xlsx") returned 5
	[0159.493] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0159.493] lstrlenW (lpString=".ppt") returned 4
	[0159.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.493] lstrlenW (lpString=".zip") returned 4
	[0159.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.493] lstrlenW (lpString=".rar") returned 4
	[0159.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.493] lstrlenW (lpString=".bz2") returned 4
	[0159.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.493] lstrlenW (lpString=".7z") returned 3
	[0159.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.493] lstrlenW (lpString=".dbf") returned 4
	[0159.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.493] lstrlenW (lpString=".1cd") returned 4
	[0159.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.493] lstrlenW (lpString=".jpg") returned 4
	[0159.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.493] lstrlenW (lpString=".doc") returned 4
	[0159.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.493] lstrlenW (lpString=".docx") returned 5
	[0159.493] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0159.493] lstrlenW (lpString=".pdf") returned 4
	[0159.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.493] lstrlenW (lpString=".xls") returned 4
	[0159.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.494] lstrlenW (lpString=".xlsx") returned 5
	[0159.494] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0159.494] lstrlenW (lpString=".ppt") returned 4
	[0159.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.494] lstrlenW (lpString=".zip") returned 4
	[0159.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.494] lstrlenW (lpString=".rar") returned 4
	[0159.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.494] lstrlenW (lpString=".bz2") returned 4
	[0159.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.494] lstrlenW (lpString=".7z") returned 3
	[0159.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.494] lstrlenW (lpString=".dbf") returned 4
	[0159.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.494] lstrlenW (lpString=".1cd") returned 4
	[0159.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0159.494] lstrlenW (lpString=".jpg") returned 4
	[0159.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.494] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.494] lstrlenW (lpString="J0099155.JPG") returned 12
	[0159.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.495] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=8826) returned 1
	[0159.495] CloseHandle (hObject=0x51c) returned 1
	[0159.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220
	[0159.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.496] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.496] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.497] GetLastError () returned 0x0
	[0159.497] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x227a, lpOverlapped=0x0) returned 1
	[0159.498] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x2280, lpOverlapped=0x0) returned 1
	[0159.499] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.499] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.499] SetEndOfFile (hFile=0x4bc) returned 1
	[0159.500] CloseHandle (hObject=0x4bc) returned 1
	[0159.500] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.500] SetEndOfFile (hFile=0x51c) returned 1
	[0159.503] CloseHandle (hObject=0x51c) returned 1
	[0159.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1
	[0159.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.504] lstrlenW (lpString=".doc") returned 4
	[0159.504] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.504] lstrlenW (lpString=".docx") returned 5
	[0159.504] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0159.504] lstrlenW (lpString=".pdf") returned 4
	[0159.504] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.504] lstrlenW (lpString=".xls") returned 4
	[0159.504] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.504] lstrlenW (lpString=".xlsx") returned 5
	[0159.504] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0159.504] lstrlenW (lpString=".ppt") returned 4
	[0159.504] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.504] lstrlenW (lpString=".zip") returned 4
	[0159.504] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.504] lstrlenW (lpString=".rar") returned 4
	[0159.504] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.505] lstrlenW (lpString=".bz2") returned 4
	[0159.505] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.505] lstrlenW (lpString=".7z") returned 3
	[0159.505] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.505] lstrlenW (lpString=".dbf") returned 4
	[0159.505] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.505] lstrlenW (lpString=".1cd") returned 4
	[0159.505] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.505] lstrlenW (lpString=".jpg") returned 4
	[0159.505] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.505] lstrlenW (lpString=".doc") returned 4
	[0159.505] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.505] lstrlenW (lpString=".docx") returned 5
	[0159.505] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0159.505] lstrlenW (lpString=".pdf") returned 4
	[0159.505] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.505] lstrlenW (lpString=".xls") returned 4
	[0159.505] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.505] lstrlenW (lpString=".xlsx") returned 5
	[0159.505] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0159.505] lstrlenW (lpString=".ppt") returned 4
	[0159.505] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.505] lstrlenW (lpString=".zip") returned 4
	[0159.505] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.506] lstrlenW (lpString=".rar") returned 4
	[0159.506] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.506] lstrlenW (lpString=".bz2") returned 4
	[0159.506] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.506] lstrlenW (lpString=".7z") returned 3
	[0159.506] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.506] lstrlenW (lpString=".dbf") returned 4
	[0159.506] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.506] lstrlenW (lpString=".1cd") returned 4
	[0159.506] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0159.506] lstrlenW (lpString=".jpg") returned 4
	[0159.506] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.506] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.506] lstrlenW (lpString="J0099156.JPG") returned 12
	[0159.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.507] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=13954) returned 1
	[0159.507] CloseHandle (hObject=0x51c) returned 1
	[0159.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220
	[0159.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.507] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.507] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.508] GetLastError () returned 0x0
	[0159.508] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x3682, lpOverlapped=0x0) returned 1
	[0159.510] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x3690, lpOverlapped=0x0) returned 1
	[0159.511] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.511] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.511] SetEndOfFile (hFile=0x4bc) returned 1
	[0159.511] CloseHandle (hObject=0x4bc) returned 1
	[0159.511] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.511] SetEndOfFile (hFile=0x51c) returned 1
	[0159.526] CloseHandle (hObject=0x51c) returned 1
	[0159.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1
	[0159.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.527] lstrlenW (lpString=".doc") returned 4
	[0159.527] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.527] lstrlenW (lpString=".docx") returned 5
	[0159.527] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0159.527] lstrlenW (lpString=".pdf") returned 4
	[0159.527] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.527] lstrlenW (lpString=".xls") returned 4
	[0159.527] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.527] lstrlenW (lpString=".xlsx") returned 5
	[0159.527] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0159.527] lstrlenW (lpString=".ppt") returned 4
	[0159.527] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.527] lstrlenW (lpString=".zip") returned 4
	[0159.527] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.528] lstrlenW (lpString=".rar") returned 4
	[0159.528] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.528] lstrlenW (lpString=".bz2") returned 4
	[0159.528] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.528] lstrlenW (lpString=".7z") returned 3
	[0159.528] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.528] lstrlenW (lpString=".dbf") returned 4
	[0159.528] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.528] lstrlenW (lpString=".1cd") returned 4
	[0159.528] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.528] lstrlenW (lpString=".jpg") returned 4
	[0159.528] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.528] lstrlenW (lpString=".doc") returned 4
	[0159.528] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.528] lstrlenW (lpString=".docx") returned 5
	[0159.529] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0159.529] lstrlenW (lpString=".pdf") returned 4
	[0159.529] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.529] lstrlenW (lpString=".xls") returned 4
	[0159.529] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.529] lstrlenW (lpString=".xlsx") returned 5
	[0159.529] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0159.529] lstrlenW (lpString=".ppt") returned 4
	[0159.529] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.529] lstrlenW (lpString=".zip") returned 4
	[0159.529] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.529] lstrlenW (lpString=".rar") returned 4
	[0159.529] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.529] lstrlenW (lpString=".bz2") returned 4
	[0159.529] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.530] lstrlenW (lpString=".7z") returned 3
	[0159.530] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.530] lstrlenW (lpString=".dbf") returned 4
	[0159.530] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.530] lstrlenW (lpString=".1cd") returned 4
	[0159.530] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0159.530] lstrlenW (lpString=".jpg") returned 4
	[0159.530] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.530] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.530] lstrlenW (lpString="J0099158.WMF") returned 12
	[0159.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.530] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=26160) returned 1
	[0159.531] CloseHandle (hObject=0x51c) returned 1
	[0159.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220
	[0159.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.531] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.531] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0159.532] GetLastError () returned 0x0
	[0159.532] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x6630, lpOverlapped=0x0) returned 1
	[0159.796] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x6640, lpOverlapped=0x0) returned 1
	[0159.798] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.798] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.798] SetEndOfFile (hFile=0x520) returned 1
	[0159.989] CloseHandle (hObject=0x520) returned 1
	[0159.989] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.989] SetEndOfFile (hFile=0x51c) returned 1
	[0159.993] CloseHandle (hObject=0x51c) returned 1
	[0159.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1
	[0159.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.994] lstrlenW (lpString=".doc") returned 4
	[0159.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.994] lstrlenW (lpString=".docx") returned 5
	[0159.994] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0159.994] lstrlenW (lpString=".pdf") returned 4
	[0159.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.994] lstrlenW (lpString=".xls") returned 4
	[0159.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.994] lstrlenW (lpString=".xlsx") returned 5
	[0159.994] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0159.994] lstrlenW (lpString=".ppt") returned 4
	[0159.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.995] lstrlenW (lpString=".zip") returned 4
	[0159.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.995] lstrlenW (lpString=".rar") returned 4
	[0159.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.995] lstrlenW (lpString=".bz2") returned 4
	[0159.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.995] lstrlenW (lpString=".7z") returned 3
	[0159.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.995] lstrlenW (lpString=".dbf") returned 4
	[0159.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.995] lstrlenW (lpString=".1cd") returned 4
	[0159.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.995] lstrlenW (lpString=".jpg") returned 4
	[0159.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.995] lstrlenW (lpString=".doc") returned 4
	[0159.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.995] lstrlenW (lpString=".docx") returned 5
	[0159.995] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0159.995] lstrlenW (lpString=".pdf") returned 4
	[0159.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.995] lstrlenW (lpString=".xls") returned 4
	[0159.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.995] lstrlenW (lpString=".xlsx") returned 5
	[0159.995] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0159.996] lstrlenW (lpString=".ppt") returned 4
	[0159.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.996] lstrlenW (lpString=".zip") returned 4
	[0159.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.996] lstrlenW (lpString=".rar") returned 4
	[0159.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.996] lstrlenW (lpString=".bz2") returned 4
	[0159.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.996] lstrlenW (lpString=".7z") returned 3
	[0159.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.996] lstrlenW (lpString=".dbf") returned 4
	[0159.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.996] lstrlenW (lpString=".1cd") returned 4
	[0159.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0159.996] lstrlenW (lpString=".jpg") returned 4
	[0159.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.996] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.996] lstrlenW (lpString="J0099164.WMF") returned 12
	[0159.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.997] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=21946) returned 1
	[0159.997] CloseHandle (hObject=0x51c) returned 1
	[0159.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220
	[0159.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.997] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.997] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0159.998] GetLastError () returned 0x0
	[0159.998] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x55ba, lpOverlapped=0x0) returned 1
	[0160.000] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x55c0, lpOverlapped=0x0) returned 1
	[0160.001] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.001] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.001] SetEndOfFile (hFile=0x520) returned 1
	[0160.002] CloseHandle (hObject=0x520) returned 1
	[0160.002] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.002] SetEndOfFile (hFile=0x51c) returned 1
	[0160.005] CloseHandle (hObject=0x51c) returned 1
	[0160.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0160.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1
	[0160.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.006] lstrlenW (lpString=".doc") returned 4
	[0160.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.006] lstrlenW (lpString=".docx") returned 5
	[0160.006] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0160.006] lstrlenW (lpString=".pdf") returned 4
	[0160.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.006] lstrlenW (lpString=".xls") returned 4
	[0160.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.006] lstrlenW (lpString=".xlsx") returned 5
	[0160.006] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0160.006] lstrlenW (lpString=".ppt") returned 4
	[0160.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.006] lstrlenW (lpString=".zip") returned 4
	[0160.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.006] lstrlenW (lpString=".rar") returned 4
	[0160.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.006] lstrlenW (lpString=".bz2") returned 4
	[0160.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.006] lstrlenW (lpString=".7z") returned 3
	[0160.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.006] lstrlenW (lpString=".dbf") returned 4
	[0160.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.007] lstrlenW (lpString=".1cd") returned 4
	[0160.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.007] lstrlenW (lpString=".jpg") returned 4
	[0160.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.007] lstrlenW (lpString=".doc") returned 4
	[0160.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.007] lstrlenW (lpString=".docx") returned 5
	[0160.007] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0160.007] lstrlenW (lpString=".pdf") returned 4
	[0160.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.007] lstrlenW (lpString=".xls") returned 4
	[0160.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.007] lstrlenW (lpString=".xlsx") returned 5
	[0160.007] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0160.007] lstrlenW (lpString=".ppt") returned 4
	[0160.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.007] lstrlenW (lpString=".zip") returned 4
	[0160.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.007] lstrlenW (lpString=".rar") returned 4
	[0160.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.007] lstrlenW (lpString=".bz2") returned 4
	[0160.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.007] lstrlenW (lpString=".7z") returned 3
	[0160.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.007] lstrlenW (lpString=".dbf") returned 4
	[0160.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.008] lstrlenW (lpString=".1cd") returned 4
	[0160.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0160.008] lstrlenW (lpString=".jpg") returned 4
	[0160.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.008] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0160.008] lstrlenW (lpString="J0099165.JPG") returned 12
	[0160.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0160.009] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=50490) returned 1
	[0160.009] CloseHandle (hObject=0x51c) returned 1
	[0160.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220
	[0160.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0160.010] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.010] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0160.010] GetLastError () returned 0x0
	[0160.010] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xc53a, lpOverlapped=0x0) returned 1
	[0160.013] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xc540, lpOverlapped=0x0) returned 1
	[0160.015] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.015] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.015] SetEndOfFile (hFile=0x520) returned 1
	[0160.015] CloseHandle (hObject=0x520) returned 1
	[0160.015] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.015] SetEndOfFile (hFile=0x51c) returned 1
	[0160.018] CloseHandle (hObject=0x51c) returned 1
	[0160.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0160.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1
	[0160.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.019] lstrlenW (lpString=".doc") returned 4
	[0160.019] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.019] lstrlenW (lpString=".docx") returned 5
	[0160.019] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0160.019] lstrlenW (lpString=".pdf") returned 4
	[0160.020] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.020] lstrlenW (lpString=".xls") returned 4
	[0160.020] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.020] lstrlenW (lpString=".xlsx") returned 5
	[0160.020] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0160.020] lstrlenW (lpString=".ppt") returned 4
	[0160.020] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.020] lstrlenW (lpString=".zip") returned 4
	[0160.020] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.020] lstrlenW (lpString=".rar") returned 4
	[0160.020] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.020] lstrlenW (lpString=".bz2") returned 4
	[0160.020] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.020] lstrlenW (lpString=".7z") returned 3
	[0160.020] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.020] lstrlenW (lpString=".dbf") returned 4
	[0160.020] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.020] lstrlenW (lpString=".1cd") returned 4
	[0160.020] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.020] lstrlenW (lpString=".jpg") returned 4
	[0160.020] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.020] lstrlenW (lpString=".doc") returned 4
	[0160.020] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.020] lstrlenW (lpString=".docx") returned 5
	[0160.021] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0160.021] lstrlenW (lpString=".pdf") returned 4
	[0160.021] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.021] lstrlenW (lpString=".xls") returned 4
	[0160.021] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.021] lstrlenW (lpString=".xlsx") returned 5
	[0160.021] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0160.021] lstrlenW (lpString=".ppt") returned 4
	[0160.021] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.021] lstrlenW (lpString=".zip") returned 4
	[0160.021] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.021] lstrlenW (lpString=".rar") returned 4
	[0160.021] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.021] lstrlenW (lpString=".bz2") returned 4
	[0160.021] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.021] lstrlenW (lpString=".7z") returned 3
	[0160.021] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.021] lstrlenW (lpString=".dbf") returned 4
	[0160.021] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.021] lstrlenW (lpString=".1cd") returned 4
	[0160.021] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0160.021] lstrlenW (lpString=".jpg") returned 4
	[0160.021] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.022] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0160.022] lstrlenW (lpString="J0099166.JPG") returned 12
	[0160.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0160.022] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=64767) returned 1
	[0160.022] CloseHandle (hObject=0x51c) returned 1
	[0160.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220
	[0160.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0160.023] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.023] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0160.023] GetLastError () returned 0x0
	[0160.023] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xfcff, lpOverlapped=0x0) returned 1
	[0160.410] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xfd00, lpOverlapped=0x0) returned 1
	[0160.605] ReadFile (in: hFile=0x51c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.606] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.606] SetEndOfFile (hFile=0x520) returned 1
	[0160.606] CloseHandle (hObject=0x520) returned 1
	[0160.606] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.606] SetEndOfFile (hFile=0x51c) returned 1
	[0160.614] CloseHandle (hObject=0x51c) returned 1
	[0160.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0160.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1
	[0161.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.023] lstrlenW (lpString=".doc") returned 4
	[0161.023] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0161.023] lstrlenW (lpString=".docx") returned 5
	[0161.023] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0161.023] lstrlenW (lpString=".pdf") returned 4
	[0161.023] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0161.023] lstrlenW (lpString=".xls") returned 4
	[0161.023] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0161.023] lstrlenW (lpString=".xlsx") returned 5
	[0161.023] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0161.023] lstrlenW (lpString=".ppt") returned 4
	[0161.023] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0161.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.023] lstrlenW (lpString=".zip") returned 4
	[0161.023] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0161.023] lstrlenW (lpString=".rar") returned 4
	[0161.023] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0161.023] lstrlenW (lpString=".bz2") returned 4
	[0161.023] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0161.023] lstrlenW (lpString=".7z") returned 3
	[0161.023] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0161.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.023] lstrlenW (lpString=".dbf") returned 4
	[0161.023] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0161.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.023] lstrlenW (lpString=".1cd") returned 4
	[0161.023] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0161.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.023] lstrlenW (lpString=".jpg") returned 4
	[0161.023] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0161.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.024] lstrlenW (lpString=".doc") returned 4
	[0161.024] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0161.024] lstrlenW (lpString=".docx") returned 5
	[0161.024] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0161.024] lstrlenW (lpString=".pdf") returned 4
	[0161.024] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0161.024] lstrlenW (lpString=".xls") returned 4
	[0161.024] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0161.024] lstrlenW (lpString=".xlsx") returned 5
	[0161.024] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0161.024] lstrlenW (lpString=".ppt") returned 4
	[0161.024] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0161.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.024] lstrlenW (lpString=".zip") returned 4
	[0161.024] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0161.024] lstrlenW (lpString=".rar") returned 4
	[0161.024] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0161.024] lstrlenW (lpString=".bz2") returned 4
	[0161.024] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0161.024] lstrlenW (lpString=".7z") returned 3
	[0161.024] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0161.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.024] lstrlenW (lpString=".dbf") returned 4
	[0161.024] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0161.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.024] lstrlenW (lpString=".1cd") returned 4
	[0161.024] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0161.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0161.025] lstrlenW (lpString=".jpg") returned 4
	[0161.025] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0161.025] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0161.025] lstrlenW (lpString="J0099174.WMF") returned 12
	[0161.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.112] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=6214) returned 1
	[0161.113] CloseHandle (hObject=0x51c) returned 1
	[0161.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220
	[0161.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0161.802] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.802] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0161.852] GetLastError () returned 0x0
	[0161.852] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1846, lpOverlapped=0x0) returned 1
	[0161.853] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1850, lpOverlapped=0x0) returned 1
	[0161.854] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.854] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.855] SetEndOfFile (hFile=0x4fc) returned 1
	[0161.855] CloseHandle (hObject=0x4fc) returned 1
	[0161.855] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.855] SetEndOfFile (hFile=0x44c) returned 1
	[0161.858] CloseHandle (hObject=0x44c) returned 1
	[0161.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1
	[0161.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.859] lstrlenW (lpString=".doc") returned 4
	[0161.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.859] lstrlenW (lpString=".docx") returned 5
	[0161.859] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0161.859] lstrlenW (lpString=".pdf") returned 4
	[0161.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.859] lstrlenW (lpString=".xls") returned 4
	[0161.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.859] lstrlenW (lpString=".xlsx") returned 5
	[0161.859] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0161.859] lstrlenW (lpString=".ppt") returned 4
	[0161.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.859] lstrlenW (lpString=".zip") returned 4
	[0161.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.859] lstrlenW (lpString=".rar") returned 4
	[0161.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.859] lstrlenW (lpString=".bz2") returned 4
	[0161.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.860] lstrlenW (lpString=".7z") returned 3
	[0161.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.860] lstrlenW (lpString=".dbf") returned 4
	[0161.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.860] lstrlenW (lpString=".1cd") returned 4
	[0161.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.860] lstrlenW (lpString=".jpg") returned 4
	[0161.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.860] lstrlenW (lpString=".doc") returned 4
	[0161.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.860] lstrlenW (lpString=".docx") returned 5
	[0161.860] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0161.860] lstrlenW (lpString=".pdf") returned 4
	[0161.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.860] lstrlenW (lpString=".xls") returned 4
	[0161.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.860] lstrlenW (lpString=".xlsx") returned 5
	[0161.860] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0161.860] lstrlenW (lpString=".ppt") returned 4
	[0161.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.860] lstrlenW (lpString=".zip") returned 4
	[0161.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.860] lstrlenW (lpString=".rar") returned 4
	[0161.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.861] lstrlenW (lpString=".bz2") returned 4
	[0161.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.861] lstrlenW (lpString=".7z") returned 3
	[0161.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.861] lstrlenW (lpString=".dbf") returned 4
	[0161.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.861] lstrlenW (lpString=".1cd") returned 4
	[0161.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0161.861] lstrlenW (lpString=".jpg") returned 4
	[0161.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.861] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0161.861] lstrlenW (lpString="J0099181.WMF") returned 12
	[0161.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0161.862] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=1198) returned 1
	[0161.862] CloseHandle (hObject=0x44c) returned 1
	[0161.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220
	[0161.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0161.862] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.863] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0161.863] GetLastError () returned 0x0
	[0161.863] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x4ae, lpOverlapped=0x0) returned 1
	[0161.864] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x4b0, lpOverlapped=0x0) returned 1
	[0161.865] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.865] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.866] SetEndOfFile (hFile=0x4fc) returned 1
	[0161.866] CloseHandle (hObject=0x4fc) returned 1
	[0161.866] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.866] SetEndOfFile (hFile=0x44c) returned 1
	[0161.868] CloseHandle (hObject=0x44c) returned 1
	[0161.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1
	[0161.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.869] lstrlenW (lpString=".doc") returned 4
	[0161.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.869] lstrlenW (lpString=".docx") returned 5
	[0161.869] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0161.869] lstrlenW (lpString=".pdf") returned 4
	[0161.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.869] lstrlenW (lpString=".xls") returned 4
	[0161.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.869] lstrlenW (lpString=".xlsx") returned 5
	[0161.869] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0161.870] lstrlenW (lpString=".ppt") returned 4
	[0161.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.870] lstrlenW (lpString=".zip") returned 4
	[0161.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.870] lstrlenW (lpString=".rar") returned 4
	[0161.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.870] lstrlenW (lpString=".bz2") returned 4
	[0161.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.870] lstrlenW (lpString=".7z") returned 3
	[0161.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.870] lstrlenW (lpString=".dbf") returned 4
	[0161.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.870] lstrlenW (lpString=".1cd") returned 4
	[0161.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.870] lstrlenW (lpString=".jpg") returned 4
	[0161.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.870] lstrlenW (lpString=".doc") returned 4
	[0161.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.870] lstrlenW (lpString=".docx") returned 5
	[0161.870] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0161.870] lstrlenW (lpString=".pdf") returned 4
	[0161.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.870] lstrlenW (lpString=".xls") returned 4
	[0161.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.871] lstrlenW (lpString=".xlsx") returned 5
	[0161.871] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0161.871] lstrlenW (lpString=".ppt") returned 4
	[0161.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.871] lstrlenW (lpString=".zip") returned 4
	[0161.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.871] lstrlenW (lpString=".rar") returned 4
	[0161.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.871] lstrlenW (lpString=".bz2") returned 4
	[0161.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.871] lstrlenW (lpString=".7z") returned 3
	[0161.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.871] lstrlenW (lpString=".dbf") returned 4
	[0161.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.871] lstrlenW (lpString=".1cd") returned 4
	[0161.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0161.871] lstrlenW (lpString=".jpg") returned 4
	[0161.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.871] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0161.871] lstrlenW (lpString="J0099182.WMF") returned 12
	[0161.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0161.872] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=3840) returned 1
	[0161.872] CloseHandle (hObject=0x44c) returned 1
	[0161.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220
	[0161.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0161.872] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.873] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0161.875] GetLastError () returned 0x0
	[0161.875] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xf00, lpOverlapped=0x0) returned 1
	[0161.878] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xf10, lpOverlapped=0x0) returned 1
	[0161.879] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.879] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.879] SetEndOfFile (hFile=0x4fc) returned 1
	[0161.880] CloseHandle (hObject=0x4fc) returned 1
	[0161.880] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.880] SetEndOfFile (hFile=0x44c) returned 1
	[0161.882] CloseHandle (hObject=0x44c) returned 1
	[0161.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1
	[0161.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.885] lstrlenW (lpString=".doc") returned 4
	[0161.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.885] lstrlenW (lpString=".docx") returned 5
	[0161.885] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0161.885] lstrlenW (lpString=".pdf") returned 4
	[0161.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.885] lstrlenW (lpString=".xls") returned 4
	[0161.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.885] lstrlenW (lpString=".xlsx") returned 5
	[0161.885] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0161.885] lstrlenW (lpString=".ppt") returned 4
	[0161.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.886] lstrlenW (lpString=".zip") returned 4
	[0161.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.886] lstrlenW (lpString=".rar") returned 4
	[0161.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.886] lstrlenW (lpString=".bz2") returned 4
	[0161.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.886] lstrlenW (lpString=".7z") returned 3
	[0161.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.886] lstrlenW (lpString=".dbf") returned 4
	[0161.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.886] lstrlenW (lpString=".1cd") returned 4
	[0161.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.886] lstrlenW (lpString=".jpg") returned 4
	[0161.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.886] lstrlenW (lpString=".doc") returned 4
	[0161.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.886] lstrlenW (lpString=".docx") returned 5
	[0161.886] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0161.886] lstrlenW (lpString=".pdf") returned 4
	[0161.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.886] lstrlenW (lpString=".xls") returned 4
	[0161.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.886] lstrlenW (lpString=".xlsx") returned 5
	[0161.886] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0161.886] lstrlenW (lpString=".ppt") returned 4
	[0161.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.887] lstrlenW (lpString=".zip") returned 4
	[0161.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.887] lstrlenW (lpString=".rar") returned 4
	[0161.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.887] lstrlenW (lpString=".bz2") returned 4
	[0161.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.887] lstrlenW (lpString=".7z") returned 3
	[0161.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.887] lstrlenW (lpString=".dbf") returned 4
	[0161.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.887] lstrlenW (lpString=".1cd") returned 4
	[0161.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0161.887] lstrlenW (lpString=".jpg") returned 4
	[0161.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.887] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0161.887] lstrlenW (lpString="J0099183.WMF") returned 12
	[0161.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0161.888] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=4946) returned 1
	[0161.888] CloseHandle (hObject=0x44c) returned 1
	[0161.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220
	[0161.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0161.889] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.889] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0161.889] GetLastError () returned 0x0
	[0161.889] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1352, lpOverlapped=0x0) returned 1
	[0162.307] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1360, lpOverlapped=0x0) returned 1
	[0162.308] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.308] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.308] SetEndOfFile (hFile=0x4fc) returned 1
	[0162.308] CloseHandle (hObject=0x4fc) returned 1
	[0162.308] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.308] SetEndOfFile (hFile=0x44c) returned 1
	[0162.310] CloseHandle (hObject=0x44c) returned 1
	[0162.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1
	[0162.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.312] lstrlenW (lpString=".doc") returned 4
	[0162.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0162.312] lstrlenW (lpString=".docx") returned 5
	[0162.312] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0162.312] lstrlenW (lpString=".pdf") returned 4
	[0162.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0162.312] lstrlenW (lpString=".xls") returned 4
	[0162.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0162.312] lstrlenW (lpString=".xlsx") returned 5
	[0162.312] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0162.312] lstrlenW (lpString=".ppt") returned 4
	[0162.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0162.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.312] lstrlenW (lpString=".zip") returned 4
	[0162.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0162.312] lstrlenW (lpString=".rar") returned 4
	[0162.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0162.312] lstrlenW (lpString=".bz2") returned 4
	[0162.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0162.312] lstrlenW (lpString=".7z") returned 3
	[0162.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0162.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.312] lstrlenW (lpString=".dbf") returned 4
	[0162.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0162.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.312] lstrlenW (lpString=".1cd") returned 4
	[0162.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0162.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.312] lstrlenW (lpString=".jpg") returned 4
	[0162.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0162.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.313] lstrlenW (lpString=".doc") returned 4
	[0162.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0162.313] lstrlenW (lpString=".docx") returned 5
	[0162.313] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0162.313] lstrlenW (lpString=".pdf") returned 4
	[0162.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0162.313] lstrlenW (lpString=".xls") returned 4
	[0162.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0162.313] lstrlenW (lpString=".xlsx") returned 5
	[0162.313] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0162.313] lstrlenW (lpString=".ppt") returned 4
	[0162.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0162.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.313] lstrlenW (lpString=".zip") returned 4
	[0162.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0162.313] lstrlenW (lpString=".rar") returned 4
	[0162.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0162.313] lstrlenW (lpString=".bz2") returned 4
	[0162.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0162.313] lstrlenW (lpString=".7z") returned 3
	[0162.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0162.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.313] lstrlenW (lpString=".dbf") returned 4
	[0162.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0162.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.313] lstrlenW (lpString=".1cd") returned 4
	[0162.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0162.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0162.313] lstrlenW (lpString=".jpg") returned 4
	[0162.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0162.314] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.314] lstrlenW (lpString="J0099192.GIF") returned 12
	[0162.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0162.314] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=17964) returned 1
	[0162.314] CloseHandle (hObject=0x44c) returned 1
	[0162.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220
	[0162.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0162.321] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.321] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0162.321] GetLastError () returned 0x0
	[0162.322] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x462c, lpOverlapped=0x0) returned 1
	[0162.323] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x4630, lpOverlapped=0x0) returned 1
	[0162.324] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.325] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.325] SetEndOfFile (hFile=0x4fc) returned 1
	[0162.325] CloseHandle (hObject=0x4fc) returned 1
	[0162.325] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.325] SetEndOfFile (hFile=0x44c) returned 1
	[0162.327] CloseHandle (hObject=0x44c) returned 1
	[0162.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1
	[0162.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.328] lstrlenW (lpString=".doc") returned 4
	[0162.328] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.328] lstrlenW (lpString=".docx") returned 5
	[0162.328] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0162.328] lstrlenW (lpString=".pdf") returned 4
	[0162.328] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.329] lstrlenW (lpString=".xls") returned 4
	[0162.329] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.329] lstrlenW (lpString=".xlsx") returned 5
	[0162.329] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0162.329] lstrlenW (lpString=".ppt") returned 4
	[0162.329] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.329] lstrlenW (lpString=".zip") returned 4
	[0162.329] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.329] lstrlenW (lpString=".rar") returned 4
	[0162.329] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.329] lstrlenW (lpString=".bz2") returned 4
	[0162.329] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.329] lstrlenW (lpString=".7z") returned 3
	[0162.329] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.329] lstrlenW (lpString=".dbf") returned 4
	[0162.329] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.329] lstrlenW (lpString=".1cd") returned 4
	[0162.329] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.329] lstrlenW (lpString=".jpg") returned 4
	[0162.329] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.329] lstrlenW (lpString=".doc") returned 4
	[0162.329] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.329] lstrlenW (lpString=".docx") returned 5
	[0162.329] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0162.329] lstrlenW (lpString=".pdf") returned 4
	[0162.330] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.330] lstrlenW (lpString=".xls") returned 4
	[0162.330] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.330] lstrlenW (lpString=".xlsx") returned 5
	[0162.330] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0162.330] lstrlenW (lpString=".ppt") returned 4
	[0162.330] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.330] lstrlenW (lpString=".zip") returned 4
	[0162.330] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.330] lstrlenW (lpString=".rar") returned 4
	[0162.330] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.330] lstrlenW (lpString=".bz2") returned 4
	[0162.330] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.330] lstrlenW (lpString=".7z") returned 3
	[0162.330] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.330] lstrlenW (lpString=".dbf") returned 4
	[0162.330] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.330] lstrlenW (lpString=".1cd") returned 4
	[0162.330] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0162.330] lstrlenW (lpString=".jpg") returned 4
	[0162.331] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.331] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.331] lstrlenW (lpString="J0099193.GIF") returned 12
	[0162.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0162.331] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=35546) returned 1
	[0162.331] CloseHandle (hObject=0x44c) returned 1
	[0162.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220
	[0162.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0162.332] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.332] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0162.332] GetLastError () returned 0x0
	[0162.332] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x8ada, lpOverlapped=0x0) returned 1
	[0162.335] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x8ae0, lpOverlapped=0x0) returned 1
	[0162.336] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.336] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.336] SetEndOfFile (hFile=0x4fc) returned 1
	[0162.336] CloseHandle (hObject=0x4fc) returned 1
	[0162.336] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.336] SetEndOfFile (hFile=0x44c) returned 1
	[0162.341] CloseHandle (hObject=0x44c) returned 1
	[0162.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1
	[0162.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.342] lstrlenW (lpString=".doc") returned 4
	[0162.342] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.342] lstrlenW (lpString=".docx") returned 5
	[0162.342] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0162.342] lstrlenW (lpString=".pdf") returned 4
	[0162.342] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.342] lstrlenW (lpString=".xls") returned 4
	[0162.342] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.342] lstrlenW (lpString=".xlsx") returned 5
	[0162.342] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0162.342] lstrlenW (lpString=".ppt") returned 4
	[0162.342] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.342] lstrlenW (lpString=".zip") returned 4
	[0162.342] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.342] lstrlenW (lpString=".rar") returned 4
	[0162.342] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.342] lstrlenW (lpString=".bz2") returned 4
	[0162.342] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.342] lstrlenW (lpString=".7z") returned 3
	[0162.342] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.342] lstrlenW (lpString=".dbf") returned 4
	[0162.343] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.343] lstrlenW (lpString=".1cd") returned 4
	[0162.343] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.343] lstrlenW (lpString=".jpg") returned 4
	[0162.343] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.343] lstrlenW (lpString=".doc") returned 4
	[0162.343] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.343] lstrlenW (lpString=".docx") returned 5
	[0162.343] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0162.343] lstrlenW (lpString=".pdf") returned 4
	[0162.343] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.343] lstrlenW (lpString=".xls") returned 4
	[0162.343] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.343] lstrlenW (lpString=".xlsx") returned 5
	[0162.343] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0162.343] lstrlenW (lpString=".ppt") returned 4
	[0162.343] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.343] lstrlenW (lpString=".zip") returned 4
	[0162.343] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.343] lstrlenW (lpString=".rar") returned 4
	[0162.343] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.343] lstrlenW (lpString=".bz2") returned 4
	[0162.343] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.343] lstrlenW (lpString=".7z") returned 3
	[0162.343] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.344] lstrlenW (lpString=".dbf") returned 4
	[0162.344] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.344] lstrlenW (lpString=".1cd") returned 4
	[0162.344] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0162.344] lstrlenW (lpString=".jpg") returned 4
	[0162.344] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.344] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.344] lstrlenW (lpString="J0099194.GIF") returned 12
	[0162.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0162.344] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=25265) returned 1
	[0162.344] CloseHandle (hObject=0x44c) returned 1
	[0162.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220
	[0162.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0162.345] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.345] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0162.345] GetLastError () returned 0x0
	[0162.725] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x62b1, lpOverlapped=0x0) returned 1
	[0162.727] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x62c0, lpOverlapped=0x0) returned 1
	[0162.728] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.728] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.728] SetEndOfFile (hFile=0x4fc) returned 1
	[0162.728] CloseHandle (hObject=0x4fc) returned 1
	[0162.729] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.729] SetEndOfFile (hFile=0x44c) returned 1
	[0162.733] CloseHandle (hObject=0x44c) returned 1
	[0162.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1
	[0162.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.734] lstrlenW (lpString=".doc") returned 4
	[0162.734] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.734] lstrlenW (lpString=".docx") returned 5
	[0162.734] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1
	[0162.734] lstrlenW (lpString=".pdf") returned 4
	[0162.734] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.734] lstrlenW (lpString=".xls") returned 4
	[0162.734] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.734] lstrlenW (lpString=".xlsx") returned 5
	[0162.734] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1
	[0162.734] lstrlenW (lpString=".ppt") returned 4
	[0162.735] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.735] lstrlenW (lpString=".zip") returned 4
	[0162.735] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.735] lstrlenW (lpString=".rar") returned 4
	[0162.735] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.735] lstrlenW (lpString=".bz2") returned 4
	[0162.735] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.735] lstrlenW (lpString=".7z") returned 3
	[0162.735] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.735] lstrlenW (lpString=".dbf") returned 4
	[0162.735] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.735] lstrlenW (lpString=".1cd") returned 4
	[0162.735] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.735] lstrlenW (lpString=".jpg") returned 4
	[0162.735] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.735] lstrlenW (lpString=".doc") returned 4
	[0162.735] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.735] lstrlenW (lpString=".docx") returned 5
	[0162.735] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1
	[0162.735] lstrlenW (lpString=".pdf") returned 4
	[0162.735] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.735] lstrlenW (lpString=".xls") returned 4
	[0162.735] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.735] lstrlenW (lpString=".xlsx") returned 5
	[0162.735] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1
	[0162.736] lstrlenW (lpString=".ppt") returned 4
	[0162.736] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.736] lstrlenW (lpString=".zip") returned 4
	[0162.736] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.736] lstrlenW (lpString=".rar") returned 4
	[0162.736] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.736] lstrlenW (lpString=".bz2") returned 4
	[0162.736] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.736] lstrlenW (lpString=".7z") returned 3
	[0162.736] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.736] lstrlenW (lpString=".dbf") returned 4
	[0162.736] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.736] lstrlenW (lpString=".1cd") returned 4
	[0162.736] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0162.736] lstrlenW (lpString=".jpg") returned 4
	[0162.736] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.737] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0162.737] lstrlenW (lpString="J0099205.WMF") returned 12
	[0162.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0162.738] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=17854) returned 1
	[0162.738] CloseHandle (hObject=0x44c) returned 1
	[0162.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220
	[0162.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0162.738] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.738] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0162.739] GetLastError () returned 0x0
	[0162.739] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x45be, lpOverlapped=0x0) returned 1
	[0162.741] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x45c0, lpOverlapped=0x0) returned 1
	[0162.742] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.742] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.742] SetEndOfFile (hFile=0x4fc) returned 1
	[0162.742] CloseHandle (hObject=0x4fc) returned 1
	[0162.742] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.742] SetEndOfFile (hFile=0x44c) returned 1
	[0162.745] CloseHandle (hObject=0x44c) returned 1
	[0162.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1
	[0162.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.746] lstrlenW (lpString=".doc") returned 4
	[0162.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0162.746] lstrlenW (lpString=".docx") returned 5
	[0162.746] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0162.746] lstrlenW (lpString=".pdf") returned 4
	[0162.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0162.746] lstrlenW (lpString=".xls") returned 4
	[0162.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0162.746] lstrlenW (lpString=".xlsx") returned 5
	[0162.746] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0162.746] lstrlenW (lpString=".ppt") returned 4
	[0162.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0162.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.746] lstrlenW (lpString=".zip") returned 4
	[0162.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0162.746] lstrlenW (lpString=".rar") returned 4
	[0162.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0162.747] lstrlenW (lpString=".bz2") returned 4
	[0162.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0162.747] lstrlenW (lpString=".7z") returned 3
	[0162.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0162.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.747] lstrlenW (lpString=".dbf") returned 4
	[0162.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0162.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.747] lstrlenW (lpString=".1cd") returned 4
	[0162.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0162.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.747] lstrlenW (lpString=".jpg") returned 4
	[0162.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0162.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.747] lstrlenW (lpString=".doc") returned 4
	[0162.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0162.747] lstrlenW (lpString=".docx") returned 5
	[0162.747] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0162.747] lstrlenW (lpString=".pdf") returned 4
	[0162.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0162.747] lstrlenW (lpString=".xls") returned 4
	[0162.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0162.747] lstrlenW (lpString=".xlsx") returned 5
	[0162.747] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0162.747] lstrlenW (lpString=".ppt") returned 4
	[0162.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0162.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.747] lstrlenW (lpString=".zip") returned 4
	[0162.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0162.748] lstrlenW (lpString=".rar") returned 4
	[0162.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0162.748] lstrlenW (lpString=".bz2") returned 4
	[0162.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0162.748] lstrlenW (lpString=".7z") returned 3
	[0162.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0162.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.748] lstrlenW (lpString=".dbf") returned 4
	[0162.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0162.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.748] lstrlenW (lpString=".1cd") returned 4
	[0162.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0162.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.748] lstrlenW (lpString=".jpg") returned 4
	[0162.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0162.748] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0162.748] lstrlenW (lpString="J0101856.BMP") returned 12
	[0162.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0162.749] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=78840) returned 1
	[0162.749] CloseHandle (hObject=0x44c) returned 1
	[0162.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220
	[0162.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0162.749] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.749] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0162.750] GetLastError () returned 0x0
	[0162.750] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x133f8, lpOverlapped=0x0) returned 1
	[0162.753] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x13400, lpOverlapped=0x0) returned 1
	[0162.756] ReadFile (in: hFile=0x44c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.756] WriteFile (in: hFile=0x4fc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.756] SetEndOfFile (hFile=0x4fc) returned 1
	[0162.756] CloseHandle (hObject=0x4fc) returned 1
	[0162.756] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.756] SetEndOfFile (hFile=0x44c) returned 1
	[0162.760] CloseHandle (hObject=0x44c) returned 1
	[0162.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1
	[0162.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.761] lstrlenW (lpString=".doc") returned 4
	[0162.761] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.761] lstrlenW (lpString=".docx") returned 5
	[0162.761] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0162.761] lstrlenW (lpString=".pdf") returned 4
	[0162.761] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.761] lstrlenW (lpString=".xls") returned 4
	[0162.762] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.762] lstrlenW (lpString=".xlsx") returned 5
	[0162.762] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0162.762] lstrlenW (lpString=".ppt") returned 4
	[0162.762] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.762] lstrlenW (lpString=".zip") returned 4
	[0162.762] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.762] lstrlenW (lpString=".rar") returned 4
	[0162.762] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.762] lstrlenW (lpString=".bz2") returned 4
	[0162.762] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.762] lstrlenW (lpString=".7z") returned 3
	[0162.762] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.762] lstrlenW (lpString=".dbf") returned 4
	[0162.762] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.762] lstrlenW (lpString=".1cd") returned 4
	[0162.762] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.762] lstrlenW (lpString=".jpg") returned 4
	[0162.762] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.762] lstrlenW (lpString=".doc") returned 4
	[0162.762] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.762] lstrlenW (lpString=".docx") returned 5
	[0162.762] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0162.762] lstrlenW (lpString=".pdf") returned 4
	[0162.763] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.763] lstrlenW (lpString=".xls") returned 4
	[0162.763] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.763] lstrlenW (lpString=".xlsx") returned 5
	[0162.763] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0162.763] lstrlenW (lpString=".ppt") returned 4
	[0162.763] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.763] lstrlenW (lpString=".zip") returned 4
	[0162.763] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.763] lstrlenW (lpString=".rar") returned 4
	[0162.763] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.763] lstrlenW (lpString=".bz2") returned 4
	[0162.763] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.763] lstrlenW (lpString=".7z") returned 3
	[0162.763] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.763] lstrlenW (lpString=".dbf") returned 4
	[0162.763] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.763] lstrlenW (lpString=".1cd") returned 4
	[0162.763] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.763] lstrlenW (lpString=".jpg") returned 4
	[0162.763] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.763] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0162.763] lstrlenW (lpString="J0101857.BMP") returned 12
	[0162.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0163.017] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=32184) returned 1
	[0163.017] CloseHandle (hObject=0x548) returned 1
	[0163.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220
	[0163.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0163.040] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.040] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0163.041] GetLastError () returned 0x0
	[0163.041] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0163.048] WriteFile (in: hFile=0x548, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0163.050] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.050] WriteFile (in: hFile=0x548, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.050] SetEndOfFile (hFile=0x548) returned 1
	[0163.210] CloseHandle (hObject=0x548) returned 1
	[0163.254] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.254] SetEndOfFile (hFile=0x55c) returned 1
	[0163.644] CloseHandle (hObject=0x55c) returned 1
	[0163.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1
	[0163.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.646] lstrlenW (lpString=".doc") returned 4
	[0163.646] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.646] lstrlenW (lpString=".docx") returned 5
	[0163.646] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0163.646] lstrlenW (lpString=".pdf") returned 4
	[0163.646] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.646] lstrlenW (lpString=".xls") returned 4
	[0163.646] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.646] lstrlenW (lpString=".xlsx") returned 5
	[0163.646] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0163.646] lstrlenW (lpString=".ppt") returned 4
	[0163.646] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.646] lstrlenW (lpString=".zip") returned 4
	[0163.646] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.646] lstrlenW (lpString=".rar") returned 4
	[0163.646] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.646] lstrlenW (lpString=".bz2") returned 4
	[0163.646] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.646] lstrlenW (lpString=".7z") returned 3
	[0163.646] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.647] lstrlenW (lpString=".dbf") returned 4
	[0163.647] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.647] lstrlenW (lpString=".1cd") returned 4
	[0163.647] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.647] lstrlenW (lpString=".jpg") returned 4
	[0163.647] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.647] lstrlenW (lpString=".doc") returned 4
	[0163.647] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.647] lstrlenW (lpString=".docx") returned 5
	[0163.647] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0163.647] lstrlenW (lpString=".pdf") returned 4
	[0163.647] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.647] lstrlenW (lpString=".xls") returned 4
	[0163.647] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.647] lstrlenW (lpString=".xlsx") returned 5
	[0163.647] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0163.647] lstrlenW (lpString=".ppt") returned 4
	[0163.648] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.648] lstrlenW (lpString=".zip") returned 4
	[0163.648] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.648] lstrlenW (lpString=".rar") returned 4
	[0163.648] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.648] lstrlenW (lpString=".bz2") returned 4
	[0163.648] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.648] lstrlenW (lpString=".7z") returned 3
	[0163.648] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.648] lstrlenW (lpString=".dbf") returned 4
	[0163.648] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.648] lstrlenW (lpString=".1cd") returned 4
	[0163.648] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0163.648] lstrlenW (lpString=".jpg") returned 4
	[0163.648] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.648] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.648] lstrlenW (lpString="J0103058.WMF") returned 12
	[0163.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0163.649] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=17344) returned 1
	[0163.649] CloseHandle (hObject=0x55c) returned 1
	[0163.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220
	[0163.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0163.649] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.650] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.650] GetLastError () returned 0x0
	[0163.650] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x43c0, lpOverlapped=0x0) returned 1
	[0163.652] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x43d0, lpOverlapped=0x0) returned 1
	[0163.653] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.654] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.654] SetEndOfFile (hFile=0x520) returned 1
	[0163.654] CloseHandle (hObject=0x520) returned 1
	[0163.654] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.654] SetEndOfFile (hFile=0x55c) returned 1
	[0163.657] CloseHandle (hObject=0x55c) returned 1
	[0163.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1
	[0163.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.658] lstrlenW (lpString=".doc") returned 4
	[0163.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.658] lstrlenW (lpString=".docx") returned 5
	[0163.658] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0163.658] lstrlenW (lpString=".pdf") returned 4
	[0163.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.658] lstrlenW (lpString=".xls") returned 4
	[0163.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.658] lstrlenW (lpString=".xlsx") returned 5
	[0163.658] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0163.658] lstrlenW (lpString=".ppt") returned 4
	[0163.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.658] lstrlenW (lpString=".zip") returned 4
	[0163.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.658] lstrlenW (lpString=".rar") returned 4
	[0163.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.659] lstrlenW (lpString=".bz2") returned 4
	[0163.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.659] lstrlenW (lpString=".7z") returned 3
	[0163.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.659] lstrlenW (lpString=".dbf") returned 4
	[0163.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.659] lstrlenW (lpString=".1cd") returned 4
	[0163.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.659] lstrlenW (lpString=".jpg") returned 4
	[0163.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.659] lstrlenW (lpString=".doc") returned 4
	[0163.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.659] lstrlenW (lpString=".docx") returned 5
	[0163.659] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0163.659] lstrlenW (lpString=".pdf") returned 4
	[0163.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.659] lstrlenW (lpString=".xls") returned 4
	[0163.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.659] lstrlenW (lpString=".xlsx") returned 5
	[0163.659] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0163.659] lstrlenW (lpString=".ppt") returned 4
	[0163.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.659] lstrlenW (lpString=".zip") returned 4
	[0163.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.660] lstrlenW (lpString=".rar") returned 4
	[0163.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.660] lstrlenW (lpString=".bz2") returned 4
	[0163.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.660] lstrlenW (lpString=".7z") returned 3
	[0163.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.660] lstrlenW (lpString=".dbf") returned 4
	[0163.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.660] lstrlenW (lpString=".1cd") returned 4
	[0163.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0163.660] lstrlenW (lpString=".jpg") returned 4
	[0163.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.660] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.660] lstrlenW (lpString="J0103262.WMF") returned 12
	[0163.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0163.661] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=12900) returned 1
	[0163.661] CloseHandle (hObject=0x55c) returned 1
	[0163.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220
	[0163.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0163.661] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.661] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.662] GetLastError () returned 0x0
	[0163.662] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x3264, lpOverlapped=0x0) returned 1
	[0163.664] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x3270, lpOverlapped=0x0) returned 1
	[0163.665] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.665] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.665] SetEndOfFile (hFile=0x520) returned 1
	[0163.665] CloseHandle (hObject=0x520) returned 1
	[0163.667] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.667] SetEndOfFile (hFile=0x55c) returned 1
	[0163.669] CloseHandle (hObject=0x55c) returned 1
	[0163.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1
	[0163.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.670] lstrlenW (lpString=".doc") returned 4
	[0163.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.670] lstrlenW (lpString=".docx") returned 5
	[0163.670] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.670] lstrlenW (lpString=".pdf") returned 4
	[0163.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.670] lstrlenW (lpString=".xls") returned 4
	[0163.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.670] lstrlenW (lpString=".xlsx") returned 5
	[0163.670] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.670] lstrlenW (lpString=".ppt") returned 4
	[0163.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.671] lstrlenW (lpString=".zip") returned 4
	[0163.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.671] lstrlenW (lpString=".rar") returned 4
	[0163.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.671] lstrlenW (lpString=".bz2") returned 4
	[0163.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.671] lstrlenW (lpString=".7z") returned 3
	[0163.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.671] lstrlenW (lpString=".dbf") returned 4
	[0163.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.671] lstrlenW (lpString=".1cd") returned 4
	[0163.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.671] lstrlenW (lpString=".jpg") returned 4
	[0163.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.671] lstrlenW (lpString=".doc") returned 4
	[0163.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.671] lstrlenW (lpString=".docx") returned 5
	[0163.671] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.671] lstrlenW (lpString=".pdf") returned 4
	[0163.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.671] lstrlenW (lpString=".xls") returned 4
	[0163.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.671] lstrlenW (lpString=".xlsx") returned 5
	[0163.671] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.671] lstrlenW (lpString=".ppt") returned 4
	[0163.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.672] lstrlenW (lpString=".zip") returned 4
	[0163.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.672] lstrlenW (lpString=".rar") returned 4
	[0163.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.672] lstrlenW (lpString=".bz2") returned 4
	[0163.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.672] lstrlenW (lpString=".7z") returned 3
	[0163.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.672] lstrlenW (lpString=".dbf") returned 4
	[0163.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.672] lstrlenW (lpString=".1cd") returned 4
	[0163.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0163.672] lstrlenW (lpString=".jpg") returned 4
	[0163.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.672] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.672] lstrlenW (lpString="J0103402.WMF") returned 12
	[0163.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0163.673] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=44948) returned 1
	[0163.673] CloseHandle (hObject=0x55c) returned 1
	[0163.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220
	[0163.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0163.674] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.674] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.675] GetLastError () returned 0x0
	[0163.675] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xaf94, lpOverlapped=0x0) returned 1
	[0163.997] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xafa0, lpOverlapped=0x0) returned 1
	[0164.005] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.005] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.005] SetEndOfFile (hFile=0x520) returned 1
	[0164.005] CloseHandle (hObject=0x520) returned 1
	[0164.005] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.005] SetEndOfFile (hFile=0x55c) returned 1
	[0164.008] CloseHandle (hObject=0x55c) returned 1
	[0164.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1
	[0164.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.009] lstrlenW (lpString=".doc") returned 4
	[0164.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.009] lstrlenW (lpString=".docx") returned 5
	[0164.009] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.009] lstrlenW (lpString=".pdf") returned 4
	[0164.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.009] lstrlenW (lpString=".xls") returned 4
	[0164.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.009] lstrlenW (lpString=".xlsx") returned 5
	[0164.010] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.010] lstrlenW (lpString=".ppt") returned 4
	[0164.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.010] lstrlenW (lpString=".zip") returned 4
	[0164.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.010] lstrlenW (lpString=".rar") returned 4
	[0164.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.010] lstrlenW (lpString=".bz2") returned 4
	[0164.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.010] lstrlenW (lpString=".7z") returned 3
	[0164.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.010] lstrlenW (lpString=".dbf") returned 4
	[0164.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.010] lstrlenW (lpString=".1cd") returned 4
	[0164.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.010] lstrlenW (lpString=".jpg") returned 4
	[0164.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.010] lstrlenW (lpString=".doc") returned 4
	[0164.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.010] lstrlenW (lpString=".docx") returned 5
	[0164.010] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.010] lstrlenW (lpString=".pdf") returned 4
	[0164.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.010] lstrlenW (lpString=".xls") returned 4
	[0164.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.011] lstrlenW (lpString=".xlsx") returned 5
	[0164.011] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.011] lstrlenW (lpString=".ppt") returned 4
	[0164.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.011] lstrlenW (lpString=".zip") returned 4
	[0164.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.011] lstrlenW (lpString=".rar") returned 4
	[0164.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.011] lstrlenW (lpString=".bz2") returned 4
	[0164.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.011] lstrlenW (lpString=".7z") returned 3
	[0164.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.011] lstrlenW (lpString=".dbf") returned 4
	[0164.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.011] lstrlenW (lpString=".1cd") returned 4
	[0164.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0164.011] lstrlenW (lpString=".jpg") returned 4
	[0164.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.011] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.011] lstrlenW (lpString="J0105250.WMF") returned 12
	[0164.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.013] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=4628) returned 1
	[0164.013] CloseHandle (hObject=0x55c) returned 1
	[0164.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220
	[0164.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.013] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.014] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0164.014] GetLastError () returned 0x0
	[0164.014] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1214, lpOverlapped=0x0) returned 1
	[0164.016] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1220, lpOverlapped=0x0) returned 1
	[0164.017] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.017] WriteFile (in: hFile=0x520, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.018] SetEndOfFile (hFile=0x520) returned 1
	[0164.018] CloseHandle (hObject=0x520) returned 1
	[0164.018] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.018] SetEndOfFile (hFile=0x55c) returned 1
	[0164.021] CloseHandle (hObject=0x55c) returned 1
	[0164.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1
	[0164.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.022] lstrlenW (lpString=".doc") returned 4
	[0164.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.022] lstrlenW (lpString=".docx") returned 5
	[0164.022] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0164.022] lstrlenW (lpString=".pdf") returned 4
	[0164.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.022] lstrlenW (lpString=".xls") returned 4
	[0164.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.022] lstrlenW (lpString=".xlsx") returned 5
	[0164.022] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0164.022] lstrlenW (lpString=".ppt") returned 4
	[0164.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.022] lstrlenW (lpString=".zip") returned 4
	[0164.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.022] lstrlenW (lpString=".rar") returned 4
	[0164.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.022] lstrlenW (lpString=".bz2") returned 4
	[0164.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.022] lstrlenW (lpString=".7z") returned 3
	[0164.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.023] lstrlenW (lpString=".dbf") returned 4
	[0164.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.023] lstrlenW (lpString=".1cd") returned 4
	[0164.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.023] lstrlenW (lpString=".jpg") returned 4
	[0164.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.023] lstrlenW (lpString=".doc") returned 4
	[0164.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.023] lstrlenW (lpString=".docx") returned 5
	[0164.023] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0164.023] lstrlenW (lpString=".pdf") returned 4
	[0164.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.023] lstrlenW (lpString=".xls") returned 4
	[0164.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.023] lstrlenW (lpString=".xlsx") returned 5
	[0164.023] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0164.023] lstrlenW (lpString=".ppt") returned 4
	[0164.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.023] lstrlenW (lpString=".zip") returned 4
	[0164.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.023] lstrlenW (lpString=".rar") returned 4
	[0164.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.023] lstrlenW (lpString=".bz2") returned 4
	[0164.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.023] lstrlenW (lpString=".7z") returned 3
	[0164.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.024] lstrlenW (lpString=".dbf") returned 4
	[0164.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.024] lstrlenW (lpString=".1cd") returned 4
	[0164.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0164.024] lstrlenW (lpString=".jpg") returned 4
	[0164.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.024] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.024] lstrlenW (lpString="J0105266.WMF") returned 12
	[0164.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.025] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=5908) returned 1
	[0164.025] CloseHandle (hObject=0x55c) returned 1
	[0164.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220
	[0164.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.026] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.026] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0164.306] GetLastError () returned 0x0
	[0164.306] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1714, lpOverlapped=0x0) returned 1
	[0164.319] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1720, lpOverlapped=0x0) returned 1
	[0164.320] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.320] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.320] SetEndOfFile (hFile=0x4f0) returned 1
	[0164.320] CloseHandle (hObject=0x4f0) returned 1
	[0164.320] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.320] SetEndOfFile (hFile=0x55c) returned 1
	[0164.323] CloseHandle (hObject=0x55c) returned 1
	[0164.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1
	[0164.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.324] lstrlenW (lpString=".doc") returned 4
	[0164.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.324] lstrlenW (lpString=".docx") returned 5
	[0164.324] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0164.324] lstrlenW (lpString=".pdf") returned 4
	[0164.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.324] lstrlenW (lpString=".xls") returned 4
	[0164.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.324] lstrlenW (lpString=".xlsx") returned 5
	[0164.324] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0164.324] lstrlenW (lpString=".ppt") returned 4
	[0164.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.324] lstrlenW (lpString=".zip") returned 4
	[0164.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.324] lstrlenW (lpString=".rar") returned 4
	[0164.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.324] lstrlenW (lpString=".bz2") returned 4
	[0164.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.324] lstrlenW (lpString=".7z") returned 3
	[0164.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.324] lstrlenW (lpString=".dbf") returned 4
	[0164.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.324] lstrlenW (lpString=".1cd") returned 4
	[0164.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.325] lstrlenW (lpString=".jpg") returned 4
	[0164.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.325] lstrlenW (lpString=".doc") returned 4
	[0164.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.325] lstrlenW (lpString=".docx") returned 5
	[0164.325] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0164.325] lstrlenW (lpString=".pdf") returned 4
	[0164.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.325] lstrlenW (lpString=".xls") returned 4
	[0164.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.325] lstrlenW (lpString=".xlsx") returned 5
	[0164.325] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0164.325] lstrlenW (lpString=".ppt") returned 4
	[0164.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.325] lstrlenW (lpString=".zip") returned 4
	[0164.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.325] lstrlenW (lpString=".rar") returned 4
	[0164.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.325] lstrlenW (lpString=".bz2") returned 4
	[0164.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.325] lstrlenW (lpString=".7z") returned 3
	[0164.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.325] lstrlenW (lpString=".dbf") returned 4
	[0164.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.326] lstrlenW (lpString=".1cd") returned 4
	[0164.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0164.326] lstrlenW (lpString=".jpg") returned 4
	[0164.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.326] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.326] lstrlenW (lpString="J0105288.WMF") returned 12
	[0164.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.326] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=15832) returned 1
	[0164.326] CloseHandle (hObject=0x55c) returned 1
	[0164.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220
	[0164.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.327] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.327] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0164.328] GetLastError () returned 0x0
	[0164.328] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x3dd8, lpOverlapped=0x0) returned 1
	[0164.332] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x3de0, lpOverlapped=0x0) returned 1
	[0164.333] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.333] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.333] SetEndOfFile (hFile=0x4f0) returned 1
	[0164.334] CloseHandle (hObject=0x4f0) returned 1
	[0164.336] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.336] SetEndOfFile (hFile=0x55c) returned 1
	[0164.338] CloseHandle (hObject=0x55c) returned 1
	[0164.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1
	[0164.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.339] lstrlenW (lpString=".doc") returned 4
	[0164.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.339] lstrlenW (lpString=".docx") returned 5
	[0164.340] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0164.340] lstrlenW (lpString=".pdf") returned 4
	[0164.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.340] lstrlenW (lpString=".xls") returned 4
	[0164.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.340] lstrlenW (lpString=".xlsx") returned 5
	[0164.340] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0164.340] lstrlenW (lpString=".ppt") returned 4
	[0164.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.340] lstrlenW (lpString=".zip") returned 4
	[0164.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.340] lstrlenW (lpString=".rar") returned 4
	[0164.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.340] lstrlenW (lpString=".bz2") returned 4
	[0164.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.340] lstrlenW (lpString=".7z") returned 3
	[0164.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.340] lstrlenW (lpString=".dbf") returned 4
	[0164.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.340] lstrlenW (lpString=".1cd") returned 4
	[0164.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.340] lstrlenW (lpString=".jpg") returned 4
	[0164.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.340] lstrlenW (lpString=".doc") returned 4
	[0164.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.341] lstrlenW (lpString=".docx") returned 5
	[0164.341] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0164.341] lstrlenW (lpString=".pdf") returned 4
	[0164.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.341] lstrlenW (lpString=".xls") returned 4
	[0164.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.341] lstrlenW (lpString=".xlsx") returned 5
	[0164.341] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0164.341] lstrlenW (lpString=".ppt") returned 4
	[0164.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.341] lstrlenW (lpString=".zip") returned 4
	[0164.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.341] lstrlenW (lpString=".rar") returned 4
	[0164.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.341] lstrlenW (lpString=".bz2") returned 4
	[0164.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.341] lstrlenW (lpString=".7z") returned 3
	[0164.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.341] lstrlenW (lpString=".dbf") returned 4
	[0164.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.341] lstrlenW (lpString=".1cd") returned 4
	[0164.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0164.341] lstrlenW (lpString=".jpg") returned 4
	[0164.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.342] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.342] lstrlenW (lpString="J0105292.WMF") returned 12
	[0164.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.342] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=14868) returned 1
	[0164.342] CloseHandle (hObject=0x55c) returned 1
	[0164.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220
	[0164.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.343] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.343] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0164.343] GetLastError () returned 0x0
	[0164.343] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x3a14, lpOverlapped=0x0) returned 1
	[0164.345] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x3a20, lpOverlapped=0x0) returned 1
	[0164.346] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.346] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.346] SetEndOfFile (hFile=0x4f0) returned 1
	[0164.347] CloseHandle (hObject=0x4f0) returned 1
	[0164.347] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.347] SetEndOfFile (hFile=0x55c) returned 1
	[0164.351] CloseHandle (hObject=0x55c) returned 1
	[0164.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1
	[0164.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.352] lstrlenW (lpString=".doc") returned 4
	[0164.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.352] lstrlenW (lpString=".docx") returned 5
	[0164.352] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.352] lstrlenW (lpString=".pdf") returned 4
	[0164.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.352] lstrlenW (lpString=".xls") returned 4
	[0164.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.352] lstrlenW (lpString=".xlsx") returned 5
	[0164.352] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.352] lstrlenW (lpString=".ppt") returned 4
	[0164.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.352] lstrlenW (lpString=".zip") returned 4
	[0164.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.352] lstrlenW (lpString=".rar") returned 4
	[0164.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.352] lstrlenW (lpString=".bz2") returned 4
	[0164.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.352] lstrlenW (lpString=".7z") returned 3
	[0164.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.352] lstrlenW (lpString=".dbf") returned 4
	[0164.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.352] lstrlenW (lpString=".1cd") returned 4
	[0164.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.353] lstrlenW (lpString=".jpg") returned 4
	[0164.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.353] lstrlenW (lpString=".doc") returned 4
	[0164.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.353] lstrlenW (lpString=".docx") returned 5
	[0164.353] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.353] lstrlenW (lpString=".pdf") returned 4
	[0164.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.353] lstrlenW (lpString=".xls") returned 4
	[0164.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.353] lstrlenW (lpString=".xlsx") returned 5
	[0164.353] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.353] lstrlenW (lpString=".ppt") returned 4
	[0164.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.353] lstrlenW (lpString=".zip") returned 4
	[0164.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.353] lstrlenW (lpString=".rar") returned 4
	[0164.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.353] lstrlenW (lpString=".bz2") returned 4
	[0164.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.353] lstrlenW (lpString=".7z") returned 3
	[0164.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.353] lstrlenW (lpString=".dbf") returned 4
	[0164.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.353] lstrlenW (lpString=".1cd") returned 4
	[0164.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0164.354] lstrlenW (lpString=".jpg") returned 4
	[0164.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.354] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.354] lstrlenW (lpString="J0105294.WMF") returned 12
	[0164.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.355] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=5504) returned 1
	[0164.355] CloseHandle (hObject=0x55c) returned 1
	[0164.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220
	[0164.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.356] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.356] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0164.356] GetLastError () returned 0x0
	[0164.356] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1580, lpOverlapped=0x0) returned 1
	[0164.450] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1590, lpOverlapped=0x0) returned 1
	[0164.451] ReadFile (in: hFile=0x55c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.451] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.451] SetEndOfFile (hFile=0x4f0) returned 1
	[0164.451] CloseHandle (hObject=0x4f0) returned 1
	[0164.451] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.452] SetEndOfFile (hFile=0x55c) returned 1
	[0164.455] CloseHandle (hObject=0x55c) returned 1
	[0164.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1
	[0164.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.639] lstrlenW (lpString=".doc") returned 4
	[0164.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.639] lstrlenW (lpString=".docx") returned 5
	[0164.639] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0164.639] lstrlenW (lpString=".pdf") returned 4
	[0164.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.639] lstrlenW (lpString=".xls") returned 4
	[0164.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.640] lstrlenW (lpString=".xlsx") returned 5
	[0164.640] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0164.640] lstrlenW (lpString=".ppt") returned 4
	[0164.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.640] lstrlenW (lpString=".zip") returned 4
	[0164.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.640] lstrlenW (lpString=".rar") returned 4
	[0164.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.640] lstrlenW (lpString=".bz2") returned 4
	[0164.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.640] lstrlenW (lpString=".7z") returned 3
	[0164.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.640] lstrlenW (lpString=".dbf") returned 4
	[0164.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.640] lstrlenW (lpString=".1cd") returned 4
	[0164.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.640] lstrlenW (lpString=".jpg") returned 4
	[0164.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.640] lstrlenW (lpString=".doc") returned 4
	[0164.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.640] lstrlenW (lpString=".docx") returned 5
	[0164.640] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0164.640] lstrlenW (lpString=".pdf") returned 4
	[0164.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.641] lstrlenW (lpString=".xls") returned 4
	[0164.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.641] lstrlenW (lpString=".xlsx") returned 5
	[0164.641] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0164.641] lstrlenW (lpString=".ppt") returned 4
	[0164.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.641] lstrlenW (lpString=".zip") returned 4
	[0164.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.641] lstrlenW (lpString=".rar") returned 4
	[0164.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.641] lstrlenW (lpString=".bz2") returned 4
	[0164.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.641] lstrlenW (lpString=".7z") returned 3
	[0164.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.641] lstrlenW (lpString=".dbf") returned 4
	[0164.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.641] lstrlenW (lpString=".1cd") returned 4
	[0164.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0164.641] lstrlenW (lpString=".jpg") returned 4
	[0164.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.641] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.641] lstrlenW (lpString="J0105338.WMF") returned 12
	[0164.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.368] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=11584) returned 1
	[0165.374] CloseHandle (hObject=0x55c) returned 1
	[0165.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220
	[0165.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0165.395] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.395] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.397] GetLastError () returned 0x0
	[0165.397] ReadFile (in: hFile=0x550, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x2d40, lpOverlapped=0x0) returned 1
	[0165.398] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0165.399] ReadFile (in: hFile=0x550, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.400] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.400] SetEndOfFile (hFile=0x4b8) returned 1
	[0165.400] CloseHandle (hObject=0x4b8) returned 1
	[0165.400] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.400] SetEndOfFile (hFile=0x550) returned 1
	[0165.403] CloseHandle (hObject=0x550) returned 1
	[0165.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0165.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1
	[0165.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.404] lstrlenW (lpString=".doc") returned 4
	[0165.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.404] lstrlenW (lpString=".docx") returned 5
	[0165.404] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0165.405] lstrlenW (lpString=".pdf") returned 4
	[0165.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.405] lstrlenW (lpString=".xls") returned 4
	[0165.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.405] lstrlenW (lpString=".xlsx") returned 5
	[0165.405] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0165.405] lstrlenW (lpString=".ppt") returned 4
	[0165.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.405] lstrlenW (lpString=".zip") returned 4
	[0165.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.405] lstrlenW (lpString=".rar") returned 4
	[0165.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.405] lstrlenW (lpString=".bz2") returned 4
	[0165.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.405] lstrlenW (lpString=".7z") returned 3
	[0165.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.405] lstrlenW (lpString=".dbf") returned 4
	[0165.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.405] lstrlenW (lpString=".1cd") returned 4
	[0165.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.405] lstrlenW (lpString=".jpg") returned 4
	[0165.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.405] lstrlenW (lpString=".doc") returned 4
	[0165.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.406] lstrlenW (lpString=".docx") returned 5
	[0165.406] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0165.406] lstrlenW (lpString=".pdf") returned 4
	[0165.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.406] lstrlenW (lpString=".xls") returned 4
	[0165.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.406] lstrlenW (lpString=".xlsx") returned 5
	[0165.406] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0165.406] lstrlenW (lpString=".ppt") returned 4
	[0165.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.406] lstrlenW (lpString=".zip") returned 4
	[0165.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.406] lstrlenW (lpString=".rar") returned 4
	[0165.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.406] lstrlenW (lpString=".bz2") returned 4
	[0165.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.406] lstrlenW (lpString=".7z") returned 3
	[0165.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.406] lstrlenW (lpString=".dbf") returned 4
	[0165.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.406] lstrlenW (lpString=".1cd") returned 4
	[0165.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0165.406] lstrlenW (lpString=".jpg") returned 4
	[0165.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.407] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0165.407] lstrlenW (lpString="J0105376.WMF") returned 12
	[0165.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0165.408] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=4964) returned 1
	[0165.408] CloseHandle (hObject=0x550) returned 1
	[0165.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220
	[0165.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0165.408] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.409] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.410] GetLastError () returned 0x0
	[0165.410] ReadFile (in: hFile=0x550, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1364, lpOverlapped=0x0) returned 1
	[0165.411] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1370, lpOverlapped=0x0) returned 1
	[0165.412] ReadFile (in: hFile=0x550, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.413] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.413] SetEndOfFile (hFile=0x4b8) returned 1
	[0165.413] CloseHandle (hObject=0x4b8) returned 1
	[0165.413] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.413] SetEndOfFile (hFile=0x550) returned 1
	[0165.416] CloseHandle (hObject=0x550) returned 1
	[0165.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0165.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1
	[0165.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.417] lstrlenW (lpString=".doc") returned 4
	[0165.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.417] lstrlenW (lpString=".docx") returned 5
	[0165.417] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0165.417] lstrlenW (lpString=".pdf") returned 4
	[0165.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.417] lstrlenW (lpString=".xls") returned 4
	[0165.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.417] lstrlenW (lpString=".xlsx") returned 5
	[0165.417] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0165.417] lstrlenW (lpString=".ppt") returned 4
	[0165.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.418] lstrlenW (lpString=".zip") returned 4
	[0165.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.418] lstrlenW (lpString=".rar") returned 4
	[0165.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.418] lstrlenW (lpString=".bz2") returned 4
	[0165.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.418] lstrlenW (lpString=".7z") returned 3
	[0165.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.418] lstrlenW (lpString=".dbf") returned 4
	[0165.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.418] lstrlenW (lpString=".1cd") returned 4
	[0165.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.418] lstrlenW (lpString=".jpg") returned 4
	[0165.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.418] lstrlenW (lpString=".doc") returned 4
	[0165.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.418] lstrlenW (lpString=".docx") returned 5
	[0165.418] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0165.418] lstrlenW (lpString=".pdf") returned 4
	[0165.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.418] lstrlenW (lpString=".xls") returned 4
	[0165.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.418] lstrlenW (lpString=".xlsx") returned 5
	[0165.418] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0165.418] lstrlenW (lpString=".ppt") returned 4
	[0165.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.419] lstrlenW (lpString=".zip") returned 4
	[0165.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.419] lstrlenW (lpString=".rar") returned 4
	[0165.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.419] lstrlenW (lpString=".bz2") returned 4
	[0165.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.419] lstrlenW (lpString=".7z") returned 3
	[0165.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.419] lstrlenW (lpString=".dbf") returned 4
	[0165.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.419] lstrlenW (lpString=".1cd") returned 4
	[0165.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0165.419] lstrlenW (lpString=".jpg") returned 4
	[0165.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.419] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0165.419] lstrlenW (lpString="J0105378.WMF") returned 12
	[0165.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0165.420] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=4964) returned 1
	[0165.420] CloseHandle (hObject=0x550) returned 1
	[0165.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220
	[0165.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0165.421] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.421] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.421] GetLastError () returned 0x0
	[0165.421] ReadFile (in: hFile=0x550, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1364, lpOverlapped=0x0) returned 1
	[0165.423] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1370, lpOverlapped=0x0) returned 1
	[0165.424] ReadFile (in: hFile=0x550, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.424] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.424] SetEndOfFile (hFile=0x4b8) returned 1
	[0165.424] CloseHandle (hObject=0x4b8) returned 1
	[0165.424] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.424] SetEndOfFile (hFile=0x550) returned 1
	[0165.427] CloseHandle (hObject=0x550) returned 1
	[0165.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0165.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1
	[0165.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.428] lstrlenW (lpString=".doc") returned 4
	[0165.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.428] lstrlenW (lpString=".docx") returned 5
	[0165.428] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0165.428] lstrlenW (lpString=".pdf") returned 4
	[0165.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.428] lstrlenW (lpString=".xls") returned 4
	[0165.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.428] lstrlenW (lpString=".xlsx") returned 5
	[0165.428] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0165.428] lstrlenW (lpString=".ppt") returned 4
	[0165.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.428] lstrlenW (lpString=".zip") returned 4
	[0165.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.428] lstrlenW (lpString=".rar") returned 4
	[0165.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.428] lstrlenW (lpString=".bz2") returned 4
	[0165.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.428] lstrlenW (lpString=".7z") returned 3
	[0165.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.429] lstrlenW (lpString=".dbf") returned 4
	[0165.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.429] lstrlenW (lpString=".1cd") returned 4
	[0165.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.429] lstrlenW (lpString=".jpg") returned 4
	[0165.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.429] lstrlenW (lpString=".doc") returned 4
	[0165.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.429] lstrlenW (lpString=".docx") returned 5
	[0165.429] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0165.429] lstrlenW (lpString=".pdf") returned 4
	[0165.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.429] lstrlenW (lpString=".xls") returned 4
	[0165.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.429] lstrlenW (lpString=".xlsx") returned 5
	[0165.429] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0165.429] lstrlenW (lpString=".ppt") returned 4
	[0165.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.429] lstrlenW (lpString=".zip") returned 4
	[0165.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.429] lstrlenW (lpString=".rar") returned 4
	[0165.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.429] lstrlenW (lpString=".bz2") returned 4
	[0165.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.430] lstrlenW (lpString=".7z") returned 3
	[0165.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.430] lstrlenW (lpString=".dbf") returned 4
	[0165.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.430] lstrlenW (lpString=".1cd") returned 4
	[0165.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0165.430] lstrlenW (lpString=".jpg") returned 4
	[0165.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.430] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0165.430] lstrlenW (lpString="J0105380.WMF") returned 12
	[0165.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0165.915] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=4624) returned 1
	[0165.915] CloseHandle (hObject=0x520) returned 1
	[0165.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220
	[0166.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0166.570] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.570] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0166.671] GetLastError () returned 0x0
	[0166.671] ReadFile (in: hFile=0x4e0, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1210, lpOverlapped=0x0) returned 1
	[0166.672] WriteFile (in: hFile=0x53c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1220, lpOverlapped=0x0) returned 1
	[0166.673] ReadFile (in: hFile=0x4e0, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.673] WriteFile (in: hFile=0x53c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.674] SetEndOfFile (hFile=0x53c) returned 1
	[0166.674] CloseHandle (hObject=0x53c) returned 1
	[0166.674] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.674] SetEndOfFile (hFile=0x4e0) returned 1
	[0166.678] CloseHandle (hObject=0x4e0) returned 1
	[0166.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0166.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1
	[0166.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.991] lstrlenW (lpString=".doc") returned 4
	[0166.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.991] lstrlenW (lpString=".docx") returned 5
	[0166.991] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0166.991] lstrlenW (lpString=".pdf") returned 4
	[0166.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.992] lstrlenW (lpString=".xls") returned 4
	[0166.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.992] lstrlenW (lpString=".xlsx") returned 5
	[0166.992] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0166.992] lstrlenW (lpString=".ppt") returned 4
	[0166.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.992] lstrlenW (lpString=".zip") returned 4
	[0166.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.992] lstrlenW (lpString=".rar") returned 4
	[0166.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.992] lstrlenW (lpString=".bz2") returned 4
	[0166.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.992] lstrlenW (lpString=".7z") returned 3
	[0166.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.992] lstrlenW (lpString=".dbf") returned 4
	[0166.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.992] lstrlenW (lpString=".1cd") returned 4
	[0166.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.992] lstrlenW (lpString=".jpg") returned 4
	[0166.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.993] lstrlenW (lpString=".doc") returned 4
	[0166.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.993] lstrlenW (lpString=".docx") returned 5
	[0166.993] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0166.993] lstrlenW (lpString=".pdf") returned 4
	[0166.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.993] lstrlenW (lpString=".xls") returned 4
	[0166.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.993] lstrlenW (lpString=".xlsx") returned 5
	[0166.993] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0166.993] lstrlenW (lpString=".ppt") returned 4
	[0166.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.993] lstrlenW (lpString=".zip") returned 4
	[0166.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.993] lstrlenW (lpString=".rar") returned 4
	[0166.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.994] lstrlenW (lpString=".bz2") returned 4
	[0166.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.994] lstrlenW (lpString=".7z") returned 3
	[0166.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.994] lstrlenW (lpString=".dbf") returned 4
	[0166.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.994] lstrlenW (lpString=".1cd") returned 4
	[0166.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.994] lstrlenW (lpString=".jpg") returned 4
	[0166.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.994] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0166.994] lstrlenW (lpString="J0105414.WMF") returned 12
	[0166.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0166.995] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=6244) returned 1
	[0166.995] CloseHandle (hObject=0x534) returned 1
	[0166.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220
	[0166.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0166.996] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.996] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0166.997] GetLastError () returned 0x0
	[0166.997] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1864, lpOverlapped=0x0) returned 1
	[0166.998] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1870, lpOverlapped=0x0) returned 1
	[0167.000] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.000] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.000] SetEndOfFile (hFile=0x554) returned 1
	[0167.000] CloseHandle (hObject=0x554) returned 1
	[0167.000] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.000] SetEndOfFile (hFile=0x534) returned 1
	[0167.003] CloseHandle (hObject=0x534) returned 1
	[0167.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1
	[0167.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.005] lstrlenW (lpString=".doc") returned 4
	[0167.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.005] lstrlenW (lpString=".docx") returned 5
	[0167.005] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0167.005] lstrlenW (lpString=".pdf") returned 4
	[0167.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.005] lstrlenW (lpString=".xls") returned 4
	[0167.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.005] lstrlenW (lpString=".xlsx") returned 5
	[0167.005] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0167.005] lstrlenW (lpString=".ppt") returned 4
	[0167.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.005] lstrlenW (lpString=".zip") returned 4
	[0167.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.005] lstrlenW (lpString=".rar") returned 4
	[0167.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.005] lstrlenW (lpString=".bz2") returned 4
	[0167.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.005] lstrlenW (lpString=".7z") returned 3
	[0167.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.005] lstrlenW (lpString=".dbf") returned 4
	[0167.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.005] lstrlenW (lpString=".1cd") returned 4
	[0167.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.006] lstrlenW (lpString=".jpg") returned 4
	[0167.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.006] lstrlenW (lpString=".doc") returned 4
	[0167.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.006] lstrlenW (lpString=".docx") returned 5
	[0167.006] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0167.006] lstrlenW (lpString=".pdf") returned 4
	[0167.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.006] lstrlenW (lpString=".xls") returned 4
	[0167.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.006] lstrlenW (lpString=".xlsx") returned 5
	[0167.006] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0167.006] lstrlenW (lpString=".ppt") returned 4
	[0167.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.006] lstrlenW (lpString=".zip") returned 4
	[0167.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.006] lstrlenW (lpString=".rar") returned 4
	[0167.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.006] lstrlenW (lpString=".bz2") returned 4
	[0167.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.006] lstrlenW (lpString=".7z") returned 3
	[0167.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.006] lstrlenW (lpString=".dbf") returned 4
	[0167.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.007] lstrlenW (lpString=".1cd") returned 4
	[0167.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.007] lstrlenW (lpString=".jpg") returned 4
	[0167.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.008] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.008] lstrlenW (lpString="J0105490.WMF") returned 12
	[0167.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0167.010] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=18728) returned 1
	[0167.010] CloseHandle (hObject=0x534) returned 1
	[0167.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220
	[0167.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0167.011] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.011] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.012] GetLastError () returned 0x0
	[0167.012] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x4928, lpOverlapped=0x0) returned 1
	[0167.014] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x4930, lpOverlapped=0x0) returned 1
	[0167.015] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.015] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.015] SetEndOfFile (hFile=0x554) returned 1
	[0167.015] CloseHandle (hObject=0x554) returned 1
	[0167.016] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.016] SetEndOfFile (hFile=0x534) returned 1
	[0167.492] CloseHandle (hObject=0x534) returned 1
	[0167.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1
	[0167.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.494] lstrlenW (lpString=".doc") returned 4
	[0167.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.494] lstrlenW (lpString=".docx") returned 5
	[0167.494] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0167.494] lstrlenW (lpString=".pdf") returned 4
	[0167.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.494] lstrlenW (lpString=".xls") returned 4
	[0167.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.494] lstrlenW (lpString=".xlsx") returned 5
	[0167.494] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0167.494] lstrlenW (lpString=".ppt") returned 4
	[0167.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.495] lstrlenW (lpString=".zip") returned 4
	[0167.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.495] lstrlenW (lpString=".rar") returned 4
	[0167.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.495] lstrlenW (lpString=".bz2") returned 4
	[0167.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.495] lstrlenW (lpString=".7z") returned 3
	[0167.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.495] lstrlenW (lpString=".dbf") returned 4
	[0167.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.495] lstrlenW (lpString=".1cd") returned 4
	[0167.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.495] lstrlenW (lpString=".jpg") returned 4
	[0167.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.495] lstrlenW (lpString=".doc") returned 4
	[0167.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.495] lstrlenW (lpString=".docx") returned 5
	[0167.495] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0167.495] lstrlenW (lpString=".pdf") returned 4
	[0167.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.495] lstrlenW (lpString=".xls") returned 4
	[0167.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.496] lstrlenW (lpString=".xlsx") returned 5
	[0167.496] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0167.496] lstrlenW (lpString=".ppt") returned 4
	[0167.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.496] lstrlenW (lpString=".zip") returned 4
	[0167.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.496] lstrlenW (lpString=".rar") returned 4
	[0167.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.496] lstrlenW (lpString=".bz2") returned 4
	[0167.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.496] lstrlenW (lpString=".7z") returned 3
	[0167.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.496] lstrlenW (lpString=".dbf") returned 4
	[0167.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.496] lstrlenW (lpString=".1cd") returned 4
	[0167.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.496] lstrlenW (lpString=".jpg") returned 4
	[0167.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.497] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.497] lstrlenW (lpString="J0105530.WMF") returned 12
	[0167.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0167.497] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=7384) returned 1
	[0167.497] CloseHandle (hObject=0x534) returned 1
	[0167.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220
	[0167.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0167.498] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.498] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0167.499] GetLastError () returned 0x0
	[0167.499] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1cd8, lpOverlapped=0x0) returned 1
	[0167.501] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1ce0, lpOverlapped=0x0) returned 1
	[0167.502] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.502] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.502] SetEndOfFile (hFile=0x4f0) returned 1
	[0167.502] CloseHandle (hObject=0x4f0) returned 1
	[0167.502] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.502] SetEndOfFile (hFile=0x534) returned 1
	[0167.506] CloseHandle (hObject=0x534) returned 1
	[0167.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1
	[0167.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.507] lstrlenW (lpString=".doc") returned 4
	[0167.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.507] lstrlenW (lpString=".docx") returned 5
	[0167.507] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0167.507] lstrlenW (lpString=".pdf") returned 4
	[0167.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.507] lstrlenW (lpString=".xls") returned 4
	[0167.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.507] lstrlenW (lpString=".xlsx") returned 5
	[0167.507] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0167.507] lstrlenW (lpString=".ppt") returned 4
	[0167.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.508] lstrlenW (lpString=".zip") returned 4
	[0167.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.508] lstrlenW (lpString=".rar") returned 4
	[0167.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.508] lstrlenW (lpString=".bz2") returned 4
	[0167.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.508] lstrlenW (lpString=".7z") returned 3
	[0167.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.508] lstrlenW (lpString=".dbf") returned 4
	[0167.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.508] lstrlenW (lpString=".1cd") returned 4
	[0167.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.508] lstrlenW (lpString=".jpg") returned 4
	[0167.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.508] lstrlenW (lpString=".doc") returned 4
	[0167.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.508] lstrlenW (lpString=".docx") returned 5
	[0167.508] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0167.508] lstrlenW (lpString=".pdf") returned 4
	[0167.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.508] lstrlenW (lpString=".xls") returned 4
	[0167.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.509] lstrlenW (lpString=".xlsx") returned 5
	[0167.509] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0167.509] lstrlenW (lpString=".ppt") returned 4
	[0167.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.509] lstrlenW (lpString=".zip") returned 4
	[0167.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.509] lstrlenW (lpString=".rar") returned 4
	[0167.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.509] lstrlenW (lpString=".bz2") returned 4
	[0167.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.509] lstrlenW (lpString=".7z") returned 3
	[0167.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.509] lstrlenW (lpString=".dbf") returned 4
	[0167.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.509] lstrlenW (lpString=".1cd") returned 4
	[0167.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0167.509] lstrlenW (lpString=".jpg") returned 4
	[0167.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.509] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.510] lstrlenW (lpString="J0105588.WMF") returned 12
	[0167.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0167.511] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=21548) returned 1
	[0167.511] CloseHandle (hObject=0x534) returned 1
	[0167.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220
	[0167.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0167.514] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.514] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0167.515] GetLastError () returned 0x0
	[0167.515] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x542c, lpOverlapped=0x0) returned 1
	[0167.517] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x5430, lpOverlapped=0x0) returned 1
	[0167.519] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.519] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.519] SetEndOfFile (hFile=0x4f0) returned 1
	[0167.520] CloseHandle (hObject=0x4f0) returned 1
	[0167.520] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.520] SetEndOfFile (hFile=0x534) returned 1
	[0167.523] CloseHandle (hObject=0x534) returned 1
	[0167.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1
	[0167.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.524] lstrlenW (lpString=".doc") returned 4
	[0167.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.524] lstrlenW (lpString=".docx") returned 5
	[0167.524] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0167.524] lstrlenW (lpString=".pdf") returned 4
	[0167.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.524] lstrlenW (lpString=".xls") returned 4
	[0167.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.524] lstrlenW (lpString=".xlsx") returned 5
	[0167.524] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0167.524] lstrlenW (lpString=".ppt") returned 4
	[0167.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.525] lstrlenW (lpString=".zip") returned 4
	[0167.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.525] lstrlenW (lpString=".rar") returned 4
	[0167.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.525] lstrlenW (lpString=".bz2") returned 4
	[0167.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.525] lstrlenW (lpString=".7z") returned 3
	[0167.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.525] lstrlenW (lpString=".dbf") returned 4
	[0167.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.525] lstrlenW (lpString=".1cd") returned 4
	[0167.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.525] lstrlenW (lpString=".jpg") returned 4
	[0167.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.525] lstrlenW (lpString=".doc") returned 4
	[0167.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.525] lstrlenW (lpString=".docx") returned 5
	[0167.525] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0167.525] lstrlenW (lpString=".pdf") returned 4
	[0167.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.525] lstrlenW (lpString=".xls") returned 4
	[0167.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.526] lstrlenW (lpString=".xlsx") returned 5
	[0167.526] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0167.526] lstrlenW (lpString=".ppt") returned 4
	[0167.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.526] lstrlenW (lpString=".zip") returned 4
	[0167.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.526] lstrlenW (lpString=".rar") returned 4
	[0167.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.526] lstrlenW (lpString=".bz2") returned 4
	[0167.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.526] lstrlenW (lpString=".7z") returned 3
	[0167.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.526] lstrlenW (lpString=".dbf") returned 4
	[0167.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.526] lstrlenW (lpString=".1cd") returned 4
	[0167.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.526] lstrlenW (lpString=".jpg") returned 4
	[0167.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.526] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.527] lstrlenW (lpString="J0105600.WMF") returned 12
	[0167.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0167.527] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=8680) returned 1
	[0167.527] CloseHandle (hObject=0x534) returned 1
	[0167.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220
	[0167.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0167.528] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.528] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0167.529] GetLastError () returned 0x0
	[0167.529] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x21e8, lpOverlapped=0x0) returned 1
	[0167.530] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x21f0, lpOverlapped=0x0) returned 1
	[0168.360] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.360] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.360] SetEndOfFile (hFile=0x4f0) returned 1
	[0168.360] CloseHandle (hObject=0x4f0) returned 1
	[0168.361] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.361] SetEndOfFile (hFile=0x534) returned 1
	[0168.867] CloseHandle (hObject=0x534) returned 1
	[0168.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 1
	[0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.869] lstrlenW (lpString=".doc") returned 4
	[0168.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.869] lstrlenW (lpString=".docx") returned 5
	[0168.869] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.869] lstrlenW (lpString=".pdf") returned 4
	[0168.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.869] lstrlenW (lpString=".xls") returned 4
	[0168.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.869] lstrlenW (lpString=".xlsx") returned 5
	[0168.869] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.869] lstrlenW (lpString=".ppt") returned 4
	[0168.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.869] lstrlenW (lpString=".zip") returned 4
	[0168.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.869] lstrlenW (lpString=".rar") returned 4
	[0168.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.869] lstrlenW (lpString=".bz2") returned 4
	[0168.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.869] lstrlenW (lpString=".7z") returned 3
	[0168.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.869] lstrlenW (lpString=".dbf") returned 4
	[0168.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.870] lstrlenW (lpString=".1cd") returned 4
	[0168.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.870] lstrlenW (lpString=".jpg") returned 4
	[0168.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.870] lstrlenW (lpString=".doc") returned 4
	[0168.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.870] lstrlenW (lpString=".docx") returned 5
	[0168.870] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.870] lstrlenW (lpString=".pdf") returned 4
	[0168.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.870] lstrlenW (lpString=".xls") returned 4
	[0168.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.870] lstrlenW (lpString=".xlsx") returned 5
	[0168.870] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.870] lstrlenW (lpString=".ppt") returned 4
	[0168.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.870] lstrlenW (lpString=".zip") returned 4
	[0168.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.870] lstrlenW (lpString=".rar") returned 4
	[0168.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.870] lstrlenW (lpString=".bz2") returned 4
	[0168.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.871] lstrlenW (lpString=".7z") returned 3
	[0168.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.871] lstrlenW (lpString=".dbf") returned 4
	[0168.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.871] lstrlenW (lpString=".1cd") returned 4
	[0168.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.871] lstrlenW (lpString=".jpg") returned 4
	[0168.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.871] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.871] lstrlenW (lpString="J0107132.WMF") returned 12
	[0168.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0168.872] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=48380) returned 1
	[0168.872] CloseHandle (hObject=0x534) returned 1
	[0168.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220
	[0168.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0168.873] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.873] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.874] GetLastError () returned 0x0
	[0168.874] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xbcfc, lpOverlapped=0x0) returned 1
	[0168.877] WriteFile (in: hFile=0x4e0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xbd00, lpOverlapped=0x0) returned 1
	[0168.881] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.881] WriteFile (in: hFile=0x4e0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.881] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.881] CloseHandle (hObject=0x4e0) returned 1
	[0168.881] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.882] SetEndOfFile (hFile=0x534) returned 1
	[0168.885] CloseHandle (hObject=0x534) returned 1
	[0168.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 1
	[0168.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.886] lstrlenW (lpString=".doc") returned 4
	[0168.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.886] lstrlenW (lpString=".docx") returned 5
	[0168.886] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.886] lstrlenW (lpString=".pdf") returned 4
	[0168.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.887] lstrlenW (lpString=".xls") returned 4
	[0168.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.887] lstrlenW (lpString=".xlsx") returned 5
	[0168.887] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.887] lstrlenW (lpString=".ppt") returned 4
	[0168.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.887] lstrlenW (lpString=".zip") returned 4
	[0168.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.887] lstrlenW (lpString=".rar") returned 4
	[0168.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.887] lstrlenW (lpString=".bz2") returned 4
	[0168.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.887] lstrlenW (lpString=".7z") returned 3
	[0168.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.887] lstrlenW (lpString=".dbf") returned 4
	[0168.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.887] lstrlenW (lpString=".1cd") returned 4
	[0168.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.887] lstrlenW (lpString=".jpg") returned 4
	[0168.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.888] lstrlenW (lpString=".doc") returned 4
	[0168.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.888] lstrlenW (lpString=".docx") returned 5
	[0168.888] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.888] lstrlenW (lpString=".pdf") returned 4
	[0168.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.888] lstrlenW (lpString=".xls") returned 4
	[0168.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.888] lstrlenW (lpString=".xlsx") returned 5
	[0168.888] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.888] lstrlenW (lpString=".ppt") returned 4
	[0168.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.888] lstrlenW (lpString=".zip") returned 4
	[0168.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.888] lstrlenW (lpString=".rar") returned 4
	[0168.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.888] lstrlenW (lpString=".bz2") returned 4
	[0168.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.888] lstrlenW (lpString=".7z") returned 3
	[0168.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.889] lstrlenW (lpString=".dbf") returned 4
	[0168.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.889] lstrlenW (lpString=".1cd") returned 4
	[0168.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0168.889] lstrlenW (lpString=".jpg") returned 4
	[0168.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.889] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.889] lstrlenW (lpString="J0107134.WMF") returned 12
	[0168.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0168.890] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=48388) returned 1
	[0168.890] CloseHandle (hObject=0x534) returned 1
	[0168.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220
	[0168.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0168.890] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.891] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.891] GetLastError () returned 0x0
	[0168.891] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xbd04, lpOverlapped=0x0) returned 1
	[0168.894] WriteFile (in: hFile=0x4e0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xbd10, lpOverlapped=0x0) returned 1
	[0168.896] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.896] WriteFile (in: hFile=0x4e0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.896] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.896] CloseHandle (hObject=0x4e0) returned 1
	[0168.896] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.896] SetEndOfFile (hFile=0x534) returned 1
	[0168.900] CloseHandle (hObject=0x534) returned 1
	[0168.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 1
	[0168.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0168.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0168.901] lstrlenW (lpString=".doc") returned 4
	[0168.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.901] lstrlenW (lpString=".docx") returned 5
	[0168.901] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0168.901] lstrlenW (lpString=".pdf") returned 4
	[0168.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.901] lstrlenW (lpString=".xls") returned 4
	[0168.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.901] lstrlenW (lpString=".xlsx") returned 5
	[0168.901] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0168.901] lstrlenW (lpString=".ppt") returned 4
	[0168.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0168.901] lstrlenW (lpString=".zip") returned 4
	[0168.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.901] lstrlenW (lpString=".rar") returned 4
	[0168.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.901] lstrlenW (lpString=".bz2") returned 4
	[0168.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.901] lstrlenW (lpString=".7z") returned 3
	[0168.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0168.902] lstrlenW (lpString=".dbf") returned 4
	[0168.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0168.902] lstrlenW (lpString=".1cd") returned 4
	[0168.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0168.902] lstrlenW (lpString=".jpg") returned 4
	[0168.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0168.902] lstrlenW (lpString=".doc") returned 4
	[0168.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.902] lstrlenW (lpString=".docx") returned 5
	[0168.902] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0168.902] lstrlenW (lpString=".pdf") returned 4
	[0168.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.902] lstrlenW (lpString=".xls") returned 4
	[0168.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.902] lstrlenW (lpString=".xlsx") returned 5
	[0168.902] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0168.902] lstrlenW (lpString=".ppt") returned 4
	[0168.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0168.902] lstrlenW (lpString=".zip") returned 4
	[0168.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.903] lstrlenW (lpString=".rar") returned 4
	[0168.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.903] lstrlenW (lpString=".bz2") returned 4
	[0168.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.903] lstrlenW (lpString=".7z") returned 3
	[0168.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0168.903] lstrlenW (lpString=".dbf") returned 4
	[0168.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0168.903] lstrlenW (lpString=".1cd") returned 4
	[0168.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0169.104] lstrlenW (lpString=".jpg") returned 4
	[0169.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.104] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.104] lstrlenW (lpString="J0107148.WMF") returned 12
	[0169.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.384] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=20136) returned 1
	[0169.384] CloseHandle (hObject=0x534) returned 1
	[0169.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220
	[0169.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.384] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.384] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0169.385] GetLastError () returned 0x0
	[0169.385] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x4ea8, lpOverlapped=0x0) returned 1
	[0169.387] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x4eb0, lpOverlapped=0x0) returned 1
	[0169.389] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.389] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.389] SetEndOfFile (hFile=0x36c) returned 1
	[0169.389] CloseHandle (hObject=0x36c) returned 1
	[0169.389] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.389] SetEndOfFile (hFile=0x534) returned 1
	[0169.392] CloseHandle (hObject=0x534) returned 1
	[0169.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 1
	[0169.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.393] lstrlenW (lpString=".doc") returned 4
	[0169.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.393] lstrlenW (lpString=".docx") returned 5
	[0169.393] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.393] lstrlenW (lpString=".pdf") returned 4
	[0169.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.393] lstrlenW (lpString=".xls") returned 4
	[0169.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.393] lstrlenW (lpString=".xlsx") returned 5
	[0169.393] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.393] lstrlenW (lpString=".ppt") returned 4
	[0169.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.394] lstrlenW (lpString=".zip") returned 4
	[0169.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.394] lstrlenW (lpString=".rar") returned 4
	[0169.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.394] lstrlenW (lpString=".bz2") returned 4
	[0169.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.394] lstrlenW (lpString=".7z") returned 3
	[0169.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.394] lstrlenW (lpString=".dbf") returned 4
	[0169.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.394] lstrlenW (lpString=".1cd") returned 4
	[0169.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.394] lstrlenW (lpString=".jpg") returned 4
	[0169.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.394] lstrlenW (lpString=".doc") returned 4
	[0169.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.394] lstrlenW (lpString=".docx") returned 5
	[0169.394] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.394] lstrlenW (lpString=".pdf") returned 4
	[0169.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.394] lstrlenW (lpString=".xls") returned 4
	[0169.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.395] lstrlenW (lpString=".xlsx") returned 5
	[0169.395] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.395] lstrlenW (lpString=".ppt") returned 4
	[0169.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.395] lstrlenW (lpString=".zip") returned 4
	[0169.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.395] lstrlenW (lpString=".rar") returned 4
	[0169.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.395] lstrlenW (lpString=".bz2") returned 4
	[0169.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.395] lstrlenW (lpString=".7z") returned 3
	[0169.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.395] lstrlenW (lpString=".dbf") returned 4
	[0169.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.395] lstrlenW (lpString=".1cd") returned 4
	[0169.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.395] lstrlenW (lpString=".jpg") returned 4
	[0169.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.395] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.396] lstrlenW (lpString="J0107154.WMF") returned 12
	[0169.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.396] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=22300) returned 1
	[0169.396] CloseHandle (hObject=0x534) returned 1
	[0169.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220
	[0169.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.397] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.397] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0169.398] GetLastError () returned 0x0
	[0169.398] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x571c, lpOverlapped=0x0) returned 1
	[0169.400] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x5720, lpOverlapped=0x0) returned 1
	[0169.401] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.401] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.402] SetEndOfFile (hFile=0x36c) returned 1
	[0169.402] CloseHandle (hObject=0x36c) returned 1
	[0169.402] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.402] SetEndOfFile (hFile=0x534) returned 1
	[0169.405] CloseHandle (hObject=0x534) returned 1
	[0169.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 1
	[0169.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.406] lstrlenW (lpString=".doc") returned 4
	[0169.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.406] lstrlenW (lpString=".docx") returned 5
	[0169.406] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0169.407] lstrlenW (lpString=".pdf") returned 4
	[0169.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.407] lstrlenW (lpString=".xls") returned 4
	[0169.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.407] lstrlenW (lpString=".xlsx") returned 5
	[0169.407] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0169.407] lstrlenW (lpString=".ppt") returned 4
	[0169.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.407] lstrlenW (lpString=".zip") returned 4
	[0169.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.407] lstrlenW (lpString=".rar") returned 4
	[0169.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.407] lstrlenW (lpString=".bz2") returned 4
	[0169.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.407] lstrlenW (lpString=".7z") returned 3
	[0169.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.407] lstrlenW (lpString=".dbf") returned 4
	[0169.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.407] lstrlenW (lpString=".1cd") returned 4
	[0169.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.407] lstrlenW (lpString=".jpg") returned 4
	[0169.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.408] lstrlenW (lpString=".doc") returned 4
	[0169.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.408] lstrlenW (lpString=".docx") returned 5
	[0169.408] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0169.408] lstrlenW (lpString=".pdf") returned 4
	[0169.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.408] lstrlenW (lpString=".xls") returned 4
	[0169.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.408] lstrlenW (lpString=".xlsx") returned 5
	[0169.408] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0169.408] lstrlenW (lpString=".ppt") returned 4
	[0169.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.408] lstrlenW (lpString=".zip") returned 4
	[0169.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.408] lstrlenW (lpString=".rar") returned 4
	[0169.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.408] lstrlenW (lpString=".bz2") returned 4
	[0169.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.408] lstrlenW (lpString=".7z") returned 3
	[0169.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.408] lstrlenW (lpString=".dbf") returned 4
	[0169.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.409] lstrlenW (lpString=".1cd") returned 4
	[0169.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.409] lstrlenW (lpString=".jpg") returned 4
	[0169.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.409] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.409] lstrlenW (lpString="J0107158.WMF") returned 12
	[0169.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.410] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=24908) returned 1
	[0169.410] CloseHandle (hObject=0x534) returned 1
	[0169.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220
	[0169.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.410] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.410] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0169.411] GetLastError () returned 0x0
	[0169.411] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x614c, lpOverlapped=0x0) returned 1
	[0169.413] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x6150, lpOverlapped=0x0) returned 1
	[0169.415] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.415] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.415] SetEndOfFile (hFile=0x36c) returned 1
	[0169.415] CloseHandle (hObject=0x36c) returned 1
	[0169.415] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.415] SetEndOfFile (hFile=0x534) returned 1
	[0169.418] CloseHandle (hObject=0x534) returned 1
	[0169.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 1
	[0169.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.956] lstrlenW (lpString=".doc") returned 4
	[0169.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.956] lstrlenW (lpString=".docx") returned 5
	[0169.956] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.956] lstrlenW (lpString=".pdf") returned 4
	[0169.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.957] lstrlenW (lpString=".xls") returned 4
	[0169.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.957] lstrlenW (lpString=".xlsx") returned 5
	[0169.957] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.957] lstrlenW (lpString=".ppt") returned 4
	[0169.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.957] lstrlenW (lpString=".zip") returned 4
	[0169.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.957] lstrlenW (lpString=".rar") returned 4
	[0169.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.957] lstrlenW (lpString=".bz2") returned 4
	[0169.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.957] lstrlenW (lpString=".7z") returned 3
	[0169.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.957] lstrlenW (lpString=".dbf") returned 4
	[0169.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.957] lstrlenW (lpString=".1cd") returned 4
	[0169.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.957] lstrlenW (lpString=".jpg") returned 4
	[0169.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.958] lstrlenW (lpString=".doc") returned 4
	[0169.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.958] lstrlenW (lpString=".docx") returned 5
	[0169.958] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.958] lstrlenW (lpString=".pdf") returned 4
	[0169.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.958] lstrlenW (lpString=".xls") returned 4
	[0169.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.958] lstrlenW (lpString=".xlsx") returned 5
	[0169.958] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.958] lstrlenW (lpString=".ppt") returned 4
	[0169.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.958] lstrlenW (lpString=".zip") returned 4
	[0169.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.958] lstrlenW (lpString=".rar") returned 4
	[0169.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.958] lstrlenW (lpString=".bz2") returned 4
	[0169.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.958] lstrlenW (lpString=".7z") returned 3
	[0169.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.958] lstrlenW (lpString=".dbf") returned 4
	[0169.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.958] lstrlenW (lpString=".1cd") returned 4
	[0169.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0169.958] lstrlenW (lpString=".jpg") returned 4
	[0169.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.959] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.959] lstrlenW (lpString="J0107266.WMF") returned 12
	[0169.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0169.959] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=5868) returned 1
	[0169.959] CloseHandle (hObject=0x4b8) returned 1
	[0169.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0x220
	[0169.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0169.960] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.960] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0169.961] GetLastError () returned 0x0
	[0169.961] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x16ec, lpOverlapped=0x0) returned 1
	[0169.965] WriteFile (in: hFile=0x370, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x16f0, lpOverlapped=0x0) returned 1
	[0169.966] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.966] WriteFile (in: hFile=0x370, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.967] SetEndOfFile (hFile=0x370) returned 1
	[0169.967] CloseHandle (hObject=0x370) returned 1
	[0169.967] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.967] SetEndOfFile (hFile=0x4b8) returned 1
	[0170.042] CloseHandle (hObject=0x4b8) returned 1
	[0170.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 1
	[0170.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.046] lstrlenW (lpString=".doc") returned 4
	[0170.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.046] lstrlenW (lpString=".docx") returned 5
	[0170.046] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0170.046] lstrlenW (lpString=".pdf") returned 4
	[0170.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.046] lstrlenW (lpString=".xls") returned 4
	[0170.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.046] lstrlenW (lpString=".xlsx") returned 5
	[0170.047] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0170.047] lstrlenW (lpString=".ppt") returned 4
	[0170.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.047] lstrlenW (lpString=".zip") returned 4
	[0170.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.047] lstrlenW (lpString=".rar") returned 4
	[0170.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.047] lstrlenW (lpString=".bz2") returned 4
	[0170.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.047] lstrlenW (lpString=".7z") returned 3
	[0170.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.047] lstrlenW (lpString=".dbf") returned 4
	[0170.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.047] lstrlenW (lpString=".1cd") returned 4
	[0170.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.047] lstrlenW (lpString=".jpg") returned 4
	[0170.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.047] lstrlenW (lpString=".doc") returned 4
	[0170.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.047] lstrlenW (lpString=".docx") returned 5
	[0170.047] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0170.048] lstrlenW (lpString=".pdf") returned 4
	[0170.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.048] lstrlenW (lpString=".xls") returned 4
	[0170.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.048] lstrlenW (lpString=".xlsx") returned 5
	[0170.048] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0170.048] lstrlenW (lpString=".ppt") returned 4
	[0170.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.048] lstrlenW (lpString=".zip") returned 4
	[0170.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.048] lstrlenW (lpString=".rar") returned 4
	[0170.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.048] lstrlenW (lpString=".bz2") returned 4
	[0170.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.048] lstrlenW (lpString=".7z") returned 3
	[0170.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.048] lstrlenW (lpString=".dbf") returned 4
	[0170.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.048] lstrlenW (lpString=".1cd") returned 4
	[0170.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0170.048] lstrlenW (lpString=".jpg") returned 4
	[0170.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.049] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.049] lstrlenW (lpString="J0107280.WMF") returned 12
	[0170.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.049] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=11108) returned 1
	[0170.050] CloseHandle (hObject=0x4b8) returned 1
	[0170.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220
	[0170.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.052] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.053] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0170.053] GetLastError () returned 0x0
	[0170.054] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x2b64, lpOverlapped=0x0) returned 1
	[0170.055] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x2b70, lpOverlapped=0x0) returned 1
	[0170.056] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.057] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.057] SetEndOfFile (hFile=0x36c) returned 1
	[0170.057] CloseHandle (hObject=0x36c) returned 1
	[0170.057] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.057] SetEndOfFile (hFile=0x4b8) returned 1
	[0170.060] CloseHandle (hObject=0x4b8) returned 1
	[0170.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 1
	[0170.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.061] lstrlenW (lpString=".doc") returned 4
	[0170.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.062] lstrlenW (lpString=".docx") returned 5
	[0170.062] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.062] lstrlenW (lpString=".pdf") returned 4
	[0170.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.062] lstrlenW (lpString=".xls") returned 4
	[0170.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.062] lstrlenW (lpString=".xlsx") returned 5
	[0170.062] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.062] lstrlenW (lpString=".ppt") returned 4
	[0170.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.062] lstrlenW (lpString=".zip") returned 4
	[0170.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.062] lstrlenW (lpString=".rar") returned 4
	[0170.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.062] lstrlenW (lpString=".bz2") returned 4
	[0170.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.062] lstrlenW (lpString=".7z") returned 3
	[0170.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.062] lstrlenW (lpString=".dbf") returned 4
	[0170.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.062] lstrlenW (lpString=".1cd") returned 4
	[0170.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.062] lstrlenW (lpString=".jpg") returned 4
	[0170.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.063] lstrlenW (lpString=".doc") returned 4
	[0170.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.063] lstrlenW (lpString=".docx") returned 5
	[0170.063] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.063] lstrlenW (lpString=".pdf") returned 4
	[0170.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.063] lstrlenW (lpString=".xls") returned 4
	[0170.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.063] lstrlenW (lpString=".xlsx") returned 5
	[0170.063] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.063] lstrlenW (lpString=".ppt") returned 4
	[0170.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.063] lstrlenW (lpString=".zip") returned 4
	[0170.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.063] lstrlenW (lpString=".rar") returned 4
	[0170.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.063] lstrlenW (lpString=".bz2") returned 4
	[0170.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.063] lstrlenW (lpString=".7z") returned 3
	[0170.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.064] lstrlenW (lpString=".dbf") returned 4
	[0170.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.064] lstrlenW (lpString=".1cd") returned 4
	[0170.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.064] lstrlenW (lpString=".jpg") returned 4
	[0170.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.064] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.064] lstrlenW (lpString="J0107282.WMF") returned 12
	[0170.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.065] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=14132) returned 1
	[0170.065] CloseHandle (hObject=0x4b8) returned 1
	[0170.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220
	[0170.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.066] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.066] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0170.066] GetLastError () returned 0x0
	[0170.066] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x3734, lpOverlapped=0x0) returned 1
	[0170.068] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x3740, lpOverlapped=0x0) returned 1
	[0170.069] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.069] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.070] SetEndOfFile (hFile=0x36c) returned 1
	[0170.070] CloseHandle (hObject=0x36c) returned 1
	[0170.070] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.070] SetEndOfFile (hFile=0x4b8) returned 1
	[0170.073] CloseHandle (hObject=0x4b8) returned 1
	[0170.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 1
	[0170.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.074] lstrlenW (lpString=".doc") returned 4
	[0170.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.074] lstrlenW (lpString=".docx") returned 5
	[0170.074] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.074] lstrlenW (lpString=".pdf") returned 4
	[0170.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.074] lstrlenW (lpString=".xls") returned 4
	[0170.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.074] lstrlenW (lpString=".xlsx") returned 5
	[0170.074] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.074] lstrlenW (lpString=".ppt") returned 4
	[0170.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.074] lstrlenW (lpString=".zip") returned 4
	[0170.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.074] lstrlenW (lpString=".rar") returned 4
	[0170.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.074] lstrlenW (lpString=".bz2") returned 4
	[0170.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.075] lstrlenW (lpString=".7z") returned 3
	[0170.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.075] lstrlenW (lpString=".dbf") returned 4
	[0170.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.075] lstrlenW (lpString=".1cd") returned 4
	[0170.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.075] lstrlenW (lpString=".jpg") returned 4
	[0170.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.075] lstrlenW (lpString=".doc") returned 4
	[0170.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.075] lstrlenW (lpString=".docx") returned 5
	[0170.075] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.075] lstrlenW (lpString=".pdf") returned 4
	[0170.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.075] lstrlenW (lpString=".xls") returned 4
	[0170.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.075] lstrlenW (lpString=".xlsx") returned 5
	[0170.075] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.076] lstrlenW (lpString=".ppt") returned 4
	[0170.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.076] lstrlenW (lpString=".zip") returned 4
	[0170.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.076] lstrlenW (lpString=".rar") returned 4
	[0170.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.076] lstrlenW (lpString=".bz2") returned 4
	[0170.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.076] lstrlenW (lpString=".7z") returned 3
	[0170.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.076] lstrlenW (lpString=".dbf") returned 4
	[0170.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.076] lstrlenW (lpString=".1cd") returned 4
	[0170.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0170.076] lstrlenW (lpString=".jpg") returned 4
	[0170.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.076] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.076] lstrlenW (lpString="J0107288.WMF") returned 12
	[0170.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.077] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=13436) returned 1
	[0170.077] CloseHandle (hObject=0x4b8) returned 1
	[0170.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220
	[0170.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.078] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.078] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0170.078] GetLastError () returned 0x0
	[0170.078] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x347c, lpOverlapped=0x0) returned 1
	[0170.299] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x3480, lpOverlapped=0x0) returned 1
	[0170.301] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.301] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.301] SetEndOfFile (hFile=0x36c) returned 1
	[0170.301] CloseHandle (hObject=0x36c) returned 1
	[0170.301] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.301] SetEndOfFile (hFile=0x4b8) returned 1
	[0170.304] CloseHandle (hObject=0x4b8) returned 1
	[0170.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 1
	[0170.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.305] lstrlenW (lpString=".doc") returned 4
	[0170.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.305] lstrlenW (lpString=".docx") returned 5
	[0170.305] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.305] lstrlenW (lpString=".pdf") returned 4
	[0170.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.305] lstrlenW (lpString=".xls") returned 4
	[0170.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.305] lstrlenW (lpString=".xlsx") returned 5
	[0170.305] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.305] lstrlenW (lpString=".ppt") returned 4
	[0170.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.305] lstrlenW (lpString=".zip") returned 4
	[0170.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.306] lstrlenW (lpString=".rar") returned 4
	[0170.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.306] lstrlenW (lpString=".bz2") returned 4
	[0170.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.306] lstrlenW (lpString=".7z") returned 3
	[0170.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.306] lstrlenW (lpString=".dbf") returned 4
	[0170.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.306] lstrlenW (lpString=".1cd") returned 4
	[0170.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.306] lstrlenW (lpString=".jpg") returned 4
	[0170.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.306] lstrlenW (lpString=".doc") returned 4
	[0170.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.306] lstrlenW (lpString=".docx") returned 5
	[0170.306] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.306] lstrlenW (lpString=".pdf") returned 4
	[0170.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.306] lstrlenW (lpString=".xls") returned 4
	[0170.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.307] lstrlenW (lpString=".xlsx") returned 5
	[0170.307] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.307] lstrlenW (lpString=".ppt") returned 4
	[0170.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.307] lstrlenW (lpString=".zip") returned 4
	[0170.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.307] lstrlenW (lpString=".rar") returned 4
	[0170.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.307] lstrlenW (lpString=".bz2") returned 4
	[0170.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.307] lstrlenW (lpString=".7z") returned 3
	[0170.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.307] lstrlenW (lpString=".dbf") returned 4
	[0170.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.307] lstrlenW (lpString=".1cd") returned 4
	[0170.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.307] lstrlenW (lpString=".jpg") returned 4
	[0170.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.308] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.308] lstrlenW (lpString="J0107344.WMF") returned 12
	[0170.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.308] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=5076) returned 1
	[0170.308] CloseHandle (hObject=0x4b8) returned 1
	[0170.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220
	[0170.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.309] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.309] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0170.310] GetLastError () returned 0x0
	[0170.310] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x13d4, lpOverlapped=0x0) returned 1
	[0170.311] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x13e0, lpOverlapped=0x0) returned 1
	[0170.312] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.312] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.312] SetEndOfFile (hFile=0x36c) returned 1
	[0170.313] CloseHandle (hObject=0x36c) returned 1
	[0170.313] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.313] SetEndOfFile (hFile=0x4b8) returned 1
	[0170.315] CloseHandle (hObject=0x4b8) returned 1
	[0170.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 1
	[0170.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.317] lstrlenW (lpString=".doc") returned 4
	[0170.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.317] lstrlenW (lpString=".docx") returned 5
	[0170.317] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.317] lstrlenW (lpString=".pdf") returned 4
	[0170.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.317] lstrlenW (lpString=".xls") returned 4
	[0170.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.317] lstrlenW (lpString=".xlsx") returned 5
	[0170.317] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.317] lstrlenW (lpString=".ppt") returned 4
	[0170.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.317] lstrlenW (lpString=".zip") returned 4
	[0170.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.317] lstrlenW (lpString=".rar") returned 4
	[0170.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.317] lstrlenW (lpString=".bz2") returned 4
	[0170.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.317] lstrlenW (lpString=".7z") returned 3
	[0170.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.317] lstrlenW (lpString=".dbf") returned 4
	[0170.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.317] lstrlenW (lpString=".1cd") returned 4
	[0170.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.318] lstrlenW (lpString=".jpg") returned 4
	[0170.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.318] lstrlenW (lpString=".doc") returned 4
	[0170.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.318] lstrlenW (lpString=".docx") returned 5
	[0170.318] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.318] lstrlenW (lpString=".pdf") returned 4
	[0170.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.318] lstrlenW (lpString=".xls") returned 4
	[0170.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.318] lstrlenW (lpString=".xlsx") returned 5
	[0170.318] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.318] lstrlenW (lpString=".ppt") returned 4
	[0170.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.318] lstrlenW (lpString=".zip") returned 4
	[0170.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.318] lstrlenW (lpString=".rar") returned 4
	[0170.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.318] lstrlenW (lpString=".bz2") returned 4
	[0170.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.318] lstrlenW (lpString=".7z") returned 3
	[0170.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.319] lstrlenW (lpString=".dbf") returned 4
	[0170.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.319] lstrlenW (lpString=".1cd") returned 4
	[0170.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0170.319] lstrlenW (lpString=".jpg") returned 4
	[0170.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.319] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.319] lstrlenW (lpString="J0107350.WMF") returned 12
	[0170.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.320] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=23672) returned 1
	[0170.320] CloseHandle (hObject=0x4b8) returned 1
	[0170.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0x220
	[0170.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.320] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.320] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0170.321] GetLastError () returned 0x0
	[0170.321] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x5c78, lpOverlapped=0x0) returned 1
	[0170.323] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x5c80, lpOverlapped=0x0) returned 1
	[0170.325] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.325] WriteFile (in: hFile=0x36c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.325] SetEndOfFile (hFile=0x36c) returned 1
	[0170.325] CloseHandle (hObject=0x36c) returned 1
	[0170.325] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.325] SetEndOfFile (hFile=0x4b8) returned 1
	[0170.329] CloseHandle (hObject=0x4b8) returned 1
	[0170.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 1
	[0170.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.330] lstrlenW (lpString=".doc") returned 4
	[0170.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.330] lstrlenW (lpString=".docx") returned 5
	[0170.330] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.330] lstrlenW (lpString=".pdf") returned 4
	[0170.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.330] lstrlenW (lpString=".xls") returned 4
	[0170.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.330] lstrlenW (lpString=".xlsx") returned 5
	[0170.330] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.330] lstrlenW (lpString=".ppt") returned 4
	[0170.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.331] lstrlenW (lpString=".zip") returned 4
	[0170.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.331] lstrlenW (lpString=".rar") returned 4
	[0170.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.331] lstrlenW (lpString=".bz2") returned 4
	[0170.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.331] lstrlenW (lpString=".7z") returned 3
	[0170.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.331] lstrlenW (lpString=".dbf") returned 4
	[0170.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.331] lstrlenW (lpString=".1cd") returned 4
	[0170.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.331] lstrlenW (lpString=".jpg") returned 4
	[0170.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.331] lstrlenW (lpString=".doc") returned 4
	[0170.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.331] lstrlenW (lpString=".docx") returned 5
	[0170.331] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.331] lstrlenW (lpString=".pdf") returned 4
	[0170.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.331] lstrlenW (lpString=".xls") returned 4
	[0170.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.331] lstrlenW (lpString=".xlsx") returned 5
	[0170.332] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.332] lstrlenW (lpString=".ppt") returned 4
	[0170.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.332] lstrlenW (lpString=".zip") returned 4
	[0170.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.332] lstrlenW (lpString=".rar") returned 4
	[0170.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.332] lstrlenW (lpString=".bz2") returned 4
	[0170.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.332] lstrlenW (lpString=".7z") returned 3
	[0170.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.332] lstrlenW (lpString=".dbf") returned 4
	[0170.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.332] lstrlenW (lpString=".1cd") returned 4
	[0170.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0170.332] lstrlenW (lpString=".jpg") returned 4
	[0170.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.332] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.332] lstrlenW (lpString="J0107358.WMF") returned 12
	[0170.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.333] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=7964) returned 1
	[0170.334] CloseHandle (hObject=0x4b8) returned 1
	[0170.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220
	[0170.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.334] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.334] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0170.750] GetLastError () returned 0x0
	[0170.750] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1f1c, lpOverlapped=0x0) returned 1
	[0170.752] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1f20, lpOverlapped=0x0) returned 1
	[0170.753] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.753] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.753] SetEndOfFile (hFile=0x4f0) returned 1
	[0170.753] CloseHandle (hObject=0x4f0) returned 1
	[0170.753] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.753] SetEndOfFile (hFile=0x4b8) returned 1
	[0170.756] CloseHandle (hObject=0x4b8) returned 1
	[0170.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 1
	[0170.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.758] lstrlenW (lpString=".doc") returned 4
	[0170.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.758] lstrlenW (lpString=".docx") returned 5
	[0170.758] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.758] lstrlenW (lpString=".pdf") returned 4
	[0170.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.758] lstrlenW (lpString=".xls") returned 4
	[0170.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.758] lstrlenW (lpString=".xlsx") returned 5
	[0170.758] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.758] lstrlenW (lpString=".ppt") returned 4
	[0170.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.759] lstrlenW (lpString=".zip") returned 4
	[0170.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.759] lstrlenW (lpString=".rar") returned 4
	[0170.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.759] lstrlenW (lpString=".bz2") returned 4
	[0170.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.759] lstrlenW (lpString=".7z") returned 3
	[0170.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.759] lstrlenW (lpString=".dbf") returned 4
	[0170.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.759] lstrlenW (lpString=".1cd") returned 4
	[0170.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.759] lstrlenW (lpString=".jpg") returned 4
	[0170.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.759] lstrlenW (lpString=".doc") returned 4
	[0170.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.759] lstrlenW (lpString=".docx") returned 5
	[0170.759] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.759] lstrlenW (lpString=".pdf") returned 4
	[0170.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.759] lstrlenW (lpString=".xls") returned 4
	[0170.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.760] lstrlenW (lpString=".xlsx") returned 5
	[0170.760] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.760] lstrlenW (lpString=".ppt") returned 4
	[0170.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.760] lstrlenW (lpString=".zip") returned 4
	[0170.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.760] lstrlenW (lpString=".rar") returned 4
	[0170.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.760] lstrlenW (lpString=".bz2") returned 4
	[0170.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.760] lstrlenW (lpString=".7z") returned 3
	[0170.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.760] lstrlenW (lpString=".dbf") returned 4
	[0170.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.760] lstrlenW (lpString=".1cd") returned 4
	[0170.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0170.761] lstrlenW (lpString=".jpg") returned 4
	[0170.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.761] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.761] lstrlenW (lpString="J0107480.WMF") returned 12
	[0170.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.761] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=6024) returned 1
	[0170.761] CloseHandle (hObject=0x4b8) returned 1
	[0170.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0x220
	[0170.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.762] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.762] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0170.763] GetLastError () returned 0x0
	[0170.763] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1788, lpOverlapped=0x0) returned 1
	[0170.765] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1790, lpOverlapped=0x0) returned 1
	[0170.768] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.768] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.768] SetEndOfFile (hFile=0x4f0) returned 1
	[0170.768] CloseHandle (hObject=0x4f0) returned 1
	[0170.768] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.768] SetEndOfFile (hFile=0x4b8) returned 1
	[0170.772] CloseHandle (hObject=0x4b8) returned 1
	[0170.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 1
	[0170.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.773] lstrlenW (lpString=".doc") returned 4
	[0170.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.773] lstrlenW (lpString=".docx") returned 5
	[0170.773] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.773] lstrlenW (lpString=".pdf") returned 4
	[0170.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.773] lstrlenW (lpString=".xls") returned 4
	[0170.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.774] lstrlenW (lpString=".xlsx") returned 5
	[0170.774] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.774] lstrlenW (lpString=".ppt") returned 4
	[0170.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.774] lstrlenW (lpString=".zip") returned 4
	[0170.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.774] lstrlenW (lpString=".rar") returned 4
	[0170.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.774] lstrlenW (lpString=".bz2") returned 4
	[0170.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.774] lstrlenW (lpString=".7z") returned 3
	[0170.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.774] lstrlenW (lpString=".dbf") returned 4
	[0170.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.774] lstrlenW (lpString=".1cd") returned 4
	[0170.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.774] lstrlenW (lpString=".jpg") returned 4
	[0170.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.774] lstrlenW (lpString=".doc") returned 4
	[0170.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.774] lstrlenW (lpString=".docx") returned 5
	[0170.775] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.775] lstrlenW (lpString=".pdf") returned 4
	[0170.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.775] lstrlenW (lpString=".xls") returned 4
	[0170.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.775] lstrlenW (lpString=".xlsx") returned 5
	[0170.775] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.775] lstrlenW (lpString=".ppt") returned 4
	[0170.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.775] lstrlenW (lpString=".zip") returned 4
	[0170.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.775] lstrlenW (lpString=".rar") returned 4
	[0170.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.776] lstrlenW (lpString=".bz2") returned 4
	[0170.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.776] lstrlenW (lpString=".7z") returned 3
	[0170.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.776] lstrlenW (lpString=".dbf") returned 4
	[0170.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.776] lstrlenW (lpString=".1cd") returned 4
	[0170.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0170.776] lstrlenW (lpString=".jpg") returned 4
	[0170.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.776] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.776] lstrlenW (lpString="J0107482.WMF") returned 12
	[0170.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.778] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=4980) returned 1
	[0170.778] CloseHandle (hObject=0x4b8) returned 1
	[0170.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0x220
	[0170.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0170.778] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.778] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0170.779] GetLastError () returned 0x0
	[0170.779] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1374, lpOverlapped=0x0) returned 1
	[0170.781] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1380, lpOverlapped=0x0) returned 1
	[0170.782] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.782] WriteFile (in: hFile=0x4f0, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.782] SetEndOfFile (hFile=0x4f0) returned 1
	[0170.782] CloseHandle (hObject=0x4f0) returned 1
	[0170.782] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.782] SetEndOfFile (hFile=0x4b8) returned 1
	[0170.785] CloseHandle (hObject=0x4b8) returned 1
	[0170.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 1
	[0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.787] lstrlenW (lpString=".doc") returned 4
	[0170.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.787] lstrlenW (lpString=".docx") returned 5
	[0170.787] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.787] lstrlenW (lpString=".pdf") returned 4
	[0170.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.787] lstrlenW (lpString=".xls") returned 4
	[0170.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.787] lstrlenW (lpString=".xlsx") returned 5
	[0170.787] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.787] lstrlenW (lpString=".ppt") returned 4
	[0170.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.787] lstrlenW (lpString=".zip") returned 4
	[0170.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.787] lstrlenW (lpString=".rar") returned 4
	[0170.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.787] lstrlenW (lpString=".bz2") returned 4
	[0170.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.787] lstrlenW (lpString=".7z") returned 3
	[0170.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.788] lstrlenW (lpString=".dbf") returned 4
	[0170.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.788] lstrlenW (lpString=".1cd") returned 4
	[0170.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.788] lstrlenW (lpString=".jpg") returned 4
	[0170.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.788] lstrlenW (lpString=".doc") returned 4
	[0170.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.788] lstrlenW (lpString=".docx") returned 5
	[0170.788] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.788] lstrlenW (lpString=".pdf") returned 4
	[0170.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.788] lstrlenW (lpString=".xls") returned 4
	[0170.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.788] lstrlenW (lpString=".xlsx") returned 5
	[0170.788] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.788] lstrlenW (lpString=".ppt") returned 4
	[0170.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.788] lstrlenW (lpString=".zip") returned 4
	[0170.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.788] lstrlenW (lpString=".rar") returned 4
	[0170.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.789] lstrlenW (lpString=".bz2") returned 4
	[0170.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.789] lstrlenW (lpString=".7z") returned 3
	[0170.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.789] lstrlenW (lpString=".dbf") returned 4
	[0170.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.789] lstrlenW (lpString=".1cd") returned 4
	[0170.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0170.789] lstrlenW (lpString=".jpg") returned 4
	[0170.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.789] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.789] lstrlenW (lpString="J0107484.WMF") returned 12
	[0170.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.329] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=3040) returned 1
	[0171.329] CloseHandle (hObject=0x36c) returned 1
	[0171.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 0x220
	[0171.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.333] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.333] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0171.334] GetLastError () returned 0x0
	[0171.334] ReadFile (in: hFile=0x36c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xbe0, lpOverlapped=0x0) returned 1
	[0171.335] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xbf0, lpOverlapped=0x0) returned 1
	[0171.338] ReadFile (in: hFile=0x36c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.338] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.338] SetEndOfFile (hFile=0x554) returned 1
	[0171.338] CloseHandle (hObject=0x554) returned 1
	[0171.338] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.339] SetEndOfFile (hFile=0x36c) returned 1
	[0171.341] CloseHandle (hObject=0x36c) returned 1
	[0171.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 1
	[0171.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.342] lstrlenW (lpString=".doc") returned 4
	[0171.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.342] lstrlenW (lpString=".docx") returned 5
	[0171.342] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0171.342] lstrlenW (lpString=".pdf") returned 4
	[0171.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.343] lstrlenW (lpString=".xls") returned 4
	[0171.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.343] lstrlenW (lpString=".xlsx") returned 5
	[0171.343] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0171.343] lstrlenW (lpString=".ppt") returned 4
	[0171.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.343] lstrlenW (lpString=".zip") returned 4
	[0171.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.343] lstrlenW (lpString=".rar") returned 4
	[0171.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.343] lstrlenW (lpString=".bz2") returned 4
	[0171.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.343] lstrlenW (lpString=".7z") returned 3
	[0171.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.343] lstrlenW (lpString=".dbf") returned 4
	[0171.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.343] lstrlenW (lpString=".1cd") returned 4
	[0171.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.343] lstrlenW (lpString=".jpg") returned 4
	[0171.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.343] lstrlenW (lpString=".doc") returned 4
	[0171.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.344] lstrlenW (lpString=".docx") returned 5
	[0171.344] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0171.344] lstrlenW (lpString=".pdf") returned 4
	[0171.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.344] lstrlenW (lpString=".xls") returned 4
	[0171.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.344] lstrlenW (lpString=".xlsx") returned 5
	[0171.344] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0171.344] lstrlenW (lpString=".ppt") returned 4
	[0171.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.344] lstrlenW (lpString=".zip") returned 4
	[0171.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.344] lstrlenW (lpString=".rar") returned 4
	[0171.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.344] lstrlenW (lpString=".bz2") returned 4
	[0171.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.344] lstrlenW (lpString=".7z") returned 3
	[0171.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.344] lstrlenW (lpString=".dbf") returned 4
	[0171.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.344] lstrlenW (lpString=".1cd") returned 4
	[0171.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0171.344] lstrlenW (lpString=".jpg") returned 4
	[0171.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.345] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.345] lstrlenW (lpString="J0107500.WMF") returned 12
	[0171.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.345] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=4200) returned 1
	[0171.345] CloseHandle (hObject=0x36c) returned 1
	[0171.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0x220
	[0171.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.346] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.346] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0171.347] GetLastError () returned 0x0
	[0171.347] ReadFile (in: hFile=0x36c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1068, lpOverlapped=0x0) returned 1
	[0171.348] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1070, lpOverlapped=0x0) returned 1
	[0171.349] ReadFile (in: hFile=0x36c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.349] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.350] SetEndOfFile (hFile=0x554) returned 1
	[0171.350] CloseHandle (hObject=0x554) returned 1
	[0171.350] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.350] SetEndOfFile (hFile=0x36c) returned 1
	[0171.353] CloseHandle (hObject=0x36c) returned 1
	[0171.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 1
	[0171.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.354] lstrlenW (lpString=".doc") returned 4
	[0171.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.354] lstrlenW (lpString=".docx") returned 5
	[0171.354] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0171.354] lstrlenW (lpString=".pdf") returned 4
	[0171.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.354] lstrlenW (lpString=".xls") returned 4
	[0171.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.354] lstrlenW (lpString=".xlsx") returned 5
	[0171.354] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0171.354] lstrlenW (lpString=".ppt") returned 4
	[0171.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.354] lstrlenW (lpString=".zip") returned 4
	[0171.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.355] lstrlenW (lpString=".rar") returned 4
	[0171.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.355] lstrlenW (lpString=".bz2") returned 4
	[0171.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.355] lstrlenW (lpString=".7z") returned 3
	[0171.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.355] lstrlenW (lpString=".dbf") returned 4
	[0171.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.355] lstrlenW (lpString=".1cd") returned 4
	[0171.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.355] lstrlenW (lpString=".jpg") returned 4
	[0171.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.355] lstrlenW (lpString=".doc") returned 4
	[0171.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.355] lstrlenW (lpString=".docx") returned 5
	[0171.355] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0171.355] lstrlenW (lpString=".pdf") returned 4
	[0171.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.355] lstrlenW (lpString=".xls") returned 4
	[0171.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.355] lstrlenW (lpString=".xlsx") returned 5
	[0171.355] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0171.356] lstrlenW (lpString=".ppt") returned 4
	[0171.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.356] lstrlenW (lpString=".zip") returned 4
	[0171.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.356] lstrlenW (lpString=".rar") returned 4
	[0171.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.356] lstrlenW (lpString=".bz2") returned 4
	[0171.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.356] lstrlenW (lpString=".7z") returned 3
	[0171.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.356] lstrlenW (lpString=".dbf") returned 4
	[0171.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.356] lstrlenW (lpString=".1cd") returned 4
	[0171.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0171.356] lstrlenW (lpString=".jpg") returned 4
	[0171.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.356] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.356] lstrlenW (lpString="J0107502.WMF") returned 12
	[0171.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.357] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=10836) returned 1
	[0171.357] CloseHandle (hObject=0x36c) returned 1
	[0171.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0x220
	[0171.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.358] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.358] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0171.359] GetLastError () returned 0x0
	[0171.359] ReadFile (in: hFile=0x36c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x2a54, lpOverlapped=0x0) returned 1
	[0171.360] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x2a60, lpOverlapped=0x0) returned 1
	[0171.362] ReadFile (in: hFile=0x36c, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.362] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.362] SetEndOfFile (hFile=0x554) returned 1
	[0171.362] CloseHandle (hObject=0x554) returned 1
	[0171.362] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.362] SetEndOfFile (hFile=0x36c) returned 1
	[0171.365] CloseHandle (hObject=0x36c) returned 1
	[0171.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 1
	[0171.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.366] lstrlenW (lpString=".doc") returned 4
	[0171.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.366] lstrlenW (lpString=".docx") returned 5
	[0171.366] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0171.367] lstrlenW (lpString=".pdf") returned 4
	[0171.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.367] lstrlenW (lpString=".xls") returned 4
	[0171.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.367] lstrlenW (lpString=".xlsx") returned 5
	[0171.367] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0171.367] lstrlenW (lpString=".ppt") returned 4
	[0171.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.367] lstrlenW (lpString=".zip") returned 4
	[0171.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.367] lstrlenW (lpString=".rar") returned 4
	[0171.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.367] lstrlenW (lpString=".bz2") returned 4
	[0171.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.367] lstrlenW (lpString=".7z") returned 3
	[0171.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.367] lstrlenW (lpString=".dbf") returned 4
	[0171.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.658] lstrlenW (lpString=".1cd") returned 4
	[0171.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.658] lstrlenW (lpString=".jpg") returned 4
	[0171.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.658] lstrlenW (lpString=".doc") returned 4
	[0171.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.658] lstrlenW (lpString=".docx") returned 5
	[0171.658] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0171.658] lstrlenW (lpString=".pdf") returned 4
	[0171.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.658] lstrlenW (lpString=".xls") returned 4
	[0171.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.658] lstrlenW (lpString=".xlsx") returned 5
	[0171.658] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0171.658] lstrlenW (lpString=".ppt") returned 4
	[0171.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.658] lstrlenW (lpString=".zip") returned 4
	[0171.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.658] lstrlenW (lpString=".rar") returned 4
	[0171.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.658] lstrlenW (lpString=".bz2") returned 4
	[0171.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.658] lstrlenW (lpString=".7z") returned 3
	[0171.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.659] lstrlenW (lpString=".dbf") returned 4
	[0171.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.659] lstrlenW (lpString=".1cd") returned 4
	[0171.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0171.659] lstrlenW (lpString=".jpg") returned 4
	[0171.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.659] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.659] lstrlenW (lpString="J0107512.WMF") returned 12
	[0171.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0172.088] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=11404) returned 1
	[0172.088] CloseHandle (hObject=0x370) returned 1
	[0172.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 0x220
	[0172.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0172.840] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.840] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0172.841] GetLastError () returned 0x0
	[0172.841] ReadFile (in: hFile=0x548, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x2c8c, lpOverlapped=0x0) returned 1
	[0172.843] WriteFile (in: hFile=0x514, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x2c90, lpOverlapped=0x0) returned 1
	[0172.844] ReadFile (in: hFile=0x548, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.844] WriteFile (in: hFile=0x514, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.844] SetEndOfFile (hFile=0x514) returned 1
	[0172.844] CloseHandle (hObject=0x514) returned 1
	[0172.844] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.845] SetEndOfFile (hFile=0x548) returned 1
	[0172.847] CloseHandle (hObject=0x548) returned 1
	[0172.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0172.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 1
	[0172.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.848] lstrlenW (lpString=".doc") returned 4
	[0172.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.848] lstrlenW (lpString=".docx") returned 5
	[0172.848] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0172.848] lstrlenW (lpString=".pdf") returned 4
	[0172.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.849] lstrlenW (lpString=".xls") returned 4
	[0172.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.849] lstrlenW (lpString=".xlsx") returned 5
	[0172.849] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0172.849] lstrlenW (lpString=".ppt") returned 4
	[0172.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.849] lstrlenW (lpString=".zip") returned 4
	[0172.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.849] lstrlenW (lpString=".rar") returned 4
	[0172.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.849] lstrlenW (lpString=".bz2") returned 4
	[0172.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.849] lstrlenW (lpString=".7z") returned 3
	[0172.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.849] lstrlenW (lpString=".dbf") returned 4
	[0172.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.849] lstrlenW (lpString=".1cd") returned 4
	[0172.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.849] lstrlenW (lpString=".jpg") returned 4
	[0172.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.849] lstrlenW (lpString=".doc") returned 4
	[0172.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.849] lstrlenW (lpString=".docx") returned 5
	[0172.850] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0172.850] lstrlenW (lpString=".pdf") returned 4
	[0172.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.850] lstrlenW (lpString=".xls") returned 4
	[0172.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.850] lstrlenW (lpString=".xlsx") returned 5
	[0172.850] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0172.850] lstrlenW (lpString=".ppt") returned 4
	[0172.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.850] lstrlenW (lpString=".zip") returned 4
	[0172.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.850] lstrlenW (lpString=".rar") returned 4
	[0172.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.850] lstrlenW (lpString=".bz2") returned 4
	[0172.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.850] lstrlenW (lpString=".7z") returned 3
	[0172.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.850] lstrlenW (lpString=".dbf") returned 4
	[0172.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.850] lstrlenW (lpString=".1cd") returned 4
	[0172.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0172.850] lstrlenW (lpString=".jpg") returned 4
	[0172.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.851] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0172.851] lstrlenW (lpString="J0107724.WMF") returned 12
	[0172.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0172.852] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=7016) returned 1
	[0172.852] CloseHandle (hObject=0x548) returned 1
	[0172.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0x220
	[0172.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0172.852] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.852] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0172.853] GetLastError () returned 0x0
	[0172.853] ReadFile (in: hFile=0x548, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1b68, lpOverlapped=0x0) returned 1
	[0172.855] WriteFile (in: hFile=0x514, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1b70, lpOverlapped=0x0) returned 1
	[0172.856] ReadFile (in: hFile=0x548, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.856] WriteFile (in: hFile=0x514, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.856] SetEndOfFile (hFile=0x514) returned 1
	[0172.856] CloseHandle (hObject=0x514) returned 1
	[0172.856] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.856] SetEndOfFile (hFile=0x548) returned 1
	[0172.859] CloseHandle (hObject=0x548) returned 1
	[0172.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0172.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 1
	[0172.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.861] lstrlenW (lpString=".doc") returned 4
	[0172.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.861] lstrlenW (lpString=".docx") returned 5
	[0172.861] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0172.861] lstrlenW (lpString=".pdf") returned 4
	[0172.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.861] lstrlenW (lpString=".xls") returned 4
	[0172.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.861] lstrlenW (lpString=".xlsx") returned 5
	[0172.861] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0172.861] lstrlenW (lpString=".ppt") returned 4
	[0172.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.861] lstrlenW (lpString=".zip") returned 4
	[0172.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.861] lstrlenW (lpString=".rar") returned 4
	[0172.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.861] lstrlenW (lpString=".bz2") returned 4
	[0172.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.861] lstrlenW (lpString=".7z") returned 3
	[0172.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.861] lstrlenW (lpString=".dbf") returned 4
	[0172.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.861] lstrlenW (lpString=".1cd") returned 4
	[0172.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.861] lstrlenW (lpString=".jpg") returned 4
	[0172.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.862] lstrlenW (lpString=".doc") returned 4
	[0172.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.862] lstrlenW (lpString=".docx") returned 5
	[0172.862] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0172.862] lstrlenW (lpString=".pdf") returned 4
	[0172.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.862] lstrlenW (lpString=".xls") returned 4
	[0172.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.862] lstrlenW (lpString=".xlsx") returned 5
	[0172.862] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0172.862] lstrlenW (lpString=".ppt") returned 4
	[0172.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.862] lstrlenW (lpString=".zip") returned 4
	[0172.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.862] lstrlenW (lpString=".rar") returned 4
	[0172.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.862] lstrlenW (lpString=".bz2") returned 4
	[0172.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.862] lstrlenW (lpString=".7z") returned 3
	[0172.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.862] lstrlenW (lpString=".dbf") returned 4
	[0172.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.862] lstrlenW (lpString=".1cd") returned 4
	[0172.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0172.862] lstrlenW (lpString=".jpg") returned 4
	[0172.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.863] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0172.863] lstrlenW (lpString="J0107728.WMF") returned 12
	[0172.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0172.863] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=5492) returned 1
	[0172.863] CloseHandle (hObject=0x548) returned 1
	[0172.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0x220
	[0172.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0172.864] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.864] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0172.865] GetLastError () returned 0x0
	[0172.865] ReadFile (in: hFile=0x548, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1574, lpOverlapped=0x0) returned 1
	[0172.866] WriteFile (in: hFile=0x514, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1580, lpOverlapped=0x0) returned 1
	[0172.867] ReadFile (in: hFile=0x548, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.867] WriteFile (in: hFile=0x514, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.867] SetEndOfFile (hFile=0x514) returned 1
	[0172.867] CloseHandle (hObject=0x514) returned 1
	[0172.867] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.867] SetEndOfFile (hFile=0x548) returned 1
	[0172.870] CloseHandle (hObject=0x548) returned 1
	[0172.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0172.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 1
	[0172.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.871] lstrlenW (lpString=".doc") returned 4
	[0172.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.871] lstrlenW (lpString=".docx") returned 5
	[0172.871] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0172.871] lstrlenW (lpString=".pdf") returned 4
	[0172.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.871] lstrlenW (lpString=".xls") returned 4
	[0172.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.871] lstrlenW (lpString=".xlsx") returned 5
	[0172.871] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0172.871] lstrlenW (lpString=".ppt") returned 4
	[0172.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.871] lstrlenW (lpString=".zip") returned 4
	[0172.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.871] lstrlenW (lpString=".rar") returned 4
	[0172.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.871] lstrlenW (lpString=".bz2") returned 4
	[0172.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.871] lstrlenW (lpString=".7z") returned 3
	[0172.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.871] lstrlenW (lpString=".dbf") returned 4
	[0172.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.872] lstrlenW (lpString=".1cd") returned 4
	[0172.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.872] lstrlenW (lpString=".jpg") returned 4
	[0172.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.872] lstrlenW (lpString=".doc") returned 4
	[0172.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.872] lstrlenW (lpString=".docx") returned 5
	[0172.872] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0172.872] lstrlenW (lpString=".pdf") returned 4
	[0172.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.872] lstrlenW (lpString=".xls") returned 4
	[0172.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.872] lstrlenW (lpString=".xlsx") returned 5
	[0172.872] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0172.872] lstrlenW (lpString=".ppt") returned 4
	[0172.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.872] lstrlenW (lpString=".zip") returned 4
	[0172.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.872] lstrlenW (lpString=".rar") returned 4
	[0172.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.872] lstrlenW (lpString=".bz2") returned 4
	[0172.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.872] lstrlenW (lpString=".7z") returned 3
	[0172.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.872] lstrlenW (lpString=".dbf") returned 4
	[0172.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.873] lstrlenW (lpString=".1cd") returned 4
	[0172.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0172.873] lstrlenW (lpString=".jpg") returned 4
	[0172.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.873] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0172.873] lstrlenW (lpString="J0107730.WMF") returned 12
	[0172.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0172.874] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=3060) returned 1
	[0172.874] CloseHandle (hObject=0x548) returned 1
	[0172.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0x220
	[0172.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.065] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.065] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0173.134] GetLastError () returned 0x0
	[0173.134] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xbf4, lpOverlapped=0x0) returned 1
	[0173.139] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xc00, lpOverlapped=0x0) returned 1
	[0173.141] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.141] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.141] SetEndOfFile (hFile=0x4b8) returned 1
	[0173.141] CloseHandle (hObject=0x4b8) returned 1
	[0173.141] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.141] SetEndOfFile (hFile=0x444) returned 1
	[0173.143] CloseHandle (hObject=0x444) returned 1
	[0173.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 1
	[0173.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.146] lstrlenW (lpString=".doc") returned 4
	[0173.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.146] lstrlenW (lpString=".docx") returned 5
	[0173.146] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0173.146] lstrlenW (lpString=".pdf") returned 4
	[0173.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.146] lstrlenW (lpString=".xls") returned 4
	[0173.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.146] lstrlenW (lpString=".xlsx") returned 5
	[0173.146] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0173.146] lstrlenW (lpString=".ppt") returned 4
	[0173.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.146] lstrlenW (lpString=".zip") returned 4
	[0173.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.147] lstrlenW (lpString=".rar") returned 4
	[0173.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.147] lstrlenW (lpString=".bz2") returned 4
	[0173.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.147] lstrlenW (lpString=".7z") returned 3
	[0173.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.147] lstrlenW (lpString=".dbf") returned 4
	[0173.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.147] lstrlenW (lpString=".1cd") returned 4
	[0173.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.147] lstrlenW (lpString=".jpg") returned 4
	[0173.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.147] lstrlenW (lpString=".doc") returned 4
	[0173.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.147] lstrlenW (lpString=".docx") returned 5
	[0173.147] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0173.147] lstrlenW (lpString=".pdf") returned 4
	[0173.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.147] lstrlenW (lpString=".xls") returned 4
	[0173.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.147] lstrlenW (lpString=".xlsx") returned 5
	[0173.147] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0173.147] lstrlenW (lpString=".ppt") returned 4
	[0173.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.148] lstrlenW (lpString=".zip") returned 4
	[0173.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.148] lstrlenW (lpString=".rar") returned 4
	[0173.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.148] lstrlenW (lpString=".bz2") returned 4
	[0173.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.148] lstrlenW (lpString=".7z") returned 3
	[0173.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.148] lstrlenW (lpString=".dbf") returned 4
	[0173.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.148] lstrlenW (lpString=".1cd") returned 4
	[0173.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0173.148] lstrlenW (lpString=".jpg") returned 4
	[0173.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.148] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0173.148] lstrlenW (lpString="J0107746.WMF") returned 12
	[0173.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.149] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=4788) returned 1
	[0173.149] CloseHandle (hObject=0x444) returned 1
	[0173.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 0x220
	[0173.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.150] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.150] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0173.150] GetLastError () returned 0x0
	[0173.150] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x12b4, lpOverlapped=0x0) returned 1
	[0173.172] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0173.173] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.173] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.174] SetEndOfFile (hFile=0x4b8) returned 1
	[0173.174] CloseHandle (hObject=0x4b8) returned 1
	[0173.174] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.174] SetEndOfFile (hFile=0x444) returned 1
	[0173.176] CloseHandle (hObject=0x444) returned 1
	[0173.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 1
	[0173.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.178] lstrlenW (lpString=".doc") returned 4
	[0173.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.178] lstrlenW (lpString=".docx") returned 5
	[0173.178] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0173.178] lstrlenW (lpString=".pdf") returned 4
	[0173.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.178] lstrlenW (lpString=".xls") returned 4
	[0173.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.178] lstrlenW (lpString=".xlsx") returned 5
	[0173.178] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0173.178] lstrlenW (lpString=".ppt") returned 4
	[0173.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.178] lstrlenW (lpString=".zip") returned 4
	[0173.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.178] lstrlenW (lpString=".rar") returned 4
	[0173.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.178] lstrlenW (lpString=".bz2") returned 4
	[0173.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.178] lstrlenW (lpString=".7z") returned 3
	[0173.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.178] lstrlenW (lpString=".dbf") returned 4
	[0173.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.178] lstrlenW (lpString=".1cd") returned 4
	[0173.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.178] lstrlenW (lpString=".jpg") returned 4
	[0173.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.179] lstrlenW (lpString=".doc") returned 4
	[0173.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.179] lstrlenW (lpString=".docx") returned 5
	[0173.179] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0173.179] lstrlenW (lpString=".pdf") returned 4
	[0173.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.179] lstrlenW (lpString=".xls") returned 4
	[0173.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.179] lstrlenW (lpString=".xlsx") returned 5
	[0173.179] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0173.179] lstrlenW (lpString=".ppt") returned 4
	[0173.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.179] lstrlenW (lpString=".zip") returned 4
	[0173.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.179] lstrlenW (lpString=".rar") returned 4
	[0173.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.179] lstrlenW (lpString=".bz2") returned 4
	[0173.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.179] lstrlenW (lpString=".7z") returned 3
	[0173.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.179] lstrlenW (lpString=".dbf") returned 4
	[0173.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.179] lstrlenW (lpString=".1cd") returned 4
	[0173.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0173.179] lstrlenW (lpString=".jpg") returned 4
	[0173.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.180] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0173.180] lstrlenW (lpString="J0107748.WMF") returned 12
	[0173.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.182] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=8224) returned 1
	[0173.182] CloseHandle (hObject=0x444) returned 1
	[0173.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0x220
	[0173.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.182] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.183] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0173.183] GetLastError () returned 0x0
	[0173.183] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x2020, lpOverlapped=0x0) returned 1
	[0173.186] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x2030, lpOverlapped=0x0) returned 1
	[0173.187] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.187] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.187] SetEndOfFile (hFile=0x4b8) returned 1
	[0173.187] CloseHandle (hObject=0x4b8) returned 1
	[0173.187] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.187] SetEndOfFile (hFile=0x444) returned 1
	[0173.190] CloseHandle (hObject=0x444) returned 1
	[0173.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 1
	[0173.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.191] lstrlenW (lpString=".doc") returned 4
	[0173.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.191] lstrlenW (lpString=".docx") returned 5
	[0173.191] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0173.191] lstrlenW (lpString=".pdf") returned 4
	[0173.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.191] lstrlenW (lpString=".xls") returned 4
	[0173.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.192] lstrlenW (lpString=".xlsx") returned 5
	[0173.192] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0173.192] lstrlenW (lpString=".ppt") returned 4
	[0173.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.192] lstrlenW (lpString=".zip") returned 4
	[0173.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.192] lstrlenW (lpString=".rar") returned 4
	[0173.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.192] lstrlenW (lpString=".bz2") returned 4
	[0173.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.192] lstrlenW (lpString=".7z") returned 3
	[0173.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.192] lstrlenW (lpString=".dbf") returned 4
	[0173.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.192] lstrlenW (lpString=".1cd") returned 4
	[0173.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.192] lstrlenW (lpString=".jpg") returned 4
	[0173.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.192] lstrlenW (lpString=".doc") returned 4
	[0173.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.192] lstrlenW (lpString=".docx") returned 5
	[0173.192] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0173.192] lstrlenW (lpString=".pdf") returned 4
	[0173.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.193] lstrlenW (lpString=".xls") returned 4
	[0173.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.193] lstrlenW (lpString=".xlsx") returned 5
	[0173.193] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0173.193] lstrlenW (lpString=".ppt") returned 4
	[0173.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.193] lstrlenW (lpString=".zip") returned 4
	[0173.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.193] lstrlenW (lpString=".rar") returned 4
	[0173.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.193] lstrlenW (lpString=".bz2") returned 4
	[0173.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.193] lstrlenW (lpString=".7z") returned 3
	[0173.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.193] lstrlenW (lpString=".dbf") returned 4
	[0173.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.193] lstrlenW (lpString=".1cd") returned 4
	[0173.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0173.193] lstrlenW (lpString=".jpg") returned 4
	[0173.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.193] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0173.193] lstrlenW (lpString="J0107750.WMF") returned 12
	[0173.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0173.696] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=4716) returned 1
	[0173.696] CloseHandle (hObject=0x54c) returned 1
	[0173.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0x220
	[0173.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0173.711] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.711] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0173.712] GetLastError () returned 0x0
	[0173.712] ReadFile (in: hFile=0x370, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x126c, lpOverlapped=0x0) returned 1
	[0173.714] WriteFile (in: hFile=0x54c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1270, lpOverlapped=0x0) returned 1
	[0173.715] ReadFile (in: hFile=0x370, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.715] WriteFile (in: hFile=0x54c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.716] SetEndOfFile (hFile=0x54c) returned 1
	[0173.716] CloseHandle (hObject=0x54c) returned 1
	[0173.716] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.716] SetEndOfFile (hFile=0x370) returned 1
	[0173.720] CloseHandle (hObject=0x370) returned 1
	[0173.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 1
	[0173.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.721] lstrlenW (lpString=".doc") returned 4
	[0173.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.721] lstrlenW (lpString=".docx") returned 5
	[0173.721] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0173.721] lstrlenW (lpString=".pdf") returned 4
	[0173.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.721] lstrlenW (lpString=".xls") returned 4
	[0173.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.721] lstrlenW (lpString=".xlsx") returned 5
	[0173.721] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0173.721] lstrlenW (lpString=".ppt") returned 4
	[0173.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.722] lstrlenW (lpString=".zip") returned 4
	[0173.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.722] lstrlenW (lpString=".rar") returned 4
	[0173.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.722] lstrlenW (lpString=".bz2") returned 4
	[0173.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.722] lstrlenW (lpString=".7z") returned 3
	[0173.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.722] lstrlenW (lpString=".dbf") returned 4
	[0173.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.722] lstrlenW (lpString=".1cd") returned 4
	[0173.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.722] lstrlenW (lpString=".jpg") returned 4
	[0173.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.722] lstrlenW (lpString=".doc") returned 4
	[0173.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.722] lstrlenW (lpString=".docx") returned 5
	[0173.722] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0173.722] lstrlenW (lpString=".pdf") returned 4
	[0173.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.722] lstrlenW (lpString=".xls") returned 4
	[0173.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.723] lstrlenW (lpString=".xlsx") returned 5
	[0173.723] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0173.723] lstrlenW (lpString=".ppt") returned 4
	[0173.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.723] lstrlenW (lpString=".zip") returned 4
	[0173.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.723] lstrlenW (lpString=".rar") returned 4
	[0173.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.723] lstrlenW (lpString=".bz2") returned 4
	[0173.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.723] lstrlenW (lpString=".7z") returned 3
	[0173.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.723] lstrlenW (lpString=".dbf") returned 4
	[0173.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.723] lstrlenW (lpString=".1cd") returned 4
	[0173.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0173.723] lstrlenW (lpString=".jpg") returned 4
	[0173.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.723] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0173.723] lstrlenW (lpString="J0144773.JPG") returned 12
	[0173.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0173.725] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=40231) returned 1
	[0173.725] CloseHandle (hObject=0x370) returned 1
	[0173.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 0x220
	[0173.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0173.726] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.726] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0173.727] GetLastError () returned 0x0
	[0173.727] ReadFile (in: hFile=0x370, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x9d27, lpOverlapped=0x0) returned 1
	[0173.736] WriteFile (in: hFile=0x54c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x9d30, lpOverlapped=0x0) returned 1
	[0173.737] ReadFile (in: hFile=0x370, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.737] WriteFile (in: hFile=0x54c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.737] SetEndOfFile (hFile=0x54c) returned 1
	[0173.738] CloseHandle (hObject=0x54c) returned 1
	[0173.738] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.738] SetEndOfFile (hFile=0x370) returned 1
	[0173.741] CloseHandle (hObject=0x370) returned 1
	[0173.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 1
	[0173.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.742] lstrlenW (lpString=".doc") returned 4
	[0173.742] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.742] lstrlenW (lpString=".docx") returned 5
	[0173.742] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0173.742] lstrlenW (lpString=".pdf") returned 4
	[0173.742] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.742] lstrlenW (lpString=".xls") returned 4
	[0173.742] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.742] lstrlenW (lpString=".xlsx") returned 5
	[0173.742] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0173.742] lstrlenW (lpString=".ppt") returned 4
	[0173.742] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.742] lstrlenW (lpString=".zip") returned 4
	[0173.742] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.742] lstrlenW (lpString=".rar") returned 4
	[0173.742] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.743] lstrlenW (lpString=".bz2") returned 4
	[0173.743] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.743] lstrlenW (lpString=".7z") returned 3
	[0173.743] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.743] lstrlenW (lpString=".dbf") returned 4
	[0173.743] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.743] lstrlenW (lpString=".1cd") returned 4
	[0173.743] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.743] lstrlenW (lpString=".jpg") returned 4
	[0173.743] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.743] lstrlenW (lpString=".doc") returned 4
	[0173.743] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.743] lstrlenW (lpString=".docx") returned 5
	[0173.743] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0173.743] lstrlenW (lpString=".pdf") returned 4
	[0173.743] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.743] lstrlenW (lpString=".xls") returned 4
	[0173.743] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.743] lstrlenW (lpString=".xlsx") returned 5
	[0173.743] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0173.743] lstrlenW (lpString=".ppt") returned 4
	[0173.743] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.743] lstrlenW (lpString=".zip") returned 4
	[0173.744] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.744] lstrlenW (lpString=".rar") returned 4
	[0173.744] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.744] lstrlenW (lpString=".bz2") returned 4
	[0173.744] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.744] lstrlenW (lpString=".7z") returned 3
	[0173.744] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.744] lstrlenW (lpString=".dbf") returned 4
	[0173.744] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.744] lstrlenW (lpString=".1cd") returned 4
	[0173.744] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0173.744] lstrlenW (lpString=".jpg") returned 4
	[0173.744] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.744] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0173.744] lstrlenW (lpString="J0145168.JPG") returned 12
	[0173.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0173.745] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=33657) returned 1
	[0173.745] CloseHandle (hObject=0x370) returned 1
	[0173.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0x220
	[0173.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0173.746] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.746] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0173.747] GetLastError () returned 0x0
	[0173.747] ReadFile (in: hFile=0x370, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x8379, lpOverlapped=0x0) returned 1
	[0173.749] WriteFile (in: hFile=0x54c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x8380, lpOverlapped=0x0) returned 1
	[0173.751] ReadFile (in: hFile=0x370, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.751] WriteFile (in: hFile=0x54c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.751] SetEndOfFile (hFile=0x54c) returned 1
	[0173.751] CloseHandle (hObject=0x54c) returned 1
	[0173.751] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.751] SetEndOfFile (hFile=0x370) returned 1
	[0173.754] CloseHandle (hObject=0x370) returned 1
	[0173.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 1
	[0173.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.755] lstrlenW (lpString=".doc") returned 4
	[0173.755] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.755] lstrlenW (lpString=".docx") returned 5
	[0173.755] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0173.755] lstrlenW (lpString=".pdf") returned 4
	[0173.755] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.755] lstrlenW (lpString=".xls") returned 4
	[0173.755] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.755] lstrlenW (lpString=".xlsx") returned 5
	[0173.755] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0173.755] lstrlenW (lpString=".ppt") returned 4
	[0173.755] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.755] lstrlenW (lpString=".zip") returned 4
	[0173.755] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.755] lstrlenW (lpString=".rar") returned 4
	[0173.755] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.756] lstrlenW (lpString=".bz2") returned 4
	[0173.756] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.756] lstrlenW (lpString=".7z") returned 3
	[0173.756] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.756] lstrlenW (lpString=".dbf") returned 4
	[0173.756] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.756] lstrlenW (lpString=".1cd") returned 4
	[0173.756] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.756] lstrlenW (lpString=".jpg") returned 4
	[0173.756] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.756] lstrlenW (lpString=".doc") returned 4
	[0173.756] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.756] lstrlenW (lpString=".docx") returned 5
	[0173.756] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0173.756] lstrlenW (lpString=".pdf") returned 4
	[0173.756] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.756] lstrlenW (lpString=".xls") returned 4
	[0173.756] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.756] lstrlenW (lpString=".xlsx") returned 5
	[0173.756] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0173.756] lstrlenW (lpString=".ppt") returned 4
	[0173.756] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.757] lstrlenW (lpString=".zip") returned 4
	[0173.757] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.757] lstrlenW (lpString=".rar") returned 4
	[0173.757] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.757] lstrlenW (lpString=".bz2") returned 4
	[0173.757] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.757] lstrlenW (lpString=".7z") returned 3
	[0173.757] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.757] lstrlenW (lpString=".dbf") returned 4
	[0173.757] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.757] lstrlenW (lpString=".1cd") returned 4
	[0173.757] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0173.757] lstrlenW (lpString=".jpg") returned 4
	[0173.757] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.757] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0173.757] lstrlenW (lpString="J0145212.JPG") returned 12
	[0173.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0173.758] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=61633) returned 1
	[0173.758] CloseHandle (hObject=0x370) returned 1
	[0173.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 0x220
	[0173.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0173.758] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.759] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0173.759] GetLastError () returned 0x0
	[0173.759] ReadFile (in: hFile=0x370, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xf0c1, lpOverlapped=0x0) returned 1
	[0173.892] WriteFile (in: hFile=0x54c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xf0d0, lpOverlapped=0x0) returned 1
	[0173.894] ReadFile (in: hFile=0x370, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.894] WriteFile (in: hFile=0x54c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.894] SetEndOfFile (hFile=0x54c) returned 1
	[0173.943] CloseHandle (hObject=0x54c) returned 1
	[0173.943] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.943] SetEndOfFile (hFile=0x370) returned 1
	[0173.947] CloseHandle (hObject=0x370) returned 1
	[0173.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 1
	[0173.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.953] lstrlenW (lpString=".doc") returned 4
	[0173.953] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.953] lstrlenW (lpString=".docx") returned 5
	[0173.953] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0173.953] lstrlenW (lpString=".pdf") returned 4
	[0173.953] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.953] lstrlenW (lpString=".xls") returned 4
	[0173.953] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.953] lstrlenW (lpString=".xlsx") returned 5
	[0173.954] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0173.954] lstrlenW (lpString=".ppt") returned 4
	[0173.954] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.954] lstrlenW (lpString=".zip") returned 4
	[0173.954] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.954] lstrlenW (lpString=".rar") returned 4
	[0173.954] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.954] lstrlenW (lpString=".bz2") returned 4
	[0173.954] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.954] lstrlenW (lpString=".7z") returned 3
	[0173.954] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.954] lstrlenW (lpString=".dbf") returned 4
	[0173.954] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.954] lstrlenW (lpString=".1cd") returned 4
	[0173.954] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.954] lstrlenW (lpString=".jpg") returned 4
	[0173.954] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.954] lstrlenW (lpString=".doc") returned 4
	[0173.954] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.954] lstrlenW (lpString=".docx") returned 5
	[0173.954] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0173.954] lstrlenW (lpString=".pdf") returned 4
	[0173.954] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.954] lstrlenW (lpString=".xls") returned 4
	[0173.954] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.955] lstrlenW (lpString=".xlsx") returned 5
	[0173.955] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0173.955] lstrlenW (lpString=".ppt") returned 4
	[0173.955] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.955] lstrlenW (lpString=".zip") returned 4
	[0173.955] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.955] lstrlenW (lpString=".rar") returned 4
	[0173.955] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.955] lstrlenW (lpString=".bz2") returned 4
	[0173.955] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.955] lstrlenW (lpString=".7z") returned 3
	[0173.955] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.955] lstrlenW (lpString=".dbf") returned 4
	[0173.955] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.955] lstrlenW (lpString=".1cd") returned 4
	[0173.955] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0173.955] lstrlenW (lpString=".jpg") returned 4
	[0173.955] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.955] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0173.955] lstrlenW (lpString="J0145373.JPG") returned 12
	[0173.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0173.957] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=17867) returned 1
	[0173.957] CloseHandle (hObject=0x530) returned 1
	[0173.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0x220
	[0173.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0173.957] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.957] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0173.958] GetLastError () returned 0x0
	[0173.958] ReadFile (in: hFile=0x530, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x45cb, lpOverlapped=0x0) returned 1
	[0173.960] WriteFile (in: hFile=0x370, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x45d0, lpOverlapped=0x0) returned 1
	[0173.961] ReadFile (in: hFile=0x530, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.961] WriteFile (in: hFile=0x370, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.961] SetEndOfFile (hFile=0x370) returned 1
	[0173.961] CloseHandle (hObject=0x370) returned 1
	[0173.961] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.962] SetEndOfFile (hFile=0x530) returned 1
	[0173.964] CloseHandle (hObject=0x530) returned 1
	[0173.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 1
	[0173.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.965] lstrlenW (lpString=".doc") returned 4
	[0173.965] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.965] lstrlenW (lpString=".docx") returned 5
	[0173.965] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0173.965] lstrlenW (lpString=".pdf") returned 4
	[0173.965] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.965] lstrlenW (lpString=".xls") returned 4
	[0173.965] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.965] lstrlenW (lpString=".xlsx") returned 5
	[0173.965] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0173.965] lstrlenW (lpString=".ppt") returned 4
	[0173.966] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.966] lstrlenW (lpString=".zip") returned 4
	[0173.966] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.966] lstrlenW (lpString=".rar") returned 4
	[0173.966] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.966] lstrlenW (lpString=".bz2") returned 4
	[0173.966] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.966] lstrlenW (lpString=".7z") returned 3
	[0173.966] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.966] lstrlenW (lpString=".dbf") returned 4
	[0173.966] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.966] lstrlenW (lpString=".1cd") returned 4
	[0173.966] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.966] lstrlenW (lpString=".jpg") returned 4
	[0173.966] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.966] lstrlenW (lpString=".doc") returned 4
	[0173.966] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.966] lstrlenW (lpString=".docx") returned 5
	[0173.966] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0173.966] lstrlenW (lpString=".pdf") returned 4
	[0173.966] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.966] lstrlenW (lpString=".xls") returned 4
	[0173.966] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.966] lstrlenW (lpString=".xlsx") returned 5
	[0173.966] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0173.967] lstrlenW (lpString=".ppt") returned 4
	[0173.967] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.967] lstrlenW (lpString=".zip") returned 4
	[0173.967] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.967] lstrlenW (lpString=".rar") returned 4
	[0173.967] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.967] lstrlenW (lpString=".bz2") returned 4
	[0173.967] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.967] lstrlenW (lpString=".7z") returned 3
	[0173.967] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.967] lstrlenW (lpString=".dbf") returned 4
	[0173.967] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.967] lstrlenW (lpString=".1cd") returned 4
	[0173.967] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0173.967] lstrlenW (lpString=".jpg") returned 4
	[0173.967] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.967] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0173.967] lstrlenW (lpString="J0145669.JPG") returned 12
	[0173.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0173.968] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=31850) returned 1
	[0173.968] CloseHandle (hObject=0x530) returned 1
	[0173.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0x220
	[0173.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0173.969] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.969] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0173.970] GetLastError () returned 0x0
	[0173.970] ReadFile (in: hFile=0x530, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x7c6a, lpOverlapped=0x0) returned 1
	[0173.972] WriteFile (in: hFile=0x370, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x7c70, lpOverlapped=0x0) returned 1
	[0173.973] ReadFile (in: hFile=0x530, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.973] WriteFile (in: hFile=0x370, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.973] SetEndOfFile (hFile=0x370) returned 1
	[0173.973] CloseHandle (hObject=0x370) returned 1
	[0173.974] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.974] SetEndOfFile (hFile=0x530) returned 1
	[0173.977] CloseHandle (hObject=0x530) returned 1
	[0173.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 1
	[0173.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.978] lstrlenW (lpString=".doc") returned 4
	[0173.979] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.979] lstrlenW (lpString=".docx") returned 5
	[0173.979] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0173.979] lstrlenW (lpString=".pdf") returned 4
	[0173.979] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.979] lstrlenW (lpString=".xls") returned 4
	[0173.979] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.979] lstrlenW (lpString=".xlsx") returned 5
	[0173.979] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0173.979] lstrlenW (lpString=".ppt") returned 4
	[0173.979] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.979] lstrlenW (lpString=".zip") returned 4
	[0173.979] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.979] lstrlenW (lpString=".rar") returned 4
	[0173.979] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.979] lstrlenW (lpString=".bz2") returned 4
	[0173.979] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.979] lstrlenW (lpString=".7z") returned 3
	[0173.979] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.979] lstrlenW (lpString=".dbf") returned 4
	[0173.979] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.979] lstrlenW (lpString=".1cd") returned 4
	[0173.979] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.979] lstrlenW (lpString=".jpg") returned 4
	[0173.979] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.980] lstrlenW (lpString=".doc") returned 4
	[0173.980] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.980] lstrlenW (lpString=".docx") returned 5
	[0173.980] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0173.980] lstrlenW (lpString=".pdf") returned 4
	[0173.980] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.980] lstrlenW (lpString=".xls") returned 4
	[0173.980] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.980] lstrlenW (lpString=".xlsx") returned 5
	[0173.980] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0173.980] lstrlenW (lpString=".ppt") returned 4
	[0173.980] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.980] lstrlenW (lpString=".zip") returned 4
	[0173.980] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.980] lstrlenW (lpString=".rar") returned 4
	[0173.980] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.980] lstrlenW (lpString=".bz2") returned 4
	[0173.980] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.980] lstrlenW (lpString=".7z") returned 3
	[0173.980] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.980] lstrlenW (lpString=".dbf") returned 4
	[0173.980] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.980] lstrlenW (lpString=".1cd") returned 4
	[0173.980] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0173.980] lstrlenW (lpString=".jpg") returned 4
	[0173.980] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.981] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0173.981] lstrlenW (lpString="J0145707.JPG") returned 12
	[0173.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0173.982] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=36820) returned 1
	[0173.982] CloseHandle (hObject=0x530) returned 1
	[0173.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0x220
	[0173.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0174.387] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.387] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0174.390] GetLastError () returned 0x0
	[0174.390] ReadFile (in: hFile=0x558, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x8fd4, lpOverlapped=0x0) returned 1
	[0174.394] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x8fe0, lpOverlapped=0x0) returned 1
	[0174.395] ReadFile (in: hFile=0x558, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.396] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.396] SetEndOfFile (hFile=0x51c) returned 1
	[0174.396] CloseHandle (hObject=0x51c) returned 1
	[0174.396] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.396] SetEndOfFile (hFile=0x558) returned 1
	[0174.403] CloseHandle (hObject=0x558) returned 1
	[0174.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 1
	[0174.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.408] lstrlenW (lpString=".doc") returned 4
	[0174.408] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.408] lstrlenW (lpString=".docx") returned 5
	[0174.408] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0174.408] lstrlenW (lpString=".pdf") returned 4
	[0174.408] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.408] lstrlenW (lpString=".xls") returned 4
	[0174.409] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.409] lstrlenW (lpString=".xlsx") returned 5
	[0174.409] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0174.409] lstrlenW (lpString=".ppt") returned 4
	[0174.409] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.409] lstrlenW (lpString=".zip") returned 4
	[0174.409] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.409] lstrlenW (lpString=".rar") returned 4
	[0174.409] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.409] lstrlenW (lpString=".bz2") returned 4
	[0174.409] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.409] lstrlenW (lpString=".7z") returned 3
	[0174.409] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.409] lstrlenW (lpString=".dbf") returned 4
	[0174.409] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.409] lstrlenW (lpString=".1cd") returned 4
	[0174.409] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.409] lstrlenW (lpString=".jpg") returned 4
	[0174.409] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.409] lstrlenW (lpString=".doc") returned 4
	[0174.409] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.409] lstrlenW (lpString=".docx") returned 5
	[0174.409] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0174.409] lstrlenW (lpString=".pdf") returned 4
	[0174.410] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.410] lstrlenW (lpString=".xls") returned 4
	[0174.410] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.410] lstrlenW (lpString=".xlsx") returned 5
	[0174.410] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0174.410] lstrlenW (lpString=".ppt") returned 4
	[0174.410] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.410] lstrlenW (lpString=".zip") returned 4
	[0174.410] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.410] lstrlenW (lpString=".rar") returned 4
	[0174.410] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.410] lstrlenW (lpString=".bz2") returned 4
	[0174.410] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.410] lstrlenW (lpString=".7z") returned 3
	[0174.410] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.410] lstrlenW (lpString=".dbf") returned 4
	[0174.410] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.410] lstrlenW (lpString=".1cd") returned 4
	[0174.410] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0174.410] lstrlenW (lpString=".jpg") returned 4
	[0174.410] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.410] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0174.410] lstrlenW (lpString="J0148798.JPG") returned 12
	[0174.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0174.547] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=38237) returned 1
	[0174.547] CloseHandle (hObject=0x544) returned 1
	[0174.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0x220
	[0174.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0174.547] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.547] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0174.548] GetLastError () returned 0x0
	[0174.548] ReadFile (in: hFile=0x544, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x955d, lpOverlapped=0x0) returned 1
	[0174.550] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x9560, lpOverlapped=0x0) returned 1
	[0174.552] ReadFile (in: hFile=0x544, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.552] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.552] SetEndOfFile (hFile=0x51c) returned 1
	[0174.552] CloseHandle (hObject=0x51c) returned 1
	[0174.552] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.552] SetEndOfFile (hFile=0x544) returned 1
	[0174.555] CloseHandle (hObject=0x544) returned 1
	[0174.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 1
	[0174.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.556] lstrlenW (lpString=".doc") returned 4
	[0174.556] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.556] lstrlenW (lpString=".docx") returned 5
	[0174.556] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0174.556] lstrlenW (lpString=".pdf") returned 4
	[0174.556] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.556] lstrlenW (lpString=".xls") returned 4
	[0174.556] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.556] lstrlenW (lpString=".xlsx") returned 5
	[0174.556] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0174.556] lstrlenW (lpString=".ppt") returned 4
	[0174.556] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.556] lstrlenW (lpString=".zip") returned 4
	[0174.556] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.556] lstrlenW (lpString=".rar") returned 4
	[0174.556] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.557] lstrlenW (lpString=".bz2") returned 4
	[0174.557] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.557] lstrlenW (lpString=".7z") returned 3
	[0174.557] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.557] lstrlenW (lpString=".dbf") returned 4
	[0174.557] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.557] lstrlenW (lpString=".1cd") returned 4
	[0174.557] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.557] lstrlenW (lpString=".jpg") returned 4
	[0174.557] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.557] lstrlenW (lpString=".doc") returned 4
	[0174.557] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.557] lstrlenW (lpString=".docx") returned 5
	[0174.557] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0174.557] lstrlenW (lpString=".pdf") returned 4
	[0174.557] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.557] lstrlenW (lpString=".xls") returned 4
	[0174.557] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.557] lstrlenW (lpString=".xlsx") returned 5
	[0174.557] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0174.557] lstrlenW (lpString=".ppt") returned 4
	[0174.557] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.557] lstrlenW (lpString=".zip") returned 4
	[0174.557] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.557] lstrlenW (lpString=".rar") returned 4
	[0174.558] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.558] lstrlenW (lpString=".bz2") returned 4
	[0174.558] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.558] lstrlenW (lpString=".7z") returned 3
	[0174.558] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.558] lstrlenW (lpString=".dbf") returned 4
	[0174.558] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.558] lstrlenW (lpString=".1cd") returned 4
	[0174.558] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0174.558] lstrlenW (lpString=".jpg") returned 4
	[0174.558] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.558] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0174.558] lstrlenW (lpString="J0150861.WMF") returned 12
	[0174.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0174.559] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=8494) returned 1
	[0174.559] CloseHandle (hObject=0x544) returned 1
	[0174.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0x220
	[0174.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0174.559] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.559] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0174.560] GetLastError () returned 0x0
	[0174.560] ReadFile (in: hFile=0x544, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x212e, lpOverlapped=0x0) returned 1
	[0174.562] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x2130, lpOverlapped=0x0) returned 1
	[0174.563] ReadFile (in: hFile=0x544, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.563] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.563] SetEndOfFile (hFile=0x51c) returned 1
	[0174.563] CloseHandle (hObject=0x51c) returned 1
	[0174.563] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.563] SetEndOfFile (hFile=0x544) returned 1
	[0174.566] CloseHandle (hObject=0x544) returned 1
	[0174.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 1
	[0174.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.567] lstrlenW (lpString=".doc") returned 4
	[0174.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.567] lstrlenW (lpString=".docx") returned 5
	[0174.567] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0174.567] lstrlenW (lpString=".pdf") returned 4
	[0174.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.567] lstrlenW (lpString=".xls") returned 4
	[0174.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.567] lstrlenW (lpString=".xlsx") returned 5
	[0174.567] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0174.567] lstrlenW (lpString=".ppt") returned 4
	[0174.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.567] lstrlenW (lpString=".zip") returned 4
	[0174.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.567] lstrlenW (lpString=".rar") returned 4
	[0174.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.567] lstrlenW (lpString=".bz2") returned 4
	[0174.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.567] lstrlenW (lpString=".7z") returned 3
	[0174.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.568] lstrlenW (lpString=".dbf") returned 4
	[0174.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.568] lstrlenW (lpString=".1cd") returned 4
	[0174.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.568] lstrlenW (lpString=".jpg") returned 4
	[0174.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.568] lstrlenW (lpString=".doc") returned 4
	[0174.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.568] lstrlenW (lpString=".docx") returned 5
	[0174.568] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0174.568] lstrlenW (lpString=".pdf") returned 4
	[0174.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.568] lstrlenW (lpString=".xls") returned 4
	[0174.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.568] lstrlenW (lpString=".xlsx") returned 5
	[0174.568] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0174.568] lstrlenW (lpString=".ppt") returned 4
	[0174.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.568] lstrlenW (lpString=".zip") returned 4
	[0174.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.568] lstrlenW (lpString=".rar") returned 4
	[0174.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.568] lstrlenW (lpString=".bz2") returned 4
	[0174.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.569] lstrlenW (lpString=".7z") returned 3
	[0174.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.569] lstrlenW (lpString=".dbf") returned 4
	[0174.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.569] lstrlenW (lpString=".1cd") returned 4
	[0174.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0174.569] lstrlenW (lpString=".jpg") returned 4
	[0174.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.569] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0174.569] lstrlenW (lpString="J0151041.WMF") returned 12
	[0174.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0174.654] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=4356) returned 1
	[0174.654] CloseHandle (hObject=0x538) returned 1
	[0174.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 0x220
	[0174.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0175.061] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.061] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.172] GetLastError () returned 0x0
	[0176.172] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1104, lpOverlapped=0x0) returned 1
	[0176.174] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1110, lpOverlapped=0x0) returned 1
	[0176.175] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.175] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.175] SetEndOfFile (hFile=0x51c) returned 1
	[0176.175] CloseHandle (hObject=0x51c) returned 1
	[0176.175] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.175] SetEndOfFile (hFile=0x3d8) returned 1
	[0176.178] CloseHandle (hObject=0x3d8) returned 1
	[0176.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 1
	[0176.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.179] lstrlenW (lpString=".doc") returned 4
	[0176.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.179] lstrlenW (lpString=".docx") returned 5
	[0176.179] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0176.179] lstrlenW (lpString=".pdf") returned 4
	[0176.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.180] lstrlenW (lpString=".xls") returned 4
	[0176.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.180] lstrlenW (lpString=".xlsx") returned 5
	[0176.180] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0176.180] lstrlenW (lpString=".ppt") returned 4
	[0176.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.180] lstrlenW (lpString=".zip") returned 4
	[0176.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.180] lstrlenW (lpString=".rar") returned 4
	[0176.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.180] lstrlenW (lpString=".bz2") returned 4
	[0176.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.180] lstrlenW (lpString=".7z") returned 3
	[0176.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.180] lstrlenW (lpString=".dbf") returned 4
	[0176.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.180] lstrlenW (lpString=".1cd") returned 4
	[0176.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.180] lstrlenW (lpString=".jpg") returned 4
	[0176.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.180] lstrlenW (lpString=".doc") returned 4
	[0176.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.180] lstrlenW (lpString=".docx") returned 5
	[0176.181] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0176.181] lstrlenW (lpString=".pdf") returned 4
	[0176.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.181] lstrlenW (lpString=".xls") returned 4
	[0176.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.181] lstrlenW (lpString=".xlsx") returned 5
	[0176.181] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0176.181] lstrlenW (lpString=".ppt") returned 4
	[0176.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.181] lstrlenW (lpString=".zip") returned 4
	[0176.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.181] lstrlenW (lpString=".rar") returned 4
	[0176.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.181] lstrlenW (lpString=".bz2") returned 4
	[0176.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.181] lstrlenW (lpString=".7z") returned 3
	[0176.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.181] lstrlenW (lpString=".dbf") returned 4
	[0176.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.181] lstrlenW (lpString=".1cd") returned 4
	[0176.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.181] lstrlenW (lpString=".jpg") returned 4
	[0176.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.181] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.182] lstrlenW (lpString="J0152558.WMF") returned 12
	[0176.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0176.183] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=16052) returned 1
	[0176.183] CloseHandle (hObject=0x3d8) returned 1
	[0176.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0x220
	[0176.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0176.184] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.184] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.184] GetLastError () returned 0x0
	[0176.184] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x3eb4, lpOverlapped=0x0) returned 1
	[0176.186] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x3ec0, lpOverlapped=0x0) returned 1
	[0176.187] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.187] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.188] SetEndOfFile (hFile=0x51c) returned 1
	[0176.188] CloseHandle (hObject=0x51c) returned 1
	[0176.188] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.188] SetEndOfFile (hFile=0x3d8) returned 1
	[0176.191] CloseHandle (hObject=0x3d8) returned 1
	[0176.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 1
	[0176.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.192] lstrlenW (lpString=".doc") returned 4
	[0176.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.192] lstrlenW (lpString=".docx") returned 5
	[0176.192] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0176.192] lstrlenW (lpString=".pdf") returned 4
	[0176.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.192] lstrlenW (lpString=".xls") returned 4
	[0176.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.192] lstrlenW (lpString=".xlsx") returned 5
	[0176.192] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0176.192] lstrlenW (lpString=".ppt") returned 4
	[0176.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.192] lstrlenW (lpString=".zip") returned 4
	[0176.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.192] lstrlenW (lpString=".rar") returned 4
	[0176.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.192] lstrlenW (lpString=".bz2") returned 4
	[0176.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.192] lstrlenW (lpString=".7z") returned 3
	[0176.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.193] lstrlenW (lpString=".dbf") returned 4
	[0176.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.193] lstrlenW (lpString=".1cd") returned 4
	[0176.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.193] lstrlenW (lpString=".jpg") returned 4
	[0176.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.193] lstrlenW (lpString=".doc") returned 4
	[0176.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.193] lstrlenW (lpString=".docx") returned 5
	[0176.193] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0176.193] lstrlenW (lpString=".pdf") returned 4
	[0176.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.193] lstrlenW (lpString=".xls") returned 4
	[0176.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.193] lstrlenW (lpString=".xlsx") returned 5
	[0176.193] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0176.193] lstrlenW (lpString=".ppt") returned 4
	[0176.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.193] lstrlenW (lpString=".zip") returned 4
	[0176.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.193] lstrlenW (lpString=".rar") returned 4
	[0176.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.193] lstrlenW (lpString=".bz2") returned 4
	[0176.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.194] lstrlenW (lpString=".7z") returned 3
	[0176.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.194] lstrlenW (lpString=".dbf") returned 4
	[0176.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.194] lstrlenW (lpString=".1cd") returned 4
	[0176.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0176.194] lstrlenW (lpString=".jpg") returned 4
	[0176.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.194] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.194] lstrlenW (lpString="J0152560.WMF") returned 12
	[0176.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0176.195] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=10880) returned 1
	[0176.195] CloseHandle (hObject=0x3d8) returned 1
	[0176.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 0x220
	[0176.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0176.195] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.195] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.196] GetLastError () returned 0x0
	[0176.196] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x2a80, lpOverlapped=0x0) returned 1
	[0176.198] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x2a90, lpOverlapped=0x0) returned 1
	[0176.199] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.199] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.199] SetEndOfFile (hFile=0x51c) returned 1
	[0176.199] CloseHandle (hObject=0x51c) returned 1
	[0176.199] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.199] SetEndOfFile (hFile=0x3d8) returned 1
	[0176.203] CloseHandle (hObject=0x3d8) returned 1
	[0176.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 1
	[0176.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.204] lstrlenW (lpString=".doc") returned 4
	[0176.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.204] lstrlenW (lpString=".docx") returned 5
	[0176.204] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0176.204] lstrlenW (lpString=".pdf") returned 4
	[0176.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.204] lstrlenW (lpString=".xls") returned 4
	[0176.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.204] lstrlenW (lpString=".xlsx") returned 5
	[0176.204] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0176.204] lstrlenW (lpString=".ppt") returned 4
	[0176.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.205] lstrlenW (lpString=".zip") returned 4
	[0176.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.205] lstrlenW (lpString=".rar") returned 4
	[0176.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.205] lstrlenW (lpString=".bz2") returned 4
	[0176.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.205] lstrlenW (lpString=".7z") returned 3
	[0176.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.205] lstrlenW (lpString=".dbf") returned 4
	[0176.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.205] lstrlenW (lpString=".1cd") returned 4
	[0176.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.205] lstrlenW (lpString=".jpg") returned 4
	[0176.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.205] lstrlenW (lpString=".doc") returned 4
	[0176.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.205] lstrlenW (lpString=".docx") returned 5
	[0176.205] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0176.205] lstrlenW (lpString=".pdf") returned 4
	[0176.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.205] lstrlenW (lpString=".xls") returned 4
	[0176.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.205] lstrlenW (lpString=".xlsx") returned 5
	[0176.206] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0176.206] lstrlenW (lpString=".ppt") returned 4
	[0176.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.206] lstrlenW (lpString=".zip") returned 4
	[0176.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.206] lstrlenW (lpString=".rar") returned 4
	[0176.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.206] lstrlenW (lpString=".bz2") returned 4
	[0176.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.206] lstrlenW (lpString=".7z") returned 3
	[0176.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.206] lstrlenW (lpString=".dbf") returned 4
	[0176.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.206] lstrlenW (lpString=".1cd") returned 4
	[0176.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0176.206] lstrlenW (lpString=".jpg") returned 4
	[0176.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.206] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.206] lstrlenW (lpString="J0152568.WMF") returned 12
	[0176.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0176.207] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=3696) returned 1
	[0176.207] CloseHandle (hObject=0x3d8) returned 1
	[0176.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0x220
	[0176.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0176.208] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.208] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.209] GetLastError () returned 0x0
	[0176.209] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xe70, lpOverlapped=0x0) returned 1
	[0176.447] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xe80, lpOverlapped=0x0) returned 1
	[0176.450] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.450] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.450] SetEndOfFile (hFile=0x51c) returned 1
	[0176.450] CloseHandle (hObject=0x51c) returned 1
	[0176.451] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.451] SetEndOfFile (hFile=0x3d8) returned 1
	[0176.454] CloseHandle (hObject=0x3d8) returned 1
	[0176.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 1
	[0176.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.456] lstrlenW (lpString=".doc") returned 4
	[0176.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.456] lstrlenW (lpString=".docx") returned 5
	[0176.456] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0176.456] lstrlenW (lpString=".pdf") returned 4
	[0176.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.457] lstrlenW (lpString=".xls") returned 4
	[0176.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.457] lstrlenW (lpString=".xlsx") returned 5
	[0176.457] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0176.457] lstrlenW (lpString=".ppt") returned 4
	[0176.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.457] lstrlenW (lpString=".zip") returned 4
	[0176.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.457] lstrlenW (lpString=".rar") returned 4
	[0176.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.457] lstrlenW (lpString=".bz2") returned 4
	[0176.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.457] lstrlenW (lpString=".7z") returned 3
	[0176.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.457] lstrlenW (lpString=".dbf") returned 4
	[0176.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.457] lstrlenW (lpString=".1cd") returned 4
	[0176.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.457] lstrlenW (lpString=".jpg") returned 4
	[0176.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.457] lstrlenW (lpString=".doc") returned 4
	[0176.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.457] lstrlenW (lpString=".docx") returned 5
	[0176.457] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0176.457] lstrlenW (lpString=".pdf") returned 4
	[0176.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.458] lstrlenW (lpString=".xls") returned 4
	[0176.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.458] lstrlenW (lpString=".xlsx") returned 5
	[0176.458] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0176.458] lstrlenW (lpString=".ppt") returned 4
	[0176.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.458] lstrlenW (lpString=".zip") returned 4
	[0176.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.458] lstrlenW (lpString=".rar") returned 4
	[0176.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.458] lstrlenW (lpString=".bz2") returned 4
	[0176.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.458] lstrlenW (lpString=".7z") returned 3
	[0176.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.458] lstrlenW (lpString=".dbf") returned 4
	[0176.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.458] lstrlenW (lpString=".1cd") returned 4
	[0176.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0176.458] lstrlenW (lpString=".jpg") returned 4
	[0176.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.458] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.458] lstrlenW (lpString="J0152600.WMF") returned 12
	[0176.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0176.461] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=9768) returned 1
	[0176.461] CloseHandle (hObject=0x3d8) returned 1
	[0176.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 0x220
	[0176.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0176.462] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.462] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.463] GetLastError () returned 0x0
	[0176.463] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x2628, lpOverlapped=0x0) returned 1
	[0176.464] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x2630, lpOverlapped=0x0) returned 1
	[0176.466] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.466] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.466] SetEndOfFile (hFile=0x51c) returned 1
	[0176.466] CloseHandle (hObject=0x51c) returned 1
	[0176.466] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.466] SetEndOfFile (hFile=0x3d8) returned 1
	[0176.469] CloseHandle (hObject=0x3d8) returned 1
	[0176.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 1
	[0176.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.470] lstrlenW (lpString=".doc") returned 4
	[0176.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.470] lstrlenW (lpString=".docx") returned 5
	[0176.470] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0176.470] lstrlenW (lpString=".pdf") returned 4
	[0176.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.471] lstrlenW (lpString=".xls") returned 4
	[0176.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.471] lstrlenW (lpString=".xlsx") returned 5
	[0176.471] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0176.471] lstrlenW (lpString=".ppt") returned 4
	[0176.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.471] lstrlenW (lpString=".zip") returned 4
	[0176.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.471] lstrlenW (lpString=".rar") returned 4
	[0176.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.471] lstrlenW (lpString=".bz2") returned 4
	[0176.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.471] lstrlenW (lpString=".7z") returned 3
	[0176.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.471] lstrlenW (lpString=".dbf") returned 4
	[0176.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.471] lstrlenW (lpString=".1cd") returned 4
	[0176.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.471] lstrlenW (lpString=".jpg") returned 4
	[0176.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.471] lstrlenW (lpString=".doc") returned 4
	[0176.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.471] lstrlenW (lpString=".docx") returned 5
	[0176.471] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0176.472] lstrlenW (lpString=".pdf") returned 4
	[0176.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.472] lstrlenW (lpString=".xls") returned 4
	[0176.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.472] lstrlenW (lpString=".xlsx") returned 5
	[0176.472] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0176.472] lstrlenW (lpString=".ppt") returned 4
	[0176.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.472] lstrlenW (lpString=".zip") returned 4
	[0176.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.472] lstrlenW (lpString=".rar") returned 4
	[0176.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.472] lstrlenW (lpString=".bz2") returned 4
	[0176.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.472] lstrlenW (lpString=".7z") returned 3
	[0176.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.472] lstrlenW (lpString=".dbf") returned 4
	[0176.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.472] lstrlenW (lpString=".1cd") returned 4
	[0176.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0176.472] lstrlenW (lpString=".jpg") returned 4
	[0176.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.472] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.473] lstrlenW (lpString="J0152602.WMF") returned 12
	[0176.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0176.477] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=6276) returned 1
	[0176.477] CloseHandle (hObject=0x3d8) returned 1
	[0176.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0x220
	[0176.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0176.478] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.478] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.479] GetLastError () returned 0x0
	[0176.479] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1884, lpOverlapped=0x0) returned 1
	[0176.480] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1890, lpOverlapped=0x0) returned 1
	[0176.481] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.481] WriteFile (in: hFile=0x51c, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.481] SetEndOfFile (hFile=0x51c) returned 1
	[0176.481] CloseHandle (hObject=0x51c) returned 1
	[0176.481] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.482] SetEndOfFile (hFile=0x3d8) returned 1
	[0176.723] CloseHandle (hObject=0x3d8) returned 1
	[0176.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 1
	[0177.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.364] lstrlenW (lpString=".doc") returned 4
	[0177.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.364] lstrlenW (lpString=".docx") returned 5
	[0177.364] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0177.364] lstrlenW (lpString=".pdf") returned 4
	[0177.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.364] lstrlenW (lpString=".xls") returned 4
	[0177.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.364] lstrlenW (lpString=".xlsx") returned 5
	[0177.364] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0177.364] lstrlenW (lpString=".ppt") returned 4
	[0177.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.364] lstrlenW (lpString=".zip") returned 4
	[0177.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.364] lstrlenW (lpString=".rar") returned 4
	[0177.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.365] lstrlenW (lpString=".bz2") returned 4
	[0177.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.365] lstrlenW (lpString=".7z") returned 3
	[0177.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.365] lstrlenW (lpString=".dbf") returned 4
	[0177.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.365] lstrlenW (lpString=".1cd") returned 4
	[0177.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.365] lstrlenW (lpString=".jpg") returned 4
	[0177.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.365] lstrlenW (lpString=".doc") returned 4
	[0177.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.365] lstrlenW (lpString=".docx") returned 5
	[0177.365] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0177.365] lstrlenW (lpString=".pdf") returned 4
	[0177.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.365] lstrlenW (lpString=".xls") returned 4
	[0177.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.365] lstrlenW (lpString=".xlsx") returned 5
	[0177.365] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0177.365] lstrlenW (lpString=".ppt") returned 4
	[0177.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.365] lstrlenW (lpString=".zip") returned 4
	[0177.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.365] lstrlenW (lpString=".rar") returned 4
	[0177.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.366] lstrlenW (lpString=".bz2") returned 4
	[0177.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.366] lstrlenW (lpString=".7z") returned 3
	[0177.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.366] lstrlenW (lpString=".dbf") returned 4
	[0177.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.366] lstrlenW (lpString=".1cd") returned 4
	[0177.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.366] lstrlenW (lpString=".jpg") returned 4
	[0177.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.366] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0177.366] lstrlenW (lpString="J0152878.WMF") returned 12
	[0177.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0178.165] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=14888) returned 1
	[0178.165] CloseHandle (hObject=0x540) returned 1
	[0178.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 0x220
	[0178.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0178.682] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.682] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0179.269] GetLastError () returned 0x0
	[0179.269] ReadFile (in: hFile=0x540, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x3a28, lpOverlapped=0x0) returned 1
	[0179.271] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x3a30, lpOverlapped=0x0) returned 1
	[0179.272] ReadFile (in: hFile=0x540, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.272] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.272] SetEndOfFile (hFile=0x554) returned 1
	[0179.272] CloseHandle (hObject=0x554) returned 1
	[0179.272] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.272] SetEndOfFile (hFile=0x540) returned 1
	[0179.275] CloseHandle (hObject=0x540) returned 1
	[0179.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 1
	[0179.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.277] lstrlenW (lpString=".doc") returned 4
	[0179.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.277] lstrlenW (lpString=".docx") returned 5
	[0179.277] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0179.277] lstrlenW (lpString=".pdf") returned 4
	[0179.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.277] lstrlenW (lpString=".xls") returned 4
	[0179.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.277] lstrlenW (lpString=".xlsx") returned 5
	[0179.277] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0179.277] lstrlenW (lpString=".ppt") returned 4
	[0179.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.277] lstrlenW (lpString=".zip") returned 4
	[0179.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.277] lstrlenW (lpString=".rar") returned 4
	[0179.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.277] lstrlenW (lpString=".bz2") returned 4
	[0179.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.277] lstrlenW (lpString=".7z") returned 3
	[0179.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.277] lstrlenW (lpString=".dbf") returned 4
	[0179.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.277] lstrlenW (lpString=".1cd") returned 4
	[0179.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.278] lstrlenW (lpString=".jpg") returned 4
	[0179.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.278] lstrlenW (lpString=".doc") returned 4
	[0179.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.278] lstrlenW (lpString=".docx") returned 5
	[0179.278] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0179.278] lstrlenW (lpString=".pdf") returned 4
	[0179.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.278] lstrlenW (lpString=".xls") returned 4
	[0179.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.278] lstrlenW (lpString=".xlsx") returned 5
	[0179.278] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0179.278] lstrlenW (lpString=".ppt") returned 4
	[0179.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.278] lstrlenW (lpString=".zip") returned 4
	[0179.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.278] lstrlenW (lpString=".rar") returned 4
	[0179.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.278] lstrlenW (lpString=".bz2") returned 4
	[0179.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.278] lstrlenW (lpString=".7z") returned 3
	[0179.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.278] lstrlenW (lpString=".dbf") returned 4
	[0179.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.278] lstrlenW (lpString=".1cd") returned 4
	[0179.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0179.279] lstrlenW (lpString=".jpg") returned 4
	[0179.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.279] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.279] lstrlenW (lpString="J0153095.WMF") returned 12
	[0179.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0179.280] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=3704) returned 1
	[0179.280] CloseHandle (hObject=0x540) returned 1
	[0179.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 0x220
	[0179.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0179.281] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.281] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0179.282] GetLastError () returned 0x0
	[0179.282] ReadFile (in: hFile=0x540, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xe78, lpOverlapped=0x0) returned 1
	[0179.283] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xe80, lpOverlapped=0x0) returned 1
	[0179.284] ReadFile (in: hFile=0x540, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.284] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.284] SetEndOfFile (hFile=0x554) returned 1
	[0179.284] CloseHandle (hObject=0x554) returned 1
	[0179.284] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.284] SetEndOfFile (hFile=0x540) returned 1
	[0179.287] CloseHandle (hObject=0x540) returned 1
	[0179.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 1
	[0179.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.290] lstrlenW (lpString=".doc") returned 4
	[0179.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.290] lstrlenW (lpString=".docx") returned 5
	[0179.290] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0179.290] lstrlenW (lpString=".pdf") returned 4
	[0179.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.291] lstrlenW (lpString=".xls") returned 4
	[0179.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.291] lstrlenW (lpString=".xlsx") returned 5
	[0179.291] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0179.291] lstrlenW (lpString=".ppt") returned 4
	[0179.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.291] lstrlenW (lpString=".zip") returned 4
	[0179.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.291] lstrlenW (lpString=".rar") returned 4
	[0179.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.291] lstrlenW (lpString=".bz2") returned 4
	[0179.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.291] lstrlenW (lpString=".7z") returned 3
	[0179.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.291] lstrlenW (lpString=".dbf") returned 4
	[0179.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.291] lstrlenW (lpString=".1cd") returned 4
	[0179.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.291] lstrlenW (lpString=".jpg") returned 4
	[0179.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.291] lstrlenW (lpString=".doc") returned 4
	[0179.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.291] lstrlenW (lpString=".docx") returned 5
	[0179.292] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0179.292] lstrlenW (lpString=".pdf") returned 4
	[0179.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.292] lstrlenW (lpString=".xls") returned 4
	[0179.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.292] lstrlenW (lpString=".xlsx") returned 5
	[0179.292] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0179.292] lstrlenW (lpString=".ppt") returned 4
	[0179.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.292] lstrlenW (lpString=".zip") returned 4
	[0179.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.292] lstrlenW (lpString=".rar") returned 4
	[0179.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.292] lstrlenW (lpString=".bz2") returned 4
	[0179.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.292] lstrlenW (lpString=".7z") returned 3
	[0179.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.292] lstrlenW (lpString=".dbf") returned 4
	[0179.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.292] lstrlenW (lpString=".1cd") returned 4
	[0179.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0179.292] lstrlenW (lpString=".jpg") returned 4
	[0179.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.293] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.293] lstrlenW (lpString="J0153265.WMF") returned 12
	[0179.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0179.294] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=3008) returned 1
	[0179.294] CloseHandle (hObject=0x540) returned 1
	[0179.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 0x220
	[0179.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0179.294] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.295] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0179.295] GetLastError () returned 0x0
	[0179.295] ReadFile (in: hFile=0x540, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xbc0, lpOverlapped=0x0) returned 1
	[0179.297] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0179.298] ReadFile (in: hFile=0x540, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.298] WriteFile (in: hFile=0x554, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.298] SetEndOfFile (hFile=0x554) returned 1
	[0179.298] CloseHandle (hObject=0x554) returned 1
	[0179.298] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.298] SetEndOfFile (hFile=0x540) returned 1
	[0179.300] CloseHandle (hObject=0x540) returned 1
	[0179.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 1
	[0179.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.301] lstrlenW (lpString=".doc") returned 4
	[0179.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.302] lstrlenW (lpString=".docx") returned 5
	[0179.302] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0179.302] lstrlenW (lpString=".pdf") returned 4
	[0179.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.302] lstrlenW (lpString=".xls") returned 4
	[0179.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.302] lstrlenW (lpString=".xlsx") returned 5
	[0179.302] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0179.302] lstrlenW (lpString=".ppt") returned 4
	[0179.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.302] lstrlenW (lpString=".zip") returned 4
	[0179.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.302] lstrlenW (lpString=".rar") returned 4
	[0179.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.302] lstrlenW (lpString=".bz2") returned 4
	[0179.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.302] lstrlenW (lpString=".7z") returned 3
	[0179.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.302] lstrlenW (lpString=".dbf") returned 4
	[0179.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.302] lstrlenW (lpString=".1cd") returned 4
	[0179.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.302] lstrlenW (lpString=".jpg") returned 4
	[0179.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.302] lstrlenW (lpString=".doc") returned 4
	[0179.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.303] lstrlenW (lpString=".docx") returned 5
	[0179.303] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0179.303] lstrlenW (lpString=".pdf") returned 4
	[0179.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.303] lstrlenW (lpString=".xls") returned 4
	[0179.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.303] lstrlenW (lpString=".xlsx") returned 5
	[0179.303] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0179.303] lstrlenW (lpString=".ppt") returned 4
	[0179.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.303] lstrlenW (lpString=".zip") returned 4
	[0179.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.303] lstrlenW (lpString=".rar") returned 4
	[0179.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.303] lstrlenW (lpString=".bz2") returned 4
	[0179.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.303] lstrlenW (lpString=".7z") returned 3
	[0179.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.303] lstrlenW (lpString=".dbf") returned 4
	[0179.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.303] lstrlenW (lpString=".1cd") returned 4
	[0179.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0179.303] lstrlenW (lpString=".jpg") returned 4
	[0179.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.304] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.304] lstrlenW (lpString="J0153273.WMF") returned 12
	[0179.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.435] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=20096) returned 1
	[0179.435] CloseHandle (hObject=0x4e4) returned 1
	[0179.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf")) returned 0x220
	[0179.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0179.656] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.656] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.658] GetLastError () returned 0x0
	[0179.658] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x4e80, lpOverlapped=0x0) returned 1
	[0179.668] WriteFile (in: hFile=0x4e4, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x4e90, lpOverlapped=0x0) returned 1
	[0179.669] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.670] WriteFile (in: hFile=0x4e4, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.670] SetEndOfFile (hFile=0x4e4) returned 1
	[0179.670] CloseHandle (hObject=0x4e4) returned 1
	[0179.670] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.670] SetEndOfFile (hFile=0x444) returned 1
	[0179.672] CloseHandle (hObject=0x444) returned 1
	[0179.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf")) returned 1
	[0179.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.673] lstrlenW (lpString=".doc") returned 4
	[0179.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.674] lstrlenW (lpString=".docx") returned 5
	[0179.674] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0179.674] lstrlenW (lpString=".pdf") returned 4
	[0179.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.674] lstrlenW (lpString=".xls") returned 4
	[0179.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.674] lstrlenW (lpString=".xlsx") returned 5
	[0179.674] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0179.674] lstrlenW (lpString=".ppt") returned 4
	[0179.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.674] lstrlenW (lpString=".zip") returned 4
	[0179.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.674] lstrlenW (lpString=".rar") returned 4
	[0179.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.674] lstrlenW (lpString=".bz2") returned 4
	[0179.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.674] lstrlenW (lpString=".7z") returned 3
	[0179.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.674] lstrlenW (lpString=".dbf") returned 4
	[0179.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.674] lstrlenW (lpString=".1cd") returned 4
	[0179.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.674] lstrlenW (lpString=".jpg") returned 4
	[0179.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.674] lstrlenW (lpString=".doc") returned 4
	[0179.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.675] lstrlenW (lpString=".docx") returned 5
	[0179.675] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0179.675] lstrlenW (lpString=".pdf") returned 4
	[0179.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.675] lstrlenW (lpString=".xls") returned 4
	[0179.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.675] lstrlenW (lpString=".xlsx") returned 5
	[0179.675] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0179.675] lstrlenW (lpString=".ppt") returned 4
	[0179.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.675] lstrlenW (lpString=".zip") returned 4
	[0179.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.675] lstrlenW (lpString=".rar") returned 4
	[0179.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.675] lstrlenW (lpString=".bz2") returned 4
	[0179.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.675] lstrlenW (lpString=".7z") returned 3
	[0179.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.675] lstrlenW (lpString=".dbf") returned 4
	[0179.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.675] lstrlenW (lpString=".1cd") returned 4
	[0179.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68
	[0179.675] lstrlenW (lpString=".jpg") returned 4
	[0179.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.676] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.676] lstrlenW (lpString="J0153305.WMF") returned 12
	[0179.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0179.676] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=38488) returned 1
	[0179.676] CloseHandle (hObject=0x444) returned 1
	[0179.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 0x220
	[0179.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0179.677] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.677] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.677] GetLastError () returned 0x0
	[0179.677] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x9658, lpOverlapped=0x0) returned 1
	[0179.692] WriteFile (in: hFile=0x4e4, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x9660, lpOverlapped=0x0) returned 1
	[0179.693] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.693] WriteFile (in: hFile=0x4e4, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.693] SetEndOfFile (hFile=0x4e4) returned 1
	[0179.693] CloseHandle (hObject=0x4e4) returned 1
	[0179.694] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.694] SetEndOfFile (hFile=0x444) returned 1
	[0179.699] CloseHandle (hObject=0x444) returned 1
	[0179.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 1
	[0179.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.704] lstrlenW (lpString=".doc") returned 4
	[0179.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.704] lstrlenW (lpString=".docx") returned 5
	[0179.704] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0179.704] lstrlenW (lpString=".pdf") returned 4
	[0179.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.705] lstrlenW (lpString=".xls") returned 4
	[0179.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.705] lstrlenW (lpString=".xlsx") returned 5
	[0179.705] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0179.705] lstrlenW (lpString=".ppt") returned 4
	[0179.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.705] lstrlenW (lpString=".zip") returned 4
	[0179.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.705] lstrlenW (lpString=".rar") returned 4
	[0179.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.705] lstrlenW (lpString=".bz2") returned 4
	[0179.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.705] lstrlenW (lpString=".7z") returned 3
	[0179.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.705] lstrlenW (lpString=".dbf") returned 4
	[0179.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.705] lstrlenW (lpString=".1cd") returned 4
	[0179.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.705] lstrlenW (lpString=".jpg") returned 4
	[0179.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.705] lstrlenW (lpString=".doc") returned 4
	[0179.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.705] lstrlenW (lpString=".docx") returned 5
	[0179.705] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0179.705] lstrlenW (lpString=".pdf") returned 4
	[0179.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.706] lstrlenW (lpString=".xls") returned 4
	[0179.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.706] lstrlenW (lpString=".xlsx") returned 5
	[0179.706] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0179.706] lstrlenW (lpString=".ppt") returned 4
	[0179.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.706] lstrlenW (lpString=".zip") returned 4
	[0179.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.706] lstrlenW (lpString=".rar") returned 4
	[0179.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.706] lstrlenW (lpString=".bz2") returned 4
	[0179.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.706] lstrlenW (lpString=".7z") returned 3
	[0179.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.706] lstrlenW (lpString=".dbf") returned 4
	[0179.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.706] lstrlenW (lpString=".1cd") returned 4
	[0179.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68
	[0179.706] lstrlenW (lpString=".jpg") returned 4
	[0179.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.706] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.706] lstrlenW (lpString="J0153313.WMF") returned 12
	[0179.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0179.926] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=16952) returned 1
	[0179.926] CloseHandle (hObject=0x4b8) returned 1
	[0179.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 0x220
	[0179.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0179.926] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.926] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0179.927] GetLastError () returned 0x0
	[0179.927] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x4238, lpOverlapped=0x0) returned 1
	[0179.929] WriteFile (in: hFile=0x534, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x4240, lpOverlapped=0x0) returned 1
	[0179.930] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.930] WriteFile (in: hFile=0x534, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.930] SetEndOfFile (hFile=0x534) returned 1
	[0179.930] CloseHandle (hObject=0x534) returned 1
	[0179.930] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.931] SetEndOfFile (hFile=0x4b8) returned 1
	[0179.943] CloseHandle (hObject=0x4b8) returned 1
	[0179.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 1
	[0179.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0179.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0179.944] lstrlenW (lpString=".doc") returned 4
	[0179.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.944] lstrlenW (lpString=".docx") returned 5
	[0179.944] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0179.944] lstrlenW (lpString=".pdf") returned 4
	[0179.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.944] lstrlenW (lpString=".xls") returned 4
	[0179.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.944] lstrlenW (lpString=".xlsx") returned 5
	[0179.944] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0179.944] lstrlenW (lpString=".ppt") returned 4
	[0179.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0179.944] lstrlenW (lpString=".zip") returned 4
	[0179.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.944] lstrlenW (lpString=".rar") returned 4
	[0179.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.944] lstrlenW (lpString=".bz2") returned 4
	[0179.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.944] lstrlenW (lpString=".7z") returned 3
	[0179.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0179.944] lstrlenW (lpString=".dbf") returned 4
	[0179.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0179.945] lstrlenW (lpString=".1cd") returned 4
	[0179.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0179.945] lstrlenW (lpString=".jpg") returned 4
	[0179.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0179.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0179.945] lstrlenW (lpString=".doc") returned 4
	[0179.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.945] lstrlenW (lpString=".docx") returned 5
	[0179.945] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0179.945] lstrlenW (lpString=".pdf") returned 4
	[0179.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.945] lstrlenW (lpString=".xls") returned 4
	[0179.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.945] lstrlenW (lpString=".xlsx") returned 5
	[0179.945] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0179.945] lstrlenW (lpString=".ppt") returned 4
	[0179.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0179.945] lstrlenW (lpString=".zip") returned 4
	[0179.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.945] lstrlenW (lpString=".rar") returned 4
	[0179.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.945] lstrlenW (lpString=".bz2") returned 4
	[0179.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.945] lstrlenW (lpString=".7z") returned 3
	[0179.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0180.352] lstrlenW (lpString=".dbf") returned 4
	[0180.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0180.361] lstrlenW (lpString=".1cd") returned 4
	[0180.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68
	[0180.361] lstrlenW (lpString=".jpg") returned 4
	[0180.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.362] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0180.362] lstrlenW (lpString="J0168644.WMF") returned 12
	[0180.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0180.693] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=20906) returned 1
	[0180.693] CloseHandle (hObject=0x4e0) returned 1
	[0180.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 0x220
	[0180.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0180.696] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.696] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0180.697] GetLastError () returned 0x0
	[0180.697] ReadFile (in: hFile=0x4e0, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x51aa, lpOverlapped=0x0) returned 1
	[0180.699] WriteFile (in: hFile=0x534, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x51b0, lpOverlapped=0x0) returned 1
	[0180.701] ReadFile (in: hFile=0x4e0, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.701] WriteFile (in: hFile=0x534, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.701] SetEndOfFile (hFile=0x534) returned 1
	[0180.701] CloseHandle (hObject=0x534) returned 1
	[0180.701] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.701] SetEndOfFile (hFile=0x4e0) returned 1
	[0180.704] CloseHandle (hObject=0x4e0) returned 1
	[0180.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 1
	[0180.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.705] lstrlenW (lpString=".doc") returned 4
	[0180.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.705] lstrlenW (lpString=".docx") returned 5
	[0180.705] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0180.705] lstrlenW (lpString=".pdf") returned 4
	[0180.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.705] lstrlenW (lpString=".xls") returned 4
	[0180.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.705] lstrlenW (lpString=".xlsx") returned 5
	[0180.705] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0180.705] lstrlenW (lpString=".ppt") returned 4
	[0180.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.705] lstrlenW (lpString=".zip") returned 4
	[0180.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.705] lstrlenW (lpString=".rar") returned 4
	[0180.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.705] lstrlenW (lpString=".bz2") returned 4
	[0180.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.705] lstrlenW (lpString=".7z") returned 3
	[0180.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.705] lstrlenW (lpString=".dbf") returned 4
	[0180.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.706] lstrlenW (lpString=".1cd") returned 4
	[0180.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.706] lstrlenW (lpString=".jpg") returned 4
	[0180.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.706] lstrlenW (lpString=".doc") returned 4
	[0180.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.706] lstrlenW (lpString=".docx") returned 5
	[0180.706] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0180.706] lstrlenW (lpString=".pdf") returned 4
	[0180.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.706] lstrlenW (lpString=".xls") returned 4
	[0180.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.706] lstrlenW (lpString=".xlsx") returned 5
	[0180.706] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0180.706] lstrlenW (lpString=".ppt") returned 4
	[0180.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.706] lstrlenW (lpString=".zip") returned 4
	[0180.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.706] lstrlenW (lpString=".rar") returned 4
	[0180.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.706] lstrlenW (lpString=".bz2") returned 4
	[0180.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.706] lstrlenW (lpString=".7z") returned 3
	[0180.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.707] lstrlenW (lpString=".dbf") returned 4
	[0180.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.707] lstrlenW (lpString=".1cd") returned 4
	[0180.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68
	[0180.707] lstrlenW (lpString=".jpg") returned 4
	[0180.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.707] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0180.707] lstrlenW (lpString="J0171685.WMF") returned 12
	[0180.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0180.708] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=14472) returned 1
	[0180.708] CloseHandle (hObject=0x4e0) returned 1
	[0180.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf")) returned 0x220
	[0180.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0180.709] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.709] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0180.710] GetLastError () returned 0x0
	[0180.710] ReadFile (in: hFile=0x4e0, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x3888, lpOverlapped=0x0) returned 1
	[0180.712] WriteFile (in: hFile=0x534, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x3890, lpOverlapped=0x0) returned 1
	[0180.713] ReadFile (in: hFile=0x4e0, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.713] WriteFile (in: hFile=0x534, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.713] SetEndOfFile (hFile=0x534) returned 1
	[0180.713] CloseHandle (hObject=0x534) returned 1
	[0180.713] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.713] SetEndOfFile (hFile=0x4e0) returned 1
	[0180.716] CloseHandle (hObject=0x4e0) returned 1
	[0180.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf")) returned 1
	[0180.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.717] lstrlenW (lpString=".doc") returned 4
	[0180.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.717] lstrlenW (lpString=".docx") returned 5
	[0180.717] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0180.717] lstrlenW (lpString=".pdf") returned 4
	[0180.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.717] lstrlenW (lpString=".xls") returned 4
	[0180.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.717] lstrlenW (lpString=".xlsx") returned 5
	[0180.717] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0180.717] lstrlenW (lpString=".ppt") returned 4
	[0180.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.717] lstrlenW (lpString=".zip") returned 4
	[0180.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.717] lstrlenW (lpString=".rar") returned 4
	[0180.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.717] lstrlenW (lpString=".bz2") returned 4
	[0180.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.717] lstrlenW (lpString=".7z") returned 3
	[0180.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.717] lstrlenW (lpString=".dbf") returned 4
	[0180.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.717] lstrlenW (lpString=".1cd") returned 4
	[0180.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.718] lstrlenW (lpString=".jpg") returned 4
	[0180.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.718] lstrlenW (lpString=".doc") returned 4
	[0180.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.718] lstrlenW (lpString=".docx") returned 5
	[0180.718] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0180.718] lstrlenW (lpString=".pdf") returned 4
	[0180.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.718] lstrlenW (lpString=".xls") returned 4
	[0180.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.718] lstrlenW (lpString=".xlsx") returned 5
	[0180.718] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0180.718] lstrlenW (lpString=".ppt") returned 4
	[0180.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.718] lstrlenW (lpString=".zip") returned 4
	[0180.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.718] lstrlenW (lpString=".rar") returned 4
	[0180.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.718] lstrlenW (lpString=".bz2") returned 4
	[0180.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.718] lstrlenW (lpString=".7z") returned 3
	[0180.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.718] lstrlenW (lpString=".dbf") returned 4
	[0180.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.718] lstrlenW (lpString=".1cd") returned 4
	[0180.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68
	[0180.719] lstrlenW (lpString=".jpg") returned 4
	[0180.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.719] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0180.719] lstrlenW (lpString="J0171847.WMF") returned 12
	[0180.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0180.720] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=6888) returned 1
	[0180.720] CloseHandle (hObject=0x4e0) returned 1
	[0180.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 0x220
	[0180.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0180.721] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.721] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0180.724] GetLastError () returned 0x0
	[0180.724] ReadFile (in: hFile=0x4e0, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1ae8, lpOverlapped=0x0) returned 1
	[0180.725] WriteFile (in: hFile=0x534, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1af0, lpOverlapped=0x0) returned 1
	[0180.726] ReadFile (in: hFile=0x4e0, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.726] WriteFile (in: hFile=0x534, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.726] SetEndOfFile (hFile=0x534) returned 1
	[0180.727] CloseHandle (hObject=0x534) returned 1
	[0180.727] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.727] SetEndOfFile (hFile=0x4e0) returned 1
	[0180.839] CloseHandle (hObject=0x4e0) returned 1
	[0180.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0181.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 1
	[0181.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.587] lstrlenW (lpString=".doc") returned 4
	[0181.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.587] lstrlenW (lpString=".docx") returned 5
	[0181.587] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0181.587] lstrlenW (lpString=".pdf") returned 4
	[0181.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.587] lstrlenW (lpString=".xls") returned 4
	[0181.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.587] lstrlenW (lpString=".xlsx") returned 5
	[0181.587] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0181.587] lstrlenW (lpString=".ppt") returned 4
	[0181.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.587] lstrlenW (lpString=".zip") returned 4
	[0181.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.588] lstrlenW (lpString=".rar") returned 4
	[0181.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.588] lstrlenW (lpString=".bz2") returned 4
	[0181.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.588] lstrlenW (lpString=".7z") returned 3
	[0181.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.588] lstrlenW (lpString=".dbf") returned 4
	[0181.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.588] lstrlenW (lpString=".1cd") returned 4
	[0181.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.588] lstrlenW (lpString=".jpg") returned 4
	[0181.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.588] lstrlenW (lpString=".doc") returned 4
	[0181.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.588] lstrlenW (lpString=".docx") returned 5
	[0181.588] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0181.588] lstrlenW (lpString=".pdf") returned 4
	[0181.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.588] lstrlenW (lpString=".xls") returned 4
	[0181.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.588] lstrlenW (lpString=".xlsx") returned 5
	[0181.588] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0181.588] lstrlenW (lpString=".ppt") returned 4
	[0181.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.589] lstrlenW (lpString=".zip") returned 4
	[0181.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.589] lstrlenW (lpString=".rar") returned 4
	[0181.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.589] lstrlenW (lpString=".bz2") returned 4
	[0181.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.589] lstrlenW (lpString=".7z") returned 3
	[0181.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.589] lstrlenW (lpString=".dbf") returned 4
	[0181.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.589] lstrlenW (lpString=".1cd") returned 4
	[0181.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68
	[0181.589] lstrlenW (lpString=".jpg") returned 4
	[0181.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.589] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0181.589] lstrlenW (lpString="J0174639.WMF") returned 12
	[0181.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.217] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=5100) returned 1
	[0182.217] CloseHandle (hObject=0x4bc) returned 1
	[0182.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 0x220
	[0182.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.219] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.219] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0182.220] GetLastError () returned 0x0
	[0182.220] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x13ec, lpOverlapped=0x0) returned 1
	[0182.222] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x13f0, lpOverlapped=0x0) returned 1
	[0182.223] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.223] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.223] SetEndOfFile (hFile=0x4b8) returned 1
	[0182.223] CloseHandle (hObject=0x4b8) returned 1
	[0182.223] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.223] SetEndOfFile (hFile=0x4bc) returned 1
	[0182.226] CloseHandle (hObject=0x4bc) returned 1
	[0182.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 1
	[0182.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.227] lstrlenW (lpString=".doc") returned 4
	[0182.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.227] lstrlenW (lpString=".docx") returned 5
	[0182.227] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0182.227] lstrlenW (lpString=".pdf") returned 4
	[0182.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.227] lstrlenW (lpString=".xls") returned 4
	[0182.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.228] lstrlenW (lpString=".xlsx") returned 5
	[0182.228] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0182.228] lstrlenW (lpString=".ppt") returned 4
	[0182.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.228] lstrlenW (lpString=".zip") returned 4
	[0182.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.228] lstrlenW (lpString=".rar") returned 4
	[0182.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.228] lstrlenW (lpString=".bz2") returned 4
	[0182.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.228] lstrlenW (lpString=".7z") returned 3
	[0182.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.228] lstrlenW (lpString=".dbf") returned 4
	[0182.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.228] lstrlenW (lpString=".1cd") returned 4
	[0182.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.228] lstrlenW (lpString=".jpg") returned 4
	[0182.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.228] lstrlenW (lpString=".doc") returned 4
	[0182.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.228] lstrlenW (lpString=".docx") returned 5
	[0182.228] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0182.228] lstrlenW (lpString=".pdf") returned 4
	[0182.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.228] lstrlenW (lpString=".xls") returned 4
	[0182.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.229] lstrlenW (lpString=".xlsx") returned 5
	[0182.229] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0182.229] lstrlenW (lpString=".ppt") returned 4
	[0182.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.229] lstrlenW (lpString=".zip") returned 4
	[0182.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.229] lstrlenW (lpString=".rar") returned 4
	[0182.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.229] lstrlenW (lpString=".bz2") returned 4
	[0182.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.229] lstrlenW (lpString=".7z") returned 3
	[0182.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.229] lstrlenW (lpString=".dbf") returned 4
	[0182.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.229] lstrlenW (lpString=".1cd") returned 4
	[0182.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68
	[0182.229] lstrlenW (lpString=".jpg") returned 4
	[0182.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.229] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.229] lstrlenW (lpString="J0175428.JPG") returned 12
	[0182.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.231] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=14552) returned 1
	[0182.231] CloseHandle (hObject=0x4bc) returned 1
	[0182.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 0x220
	[0182.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.231] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.231] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0182.232] GetLastError () returned 0x0
	[0182.232] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x38d8, lpOverlapped=0x0) returned 1
	[0182.234] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x38e0, lpOverlapped=0x0) returned 1
	[0182.235] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.235] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.235] SetEndOfFile (hFile=0x4b8) returned 1
	[0182.235] CloseHandle (hObject=0x4b8) returned 1
	[0182.235] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.235] SetEndOfFile (hFile=0x4bc) returned 1
	[0182.238] CloseHandle (hObject=0x4bc) returned 1
	[0182.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 1
	[0182.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.239] lstrlenW (lpString=".doc") returned 4
	[0182.239] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.239] lstrlenW (lpString=".docx") returned 5
	[0182.239] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0182.239] lstrlenW (lpString=".pdf") returned 4
	[0182.239] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.239] lstrlenW (lpString=".xls") returned 4
	[0182.239] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.239] lstrlenW (lpString=".xlsx") returned 5
	[0182.240] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0182.240] lstrlenW (lpString=".ppt") returned 4
	[0182.240] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.240] lstrlenW (lpString=".zip") returned 4
	[0182.240] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.240] lstrlenW (lpString=".rar") returned 4
	[0182.240] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.240] lstrlenW (lpString=".bz2") returned 4
	[0182.240] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.240] lstrlenW (lpString=".7z") returned 3
	[0182.240] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.240] lstrlenW (lpString=".dbf") returned 4
	[0182.240] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.240] lstrlenW (lpString=".1cd") returned 4
	[0182.240] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.240] lstrlenW (lpString=".jpg") returned 4
	[0182.240] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.240] lstrlenW (lpString=".doc") returned 4
	[0182.240] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.240] lstrlenW (lpString=".docx") returned 5
	[0182.240] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0182.240] lstrlenW (lpString=".pdf") returned 4
	[0182.240] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.240] lstrlenW (lpString=".xls") returned 4
	[0182.240] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.241] lstrlenW (lpString=".xlsx") returned 5
	[0182.241] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0182.241] lstrlenW (lpString=".ppt") returned 4
	[0182.241] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.241] lstrlenW (lpString=".zip") returned 4
	[0182.241] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.241] lstrlenW (lpString=".rar") returned 4
	[0182.241] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.241] lstrlenW (lpString=".bz2") returned 4
	[0182.241] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.241] lstrlenW (lpString=".7z") returned 3
	[0182.241] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.241] lstrlenW (lpString=".dbf") returned 4
	[0182.241] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.241] lstrlenW (lpString=".1cd") returned 4
	[0182.241] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68
	[0182.241] lstrlenW (lpString=".jpg") returned 4
	[0182.241] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.241] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.241] lstrlenW (lpString="J0177257.JPG") returned 12
	[0182.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.242] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=45358) returned 1
	[0182.242] CloseHandle (hObject=0x4bc) returned 1
	[0182.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 0x220
	[0182.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.254] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.255] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0182.255] GetLastError () returned 0x0
	[0182.255] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xb12e, lpOverlapped=0x0) returned 1
	[0182.494] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xb130, lpOverlapped=0x0) returned 1
	[0182.496] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.496] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.496] SetEndOfFile (hFile=0x4b8) returned 1
	[0182.496] CloseHandle (hObject=0x4b8) returned 1
	[0182.496] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.496] SetEndOfFile (hFile=0x4bc) returned 1
	[0182.500] CloseHandle (hObject=0x4bc) returned 1
	[0182.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 1
	[0182.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.757] lstrlenW (lpString=".doc") returned 4
	[0182.757] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.757] lstrlenW (lpString=".docx") returned 5
	[0182.757] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0182.757] lstrlenW (lpString=".pdf") returned 4
	[0182.757] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.757] lstrlenW (lpString=".xls") returned 4
	[0182.757] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.757] lstrlenW (lpString=".xlsx") returned 5
	[0182.758] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0182.758] lstrlenW (lpString=".ppt") returned 4
	[0182.758] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.758] lstrlenW (lpString=".zip") returned 4
	[0182.758] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.758] lstrlenW (lpString=".rar") returned 4
	[0182.758] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.758] lstrlenW (lpString=".bz2") returned 4
	[0182.758] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.758] lstrlenW (lpString=".7z") returned 3
	[0182.758] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.758] lstrlenW (lpString=".dbf") returned 4
	[0182.758] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.758] lstrlenW (lpString=".1cd") returned 4
	[0182.758] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.758] lstrlenW (lpString=".jpg") returned 4
	[0182.758] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.758] lstrlenW (lpString=".doc") returned 4
	[0182.758] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.758] lstrlenW (lpString=".docx") returned 5
	[0182.758] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0182.758] lstrlenW (lpString=".pdf") returned 4
	[0182.758] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.758] lstrlenW (lpString=".xls") returned 4
	[0182.758] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.759] lstrlenW (lpString=".xlsx") returned 5
	[0182.759] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0182.759] lstrlenW (lpString=".ppt") returned 4
	[0182.759] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.759] lstrlenW (lpString=".zip") returned 4
	[0182.759] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.759] lstrlenW (lpString=".rar") returned 4
	[0182.759] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.759] lstrlenW (lpString=".bz2") returned 4
	[0182.759] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.759] lstrlenW (lpString=".7z") returned 3
	[0182.759] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.759] lstrlenW (lpString=".dbf") returned 4
	[0182.759] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.759] lstrlenW (lpString=".1cd") returned 4
	[0182.759] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68
	[0182.759] lstrlenW (lpString=".jpg") returned 4
	[0182.759] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.759] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.759] lstrlenW (lpString="J0178459.JPG") returned 12
	[0182.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.761] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=29204) returned 1
	[0182.761] CloseHandle (hObject=0x534) returned 1
	[0182.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 0x220
	[0182.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.761] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.761] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.762] GetLastError () returned 0x0
	[0182.762] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x7214, lpOverlapped=0x0) returned 1
	[0182.764] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x7220, lpOverlapped=0x0) returned 1
	[0182.766] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.766] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.766] SetEndOfFile (hFile=0x4bc) returned 1
	[0182.766] CloseHandle (hObject=0x4bc) returned 1
	[0182.766] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.766] SetEndOfFile (hFile=0x534) returned 1
	[0182.769] CloseHandle (hObject=0x534) returned 1
	[0182.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 1
	[0182.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.770] lstrlenW (lpString=".doc") returned 4
	[0182.770] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.770] lstrlenW (lpString=".docx") returned 5
	[0182.770] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0182.770] lstrlenW (lpString=".pdf") returned 4
	[0182.770] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.770] lstrlenW (lpString=".xls") returned 4
	[0182.770] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.770] lstrlenW (lpString=".xlsx") returned 5
	[0182.770] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0182.770] lstrlenW (lpString=".ppt") returned 4
	[0182.771] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.771] lstrlenW (lpString=".zip") returned 4
	[0182.771] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.771] lstrlenW (lpString=".rar") returned 4
	[0182.771] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.771] lstrlenW (lpString=".bz2") returned 4
	[0182.771] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.771] lstrlenW (lpString=".7z") returned 3
	[0182.771] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.771] lstrlenW (lpString=".dbf") returned 4
	[0182.771] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.771] lstrlenW (lpString=".1cd") returned 4
	[0182.771] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.771] lstrlenW (lpString=".jpg") returned 4
	[0182.771] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.772] lstrlenW (lpString=".doc") returned 4
	[0182.772] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.772] lstrlenW (lpString=".docx") returned 5
	[0182.772] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0182.772] lstrlenW (lpString=".pdf") returned 4
	[0182.772] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.772] lstrlenW (lpString=".xls") returned 4
	[0182.772] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.772] lstrlenW (lpString=".xlsx") returned 5
	[0182.772] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0182.772] lstrlenW (lpString=".ppt") returned 4
	[0182.772] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.772] lstrlenW (lpString=".zip") returned 4
	[0182.772] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.772] lstrlenW (lpString=".rar") returned 4
	[0182.772] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.772] lstrlenW (lpString=".bz2") returned 4
	[0182.772] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.772] lstrlenW (lpString=".7z") returned 3
	[0182.772] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.772] lstrlenW (lpString=".dbf") returned 4
	[0182.772] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.773] lstrlenW (lpString=".1cd") returned 4
	[0182.773] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68
	[0182.773] lstrlenW (lpString=".jpg") returned 4
	[0182.773] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.773] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.773] lstrlenW (lpString="J0178460.JPG") returned 12
	[0182.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.774] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=26531) returned 1
	[0182.774] CloseHandle (hObject=0x534) returned 1
	[0182.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 0x220
	[0182.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.774] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.774] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.775] GetLastError () returned 0x0
	[0182.775] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x67a3, lpOverlapped=0x0) returned 1
	[0182.777] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0182.778] ReadFile (in: hFile=0x534, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.779] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.779] SetEndOfFile (hFile=0x4bc) returned 1
	[0182.779] CloseHandle (hObject=0x4bc) returned 1
	[0182.779] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.779] SetEndOfFile (hFile=0x534) returned 1
	[0182.782] CloseHandle (hObject=0x534) returned 1
	[0182.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 1
	[0182.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.783] lstrlenW (lpString=".doc") returned 4
	[0182.783] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.783] lstrlenW (lpString=".docx") returned 5
	[0182.783] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0182.783] lstrlenW (lpString=".pdf") returned 4
	[0182.784] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.784] lstrlenW (lpString=".xls") returned 4
	[0182.784] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.784] lstrlenW (lpString=".xlsx") returned 5
	[0182.784] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0182.784] lstrlenW (lpString=".ppt") returned 4
	[0182.784] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.784] lstrlenW (lpString=".zip") returned 4
	[0182.784] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.784] lstrlenW (lpString=".rar") returned 4
	[0182.784] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.784] lstrlenW (lpString=".bz2") returned 4
	[0182.784] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.784] lstrlenW (lpString=".7z") returned 3
	[0182.784] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.784] lstrlenW (lpString=".dbf") returned 4
	[0182.784] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.784] lstrlenW (lpString=".1cd") returned 4
	[0182.784] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.784] lstrlenW (lpString=".jpg") returned 4
	[0182.784] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.784] lstrlenW (lpString=".doc") returned 4
	[0182.784] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.784] lstrlenW (lpString=".docx") returned 5
	[0182.784] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0182.785] lstrlenW (lpString=".pdf") returned 4
	[0182.785] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.785] lstrlenW (lpString=".xls") returned 4
	[0182.785] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.785] lstrlenW (lpString=".xlsx") returned 5
	[0182.785] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0182.785] lstrlenW (lpString=".ppt") returned 4
	[0182.785] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.785] lstrlenW (lpString=".zip") returned 4
	[0182.785] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.785] lstrlenW (lpString=".rar") returned 4
	[0182.785] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.785] lstrlenW (lpString=".bz2") returned 4
	[0182.785] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.785] lstrlenW (lpString=".7z") returned 3
	[0182.785] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.785] lstrlenW (lpString=".dbf") returned 4
	[0182.785] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.785] lstrlenW (lpString=".1cd") returned 4
	[0182.785] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68
	[0182.785] lstrlenW (lpString=".jpg") returned 4
	[0182.785] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.785] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.786] lstrlenW (lpString="J0178523.JPG") returned 12
	[0182.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0182.787] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=24034) returned 1
	[0182.787] CloseHandle (hObject=0x4b8) returned 1
	[0182.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg")) returned 0x220
	[0182.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0182.787] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.788] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.788] GetLastError () returned 0x0
	[0182.788] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x5de2, lpOverlapped=0x0) returned 1
	[0182.997] WriteFile (in: hFile=0x534, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x5df0, lpOverlapped=0x0) returned 1
	[0182.999] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.999] WriteFile (in: hFile=0x534, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.999] SetEndOfFile (hFile=0x534) returned 1
	[0182.999] CloseHandle (hObject=0x534) returned 1
	[0182.999] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.999] SetEndOfFile (hFile=0x4b8) returned 1
	[0183.002] CloseHandle (hObject=0x4b8) returned 1
	[0183.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg")) returned 1
	[0184.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.847] lstrlenW (lpString=".doc") returned 4
	[0184.847] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.847] lstrlenW (lpString=".docx") returned 5
	[0184.847] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0184.847] lstrlenW (lpString=".pdf") returned 4
	[0184.847] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.847] lstrlenW (lpString=".xls") returned 4
	[0184.847] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.847] lstrlenW (lpString=".xlsx") returned 5
	[0184.847] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0184.847] lstrlenW (lpString=".ppt") returned 4
	[0184.847] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.847] lstrlenW (lpString=".zip") returned 4
	[0184.848] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.848] lstrlenW (lpString=".rar") returned 4
	[0184.848] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.848] lstrlenW (lpString=".bz2") returned 4
	[0184.848] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.848] lstrlenW (lpString=".7z") returned 3
	[0184.848] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.848] lstrlenW (lpString=".dbf") returned 4
	[0184.848] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.848] lstrlenW (lpString=".1cd") returned 4
	[0184.848] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.848] lstrlenW (lpString=".jpg") returned 4
	[0184.848] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.848] lstrlenW (lpString=".doc") returned 4
	[0184.848] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.848] lstrlenW (lpString=".docx") returned 5
	[0184.848] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0184.848] lstrlenW (lpString=".pdf") returned 4
	[0184.848] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.848] lstrlenW (lpString=".xls") returned 4
	[0184.848] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.848] lstrlenW (lpString=".xlsx") returned 5
	[0184.848] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0184.848] lstrlenW (lpString=".ppt") returned 4
	[0184.848] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.849] lstrlenW (lpString=".zip") returned 4
	[0184.849] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.849] lstrlenW (lpString=".rar") returned 4
	[0184.849] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.849] lstrlenW (lpString=".bz2") returned 4
	[0184.849] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.849] lstrlenW (lpString=".7z") returned 3
	[0184.849] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.849] lstrlenW (lpString=".dbf") returned 4
	[0184.849] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.849] lstrlenW (lpString=".1cd") returned 4
	[0184.849] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68
	[0184.849] lstrlenW (lpString=".jpg") returned 4
	[0184.849] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.849] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0184.849] lstrlenW (lpString="J0185796.WMF") returned 12
	[0184.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0184.851] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=25868) returned 1
	[0184.851] CloseHandle (hObject=0x444) returned 1
	[0184.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf")) returned 0x220
	[0184.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0184.852] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.852] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0184.853] GetLastError () returned 0x0
	[0184.853] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x650c, lpOverlapped=0x0) returned 1
	[0184.855] WriteFile (in: hFile=0x324, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x6510, lpOverlapped=0x0) returned 1
	[0184.857] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.857] WriteFile (in: hFile=0x324, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.857] SetEndOfFile (hFile=0x324) returned 1
	[0184.857] CloseHandle (hObject=0x324) returned 1
	[0184.857] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.857] SetEndOfFile (hFile=0x444) returned 1
	[0184.860] CloseHandle (hObject=0x444) returned 1
	[0184.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf")) returned 1
	[0184.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.861] lstrlenW (lpString=".doc") returned 4
	[0184.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.861] lstrlenW (lpString=".docx") returned 5
	[0184.862] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0184.862] lstrlenW (lpString=".pdf") returned 4
	[0184.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.862] lstrlenW (lpString=".xls") returned 4
	[0184.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.862] lstrlenW (lpString=".xlsx") returned 5
	[0184.862] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0184.862] lstrlenW (lpString=".ppt") returned 4
	[0184.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.862] lstrlenW (lpString=".zip") returned 4
	[0184.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.862] lstrlenW (lpString=".rar") returned 4
	[0184.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.862] lstrlenW (lpString=".bz2") returned 4
	[0184.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.862] lstrlenW (lpString=".7z") returned 3
	[0184.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.862] lstrlenW (lpString=".dbf") returned 4
	[0184.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.862] lstrlenW (lpString=".1cd") returned 4
	[0184.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.862] lstrlenW (lpString=".jpg") returned 4
	[0184.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.862] lstrlenW (lpString=".doc") returned 4
	[0184.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.863] lstrlenW (lpString=".docx") returned 5
	[0184.863] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0184.863] lstrlenW (lpString=".pdf") returned 4
	[0184.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.863] lstrlenW (lpString=".xls") returned 4
	[0184.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.863] lstrlenW (lpString=".xlsx") returned 5
	[0184.863] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0184.863] lstrlenW (lpString=".ppt") returned 4
	[0184.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.863] lstrlenW (lpString=".zip") returned 4
	[0184.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.863] lstrlenW (lpString=".rar") returned 4
	[0184.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.863] lstrlenW (lpString=".bz2") returned 4
	[0184.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.863] lstrlenW (lpString=".7z") returned 3
	[0184.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.863] lstrlenW (lpString=".dbf") returned 4
	[0184.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.863] lstrlenW (lpString=".1cd") returned 4
	[0184.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68
	[0184.863] lstrlenW (lpString=".jpg") returned 4
	[0184.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.864] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0184.864] lstrlenW (lpString="J0185798.WMF") returned 12
	[0184.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0184.865] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=33824) returned 1
	[0184.865] CloseHandle (hObject=0x444) returned 1
	[0184.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 0x220
	[0184.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0184.868] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.872] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0184.873] GetLastError () returned 0x0
	[0184.873] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x8420, lpOverlapped=0x0) returned 1
	[0184.987] WriteFile (in: hFile=0x538, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x8430, lpOverlapped=0x0) returned 1
	[0184.988] ReadFile (in: hFile=0x444, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.988] WriteFile (in: hFile=0x538, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.988] SetEndOfFile (hFile=0x538) returned 1
	[0184.988] CloseHandle (hObject=0x538) returned 1
	[0184.988] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.989] SetEndOfFile (hFile=0x444) returned 1
	[0184.991] CloseHandle (hObject=0x444) returned 1
	[0184.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 1
	[0184.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.993] lstrlenW (lpString=".doc") returned 4
	[0184.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.993] lstrlenW (lpString=".docx") returned 5
	[0184.993] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0184.993] lstrlenW (lpString=".pdf") returned 4
	[0184.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.993] lstrlenW (lpString=".xls") returned 4
	[0184.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.993] lstrlenW (lpString=".xlsx") returned 5
	[0184.993] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0184.993] lstrlenW (lpString=".ppt") returned 4
	[0184.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.993] lstrlenW (lpString=".zip") returned 4
	[0184.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.994] lstrlenW (lpString=".rar") returned 4
	[0184.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.994] lstrlenW (lpString=".bz2") returned 4
	[0184.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.994] lstrlenW (lpString=".7z") returned 3
	[0184.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.994] lstrlenW (lpString=".dbf") returned 4
	[0184.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.994] lstrlenW (lpString=".1cd") returned 4
	[0184.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.994] lstrlenW (lpString=".jpg") returned 4
	[0184.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.994] lstrlenW (lpString=".doc") returned 4
	[0184.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.994] lstrlenW (lpString=".docx") returned 5
	[0184.994] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0184.994] lstrlenW (lpString=".pdf") returned 4
	[0184.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.994] lstrlenW (lpString=".xls") returned 4
	[0184.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.994] lstrlenW (lpString=".xlsx") returned 5
	[0184.994] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0184.994] lstrlenW (lpString=".ppt") returned 4
	[0184.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.995] lstrlenW (lpString=".zip") returned 4
	[0184.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.995] lstrlenW (lpString=".rar") returned 4
	[0184.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.995] lstrlenW (lpString=".bz2") returned 4
	[0184.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.995] lstrlenW (lpString=".7z") returned 3
	[0184.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.995] lstrlenW (lpString=".dbf") returned 4
	[0184.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.995] lstrlenW (lpString=".1cd") returned 4
	[0184.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68
	[0184.995] lstrlenW (lpString=".jpg") returned 4
	[0184.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.995] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0184.995] lstrlenW (lpString="J0185800.WMF") returned 12
	[0184.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0185.095] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=24238) returned 1
	[0185.095] CloseHandle (hObject=0x444) returned 1
	[0185.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 0x220
	[0185.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.501] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.501] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0187.502] GetLastError () returned 0x0
	[0187.502] ReadFile (in: hFile=0x4e4, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x5eae, lpOverlapped=0x0) returned 1
	[0187.504] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x5eb0, lpOverlapped=0x0) returned 1
	[0187.505] ReadFile (in: hFile=0x4e4, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.505] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.505] SetEndOfFile (hFile=0x4b8) returned 1
	[0187.505] CloseHandle (hObject=0x4b8) returned 1
	[0187.505] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.505] SetEndOfFile (hFile=0x4e4) returned 1
	[0187.508] CloseHandle (hObject=0x4e4) returned 1
	[0187.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 1
	[0187.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.509] lstrlenW (lpString=".doc") returned 4
	[0187.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.509] lstrlenW (lpString=".docx") returned 5
	[0187.509] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0187.509] lstrlenW (lpString=".pdf") returned 4
	[0187.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.509] lstrlenW (lpString=".xls") returned 4
	[0187.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.509] lstrlenW (lpString=".xlsx") returned 5
	[0187.509] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0187.509] lstrlenW (lpString=".ppt") returned 4
	[0187.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.510] lstrlenW (lpString=".zip") returned 4
	[0187.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.510] lstrlenW (lpString=".rar") returned 4
	[0187.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.510] lstrlenW (lpString=".bz2") returned 4
	[0187.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.510] lstrlenW (lpString=".7z") returned 3
	[0187.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.510] lstrlenW (lpString=".dbf") returned 4
	[0187.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.510] lstrlenW (lpString=".1cd") returned 4
	[0187.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.510] lstrlenW (lpString=".jpg") returned 4
	[0187.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.510] lstrlenW (lpString=".doc") returned 4
	[0187.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.510] lstrlenW (lpString=".docx") returned 5
	[0187.510] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0187.510] lstrlenW (lpString=".pdf") returned 4
	[0187.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.510] lstrlenW (lpString=".xls") returned 4
	[0187.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.510] lstrlenW (lpString=".xlsx") returned 5
	[0187.510] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0187.511] lstrlenW (lpString=".ppt") returned 4
	[0187.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.511] lstrlenW (lpString=".zip") returned 4
	[0187.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.511] lstrlenW (lpString=".rar") returned 4
	[0187.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.511] lstrlenW (lpString=".bz2") returned 4
	[0187.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.511] lstrlenW (lpString=".7z") returned 3
	[0187.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.511] lstrlenW (lpString=".dbf") returned 4
	[0187.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.511] lstrlenW (lpString=".1cd") returned 4
	[0187.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68
	[0187.511] lstrlenW (lpString=".jpg") returned 4
	[0187.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.511] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.511] lstrlenW (lpString="J0187847.WMF") returned 12
	[0187.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.512] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=7116) returned 1
	[0187.512] CloseHandle (hObject=0x4e4) returned 1
	[0187.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 0x220
	[0187.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.513] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.513] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0187.514] GetLastError () returned 0x0
	[0187.514] ReadFile (in: hFile=0x4e4, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1bcc, lpOverlapped=0x0) returned 1
	[0187.515] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1bd0, lpOverlapped=0x0) returned 1
	[0187.516] ReadFile (in: hFile=0x4e4, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.516] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.516] SetEndOfFile (hFile=0x4b8) returned 1
	[0187.516] CloseHandle (hObject=0x4b8) returned 1
	[0187.517] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.517] SetEndOfFile (hFile=0x4e4) returned 1
	[0187.519] CloseHandle (hObject=0x4e4) returned 1
	[0187.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 1
	[0187.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.520] lstrlenW (lpString=".doc") returned 4
	[0187.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.520] lstrlenW (lpString=".docx") returned 5
	[0187.520] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0187.520] lstrlenW (lpString=".pdf") returned 4
	[0187.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.520] lstrlenW (lpString=".xls") returned 4
	[0187.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.520] lstrlenW (lpString=".xlsx") returned 5
	[0187.520] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0187.520] lstrlenW (lpString=".ppt") returned 4
	[0187.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.521] lstrlenW (lpString=".zip") returned 4
	[0187.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.521] lstrlenW (lpString=".rar") returned 4
	[0187.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.521] lstrlenW (lpString=".bz2") returned 4
	[0187.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.521] lstrlenW (lpString=".7z") returned 3
	[0187.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.521] lstrlenW (lpString=".dbf") returned 4
	[0187.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.521] lstrlenW (lpString=".1cd") returned 4
	[0187.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.521] lstrlenW (lpString=".jpg") returned 4
	[0187.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.521] lstrlenW (lpString=".doc") returned 4
	[0187.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.521] lstrlenW (lpString=".docx") returned 5
	[0187.521] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0187.521] lstrlenW (lpString=".pdf") returned 4
	[0187.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.521] lstrlenW (lpString=".xls") returned 4
	[0187.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.521] lstrlenW (lpString=".xlsx") returned 5
	[0187.521] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0187.521] lstrlenW (lpString=".ppt") returned 4
	[0187.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.522] lstrlenW (lpString=".zip") returned 4
	[0187.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.522] lstrlenW (lpString=".rar") returned 4
	[0187.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.522] lstrlenW (lpString=".bz2") returned 4
	[0187.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.522] lstrlenW (lpString=".7z") returned 3
	[0187.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.522] lstrlenW (lpString=".dbf") returned 4
	[0187.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.522] lstrlenW (lpString=".1cd") returned 4
	[0187.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68
	[0187.522] lstrlenW (lpString=".jpg") returned 4
	[0187.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.522] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.522] lstrlenW (lpString="J0187849.WMF") returned 12
	[0187.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.524] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=7572) returned 1
	[0187.524] CloseHandle (hObject=0x4e4) returned 1
	[0187.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 0x220
	[0187.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.524] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.524] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0187.525] GetLastError () returned 0x0
	[0187.525] ReadFile (in: hFile=0x4e4, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x1d94, lpOverlapped=0x0) returned 1
	[0187.526] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x1da0, lpOverlapped=0x0) returned 1
	[0187.527] ReadFile (in: hFile=0x4e4, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.527] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.528] SetEndOfFile (hFile=0x4b8) returned 1
	[0187.528] CloseHandle (hObject=0x4b8) returned 1
	[0187.528] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.528] SetEndOfFile (hFile=0x4e4) returned 1
	[0187.530] CloseHandle (hObject=0x4e4) returned 1
	[0187.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 1
	[0187.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.532] lstrlenW (lpString=".doc") returned 4
	[0187.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.532] lstrlenW (lpString=".docx") returned 5
	[0187.532] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0187.532] lstrlenW (lpString=".pdf") returned 4
	[0187.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.532] lstrlenW (lpString=".xls") returned 4
	[0187.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.532] lstrlenW (lpString=".xlsx") returned 5
	[0187.532] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0187.532] lstrlenW (lpString=".ppt") returned 4
	[0187.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.532] lstrlenW (lpString=".zip") returned 4
	[0187.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.532] lstrlenW (lpString=".rar") returned 4
	[0187.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.532] lstrlenW (lpString=".bz2") returned 4
	[0187.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.532] lstrlenW (lpString=".7z") returned 3
	[0187.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.533] lstrlenW (lpString=".dbf") returned 4
	[0187.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.533] lstrlenW (lpString=".1cd") returned 4
	[0187.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.533] lstrlenW (lpString=".jpg") returned 4
	[0187.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.533] lstrlenW (lpString=".doc") returned 4
	[0187.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.533] lstrlenW (lpString=".docx") returned 5
	[0187.533] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0187.533] lstrlenW (lpString=".pdf") returned 4
	[0187.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.533] lstrlenW (lpString=".xls") returned 4
	[0187.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.533] lstrlenW (lpString=".xlsx") returned 5
	[0187.533] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0187.533] lstrlenW (lpString=".ppt") returned 4
	[0187.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.533] lstrlenW (lpString=".zip") returned 4
	[0187.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.533] lstrlenW (lpString=".rar") returned 4
	[0187.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.533] lstrlenW (lpString=".bz2") returned 4
	[0187.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.534] lstrlenW (lpString=".7z") returned 3
	[0187.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.534] lstrlenW (lpString=".dbf") returned 4
	[0187.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.534] lstrlenW (lpString=".1cd") returned 4
	[0187.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68
	[0187.534] lstrlenW (lpString=".jpg") returned 4
	[0187.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.534] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.534] lstrlenW (lpString="J0187851.WMF") returned 12
	[0187.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.535] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=8732) returned 1
	[0187.535] CloseHandle (hObject=0x4e4) returned 1
	[0187.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 0x220
	[0187.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.535] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.536] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0187.536] GetLastError () returned 0x0
	[0187.536] ReadFile (in: hFile=0x4e4, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x221c, lpOverlapped=0x0) returned 1
	[0187.875] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0x2220, lpOverlapped=0x0) returned 1
	[0187.876] ReadFile (in: hFile=0x4e4, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.877] WriteFile (in: hFile=0x4b8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.877] SetEndOfFile (hFile=0x4b8) returned 1
	[0187.877] CloseHandle (hObject=0x4b8) returned 1
	[0187.877] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.877] SetEndOfFile (hFile=0x4e4) returned 1
	[0187.879] CloseHandle (hObject=0x4e4) returned 1
	[0187.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 1
	[0187.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.881] lstrlenW (lpString=".doc") returned 4
	[0187.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.881] lstrlenW (lpString=".docx") returned 5
	[0187.881] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0187.881] lstrlenW (lpString=".pdf") returned 4
	[0187.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.881] lstrlenW (lpString=".xls") returned 4
	[0187.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.881] lstrlenW (lpString=".xlsx") returned 5
	[0187.881] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0187.881] lstrlenW (lpString=".ppt") returned 4
	[0187.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.881] lstrlenW (lpString=".zip") returned 4
	[0187.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.881] lstrlenW (lpString=".rar") returned 4
	[0187.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.881] lstrlenW (lpString=".bz2") returned 4
	[0187.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.881] lstrlenW (lpString=".7z") returned 3
	[0187.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.881] lstrlenW (lpString=".dbf") returned 4
	[0187.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.881] lstrlenW (lpString=".1cd") returned 4
	[0187.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.882] lstrlenW (lpString=".jpg") returned 4
	[0187.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.882] lstrlenW (lpString=".doc") returned 4
	[0187.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.882] lstrlenW (lpString=".docx") returned 5
	[0187.882] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0187.882] lstrlenW (lpString=".pdf") returned 4
	[0187.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.882] lstrlenW (lpString=".xls") returned 4
	[0187.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.882] lstrlenW (lpString=".xlsx") returned 5
	[0187.882] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0187.882] lstrlenW (lpString=".ppt") returned 4
	[0187.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.882] lstrlenW (lpString=".zip") returned 4
	[0187.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.882] lstrlenW (lpString=".rar") returned 4
	[0187.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.882] lstrlenW (lpString=".bz2") returned 4
	[0187.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.882] lstrlenW (lpString=".7z") returned 3
	[0187.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.882] lstrlenW (lpString=".dbf") returned 4
	[0187.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.883] lstrlenW (lpString=".1cd") returned 4
	[0187.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68
	[0187.883] lstrlenW (lpString=".jpg") returned 4
	[0187.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.883] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.883] lstrlenW (lpString="J0187895.WMF") returned 12
	[0187.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0188.160] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x31dff14 | out: lpFileSize=0x31dff14*=3472) returned 1
	[0188.160] CloseHandle (hObject=0x558) returned 1
	[0188.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 0x220
	[0188.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0188.161] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.161] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0188.163] GetLastError () returned 0x0
	[0188.163] ReadFile (in: hFile=0x558, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0xd90, lpOverlapped=0x0) returned 1
	[0188.164] WriteFile (in: hFile=0x3e8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xda0, lpOverlapped=0x0) returned 1
	[0188.165] ReadFile (in: hFile=0x558, lpBuffer=0x3bee020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesRead=0x31dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.165] WriteFile (in: hFile=0x3e8, lpBuffer=0x3bee020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3bee020*, lpNumberOfBytesWritten=0x31dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.165] SetEndOfFile (hFile=0x3e8) returned 1
	[0188.165] CloseHandle (hObject=0x3e8) returned 1
	[0188.166] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.166] SetEndOfFile (hFile=0x558) returned 1
	[0188.168] CloseHandle (hObject=0x558) returned 1
	[0188.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 1
	[0188.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.197] lstrlenW (lpString=".doc") returned 4
	[0188.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0188.197] lstrlenW (lpString=".docx") returned 5
	[0188.197] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0188.197] lstrlenW (lpString=".pdf") returned 4
	[0188.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0188.197] lstrlenW (lpString=".xls") returned 4
	[0188.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0188.197] lstrlenW (lpString=".xlsx") returned 5
	[0188.197] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0188.197] lstrlenW (lpString=".ppt") returned 4
	[0188.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0188.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.197] lstrlenW (lpString=".zip") returned 4
	[0188.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0188.198] lstrlenW (lpString=".rar") returned 4
	[0188.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0188.198] lstrlenW (lpString=".bz2") returned 4
	[0188.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0188.198] lstrlenW (lpString=".7z") returned 3
	[0188.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0188.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.198] lstrlenW (lpString=".dbf") returned 4
	[0188.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0188.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.198] lstrlenW (lpString=".1cd") returned 4
	[0188.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0188.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.198] lstrlenW (lpString=".jpg") returned 4
	[0188.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0188.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.198] lstrlenW (lpString=".doc") returned 4
	[0188.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0188.198] lstrlenW (lpString=".docx") returned 5
	[0188.198] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0188.198] lstrlenW (lpString=".pdf") returned 4
	[0188.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0188.198] lstrlenW (lpString=".xls") returned 4
	[0188.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0188.198] lstrlenW (lpString=".xlsx") returned 5
	[0188.198] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0188.198] lstrlenW (lpString=".ppt") returned 4
	[0188.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0188.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.199] lstrlenW (lpString=".zip") returned 4
	[0188.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0188.199] lstrlenW (lpString=".rar") returned 4
	[0188.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0188.199] lstrlenW (lpString=".bz2") returned 4
	[0188.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0188.199] lstrlenW (lpString=".7z") returned 3
	[0188.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0188.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.199] lstrlenW (lpString=".dbf") returned 4
	[0188.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0188.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.199] lstrlenW (lpString=".1cd") returned 4
	[0188.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0188.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68
	[0188.199] lstrlenW (lpString=".jpg") returned 4
	[0188.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0188.199] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0188.199] lstrlenW (lpString="J0187921.WMF") returned 12
	[0188.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 43
	os_tid = 0xe10

	[0153.927] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x594a88
	[0153.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x5a4a90
	[0153.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e618
	[0153.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x571e60
	[0153.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e648
	[0153.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x3cf3020
	[0153.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e540
	[0153.931] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e540, Size=0x20) returned 0x4f27f8
	[0153.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e660
	[0153.931] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e660, Size=0x20) returned 0x4f2668
	[0153.931] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0153.931] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0153.931] Wow64DisableWow64FsRedirection (in: OldValue=0x331ff50 | out: OldValue=0x331ff50*=0x0) returned 1
	[0153.931] lstrlenW (lpString="kernel32.dll") returned 12
	[0153.931] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f27f8 | out: hHeap=0x4c0000) returned 1
	[0153.931] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0153.931] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2668 | out: hHeap=0x4c0000) returned 1
	[0153.931] Sleep (dwMilliseconds=0x64) 
	[0154.256] Sleep (dwMilliseconds=0x64) 
	[0154.437] Sleep (dwMilliseconds=0x64) 
	[0154.724] Sleep (dwMilliseconds=0x64) 
	[0154.982] lstrcmpiW (lpString1=".LOG", lpString2=".money") returned -1
	[0154.983] lstrlenW (lpString="BCD.LOG") returned 7
	[0154.983] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0154.994] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0154.997] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0154.997] lstrlenW (lpString=".doc") returned 4
	[0155.005] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0155.007] lstrlenW (lpString=".docx") returned 5
	[0155.007] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0155.009] lstrlenW (lpString=".pdf") returned 4
	[0155.012] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0155.014] lstrlenW (lpString=".xls") returned 4
	[0155.022] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0155.025] lstrlenW (lpString=".xlsx") returned 5
	[0155.026] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0155.026] lstrlenW (lpString=".ppt") returned 4
	[0155.026] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0155.026] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0155.026] lstrlenW (lpString=".zip") returned 4
	[0155.026] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0155.026] lstrlenW (lpString=".rar") returned 4
	[0155.026] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0155.026] lstrlenW (lpString=".bz2") returned 4
	[0155.026] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0155.026] lstrlenW (lpString=".7z") returned 3
	[0155.026] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0155.026] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0155.026] lstrlenW (lpString=".dbf") returned 4
	[0155.026] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0155.026] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0155.026] lstrlenW (lpString=".1cd") returned 4
	[0155.026] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0155.026] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0155.026] lstrlenW (lpString=".jpg") returned 4
	[0155.026] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0155.026] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0155.026] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0155.026] lstrlenW (lpString=".doc") returned 4
	[0155.026] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0155.026] lstrlenW (lpString=".docx") returned 5
	[0155.026] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0155.026] lstrlenW (lpString=".pdf") returned 4
	[0155.027] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0155.027] lstrlenW (lpString=".xls") returned 4
	[0155.027] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0155.027] lstrlenW (lpString=".xlsx") returned 5
	[0155.027] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0155.027] lstrlenW (lpString=".ppt") returned 4
	[0155.027] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0155.027] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0155.027] lstrlenW (lpString=".zip") returned 4
	[0155.027] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0155.027] lstrlenW (lpString=".rar") returned 4
	[0155.027] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0155.027] lstrlenW (lpString=".bz2") returned 4
	[0155.027] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0155.027] lstrlenW (lpString=".7z") returned 3
	[0155.027] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0155.027] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0155.027] lstrlenW (lpString=".dbf") returned 4
	[0155.027] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0155.027] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0155.027] lstrlenW (lpString=".1cd") returned 4
	[0155.027] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0155.027] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0155.027] lstrlenW (lpString=".jpg") returned 4
	[0155.027] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0155.027] Sleep (dwMilliseconds=0x64) 
	[0155.392] Sleep (dwMilliseconds=0x64) 
	[0155.601] Sleep (dwMilliseconds=0x64) 
	[0155.853] Sleep (dwMilliseconds=0x64) 
	[0156.165] Sleep (dwMilliseconds=0x64) 
	[0156.524] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.527] lstrlenW (lpString="keypadbase.xml") returned 14
	[0156.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0156.975] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=903) returned 1
	[0156.975] CloseHandle (hObject=0x454) returned 1
	[0156.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20
	[0157.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0157.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.937] lstrlenW (lpString=".doc") returned 4
	[0157.937] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0157.937] lstrlenW (lpString=".docx") returned 5
	[0157.937] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0157.937] lstrlenW (lpString=".pdf") returned 4
	[0157.937] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0157.937] lstrlenW (lpString=".xls") returned 4
	[0157.937] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0157.937] lstrlenW (lpString=".xlsx") returned 5
	[0157.937] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0157.937] lstrlenW (lpString=".ppt") returned 4
	[0157.937] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0157.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.937] lstrlenW (lpString=".zip") returned 4
	[0157.937] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0157.937] lstrlenW (lpString=".rar") returned 4
	[0157.937] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0157.937] lstrlenW (lpString=".bz2") returned 4
	[0157.937] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0157.937] lstrlenW (lpString=".7z") returned 3
	[0157.937] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0157.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.937] lstrlenW (lpString=".dbf") returned 4
	[0157.937] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0157.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.937] lstrlenW (lpString=".1cd") returned 4
	[0157.937] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0157.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.938] lstrlenW (lpString=".jpg") returned 4
	[0157.938] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0157.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.938] lstrlenW (lpString=".doc") returned 4
	[0157.938] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0157.938] lstrlenW (lpString=".docx") returned 5
	[0157.938] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0157.938] lstrlenW (lpString=".pdf") returned 4
	[0157.938] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0157.938] lstrlenW (lpString=".xls") returned 4
	[0157.938] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0157.938] lstrlenW (lpString=".xlsx") returned 5
	[0157.938] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0157.938] lstrlenW (lpString=".ppt") returned 4
	[0157.938] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0157.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.938] lstrlenW (lpString=".zip") returned 4
	[0157.938] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0157.938] lstrlenW (lpString=".rar") returned 4
	[0157.938] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0157.938] lstrlenW (lpString=".bz2") returned 4
	[0157.938] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0157.938] lstrlenW (lpString=".7z") returned 3
	[0157.938] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0157.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.938] lstrlenW (lpString=".dbf") returned 4
	[0157.938] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0157.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.938] lstrlenW (lpString=".1cd") returned 4
	[0157.939] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0157.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0157.939] lstrlenW (lpString=".jpg") returned 4
	[0157.939] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0157.939] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0157.939] lstrlenW (lpString="J0075478.GIF") returned 12
	[0157.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0158.129] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=1220) returned 1
	[0158.129] CloseHandle (hObject=0x40c) returned 1
	[0158.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220
	[0158.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.465] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.466] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0158.467] GetLastError () returned 0x0
	[0158.467] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x4c4, lpOverlapped=0x0) returned 1
	[0158.482] WriteFile (in: hFile=0x500, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4d0, lpOverlapped=0x0) returned 1
	[0158.483] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.483] WriteFile (in: hFile=0x500, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.483] SetEndOfFile (hFile=0x500) returned 1
	[0158.484] CloseHandle (hObject=0x500) returned 1
	[0158.484] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.484] SetEndOfFile (hFile=0x4fc) returned 1
	[0158.506] CloseHandle (hObject=0x4fc) returned 1
	[0158.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1
	[0158.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.507] lstrlenW (lpString=".doc") returned 4
	[0158.507] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0158.507] lstrlenW (lpString=".docx") returned 5
	[0158.507] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0158.507] lstrlenW (lpString=".pdf") returned 4
	[0158.507] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0158.507] lstrlenW (lpString=".xls") returned 4
	[0158.507] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0158.507] lstrlenW (lpString=".xlsx") returned 5
	[0158.507] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0158.507] lstrlenW (lpString=".ppt") returned 4
	[0158.507] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0158.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.507] lstrlenW (lpString=".zip") returned 4
	[0158.507] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0158.507] lstrlenW (lpString=".rar") returned 4
	[0158.507] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0158.507] lstrlenW (lpString=".bz2") returned 4
	[0158.508] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0158.508] lstrlenW (lpString=".7z") returned 3
	[0158.508] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0158.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.508] lstrlenW (lpString=".dbf") returned 4
	[0158.508] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0158.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.508] lstrlenW (lpString=".1cd") returned 4
	[0158.508] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0158.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.508] lstrlenW (lpString=".jpg") returned 4
	[0158.508] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0158.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.508] lstrlenW (lpString=".doc") returned 4
	[0158.508] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0158.508] lstrlenW (lpString=".docx") returned 5
	[0158.508] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0158.508] lstrlenW (lpString=".pdf") returned 4
	[0158.508] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0158.508] lstrlenW (lpString=".xls") returned 4
	[0158.508] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0158.508] lstrlenW (lpString=".xlsx") returned 5
	[0158.508] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0158.508] lstrlenW (lpString=".ppt") returned 4
	[0158.508] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0158.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.508] lstrlenW (lpString=".zip") returned 4
	[0158.509] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0158.509] lstrlenW (lpString=".rar") returned 4
	[0158.509] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0158.509] lstrlenW (lpString=".bz2") returned 4
	[0158.509] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0158.509] lstrlenW (lpString=".7z") returned 3
	[0158.509] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0158.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.509] lstrlenW (lpString=".dbf") returned 4
	[0158.509] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0158.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.509] lstrlenW (lpString=".1cd") returned 4
	[0158.509] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0158.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0158.509] lstrlenW (lpString=".jpg") returned 4
	[0158.509] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0158.509] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.509] lstrlenW (lpString="J0086384.WMF") returned 12
	[0158.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.520] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=9734) returned 1
	[0158.521] CloseHandle (hObject=0x4fc) returned 1
	[0158.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220
	[0158.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.521] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.521] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0158.522] GetLastError () returned 0x0
	[0158.522] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x2606, lpOverlapped=0x0) returned 1
	[0158.524] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2610, lpOverlapped=0x0) returned 1
	[0158.525] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.525] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.525] SetEndOfFile (hFile=0x508) returned 1
	[0158.525] CloseHandle (hObject=0x508) returned 1
	[0158.525] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.525] SetEndOfFile (hFile=0x4fc) returned 1
	[0158.528] CloseHandle (hObject=0x4fc) returned 1
	[0158.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1
	[0158.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.529] lstrlenW (lpString=".doc") returned 4
	[0158.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.529] lstrlenW (lpString=".docx") returned 5
	[0158.529] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0158.529] lstrlenW (lpString=".pdf") returned 4
	[0158.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.529] lstrlenW (lpString=".xls") returned 4
	[0158.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.529] lstrlenW (lpString=".xlsx") returned 5
	[0158.529] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0158.529] lstrlenW (lpString=".ppt") returned 4
	[0158.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.529] lstrlenW (lpString=".zip") returned 4
	[0158.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.529] lstrlenW (lpString=".rar") returned 4
	[0158.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.529] lstrlenW (lpString=".bz2") returned 4
	[0158.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.529] lstrlenW (lpString=".7z") returned 3
	[0158.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.530] lstrlenW (lpString=".dbf") returned 4
	[0158.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.530] lstrlenW (lpString=".1cd") returned 4
	[0158.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.530] lstrlenW (lpString=".jpg") returned 4
	[0158.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.530] lstrlenW (lpString=".doc") returned 4
	[0158.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.530] lstrlenW (lpString=".docx") returned 5
	[0158.530] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0158.530] lstrlenW (lpString=".pdf") returned 4
	[0158.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.530] lstrlenW (lpString=".xls") returned 4
	[0158.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.530] lstrlenW (lpString=".xlsx") returned 5
	[0158.530] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0158.530] lstrlenW (lpString=".ppt") returned 4
	[0158.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.530] lstrlenW (lpString=".zip") returned 4
	[0158.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.530] lstrlenW (lpString=".rar") returned 4
	[0158.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.530] lstrlenW (lpString=".bz2") returned 4
	[0158.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.530] lstrlenW (lpString=".7z") returned 3
	[0158.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.531] lstrlenW (lpString=".dbf") returned 4
	[0158.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.531] lstrlenW (lpString=".1cd") returned 4
	[0158.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0158.531] lstrlenW (lpString=".jpg") returned 4
	[0158.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.531] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.531] lstrlenW (lpString="J0086424.WMF") returned 12
	[0158.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.532] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=17016) returned 1
	[0158.532] CloseHandle (hObject=0x4fc) returned 1
	[0158.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220
	[0158.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.533] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.533] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0158.533] GetLastError () returned 0x0
	[0158.533] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x4278, lpOverlapped=0x0) returned 1
	[0158.535] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4280, lpOverlapped=0x0) returned 1
	[0158.536] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.536] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.536] SetEndOfFile (hFile=0x508) returned 1
	[0158.536] CloseHandle (hObject=0x508) returned 1
	[0158.537] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.537] SetEndOfFile (hFile=0x4fc) returned 1
	[0158.539] CloseHandle (hObject=0x4fc) returned 1
	[0158.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1
	[0158.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.540] lstrlenW (lpString=".doc") returned 4
	[0158.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.540] lstrlenW (lpString=".docx") returned 5
	[0158.540] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0158.540] lstrlenW (lpString=".pdf") returned 4
	[0158.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.540] lstrlenW (lpString=".xls") returned 4
	[0158.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.540] lstrlenW (lpString=".xlsx") returned 5
	[0158.540] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0158.540] lstrlenW (lpString=".ppt") returned 4
	[0158.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.540] lstrlenW (lpString=".zip") returned 4
	[0158.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.541] lstrlenW (lpString=".rar") returned 4
	[0158.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.541] lstrlenW (lpString=".bz2") returned 4
	[0158.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.541] lstrlenW (lpString=".7z") returned 3
	[0158.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.541] lstrlenW (lpString=".dbf") returned 4
	[0158.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.541] lstrlenW (lpString=".1cd") returned 4
	[0158.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.541] lstrlenW (lpString=".jpg") returned 4
	[0158.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.541] lstrlenW (lpString=".doc") returned 4
	[0158.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.541] lstrlenW (lpString=".docx") returned 5
	[0158.541] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0158.541] lstrlenW (lpString=".pdf") returned 4
	[0158.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.541] lstrlenW (lpString=".xls") returned 4
	[0158.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.541] lstrlenW (lpString=".xlsx") returned 5
	[0158.542] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0158.542] lstrlenW (lpString=".ppt") returned 4
	[0158.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.542] lstrlenW (lpString=".zip") returned 4
	[0158.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.542] lstrlenW (lpString=".rar") returned 4
	[0158.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.542] lstrlenW (lpString=".bz2") returned 4
	[0158.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.542] lstrlenW (lpString=".7z") returned 3
	[0158.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.542] lstrlenW (lpString=".dbf") returned 4
	[0158.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.542] lstrlenW (lpString=".1cd") returned 4
	[0158.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0158.542] lstrlenW (lpString=".jpg") returned 4
	[0158.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.542] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.542] lstrlenW (lpString="J0086426.WMF") returned 12
	[0158.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.543] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=21782) returned 1
	[0158.543] CloseHandle (hObject=0x4fc) returned 1
	[0158.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220
	[0158.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.543] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.544] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0158.544] GetLastError () returned 0x0
	[0158.544] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x5516, lpOverlapped=0x0) returned 1
	[0158.546] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x5520, lpOverlapped=0x0) returned 1
	[0158.547] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.547] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.547] SetEndOfFile (hFile=0x508) returned 1
	[0158.548] CloseHandle (hObject=0x508) returned 1
	[0158.548] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.548] SetEndOfFile (hFile=0x4fc) returned 1
	[0158.551] CloseHandle (hObject=0x4fc) returned 1
	[0158.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1
	[0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.552] lstrlenW (lpString=".doc") returned 4
	[0158.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.552] lstrlenW (lpString=".docx") returned 5
	[0158.552] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0158.552] lstrlenW (lpString=".pdf") returned 4
	[0158.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.552] lstrlenW (lpString=".xls") returned 4
	[0158.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.552] lstrlenW (lpString=".xlsx") returned 5
	[0158.552] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0158.552] lstrlenW (lpString=".ppt") returned 4
	[0158.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.552] lstrlenW (lpString=".zip") returned 4
	[0158.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.552] lstrlenW (lpString=".rar") returned 4
	[0158.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.552] lstrlenW (lpString=".bz2") returned 4
	[0158.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.553] lstrlenW (lpString=".7z") returned 3
	[0158.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.553] lstrlenW (lpString=".dbf") returned 4
	[0158.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.553] lstrlenW (lpString=".1cd") returned 4
	[0158.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.553] lstrlenW (lpString=".jpg") returned 4
	[0158.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.553] lstrlenW (lpString=".doc") returned 4
	[0158.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.553] lstrlenW (lpString=".docx") returned 5
	[0158.553] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0158.553] lstrlenW (lpString=".pdf") returned 4
	[0158.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.553] lstrlenW (lpString=".xls") returned 4
	[0158.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.553] lstrlenW (lpString=".xlsx") returned 5
	[0158.553] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0158.553] lstrlenW (lpString=".ppt") returned 4
	[0158.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.553] lstrlenW (lpString=".zip") returned 4
	[0158.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.553] lstrlenW (lpString=".rar") returned 4
	[0158.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.554] lstrlenW (lpString=".bz2") returned 4
	[0158.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.554] lstrlenW (lpString=".7z") returned 3
	[0158.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.554] lstrlenW (lpString=".dbf") returned 4
	[0158.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.554] lstrlenW (lpString=".1cd") returned 4
	[0158.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0158.554] lstrlenW (lpString=".jpg") returned 4
	[0158.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.554] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.554] lstrlenW (lpString="J0086428.WMF") returned 12
	[0158.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.555] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=35346) returned 1
	[0158.555] CloseHandle (hObject=0x4fc) returned 1
	[0158.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220
	[0158.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.555] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.555] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0158.556] GetLastError () returned 0x0
	[0158.556] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x8a12, lpOverlapped=0x0) returned 1
	[0158.809] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x8a20, lpOverlapped=0x0) returned 1
	[0158.810] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.810] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.810] SetEndOfFile (hFile=0x508) returned 1
	[0158.811] CloseHandle (hObject=0x508) returned 1
	[0158.811] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.811] SetEndOfFile (hFile=0x4fc) returned 1
	[0158.814] CloseHandle (hObject=0x4fc) returned 1
	[0158.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1
	[0158.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.815] lstrlenW (lpString=".doc") returned 4
	[0158.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.815] lstrlenW (lpString=".docx") returned 5
	[0158.815] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0158.815] lstrlenW (lpString=".pdf") returned 4
	[0158.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.816] lstrlenW (lpString=".xls") returned 4
	[0158.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.816] lstrlenW (lpString=".xlsx") returned 5
	[0158.816] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0158.816] lstrlenW (lpString=".ppt") returned 4
	[0158.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.816] lstrlenW (lpString=".zip") returned 4
	[0158.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.816] lstrlenW (lpString=".rar") returned 4
	[0158.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.816] lstrlenW (lpString=".bz2") returned 4
	[0158.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.816] lstrlenW (lpString=".7z") returned 3
	[0158.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.816] lstrlenW (lpString=".dbf") returned 4
	[0158.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.816] lstrlenW (lpString=".1cd") returned 4
	[0158.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.816] lstrlenW (lpString=".jpg") returned 4
	[0158.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.816] lstrlenW (lpString=".doc") returned 4
	[0158.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.816] lstrlenW (lpString=".docx") returned 5
	[0158.817] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0158.817] lstrlenW (lpString=".pdf") returned 4
	[0158.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.817] lstrlenW (lpString=".xls") returned 4
	[0158.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.817] lstrlenW (lpString=".xlsx") returned 5
	[0158.817] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0158.817] lstrlenW (lpString=".ppt") returned 4
	[0158.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.817] lstrlenW (lpString=".zip") returned 4
	[0158.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.817] lstrlenW (lpString=".rar") returned 4
	[0158.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.817] lstrlenW (lpString=".bz2") returned 4
	[0158.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.817] lstrlenW (lpString=".7z") returned 3
	[0158.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.817] lstrlenW (lpString=".dbf") returned 4
	[0158.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.817] lstrlenW (lpString=".1cd") returned 4
	[0158.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0158.817] lstrlenW (lpString=".jpg") returned 4
	[0158.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.818] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.818] lstrlenW (lpString="J0090087.WMF") returned 12
	[0158.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.819] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=46936) returned 1
	[0158.819] CloseHandle (hObject=0x4fc) returned 1
	[0158.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220
	[0158.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.819] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.820] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0158.820] GetLastError () returned 0x0
	[0158.820] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0xb758, lpOverlapped=0x0) returned 1
	[0158.823] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xb760, lpOverlapped=0x0) returned 1
	[0158.825] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.825] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.825] SetEndOfFile (hFile=0x508) returned 1
	[0158.825] CloseHandle (hObject=0x508) returned 1
	[0158.825] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.825] SetEndOfFile (hFile=0x4fc) returned 1
	[0158.829] CloseHandle (hObject=0x4fc) returned 1
	[0158.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1
	[0158.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.831] lstrlenW (lpString=".doc") returned 4
	[0158.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.831] lstrlenW (lpString=".docx") returned 5
	[0158.831] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0158.831] lstrlenW (lpString=".pdf") returned 4
	[0158.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.831] lstrlenW (lpString=".xls") returned 4
	[0158.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.831] lstrlenW (lpString=".xlsx") returned 5
	[0158.831] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0158.831] lstrlenW (lpString=".ppt") returned 4
	[0158.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.831] lstrlenW (lpString=".zip") returned 4
	[0158.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.831] lstrlenW (lpString=".rar") returned 4
	[0158.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.831] lstrlenW (lpString=".bz2") returned 4
	[0158.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.831] lstrlenW (lpString=".7z") returned 3
	[0158.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.832] lstrlenW (lpString=".dbf") returned 4
	[0158.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.832] lstrlenW (lpString=".1cd") returned 4
	[0158.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.832] lstrlenW (lpString=".jpg") returned 4
	[0158.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.832] lstrlenW (lpString=".doc") returned 4
	[0158.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.832] lstrlenW (lpString=".docx") returned 5
	[0158.832] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0158.832] lstrlenW (lpString=".pdf") returned 4
	[0158.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.832] lstrlenW (lpString=".xls") returned 4
	[0158.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.832] lstrlenW (lpString=".xlsx") returned 5
	[0158.832] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0158.832] lstrlenW (lpString=".ppt") returned 4
	[0158.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.832] lstrlenW (lpString=".zip") returned 4
	[0158.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.833] lstrlenW (lpString=".rar") returned 4
	[0158.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.833] lstrlenW (lpString=".bz2") returned 4
	[0158.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.833] lstrlenW (lpString=".7z") returned 3
	[0158.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.833] lstrlenW (lpString=".dbf") returned 4
	[0158.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.833] lstrlenW (lpString=".1cd") returned 4
	[0158.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0158.833] lstrlenW (lpString=".jpg") returned 4
	[0158.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.833] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.833] lstrlenW (lpString="J0090089.WMF") returned 12
	[0158.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.834] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=15760) returned 1
	[0158.834] CloseHandle (hObject=0x4fc) returned 1
	[0158.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220
	[0158.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.834] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.834] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0158.835] GetLastError () returned 0x0
	[0158.835] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x3d90, lpOverlapped=0x0) returned 1
	[0158.837] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x3da0, lpOverlapped=0x0) returned 1
	[0158.839] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.839] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.839] SetEndOfFile (hFile=0x508) returned 1
	[0158.839] CloseHandle (hObject=0x508) returned 1
	[0158.839] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.839] SetEndOfFile (hFile=0x4fc) returned 1
	[0158.841] CloseHandle (hObject=0x4fc) returned 1
	[0158.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0158.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1
	[0158.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.843] lstrlenW (lpString=".doc") returned 4
	[0158.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.843] lstrlenW (lpString=".docx") returned 5
	[0158.843] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0158.843] lstrlenW (lpString=".pdf") returned 4
	[0158.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.843] lstrlenW (lpString=".xls") returned 4
	[0158.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.843] lstrlenW (lpString=".xlsx") returned 5
	[0158.843] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0158.843] lstrlenW (lpString=".ppt") returned 4
	[0158.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.843] lstrlenW (lpString=".zip") returned 4
	[0158.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.843] lstrlenW (lpString=".rar") returned 4
	[0158.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.843] lstrlenW (lpString=".bz2") returned 4
	[0158.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.843] lstrlenW (lpString=".7z") returned 3
	[0158.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.843] lstrlenW (lpString=".dbf") returned 4
	[0158.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.843] lstrlenW (lpString=".1cd") returned 4
	[0158.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.843] lstrlenW (lpString=".jpg") returned 4
	[0158.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.844] lstrlenW (lpString=".doc") returned 4
	[0158.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.844] lstrlenW (lpString=".docx") returned 5
	[0158.844] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0158.844] lstrlenW (lpString=".pdf") returned 4
	[0158.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.844] lstrlenW (lpString=".xls") returned 4
	[0158.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.844] lstrlenW (lpString=".xlsx") returned 5
	[0158.844] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0158.844] lstrlenW (lpString=".ppt") returned 4
	[0158.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.844] lstrlenW (lpString=".zip") returned 4
	[0158.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.844] lstrlenW (lpString=".rar") returned 4
	[0158.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.844] lstrlenW (lpString=".bz2") returned 4
	[0158.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.844] lstrlenW (lpString=".7z") returned 3
	[0158.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.844] lstrlenW (lpString=".dbf") returned 4
	[0158.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.844] lstrlenW (lpString=".1cd") returned 4
	[0158.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0158.845] lstrlenW (lpString=".jpg") returned 4
	[0158.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.845] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0158.845] lstrlenW (lpString="J0090149.WMF") returned 12
	[0158.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.845] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=28212) returned 1
	[0158.845] CloseHandle (hObject=0x4fc) returned 1
	[0158.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220
	[0158.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.846] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.846] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0158.847] GetLastError () returned 0x0
	[0158.847] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x6e34, lpOverlapped=0x0) returned 1
	[0159.133] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x6e40, lpOverlapped=0x0) returned 1
	[0159.135] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.135] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.135] SetEndOfFile (hFile=0x508) returned 1
	[0159.136] CloseHandle (hObject=0x508) returned 1
	[0159.136] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.136] SetEndOfFile (hFile=0x4fc) returned 1
	[0159.139] CloseHandle (hObject=0x4fc) returned 1
	[0159.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1
	[0159.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.140] lstrlenW (lpString=".doc") returned 4
	[0159.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.140] lstrlenW (lpString=".docx") returned 5
	[0159.140] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0159.140] lstrlenW (lpString=".pdf") returned 4
	[0159.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.140] lstrlenW (lpString=".xls") returned 4
	[0159.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.140] lstrlenW (lpString=".xlsx") returned 5
	[0159.140] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0159.140] lstrlenW (lpString=".ppt") returned 4
	[0159.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.140] lstrlenW (lpString=".zip") returned 4
	[0159.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.140] lstrlenW (lpString=".rar") returned 4
	[0159.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.140] lstrlenW (lpString=".bz2") returned 4
	[0159.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.140] lstrlenW (lpString=".7z") returned 3
	[0159.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.140] lstrlenW (lpString=".dbf") returned 4
	[0159.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.141] lstrlenW (lpString=".1cd") returned 4
	[0159.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.141] lstrlenW (lpString=".jpg") returned 4
	[0159.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.141] lstrlenW (lpString=".doc") returned 4
	[0159.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.141] lstrlenW (lpString=".docx") returned 5
	[0159.141] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0159.141] lstrlenW (lpString=".pdf") returned 4
	[0159.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.141] lstrlenW (lpString=".xls") returned 4
	[0159.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.141] lstrlenW (lpString=".xlsx") returned 5
	[0159.141] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0159.141] lstrlenW (lpString=".ppt") returned 4
	[0159.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.141] lstrlenW (lpString=".zip") returned 4
	[0159.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.141] lstrlenW (lpString=".rar") returned 4
	[0159.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.141] lstrlenW (lpString=".bz2") returned 4
	[0159.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.142] lstrlenW (lpString=".7z") returned 3
	[0159.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.142] lstrlenW (lpString=".dbf") returned 4
	[0159.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.142] lstrlenW (lpString=".1cd") returned 4
	[0159.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0159.142] lstrlenW (lpString=".jpg") returned 4
	[0159.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.142] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.142] lstrlenW (lpString="J0099147.JPG") returned 12
	[0159.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.143] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=24377) returned 1
	[0159.143] CloseHandle (hObject=0x4fc) returned 1
	[0159.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220
	[0159.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.144] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.144] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0159.144] GetLastError () returned 0x0
	[0159.145] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x5f39, lpOverlapped=0x0) returned 1
	[0159.148] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0159.149] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.150] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.150] SetEndOfFile (hFile=0x508) returned 1
	[0159.150] CloseHandle (hObject=0x508) returned 1
	[0159.150] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.150] SetEndOfFile (hFile=0x4fc) returned 1
	[0159.154] CloseHandle (hObject=0x4fc) returned 1
	[0159.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1
	[0159.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.155] lstrlenW (lpString=".doc") returned 4
	[0159.155] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.155] lstrlenW (lpString=".docx") returned 5
	[0159.155] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0159.155] lstrlenW (lpString=".pdf") returned 4
	[0159.155] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.155] lstrlenW (lpString=".xls") returned 4
	[0159.155] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.155] lstrlenW (lpString=".xlsx") returned 5
	[0159.155] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0159.155] lstrlenW (lpString=".ppt") returned 4
	[0159.155] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.155] lstrlenW (lpString=".zip") returned 4
	[0159.155] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.155] lstrlenW (lpString=".rar") returned 4
	[0159.155] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.155] lstrlenW (lpString=".bz2") returned 4
	[0159.155] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.155] lstrlenW (lpString=".7z") returned 3
	[0159.155] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.155] lstrlenW (lpString=".dbf") returned 4
	[0159.155] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.156] lstrlenW (lpString=".1cd") returned 4
	[0159.156] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.156] lstrlenW (lpString=".jpg") returned 4
	[0159.156] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.156] lstrlenW (lpString=".doc") returned 4
	[0159.156] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.156] lstrlenW (lpString=".docx") returned 5
	[0159.156] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0159.156] lstrlenW (lpString=".pdf") returned 4
	[0159.156] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.156] lstrlenW (lpString=".xls") returned 4
	[0159.156] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.156] lstrlenW (lpString=".xlsx") returned 5
	[0159.156] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0159.156] lstrlenW (lpString=".ppt") returned 4
	[0159.156] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.156] lstrlenW (lpString=".zip") returned 4
	[0159.156] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.156] lstrlenW (lpString=".rar") returned 4
	[0159.156] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.156] lstrlenW (lpString=".bz2") returned 4
	[0159.156] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.156] lstrlenW (lpString=".7z") returned 3
	[0159.156] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.157] lstrlenW (lpString=".dbf") returned 4
	[0159.157] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.157] lstrlenW (lpString=".1cd") returned 4
	[0159.157] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0159.157] lstrlenW (lpString=".jpg") returned 4
	[0159.157] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.158] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.158] lstrlenW (lpString="J0099148.JPG") returned 12
	[0159.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.159] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=18258) returned 1
	[0159.159] CloseHandle (hObject=0x4fc) returned 1
	[0159.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220
	[0159.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.159] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.159] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0159.161] GetLastError () returned 0x0
	[0159.161] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x4752, lpOverlapped=0x0) returned 1
	[0159.164] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0159.165] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.165] WriteFile (in: hFile=0x508, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.165] SetEndOfFile (hFile=0x508) returned 1
	[0159.165] CloseHandle (hObject=0x508) returned 1
	[0159.165] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.165] SetEndOfFile (hFile=0x4fc) returned 1
	[0159.171] CloseHandle (hObject=0x4fc) returned 1
	[0159.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1
	[0159.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.172] lstrlenW (lpString=".doc") returned 4
	[0159.172] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.173] lstrlenW (lpString=".docx") returned 5
	[0159.173] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0159.173] lstrlenW (lpString=".pdf") returned 4
	[0159.173] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.173] lstrlenW (lpString=".xls") returned 4
	[0159.173] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.173] lstrlenW (lpString=".xlsx") returned 5
	[0159.173] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0159.173] lstrlenW (lpString=".ppt") returned 4
	[0159.173] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.173] lstrlenW (lpString=".zip") returned 4
	[0159.173] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.173] lstrlenW (lpString=".rar") returned 4
	[0159.173] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.173] lstrlenW (lpString=".bz2") returned 4
	[0159.173] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.173] lstrlenW (lpString=".7z") returned 3
	[0159.173] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.173] lstrlenW (lpString=".dbf") returned 4
	[0159.173] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.173] lstrlenW (lpString=".1cd") returned 4
	[0159.173] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.173] lstrlenW (lpString=".jpg") returned 4
	[0159.173] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.173] lstrlenW (lpString=".doc") returned 4
	[0159.173] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.174] lstrlenW (lpString=".docx") returned 5
	[0159.174] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0159.174] lstrlenW (lpString=".pdf") returned 4
	[0159.174] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.174] lstrlenW (lpString=".xls") returned 4
	[0159.174] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.174] lstrlenW (lpString=".xlsx") returned 5
	[0159.174] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0159.174] lstrlenW (lpString=".ppt") returned 4
	[0159.174] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.174] lstrlenW (lpString=".zip") returned 4
	[0159.174] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.174] lstrlenW (lpString=".rar") returned 4
	[0159.174] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.174] lstrlenW (lpString=".bz2") returned 4
	[0159.174] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.174] lstrlenW (lpString=".7z") returned 3
	[0159.174] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.174] lstrlenW (lpString=".dbf") returned 4
	[0159.174] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.174] lstrlenW (lpString=".1cd") returned 4
	[0159.174] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0159.175] lstrlenW (lpString=".jpg") returned 4
	[0159.175] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.175] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.175] lstrlenW (lpString="J0099149.WMF") returned 12
	[0159.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.175] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=73214) returned 1
	[0159.175] CloseHandle (hObject=0x4fc) returned 1
	[0159.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220
	[0159.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.176] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.176] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0159.330] GetLastError () returned 0x0
	[0159.330] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x11dfe, lpOverlapped=0x0) returned 1
	[0159.334] WriteFile (in: hFile=0x518, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x11e00, lpOverlapped=0x0) returned 1
	[0159.336] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.336] WriteFile (in: hFile=0x518, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.336] SetEndOfFile (hFile=0x518) returned 1
	[0159.336] CloseHandle (hObject=0x518) returned 1
	[0159.336] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.336] SetEndOfFile (hFile=0x4fc) returned 1
	[0159.340] CloseHandle (hObject=0x4fc) returned 1
	[0159.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1
	[0159.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.341] lstrlenW (lpString=".doc") returned 4
	[0159.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.341] lstrlenW (lpString=".docx") returned 5
	[0159.341] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0159.341] lstrlenW (lpString=".pdf") returned 4
	[0159.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.341] lstrlenW (lpString=".xls") returned 4
	[0159.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.341] lstrlenW (lpString=".xlsx") returned 5
	[0159.341] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0159.341] lstrlenW (lpString=".ppt") returned 4
	[0159.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.341] lstrlenW (lpString=".zip") returned 4
	[0159.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.341] lstrlenW (lpString=".rar") returned 4
	[0159.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.341] lstrlenW (lpString=".bz2") returned 4
	[0159.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.341] lstrlenW (lpString=".7z") returned 3
	[0159.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.341] lstrlenW (lpString=".dbf") returned 4
	[0159.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.341] lstrlenW (lpString=".1cd") returned 4
	[0159.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.341] lstrlenW (lpString=".jpg") returned 4
	[0159.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.342] lstrlenW (lpString=".doc") returned 4
	[0159.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.342] lstrlenW (lpString=".docx") returned 5
	[0159.342] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0159.342] lstrlenW (lpString=".pdf") returned 4
	[0159.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.342] lstrlenW (lpString=".xls") returned 4
	[0159.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.342] lstrlenW (lpString=".xlsx") returned 5
	[0159.342] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0159.342] lstrlenW (lpString=".ppt") returned 4
	[0159.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.342] lstrlenW (lpString=".zip") returned 4
	[0159.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.342] lstrlenW (lpString=".rar") returned 4
	[0159.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.342] lstrlenW (lpString=".bz2") returned 4
	[0159.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.342] lstrlenW (lpString=".7z") returned 3
	[0159.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.342] lstrlenW (lpString=".dbf") returned 4
	[0159.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.342] lstrlenW (lpString=".1cd") returned 4
	[0159.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0159.343] lstrlenW (lpString=".jpg") returned 4
	[0159.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.343] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.343] lstrlenW (lpString="J0099152.JPG") returned 12
	[0159.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.343] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=11694) returned 1
	[0159.343] CloseHandle (hObject=0x4fc) returned 1
	[0159.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220
	[0159.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.344] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.344] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0159.345] GetLastError () returned 0x0
	[0159.345] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x2dae, lpOverlapped=0x0) returned 1
	[0159.346] WriteFile (in: hFile=0x518, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2db0, lpOverlapped=0x0) returned 1
	[0159.347] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.348] WriteFile (in: hFile=0x518, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.348] SetEndOfFile (hFile=0x518) returned 1
	[0159.348] CloseHandle (hObject=0x518) returned 1
	[0159.348] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.348] SetEndOfFile (hFile=0x4fc) returned 1
	[0159.350] CloseHandle (hObject=0x4fc) returned 1
	[0159.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1
	[0159.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.351] lstrlenW (lpString=".doc") returned 4
	[0159.352] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.352] lstrlenW (lpString=".docx") returned 5
	[0159.352] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0159.352] lstrlenW (lpString=".pdf") returned 4
	[0159.352] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.352] lstrlenW (lpString=".xls") returned 4
	[0159.352] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.352] lstrlenW (lpString=".xlsx") returned 5
	[0159.352] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0159.352] lstrlenW (lpString=".ppt") returned 4
	[0159.352] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.352] lstrlenW (lpString=".zip") returned 4
	[0159.352] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.352] lstrlenW (lpString=".rar") returned 4
	[0159.352] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.352] lstrlenW (lpString=".bz2") returned 4
	[0159.352] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.352] lstrlenW (lpString=".7z") returned 3
	[0159.352] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.352] lstrlenW (lpString=".dbf") returned 4
	[0159.352] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.352] lstrlenW (lpString=".1cd") returned 4
	[0159.352] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.352] lstrlenW (lpString=".jpg") returned 4
	[0159.352] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.353] lstrlenW (lpString=".doc") returned 4
	[0159.353] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.353] lstrlenW (lpString=".docx") returned 5
	[0159.353] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0159.353] lstrlenW (lpString=".pdf") returned 4
	[0159.353] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.353] lstrlenW (lpString=".xls") returned 4
	[0159.353] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.353] lstrlenW (lpString=".xlsx") returned 5
	[0159.353] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0159.353] lstrlenW (lpString=".ppt") returned 4
	[0159.353] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.353] lstrlenW (lpString=".zip") returned 4
	[0159.353] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.353] lstrlenW (lpString=".rar") returned 4
	[0159.353] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.353] lstrlenW (lpString=".bz2") returned 4
	[0159.353] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.353] lstrlenW (lpString=".7z") returned 3
	[0159.353] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.353] lstrlenW (lpString=".dbf") returned 4
	[0159.353] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.353] lstrlenW (lpString=".1cd") returned 4
	[0159.353] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0159.354] lstrlenW (lpString=".jpg") returned 4
	[0159.354] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.354] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.354] lstrlenW (lpString="J0099153.WMF") returned 12
	[0159.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.354] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=13874) returned 1
	[0159.354] CloseHandle (hObject=0x4fc) returned 1
	[0159.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220
	[0159.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.355] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.355] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0159.356] GetLastError () returned 0x0
	[0159.356] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x3632, lpOverlapped=0x0) returned 1
	[0159.357] WriteFile (in: hFile=0x518, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x3640, lpOverlapped=0x0) returned 1
	[0159.358] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.359] WriteFile (in: hFile=0x518, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.359] SetEndOfFile (hFile=0x518) returned 1
	[0159.359] CloseHandle (hObject=0x518) returned 1
	[0159.359] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.359] SetEndOfFile (hFile=0x4fc) returned 1
	[0159.517] CloseHandle (hObject=0x4fc) returned 1
	[0159.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1
	[0159.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.518] lstrlenW (lpString=".doc") returned 4
	[0159.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.518] lstrlenW (lpString=".docx") returned 5
	[0159.518] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0159.518] lstrlenW (lpString=".pdf") returned 4
	[0159.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.518] lstrlenW (lpString=".xls") returned 4
	[0159.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.518] lstrlenW (lpString=".xlsx") returned 5
	[0159.519] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0159.519] lstrlenW (lpString=".ppt") returned 4
	[0159.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.519] lstrlenW (lpString=".zip") returned 4
	[0159.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.519] lstrlenW (lpString=".rar") returned 4
	[0159.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.519] lstrlenW (lpString=".bz2") returned 4
	[0159.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.519] lstrlenW (lpString=".7z") returned 3
	[0159.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.519] lstrlenW (lpString=".dbf") returned 4
	[0159.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.519] lstrlenW (lpString=".1cd") returned 4
	[0159.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.519] lstrlenW (lpString=".jpg") returned 4
	[0159.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.519] lstrlenW (lpString=".doc") returned 4
	[0159.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.519] lstrlenW (lpString=".docx") returned 5
	[0159.519] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0159.519] lstrlenW (lpString=".pdf") returned 4
	[0159.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.519] lstrlenW (lpString=".xls") returned 4
	[0159.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.520] lstrlenW (lpString=".xlsx") returned 5
	[0159.520] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0159.520] lstrlenW (lpString=".ppt") returned 4
	[0159.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.520] lstrlenW (lpString=".zip") returned 4
	[0159.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.520] lstrlenW (lpString=".rar") returned 4
	[0159.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.520] lstrlenW (lpString=".bz2") returned 4
	[0159.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.520] lstrlenW (lpString=".7z") returned 3
	[0159.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.520] lstrlenW (lpString=".dbf") returned 4
	[0159.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.520] lstrlenW (lpString=".1cd") returned 4
	[0159.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0159.520] lstrlenW (lpString=".jpg") returned 4
	[0159.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.520] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.520] lstrlenW (lpString="J0099157.JPG") returned 12
	[0159.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.521] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=9671) returned 1
	[0159.521] CloseHandle (hObject=0x4fc) returned 1
	[0159.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220
	[0159.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.522] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.522] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.522] GetLastError () returned 0x0
	[0159.522] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x25c7, lpOverlapped=0x0) returned 1
	[0159.534] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x25d0, lpOverlapped=0x0) returned 1
	[0159.535] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.535] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.535] SetEndOfFile (hFile=0x4bc) returned 1
	[0159.535] CloseHandle (hObject=0x4bc) returned 1
	[0159.535] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.535] SetEndOfFile (hFile=0x4fc) returned 1
	[0159.538] CloseHandle (hObject=0x4fc) returned 1
	[0159.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1
	[0159.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.539] lstrlenW (lpString=".doc") returned 4
	[0159.539] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.539] lstrlenW (lpString=".docx") returned 5
	[0159.539] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0159.539] lstrlenW (lpString=".pdf") returned 4
	[0159.539] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.539] lstrlenW (lpString=".xls") returned 4
	[0159.539] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.539] lstrlenW (lpString=".xlsx") returned 5
	[0159.539] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0159.539] lstrlenW (lpString=".ppt") returned 4
	[0159.539] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.539] lstrlenW (lpString=".zip") returned 4
	[0159.539] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.539] lstrlenW (lpString=".rar") returned 4
	[0159.539] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.539] lstrlenW (lpString=".bz2") returned 4
	[0159.539] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.539] lstrlenW (lpString=".7z") returned 3
	[0159.539] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.539] lstrlenW (lpString=".dbf") returned 4
	[0159.539] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.539] lstrlenW (lpString=".1cd") returned 4
	[0159.540] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.540] lstrlenW (lpString=".jpg") returned 4
	[0159.540] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.540] lstrlenW (lpString=".doc") returned 4
	[0159.540] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.540] lstrlenW (lpString=".docx") returned 5
	[0159.540] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0159.540] lstrlenW (lpString=".pdf") returned 4
	[0159.540] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.540] lstrlenW (lpString=".xls") returned 4
	[0159.540] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.540] lstrlenW (lpString=".xlsx") returned 5
	[0159.540] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0159.540] lstrlenW (lpString=".ppt") returned 4
	[0159.540] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.540] lstrlenW (lpString=".zip") returned 4
	[0159.540] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.540] lstrlenW (lpString=".rar") returned 4
	[0159.540] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.540] lstrlenW (lpString=".bz2") returned 4
	[0159.540] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.540] lstrlenW (lpString=".7z") returned 3
	[0159.540] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.541] lstrlenW (lpString=".dbf") returned 4
	[0159.541] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.541] lstrlenW (lpString=".1cd") returned 4
	[0159.541] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0159.541] lstrlenW (lpString=".jpg") returned 4
	[0159.541] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.541] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.541] lstrlenW (lpString="J0099159.WMF") returned 12
	[0159.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.542] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=27546) returned 1
	[0159.542] CloseHandle (hObject=0x4fc) returned 1
	[0159.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220
	[0159.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.543] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.543] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.543] GetLastError () returned 0x0
	[0159.543] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x6b9a, lpOverlapped=0x0) returned 1
	[0159.545] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x6ba0, lpOverlapped=0x0) returned 1
	[0159.547] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.547] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.547] SetEndOfFile (hFile=0x4bc) returned 1
	[0159.547] CloseHandle (hObject=0x4bc) returned 1
	[0159.547] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.547] SetEndOfFile (hFile=0x4fc) returned 1
	[0159.550] CloseHandle (hObject=0x4fc) returned 1
	[0159.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1
	[0159.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.551] lstrlenW (lpString=".doc") returned 4
	[0159.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.551] lstrlenW (lpString=".docx") returned 5
	[0159.551] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0159.551] lstrlenW (lpString=".pdf") returned 4
	[0159.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.551] lstrlenW (lpString=".xls") returned 4
	[0159.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.551] lstrlenW (lpString=".xlsx") returned 5
	[0159.552] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0159.552] lstrlenW (lpString=".ppt") returned 4
	[0159.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.552] lstrlenW (lpString=".zip") returned 4
	[0159.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.552] lstrlenW (lpString=".rar") returned 4
	[0159.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.552] lstrlenW (lpString=".bz2") returned 4
	[0159.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.552] lstrlenW (lpString=".7z") returned 3
	[0159.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.552] lstrlenW (lpString=".dbf") returned 4
	[0159.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.552] lstrlenW (lpString=".1cd") returned 4
	[0159.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.552] lstrlenW (lpString=".jpg") returned 4
	[0159.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.552] lstrlenW (lpString=".doc") returned 4
	[0159.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.552] lstrlenW (lpString=".docx") returned 5
	[0159.552] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0159.552] lstrlenW (lpString=".pdf") returned 4
	[0159.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.552] lstrlenW (lpString=".xls") returned 4
	[0159.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.553] lstrlenW (lpString=".xlsx") returned 5
	[0159.553] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0159.553] lstrlenW (lpString=".ppt") returned 4
	[0159.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.553] lstrlenW (lpString=".zip") returned 4
	[0159.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.553] lstrlenW (lpString=".rar") returned 4
	[0159.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.553] lstrlenW (lpString=".bz2") returned 4
	[0159.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.553] lstrlenW (lpString=".7z") returned 3
	[0159.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.553] lstrlenW (lpString=".dbf") returned 4
	[0159.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.553] lstrlenW (lpString=".1cd") returned 4
	[0159.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0159.553] lstrlenW (lpString=".jpg") returned 4
	[0159.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.553] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.553] lstrlenW (lpString="J0099160.JPG") returned 12
	[0159.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.554] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=15145) returned 1
	[0159.554] CloseHandle (hObject=0x4fc) returned 1
	[0159.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220
	[0159.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0159.555] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.555] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.555] GetLastError () returned 0x0
	[0159.556] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x3b29, lpOverlapped=0x0) returned 1
	[0159.557] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x3b30, lpOverlapped=0x0) returned 1
	[0159.558] ReadFile (in: hFile=0x4fc, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.558] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.559] SetEndOfFile (hFile=0x4bc) returned 1
	[0159.559] CloseHandle (hObject=0x4bc) returned 1
	[0159.559] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.559] SetEndOfFile (hFile=0x4fc) returned 1
	[0159.989] CloseHandle (hObject=0x4fc) returned 1
	[0159.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0160.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1
	[0160.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.701] lstrlenW (lpString=".doc") returned 4
	[0160.701] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.701] lstrlenW (lpString=".docx") returned 5
	[0160.701] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0160.701] lstrlenW (lpString=".pdf") returned 4
	[0160.701] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.701] lstrlenW (lpString=".xls") returned 4
	[0160.701] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.702] lstrlenW (lpString=".xlsx") returned 5
	[0160.702] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0160.702] lstrlenW (lpString=".ppt") returned 4
	[0160.702] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.702] lstrlenW (lpString=".zip") returned 4
	[0160.702] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.702] lstrlenW (lpString=".rar") returned 4
	[0160.702] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.702] lstrlenW (lpString=".bz2") returned 4
	[0160.702] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.702] lstrlenW (lpString=".7z") returned 3
	[0160.702] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.702] lstrlenW (lpString=".dbf") returned 4
	[0160.702] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.702] lstrlenW (lpString=".1cd") returned 4
	[0160.702] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.702] lstrlenW (lpString=".jpg") returned 4
	[0160.702] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.702] lstrlenW (lpString=".doc") returned 4
	[0160.702] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.702] lstrlenW (lpString=".docx") returned 5
	[0160.702] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0160.702] lstrlenW (lpString=".pdf") returned 4
	[0160.702] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.703] lstrlenW (lpString=".xls") returned 4
	[0160.703] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.703] lstrlenW (lpString=".xlsx") returned 5
	[0160.703] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0160.703] lstrlenW (lpString=".ppt") returned 4
	[0160.703] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.703] lstrlenW (lpString=".zip") returned 4
	[0160.703] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.703] lstrlenW (lpString=".rar") returned 4
	[0160.703] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.703] lstrlenW (lpString=".bz2") returned 4
	[0160.703] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.703] lstrlenW (lpString=".7z") returned 3
	[0160.703] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.703] lstrlenW (lpString=".dbf") returned 4
	[0160.703] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.703] lstrlenW (lpString=".1cd") returned 4
	[0160.703] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0160.703] lstrlenW (lpString=".jpg") returned 4
	[0160.703] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.703] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0160.703] lstrlenW (lpString="J0099172.WMF") returned 12
	[0160.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0160.872] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=58258) returned 1
	[0160.872] CloseHandle (hObject=0x44c) returned 1
	[0160.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220
	[0160.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0161.774] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.774] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0161.775] GetLastError () returned 0x0
	[0161.775] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0xe392, lpOverlapped=0x0) returned 1
	[0161.778] WriteFile (in: hFile=0x44c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xe3a0, lpOverlapped=0x0) returned 1
	[0161.780] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.780] WriteFile (in: hFile=0x44c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.780] SetEndOfFile (hFile=0x44c) returned 1
	[0161.781] CloseHandle (hObject=0x44c) returned 1
	[0161.781] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.781] SetEndOfFile (hFile=0x4f0) returned 1
	[0161.784] CloseHandle (hObject=0x4f0) returned 1
	[0161.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1
	[0161.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.785] lstrlenW (lpString=".doc") returned 4
	[0161.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.785] lstrlenW (lpString=".docx") returned 5
	[0161.785] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0161.785] lstrlenW (lpString=".pdf") returned 4
	[0161.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.786] lstrlenW (lpString=".xls") returned 4
	[0161.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.786] lstrlenW (lpString=".xlsx") returned 5
	[0161.786] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0161.786] lstrlenW (lpString=".ppt") returned 4
	[0161.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.786] lstrlenW (lpString=".zip") returned 4
	[0161.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.786] lstrlenW (lpString=".rar") returned 4
	[0161.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.786] lstrlenW (lpString=".bz2") returned 4
	[0161.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.786] lstrlenW (lpString=".7z") returned 3
	[0161.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.786] lstrlenW (lpString=".dbf") returned 4
	[0161.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.786] lstrlenW (lpString=".1cd") returned 4
	[0161.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.786] lstrlenW (lpString=".jpg") returned 4
	[0161.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.786] lstrlenW (lpString=".doc") returned 4
	[0161.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.786] lstrlenW (lpString=".docx") returned 5
	[0161.786] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0161.787] lstrlenW (lpString=".pdf") returned 4
	[0161.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.787] lstrlenW (lpString=".xls") returned 4
	[0161.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.787] lstrlenW (lpString=".xlsx") returned 5
	[0161.787] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0161.787] lstrlenW (lpString=".ppt") returned 4
	[0161.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.787] lstrlenW (lpString=".zip") returned 4
	[0161.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.787] lstrlenW (lpString=".rar") returned 4
	[0161.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.787] lstrlenW (lpString=".bz2") returned 4
	[0161.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.787] lstrlenW (lpString=".7z") returned 3
	[0161.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.787] lstrlenW (lpString=".dbf") returned 4
	[0161.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.787] lstrlenW (lpString=".1cd") returned 4
	[0161.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0161.787] lstrlenW (lpString=".jpg") returned 4
	[0161.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.787] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0161.788] lstrlenW (lpString="J0099175.WMF") returned 12
	[0161.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0161.788] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=9744) returned 1
	[0161.788] CloseHandle (hObject=0x4f0) returned 1
	[0161.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220
	[0161.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0161.789] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.789] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0161.790] GetLastError () returned 0x0
	[0161.790] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x2610, lpOverlapped=0x0) returned 1
	[0161.792] WriteFile (in: hFile=0x44c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2620, lpOverlapped=0x0) returned 1
	[0161.793] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.793] WriteFile (in: hFile=0x44c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.793] SetEndOfFile (hFile=0x44c) returned 1
	[0161.793] CloseHandle (hObject=0x44c) returned 1
	[0161.793] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.793] SetEndOfFile (hFile=0x4f0) returned 1
	[0161.796] CloseHandle (hObject=0x4f0) returned 1
	[0161.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1
	[0161.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.797] lstrlenW (lpString=".doc") returned 4
	[0161.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.797] lstrlenW (lpString=".docx") returned 5
	[0161.797] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0161.797] lstrlenW (lpString=".pdf") returned 4
	[0161.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.797] lstrlenW (lpString=".xls") returned 4
	[0161.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.797] lstrlenW (lpString=".xlsx") returned 5
	[0161.798] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0161.798] lstrlenW (lpString=".ppt") returned 4
	[0161.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.798] lstrlenW (lpString=".zip") returned 4
	[0161.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.798] lstrlenW (lpString=".rar") returned 4
	[0161.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.798] lstrlenW (lpString=".bz2") returned 4
	[0161.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.798] lstrlenW (lpString=".7z") returned 3
	[0161.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.798] lstrlenW (lpString=".dbf") returned 4
	[0161.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.798] lstrlenW (lpString=".1cd") returned 4
	[0161.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.798] lstrlenW (lpString=".jpg") returned 4
	[0161.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.798] lstrlenW (lpString=".doc") returned 4
	[0161.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.798] lstrlenW (lpString=".docx") returned 5
	[0161.798] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0161.798] lstrlenW (lpString=".pdf") returned 4
	[0161.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.798] lstrlenW (lpString=".xls") returned 4
	[0161.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.799] lstrlenW (lpString=".xlsx") returned 5
	[0161.799] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0161.799] lstrlenW (lpString=".ppt") returned 4
	[0161.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.799] lstrlenW (lpString=".zip") returned 4
	[0161.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.799] lstrlenW (lpString=".rar") returned 4
	[0161.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.799] lstrlenW (lpString=".bz2") returned 4
	[0161.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.799] lstrlenW (lpString=".7z") returned 3
	[0161.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.799] lstrlenW (lpString=".dbf") returned 4
	[0161.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.799] lstrlenW (lpString=".1cd") returned 4
	[0161.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0161.799] lstrlenW (lpString=".jpg") returned 4
	[0161.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.800] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0161.800] lstrlenW (lpString="J0099176.WMF") returned 12
	[0161.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0161.800] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=2488) returned 1
	[0161.800] CloseHandle (hObject=0x4f0) returned 1
	[0161.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220
	[0161.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0161.801] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.801] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0161.806] GetLastError () returned 0x0
	[0161.807] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x9b8, lpOverlapped=0x0) returned 1
	[0161.816] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0161.817] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.817] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.817] SetEndOfFile (hFile=0x52c) returned 1
	[0161.817] CloseHandle (hObject=0x52c) returned 1
	[0161.822] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.822] SetEndOfFile (hFile=0x4f0) returned 1
	[0161.824] CloseHandle (hObject=0x4f0) returned 1
	[0161.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1
	[0161.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.825] lstrlenW (lpString=".doc") returned 4
	[0161.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.825] lstrlenW (lpString=".docx") returned 5
	[0161.825] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0161.825] lstrlenW (lpString=".pdf") returned 4
	[0161.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.825] lstrlenW (lpString=".xls") returned 4
	[0161.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.825] lstrlenW (lpString=".xlsx") returned 5
	[0161.825] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0161.825] lstrlenW (lpString=".ppt") returned 4
	[0161.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.825] lstrlenW (lpString=".zip") returned 4
	[0161.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.825] lstrlenW (lpString=".rar") returned 4
	[0161.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.825] lstrlenW (lpString=".bz2") returned 4
	[0161.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.825] lstrlenW (lpString=".7z") returned 3
	[0161.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.826] lstrlenW (lpString=".dbf") returned 4
	[0161.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.826] lstrlenW (lpString=".1cd") returned 4
	[0161.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.826] lstrlenW (lpString=".jpg") returned 4
	[0161.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.826] lstrlenW (lpString=".doc") returned 4
	[0161.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.826] lstrlenW (lpString=".docx") returned 5
	[0161.826] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0161.826] lstrlenW (lpString=".pdf") returned 4
	[0161.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.826] lstrlenW (lpString=".xls") returned 4
	[0161.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.826] lstrlenW (lpString=".xlsx") returned 5
	[0161.826] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0161.826] lstrlenW (lpString=".ppt") returned 4
	[0161.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.826] lstrlenW (lpString=".zip") returned 4
	[0161.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.826] lstrlenW (lpString=".rar") returned 4
	[0161.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.826] lstrlenW (lpString=".bz2") returned 4
	[0161.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.826] lstrlenW (lpString=".7z") returned 3
	[0161.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.827] lstrlenW (lpString=".dbf") returned 4
	[0161.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.827] lstrlenW (lpString=".1cd") returned 4
	[0161.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0161.827] lstrlenW (lpString=".jpg") returned 4
	[0161.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.827] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0161.827] lstrlenW (lpString="J0099178.WMF") returned 12
	[0161.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0161.827] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=3606) returned 1
	[0161.827] CloseHandle (hObject=0x4f0) returned 1
	[0161.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220
	[0161.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0161.828] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.828] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0161.829] GetLastError () returned 0x0
	[0161.829] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0xe16, lpOverlapped=0x0) returned 1
	[0162.228] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xe20, lpOverlapped=0x0) returned 1
	[0162.229] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.229] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.229] SetEndOfFile (hFile=0x52c) returned 1
	[0162.230] CloseHandle (hObject=0x52c) returned 1
	[0162.230] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.230] SetEndOfFile (hFile=0x4f0) returned 1
	[0162.232] CloseHandle (hObject=0x4f0) returned 1
	[0162.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1
	[0162.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.233] lstrlenW (lpString=".doc") returned 4
	[0162.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0162.234] lstrlenW (lpString=".docx") returned 5
	[0162.234] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0162.234] lstrlenW (lpString=".pdf") returned 4
	[0162.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0162.234] lstrlenW (lpString=".xls") returned 4
	[0162.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0162.234] lstrlenW (lpString=".xlsx") returned 5
	[0162.234] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0162.234] lstrlenW (lpString=".ppt") returned 4
	[0162.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0162.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.234] lstrlenW (lpString=".zip") returned 4
	[0162.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0162.234] lstrlenW (lpString=".rar") returned 4
	[0162.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0162.234] lstrlenW (lpString=".bz2") returned 4
	[0162.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0162.234] lstrlenW (lpString=".7z") returned 3
	[0162.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0162.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.234] lstrlenW (lpString=".dbf") returned 4
	[0162.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0162.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.234] lstrlenW (lpString=".1cd") returned 4
	[0162.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0162.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.234] lstrlenW (lpString=".jpg") returned 4
	[0162.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0162.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.235] lstrlenW (lpString=".doc") returned 4
	[0162.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0162.235] lstrlenW (lpString=".docx") returned 5
	[0162.235] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0162.235] lstrlenW (lpString=".pdf") returned 4
	[0162.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0162.235] lstrlenW (lpString=".xls") returned 4
	[0162.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0162.235] lstrlenW (lpString=".xlsx") returned 5
	[0162.235] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0162.235] lstrlenW (lpString=".ppt") returned 4
	[0162.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0162.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.235] lstrlenW (lpString=".zip") returned 4
	[0162.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0162.235] lstrlenW (lpString=".rar") returned 4
	[0162.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0162.235] lstrlenW (lpString=".bz2") returned 4
	[0162.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0162.235] lstrlenW (lpString=".7z") returned 3
	[0162.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0162.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.235] lstrlenW (lpString=".dbf") returned 4
	[0162.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0162.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.235] lstrlenW (lpString=".1cd") returned 4
	[0162.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0162.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0162.235] lstrlenW (lpString=".jpg") returned 4
	[0162.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0162.236] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0162.236] lstrlenW (lpString="J0099187.JPG") returned 12
	[0162.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0162.246] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=24528) returned 1
	[0162.246] CloseHandle (hObject=0x4f0) returned 1
	[0162.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220
	[0162.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0162.246] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.246] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.247] GetLastError () returned 0x0
	[0162.247] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x5fd0, lpOverlapped=0x0) returned 1
	[0162.249] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x5fe0, lpOverlapped=0x0) returned 1
	[0162.250] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.251] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.251] SetEndOfFile (hFile=0x52c) returned 1
	[0162.251] CloseHandle (hObject=0x52c) returned 1
	[0162.251] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.251] SetEndOfFile (hFile=0x4f0) returned 1
	[0162.254] CloseHandle (hObject=0x4f0) returned 1
	[0162.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1
	[0162.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.255] lstrlenW (lpString=".doc") returned 4
	[0162.255] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.255] lstrlenW (lpString=".docx") returned 5
	[0162.255] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0162.255] lstrlenW (lpString=".pdf") returned 4
	[0162.255] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.255] lstrlenW (lpString=".xls") returned 4
	[0162.255] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.255] lstrlenW (lpString=".xlsx") returned 5
	[0162.256] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0162.256] lstrlenW (lpString=".ppt") returned 4
	[0162.256] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.256] lstrlenW (lpString=".zip") returned 4
	[0162.256] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.256] lstrlenW (lpString=".rar") returned 4
	[0162.256] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.256] lstrlenW (lpString=".bz2") returned 4
	[0162.256] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.256] lstrlenW (lpString=".7z") returned 3
	[0162.256] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.256] lstrlenW (lpString=".dbf") returned 4
	[0162.256] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.256] lstrlenW (lpString=".1cd") returned 4
	[0162.256] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.256] lstrlenW (lpString=".jpg") returned 4
	[0162.256] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.256] lstrlenW (lpString=".doc") returned 4
	[0162.256] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.256] lstrlenW (lpString=".docx") returned 5
	[0162.256] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0162.256] lstrlenW (lpString=".pdf") returned 4
	[0162.256] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.256] lstrlenW (lpString=".xls") returned 4
	[0162.257] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.257] lstrlenW (lpString=".xlsx") returned 5
	[0162.257] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0162.257] lstrlenW (lpString=".ppt") returned 4
	[0162.257] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.257] lstrlenW (lpString=".zip") returned 4
	[0162.257] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.257] lstrlenW (lpString=".rar") returned 4
	[0162.257] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.257] lstrlenW (lpString=".bz2") returned 4
	[0162.257] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.257] lstrlenW (lpString=".7z") returned 3
	[0162.257] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.257] lstrlenW (lpString=".dbf") returned 4
	[0162.257] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.257] lstrlenW (lpString=".1cd") returned 4
	[0162.257] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0162.257] lstrlenW (lpString=".jpg") returned 4
	[0162.257] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.257] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0162.257] lstrlenW (lpString="J0099188.JPG") returned 12
	[0162.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0162.258] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=9080) returned 1
	[0162.258] CloseHandle (hObject=0x4f0) returned 1
	[0162.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220
	[0162.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0162.258] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.259] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.259] GetLastError () returned 0x0
	[0162.259] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x2378, lpOverlapped=0x0) returned 1
	[0162.261] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2380, lpOverlapped=0x0) returned 1
	[0162.262] ReadFile (in: hFile=0x4f0, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.262] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.262] SetEndOfFile (hFile=0x52c) returned 1
	[0162.262] CloseHandle (hObject=0x52c) returned 1
	[0162.262] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.262] SetEndOfFile (hFile=0x4f0) returned 1
	[0162.265] CloseHandle (hObject=0x4f0) returned 1
	[0162.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1
	[0162.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.266] lstrlenW (lpString=".doc") returned 4
	[0162.266] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.266] lstrlenW (lpString=".docx") returned 5
	[0162.266] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0162.266] lstrlenW (lpString=".pdf") returned 4
	[0162.266] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.266] lstrlenW (lpString=".xls") returned 4
	[0162.266] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.266] lstrlenW (lpString=".xlsx") returned 5
	[0162.266] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0162.266] lstrlenW (lpString=".ppt") returned 4
	[0162.266] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.266] lstrlenW (lpString=".zip") returned 4
	[0162.266] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.267] lstrlenW (lpString=".rar") returned 4
	[0162.267] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.267] lstrlenW (lpString=".bz2") returned 4
	[0162.267] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.267] lstrlenW (lpString=".7z") returned 3
	[0162.267] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.267] lstrlenW (lpString=".dbf") returned 4
	[0162.267] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.267] lstrlenW (lpString=".1cd") returned 4
	[0162.267] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.267] lstrlenW (lpString=".jpg") returned 4
	[0162.267] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.267] lstrlenW (lpString=".doc") returned 4
	[0162.267] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.267] lstrlenW (lpString=".docx") returned 5
	[0162.267] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0162.267] lstrlenW (lpString=".pdf") returned 4
	[0162.267] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.267] lstrlenW (lpString=".xls") returned 4
	[0162.267] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.644] lstrlenW (lpString=".xlsx") returned 5
	[0162.644] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0162.644] lstrlenW (lpString=".ppt") returned 4
	[0162.644] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.645] lstrlenW (lpString=".zip") returned 4
	[0162.645] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.645] lstrlenW (lpString=".rar") returned 4
	[0162.645] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.645] lstrlenW (lpString=".bz2") returned 4
	[0162.645] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.645] lstrlenW (lpString=".7z") returned 3
	[0162.645] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.645] lstrlenW (lpString=".dbf") returned 4
	[0162.645] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.645] lstrlenW (lpString=".1cd") returned 4
	[0162.645] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0162.645] lstrlenW (lpString=".jpg") returned 4
	[0162.645] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.645] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.645] lstrlenW (lpString="J0099198.GIF") returned 12
	[0162.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0162.646] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=5259) returned 1
	[0162.646] CloseHandle (hObject=0x550) returned 1
	[0162.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220
	[0162.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0162.647] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.647] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0162.648] GetLastError () returned 0x0
	[0162.648] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x148b, lpOverlapped=0x0) returned 1
	[0162.649] WriteFile (in: hFile=0x55c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1490, lpOverlapped=0x0) returned 1
	[0162.650] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.650] WriteFile (in: hFile=0x55c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.650] SetEndOfFile (hFile=0x55c) returned 1
	[0162.650] CloseHandle (hObject=0x55c) returned 1
	[0162.651] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.651] SetEndOfFile (hFile=0x550) returned 1
	[0162.653] CloseHandle (hObject=0x550) returned 1
	[0162.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1
	[0162.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.654] lstrlenW (lpString=".doc") returned 4
	[0162.654] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.654] lstrlenW (lpString=".docx") returned 5
	[0162.654] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0162.654] lstrlenW (lpString=".pdf") returned 4
	[0162.654] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.654] lstrlenW (lpString=".xls") returned 4
	[0162.655] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.655] lstrlenW (lpString=".xlsx") returned 5
	[0162.655] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0162.655] lstrlenW (lpString=".ppt") returned 4
	[0162.655] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.655] lstrlenW (lpString=".zip") returned 4
	[0162.655] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.655] lstrlenW (lpString=".rar") returned 4
	[0162.655] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.655] lstrlenW (lpString=".bz2") returned 4
	[0162.655] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.655] lstrlenW (lpString=".7z") returned 3
	[0162.655] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.655] lstrlenW (lpString=".dbf") returned 4
	[0162.655] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.655] lstrlenW (lpString=".1cd") returned 4
	[0162.655] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.655] lstrlenW (lpString=".jpg") returned 4
	[0162.655] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.655] lstrlenW (lpString=".doc") returned 4
	[0162.655] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.655] lstrlenW (lpString=".docx") returned 5
	[0162.655] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0162.655] lstrlenW (lpString=".pdf") returned 4
	[0162.655] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.656] lstrlenW (lpString=".xls") returned 4
	[0162.656] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.656] lstrlenW (lpString=".xlsx") returned 5
	[0162.656] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0162.656] lstrlenW (lpString=".ppt") returned 4
	[0162.656] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.656] lstrlenW (lpString=".zip") returned 4
	[0162.656] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.656] lstrlenW (lpString=".rar") returned 4
	[0162.656] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.656] lstrlenW (lpString=".bz2") returned 4
	[0162.656] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.656] lstrlenW (lpString=".7z") returned 3
	[0162.656] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.656] lstrlenW (lpString=".dbf") returned 4
	[0162.656] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.656] lstrlenW (lpString=".1cd") returned 4
	[0162.656] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0162.656] lstrlenW (lpString=".jpg") returned 4
	[0162.656] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.656] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.656] lstrlenW (lpString="J0099199.GIF") returned 12
	[0162.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0162.657] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=33975) returned 1
	[0162.657] CloseHandle (hObject=0x550) returned 1
	[0162.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220
	[0162.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0162.658] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.658] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0162.659] GetLastError () returned 0x0
	[0162.659] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x84b7, lpOverlapped=0x0) returned 1
	[0162.661] WriteFile (in: hFile=0x55c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x84c0, lpOverlapped=0x0) returned 1
	[0162.663] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.663] WriteFile (in: hFile=0x55c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.663] SetEndOfFile (hFile=0x55c) returned 1
	[0162.663] CloseHandle (hObject=0x55c) returned 1
	[0162.663] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.664] SetEndOfFile (hFile=0x550) returned 1
	[0162.669] CloseHandle (hObject=0x550) returned 1
	[0162.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1
	[0162.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.670] lstrlenW (lpString=".doc") returned 4
	[0162.670] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.670] lstrlenW (lpString=".docx") returned 5
	[0162.670] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1
	[0162.671] lstrlenW (lpString=".pdf") returned 4
	[0162.671] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.671] lstrlenW (lpString=".xls") returned 4
	[0162.671] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.671] lstrlenW (lpString=".xlsx") returned 5
	[0162.671] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1
	[0162.671] lstrlenW (lpString=".ppt") returned 4
	[0162.671] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.671] lstrlenW (lpString=".zip") returned 4
	[0162.671] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.671] lstrlenW (lpString=".rar") returned 4
	[0162.671] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.671] lstrlenW (lpString=".bz2") returned 4
	[0162.671] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.671] lstrlenW (lpString=".7z") returned 3
	[0162.671] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.671] lstrlenW (lpString=".dbf") returned 4
	[0162.671] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.671] lstrlenW (lpString=".1cd") returned 4
	[0162.671] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.671] lstrlenW (lpString=".jpg") returned 4
	[0162.671] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.671] lstrlenW (lpString=".doc") returned 4
	[0162.671] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.671] lstrlenW (lpString=".docx") returned 5
	[0162.672] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1
	[0162.672] lstrlenW (lpString=".pdf") returned 4
	[0162.672] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.672] lstrlenW (lpString=".xls") returned 4
	[0162.672] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.672] lstrlenW (lpString=".xlsx") returned 5
	[0162.672] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1
	[0162.672] lstrlenW (lpString=".ppt") returned 4
	[0162.672] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.672] lstrlenW (lpString=".zip") returned 4
	[0162.672] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.672] lstrlenW (lpString=".rar") returned 4
	[0162.672] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.672] lstrlenW (lpString=".bz2") returned 4
	[0162.672] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.672] lstrlenW (lpString=".7z") returned 3
	[0162.672] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.672] lstrlenW (lpString=".dbf") returned 4
	[0162.672] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.672] lstrlenW (lpString=".1cd") returned 4
	[0162.672] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0162.672] lstrlenW (lpString=".jpg") returned 4
	[0162.672] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.673] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.673] lstrlenW (lpString="J0099200.GIF") returned 12
	[0162.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0162.673] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=16543) returned 1
	[0162.673] CloseHandle (hObject=0x550) returned 1
	[0162.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220
	[0162.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0162.674] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.674] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0162.675] GetLastError () returned 0x0
	[0162.675] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x409f, lpOverlapped=0x0) returned 1
	[0162.677] WriteFile (in: hFile=0x55c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x40a0, lpOverlapped=0x0) returned 1
	[0162.678] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.678] WriteFile (in: hFile=0x55c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.678] SetEndOfFile (hFile=0x55c) returned 1
	[0162.679] CloseHandle (hObject=0x55c) returned 1
	[0162.679] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.679] SetEndOfFile (hFile=0x550) returned 1
	[0162.681] CloseHandle (hObject=0x550) returned 1
	[0162.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1
	[0162.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.683] lstrlenW (lpString=".doc") returned 4
	[0162.683] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.683] lstrlenW (lpString=".docx") returned 5
	[0162.683] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1
	[0162.683] lstrlenW (lpString=".pdf") returned 4
	[0162.683] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.683] lstrlenW (lpString=".xls") returned 4
	[0162.683] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.683] lstrlenW (lpString=".xlsx") returned 5
	[0162.683] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1
	[0162.683] lstrlenW (lpString=".ppt") returned 4
	[0162.683] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.683] lstrlenW (lpString=".zip") returned 4
	[0162.683] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.683] lstrlenW (lpString=".rar") returned 4
	[0162.683] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.683] lstrlenW (lpString=".bz2") returned 4
	[0162.683] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.683] lstrlenW (lpString=".7z") returned 3
	[0162.683] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.683] lstrlenW (lpString=".dbf") returned 4
	[0162.683] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.683] lstrlenW (lpString=".1cd") returned 4
	[0162.683] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.683] lstrlenW (lpString=".jpg") returned 4
	[0162.683] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.684] lstrlenW (lpString=".doc") returned 4
	[0162.684] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.684] lstrlenW (lpString=".docx") returned 5
	[0162.684] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1
	[0162.684] lstrlenW (lpString=".pdf") returned 4
	[0162.684] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.684] lstrlenW (lpString=".xls") returned 4
	[0162.684] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.684] lstrlenW (lpString=".xlsx") returned 5
	[0162.684] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1
	[0162.684] lstrlenW (lpString=".ppt") returned 4
	[0162.684] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.684] lstrlenW (lpString=".zip") returned 4
	[0162.684] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.684] lstrlenW (lpString=".rar") returned 4
	[0162.684] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.684] lstrlenW (lpString=".bz2") returned 4
	[0162.684] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.684] lstrlenW (lpString=".7z") returned 3
	[0162.684] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.684] lstrlenW (lpString=".dbf") returned 4
	[0162.684] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.684] lstrlenW (lpString=".1cd") returned 4
	[0162.684] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0162.684] lstrlenW (lpString=".jpg") returned 4
	[0162.685] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.685] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.685] lstrlenW (lpString="J0099201.GIF") returned 12
	[0162.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0162.685] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=51401) returned 1
	[0162.685] CloseHandle (hObject=0x550) returned 1
	[0162.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220
	[0162.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0162.686] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.686] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0162.687] GetLastError () returned 0x0
	[0162.687] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0xc8c9, lpOverlapped=0x0) returned 1
	[0162.994] WriteFile (in: hFile=0x55c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xc8d0, lpOverlapped=0x0) returned 1
	[0162.995] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.995] WriteFile (in: hFile=0x55c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.995] SetEndOfFile (hFile=0x55c) returned 1
	[0163.017] CloseHandle (hObject=0x55c) returned 1
	[0163.017] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.017] SetEndOfFile (hFile=0x550) returned 1
	[0163.407] CloseHandle (hObject=0x550) returned 1
	[0163.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1
	[0163.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.409] lstrlenW (lpString=".doc") returned 4
	[0163.409] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0163.409] lstrlenW (lpString=".docx") returned 5
	[0163.409] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1
	[0163.409] lstrlenW (lpString=".pdf") returned 4
	[0163.409] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0163.409] lstrlenW (lpString=".xls") returned 4
	[0163.409] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0163.409] lstrlenW (lpString=".xlsx") returned 5
	[0163.409] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1
	[0163.409] lstrlenW (lpString=".ppt") returned 4
	[0163.409] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0163.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.409] lstrlenW (lpString=".zip") returned 4
	[0163.410] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0163.410] lstrlenW (lpString=".rar") returned 4
	[0163.410] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0163.410] lstrlenW (lpString=".bz2") returned 4
	[0163.410] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0163.410] lstrlenW (lpString=".7z") returned 3
	[0163.410] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0163.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.410] lstrlenW (lpString=".dbf") returned 4
	[0163.410] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0163.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.410] lstrlenW (lpString=".1cd") returned 4
	[0163.410] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0163.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.410] lstrlenW (lpString=".jpg") returned 4
	[0163.410] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0163.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.410] lstrlenW (lpString=".doc") returned 4
	[0163.410] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0163.410] lstrlenW (lpString=".docx") returned 5
	[0163.410] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1
	[0163.410] lstrlenW (lpString=".pdf") returned 4
	[0163.410] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0163.410] lstrlenW (lpString=".xls") returned 4
	[0163.410] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0163.410] lstrlenW (lpString=".xlsx") returned 5
	[0163.410] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1
	[0163.410] lstrlenW (lpString=".ppt") returned 4
	[0163.410] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0163.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.411] lstrlenW (lpString=".zip") returned 4
	[0163.411] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0163.411] lstrlenW (lpString=".rar") returned 4
	[0163.411] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0163.411] lstrlenW (lpString=".bz2") returned 4
	[0163.411] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0163.411] lstrlenW (lpString=".7z") returned 3
	[0163.411] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0163.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.411] lstrlenW (lpString=".dbf") returned 4
	[0163.411] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0163.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.411] lstrlenW (lpString=".1cd") returned 4
	[0163.411] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0163.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0163.411] lstrlenW (lpString=".jpg") returned 4
	[0163.411] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0163.411] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0163.411] lstrlenW (lpString="J0101864.BMP") returned 12
	[0163.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.412] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=31968) returned 1
	[0163.412] CloseHandle (hObject=0x550) returned 1
	[0163.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220
	[0163.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.412] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.413] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.413] GetLastError () returned 0x0
	[0163.413] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x7ce0, lpOverlapped=0x0) returned 1
	[0163.416] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x7cf0, lpOverlapped=0x0) returned 1
	[0163.417] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.417] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.417] SetEndOfFile (hFile=0x554) returned 1
	[0163.417] CloseHandle (hObject=0x554) returned 1
	[0163.417] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.417] SetEndOfFile (hFile=0x550) returned 1
	[0163.421] CloseHandle (hObject=0x550) returned 1
	[0163.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1
	[0163.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.422] lstrlenW (lpString=".doc") returned 4
	[0163.422] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.422] lstrlenW (lpString=".docx") returned 5
	[0163.422] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1
	[0163.422] lstrlenW (lpString=".pdf") returned 4
	[0163.422] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.422] lstrlenW (lpString=".xls") returned 4
	[0163.422] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.422] lstrlenW (lpString=".xlsx") returned 5
	[0163.422] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1
	[0163.422] lstrlenW (lpString=".ppt") returned 4
	[0163.422] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.422] lstrlenW (lpString=".zip") returned 4
	[0163.422] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.422] lstrlenW (lpString=".rar") returned 4
	[0163.422] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.422] lstrlenW (lpString=".bz2") returned 4
	[0163.422] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.422] lstrlenW (lpString=".7z") returned 3
	[0163.422] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.423] lstrlenW (lpString=".dbf") returned 4
	[0163.423] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.423] lstrlenW (lpString=".1cd") returned 4
	[0163.423] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.423] lstrlenW (lpString=".jpg") returned 4
	[0163.423] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.423] lstrlenW (lpString=".doc") returned 4
	[0163.423] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.423] lstrlenW (lpString=".docx") returned 5
	[0163.423] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1
	[0163.423] lstrlenW (lpString=".pdf") returned 4
	[0163.423] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.423] lstrlenW (lpString=".xls") returned 4
	[0163.423] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.423] lstrlenW (lpString=".xlsx") returned 5
	[0163.423] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1
	[0163.423] lstrlenW (lpString=".ppt") returned 4
	[0163.423] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.423] lstrlenW (lpString=".zip") returned 4
	[0163.423] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.423] lstrlenW (lpString=".rar") returned 4
	[0163.423] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.423] lstrlenW (lpString=".bz2") returned 4
	[0163.423] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.424] lstrlenW (lpString=".7z") returned 3
	[0163.424] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.424] lstrlenW (lpString=".dbf") returned 4
	[0163.424] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.424] lstrlenW (lpString=".1cd") returned 4
	[0163.424] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0163.424] lstrlenW (lpString=".jpg") returned 4
	[0163.424] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.424] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0163.424] lstrlenW (lpString="J0101865.BMP") returned 12
	[0163.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.425] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=32184) returned 1
	[0163.426] CloseHandle (hObject=0x550) returned 1
	[0163.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220
	[0163.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.426] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.426] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.427] GetLastError () returned 0x0
	[0163.427] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0163.429] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0163.431] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.431] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.431] SetEndOfFile (hFile=0x554) returned 1
	[0163.431] CloseHandle (hObject=0x554) returned 1
	[0163.431] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.431] SetEndOfFile (hFile=0x550) returned 1
	[0163.434] CloseHandle (hObject=0x550) returned 1
	[0163.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1
	[0163.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.435] lstrlenW (lpString=".doc") returned 4
	[0163.435] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.435] lstrlenW (lpString=".docx") returned 5
	[0163.435] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1
	[0163.435] lstrlenW (lpString=".pdf") returned 4
	[0163.435] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.435] lstrlenW (lpString=".xls") returned 4
	[0163.435] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.435] lstrlenW (lpString=".xlsx") returned 5
	[0163.435] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1
	[0163.435] lstrlenW (lpString=".ppt") returned 4
	[0163.435] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.435] lstrlenW (lpString=".zip") returned 4
	[0163.435] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.435] lstrlenW (lpString=".rar") returned 4
	[0163.436] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.436] lstrlenW (lpString=".bz2") returned 4
	[0163.436] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.436] lstrlenW (lpString=".7z") returned 3
	[0163.436] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.436] lstrlenW (lpString=".dbf") returned 4
	[0163.436] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.436] lstrlenW (lpString=".1cd") returned 4
	[0163.436] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.436] lstrlenW (lpString=".jpg") returned 4
	[0163.436] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.436] lstrlenW (lpString=".doc") returned 4
	[0163.436] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.436] lstrlenW (lpString=".docx") returned 5
	[0163.436] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1
	[0163.436] lstrlenW (lpString=".pdf") returned 4
	[0163.436] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.436] lstrlenW (lpString=".xls") returned 4
	[0163.436] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.436] lstrlenW (lpString=".xlsx") returned 5
	[0163.436] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1
	[0163.436] lstrlenW (lpString=".ppt") returned 4
	[0163.436] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.436] lstrlenW (lpString=".zip") returned 4
	[0163.437] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.437] lstrlenW (lpString=".rar") returned 4
	[0163.437] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.437] lstrlenW (lpString=".bz2") returned 4
	[0163.437] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.437] lstrlenW (lpString=".7z") returned 3
	[0163.437] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.437] lstrlenW (lpString=".dbf") returned 4
	[0163.437] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.437] lstrlenW (lpString=".1cd") returned 4
	[0163.437] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.437] lstrlenW (lpString=".jpg") returned 4
	[0163.437] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.437] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0163.437] lstrlenW (lpString="J0101866.BMP") returned 12
	[0163.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.438] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=32184) returned 1
	[0163.438] CloseHandle (hObject=0x550) returned 1
	[0163.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220
	[0163.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.439] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.439] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.439] GetLastError () returned 0x0
	[0163.818] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0163.821] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0163.822] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.822] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.822] SetEndOfFile (hFile=0x554) returned 1
	[0163.823] CloseHandle (hObject=0x554) returned 1
	[0163.823] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.823] SetEndOfFile (hFile=0x550) returned 1
	[0163.826] CloseHandle (hObject=0x550) returned 1
	[0163.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1
	[0163.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.827] lstrlenW (lpString=".doc") returned 4
	[0163.827] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.827] lstrlenW (lpString=".docx") returned 5
	[0163.827] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0163.827] lstrlenW (lpString=".pdf") returned 4
	[0163.827] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.827] lstrlenW (lpString=".xls") returned 4
	[0163.827] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.827] lstrlenW (lpString=".xlsx") returned 5
	[0163.827] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0163.827] lstrlenW (lpString=".ppt") returned 4
	[0163.827] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.828] lstrlenW (lpString=".zip") returned 4
	[0163.828] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.828] lstrlenW (lpString=".rar") returned 4
	[0163.828] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.828] lstrlenW (lpString=".bz2") returned 4
	[0163.828] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.828] lstrlenW (lpString=".7z") returned 3
	[0163.828] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.828] lstrlenW (lpString=".dbf") returned 4
	[0163.828] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.828] lstrlenW (lpString=".1cd") returned 4
	[0163.828] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.828] lstrlenW (lpString=".jpg") returned 4
	[0163.828] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.828] lstrlenW (lpString=".doc") returned 4
	[0163.828] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.828] lstrlenW (lpString=".docx") returned 5
	[0163.828] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0163.828] lstrlenW (lpString=".pdf") returned 4
	[0163.828] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.828] lstrlenW (lpString=".xls") returned 4
	[0163.828] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.828] lstrlenW (lpString=".xlsx") returned 5
	[0163.829] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0163.829] lstrlenW (lpString=".ppt") returned 4
	[0163.829] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.829] lstrlenW (lpString=".zip") returned 4
	[0163.829] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.829] lstrlenW (lpString=".rar") returned 4
	[0163.829] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.829] lstrlenW (lpString=".bz2") returned 4
	[0163.829] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.829] lstrlenW (lpString=".7z") returned 3
	[0163.829] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.829] lstrlenW (lpString=".dbf") returned 4
	[0163.829] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.829] lstrlenW (lpString=".1cd") returned 4
	[0163.829] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.829] lstrlenW (lpString=".jpg") returned 4
	[0163.829] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.829] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.829] lstrlenW (lpString="J0103812.WMF") returned 12
	[0163.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.830] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=5908) returned 1
	[0163.830] CloseHandle (hObject=0x550) returned 1
	[0163.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220
	[0163.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.831] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.831] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.832] GetLastError () returned 0x0
	[0163.832] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1714, lpOverlapped=0x0) returned 1
	[0163.833] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1720, lpOverlapped=0x0) returned 1
	[0163.834] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.835] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.835] SetEndOfFile (hFile=0x554) returned 1
	[0163.835] CloseHandle (hObject=0x554) returned 1
	[0163.835] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.835] SetEndOfFile (hFile=0x550) returned 1
	[0163.837] CloseHandle (hObject=0x550) returned 1
	[0163.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1
	[0163.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.840] lstrlenW (lpString=".doc") returned 4
	[0163.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.840] lstrlenW (lpString=".docx") returned 5
	[0163.840] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.840] lstrlenW (lpString=".pdf") returned 4
	[0163.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.840] lstrlenW (lpString=".xls") returned 4
	[0163.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.840] lstrlenW (lpString=".xlsx") returned 5
	[0163.840] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.840] lstrlenW (lpString=".ppt") returned 4
	[0163.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.840] lstrlenW (lpString=".zip") returned 4
	[0163.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.840] lstrlenW (lpString=".rar") returned 4
	[0163.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.840] lstrlenW (lpString=".bz2") returned 4
	[0163.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.840] lstrlenW (lpString=".7z") returned 3
	[0163.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.840] lstrlenW (lpString=".dbf") returned 4
	[0163.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.840] lstrlenW (lpString=".1cd") returned 4
	[0163.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.841] lstrlenW (lpString=".jpg") returned 4
	[0163.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.841] lstrlenW (lpString=".doc") returned 4
	[0163.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.841] lstrlenW (lpString=".docx") returned 5
	[0163.841] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.841] lstrlenW (lpString=".pdf") returned 4
	[0163.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.841] lstrlenW (lpString=".xls") returned 4
	[0163.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.841] lstrlenW (lpString=".xlsx") returned 5
	[0163.841] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.841] lstrlenW (lpString=".ppt") returned 4
	[0163.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.841] lstrlenW (lpString=".zip") returned 4
	[0163.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.841] lstrlenW (lpString=".rar") returned 4
	[0163.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.841] lstrlenW (lpString=".bz2") returned 4
	[0163.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.841] lstrlenW (lpString=".7z") returned 3
	[0163.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.841] lstrlenW (lpString=".dbf") returned 4
	[0163.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.842] lstrlenW (lpString=".1cd") returned 4
	[0163.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0163.842] lstrlenW (lpString=".jpg") returned 4
	[0163.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.842] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.842] lstrlenW (lpString="J0103850.WMF") returned 12
	[0163.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.843] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=23596) returned 1
	[0163.843] CloseHandle (hObject=0x550) returned 1
	[0163.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220
	[0163.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.844] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.844] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.844] GetLastError () returned 0x0
	[0163.845] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x5c2c, lpOverlapped=0x0) returned 1
	[0163.846] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x5c30, lpOverlapped=0x0) returned 1
	[0163.848] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.848] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.848] SetEndOfFile (hFile=0x554) returned 1
	[0163.848] CloseHandle (hObject=0x554) returned 1
	[0163.848] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.848] SetEndOfFile (hFile=0x550) returned 1
	[0163.851] CloseHandle (hObject=0x550) returned 1
	[0163.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1
	[0163.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.852] lstrlenW (lpString=".doc") returned 4
	[0163.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.852] lstrlenW (lpString=".docx") returned 5
	[0163.852] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0163.852] lstrlenW (lpString=".pdf") returned 4
	[0163.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.852] lstrlenW (lpString=".xls") returned 4
	[0163.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.852] lstrlenW (lpString=".xlsx") returned 5
	[0163.852] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0163.852] lstrlenW (lpString=".ppt") returned 4
	[0163.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.852] lstrlenW (lpString=".zip") returned 4
	[0163.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.852] lstrlenW (lpString=".rar") returned 4
	[0163.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.853] lstrlenW (lpString=".bz2") returned 4
	[0163.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.853] lstrlenW (lpString=".7z") returned 3
	[0163.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.853] lstrlenW (lpString=".dbf") returned 4
	[0163.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.853] lstrlenW (lpString=".1cd") returned 4
	[0163.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.853] lstrlenW (lpString=".jpg") returned 4
	[0163.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.853] lstrlenW (lpString=".doc") returned 4
	[0163.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.853] lstrlenW (lpString=".docx") returned 5
	[0163.853] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0163.853] lstrlenW (lpString=".pdf") returned 4
	[0163.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.853] lstrlenW (lpString=".xls") returned 4
	[0163.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.853] lstrlenW (lpString=".xlsx") returned 5
	[0163.853] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0163.853] lstrlenW (lpString=".ppt") returned 4
	[0163.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.853] lstrlenW (lpString=".zip") returned 4
	[0163.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.854] lstrlenW (lpString=".rar") returned 4
	[0163.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.854] lstrlenW (lpString=".bz2") returned 4
	[0163.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.854] lstrlenW (lpString=".7z") returned 3
	[0163.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.854] lstrlenW (lpString=".dbf") returned 4
	[0163.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.854] lstrlenW (lpString=".1cd") returned 4
	[0163.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0163.854] lstrlenW (lpString=".jpg") returned 4
	[0163.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.854] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.854] lstrlenW (lpString="J0105230.WMF") returned 12
	[0163.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.855] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=5172) returned 1
	[0163.855] CloseHandle (hObject=0x550) returned 1
	[0163.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220
	[0163.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0163.855] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.855] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.856] GetLastError () returned 0x0
	[0163.856] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1434, lpOverlapped=0x0) returned 1
	[0164.225] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1440, lpOverlapped=0x0) returned 1
	[0164.227] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.227] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.227] SetEndOfFile (hFile=0x554) returned 1
	[0164.263] CloseHandle (hObject=0x554) returned 1
	[0164.263] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.263] SetEndOfFile (hFile=0x550) returned 1
	[0164.266] CloseHandle (hObject=0x550) returned 1
	[0164.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1
	[0164.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.267] lstrlenW (lpString=".doc") returned 4
	[0164.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.267] lstrlenW (lpString=".docx") returned 5
	[0164.267] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0164.267] lstrlenW (lpString=".pdf") returned 4
	[0164.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.267] lstrlenW (lpString=".xls") returned 4
	[0164.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.267] lstrlenW (lpString=".xlsx") returned 5
	[0164.267] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0164.268] lstrlenW (lpString=".ppt") returned 4
	[0164.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.268] lstrlenW (lpString=".zip") returned 4
	[0164.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.268] lstrlenW (lpString=".rar") returned 4
	[0164.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.268] lstrlenW (lpString=".bz2") returned 4
	[0164.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.268] lstrlenW (lpString=".7z") returned 3
	[0164.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.268] lstrlenW (lpString=".dbf") returned 4
	[0164.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.268] lstrlenW (lpString=".1cd") returned 4
	[0164.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.268] lstrlenW (lpString=".jpg") returned 4
	[0164.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.268] lstrlenW (lpString=".doc") returned 4
	[0164.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.268] lstrlenW (lpString=".docx") returned 5
	[0164.268] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0164.268] lstrlenW (lpString=".pdf") returned 4
	[0164.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.268] lstrlenW (lpString=".xls") returned 4
	[0164.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.268] lstrlenW (lpString=".xlsx") returned 5
	[0164.269] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0164.269] lstrlenW (lpString=".ppt") returned 4
	[0164.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.269] lstrlenW (lpString=".zip") returned 4
	[0164.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.269] lstrlenW (lpString=".rar") returned 4
	[0164.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.269] lstrlenW (lpString=".bz2") returned 4
	[0164.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.269] lstrlenW (lpString=".7z") returned 3
	[0164.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.269] lstrlenW (lpString=".dbf") returned 4
	[0164.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.269] lstrlenW (lpString=".1cd") returned 4
	[0164.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.269] lstrlenW (lpString=".jpg") returned 4
	[0164.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.269] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.269] lstrlenW (lpString="J0105272.WMF") returned 12
	[0164.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0164.270] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=17728) returned 1
	[0164.270] CloseHandle (hObject=0x550) returned 1
	[0164.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220
	[0164.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0164.271] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.271] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0164.272] GetLastError () returned 0x0
	[0164.272] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x4540, lpOverlapped=0x0) returned 1
	[0164.274] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4550, lpOverlapped=0x0) returned 1
	[0164.275] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.275] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.275] SetEndOfFile (hFile=0x554) returned 1
	[0164.275] CloseHandle (hObject=0x554) returned 1
	[0164.276] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.276] SetEndOfFile (hFile=0x550) returned 1
	[0164.278] CloseHandle (hObject=0x550) returned 1
	[0164.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1
	[0164.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.279] lstrlenW (lpString=".doc") returned 4
	[0164.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.279] lstrlenW (lpString=".docx") returned 5
	[0164.279] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.279] lstrlenW (lpString=".pdf") returned 4
	[0164.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.280] lstrlenW (lpString=".xls") returned 4
	[0164.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.280] lstrlenW (lpString=".xlsx") returned 5
	[0164.280] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.280] lstrlenW (lpString=".ppt") returned 4
	[0164.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.280] lstrlenW (lpString=".zip") returned 4
	[0164.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.280] lstrlenW (lpString=".rar") returned 4
	[0164.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.280] lstrlenW (lpString=".bz2") returned 4
	[0164.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.280] lstrlenW (lpString=".7z") returned 3
	[0164.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.280] lstrlenW (lpString=".dbf") returned 4
	[0164.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.280] lstrlenW (lpString=".1cd") returned 4
	[0164.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.280] lstrlenW (lpString=".jpg") returned 4
	[0164.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.280] lstrlenW (lpString=".doc") returned 4
	[0164.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.280] lstrlenW (lpString=".docx") returned 5
	[0164.280] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.280] lstrlenW (lpString=".pdf") returned 4
	[0164.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.281] lstrlenW (lpString=".xls") returned 4
	[0164.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.281] lstrlenW (lpString=".xlsx") returned 5
	[0164.281] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.281] lstrlenW (lpString=".ppt") returned 4
	[0164.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.281] lstrlenW (lpString=".zip") returned 4
	[0164.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.281] lstrlenW (lpString=".rar") returned 4
	[0164.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.281] lstrlenW (lpString=".bz2") returned 4
	[0164.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.281] lstrlenW (lpString=".7z") returned 3
	[0164.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.281] lstrlenW (lpString=".dbf") returned 4
	[0164.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.281] lstrlenW (lpString=".1cd") returned 4
	[0164.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0164.281] lstrlenW (lpString=".jpg") returned 4
	[0164.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.281] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.282] lstrlenW (lpString="J0105276.WMF") returned 12
	[0164.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0164.282] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=19240) returned 1
	[0164.282] CloseHandle (hObject=0x550) returned 1
	[0164.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220
	[0164.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0164.283] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.283] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0164.283] GetLastError () returned 0x0
	[0164.283] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x4b28, lpOverlapped=0x0) returned 1
	[0164.285] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4b30, lpOverlapped=0x0) returned 1
	[0164.286] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.286] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.286] SetEndOfFile (hFile=0x554) returned 1
	[0164.287] CloseHandle (hObject=0x554) returned 1
	[0164.287] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.287] SetEndOfFile (hFile=0x550) returned 1
	[0164.290] CloseHandle (hObject=0x550) returned 1
	[0164.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1
	[0164.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.291] lstrlenW (lpString=".doc") returned 4
	[0164.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.291] lstrlenW (lpString=".docx") returned 5
	[0164.291] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0164.291] lstrlenW (lpString=".pdf") returned 4
	[0164.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.292] lstrlenW (lpString=".xls") returned 4
	[0164.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.292] lstrlenW (lpString=".xlsx") returned 5
	[0164.292] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0164.292] lstrlenW (lpString=".ppt") returned 4
	[0164.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.292] lstrlenW (lpString=".zip") returned 4
	[0164.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.292] lstrlenW (lpString=".rar") returned 4
	[0164.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.292] lstrlenW (lpString=".bz2") returned 4
	[0164.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.292] lstrlenW (lpString=".7z") returned 3
	[0164.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.292] lstrlenW (lpString=".dbf") returned 4
	[0164.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.292] lstrlenW (lpString=".1cd") returned 4
	[0164.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.292] lstrlenW (lpString=".jpg") returned 4
	[0164.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.292] lstrlenW (lpString=".doc") returned 4
	[0164.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.292] lstrlenW (lpString=".docx") returned 5
	[0164.292] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0164.293] lstrlenW (lpString=".pdf") returned 4
	[0164.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.293] lstrlenW (lpString=".xls") returned 4
	[0164.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.293] lstrlenW (lpString=".xlsx") returned 5
	[0164.293] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0164.293] lstrlenW (lpString=".ppt") returned 4
	[0164.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.293] lstrlenW (lpString=".zip") returned 4
	[0164.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.293] lstrlenW (lpString=".rar") returned 4
	[0164.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.293] lstrlenW (lpString=".bz2") returned 4
	[0164.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.293] lstrlenW (lpString=".7z") returned 3
	[0164.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.293] lstrlenW (lpString=".dbf") returned 4
	[0164.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.293] lstrlenW (lpString=".1cd") returned 4
	[0164.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0164.293] lstrlenW (lpString=".jpg") returned 4
	[0164.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.293] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.294] lstrlenW (lpString="J0105280.WMF") returned 12
	[0164.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0164.295] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=11540) returned 1
	[0164.295] CloseHandle (hObject=0x550) returned 1
	[0164.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220
	[0164.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0164.295] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.295] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0164.296] GetLastError () returned 0x0
	[0164.296] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x2d14, lpOverlapped=0x0) returned 1
	[0164.443] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2d20, lpOverlapped=0x0) returned 1
	[0164.445] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.445] WriteFile (in: hFile=0x554, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.445] SetEndOfFile (hFile=0x554) returned 1
	[0164.445] CloseHandle (hObject=0x554) returned 1
	[0164.445] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.445] SetEndOfFile (hFile=0x550) returned 1
	[0164.469] CloseHandle (hObject=0x550) returned 1
	[0164.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1
	[0164.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.601] lstrlenW (lpString=".doc") returned 4
	[0164.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.601] lstrlenW (lpString=".docx") returned 5
	[0164.601] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0164.601] lstrlenW (lpString=".pdf") returned 4
	[0164.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.601] lstrlenW (lpString=".xls") returned 4
	[0164.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.601] lstrlenW (lpString=".xlsx") returned 5
	[0164.601] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0164.601] lstrlenW (lpString=".ppt") returned 4
	[0164.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.601] lstrlenW (lpString=".zip") returned 4
	[0164.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.601] lstrlenW (lpString=".rar") returned 4
	[0164.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.601] lstrlenW (lpString=".bz2") returned 4
	[0164.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.601] lstrlenW (lpString=".7z") returned 3
	[0164.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.602] lstrlenW (lpString=".dbf") returned 4
	[0164.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.602] lstrlenW (lpString=".1cd") returned 4
	[0164.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.602] lstrlenW (lpString=".jpg") returned 4
	[0164.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.602] lstrlenW (lpString=".doc") returned 4
	[0164.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.602] lstrlenW (lpString=".docx") returned 5
	[0164.602] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0164.602] lstrlenW (lpString=".pdf") returned 4
	[0164.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.602] lstrlenW (lpString=".xls") returned 4
	[0164.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.602] lstrlenW (lpString=".xlsx") returned 5
	[0164.602] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0164.602] lstrlenW (lpString=".ppt") returned 4
	[0164.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.602] lstrlenW (lpString=".zip") returned 4
	[0164.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.602] lstrlenW (lpString=".rar") returned 4
	[0164.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.602] lstrlenW (lpString=".bz2") returned 4
	[0164.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.602] lstrlenW (lpString=".7z") returned 3
	[0164.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.603] lstrlenW (lpString=".dbf") returned 4
	[0164.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.603] lstrlenW (lpString=".1cd") returned 4
	[0164.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0164.603] lstrlenW (lpString=".jpg") returned 4
	[0164.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.603] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.603] lstrlenW (lpString="J0105336.WMF") returned 12
	[0164.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.732] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=2900) returned 1
	[0165.732] CloseHandle (hObject=0x4b8) returned 1
	[0165.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220
	[0166.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0166.567] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.567] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0166.680] GetLastError () returned 0x0
	[0166.680] ReadFile (in: hFile=0x424, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0xb54, lpOverlapped=0x0) returned 1
	[0166.682] WriteFile (in: hFile=0x53c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xb60, lpOverlapped=0x0) returned 1
	[0166.683] ReadFile (in: hFile=0x424, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.683] WriteFile (in: hFile=0x53c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.684] SetEndOfFile (hFile=0x53c) returned 1
	[0166.684] CloseHandle (hObject=0x53c) returned 1
	[0166.684] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.684] SetEndOfFile (hFile=0x424) returned 1
	[0166.686] CloseHandle (hObject=0x424) returned 1
	[0166.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0166.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1
	[0166.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.927] lstrlenW (lpString=".doc") returned 4
	[0166.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.928] lstrlenW (lpString=".docx") returned 5
	[0166.928] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0166.928] lstrlenW (lpString=".pdf") returned 4
	[0166.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.928] lstrlenW (lpString=".xls") returned 4
	[0166.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.928] lstrlenW (lpString=".xlsx") returned 5
	[0166.928] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0166.928] lstrlenW (lpString=".ppt") returned 4
	[0166.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.928] lstrlenW (lpString=".zip") returned 4
	[0166.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.928] lstrlenW (lpString=".rar") returned 4
	[0166.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.928] lstrlenW (lpString=".bz2") returned 4
	[0166.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.928] lstrlenW (lpString=".7z") returned 3
	[0166.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.928] lstrlenW (lpString=".dbf") returned 4
	[0166.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.928] lstrlenW (lpString=".1cd") returned 4
	[0166.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.928] lstrlenW (lpString=".jpg") returned 4
	[0166.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.929] lstrlenW (lpString=".doc") returned 4
	[0166.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.929] lstrlenW (lpString=".docx") returned 5
	[0166.929] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0166.929] lstrlenW (lpString=".pdf") returned 4
	[0166.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.929] lstrlenW (lpString=".xls") returned 4
	[0166.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.929] lstrlenW (lpString=".xlsx") returned 5
	[0166.929] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0166.929] lstrlenW (lpString=".ppt") returned 4
	[0166.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.929] lstrlenW (lpString=".zip") returned 4
	[0166.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.929] lstrlenW (lpString=".rar") returned 4
	[0166.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.929] lstrlenW (lpString=".bz2") returned 4
	[0166.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.929] lstrlenW (lpString=".7z") returned 3
	[0166.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.930] lstrlenW (lpString=".dbf") returned 4
	[0166.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.930] lstrlenW (lpString=".1cd") returned 4
	[0166.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.930] lstrlenW (lpString=".jpg") returned 4
	[0166.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.930] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0166.930] lstrlenW (lpString="J0105410.WMF") returned 12
	[0166.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0166.931] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=20444) returned 1
	[0166.931] CloseHandle (hObject=0x54c) returned 1
	[0166.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220
	[0166.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0166.932] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.932] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0166.933] GetLastError () returned 0x0
	[0166.933] ReadFile (in: hFile=0x54c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x4fdc, lpOverlapped=0x0) returned 1
	[0166.935] WriteFile (in: hFile=0x550, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4fe0, lpOverlapped=0x0) returned 1
	[0166.940] ReadFile (in: hFile=0x54c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.940] WriteFile (in: hFile=0x550, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.940] SetEndOfFile (hFile=0x550) returned 1
	[0166.940] CloseHandle (hObject=0x550) returned 1
	[0166.940] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.940] SetEndOfFile (hFile=0x54c) returned 1
	[0166.944] CloseHandle (hObject=0x54c) returned 1
	[0166.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0166.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1
	[0166.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.946] lstrlenW (lpString=".doc") returned 4
	[0166.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.946] lstrlenW (lpString=".docx") returned 5
	[0166.946] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0166.946] lstrlenW (lpString=".pdf") returned 4
	[0166.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.946] lstrlenW (lpString=".xls") returned 4
	[0166.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.947] lstrlenW (lpString=".xlsx") returned 5
	[0166.947] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0166.947] lstrlenW (lpString=".ppt") returned 4
	[0166.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.947] lstrlenW (lpString=".zip") returned 4
	[0166.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.947] lstrlenW (lpString=".rar") returned 4
	[0166.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.947] lstrlenW (lpString=".bz2") returned 4
	[0166.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.947] lstrlenW (lpString=".7z") returned 3
	[0166.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.947] lstrlenW (lpString=".dbf") returned 4
	[0166.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.947] lstrlenW (lpString=".1cd") returned 4
	[0166.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.947] lstrlenW (lpString=".jpg") returned 4
	[0166.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.948] lstrlenW (lpString=".doc") returned 4
	[0166.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.948] lstrlenW (lpString=".docx") returned 5
	[0166.948] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0166.948] lstrlenW (lpString=".pdf") returned 4
	[0166.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.948] lstrlenW (lpString=".xls") returned 4
	[0166.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.948] lstrlenW (lpString=".xlsx") returned 5
	[0166.948] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0166.948] lstrlenW (lpString=".ppt") returned 4
	[0166.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.948] lstrlenW (lpString=".zip") returned 4
	[0166.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.948] lstrlenW (lpString=".rar") returned 4
	[0166.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.948] lstrlenW (lpString=".bz2") returned 4
	[0166.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.948] lstrlenW (lpString=".7z") returned 3
	[0166.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.948] lstrlenW (lpString=".dbf") returned 4
	[0166.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.948] lstrlenW (lpString=".1cd") returned 4
	[0166.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0166.949] lstrlenW (lpString=".jpg") returned 4
	[0166.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.949] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0166.949] lstrlenW (lpString="J0105412.WMF") returned 12
	[0166.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0166.950] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=9400) returned 1
	[0166.950] CloseHandle (hObject=0x54c) returned 1
	[0166.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220
	[0166.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0166.951] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.951] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0166.952] GetLastError () returned 0x0
	[0166.952] ReadFile (in: hFile=0x54c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x24b8, lpOverlapped=0x0) returned 1
	[0167.251] WriteFile (in: hFile=0x550, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x24c0, lpOverlapped=0x0) returned 1
	[0167.253] ReadFile (in: hFile=0x54c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.253] WriteFile (in: hFile=0x550, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.253] SetEndOfFile (hFile=0x550) returned 1
	[0167.399] CloseHandle (hObject=0x550) returned 1
	[0167.399] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.399] SetEndOfFile (hFile=0x54c) returned 1
	[0167.402] CloseHandle (hObject=0x54c) returned 1
	[0167.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1
	[0167.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.415] lstrlenW (lpString=".doc") returned 4
	[0167.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.415] lstrlenW (lpString=".docx") returned 5
	[0167.415] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0167.415] lstrlenW (lpString=".pdf") returned 4
	[0167.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.415] lstrlenW (lpString=".xls") returned 4
	[0167.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.415] lstrlenW (lpString=".xlsx") returned 5
	[0167.415] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0167.415] lstrlenW (lpString=".ppt") returned 4
	[0167.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.415] lstrlenW (lpString=".zip") returned 4
	[0167.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.415] lstrlenW (lpString=".rar") returned 4
	[0167.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.415] lstrlenW (lpString=".bz2") returned 4
	[0167.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.415] lstrlenW (lpString=".7z") returned 3
	[0167.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.415] lstrlenW (lpString=".dbf") returned 4
	[0167.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.415] lstrlenW (lpString=".1cd") returned 4
	[0167.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.416] lstrlenW (lpString=".jpg") returned 4
	[0167.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.416] lstrlenW (lpString=".doc") returned 4
	[0167.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.416] lstrlenW (lpString=".docx") returned 5
	[0167.416] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0167.416] lstrlenW (lpString=".pdf") returned 4
	[0167.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.416] lstrlenW (lpString=".xls") returned 4
	[0167.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.416] lstrlenW (lpString=".xlsx") returned 5
	[0167.416] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0167.416] lstrlenW (lpString=".ppt") returned 4
	[0167.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.416] lstrlenW (lpString=".zip") returned 4
	[0167.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.416] lstrlenW (lpString=".rar") returned 4
	[0167.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.416] lstrlenW (lpString=".bz2") returned 4
	[0167.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.416] lstrlenW (lpString=".7z") returned 3
	[0167.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.417] lstrlenW (lpString=".dbf") returned 4
	[0167.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.417] lstrlenW (lpString=".1cd") returned 4
	[0167.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.417] lstrlenW (lpString=".jpg") returned 4
	[0167.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.417] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.417] lstrlenW (lpString="J0105506.WMF") returned 12
	[0167.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0167.418] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=2912) returned 1
	[0167.418] CloseHandle (hObject=0x4b8) returned 1
	[0167.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220
	[0167.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0167.424] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.424] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0167.425] GetLastError () returned 0x0
	[0167.425] ReadFile (in: hFile=0x4b8, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0xb60, lpOverlapped=0x0) returned 1
	[0167.426] WriteFile (in: hFile=0x4f0, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xb70, lpOverlapped=0x0) returned 1
	[0167.427] ReadFile (in: hFile=0x4b8, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.427] WriteFile (in: hFile=0x4f0, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.427] SetEndOfFile (hFile=0x4f0) returned 1
	[0167.427] CloseHandle (hObject=0x4f0) returned 1
	[0167.428] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.428] SetEndOfFile (hFile=0x4b8) returned 1
	[0167.431] CloseHandle (hObject=0x4b8) returned 1
	[0167.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1
	[0167.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.432] lstrlenW (lpString=".doc") returned 4
	[0167.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.432] lstrlenW (lpString=".docx") returned 5
	[0167.432] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0167.432] lstrlenW (lpString=".pdf") returned 4
	[0167.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.432] lstrlenW (lpString=".xls") returned 4
	[0167.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.432] lstrlenW (lpString=".xlsx") returned 5
	[0167.432] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0167.433] lstrlenW (lpString=".ppt") returned 4
	[0167.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.433] lstrlenW (lpString=".zip") returned 4
	[0167.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.433] lstrlenW (lpString=".rar") returned 4
	[0167.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.433] lstrlenW (lpString=".bz2") returned 4
	[0167.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.433] lstrlenW (lpString=".7z") returned 3
	[0167.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.433] lstrlenW (lpString=".dbf") returned 4
	[0167.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.433] lstrlenW (lpString=".1cd") returned 4
	[0167.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.433] lstrlenW (lpString=".jpg") returned 4
	[0167.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.433] lstrlenW (lpString=".doc") returned 4
	[0167.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.433] lstrlenW (lpString=".docx") returned 5
	[0167.433] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0167.433] lstrlenW (lpString=".pdf") returned 4
	[0167.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.434] lstrlenW (lpString=".xls") returned 4
	[0167.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.434] lstrlenW (lpString=".xlsx") returned 5
	[0167.434] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0167.434] lstrlenW (lpString=".ppt") returned 4
	[0167.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.434] lstrlenW (lpString=".zip") returned 4
	[0167.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.434] lstrlenW (lpString=".rar") returned 4
	[0167.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.434] lstrlenW (lpString=".bz2") returned 4
	[0167.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.434] lstrlenW (lpString=".7z") returned 3
	[0167.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.434] lstrlenW (lpString=".dbf") returned 4
	[0167.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.434] lstrlenW (lpString=".1cd") returned 4
	[0167.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.435] lstrlenW (lpString=".jpg") returned 4
	[0167.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.435] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.435] lstrlenW (lpString="J0105520.WMF") returned 12
	[0167.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.469] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=31812) returned 1
	[0167.469] CloseHandle (hObject=0x550) returned 1
	[0167.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220
	[0167.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.470] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.470] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0167.471] GetLastError () returned 0x0
	[0167.471] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x7c44, lpOverlapped=0x0) returned 1
	[0167.474] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x7c50, lpOverlapped=0x0) returned 1
	[0167.476] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.476] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.476] SetEndOfFile (hFile=0x4b8) returned 1
	[0167.476] CloseHandle (hObject=0x4b8) returned 1
	[0167.476] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.476] SetEndOfFile (hFile=0x550) returned 1
	[0167.479] CloseHandle (hObject=0x550) returned 1
	[0167.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1
	[0167.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.484] lstrlenW (lpString=".doc") returned 4
	[0167.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.484] lstrlenW (lpString=".docx") returned 5
	[0167.484] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0167.484] lstrlenW (lpString=".pdf") returned 4
	[0167.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.485] lstrlenW (lpString=".xls") returned 4
	[0167.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.485] lstrlenW (lpString=".xlsx") returned 5
	[0167.485] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0167.485] lstrlenW (lpString=".ppt") returned 4
	[0167.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.485] lstrlenW (lpString=".zip") returned 4
	[0167.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.485] lstrlenW (lpString=".rar") returned 4
	[0167.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.485] lstrlenW (lpString=".bz2") returned 4
	[0167.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.485] lstrlenW (lpString=".7z") returned 3
	[0167.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.485] lstrlenW (lpString=".dbf") returned 4
	[0167.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.485] lstrlenW (lpString=".1cd") returned 4
	[0167.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.485] lstrlenW (lpString=".jpg") returned 4
	[0167.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.486] lstrlenW (lpString=".doc") returned 4
	[0167.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.486] lstrlenW (lpString=".docx") returned 5
	[0167.486] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0167.486] lstrlenW (lpString=".pdf") returned 4
	[0167.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.486] lstrlenW (lpString=".xls") returned 4
	[0167.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.486] lstrlenW (lpString=".xlsx") returned 5
	[0167.486] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0167.486] lstrlenW (lpString=".ppt") returned 4
	[0167.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.486] lstrlenW (lpString=".zip") returned 4
	[0167.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.486] lstrlenW (lpString=".rar") returned 4
	[0167.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.486] lstrlenW (lpString=".bz2") returned 4
	[0167.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.486] lstrlenW (lpString=".7z") returned 3
	[0167.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.486] lstrlenW (lpString=".dbf") returned 4
	[0167.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.486] lstrlenW (lpString=".1cd") returned 4
	[0167.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.486] lstrlenW (lpString=".jpg") returned 4
	[0167.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.487] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.487] lstrlenW (lpString="J0105526.WMF") returned 12
	[0167.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.487] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=17332) returned 1
	[0167.487] CloseHandle (hObject=0x550) returned 1
	[0167.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220
	[0167.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.488] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.488] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0167.489] GetLastError () returned 0x0
	[0167.489] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x43b4, lpOverlapped=0x0) returned 1
	[0167.491] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x43c0, lpOverlapped=0x0) returned 1
	[0168.325] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.325] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.325] SetEndOfFile (hFile=0x4b8) returned 1
	[0168.325] CloseHandle (hObject=0x4b8) returned 1
	[0168.325] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.326] SetEndOfFile (hFile=0x550) returned 1
	[0168.329] CloseHandle (hObject=0x550) returned 1
	[0168.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1
	[0168.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.330] lstrlenW (lpString=".doc") returned 4
	[0168.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.330] lstrlenW (lpString=".docx") returned 5
	[0168.330] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0168.330] lstrlenW (lpString=".pdf") returned 4
	[0168.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.330] lstrlenW (lpString=".xls") returned 4
	[0168.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.330] lstrlenW (lpString=".xlsx") returned 5
	[0168.331] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0168.331] lstrlenW (lpString=".ppt") returned 4
	[0168.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.331] lstrlenW (lpString=".zip") returned 4
	[0168.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.331] lstrlenW (lpString=".rar") returned 4
	[0168.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.331] lstrlenW (lpString=".bz2") returned 4
	[0168.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.331] lstrlenW (lpString=".7z") returned 3
	[0168.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.331] lstrlenW (lpString=".dbf") returned 4
	[0168.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.331] lstrlenW (lpString=".1cd") returned 4
	[0168.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.331] lstrlenW (lpString=".jpg") returned 4
	[0168.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.331] lstrlenW (lpString=".doc") returned 4
	[0168.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.332] lstrlenW (lpString=".docx") returned 5
	[0168.332] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0168.332] lstrlenW (lpString=".pdf") returned 4
	[0168.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.332] lstrlenW (lpString=".xls") returned 4
	[0168.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.332] lstrlenW (lpString=".xlsx") returned 5
	[0168.332] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0168.332] lstrlenW (lpString=".ppt") returned 4
	[0168.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.332] lstrlenW (lpString=".zip") returned 4
	[0168.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.332] lstrlenW (lpString=".rar") returned 4
	[0168.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.332] lstrlenW (lpString=".bz2") returned 4
	[0168.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.332] lstrlenW (lpString=".7z") returned 3
	[0168.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.332] lstrlenW (lpString=".dbf") returned 4
	[0168.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.332] lstrlenW (lpString=".1cd") returned 4
	[0168.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.332] lstrlenW (lpString=".jpg") returned 4
	[0168.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.333] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.333] lstrlenW (lpString="J0105974.WMF") returned 12
	[0168.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.333] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=4612) returned 1
	[0168.333] CloseHandle (hObject=0x550) returned 1
	[0168.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220
	[0168.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.334] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.334] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0168.335] GetLastError () returned 0x0
	[0168.335] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1204, lpOverlapped=0x0) returned 1
	[0168.336] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1210, lpOverlapped=0x0) returned 1
	[0168.338] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.338] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.338] SetEndOfFile (hFile=0x4b8) returned 1
	[0168.338] CloseHandle (hObject=0x4b8) returned 1
	[0168.338] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.338] SetEndOfFile (hFile=0x550) returned 1
	[0168.341] CloseHandle (hObject=0x550) returned 1
	[0168.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1
	[0168.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.342] lstrlenW (lpString=".doc") returned 4
	[0168.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.342] lstrlenW (lpString=".docx") returned 5
	[0168.342] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0168.342] lstrlenW (lpString=".pdf") returned 4
	[0168.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.342] lstrlenW (lpString=".xls") returned 4
	[0168.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.342] lstrlenW (lpString=".xlsx") returned 5
	[0168.343] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0168.343] lstrlenW (lpString=".ppt") returned 4
	[0168.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.343] lstrlenW (lpString=".zip") returned 4
	[0168.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.343] lstrlenW (lpString=".rar") returned 4
	[0168.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.343] lstrlenW (lpString=".bz2") returned 4
	[0168.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.343] lstrlenW (lpString=".7z") returned 3
	[0168.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.343] lstrlenW (lpString=".dbf") returned 4
	[0168.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.343] lstrlenW (lpString=".1cd") returned 4
	[0168.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.343] lstrlenW (lpString=".jpg") returned 4
	[0168.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.343] lstrlenW (lpString=".doc") returned 4
	[0168.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.343] lstrlenW (lpString=".docx") returned 5
	[0168.344] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0168.344] lstrlenW (lpString=".pdf") returned 4
	[0168.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.344] lstrlenW (lpString=".xls") returned 4
	[0168.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.344] lstrlenW (lpString=".xlsx") returned 5
	[0168.344] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0168.344] lstrlenW (lpString=".ppt") returned 4
	[0168.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.344] lstrlenW (lpString=".zip") returned 4
	[0168.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.344] lstrlenW (lpString=".rar") returned 4
	[0168.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.344] lstrlenW (lpString=".bz2") returned 4
	[0168.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.344] lstrlenW (lpString=".7z") returned 3
	[0168.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.344] lstrlenW (lpString=".dbf") returned 4
	[0168.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.344] lstrlenW (lpString=".1cd") returned 4
	[0168.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.344] lstrlenW (lpString=".jpg") returned 4
	[0168.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.345] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.345] lstrlenW (lpString="J0106020.WMF") returned 12
	[0168.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.345] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=10060) returned 1
	[0168.345] CloseHandle (hObject=0x550) returned 1
	[0168.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220
	[0168.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.346] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.346] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0168.347] GetLastError () returned 0x0
	[0168.347] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x274c, lpOverlapped=0x0) returned 1
	[0168.348] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2750, lpOverlapped=0x0) returned 1
	[0168.350] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.350] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.350] SetEndOfFile (hFile=0x4b8) returned 1
	[0168.350] CloseHandle (hObject=0x4b8) returned 1
	[0168.350] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.350] SetEndOfFile (hFile=0x550) returned 1
	[0168.353] CloseHandle (hObject=0x550) returned 1
	[0168.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1
	[0168.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.355] lstrlenW (lpString=".doc") returned 4
	[0168.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.355] lstrlenW (lpString=".docx") returned 5
	[0168.355] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.355] lstrlenW (lpString=".pdf") returned 4
	[0168.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.355] lstrlenW (lpString=".xls") returned 4
	[0168.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.355] lstrlenW (lpString=".xlsx") returned 5
	[0168.355] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.355] lstrlenW (lpString=".ppt") returned 4
	[0168.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.355] lstrlenW (lpString=".zip") returned 4
	[0168.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.355] lstrlenW (lpString=".rar") returned 4
	[0168.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.355] lstrlenW (lpString=".bz2") returned 4
	[0168.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.355] lstrlenW (lpString=".7z") returned 3
	[0168.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.355] lstrlenW (lpString=".dbf") returned 4
	[0168.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.356] lstrlenW (lpString=".1cd") returned 4
	[0168.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.356] lstrlenW (lpString=".jpg") returned 4
	[0168.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.356] lstrlenW (lpString=".doc") returned 4
	[0168.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.356] lstrlenW (lpString=".docx") returned 5
	[0168.356] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.356] lstrlenW (lpString=".pdf") returned 4
	[0168.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.356] lstrlenW (lpString=".xls") returned 4
	[0168.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.356] lstrlenW (lpString=".xlsx") returned 5
	[0168.356] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.356] lstrlenW (lpString=".ppt") returned 4
	[0168.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.356] lstrlenW (lpString=".zip") returned 4
	[0168.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.356] lstrlenW (lpString=".rar") returned 4
	[0168.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.356] lstrlenW (lpString=".bz2") returned 4
	[0168.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.356] lstrlenW (lpString=".7z") returned 3
	[0168.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.357] lstrlenW (lpString=".dbf") returned 4
	[0168.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.357] lstrlenW (lpString=".1cd") returned 4
	[0168.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.357] lstrlenW (lpString=".jpg") returned 4
	[0168.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.357] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.357] lstrlenW (lpString="J0106124.WMF") returned 12
	[0168.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.358] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=5812) returned 1
	[0168.358] CloseHandle (hObject=0x550) returned 1
	[0168.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220
	[0168.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.358] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.358] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0168.359] GetLastError () returned 0x0
	[0168.359] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x16b4, lpOverlapped=0x0) returned 1
	[0168.530] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x16c0, lpOverlapped=0x0) returned 1
	[0168.531] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.531] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.531] SetEndOfFile (hFile=0x4b8) returned 1
	[0168.675] CloseHandle (hObject=0x4b8) returned 1
	[0168.675] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.675] SetEndOfFile (hFile=0x550) returned 1
	[0168.678] CloseHandle (hObject=0x550) returned 1
	[0168.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1
	[0168.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.682] lstrlenW (lpString=".doc") returned 4
	[0168.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.682] lstrlenW (lpString=".docx") returned 5
	[0168.682] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0168.682] lstrlenW (lpString=".pdf") returned 4
	[0168.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.682] lstrlenW (lpString=".xls") returned 4
	[0168.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.682] lstrlenW (lpString=".xlsx") returned 5
	[0168.682] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0168.682] lstrlenW (lpString=".ppt") returned 4
	[0168.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.682] lstrlenW (lpString=".zip") returned 4
	[0168.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.682] lstrlenW (lpString=".rar") returned 4
	[0168.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.682] lstrlenW (lpString=".bz2") returned 4
	[0168.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.683] lstrlenW (lpString=".7z") returned 3
	[0168.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.683] lstrlenW (lpString=".dbf") returned 4
	[0168.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.683] lstrlenW (lpString=".1cd") returned 4
	[0168.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.683] lstrlenW (lpString=".jpg") returned 4
	[0168.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.683] lstrlenW (lpString=".doc") returned 4
	[0168.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.683] lstrlenW (lpString=".docx") returned 5
	[0168.683] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0168.683] lstrlenW (lpString=".pdf") returned 4
	[0168.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.683] lstrlenW (lpString=".xls") returned 4
	[0168.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.683] lstrlenW (lpString=".xlsx") returned 5
	[0168.683] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0168.683] lstrlenW (lpString=".ppt") returned 4
	[0168.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.684] lstrlenW (lpString=".zip") returned 4
	[0168.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.684] lstrlenW (lpString=".rar") returned 4
	[0168.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.684] lstrlenW (lpString=".bz2") returned 4
	[0168.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.684] lstrlenW (lpString=".7z") returned 3
	[0168.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.684] lstrlenW (lpString=".dbf") returned 4
	[0168.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.684] lstrlenW (lpString=".1cd") returned 4
	[0168.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.684] lstrlenW (lpString=".jpg") returned 4
	[0168.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.684] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.684] lstrlenW (lpString="J0106146.WMF") returned 12
	[0168.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.685] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=23548) returned 1
	[0168.685] CloseHandle (hObject=0x550) returned 1
	[0168.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220
	[0168.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.686] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.686] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0168.687] GetLastError () returned 0x0
	[0168.687] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x5bfc, lpOverlapped=0x0) returned 1
	[0168.705] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x5c00, lpOverlapped=0x0) returned 1
	[0168.706] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.706] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.706] SetEndOfFile (hFile=0x4b8) returned 1
	[0168.706] CloseHandle (hObject=0x4b8) returned 1
	[0168.706] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.707] SetEndOfFile (hFile=0x550) returned 1
	[0168.710] CloseHandle (hObject=0x550) returned 1
	[0168.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1
	[0168.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.711] lstrlenW (lpString=".doc") returned 4
	[0168.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.711] lstrlenW (lpString=".docx") returned 5
	[0168.711] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0168.711] lstrlenW (lpString=".pdf") returned 4
	[0168.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.711] lstrlenW (lpString=".xls") returned 4
	[0168.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.711] lstrlenW (lpString=".xlsx") returned 5
	[0168.711] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0168.711] lstrlenW (lpString=".ppt") returned 4
	[0168.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.711] lstrlenW (lpString=".zip") returned 4
	[0168.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.711] lstrlenW (lpString=".rar") returned 4
	[0168.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.711] lstrlenW (lpString=".bz2") returned 4
	[0168.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.711] lstrlenW (lpString=".7z") returned 3
	[0168.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.712] lstrlenW (lpString=".dbf") returned 4
	[0168.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.712] lstrlenW (lpString=".1cd") returned 4
	[0168.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.712] lstrlenW (lpString=".jpg") returned 4
	[0168.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.712] lstrlenW (lpString=".doc") returned 4
	[0168.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.712] lstrlenW (lpString=".docx") returned 5
	[0168.712] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0168.712] lstrlenW (lpString=".pdf") returned 4
	[0168.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.712] lstrlenW (lpString=".xls") returned 4
	[0168.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.712] lstrlenW (lpString=".xlsx") returned 5
	[0168.712] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0168.712] lstrlenW (lpString=".ppt") returned 4
	[0168.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.713] lstrlenW (lpString=".zip") returned 4
	[0168.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.713] lstrlenW (lpString=".rar") returned 4
	[0168.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.713] lstrlenW (lpString=".bz2") returned 4
	[0168.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.713] lstrlenW (lpString=".7z") returned 3
	[0168.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.713] lstrlenW (lpString=".dbf") returned 4
	[0168.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.713] lstrlenW (lpString=".1cd") returned 4
	[0168.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.713] lstrlenW (lpString=".jpg") returned 4
	[0168.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.713] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.713] lstrlenW (lpString="J0106572.WMF") returned 12
	[0168.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0168.848] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=2148) returned 1
	[0168.848] CloseHandle (hObject=0x36c) returned 1
	[0168.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220
	[0168.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0168.848] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.849] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.850] GetLastError () returned 0x0
	[0168.850] ReadFile (in: hFile=0x36c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x864, lpOverlapped=0x0) returned 1
	[0168.851] WriteFile (in: hFile=0x4e0, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x870, lpOverlapped=0x0) returned 1
	[0168.852] ReadFile (in: hFile=0x36c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.852] WriteFile (in: hFile=0x4e0, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.852] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.852] CloseHandle (hObject=0x4e0) returned 1
	[0168.852] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.853] SetEndOfFile (hFile=0x36c) returned 1
	[0168.855] CloseHandle (hObject=0x36c) returned 1
	[0168.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1
	[0168.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.858] lstrlenW (lpString=".doc") returned 4
	[0168.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.858] lstrlenW (lpString=".docx") returned 5
	[0168.858] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.858] lstrlenW (lpString=".pdf") returned 4
	[0168.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.858] lstrlenW (lpString=".xls") returned 4
	[0168.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.859] lstrlenW (lpString=".xlsx") returned 5
	[0168.859] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.859] lstrlenW (lpString=".ppt") returned 4
	[0168.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.859] lstrlenW (lpString=".zip") returned 4
	[0168.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.859] lstrlenW (lpString=".rar") returned 4
	[0168.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.859] lstrlenW (lpString=".bz2") returned 4
	[0168.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.859] lstrlenW (lpString=".7z") returned 3
	[0168.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.859] lstrlenW (lpString=".dbf") returned 4
	[0168.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.859] lstrlenW (lpString=".1cd") returned 4
	[0168.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.859] lstrlenW (lpString=".jpg") returned 4
	[0168.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.859] lstrlenW (lpString=".doc") returned 4
	[0168.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.860] lstrlenW (lpString=".docx") returned 5
	[0168.860] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.860] lstrlenW (lpString=".pdf") returned 4
	[0168.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.860] lstrlenW (lpString=".xls") returned 4
	[0168.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.860] lstrlenW (lpString=".xlsx") returned 5
	[0168.860] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.860] lstrlenW (lpString=".ppt") returned 4
	[0168.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.860] lstrlenW (lpString=".zip") returned 4
	[0168.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.860] lstrlenW (lpString=".rar") returned 4
	[0168.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.860] lstrlenW (lpString=".bz2") returned 4
	[0168.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.860] lstrlenW (lpString=".7z") returned 3
	[0168.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.860] lstrlenW (lpString=".dbf") returned 4
	[0168.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.860] lstrlenW (lpString=".1cd") returned 4
	[0168.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0168.860] lstrlenW (lpString=".jpg") returned 4
	[0168.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.861] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.861] lstrlenW (lpString="J0107130.WMF") returned 12
	[0168.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0168.861] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=27084) returned 1
	[0168.861] CloseHandle (hObject=0x36c) returned 1
	[0168.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220
	[0168.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0168.862] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.862] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.863] GetLastError () returned 0x0
	[0168.863] ReadFile (in: hFile=0x36c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x69cc, lpOverlapped=0x0) returned 1
	[0168.865] WriteFile (in: hFile=0x4e0, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x69d0, lpOverlapped=0x0) returned 1
	[0168.866] ReadFile (in: hFile=0x36c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.867] WriteFile (in: hFile=0x4e0, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.867] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.867] CloseHandle (hObject=0x4e0) returned 1
	[0168.867] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.101] SetEndOfFile (hFile=0x36c) returned 1
	[0169.104] CloseHandle (hObject=0x36c) returned 1
	[0169.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1
	[0170.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.233] lstrlenW (lpString=".doc") returned 4
	[0170.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.233] lstrlenW (lpString=".docx") returned 5
	[0170.233] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.233] lstrlenW (lpString=".pdf") returned 4
	[0170.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.233] lstrlenW (lpString=".xls") returned 4
	[0170.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.233] lstrlenW (lpString=".xlsx") returned 5
	[0170.234] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.234] lstrlenW (lpString=".ppt") returned 4
	[0170.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.234] lstrlenW (lpString=".zip") returned 4
	[0170.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.234] lstrlenW (lpString=".rar") returned 4
	[0170.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.234] lstrlenW (lpString=".bz2") returned 4
	[0170.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.234] lstrlenW (lpString=".7z") returned 3
	[0170.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.234] lstrlenW (lpString=".dbf") returned 4
	[0170.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.234] lstrlenW (lpString=".1cd") returned 4
	[0170.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.234] lstrlenW (lpString=".jpg") returned 4
	[0170.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.234] lstrlenW (lpString=".doc") returned 4
	[0170.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.234] lstrlenW (lpString=".docx") returned 5
	[0170.234] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.234] lstrlenW (lpString=".pdf") returned 4
	[0170.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.235] lstrlenW (lpString=".xls") returned 4
	[0170.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.235] lstrlenW (lpString=".xlsx") returned 5
	[0170.235] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.235] lstrlenW (lpString=".ppt") returned 4
	[0170.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.235] lstrlenW (lpString=".zip") returned 4
	[0170.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.235] lstrlenW (lpString=".rar") returned 4
	[0170.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.235] lstrlenW (lpString=".bz2") returned 4
	[0170.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.235] lstrlenW (lpString=".7z") returned 3
	[0170.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.235] lstrlenW (lpString=".dbf") returned 4
	[0170.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.235] lstrlenW (lpString=".1cd") returned 4
	[0170.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0170.235] lstrlenW (lpString=".jpg") returned 4
	[0170.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.236] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.236] lstrlenW (lpString="J0107308.WMF") returned 12
	[0170.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.244] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=15888) returned 1
	[0170.244] CloseHandle (hObject=0x53c) returned 1
	[0170.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220
	[0170.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.245] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.245] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0170.246] GetLastError () returned 0x0
	[0170.246] ReadFile (in: hFile=0x53c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x3e10, lpOverlapped=0x0) returned 1
	[0170.248] WriteFile (in: hFile=0x370, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x3e20, lpOverlapped=0x0) returned 1
	[0170.249] ReadFile (in: hFile=0x53c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.249] WriteFile (in: hFile=0x370, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.249] SetEndOfFile (hFile=0x370) returned 1
	[0170.249] CloseHandle (hObject=0x370) returned 1
	[0170.250] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.250] SetEndOfFile (hFile=0x53c) returned 1
	[0170.252] CloseHandle (hObject=0x53c) returned 1
	[0170.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 1
	[0170.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.254] lstrlenW (lpString=".doc") returned 4
	[0170.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.254] lstrlenW (lpString=".docx") returned 5
	[0170.254] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.254] lstrlenW (lpString=".pdf") returned 4
	[0170.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.254] lstrlenW (lpString=".xls") returned 4
	[0170.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.254] lstrlenW (lpString=".xlsx") returned 5
	[0170.254] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.254] lstrlenW (lpString=".ppt") returned 4
	[0170.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.254] lstrlenW (lpString=".zip") returned 4
	[0170.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.254] lstrlenW (lpString=".rar") returned 4
	[0170.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.254] lstrlenW (lpString=".bz2") returned 4
	[0170.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.254] lstrlenW (lpString=".7z") returned 3
	[0170.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.255] lstrlenW (lpString=".dbf") returned 4
	[0170.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.255] lstrlenW (lpString=".1cd") returned 4
	[0170.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.255] lstrlenW (lpString=".jpg") returned 4
	[0170.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.255] lstrlenW (lpString=".doc") returned 4
	[0170.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.255] lstrlenW (lpString=".docx") returned 5
	[0170.255] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.255] lstrlenW (lpString=".pdf") returned 4
	[0170.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.255] lstrlenW (lpString=".xls") returned 4
	[0170.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.255] lstrlenW (lpString=".xlsx") returned 5
	[0170.255] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.255] lstrlenW (lpString=".ppt") returned 4
	[0170.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.256] lstrlenW (lpString=".zip") returned 4
	[0170.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.256] lstrlenW (lpString=".rar") returned 4
	[0170.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.256] lstrlenW (lpString=".bz2") returned 4
	[0170.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.256] lstrlenW (lpString=".7z") returned 3
	[0170.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.256] lstrlenW (lpString=".dbf") returned 4
	[0170.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.256] lstrlenW (lpString=".1cd") returned 4
	[0170.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0170.256] lstrlenW (lpString=".jpg") returned 4
	[0170.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.256] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.256] lstrlenW (lpString="J0107314.WMF") returned 12
	[0170.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.258] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=10852) returned 1
	[0170.258] CloseHandle (hObject=0x53c) returned 1
	[0170.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220
	[0170.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.258] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.258] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0170.259] GetLastError () returned 0x0
	[0170.259] ReadFile (in: hFile=0x53c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x2a64, lpOverlapped=0x0) returned 1
	[0170.261] WriteFile (in: hFile=0x370, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2a70, lpOverlapped=0x0) returned 1
	[0170.262] ReadFile (in: hFile=0x53c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.262] WriteFile (in: hFile=0x370, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.262] SetEndOfFile (hFile=0x370) returned 1
	[0170.263] CloseHandle (hObject=0x370) returned 1
	[0170.263] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.263] SetEndOfFile (hFile=0x53c) returned 1
	[0170.266] CloseHandle (hObject=0x53c) returned 1
	[0170.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 1
	[0170.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.267] lstrlenW (lpString=".doc") returned 4
	[0170.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.642] lstrlenW (lpString=".docx") returned 5
	[0170.642] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.642] lstrlenW (lpString=".pdf") returned 4
	[0170.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.642] lstrlenW (lpString=".xls") returned 4
	[0170.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.642] lstrlenW (lpString=".xlsx") returned 5
	[0170.642] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.642] lstrlenW (lpString=".ppt") returned 4
	[0170.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.642] lstrlenW (lpString=".zip") returned 4
	[0170.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.642] lstrlenW (lpString=".rar") returned 4
	[0170.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.642] lstrlenW (lpString=".bz2") returned 4
	[0170.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.642] lstrlenW (lpString=".7z") returned 3
	[0170.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.642] lstrlenW (lpString=".dbf") returned 4
	[0170.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.642] lstrlenW (lpString=".1cd") returned 4
	[0170.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.642] lstrlenW (lpString=".jpg") returned 4
	[0170.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.643] lstrlenW (lpString=".doc") returned 4
	[0170.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.643] lstrlenW (lpString=".docx") returned 5
	[0170.643] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.643] lstrlenW (lpString=".pdf") returned 4
	[0170.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.643] lstrlenW (lpString=".xls") returned 4
	[0170.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.643] lstrlenW (lpString=".xlsx") returned 5
	[0170.643] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.643] lstrlenW (lpString=".ppt") returned 4
	[0170.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.643] lstrlenW (lpString=".zip") returned 4
	[0170.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.643] lstrlenW (lpString=".rar") returned 4
	[0170.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.643] lstrlenW (lpString=".bz2") returned 4
	[0170.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.643] lstrlenW (lpString=".7z") returned 3
	[0170.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.644] lstrlenW (lpString=".dbf") returned 4
	[0170.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.644] lstrlenW (lpString=".1cd") returned 4
	[0170.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0170.644] lstrlenW (lpString=".jpg") returned 4
	[0170.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.644] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.644] lstrlenW (lpString="J0107446.WMF") returned 12
	[0170.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.645] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=30336) returned 1
	[0170.645] CloseHandle (hObject=0x55c) returned 1
	[0170.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0x220
	[0170.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.646] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.646] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0170.647] GetLastError () returned 0x0
	[0170.647] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x7680, lpOverlapped=0x0) returned 1
	[0170.649] WriteFile (in: hFile=0x514, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x7690, lpOverlapped=0x0) returned 1
	[0170.650] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.650] WriteFile (in: hFile=0x514, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.651] SetEndOfFile (hFile=0x514) returned 1
	[0170.651] CloseHandle (hObject=0x514) returned 1
	[0170.651] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.651] SetEndOfFile (hFile=0x55c) returned 1
	[0170.654] CloseHandle (hObject=0x55c) returned 1
	[0170.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 1
	[0170.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.656] lstrlenW (lpString=".doc") returned 4
	[0170.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.656] lstrlenW (lpString=".docx") returned 5
	[0170.656] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0170.656] lstrlenW (lpString=".pdf") returned 4
	[0170.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.656] lstrlenW (lpString=".xls") returned 4
	[0170.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.656] lstrlenW (lpString=".xlsx") returned 5
	[0170.656] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0170.656] lstrlenW (lpString=".ppt") returned 4
	[0170.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.656] lstrlenW (lpString=".zip") returned 4
	[0170.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.656] lstrlenW (lpString=".rar") returned 4
	[0170.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.657] lstrlenW (lpString=".bz2") returned 4
	[0170.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.657] lstrlenW (lpString=".7z") returned 3
	[0170.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.657] lstrlenW (lpString=".dbf") returned 4
	[0170.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.657] lstrlenW (lpString=".1cd") returned 4
	[0170.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.657] lstrlenW (lpString=".jpg") returned 4
	[0170.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.657] lstrlenW (lpString=".doc") returned 4
	[0170.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.657] lstrlenW (lpString=".docx") returned 5
	[0170.657] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0170.657] lstrlenW (lpString=".pdf") returned 4
	[0170.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.657] lstrlenW (lpString=".xls") returned 4
	[0170.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.657] lstrlenW (lpString=".xlsx") returned 5
	[0170.657] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0170.657] lstrlenW (lpString=".ppt") returned 4
	[0170.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.658] lstrlenW (lpString=".zip") returned 4
	[0170.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.658] lstrlenW (lpString=".rar") returned 4
	[0170.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.658] lstrlenW (lpString=".bz2") returned 4
	[0170.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.658] lstrlenW (lpString=".7z") returned 3
	[0170.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.658] lstrlenW (lpString=".dbf") returned 4
	[0170.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.658] lstrlenW (lpString=".1cd") returned 4
	[0170.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0170.658] lstrlenW (lpString=".jpg") returned 4
	[0170.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.658] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.658] lstrlenW (lpString="J0107450.WMF") returned 12
	[0170.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.659] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=4920) returned 1
	[0170.659] CloseHandle (hObject=0x55c) returned 1
	[0170.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0x220
	[0170.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.660] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.660] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0170.661] GetLastError () returned 0x0
	[0170.661] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1338, lpOverlapped=0x0) returned 1
	[0170.662] WriteFile (in: hFile=0x514, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1340, lpOverlapped=0x0) returned 1
	[0170.663] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.663] WriteFile (in: hFile=0x514, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.664] SetEndOfFile (hFile=0x514) returned 1
	[0170.664] CloseHandle (hObject=0x514) returned 1
	[0170.664] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.664] SetEndOfFile (hFile=0x55c) returned 1
	[0170.668] CloseHandle (hObject=0x55c) returned 1
	[0170.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 1
	[0170.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.669] lstrlenW (lpString=".doc") returned 4
	[0170.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.669] lstrlenW (lpString=".docx") returned 5
	[0170.669] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.669] lstrlenW (lpString=".pdf") returned 4
	[0170.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.669] lstrlenW (lpString=".xls") returned 4
	[0170.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.669] lstrlenW (lpString=".xlsx") returned 5
	[0170.669] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.669] lstrlenW (lpString=".ppt") returned 4
	[0170.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.669] lstrlenW (lpString=".zip") returned 4
	[0170.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.669] lstrlenW (lpString=".rar") returned 4
	[0170.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.669] lstrlenW (lpString=".bz2") returned 4
	[0170.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.669] lstrlenW (lpString=".7z") returned 3
	[0170.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.670] lstrlenW (lpString=".dbf") returned 4
	[0170.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.670] lstrlenW (lpString=".1cd") returned 4
	[0170.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.670] lstrlenW (lpString=".jpg") returned 4
	[0170.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.670] lstrlenW (lpString=".doc") returned 4
	[0170.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.670] lstrlenW (lpString=".docx") returned 5
	[0170.670] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.670] lstrlenW (lpString=".pdf") returned 4
	[0170.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.670] lstrlenW (lpString=".xls") returned 4
	[0170.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.670] lstrlenW (lpString=".xlsx") returned 5
	[0170.670] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.670] lstrlenW (lpString=".ppt") returned 4
	[0170.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.670] lstrlenW (lpString=".zip") returned 4
	[0170.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.670] lstrlenW (lpString=".rar") returned 4
	[0170.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.671] lstrlenW (lpString=".bz2") returned 4
	[0170.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.671] lstrlenW (lpString=".7z") returned 3
	[0170.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.671] lstrlenW (lpString=".dbf") returned 4
	[0170.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.671] lstrlenW (lpString=".1cd") returned 4
	[0170.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0170.671] lstrlenW (lpString=".jpg") returned 4
	[0170.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.671] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.671] lstrlenW (lpString="J0107452.WMF") returned 12
	[0170.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.672] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=21216) returned 1
	[0170.672] CloseHandle (hObject=0x55c) returned 1
	[0170.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0x220
	[0170.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.673] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.673] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0170.674] GetLastError () returned 0x0
	[0170.674] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x52e0, lpOverlapped=0x0) returned 1
	[0170.676] WriteFile (in: hFile=0x514, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x52f0, lpOverlapped=0x0) returned 1
	[0170.695] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.695] WriteFile (in: hFile=0x514, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.695] SetEndOfFile (hFile=0x514) returned 1
	[0170.970] CloseHandle (hObject=0x514) returned 1
	[0170.970] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.970] SetEndOfFile (hFile=0x55c) returned 1
	[0170.973] CloseHandle (hObject=0x55c) returned 1
	[0170.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 1
	[0171.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.691] lstrlenW (lpString=".doc") returned 4
	[0171.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.692] lstrlenW (lpString=".docx") returned 5
	[0171.692] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0171.692] lstrlenW (lpString=".pdf") returned 4
	[0171.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.692] lstrlenW (lpString=".xls") returned 4
	[0171.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.692] lstrlenW (lpString=".xlsx") returned 5
	[0171.692] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0171.692] lstrlenW (lpString=".ppt") returned 4
	[0171.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.692] lstrlenW (lpString=".zip") returned 4
	[0171.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.692] lstrlenW (lpString=".rar") returned 4
	[0171.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.692] lstrlenW (lpString=".bz2") returned 4
	[0171.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.692] lstrlenW (lpString=".7z") returned 3
	[0171.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.692] lstrlenW (lpString=".dbf") returned 4
	[0171.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.693] lstrlenW (lpString=".1cd") returned 4
	[0171.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.693] lstrlenW (lpString=".jpg") returned 4
	[0171.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.693] lstrlenW (lpString=".doc") returned 4
	[0171.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.693] lstrlenW (lpString=".docx") returned 5
	[0171.693] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0171.693] lstrlenW (lpString=".pdf") returned 4
	[0171.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.693] lstrlenW (lpString=".xls") returned 4
	[0171.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.693] lstrlenW (lpString=".xlsx") returned 5
	[0171.693] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0171.693] lstrlenW (lpString=".ppt") returned 4
	[0171.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.693] lstrlenW (lpString=".zip") returned 4
	[0171.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.693] lstrlenW (lpString=".rar") returned 4
	[0171.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.693] lstrlenW (lpString=".bz2") returned 4
	[0171.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.694] lstrlenW (lpString=".7z") returned 3
	[0171.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.694] lstrlenW (lpString=".dbf") returned 4
	[0171.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.694] lstrlenW (lpString=".1cd") returned 4
	[0171.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.694] lstrlenW (lpString=".jpg") returned 4
	[0171.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.694] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.694] lstrlenW (lpString="J0107514.WMF") returned 12
	[0171.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.695] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=12204) returned 1
	[0171.696] CloseHandle (hObject=0x36c) returned 1
	[0171.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0x220
	[0171.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.696] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.696] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.697] GetLastError () returned 0x0
	[0171.697] ReadFile (in: hFile=0x36c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x2fac, lpOverlapped=0x0) returned 1
	[0171.699] WriteFile (in: hFile=0x4e4, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2fb0, lpOverlapped=0x0) returned 1
	[0171.700] ReadFile (in: hFile=0x36c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.700] WriteFile (in: hFile=0x4e4, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.700] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.701] CloseHandle (hObject=0x4e4) returned 1
	[0171.701] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.701] SetEndOfFile (hFile=0x36c) returned 1
	[0171.704] CloseHandle (hObject=0x36c) returned 1
	[0171.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 1
	[0171.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.705] lstrlenW (lpString=".doc") returned 4
	[0171.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.705] lstrlenW (lpString=".docx") returned 5
	[0171.705] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0171.705] lstrlenW (lpString=".pdf") returned 4
	[0171.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.705] lstrlenW (lpString=".xls") returned 4
	[0171.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.705] lstrlenW (lpString=".xlsx") returned 5
	[0171.705] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0171.705] lstrlenW (lpString=".ppt") returned 4
	[0171.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.706] lstrlenW (lpString=".zip") returned 4
	[0171.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.706] lstrlenW (lpString=".rar") returned 4
	[0171.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.706] lstrlenW (lpString=".bz2") returned 4
	[0171.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.706] lstrlenW (lpString=".7z") returned 3
	[0171.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.706] lstrlenW (lpString=".dbf") returned 4
	[0171.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.706] lstrlenW (lpString=".1cd") returned 4
	[0171.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.706] lstrlenW (lpString=".jpg") returned 4
	[0171.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.706] lstrlenW (lpString=".doc") returned 4
	[0171.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.706] lstrlenW (lpString=".docx") returned 5
	[0171.706] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0171.706] lstrlenW (lpString=".pdf") returned 4
	[0171.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.706] lstrlenW (lpString=".xls") returned 4
	[0171.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.707] lstrlenW (lpString=".xlsx") returned 5
	[0171.707] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0171.707] lstrlenW (lpString=".ppt") returned 4
	[0171.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.707] lstrlenW (lpString=".zip") returned 4
	[0171.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.707] lstrlenW (lpString=".rar") returned 4
	[0171.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.707] lstrlenW (lpString=".bz2") returned 4
	[0171.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.707] lstrlenW (lpString=".7z") returned 3
	[0171.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.707] lstrlenW (lpString=".dbf") returned 4
	[0171.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.707] lstrlenW (lpString=".1cd") returned 4
	[0171.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0171.707] lstrlenW (lpString=".jpg") returned 4
	[0171.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.707] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.707] lstrlenW (lpString="J0107516.WMF") returned 12
	[0171.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.709] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=14008) returned 1
	[0171.709] CloseHandle (hObject=0x36c) returned 1
	[0171.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0x220
	[0171.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.710] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.710] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.711] GetLastError () returned 0x0
	[0171.711] ReadFile (in: hFile=0x36c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x36b8, lpOverlapped=0x0) returned 1
	[0171.713] WriteFile (in: hFile=0x4e4, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x36c0, lpOverlapped=0x0) returned 1
	[0171.714] ReadFile (in: hFile=0x36c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.714] WriteFile (in: hFile=0x4e4, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.714] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.714] CloseHandle (hObject=0x4e4) returned 1
	[0171.714] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.715] SetEndOfFile (hFile=0x36c) returned 1
	[0171.717] CloseHandle (hObject=0x36c) returned 1
	[0171.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 1
	[0171.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.719] lstrlenW (lpString=".doc") returned 4
	[0171.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.719] lstrlenW (lpString=".docx") returned 5
	[0171.719] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0171.719] lstrlenW (lpString=".pdf") returned 4
	[0171.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.719] lstrlenW (lpString=".xls") returned 4
	[0171.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.719] lstrlenW (lpString=".xlsx") returned 5
	[0171.719] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0171.719] lstrlenW (lpString=".ppt") returned 4
	[0171.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.719] lstrlenW (lpString=".zip") returned 4
	[0171.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.719] lstrlenW (lpString=".rar") returned 4
	[0171.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.719] lstrlenW (lpString=".bz2") returned 4
	[0171.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.719] lstrlenW (lpString=".7z") returned 3
	[0171.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.719] lstrlenW (lpString=".dbf") returned 4
	[0171.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.719] lstrlenW (lpString=".1cd") returned 4
	[0171.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.720] lstrlenW (lpString=".jpg") returned 4
	[0171.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.720] lstrlenW (lpString=".doc") returned 4
	[0171.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.720] lstrlenW (lpString=".docx") returned 5
	[0171.720] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0171.720] lstrlenW (lpString=".pdf") returned 4
	[0171.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.720] lstrlenW (lpString=".xls") returned 4
	[0171.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.720] lstrlenW (lpString=".xlsx") returned 5
	[0171.720] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0171.720] lstrlenW (lpString=".ppt") returned 4
	[0171.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.720] lstrlenW (lpString=".zip") returned 4
	[0171.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.720] lstrlenW (lpString=".rar") returned 4
	[0171.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.720] lstrlenW (lpString=".bz2") returned 4
	[0171.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.720] lstrlenW (lpString=".7z") returned 3
	[0171.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.721] lstrlenW (lpString=".dbf") returned 4
	[0171.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.721] lstrlenW (lpString=".1cd") returned 4
	[0171.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0171.721] lstrlenW (lpString=".jpg") returned 4
	[0171.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.721] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.721] lstrlenW (lpString="J0107526.WMF") returned 12
	[0171.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.722] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=7948) returned 1
	[0171.722] CloseHandle (hObject=0x36c) returned 1
	[0171.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 0x220
	[0171.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.723] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.723] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.724] GetLastError () returned 0x0
	[0171.724] ReadFile (in: hFile=0x36c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1f0c, lpOverlapped=0x0) returned 1
	[0171.726] WriteFile (in: hFile=0x4e4, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1f10, lpOverlapped=0x0) returned 1
	[0171.727] ReadFile (in: hFile=0x36c, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.727] WriteFile (in: hFile=0x4e4, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.727] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.727] CloseHandle (hObject=0x4e4) returned 1
	[0171.727] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.727] SetEndOfFile (hFile=0x36c) returned 1
	[0172.027] CloseHandle (hObject=0x36c) returned 1
	[0172.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0172.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 1
	[0172.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.227] lstrlenW (lpString=".doc") returned 4
	[0172.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.227] lstrlenW (lpString=".docx") returned 5
	[0172.227] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0172.227] lstrlenW (lpString=".pdf") returned 4
	[0172.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.227] lstrlenW (lpString=".xls") returned 4
	[0172.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.227] lstrlenW (lpString=".xlsx") returned 5
	[0172.227] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0172.227] lstrlenW (lpString=".ppt") returned 4
	[0172.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.227] lstrlenW (lpString=".zip") returned 4
	[0172.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.227] lstrlenW (lpString=".rar") returned 4
	[0172.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.228] lstrlenW (lpString=".bz2") returned 4
	[0172.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.228] lstrlenW (lpString=".7z") returned 3
	[0172.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.228] lstrlenW (lpString=".dbf") returned 4
	[0172.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.228] lstrlenW (lpString=".1cd") returned 4
	[0172.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.228] lstrlenW (lpString=".jpg") returned 4
	[0172.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.228] lstrlenW (lpString=".doc") returned 4
	[0172.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.228] lstrlenW (lpString=".docx") returned 5
	[0172.228] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0172.228] lstrlenW (lpString=".pdf") returned 4
	[0172.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.228] lstrlenW (lpString=".xls") returned 4
	[0172.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.228] lstrlenW (lpString=".xlsx") returned 5
	[0172.228] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0172.228] lstrlenW (lpString=".ppt") returned 4
	[0172.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.229] lstrlenW (lpString=".zip") returned 4
	[0172.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.229] lstrlenW (lpString=".rar") returned 4
	[0172.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.229] lstrlenW (lpString=".bz2") returned 4
	[0172.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.229] lstrlenW (lpString=".7z") returned 3
	[0172.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.229] lstrlenW (lpString=".dbf") returned 4
	[0172.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.229] lstrlenW (lpString=".1cd") returned 4
	[0172.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0172.229] lstrlenW (lpString=".jpg") returned 4
	[0172.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.229] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0172.229] lstrlenW (lpString="J0107722.WMF") returned 12
	[0172.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0173.037] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=8260) returned 1
	[0173.037] CloseHandle (hObject=0x4e0) returned 1
	[0173.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0x220
	[0173.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.232] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.232] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0174.422] GetLastError () returned 0x0
	[0174.422] ReadFile (in: hFile=0x514, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x2044, lpOverlapped=0x0) returned 1
	[0174.423] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2050, lpOverlapped=0x0) returned 1
	[0174.424] ReadFile (in: hFile=0x514, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.424] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.424] SetEndOfFile (hFile=0x52c) returned 1
	[0174.425] CloseHandle (hObject=0x52c) returned 1
	[0174.425] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.425] SetEndOfFile (hFile=0x514) returned 1
	[0174.427] CloseHandle (hObject=0x514) returned 1
	[0174.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 1
	[0174.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.428] lstrlenW (lpString=".doc") returned 4
	[0174.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.428] lstrlenW (lpString=".docx") returned 5
	[0174.428] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0174.428] lstrlenW (lpString=".pdf") returned 4
	[0174.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.428] lstrlenW (lpString=".xls") returned 4
	[0174.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.428] lstrlenW (lpString=".xlsx") returned 5
	[0174.428] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0174.428] lstrlenW (lpString=".ppt") returned 4
	[0174.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.428] lstrlenW (lpString=".zip") returned 4
	[0174.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.429] lstrlenW (lpString=".rar") returned 4
	[0174.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.429] lstrlenW (lpString=".bz2") returned 4
	[0174.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.429] lstrlenW (lpString=".7z") returned 3
	[0174.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.429] lstrlenW (lpString=".dbf") returned 4
	[0174.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.429] lstrlenW (lpString=".1cd") returned 4
	[0174.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.429] lstrlenW (lpString=".jpg") returned 4
	[0174.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.429] lstrlenW (lpString=".doc") returned 4
	[0174.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.429] lstrlenW (lpString=".docx") returned 5
	[0174.429] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0174.429] lstrlenW (lpString=".pdf") returned 4
	[0174.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.429] lstrlenW (lpString=".xls") returned 4
	[0174.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.429] lstrlenW (lpString=".xlsx") returned 5
	[0174.429] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0174.429] lstrlenW (lpString=".ppt") returned 4
	[0174.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.430] lstrlenW (lpString=".zip") returned 4
	[0174.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.430] lstrlenW (lpString=".rar") returned 4
	[0174.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.430] lstrlenW (lpString=".bz2") returned 4
	[0174.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.430] lstrlenW (lpString=".7z") returned 3
	[0174.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.430] lstrlenW (lpString=".dbf") returned 4
	[0174.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.430] lstrlenW (lpString=".1cd") returned 4
	[0174.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.430] lstrlenW (lpString=".jpg") returned 4
	[0174.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.430] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0174.430] lstrlenW (lpString="J0149018.JPG") returned 12
	[0174.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.432] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=27393) returned 1
	[0174.432] CloseHandle (hObject=0x514) returned 1
	[0174.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 0x220
	[0174.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.433] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.433] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0174.434] GetLastError () returned 0x0
	[0174.434] ReadFile (in: hFile=0x514, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x6b01, lpOverlapped=0x0) returned 1
	[0174.436] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x6b10, lpOverlapped=0x0) returned 1
	[0174.437] ReadFile (in: hFile=0x514, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.438] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.438] SetEndOfFile (hFile=0x52c) returned 1
	[0174.438] CloseHandle (hObject=0x52c) returned 1
	[0174.438] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.438] SetEndOfFile (hFile=0x514) returned 1
	[0174.441] CloseHandle (hObject=0x514) returned 1
	[0174.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 1
	[0174.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.442] lstrlenW (lpString=".doc") returned 4
	[0174.442] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.442] lstrlenW (lpString=".docx") returned 5
	[0174.442] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0174.442] lstrlenW (lpString=".pdf") returned 4
	[0174.442] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.442] lstrlenW (lpString=".xls") returned 4
	[0174.442] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.442] lstrlenW (lpString=".xlsx") returned 5
	[0174.442] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0174.442] lstrlenW (lpString=".ppt") returned 4
	[0174.442] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.442] lstrlenW (lpString=".zip") returned 4
	[0174.442] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.442] lstrlenW (lpString=".rar") returned 4
	[0174.442] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.442] lstrlenW (lpString=".bz2") returned 4
	[0174.442] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.442] lstrlenW (lpString=".7z") returned 3
	[0174.442] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.442] lstrlenW (lpString=".dbf") returned 4
	[0174.442] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.442] lstrlenW (lpString=".1cd") returned 4
	[0174.442] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.443] lstrlenW (lpString=".jpg") returned 4
	[0174.443] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.443] lstrlenW (lpString=".doc") returned 4
	[0174.443] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.443] lstrlenW (lpString=".docx") returned 5
	[0174.443] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0174.443] lstrlenW (lpString=".pdf") returned 4
	[0174.443] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.443] lstrlenW (lpString=".xls") returned 4
	[0174.443] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.443] lstrlenW (lpString=".xlsx") returned 5
	[0174.443] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0174.443] lstrlenW (lpString=".ppt") returned 4
	[0174.443] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.443] lstrlenW (lpString=".zip") returned 4
	[0174.443] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.443] lstrlenW (lpString=".rar") returned 4
	[0174.443] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.443] lstrlenW (lpString=".bz2") returned 4
	[0174.443] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.443] lstrlenW (lpString=".7z") returned 3
	[0174.443] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.443] lstrlenW (lpString=".dbf") returned 4
	[0174.443] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.443] lstrlenW (lpString=".1cd") returned 4
	[0174.443] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0174.444] lstrlenW (lpString=".jpg") returned 4
	[0174.444] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.444] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0174.444] lstrlenW (lpString="J0149118.JPG") returned 12
	[0174.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.444] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=64802) returned 1
	[0174.444] CloseHandle (hObject=0x514) returned 1
	[0174.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0x220
	[0174.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.445] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.445] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0174.446] GetLastError () returned 0x0
	[0174.446] ReadFile (in: hFile=0x514, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0xfd22, lpOverlapped=0x0) returned 1
	[0174.449] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xfd30, lpOverlapped=0x0) returned 1
	[0174.451] ReadFile (in: hFile=0x514, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.451] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.451] SetEndOfFile (hFile=0x52c) returned 1
	[0174.451] CloseHandle (hObject=0x52c) returned 1
	[0174.451] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.451] SetEndOfFile (hFile=0x514) returned 1
	[0174.455] CloseHandle (hObject=0x514) returned 1
	[0174.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 1
	[0174.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.456] lstrlenW (lpString=".doc") returned 4
	[0174.456] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.456] lstrlenW (lpString=".docx") returned 5
	[0174.456] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0174.456] lstrlenW (lpString=".pdf") returned 4
	[0174.456] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.456] lstrlenW (lpString=".xls") returned 4
	[0174.456] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.456] lstrlenW (lpString=".xlsx") returned 5
	[0174.456] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0174.456] lstrlenW (lpString=".ppt") returned 4
	[0174.456] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.456] lstrlenW (lpString=".zip") returned 4
	[0174.456] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.456] lstrlenW (lpString=".rar") returned 4
	[0174.456] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.456] lstrlenW (lpString=".bz2") returned 4
	[0174.456] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.456] lstrlenW (lpString=".7z") returned 3
	[0174.456] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.457] lstrlenW (lpString=".dbf") returned 4
	[0174.457] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.457] lstrlenW (lpString=".1cd") returned 4
	[0174.457] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.457] lstrlenW (lpString=".jpg") returned 4
	[0174.457] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.457] lstrlenW (lpString=".doc") returned 4
	[0174.457] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.457] lstrlenW (lpString=".docx") returned 5
	[0174.457] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0174.457] lstrlenW (lpString=".pdf") returned 4
	[0174.457] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.457] lstrlenW (lpString=".xls") returned 4
	[0174.457] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.457] lstrlenW (lpString=".xlsx") returned 5
	[0174.457] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0174.457] lstrlenW (lpString=".ppt") returned 4
	[0174.457] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.457] lstrlenW (lpString=".zip") returned 4
	[0174.457] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.457] lstrlenW (lpString=".rar") returned 4
	[0174.457] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.457] lstrlenW (lpString=".bz2") returned 4
	[0174.457] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.457] lstrlenW (lpString=".7z") returned 3
	[0174.458] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.458] lstrlenW (lpString=".dbf") returned 4
	[0174.458] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.458] lstrlenW (lpString=".1cd") returned 4
	[0174.458] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0174.458] lstrlenW (lpString=".jpg") returned 4
	[0174.458] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.458] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0174.458] lstrlenW (lpString="J0150150.WMF") returned 12
	[0174.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.459] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=46404) returned 1
	[0174.459] CloseHandle (hObject=0x514) returned 1
	[0174.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0x220
	[0174.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.459] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.459] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0174.460] GetLastError () returned 0x0
	[0174.460] ReadFile (in: hFile=0x514, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0xb544, lpOverlapped=0x0) returned 1
	[0174.572] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xb550, lpOverlapped=0x0) returned 1
	[0174.574] ReadFile (in: hFile=0x514, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.574] WriteFile (in: hFile=0x52c, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.574] SetEndOfFile (hFile=0x52c) returned 1
	[0174.574] CloseHandle (hObject=0x52c) returned 1
	[0174.574] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.574] SetEndOfFile (hFile=0x514) returned 1
	[0174.577] CloseHandle (hObject=0x514) returned 1
	[0174.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 1
	[0174.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.900] lstrlenW (lpString=".doc") returned 4
	[0174.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.900] lstrlenW (lpString=".docx") returned 5
	[0174.900] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0174.900] lstrlenW (lpString=".pdf") returned 4
	[0174.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.900] lstrlenW (lpString=".xls") returned 4
	[0174.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.900] lstrlenW (lpString=".xlsx") returned 5
	[0174.900] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0174.900] lstrlenW (lpString=".ppt") returned 4
	[0174.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.900] lstrlenW (lpString=".zip") returned 4
	[0174.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.900] lstrlenW (lpString=".rar") returned 4
	[0174.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.900] lstrlenW (lpString=".bz2") returned 4
	[0174.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.900] lstrlenW (lpString=".7z") returned 3
	[0174.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.900] lstrlenW (lpString=".dbf") returned 4
	[0174.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.901] lstrlenW (lpString=".1cd") returned 4
	[0174.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.901] lstrlenW (lpString=".jpg") returned 4
	[0174.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.901] lstrlenW (lpString=".doc") returned 4
	[0174.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.901] lstrlenW (lpString=".docx") returned 5
	[0174.901] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0174.901] lstrlenW (lpString=".pdf") returned 4
	[0174.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.901] lstrlenW (lpString=".xls") returned 4
	[0174.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.901] lstrlenW (lpString=".xlsx") returned 5
	[0174.901] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0174.901] lstrlenW (lpString=".ppt") returned 4
	[0174.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.901] lstrlenW (lpString=".zip") returned 4
	[0174.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.901] lstrlenW (lpString=".rar") returned 4
	[0174.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.901] lstrlenW (lpString=".bz2") returned 4
	[0174.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.901] lstrlenW (lpString=".7z") returned 3
	[0174.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.901] lstrlenW (lpString=".dbf") returned 4
	[0174.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.902] lstrlenW (lpString=".1cd") returned 4
	[0174.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0174.902] lstrlenW (lpString=".jpg") returned 4
	[0174.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.902] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0174.902] lstrlenW (lpString="J0151047.WMF") returned 12
	[0174.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0175.021] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=18500) returned 1
	[0175.023] CloseHandle (hObject=0x514) returned 1
	[0175.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0x220
	[0175.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.165] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.165] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.276] GetLastError () returned 0x0
	[0175.276] ReadFile (in: hFile=0x524, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x4844, lpOverlapped=0x0) returned 1
	[0175.279] WriteFile (in: hFile=0x538, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4850, lpOverlapped=0x0) returned 1
	[0175.280] ReadFile (in: hFile=0x524, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.280] WriteFile (in: hFile=0x538, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.280] SetEndOfFile (hFile=0x538) returned 1
	[0175.280] CloseHandle (hObject=0x538) returned 1
	[0175.281] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.281] SetEndOfFile (hFile=0x524) returned 1
	[0175.283] CloseHandle (hObject=0x524) returned 1
	[0175.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 1
	[0176.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.720] lstrlenW (lpString=".doc") returned 4
	[0176.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.720] lstrlenW (lpString=".docx") returned 5
	[0176.720] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0176.720] lstrlenW (lpString=".pdf") returned 4
	[0176.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.720] lstrlenW (lpString=".xls") returned 4
	[0176.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.720] lstrlenW (lpString=".xlsx") returned 5
	[0176.720] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0176.720] lstrlenW (lpString=".ppt") returned 4
	[0176.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.720] lstrlenW (lpString=".zip") returned 4
	[0176.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.720] lstrlenW (lpString=".rar") returned 4
	[0176.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.720] lstrlenW (lpString=".bz2") returned 4
	[0176.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.720] lstrlenW (lpString=".7z") returned 3
	[0176.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.721] lstrlenW (lpString=".dbf") returned 4
	[0176.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.721] lstrlenW (lpString=".1cd") returned 4
	[0176.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.721] lstrlenW (lpString=".jpg") returned 4
	[0176.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.721] lstrlenW (lpString=".doc") returned 4
	[0176.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.721] lstrlenW (lpString=".docx") returned 5
	[0176.721] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0176.721] lstrlenW (lpString=".pdf") returned 4
	[0176.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.721] lstrlenW (lpString=".xls") returned 4
	[0176.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.721] lstrlenW (lpString=".xlsx") returned 5
	[0176.721] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0176.721] lstrlenW (lpString=".ppt") returned 4
	[0176.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.721] lstrlenW (lpString=".zip") returned 4
	[0176.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.721] lstrlenW (lpString=".rar") returned 4
	[0176.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.721] lstrlenW (lpString=".bz2") returned 4
	[0176.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.721] lstrlenW (lpString=".7z") returned 3
	[0176.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.722] lstrlenW (lpString=".dbf") returned 4
	[0176.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.722] lstrlenW (lpString=".1cd") returned 4
	[0176.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0176.722] lstrlenW (lpString=".jpg") returned 4
	[0176.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.722] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.722] lstrlenW (lpString="J0152626.WMF") returned 12
	[0176.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0177.325] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=26248) returned 1
	[0177.325] CloseHandle (hObject=0x550) returned 1
	[0177.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0x220
	[0177.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0177.327] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.327] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0177.328] GetLastError () returned 0x0
	[0177.328] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x6688, lpOverlapped=0x0) returned 1
	[0177.330] WriteFile (in: hFile=0x424, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x6690, lpOverlapped=0x0) returned 1
	[0177.331] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.332] WriteFile (in: hFile=0x424, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.332] SetEndOfFile (hFile=0x424) returned 1
	[0177.332] CloseHandle (hObject=0x424) returned 1
	[0177.332] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.332] SetEndOfFile (hFile=0x550) returned 1
	[0177.335] CloseHandle (hObject=0x550) returned 1
	[0177.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 1
	[0177.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.337] lstrlenW (lpString=".doc") returned 4
	[0177.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.337] lstrlenW (lpString=".docx") returned 5
	[0177.337] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.337] lstrlenW (lpString=".pdf") returned 4
	[0177.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.337] lstrlenW (lpString=".xls") returned 4
	[0177.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.337] lstrlenW (lpString=".xlsx") returned 5
	[0177.337] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.337] lstrlenW (lpString=".ppt") returned 4
	[0177.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.337] lstrlenW (lpString=".zip") returned 4
	[0177.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.337] lstrlenW (lpString=".rar") returned 4
	[0177.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.337] lstrlenW (lpString=".bz2") returned 4
	[0177.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.337] lstrlenW (lpString=".7z") returned 3
	[0177.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.337] lstrlenW (lpString=".dbf") returned 4
	[0177.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.337] lstrlenW (lpString=".1cd") returned 4
	[0177.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.337] lstrlenW (lpString=".jpg") returned 4
	[0177.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.338] lstrlenW (lpString=".doc") returned 4
	[0177.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.338] lstrlenW (lpString=".docx") returned 5
	[0177.338] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.338] lstrlenW (lpString=".pdf") returned 4
	[0177.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.338] lstrlenW (lpString=".xls") returned 4
	[0177.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.338] lstrlenW (lpString=".xlsx") returned 5
	[0177.338] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.338] lstrlenW (lpString=".ppt") returned 4
	[0177.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.338] lstrlenW (lpString=".zip") returned 4
	[0177.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.338] lstrlenW (lpString=".rar") returned 4
	[0177.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.338] lstrlenW (lpString=".bz2") returned 4
	[0177.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.338] lstrlenW (lpString=".7z") returned 3
	[0177.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.338] lstrlenW (lpString=".dbf") returned 4
	[0177.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.338] lstrlenW (lpString=".1cd") returned 4
	[0177.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.338] lstrlenW (lpString=".jpg") returned 4
	[0177.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.339] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0177.339] lstrlenW (lpString="J0152716.WMF") returned 12
	[0177.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0177.340] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=4580) returned 1
	[0177.340] CloseHandle (hObject=0x550) returned 1
	[0177.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 0x220
	[0177.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0177.341] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.341] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0177.341] GetLastError () returned 0x0
	[0177.341] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x11e4, lpOverlapped=0x0) returned 1
	[0177.343] WriteFile (in: hFile=0x424, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x11f0, lpOverlapped=0x0) returned 1
	[0177.344] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.344] WriteFile (in: hFile=0x424, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.344] SetEndOfFile (hFile=0x424) returned 1
	[0177.344] CloseHandle (hObject=0x424) returned 1
	[0177.344] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.344] SetEndOfFile (hFile=0x550) returned 1
	[0177.347] CloseHandle (hObject=0x550) returned 1
	[0177.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 1
	[0177.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.348] lstrlenW (lpString=".doc") returned 4
	[0177.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.348] lstrlenW (lpString=".docx") returned 5
	[0177.348] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.348] lstrlenW (lpString=".pdf") returned 4
	[0177.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.348] lstrlenW (lpString=".xls") returned 4
	[0177.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.348] lstrlenW (lpString=".xlsx") returned 5
	[0177.348] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.348] lstrlenW (lpString=".ppt") returned 4
	[0177.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.348] lstrlenW (lpString=".zip") returned 4
	[0177.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.348] lstrlenW (lpString=".rar") returned 4
	[0177.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.348] lstrlenW (lpString=".bz2") returned 4
	[0177.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.348] lstrlenW (lpString=".7z") returned 3
	[0177.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.349] lstrlenW (lpString=".dbf") returned 4
	[0177.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.349] lstrlenW (lpString=".1cd") returned 4
	[0177.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.349] lstrlenW (lpString=".jpg") returned 4
	[0177.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.349] lstrlenW (lpString=".doc") returned 4
	[0177.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.349] lstrlenW (lpString=".docx") returned 5
	[0177.349] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.349] lstrlenW (lpString=".pdf") returned 4
	[0177.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.349] lstrlenW (lpString=".xls") returned 4
	[0177.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.349] lstrlenW (lpString=".xlsx") returned 5
	[0177.349] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.349] lstrlenW (lpString=".ppt") returned 4
	[0177.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.349] lstrlenW (lpString=".zip") returned 4
	[0177.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.349] lstrlenW (lpString=".rar") returned 4
	[0177.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.349] lstrlenW (lpString=".bz2") returned 4
	[0177.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.349] lstrlenW (lpString=".7z") returned 3
	[0177.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.350] lstrlenW (lpString=".dbf") returned 4
	[0177.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.350] lstrlenW (lpString=".1cd") returned 4
	[0177.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0177.350] lstrlenW (lpString=".jpg") returned 4
	[0177.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.350] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0177.350] lstrlenW (lpString="J0152722.WMF") returned 12
	[0177.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0177.351] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=7020) returned 1
	[0177.352] CloseHandle (hObject=0x550) returned 1
	[0177.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 0x220
	[0177.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0177.353] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.353] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0177.354] GetLastError () returned 0x0
	[0177.354] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1b6c, lpOverlapped=0x0) returned 1
	[0177.355] WriteFile (in: hFile=0x424, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1b70, lpOverlapped=0x0) returned 1
	[0177.356] ReadFile (in: hFile=0x550, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.356] WriteFile (in: hFile=0x424, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.356] SetEndOfFile (hFile=0x424) returned 1
	[0177.356] CloseHandle (hObject=0x424) returned 1
	[0177.356] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.356] SetEndOfFile (hFile=0x550) returned 1
	[0177.359] CloseHandle (hObject=0x550) returned 1
	[0177.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 1
	[0177.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.360] lstrlenW (lpString=".doc") returned 4
	[0177.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.360] lstrlenW (lpString=".docx") returned 5
	[0177.360] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0177.360] lstrlenW (lpString=".pdf") returned 4
	[0177.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.361] lstrlenW (lpString=".xls") returned 4
	[0177.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.361] lstrlenW (lpString=".xlsx") returned 5
	[0177.361] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0177.361] lstrlenW (lpString=".ppt") returned 4
	[0177.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.361] lstrlenW (lpString=".zip") returned 4
	[0177.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.361] lstrlenW (lpString=".rar") returned 4
	[0177.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.361] lstrlenW (lpString=".bz2") returned 4
	[0177.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.361] lstrlenW (lpString=".7z") returned 3
	[0177.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.361] lstrlenW (lpString=".dbf") returned 4
	[0177.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.361] lstrlenW (lpString=".1cd") returned 4
	[0177.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.361] lstrlenW (lpString=".jpg") returned 4
	[0177.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.361] lstrlenW (lpString=".doc") returned 4
	[0177.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.361] lstrlenW (lpString=".docx") returned 5
	[0177.361] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0177.361] lstrlenW (lpString=".pdf") returned 4
	[0177.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.362] lstrlenW (lpString=".xls") returned 4
	[0177.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.362] lstrlenW (lpString=".xlsx") returned 5
	[0177.362] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0177.362] lstrlenW (lpString=".ppt") returned 4
	[0177.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.362] lstrlenW (lpString=".zip") returned 4
	[0177.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.362] lstrlenW (lpString=".rar") returned 4
	[0177.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.362] lstrlenW (lpString=".bz2") returned 4
	[0177.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.362] lstrlenW (lpString=".7z") returned 3
	[0177.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.362] lstrlenW (lpString=".dbf") returned 4
	[0177.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.362] lstrlenW (lpString=".1cd") returned 4
	[0177.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0177.362] lstrlenW (lpString=".jpg") returned 4
	[0177.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.362] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0177.362] lstrlenW (lpString="J0152876.WMF") returned 12
	[0177.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0177.749] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=7876) returned 1
	[0177.749] CloseHandle (hObject=0x4e4) returned 1
	[0177.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 0x220
	[0177.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0177.750] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.750] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0177.751] GetLastError () returned 0x0
	[0177.751] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1ec4, lpOverlapped=0x0) returned 1
	[0177.754] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1ed0, lpOverlapped=0x0) returned 1
	[0177.755] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.755] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.755] SetEndOfFile (hFile=0x4bc) returned 1
	[0177.755] CloseHandle (hObject=0x4bc) returned 1
	[0177.755] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.755] SetEndOfFile (hFile=0x4e4) returned 1
	[0177.758] CloseHandle (hObject=0x4e4) returned 1
	[0177.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 1
	[0177.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.760] lstrlenW (lpString=".doc") returned 4
	[0177.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.760] lstrlenW (lpString=".docx") returned 5
	[0177.760] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.760] lstrlenW (lpString=".pdf") returned 4
	[0177.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.760] lstrlenW (lpString=".xls") returned 4
	[0177.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.760] lstrlenW (lpString=".xlsx") returned 5
	[0177.760] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.760] lstrlenW (lpString=".ppt") returned 4
	[0177.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.760] lstrlenW (lpString=".zip") returned 4
	[0177.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.760] lstrlenW (lpString=".rar") returned 4
	[0177.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.760] lstrlenW (lpString=".bz2") returned 4
	[0177.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.760] lstrlenW (lpString=".7z") returned 3
	[0177.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.760] lstrlenW (lpString=".dbf") returned 4
	[0177.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.761] lstrlenW (lpString=".1cd") returned 4
	[0177.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.761] lstrlenW (lpString=".jpg") returned 4
	[0177.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.761] lstrlenW (lpString=".doc") returned 4
	[0177.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.761] lstrlenW (lpString=".docx") returned 5
	[0177.761] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.761] lstrlenW (lpString=".pdf") returned 4
	[0177.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.761] lstrlenW (lpString=".xls") returned 4
	[0177.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.761] lstrlenW (lpString=".xlsx") returned 5
	[0177.761] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.761] lstrlenW (lpString=".ppt") returned 4
	[0177.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.761] lstrlenW (lpString=".zip") returned 4
	[0177.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.761] lstrlenW (lpString=".rar") returned 4
	[0177.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.761] lstrlenW (lpString=".bz2") returned 4
	[0177.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.761] lstrlenW (lpString=".7z") returned 3
	[0177.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.761] lstrlenW (lpString=".dbf") returned 4
	[0177.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.762] lstrlenW (lpString=".1cd") returned 4
	[0177.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0177.762] lstrlenW (lpString=".jpg") returned 4
	[0177.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.762] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0177.762] lstrlenW (lpString="J0152882.WMF") returned 12
	[0177.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0177.763] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=9072) returned 1
	[0177.763] CloseHandle (hObject=0x4e4) returned 1
	[0177.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 0x220
	[0177.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0177.764] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.764] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0177.765] GetLastError () returned 0x0
	[0177.765] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x2370, lpOverlapped=0x0) returned 1
	[0177.767] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2380, lpOverlapped=0x0) returned 1
	[0177.946] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.947] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.947] SetEndOfFile (hFile=0x4bc) returned 1
	[0177.947] CloseHandle (hObject=0x4bc) returned 1
	[0177.947] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.947] SetEndOfFile (hFile=0x4e4) returned 1
	[0177.950] CloseHandle (hObject=0x4e4) returned 1
	[0177.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 1
	[0177.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.951] lstrlenW (lpString=".doc") returned 4
	[0177.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.951] lstrlenW (lpString=".docx") returned 5
	[0177.951] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0177.951] lstrlenW (lpString=".pdf") returned 4
	[0177.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.951] lstrlenW (lpString=".xls") returned 4
	[0177.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.951] lstrlenW (lpString=".xlsx") returned 5
	[0177.951] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0177.951] lstrlenW (lpString=".ppt") returned 4
	[0177.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.952] lstrlenW (lpString=".zip") returned 4
	[0177.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.952] lstrlenW (lpString=".rar") returned 4
	[0177.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.952] lstrlenW (lpString=".bz2") returned 4
	[0177.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.952] lstrlenW (lpString=".7z") returned 3
	[0177.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.952] lstrlenW (lpString=".dbf") returned 4
	[0177.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.952] lstrlenW (lpString=".1cd") returned 4
	[0177.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.952] lstrlenW (lpString=".jpg") returned 4
	[0177.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.952] lstrlenW (lpString=".doc") returned 4
	[0177.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.952] lstrlenW (lpString=".docx") returned 5
	[0177.952] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0177.952] lstrlenW (lpString=".pdf") returned 4
	[0177.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.952] lstrlenW (lpString=".xls") returned 4
	[0177.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.952] lstrlenW (lpString=".xlsx") returned 5
	[0177.953] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0177.953] lstrlenW (lpString=".ppt") returned 4
	[0177.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.953] lstrlenW (lpString=".zip") returned 4
	[0177.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.953] lstrlenW (lpString=".rar") returned 4
	[0177.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.953] lstrlenW (lpString=".bz2") returned 4
	[0177.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.953] lstrlenW (lpString=".7z") returned 3
	[0177.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.953] lstrlenW (lpString=".dbf") returned 4
	[0177.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.953] lstrlenW (lpString=".1cd") returned 4
	[0177.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0177.953] lstrlenW (lpString=".jpg") returned 4
	[0177.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.953] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0177.953] lstrlenW (lpString="J0152884.WMF") returned 12
	[0177.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0177.955] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=6956) returned 1
	[0177.955] CloseHandle (hObject=0x4e4) returned 1
	[0177.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 0x220
	[0177.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0177.956] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.956] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0177.956] GetLastError () returned 0x0
	[0177.956] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1b2c, lpOverlapped=0x0) returned 1
	[0177.958] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1b30, lpOverlapped=0x0) returned 1
	[0177.959] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.959] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.959] SetEndOfFile (hFile=0x4bc) returned 1
	[0177.959] CloseHandle (hObject=0x4bc) returned 1
	[0177.959] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.959] SetEndOfFile (hFile=0x4e4) returned 1
	[0178.199] CloseHandle (hObject=0x4e4) returned 1
	[0178.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 1
	[0178.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.200] lstrlenW (lpString=".doc") returned 4
	[0178.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.200] lstrlenW (lpString=".docx") returned 5
	[0178.200] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0178.201] lstrlenW (lpString=".pdf") returned 4
	[0178.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.201] lstrlenW (lpString=".xls") returned 4
	[0178.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.201] lstrlenW (lpString=".xlsx") returned 5
	[0178.201] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0178.201] lstrlenW (lpString=".ppt") returned 4
	[0178.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.201] lstrlenW (lpString=".zip") returned 4
	[0178.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.201] lstrlenW (lpString=".rar") returned 4
	[0178.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.201] lstrlenW (lpString=".bz2") returned 4
	[0178.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.201] lstrlenW (lpString=".7z") returned 3
	[0178.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.201] lstrlenW (lpString=".dbf") returned 4
	[0178.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.201] lstrlenW (lpString=".1cd") returned 4
	[0178.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.201] lstrlenW (lpString=".jpg") returned 4
	[0178.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.201] lstrlenW (lpString=".doc") returned 4
	[0178.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.202] lstrlenW (lpString=".docx") returned 5
	[0178.202] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0178.202] lstrlenW (lpString=".pdf") returned 4
	[0178.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.202] lstrlenW (lpString=".xls") returned 4
	[0178.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.202] lstrlenW (lpString=".xlsx") returned 5
	[0178.202] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0178.202] lstrlenW (lpString=".ppt") returned 4
	[0178.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.202] lstrlenW (lpString=".zip") returned 4
	[0178.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.202] lstrlenW (lpString=".rar") returned 4
	[0178.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.202] lstrlenW (lpString=".bz2") returned 4
	[0178.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.202] lstrlenW (lpString=".7z") returned 3
	[0178.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.202] lstrlenW (lpString=".dbf") returned 4
	[0178.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.202] lstrlenW (lpString=".1cd") returned 4
	[0178.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0178.202] lstrlenW (lpString=".jpg") returned 4
	[0178.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.203] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0178.203] lstrlenW (lpString="J0152898.WMF") returned 12
	[0178.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.204] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=4496) returned 1
	[0178.204] CloseHandle (hObject=0x4e4) returned 1
	[0178.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 0x220
	[0178.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.204] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.204] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0178.205] GetLastError () returned 0x0
	[0178.205] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1190, lpOverlapped=0x0) returned 1
	[0178.207] WriteFile (in: hFile=0x540, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x11a0, lpOverlapped=0x0) returned 1
	[0178.208] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.208] WriteFile (in: hFile=0x540, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.208] SetEndOfFile (hFile=0x540) returned 1
	[0178.208] CloseHandle (hObject=0x540) returned 1
	[0178.208] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.208] SetEndOfFile (hFile=0x4e4) returned 1
	[0178.211] CloseHandle (hObject=0x4e4) returned 1
	[0178.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 1
	[0178.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.213] lstrlenW (lpString=".doc") returned 4
	[0178.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.213] lstrlenW (lpString=".docx") returned 5
	[0178.213] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0178.213] lstrlenW (lpString=".pdf") returned 4
	[0178.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.213] lstrlenW (lpString=".xls") returned 4
	[0178.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.213] lstrlenW (lpString=".xlsx") returned 5
	[0178.213] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0178.213] lstrlenW (lpString=".ppt") returned 4
	[0178.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.213] lstrlenW (lpString=".zip") returned 4
	[0178.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.213] lstrlenW (lpString=".rar") returned 4
	[0178.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.213] lstrlenW (lpString=".bz2") returned 4
	[0178.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.213] lstrlenW (lpString=".7z") returned 3
	[0178.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.213] lstrlenW (lpString=".dbf") returned 4
	[0178.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.213] lstrlenW (lpString=".1cd") returned 4
	[0178.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.213] lstrlenW (lpString=".jpg") returned 4
	[0178.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.214] lstrlenW (lpString=".doc") returned 4
	[0178.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.214] lstrlenW (lpString=".docx") returned 5
	[0178.214] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0178.214] lstrlenW (lpString=".pdf") returned 4
	[0178.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.214] lstrlenW (lpString=".xls") returned 4
	[0178.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.214] lstrlenW (lpString=".xlsx") returned 5
	[0178.214] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0178.214] lstrlenW (lpString=".ppt") returned 4
	[0178.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.214] lstrlenW (lpString=".zip") returned 4
	[0178.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.214] lstrlenW (lpString=".rar") returned 4
	[0178.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.214] lstrlenW (lpString=".bz2") returned 4
	[0178.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.214] lstrlenW (lpString=".7z") returned 3
	[0178.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.214] lstrlenW (lpString=".dbf") returned 4
	[0178.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.214] lstrlenW (lpString=".1cd") returned 4
	[0178.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0178.214] lstrlenW (lpString=".jpg") returned 4
	[0178.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.215] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0178.215] lstrlenW (lpString="J0153047.WMF") returned 12
	[0178.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.215] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=33068) returned 1
	[0178.215] CloseHandle (hObject=0x4e4) returned 1
	[0178.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 0x220
	[0178.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.216] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.216] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0178.217] GetLastError () returned 0x0
	[0178.217] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x812c, lpOverlapped=0x0) returned 1
	[0178.219] WriteFile (in: hFile=0x540, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x8130, lpOverlapped=0x0) returned 1
	[0178.220] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.221] WriteFile (in: hFile=0x540, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.221] SetEndOfFile (hFile=0x540) returned 1
	[0178.221] CloseHandle (hObject=0x540) returned 1
	[0178.221] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.221] SetEndOfFile (hFile=0x4e4) returned 1
	[0178.224] CloseHandle (hObject=0x4e4) returned 1
	[0178.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 1
	[0178.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.225] lstrlenW (lpString=".doc") returned 4
	[0178.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.225] lstrlenW (lpString=".docx") returned 5
	[0178.225] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0178.225] lstrlenW (lpString=".pdf") returned 4
	[0178.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.225] lstrlenW (lpString=".xls") returned 4
	[0178.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.225] lstrlenW (lpString=".xlsx") returned 5
	[0178.225] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0178.225] lstrlenW (lpString=".ppt") returned 4
	[0178.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.225] lstrlenW (lpString=".zip") returned 4
	[0178.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.225] lstrlenW (lpString=".rar") returned 4
	[0178.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.225] lstrlenW (lpString=".bz2") returned 4
	[0178.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.225] lstrlenW (lpString=".7z") returned 3
	[0178.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.225] lstrlenW (lpString=".dbf") returned 4
	[0178.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.225] lstrlenW (lpString=".1cd") returned 4
	[0178.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.226] lstrlenW (lpString=".jpg") returned 4
	[0178.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.226] lstrlenW (lpString=".doc") returned 4
	[0178.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.226] lstrlenW (lpString=".docx") returned 5
	[0178.226] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0178.226] lstrlenW (lpString=".pdf") returned 4
	[0178.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.226] lstrlenW (lpString=".xls") returned 4
	[0178.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.226] lstrlenW (lpString=".xlsx") returned 5
	[0178.226] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0178.226] lstrlenW (lpString=".ppt") returned 4
	[0178.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.226] lstrlenW (lpString=".zip") returned 4
	[0178.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.226] lstrlenW (lpString=".rar") returned 4
	[0178.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.226] lstrlenW (lpString=".bz2") returned 4
	[0178.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.226] lstrlenW (lpString=".7z") returned 3
	[0178.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.226] lstrlenW (lpString=".dbf") returned 4
	[0178.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.226] lstrlenW (lpString=".1cd") returned 4
	[0178.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0178.227] lstrlenW (lpString=".jpg") returned 4
	[0178.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.227] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0178.227] lstrlenW (lpString="J0153087.WMF") returned 12
	[0178.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.228] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=1912) returned 1
	[0178.228] CloseHandle (hObject=0x4e4) returned 1
	[0178.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 0x220
	[0178.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.229] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.229] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0178.229] GetLastError () returned 0x0
	[0178.230] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x778, lpOverlapped=0x0) returned 1
	[0178.231] WriteFile (in: hFile=0x540, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x780, lpOverlapped=0x0) returned 1
	[0178.232] ReadFile (in: hFile=0x4e4, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.232] WriteFile (in: hFile=0x540, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.232] SetEndOfFile (hFile=0x540) returned 1
	[0178.232] CloseHandle (hObject=0x540) returned 1
	[0178.232] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.232] SetEndOfFile (hFile=0x4e4) returned 1
	[0178.234] CloseHandle (hObject=0x4e4) returned 1
	[0178.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 1
	[0178.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.235] lstrlenW (lpString=".doc") returned 4
	[0178.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.235] lstrlenW (lpString=".docx") returned 5
	[0178.236] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0178.236] lstrlenW (lpString=".pdf") returned 4
	[0178.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.236] lstrlenW (lpString=".xls") returned 4
	[0178.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.236] lstrlenW (lpString=".xlsx") returned 5
	[0178.236] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0178.236] lstrlenW (lpString=".ppt") returned 4
	[0178.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.236] lstrlenW (lpString=".zip") returned 4
	[0178.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.236] lstrlenW (lpString=".rar") returned 4
	[0178.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.236] lstrlenW (lpString=".bz2") returned 4
	[0178.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.236] lstrlenW (lpString=".7z") returned 3
	[0178.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.236] lstrlenW (lpString=".dbf") returned 4
	[0178.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.236] lstrlenW (lpString=".1cd") returned 4
	[0178.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.236] lstrlenW (lpString=".jpg") returned 4
	[0178.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.236] lstrlenW (lpString=".doc") returned 4
	[0178.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.237] lstrlenW (lpString=".docx") returned 5
	[0178.237] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0178.237] lstrlenW (lpString=".pdf") returned 4
	[0178.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.237] lstrlenW (lpString=".xls") returned 4
	[0178.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.237] lstrlenW (lpString=".xlsx") returned 5
	[0178.237] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0178.237] lstrlenW (lpString=".ppt") returned 4
	[0178.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.237] lstrlenW (lpString=".zip") returned 4
	[0178.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.237] lstrlenW (lpString=".rar") returned 4
	[0178.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.237] lstrlenW (lpString=".bz2") returned 4
	[0178.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.237] lstrlenW (lpString=".7z") returned 3
	[0178.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.237] lstrlenW (lpString=".dbf") returned 4
	[0178.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.237] lstrlenW (lpString=".1cd") returned 4
	[0178.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0178.237] lstrlenW (lpString=".jpg") returned 4
	[0178.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.238] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0178.238] lstrlenW (lpString="J0153089.WMF") returned 12
	[0178.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.238] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=7848) returned 1
	[0178.238] CloseHandle (hObject=0x4e4) returned 1
	[0178.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 0x220
	[0178.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0179.516] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.516] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0179.650] GetLastError () returned 0x0
	[0179.650] ReadFile (in: hFile=0x500, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1ea8, lpOverlapped=0x0) returned 1
	[0179.652] WriteFile (in: hFile=0x444, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1eb0, lpOverlapped=0x0) returned 1
	[0179.653] ReadFile (in: hFile=0x500, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.653] WriteFile (in: hFile=0x444, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.653] SetEndOfFile (hFile=0x444) returned 1
	[0179.653] CloseHandle (hObject=0x444) returned 1
	[0179.653] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.653] SetEndOfFile (hFile=0x500) returned 1
	[0179.660] CloseHandle (hObject=0x500) returned 1
	[0179.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 1
	[0179.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.661] lstrlenW (lpString=".doc") returned 4
	[0179.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.661] lstrlenW (lpString=".docx") returned 5
	[0179.661] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0179.661] lstrlenW (lpString=".pdf") returned 4
	[0179.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.661] lstrlenW (lpString=".xls") returned 4
	[0179.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.661] lstrlenW (lpString=".xlsx") returned 5
	[0179.661] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0179.661] lstrlenW (lpString=".ppt") returned 4
	[0179.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.661] lstrlenW (lpString=".zip") returned 4
	[0179.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.661] lstrlenW (lpString=".rar") returned 4
	[0179.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.661] lstrlenW (lpString=".bz2") returned 4
	[0179.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.662] lstrlenW (lpString=".7z") returned 3
	[0179.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.662] lstrlenW (lpString=".dbf") returned 4
	[0179.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.662] lstrlenW (lpString=".1cd") returned 4
	[0179.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.662] lstrlenW (lpString=".jpg") returned 4
	[0179.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.662] lstrlenW (lpString=".doc") returned 4
	[0179.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.662] lstrlenW (lpString=".docx") returned 5
	[0179.662] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0179.662] lstrlenW (lpString=".pdf") returned 4
	[0179.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.662] lstrlenW (lpString=".xls") returned 4
	[0179.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.662] lstrlenW (lpString=".xlsx") returned 5
	[0179.662] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0179.662] lstrlenW (lpString=".ppt") returned 4
	[0179.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.662] lstrlenW (lpString=".zip") returned 4
	[0179.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.662] lstrlenW (lpString=".rar") returned 4
	[0179.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.663] lstrlenW (lpString=".bz2") returned 4
	[0179.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.663] lstrlenW (lpString=".7z") returned 3
	[0179.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.663] lstrlenW (lpString=".dbf") returned 4
	[0179.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.663] lstrlenW (lpString=".1cd") returned 4
	[0179.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0179.663] lstrlenW (lpString=".jpg") returned 4
	[0179.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.663] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.663] lstrlenW (lpString="J0153302.WMF") returned 12
	[0179.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0179.664] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=30800) returned 1
	[0179.664] CloseHandle (hObject=0x500) returned 1
	[0179.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 0x220
	[0179.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0179.665] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.665] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.665] GetLastError () returned 0x0
	[0179.665] ReadFile (in: hFile=0x500, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x7850, lpOverlapped=0x0) returned 1
	[0179.680] WriteFile (in: hFile=0x370, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x7860, lpOverlapped=0x0) returned 1
	[0179.681] ReadFile (in: hFile=0x500, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.681] WriteFile (in: hFile=0x370, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.681] SetEndOfFile (hFile=0x370) returned 1
	[0179.681] CloseHandle (hObject=0x370) returned 1
	[0179.681] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.681] SetEndOfFile (hFile=0x500) returned 1
	[0179.684] CloseHandle (hObject=0x500) returned 1
	[0179.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 1
	[0179.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.686] lstrlenW (lpString=".doc") returned 4
	[0179.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.686] lstrlenW (lpString=".docx") returned 5
	[0179.686] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0179.686] lstrlenW (lpString=".pdf") returned 4
	[0179.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.686] lstrlenW (lpString=".xls") returned 4
	[0179.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.686] lstrlenW (lpString=".xlsx") returned 5
	[0179.686] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0179.686] lstrlenW (lpString=".ppt") returned 4
	[0179.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.686] lstrlenW (lpString=".zip") returned 4
	[0179.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.686] lstrlenW (lpString=".rar") returned 4
	[0179.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.686] lstrlenW (lpString=".bz2") returned 4
	[0179.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.686] lstrlenW (lpString=".7z") returned 3
	[0179.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.686] lstrlenW (lpString=".dbf") returned 4
	[0179.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.686] lstrlenW (lpString=".1cd") returned 4
	[0179.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.686] lstrlenW (lpString=".jpg") returned 4
	[0179.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.687] lstrlenW (lpString=".doc") returned 4
	[0179.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.687] lstrlenW (lpString=".docx") returned 5
	[0179.687] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0179.687] lstrlenW (lpString=".pdf") returned 4
	[0179.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.687] lstrlenW (lpString=".xls") returned 4
	[0179.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.687] lstrlenW (lpString=".xlsx") returned 5
	[0179.687] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0179.687] lstrlenW (lpString=".ppt") returned 4
	[0179.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.687] lstrlenW (lpString=".zip") returned 4
	[0179.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.687] lstrlenW (lpString=".rar") returned 4
	[0179.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.687] lstrlenW (lpString=".bz2") returned 4
	[0179.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.687] lstrlenW (lpString=".7z") returned 3
	[0179.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.687] lstrlenW (lpString=".dbf") returned 4
	[0179.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.687] lstrlenW (lpString=".1cd") returned 4
	[0179.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68
	[0179.687] lstrlenW (lpString=".jpg") returned 4
	[0179.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.688] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.688] lstrlenW (lpString="J0153307.WMF") returned 12
	[0179.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0179.688] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=15448) returned 1
	[0179.688] CloseHandle (hObject=0x500) returned 1
	[0179.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf")) returned 0x220
	[0179.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0179.689] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.689] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.690] GetLastError () returned 0x0
	[0179.690] ReadFile (in: hFile=0x500, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x3c58, lpOverlapped=0x0) returned 1
	[0179.694] WriteFile (in: hFile=0x370, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x3c60, lpOverlapped=0x0) returned 1
	[0179.696] ReadFile (in: hFile=0x500, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.696] WriteFile (in: hFile=0x370, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.696] SetEndOfFile (hFile=0x370) returned 1
	[0179.697] CloseHandle (hObject=0x370) returned 1
	[0179.700] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.700] SetEndOfFile (hFile=0x500) returned 1
	[0179.704] CloseHandle (hObject=0x500) returned 1
	[0179.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf")) returned 1
	[0179.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.708] lstrlenW (lpString=".doc") returned 4
	[0179.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.708] lstrlenW (lpString=".docx") returned 5
	[0179.708] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0179.708] lstrlenW (lpString=".pdf") returned 4
	[0179.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.708] lstrlenW (lpString=".xls") returned 4
	[0179.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.708] lstrlenW (lpString=".xlsx") returned 5
	[0179.708] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0179.708] lstrlenW (lpString=".ppt") returned 4
	[0179.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.708] lstrlenW (lpString=".zip") returned 4
	[0179.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.708] lstrlenW (lpString=".rar") returned 4
	[0179.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.708] lstrlenW (lpString=".bz2") returned 4
	[0179.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.708] lstrlenW (lpString=".7z") returned 3
	[0179.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.709] lstrlenW (lpString=".dbf") returned 4
	[0179.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.709] lstrlenW (lpString=".1cd") returned 4
	[0179.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.709] lstrlenW (lpString=".jpg") returned 4
	[0179.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.709] lstrlenW (lpString=".doc") returned 4
	[0179.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.709] lstrlenW (lpString=".docx") returned 5
	[0179.709] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0179.709] lstrlenW (lpString=".pdf") returned 4
	[0179.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.709] lstrlenW (lpString=".xls") returned 4
	[0179.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.709] lstrlenW (lpString=".xlsx") returned 5
	[0179.709] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0179.709] lstrlenW (lpString=".ppt") returned 4
	[0179.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.709] lstrlenW (lpString=".zip") returned 4
	[0179.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.709] lstrlenW (lpString=".rar") returned 4
	[0179.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.709] lstrlenW (lpString=".bz2") returned 4
	[0179.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.710] lstrlenW (lpString=".7z") returned 3
	[0179.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.710] lstrlenW (lpString=".dbf") returned 4
	[0179.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.710] lstrlenW (lpString=".1cd") returned 4
	[0179.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68
	[0179.710] lstrlenW (lpString=".jpg") returned 4
	[0179.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.710] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.710] lstrlenW (lpString="J0153398.WMF") returned 12
	[0179.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0179.975] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=17508) returned 1
	[0179.985] CloseHandle (hObject=0x534) returned 1
	[0179.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 0x220
	[0179.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0179.986] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.986] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0179.987] GetLastError () returned 0x0
	[0179.987] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x4464, lpOverlapped=0x0) returned 1
	[0179.989] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4470, lpOverlapped=0x0) returned 1
	[0179.990] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.990] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.990] SetEndOfFile (hFile=0x4bc) returned 1
	[0179.990] CloseHandle (hObject=0x4bc) returned 1
	[0179.991] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.991] SetEndOfFile (hFile=0x534) returned 1
	[0179.993] CloseHandle (hObject=0x534) returned 1
	[0179.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 1
	[0179.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.994] lstrlenW (lpString=".doc") returned 4
	[0179.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.994] lstrlenW (lpString=".docx") returned 5
	[0179.994] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0179.995] lstrlenW (lpString=".pdf") returned 4
	[0179.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.995] lstrlenW (lpString=".xls") returned 4
	[0179.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.995] lstrlenW (lpString=".xlsx") returned 5
	[0179.995] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0179.995] lstrlenW (lpString=".ppt") returned 4
	[0179.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.995] lstrlenW (lpString=".zip") returned 4
	[0179.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.995] lstrlenW (lpString=".rar") returned 4
	[0179.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.995] lstrlenW (lpString=".bz2") returned 4
	[0179.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.995] lstrlenW (lpString=".7z") returned 3
	[0179.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.995] lstrlenW (lpString=".dbf") returned 4
	[0179.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.995] lstrlenW (lpString=".1cd") returned 4
	[0179.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.995] lstrlenW (lpString=".jpg") returned 4
	[0179.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.995] lstrlenW (lpString=".doc") returned 4
	[0179.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.995] lstrlenW (lpString=".docx") returned 5
	[0179.996] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0179.996] lstrlenW (lpString=".pdf") returned 4
	[0179.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.996] lstrlenW (lpString=".xls") returned 4
	[0179.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.996] lstrlenW (lpString=".xlsx") returned 5
	[0179.996] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0179.996] lstrlenW (lpString=".ppt") returned 4
	[0179.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.996] lstrlenW (lpString=".zip") returned 4
	[0179.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.996] lstrlenW (lpString=".rar") returned 4
	[0179.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.996] lstrlenW (lpString=".bz2") returned 4
	[0179.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.996] lstrlenW (lpString=".7z") returned 3
	[0179.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.996] lstrlenW (lpString=".dbf") returned 4
	[0179.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.996] lstrlenW (lpString=".1cd") returned 4
	[0179.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68
	[0179.996] lstrlenW (lpString=".jpg") returned 4
	[0179.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.997] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.997] lstrlenW (lpString="J0157191.WMF") returned 12
	[0179.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0179.998] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=17912) returned 1
	[0179.998] CloseHandle (hObject=0x534) returned 1
	[0179.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 0x220
	[0179.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0179.998] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.998] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0179.999] GetLastError () returned 0x0
	[0179.999] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x45f8, lpOverlapped=0x0) returned 1
	[0180.001] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4600, lpOverlapped=0x0) returned 1
	[0180.002] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.002] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.002] SetEndOfFile (hFile=0x4bc) returned 1
	[0180.002] CloseHandle (hObject=0x4bc) returned 1
	[0180.003] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.003] SetEndOfFile (hFile=0x534) returned 1
	[0180.005] CloseHandle (hObject=0x534) returned 1
	[0180.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 1
	[0180.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.007] lstrlenW (lpString=".doc") returned 4
	[0180.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.007] lstrlenW (lpString=".docx") returned 5
	[0180.007] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0180.007] lstrlenW (lpString=".pdf") returned 4
	[0180.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.007] lstrlenW (lpString=".xls") returned 4
	[0180.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.007] lstrlenW (lpString=".xlsx") returned 5
	[0180.007] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0180.007] lstrlenW (lpString=".ppt") returned 4
	[0180.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.008] lstrlenW (lpString=".zip") returned 4
	[0180.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.008] lstrlenW (lpString=".rar") returned 4
	[0180.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.008] lstrlenW (lpString=".bz2") returned 4
	[0180.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.008] lstrlenW (lpString=".7z") returned 3
	[0180.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.008] lstrlenW (lpString=".dbf") returned 4
	[0180.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.008] lstrlenW (lpString=".1cd") returned 4
	[0180.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.008] lstrlenW (lpString=".jpg") returned 4
	[0180.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.009] lstrlenW (lpString=".doc") returned 4
	[0180.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.009] lstrlenW (lpString=".docx") returned 5
	[0180.009] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0180.009] lstrlenW (lpString=".pdf") returned 4
	[0180.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.009] lstrlenW (lpString=".xls") returned 4
	[0180.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.009] lstrlenW (lpString=".xlsx") returned 5
	[0180.009] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0180.009] lstrlenW (lpString=".ppt") returned 4
	[0180.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.009] lstrlenW (lpString=".zip") returned 4
	[0180.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.009] lstrlenW (lpString=".rar") returned 4
	[0180.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.009] lstrlenW (lpString=".bz2") returned 4
	[0180.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.009] lstrlenW (lpString=".7z") returned 3
	[0180.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.009] lstrlenW (lpString=".dbf") returned 4
	[0180.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.009] lstrlenW (lpString=".1cd") returned 4
	[0180.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68
	[0180.009] lstrlenW (lpString=".jpg") returned 4
	[0180.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.010] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0180.010] lstrlenW (lpString="J0157831.WMF") returned 12
	[0180.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0180.011] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=11396) returned 1
	[0180.011] CloseHandle (hObject=0x534) returned 1
	[0180.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 0x220
	[0180.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0180.011] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.012] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0180.012] GetLastError () returned 0x0
	[0180.012] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x2c84, lpOverlapped=0x0) returned 1
	[0180.014] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2c90, lpOverlapped=0x0) returned 1
	[0180.015] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.015] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.015] SetEndOfFile (hFile=0x4bc) returned 1
	[0180.015] CloseHandle (hObject=0x4bc) returned 1
	[0180.015] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.015] SetEndOfFile (hFile=0x534) returned 1
	[0180.018] CloseHandle (hObject=0x534) returned 1
	[0180.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 1
	[0180.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.019] lstrlenW (lpString=".doc") returned 4
	[0180.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.019] lstrlenW (lpString=".docx") returned 5
	[0180.019] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0180.019] lstrlenW (lpString=".pdf") returned 4
	[0180.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.019] lstrlenW (lpString=".xls") returned 4
	[0180.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.019] lstrlenW (lpString=".xlsx") returned 5
	[0180.019] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0180.019] lstrlenW (lpString=".ppt") returned 4
	[0180.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.019] lstrlenW (lpString=".zip") returned 4
	[0180.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.019] lstrlenW (lpString=".rar") returned 4
	[0180.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.019] lstrlenW (lpString=".bz2") returned 4
	[0180.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.019] lstrlenW (lpString=".7z") returned 3
	[0180.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.019] lstrlenW (lpString=".dbf") returned 4
	[0180.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.020] lstrlenW (lpString=".1cd") returned 4
	[0180.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.020] lstrlenW (lpString=".jpg") returned 4
	[0180.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.020] lstrlenW (lpString=".doc") returned 4
	[0180.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.020] lstrlenW (lpString=".docx") returned 5
	[0180.020] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0180.020] lstrlenW (lpString=".pdf") returned 4
	[0180.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.020] lstrlenW (lpString=".xls") returned 4
	[0180.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.020] lstrlenW (lpString=".xlsx") returned 5
	[0180.020] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0180.020] lstrlenW (lpString=".ppt") returned 4
	[0180.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.020] lstrlenW (lpString=".zip") returned 4
	[0180.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.020] lstrlenW (lpString=".rar") returned 4
	[0180.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.020] lstrlenW (lpString=".bz2") returned 4
	[0180.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.020] lstrlenW (lpString=".7z") returned 3
	[0180.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.020] lstrlenW (lpString=".dbf") returned 4
	[0180.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.021] lstrlenW (lpString=".1cd") returned 4
	[0180.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68
	[0180.021] lstrlenW (lpString=".jpg") returned 4
	[0180.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.021] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0180.021] lstrlenW (lpString="J0158071.WMF") returned 12
	[0180.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0180.021] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=18652) returned 1
	[0180.022] CloseHandle (hObject=0x534) returned 1
	[0180.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf")) returned 0x220
	[0180.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0180.022] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.022] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0180.023] GetLastError () returned 0x0
	[0180.023] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x48dc, lpOverlapped=0x0) returned 1
	[0180.384] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x48e0, lpOverlapped=0x0) returned 1
	[0180.385] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.386] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.386] SetEndOfFile (hFile=0x4bc) returned 1
	[0180.386] CloseHandle (hObject=0x4bc) returned 1
	[0180.386] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.386] SetEndOfFile (hFile=0x534) returned 1
	[0180.389] CloseHandle (hObject=0x534) returned 1
	[0180.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf")) returned 1
	[0181.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.183] lstrlenW (lpString=".doc") returned 4
	[0181.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.183] lstrlenW (lpString=".docx") returned 5
	[0181.183] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0181.183] lstrlenW (lpString=".pdf") returned 4
	[0181.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.183] lstrlenW (lpString=".xls") returned 4
	[0181.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.183] lstrlenW (lpString=".xlsx") returned 5
	[0181.184] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0181.184] lstrlenW (lpString=".ppt") returned 4
	[0181.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.184] lstrlenW (lpString=".zip") returned 4
	[0181.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.184] lstrlenW (lpString=".rar") returned 4
	[0181.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.184] lstrlenW (lpString=".bz2") returned 4
	[0181.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.184] lstrlenW (lpString=".7z") returned 3
	[0181.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.184] lstrlenW (lpString=".dbf") returned 4
	[0181.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.184] lstrlenW (lpString=".1cd") returned 4
	[0181.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.184] lstrlenW (lpString=".jpg") returned 4
	[0181.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.184] lstrlenW (lpString=".doc") returned 4
	[0181.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.184] lstrlenW (lpString=".docx") returned 5
	[0181.184] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0181.184] lstrlenW (lpString=".pdf") returned 4
	[0181.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.184] lstrlenW (lpString=".xls") returned 4
	[0181.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.185] lstrlenW (lpString=".xlsx") returned 5
	[0181.185] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0181.185] lstrlenW (lpString=".ppt") returned 4
	[0181.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.185] lstrlenW (lpString=".zip") returned 4
	[0181.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.185] lstrlenW (lpString=".rar") returned 4
	[0181.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.185] lstrlenW (lpString=".bz2") returned 4
	[0181.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.185] lstrlenW (lpString=".7z") returned 3
	[0181.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.185] lstrlenW (lpString=".dbf") returned 4
	[0181.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.185] lstrlenW (lpString=".1cd") returned 4
	[0181.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68
	[0181.185] lstrlenW (lpString=".jpg") returned 4
	[0181.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.185] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0181.185] lstrlenW (lpString="J0172067.WMF") returned 12
	[0181.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0182.638] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=7028) returned 1
	[0182.638] CloseHandle (hObject=0x548) returned 1
	[0182.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 0x220
	[0182.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0183.003] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.003] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0183.004] GetLastError () returned 0x0
	[0183.004] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1b74, lpOverlapped=0x0) returned 1
	[0183.006] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1b80, lpOverlapped=0x0) returned 1
	[0183.007] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.007] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.007] SetEndOfFile (hFile=0x4bc) returned 1
	[0183.007] CloseHandle (hObject=0x4bc) returned 1
	[0183.007] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.007] SetEndOfFile (hFile=0x534) returned 1
	[0183.010] CloseHandle (hObject=0x534) returned 1
	[0183.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 1
	[0183.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.011] lstrlenW (lpString=".doc") returned 4
	[0183.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.011] lstrlenW (lpString=".docx") returned 5
	[0183.011] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0183.011] lstrlenW (lpString=".pdf") returned 4
	[0183.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.011] lstrlenW (lpString=".xls") returned 4
	[0183.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.011] lstrlenW (lpString=".xlsx") returned 5
	[0183.011] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0183.011] lstrlenW (lpString=".ppt") returned 4
	[0183.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.011] lstrlenW (lpString=".zip") returned 4
	[0183.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.011] lstrlenW (lpString=".rar") returned 4
	[0183.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.011] lstrlenW (lpString=".bz2") returned 4
	[0183.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.011] lstrlenW (lpString=".7z") returned 3
	[0183.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.012] lstrlenW (lpString=".dbf") returned 4
	[0183.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.012] lstrlenW (lpString=".1cd") returned 4
	[0183.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.012] lstrlenW (lpString=".jpg") returned 4
	[0183.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.012] lstrlenW (lpString=".doc") returned 4
	[0183.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.012] lstrlenW (lpString=".docx") returned 5
	[0183.012] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0183.012] lstrlenW (lpString=".pdf") returned 4
	[0183.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.012] lstrlenW (lpString=".xls") returned 4
	[0183.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.012] lstrlenW (lpString=".xlsx") returned 5
	[0183.012] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0183.012] lstrlenW (lpString=".ppt") returned 4
	[0183.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.012] lstrlenW (lpString=".zip") returned 4
	[0183.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.012] lstrlenW (lpString=".rar") returned 4
	[0183.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.012] lstrlenW (lpString=".bz2") returned 4
	[0183.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.013] lstrlenW (lpString=".7z") returned 3
	[0183.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.013] lstrlenW (lpString=".dbf") returned 4
	[0183.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.013] lstrlenW (lpString=".1cd") returned 4
	[0183.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68
	[0183.013] lstrlenW (lpString=".jpg") returned 4
	[0183.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.013] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0183.013] lstrlenW (lpString="J0182689.JPG") returned 12
	[0183.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0183.014] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=16615) returned 1
	[0183.014] CloseHandle (hObject=0x534) returned 1
	[0183.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg")) returned 0x220
	[0183.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0183.015] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.015] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0183.016] GetLastError () returned 0x0
	[0183.016] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x40e7, lpOverlapped=0x0) returned 1
	[0183.018] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x40f0, lpOverlapped=0x0) returned 1
	[0183.019] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.019] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.019] SetEndOfFile (hFile=0x4bc) returned 1
	[0183.020] CloseHandle (hObject=0x4bc) returned 1
	[0183.020] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.020] SetEndOfFile (hFile=0x534) returned 1
	[0183.023] CloseHandle (hObject=0x534) returned 1
	[0183.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg")) returned 1
	[0183.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.024] lstrlenW (lpString=".doc") returned 4
	[0183.024] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.024] lstrlenW (lpString=".docx") returned 5
	[0183.024] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0183.024] lstrlenW (lpString=".pdf") returned 4
	[0183.024] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.024] lstrlenW (lpString=".xls") returned 4
	[0183.024] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.024] lstrlenW (lpString=".xlsx") returned 5
	[0183.024] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0183.024] lstrlenW (lpString=".ppt") returned 4
	[0183.024] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.024] lstrlenW (lpString=".zip") returned 4
	[0183.024] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.024] lstrlenW (lpString=".rar") returned 4
	[0183.024] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.024] lstrlenW (lpString=".bz2") returned 4
	[0183.024] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.024] lstrlenW (lpString=".7z") returned 3
	[0183.024] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.024] lstrlenW (lpString=".dbf") returned 4
	[0183.024] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.024] lstrlenW (lpString=".1cd") returned 4
	[0183.024] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.024] lstrlenW (lpString=".jpg") returned 4
	[0183.024] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.025] lstrlenW (lpString=".doc") returned 4
	[0183.025] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.025] lstrlenW (lpString=".docx") returned 5
	[0183.025] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0183.025] lstrlenW (lpString=".pdf") returned 4
	[0183.025] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.025] lstrlenW (lpString=".xls") returned 4
	[0183.025] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.025] lstrlenW (lpString=".xlsx") returned 5
	[0183.025] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0183.025] lstrlenW (lpString=".ppt") returned 4
	[0183.025] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.025] lstrlenW (lpString=".zip") returned 4
	[0183.025] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.025] lstrlenW (lpString=".rar") returned 4
	[0183.025] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.025] lstrlenW (lpString=".bz2") returned 4
	[0183.025] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.025] lstrlenW (lpString=".7z") returned 3
	[0183.025] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.025] lstrlenW (lpString=".dbf") returned 4
	[0183.025] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.025] lstrlenW (lpString=".1cd") returned 4
	[0183.025] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68
	[0183.026] lstrlenW (lpString=".jpg") returned 4
	[0183.026] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.026] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0183.026] lstrlenW (lpString="J0182888.WMF") returned 12
	[0183.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0183.026] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=24392) returned 1
	[0183.026] CloseHandle (hObject=0x534) returned 1
	[0183.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 0x220
	[0183.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0183.028] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.028] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0183.029] GetLastError () returned 0x0
	[0183.029] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x5f48, lpOverlapped=0x0) returned 1
	[0183.031] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x5f50, lpOverlapped=0x0) returned 1
	[0183.032] ReadFile (in: hFile=0x534, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.032] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.032] SetEndOfFile (hFile=0x4bc) returned 1
	[0183.032] CloseHandle (hObject=0x4bc) returned 1
	[0183.032] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.032] SetEndOfFile (hFile=0x534) returned 1
	[0183.035] CloseHandle (hObject=0x534) returned 1
	[0183.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 1
	[0183.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.036] lstrlenW (lpString=".doc") returned 4
	[0183.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.036] lstrlenW (lpString=".docx") returned 5
	[0183.036] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0183.036] lstrlenW (lpString=".pdf") returned 4
	[0183.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.036] lstrlenW (lpString=".xls") returned 4
	[0183.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.036] lstrlenW (lpString=".xlsx") returned 5
	[0183.036] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0183.036] lstrlenW (lpString=".ppt") returned 4
	[0183.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.037] lstrlenW (lpString=".zip") returned 4
	[0183.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.037] lstrlenW (lpString=".rar") returned 4
	[0183.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.037] lstrlenW (lpString=".bz2") returned 4
	[0183.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.037] lstrlenW (lpString=".7z") returned 3
	[0183.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.037] lstrlenW (lpString=".dbf") returned 4
	[0183.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.037] lstrlenW (lpString=".1cd") returned 4
	[0183.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.037] lstrlenW (lpString=".jpg") returned 4
	[0183.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.037] lstrlenW (lpString=".doc") returned 4
	[0183.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.037] lstrlenW (lpString=".docx") returned 5
	[0183.037] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0183.037] lstrlenW (lpString=".pdf") returned 4
	[0183.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.037] lstrlenW (lpString=".xls") returned 4
	[0183.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.037] lstrlenW (lpString=".xlsx") returned 5
	[0183.037] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0183.037] lstrlenW (lpString=".ppt") returned 4
	[0183.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.038] lstrlenW (lpString=".zip") returned 4
	[0183.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.038] lstrlenW (lpString=".rar") returned 4
	[0183.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.038] lstrlenW (lpString=".bz2") returned 4
	[0183.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.038] lstrlenW (lpString=".7z") returned 3
	[0183.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.038] lstrlenW (lpString=".dbf") returned 4
	[0183.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.038] lstrlenW (lpString=".1cd") returned 4
	[0183.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68
	[0183.038] lstrlenW (lpString=".jpg") returned 4
	[0183.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.038] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0183.038] lstrlenW (lpString="J0182898.WMF") returned 12
	[0183.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.390] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=15150) returned 1
	[0183.390] CloseHandle (hObject=0x370) returned 1
	[0183.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 0x220
	[0183.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.391] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.391] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0183.797] GetLastError () returned 0x0
	[0183.797] ReadFile (in: hFile=0x370, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x3b2e, lpOverlapped=0x0) returned 1
	[0183.800] WriteFile (in: hFile=0x530, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x3b30, lpOverlapped=0x0) returned 1
	[0183.801] ReadFile (in: hFile=0x370, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.801] WriteFile (in: hFile=0x530, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.801] SetEndOfFile (hFile=0x530) returned 1
	[0183.801] CloseHandle (hObject=0x530) returned 1
	[0183.801] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.801] SetEndOfFile (hFile=0x370) returned 1
	[0183.804] CloseHandle (hObject=0x370) returned 1
	[0183.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 1
	[0183.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.809] lstrlenW (lpString=".doc") returned 4
	[0183.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.809] lstrlenW (lpString=".docx") returned 5
	[0183.809] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0183.809] lstrlenW (lpString=".pdf") returned 4
	[0183.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.809] lstrlenW (lpString=".xls") returned 4
	[0183.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.809] lstrlenW (lpString=".xlsx") returned 5
	[0183.809] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0183.809] lstrlenW (lpString=".ppt") returned 4
	[0183.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.809] lstrlenW (lpString=".zip") returned 4
	[0183.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.809] lstrlenW (lpString=".rar") returned 4
	[0183.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.809] lstrlenW (lpString=".bz2") returned 4
	[0183.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.809] lstrlenW (lpString=".7z") returned 3
	[0183.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.809] lstrlenW (lpString=".dbf") returned 4
	[0183.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.809] lstrlenW (lpString=".1cd") returned 4
	[0183.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.809] lstrlenW (lpString=".jpg") returned 4
	[0183.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.810] lstrlenW (lpString=".doc") returned 4
	[0183.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.810] lstrlenW (lpString=".docx") returned 5
	[0183.810] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0183.810] lstrlenW (lpString=".pdf") returned 4
	[0183.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.810] lstrlenW (lpString=".xls") returned 4
	[0183.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.810] lstrlenW (lpString=".xlsx") returned 5
	[0183.810] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0183.810] lstrlenW (lpString=".ppt") returned 4
	[0183.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.810] lstrlenW (lpString=".zip") returned 4
	[0183.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.810] lstrlenW (lpString=".rar") returned 4
	[0183.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.810] lstrlenW (lpString=".bz2") returned 4
	[0183.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.810] lstrlenW (lpString=".7z") returned 3
	[0183.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.810] lstrlenW (lpString=".dbf") returned 4
	[0183.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.810] lstrlenW (lpString=".1cd") returned 4
	[0183.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68
	[0183.811] lstrlenW (lpString=".jpg") returned 4
	[0183.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.811] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0183.811] lstrlenW (lpString="J0183174.WMF") returned 12
	[0183.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.812] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=28626) returned 1
	[0183.812] CloseHandle (hObject=0x370) returned 1
	[0183.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 0x220
	[0183.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.813] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.813] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0183.814] GetLastError () returned 0x0
	[0183.814] ReadFile (in: hFile=0x370, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x6fd2, lpOverlapped=0x0) returned 1
	[0183.816] WriteFile (in: hFile=0x530, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x6fe0, lpOverlapped=0x0) returned 1
	[0183.817] ReadFile (in: hFile=0x370, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.817] WriteFile (in: hFile=0x530, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.817] SetEndOfFile (hFile=0x530) returned 1
	[0183.817] CloseHandle (hObject=0x530) returned 1
	[0183.818] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.818] SetEndOfFile (hFile=0x370) returned 1
	[0183.820] CloseHandle (hObject=0x370) returned 1
	[0183.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 1
	[0183.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.822] lstrlenW (lpString=".doc") returned 4
	[0183.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.822] lstrlenW (lpString=".docx") returned 5
	[0183.822] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0183.822] lstrlenW (lpString=".pdf") returned 4
	[0183.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.822] lstrlenW (lpString=".xls") returned 4
	[0183.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.822] lstrlenW (lpString=".xlsx") returned 5
	[0183.822] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0183.822] lstrlenW (lpString=".ppt") returned 4
	[0183.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.822] lstrlenW (lpString=".zip") returned 4
	[0183.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.822] lstrlenW (lpString=".rar") returned 4
	[0183.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.822] lstrlenW (lpString=".bz2") returned 4
	[0183.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.822] lstrlenW (lpString=".7z") returned 3
	[0183.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.822] lstrlenW (lpString=".dbf") returned 4
	[0183.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.822] lstrlenW (lpString=".1cd") returned 4
	[0183.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.822] lstrlenW (lpString=".jpg") returned 4
	[0183.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.823] lstrlenW (lpString=".doc") returned 4
	[0183.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.823] lstrlenW (lpString=".docx") returned 5
	[0183.823] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0183.823] lstrlenW (lpString=".pdf") returned 4
	[0183.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.823] lstrlenW (lpString=".xls") returned 4
	[0183.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.823] lstrlenW (lpString=".xlsx") returned 5
	[0183.823] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0183.823] lstrlenW (lpString=".ppt") returned 4
	[0183.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.823] lstrlenW (lpString=".zip") returned 4
	[0183.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.823] lstrlenW (lpString=".rar") returned 4
	[0183.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.823] lstrlenW (lpString=".bz2") returned 4
	[0183.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.823] lstrlenW (lpString=".7z") returned 3
	[0183.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.823] lstrlenW (lpString=".dbf") returned 4
	[0183.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.823] lstrlenW (lpString=".1cd") returned 4
	[0183.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68
	[0183.823] lstrlenW (lpString=".jpg") returned 4
	[0183.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.824] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0183.824] lstrlenW (lpString="J0183198.WMF") returned 12
	[0183.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.825] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=24430) returned 1
	[0183.825] CloseHandle (hObject=0x370) returned 1
	[0183.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 0x220
	[0183.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.825] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.825] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0183.826] GetLastError () returned 0x0
	[0183.826] ReadFile (in: hFile=0x370, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x5f6e, lpOverlapped=0x0) returned 1
	[0183.828] WriteFile (in: hFile=0x530, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x5f70, lpOverlapped=0x0) returned 1
	[0183.830] ReadFile (in: hFile=0x370, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.830] WriteFile (in: hFile=0x530, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.830] SetEndOfFile (hFile=0x530) returned 1
	[0183.830] CloseHandle (hObject=0x530) returned 1
	[0183.830] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.830] SetEndOfFile (hFile=0x370) returned 1
	[0183.833] CloseHandle (hObject=0x370) returned 1
	[0183.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 1
	[0183.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.834] lstrlenW (lpString=".doc") returned 4
	[0183.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.834] lstrlenW (lpString=".docx") returned 5
	[0183.834] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0183.834] lstrlenW (lpString=".pdf") returned 4
	[0183.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.834] lstrlenW (lpString=".xls") returned 4
	[0183.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.834] lstrlenW (lpString=".xlsx") returned 5
	[0183.834] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0183.834] lstrlenW (lpString=".ppt") returned 4
	[0183.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.834] lstrlenW (lpString=".zip") returned 4
	[0183.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.834] lstrlenW (lpString=".rar") returned 4
	[0183.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.834] lstrlenW (lpString=".bz2") returned 4
	[0183.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.834] lstrlenW (lpString=".7z") returned 3
	[0183.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.834] lstrlenW (lpString=".dbf") returned 4
	[0183.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.835] lstrlenW (lpString=".1cd") returned 4
	[0183.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.835] lstrlenW (lpString=".jpg") returned 4
	[0183.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.835] lstrlenW (lpString=".doc") returned 4
	[0183.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.835] lstrlenW (lpString=".docx") returned 5
	[0183.835] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0183.835] lstrlenW (lpString=".pdf") returned 4
	[0183.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.835] lstrlenW (lpString=".xls") returned 4
	[0183.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.835] lstrlenW (lpString=".xlsx") returned 5
	[0183.835] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0183.835] lstrlenW (lpString=".ppt") returned 4
	[0183.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.835] lstrlenW (lpString=".zip") returned 4
	[0183.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.835] lstrlenW (lpString=".rar") returned 4
	[0183.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.835] lstrlenW (lpString=".bz2") returned 4
	[0183.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.835] lstrlenW (lpString=".7z") returned 3
	[0183.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.836] lstrlenW (lpString=".dbf") returned 4
	[0183.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.836] lstrlenW (lpString=".1cd") returned 4
	[0183.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68
	[0183.836] lstrlenW (lpString=".jpg") returned 4
	[0183.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.836] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0183.836] lstrlenW (lpString="J0183574.WMF") returned 12
	[0183.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0184.031] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=19274) returned 1
	[0184.031] CloseHandle (hObject=0x558) returned 1
	[0184.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf")) returned 0x220
	[0184.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0184.032] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.032] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0184.032] GetLastError () returned 0x0
	[0184.032] ReadFile (in: hFile=0x558, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x4b4a, lpOverlapped=0x0) returned 1
	[0184.035] WriteFile (in: hFile=0x328, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4b50, lpOverlapped=0x0) returned 1
	[0184.036] ReadFile (in: hFile=0x558, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.036] WriteFile (in: hFile=0x328, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.036] SetEndOfFile (hFile=0x328) returned 1
	[0184.037] CloseHandle (hObject=0x328) returned 1
	[0184.037] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.037] SetEndOfFile (hFile=0x558) returned 1
	[0184.039] CloseHandle (hObject=0x558) returned 1
	[0184.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf")) returned 1
	[0184.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.040] lstrlenW (lpString=".doc") returned 4
	[0184.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.040] lstrlenW (lpString=".docx") returned 5
	[0184.040] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0184.040] lstrlenW (lpString=".pdf") returned 4
	[0184.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.041] lstrlenW (lpString=".xls") returned 4
	[0184.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.041] lstrlenW (lpString=".xlsx") returned 5
	[0184.041] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0184.041] lstrlenW (lpString=".ppt") returned 4
	[0184.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.041] lstrlenW (lpString=".zip") returned 4
	[0184.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.041] lstrlenW (lpString=".rar") returned 4
	[0184.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.041] lstrlenW (lpString=".bz2") returned 4
	[0184.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.041] lstrlenW (lpString=".7z") returned 3
	[0184.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.041] lstrlenW (lpString=".dbf") returned 4
	[0184.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.041] lstrlenW (lpString=".1cd") returned 4
	[0184.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.041] lstrlenW (lpString=".jpg") returned 4
	[0184.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.041] lstrlenW (lpString=".doc") returned 4
	[0184.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.041] lstrlenW (lpString=".docx") returned 5
	[0184.042] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0184.042] lstrlenW (lpString=".pdf") returned 4
	[0184.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString=".xls") returned 4
	[0184.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.042] lstrlenW (lpString=".xlsx") returned 5
	[0184.042] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0184.042] lstrlenW (lpString=".ppt") returned 4
	[0184.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.042] lstrlenW (lpString=".zip") returned 4
	[0184.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.042] lstrlenW (lpString=".rar") returned 4
	[0184.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString=".bz2") returned 4
	[0184.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString=".7z") returned 3
	[0184.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.042] lstrlenW (lpString=".dbf") returned 4
	[0184.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.042] lstrlenW (lpString=".1cd") returned 4
	[0184.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68
	[0184.042] lstrlenW (lpString=".jpg") returned 4
	[0184.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.043] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0184.043] lstrlenW (lpString="J0185670.WMF") returned 12
	[0184.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0184.045] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=7304) returned 1
	[0184.045] CloseHandle (hObject=0x558) returned 1
	[0184.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 0x220
	[0184.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0184.046] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.046] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0184.047] GetLastError () returned 0x0
	[0184.047] ReadFile (in: hFile=0x558, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1c88, lpOverlapped=0x0) returned 1
	[0184.049] WriteFile (in: hFile=0x328, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1c90, lpOverlapped=0x0) returned 1
	[0184.050] ReadFile (in: hFile=0x558, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.050] WriteFile (in: hFile=0x328, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.050] SetEndOfFile (hFile=0x328) returned 1
	[0184.050] CloseHandle (hObject=0x328) returned 1
	[0184.050] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.050] SetEndOfFile (hFile=0x558) returned 1
	[0184.053] CloseHandle (hObject=0x558) returned 1
	[0184.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 1
	[0184.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.054] lstrlenW (lpString=".doc") returned 4
	[0184.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.054] lstrlenW (lpString=".docx") returned 5
	[0184.054] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0184.054] lstrlenW (lpString=".pdf") returned 4
	[0184.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.054] lstrlenW (lpString=".xls") returned 4
	[0184.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.054] lstrlenW (lpString=".xlsx") returned 5
	[0184.054] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0184.054] lstrlenW (lpString=".ppt") returned 4
	[0184.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.055] lstrlenW (lpString=".zip") returned 4
	[0184.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.055] lstrlenW (lpString=".rar") returned 4
	[0184.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.055] lstrlenW (lpString=".bz2") returned 4
	[0184.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.055] lstrlenW (lpString=".7z") returned 3
	[0184.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.055] lstrlenW (lpString=".dbf") returned 4
	[0184.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.055] lstrlenW (lpString=".1cd") returned 4
	[0184.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.055] lstrlenW (lpString=".jpg") returned 4
	[0184.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.055] lstrlenW (lpString=".doc") returned 4
	[0184.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.055] lstrlenW (lpString=".docx") returned 5
	[0184.055] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0184.055] lstrlenW (lpString=".pdf") returned 4
	[0184.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.055] lstrlenW (lpString=".xls") returned 4
	[0184.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.055] lstrlenW (lpString=".xlsx") returned 5
	[0184.055] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0184.055] lstrlenW (lpString=".ppt") returned 4
	[0184.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.056] lstrlenW (lpString=".zip") returned 4
	[0184.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.056] lstrlenW (lpString=".rar") returned 4
	[0184.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.056] lstrlenW (lpString=".bz2") returned 4
	[0184.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.056] lstrlenW (lpString=".7z") returned 3
	[0184.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.056] lstrlenW (lpString=".dbf") returned 4
	[0184.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.056] lstrlenW (lpString=".1cd") returned 4
	[0184.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68
	[0184.056] lstrlenW (lpString=".jpg") returned 4
	[0184.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.056] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0184.056] lstrlenW (lpString="J0185774.WMF") returned 12
	[0184.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0184.057] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=20038) returned 1
	[0184.057] CloseHandle (hObject=0x558) returned 1
	[0184.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 0x220
	[0184.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0184.058] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.058] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0184.059] GetLastError () returned 0x0
	[0184.059] ReadFile (in: hFile=0x558, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x4e46, lpOverlapped=0x0) returned 1
	[0184.064] WriteFile (in: hFile=0x328, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4e50, lpOverlapped=0x0) returned 1
	[0184.066] ReadFile (in: hFile=0x558, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.066] WriteFile (in: hFile=0x328, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.066] SetEndOfFile (hFile=0x328) returned 1
	[0184.066] CloseHandle (hObject=0x328) returned 1
	[0184.066] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.066] SetEndOfFile (hFile=0x558) returned 1
	[0184.070] CloseHandle (hObject=0x558) returned 1
	[0184.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 1
	[0184.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.071] lstrlenW (lpString=".doc") returned 4
	[0184.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.071] lstrlenW (lpString=".docx") returned 5
	[0184.071] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0184.071] lstrlenW (lpString=".pdf") returned 4
	[0184.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.071] lstrlenW (lpString=".xls") returned 4
	[0184.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.071] lstrlenW (lpString=".xlsx") returned 5
	[0184.071] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0184.071] lstrlenW (lpString=".ppt") returned 4
	[0184.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.071] lstrlenW (lpString=".zip") returned 4
	[0184.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.071] lstrlenW (lpString=".rar") returned 4
	[0184.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.071] lstrlenW (lpString=".bz2") returned 4
	[0184.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.071] lstrlenW (lpString=".7z") returned 3
	[0184.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.071] lstrlenW (lpString=".dbf") returned 4
	[0184.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.072] lstrlenW (lpString=".1cd") returned 4
	[0184.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.072] lstrlenW (lpString=".jpg") returned 4
	[0184.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.072] lstrlenW (lpString=".doc") returned 4
	[0184.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.072] lstrlenW (lpString=".docx") returned 5
	[0184.072] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0184.072] lstrlenW (lpString=".pdf") returned 4
	[0184.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.072] lstrlenW (lpString=".xls") returned 4
	[0184.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.072] lstrlenW (lpString=".xlsx") returned 5
	[0184.072] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0184.072] lstrlenW (lpString=".ppt") returned 4
	[0184.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.072] lstrlenW (lpString=".zip") returned 4
	[0184.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.072] lstrlenW (lpString=".rar") returned 4
	[0184.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.072] lstrlenW (lpString=".bz2") returned 4
	[0184.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.072] lstrlenW (lpString=".7z") returned 3
	[0184.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.073] lstrlenW (lpString=".dbf") returned 4
	[0184.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.073] lstrlenW (lpString=".1cd") returned 4
	[0184.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68
	[0184.073] lstrlenW (lpString=".jpg") returned 4
	[0184.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.073] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0184.073] lstrlenW (lpString="J0185776.WMF") returned 12
	[0184.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0184.074] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=27096) returned 1
	[0184.074] CloseHandle (hObject=0x558) returned 1
	[0184.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 0x220
	[0184.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0185.043] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.043] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.232] GetLastError () returned 0x0
	[0185.232] ReadFile (in: hFile=0x324, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x69d8, lpOverlapped=0x0) returned 1
	[0185.234] WriteFile (in: hFile=0x538, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x69e0, lpOverlapped=0x0) returned 1
	[0185.235] ReadFile (in: hFile=0x324, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.235] WriteFile (in: hFile=0x538, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0185.235] SetEndOfFile (hFile=0x538) returned 1
	[0185.236] CloseHandle (hObject=0x538) returned 1
	[0185.236] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.236] SetEndOfFile (hFile=0x324) returned 1
	[0185.238] CloseHandle (hObject=0x324) returned 1
	[0185.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 1
	[0186.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.355] lstrlenW (lpString=".doc") returned 4
	[0186.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.355] lstrlenW (lpString=".docx") returned 5
	[0186.355] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0186.355] lstrlenW (lpString=".pdf") returned 4
	[0186.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.355] lstrlenW (lpString=".xls") returned 4
	[0186.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.355] lstrlenW (lpString=".xlsx") returned 5
	[0186.355] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0186.355] lstrlenW (lpString=".ppt") returned 4
	[0186.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.356] lstrlenW (lpString=".zip") returned 4
	[0186.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.356] lstrlenW (lpString=".rar") returned 4
	[0186.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.356] lstrlenW (lpString=".bz2") returned 4
	[0186.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.356] lstrlenW (lpString=".7z") returned 3
	[0186.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.356] lstrlenW (lpString=".dbf") returned 4
	[0186.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.356] lstrlenW (lpString=".1cd") returned 4
	[0186.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.356] lstrlenW (lpString=".jpg") returned 4
	[0186.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.356] lstrlenW (lpString=".doc") returned 4
	[0186.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.356] lstrlenW (lpString=".docx") returned 5
	[0186.356] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0186.356] lstrlenW (lpString=".pdf") returned 4
	[0186.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.356] lstrlenW (lpString=".xls") returned 4
	[0186.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.356] lstrlenW (lpString=".xlsx") returned 5
	[0186.356] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0186.357] lstrlenW (lpString=".ppt") returned 4
	[0186.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.357] lstrlenW (lpString=".zip") returned 4
	[0186.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.357] lstrlenW (lpString=".rar") returned 4
	[0186.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.357] lstrlenW (lpString=".bz2") returned 4
	[0186.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.357] lstrlenW (lpString=".7z") returned 3
	[0186.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.357] lstrlenW (lpString=".dbf") returned 4
	[0186.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.357] lstrlenW (lpString=".1cd") returned 4
	[0186.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68
	[0186.357] lstrlenW (lpString=".jpg") returned 4
	[0186.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.357] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0186.357] lstrlenW (lpString="J0186346.WMF") returned 12
	[0186.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0186.359] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=8666) returned 1
	[0186.359] CloseHandle (hObject=0x444) returned 1
	[0186.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf")) returned 0x220
	[0186.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0186.360] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.360] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0186.361] GetLastError () returned 0x0
	[0186.361] ReadFile (in: hFile=0x444, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x21da, lpOverlapped=0x0) returned 1
	[0186.362] WriteFile (in: hFile=0x324, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x21e0, lpOverlapped=0x0) returned 1
	[0186.363] ReadFile (in: hFile=0x444, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.364] WriteFile (in: hFile=0x324, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.364] SetEndOfFile (hFile=0x324) returned 1
	[0186.364] CloseHandle (hObject=0x324) returned 1
	[0186.364] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.364] SetEndOfFile (hFile=0x444) returned 1
	[0186.366] CloseHandle (hObject=0x444) returned 1
	[0186.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf")) returned 1
	[0186.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.368] lstrlenW (lpString=".doc") returned 4
	[0186.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.368] lstrlenW (lpString=".docx") returned 5
	[0186.368] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0186.368] lstrlenW (lpString=".pdf") returned 4
	[0186.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.368] lstrlenW (lpString=".xls") returned 4
	[0186.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.368] lstrlenW (lpString=".xlsx") returned 5
	[0186.368] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0186.368] lstrlenW (lpString=".ppt") returned 4
	[0186.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.368] lstrlenW (lpString=".zip") returned 4
	[0186.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.368] lstrlenW (lpString=".rar") returned 4
	[0186.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.368] lstrlenW (lpString=".bz2") returned 4
	[0186.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.368] lstrlenW (lpString=".7z") returned 3
	[0186.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.368] lstrlenW (lpString=".dbf") returned 4
	[0186.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.368] lstrlenW (lpString=".1cd") returned 4
	[0186.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.368] lstrlenW (lpString=".jpg") returned 4
	[0186.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.369] lstrlenW (lpString=".doc") returned 4
	[0186.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.369] lstrlenW (lpString=".docx") returned 5
	[0186.369] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0186.369] lstrlenW (lpString=".pdf") returned 4
	[0186.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.369] lstrlenW (lpString=".xls") returned 4
	[0186.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.369] lstrlenW (lpString=".xlsx") returned 5
	[0186.369] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0186.369] lstrlenW (lpString=".ppt") returned 4
	[0186.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.369] lstrlenW (lpString=".zip") returned 4
	[0186.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.369] lstrlenW (lpString=".rar") returned 4
	[0186.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.369] lstrlenW (lpString=".bz2") returned 4
	[0186.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.369] lstrlenW (lpString=".7z") returned 3
	[0186.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.369] lstrlenW (lpString=".dbf") returned 4
	[0186.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.369] lstrlenW (lpString=".1cd") returned 4
	[0186.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68
	[0186.370] lstrlenW (lpString=".jpg") returned 4
	[0186.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.370] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0186.370] lstrlenW (lpString="J0186360.WMF") returned 12
	[0186.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0186.377] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=33850) returned 1
	[0186.377] CloseHandle (hObject=0x444) returned 1
	[0186.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 0x220
	[0186.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0186.378] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.378] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0186.379] GetLastError () returned 0x0
	[0186.379] ReadFile (in: hFile=0x444, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x843a, lpOverlapped=0x0) returned 1
	[0186.381] WriteFile (in: hFile=0x324, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x8440, lpOverlapped=0x0) returned 1
	[0186.383] ReadFile (in: hFile=0x444, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.383] WriteFile (in: hFile=0x324, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.383] SetEndOfFile (hFile=0x324) returned 1
	[0186.383] CloseHandle (hObject=0x324) returned 1
	[0186.383] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.383] SetEndOfFile (hFile=0x444) returned 1
	[0186.386] CloseHandle (hObject=0x444) returned 1
	[0186.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 1
	[0186.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.387] lstrlenW (lpString=".doc") returned 4
	[0186.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.387] lstrlenW (lpString=".docx") returned 5
	[0186.387] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0186.387] lstrlenW (lpString=".pdf") returned 4
	[0186.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.387] lstrlenW (lpString=".xls") returned 4
	[0186.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.387] lstrlenW (lpString=".xlsx") returned 5
	[0186.387] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0186.387] lstrlenW (lpString=".ppt") returned 4
	[0186.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.388] lstrlenW (lpString=".zip") returned 4
	[0186.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.388] lstrlenW (lpString=".rar") returned 4
	[0186.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.388] lstrlenW (lpString=".bz2") returned 4
	[0186.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.388] lstrlenW (lpString=".7z") returned 3
	[0186.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.388] lstrlenW (lpString=".dbf") returned 4
	[0186.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.388] lstrlenW (lpString=".1cd") returned 4
	[0186.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.388] lstrlenW (lpString=".jpg") returned 4
	[0186.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.388] lstrlenW (lpString=".doc") returned 4
	[0186.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.388] lstrlenW (lpString=".docx") returned 5
	[0186.388] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0186.388] lstrlenW (lpString=".pdf") returned 4
	[0186.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.388] lstrlenW (lpString=".xls") returned 4
	[0186.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.388] lstrlenW (lpString=".xlsx") returned 5
	[0186.388] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0186.389] lstrlenW (lpString=".ppt") returned 4
	[0186.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.389] lstrlenW (lpString=".zip") returned 4
	[0186.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.389] lstrlenW (lpString=".rar") returned 4
	[0186.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.389] lstrlenW (lpString=".bz2") returned 4
	[0186.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.389] lstrlenW (lpString=".7z") returned 3
	[0186.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.389] lstrlenW (lpString=".dbf") returned 4
	[0186.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.389] lstrlenW (lpString=".1cd") returned 4
	[0186.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68
	[0186.389] lstrlenW (lpString=".jpg") returned 4
	[0186.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.389] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0186.389] lstrlenW (lpString="J0186362.WMF") returned 12
	[0186.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0186.390] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=17662) returned 1
	[0186.391] CloseHandle (hObject=0x444) returned 1
	[0186.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 0x220
	[0186.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0186.391] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.391] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0186.392] GetLastError () returned 0x0
	[0186.392] ReadFile (in: hFile=0x444, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x44fe, lpOverlapped=0x0) returned 1
	[0186.394] WriteFile (in: hFile=0x324, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x4500, lpOverlapped=0x0) returned 1
	[0186.395] ReadFile (in: hFile=0x444, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.395] WriteFile (in: hFile=0x324, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.395] SetEndOfFile (hFile=0x324) returned 1
	[0186.395] CloseHandle (hObject=0x324) returned 1
	[0186.395] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.396] SetEndOfFile (hFile=0x444) returned 1
	[0186.501] CloseHandle (hObject=0x444) returned 1
	[0186.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 1
	[0186.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.961] lstrlenW (lpString=".doc") returned 4
	[0186.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.961] lstrlenW (lpString=".docx") returned 5
	[0186.961] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0186.961] lstrlenW (lpString=".pdf") returned 4
	[0186.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.961] lstrlenW (lpString=".xls") returned 4
	[0186.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.962] lstrlenW (lpString=".xlsx") returned 5
	[0186.962] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0186.962] lstrlenW (lpString=".ppt") returned 4
	[0186.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.962] lstrlenW (lpString=".zip") returned 4
	[0186.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.962] lstrlenW (lpString=".rar") returned 4
	[0186.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.962] lstrlenW (lpString=".bz2") returned 4
	[0186.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.962] lstrlenW (lpString=".7z") returned 3
	[0186.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.962] lstrlenW (lpString=".dbf") returned 4
	[0186.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.962] lstrlenW (lpString=".1cd") returned 4
	[0186.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.962] lstrlenW (lpString=".jpg") returned 4
	[0186.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.962] lstrlenW (lpString=".doc") returned 4
	[0186.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.962] lstrlenW (lpString=".docx") returned 5
	[0186.962] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0186.962] lstrlenW (lpString=".pdf") returned 4
	[0186.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.962] lstrlenW (lpString=".xls") returned 4
	[0186.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.963] lstrlenW (lpString=".xlsx") returned 5
	[0186.963] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0186.963] lstrlenW (lpString=".ppt") returned 4
	[0186.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.963] lstrlenW (lpString=".zip") returned 4
	[0186.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.963] lstrlenW (lpString=".rar") returned 4
	[0186.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.963] lstrlenW (lpString=".bz2") returned 4
	[0186.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.963] lstrlenW (lpString=".7z") returned 3
	[0186.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.963] lstrlenW (lpString=".dbf") returned 4
	[0186.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.963] lstrlenW (lpString=".1cd") returned 4
	[0186.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68
	[0186.963] lstrlenW (lpString=".jpg") returned 4
	[0186.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.963] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0186.963] lstrlenW (lpString="J0187817.WMF") returned 12
	[0186.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0187.837] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=11644) returned 1
	[0187.837] CloseHandle (hObject=0x418) returned 1
	[0187.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 0x220
	[0187.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0187.838] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.838] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0187.839] GetLastError () returned 0x0
	[0187.839] ReadFile (in: hFile=0x418, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x2d7c, lpOverlapped=0x0) returned 1
	[0187.841] WriteFile (in: hFile=0x550, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0187.842] ReadFile (in: hFile=0x418, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.842] WriteFile (in: hFile=0x550, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.842] SetEndOfFile (hFile=0x550) returned 1
	[0187.842] CloseHandle (hObject=0x550) returned 1
	[0187.842] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.843] SetEndOfFile (hFile=0x418) returned 1
	[0187.845] CloseHandle (hObject=0x418) returned 1
	[0187.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 1
	[0187.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.848] lstrlenW (lpString=".doc") returned 4
	[0187.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.848] lstrlenW (lpString=".docx") returned 5
	[0187.848] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0187.848] lstrlenW (lpString=".pdf") returned 4
	[0187.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.848] lstrlenW (lpString=".xls") returned 4
	[0187.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.848] lstrlenW (lpString=".xlsx") returned 5
	[0187.849] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0187.849] lstrlenW (lpString=".ppt") returned 4
	[0187.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.849] lstrlenW (lpString=".zip") returned 4
	[0187.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.849] lstrlenW (lpString=".rar") returned 4
	[0187.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.849] lstrlenW (lpString=".bz2") returned 4
	[0187.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.849] lstrlenW (lpString=".7z") returned 3
	[0187.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.849] lstrlenW (lpString=".dbf") returned 4
	[0187.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.849] lstrlenW (lpString=".1cd") returned 4
	[0187.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.849] lstrlenW (lpString=".jpg") returned 4
	[0187.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.849] lstrlenW (lpString=".doc") returned 4
	[0187.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.849] lstrlenW (lpString=".docx") returned 5
	[0187.849] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0187.849] lstrlenW (lpString=".pdf") returned 4
	[0187.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.849] lstrlenW (lpString=".xls") returned 4
	[0187.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.850] lstrlenW (lpString=".xlsx") returned 5
	[0187.850] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0187.850] lstrlenW (lpString=".ppt") returned 4
	[0187.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.850] lstrlenW (lpString=".zip") returned 4
	[0187.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.850] lstrlenW (lpString=".rar") returned 4
	[0187.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.850] lstrlenW (lpString=".bz2") returned 4
	[0187.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.850] lstrlenW (lpString=".7z") returned 3
	[0187.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.850] lstrlenW (lpString=".dbf") returned 4
	[0187.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.850] lstrlenW (lpString=".1cd") returned 4
	[0187.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68
	[0187.850] lstrlenW (lpString=".jpg") returned 4
	[0187.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.850] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.850] lstrlenW (lpString="J0187881.WMF") returned 12
	[0187.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0187.851] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=4696) returned 1
	[0187.851] CloseHandle (hObject=0x418) returned 1
	[0187.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 0x220
	[0187.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0187.852] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.852] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0187.853] GetLastError () returned 0x0
	[0187.853] ReadFile (in: hFile=0x418, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x1258, lpOverlapped=0x0) returned 1
	[0187.854] WriteFile (in: hFile=0x550, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x1260, lpOverlapped=0x0) returned 1
	[0187.855] ReadFile (in: hFile=0x418, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.855] WriteFile (in: hFile=0x550, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.855] SetEndOfFile (hFile=0x550) returned 1
	[0187.856] CloseHandle (hObject=0x550) returned 1
	[0187.856] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.856] SetEndOfFile (hFile=0x418) returned 1
	[0187.858] CloseHandle (hObject=0x418) returned 1
	[0187.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 1
	[0187.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.859] lstrlenW (lpString=".doc") returned 4
	[0187.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.860] lstrlenW (lpString=".docx") returned 5
	[0187.860] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0187.860] lstrlenW (lpString=".pdf") returned 4
	[0187.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.860] lstrlenW (lpString=".xls") returned 4
	[0187.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.860] lstrlenW (lpString=".xlsx") returned 5
	[0187.860] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0187.860] lstrlenW (lpString=".ppt") returned 4
	[0187.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.860] lstrlenW (lpString=".zip") returned 4
	[0187.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.860] lstrlenW (lpString=".rar") returned 4
	[0187.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.860] lstrlenW (lpString=".bz2") returned 4
	[0187.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.860] lstrlenW (lpString=".7z") returned 3
	[0187.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.860] lstrlenW (lpString=".dbf") returned 4
	[0187.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.861] lstrlenW (lpString=".1cd") returned 4
	[0187.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.861] lstrlenW (lpString=".jpg") returned 4
	[0187.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.861] lstrlenW (lpString=".doc") returned 4
	[0187.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.861] lstrlenW (lpString=".docx") returned 5
	[0187.861] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0187.861] lstrlenW (lpString=".pdf") returned 4
	[0187.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.861] lstrlenW (lpString=".xls") returned 4
	[0187.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.861] lstrlenW (lpString=".xlsx") returned 5
	[0187.861] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0187.861] lstrlenW (lpString=".ppt") returned 4
	[0187.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.861] lstrlenW (lpString=".zip") returned 4
	[0187.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.861] lstrlenW (lpString=".rar") returned 4
	[0187.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.861] lstrlenW (lpString=".bz2") returned 4
	[0187.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.861] lstrlenW (lpString=".7z") returned 3
	[0187.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.861] lstrlenW (lpString=".dbf") returned 4
	[0187.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.862] lstrlenW (lpString=".1cd") returned 4
	[0187.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68
	[0187.862] lstrlenW (lpString=".jpg") returned 4
	[0187.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.862] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.862] lstrlenW (lpString="J0187883.WMF") returned 12
	[0187.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0187.863] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x331ff14 | out: lpFileSize=0x331ff14*=2100) returned 1
	[0187.863] CloseHandle (hObject=0x418) returned 1
	[0187.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf")) returned 0x220
	[0187.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0187.863] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.863] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0187.864] GetLastError () returned 0x0
	[0187.864] ReadFile (in: hFile=0x418, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x834, lpOverlapped=0x0) returned 1
	[0187.866] WriteFile (in: hFile=0x550, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0x840, lpOverlapped=0x0) returned 1
	[0187.867] ReadFile (in: hFile=0x418, lpBuffer=0x3cf3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x331fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesRead=0x331fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.867] WriteFile (in: hFile=0x550, lpBuffer=0x3cf3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x331fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf3020*, lpNumberOfBytesWritten=0x331fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.867] SetEndOfFile (hFile=0x550) returned 1
	[0187.867] CloseHandle (hObject=0x550) returned 1
	[0187.867] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x331fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.867] SetEndOfFile (hFile=0x418) returned 1
	[0187.870] CloseHandle (hObject=0x418) returned 1
	[0187.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf")) returned 1
	[0187.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.871] lstrlenW (lpString=".doc") returned 4
	[0187.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.871] lstrlenW (lpString=".docx") returned 5
	[0187.871] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0187.871] lstrlenW (lpString=".pdf") returned 4
	[0187.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.871] lstrlenW (lpString=".xls") returned 4
	[0187.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.871] lstrlenW (lpString=".xlsx") returned 5
	[0187.871] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0187.871] lstrlenW (lpString=".ppt") returned 4
	[0187.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.871] lstrlenW (lpString=".zip") returned 4
	[0187.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.872] lstrlenW (lpString=".rar") returned 4
	[0187.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.872] lstrlenW (lpString=".bz2") returned 4
	[0187.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.872] lstrlenW (lpString=".7z") returned 3
	[0187.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.872] lstrlenW (lpString=".dbf") returned 4
	[0187.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.872] lstrlenW (lpString=".1cd") returned 4
	[0187.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.872] lstrlenW (lpString=".jpg") returned 4
	[0187.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.872] lstrlenW (lpString=".doc") returned 4
	[0187.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.872] lstrlenW (lpString=".docx") returned 5
	[0187.872] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0187.872] lstrlenW (lpString=".pdf") returned 4
	[0187.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.872] lstrlenW (lpString=".xls") returned 4
	[0187.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.872] lstrlenW (lpString=".xlsx") returned 5
	[0187.872] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0187.872] lstrlenW (lpString=".ppt") returned 4
	[0187.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.873] lstrlenW (lpString=".zip") returned 4
	[0187.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.873] lstrlenW (lpString=".rar") returned 4
	[0187.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.873] lstrlenW (lpString=".bz2") returned 4
	[0187.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.873] lstrlenW (lpString=".7z") returned 3
	[0187.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.873] lstrlenW (lpString=".dbf") returned 4
	[0187.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.873] lstrlenW (lpString=".1cd") returned 4
	[0187.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68
	[0187.873] lstrlenW (lpString=".jpg") returned 4
	[0187.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.873] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.873] lstrlenW (lpString="J0187893.WMF") returned 12
	[0187.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 44
	os_tid = 0xe14

	[0153.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3e00048
	[0153.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3e10050
	[0153.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e660
	[0153.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x571c80
	[0153.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e678
	[0153.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x3f0d020
	[0153.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e540
	[0153.936] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e540, Size=0x20) returned 0x4f27f8
	[0153.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e690
	[0153.936] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e690, Size=0x20) returned 0x4f2668
	[0153.936] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0153.936] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0153.936] Wow64DisableWow64FsRedirection (in: OldValue=0x345ff50 | out: OldValue=0x345ff50*=0x0) returned 1
	[0153.936] lstrlenW (lpString="kernel32.dll") returned 12
	[0153.936] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f27f8 | out: hHeap=0x4c0000) returned 1
	[0153.936] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0153.936] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2668 | out: hHeap=0x4c0000) returned 1
	[0153.936] Sleep (dwMilliseconds=0x64) 
	[0154.255] Sleep (dwMilliseconds=0x64) 
	[0154.437] Sleep (dwMilliseconds=0x64) 
	[0154.723] Sleep (dwMilliseconds=0x64) 
	[0155.028] Sleep (dwMilliseconds=0x64) 
	[0155.392] Sleep (dwMilliseconds=0x64) 
	[0155.608] lstrcmpiW (lpString1=".p7b", lpString2=".money") returned 1
	[0155.608] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24
	[0155.608] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0155.610] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=4662) returned 1
	[0155.610] CloseHandle (hObject=0x388) returned 1
	[0155.610] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20
	[0155.610] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.610] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.610] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.610] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.610] lstrlenW (lpString=".doc") returned 4
	[0155.610] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0155.610] lstrlenW (lpString=".docx") returned 5
	[0155.610] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0155.610] lstrlenW (lpString=".pdf") returned 4
	[0155.610] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0155.610] lstrlenW (lpString=".xls") returned 4
	[0155.611] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0155.611] lstrlenW (lpString=".xlsx") returned 5
	[0155.611] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0155.611] lstrlenW (lpString=".ppt") returned 4
	[0155.611] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0155.611] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.611] lstrlenW (lpString=".zip") returned 4
	[0155.611] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0155.611] lstrlenW (lpString=".rar") returned 4
	[0155.611] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0155.611] lstrlenW (lpString=".bz2") returned 4
	[0155.611] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0155.611] lstrlenW (lpString=".7z") returned 3
	[0155.611] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0155.611] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.611] lstrlenW (lpString=".dbf") returned 4
	[0155.611] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0155.611] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.611] lstrlenW (lpString=".1cd") returned 4
	[0155.611] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0155.611] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.611] lstrlenW (lpString=".jpg") returned 4
	[0155.611] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0155.611] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.611] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.611] lstrlenW (lpString=".doc") returned 4
	[0155.611] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0155.611] lstrlenW (lpString=".docx") returned 5
	[0155.611] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0155.611] lstrlenW (lpString=".pdf") returned 4
	[0155.612] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0155.612] lstrlenW (lpString=".xls") returned 4
	[0155.612] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0155.612] lstrlenW (lpString=".xlsx") returned 5
	[0155.612] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0155.612] lstrlenW (lpString=".ppt") returned 4
	[0155.612] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0155.612] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.612] lstrlenW (lpString=".zip") returned 4
	[0155.612] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0155.612] lstrlenW (lpString=".rar") returned 4
	[0155.612] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0155.612] lstrlenW (lpString=".bz2") returned 4
	[0155.612] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0155.612] lstrlenW (lpString=".7z") returned 3
	[0155.612] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0155.612] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.612] lstrlenW (lpString=".dbf") returned 4
	[0155.612] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0155.612] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.612] lstrlenW (lpString=".1cd") returned 4
	[0155.612] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0155.612] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0155.612] lstrlenW (lpString=".jpg") returned 4
	[0155.612] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0155.612] Sleep (dwMilliseconds=0x64) 
	[0155.853] Sleep (dwMilliseconds=0x64) 
	[0156.165] Sleep (dwMilliseconds=0x64) 
	[0156.430] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.470] lstrlenW (lpString="auxbase.xml") returned 11
	[0156.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0156.484] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=1434) returned 1
	[0156.485] CloseHandle (hObject=0x448) returned 1
	[0156.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20
	[0156.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.511] lstrlenW (lpString=".doc") returned 4
	[0156.511] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.511] lstrlenW (lpString=".docx") returned 5
	[0156.511] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0156.511] lstrlenW (lpString=".pdf") returned 4
	[0156.511] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.511] lstrlenW (lpString=".xls") returned 4
	[0156.511] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.511] lstrlenW (lpString=".xlsx") returned 5
	[0156.512] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0156.512] lstrlenW (lpString=".ppt") returned 4
	[0156.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.512] lstrlenW (lpString=".zip") returned 4
	[0156.512] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.512] lstrlenW (lpString=".rar") returned 4
	[0156.512] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.512] lstrlenW (lpString=".bz2") returned 4
	[0156.512] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.512] lstrlenW (lpString=".7z") returned 3
	[0156.512] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.512] lstrlenW (lpString=".dbf") returned 4
	[0156.512] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.512] lstrlenW (lpString=".1cd") returned 4
	[0156.512] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.512] lstrlenW (lpString=".jpg") returned 4
	[0156.512] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.512] lstrlenW (lpString=".doc") returned 4
	[0156.512] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.512] lstrlenW (lpString=".docx") returned 5
	[0156.512] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0156.512] lstrlenW (lpString=".pdf") returned 4
	[0156.512] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.512] lstrlenW (lpString=".xls") returned 4
	[0156.513] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.513] lstrlenW (lpString=".xlsx") returned 5
	[0156.513] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0156.513] lstrlenW (lpString=".ppt") returned 4
	[0156.513] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.513] lstrlenW (lpString=".zip") returned 4
	[0156.513] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.513] lstrlenW (lpString=".rar") returned 4
	[0156.513] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.513] lstrlenW (lpString=".bz2") returned 4
	[0156.513] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.513] lstrlenW (lpString=".7z") returned 3
	[0156.513] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.513] lstrlenW (lpString=".dbf") returned 4
	[0156.513] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.513] lstrlenW (lpString=".1cd") returned 4
	[0156.513] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0156.513] lstrlenW (lpString=".jpg") returned 4
	[0156.513] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.513] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.513] lstrlenW (lpString="auxpad.xml") returned 10
	[0156.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c
	[0156.514] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=212) returned 1
	[0156.514] CloseHandle (hObject=0x45c) returned 1
	[0156.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20
	[0156.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.515] lstrlenW (lpString=".doc") returned 4
	[0156.515] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.515] lstrlenW (lpString=".docx") returned 5
	[0156.515] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0156.515] lstrlenW (lpString=".pdf") returned 4
	[0156.515] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.515] lstrlenW (lpString=".xls") returned 4
	[0156.515] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.515] lstrlenW (lpString=".xlsx") returned 5
	[0156.515] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0156.515] lstrlenW (lpString=".ppt") returned 4
	[0156.515] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.515] lstrlenW (lpString=".zip") returned 4
	[0156.515] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.515] lstrlenW (lpString=".rar") returned 4
	[0156.515] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.515] lstrlenW (lpString=".bz2") returned 4
	[0156.515] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.515] lstrlenW (lpString=".7z") returned 3
	[0156.515] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.515] lstrlenW (lpString=".dbf") returned 4
	[0156.515] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.516] lstrlenW (lpString=".1cd") returned 4
	[0156.516] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.516] lstrlenW (lpString=".jpg") returned 4
	[0156.516] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.516] lstrlenW (lpString=".doc") returned 4
	[0156.516] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.516] lstrlenW (lpString=".docx") returned 5
	[0156.516] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0156.516] lstrlenW (lpString=".pdf") returned 4
	[0156.516] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.516] lstrlenW (lpString=".xls") returned 4
	[0156.516] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.516] lstrlenW (lpString=".xlsx") returned 5
	[0156.516] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0156.516] lstrlenW (lpString=".ppt") returned 4
	[0156.516] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.516] lstrlenW (lpString=".zip") returned 4
	[0156.516] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.516] lstrlenW (lpString=".rar") returned 4
	[0156.516] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.516] lstrlenW (lpString=".bz2") returned 4
	[0156.516] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.516] lstrlenW (lpString=".7z") returned 3
	[0156.516] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.516] lstrlenW (lpString=".dbf") returned 4
	[0156.516] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.517] lstrlenW (lpString=".1cd") returned 4
	[0156.517] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0156.517] lstrlenW (lpString=".jpg") returned 4
	[0156.517] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.517] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.517] lstrlenW (lpString="insertbase.xml") returned 14
	[0156.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c
	[0156.518] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=903) returned 1
	[0156.518] CloseHandle (hObject=0x45c) returned 1
	[0156.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20
	[0156.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.518] lstrlenW (lpString=".doc") returned 4
	[0156.518] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.518] lstrlenW (lpString=".docx") returned 5
	[0156.518] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0156.518] lstrlenW (lpString=".pdf") returned 4
	[0156.518] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.518] lstrlenW (lpString=".xls") returned 4
	[0156.518] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.518] lstrlenW (lpString=".xlsx") returned 5
	[0156.518] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0156.518] lstrlenW (lpString=".ppt") returned 4
	[0156.518] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.519] lstrlenW (lpString=".zip") returned 4
	[0156.519] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.519] lstrlenW (lpString=".rar") returned 4
	[0156.519] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.519] lstrlenW (lpString=".bz2") returned 4
	[0156.519] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.519] lstrlenW (lpString=".7z") returned 3
	[0156.519] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.519] lstrlenW (lpString=".dbf") returned 4
	[0156.519] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.519] lstrlenW (lpString=".1cd") returned 4
	[0156.519] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.519] lstrlenW (lpString=".jpg") returned 4
	[0156.519] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.519] lstrlenW (lpString=".doc") returned 4
	[0156.519] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.519] lstrlenW (lpString=".docx") returned 5
	[0156.519] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0156.519] lstrlenW (lpString=".pdf") returned 4
	[0156.519] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.519] lstrlenW (lpString=".xls") returned 4
	[0156.519] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.519] lstrlenW (lpString=".xlsx") returned 5
	[0156.519] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0156.519] lstrlenW (lpString=".ppt") returned 4
	[0156.519] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.520] lstrlenW (lpString=".zip") returned 4
	[0156.520] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.520] lstrlenW (lpString=".rar") returned 4
	[0156.520] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.520] lstrlenW (lpString=".bz2") returned 4
	[0156.520] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.520] lstrlenW (lpString=".7z") returned 3
	[0156.520] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.520] lstrlenW (lpString=".dbf") returned 4
	[0156.520] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.520] lstrlenW (lpString=".1cd") returned 4
	[0156.520] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0156.520] lstrlenW (lpString=".jpg") returned 4
	[0156.520] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.520] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.520] lstrlenW (lpString="insert.xml") returned 10
	[0156.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c
	[0156.521] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=215) returned 1
	[0156.521] CloseHandle (hObject=0x45c) returned 1
	[0156.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20
	[0156.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.521] lstrlenW (lpString=".doc") returned 4
	[0156.521] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.521] lstrlenW (lpString=".docx") returned 5
	[0156.522] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0156.522] lstrlenW (lpString=".pdf") returned 4
	[0156.522] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.522] lstrlenW (lpString=".xls") returned 4
	[0156.522] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.522] lstrlenW (lpString=".xlsx") returned 5
	[0156.522] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0156.522] lstrlenW (lpString=".ppt") returned 4
	[0156.522] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.522] lstrlenW (lpString=".zip") returned 4
	[0156.522] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.522] lstrlenW (lpString=".rar") returned 4
	[0156.522] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.522] lstrlenW (lpString=".bz2") returned 4
	[0156.522] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.522] lstrlenW (lpString=".7z") returned 3
	[0156.522] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.522] lstrlenW (lpString=".dbf") returned 4
	[0156.522] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.522] lstrlenW (lpString=".1cd") returned 4
	[0156.522] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.522] lstrlenW (lpString=".jpg") returned 4
	[0156.522] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.522] lstrlenW (lpString=".doc") returned 4
	[0156.523] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.523] lstrlenW (lpString=".docx") returned 5
	[0156.523] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0156.523] lstrlenW (lpString=".pdf") returned 4
	[0156.523] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.523] lstrlenW (lpString=".xls") returned 4
	[0156.523] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.523] lstrlenW (lpString=".xlsx") returned 5
	[0156.523] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0156.523] lstrlenW (lpString=".ppt") returned 4
	[0156.523] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.523] lstrlenW (lpString=".zip") returned 4
	[0156.523] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.523] lstrlenW (lpString=".rar") returned 4
	[0156.523] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.523] lstrlenW (lpString=".bz2") returned 4
	[0156.523] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.523] lstrlenW (lpString=".7z") returned 3
	[0156.523] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.523] lstrlenW (lpString=".dbf") returned 4
	[0156.523] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.523] lstrlenW (lpString=".1cd") returned 4
	[0156.523] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0156.523] lstrlenW (lpString=".jpg") returned 4
	[0156.523] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.524] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.524] lstrlenW (lpString="ea.xml") returned 6
	[0156.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c
	[0156.524] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=384) returned 1
	[0156.525] CloseHandle (hObject=0x45c) returned 1
	[0156.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20
	[0156.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.525] lstrlenW (lpString=".doc") returned 4
	[0156.525] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.525] lstrlenW (lpString=".docx") returned 5
	[0156.525] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0156.525] lstrlenW (lpString=".pdf") returned 4
	[0156.525] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.525] lstrlenW (lpString=".xls") returned 4
	[0156.525] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.525] lstrlenW (lpString=".xlsx") returned 5
	[0156.525] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0156.525] lstrlenW (lpString=".ppt") returned 4
	[0156.525] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.525] lstrlenW (lpString=".zip") returned 4
	[0156.525] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.525] lstrlenW (lpString=".rar") returned 4
	[0156.525] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.525] lstrlenW (lpString=".bz2") returned 4
	[0156.525] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.526] lstrlenW (lpString=".7z") returned 3
	[0156.526] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.526] lstrlenW (lpString=".dbf") returned 4
	[0156.526] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.526] lstrlenW (lpString=".1cd") returned 4
	[0156.526] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.526] lstrlenW (lpString=".jpg") returned 4
	[0156.526] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.526] lstrlenW (lpString=".doc") returned 4
	[0156.526] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.526] lstrlenW (lpString=".docx") returned 5
	[0156.526] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0156.526] lstrlenW (lpString=".pdf") returned 4
	[0156.526] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.526] lstrlenW (lpString=".xls") returned 4
	[0156.526] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.526] lstrlenW (lpString=".xlsx") returned 5
	[0156.526] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0156.526] lstrlenW (lpString=".ppt") returned 4
	[0156.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.526] lstrlenW (lpString=".zip") returned 4
	[0156.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.526] lstrlenW (lpString=".rar") returned 4
	[0156.527] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.527] lstrlenW (lpString=".bz2") returned 4
	[0156.527] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.527] lstrlenW (lpString=".7z") returned 3
	[0156.527] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.527] lstrlenW (lpString=".dbf") returned 4
	[0156.527] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0156.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.527] lstrlenW (lpString=".1cd") returned 4
	[0156.527] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0156.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0156.527] lstrlenW (lpString=".jpg") returned 4
	[0156.527] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0156.527] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0156.527] lstrlenW (lpString="kor-kor.xml") returned 11
	[0156.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c
	[0156.528] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=392) returned 1
	[0156.528] CloseHandle (hObject=0x45c) returned 1
	[0156.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20
	[0156.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0156.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0156.528] lstrlenW (lpString=".doc") returned 4
	[0156.528] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0156.528] lstrlenW (lpString=".docx") returned 5
	[0156.528] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0156.529] lstrlenW (lpString=".pdf") returned 4
	[0156.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0156.529] lstrlenW (lpString=".xls") returned 4
	[0156.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0156.529] lstrlenW (lpString=".xlsx") returned 5
	[0156.529] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0156.529] lstrlenW (lpString=".ppt") returned 4
	[0156.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0156.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0156.529] lstrlenW (lpString=".zip") returned 4
	[0156.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0156.529] lstrlenW (lpString=".rar") returned 4
	[0156.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0156.529] lstrlenW (lpString=".bz2") returned 4
	[0156.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0156.529] lstrlenW (lpString=".7z") returned 3
	[0156.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0156.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0156.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.546] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x3e69b70, Size=0x2000) returned 0x3e69b70
	[0156.546] lstrcmpiW (lpString1=".xml", lpString2=".money") returned 1
	[0158.254] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.254] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0159.011] GetLastError () returned 0x0
	[0159.011] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1b08, lpOverlapped=0x0) returned 1
	[0159.027] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1b10, lpOverlapped=0x0) returned 1
	[0159.028] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.028] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.028] SetEndOfFile (hFile=0x520) returned 1
	[0159.028] CloseHandle (hObject=0x520) returned 1
	[0159.028] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.028] SetEndOfFile (hFile=0x4bc) returned 1
	[0159.031] CloseHandle (hObject=0x4bc) returned 1
	[0159.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1
	[0159.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.034] lstrlenW (lpString=".doc") returned 4
	[0159.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.034] lstrlenW (lpString=".docx") returned 5
	[0159.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0159.034] lstrlenW (lpString=".pdf") returned 4
	[0159.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.034] lstrlenW (lpString=".xls") returned 4
	[0159.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.034] lstrlenW (lpString=".xlsx") returned 5
	[0159.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0159.034] lstrlenW (lpString=".ppt") returned 4
	[0159.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.034] lstrlenW (lpString=".zip") returned 4
	[0159.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.034] lstrlenW (lpString=".rar") returned 4
	[0159.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.034] lstrlenW (lpString=".bz2") returned 4
	[0159.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.034] lstrlenW (lpString=".7z") returned 3
	[0159.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.034] lstrlenW (lpString=".dbf") returned 4
	[0159.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.034] lstrlenW (lpString=".1cd") returned 4
	[0159.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.035] lstrlenW (lpString=".jpg") returned 4
	[0159.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.035] lstrlenW (lpString=".doc") returned 4
	[0159.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.035] lstrlenW (lpString=".docx") returned 5
	[0159.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0159.035] lstrlenW (lpString=".pdf") returned 4
	[0159.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.035] lstrlenW (lpString=".xls") returned 4
	[0159.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.035] lstrlenW (lpString=".xlsx") returned 5
	[0159.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0159.035] lstrlenW (lpString=".ppt") returned 4
	[0159.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.035] lstrlenW (lpString=".zip") returned 4
	[0159.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.035] lstrlenW (lpString=".rar") returned 4
	[0159.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.035] lstrlenW (lpString=".bz2") returned 4
	[0159.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.035] lstrlenW (lpString=".7z") returned 3
	[0159.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.035] lstrlenW (lpString=".dbf") returned 4
	[0159.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.036] lstrlenW (lpString=".1cd") returned 4
	[0159.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0159.036] lstrlenW (lpString=".jpg") returned 4
	[0159.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.036] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.036] lstrlenW (lpString="J0090783.WMF") returned 12
	[0159.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.036] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=6934) returned 1
	[0159.036] CloseHandle (hObject=0x4bc) returned 1
	[0159.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220
	[0159.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.037] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.037] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0159.038] GetLastError () returned 0x0
	[0159.038] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1b16, lpOverlapped=0x0) returned 1
	[0159.040] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0159.041] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.041] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.041] SetEndOfFile (hFile=0x520) returned 1
	[0159.042] CloseHandle (hObject=0x520) returned 1
	[0159.042] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.042] SetEndOfFile (hFile=0x4bc) returned 1
	[0159.045] CloseHandle (hObject=0x4bc) returned 1
	[0159.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1
	[0159.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.046] lstrlenW (lpString=".doc") returned 4
	[0159.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.046] lstrlenW (lpString=".docx") returned 5
	[0159.046] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0159.046] lstrlenW (lpString=".pdf") returned 4
	[0159.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.046] lstrlenW (lpString=".xls") returned 4
	[0159.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.046] lstrlenW (lpString=".xlsx") returned 5
	[0159.046] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0159.046] lstrlenW (lpString=".ppt") returned 4
	[0159.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.046] lstrlenW (lpString=".zip") returned 4
	[0159.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.046] lstrlenW (lpString=".rar") returned 4
	[0159.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.046] lstrlenW (lpString=".bz2") returned 4
	[0159.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.047] lstrlenW (lpString=".7z") returned 3
	[0159.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.047] lstrlenW (lpString=".dbf") returned 4
	[0159.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.047] lstrlenW (lpString=".1cd") returned 4
	[0159.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.047] lstrlenW (lpString=".jpg") returned 4
	[0159.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.047] lstrlenW (lpString=".doc") returned 4
	[0159.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.047] lstrlenW (lpString=".docx") returned 5
	[0159.047] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0159.047] lstrlenW (lpString=".pdf") returned 4
	[0159.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.047] lstrlenW (lpString=".xls") returned 4
	[0159.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.047] lstrlenW (lpString=".xlsx") returned 5
	[0159.047] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0159.047] lstrlenW (lpString=".ppt") returned 4
	[0159.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.047] lstrlenW (lpString=".zip") returned 4
	[0159.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.047] lstrlenW (lpString=".rar") returned 4
	[0159.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.048] lstrlenW (lpString=".bz2") returned 4
	[0159.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.048] lstrlenW (lpString=".7z") returned 3
	[0159.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.048] lstrlenW (lpString=".dbf") returned 4
	[0159.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.048] lstrlenW (lpString=".1cd") returned 4
	[0159.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0159.048] lstrlenW (lpString=".jpg") returned 4
	[0159.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.048] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.048] lstrlenW (lpString="J0093905.WMF") returned 12
	[0159.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.049] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=42050) returned 1
	[0159.049] CloseHandle (hObject=0x4bc) returned 1
	[0159.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220
	[0159.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.049] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.049] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0159.050] GetLastError () returned 0x0
	[0159.050] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xa442, lpOverlapped=0x0) returned 1
	[0159.287] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xa450, lpOverlapped=0x0) returned 1
	[0159.289] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.289] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.289] SetEndOfFile (hFile=0x520) returned 1
	[0159.297] CloseHandle (hObject=0x520) returned 1
	[0159.297] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.297] SetEndOfFile (hFile=0x4bc) returned 1
	[0159.301] CloseHandle (hObject=0x4bc) returned 1
	[0159.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1
	[0159.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.303] lstrlenW (lpString=".doc") returned 4
	[0159.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.303] lstrlenW (lpString=".docx") returned 5
	[0159.303] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0159.303] lstrlenW (lpString=".pdf") returned 4
	[0159.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.303] lstrlenW (lpString=".xls") returned 4
	[0159.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.303] lstrlenW (lpString=".xlsx") returned 5
	[0159.303] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0159.303] lstrlenW (lpString=".ppt") returned 4
	[0159.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.303] lstrlenW (lpString=".zip") returned 4
	[0159.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.303] lstrlenW (lpString=".rar") returned 4
	[0159.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.304] lstrlenW (lpString=".bz2") returned 4
	[0159.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.304] lstrlenW (lpString=".7z") returned 3
	[0159.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.304] lstrlenW (lpString=".dbf") returned 4
	[0159.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.304] lstrlenW (lpString=".1cd") returned 4
	[0159.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.304] lstrlenW (lpString=".jpg") returned 4
	[0159.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.304] lstrlenW (lpString=".doc") returned 4
	[0159.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.304] lstrlenW (lpString=".docx") returned 5
	[0159.304] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0159.304] lstrlenW (lpString=".pdf") returned 4
	[0159.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.304] lstrlenW (lpString=".xls") returned 4
	[0159.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.304] lstrlenW (lpString=".xlsx") returned 5
	[0159.304] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0159.304] lstrlenW (lpString=".ppt") returned 4
	[0159.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.304] lstrlenW (lpString=".zip") returned 4
	[0159.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.305] lstrlenW (lpString=".rar") returned 4
	[0159.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.305] lstrlenW (lpString=".bz2") returned 4
	[0159.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.305] lstrlenW (lpString=".7z") returned 3
	[0159.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.305] lstrlenW (lpString=".dbf") returned 4
	[0159.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.305] lstrlenW (lpString=".1cd") returned 4
	[0159.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0159.305] lstrlenW (lpString=".jpg") returned 4
	[0159.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.305] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.305] lstrlenW (lpString="J0099150.JPG") returned 12
	[0159.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.306] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=21914) returned 1
	[0159.306] CloseHandle (hObject=0x4bc) returned 1
	[0159.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220
	[0159.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.307] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.307] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0159.308] GetLastError () returned 0x0
	[0159.308] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x559a, lpOverlapped=0x0) returned 1
	[0159.310] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x55a0, lpOverlapped=0x0) returned 1
	[0159.311] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.311] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.311] SetEndOfFile (hFile=0x520) returned 1
	[0159.311] CloseHandle (hObject=0x520) returned 1
	[0159.311] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.311] SetEndOfFile (hFile=0x4bc) returned 1
	[0159.315] CloseHandle (hObject=0x4bc) returned 1
	[0159.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1
	[0159.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.316] lstrlenW (lpString=".doc") returned 4
	[0159.316] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.316] lstrlenW (lpString=".docx") returned 5
	[0159.316] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0159.316] lstrlenW (lpString=".pdf") returned 4
	[0159.316] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.316] lstrlenW (lpString=".xls") returned 4
	[0159.316] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.316] lstrlenW (lpString=".xlsx") returned 5
	[0159.316] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0159.316] lstrlenW (lpString=".ppt") returned 4
	[0159.316] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.316] lstrlenW (lpString=".zip") returned 4
	[0159.316] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.316] lstrlenW (lpString=".rar") returned 4
	[0159.316] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.316] lstrlenW (lpString=".bz2") returned 4
	[0159.316] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.317] lstrlenW (lpString=".7z") returned 3
	[0159.317] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.317] lstrlenW (lpString=".dbf") returned 4
	[0159.317] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.317] lstrlenW (lpString=".1cd") returned 4
	[0159.317] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.317] lstrlenW (lpString=".jpg") returned 4
	[0159.317] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.317] lstrlenW (lpString=".doc") returned 4
	[0159.317] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.317] lstrlenW (lpString=".docx") returned 5
	[0159.317] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0159.317] lstrlenW (lpString=".pdf") returned 4
	[0159.317] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.317] lstrlenW (lpString=".xls") returned 4
	[0159.317] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.317] lstrlenW (lpString=".xlsx") returned 5
	[0159.317] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0159.317] lstrlenW (lpString=".ppt") returned 4
	[0159.317] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.317] lstrlenW (lpString=".zip") returned 4
	[0159.317] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.317] lstrlenW (lpString=".rar") returned 4
	[0159.317] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.318] lstrlenW (lpString=".bz2") returned 4
	[0159.318] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.318] lstrlenW (lpString=".7z") returned 3
	[0159.318] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.318] lstrlenW (lpString=".dbf") returned 4
	[0159.318] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.318] lstrlenW (lpString=".1cd") returned 4
	[0159.318] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0159.318] lstrlenW (lpString=".jpg") returned 4
	[0159.318] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.318] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0159.318] lstrlenW (lpString="J0099151.WMF") returned 12
	[0159.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.318] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=26086) returned 1
	[0159.319] CloseHandle (hObject=0x4bc) returned 1
	[0159.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220
	[0159.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0159.319] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.319] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0159.320] GetLastError () returned 0x0
	[0159.320] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x65e6, lpOverlapped=0x0) returned 1
	[0159.322] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x65f0, lpOverlapped=0x0) returned 1
	[0159.323] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.323] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.323] SetEndOfFile (hFile=0x520) returned 1
	[0159.324] CloseHandle (hObject=0x520) returned 1
	[0159.324] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.324] SetEndOfFile (hFile=0x4bc) returned 1
	[0159.327] CloseHandle (hObject=0x4bc) returned 1
	[0159.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0159.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1
	[0159.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.328] lstrlenW (lpString=".doc") returned 4
	[0159.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.328] lstrlenW (lpString=".docx") returned 5
	[0159.328] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0159.328] lstrlenW (lpString=".pdf") returned 4
	[0159.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.328] lstrlenW (lpString=".xls") returned 4
	[0159.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.328] lstrlenW (lpString=".xlsx") returned 5
	[0159.328] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0159.328] lstrlenW (lpString=".ppt") returned 4
	[0159.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.328] lstrlenW (lpString=".zip") returned 4
	[0159.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.328] lstrlenW (lpString=".rar") returned 4
	[0159.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.328] lstrlenW (lpString=".bz2") returned 4
	[0159.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.328] lstrlenW (lpString=".7z") returned 3
	[0159.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.328] lstrlenW (lpString=".dbf") returned 4
	[0159.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.328] lstrlenW (lpString=".1cd") returned 4
	[0159.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.329] lstrlenW (lpString=".jpg") returned 4
	[0159.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.329] lstrlenW (lpString=".doc") returned 4
	[0159.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.329] lstrlenW (lpString=".docx") returned 5
	[0159.329] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0159.329] lstrlenW (lpString=".pdf") returned 4
	[0159.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.329] lstrlenW (lpString=".xls") returned 4
	[0159.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.329] lstrlenW (lpString=".xlsx") returned 5
	[0159.329] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0159.329] lstrlenW (lpString=".ppt") returned 4
	[0159.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.329] lstrlenW (lpString=".zip") returned 4
	[0159.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.329] lstrlenW (lpString=".rar") returned 4
	[0159.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.329] lstrlenW (lpString=".bz2") returned 4
	[0159.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.330] lstrlenW (lpString=".7z") returned 3
	[0159.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.330] lstrlenW (lpString=".dbf") returned 4
	[0159.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.330] lstrlenW (lpString=".1cd") returned 4
	[0159.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0159.480] lstrlenW (lpString=".jpg") returned 4
	[0159.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.480] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0159.480] lstrlenW (lpString="J0099154.JPG") returned 12
	[0159.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0160.615] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=6929) returned 1
	[0160.615] CloseHandle (hObject=0x51c) returned 1
	[0160.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220
	[0160.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0161.552] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.552] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0161.802] GetLastError () returned 0x0
	[0161.802] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1b11, lpOverlapped=0x0) returned 1
	[0161.804] WriteFile (in: hFile=0x52c, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0161.805] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.805] WriteFile (in: hFile=0x52c, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.805] SetEndOfFile (hFile=0x52c) returned 1
	[0161.805] CloseHandle (hObject=0x52c) returned 1
	[0161.805] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.805] SetEndOfFile (hFile=0x520) returned 1
	[0161.810] CloseHandle (hObject=0x520) returned 1
	[0161.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1
	[0161.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.811] lstrlenW (lpString=".doc") returned 4
	[0161.811] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0161.811] lstrlenW (lpString=".docx") returned 5
	[0161.811] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0161.811] lstrlenW (lpString=".pdf") returned 4
	[0161.811] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0161.811] lstrlenW (lpString=".xls") returned 4
	[0161.811] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0161.811] lstrlenW (lpString=".xlsx") returned 5
	[0161.811] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0161.811] lstrlenW (lpString=".ppt") returned 4
	[0161.811] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0161.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.811] lstrlenW (lpString=".zip") returned 4
	[0161.811] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0161.811] lstrlenW (lpString=".rar") returned 4
	[0161.811] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0161.811] lstrlenW (lpString=".bz2") returned 4
	[0161.811] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0161.811] lstrlenW (lpString=".7z") returned 3
	[0161.811] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0161.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.811] lstrlenW (lpString=".dbf") returned 4
	[0161.811] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0161.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.811] lstrlenW (lpString=".1cd") returned 4
	[0161.811] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0161.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.812] lstrlenW (lpString=".jpg") returned 4
	[0161.812] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0161.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.812] lstrlenW (lpString=".doc") returned 4
	[0161.812] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0161.812] lstrlenW (lpString=".docx") returned 5
	[0161.812] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0161.812] lstrlenW (lpString=".pdf") returned 4
	[0161.812] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0161.812] lstrlenW (lpString=".xls") returned 4
	[0161.812] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0161.812] lstrlenW (lpString=".xlsx") returned 5
	[0161.812] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0161.812] lstrlenW (lpString=".ppt") returned 4
	[0161.812] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0161.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.812] lstrlenW (lpString=".zip") returned 4
	[0161.812] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0161.812] lstrlenW (lpString=".rar") returned 4
	[0161.812] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0161.812] lstrlenW (lpString=".bz2") returned 4
	[0161.812] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0161.812] lstrlenW (lpString=".7z") returned 3
	[0161.812] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0161.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.812] lstrlenW (lpString=".dbf") returned 4
	[0161.812] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0161.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.812] lstrlenW (lpString=".1cd") returned 4
	[0161.813] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0161.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0161.813] lstrlenW (lpString=".jpg") returned 4
	[0161.813] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0161.813] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0161.813] lstrlenW (lpString="J0099177.WMF") returned 12
	[0161.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0161.813] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=5386) returned 1
	[0161.813] CloseHandle (hObject=0x520) returned 1
	[0161.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220
	[0161.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0161.814] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.814] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0161.815] GetLastError () returned 0x0
	[0161.815] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x150a, lpOverlapped=0x0) returned 1
	[0161.830] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1510, lpOverlapped=0x0) returned 1
	[0161.831] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.831] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.831] SetEndOfFile (hFile=0x500) returned 1
	[0161.831] CloseHandle (hObject=0x500) returned 1
	[0161.831] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.831] SetEndOfFile (hFile=0x520) returned 1
	[0161.834] CloseHandle (hObject=0x520) returned 1
	[0161.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1
	[0161.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.835] lstrlenW (lpString=".doc") returned 4
	[0161.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.835] lstrlenW (lpString=".docx") returned 5
	[0161.835] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0161.835] lstrlenW (lpString=".pdf") returned 4
	[0161.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.835] lstrlenW (lpString=".xls") returned 4
	[0161.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.835] lstrlenW (lpString=".xlsx") returned 5
	[0161.836] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0161.836] lstrlenW (lpString=".ppt") returned 4
	[0161.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.836] lstrlenW (lpString=".zip") returned 4
	[0161.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.836] lstrlenW (lpString=".rar") returned 4
	[0161.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.836] lstrlenW (lpString=".bz2") returned 4
	[0161.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.836] lstrlenW (lpString=".7z") returned 3
	[0161.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.836] lstrlenW (lpString=".dbf") returned 4
	[0161.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.836] lstrlenW (lpString=".1cd") returned 4
	[0161.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.836] lstrlenW (lpString=".jpg") returned 4
	[0161.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.836] lstrlenW (lpString=".doc") returned 4
	[0161.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.836] lstrlenW (lpString=".docx") returned 5
	[0161.836] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0161.836] lstrlenW (lpString=".pdf") returned 4
	[0161.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.836] lstrlenW (lpString=".xls") returned 4
	[0161.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.837] lstrlenW (lpString=".xlsx") returned 5
	[0161.837] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0161.837] lstrlenW (lpString=".ppt") returned 4
	[0161.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.837] lstrlenW (lpString=".zip") returned 4
	[0161.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.837] lstrlenW (lpString=".rar") returned 4
	[0161.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.837] lstrlenW (lpString=".bz2") returned 4
	[0161.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.837] lstrlenW (lpString=".7z") returned 3
	[0161.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.837] lstrlenW (lpString=".dbf") returned 4
	[0161.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.837] lstrlenW (lpString=".1cd") returned 4
	[0161.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0161.837] lstrlenW (lpString=".jpg") returned 4
	[0161.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.837] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0161.837] lstrlenW (lpString="J0099179.WMF") returned 12
	[0161.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0161.838] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=9154) returned 1
	[0161.838] CloseHandle (hObject=0x520) returned 1
	[0161.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220
	[0161.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0161.839] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.839] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0161.840] GetLastError () returned 0x0
	[0161.840] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x23c2, lpOverlapped=0x0) returned 1
	[0161.841] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x23d0, lpOverlapped=0x0) returned 1
	[0161.842] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.842] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.843] SetEndOfFile (hFile=0x500) returned 1
	[0161.843] CloseHandle (hObject=0x500) returned 1
	[0161.843] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.843] SetEndOfFile (hFile=0x520) returned 1
	[0161.846] CloseHandle (hObject=0x520) returned 1
	[0161.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0161.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1
	[0161.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.847] lstrlenW (lpString=".doc") returned 4
	[0161.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.847] lstrlenW (lpString=".docx") returned 5
	[0161.847] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0161.847] lstrlenW (lpString=".pdf") returned 4
	[0161.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.847] lstrlenW (lpString=".xls") returned 4
	[0161.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.847] lstrlenW (lpString=".xlsx") returned 5
	[0161.847] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0161.847] lstrlenW (lpString=".ppt") returned 4
	[0161.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.847] lstrlenW (lpString=".zip") returned 4
	[0161.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.847] lstrlenW (lpString=".rar") returned 4
	[0161.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.847] lstrlenW (lpString=".bz2") returned 4
	[0161.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.848] lstrlenW (lpString=".7z") returned 3
	[0161.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.848] lstrlenW (lpString=".dbf") returned 4
	[0161.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.848] lstrlenW (lpString=".1cd") returned 4
	[0161.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.848] lstrlenW (lpString=".jpg") returned 4
	[0161.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.848] lstrlenW (lpString=".doc") returned 4
	[0161.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.848] lstrlenW (lpString=".docx") returned 5
	[0161.848] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0161.848] lstrlenW (lpString=".pdf") returned 4
	[0161.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.848] lstrlenW (lpString=".xls") returned 4
	[0161.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.848] lstrlenW (lpString=".xlsx") returned 5
	[0161.848] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0161.848] lstrlenW (lpString=".ppt") returned 4
	[0161.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.848] lstrlenW (lpString=".zip") returned 4
	[0161.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.848] lstrlenW (lpString=".rar") returned 4
	[0161.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.849] lstrlenW (lpString=".bz2") returned 4
	[0161.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.849] lstrlenW (lpString=".7z") returned 3
	[0161.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.849] lstrlenW (lpString=".dbf") returned 4
	[0161.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.849] lstrlenW (lpString=".1cd") returned 4
	[0161.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0161.849] lstrlenW (lpString=".jpg") returned 4
	[0161.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.849] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0161.849] lstrlenW (lpString="J0099180.WMF") returned 12
	[0161.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0161.849] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=3394) returned 1
	[0161.850] CloseHandle (hObject=0x520) returned 1
	[0161.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220
	[0161.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0161.850] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.850] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0161.851] GetLastError () returned 0x0
	[0161.851] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xd42, lpOverlapped=0x0) returned 1
	[0162.260] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xd50, lpOverlapped=0x0) returned 1
	[0162.269] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.269] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.269] SetEndOfFile (hFile=0x500) returned 1
	[0162.269] CloseHandle (hObject=0x500) returned 1
	[0162.270] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.270] SetEndOfFile (hFile=0x520) returned 1
	[0162.272] CloseHandle (hObject=0x520) returned 1
	[0162.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1
	[0162.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.275] lstrlenW (lpString=".doc") returned 4
	[0162.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0162.275] lstrlenW (lpString=".docx") returned 5
	[0162.275] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0162.275] lstrlenW (lpString=".pdf") returned 4
	[0162.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0162.275] lstrlenW (lpString=".xls") returned 4
	[0162.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0162.275] lstrlenW (lpString=".xlsx") returned 5
	[0162.275] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0162.275] lstrlenW (lpString=".ppt") returned 4
	[0162.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0162.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.275] lstrlenW (lpString=".zip") returned 4
	[0162.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0162.275] lstrlenW (lpString=".rar") returned 4
	[0162.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0162.276] lstrlenW (lpString=".bz2") returned 4
	[0162.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0162.276] lstrlenW (lpString=".7z") returned 3
	[0162.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0162.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.276] lstrlenW (lpString=".dbf") returned 4
	[0162.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0162.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.276] lstrlenW (lpString=".1cd") returned 4
	[0162.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0162.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.276] lstrlenW (lpString=".jpg") returned 4
	[0162.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0162.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.276] lstrlenW (lpString=".doc") returned 4
	[0162.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0162.276] lstrlenW (lpString=".docx") returned 5
	[0162.276] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0162.276] lstrlenW (lpString=".pdf") returned 4
	[0162.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0162.276] lstrlenW (lpString=".xls") returned 4
	[0162.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0162.276] lstrlenW (lpString=".xlsx") returned 5
	[0162.276] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0162.276] lstrlenW (lpString=".ppt") returned 4
	[0162.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0162.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.276] lstrlenW (lpString=".zip") returned 4
	[0162.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0162.277] lstrlenW (lpString=".rar") returned 4
	[0162.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0162.277] lstrlenW (lpString=".bz2") returned 4
	[0162.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0162.277] lstrlenW (lpString=".7z") returned 3
	[0162.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0162.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.277] lstrlenW (lpString=".dbf") returned 4
	[0162.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0162.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.277] lstrlenW (lpString=".1cd") returned 4
	[0162.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0162.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0162.277] lstrlenW (lpString=".jpg") returned 4
	[0162.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0162.277] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0162.277] lstrlenW (lpString="J0099189.JPG") returned 12
	[0162.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.278] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=8076) returned 1
	[0162.278] CloseHandle (hObject=0x520) returned 1
	[0162.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220
	[0162.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.278] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.278] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0162.279] GetLastError () returned 0x0
	[0162.279] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1f8c, lpOverlapped=0x0) returned 1
	[0162.280] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1f90, lpOverlapped=0x0) returned 1
	[0162.281] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.282] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.282] SetEndOfFile (hFile=0x500) returned 1
	[0162.282] CloseHandle (hObject=0x500) returned 1
	[0162.282] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.282] SetEndOfFile (hFile=0x520) returned 1
	[0162.284] CloseHandle (hObject=0x520) returned 1
	[0162.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1
	[0162.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.286] lstrlenW (lpString=".doc") returned 4
	[0162.286] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.286] lstrlenW (lpString=".docx") returned 5
	[0162.286] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0162.286] lstrlenW (lpString=".pdf") returned 4
	[0162.286] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.286] lstrlenW (lpString=".xls") returned 4
	[0162.286] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.286] lstrlenW (lpString=".xlsx") returned 5
	[0162.286] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0162.286] lstrlenW (lpString=".ppt") returned 4
	[0162.286] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.286] lstrlenW (lpString=".zip") returned 4
	[0162.286] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.286] lstrlenW (lpString=".rar") returned 4
	[0162.286] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.286] lstrlenW (lpString=".bz2") returned 4
	[0162.286] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.286] lstrlenW (lpString=".7z") returned 3
	[0162.286] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.286] lstrlenW (lpString=".dbf") returned 4
	[0162.286] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.286] lstrlenW (lpString=".1cd") returned 4
	[0162.286] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.286] lstrlenW (lpString=".jpg") returned 4
	[0162.286] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.287] lstrlenW (lpString=".doc") returned 4
	[0162.287] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.287] lstrlenW (lpString=".docx") returned 5
	[0162.287] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0162.287] lstrlenW (lpString=".pdf") returned 4
	[0162.287] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.287] lstrlenW (lpString=".xls") returned 4
	[0162.287] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.287] lstrlenW (lpString=".xlsx") returned 5
	[0162.287] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0162.287] lstrlenW (lpString=".ppt") returned 4
	[0162.287] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.287] lstrlenW (lpString=".zip") returned 4
	[0162.287] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.287] lstrlenW (lpString=".rar") returned 4
	[0162.287] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.287] lstrlenW (lpString=".bz2") returned 4
	[0162.287] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.287] lstrlenW (lpString=".7z") returned 3
	[0162.287] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.287] lstrlenW (lpString=".dbf") returned 4
	[0162.287] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.287] lstrlenW (lpString=".1cd") returned 4
	[0162.287] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0162.287] lstrlenW (lpString=".jpg") returned 4
	[0162.287] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.288] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0162.288] lstrlenW (lpString="J0099190.JPG") returned 12
	[0162.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.289] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=43892) returned 1
	[0162.289] CloseHandle (hObject=0x520) returned 1
	[0162.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220
	[0162.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.289] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.289] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0162.290] GetLastError () returned 0x0
	[0162.290] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xab74, lpOverlapped=0x0) returned 1
	[0162.293] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xab80, lpOverlapped=0x0) returned 1
	[0162.294] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.294] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.294] SetEndOfFile (hFile=0x500) returned 1
	[0162.294] CloseHandle (hObject=0x500) returned 1
	[0162.294] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.294] SetEndOfFile (hFile=0x520) returned 1
	[0162.298] CloseHandle (hObject=0x520) returned 1
	[0162.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1
	[0162.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.300] lstrlenW (lpString=".doc") returned 4
	[0162.300] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.300] lstrlenW (lpString=".docx") returned 5
	[0162.300] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0162.300] lstrlenW (lpString=".pdf") returned 4
	[0162.300] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.300] lstrlenW (lpString=".xls") returned 4
	[0162.300] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.301] lstrlenW (lpString=".xlsx") returned 5
	[0162.301] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0162.301] lstrlenW (lpString=".ppt") returned 4
	[0162.301] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.301] lstrlenW (lpString=".zip") returned 4
	[0162.301] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.301] lstrlenW (lpString=".rar") returned 4
	[0162.301] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.301] lstrlenW (lpString=".bz2") returned 4
	[0162.301] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.301] lstrlenW (lpString=".7z") returned 3
	[0162.301] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.301] lstrlenW (lpString=".dbf") returned 4
	[0162.301] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.301] lstrlenW (lpString=".1cd") returned 4
	[0162.301] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.301] lstrlenW (lpString=".jpg") returned 4
	[0162.301] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.301] lstrlenW (lpString=".doc") returned 4
	[0162.301] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.301] lstrlenW (lpString=".docx") returned 5
	[0162.301] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0162.301] lstrlenW (lpString=".pdf") returned 4
	[0162.301] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.301] lstrlenW (lpString=".xls") returned 4
	[0162.302] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.302] lstrlenW (lpString=".xlsx") returned 5
	[0162.302] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0162.302] lstrlenW (lpString=".ppt") returned 4
	[0162.302] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.302] lstrlenW (lpString=".zip") returned 4
	[0162.302] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.302] lstrlenW (lpString=".rar") returned 4
	[0162.302] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.302] lstrlenW (lpString=".bz2") returned 4
	[0162.302] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.302] lstrlenW (lpString=".7z") returned 3
	[0162.302] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.302] lstrlenW (lpString=".dbf") returned 4
	[0162.302] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.302] lstrlenW (lpString=".1cd") returned 4
	[0162.302] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0162.302] lstrlenW (lpString=".jpg") returned 4
	[0162.302] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.302] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0162.302] lstrlenW (lpString="J0099191.JPG") returned 12
	[0162.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.303] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=62367) returned 1
	[0162.303] CloseHandle (hObject=0x520) returned 1
	[0162.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220
	[0162.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.303] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.304] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0162.304] GetLastError () returned 0x0
	[0162.304] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xf39f, lpOverlapped=0x0) returned 1
	[0162.690] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xf3a0, lpOverlapped=0x0) returned 1
	[0162.692] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.692] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.692] SetEndOfFile (hFile=0x500) returned 1
	[0162.692] CloseHandle (hObject=0x500) returned 1
	[0162.692] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.692] SetEndOfFile (hFile=0x520) returned 1
	[0162.696] CloseHandle (hObject=0x520) returned 1
	[0162.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1
	[0162.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.697] lstrlenW (lpString=".doc") returned 4
	[0162.697] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.697] lstrlenW (lpString=".docx") returned 5
	[0162.697] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0162.697] lstrlenW (lpString=".pdf") returned 4
	[0162.697] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.697] lstrlenW (lpString=".xls") returned 4
	[0162.697] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.697] lstrlenW (lpString=".xlsx") returned 5
	[0162.697] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0162.697] lstrlenW (lpString=".ppt") returned 4
	[0162.697] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.697] lstrlenW (lpString=".zip") returned 4
	[0162.697] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.697] lstrlenW (lpString=".rar") returned 4
	[0162.697] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.697] lstrlenW (lpString=".bz2") returned 4
	[0162.697] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.697] lstrlenW (lpString=".7z") returned 3
	[0162.698] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.698] lstrlenW (lpString=".dbf") returned 4
	[0162.698] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.698] lstrlenW (lpString=".1cd") returned 4
	[0162.698] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.698] lstrlenW (lpString=".jpg") returned 4
	[0162.698] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.698] lstrlenW (lpString=".doc") returned 4
	[0162.698] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0162.698] lstrlenW (lpString=".docx") returned 5
	[0162.698] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0162.698] lstrlenW (lpString=".pdf") returned 4
	[0162.698] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0162.698] lstrlenW (lpString=".xls") returned 4
	[0162.698] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0162.698] lstrlenW (lpString=".xlsx") returned 5
	[0162.698] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0162.698] lstrlenW (lpString=".ppt") returned 4
	[0162.698] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0162.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.698] lstrlenW (lpString=".zip") returned 4
	[0162.698] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0162.698] lstrlenW (lpString=".rar") returned 4
	[0162.698] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0162.698] lstrlenW (lpString=".bz2") returned 4
	[0162.699] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0162.699] lstrlenW (lpString=".7z") returned 3
	[0162.699] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0162.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.699] lstrlenW (lpString=".dbf") returned 4
	[0162.699] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0162.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.699] lstrlenW (lpString=".1cd") returned 4
	[0162.699] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0162.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0162.699] lstrlenW (lpString=".jpg") returned 4
	[0162.699] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0162.699] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.699] lstrlenW (lpString="J0099202.GIF") returned 12
	[0162.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.700] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=4967) returned 1
	[0162.700] CloseHandle (hObject=0x520) returned 1
	[0162.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220
	[0162.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.700] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.700] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0162.701] GetLastError () returned 0x0
	[0162.701] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1367, lpOverlapped=0x0) returned 1
	[0162.702] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0162.703] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.703] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.704] SetEndOfFile (hFile=0x500) returned 1
	[0162.704] CloseHandle (hObject=0x500) returned 1
	[0162.704] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.704] SetEndOfFile (hFile=0x520) returned 1
	[0162.707] CloseHandle (hObject=0x520) returned 1
	[0162.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1
	[0162.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.708] lstrlenW (lpString=".doc") returned 4
	[0162.708] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.708] lstrlenW (lpString=".docx") returned 5
	[0162.708] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0162.708] lstrlenW (lpString=".pdf") returned 4
	[0162.708] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.708] lstrlenW (lpString=".xls") returned 4
	[0162.708] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.708] lstrlenW (lpString=".xlsx") returned 5
	[0162.708] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0162.708] lstrlenW (lpString=".ppt") returned 4
	[0162.708] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.708] lstrlenW (lpString=".zip") returned 4
	[0162.708] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.708] lstrlenW (lpString=".rar") returned 4
	[0162.708] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.708] lstrlenW (lpString=".bz2") returned 4
	[0162.708] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.708] lstrlenW (lpString=".7z") returned 3
	[0162.708] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.708] lstrlenW (lpString=".dbf") returned 4
	[0162.708] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.708] lstrlenW (lpString=".1cd") returned 4
	[0162.709] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.709] lstrlenW (lpString=".jpg") returned 4
	[0162.709] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.709] lstrlenW (lpString=".doc") returned 4
	[0162.709] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.709] lstrlenW (lpString=".docx") returned 5
	[0162.709] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0162.709] lstrlenW (lpString=".pdf") returned 4
	[0162.709] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.709] lstrlenW (lpString=".xls") returned 4
	[0162.709] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.709] lstrlenW (lpString=".xlsx") returned 5
	[0162.709] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0162.709] lstrlenW (lpString=".ppt") returned 4
	[0162.709] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.709] lstrlenW (lpString=".zip") returned 4
	[0162.709] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.709] lstrlenW (lpString=".rar") returned 4
	[0162.709] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.709] lstrlenW (lpString=".bz2") returned 4
	[0162.709] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.709] lstrlenW (lpString=".7z") returned 3
	[0162.709] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.709] lstrlenW (lpString=".dbf") returned 4
	[0162.709] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.710] lstrlenW (lpString=".1cd") returned 4
	[0162.710] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0162.710] lstrlenW (lpString=".jpg") returned 4
	[0162.710] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.710] lstrcmpiW (lpString1=".GIF", lpString2=".money") returned -1
	[0162.710] lstrlenW (lpString="J0099203.GIF") returned 12
	[0162.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.710] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=3904) returned 1
	[0162.710] CloseHandle (hObject=0x520) returned 1
	[0162.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220
	[0162.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.711] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.711] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0162.711] GetLastError () returned 0x0
	[0162.712] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xf40, lpOverlapped=0x0) returned 1
	[0162.713] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xf50, lpOverlapped=0x0) returned 1
	[0162.714] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.714] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.715] SetEndOfFile (hFile=0x500) returned 1
	[0162.715] CloseHandle (hObject=0x500) returned 1
	[0162.715] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.715] SetEndOfFile (hFile=0x520) returned 1
	[0162.718] CloseHandle (hObject=0x520) returned 1
	[0162.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0162.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1
	[0162.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.719] lstrlenW (lpString=".doc") returned 4
	[0162.719] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.719] lstrlenW (lpString=".docx") returned 5
	[0162.719] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0162.719] lstrlenW (lpString=".pdf") returned 4
	[0162.719] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.719] lstrlenW (lpString=".xls") returned 4
	[0162.719] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.719] lstrlenW (lpString=".xlsx") returned 5
	[0162.719] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0162.719] lstrlenW (lpString=".ppt") returned 4
	[0162.719] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.719] lstrlenW (lpString=".zip") returned 4
	[0162.719] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.719] lstrlenW (lpString=".rar") returned 4
	[0162.719] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.719] lstrlenW (lpString=".bz2") returned 4
	[0162.719] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.719] lstrlenW (lpString=".7z") returned 3
	[0162.719] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.719] lstrlenW (lpString=".dbf") returned 4
	[0162.719] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.720] lstrlenW (lpString=".1cd") returned 4
	[0162.720] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.720] lstrlenW (lpString=".jpg") returned 4
	[0162.720] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.720] lstrlenW (lpString=".doc") returned 4
	[0162.720] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.720] lstrlenW (lpString=".docx") returned 5
	[0162.720] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0162.720] lstrlenW (lpString=".pdf") returned 4
	[0162.720] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.720] lstrlenW (lpString=".xls") returned 4
	[0162.720] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.720] lstrlenW (lpString=".xlsx") returned 5
	[0162.720] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0162.720] lstrlenW (lpString=".ppt") returned 4
	[0162.720] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.720] lstrlenW (lpString=".zip") returned 4
	[0162.720] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.720] lstrlenW (lpString=".rar") returned 4
	[0162.720] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.720] lstrlenW (lpString=".bz2") returned 4
	[0162.720] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.720] lstrlenW (lpString=".7z") returned 3
	[0162.720] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.721] lstrlenW (lpString=".dbf") returned 4
	[0162.721] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.721] lstrlenW (lpString=".1cd") returned 4
	[0162.721] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.721] lstrlenW (lpString=".jpg") returned 4
	[0162.721] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.721] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0162.721] lstrlenW (lpString="J0099204.WMF") returned 12
	[0162.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.722] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=17854) returned 1
	[0162.722] CloseHandle (hObject=0x520) returned 1
	[0162.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220
	[0162.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.722] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.722] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0162.723] GetLastError () returned 0x0
	[0162.723] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x45be, lpOverlapped=0x0) returned 1
	[0162.996] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x45c0, lpOverlapped=0x0) returned 1
	[0162.997] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.997] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.997] SetEndOfFile (hFile=0x500) returned 1
	[0163.025] CloseHandle (hObject=0x500) returned 1
	[0163.025] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.026] SetEndOfFile (hFile=0x520) returned 1
	[0163.028] CloseHandle (hObject=0x520) returned 1
	[0163.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1
	[0163.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.034] lstrlenW (lpString=".doc") returned 4
	[0163.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.034] lstrlenW (lpString=".docx") returned 5
	[0163.034] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0163.034] lstrlenW (lpString=".pdf") returned 4
	[0163.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.034] lstrlenW (lpString=".xls") returned 4
	[0163.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.034] lstrlenW (lpString=".xlsx") returned 5
	[0163.034] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0163.034] lstrlenW (lpString=".ppt") returned 4
	[0163.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.034] lstrlenW (lpString=".zip") returned 4
	[0163.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.035] lstrlenW (lpString=".rar") returned 4
	[0163.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.035] lstrlenW (lpString=".bz2") returned 4
	[0163.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.035] lstrlenW (lpString=".7z") returned 3
	[0163.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.035] lstrlenW (lpString=".dbf") returned 4
	[0163.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.035] lstrlenW (lpString=".1cd") returned 4
	[0163.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.035] lstrlenW (lpString=".jpg") returned 4
	[0163.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.035] lstrlenW (lpString=".doc") returned 4
	[0163.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.035] lstrlenW (lpString=".docx") returned 5
	[0163.035] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0163.035] lstrlenW (lpString=".pdf") returned 4
	[0163.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.035] lstrlenW (lpString=".xls") returned 4
	[0163.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.035] lstrlenW (lpString=".xlsx") returned 5
	[0163.035] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0163.035] lstrlenW (lpString=".ppt") returned 4
	[0163.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.036] lstrlenW (lpString=".zip") returned 4
	[0163.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.036] lstrlenW (lpString=".rar") returned 4
	[0163.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.036] lstrlenW (lpString=".bz2") returned 4
	[0163.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.036] lstrlenW (lpString=".7z") returned 3
	[0163.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.036] lstrlenW (lpString=".dbf") returned 4
	[0163.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.036] lstrlenW (lpString=".1cd") returned 4
	[0163.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0163.036] lstrlenW (lpString=".jpg") returned 4
	[0163.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.036] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0163.036] lstrlenW (lpString="J0101861.BMP") returned 12
	[0163.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.037] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=32184) returned 1
	[0163.037] CloseHandle (hObject=0x520) returned 1
	[0163.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220
	[0163.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.037] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.038] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0163.038] GetLastError () returned 0x0
	[0163.038] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0163.046] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0163.047] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.047] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.047] SetEndOfFile (hFile=0x500) returned 1
	[0163.063] CloseHandle (hObject=0x500) returned 1
	[0163.063] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.063] SetEndOfFile (hFile=0x520) returned 1
	[0163.564] CloseHandle (hObject=0x520) returned 1
	[0163.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1
	[0163.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.566] lstrlenW (lpString=".doc") returned 4
	[0163.566] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.566] lstrlenW (lpString=".docx") returned 5
	[0163.566] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1
	[0163.566] lstrlenW (lpString=".pdf") returned 4
	[0163.566] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.566] lstrlenW (lpString=".xls") returned 4
	[0163.566] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.566] lstrlenW (lpString=".xlsx") returned 5
	[0163.566] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1
	[0163.566] lstrlenW (lpString=".ppt") returned 4
	[0163.566] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.566] lstrlenW (lpString=".zip") returned 4
	[0163.566] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.566] lstrlenW (lpString=".rar") returned 4
	[0163.566] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.566] lstrlenW (lpString=".bz2") returned 4
	[0163.566] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.566] lstrlenW (lpString=".7z") returned 3
	[0163.566] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.566] lstrlenW (lpString=".dbf") returned 4
	[0163.566] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.566] lstrlenW (lpString=".1cd") returned 4
	[0163.567] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.567] lstrlenW (lpString=".jpg") returned 4
	[0163.567] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.567] lstrlenW (lpString=".doc") returned 4
	[0163.567] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.567] lstrlenW (lpString=".docx") returned 5
	[0163.567] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1
	[0163.567] lstrlenW (lpString=".pdf") returned 4
	[0163.567] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.567] lstrlenW (lpString=".xls") returned 4
	[0163.567] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.567] lstrlenW (lpString=".xlsx") returned 5
	[0163.567] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1
	[0163.567] lstrlenW (lpString=".ppt") returned 4
	[0163.567] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.567] lstrlenW (lpString=".zip") returned 4
	[0163.567] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.567] lstrlenW (lpString=".rar") returned 4
	[0163.567] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.567] lstrlenW (lpString=".bz2") returned 4
	[0163.567] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.567] lstrlenW (lpString=".7z") returned 3
	[0163.567] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.567] lstrlenW (lpString=".dbf") returned 4
	[0163.567] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.568] lstrlenW (lpString=".1cd") returned 4
	[0163.568] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0163.568] lstrlenW (lpString=".jpg") returned 4
	[0163.568] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.568] lstrcmpiW (lpString1=".BMP", lpString2=".money") returned -1
	[0163.568] lstrlenW (lpString="J0101867.BMP") returned 12
	[0163.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.569] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=32616) returned 1
	[0163.569] CloseHandle (hObject=0x520) returned 1
	[0163.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220
	[0163.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.569] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.569] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0163.570] GetLastError () returned 0x0
	[0163.570] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x7f68, lpOverlapped=0x0) returned 1
	[0163.573] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x7f70, lpOverlapped=0x0) returned 1
	[0163.574] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.574] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.574] SetEndOfFile (hFile=0x4b8) returned 1
	[0163.575] CloseHandle (hObject=0x4b8) returned 1
	[0163.575] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.575] SetEndOfFile (hFile=0x520) returned 1
	[0163.582] CloseHandle (hObject=0x520) returned 1
	[0163.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1
	[0163.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.583] lstrlenW (lpString=".doc") returned 4
	[0163.583] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.583] lstrlenW (lpString=".docx") returned 5
	[0163.583] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0163.583] lstrlenW (lpString=".pdf") returned 4
	[0163.583] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.583] lstrlenW (lpString=".xls") returned 4
	[0163.583] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.583] lstrlenW (lpString=".xlsx") returned 5
	[0163.583] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0163.583] lstrlenW (lpString=".ppt") returned 4
	[0163.583] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.583] lstrlenW (lpString=".zip") returned 4
	[0163.584] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.584] lstrlenW (lpString=".rar") returned 4
	[0163.584] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.584] lstrlenW (lpString=".bz2") returned 4
	[0163.584] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.584] lstrlenW (lpString=".7z") returned 3
	[0163.584] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.584] lstrlenW (lpString=".dbf") returned 4
	[0163.584] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.584] lstrlenW (lpString=".1cd") returned 4
	[0163.584] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.584] lstrlenW (lpString=".jpg") returned 4
	[0163.584] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.584] lstrlenW (lpString=".doc") returned 4
	[0163.584] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.584] lstrlenW (lpString=".docx") returned 5
	[0163.584] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0163.584] lstrlenW (lpString=".pdf") returned 4
	[0163.584] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.584] lstrlenW (lpString=".xls") returned 4
	[0163.584] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.584] lstrlenW (lpString=".xlsx") returned 5
	[0163.584] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0163.584] lstrlenW (lpString=".ppt") returned 4
	[0163.584] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.585] lstrlenW (lpString=".zip") returned 4
	[0163.585] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.585] lstrlenW (lpString=".rar") returned 4
	[0163.585] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.585] lstrlenW (lpString=".bz2") returned 4
	[0163.585] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.585] lstrlenW (lpString=".7z") returned 3
	[0163.585] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.585] lstrlenW (lpString=".dbf") returned 4
	[0163.585] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.585] lstrlenW (lpString=".1cd") returned 4
	[0163.585] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0163.585] lstrlenW (lpString=".jpg") returned 4
	[0163.585] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.585] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.585] lstrlenW (lpString="J0101980.WMF") returned 12
	[0163.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.586] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=16104) returned 1
	[0163.586] CloseHandle (hObject=0x520) returned 1
	[0163.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220
	[0163.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.586] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.587] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0163.587] GetLastError () returned 0x0
	[0163.587] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x3ee8, lpOverlapped=0x0) returned 1
	[0163.589] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x3ef0, lpOverlapped=0x0) returned 1
	[0163.590] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.590] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.590] SetEndOfFile (hFile=0x4b8) returned 1
	[0163.591] CloseHandle (hObject=0x4b8) returned 1
	[0163.591] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.591] SetEndOfFile (hFile=0x520) returned 1
	[0163.593] CloseHandle (hObject=0x520) returned 1
	[0163.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1
	[0163.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.594] lstrlenW (lpString=".doc") returned 4
	[0163.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.594] lstrlenW (lpString=".docx") returned 5
	[0163.594] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0163.594] lstrlenW (lpString=".pdf") returned 4
	[0163.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.595] lstrlenW (lpString=".xls") returned 4
	[0163.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.595] lstrlenW (lpString=".xlsx") returned 5
	[0163.595] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0163.595] lstrlenW (lpString=".ppt") returned 4
	[0163.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.595] lstrlenW (lpString=".zip") returned 4
	[0163.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.595] lstrlenW (lpString=".rar") returned 4
	[0163.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.595] lstrlenW (lpString=".bz2") returned 4
	[0163.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.595] lstrlenW (lpString=".7z") returned 3
	[0163.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.595] lstrlenW (lpString=".dbf") returned 4
	[0163.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.595] lstrlenW (lpString=".1cd") returned 4
	[0163.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.595] lstrlenW (lpString=".jpg") returned 4
	[0163.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.595] lstrlenW (lpString=".doc") returned 4
	[0163.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.595] lstrlenW (lpString=".docx") returned 5
	[0163.905] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0163.905] lstrlenW (lpString=".pdf") returned 4
	[0163.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.905] lstrlenW (lpString=".xls") returned 4
	[0163.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.906] lstrlenW (lpString=".xlsx") returned 5
	[0163.906] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0163.906] lstrlenW (lpString=".ppt") returned 4
	[0163.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.906] lstrlenW (lpString=".zip") returned 4
	[0163.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.906] lstrlenW (lpString=".rar") returned 4
	[0163.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.906] lstrlenW (lpString=".bz2") returned 4
	[0163.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.906] lstrlenW (lpString=".7z") returned 3
	[0163.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.906] lstrlenW (lpString=".dbf") returned 4
	[0163.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.906] lstrlenW (lpString=".1cd") returned 4
	[0163.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.906] lstrlenW (lpString=".jpg") returned 4
	[0163.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.906] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.906] lstrlenW (lpString="J0105232.WMF") returned 12
	[0163.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0163.907] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=5632) returned 1
	[0163.907] CloseHandle (hObject=0x500) returned 1
	[0163.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220
	[0163.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0163.908] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.908] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0163.909] GetLastError () returned 0x0
	[0163.909] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1600, lpOverlapped=0x0) returned 1
	[0163.911] WriteFile (in: hFile=0x540, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1610, lpOverlapped=0x0) returned 1
	[0163.912] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.912] WriteFile (in: hFile=0x540, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.912] SetEndOfFile (hFile=0x540) returned 1
	[0163.912] CloseHandle (hObject=0x540) returned 1
	[0163.912] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.912] SetEndOfFile (hFile=0x500) returned 1
	[0163.915] CloseHandle (hObject=0x500) returned 1
	[0163.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1
	[0163.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.917] lstrlenW (lpString=".doc") returned 4
	[0163.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.917] lstrlenW (lpString=".docx") returned 5
	[0163.917] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.917] lstrlenW (lpString=".pdf") returned 4
	[0163.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.917] lstrlenW (lpString=".xls") returned 4
	[0163.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.917] lstrlenW (lpString=".xlsx") returned 5
	[0163.917] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.917] lstrlenW (lpString=".ppt") returned 4
	[0163.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.917] lstrlenW (lpString=".zip") returned 4
	[0163.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.917] lstrlenW (lpString=".rar") returned 4
	[0163.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.917] lstrlenW (lpString=".bz2") returned 4
	[0163.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.917] lstrlenW (lpString=".7z") returned 3
	[0163.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.917] lstrlenW (lpString=".dbf") returned 4
	[0163.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.917] lstrlenW (lpString=".1cd") returned 4
	[0163.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.917] lstrlenW (lpString=".jpg") returned 4
	[0163.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.918] lstrlenW (lpString=".doc") returned 4
	[0163.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.918] lstrlenW (lpString=".docx") returned 5
	[0163.918] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.918] lstrlenW (lpString=".pdf") returned 4
	[0163.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.918] lstrlenW (lpString=".xls") returned 4
	[0163.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.918] lstrlenW (lpString=".xlsx") returned 5
	[0163.918] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.918] lstrlenW (lpString=".ppt") returned 4
	[0163.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.918] lstrlenW (lpString=".zip") returned 4
	[0163.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.918] lstrlenW (lpString=".rar") returned 4
	[0163.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.918] lstrlenW (lpString=".bz2") returned 4
	[0163.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.918] lstrlenW (lpString=".7z") returned 3
	[0163.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.918] lstrlenW (lpString=".dbf") returned 4
	[0163.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.918] lstrlenW (lpString=".1cd") returned 4
	[0163.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0163.919] lstrlenW (lpString=".jpg") returned 4
	[0163.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.919] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.919] lstrlenW (lpString="J0105234.WMF") returned 12
	[0163.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0163.920] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=3444) returned 1
	[0163.920] CloseHandle (hObject=0x500) returned 1
	[0163.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220
	[0163.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0163.921] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.921] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0163.921] GetLastError () returned 0x0
	[0163.921] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xd74, lpOverlapped=0x0) returned 1
	[0163.923] WriteFile (in: hFile=0x540, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xd80, lpOverlapped=0x0) returned 1
	[0163.924] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.924] WriteFile (in: hFile=0x540, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.924] SetEndOfFile (hFile=0x540) returned 1
	[0163.924] CloseHandle (hObject=0x540) returned 1
	[0163.925] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.925] SetEndOfFile (hFile=0x500) returned 1
	[0163.927] CloseHandle (hObject=0x500) returned 1
	[0163.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1
	[0163.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.928] lstrlenW (lpString=".doc") returned 4
	[0163.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.928] lstrlenW (lpString=".docx") returned 5
	[0163.928] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0163.928] lstrlenW (lpString=".pdf") returned 4
	[0163.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.928] lstrlenW (lpString=".xls") returned 4
	[0163.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.928] lstrlenW (lpString=".xlsx") returned 5
	[0163.928] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0163.928] lstrlenW (lpString=".ppt") returned 4
	[0163.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.928] lstrlenW (lpString=".zip") returned 4
	[0163.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.928] lstrlenW (lpString=".rar") returned 4
	[0163.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.928] lstrlenW (lpString=".bz2") returned 4
	[0163.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.929] lstrlenW (lpString=".7z") returned 3
	[0163.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.929] lstrlenW (lpString=".dbf") returned 4
	[0163.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.929] lstrlenW (lpString=".1cd") returned 4
	[0163.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.929] lstrlenW (lpString=".jpg") returned 4
	[0163.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.929] lstrlenW (lpString=".doc") returned 4
	[0163.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.929] lstrlenW (lpString=".docx") returned 5
	[0163.929] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0163.929] lstrlenW (lpString=".pdf") returned 4
	[0163.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.929] lstrlenW (lpString=".xls") returned 4
	[0163.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.929] lstrlenW (lpString=".xlsx") returned 5
	[0163.929] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0163.929] lstrlenW (lpString=".ppt") returned 4
	[0163.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.929] lstrlenW (lpString=".zip") returned 4
	[0163.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.929] lstrlenW (lpString=".rar") returned 4
	[0163.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.930] lstrlenW (lpString=".bz2") returned 4
	[0163.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.930] lstrlenW (lpString=".7z") returned 3
	[0163.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.930] lstrlenW (lpString=".dbf") returned 4
	[0163.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.930] lstrlenW (lpString=".1cd") returned 4
	[0163.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0163.930] lstrlenW (lpString=".jpg") returned 4
	[0163.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.930] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0163.930] lstrlenW (lpString="J0105238.WMF") returned 12
	[0163.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0163.931] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=17172) returned 1
	[0163.931] CloseHandle (hObject=0x500) returned 1
	[0163.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220
	[0163.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0163.931] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.931] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0163.932] GetLastError () returned 0x0
	[0163.932] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x4314, lpOverlapped=0x0) returned 1
	[0163.934] WriteFile (in: hFile=0x540, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x4320, lpOverlapped=0x0) returned 1
	[0163.935] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.935] WriteFile (in: hFile=0x540, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.935] SetEndOfFile (hFile=0x540) returned 1
	[0163.936] CloseHandle (hObject=0x540) returned 1
	[0163.936] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.936] SetEndOfFile (hFile=0x500) returned 1
	[0163.938] CloseHandle (hObject=0x500) returned 1
	[0163.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0163.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1
	[0164.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.358] lstrlenW (lpString=".doc") returned 4
	[0164.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.358] lstrlenW (lpString=".docx") returned 5
	[0164.358] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0164.358] lstrlenW (lpString=".pdf") returned 4
	[0164.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.358] lstrlenW (lpString=".xls") returned 4
	[0164.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.358] lstrlenW (lpString=".xlsx") returned 5
	[0164.358] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0164.358] lstrlenW (lpString=".ppt") returned 4
	[0164.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.358] lstrlenW (lpString=".zip") returned 4
	[0164.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.358] lstrlenW (lpString=".rar") returned 4
	[0164.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.358] lstrlenW (lpString=".bz2") returned 4
	[0164.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.358] lstrlenW (lpString=".7z") returned 3
	[0164.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.358] lstrlenW (lpString=".dbf") returned 4
	[0164.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.358] lstrlenW (lpString=".1cd") returned 4
	[0164.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.359] lstrlenW (lpString=".jpg") returned 4
	[0164.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.359] lstrlenW (lpString=".doc") returned 4
	[0164.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.359] lstrlenW (lpString=".docx") returned 5
	[0164.359] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0164.359] lstrlenW (lpString=".pdf") returned 4
	[0164.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.359] lstrlenW (lpString=".xls") returned 4
	[0164.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.359] lstrlenW (lpString=".xlsx") returned 5
	[0164.359] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0164.359] lstrlenW (lpString=".ppt") returned 4
	[0164.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.359] lstrlenW (lpString=".zip") returned 4
	[0164.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.359] lstrlenW (lpString=".rar") returned 4
	[0164.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.359] lstrlenW (lpString=".bz2") returned 4
	[0164.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.359] lstrlenW (lpString=".7z") returned 3
	[0164.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.359] lstrlenW (lpString=".dbf") returned 4
	[0164.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.359] lstrlenW (lpString=".1cd") returned 4
	[0164.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.360] lstrlenW (lpString=".jpg") returned 4
	[0164.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.360] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.360] lstrlenW (lpString="J0105298.WMF") returned 12
	[0164.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.361] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=6320) returned 1
	[0164.361] CloseHandle (hObject=0x500) returned 1
	[0164.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220
	[0164.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.362] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.362] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0164.362] GetLastError () returned 0x0
	[0164.362] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x18b0, lpOverlapped=0x0) returned 1
	[0164.364] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x18c0, lpOverlapped=0x0) returned 1
	[0164.365] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.365] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.365] SetEndOfFile (hFile=0x520) returned 1
	[0164.365] CloseHandle (hObject=0x520) returned 1
	[0164.365] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.366] SetEndOfFile (hFile=0x500) returned 1
	[0164.368] CloseHandle (hObject=0x500) returned 1
	[0164.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1
	[0164.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.369] lstrlenW (lpString=".doc") returned 4
	[0164.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.369] lstrlenW (lpString=".docx") returned 5
	[0164.369] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0164.370] lstrlenW (lpString=".pdf") returned 4
	[0164.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.370] lstrlenW (lpString=".xls") returned 4
	[0164.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.370] lstrlenW (lpString=".xlsx") returned 5
	[0164.370] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0164.370] lstrlenW (lpString=".ppt") returned 4
	[0164.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.370] lstrlenW (lpString=".zip") returned 4
	[0164.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.370] lstrlenW (lpString=".rar") returned 4
	[0164.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.370] lstrlenW (lpString=".bz2") returned 4
	[0164.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.370] lstrlenW (lpString=".7z") returned 3
	[0164.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.370] lstrlenW (lpString=".dbf") returned 4
	[0164.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.370] lstrlenW (lpString=".1cd") returned 4
	[0164.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.370] lstrlenW (lpString=".jpg") returned 4
	[0164.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.370] lstrlenW (lpString=".doc") returned 4
	[0164.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.370] lstrlenW (lpString=".docx") returned 5
	[0164.371] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0164.371] lstrlenW (lpString=".pdf") returned 4
	[0164.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.371] lstrlenW (lpString=".xls") returned 4
	[0164.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.371] lstrlenW (lpString=".xlsx") returned 5
	[0164.371] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0164.371] lstrlenW (lpString=".ppt") returned 4
	[0164.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.371] lstrlenW (lpString=".zip") returned 4
	[0164.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.371] lstrlenW (lpString=".rar") returned 4
	[0164.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.371] lstrlenW (lpString=".bz2") returned 4
	[0164.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.371] lstrlenW (lpString=".7z") returned 3
	[0164.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.371] lstrlenW (lpString=".dbf") returned 4
	[0164.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.371] lstrlenW (lpString=".1cd") returned 4
	[0164.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0164.371] lstrlenW (lpString=".jpg") returned 4
	[0164.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.371] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.372] lstrlenW (lpString="J0105306.WMF") returned 12
	[0164.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.372] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=4320) returned 1
	[0164.372] CloseHandle (hObject=0x500) returned 1
	[0164.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220
	[0164.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.373] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.373] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0164.374] GetLastError () returned 0x0
	[0164.374] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x10e0, lpOverlapped=0x0) returned 1
	[0164.375] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x10f0, lpOverlapped=0x0) returned 1
	[0164.376] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.376] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.376] SetEndOfFile (hFile=0x520) returned 1
	[0164.377] CloseHandle (hObject=0x520) returned 1
	[0164.377] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.377] SetEndOfFile (hFile=0x500) returned 1
	[0164.379] CloseHandle (hObject=0x500) returned 1
	[0164.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1
	[0164.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.380] lstrlenW (lpString=".doc") returned 4
	[0164.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.380] lstrlenW (lpString=".docx") returned 5
	[0164.380] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0164.380] lstrlenW (lpString=".pdf") returned 4
	[0164.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.381] lstrlenW (lpString=".xls") returned 4
	[0164.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.381] lstrlenW (lpString=".xlsx") returned 5
	[0164.381] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0164.381] lstrlenW (lpString=".ppt") returned 4
	[0164.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.381] lstrlenW (lpString=".zip") returned 4
	[0164.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.381] lstrlenW (lpString=".rar") returned 4
	[0164.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.381] lstrlenW (lpString=".bz2") returned 4
	[0164.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.381] lstrlenW (lpString=".7z") returned 3
	[0164.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.381] lstrlenW (lpString=".dbf") returned 4
	[0164.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.381] lstrlenW (lpString=".1cd") returned 4
	[0164.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.381] lstrlenW (lpString=".jpg") returned 4
	[0164.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.381] lstrlenW (lpString=".doc") returned 4
	[0164.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.382] lstrlenW (lpString=".docx") returned 5
	[0164.382] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0164.382] lstrlenW (lpString=".pdf") returned 4
	[0164.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.382] lstrlenW (lpString=".xls") returned 4
	[0164.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.382] lstrlenW (lpString=".xlsx") returned 5
	[0164.382] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0164.382] lstrlenW (lpString=".ppt") returned 4
	[0164.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.382] lstrlenW (lpString=".zip") returned 4
	[0164.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.382] lstrlenW (lpString=".rar") returned 4
	[0164.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.382] lstrlenW (lpString=".bz2") returned 4
	[0164.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.382] lstrlenW (lpString=".7z") returned 3
	[0164.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.382] lstrlenW (lpString=".dbf") returned 4
	[0164.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.382] lstrlenW (lpString=".1cd") returned 4
	[0164.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0164.382] lstrlenW (lpString=".jpg") returned 4
	[0164.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.383] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.383] lstrlenW (lpString="J0105320.WMF") returned 12
	[0164.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.383] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=2020) returned 1
	[0164.383] CloseHandle (hObject=0x500) returned 1
	[0164.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220
	[0164.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.384] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.384] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0164.384] GetLastError () returned 0x0
	[0164.384] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x7e4, lpOverlapped=0x0) returned 1
	[0164.386] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0164.387] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.387] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.387] SetEndOfFile (hFile=0x520) returned 1
	[0164.387] CloseHandle (hObject=0x520) returned 1
	[0164.387] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.387] SetEndOfFile (hFile=0x500) returned 1
	[0164.390] CloseHandle (hObject=0x500) returned 1
	[0164.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1
	[0164.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.391] lstrlenW (lpString=".doc") returned 4
	[0164.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.391] lstrlenW (lpString=".docx") returned 5
	[0164.391] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0164.391] lstrlenW (lpString=".pdf") returned 4
	[0164.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.391] lstrlenW (lpString=".xls") returned 4
	[0164.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.391] lstrlenW (lpString=".xlsx") returned 5
	[0164.391] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0164.391] lstrlenW (lpString=".ppt") returned 4
	[0164.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.391] lstrlenW (lpString=".zip") returned 4
	[0164.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.391] lstrlenW (lpString=".rar") returned 4
	[0164.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.391] lstrlenW (lpString=".bz2") returned 4
	[0164.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.391] lstrlenW (lpString=".7z") returned 3
	[0164.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.391] lstrlenW (lpString=".dbf") returned 4
	[0164.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.391] lstrlenW (lpString=".1cd") returned 4
	[0164.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.392] lstrlenW (lpString=".jpg") returned 4
	[0164.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.392] lstrlenW (lpString=".doc") returned 4
	[0164.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.392] lstrlenW (lpString=".docx") returned 5
	[0164.392] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0164.392] lstrlenW (lpString=".pdf") returned 4
	[0164.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.392] lstrlenW (lpString=".xls") returned 4
	[0164.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.392] lstrlenW (lpString=".xlsx") returned 5
	[0164.392] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0164.392] lstrlenW (lpString=".ppt") returned 4
	[0164.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.392] lstrlenW (lpString=".zip") returned 4
	[0164.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.392] lstrlenW (lpString=".rar") returned 4
	[0164.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.392] lstrlenW (lpString=".bz2") returned 4
	[0164.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.392] lstrlenW (lpString=".7z") returned 3
	[0164.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.392] lstrlenW (lpString=".dbf") returned 4
	[0164.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.393] lstrlenW (lpString=".1cd") returned 4
	[0164.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0164.393] lstrlenW (lpString=".jpg") returned 4
	[0164.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.393] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.393] lstrlenW (lpString="J0105328.WMF") returned 12
	[0164.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.393] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=7992) returned 1
	[0164.394] CloseHandle (hObject=0x500) returned 1
	[0164.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220
	[0164.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.394] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.394] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0164.395] GetLastError () returned 0x0
	[0164.395] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1f38, lpOverlapped=0x0) returned 1
	[0164.455] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1f40, lpOverlapped=0x0) returned 1
	[0164.461] ReadFile (in: hFile=0x500, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.461] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.461] SetEndOfFile (hFile=0x520) returned 1
	[0164.461] CloseHandle (hObject=0x520) returned 1
	[0164.462] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.462] SetEndOfFile (hFile=0x500) returned 1
	[0164.470] CloseHandle (hObject=0x500) returned 1
	[0164.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0164.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1
	[0164.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.642] lstrlenW (lpString=".doc") returned 4
	[0164.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.643] lstrlenW (lpString=".docx") returned 5
	[0164.643] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0164.643] lstrlenW (lpString=".pdf") returned 4
	[0164.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.643] lstrlenW (lpString=".xls") returned 4
	[0164.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.643] lstrlenW (lpString=".xlsx") returned 5
	[0164.643] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0164.643] lstrlenW (lpString=".ppt") returned 4
	[0164.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.643] lstrlenW (lpString=".zip") returned 4
	[0164.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.643] lstrlenW (lpString=".rar") returned 4
	[0164.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.643] lstrlenW (lpString=".bz2") returned 4
	[0164.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.643] lstrlenW (lpString=".7z") returned 3
	[0164.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.643] lstrlenW (lpString=".dbf") returned 4
	[0164.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.643] lstrlenW (lpString=".1cd") returned 4
	[0164.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.643] lstrlenW (lpString=".jpg") returned 4
	[0164.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.644] lstrlenW (lpString=".doc") returned 4
	[0164.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.644] lstrlenW (lpString=".docx") returned 5
	[0164.644] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0164.644] lstrlenW (lpString=".pdf") returned 4
	[0164.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.644] lstrlenW (lpString=".xls") returned 4
	[0164.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.644] lstrlenW (lpString=".xlsx") returned 5
	[0164.644] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0164.644] lstrlenW (lpString=".ppt") returned 4
	[0164.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.644] lstrlenW (lpString=".zip") returned 4
	[0164.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.644] lstrlenW (lpString=".rar") returned 4
	[0164.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.644] lstrlenW (lpString=".bz2") returned 4
	[0164.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.644] lstrlenW (lpString=".7z") returned 3
	[0164.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.644] lstrlenW (lpString=".dbf") returned 4
	[0164.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.644] lstrlenW (lpString=".1cd") returned 4
	[0164.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0164.645] lstrlenW (lpString=".jpg") returned 4
	[0164.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.645] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0164.645] lstrlenW (lpString="J0105348.WMF") returned 12
	[0164.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0165.914] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=17060) returned 1
	[0165.915] CloseHandle (hObject=0x520) returned 1
	[0165.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220
	[0166.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0166.679] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.679] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0167.657] GetLastError () returned 0x0
	[0167.657] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x42a4, lpOverlapped=0x0) returned 1
	[0167.659] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x42b0, lpOverlapped=0x0) returned 1
	[0167.660] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.660] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.660] SetEndOfFile (hFile=0x520) returned 1
	[0167.660] CloseHandle (hObject=0x520) returned 1
	[0167.660] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.660] SetEndOfFile (hFile=0x4e0) returned 1
	[0167.663] CloseHandle (hObject=0x4e0) returned 1
	[0167.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1
	[0167.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.665] lstrlenW (lpString=".doc") returned 4
	[0167.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.665] lstrlenW (lpString=".docx") returned 5
	[0167.665] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0167.665] lstrlenW (lpString=".pdf") returned 4
	[0167.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.665] lstrlenW (lpString=".xls") returned 4
	[0167.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.665] lstrlenW (lpString=".xlsx") returned 5
	[0167.665] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0167.665] lstrlenW (lpString=".ppt") returned 4
	[0167.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.665] lstrlenW (lpString=".zip") returned 4
	[0167.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.665] lstrlenW (lpString=".rar") returned 4
	[0167.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.665] lstrlenW (lpString=".bz2") returned 4
	[0167.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.665] lstrlenW (lpString=".7z") returned 3
	[0167.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.668] lstrlenW (lpString=".dbf") returned 4
	[0167.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.668] lstrlenW (lpString=".1cd") returned 4
	[0167.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.668] lstrlenW (lpString=".jpg") returned 4
	[0167.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.668] lstrlenW (lpString=".doc") returned 4
	[0167.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.668] lstrlenW (lpString=".docx") returned 5
	[0167.668] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0167.668] lstrlenW (lpString=".pdf") returned 4
	[0167.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.668] lstrlenW (lpString=".xls") returned 4
	[0167.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.668] lstrlenW (lpString=".xlsx") returned 5
	[0167.668] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0167.668] lstrlenW (lpString=".ppt") returned 4
	[0167.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.668] lstrlenW (lpString=".zip") returned 4
	[0167.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.669] lstrlenW (lpString=".rar") returned 4
	[0167.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.669] lstrlenW (lpString=".bz2") returned 4
	[0167.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.669] lstrlenW (lpString=".7z") returned 3
	[0167.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.669] lstrlenW (lpString=".dbf") returned 4
	[0167.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.669] lstrlenW (lpString=".1cd") returned 4
	[0167.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0167.669] lstrlenW (lpString=".jpg") returned 4
	[0167.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.669] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.669] lstrlenW (lpString="J0105638.WMF") returned 12
	[0167.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0167.670] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=10364) returned 1
	[0167.670] CloseHandle (hObject=0x4e0) returned 1
	[0167.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220
	[0167.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0167.671] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.671] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0167.672] GetLastError () returned 0x0
	[0167.672] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x287c, lpOverlapped=0x0) returned 1
	[0167.674] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x2880, lpOverlapped=0x0) returned 1
	[0167.675] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.675] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.675] SetEndOfFile (hFile=0x520) returned 1
	[0167.675] CloseHandle (hObject=0x520) returned 1
	[0167.675] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.675] SetEndOfFile (hFile=0x4e0) returned 1
	[0167.678] CloseHandle (hObject=0x4e0) returned 1
	[0167.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1
	[0167.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.679] lstrlenW (lpString=".doc") returned 4
	[0167.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.679] lstrlenW (lpString=".docx") returned 5
	[0167.679] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0167.679] lstrlenW (lpString=".pdf") returned 4
	[0167.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.680] lstrlenW (lpString=".xls") returned 4
	[0167.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.680] lstrlenW (lpString=".xlsx") returned 5
	[0167.680] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0167.680] lstrlenW (lpString=".ppt") returned 4
	[0167.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.680] lstrlenW (lpString=".zip") returned 4
	[0167.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.680] lstrlenW (lpString=".rar") returned 4
	[0167.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.680] lstrlenW (lpString=".bz2") returned 4
	[0167.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.680] lstrlenW (lpString=".7z") returned 3
	[0167.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.680] lstrlenW (lpString=".dbf") returned 4
	[0167.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.680] lstrlenW (lpString=".1cd") returned 4
	[0167.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.680] lstrlenW (lpString=".jpg") returned 4
	[0167.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.680] lstrlenW (lpString=".doc") returned 4
	[0167.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.681] lstrlenW (lpString=".docx") returned 5
	[0167.681] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0167.681] lstrlenW (lpString=".pdf") returned 4
	[0167.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.681] lstrlenW (lpString=".xls") returned 4
	[0167.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.681] lstrlenW (lpString=".xlsx") returned 5
	[0167.681] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0167.681] lstrlenW (lpString=".ppt") returned 4
	[0167.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.681] lstrlenW (lpString=".zip") returned 4
	[0167.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.681] lstrlenW (lpString=".rar") returned 4
	[0167.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.681] lstrlenW (lpString=".bz2") returned 4
	[0167.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.681] lstrlenW (lpString=".7z") returned 3
	[0167.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.681] lstrlenW (lpString=".dbf") returned 4
	[0167.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.681] lstrlenW (lpString=".1cd") returned 4
	[0167.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0167.681] lstrlenW (lpString=".jpg") returned 4
	[0167.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.682] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0167.682] lstrlenW (lpString="J0105710.WMF") returned 12
	[0167.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0167.683] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=13808) returned 1
	[0167.683] CloseHandle (hObject=0x4e0) returned 1
	[0167.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220
	[0167.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0167.683] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.683] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0167.684] GetLastError () returned 0x0
	[0167.684] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x35f0, lpOverlapped=0x0) returned 1
	[0167.686] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x3600, lpOverlapped=0x0) returned 1
	[0167.688] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.688] WriteFile (in: hFile=0x520, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.688] SetEndOfFile (hFile=0x520) returned 1
	[0167.688] CloseHandle (hObject=0x520) returned 1
	[0167.688] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.688] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.674] CloseHandle (hObject=0x4e0) returned 1
	[0168.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1
	[0168.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.689] lstrlenW (lpString=".doc") returned 4
	[0168.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.689] lstrlenW (lpString=".docx") returned 5
	[0168.689] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.689] lstrlenW (lpString=".pdf") returned 4
	[0168.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.689] lstrlenW (lpString=".xls") returned 4
	[0168.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.689] lstrlenW (lpString=".xlsx") returned 5
	[0168.689] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.689] lstrlenW (lpString=".ppt") returned 4
	[0168.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.689] lstrlenW (lpString=".zip") returned 4
	[0168.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.689] lstrlenW (lpString=".rar") returned 4
	[0168.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.690] lstrlenW (lpString=".bz2") returned 4
	[0168.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.690] lstrlenW (lpString=".7z") returned 3
	[0168.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.690] lstrlenW (lpString=".dbf") returned 4
	[0168.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.690] lstrlenW (lpString=".1cd") returned 4
	[0168.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.690] lstrlenW (lpString=".jpg") returned 4
	[0168.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.690] lstrlenW (lpString=".doc") returned 4
	[0168.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.690] lstrlenW (lpString=".docx") returned 5
	[0168.690] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.690] lstrlenW (lpString=".pdf") returned 4
	[0168.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.690] lstrlenW (lpString=".xls") returned 4
	[0168.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.690] lstrlenW (lpString=".xlsx") returned 5
	[0168.690] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.690] lstrlenW (lpString=".ppt") returned 4
	[0168.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.691] lstrlenW (lpString=".zip") returned 4
	[0168.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.691] lstrlenW (lpString=".rar") returned 4
	[0168.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.691] lstrlenW (lpString=".bz2") returned 4
	[0168.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.691] lstrlenW (lpString=".7z") returned 3
	[0168.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.691] lstrlenW (lpString=".dbf") returned 4
	[0168.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.691] lstrlenW (lpString=".1cd") returned 4
	[0168.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.691] lstrlenW (lpString=".jpg") returned 4
	[0168.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.691] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.692] lstrlenW (lpString="J0106208.WMF") returned 12
	[0168.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0168.693] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=11900) returned 1
	[0168.693] CloseHandle (hObject=0x53c) returned 1
	[0168.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220
	[0168.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0168.693] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.693] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.696] GetLastError () returned 0x0
	[0168.696] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x2e7c, lpOverlapped=0x0) returned 1
	[0168.714] WriteFile (in: hFile=0x4e0, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x2e80, lpOverlapped=0x0) returned 1
	[0168.716] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.716] WriteFile (in: hFile=0x4e0, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.716] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.716] CloseHandle (hObject=0x4e0) returned 1
	[0168.716] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.716] SetEndOfFile (hFile=0x53c) returned 1
	[0168.719] CloseHandle (hObject=0x53c) returned 1
	[0168.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1
	[0168.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.720] lstrlenW (lpString=".doc") returned 4
	[0168.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.720] lstrlenW (lpString=".docx") returned 5
	[0168.720] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0168.720] lstrlenW (lpString=".pdf") returned 4
	[0168.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.720] lstrlenW (lpString=".xls") returned 4
	[0168.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.721] lstrlenW (lpString=".xlsx") returned 5
	[0168.721] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0168.721] lstrlenW (lpString=".ppt") returned 4
	[0168.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.721] lstrlenW (lpString=".zip") returned 4
	[0168.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.721] lstrlenW (lpString=".rar") returned 4
	[0168.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.721] lstrlenW (lpString=".bz2") returned 4
	[0168.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.721] lstrlenW (lpString=".7z") returned 3
	[0168.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.721] lstrlenW (lpString=".dbf") returned 4
	[0168.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.721] lstrlenW (lpString=".1cd") returned 4
	[0168.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.721] lstrlenW (lpString=".jpg") returned 4
	[0168.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.721] lstrlenW (lpString=".doc") returned 4
	[0168.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.722] lstrlenW (lpString=".docx") returned 5
	[0168.722] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0168.722] lstrlenW (lpString=".pdf") returned 4
	[0168.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.722] lstrlenW (lpString=".xls") returned 4
	[0168.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.722] lstrlenW (lpString=".xlsx") returned 5
	[0168.722] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0168.722] lstrlenW (lpString=".ppt") returned 4
	[0168.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.722] lstrlenW (lpString=".zip") returned 4
	[0168.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.722] lstrlenW (lpString=".rar") returned 4
	[0168.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.722] lstrlenW (lpString=".bz2") returned 4
	[0168.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.722] lstrlenW (lpString=".7z") returned 3
	[0168.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.722] lstrlenW (lpString=".dbf") returned 4
	[0168.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.722] lstrlenW (lpString=".1cd") returned 4
	[0168.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.723] lstrlenW (lpString=".jpg") returned 4
	[0168.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.723] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.723] lstrlenW (lpString="J0106816.WMF") returned 12
	[0168.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0168.735] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=3332) returned 1
	[0168.735] CloseHandle (hObject=0x55c) returned 1
	[0168.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220
	[0168.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0168.743] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.743] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.744] GetLastError () returned 0x0
	[0168.744] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xd04, lpOverlapped=0x0) returned 1
	[0168.755] WriteFile (in: hFile=0x4e0, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xd10, lpOverlapped=0x0) returned 1
	[0168.756] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.756] WriteFile (in: hFile=0x4e0, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.756] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.756] CloseHandle (hObject=0x4e0) returned 1
	[0168.756] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.756] SetEndOfFile (hFile=0x53c) returned 1
	[0168.759] CloseHandle (hObject=0x53c) returned 1
	[0168.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 1
	[0168.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.760] lstrlenW (lpString=".doc") returned 4
	[0168.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.760] lstrlenW (lpString=".docx") returned 5
	[0168.760] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0168.760] lstrlenW (lpString=".pdf") returned 4
	[0168.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.760] lstrlenW (lpString=".xls") returned 4
	[0168.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.760] lstrlenW (lpString=".xlsx") returned 5
	[0168.760] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0168.760] lstrlenW (lpString=".ppt") returned 4
	[0168.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.761] lstrlenW (lpString=".zip") returned 4
	[0168.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.761] lstrlenW (lpString=".rar") returned 4
	[0168.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.761] lstrlenW (lpString=".bz2") returned 4
	[0168.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.761] lstrlenW (lpString=".7z") returned 3
	[0168.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.761] lstrlenW (lpString=".dbf") returned 4
	[0168.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.761] lstrlenW (lpString=".1cd") returned 4
	[0168.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.761] lstrlenW (lpString=".jpg") returned 4
	[0168.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.761] lstrlenW (lpString=".doc") returned 4
	[0168.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.761] lstrlenW (lpString=".docx") returned 5
	[0168.761] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0168.761] lstrlenW (lpString=".pdf") returned 4
	[0168.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.762] lstrlenW (lpString=".xls") returned 4
	[0168.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.762] lstrlenW (lpString=".xlsx") returned 5
	[0168.762] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0168.762] lstrlenW (lpString=".ppt") returned 4
	[0168.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.762] lstrlenW (lpString=".zip") returned 4
	[0168.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.762] lstrlenW (lpString=".rar") returned 4
	[0168.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.762] lstrlenW (lpString=".bz2") returned 4
	[0168.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.762] lstrlenW (lpString=".7z") returned 3
	[0168.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.762] lstrlenW (lpString=".dbf") returned 4
	[0168.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.762] lstrlenW (lpString=".1cd") returned 4
	[0168.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.762] lstrlenW (lpString=".jpg") returned 4
	[0168.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.763] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0168.763] lstrlenW (lpString="J0107026.WMF") returned 12
	[0168.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0168.764] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=7632) returned 1
	[0168.764] CloseHandle (hObject=0x53c) returned 1
	[0168.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220
	[0168.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0168.765] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.765] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.766] GetLastError () returned 0x0
	[0168.766] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1dd0, lpOverlapped=0x0) returned 1
	[0168.768] WriteFile (in: hFile=0x4e0, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1de0, lpOverlapped=0x0) returned 1
	[0168.769] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.769] WriteFile (in: hFile=0x4e0, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.769] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.769] CloseHandle (hObject=0x4e0) returned 1
	[0168.769] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.769] SetEndOfFile (hFile=0x53c) returned 1
	[0169.096] CloseHandle (hObject=0x53c) returned 1
	[0169.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1
	[0169.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.097] lstrlenW (lpString=".doc") returned 4
	[0169.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.097] lstrlenW (lpString=".docx") returned 5
	[0169.097] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0169.097] lstrlenW (lpString=".pdf") returned 4
	[0169.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.097] lstrlenW (lpString=".xls") returned 4
	[0169.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.097] lstrlenW (lpString=".xlsx") returned 5
	[0169.097] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0169.097] lstrlenW (lpString=".ppt") returned 4
	[0169.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.097] lstrlenW (lpString=".zip") returned 4
	[0169.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.097] lstrlenW (lpString=".rar") returned 4
	[0169.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.097] lstrlenW (lpString=".bz2") returned 4
	[0169.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.097] lstrlenW (lpString=".7z") returned 3
	[0169.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.098] lstrlenW (lpString=".dbf") returned 4
	[0169.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.098] lstrlenW (lpString=".1cd") returned 4
	[0169.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.098] lstrlenW (lpString=".jpg") returned 4
	[0169.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.098] lstrlenW (lpString=".doc") returned 4
	[0169.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.098] lstrlenW (lpString=".docx") returned 5
	[0169.098] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0169.098] lstrlenW (lpString=".pdf") returned 4
	[0169.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.098] lstrlenW (lpString=".xls") returned 4
	[0169.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.098] lstrlenW (lpString=".xlsx") returned 5
	[0169.098] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0169.098] lstrlenW (lpString=".ppt") returned 4
	[0169.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.098] lstrlenW (lpString=".zip") returned 4
	[0169.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.098] lstrlenW (lpString=".rar") returned 4
	[0169.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.099] lstrlenW (lpString=".bz2") returned 4
	[0169.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.099] lstrlenW (lpString=".7z") returned 3
	[0169.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.099] lstrlenW (lpString=".dbf") returned 4
	[0169.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.099] lstrlenW (lpString=".1cd") returned 4
	[0169.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0169.099] lstrlenW (lpString=".jpg") returned 4
	[0169.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.099] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.099] lstrlenW (lpString="J0107138.WMF") returned 12
	[0169.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.306] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=17200) returned 1
	[0169.306] CloseHandle (hObject=0x4e0) returned 1
	[0169.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220
	[0169.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.307] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.307] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.308] GetLastError () returned 0x0
	[0169.308] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x4330, lpOverlapped=0x0) returned 1
	[0169.310] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x4340, lpOverlapped=0x0) returned 1
	[0169.314] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.314] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.314] SetEndOfFile (hFile=0x534) returned 1
	[0169.314] CloseHandle (hObject=0x534) returned 1
	[0169.314] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.314] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.317] CloseHandle (hObject=0x4e0) returned 1
	[0169.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 1
	[0169.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.318] lstrlenW (lpString=".doc") returned 4
	[0169.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.318] lstrlenW (lpString=".docx") returned 5
	[0169.318] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.318] lstrlenW (lpString=".pdf") returned 4
	[0169.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.318] lstrlenW (lpString=".xls") returned 4
	[0169.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.318] lstrlenW (lpString=".xlsx") returned 5
	[0169.318] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.318] lstrlenW (lpString=".ppt") returned 4
	[0169.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.319] lstrlenW (lpString=".zip") returned 4
	[0169.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.319] lstrlenW (lpString=".rar") returned 4
	[0169.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.319] lstrlenW (lpString=".bz2") returned 4
	[0169.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.319] lstrlenW (lpString=".7z") returned 3
	[0169.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.319] lstrlenW (lpString=".dbf") returned 4
	[0169.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.319] lstrlenW (lpString=".1cd") returned 4
	[0169.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.319] lstrlenW (lpString=".jpg") returned 4
	[0169.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.319] lstrlenW (lpString=".doc") returned 4
	[0169.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.319] lstrlenW (lpString=".docx") returned 5
	[0169.319] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.319] lstrlenW (lpString=".pdf") returned 4
	[0169.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.319] lstrlenW (lpString=".xls") returned 4
	[0169.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.319] lstrlenW (lpString=".xlsx") returned 5
	[0169.319] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.320] lstrlenW (lpString=".ppt") returned 4
	[0169.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.320] lstrlenW (lpString=".zip") returned 4
	[0169.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.320] lstrlenW (lpString=".rar") returned 4
	[0169.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.320] lstrlenW (lpString=".bz2") returned 4
	[0169.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.320] lstrlenW (lpString=".7z") returned 3
	[0169.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.320] lstrlenW (lpString=".dbf") returned 4
	[0169.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.320] lstrlenW (lpString=".1cd") returned 4
	[0169.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.320] lstrlenW (lpString=".jpg") returned 4
	[0169.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.320] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.320] lstrlenW (lpString="J0107150.WMF") returned 12
	[0169.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.321] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=13456) returned 1
	[0169.321] CloseHandle (hObject=0x4e0) returned 1
	[0169.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220
	[0169.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.322] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.322] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.331] GetLastError () returned 0x0
	[0169.331] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x3490, lpOverlapped=0x0) returned 1
	[0169.333] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x34a0, lpOverlapped=0x0) returned 1
	[0169.334] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.334] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.334] SetEndOfFile (hFile=0x534) returned 1
	[0169.335] CloseHandle (hObject=0x534) returned 1
	[0169.335] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.335] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.338] CloseHandle (hObject=0x4e0) returned 1
	[0169.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 1
	[0169.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.339] lstrlenW (lpString=".doc") returned 4
	[0169.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.339] lstrlenW (lpString=".docx") returned 5
	[0169.339] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0169.339] lstrlenW (lpString=".pdf") returned 4
	[0169.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.339] lstrlenW (lpString=".xls") returned 4
	[0169.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.339] lstrlenW (lpString=".xlsx") returned 5
	[0169.339] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0169.340] lstrlenW (lpString=".ppt") returned 4
	[0169.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.340] lstrlenW (lpString=".zip") returned 4
	[0169.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.340] lstrlenW (lpString=".rar") returned 4
	[0169.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.340] lstrlenW (lpString=".bz2") returned 4
	[0169.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.340] lstrlenW (lpString=".7z") returned 3
	[0169.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.340] lstrlenW (lpString=".dbf") returned 4
	[0169.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.340] lstrlenW (lpString=".1cd") returned 4
	[0169.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.340] lstrlenW (lpString=".jpg") returned 4
	[0169.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.340] lstrlenW (lpString=".doc") returned 4
	[0169.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.340] lstrlenW (lpString=".docx") returned 5
	[0169.340] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0169.341] lstrlenW (lpString=".pdf") returned 4
	[0169.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.341] lstrlenW (lpString=".xls") returned 4
	[0169.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.341] lstrlenW (lpString=".xlsx") returned 5
	[0169.341] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0169.341] lstrlenW (lpString=".ppt") returned 4
	[0169.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.341] lstrlenW (lpString=".zip") returned 4
	[0169.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.341] lstrlenW (lpString=".rar") returned 4
	[0169.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.341] lstrlenW (lpString=".bz2") returned 4
	[0169.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.341] lstrlenW (lpString=".7z") returned 3
	[0169.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.341] lstrlenW (lpString=".dbf") returned 4
	[0169.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.341] lstrlenW (lpString=".1cd") returned 4
	[0169.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.341] lstrlenW (lpString=".jpg") returned 4
	[0169.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.342] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.342] lstrlenW (lpString="J0107152.WMF") returned 12
	[0169.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.343] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=22532) returned 1
	[0169.343] CloseHandle (hObject=0x4e0) returned 1
	[0169.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220
	[0169.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.343] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.343] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.569] GetLastError () returned 0x0
	[0169.569] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x5804, lpOverlapped=0x0) returned 1
	[0169.571] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x5810, lpOverlapped=0x0) returned 1
	[0169.573] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.573] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.573] SetEndOfFile (hFile=0x534) returned 1
	[0169.573] CloseHandle (hObject=0x534) returned 1
	[0169.573] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.573] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.578] CloseHandle (hObject=0x4e0) returned 1
	[0169.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 1
	[0169.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.584] lstrlenW (lpString=".doc") returned 4
	[0169.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.584] lstrlenW (lpString=".docx") returned 5
	[0169.584] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0169.584] lstrlenW (lpString=".pdf") returned 4
	[0169.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.584] lstrlenW (lpString=".xls") returned 4
	[0169.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.584] lstrlenW (lpString=".xlsx") returned 5
	[0169.584] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0169.584] lstrlenW (lpString=".ppt") returned 4
	[0169.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.584] lstrlenW (lpString=".zip") returned 4
	[0169.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.584] lstrlenW (lpString=".rar") returned 4
	[0169.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.584] lstrlenW (lpString=".bz2") returned 4
	[0169.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.584] lstrlenW (lpString=".7z") returned 3
	[0169.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.584] lstrlenW (lpString=".dbf") returned 4
	[0169.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.585] lstrlenW (lpString=".1cd") returned 4
	[0169.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.585] lstrlenW (lpString=".jpg") returned 4
	[0169.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.585] lstrlenW (lpString=".doc") returned 4
	[0169.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.585] lstrlenW (lpString=".docx") returned 5
	[0169.585] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0169.585] lstrlenW (lpString=".pdf") returned 4
	[0169.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.585] lstrlenW (lpString=".xls") returned 4
	[0169.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.585] lstrlenW (lpString=".xlsx") returned 5
	[0169.585] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0169.585] lstrlenW (lpString=".ppt") returned 4
	[0169.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.585] lstrlenW (lpString=".zip") returned 4
	[0169.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.586] lstrlenW (lpString=".rar") returned 4
	[0169.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.586] lstrlenW (lpString=".bz2") returned 4
	[0169.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.586] lstrlenW (lpString=".7z") returned 3
	[0169.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.586] lstrlenW (lpString=".dbf") returned 4
	[0169.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.586] lstrlenW (lpString=".1cd") returned 4
	[0169.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0169.586] lstrlenW (lpString=".jpg") returned 4
	[0169.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.586] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.586] lstrlenW (lpString="J0107182.WMF") returned 12
	[0169.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.587] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=16100) returned 1
	[0169.587] CloseHandle (hObject=0x4e0) returned 1
	[0169.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0x220
	[0169.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.588] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.588] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.589] GetLastError () returned 0x0
	[0169.589] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x3ee4, lpOverlapped=0x0) returned 1
	[0169.591] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x3ef0, lpOverlapped=0x0) returned 1
	[0169.592] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.592] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.592] SetEndOfFile (hFile=0x534) returned 1
	[0169.592] CloseHandle (hObject=0x534) returned 1
	[0169.593] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.593] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.595] CloseHandle (hObject=0x4e0) returned 1
	[0169.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 1
	[0169.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.597] lstrlenW (lpString=".doc") returned 4
	[0169.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.597] lstrlenW (lpString=".docx") returned 5
	[0169.597] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0169.597] lstrlenW (lpString=".pdf") returned 4
	[0169.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.597] lstrlenW (lpString=".xls") returned 4
	[0169.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.597] lstrlenW (lpString=".xlsx") returned 5
	[0169.597] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0169.597] lstrlenW (lpString=".ppt") returned 4
	[0169.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.597] lstrlenW (lpString=".zip") returned 4
	[0169.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.597] lstrlenW (lpString=".rar") returned 4
	[0169.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.597] lstrlenW (lpString=".bz2") returned 4
	[0169.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.597] lstrlenW (lpString=".7z") returned 3
	[0169.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.598] lstrlenW (lpString=".dbf") returned 4
	[0169.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.598] lstrlenW (lpString=".1cd") returned 4
	[0169.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.598] lstrlenW (lpString=".jpg") returned 4
	[0169.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.598] lstrlenW (lpString=".doc") returned 4
	[0169.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.598] lstrlenW (lpString=".docx") returned 5
	[0169.598] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0169.598] lstrlenW (lpString=".pdf") returned 4
	[0169.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.598] lstrlenW (lpString=".xls") returned 4
	[0169.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.598] lstrlenW (lpString=".xlsx") returned 5
	[0169.598] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0169.598] lstrlenW (lpString=".ppt") returned 4
	[0169.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.598] lstrlenW (lpString=".zip") returned 4
	[0169.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.598] lstrlenW (lpString=".rar") returned 4
	[0169.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.599] lstrlenW (lpString=".bz2") returned 4
	[0169.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.599] lstrlenW (lpString=".7z") returned 3
	[0169.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.599] lstrlenW (lpString=".dbf") returned 4
	[0169.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.599] lstrlenW (lpString=".1cd") returned 4
	[0169.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0169.599] lstrlenW (lpString=".jpg") returned 4
	[0169.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.599] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.599] lstrlenW (lpString="J0107188.WMF") returned 12
	[0169.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.600] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=4536) returned 1
	[0169.600] CloseHandle (hObject=0x4e0) returned 1
	[0169.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220
	[0169.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.601] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.601] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.602] GetLastError () returned 0x0
	[0169.602] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x11b8, lpOverlapped=0x0) returned 1
	[0169.603] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x11c0, lpOverlapped=0x0) returned 1
	[0169.604] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.604] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.605] SetEndOfFile (hFile=0x534) returned 1
	[0169.605] CloseHandle (hObject=0x534) returned 1
	[0169.605] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.605] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.608] CloseHandle (hObject=0x4e0) returned 1
	[0169.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 1
	[0169.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.920] lstrlenW (lpString=".doc") returned 4
	[0169.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.920] lstrlenW (lpString=".docx") returned 5
	[0169.920] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.920] lstrlenW (lpString=".pdf") returned 4
	[0169.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.920] lstrlenW (lpString=".xls") returned 4
	[0169.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.921] lstrlenW (lpString=".xlsx") returned 5
	[0169.921] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.921] lstrlenW (lpString=".ppt") returned 4
	[0169.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.921] lstrlenW (lpString=".zip") returned 4
	[0169.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.921] lstrlenW (lpString=".rar") returned 4
	[0169.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.921] lstrlenW (lpString=".bz2") returned 4
	[0169.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.921] lstrlenW (lpString=".7z") returned 3
	[0169.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.921] lstrlenW (lpString=".dbf") returned 4
	[0169.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.921] lstrlenW (lpString=".1cd") returned 4
	[0169.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.921] lstrlenW (lpString=".jpg") returned 4
	[0169.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.921] lstrlenW (lpString=".doc") returned 4
	[0169.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.921] lstrlenW (lpString=".docx") returned 5
	[0169.922] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.922] lstrlenW (lpString=".pdf") returned 4
	[0169.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.922] lstrlenW (lpString=".xls") returned 4
	[0169.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.922] lstrlenW (lpString=".xlsx") returned 5
	[0169.922] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.922] lstrlenW (lpString=".ppt") returned 4
	[0169.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.922] lstrlenW (lpString=".zip") returned 4
	[0169.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.922] lstrlenW (lpString=".rar") returned 4
	[0169.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.922] lstrlenW (lpString=".bz2") returned 4
	[0169.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.922] lstrlenW (lpString=".7z") returned 3
	[0169.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.922] lstrlenW (lpString=".dbf") returned 4
	[0169.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.922] lstrlenW (lpString=".1cd") returned 4
	[0169.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0169.923] lstrlenW (lpString=".jpg") returned 4
	[0169.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.923] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.923] lstrlenW (lpString="J0107258.WMF") returned 12
	[0169.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.923] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=8552) returned 1
	[0169.924] CloseHandle (hObject=0x550) returned 1
	[0169.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0x220
	[0169.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.924] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.924] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0169.925] GetLastError () returned 0x0
	[0169.925] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x2168, lpOverlapped=0x0) returned 1
	[0169.927] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x2170, lpOverlapped=0x0) returned 1
	[0169.928] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.928] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.928] SetEndOfFile (hFile=0x4b8) returned 1
	[0169.928] CloseHandle (hObject=0x4b8) returned 1
	[0169.928] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.928] SetEndOfFile (hFile=0x550) returned 1
	[0169.931] CloseHandle (hObject=0x550) returned 1
	[0169.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 1
	[0169.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.933] lstrlenW (lpString=".doc") returned 4
	[0169.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.933] lstrlenW (lpString=".docx") returned 5
	[0169.933] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.933] lstrlenW (lpString=".pdf") returned 4
	[0169.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.933] lstrlenW (lpString=".xls") returned 4
	[0169.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.933] lstrlenW (lpString=".xlsx") returned 5
	[0169.933] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.933] lstrlenW (lpString=".ppt") returned 4
	[0169.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.933] lstrlenW (lpString=".zip") returned 4
	[0169.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.933] lstrlenW (lpString=".rar") returned 4
	[0169.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.933] lstrlenW (lpString=".bz2") returned 4
	[0169.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.933] lstrlenW (lpString=".7z") returned 3
	[0169.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.934] lstrlenW (lpString=".dbf") returned 4
	[0169.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.934] lstrlenW (lpString=".1cd") returned 4
	[0169.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.934] lstrlenW (lpString=".jpg") returned 4
	[0169.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.934] lstrlenW (lpString=".doc") returned 4
	[0169.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.934] lstrlenW (lpString=".docx") returned 5
	[0169.934] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.934] lstrlenW (lpString=".pdf") returned 4
	[0169.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.934] lstrlenW (lpString=".xls") returned 4
	[0169.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.934] lstrlenW (lpString=".xlsx") returned 5
	[0169.934] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.934] lstrlenW (lpString=".ppt") returned 4
	[0169.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.934] lstrlenW (lpString=".zip") returned 4
	[0169.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.935] lstrlenW (lpString=".rar") returned 4
	[0169.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.935] lstrlenW (lpString=".bz2") returned 4
	[0169.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.935] lstrlenW (lpString=".7z") returned 3
	[0169.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.935] lstrlenW (lpString=".dbf") returned 4
	[0169.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.935] lstrlenW (lpString=".1cd") returned 4
	[0169.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0169.935] lstrlenW (lpString=".jpg") returned 4
	[0169.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.935] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.935] lstrlenW (lpString="J0107262.WMF") returned 12
	[0169.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.936] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=7996) returned 1
	[0169.936] CloseHandle (hObject=0x550) returned 1
	[0169.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220
	[0169.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.937] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.937] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0169.937] GetLastError () returned 0x0
	[0169.938] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1f3c, lpOverlapped=0x0) returned 1
	[0169.939] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1f40, lpOverlapped=0x0) returned 1
	[0169.940] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.940] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.941] SetEndOfFile (hFile=0x4b8) returned 1
	[0169.941] CloseHandle (hObject=0x4b8) returned 1
	[0169.941] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.941] SetEndOfFile (hFile=0x550) returned 1
	[0169.944] CloseHandle (hObject=0x550) returned 1
	[0169.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 1
	[0169.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.946] lstrlenW (lpString=".doc") returned 4
	[0169.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.946] lstrlenW (lpString=".docx") returned 5
	[0169.946] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0169.946] lstrlenW (lpString=".pdf") returned 4
	[0169.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.946] lstrlenW (lpString=".xls") returned 4
	[0169.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.946] lstrlenW (lpString=".xlsx") returned 5
	[0169.946] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0169.946] lstrlenW (lpString=".ppt") returned 4
	[0169.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.946] lstrlenW (lpString=".zip") returned 4
	[0169.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.946] lstrlenW (lpString=".rar") returned 4
	[0169.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.946] lstrlenW (lpString=".bz2") returned 4
	[0169.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.946] lstrlenW (lpString=".7z") returned 3
	[0169.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.946] lstrlenW (lpString=".dbf") returned 4
	[0169.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.946] lstrlenW (lpString=".1cd") returned 4
	[0169.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.947] lstrlenW (lpString=".jpg") returned 4
	[0169.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.947] lstrlenW (lpString=".doc") returned 4
	[0169.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.947] lstrlenW (lpString=".docx") returned 5
	[0169.947] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0169.947] lstrlenW (lpString=".pdf") returned 4
	[0169.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.947] lstrlenW (lpString=".xls") returned 4
	[0169.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.947] lstrlenW (lpString=".xlsx") returned 5
	[0169.947] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0169.947] lstrlenW (lpString=".ppt") returned 4
	[0169.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.947] lstrlenW (lpString=".zip") returned 4
	[0169.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.947] lstrlenW (lpString=".rar") returned 4
	[0169.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.947] lstrlenW (lpString=".bz2") returned 4
	[0169.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.947] lstrlenW (lpString=".7z") returned 3
	[0169.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.948] lstrlenW (lpString=".dbf") returned 4
	[0169.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.948] lstrlenW (lpString=".1cd") returned 4
	[0169.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0169.948] lstrlenW (lpString=".jpg") returned 4
	[0169.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.948] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0169.948] lstrlenW (lpString="J0107264.WMF") returned 12
	[0169.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.949] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=5272) returned 1
	[0169.949] CloseHandle (hObject=0x550) returned 1
	[0169.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220
	[0169.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.950] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.950] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0169.951] GetLastError () returned 0x0
	[0169.951] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1498, lpOverlapped=0x0) returned 1
	[0169.952] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x14a0, lpOverlapped=0x0) returned 1
	[0169.954] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.954] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.954] SetEndOfFile (hFile=0x4b8) returned 1
	[0169.954] CloseHandle (hObject=0x4b8) returned 1
	[0169.954] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.954] SetEndOfFile (hFile=0x550) returned 1
	[0170.080] CloseHandle (hObject=0x550) returned 1
	[0170.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 1
	[0170.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.082] lstrlenW (lpString=".doc") returned 4
	[0170.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.082] lstrlenW (lpString=".docx") returned 5
	[0170.082] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.082] lstrlenW (lpString=".pdf") returned 4
	[0170.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.082] lstrlenW (lpString=".xls") returned 4
	[0170.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.082] lstrlenW (lpString=".xlsx") returned 5
	[0170.082] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.082] lstrlenW (lpString=".ppt") returned 4
	[0170.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.082] lstrlenW (lpString=".zip") returned 4
	[0170.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.082] lstrlenW (lpString=".rar") returned 4
	[0170.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.082] lstrlenW (lpString=".bz2") returned 4
	[0170.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.082] lstrlenW (lpString=".7z") returned 3
	[0170.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.082] lstrlenW (lpString=".dbf") returned 4
	[0170.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.083] lstrlenW (lpString=".1cd") returned 4
	[0170.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.083] lstrlenW (lpString=".jpg") returned 4
	[0170.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.083] lstrlenW (lpString=".doc") returned 4
	[0170.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.083] lstrlenW (lpString=".docx") returned 5
	[0170.083] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.083] lstrlenW (lpString=".pdf") returned 4
	[0170.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.083] lstrlenW (lpString=".xls") returned 4
	[0170.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.083] lstrlenW (lpString=".xlsx") returned 5
	[0170.083] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.083] lstrlenW (lpString=".ppt") returned 4
	[0170.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.083] lstrlenW (lpString=".zip") returned 4
	[0170.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.084] lstrlenW (lpString=".rar") returned 4
	[0170.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.084] lstrlenW (lpString=".bz2") returned 4
	[0170.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.084] lstrlenW (lpString=".7z") returned 3
	[0170.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.084] lstrlenW (lpString=".dbf") returned 4
	[0170.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.084] lstrlenW (lpString=".1cd") returned 4
	[0170.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.084] lstrlenW (lpString=".jpg") returned 4
	[0170.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.084] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.084] lstrlenW (lpString="J0107290.WMF") returned 12
	[0170.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.086] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=12308) returned 1
	[0170.086] CloseHandle (hObject=0x550) returned 1
	[0170.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0x220
	[0170.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.086] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.086] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0170.087] GetLastError () returned 0x0
	[0170.087] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x3014, lpOverlapped=0x0) returned 1
	[0170.089] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x3020, lpOverlapped=0x0) returned 1
	[0170.090] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.090] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.090] SetEndOfFile (hFile=0x534) returned 1
	[0170.090] CloseHandle (hObject=0x534) returned 1
	[0170.091] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.091] SetEndOfFile (hFile=0x550) returned 1
	[0170.096] CloseHandle (hObject=0x550) returned 1
	[0170.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 1
	[0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.097] lstrlenW (lpString=".doc") returned 4
	[0170.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.097] lstrlenW (lpString=".docx") returned 5
	[0170.097] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.097] lstrlenW (lpString=".pdf") returned 4
	[0170.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.097] lstrlenW (lpString=".xls") returned 4
	[0170.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.098] lstrlenW (lpString=".xlsx") returned 5
	[0170.098] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.098] lstrlenW (lpString=".ppt") returned 4
	[0170.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.098] lstrlenW (lpString=".zip") returned 4
	[0170.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.098] lstrlenW (lpString=".rar") returned 4
	[0170.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.098] lstrlenW (lpString=".bz2") returned 4
	[0170.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.098] lstrlenW (lpString=".7z") returned 3
	[0170.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.098] lstrlenW (lpString=".dbf") returned 4
	[0170.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.098] lstrlenW (lpString=".1cd") returned 4
	[0170.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.098] lstrlenW (lpString=".jpg") returned 4
	[0170.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.098] lstrlenW (lpString=".doc") returned 4
	[0170.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.099] lstrlenW (lpString=".docx") returned 5
	[0170.099] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.099] lstrlenW (lpString=".pdf") returned 4
	[0170.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.099] lstrlenW (lpString=".xls") returned 4
	[0170.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.099] lstrlenW (lpString=".xlsx") returned 5
	[0170.099] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.099] lstrlenW (lpString=".ppt") returned 4
	[0170.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.099] lstrlenW (lpString=".zip") returned 4
	[0170.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.099] lstrlenW (lpString=".rar") returned 4
	[0170.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.099] lstrlenW (lpString=".bz2") returned 4
	[0170.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.099] lstrlenW (lpString=".7z") returned 3
	[0170.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.099] lstrlenW (lpString=".dbf") returned 4
	[0170.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.099] lstrlenW (lpString=".1cd") returned 4
	[0170.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.100] lstrlenW (lpString=".jpg") returned 4
	[0170.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.100] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.100] lstrlenW (lpString="J0107300.WMF") returned 12
	[0170.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.100] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=2460) returned 1
	[0170.100] CloseHandle (hObject=0x550) returned 1
	[0170.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220
	[0170.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.101] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.101] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0170.102] GetLastError () returned 0x0
	[0170.102] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x99c, lpOverlapped=0x0) returned 1
	[0170.103] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x9a0, lpOverlapped=0x0) returned 1
	[0170.105] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.105] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.105] SetEndOfFile (hFile=0x534) returned 1
	[0170.105] CloseHandle (hObject=0x534) returned 1
	[0170.105] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.105] SetEndOfFile (hFile=0x550) returned 1
	[0170.108] CloseHandle (hObject=0x550) returned 1
	[0170.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 1
	[0170.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.109] lstrlenW (lpString=".doc") returned 4
	[0170.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.110] lstrlenW (lpString=".docx") returned 5
	[0170.110] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.110] lstrlenW (lpString=".pdf") returned 4
	[0170.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.110] lstrlenW (lpString=".xls") returned 4
	[0170.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.110] lstrlenW (lpString=".xlsx") returned 5
	[0170.110] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.110] lstrlenW (lpString=".ppt") returned 4
	[0170.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.110] lstrlenW (lpString=".zip") returned 4
	[0170.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.110] lstrlenW (lpString=".rar") returned 4
	[0170.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.110] lstrlenW (lpString=".bz2") returned 4
	[0170.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.110] lstrlenW (lpString=".7z") returned 3
	[0170.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.110] lstrlenW (lpString=".dbf") returned 4
	[0170.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.110] lstrlenW (lpString=".1cd") returned 4
	[0170.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.111] lstrlenW (lpString=".jpg") returned 4
	[0170.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.111] lstrlenW (lpString=".doc") returned 4
	[0170.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.111] lstrlenW (lpString=".docx") returned 5
	[0170.111] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.111] lstrlenW (lpString=".pdf") returned 4
	[0170.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.111] lstrlenW (lpString=".xls") returned 4
	[0170.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.111] lstrlenW (lpString=".xlsx") returned 5
	[0170.111] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.111] lstrlenW (lpString=".ppt") returned 4
	[0170.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.111] lstrlenW (lpString=".zip") returned 4
	[0170.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.111] lstrlenW (lpString=".rar") returned 4
	[0170.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.111] lstrlenW (lpString=".bz2") returned 4
	[0170.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.111] lstrlenW (lpString=".7z") returned 3
	[0170.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.111] lstrlenW (lpString=".dbf") returned 4
	[0170.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.112] lstrlenW (lpString=".1cd") returned 4
	[0170.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0170.112] lstrlenW (lpString=".jpg") returned 4
	[0170.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.112] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.112] lstrlenW (lpString="J0107302.WMF") returned 12
	[0170.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.113] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=4136) returned 1
	[0170.113] CloseHandle (hObject=0x550) returned 1
	[0170.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220
	[0170.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.113] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.113] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0170.114] GetLastError () returned 0x0
	[0170.114] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1028, lpOverlapped=0x0) returned 1
	[0170.337] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1030, lpOverlapped=0x0) returned 1
	[0170.338] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.338] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.338] SetEndOfFile (hFile=0x534) returned 1
	[0170.338] CloseHandle (hObject=0x534) returned 1
	[0170.338] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.339] SetEndOfFile (hFile=0x550) returned 1
	[0170.341] CloseHandle (hObject=0x550) returned 1
	[0170.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 1
	[0170.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.342] lstrlenW (lpString=".doc") returned 4
	[0170.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.342] lstrlenW (lpString=".docx") returned 5
	[0170.342] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.342] lstrlenW (lpString=".pdf") returned 4
	[0170.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.342] lstrlenW (lpString=".xls") returned 4
	[0170.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.342] lstrlenW (lpString=".xlsx") returned 5
	[0170.343] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.343] lstrlenW (lpString=".ppt") returned 4
	[0170.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.343] lstrlenW (lpString=".zip") returned 4
	[0170.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.343] lstrlenW (lpString=".rar") returned 4
	[0170.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.343] lstrlenW (lpString=".bz2") returned 4
	[0170.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.343] lstrlenW (lpString=".7z") returned 3
	[0170.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.343] lstrlenW (lpString=".dbf") returned 4
	[0170.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.343] lstrlenW (lpString=".1cd") returned 4
	[0170.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.343] lstrlenW (lpString=".jpg") returned 4
	[0170.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.343] lstrlenW (lpString=".doc") returned 4
	[0170.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.343] lstrlenW (lpString=".docx") returned 5
	[0170.343] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.343] lstrlenW (lpString=".pdf") returned 4
	[0170.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.344] lstrlenW (lpString=".xls") returned 4
	[0170.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.344] lstrlenW (lpString=".xlsx") returned 5
	[0170.344] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.344] lstrlenW (lpString=".ppt") returned 4
	[0170.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.344] lstrlenW (lpString=".zip") returned 4
	[0170.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.344] lstrlenW (lpString=".rar") returned 4
	[0170.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.344] lstrlenW (lpString=".bz2") returned 4
	[0170.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.344] lstrlenW (lpString=".7z") returned 3
	[0170.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.344] lstrlenW (lpString=".dbf") returned 4
	[0170.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.344] lstrlenW (lpString=".1cd") returned 4
	[0170.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0170.344] lstrlenW (lpString=".jpg") returned 4
	[0170.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.345] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.345] lstrlenW (lpString="J0107364.WMF") returned 12
	[0170.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.345] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=16588) returned 1
	[0170.345] CloseHandle (hObject=0x550) returned 1
	[0170.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0x220
	[0170.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.346] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.346] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0170.347] GetLastError () returned 0x0
	[0170.347] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x40cc, lpOverlapped=0x0) returned 1
	[0170.349] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x40d0, lpOverlapped=0x0) returned 1
	[0170.350] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.350] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.351] SetEndOfFile (hFile=0x534) returned 1
	[0170.351] CloseHandle (hObject=0x534) returned 1
	[0170.351] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.351] SetEndOfFile (hFile=0x550) returned 1
	[0170.356] CloseHandle (hObject=0x550) returned 1
	[0170.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 1
	[0170.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.357] lstrlenW (lpString=".doc") returned 4
	[0170.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.357] lstrlenW (lpString=".docx") returned 5
	[0170.357] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.357] lstrlenW (lpString=".pdf") returned 4
	[0170.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.357] lstrlenW (lpString=".xls") returned 4
	[0170.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.357] lstrlenW (lpString=".xlsx") returned 5
	[0170.357] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.357] lstrlenW (lpString=".ppt") returned 4
	[0170.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.358] lstrlenW (lpString=".zip") returned 4
	[0170.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.358] lstrlenW (lpString=".rar") returned 4
	[0170.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.358] lstrlenW (lpString=".bz2") returned 4
	[0170.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.358] lstrlenW (lpString=".7z") returned 3
	[0170.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.358] lstrlenW (lpString=".dbf") returned 4
	[0170.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.358] lstrlenW (lpString=".1cd") returned 4
	[0170.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.358] lstrlenW (lpString=".jpg") returned 4
	[0170.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.358] lstrlenW (lpString=".doc") returned 4
	[0170.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.358] lstrlenW (lpString=".docx") returned 5
	[0170.358] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.358] lstrlenW (lpString=".pdf") returned 4
	[0170.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.358] lstrlenW (lpString=".xls") returned 4
	[0170.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.358] lstrlenW (lpString=".xlsx") returned 5
	[0170.359] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.359] lstrlenW (lpString=".ppt") returned 4
	[0170.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.359] lstrlenW (lpString=".zip") returned 4
	[0170.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.359] lstrlenW (lpString=".rar") returned 4
	[0170.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.359] lstrlenW (lpString=".bz2") returned 4
	[0170.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.359] lstrlenW (lpString=".7z") returned 3
	[0170.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.359] lstrlenW (lpString=".dbf") returned 4
	[0170.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.359] lstrlenW (lpString=".1cd") returned 4
	[0170.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0170.359] lstrlenW (lpString=".jpg") returned 4
	[0170.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.359] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.359] lstrlenW (lpString="J0107426.WMF") returned 12
	[0170.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.361] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=11492) returned 1
	[0170.361] CloseHandle (hObject=0x550) returned 1
	[0170.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 0x220
	[0170.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.361] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.361] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0170.362] GetLastError () returned 0x0
	[0170.362] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x2ce4, lpOverlapped=0x0) returned 1
	[0170.364] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x2cf0, lpOverlapped=0x0) returned 1
	[0170.365] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.365] WriteFile (in: hFile=0x534, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.365] SetEndOfFile (hFile=0x534) returned 1
	[0170.365] CloseHandle (hObject=0x534) returned 1
	[0170.365] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.365] SetEndOfFile (hFile=0x550) returned 1
	[0170.368] CloseHandle (hObject=0x550) returned 1
	[0170.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 1
	[0170.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.369] lstrlenW (lpString=".doc") returned 4
	[0170.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.370] lstrlenW (lpString=".docx") returned 5
	[0170.370] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0170.370] lstrlenW (lpString=".pdf") returned 4
	[0170.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.370] lstrlenW (lpString=".xls") returned 4
	[0170.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.370] lstrlenW (lpString=".xlsx") returned 5
	[0170.370] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0170.370] lstrlenW (lpString=".ppt") returned 4
	[0170.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.370] lstrlenW (lpString=".zip") returned 4
	[0170.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.370] lstrlenW (lpString=".rar") returned 4
	[0170.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.370] lstrlenW (lpString=".bz2") returned 4
	[0170.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.370] lstrlenW (lpString=".7z") returned 3
	[0170.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.370] lstrlenW (lpString=".dbf") returned 4
	[0170.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.370] lstrlenW (lpString=".1cd") returned 4
	[0170.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.370] lstrlenW (lpString=".jpg") returned 4
	[0170.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.371] lstrlenW (lpString=".doc") returned 4
	[0170.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.371] lstrlenW (lpString=".docx") returned 5
	[0170.371] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0170.371] lstrlenW (lpString=".pdf") returned 4
	[0170.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.371] lstrlenW (lpString=".xls") returned 4
	[0170.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.371] lstrlenW (lpString=".xlsx") returned 5
	[0170.371] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0170.371] lstrlenW (lpString=".ppt") returned 4
	[0170.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.371] lstrlenW (lpString=".zip") returned 4
	[0170.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.371] lstrlenW (lpString=".rar") returned 4
	[0170.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.371] lstrlenW (lpString=".bz2") returned 4
	[0170.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.371] lstrlenW (lpString=".7z") returned 3
	[0170.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.371] lstrlenW (lpString=".dbf") returned 4
	[0170.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.790] lstrlenW (lpString=".1cd") returned 4
	[0170.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0170.790] lstrlenW (lpString=".jpg") returned 4
	[0170.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.790] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0170.790] lstrlenW (lpString="J0107488.WMF") returned 12
	[0170.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.764] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=8000) returned 1
	[0171.764] CloseHandle (hObject=0x53c) returned 1
	[0171.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 0x220
	[0171.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.764] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.765] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.765] GetLastError () returned 0x0
	[0171.765] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1f40, lpOverlapped=0x0) returned 1
	[0171.767] WriteFile (in: hFile=0x4e4, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1f50, lpOverlapped=0x0) returned 1
	[0171.768] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.768] WriteFile (in: hFile=0x4e4, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.768] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.768] CloseHandle (hObject=0x4e4) returned 1
	[0171.768] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.768] SetEndOfFile (hFile=0x53c) returned 1
	[0171.771] CloseHandle (hObject=0x53c) returned 1
	[0171.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 1
	[0171.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.777] lstrlenW (lpString=".doc") returned 4
	[0171.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.777] lstrlenW (lpString=".docx") returned 5
	[0171.777] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0171.777] lstrlenW (lpString=".pdf") returned 4
	[0171.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.777] lstrlenW (lpString=".xls") returned 4
	[0171.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.777] lstrlenW (lpString=".xlsx") returned 5
	[0171.777] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0171.777] lstrlenW (lpString=".ppt") returned 4
	[0171.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.777] lstrlenW (lpString=".zip") returned 4
	[0171.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.777] lstrlenW (lpString=".rar") returned 4
	[0171.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.777] lstrlenW (lpString=".bz2") returned 4
	[0171.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.777] lstrlenW (lpString=".7z") returned 3
	[0171.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.777] lstrlenW (lpString=".dbf") returned 4
	[0171.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.777] lstrlenW (lpString=".1cd") returned 4
	[0171.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.778] lstrlenW (lpString=".jpg") returned 4
	[0171.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.778] lstrlenW (lpString=".doc") returned 4
	[0171.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.778] lstrlenW (lpString=".docx") returned 5
	[0171.778] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0171.778] lstrlenW (lpString=".pdf") returned 4
	[0171.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.778] lstrlenW (lpString=".xls") returned 4
	[0171.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.778] lstrlenW (lpString=".xlsx") returned 5
	[0171.778] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0171.778] lstrlenW (lpString=".ppt") returned 4
	[0171.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.778] lstrlenW (lpString=".zip") returned 4
	[0171.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.778] lstrlenW (lpString=".rar") returned 4
	[0171.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.778] lstrlenW (lpString=".bz2") returned 4
	[0171.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.778] lstrlenW (lpString=".7z") returned 3
	[0171.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.779] lstrlenW (lpString=".dbf") returned 4
	[0171.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.779] lstrlenW (lpString=".1cd") returned 4
	[0171.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0171.779] lstrlenW (lpString=".jpg") returned 4
	[0171.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.779] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.779] lstrlenW (lpString="J0107528.WMF") returned 12
	[0171.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.780] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=6792) returned 1
	[0171.780] CloseHandle (hObject=0x53c) returned 1
	[0171.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0x220
	[0171.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.780] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.780] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.781] GetLastError () returned 0x0
	[0171.781] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1a88, lpOverlapped=0x0) returned 1
	[0171.783] WriteFile (in: hFile=0x4e4, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1a90, lpOverlapped=0x0) returned 1
	[0171.784] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.784] WriteFile (in: hFile=0x4e4, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.784] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.784] CloseHandle (hObject=0x4e4) returned 1
	[0171.784] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.784] SetEndOfFile (hFile=0x53c) returned 1
	[0171.787] CloseHandle (hObject=0x53c) returned 1
	[0171.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 1
	[0171.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.789] lstrlenW (lpString=".doc") returned 4
	[0171.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.789] lstrlenW (lpString=".docx") returned 5
	[0171.789] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0171.789] lstrlenW (lpString=".pdf") returned 4
	[0171.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.789] lstrlenW (lpString=".xls") returned 4
	[0171.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.789] lstrlenW (lpString=".xlsx") returned 5
	[0171.789] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0171.789] lstrlenW (lpString=".ppt") returned 4
	[0171.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.789] lstrlenW (lpString=".zip") returned 4
	[0171.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.789] lstrlenW (lpString=".rar") returned 4
	[0171.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.789] lstrlenW (lpString=".bz2") returned 4
	[0171.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.789] lstrlenW (lpString=".7z") returned 3
	[0171.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.790] lstrlenW (lpString=".dbf") returned 4
	[0171.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.790] lstrlenW (lpString=".1cd") returned 4
	[0171.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.790] lstrlenW (lpString=".jpg") returned 4
	[0171.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.790] lstrlenW (lpString=".doc") returned 4
	[0171.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.790] lstrlenW (lpString=".docx") returned 5
	[0171.790] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0171.790] lstrlenW (lpString=".pdf") returned 4
	[0171.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.790] lstrlenW (lpString=".xls") returned 4
	[0171.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.790] lstrlenW (lpString=".xlsx") returned 5
	[0171.790] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0171.790] lstrlenW (lpString=".ppt") returned 4
	[0171.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.790] lstrlenW (lpString=".zip") returned 4
	[0171.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.791] lstrlenW (lpString=".rar") returned 4
	[0171.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.791] lstrlenW (lpString=".bz2") returned 4
	[0171.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.791] lstrlenW (lpString=".7z") returned 3
	[0171.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.791] lstrlenW (lpString=".dbf") returned 4
	[0171.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.791] lstrlenW (lpString=".1cd") returned 4
	[0171.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0171.791] lstrlenW (lpString=".jpg") returned 4
	[0171.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.791] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0171.791] lstrlenW (lpString="J0107544.WMF") returned 12
	[0171.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.792] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=26768) returned 1
	[0171.792] CloseHandle (hObject=0x53c) returned 1
	[0171.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0x220
	[0171.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.793] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.793] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.794] GetLastError () returned 0x0
	[0171.794] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x6890, lpOverlapped=0x0) returned 1
	[0171.797] WriteFile (in: hFile=0x4e4, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x68a0, lpOverlapped=0x0) returned 1
	[0171.798] ReadFile (in: hFile=0x53c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.798] WriteFile (in: hFile=0x4e4, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.798] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.799] CloseHandle (hObject=0x4e4) returned 1
	[0171.799] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.799] SetEndOfFile (hFile=0x53c) returned 1
	[0172.033] CloseHandle (hObject=0x53c) returned 1
	[0172.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0172.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 1
	[0172.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.160] lstrlenW (lpString=".doc") returned 4
	[0172.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.161] lstrlenW (lpString=".docx") returned 5
	[0172.161] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0172.161] lstrlenW (lpString=".pdf") returned 4
	[0172.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.161] lstrlenW (lpString=".xls") returned 4
	[0172.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.161] lstrlenW (lpString=".xlsx") returned 5
	[0172.161] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0172.161] lstrlenW (lpString=".ppt") returned 4
	[0172.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.161] lstrlenW (lpString=".zip") returned 4
	[0172.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.161] lstrlenW (lpString=".rar") returned 4
	[0172.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.161] lstrlenW (lpString=".bz2") returned 4
	[0172.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.162] lstrlenW (lpString=".7z") returned 3
	[0172.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.162] lstrlenW (lpString=".dbf") returned 4
	[0172.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.162] lstrlenW (lpString=".1cd") returned 4
	[0172.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.162] lstrlenW (lpString=".jpg") returned 4
	[0172.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.162] lstrlenW (lpString=".doc") returned 4
	[0172.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.162] lstrlenW (lpString=".docx") returned 5
	[0172.162] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0172.162] lstrlenW (lpString=".pdf") returned 4
	[0172.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.162] lstrlenW (lpString=".xls") returned 4
	[0172.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.162] lstrlenW (lpString=".xlsx") returned 5
	[0172.162] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0172.162] lstrlenW (lpString=".ppt") returned 4
	[0172.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.163] lstrlenW (lpString=".zip") returned 4
	[0172.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.163] lstrlenW (lpString=".rar") returned 4
	[0172.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.163] lstrlenW (lpString=".bz2") returned 4
	[0172.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.163] lstrlenW (lpString=".7z") returned 3
	[0172.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.163] lstrlenW (lpString=".dbf") returned 4
	[0172.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.163] lstrlenW (lpString=".1cd") returned 4
	[0172.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0172.163] lstrlenW (lpString=".jpg") returned 4
	[0172.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.163] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0172.164] lstrlenW (lpString="J0107708.WMF") returned 12
	[0172.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0172.165] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=4808) returned 1
	[0172.165] CloseHandle (hObject=0x370) returned 1
	[0172.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 0x220
	[0172.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0172.166] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.166] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0172.167] GetLastError () returned 0x0
	[0172.167] ReadFile (in: hFile=0x370, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x12c8, lpOverlapped=0x0) returned 1
	[0172.169] WriteFile (in: hFile=0x55c, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x12d0, lpOverlapped=0x0) returned 1
	[0172.170] ReadFile (in: hFile=0x370, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.170] WriteFile (in: hFile=0x55c, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.170] SetEndOfFile (hFile=0x55c) returned 1
	[0172.171] CloseHandle (hObject=0x55c) returned 1
	[0172.171] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.171] SetEndOfFile (hFile=0x370) returned 1
	[0172.174] CloseHandle (hObject=0x370) returned 1
	[0172.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0172.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 1
	[0172.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.176] lstrlenW (lpString=".doc") returned 4
	[0172.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.176] lstrlenW (lpString=".docx") returned 5
	[0172.176] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0172.176] lstrlenW (lpString=".pdf") returned 4
	[0172.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.176] lstrlenW (lpString=".xls") returned 4
	[0172.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.176] lstrlenW (lpString=".xlsx") returned 5
	[0172.176] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0172.176] lstrlenW (lpString=".ppt") returned 4
	[0172.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.176] lstrlenW (lpString=".zip") returned 4
	[0172.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.176] lstrlenW (lpString=".rar") returned 4
	[0172.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.176] lstrlenW (lpString=".bz2") returned 4
	[0172.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.176] lstrlenW (lpString=".7z") returned 3
	[0172.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.176] lstrlenW (lpString=".dbf") returned 4
	[0172.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.177] lstrlenW (lpString=".1cd") returned 4
	[0172.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.177] lstrlenW (lpString=".jpg") returned 4
	[0172.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.177] lstrlenW (lpString=".doc") returned 4
	[0172.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.177] lstrlenW (lpString=".docx") returned 5
	[0172.177] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0172.177] lstrlenW (lpString=".pdf") returned 4
	[0172.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.177] lstrlenW (lpString=".xls") returned 4
	[0172.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.177] lstrlenW (lpString=".xlsx") returned 5
	[0172.177] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0172.177] lstrlenW (lpString=".ppt") returned 4
	[0172.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.178] lstrlenW (lpString=".zip") returned 4
	[0172.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.178] lstrlenW (lpString=".rar") returned 4
	[0172.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.178] lstrlenW (lpString=".bz2") returned 4
	[0172.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.178] lstrlenW (lpString=".7z") returned 3
	[0172.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.178] lstrlenW (lpString=".dbf") returned 4
	[0172.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.178] lstrlenW (lpString=".1cd") returned 4
	[0172.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0172.178] lstrlenW (lpString=".jpg") returned 4
	[0172.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.178] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0172.178] lstrlenW (lpString="J0107712.WMF") returned 12
	[0172.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0172.179] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=4636) returned 1
	[0172.179] CloseHandle (hObject=0x370) returned 1
	[0172.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0x220
	[0172.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0172.180] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.180] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0172.182] GetLastError () returned 0x0
	[0172.182] ReadFile (in: hFile=0x370, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x121c, lpOverlapped=0x0) returned 1
	[0172.183] WriteFile (in: hFile=0x55c, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1220, lpOverlapped=0x0) returned 1
	[0172.184] ReadFile (in: hFile=0x370, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.185] WriteFile (in: hFile=0x55c, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.185] SetEndOfFile (hFile=0x55c) returned 1
	[0172.185] CloseHandle (hObject=0x55c) returned 1
	[0172.185] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.185] SetEndOfFile (hFile=0x370) returned 1
	[0172.188] CloseHandle (hObject=0x370) returned 1
	[0172.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0172.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 1
	[0172.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.189] lstrlenW (lpString=".doc") returned 4
	[0172.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.189] lstrlenW (lpString=".docx") returned 5
	[0172.189] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0172.189] lstrlenW (lpString=".pdf") returned 4
	[0172.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.189] lstrlenW (lpString=".xls") returned 4
	[0172.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.189] lstrlenW (lpString=".xlsx") returned 5
	[0172.189] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0172.189] lstrlenW (lpString=".ppt") returned 4
	[0172.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.190] lstrlenW (lpString=".zip") returned 4
	[0172.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.190] lstrlenW (lpString=".rar") returned 4
	[0172.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.190] lstrlenW (lpString=".bz2") returned 4
	[0172.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.190] lstrlenW (lpString=".7z") returned 3
	[0172.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.190] lstrlenW (lpString=".dbf") returned 4
	[0172.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.190] lstrlenW (lpString=".1cd") returned 4
	[0172.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.190] lstrlenW (lpString=".jpg") returned 4
	[0172.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.191] lstrlenW (lpString=".doc") returned 4
	[0172.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.191] lstrlenW (lpString=".docx") returned 5
	[0172.191] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0172.191] lstrlenW (lpString=".pdf") returned 4
	[0172.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.191] lstrlenW (lpString=".xls") returned 4
	[0172.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.191] lstrlenW (lpString=".xlsx") returned 5
	[0172.191] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0172.191] lstrlenW (lpString=".ppt") returned 4
	[0172.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.192] lstrlenW (lpString=".zip") returned 4
	[0172.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.192] lstrlenW (lpString=".rar") returned 4
	[0172.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.192] lstrlenW (lpString=".bz2") returned 4
	[0172.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.192] lstrlenW (lpString=".7z") returned 3
	[0172.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.192] lstrlenW (lpString=".dbf") returned 4
	[0172.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.192] lstrlenW (lpString=".1cd") returned 4
	[0172.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0172.192] lstrlenW (lpString=".jpg") returned 4
	[0172.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.192] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0172.192] lstrlenW (lpString="J0107718.WMF") returned 12
	[0172.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0172.194] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=3800) returned 1
	[0172.194] CloseHandle (hObject=0x370) returned 1
	[0172.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0x220
	[0173.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.761] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.761] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0173.762] GetLastError () returned 0x0
	[0173.762] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xed8, lpOverlapped=0x0) returned 1
	[0173.764] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xee0, lpOverlapped=0x0) returned 1
	[0173.765] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.765] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.765] SetEndOfFile (hFile=0x4b8) returned 1
	[0173.765] CloseHandle (hObject=0x4b8) returned 1
	[0173.765] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.765] SetEndOfFile (hFile=0x444) returned 1
	[0173.768] CloseHandle (hObject=0x444) returned 1
	[0173.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 1
	[0173.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.769] lstrlenW (lpString=".doc") returned 4
	[0173.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.769] lstrlenW (lpString=".docx") returned 5
	[0173.769] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0173.769] lstrlenW (lpString=".pdf") returned 4
	[0173.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.769] lstrlenW (lpString=".xls") returned 4
	[0173.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.769] lstrlenW (lpString=".xlsx") returned 5
	[0173.769] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0173.769] lstrlenW (lpString=".ppt") returned 4
	[0173.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.769] lstrlenW (lpString=".zip") returned 4
	[0173.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.769] lstrlenW (lpString=".rar") returned 4
	[0173.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.769] lstrlenW (lpString=".bz2") returned 4
	[0173.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.770] lstrlenW (lpString=".7z") returned 3
	[0173.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.770] lstrlenW (lpString=".dbf") returned 4
	[0173.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.770] lstrlenW (lpString=".1cd") returned 4
	[0173.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.770] lstrlenW (lpString=".jpg") returned 4
	[0173.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.770] lstrlenW (lpString=".doc") returned 4
	[0173.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.770] lstrlenW (lpString=".docx") returned 5
	[0173.770] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0173.770] lstrlenW (lpString=".pdf") returned 4
	[0173.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.770] lstrlenW (lpString=".xls") returned 4
	[0173.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.770] lstrlenW (lpString=".xlsx") returned 5
	[0173.770] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0173.770] lstrlenW (lpString=".ppt") returned 4
	[0173.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.770] lstrlenW (lpString=".zip") returned 4
	[0173.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.770] lstrlenW (lpString=".rar") returned 4
	[0173.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.771] lstrlenW (lpString=".bz2") returned 4
	[0173.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.771] lstrlenW (lpString=".7z") returned 3
	[0173.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.771] lstrlenW (lpString=".dbf") returned 4
	[0173.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.771] lstrlenW (lpString=".1cd") returned 4
	[0173.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.771] lstrlenW (lpString=".jpg") returned 4
	[0173.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.771] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0173.771] lstrlenW (lpString="J0145272.JPG") returned 12
	[0173.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.772] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=49238) returned 1
	[0173.772] CloseHandle (hObject=0x444) returned 1
	[0173.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0x220
	[0173.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.772] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.772] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0173.776] GetLastError () returned 0x0
	[0173.776] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xc056, lpOverlapped=0x0) returned 1
	[0173.779] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xc060, lpOverlapped=0x0) returned 1
	[0173.781] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.781] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.781] SetEndOfFile (hFile=0x4b8) returned 1
	[0173.781] CloseHandle (hObject=0x4b8) returned 1
	[0173.781] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.781] SetEndOfFile (hFile=0x444) returned 1
	[0173.784] CloseHandle (hObject=0x444) returned 1
	[0173.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 1
	[0173.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.786] lstrlenW (lpString=".doc") returned 4
	[0173.786] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.786] lstrlenW (lpString=".docx") returned 5
	[0173.786] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0173.786] lstrlenW (lpString=".pdf") returned 4
	[0173.786] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.786] lstrlenW (lpString=".xls") returned 4
	[0173.786] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.786] lstrlenW (lpString=".xlsx") returned 5
	[0173.786] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0173.786] lstrlenW (lpString=".ppt") returned 4
	[0173.786] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.786] lstrlenW (lpString=".zip") returned 4
	[0173.786] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.786] lstrlenW (lpString=".rar") returned 4
	[0173.786] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.786] lstrlenW (lpString=".bz2") returned 4
	[0173.786] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.786] lstrlenW (lpString=".7z") returned 3
	[0173.786] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.786] lstrlenW (lpString=".dbf") returned 4
	[0173.786] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.786] lstrlenW (lpString=".1cd") returned 4
	[0173.786] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.786] lstrlenW (lpString=".jpg") returned 4
	[0173.786] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.787] lstrlenW (lpString=".doc") returned 4
	[0173.787] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0173.787] lstrlenW (lpString=".docx") returned 5
	[0173.787] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0173.787] lstrlenW (lpString=".pdf") returned 4
	[0173.787] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0173.787] lstrlenW (lpString=".xls") returned 4
	[0173.787] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0173.787] lstrlenW (lpString=".xlsx") returned 5
	[0173.787] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0173.787] lstrlenW (lpString=".ppt") returned 4
	[0173.787] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0173.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.787] lstrlenW (lpString=".zip") returned 4
	[0173.787] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0173.787] lstrlenW (lpString=".rar") returned 4
	[0173.787] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0173.787] lstrlenW (lpString=".bz2") returned 4
	[0173.787] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0173.787] lstrlenW (lpString=".7z") returned 3
	[0173.787] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0173.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.787] lstrlenW (lpString=".dbf") returned 4
	[0173.787] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0173.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.787] lstrlenW (lpString=".1cd") returned 4
	[0173.787] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0173.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0173.788] lstrlenW (lpString=".jpg") returned 4
	[0173.788] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0173.788] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0173.788] lstrlenW (lpString="J0145361.JPG") returned 12
	[0173.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.788] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=21125) returned 1
	[0173.788] CloseHandle (hObject=0x444) returned 1
	[0173.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0x220
	[0173.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.789] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.789] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0173.790] GetLastError () returned 0x0
	[0173.790] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x5285, lpOverlapped=0x0) returned 1
	[0173.792] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x5290, lpOverlapped=0x0) returned 1
	[0173.793] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.793] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.793] SetEndOfFile (hFile=0x4b8) returned 1
	[0173.794] CloseHandle (hObject=0x4b8) returned 1
	[0173.794] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.794] SetEndOfFile (hFile=0x444) returned 1
	[0173.982] CloseHandle (hObject=0x444) returned 1
	[0174.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 1
	[0174.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.101] lstrlenW (lpString=".doc") returned 4
	[0174.101] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.101] lstrlenW (lpString=".docx") returned 5
	[0174.101] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0174.101] lstrlenW (lpString=".pdf") returned 4
	[0174.101] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.101] lstrlenW (lpString=".xls") returned 4
	[0174.101] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.101] lstrlenW (lpString=".xlsx") returned 5
	[0174.101] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0174.101] lstrlenW (lpString=".ppt") returned 4
	[0174.101] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.101] lstrlenW (lpString=".zip") returned 4
	[0174.102] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.102] lstrlenW (lpString=".rar") returned 4
	[0174.102] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.102] lstrlenW (lpString=".bz2") returned 4
	[0174.102] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.102] lstrlenW (lpString=".7z") returned 3
	[0174.102] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.102] lstrlenW (lpString=".dbf") returned 4
	[0174.102] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.102] lstrlenW (lpString=".1cd") returned 4
	[0174.102] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.102] lstrlenW (lpString=".jpg") returned 4
	[0174.102] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.102] lstrlenW (lpString=".doc") returned 4
	[0174.102] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.102] lstrlenW (lpString=".docx") returned 5
	[0174.102] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0174.102] lstrlenW (lpString=".pdf") returned 4
	[0174.102] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.102] lstrlenW (lpString=".xls") returned 4
	[0174.102] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.102] lstrlenW (lpString=".xlsx") returned 5
	[0174.102] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0174.102] lstrlenW (lpString=".ppt") returned 4
	[0174.102] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.103] lstrlenW (lpString=".zip") returned 4
	[0174.103] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.103] lstrlenW (lpString=".rar") returned 4
	[0174.103] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.103] lstrlenW (lpString=".bz2") returned 4
	[0174.103] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.103] lstrlenW (lpString=".7z") returned 3
	[0174.103] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.103] lstrlenW (lpString=".dbf") returned 4
	[0174.103] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.103] lstrlenW (lpString=".1cd") returned 4
	[0174.103] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.103] lstrlenW (lpString=".jpg") returned 4
	[0174.103] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.103] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0174.103] lstrlenW (lpString="J0145904.JPG") returned 12
	[0174.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0174.193] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=39542) returned 1
	[0174.193] CloseHandle (hObject=0x520) returned 1
	[0174.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 0x220
	[0174.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0174.193] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.194] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0174.194] GetLastError () returned 0x0
	[0174.194] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x9a76, lpOverlapped=0x0) returned 1
	[0174.197] WriteFile (in: hFile=0x4f0, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x9a80, lpOverlapped=0x0) returned 1
	[0174.211] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.211] WriteFile (in: hFile=0x4f0, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.211] SetEndOfFile (hFile=0x4f0) returned 1
	[0174.211] CloseHandle (hObject=0x4f0) returned 1
	[0174.211] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.211] SetEndOfFile (hFile=0x520) returned 1
	[0174.214] CloseHandle (hObject=0x520) returned 1
	[0174.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 1
	[0174.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.215] lstrlenW (lpString=".doc") returned 4
	[0174.215] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.215] lstrlenW (lpString=".docx") returned 5
	[0174.215] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0174.215] lstrlenW (lpString=".pdf") returned 4
	[0174.215] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.215] lstrlenW (lpString=".xls") returned 4
	[0174.215] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.215] lstrlenW (lpString=".xlsx") returned 5
	[0174.215] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0174.215] lstrlenW (lpString=".ppt") returned 4
	[0174.215] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.215] lstrlenW (lpString=".zip") returned 4
	[0174.215] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.215] lstrlenW (lpString=".rar") returned 4
	[0174.216] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.216] lstrlenW (lpString=".bz2") returned 4
	[0174.216] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.216] lstrlenW (lpString=".7z") returned 3
	[0174.216] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.216] lstrlenW (lpString=".dbf") returned 4
	[0174.216] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.216] lstrlenW (lpString=".1cd") returned 4
	[0174.216] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.216] lstrlenW (lpString=".jpg") returned 4
	[0174.216] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.216] lstrlenW (lpString=".doc") returned 4
	[0174.216] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.216] lstrlenW (lpString=".docx") returned 5
	[0174.216] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0174.216] lstrlenW (lpString=".pdf") returned 4
	[0174.216] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.216] lstrlenW (lpString=".xls") returned 4
	[0174.216] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.216] lstrlenW (lpString=".xlsx") returned 5
	[0174.216] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0174.216] lstrlenW (lpString=".ppt") returned 4
	[0174.216] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.216] lstrlenW (lpString=".zip") returned 4
	[0174.216] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.217] lstrlenW (lpString=".rar") returned 4
	[0174.217] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.217] lstrlenW (lpString=".bz2") returned 4
	[0174.217] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.217] lstrlenW (lpString=".7z") returned 3
	[0174.217] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.217] lstrlenW (lpString=".dbf") returned 4
	[0174.217] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.217] lstrlenW (lpString=".1cd") returned 4
	[0174.217] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0174.217] lstrlenW (lpString=".jpg") returned 4
	[0174.217] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.217] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0174.217] lstrlenW (lpString="J0146142.JPG") returned 12
	[0174.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0174.219] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=46508) returned 1
	[0174.219] CloseHandle (hObject=0x520) returned 1
	[0174.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0x220
	[0174.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0174.219] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.219] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0174.220] GetLastError () returned 0x0
	[0174.220] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xb5ac, lpOverlapped=0x0) returned 1
	[0174.223] WriteFile (in: hFile=0x4f0, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xb5b0, lpOverlapped=0x0) returned 1
	[0174.224] ReadFile (in: hFile=0x520, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.224] WriteFile (in: hFile=0x4f0, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.225] SetEndOfFile (hFile=0x4f0) returned 1
	[0174.225] CloseHandle (hObject=0x4f0) returned 1
	[0174.225] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.225] SetEndOfFile (hFile=0x520) returned 1
	[0174.228] CloseHandle (hObject=0x520) returned 1
	[0174.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 1
	[0174.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.229] lstrlenW (lpString=".doc") returned 4
	[0174.229] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.229] lstrlenW (lpString=".docx") returned 5
	[0174.229] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0174.229] lstrlenW (lpString=".pdf") returned 4
	[0174.229] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.229] lstrlenW (lpString=".xls") returned 4
	[0174.229] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.229] lstrlenW (lpString=".xlsx") returned 5
	[0174.229] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0174.229] lstrlenW (lpString=".ppt") returned 4
	[0174.229] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.229] lstrlenW (lpString=".zip") returned 4
	[0174.229] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.229] lstrlenW (lpString=".rar") returned 4
	[0174.229] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.229] lstrlenW (lpString=".bz2") returned 4
	[0174.229] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.229] lstrlenW (lpString=".7z") returned 3
	[0174.230] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.230] lstrlenW (lpString=".dbf") returned 4
	[0174.230] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.230] lstrlenW (lpString=".1cd") returned 4
	[0174.230] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.230] lstrlenW (lpString=".jpg") returned 4
	[0174.230] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.230] lstrlenW (lpString=".doc") returned 4
	[0174.230] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.230] lstrlenW (lpString=".docx") returned 5
	[0174.230] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0174.230] lstrlenW (lpString=".pdf") returned 4
	[0174.230] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.230] lstrlenW (lpString=".xls") returned 4
	[0174.230] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.230] lstrlenW (lpString=".xlsx") returned 5
	[0174.230] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0174.230] lstrlenW (lpString=".ppt") returned 4
	[0174.230] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.230] lstrlenW (lpString=".zip") returned 4
	[0174.230] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.230] lstrlenW (lpString=".rar") returned 4
	[0174.230] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.230] lstrlenW (lpString=".bz2") returned 4
	[0174.231] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.231] lstrlenW (lpString=".7z") returned 3
	[0174.231] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.231] lstrlenW (lpString=".dbf") returned 4
	[0174.231] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.231] lstrlenW (lpString=".1cd") returned 4
	[0174.231] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0174.231] lstrlenW (lpString=".jpg") returned 4
	[0174.231] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.231] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0174.231] lstrlenW (lpString="J0148309.JPG") returned 12
	[0174.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.432] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=43674) returned 1
	[0174.432] CloseHandle (hObject=0x514) returned 1
	[0174.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0x220
	[0174.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0174.866] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.868] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0175.126] GetLastError () returned 0x0
	[0175.126] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xaa9a, lpOverlapped=0x0) returned 1
	[0175.128] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xaaa0, lpOverlapped=0x0) returned 1
	[0175.140] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.140] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.141] SetEndOfFile (hFile=0x3e8) returned 1
	[0175.141] CloseHandle (hObject=0x3e8) returned 1
	[0175.141] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.141] SetEndOfFile (hFile=0x524) returned 1
	[0175.144] CloseHandle (hObject=0x524) returned 1
	[0175.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 1
	[0175.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.148] lstrlenW (lpString=".doc") returned 4
	[0175.148] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0175.148] lstrlenW (lpString=".docx") returned 5
	[0175.148] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0175.149] lstrlenW (lpString=".pdf") returned 4
	[0175.149] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0175.149] lstrlenW (lpString=".xls") returned 4
	[0175.149] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0175.149] lstrlenW (lpString=".xlsx") returned 5
	[0175.149] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0175.149] lstrlenW (lpString=".ppt") returned 4
	[0175.149] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0175.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.149] lstrlenW (lpString=".zip") returned 4
	[0175.149] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0175.149] lstrlenW (lpString=".rar") returned 4
	[0175.149] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0175.149] lstrlenW (lpString=".bz2") returned 4
	[0175.149] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0175.149] lstrlenW (lpString=".7z") returned 3
	[0175.149] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0175.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.149] lstrlenW (lpString=".dbf") returned 4
	[0175.149] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0175.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.149] lstrlenW (lpString=".1cd") returned 4
	[0175.149] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0175.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.149] lstrlenW (lpString=".jpg") returned 4
	[0175.149] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0175.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.149] lstrlenW (lpString=".doc") returned 4
	[0175.149] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0175.150] lstrlenW (lpString=".docx") returned 5
	[0175.150] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0175.150] lstrlenW (lpString=".pdf") returned 4
	[0175.150] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0175.150] lstrlenW (lpString=".xls") returned 4
	[0175.150] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0175.150] lstrlenW (lpString=".xlsx") returned 5
	[0175.150] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0175.150] lstrlenW (lpString=".ppt") returned 4
	[0175.150] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0175.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.150] lstrlenW (lpString=".zip") returned 4
	[0175.150] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0175.150] lstrlenW (lpString=".rar") returned 4
	[0175.150] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0175.150] lstrlenW (lpString=".bz2") returned 4
	[0175.150] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0175.150] lstrlenW (lpString=".7z") returned 3
	[0175.150] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0175.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.150] lstrlenW (lpString=".dbf") returned 4
	[0175.150] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0175.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.150] lstrlenW (lpString=".1cd") returned 4
	[0175.150] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0175.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0175.150] lstrlenW (lpString=".jpg") returned 4
	[0175.150] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0175.151] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0175.151] lstrlenW (lpString="J0151055.WMF") returned 12
	[0175.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.152] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=14632) returned 1
	[0175.152] CloseHandle (hObject=0x524) returned 1
	[0175.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0x220
	[0175.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.153] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.153] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0175.153] GetLastError () returned 0x0
	[0175.154] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x3928, lpOverlapped=0x0) returned 1
	[0175.156] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x3930, lpOverlapped=0x0) returned 1
	[0175.157] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.157] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.157] SetEndOfFile (hFile=0x3e8) returned 1
	[0175.157] CloseHandle (hObject=0x3e8) returned 1
	[0175.157] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.157] SetEndOfFile (hFile=0x524) returned 1
	[0175.160] CloseHandle (hObject=0x524) returned 1
	[0175.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 1
	[0175.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.162] lstrlenW (lpString=".doc") returned 4
	[0175.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.162] lstrlenW (lpString=".docx") returned 5
	[0175.162] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0175.162] lstrlenW (lpString=".pdf") returned 4
	[0175.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.162] lstrlenW (lpString=".xls") returned 4
	[0175.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.162] lstrlenW (lpString=".xlsx") returned 5
	[0175.162] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0175.162] lstrlenW (lpString=".ppt") returned 4
	[0175.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.162] lstrlenW (lpString=".zip") returned 4
	[0175.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.162] lstrlenW (lpString=".rar") returned 4
	[0175.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.162] lstrlenW (lpString=".bz2") returned 4
	[0175.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.162] lstrlenW (lpString=".7z") returned 3
	[0175.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.162] lstrlenW (lpString=".dbf") returned 4
	[0175.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.162] lstrlenW (lpString=".1cd") returned 4
	[0175.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.162] lstrlenW (lpString=".jpg") returned 4
	[0175.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.163] lstrlenW (lpString=".doc") returned 4
	[0175.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.163] lstrlenW (lpString=".docx") returned 5
	[0175.163] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0175.163] lstrlenW (lpString=".pdf") returned 4
	[0175.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.163] lstrlenW (lpString=".xls") returned 4
	[0175.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.163] lstrlenW (lpString=".xlsx") returned 5
	[0175.163] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0175.163] lstrlenW (lpString=".ppt") returned 4
	[0175.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.163] lstrlenW (lpString=".zip") returned 4
	[0175.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.163] lstrlenW (lpString=".rar") returned 4
	[0175.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.163] lstrlenW (lpString=".bz2") returned 4
	[0175.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.163] lstrlenW (lpString=".7z") returned 3
	[0175.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.163] lstrlenW (lpString=".dbf") returned 4
	[0175.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.163] lstrlenW (lpString=".1cd") returned 4
	[0175.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0175.164] lstrlenW (lpString=".jpg") returned 4
	[0175.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.164] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0175.164] lstrlenW (lpString="J0151061.WMF") returned 12
	[0175.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0175.298] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=6752) returned 1
	[0175.302] CloseHandle (hObject=0x4f0) returned 1
	[0175.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 0x220
	[0175.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.683] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.683] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0175.684] GetLastError () returned 0x0
	[0175.684] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1a60, lpOverlapped=0x0) returned 1
	[0175.685] WriteFile (in: hFile=0x514, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1a70, lpOverlapped=0x0) returned 1
	[0175.686] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.686] WriteFile (in: hFile=0x514, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.686] SetEndOfFile (hFile=0x514) returned 1
	[0175.686] CloseHandle (hObject=0x514) returned 1
	[0175.686] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.686] SetEndOfFile (hFile=0x524) returned 1
	[0175.689] CloseHandle (hObject=0x524) returned 1
	[0175.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 1
	[0175.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.690] lstrlenW (lpString=".doc") returned 4
	[0175.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.690] lstrlenW (lpString=".docx") returned 5
	[0175.690] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0175.690] lstrlenW (lpString=".pdf") returned 4
	[0175.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.690] lstrlenW (lpString=".xls") returned 4
	[0175.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.691] lstrlenW (lpString=".xlsx") returned 5
	[0175.691] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0175.691] lstrlenW (lpString=".ppt") returned 4
	[0175.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.691] lstrlenW (lpString=".zip") returned 4
	[0175.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.691] lstrlenW (lpString=".rar") returned 4
	[0175.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.691] lstrlenW (lpString=".bz2") returned 4
	[0175.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.691] lstrlenW (lpString=".7z") returned 3
	[0175.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.691] lstrlenW (lpString=".dbf") returned 4
	[0175.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.691] lstrlenW (lpString=".1cd") returned 4
	[0175.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.691] lstrlenW (lpString=".jpg") returned 4
	[0175.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.691] lstrlenW (lpString=".doc") returned 4
	[0175.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.691] lstrlenW (lpString=".docx") returned 5
	[0175.691] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0175.691] lstrlenW (lpString=".pdf") returned 4
	[0175.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.692] lstrlenW (lpString=".xls") returned 4
	[0175.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.692] lstrlenW (lpString=".xlsx") returned 5
	[0175.692] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0175.692] lstrlenW (lpString=".ppt") returned 4
	[0175.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.692] lstrlenW (lpString=".zip") returned 4
	[0175.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.692] lstrlenW (lpString=".rar") returned 4
	[0175.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.692] lstrlenW (lpString=".bz2") returned 4
	[0175.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.692] lstrlenW (lpString=".7z") returned 3
	[0175.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.692] lstrlenW (lpString=".dbf") returned 4
	[0175.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.692] lstrlenW (lpString=".1cd") returned 4
	[0175.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0175.692] lstrlenW (lpString=".jpg") returned 4
	[0175.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.692] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0175.693] lstrlenW (lpString="J0151063.WMF") returned 12
	[0175.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.693] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=10632) returned 1
	[0175.693] CloseHandle (hObject=0x524) returned 1
	[0175.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0x220
	[0175.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.694] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.694] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0175.695] GetLastError () returned 0x0
	[0175.695] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x2988, lpOverlapped=0x0) returned 1
	[0175.696] WriteFile (in: hFile=0x514, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0175.697] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.697] WriteFile (in: hFile=0x514, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.698] SetEndOfFile (hFile=0x514) returned 1
	[0175.698] CloseHandle (hObject=0x514) returned 1
	[0175.698] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.698] SetEndOfFile (hFile=0x524) returned 1
	[0175.701] CloseHandle (hObject=0x524) returned 1
	[0175.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 1
	[0175.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.702] lstrlenW (lpString=".doc") returned 4
	[0175.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.702] lstrlenW (lpString=".docx") returned 5
	[0175.703] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0175.703] lstrlenW (lpString=".pdf") returned 4
	[0175.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.703] lstrlenW (lpString=".xls") returned 4
	[0175.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.703] lstrlenW (lpString=".xlsx") returned 5
	[0175.703] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0175.703] lstrlenW (lpString=".ppt") returned 4
	[0175.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.703] lstrlenW (lpString=".zip") returned 4
	[0175.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.703] lstrlenW (lpString=".rar") returned 4
	[0175.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.703] lstrlenW (lpString=".bz2") returned 4
	[0175.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.703] lstrlenW (lpString=".7z") returned 3
	[0175.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.703] lstrlenW (lpString=".dbf") returned 4
	[0175.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.703] lstrlenW (lpString=".1cd") returned 4
	[0175.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.703] lstrlenW (lpString=".jpg") returned 4
	[0175.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.704] lstrlenW (lpString=".doc") returned 4
	[0175.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.704] lstrlenW (lpString=".docx") returned 5
	[0175.704] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0175.704] lstrlenW (lpString=".pdf") returned 4
	[0175.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.704] lstrlenW (lpString=".xls") returned 4
	[0175.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.704] lstrlenW (lpString=".xlsx") returned 5
	[0175.704] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0175.704] lstrlenW (lpString=".ppt") returned 4
	[0175.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.704] lstrlenW (lpString=".zip") returned 4
	[0175.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.704] lstrlenW (lpString=".rar") returned 4
	[0175.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.704] lstrlenW (lpString=".bz2") returned 4
	[0175.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.704] lstrlenW (lpString=".7z") returned 3
	[0175.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.704] lstrlenW (lpString=".dbf") returned 4
	[0175.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.704] lstrlenW (lpString=".1cd") returned 4
	[0175.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0175.704] lstrlenW (lpString=".jpg") returned 4
	[0175.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.705] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0175.705] lstrlenW (lpString="J0151067.WMF") returned 12
	[0175.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.705] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=13204) returned 1
	[0175.705] CloseHandle (hObject=0x524) returned 1
	[0175.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0x220
	[0175.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.706] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.706] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0175.707] GetLastError () returned 0x0
	[0175.707] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x3394, lpOverlapped=0x0) returned 1
	[0175.709] WriteFile (in: hFile=0x514, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x33a0, lpOverlapped=0x0) returned 1
	[0175.710] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.710] WriteFile (in: hFile=0x514, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.710] SetEndOfFile (hFile=0x514) returned 1
	[0175.710] CloseHandle (hObject=0x514) returned 1
	[0175.710] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.710] SetEndOfFile (hFile=0x524) returned 1
	[0175.713] CloseHandle (hObject=0x524) returned 1
	[0175.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 1
	[0175.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.714] lstrlenW (lpString=".doc") returned 4
	[0175.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.714] lstrlenW (lpString=".docx") returned 5
	[0175.714] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0175.714] lstrlenW (lpString=".pdf") returned 4
	[0175.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.714] lstrlenW (lpString=".xls") returned 4
	[0175.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.714] lstrlenW (lpString=".xlsx") returned 5
	[0175.714] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0175.714] lstrlenW (lpString=".ppt") returned 4
	[0175.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.715] lstrlenW (lpString=".zip") returned 4
	[0175.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.715] lstrlenW (lpString=".rar") returned 4
	[0175.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.715] lstrlenW (lpString=".bz2") returned 4
	[0175.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.715] lstrlenW (lpString=".7z") returned 3
	[0175.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.715] lstrlenW (lpString=".dbf") returned 4
	[0175.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.715] lstrlenW (lpString=".1cd") returned 4
	[0175.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.715] lstrlenW (lpString=".jpg") returned 4
	[0175.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.715] lstrlenW (lpString=".doc") returned 4
	[0175.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.715] lstrlenW (lpString=".docx") returned 5
	[0175.715] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0175.715] lstrlenW (lpString=".pdf") returned 4
	[0175.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.715] lstrlenW (lpString=".xls") returned 4
	[0175.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.715] lstrlenW (lpString=".xlsx") returned 5
	[0175.715] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0175.716] lstrlenW (lpString=".ppt") returned 4
	[0175.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.716] lstrlenW (lpString=".zip") returned 4
	[0175.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.716] lstrlenW (lpString=".rar") returned 4
	[0175.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.716] lstrlenW (lpString=".bz2") returned 4
	[0175.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.716] lstrlenW (lpString=".7z") returned 3
	[0175.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.716] lstrlenW (lpString=".dbf") returned 4
	[0175.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.716] lstrlenW (lpString=".1cd") returned 4
	[0175.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0175.716] lstrlenW (lpString=".jpg") returned 4
	[0175.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.716] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0175.716] lstrlenW (lpString="J0151073.WMF") returned 12
	[0175.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.717] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=13336) returned 1
	[0175.717] CloseHandle (hObject=0x524) returned 1
	[0175.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0x220
	[0175.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.718] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.718] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0176.262] GetLastError () returned 0x0
	[0176.262] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x3418, lpOverlapped=0x0) returned 1
	[0176.264] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x3420, lpOverlapped=0x0) returned 1
	[0176.265] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.265] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.266] SetEndOfFile (hFile=0x3e8) returned 1
	[0176.266] CloseHandle (hObject=0x3e8) returned 1
	[0176.266] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.266] SetEndOfFile (hFile=0x524) returned 1
	[0176.269] CloseHandle (hObject=0x524) returned 1
	[0176.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 1
	[0176.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.270] lstrlenW (lpString=".doc") returned 4
	[0176.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.270] lstrlenW (lpString=".docx") returned 5
	[0176.270] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0176.270] lstrlenW (lpString=".pdf") returned 4
	[0176.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.270] lstrlenW (lpString=".xls") returned 4
	[0176.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.270] lstrlenW (lpString=".xlsx") returned 5
	[0176.270] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0176.270] lstrlenW (lpString=".ppt") returned 4
	[0176.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.271] lstrlenW (lpString=".zip") returned 4
	[0176.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.271] lstrlenW (lpString=".rar") returned 4
	[0176.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.271] lstrlenW (lpString=".bz2") returned 4
	[0176.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.271] lstrlenW (lpString=".7z") returned 3
	[0176.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.271] lstrlenW (lpString=".dbf") returned 4
	[0176.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.271] lstrlenW (lpString=".1cd") returned 4
	[0176.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.271] lstrlenW (lpString=".jpg") returned 4
	[0176.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.271] lstrlenW (lpString=".doc") returned 4
	[0176.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.271] lstrlenW (lpString=".docx") returned 5
	[0176.271] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0176.271] lstrlenW (lpString=".pdf") returned 4
	[0176.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.271] lstrlenW (lpString=".xls") returned 4
	[0176.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.271] lstrlenW (lpString=".xlsx") returned 5
	[0176.271] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0176.271] lstrlenW (lpString=".ppt") returned 4
	[0176.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.272] lstrlenW (lpString=".zip") returned 4
	[0176.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.272] lstrlenW (lpString=".rar") returned 4
	[0176.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.272] lstrlenW (lpString=".bz2") returned 4
	[0176.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.272] lstrlenW (lpString=".7z") returned 3
	[0176.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.272] lstrlenW (lpString=".dbf") returned 4
	[0176.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.272] lstrlenW (lpString=".1cd") returned 4
	[0176.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.272] lstrlenW (lpString=".jpg") returned 4
	[0176.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.272] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.272] lstrlenW (lpString="J0152570.WMF") returned 12
	[0176.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.273] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=3368) returned 1
	[0176.273] CloseHandle (hObject=0x524) returned 1
	[0176.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 0x220
	[0176.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.274] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.274] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0176.274] GetLastError () returned 0x0
	[0176.274] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xd28, lpOverlapped=0x0) returned 1
	[0176.276] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xd30, lpOverlapped=0x0) returned 1
	[0176.277] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.277] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.277] SetEndOfFile (hFile=0x3e8) returned 1
	[0176.277] CloseHandle (hObject=0x3e8) returned 1
	[0176.277] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.277] SetEndOfFile (hFile=0x524) returned 1
	[0176.280] CloseHandle (hObject=0x524) returned 1
	[0176.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 1
	[0176.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.281] lstrlenW (lpString=".doc") returned 4
	[0176.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.281] lstrlenW (lpString=".docx") returned 5
	[0176.281] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0176.281] lstrlenW (lpString=".pdf") returned 4
	[0176.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.281] lstrlenW (lpString=".xls") returned 4
	[0176.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.281] lstrlenW (lpString=".xlsx") returned 5
	[0176.281] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0176.281] lstrlenW (lpString=".ppt") returned 4
	[0176.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.281] lstrlenW (lpString=".zip") returned 4
	[0176.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.281] lstrlenW (lpString=".rar") returned 4
	[0176.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.281] lstrlenW (lpString=".bz2") returned 4
	[0176.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.281] lstrlenW (lpString=".7z") returned 3
	[0176.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.282] lstrlenW (lpString=".dbf") returned 4
	[0176.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.282] lstrlenW (lpString=".1cd") returned 4
	[0176.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.282] lstrlenW (lpString=".jpg") returned 4
	[0176.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.282] lstrlenW (lpString=".doc") returned 4
	[0176.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.282] lstrlenW (lpString=".docx") returned 5
	[0176.282] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0176.282] lstrlenW (lpString=".pdf") returned 4
	[0176.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.282] lstrlenW (lpString=".xls") returned 4
	[0176.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.282] lstrlenW (lpString=".xlsx") returned 5
	[0176.282] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0176.282] lstrlenW (lpString=".ppt") returned 4
	[0176.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.282] lstrlenW (lpString=".zip") returned 4
	[0176.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.282] lstrlenW (lpString=".rar") returned 4
	[0176.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.282] lstrlenW (lpString=".bz2") returned 4
	[0176.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.283] lstrlenW (lpString=".7z") returned 3
	[0176.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.283] lstrlenW (lpString=".dbf") returned 4
	[0176.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.283] lstrlenW (lpString=".1cd") returned 4
	[0176.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0176.283] lstrlenW (lpString=".jpg") returned 4
	[0176.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.283] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.283] lstrlenW (lpString="J0152590.WMF") returned 12
	[0176.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.284] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=10932) returned 1
	[0176.284] CloseHandle (hObject=0x524) returned 1
	[0176.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0x220
	[0176.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.285] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.285] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0176.286] GetLastError () returned 0x0
	[0176.286] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x2ab4, lpOverlapped=0x0) returned 1
	[0176.287] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x2ac0, lpOverlapped=0x0) returned 1
	[0176.288] ReadFile (in: hFile=0x524, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.288] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.288] SetEndOfFile (hFile=0x3e8) returned 1
	[0176.289] CloseHandle (hObject=0x3e8) returned 1
	[0176.289] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.289] SetEndOfFile (hFile=0x524) returned 1
	[0176.292] CloseHandle (hObject=0x524) returned 1
	[0176.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 1
	[0176.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.293] lstrlenW (lpString=".doc") returned 4
	[0176.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.293] lstrlenW (lpString=".docx") returned 5
	[0176.293] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0176.293] lstrlenW (lpString=".pdf") returned 4
	[0176.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.293] lstrlenW (lpString=".xls") returned 4
	[0176.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.293] lstrlenW (lpString=".xlsx") returned 5
	[0176.293] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0176.293] lstrlenW (lpString=".ppt") returned 4
	[0176.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.293] lstrlenW (lpString=".zip") returned 4
	[0176.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.293] lstrlenW (lpString=".rar") returned 4
	[0176.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.293] lstrlenW (lpString=".bz2") returned 4
	[0176.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.293] lstrlenW (lpString=".7z") returned 3
	[0176.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.294] lstrlenW (lpString=".dbf") returned 4
	[0176.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.294] lstrlenW (lpString=".1cd") returned 4
	[0176.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.294] lstrlenW (lpString=".jpg") returned 4
	[0176.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.294] lstrlenW (lpString=".doc") returned 4
	[0176.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.294] lstrlenW (lpString=".docx") returned 5
	[0176.294] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0176.294] lstrlenW (lpString=".pdf") returned 4
	[0176.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.294] lstrlenW (lpString=".xls") returned 4
	[0176.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.294] lstrlenW (lpString=".xlsx") returned 5
	[0176.294] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0176.294] lstrlenW (lpString=".ppt") returned 4
	[0176.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.294] lstrlenW (lpString=".zip") returned 4
	[0176.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.294] lstrlenW (lpString=".rar") returned 4
	[0176.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.294] lstrlenW (lpString=".bz2") returned 4
	[0176.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.294] lstrlenW (lpString=".7z") returned 3
	[0176.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.295] lstrlenW (lpString=".dbf") returned 4
	[0176.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.295] lstrlenW (lpString=".1cd") returned 4
	[0176.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0176.295] lstrlenW (lpString=".jpg") returned 4
	[0176.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.295] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.295] lstrlenW (lpString="J0152594.WMF") returned 12
	[0176.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.296] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=6340) returned 1
	[0176.296] CloseHandle (hObject=0x524) returned 1
	[0176.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0x220
	[0176.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0176.680] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.680] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0176.681] GetLastError () returned 0x0
	[0176.681] ReadFile (in: hFile=0x3f4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x18c4, lpOverlapped=0x0) returned 1
	[0176.684] WriteFile (in: hFile=0x298, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x18d0, lpOverlapped=0x0) returned 1
	[0176.685] ReadFile (in: hFile=0x3f4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.685] WriteFile (in: hFile=0x298, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.685] SetEndOfFile (hFile=0x298) returned 1
	[0176.685] CloseHandle (hObject=0x298) returned 1
	[0176.685] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.685] SetEndOfFile (hFile=0x3f4) returned 1
	[0176.688] CloseHandle (hObject=0x3f4) returned 1
	[0176.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 1
	[0176.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.689] lstrlenW (lpString=".doc") returned 4
	[0176.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.689] lstrlenW (lpString=".docx") returned 5
	[0176.689] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0176.689] lstrlenW (lpString=".pdf") returned 4
	[0176.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.689] lstrlenW (lpString=".xls") returned 4
	[0176.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.690] lstrlenW (lpString=".xlsx") returned 5
	[0176.690] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0176.690] lstrlenW (lpString=".ppt") returned 4
	[0176.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.690] lstrlenW (lpString=".zip") returned 4
	[0176.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.690] lstrlenW (lpString=".rar") returned 4
	[0176.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.690] lstrlenW (lpString=".bz2") returned 4
	[0176.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.690] lstrlenW (lpString=".7z") returned 3
	[0176.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.690] lstrlenW (lpString=".dbf") returned 4
	[0176.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.690] lstrlenW (lpString=".1cd") returned 4
	[0176.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.690] lstrlenW (lpString=".jpg") returned 4
	[0176.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.690] lstrlenW (lpString=".doc") returned 4
	[0176.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.690] lstrlenW (lpString=".docx") returned 5
	[0176.690] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0176.690] lstrlenW (lpString=".pdf") returned 4
	[0176.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.691] lstrlenW (lpString=".xls") returned 4
	[0176.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.691] lstrlenW (lpString=".xlsx") returned 5
	[0176.691] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0176.691] lstrlenW (lpString=".ppt") returned 4
	[0176.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.691] lstrlenW (lpString=".zip") returned 4
	[0176.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.691] lstrlenW (lpString=".rar") returned 4
	[0176.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.691] lstrlenW (lpString=".bz2") returned 4
	[0176.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.691] lstrlenW (lpString=".7z") returned 3
	[0176.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.691] lstrlenW (lpString=".dbf") returned 4
	[0176.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.691] lstrlenW (lpString=".1cd") returned 4
	[0176.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0176.691] lstrlenW (lpString=".jpg") returned 4
	[0176.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.691] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.691] lstrlenW (lpString="J0152606.WMF") returned 12
	[0176.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0176.693] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=16632) returned 1
	[0176.693] CloseHandle (hObject=0x3f4) returned 1
	[0176.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 0x220
	[0176.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0176.693] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.693] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0176.694] GetLastError () returned 0x0
	[0176.694] ReadFile (in: hFile=0x3f4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x40f8, lpOverlapped=0x0) returned 1
	[0176.696] WriteFile (in: hFile=0x298, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x4100, lpOverlapped=0x0) returned 1
	[0176.697] ReadFile (in: hFile=0x3f4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.697] WriteFile (in: hFile=0x298, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.697] SetEndOfFile (hFile=0x298) returned 1
	[0176.697] CloseHandle (hObject=0x298) returned 1
	[0176.698] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.698] SetEndOfFile (hFile=0x3f4) returned 1
	[0176.700] CloseHandle (hObject=0x3f4) returned 1
	[0176.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 1
	[0176.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.701] lstrlenW (lpString=".doc") returned 4
	[0176.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.701] lstrlenW (lpString=".docx") returned 5
	[0176.701] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0176.701] lstrlenW (lpString=".pdf") returned 4
	[0176.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.701] lstrlenW (lpString=".xls") returned 4
	[0176.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.701] lstrlenW (lpString=".xlsx") returned 5
	[0176.701] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0176.701] lstrlenW (lpString=".ppt") returned 4
	[0176.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.701] lstrlenW (lpString=".zip") returned 4
	[0176.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.702] lstrlenW (lpString=".rar") returned 4
	[0176.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.702] lstrlenW (lpString=".bz2") returned 4
	[0176.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.702] lstrlenW (lpString=".7z") returned 3
	[0176.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.702] lstrlenW (lpString=".dbf") returned 4
	[0176.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.702] lstrlenW (lpString=".1cd") returned 4
	[0176.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.702] lstrlenW (lpString=".jpg") returned 4
	[0176.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.702] lstrlenW (lpString=".doc") returned 4
	[0176.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.702] lstrlenW (lpString=".docx") returned 5
	[0176.703] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0176.703] lstrlenW (lpString=".pdf") returned 4
	[0176.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.703] lstrlenW (lpString=".xls") returned 4
	[0176.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.703] lstrlenW (lpString=".xlsx") returned 5
	[0176.703] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0176.703] lstrlenW (lpString=".ppt") returned 4
	[0176.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.703] lstrlenW (lpString=".zip") returned 4
	[0176.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.703] lstrlenW (lpString=".rar") returned 4
	[0176.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.703] lstrlenW (lpString=".bz2") returned 4
	[0176.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.703] lstrlenW (lpString=".7z") returned 3
	[0176.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.703] lstrlenW (lpString=".dbf") returned 4
	[0176.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.703] lstrlenW (lpString=".1cd") returned 4
	[0176.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0176.703] lstrlenW (lpString=".jpg") returned 4
	[0176.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.703] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.704] lstrlenW (lpString="J0152608.WMF") returned 12
	[0176.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0176.704] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=12436) returned 1
	[0176.704] CloseHandle (hObject=0x3f4) returned 1
	[0176.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0x220
	[0176.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0176.705] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.705] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0176.706] GetLastError () returned 0x0
	[0176.706] ReadFile (in: hFile=0x3f4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x3094, lpOverlapped=0x0) returned 1
	[0176.707] WriteFile (in: hFile=0x298, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x30a0, lpOverlapped=0x0) returned 1
	[0176.709] ReadFile (in: hFile=0x3f4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.709] WriteFile (in: hFile=0x298, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.709] SetEndOfFile (hFile=0x298) returned 1
	[0176.709] CloseHandle (hObject=0x298) returned 1
	[0176.709] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.709] SetEndOfFile (hFile=0x3f4) returned 1
	[0176.712] CloseHandle (hObject=0x3f4) returned 1
	[0176.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 1
	[0176.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.713] lstrlenW (lpString=".doc") returned 4
	[0176.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.713] lstrlenW (lpString=".docx") returned 5
	[0176.713] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0176.713] lstrlenW (lpString=".pdf") returned 4
	[0176.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.713] lstrlenW (lpString=".xls") returned 4
	[0176.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.713] lstrlenW (lpString=".xlsx") returned 5
	[0176.713] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0176.713] lstrlenW (lpString=".ppt") returned 4
	[0176.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.714] lstrlenW (lpString=".zip") returned 4
	[0176.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.714] lstrlenW (lpString=".rar") returned 4
	[0176.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.714] lstrlenW (lpString=".bz2") returned 4
	[0176.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.714] lstrlenW (lpString=".7z") returned 3
	[0176.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.714] lstrlenW (lpString=".dbf") returned 4
	[0176.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.714] lstrlenW (lpString=".1cd") returned 4
	[0176.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.714] lstrlenW (lpString=".jpg") returned 4
	[0176.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.714] lstrlenW (lpString=".doc") returned 4
	[0176.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.714] lstrlenW (lpString=".docx") returned 5
	[0176.714] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0176.714] lstrlenW (lpString=".pdf") returned 4
	[0176.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.714] lstrlenW (lpString=".xls") returned 4
	[0176.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.714] lstrlenW (lpString=".xlsx") returned 5
	[0176.714] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0176.714] lstrlenW (lpString=".ppt") returned 4
	[0176.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.715] lstrlenW (lpString=".zip") returned 4
	[0176.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.715] lstrlenW (lpString=".rar") returned 4
	[0176.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.715] lstrlenW (lpString=".bz2") returned 4
	[0176.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.715] lstrlenW (lpString=".7z") returned 3
	[0176.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.715] lstrlenW (lpString=".dbf") returned 4
	[0176.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.715] lstrlenW (lpString=".1cd") returned 4
	[0176.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0176.715] lstrlenW (lpString=".jpg") returned 4
	[0176.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.715] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.715] lstrlenW (lpString="J0152610.WMF") returned 12
	[0176.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.841] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=5960) returned 1
	[0176.841] CloseHandle (hObject=0x524) returned 1
	[0176.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 0x220
	[0176.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.937] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.937] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.938] GetLastError () returned 0x0
	[0176.938] ReadFile (in: hFile=0x51c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1748, lpOverlapped=0x0) returned 1
	[0176.940] WriteFile (in: hFile=0x524, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1750, lpOverlapped=0x0) returned 1
	[0176.940] ReadFile (in: hFile=0x51c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.941] WriteFile (in: hFile=0x524, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.941] SetEndOfFile (hFile=0x524) returned 1
	[0176.941] CloseHandle (hObject=0x524) returned 1
	[0176.941] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.941] SetEndOfFile (hFile=0x51c) returned 1
	[0176.944] CloseHandle (hObject=0x51c) returned 1
	[0176.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 1
	[0176.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.945] lstrlenW (lpString=".doc") returned 4
	[0176.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.945] lstrlenW (lpString=".docx") returned 5
	[0176.945] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0176.945] lstrlenW (lpString=".pdf") returned 4
	[0176.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.945] lstrlenW (lpString=".xls") returned 4
	[0176.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.945] lstrlenW (lpString=".xlsx") returned 5
	[0176.945] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0176.945] lstrlenW (lpString=".ppt") returned 4
	[0176.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.946] lstrlenW (lpString=".zip") returned 4
	[0176.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.946] lstrlenW (lpString=".rar") returned 4
	[0176.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.946] lstrlenW (lpString=".bz2") returned 4
	[0176.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.946] lstrlenW (lpString=".7z") returned 3
	[0176.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.946] lstrlenW (lpString=".dbf") returned 4
	[0176.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.946] lstrlenW (lpString=".1cd") returned 4
	[0176.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.946] lstrlenW (lpString=".jpg") returned 4
	[0176.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.947] lstrlenW (lpString=".doc") returned 4
	[0176.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.947] lstrlenW (lpString=".docx") returned 5
	[0176.947] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0176.947] lstrlenW (lpString=".pdf") returned 4
	[0176.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.947] lstrlenW (lpString=".xls") returned 4
	[0176.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.947] lstrlenW (lpString=".xlsx") returned 5
	[0176.947] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0176.947] lstrlenW (lpString=".ppt") returned 4
	[0176.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.947] lstrlenW (lpString=".zip") returned 4
	[0176.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.947] lstrlenW (lpString=".rar") returned 4
	[0176.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.947] lstrlenW (lpString=".bz2") returned 4
	[0176.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.947] lstrlenW (lpString=".7z") returned 3
	[0176.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.947] lstrlenW (lpString=".dbf") returned 4
	[0176.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.947] lstrlenW (lpString=".1cd") returned 4
	[0176.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0176.948] lstrlenW (lpString=".jpg") returned 4
	[0176.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.948] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.948] lstrlenW (lpString="J0152694.WMF") returned 12
	[0176.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.950] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=1348) returned 1
	[0176.950] CloseHandle (hObject=0x51c) returned 1
	[0176.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 0x220
	[0176.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.950] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.950] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.951] GetLastError () returned 0x0
	[0176.951] ReadFile (in: hFile=0x51c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x544, lpOverlapped=0x0) returned 1
	[0176.952] WriteFile (in: hFile=0x524, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x550, lpOverlapped=0x0) returned 1
	[0176.953] ReadFile (in: hFile=0x51c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.954] WriteFile (in: hFile=0x524, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.954] SetEndOfFile (hFile=0x524) returned 1
	[0176.954] CloseHandle (hObject=0x524) returned 1
	[0176.954] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.954] SetEndOfFile (hFile=0x51c) returned 1
	[0176.957] CloseHandle (hObject=0x51c) returned 1
	[0176.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 1
	[0176.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.958] lstrlenW (lpString=".doc") returned 4
	[0176.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.958] lstrlenW (lpString=".docx") returned 5
	[0176.958] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0176.958] lstrlenW (lpString=".pdf") returned 4
	[0176.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.958] lstrlenW (lpString=".xls") returned 4
	[0176.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.958] lstrlenW (lpString=".xlsx") returned 5
	[0176.958] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0176.958] lstrlenW (lpString=".ppt") returned 4
	[0176.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.958] lstrlenW (lpString=".zip") returned 4
	[0176.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.959] lstrlenW (lpString=".rar") returned 4
	[0176.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.959] lstrlenW (lpString=".bz2") returned 4
	[0176.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.959] lstrlenW (lpString=".7z") returned 3
	[0176.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.959] lstrlenW (lpString=".dbf") returned 4
	[0176.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.959] lstrlenW (lpString=".1cd") returned 4
	[0176.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.959] lstrlenW (lpString=".jpg") returned 4
	[0176.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.959] lstrlenW (lpString=".doc") returned 4
	[0176.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.959] lstrlenW (lpString=".docx") returned 5
	[0176.959] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0176.959] lstrlenW (lpString=".pdf") returned 4
	[0176.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.959] lstrlenW (lpString=".xls") returned 4
	[0176.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.959] lstrlenW (lpString=".xlsx") returned 5
	[0176.959] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0176.959] lstrlenW (lpString=".ppt") returned 4
	[0176.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.960] lstrlenW (lpString=".zip") returned 4
	[0176.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.960] lstrlenW (lpString=".rar") returned 4
	[0176.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.960] lstrlenW (lpString=".bz2") returned 4
	[0176.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.960] lstrlenW (lpString=".7z") returned 3
	[0176.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.960] lstrlenW (lpString=".dbf") returned 4
	[0176.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.960] lstrlenW (lpString=".1cd") returned 4
	[0176.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0176.960] lstrlenW (lpString=".jpg") returned 4
	[0176.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.960] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0176.960] lstrlenW (lpString="J0152696.WMF") returned 12
	[0176.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.961] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=7320) returned 1
	[0176.961] CloseHandle (hObject=0x51c) returned 1
	[0176.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 0x220
	[0176.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.962] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.962] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.963] GetLastError () returned 0x0
	[0176.963] ReadFile (in: hFile=0x51c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1c98, lpOverlapped=0x0) returned 1
	[0176.964] WriteFile (in: hFile=0x524, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1ca0, lpOverlapped=0x0) returned 1
	[0176.965] ReadFile (in: hFile=0x51c, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.965] WriteFile (in: hFile=0x524, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.966] SetEndOfFile (hFile=0x524) returned 1
	[0177.063] CloseHandle (hObject=0x524) returned 1
	[0177.072] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.083] SetEndOfFile (hFile=0x51c) returned 1
	[0177.086] CloseHandle (hObject=0x51c) returned 1
	[0177.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 1
	[0177.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.087] lstrlenW (lpString=".doc") returned 4
	[0177.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.087] lstrlenW (lpString=".docx") returned 5
	[0177.087] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.087] lstrlenW (lpString=".pdf") returned 4
	[0177.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.087] lstrlenW (lpString=".xls") returned 4
	[0177.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.087] lstrlenW (lpString=".xlsx") returned 5
	[0177.087] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.087] lstrlenW (lpString=".ppt") returned 4
	[0177.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.087] lstrlenW (lpString=".zip") returned 4
	[0177.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.087] lstrlenW (lpString=".rar") returned 4
	[0177.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.087] lstrlenW (lpString=".bz2") returned 4
	[0177.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.087] lstrlenW (lpString=".7z") returned 3
	[0177.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.087] lstrlenW (lpString=".dbf") returned 4
	[0177.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.088] lstrlenW (lpString=".1cd") returned 4
	[0177.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.088] lstrlenW (lpString=".jpg") returned 4
	[0177.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.088] lstrlenW (lpString=".doc") returned 4
	[0177.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.088] lstrlenW (lpString=".docx") returned 5
	[0177.088] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.088] lstrlenW (lpString=".pdf") returned 4
	[0177.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.088] lstrlenW (lpString=".xls") returned 4
	[0177.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.088] lstrlenW (lpString=".xlsx") returned 5
	[0177.088] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.088] lstrlenW (lpString=".ppt") returned 4
	[0177.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.088] lstrlenW (lpString=".zip") returned 4
	[0177.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.088] lstrlenW (lpString=".rar") returned 4
	[0177.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.088] lstrlenW (lpString=".bz2") returned 4
	[0177.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.088] lstrlenW (lpString=".7z") returned 3
	[0177.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.088] lstrlenW (lpString=".dbf") returned 4
	[0177.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.089] lstrlenW (lpString=".1cd") returned 4
	[0177.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0177.089] lstrlenW (lpString=".jpg") returned 4
	[0177.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.089] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0177.089] lstrlenW (lpString="J0152708.WMF") returned 12
	[0177.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.957] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=4908) returned 1
	[0177.962] CloseHandle (hObject=0x554) returned 1
	[0177.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 0x220
	[0177.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.962] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.962] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0178.163] GetLastError () returned 0x0
	[0178.163] ReadFile (in: hFile=0x554, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x132c, lpOverlapped=0x0) returned 1
	[0178.166] WriteFile (in: hFile=0x530, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1330, lpOverlapped=0x0) returned 1
	[0178.167] ReadFile (in: hFile=0x554, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.167] WriteFile (in: hFile=0x530, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.167] SetEndOfFile (hFile=0x530) returned 1
	[0178.167] CloseHandle (hObject=0x530) returned 1
	[0178.167] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.167] SetEndOfFile (hFile=0x554) returned 1
	[0178.170] CloseHandle (hObject=0x554) returned 1
	[0178.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 1
	[0178.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.171] lstrlenW (lpString=".doc") returned 4
	[0178.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.171] lstrlenW (lpString=".docx") returned 5
	[0178.172] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0178.172] lstrlenW (lpString=".pdf") returned 4
	[0178.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.172] lstrlenW (lpString=".xls") returned 4
	[0178.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.172] lstrlenW (lpString=".xlsx") returned 5
	[0178.172] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0178.172] lstrlenW (lpString=".ppt") returned 4
	[0178.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.172] lstrlenW (lpString=".zip") returned 4
	[0178.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.172] lstrlenW (lpString=".rar") returned 4
	[0178.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.172] lstrlenW (lpString=".bz2") returned 4
	[0178.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.172] lstrlenW (lpString=".7z") returned 3
	[0178.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.172] lstrlenW (lpString=".dbf") returned 4
	[0178.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.172] lstrlenW (lpString=".1cd") returned 4
	[0178.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.172] lstrlenW (lpString=".jpg") returned 4
	[0178.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.172] lstrlenW (lpString=".doc") returned 4
	[0178.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.173] lstrlenW (lpString=".docx") returned 5
	[0178.173] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0178.173] lstrlenW (lpString=".pdf") returned 4
	[0178.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.173] lstrlenW (lpString=".xls") returned 4
	[0178.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.173] lstrlenW (lpString=".xlsx") returned 5
	[0178.173] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0178.173] lstrlenW (lpString=".ppt") returned 4
	[0178.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.173] lstrlenW (lpString=".zip") returned 4
	[0178.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.173] lstrlenW (lpString=".rar") returned 4
	[0178.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.173] lstrlenW (lpString=".bz2") returned 4
	[0178.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.173] lstrlenW (lpString=".7z") returned 3
	[0178.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.173] lstrlenW (lpString=".dbf") returned 4
	[0178.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.173] lstrlenW (lpString=".1cd") returned 4
	[0178.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0178.173] lstrlenW (lpString=".jpg") returned 4
	[0178.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.174] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0178.174] lstrlenW (lpString="J0152890.WMF") returned 12
	[0178.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0178.174] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=1940) returned 1
	[0178.174] CloseHandle (hObject=0x554) returned 1
	[0178.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 0x220
	[0178.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0178.175] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.175] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0178.175] GetLastError () returned 0x0
	[0178.175] ReadFile (in: hFile=0x554, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x794, lpOverlapped=0x0) returned 1
	[0178.177] WriteFile (in: hFile=0x530, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x7a0, lpOverlapped=0x0) returned 1
	[0178.178] ReadFile (in: hFile=0x554, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.178] WriteFile (in: hFile=0x530, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.178] SetEndOfFile (hFile=0x530) returned 1
	[0178.178] CloseHandle (hObject=0x530) returned 1
	[0178.178] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.178] SetEndOfFile (hFile=0x554) returned 1
	[0178.181] CloseHandle (hObject=0x554) returned 1
	[0178.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 1
	[0178.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.182] lstrlenW (lpString=".doc") returned 4
	[0178.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.182] lstrlenW (lpString=".docx") returned 5
	[0178.182] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0178.182] lstrlenW (lpString=".pdf") returned 4
	[0178.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.183] lstrlenW (lpString=".xls") returned 4
	[0178.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.183] lstrlenW (lpString=".xlsx") returned 5
	[0178.183] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0178.183] lstrlenW (lpString=".ppt") returned 4
	[0178.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.183] lstrlenW (lpString=".zip") returned 4
	[0178.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.183] lstrlenW (lpString=".rar") returned 4
	[0178.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.183] lstrlenW (lpString=".bz2") returned 4
	[0178.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.183] lstrlenW (lpString=".7z") returned 3
	[0178.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.183] lstrlenW (lpString=".dbf") returned 4
	[0178.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.183] lstrlenW (lpString=".1cd") returned 4
	[0178.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.183] lstrlenW (lpString=".jpg") returned 4
	[0178.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.183] lstrlenW (lpString=".doc") returned 4
	[0178.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.183] lstrlenW (lpString=".docx") returned 5
	[0178.183] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0178.184] lstrlenW (lpString=".pdf") returned 4
	[0178.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.184] lstrlenW (lpString=".xls") returned 4
	[0178.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.184] lstrlenW (lpString=".xlsx") returned 5
	[0178.184] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0178.184] lstrlenW (lpString=".ppt") returned 4
	[0178.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.184] lstrlenW (lpString=".zip") returned 4
	[0178.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.184] lstrlenW (lpString=".rar") returned 4
	[0178.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.184] lstrlenW (lpString=".bz2") returned 4
	[0178.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.184] lstrlenW (lpString=".7z") returned 3
	[0178.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.184] lstrlenW (lpString=".dbf") returned 4
	[0178.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.184] lstrlenW (lpString=".1cd") returned 4
	[0178.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0178.184] lstrlenW (lpString=".jpg") returned 4
	[0178.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.184] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0178.185] lstrlenW (lpString="J0152892.WMF") returned 12
	[0178.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0178.186] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=10668) returned 1
	[0178.186] CloseHandle (hObject=0x554) returned 1
	[0178.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 0x220
	[0178.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0178.186] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.186] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0178.187] GetLastError () returned 0x0
	[0178.187] ReadFile (in: hFile=0x554, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x29ac, lpOverlapped=0x0) returned 1
	[0178.189] WriteFile (in: hFile=0x530, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0178.190] ReadFile (in: hFile=0x554, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.190] WriteFile (in: hFile=0x530, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.190] SetEndOfFile (hFile=0x530) returned 1
	[0178.190] CloseHandle (hObject=0x530) returned 1
	[0178.190] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.190] SetEndOfFile (hFile=0x554) returned 1
	[0178.192] CloseHandle (hObject=0x554) returned 1
	[0178.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 1
	[0178.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.194] lstrlenW (lpString=".doc") returned 4
	[0178.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.194] lstrlenW (lpString=".docx") returned 5
	[0178.194] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0178.194] lstrlenW (lpString=".pdf") returned 4
	[0178.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.194] lstrlenW (lpString=".xls") returned 4
	[0178.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.194] lstrlenW (lpString=".xlsx") returned 5
	[0178.194] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0178.194] lstrlenW (lpString=".ppt") returned 4
	[0178.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.194] lstrlenW (lpString=".zip") returned 4
	[0178.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.194] lstrlenW (lpString=".rar") returned 4
	[0178.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.194] lstrlenW (lpString=".bz2") returned 4
	[0178.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.194] lstrlenW (lpString=".7z") returned 3
	[0178.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.194] lstrlenW (lpString=".dbf") returned 4
	[0178.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.194] lstrlenW (lpString=".1cd") returned 4
	[0178.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.194] lstrlenW (lpString=".jpg") returned 4
	[0178.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.195] lstrlenW (lpString=".doc") returned 4
	[0178.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.195] lstrlenW (lpString=".docx") returned 5
	[0178.195] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0178.195] lstrlenW (lpString=".pdf") returned 4
	[0178.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.195] lstrlenW (lpString=".xls") returned 4
	[0178.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.195] lstrlenW (lpString=".xlsx") returned 5
	[0178.195] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0178.195] lstrlenW (lpString=".ppt") returned 4
	[0178.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.195] lstrlenW (lpString=".zip") returned 4
	[0178.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.195] lstrlenW (lpString=".rar") returned 4
	[0178.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.195] lstrlenW (lpString=".bz2") returned 4
	[0178.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.195] lstrlenW (lpString=".7z") returned 3
	[0178.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.195] lstrlenW (lpString=".dbf") returned 4
	[0178.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.195] lstrlenW (lpString=".1cd") returned 4
	[0178.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0178.195] lstrlenW (lpString=".jpg") returned 4
	[0178.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.196] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0178.196] lstrlenW (lpString="J0152894.WMF") returned 12
	[0178.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0178.197] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=11348) returned 1
	[0178.197] CloseHandle (hObject=0x554) returned 1
	[0178.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 0x220
	[0178.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0178.197] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.197] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0178.198] GetLastError () returned 0x0
	[0178.198] ReadFile (in: hFile=0x554, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x2c54, lpOverlapped=0x0) returned 1
	[0178.489] WriteFile (in: hFile=0x530, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x2c60, lpOverlapped=0x0) returned 1
	[0178.490] ReadFile (in: hFile=0x554, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.490] WriteFile (in: hFile=0x530, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.490] SetEndOfFile (hFile=0x530) returned 1
	[0178.490] CloseHandle (hObject=0x530) returned 1
	[0178.491] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.491] SetEndOfFile (hFile=0x554) returned 1
	[0178.493] CloseHandle (hObject=0x554) returned 1
	[0178.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 1
	[0179.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.358] lstrlenW (lpString=".doc") returned 4
	[0179.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.358] lstrlenW (lpString=".docx") returned 5
	[0179.358] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0179.358] lstrlenW (lpString=".pdf") returned 4
	[0179.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.358] lstrlenW (lpString=".xls") returned 4
	[0179.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.359] lstrlenW (lpString=".xlsx") returned 5
	[0179.359] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0179.359] lstrlenW (lpString=".ppt") returned 4
	[0179.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.359] lstrlenW (lpString=".zip") returned 4
	[0179.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.359] lstrlenW (lpString=".rar") returned 4
	[0179.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.359] lstrlenW (lpString=".bz2") returned 4
	[0179.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.359] lstrlenW (lpString=".7z") returned 3
	[0179.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.359] lstrlenW (lpString=".dbf") returned 4
	[0179.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.359] lstrlenW (lpString=".1cd") returned 4
	[0179.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.359] lstrlenW (lpString=".jpg") returned 4
	[0179.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.359] lstrlenW (lpString=".doc") returned 4
	[0179.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.359] lstrlenW (lpString=".docx") returned 5
	[0179.359] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0179.359] lstrlenW (lpString=".pdf") returned 4
	[0179.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.359] lstrlenW (lpString=".xls") returned 4
	[0179.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.360] lstrlenW (lpString=".xlsx") returned 5
	[0179.360] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0179.360] lstrlenW (lpString=".ppt") returned 4
	[0179.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.360] lstrlenW (lpString=".zip") returned 4
	[0179.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.360] lstrlenW (lpString=".rar") returned 4
	[0179.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.360] lstrlenW (lpString=".bz2") returned 4
	[0179.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.360] lstrlenW (lpString=".7z") returned 3
	[0179.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.360] lstrlenW (lpString=".dbf") returned 4
	[0179.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.360] lstrlenW (lpString=".1cd") returned 4
	[0179.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0179.360] lstrlenW (lpString=".jpg") returned 4
	[0179.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.360] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.360] lstrlenW (lpString="J0153299.WMF") returned 12
	[0179.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.432] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=36620) returned 1
	[0179.432] CloseHandle (hObject=0x4e4) returned 1
	[0179.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 0x220
	[0179.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0179.836] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.837] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0179.946] GetLastError () returned 0x0
	[0179.946] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x8f0c, lpOverlapped=0x0) returned 1
	[0179.949] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x8f10, lpOverlapped=0x0) returned 1
	[0179.950] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.950] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.950] SetEndOfFile (hFile=0x4b8) returned 1
	[0179.950] CloseHandle (hObject=0x4b8) returned 1
	[0179.950] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.950] SetEndOfFile (hFile=0x4e0) returned 1
	[0179.953] CloseHandle (hObject=0x4e0) returned 1
	[0179.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 1
	[0179.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.954] lstrlenW (lpString=".doc") returned 4
	[0179.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.955] lstrlenW (lpString=".docx") returned 5
	[0179.955] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0179.955] lstrlenW (lpString=".pdf") returned 4
	[0179.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.955] lstrlenW (lpString=".xls") returned 4
	[0179.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.955] lstrlenW (lpString=".xlsx") returned 5
	[0179.955] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0179.955] lstrlenW (lpString=".ppt") returned 4
	[0179.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.955] lstrlenW (lpString=".zip") returned 4
	[0179.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.955] lstrlenW (lpString=".rar") returned 4
	[0179.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.955] lstrlenW (lpString=".bz2") returned 4
	[0179.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.955] lstrlenW (lpString=".7z") returned 3
	[0179.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.955] lstrlenW (lpString=".dbf") returned 4
	[0179.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.955] lstrlenW (lpString=".1cd") returned 4
	[0179.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.955] lstrlenW (lpString=".jpg") returned 4
	[0179.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.956] lstrlenW (lpString=".doc") returned 4
	[0179.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.956] lstrlenW (lpString=".docx") returned 5
	[0179.956] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0179.956] lstrlenW (lpString=".pdf") returned 4
	[0179.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.956] lstrlenW (lpString=".xls") returned 4
	[0179.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.956] lstrlenW (lpString=".xlsx") returned 5
	[0179.956] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0179.956] lstrlenW (lpString=".ppt") returned 4
	[0179.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.956] lstrlenW (lpString=".zip") returned 4
	[0179.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.956] lstrlenW (lpString=".rar") returned 4
	[0179.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.956] lstrlenW (lpString=".bz2") returned 4
	[0179.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.956] lstrlenW (lpString=".7z") returned 3
	[0179.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.956] lstrlenW (lpString=".dbf") returned 4
	[0179.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.956] lstrlenW (lpString=".1cd") returned 4
	[0179.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68
	[0179.956] lstrlenW (lpString=".jpg") returned 4
	[0179.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.957] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.957] lstrlenW (lpString="J0156537.WMF") returned 12
	[0179.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0179.958] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=1376) returned 1
	[0179.958] CloseHandle (hObject=0x4e0) returned 1
	[0179.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 0x220
	[0179.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0179.958] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.958] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0179.959] GetLastError () returned 0x0
	[0179.959] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x560, lpOverlapped=0x0) returned 1
	[0179.960] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x570, lpOverlapped=0x0) returned 1
	[0179.961] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.961] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.962] SetEndOfFile (hFile=0x4b8) returned 1
	[0179.962] CloseHandle (hObject=0x4b8) returned 1
	[0179.962] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.962] SetEndOfFile (hFile=0x4e0) returned 1
	[0179.964] CloseHandle (hObject=0x4e0) returned 1
	[0179.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 1
	[0179.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.965] lstrlenW (lpString=".doc") returned 4
	[0179.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.965] lstrlenW (lpString=".docx") returned 5
	[0179.965] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0179.965] lstrlenW (lpString=".pdf") returned 4
	[0179.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.965] lstrlenW (lpString=".xls") returned 4
	[0179.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.965] lstrlenW (lpString=".xlsx") returned 5
	[0179.966] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0179.966] lstrlenW (lpString=".ppt") returned 4
	[0179.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.966] lstrlenW (lpString=".zip") returned 4
	[0179.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.966] lstrlenW (lpString=".rar") returned 4
	[0179.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.966] lstrlenW (lpString=".bz2") returned 4
	[0179.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.966] lstrlenW (lpString=".7z") returned 3
	[0179.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.966] lstrlenW (lpString=".dbf") returned 4
	[0179.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.966] lstrlenW (lpString=".1cd") returned 4
	[0179.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.966] lstrlenW (lpString=".jpg") returned 4
	[0179.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.966] lstrlenW (lpString=".doc") returned 4
	[0179.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.966] lstrlenW (lpString=".docx") returned 5
	[0179.966] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0179.966] lstrlenW (lpString=".pdf") returned 4
	[0179.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.966] lstrlenW (lpString=".xls") returned 4
	[0179.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.967] lstrlenW (lpString=".xlsx") returned 5
	[0179.967] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0179.967] lstrlenW (lpString=".ppt") returned 4
	[0179.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.967] lstrlenW (lpString=".zip") returned 4
	[0179.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.967] lstrlenW (lpString=".rar") returned 4
	[0179.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.967] lstrlenW (lpString=".bz2") returned 4
	[0179.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.967] lstrlenW (lpString=".7z") returned 3
	[0179.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.967] lstrlenW (lpString=".dbf") returned 4
	[0179.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.967] lstrlenW (lpString=".1cd") returned 4
	[0179.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68
	[0179.967] lstrlenW (lpString=".jpg") returned 4
	[0179.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.967] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.967] lstrlenW (lpString="J0157167.WMF") returned 12
	[0179.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0179.968] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=46702) returned 1
	[0179.968] CloseHandle (hObject=0x4e0) returned 1
	[0179.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf")) returned 0x220
	[0179.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0179.969] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.969] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0179.970] GetLastError () returned 0x0
	[0179.970] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xb66e, lpOverlapped=0x0) returned 1
	[0179.973] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xb670, lpOverlapped=0x0) returned 1
	[0179.974] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.974] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.974] SetEndOfFile (hFile=0x4b8) returned 1
	[0179.974] CloseHandle (hObject=0x4b8) returned 1
	[0179.975] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.975] SetEndOfFile (hFile=0x4e0) returned 1
	[0179.978] CloseHandle (hObject=0x4e0) returned 1
	[0179.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf")) returned 1
	[0179.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.980] lstrlenW (lpString=".doc") returned 4
	[0179.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.980] lstrlenW (lpString=".docx") returned 5
	[0179.980] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0179.980] lstrlenW (lpString=".pdf") returned 4
	[0179.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.980] lstrlenW (lpString=".xls") returned 4
	[0179.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.980] lstrlenW (lpString=".xlsx") returned 5
	[0179.980] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0179.980] lstrlenW (lpString=".ppt") returned 4
	[0179.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.980] lstrlenW (lpString=".zip") returned 4
	[0179.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.980] lstrlenW (lpString=".rar") returned 4
	[0179.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.980] lstrlenW (lpString=".bz2") returned 4
	[0179.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.980] lstrlenW (lpString=".7z") returned 3
	[0179.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.980] lstrlenW (lpString=".dbf") returned 4
	[0179.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.980] lstrlenW (lpString=".1cd") returned 4
	[0179.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.981] lstrlenW (lpString=".jpg") returned 4
	[0179.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.981] lstrlenW (lpString=".doc") returned 4
	[0179.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.981] lstrlenW (lpString=".docx") returned 5
	[0179.981] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0179.981] lstrlenW (lpString=".pdf") returned 4
	[0179.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.981] lstrlenW (lpString=".xls") returned 4
	[0179.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.981] lstrlenW (lpString=".xlsx") returned 5
	[0179.981] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0179.981] lstrlenW (lpString=".ppt") returned 4
	[0179.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.981] lstrlenW (lpString=".zip") returned 4
	[0179.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.981] lstrlenW (lpString=".rar") returned 4
	[0179.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.981] lstrlenW (lpString=".bz2") returned 4
	[0179.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.981] lstrlenW (lpString=".7z") returned 3
	[0179.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.981] lstrlenW (lpString=".dbf") returned 4
	[0179.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.982] lstrlenW (lpString=".1cd") returned 4
	[0179.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68
	[0179.982] lstrlenW (lpString=".jpg") returned 4
	[0179.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.982] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0179.982] lstrlenW (lpString="J0157177.WMF") returned 12
	[0179.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0179.982] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=21716) returned 1
	[0179.983] CloseHandle (hObject=0x4e0) returned 1
	[0179.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 0x220
	[0179.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0179.983] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.983] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0179.984] GetLastError () returned 0x0
	[0179.984] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x54d4, lpOverlapped=0x0) returned 1
	[0180.362] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x54e0, lpOverlapped=0x0) returned 1
	[0180.364] ReadFile (in: hFile=0x4e0, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.364] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.364] SetEndOfFile (hFile=0x4b8) returned 1
	[0180.364] CloseHandle (hObject=0x4b8) returned 1
	[0180.364] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.364] SetEndOfFile (hFile=0x4e0) returned 1
	[0180.367] CloseHandle (hObject=0x4e0) returned 1
	[0180.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 1
	[0181.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.046] lstrlenW (lpString=".doc") returned 4
	[0181.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.046] lstrlenW (lpString=".docx") returned 5
	[0181.047] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0181.047] lstrlenW (lpString=".pdf") returned 4
	[0181.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.047] lstrlenW (lpString=".xls") returned 4
	[0181.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.047] lstrlenW (lpString=".xlsx") returned 5
	[0181.047] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0181.047] lstrlenW (lpString=".ppt") returned 4
	[0181.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.047] lstrlenW (lpString=".zip") returned 4
	[0181.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.047] lstrlenW (lpString=".rar") returned 4
	[0181.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.047] lstrlenW (lpString=".bz2") returned 4
	[0181.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.047] lstrlenW (lpString=".7z") returned 3
	[0181.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.047] lstrlenW (lpString=".dbf") returned 4
	[0181.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.047] lstrlenW (lpString=".1cd") returned 4
	[0181.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.047] lstrlenW (lpString=".jpg") returned 4
	[0181.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.047] lstrlenW (lpString=".doc") returned 4
	[0181.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.048] lstrlenW (lpString=".docx") returned 5
	[0181.048] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0181.048] lstrlenW (lpString=".pdf") returned 4
	[0181.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.048] lstrlenW (lpString=".xls") returned 4
	[0181.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.048] lstrlenW (lpString=".xlsx") returned 5
	[0181.048] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0181.048] lstrlenW (lpString=".ppt") returned 4
	[0181.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.048] lstrlenW (lpString=".zip") returned 4
	[0181.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.048] lstrlenW (lpString=".rar") returned 4
	[0181.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.048] lstrlenW (lpString=".bz2") returned 4
	[0181.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.048] lstrlenW (lpString=".7z") returned 3
	[0181.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.048] lstrlenW (lpString=".dbf") returned 4
	[0181.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.048] lstrlenW (lpString=".1cd") returned 4
	[0181.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68
	[0181.048] lstrlenW (lpString=".jpg") returned 4
	[0181.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.049] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0181.049] lstrlenW (lpString="J0172035.WMF") returned 12
	[0181.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0181.181] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=7448) returned 1
	[0181.181] CloseHandle (hObject=0x424) returned 1
	[0181.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 0x220
	[0181.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0181.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0181.551] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.551] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0181.552] GetLastError () returned 0x0
	[0181.552] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x1d18, lpOverlapped=0x0) returned 1
	[0181.554] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x1d20, lpOverlapped=0x0) returned 1
	[0181.555] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.555] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.555] SetEndOfFile (hFile=0x4bc) returned 1
	[0181.555] CloseHandle (hObject=0x4bc) returned 1
	[0181.555] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.555] SetEndOfFile (hFile=0x444) returned 1
	[0181.557] CloseHandle (hObject=0x444) returned 1
	[0181.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0181.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 1
	[0181.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.559] lstrlenW (lpString=".doc") returned 4
	[0181.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.559] lstrlenW (lpString=".docx") returned 5
	[0181.559] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0181.559] lstrlenW (lpString=".pdf") returned 4
	[0181.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.559] lstrlenW (lpString=".xls") returned 4
	[0181.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.559] lstrlenW (lpString=".xlsx") returned 5
	[0181.559] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0181.559] lstrlenW (lpString=".ppt") returned 4
	[0181.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.559] lstrlenW (lpString=".zip") returned 4
	[0181.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.559] lstrlenW (lpString=".rar") returned 4
	[0181.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.559] lstrlenW (lpString=".bz2") returned 4
	[0181.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.559] lstrlenW (lpString=".7z") returned 3
	[0181.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.559] lstrlenW (lpString=".dbf") returned 4
	[0181.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.559] lstrlenW (lpString=".1cd") returned 4
	[0181.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.559] lstrlenW (lpString=".jpg") returned 4
	[0181.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.560] lstrlenW (lpString=".doc") returned 4
	[0181.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.560] lstrlenW (lpString=".docx") returned 5
	[0181.560] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0181.560] lstrlenW (lpString=".pdf") returned 4
	[0181.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.560] lstrlenW (lpString=".xls") returned 4
	[0181.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.560] lstrlenW (lpString=".xlsx") returned 5
	[0181.560] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0181.560] lstrlenW (lpString=".ppt") returned 4
	[0181.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.560] lstrlenW (lpString=".zip") returned 4
	[0181.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.560] lstrlenW (lpString=".rar") returned 4
	[0181.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.560] lstrlenW (lpString=".bz2") returned 4
	[0181.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.560] lstrlenW (lpString=".7z") returned 3
	[0181.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.560] lstrlenW (lpString=".dbf") returned 4
	[0181.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.560] lstrlenW (lpString=".1cd") returned 4
	[0181.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68
	[0181.560] lstrlenW (lpString=".jpg") returned 4
	[0181.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.561] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0181.561] lstrlenW (lpString="J0172193.WMF") returned 12
	[0181.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0181.562] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=12696) returned 1
	[0181.562] CloseHandle (hObject=0x444) returned 1
	[0181.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf")) returned 0x220
	[0181.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0181.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0181.562] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.562] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0181.563] GetLastError () returned 0x0
	[0181.563] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x3198, lpOverlapped=0x0) returned 1
	[0181.565] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x31a0, lpOverlapped=0x0) returned 1
	[0181.566] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.566] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.566] SetEndOfFile (hFile=0x4bc) returned 1
	[0181.566] CloseHandle (hObject=0x4bc) returned 1
	[0181.566] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.566] SetEndOfFile (hFile=0x444) returned 1
	[0181.570] CloseHandle (hObject=0x444) returned 1
	[0181.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0181.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf")) returned 1
	[0181.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.572] lstrlenW (lpString=".doc") returned 4
	[0181.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.572] lstrlenW (lpString=".docx") returned 5
	[0181.572] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0181.572] lstrlenW (lpString=".pdf") returned 4
	[0181.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.572] lstrlenW (lpString=".xls") returned 4
	[0181.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.572] lstrlenW (lpString=".xlsx") returned 5
	[0181.572] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0181.572] lstrlenW (lpString=".ppt") returned 4
	[0181.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.572] lstrlenW (lpString=".zip") returned 4
	[0181.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.572] lstrlenW (lpString=".rar") returned 4
	[0181.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.572] lstrlenW (lpString=".bz2") returned 4
	[0181.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.573] lstrlenW (lpString=".7z") returned 3
	[0181.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.573] lstrlenW (lpString=".dbf") returned 4
	[0181.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.573] lstrlenW (lpString=".1cd") returned 4
	[0181.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.573] lstrlenW (lpString=".jpg") returned 4
	[0181.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.573] lstrlenW (lpString=".doc") returned 4
	[0181.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.573] lstrlenW (lpString=".docx") returned 5
	[0181.573] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0181.573] lstrlenW (lpString=".pdf") returned 4
	[0181.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.573] lstrlenW (lpString=".xls") returned 4
	[0181.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.573] lstrlenW (lpString=".xlsx") returned 5
	[0181.573] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0181.573] lstrlenW (lpString=".ppt") returned 4
	[0181.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.573] lstrlenW (lpString=".zip") returned 4
	[0181.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.573] lstrlenW (lpString=".rar") returned 4
	[0181.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.574] lstrlenW (lpString=".bz2") returned 4
	[0181.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.574] lstrlenW (lpString=".7z") returned 3
	[0181.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.574] lstrlenW (lpString=".dbf") returned 4
	[0181.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.574] lstrlenW (lpString=".1cd") returned 4
	[0181.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68
	[0181.574] lstrlenW (lpString=".jpg") returned 4
	[0181.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.574] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0181.574] lstrlenW (lpString="J0174315.WMF") returned 12
	[0181.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0181.575] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=5864) returned 1
	[0181.575] CloseHandle (hObject=0x444) returned 1
	[0181.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 0x220
	[0181.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0181.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0181.576] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.576] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0181.577] GetLastError () returned 0x0
	[0181.577] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x16e8, lpOverlapped=0x0) returned 1
	[0181.578] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x16f0, lpOverlapped=0x0) returned 1
	[0181.579] ReadFile (in: hFile=0x444, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.579] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.579] SetEndOfFile (hFile=0x4bc) returned 1
	[0181.579] CloseHandle (hObject=0x4bc) returned 1
	[0181.580] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.580] SetEndOfFile (hFile=0x444) returned 1
	[0181.583] CloseHandle (hObject=0x444) returned 1
	[0181.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0181.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 1
	[0181.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.584] lstrlenW (lpString=".doc") returned 4
	[0181.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.584] lstrlenW (lpString=".docx") returned 5
	[0181.584] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0181.584] lstrlenW (lpString=".pdf") returned 4
	[0181.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.584] lstrlenW (lpString=".xls") returned 4
	[0181.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.584] lstrlenW (lpString=".xlsx") returned 5
	[0181.584] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0181.584] lstrlenW (lpString=".ppt") returned 4
	[0181.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.584] lstrlenW (lpString=".zip") returned 4
	[0181.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.584] lstrlenW (lpString=".rar") returned 4
	[0181.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.584] lstrlenW (lpString=".bz2") returned 4
	[0181.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.584] lstrlenW (lpString=".7z") returned 3
	[0181.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.584] lstrlenW (lpString=".dbf") returned 4
	[0181.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.584] lstrlenW (lpString=".1cd") returned 4
	[0181.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.585] lstrlenW (lpString=".jpg") returned 4
	[0181.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.585] lstrlenW (lpString=".doc") returned 4
	[0181.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.585] lstrlenW (lpString=".docx") returned 5
	[0181.585] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0181.585] lstrlenW (lpString=".pdf") returned 4
	[0181.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.585] lstrlenW (lpString=".xls") returned 4
	[0181.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.585] lstrlenW (lpString=".xlsx") returned 5
	[0181.585] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0181.585] lstrlenW (lpString=".ppt") returned 4
	[0181.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.585] lstrlenW (lpString=".zip") returned 4
	[0181.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.585] lstrlenW (lpString=".rar") returned 4
	[0181.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.585] lstrlenW (lpString=".bz2") returned 4
	[0181.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.585] lstrlenW (lpString=".7z") returned 3
	[0181.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.585] lstrlenW (lpString=".dbf") returned 4
	[0181.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.585] lstrlenW (lpString=".1cd") returned 4
	[0181.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68
	[0181.586] lstrlenW (lpString=".jpg") returned 4
	[0181.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.586] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0181.586] lstrlenW (lpString="J0174635.WMF") returned 12
	[0181.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.017] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=9736) returned 1
	[0182.017] CloseHandle (hObject=0x534) returned 1
	[0182.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 0x220
	[0182.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.019] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.019] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0182.020] GetLastError () returned 0x0
	[0182.020] ReadFile (in: hFile=0x534, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x2608, lpOverlapped=0x0) returned 1
	[0182.022] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x2610, lpOverlapped=0x0) returned 1
	[0182.023] ReadFile (in: hFile=0x534, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.023] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.024] SetEndOfFile (hFile=0x500) returned 1
	[0182.024] CloseHandle (hObject=0x500) returned 1
	[0182.024] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.024] SetEndOfFile (hFile=0x534) returned 1
	[0182.027] CloseHandle (hObject=0x534) returned 1
	[0182.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 1
	[0182.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.029] lstrlenW (lpString=".doc") returned 4
	[0182.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.029] lstrlenW (lpString=".docx") returned 5
	[0182.029] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0182.029] lstrlenW (lpString=".pdf") returned 4
	[0182.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.030] lstrlenW (lpString=".xls") returned 4
	[0182.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.030] lstrlenW (lpString=".xlsx") returned 5
	[0182.030] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0182.030] lstrlenW (lpString=".ppt") returned 4
	[0182.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.030] lstrlenW (lpString=".zip") returned 4
	[0182.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.030] lstrlenW (lpString=".rar") returned 4
	[0182.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.030] lstrlenW (lpString=".bz2") returned 4
	[0182.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.030] lstrlenW (lpString=".7z") returned 3
	[0182.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.030] lstrlenW (lpString=".dbf") returned 4
	[0182.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.030] lstrlenW (lpString=".1cd") returned 4
	[0182.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.030] lstrlenW (lpString=".jpg") returned 4
	[0182.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.030] lstrlenW (lpString=".doc") returned 4
	[0182.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.030] lstrlenW (lpString=".docx") returned 5
	[0182.030] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0182.031] lstrlenW (lpString=".pdf") returned 4
	[0182.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.031] lstrlenW (lpString=".xls") returned 4
	[0182.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.031] lstrlenW (lpString=".xlsx") returned 5
	[0182.031] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0182.031] lstrlenW (lpString=".ppt") returned 4
	[0182.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.031] lstrlenW (lpString=".zip") returned 4
	[0182.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.031] lstrlenW (lpString=".rar") returned 4
	[0182.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.031] lstrlenW (lpString=".bz2") returned 4
	[0182.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.031] lstrlenW (lpString=".7z") returned 3
	[0182.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.031] lstrlenW (lpString=".dbf") returned 4
	[0182.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.031] lstrlenW (lpString=".1cd") returned 4
	[0182.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68
	[0182.031] lstrlenW (lpString=".jpg") returned 4
	[0182.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.031] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.031] lstrlenW (lpString="J0174952.JPG") returned 12
	[0182.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.033] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=24982) returned 1
	[0182.033] CloseHandle (hObject=0x534) returned 1
	[0182.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg")) returned 0x220
	[0182.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.034] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.034] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0182.036] GetLastError () returned 0x0
	[0182.036] ReadFile (in: hFile=0x534, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x6196, lpOverlapped=0x0) returned 1
	[0182.038] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x61a0, lpOverlapped=0x0) returned 1
	[0182.039] ReadFile (in: hFile=0x534, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.039] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.039] SetEndOfFile (hFile=0x500) returned 1
	[0182.039] CloseHandle (hObject=0x500) returned 1
	[0182.039] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.039] SetEndOfFile (hFile=0x534) returned 1
	[0182.048] CloseHandle (hObject=0x534) returned 1
	[0182.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg")) returned 1
	[0182.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.049] lstrlenW (lpString=".doc") returned 4
	[0182.049] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.049] lstrlenW (lpString=".docx") returned 5
	[0182.049] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0182.049] lstrlenW (lpString=".pdf") returned 4
	[0182.049] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.049] lstrlenW (lpString=".xls") returned 4
	[0182.049] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.049] lstrlenW (lpString=".xlsx") returned 5
	[0182.049] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0182.050] lstrlenW (lpString=".ppt") returned 4
	[0182.050] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.050] lstrlenW (lpString=".zip") returned 4
	[0182.050] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.050] lstrlenW (lpString=".rar") returned 4
	[0182.050] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.050] lstrlenW (lpString=".bz2") returned 4
	[0182.050] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.050] lstrlenW (lpString=".7z") returned 3
	[0182.050] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.050] lstrlenW (lpString=".dbf") returned 4
	[0182.050] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.050] lstrlenW (lpString=".1cd") returned 4
	[0182.050] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.050] lstrlenW (lpString=".jpg") returned 4
	[0182.050] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.050] lstrlenW (lpString=".doc") returned 4
	[0182.050] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.050] lstrlenW (lpString=".docx") returned 5
	[0182.050] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0182.050] lstrlenW (lpString=".pdf") returned 4
	[0182.050] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.050] lstrlenW (lpString=".xls") returned 4
	[0182.050] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.050] lstrlenW (lpString=".xlsx") returned 5
	[0182.051] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0182.051] lstrlenW (lpString=".ppt") returned 4
	[0182.051] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.051] lstrlenW (lpString=".zip") returned 4
	[0182.051] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.051] lstrlenW (lpString=".rar") returned 4
	[0182.051] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.051] lstrlenW (lpString=".bz2") returned 4
	[0182.051] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.051] lstrlenW (lpString=".7z") returned 3
	[0182.051] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.051] lstrlenW (lpString=".dbf") returned 4
	[0182.051] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.051] lstrlenW (lpString=".1cd") returned 4
	[0182.051] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68
	[0182.051] lstrlenW (lpString=".jpg") returned 4
	[0182.051] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.051] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.051] lstrlenW (lpString="J0175361.JPG") returned 12
	[0182.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.053] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=46461) returned 1
	[0182.053] CloseHandle (hObject=0x534) returned 1
	[0182.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 0x220
	[0182.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.053] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.053] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0182.054] GetLastError () returned 0x0
	[0182.054] ReadFile (in: hFile=0x534, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xb57d, lpOverlapped=0x0) returned 1
	[0182.057] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xb580, lpOverlapped=0x0) returned 1
	[0182.059] ReadFile (in: hFile=0x534, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.059] WriteFile (in: hFile=0x500, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.059] SetEndOfFile (hFile=0x500) returned 1
	[0182.059] CloseHandle (hObject=0x500) returned 1
	[0182.059] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.059] SetEndOfFile (hFile=0x534) returned 1
	[0182.261] CloseHandle (hObject=0x534) returned 1
	[0182.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 1
	[0182.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.263] lstrlenW (lpString=".doc") returned 4
	[0182.263] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.263] lstrlenW (lpString=".docx") returned 5
	[0182.263] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0182.263] lstrlenW (lpString=".pdf") returned 4
	[0182.263] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.263] lstrlenW (lpString=".xls") returned 4
	[0182.263] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.263] lstrlenW (lpString=".xlsx") returned 5
	[0182.263] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0182.263] lstrlenW (lpString=".ppt") returned 4
	[0182.263] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.263] lstrlenW (lpString=".zip") returned 4
	[0182.263] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.263] lstrlenW (lpString=".rar") returned 4
	[0182.263] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.263] lstrlenW (lpString=".bz2") returned 4
	[0182.263] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.263] lstrlenW (lpString=".7z") returned 3
	[0182.263] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.263] lstrlenW (lpString=".dbf") returned 4
	[0182.263] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.263] lstrlenW (lpString=".1cd") returned 4
	[0182.263] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.263] lstrlenW (lpString=".jpg") returned 4
	[0182.263] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.264] lstrlenW (lpString=".doc") returned 4
	[0182.264] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.264] lstrlenW (lpString=".docx") returned 5
	[0182.264] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0182.264] lstrlenW (lpString=".pdf") returned 4
	[0182.264] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.264] lstrlenW (lpString=".xls") returned 4
	[0182.264] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.264] lstrlenW (lpString=".xlsx") returned 5
	[0182.264] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0182.264] lstrlenW (lpString=".ppt") returned 4
	[0182.264] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.264] lstrlenW (lpString=".zip") returned 4
	[0182.264] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.264] lstrlenW (lpString=".rar") returned 4
	[0182.264] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.264] lstrlenW (lpString=".bz2") returned 4
	[0182.264] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.264] lstrlenW (lpString=".7z") returned 3
	[0182.264] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.264] lstrlenW (lpString=".dbf") returned 4
	[0182.264] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.264] lstrlenW (lpString=".1cd") returned 4
	[0182.264] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68
	[0182.264] lstrlenW (lpString=".jpg") returned 4
	[0182.265] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.265] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.265] lstrlenW (lpString="J0177806.JPG") returned 12
	[0182.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.265] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=55554) returned 1
	[0182.265] CloseHandle (hObject=0x534) returned 1
	[0182.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg")) returned 0x220
	[0182.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.266] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.266] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0182.267] GetLastError () returned 0x0
	[0182.267] ReadFile (in: hFile=0x534, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0xd902, lpOverlapped=0x0) returned 1
	[0182.269] WriteFile (in: hFile=0x54c, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xd910, lpOverlapped=0x0) returned 1
	[0182.271] ReadFile (in: hFile=0x534, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.271] WriteFile (in: hFile=0x54c, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.271] SetEndOfFile (hFile=0x54c) returned 1
	[0182.271] CloseHandle (hObject=0x54c) returned 1
	[0182.272] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.272] SetEndOfFile (hFile=0x534) returned 1
	[0182.275] CloseHandle (hObject=0x534) returned 1
	[0182.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg")) returned 1
	[0182.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.277] lstrlenW (lpString=".doc") returned 4
	[0182.277] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.277] lstrlenW (lpString=".docx") returned 5
	[0182.277] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0182.277] lstrlenW (lpString=".pdf") returned 4
	[0182.277] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.277] lstrlenW (lpString=".xls") returned 4
	[0182.277] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.277] lstrlenW (lpString=".xlsx") returned 5
	[0182.277] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0182.277] lstrlenW (lpString=".ppt") returned 4
	[0182.277] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.277] lstrlenW (lpString=".zip") returned 4
	[0182.277] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.277] lstrlenW (lpString=".rar") returned 4
	[0182.277] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.277] lstrlenW (lpString=".bz2") returned 4
	[0182.277] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.277] lstrlenW (lpString=".7z") returned 3
	[0182.277] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.277] lstrlenW (lpString=".dbf") returned 4
	[0182.277] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.277] lstrlenW (lpString=".1cd") returned 4
	[0182.277] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.277] lstrlenW (lpString=".jpg") returned 4
	[0182.277] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.278] lstrlenW (lpString=".doc") returned 4
	[0182.278] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.278] lstrlenW (lpString=".docx") returned 5
	[0182.278] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0182.278] lstrlenW (lpString=".pdf") returned 4
	[0182.278] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.278] lstrlenW (lpString=".xls") returned 4
	[0182.278] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.278] lstrlenW (lpString=".xlsx") returned 5
	[0182.278] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0182.278] lstrlenW (lpString=".ppt") returned 4
	[0182.278] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.278] lstrlenW (lpString=".zip") returned 4
	[0182.278] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.278] lstrlenW (lpString=".rar") returned 4
	[0182.278] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.278] lstrlenW (lpString=".bz2") returned 4
	[0182.278] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.278] lstrlenW (lpString=".7z") returned 3
	[0182.278] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.278] lstrlenW (lpString=".dbf") returned 4
	[0182.278] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.278] lstrlenW (lpString=".1cd") returned 4
	[0182.278] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68
	[0182.278] lstrlenW (lpString=".jpg") returned 4
	[0182.278] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.279] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.279] lstrlenW (lpString="J0178348.JPG") returned 12
	[0182.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.279] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=36989) returned 1
	[0182.279] CloseHandle (hObject=0x534) returned 1
	[0182.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 0x220
	[0182.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0182.280] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.280] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0182.281] GetLastError () returned 0x0
	[0182.281] ReadFile (in: hFile=0x534, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x907d, lpOverlapped=0x0) returned 1
	[0182.283] WriteFile (in: hFile=0x54c, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x9080, lpOverlapped=0x0) returned 1
	[0182.288] ReadFile (in: hFile=0x534, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.288] WriteFile (in: hFile=0x54c, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.288] SetEndOfFile (hFile=0x54c) returned 1
	[0182.288] CloseHandle (hObject=0x54c) returned 1
	[0182.288] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.288] SetEndOfFile (hFile=0x534) returned 1
	[0182.503] CloseHandle (hObject=0x534) returned 1
	[0182.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 1
	[0182.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.791] lstrlenW (lpString=".doc") returned 4
	[0182.791] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.791] lstrlenW (lpString=".docx") returned 5
	[0182.791] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0182.791] lstrlenW (lpString=".pdf") returned 4
	[0182.791] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.791] lstrlenW (lpString=".xls") returned 4
	[0182.791] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.791] lstrlenW (lpString=".xlsx") returned 5
	[0182.791] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0182.791] lstrlenW (lpString=".ppt") returned 4
	[0182.791] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.791] lstrlenW (lpString=".zip") returned 4
	[0182.791] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.791] lstrlenW (lpString=".rar") returned 4
	[0182.791] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.791] lstrlenW (lpString=".bz2") returned 4
	[0182.791] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.791] lstrlenW (lpString=".7z") returned 3
	[0182.791] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.792] lstrlenW (lpString=".dbf") returned 4
	[0182.792] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.792] lstrlenW (lpString=".1cd") returned 4
	[0182.792] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.792] lstrlenW (lpString=".jpg") returned 4
	[0182.792] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.792] lstrlenW (lpString=".doc") returned 4
	[0182.792] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.792] lstrlenW (lpString=".docx") returned 5
	[0182.792] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0182.792] lstrlenW (lpString=".pdf") returned 4
	[0182.792] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.792] lstrlenW (lpString=".xls") returned 4
	[0182.792] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.792] lstrlenW (lpString=".xlsx") returned 5
	[0182.792] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0182.792] lstrlenW (lpString=".ppt") returned 4
	[0182.792] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.792] lstrlenW (lpString=".zip") returned 4
	[0182.792] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.792] lstrlenW (lpString=".rar") returned 4
	[0182.792] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.792] lstrlenW (lpString=".bz2") returned 4
	[0182.792] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.792] lstrlenW (lpString=".7z") returned 3
	[0182.793] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.793] lstrlenW (lpString=".dbf") returned 4
	[0182.793] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.793] lstrlenW (lpString=".1cd") returned 4
	[0182.793] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68
	[0182.793] lstrlenW (lpString=".jpg") returned 4
	[0182.793] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.793] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.793] lstrlenW (lpString="J0178632.JPG") returned 12
	[0182.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.794] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=23338) returned 1
	[0182.794] CloseHandle (hObject=0x4bc) returned 1
	[0182.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 0x220
	[0182.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.795] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.795] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0182.795] GetLastError () returned 0x0
	[0182.796] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x5b2a, lpOverlapped=0x0) returned 1
	[0182.797] WriteFile (in: hFile=0x504, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x5b30, lpOverlapped=0x0) returned 1
	[0182.799] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.799] WriteFile (in: hFile=0x504, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.799] SetEndOfFile (hFile=0x504) returned 1
	[0182.799] CloseHandle (hObject=0x504) returned 1
	[0182.799] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.799] SetEndOfFile (hFile=0x4bc) returned 1
	[0182.803] CloseHandle (hObject=0x4bc) returned 1
	[0182.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 1
	[0182.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.804] lstrlenW (lpString=".doc") returned 4
	[0182.804] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.804] lstrlenW (lpString=".docx") returned 5
	[0182.804] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0182.804] lstrlenW (lpString=".pdf") returned 4
	[0182.804] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.804] lstrlenW (lpString=".xls") returned 4
	[0182.804] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.804] lstrlenW (lpString=".xlsx") returned 5
	[0182.804] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0182.804] lstrlenW (lpString=".ppt") returned 4
	[0182.804] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.804] lstrlenW (lpString=".zip") returned 4
	[0182.804] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.804] lstrlenW (lpString=".rar") returned 4
	[0182.804] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.805] lstrlenW (lpString=".bz2") returned 4
	[0182.805] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.805] lstrlenW (lpString=".7z") returned 3
	[0182.805] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.805] lstrlenW (lpString=".dbf") returned 4
	[0182.805] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.805] lstrlenW (lpString=".1cd") returned 4
	[0182.805] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.805] lstrlenW (lpString=".jpg") returned 4
	[0182.805] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.805] lstrlenW (lpString=".doc") returned 4
	[0182.805] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.805] lstrlenW (lpString=".docx") returned 5
	[0182.805] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0182.805] lstrlenW (lpString=".pdf") returned 4
	[0182.805] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.805] lstrlenW (lpString=".xls") returned 4
	[0182.805] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.805] lstrlenW (lpString=".xlsx") returned 5
	[0182.805] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0182.805] lstrlenW (lpString=".ppt") returned 4
	[0182.805] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.805] lstrlenW (lpString=".zip") returned 4
	[0182.805] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.806] lstrlenW (lpString=".rar") returned 4
	[0182.806] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.806] lstrlenW (lpString=".bz2") returned 4
	[0182.806] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.806] lstrlenW (lpString=".7z") returned 3
	[0182.806] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.806] lstrlenW (lpString=".dbf") returned 4
	[0182.806] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.806] lstrlenW (lpString=".1cd") returned 4
	[0182.806] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68
	[0182.806] lstrlenW (lpString=".jpg") returned 4
	[0182.806] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.806] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.806] lstrlenW (lpString="J0178639.JPG") returned 12
	[0182.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.807] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=32038) returned 1
	[0182.807] CloseHandle (hObject=0x4bc) returned 1
	[0182.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 0x220
	[0182.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.807] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.807] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0182.808] GetLastError () returned 0x0
	[0182.808] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x7d26, lpOverlapped=0x0) returned 1
	[0182.810] WriteFile (in: hFile=0x370, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x7d30, lpOverlapped=0x0) returned 1
	[0182.812] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.812] WriteFile (in: hFile=0x370, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.812] SetEndOfFile (hFile=0x370) returned 1
	[0182.812] CloseHandle (hObject=0x370) returned 1
	[0182.812] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.812] SetEndOfFile (hFile=0x4bc) returned 1
	[0182.815] CloseHandle (hObject=0x4bc) returned 1
	[0182.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 1
	[0182.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.816] lstrlenW (lpString=".doc") returned 4
	[0182.816] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.816] lstrlenW (lpString=".docx") returned 5
	[0182.816] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0182.816] lstrlenW (lpString=".pdf") returned 4
	[0182.816] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.816] lstrlenW (lpString=".xls") returned 4
	[0182.816] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.816] lstrlenW (lpString=".xlsx") returned 5
	[0182.816] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0182.816] lstrlenW (lpString=".ppt") returned 4
	[0182.816] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.816] lstrlenW (lpString=".zip") returned 4
	[0182.816] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.816] lstrlenW (lpString=".rar") returned 4
	[0182.816] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.816] lstrlenW (lpString=".bz2") returned 4
	[0182.816] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.816] lstrlenW (lpString=".7z") returned 3
	[0182.816] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.816] lstrlenW (lpString=".dbf") returned 4
	[0182.816] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.816] lstrlenW (lpString=".1cd") returned 4
	[0182.816] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.816] lstrlenW (lpString=".jpg") returned 4
	[0182.817] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.817] lstrlenW (lpString=".doc") returned 4
	[0182.817] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.817] lstrlenW (lpString=".docx") returned 5
	[0182.817] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0182.817] lstrlenW (lpString=".pdf") returned 4
	[0182.817] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.817] lstrlenW (lpString=".xls") returned 4
	[0182.817] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.817] lstrlenW (lpString=".xlsx") returned 5
	[0182.817] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0182.817] lstrlenW (lpString=".ppt") returned 4
	[0182.817] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.817] lstrlenW (lpString=".zip") returned 4
	[0182.817] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.817] lstrlenW (lpString=".rar") returned 4
	[0182.817] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.817] lstrlenW (lpString=".bz2") returned 4
	[0182.817] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.817] lstrlenW (lpString=".7z") returned 3
	[0182.817] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.817] lstrlenW (lpString=".dbf") returned 4
	[0182.817] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.817] lstrlenW (lpString=".1cd") returned 4
	[0182.817] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68
	[0182.818] lstrlenW (lpString=".jpg") returned 4
	[0182.818] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.818] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.818] lstrlenW (lpString="J0178932.JPG") returned 12
	[0182.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.819] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=35340) returned 1
	[0182.819] CloseHandle (hObject=0x4bc) returned 1
	[0182.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 0x220
	[0182.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0182.820] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.820] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0182.820] GetLastError () returned 0x0
	[0182.820] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x8a0c, lpOverlapped=0x0) returned 1
	[0182.823] WriteFile (in: hFile=0x370, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x8a10, lpOverlapped=0x0) returned 1
	[0182.824] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.824] WriteFile (in: hFile=0x370, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.824] SetEndOfFile (hFile=0x370) returned 1
	[0182.824] CloseHandle (hObject=0x370) returned 1
	[0182.824] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.824] SetEndOfFile (hFile=0x4bc) returned 1
	[0182.827] CloseHandle (hObject=0x4bc) returned 1
	[0182.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 1
	[0182.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.828] lstrlenW (lpString=".doc") returned 4
	[0182.828] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.828] lstrlenW (lpString=".docx") returned 5
	[0182.828] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0182.828] lstrlenW (lpString=".pdf") returned 4
	[0182.828] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.829] lstrlenW (lpString=".xls") returned 4
	[0182.829] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.829] lstrlenW (lpString=".xlsx") returned 5
	[0182.829] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0182.829] lstrlenW (lpString=".ppt") returned 4
	[0182.829] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.829] lstrlenW (lpString=".zip") returned 4
	[0182.829] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.829] lstrlenW (lpString=".rar") returned 4
	[0182.829] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.829] lstrlenW (lpString=".bz2") returned 4
	[0182.829] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.829] lstrlenW (lpString=".7z") returned 3
	[0182.829] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.829] lstrlenW (lpString=".dbf") returned 4
	[0182.829] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.829] lstrlenW (lpString=".1cd") returned 4
	[0182.829] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.829] lstrlenW (lpString=".jpg") returned 4
	[0182.829] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.829] lstrlenW (lpString=".doc") returned 4
	[0182.829] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0182.829] lstrlenW (lpString=".docx") returned 5
	[0182.829] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0182.830] lstrlenW (lpString=".pdf") returned 4
	[0182.830] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0182.830] lstrlenW (lpString=".xls") returned 4
	[0182.830] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0182.830] lstrlenW (lpString=".xlsx") returned 5
	[0182.830] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0182.830] lstrlenW (lpString=".ppt") returned 4
	[0182.830] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0182.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.830] lstrlenW (lpString=".zip") returned 4
	[0182.830] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0182.830] lstrlenW (lpString=".rar") returned 4
	[0182.830] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0182.830] lstrlenW (lpString=".bz2") returned 4
	[0182.830] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0182.830] lstrlenW (lpString=".7z") returned 3
	[0182.830] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0182.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.830] lstrlenW (lpString=".dbf") returned 4
	[0182.830] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0182.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.830] lstrlenW (lpString=".1cd") returned 4
	[0182.830] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0182.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68
	[0182.830] lstrlenW (lpString=".jpg") returned 4
	[0182.830] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0182.830] lstrcmpiW (lpString1=".JPG", lpString2=".money") returned -1
	[0182.830] lstrlenW (lpString="J0179963.JPG") returned 12
	[0182.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0183.071] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=32110) returned 1
	[0183.078] CloseHandle (hObject=0x4bc) returned 1
	[0183.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 0x220
	[0183.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0184.137] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.138] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0184.138] GetLastError () returned 0x0
	[0184.138] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x7d6e, lpOverlapped=0x0) returned 1
	[0184.140] WriteFile (in: hFile=0x558, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x7d70, lpOverlapped=0x0) returned 1
	[0184.142] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.142] WriteFile (in: hFile=0x558, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.142] SetEndOfFile (hFile=0x558) returned 1
	[0184.142] CloseHandle (hObject=0x558) returned 1
	[0184.142] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.143] SetEndOfFile (hFile=0x550) returned 1
	[0184.145] CloseHandle (hObject=0x550) returned 1
	[0184.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 1
	[0184.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.147] lstrlenW (lpString=".doc") returned 4
	[0184.147] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.147] lstrlenW (lpString=".docx") returned 5
	[0184.147] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0184.147] lstrlenW (lpString=".pdf") returned 4
	[0184.147] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.147] lstrlenW (lpString=".xls") returned 4
	[0184.147] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.147] lstrlenW (lpString=".xlsx") returned 5
	[0184.147] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0184.147] lstrlenW (lpString=".ppt") returned 4
	[0184.147] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.147] lstrlenW (lpString=".zip") returned 4
	[0184.147] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.147] lstrlenW (lpString=".rar") returned 4
	[0184.147] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.147] lstrlenW (lpString=".bz2") returned 4
	[0184.147] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.147] lstrlenW (lpString=".7z") returned 3
	[0184.147] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.147] lstrlenW (lpString=".dbf") returned 4
	[0184.147] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.147] lstrlenW (lpString=".1cd") returned 4
	[0184.147] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.147] lstrlenW (lpString=".jpg") returned 4
	[0184.147] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.148] lstrlenW (lpString=".doc") returned 4
	[0184.148] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.148] lstrlenW (lpString=".docx") returned 5
	[0184.148] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0184.148] lstrlenW (lpString=".pdf") returned 4
	[0184.148] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.148] lstrlenW (lpString=".xls") returned 4
	[0184.148] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.148] lstrlenW (lpString=".xlsx") returned 5
	[0184.148] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0184.148] lstrlenW (lpString=".ppt") returned 4
	[0184.148] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.148] lstrlenW (lpString=".zip") returned 4
	[0184.148] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.148] lstrlenW (lpString=".rar") returned 4
	[0184.148] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.148] lstrlenW (lpString=".bz2") returned 4
	[0184.148] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.148] lstrlenW (lpString=".7z") returned 3
	[0184.148] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.148] lstrlenW (lpString=".dbf") returned 4
	[0184.148] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.148] lstrlenW (lpString=".1cd") returned 4
	[0184.148] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68
	[0184.148] lstrlenW (lpString=".jpg") returned 4
	[0184.148] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.149] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0184.149] lstrlenW (lpString="J0185786.WMF") returned 12
	[0184.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0184.149] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=39330) returned 1
	[0184.149] CloseHandle (hObject=0x550) returned 1
	[0184.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 0x220
	[0184.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0184.150] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.150] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0184.151] GetLastError () returned 0x0
	[0184.151] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x99a2, lpOverlapped=0x0) returned 1
	[0184.154] WriteFile (in: hFile=0x558, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x99b0, lpOverlapped=0x0) returned 1
	[0184.156] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.156] WriteFile (in: hFile=0x558, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.156] SetEndOfFile (hFile=0x558) returned 1
	[0184.156] CloseHandle (hObject=0x558) returned 1
	[0184.156] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.156] SetEndOfFile (hFile=0x550) returned 1
	[0184.197] CloseHandle (hObject=0x550) returned 1
	[0184.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 1
	[0184.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.199] lstrlenW (lpString=".doc") returned 4
	[0184.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.199] lstrlenW (lpString=".docx") returned 5
	[0184.199] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0184.199] lstrlenW (lpString=".pdf") returned 4
	[0184.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.199] lstrlenW (lpString=".xls") returned 4
	[0184.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.199] lstrlenW (lpString=".xlsx") returned 5
	[0184.199] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0184.199] lstrlenW (lpString=".ppt") returned 4
	[0184.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.200] lstrlenW (lpString=".zip") returned 4
	[0184.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.200] lstrlenW (lpString=".rar") returned 4
	[0184.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.200] lstrlenW (lpString=".bz2") returned 4
	[0184.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.200] lstrlenW (lpString=".7z") returned 3
	[0184.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.200] lstrlenW (lpString=".dbf") returned 4
	[0184.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.200] lstrlenW (lpString=".1cd") returned 4
	[0184.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.200] lstrlenW (lpString=".jpg") returned 4
	[0184.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.200] lstrlenW (lpString=".doc") returned 4
	[0184.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.200] lstrlenW (lpString=".docx") returned 5
	[0184.200] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0184.200] lstrlenW (lpString=".pdf") returned 4
	[0184.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.200] lstrlenW (lpString=".xls") returned 4
	[0184.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.200] lstrlenW (lpString=".xlsx") returned 5
	[0184.200] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0184.200] lstrlenW (lpString=".ppt") returned 4
	[0184.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.201] lstrlenW (lpString=".zip") returned 4
	[0184.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.201] lstrlenW (lpString=".rar") returned 4
	[0184.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.201] lstrlenW (lpString=".bz2") returned 4
	[0184.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.201] lstrlenW (lpString=".7z") returned 3
	[0184.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.201] lstrlenW (lpString=".dbf") returned 4
	[0184.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.201] lstrlenW (lpString=".1cd") returned 4
	[0184.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68
	[0184.201] lstrlenW (lpString=".jpg") returned 4
	[0184.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.201] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0184.201] lstrlenW (lpString="J0185790.WMF") returned 12
	[0184.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0184.203] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=20662) returned 1
	[0184.203] CloseHandle (hObject=0x550) returned 1
	[0184.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 0x220
	[0184.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0184.204] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.204] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0184.205] GetLastError () returned 0x0
	[0184.205] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x50b6, lpOverlapped=0x0) returned 1
	[0184.207] WriteFile (in: hFile=0x558, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x50c0, lpOverlapped=0x0) returned 1
	[0184.208] ReadFile (in: hFile=0x550, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.208] WriteFile (in: hFile=0x558, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.208] SetEndOfFile (hFile=0x558) returned 1
	[0184.208] CloseHandle (hObject=0x558) returned 1
	[0184.208] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.208] SetEndOfFile (hFile=0x550) returned 1
	[0184.581] CloseHandle (hObject=0x550) returned 1
	[0184.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 1
	[0185.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.815] lstrlenW (lpString=".doc") returned 4
	[0185.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0185.815] lstrlenW (lpString=".docx") returned 5
	[0185.815] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0185.815] lstrlenW (lpString=".pdf") returned 4
	[0185.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0185.815] lstrlenW (lpString=".xls") returned 4
	[0185.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0185.815] lstrlenW (lpString=".xlsx") returned 5
	[0185.815] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0185.815] lstrlenW (lpString=".ppt") returned 4
	[0185.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0185.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.815] lstrlenW (lpString=".zip") returned 4
	[0185.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0185.815] lstrlenW (lpString=".rar") returned 4
	[0185.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0185.815] lstrlenW (lpString=".bz2") returned 4
	[0185.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0185.815] lstrlenW (lpString=".7z") returned 3
	[0185.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0185.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.816] lstrlenW (lpString=".dbf") returned 4
	[0185.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0185.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.816] lstrlenW (lpString=".1cd") returned 4
	[0185.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0185.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.816] lstrlenW (lpString=".jpg") returned 4
	[0185.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0185.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.816] lstrlenW (lpString=".doc") returned 4
	[0185.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0185.816] lstrlenW (lpString=".docx") returned 5
	[0185.816] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0185.816] lstrlenW (lpString=".pdf") returned 4
	[0185.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0185.816] lstrlenW (lpString=".xls") returned 4
	[0185.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0185.816] lstrlenW (lpString=".xlsx") returned 5
	[0185.816] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0185.816] lstrlenW (lpString=".ppt") returned 4
	[0185.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0185.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.816] lstrlenW (lpString=".zip") returned 4
	[0185.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0185.816] lstrlenW (lpString=".rar") returned 4
	[0185.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0185.816] lstrlenW (lpString=".bz2") returned 4
	[0185.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0185.816] lstrlenW (lpString=".7z") returned 3
	[0185.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0185.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.817] lstrlenW (lpString=".dbf") returned 4
	[0185.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0185.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.817] lstrlenW (lpString=".1cd") returned 4
	[0185.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0185.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68
	[0185.817] lstrlenW (lpString=".jpg") returned 4
	[0185.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0185.817] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0185.817] lstrlenW (lpString="J0185818.WMF") returned 12
	[0185.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0186.370] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=35726) returned 1
	[0186.380] CloseHandle (hObject=0x54c) returned 1
	[0186.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf")) returned 0x220
	[0186.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.463] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.463] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0187.464] GetLastError () returned 0x0
	[0187.464] ReadFile (in: hFile=0x4e4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x8b8e, lpOverlapped=0x0) returned 1
	[0187.467] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x8b90, lpOverlapped=0x0) returned 1
	[0187.468] ReadFile (in: hFile=0x4e4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.468] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.468] SetEndOfFile (hFile=0x4b8) returned 1
	[0187.468] CloseHandle (hObject=0x4b8) returned 1
	[0187.468] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.468] SetEndOfFile (hFile=0x4e4) returned 1
	[0187.471] CloseHandle (hObject=0x4e4) returned 1
	[0187.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf")) returned 1
	[0187.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.473] lstrlenW (lpString=".doc") returned 4
	[0187.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.473] lstrlenW (lpString=".docx") returned 5
	[0187.473] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0187.473] lstrlenW (lpString=".pdf") returned 4
	[0187.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.473] lstrlenW (lpString=".xls") returned 4
	[0187.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.473] lstrlenW (lpString=".xlsx") returned 5
	[0187.473] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0187.473] lstrlenW (lpString=".ppt") returned 4
	[0187.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.473] lstrlenW (lpString=".zip") returned 4
	[0187.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.473] lstrlenW (lpString=".rar") returned 4
	[0187.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.473] lstrlenW (lpString=".bz2") returned 4
	[0187.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.473] lstrlenW (lpString=".7z") returned 3
	[0187.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.473] lstrlenW (lpString=".dbf") returned 4
	[0187.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.473] lstrlenW (lpString=".1cd") returned 4
	[0187.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.474] lstrlenW (lpString=".jpg") returned 4
	[0187.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.474] lstrlenW (lpString=".doc") returned 4
	[0187.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.474] lstrlenW (lpString=".docx") returned 5
	[0187.474] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0187.474] lstrlenW (lpString=".pdf") returned 4
	[0187.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.474] lstrlenW (lpString=".xls") returned 4
	[0187.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.474] lstrlenW (lpString=".xlsx") returned 5
	[0187.474] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0187.474] lstrlenW (lpString=".ppt") returned 4
	[0187.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.474] lstrlenW (lpString=".zip") returned 4
	[0187.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.474] lstrlenW (lpString=".rar") returned 4
	[0187.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.474] lstrlenW (lpString=".bz2") returned 4
	[0187.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.474] lstrlenW (lpString=".7z") returned 3
	[0187.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.474] lstrlenW (lpString=".dbf") returned 4
	[0187.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.475] lstrlenW (lpString=".1cd") returned 4
	[0187.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68
	[0187.475] lstrlenW (lpString=".jpg") returned 4
	[0187.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.475] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.475] lstrlenW (lpString="J0187835.WMF") returned 12
	[0187.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.475] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=9344) returned 1
	[0187.476] CloseHandle (hObject=0x4e4) returned 1
	[0187.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 0x220
	[0187.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.476] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.476] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0187.477] GetLastError () returned 0x0
	[0187.477] ReadFile (in: hFile=0x4e4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x2480, lpOverlapped=0x0) returned 1
	[0187.478] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x2490, lpOverlapped=0x0) returned 1
	[0187.480] ReadFile (in: hFile=0x4e4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.480] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.480] SetEndOfFile (hFile=0x4b8) returned 1
	[0187.480] CloseHandle (hObject=0x4b8) returned 1
	[0187.480] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.480] SetEndOfFile (hFile=0x4e4) returned 1
	[0187.482] CloseHandle (hObject=0x4e4) returned 1
	[0187.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 1
	[0187.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.484] lstrlenW (lpString=".doc") returned 4
	[0187.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.484] lstrlenW (lpString=".docx") returned 5
	[0187.484] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0187.484] lstrlenW (lpString=".pdf") returned 4
	[0187.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.484] lstrlenW (lpString=".xls") returned 4
	[0187.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.484] lstrlenW (lpString=".xlsx") returned 5
	[0187.484] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0187.484] lstrlenW (lpString=".ppt") returned 4
	[0187.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.484] lstrlenW (lpString=".zip") returned 4
	[0187.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.484] lstrlenW (lpString=".rar") returned 4
	[0187.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.484] lstrlenW (lpString=".bz2") returned 4
	[0187.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.484] lstrlenW (lpString=".7z") returned 3
	[0187.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.484] lstrlenW (lpString=".dbf") returned 4
	[0187.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.484] lstrlenW (lpString=".1cd") returned 4
	[0187.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.485] lstrlenW (lpString=".jpg") returned 4
	[0187.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.485] lstrlenW (lpString=".doc") returned 4
	[0187.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.485] lstrlenW (lpString=".docx") returned 5
	[0187.485] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0187.485] lstrlenW (lpString=".pdf") returned 4
	[0187.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.485] lstrlenW (lpString=".xls") returned 4
	[0187.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.485] lstrlenW (lpString=".xlsx") returned 5
	[0187.485] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0187.485] lstrlenW (lpString=".ppt") returned 4
	[0187.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.485] lstrlenW (lpString=".zip") returned 4
	[0187.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.485] lstrlenW (lpString=".rar") returned 4
	[0187.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.485] lstrlenW (lpString=".bz2") returned 4
	[0187.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.485] lstrlenW (lpString=".7z") returned 3
	[0187.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.485] lstrlenW (lpString=".dbf") returned 4
	[0187.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.486] lstrlenW (lpString=".1cd") returned 4
	[0187.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68
	[0187.486] lstrlenW (lpString=".jpg") returned 4
	[0187.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.486] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.486] lstrlenW (lpString="J0187837.WMF") returned 12
	[0187.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.487] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=16354) returned 1
	[0187.487] CloseHandle (hObject=0x4e4) returned 1
	[0187.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 0x220
	[0187.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.488] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.488] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0187.489] GetLastError () returned 0x0
	[0187.489] ReadFile (in: hFile=0x4e4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x3fe2, lpOverlapped=0x0) returned 1
	[0187.491] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0x3ff0, lpOverlapped=0x0) returned 1
	[0187.492] ReadFile (in: hFile=0x4e4, lpBuffer=0x3f0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x345fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesRead=0x345fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.492] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x345fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0d020*, lpNumberOfBytesWritten=0x345fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.492] SetEndOfFile (hFile=0x4b8) returned 1
	[0187.492] CloseHandle (hObject=0x4b8) returned 1
	[0187.492] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.492] SetEndOfFile (hFile=0x4e4) returned 1
	[0187.496] CloseHandle (hObject=0x4e4) returned 1
	[0187.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 1
	[0187.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.497] lstrlenW (lpString=".doc") returned 4
	[0187.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.497] lstrlenW (lpString=".docx") returned 5
	[0187.497] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0187.497] lstrlenW (lpString=".pdf") returned 4
	[0187.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.497] lstrlenW (lpString=".xls") returned 4
	[0187.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.497] lstrlenW (lpString=".xlsx") returned 5
	[0187.497] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0187.497] lstrlenW (lpString=".ppt") returned 4
	[0187.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.497] lstrlenW (lpString=".zip") returned 4
	[0187.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.497] lstrlenW (lpString=".rar") returned 4
	[0187.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.498] lstrlenW (lpString=".bz2") returned 4
	[0187.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.498] lstrlenW (lpString=".7z") returned 3
	[0187.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.498] lstrlenW (lpString=".dbf") returned 4
	[0187.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.498] lstrlenW (lpString=".1cd") returned 4
	[0187.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.498] lstrlenW (lpString=".jpg") returned 4
	[0187.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.498] lstrlenW (lpString=".doc") returned 4
	[0187.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.498] lstrlenW (lpString=".docx") returned 5
	[0187.498] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0187.498] lstrlenW (lpString=".pdf") returned 4
	[0187.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.498] lstrlenW (lpString=".xls") returned 4
	[0187.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.498] lstrlenW (lpString=".xlsx") returned 5
	[0187.498] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0187.498] lstrlenW (lpString=".ppt") returned 4
	[0187.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.498] lstrlenW (lpString=".zip") returned 4
	[0187.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.498] lstrlenW (lpString=".rar") returned 4
	[0187.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.499] lstrlenW (lpString=".bz2") returned 4
	[0187.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.499] lstrlenW (lpString=".7z") returned 3
	[0187.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.499] lstrlenW (lpString=".dbf") returned 4
	[0187.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.499] lstrlenW (lpString=".1cd") returned 4
	[0187.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68
	[0187.499] lstrlenW (lpString=".jpg") returned 4
	[0187.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.499] lstrcmpiW (lpString1=".WMF", lpString2=".money") returned 1
	[0187.499] lstrlenW (lpString="J0187839.WMF") returned 12
	[0187.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0187.500] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x345ff14 | out: lpFileSize=0x345ff14*=5372) returned 1
	[0187.500] CloseHandle (hObject=0x4e4) returned 1
	[0187.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf")) returned 0x220
	[0187.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0187.875] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.875] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x345fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 45
	os_tid = 0xe18

	[0153.937] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e20058
	[0153.937] lstrlenW (lpString="C:") returned 2
	[0153.937] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x4eee10
	[0153.937] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0153.937] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0153.937] lstrlenW (lpString="$GetCurrent") returned 11
	[0153.937] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0153.937] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e30060
	[0153.938] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0153.938] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4ef110
	[0153.944] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0153.944] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0153.944] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0153.944] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0153.944] lstrlenW (lpString="Logs") returned 4
	[0153.944] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0153.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e61080
	[0153.944] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0153.944] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa97, dwReserved1=0xbed, cFileName=".", cAlternateFileName="")) returned 0x4ef150
	[0153.958] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="..", cAlternateFileName="")) returned 1
	[0153.958] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd838e407, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd838e407, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd83b4615, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DOWNLE~1.MON")) returned 1
	[0153.958] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[admin@stex777.com].money") returned 75
	[0153.958] lstrlenW (lpString=".1cd") returned 4
	[0153.958] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0153.958] lstrlenW (lpString=".3ds") returned 4
	[0153.958] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0153.958] lstrlenW (lpString=".3fr") returned 4
	[0153.958] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0153.959] lstrlenW (lpString=".3g2") returned 4
	[0153.959] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0153.959] lstrlenW (lpString=".3gp") returned 4
	[0153.959] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0153.959] lstrlenW (lpString=".7z") returned 3
	[0153.959] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0153.959] lstrlenW (lpString=".accda") returned 6
	[0153.959] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0153.959] lstrlenW (lpString=".accdb") returned 6
	[0153.959] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0153.959] lstrlenW (lpString=".accdc") returned 6
	[0153.959] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0153.959] lstrlenW (lpString=".accde") returned 6
	[0153.959] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0153.959] lstrlenW (lpString=".accdt") returned 6
	[0153.959] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0153.959] lstrlenW (lpString=".accdw") returned 6
	[0153.959] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0153.959] lstrlenW (lpString=".adb") returned 4
	[0153.959] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0153.959] lstrlenW (lpString=".adp") returned 4
	[0153.959] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0153.959] lstrlenW (lpString=".ai") returned 3
	[0153.959] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0153.959] lstrlenW (lpString=".ai3") returned 4
	[0153.959] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0153.959] lstrlenW (lpString=".ai4") returned 4
	[0153.959] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0153.959] lstrlenW (lpString=".ai5") returned 4
	[0153.959] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0153.959] lstrlenW (lpString=".ai6") returned 4
	[0153.959] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0153.959] lstrlenW (lpString=".ai7") returned 4
	[0153.959] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0153.960] lstrlenW (lpString=".ai8") returned 4
	[0153.960] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0153.960] lstrlenW (lpString=".anim") returned 5
	[0153.960] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0153.960] lstrlenW (lpString=".arw") returned 4
	[0153.960] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0153.960] lstrlenW (lpString=".as") returned 3
	[0153.960] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0153.960] lstrlenW (lpString=".asa") returned 4
	[0153.960] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0153.960] lstrlenW (lpString=".asc") returned 4
	[0153.960] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0153.960] lstrlenW (lpString=".ascx") returned 5
	[0153.960] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0153.960] lstrlenW (lpString=".asm") returned 4
	[0153.960] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0153.960] lstrlenW (lpString=".asmx") returned 5
	[0153.960] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0153.960] lstrlenW (lpString=".asp") returned 4
	[0153.960] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0153.960] lstrlenW (lpString=".aspx") returned 5
	[0153.960] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0153.960] lstrlenW (lpString=".asr") returned 4
	[0153.960] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0153.960] lstrlenW (lpString=".asx") returned 4
	[0153.960] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0153.960] lstrlenW (lpString=".avi") returned 4
	[0153.960] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0153.960] lstrlenW (lpString=".avs") returned 4
	[0153.960] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0153.960] lstrlenW (lpString=".backup") returned 7
	[0153.960] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0153.961] lstrlenW (lpString=".bak") returned 4
	[0153.961] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0153.961] lstrlenW (lpString=".bay") returned 4
	[0153.961] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0153.961] lstrlenW (lpString=".bd") returned 3
	[0153.961] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0153.961] lstrlenW (lpString=".bin") returned 4
	[0153.961] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0153.961] lstrlenW (lpString=".bmp") returned 4
	[0153.961] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0153.961] lstrlenW (lpString=".bz2") returned 4
	[0153.961] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0153.961] lstrlenW (lpString=".c") returned 2
	[0153.961] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0153.961] lstrlenW (lpString=".cdr") returned 4
	[0153.961] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0153.961] lstrlenW (lpString=".cer") returned 4
	[0153.961] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0153.961] lstrlenW (lpString=".cf") returned 3
	[0153.961] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0153.961] lstrlenW (lpString=".cfc") returned 4
	[0153.961] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0153.961] lstrlenW (lpString=".cfm") returned 4
	[0153.961] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0153.961] lstrlenW (lpString=".cfml") returned 5
	[0153.961] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0153.961] lstrlenW (lpString=".cfu") returned 4
	[0153.961] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0153.961] lstrlenW (lpString=".chm") returned 4
	[0153.961] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0153.961] lstrlenW (lpString=".cin") returned 4
	[0153.961] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".class") returned 6
	[0153.962] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0153.962] lstrlenW (lpString=".clx") returned 4
	[0153.962] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".config") returned 7
	[0153.962] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0153.962] lstrlenW (lpString=".cpp") returned 4
	[0153.962] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".cr2") returned 4
	[0153.962] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".crt") returned 4
	[0153.962] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".crw") returned 4
	[0153.962] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".cs") returned 3
	[0153.962] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0153.962] lstrlenW (lpString=".css") returned 4
	[0153.962] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".csv") returned 4
	[0153.962] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".cub") returned 4
	[0153.962] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".dae") returned 4
	[0153.962] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".dat") returned 4
	[0153.962] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".db") returned 3
	[0153.962] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0153.962] lstrlenW (lpString=".dbf") returned 4
	[0153.962] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".dbx") returned 4
	[0153.962] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0153.962] lstrlenW (lpString=".dc3") returned 4
	[0153.962] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0153.963] lstrlenW (lpString=".dcm") returned 4
	[0153.963] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0153.963] lstrlenW (lpString=".dcr") returned 4
	[0153.963] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0153.963] lstrlenW (lpString=".der") returned 4
	[0153.963] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0153.963] lstrlenW (lpString=".dib") returned 4
	[0153.963] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0153.963] lstrlenW (lpString=".dic") returned 4
	[0153.963] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0153.963] lstrlenW (lpString=".dif") returned 4
	[0153.963] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0153.963] lstrlenW (lpString=".divx") returned 5
	[0153.963] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0153.963] lstrlenW (lpString=".djvu") returned 5
	[0153.963] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0153.963] lstrlenW (lpString=".dng") returned 4
	[0153.963] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0153.963] lstrlenW (lpString=".doc") returned 4
	[0153.963] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0153.963] lstrlenW (lpString=".docm") returned 5
	[0153.963] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0153.963] lstrlenW (lpString=".docx") returned 5
	[0153.963] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0153.963] lstrlenW (lpString=".dot") returned 4
	[0153.963] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0153.963] lstrlenW (lpString=".dotm") returned 5
	[0153.963] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0153.963] lstrlenW (lpString=".dotx") returned 5
	[0153.963] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0153.963] lstrlenW (lpString=".dpx") returned 4
	[0153.963] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0153.963] lstrlenW (lpString=".dqy") returned 4
	[0153.964] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".dsn") returned 4
	[0153.964] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".dt") returned 3
	[0153.964] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0153.964] lstrlenW (lpString=".dtd") returned 4
	[0153.964] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".dwg") returned 4
	[0153.964] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".dwt") returned 4
	[0153.964] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".dx") returned 3
	[0153.964] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0153.964] lstrlenW (lpString=".dxf") returned 4
	[0153.964] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".edml") returned 5
	[0153.964] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0153.964] lstrlenW (lpString=".efd") returned 4
	[0153.964] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".elf") returned 4
	[0153.964] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".emf") returned 4
	[0153.964] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".emz") returned 4
	[0153.964] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".epf") returned 4
	[0153.964] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".eps") returned 4
	[0153.964] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0153.964] lstrlenW (lpString=".epsf") returned 5
	[0153.964] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0153.964] lstrlenW (lpString=".epsp") returned 5
	[0153.965] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0153.965] lstrlenW (lpString=".erf") returned 4
	[0153.965] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0153.965] lstrlenW (lpString=".exr") returned 4
	[0153.965] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0153.965] lstrlenW (lpString=".f4v") returned 4
	[0153.965] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0153.965] lstrlenW (lpString=".fido") returned 5
	[0153.965] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0153.965] lstrlenW (lpString=".flm") returned 4
	[0153.965] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0153.965] lstrlenW (lpString=".flv") returned 4
	[0153.965] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0153.965] lstrlenW (lpString=".frm") returned 4
	[0153.965] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0153.965] lstrlenW (lpString=".fxg") returned 4
	[0153.965] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0153.965] lstrlenW (lpString=".geo") returned 4
	[0153.965] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0153.965] lstrlenW (lpString=".gif") returned 4
	[0153.965] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0153.965] lstrlenW (lpString=".grs") returned 4
	[0153.965] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0153.965] lstrlenW (lpString=".gz") returned 3
	[0153.965] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0153.965] lstrlenW (lpString=".h") returned 2
	[0153.965] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0153.965] lstrlenW (lpString=".hdr") returned 4
	[0153.965] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0153.965] lstrlenW (lpString=".hpp") returned 4
	[0153.965] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".hta") returned 4
	[0153.966] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".htc") returned 4
	[0153.966] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".htm") returned 4
	[0153.966] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".html") returned 5
	[0153.966] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0153.966] lstrlenW (lpString=".icb") returned 4
	[0153.966] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".ics") returned 4
	[0153.966] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".iff") returned 4
	[0153.966] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".inc") returned 4
	[0153.966] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".indd") returned 5
	[0153.966] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0153.966] lstrlenW (lpString=".ini") returned 4
	[0153.966] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".iqy") returned 4
	[0153.966] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".j2c") returned 4
	[0153.966] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".j2k") returned 4
	[0153.966] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".java") returned 5
	[0153.966] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0153.966] lstrlenW (lpString=".jp2") returned 4
	[0153.966] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".jpc") returned 4
	[0153.966] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0153.966] lstrlenW (lpString=".jpe") returned 4
	[0153.967] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".jpeg") returned 5
	[0153.967] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0153.967] lstrlenW (lpString=".jpf") returned 4
	[0153.967] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".jpg") returned 4
	[0153.967] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".jpx") returned 4
	[0153.967] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".js") returned 3
	[0153.967] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0153.967] lstrlenW (lpString=".jsf") returned 4
	[0153.967] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".json") returned 5
	[0153.967] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0153.967] lstrlenW (lpString=".jsp") returned 4
	[0153.967] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".kdc") returned 4
	[0153.967] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".kmz") returned 4
	[0153.967] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".kwm") returned 4
	[0153.967] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".lasso") returned 6
	[0153.967] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0153.967] lstrlenW (lpString=".lbi") returned 4
	[0153.967] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".lgf") returned 4
	[0153.967] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".lgp") returned 4
	[0153.967] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".log") returned 4
	[0153.967] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0153.967] lstrlenW (lpString=".m1v") returned 4
	[0153.968] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".m4a") returned 4
	[0153.968] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".m4v") returned 4
	[0153.968] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".max") returned 4
	[0153.968] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".md") returned 3
	[0153.968] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0153.968] lstrlenW (lpString=".mda") returned 4
	[0153.968] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".mdb") returned 4
	[0153.968] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".mde") returned 4
	[0153.968] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".mdf") returned 4
	[0153.968] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".mdw") returned 4
	[0153.968] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".mef") returned 4
	[0153.968] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".mft") returned 4
	[0153.968] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".mfw") returned 4
	[0153.968] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".mht") returned 4
	[0153.968] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".mhtml") returned 6
	[0153.968] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0153.968] lstrlenW (lpString=".mka") returned 4
	[0153.968] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0153.968] lstrlenW (lpString=".mkidx") returned 6
	[0153.969] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0153.969] lstrlenW (lpString=".mkv") returned 4
	[0153.969] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".mos") returned 4
	[0153.969] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".mov") returned 4
	[0153.969] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".mp3") returned 4
	[0153.969] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".mp4") returned 4
	[0153.969] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".mpeg") returned 5
	[0153.969] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0153.969] lstrlenW (lpString=".mpg") returned 4
	[0153.969] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".mpv") returned 4
	[0153.969] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".mrw") returned 4
	[0153.969] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".msg") returned 4
	[0153.969] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".mxl") returned 4
	[0153.969] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".myd") returned 4
	[0153.969] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".myi") returned 4
	[0153.969] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".nef") returned 4
	[0153.969] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".nrw") returned 4
	[0153.969] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0153.969] lstrlenW (lpString=".obj") returned 4
	[0153.970] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".odb") returned 4
	[0153.970] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".odc") returned 4
	[0153.970] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".odm") returned 4
	[0153.970] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".odp") returned 4
	[0153.970] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".ods") returned 4
	[0153.970] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".oft") returned 4
	[0153.970] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".one") returned 4
	[0153.970] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".onepkg") returned 7
	[0153.970] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0153.970] lstrlenW (lpString=".onetoc2") returned 8
	[0153.970] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0153.970] lstrlenW (lpString=".opt") returned 4
	[0153.970] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".oqy") returned 4
	[0153.970] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".orf") returned 4
	[0153.970] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".p12") returned 4
	[0153.970] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".p7b") returned 4
	[0153.970] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".p7c") returned 4
	[0153.970] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".pam") returned 4
	[0153.970] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0153.970] lstrlenW (lpString=".pbm") returned 4
	[0153.971] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".pct") returned 4
	[0153.971] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".pcx") returned 4
	[0153.971] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".pdd") returned 4
	[0153.971] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".pdf") returned 4
	[0153.971] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".pdp") returned 4
	[0153.971] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".pef") returned 4
	[0153.971] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".pem") returned 4
	[0153.971] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".pff") returned 4
	[0153.971] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".pfm") returned 4
	[0153.971] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".pfx") returned 4
	[0153.971] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".pgm") returned 4
	[0153.971] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".php") returned 4
	[0153.971] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0153.971] lstrlenW (lpString=".php3") returned 5
	[0153.971] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0153.971] lstrlenW (lpString=".php4") returned 5
	[0153.971] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0153.971] lstrlenW (lpString=".php5") returned 5
	[0153.971] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0153.971] lstrlenW (lpString=".phtml") returned 6
	[0153.971] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0153.972] lstrlenW (lpString=".pict") returned 5
	[0153.972] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0153.972] lstrlenW (lpString=".pl") returned 3
	[0153.972] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0153.972] lstrlenW (lpString=".pls") returned 4
	[0153.972] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0153.972] lstrlenW (lpString=".pm") returned 3
	[0153.972] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0153.972] lstrlenW (lpString=".png") returned 4
	[0153.972] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0153.972] lstrlenW (lpString=".pnm") returned 4
	[0153.972] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0153.972] lstrlenW (lpString=".pot") returned 4
	[0153.972] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0153.972] lstrlenW (lpString=".potm") returned 5
	[0153.972] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0153.972] lstrlenW (lpString=".potx") returned 5
	[0153.972] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0153.972] lstrlenW (lpString=".ppa") returned 4
	[0153.972] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0153.972] lstrlenW (lpString=".ppam") returned 5
	[0153.972] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0153.972] lstrlenW (lpString=".ppm") returned 4
	[0153.972] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0153.972] lstrlenW (lpString=".pps") returned 4
	[0153.972] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0153.972] lstrlenW (lpString=".ppsm") returned 5
	[0153.972] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0153.972] lstrlenW (lpString=".ppt") returned 4
	[0153.972] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0153.972] lstrlenW (lpString=".pptm") returned 5
	[0153.972] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0153.973] lstrlenW (lpString=".pptx") returned 5
	[0153.973] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0153.973] lstrlenW (lpString=".prn") returned 4
	[0153.973] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0153.973] lstrlenW (lpString=".ps") returned 3
	[0153.973] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0153.973] lstrlenW (lpString=".psb") returned 4
	[0153.973] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0153.973] lstrlenW (lpString=".psd") returned 4
	[0153.973] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0153.973] lstrlenW (lpString=".pst") returned 4
	[0153.973] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0153.973] lstrlenW (lpString=".ptx") returned 4
	[0153.973] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0153.973] lstrlenW (lpString=".pub") returned 4
	[0153.973] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0153.973] lstrlenW (lpString=".pwm") returned 4
	[0153.973] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0153.973] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8426f15, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="OOBE_2~1.MON")) returned 1
	[0153.973] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83da953, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd83da953, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8400cf6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARTNE~1.MON")) returned 1
	[0153.973] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83da953, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd83da953, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8400cf6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARTNE~1.MON")) returned 0
	[0153.973] FindClose (in: hFindFile=0x4ef150 | out: hFindFile=0x4ef150) returned 1
	[0153.974] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e61080 | out: hHeap=0x4c0000) returned 1
	[0153.974] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0153.974] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e61080
	[0153.974] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa97, dwReserved1=0xbed, cFileName=".", cAlternateFileName="")) returned 0x4ef150
	[0153.985] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="..", cAlternateFileName="")) returned 1
	[0153.986] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8879283, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8879283, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd88c5690, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="GetCurrentOOBE.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="GETCUR~2.MON")) returned 1
	[0153.986] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8400cf6, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8400cf6, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8400cf6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="GetCurrentRollback.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="GETCUR~1.MON")) returned 1
	[0153.986] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88c5690, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd88c5690, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c7f0c4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="PartnerSetupComplete.cmd.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARTNE~1.MON")) returned 1
	[0153.986] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88eb90b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd88eb90b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8911ad0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="preoobe.cmd.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PREOOB~1.MON")) returned 1
	[0153.986] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8911ad0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8911ad0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8911ad0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="SetupComplete.cmd.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPC~1.MON")) returned 1
	[0153.986] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8911ad0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8911ad0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8911ad0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xa97, dwReserved1=0xbed, cFileName="SetupComplete.cmd.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPC~1.MON")) returned 0
	[0153.986] FindClose (in: hFindFile=0x4ef150 | out: hFindFile=0x4ef150) returned 1
	[0153.987] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e61080 | out: hHeap=0x4c0000) returned 1
	[0153.987] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0153.987] FindClose (in: hFindFile=0x4ef110 | out: hFindFile=0x4ef110) returned 1
	[0153.987] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0153.988] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0153.988] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e30060
	[0153.988] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName=".", cAlternateFileName="")) returned 0x4ef110
	[0153.989] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="..", cAlternateFileName="")) returned 1
	[0153.989] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd876e0d4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0153.989] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0153.990] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0xfffff0cf, nFileSizeHigh=0xfffff0cf, nFileSizeLow=0x12cf, dwReserved0=0xfffff0cf, dwReserved1=0x12d1, cFileName="", cAlternateFileName="?S\x08")) returned 0xffffffff
	[0153.990] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0153.990] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5010a3e, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x5010a3e, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0153.991] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0153.991] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5010a3e, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x5010a3e, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff0cf, dwReserved1=0x12d1, cFileName=".", cAlternateFileName="")) returned 0x4ef150
	[0153.991] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5010a3e, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x5010a3e, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff0cf, dwReserved1=0x12d1, cFileName="..", cAlternateFileName="")) returned 1
	[0153.991] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5010a3e, ftCreationTime.dwHighDateTime=0x1d590a2, ftLastAccessTime.dwLowDateTime=0x5010a3e, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x5010a3e, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xfffff0cf, dwReserved1=0x12d1, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0153.991] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd876e0d4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd876e0d4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xfffff0cf, dwReserved1=0x12d1, cFileName="desktop.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DESKTO~1.MON")) returned 1
	[0153.991] lstrlenW (lpString="desktop.ini.id-B4197730.[admin@stex777.com].money") returned 49
	[0153.991] lstrlenW (lpString=".1cd") returned 4
	[0153.991] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0153.991] lstrlenW (lpString=".3ds") returned 4
	[0153.991] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0153.991] lstrlenW (lpString=".3fr") returned 4
	[0153.991] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0153.991] lstrlenW (lpString=".3g2") returned 4
	[0153.991] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0153.991] lstrlenW (lpString=".3gp") returned 4
	[0153.991] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0153.991] lstrlenW (lpString=".7z") returned 3
	[0153.991] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0153.991] lstrlenW (lpString=".accda") returned 6
	[0153.991] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0153.992] lstrlenW (lpString=".accdb") returned 6
	[0153.992] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0153.992] lstrlenW (lpString=".accdc") returned 6
	[0153.992] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0153.992] lstrlenW (lpString=".accde") returned 6
	[0153.992] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0153.992] lstrlenW (lpString=".accdt") returned 6
	[0153.992] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0153.992] lstrlenW (lpString=".accdw") returned 6
	[0153.992] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0153.992] lstrlenW (lpString=".adb") returned 4
	[0153.992] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0153.992] lstrlenW (lpString=".adp") returned 4
	[0153.992] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0153.992] lstrlenW (lpString=".ai") returned 3
	[0153.992] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0153.992] lstrlenW (lpString=".ai3") returned 4
	[0153.992] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0153.992] lstrlenW (lpString=".ai4") returned 4
	[0153.992] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0153.992] lstrlenW (lpString=".ai5") returned 4
	[0153.992] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0153.992] lstrlenW (lpString=".ai6") returned 4
	[0153.992] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0153.992] lstrlenW (lpString=".ai7") returned 4
	[0153.992] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0153.992] lstrlenW (lpString=".ai8") returned 4
	[0153.992] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0153.992] lstrlenW (lpString=".anim") returned 5
	[0153.992] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0153.993] lstrlenW (lpString=".arw") returned 4
	[0153.993] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0153.993] lstrlenW (lpString=".as") returned 3
	[0153.993] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0153.993] lstrlenW (lpString=".asa") returned 4
	[0153.993] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0153.993] lstrlenW (lpString=".asc") returned 4
	[0153.993] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0153.993] lstrlenW (lpString=".ascx") returned 5
	[0153.993] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0153.993] lstrlenW (lpString=".asm") returned 4
	[0153.993] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0153.993] lstrlenW (lpString=".asmx") returned 5
	[0153.993] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0153.993] lstrlenW (lpString=".asp") returned 4
	[0153.993] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0153.993] lstrlenW (lpString=".aspx") returned 5
	[0153.993] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0153.993] lstrlenW (lpString=".asr") returned 4
	[0153.993] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0153.993] lstrlenW (lpString=".asx") returned 4
	[0153.993] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0153.993] lstrlenW (lpString=".avi") returned 4
	[0153.993] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0153.993] lstrlenW (lpString=".avs") returned 4
	[0153.993] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0153.993] lstrlenW (lpString=".backup") returned 7
	[0153.993] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0153.993] lstrlenW (lpString=".bak") returned 4
	[0153.993] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0153.993] lstrlenW (lpString=".bay") returned 4
	[0153.994] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0153.994] lstrlenW (lpString=".bd") returned 3
	[0153.994] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0153.994] lstrlenW (lpString=".bin") returned 4
	[0153.994] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0153.994] lstrlenW (lpString=".bmp") returned 4
	[0153.994] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0153.994] lstrlenW (lpString=".bz2") returned 4
	[0153.994] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0153.994] lstrlenW (lpString=".c") returned 2
	[0153.994] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0153.994] lstrlenW (lpString=".cdr") returned 4
	[0153.994] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0153.994] lstrlenW (lpString=".cer") returned 4
	[0153.994] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0153.994] lstrlenW (lpString=".cf") returned 3
	[0153.994] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0153.994] lstrlenW (lpString=".cfc") returned 4
	[0153.994] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0153.994] lstrlenW (lpString=".cfm") returned 4
	[0153.994] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0153.994] lstrlenW (lpString=".cfml") returned 5
	[0153.994] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0153.994] lstrlenW (lpString=".cfu") returned 4
	[0153.994] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0153.994] lstrlenW (lpString=".chm") returned 4
	[0153.994] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0153.994] lstrlenW (lpString=".cin") returned 4
	[0153.994] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0153.994] lstrlenW (lpString=".class") returned 6
	[0153.994] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0153.994] lstrlenW (lpString=".clx") returned 4
	[0153.994] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".config") returned 7
	[0153.995] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0153.995] lstrlenW (lpString=".cpp") returned 4
	[0153.995] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".cr2") returned 4
	[0153.995] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".crt") returned 4
	[0153.995] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".crw") returned 4
	[0153.995] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".cs") returned 3
	[0153.995] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0153.995] lstrlenW (lpString=".css") returned 4
	[0153.995] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".csv") returned 4
	[0153.995] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".cub") returned 4
	[0153.995] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".dae") returned 4
	[0153.995] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".dat") returned 4
	[0153.995] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".db") returned 3
	[0153.995] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0153.995] lstrlenW (lpString=".dbf") returned 4
	[0153.995] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".dbx") returned 4
	[0153.995] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".dc3") returned 4
	[0153.995] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".dcm") returned 4
	[0153.995] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0153.995] lstrlenW (lpString=".dcr") returned 4
	[0153.996] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0153.996] lstrlenW (lpString=".der") returned 4
	[0153.996] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0153.996] lstrlenW (lpString=".dib") returned 4
	[0153.996] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0153.996] lstrlenW (lpString=".dic") returned 4
	[0153.996] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0153.996] lstrlenW (lpString=".dif") returned 4
	[0153.996] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0153.996] lstrlenW (lpString=".divx") returned 5
	[0153.996] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0153.996] lstrlenW (lpString=".djvu") returned 5
	[0153.996] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0153.996] lstrlenW (lpString=".dng") returned 4
	[0153.996] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0153.996] lstrlenW (lpString=".doc") returned 4
	[0153.996] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0153.996] lstrlenW (lpString=".docm") returned 5
	[0153.996] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0153.996] lstrlenW (lpString=".docx") returned 5
	[0153.996] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0153.996] lstrlenW (lpString=".dot") returned 4
	[0153.996] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0153.996] lstrlenW (lpString=".dotm") returned 5
	[0153.996] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0153.996] lstrlenW (lpString=".dotx") returned 5
	[0153.996] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0153.996] lstrlenW (lpString=".dpx") returned 4
	[0153.996] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0153.996] lstrlenW (lpString=".dqy") returned 4
	[0153.996] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0153.997] lstrlenW (lpString=".dsn") returned 4
	[0153.997] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0153.997] lstrlenW (lpString=".dt") returned 3
	[0154.233] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0154.233] lstrlenW (lpString=".dtd") returned 4
	[0154.233] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0154.233] lstrlenW (lpString=".dwg") returned 4
	[0154.233] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0154.233] lstrlenW (lpString=".dwt") returned 4
	[0154.233] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0154.233] lstrlenW (lpString=".dx") returned 3
	[0154.233] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0154.233] lstrlenW (lpString=".dxf") returned 4
	[0154.233] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0154.233] lstrlenW (lpString=".edml") returned 5
	[0154.235] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0154.235] lstrlenW (lpString=".efd") returned 4
	[0154.235] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0154.235] lstrlenW (lpString=".elf") returned 4
	[0154.235] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0154.235] lstrlenW (lpString=".emf") returned 4
	[0154.235] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0154.235] lstrlenW (lpString=".emz") returned 4
	[0154.235] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0154.235] lstrlenW (lpString=".epf") returned 4
	[0154.235] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0154.235] lstrlenW (lpString=".eps") returned 4
	[0154.235] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0154.235] lstrlenW (lpString=".epsf") returned 5
	[0154.235] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0154.235] lstrlenW (lpString=".epsp") returned 5
	[0154.235] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0154.235] lstrlenW (lpString=".erf") returned 4
	[0154.235] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0154.235] lstrlenW (lpString=".exr") returned 4
	[0154.235] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0154.235] lstrlenW (lpString=".f4v") returned 4
	[0154.235] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0154.235] lstrlenW (lpString=".fido") returned 5
	[0154.235] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0154.235] lstrlenW (lpString=".flm") returned 4
	[0154.235] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".flv") returned 4
	[0154.236] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".frm") returned 4
	[0154.236] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".fxg") returned 4
	[0154.236] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".geo") returned 4
	[0154.236] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".gif") returned 4
	[0154.236] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".grs") returned 4
	[0154.236] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".gz") returned 3
	[0154.236] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0154.236] lstrlenW (lpString=".h") returned 2
	[0154.236] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0154.236] lstrlenW (lpString=".hdr") returned 4
	[0154.236] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".hpp") returned 4
	[0154.236] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".hta") returned 4
	[0154.236] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".htc") returned 4
	[0154.236] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".htm") returned 4
	[0154.236] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0154.236] lstrlenW (lpString=".html") returned 5
	[0154.236] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0154.237] lstrlenW (lpString=".icb") returned 4
	[0154.237] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0154.237] lstrlenW (lpString=".ics") returned 4
	[0154.237] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0154.237] lstrlenW (lpString=".iff") returned 4
	[0154.237] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0154.237] lstrlenW (lpString=".inc") returned 4
	[0154.237] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0154.237] lstrlenW (lpString=".indd") returned 5
	[0154.237] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0154.237] lstrlenW (lpString=".ini") returned 4
	[0154.237] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0154.237] lstrlenW (lpString=".iqy") returned 4
	[0154.237] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0154.237] lstrlenW (lpString=".j2c") returned 4
	[0154.237] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0154.237] lstrlenW (lpString=".j2k") returned 4
	[0154.237] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0154.237] lstrlenW (lpString=".java") returned 5
	[0154.237] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0154.237] lstrlenW (lpString=".jp2") returned 4
	[0154.237] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0154.238] lstrlenW (lpString=".jpc") returned 4
	[0154.238] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0154.238] lstrlenW (lpString=".jpe") returned 4
	[0154.238] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0154.238] lstrlenW (lpString=".jpeg") returned 5
	[0154.238] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0154.238] lstrlenW (lpString=".jpf") returned 4
	[0154.238] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0154.238] lstrlenW (lpString=".jpg") returned 4
	[0154.238] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0154.238] lstrlenW (lpString=".jpx") returned 4
	[0154.238] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0154.238] lstrlenW (lpString=".js") returned 3
	[0154.238] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0154.238] lstrlenW (lpString=".jsf") returned 4
	[0154.238] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0154.238] lstrlenW (lpString=".json") returned 5
	[0154.238] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0154.238] lstrlenW (lpString=".jsp") returned 4
	[0154.238] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0154.238] lstrlenW (lpString=".kdc") returned 4
	[0154.238] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0154.238] lstrlenW (lpString=".kmz") returned 4
	[0154.238] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0154.238] lstrlenW (lpString=".kwm") returned 4
	[0154.238] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0154.238] lstrlenW (lpString=".lasso") returned 6
	[0154.239] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0154.239] lstrlenW (lpString=".lbi") returned 4
	[0154.239] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0154.239] lstrlenW (lpString=".lgf") returned 4
	[0154.239] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0154.239] lstrlenW (lpString=".lgp") returned 4
	[0154.239] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0154.239] lstrlenW (lpString=".log") returned 4
	[0154.239] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0154.239] lstrlenW (lpString=".m1v") returned 4
	[0154.239] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0154.239] lstrlenW (lpString=".m4a") returned 4
	[0154.239] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0154.239] lstrlenW (lpString=".m4v") returned 4
	[0154.239] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0154.239] lstrlenW (lpString=".max") returned 4
	[0154.239] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0154.239] lstrlenW (lpString=".md") returned 3
	[0154.239] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0154.239] lstrlenW (lpString=".mda") returned 4
	[0154.239] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0154.239] lstrlenW (lpString=".mdb") returned 4
	[0154.240] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mde") returned 4
	[0154.240] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mdf") returned 4
	[0154.240] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mdw") returned 4
	[0154.240] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mef") returned 4
	[0154.240] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mft") returned 4
	[0154.240] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mfw") returned 4
	[0154.240] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mht") returned 4
	[0154.240] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mhtml") returned 6
	[0154.240] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0154.240] lstrlenW (lpString=".mka") returned 4
	[0154.240] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mkidx") returned 6
	[0154.240] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0154.240] lstrlenW (lpString=".mkv") returned 4
	[0154.240] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mos") returned 4
	[0154.240] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mov") returned 4
	[0154.240] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0154.240] lstrlenW (lpString=".mp3") returned 4
	[0154.241] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".mp4") returned 4
	[0154.241] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".mpeg") returned 5
	[0154.241] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0154.241] lstrlenW (lpString=".mpg") returned 4
	[0154.241] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".mpv") returned 4
	[0154.241] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".mrw") returned 4
	[0154.241] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".msg") returned 4
	[0154.241] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".mxl") returned 4
	[0154.241] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".myd") returned 4
	[0154.241] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".myi") returned 4
	[0154.241] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".nef") returned 4
	[0154.241] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".nrw") returned 4
	[0154.241] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".obj") returned 4
	[0154.241] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".odb") returned 4
	[0154.241] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0154.241] lstrlenW (lpString=".odc") returned 4
	[0154.241] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0154.242] lstrlenW (lpString=".odm") returned 4
	[0154.242] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0154.242] lstrlenW (lpString=".odp") returned 4
	[0154.242] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0154.242] lstrlenW (lpString=".ods") returned 4
	[0154.242] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0154.242] lstrlenW (lpString=".oft") returned 4
	[0154.242] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0154.242] lstrlenW (lpString=".one") returned 4
	[0154.242] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0154.242] lstrlenW (lpString=".onepkg") returned 7
	[0154.242] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0154.242] lstrlenW (lpString=".onetoc2") returned 8
	[0154.242] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0154.242] lstrlenW (lpString=".opt") returned 4
	[0154.242] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0154.242] lstrlenW (lpString=".oqy") returned 4
	[0154.242] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0154.242] lstrlenW (lpString=".orf") returned 4
	[0154.242] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0154.242] lstrlenW (lpString=".p12") returned 4
	[0154.242] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".p7b") returned 4
	[0154.243] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".p7c") returned 4
	[0154.243] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pam") returned 4
	[0154.243] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pbm") returned 4
	[0154.243] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pct") returned 4
	[0154.243] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pcx") returned 4
	[0154.243] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pdd") returned 4
	[0154.243] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pdf") returned 4
	[0154.243] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pdp") returned 4
	[0154.243] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pef") returned 4
	[0154.243] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pem") returned 4
	[0154.243] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pff") returned 4
	[0154.243] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pfm") returned 4
	[0154.243] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0154.243] lstrlenW (lpString=".pfx") returned 4
	[0154.243] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0154.244] lstrlenW (lpString=".pgm") returned 4
	[0154.244] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0154.244] lstrlenW (lpString=".php") returned 4
	[0154.244] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0154.244] lstrlenW (lpString=".php3") returned 5
	[0154.244] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0154.244] lstrlenW (lpString=".php4") returned 5
	[0154.244] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0154.244] lstrlenW (lpString=".php5") returned 5
	[0154.244] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0154.244] lstrlenW (lpString=".phtml") returned 6
	[0154.244] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0154.244] lstrlenW (lpString=".pict") returned 5
	[0154.244] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0154.244] lstrlenW (lpString=".pl") returned 3
	[0154.244] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0154.244] lstrlenW (lpString=".pls") returned 4
	[0154.244] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0154.244] lstrlenW (lpString=".pm") returned 3
	[0154.244] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0154.244] lstrlenW (lpString=".png") returned 4
	[0154.244] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0154.244] lstrlenW (lpString=".pnm") returned 4
	[0154.244] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0154.245] lstrlenW (lpString=".pot") returned 4
	[0154.245] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0154.245] lstrlenW (lpString=".potm") returned 5
	[0154.245] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0154.245] lstrlenW (lpString=".potx") returned 5
	[0154.245] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0154.245] lstrlenW (lpString=".ppa") returned 4
	[0154.245] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0154.245] lstrlenW (lpString=".ppam") returned 5
	[0154.245] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0154.245] lstrlenW (lpString=".ppm") returned 4
	[0154.245] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0154.245] lstrlenW (lpString=".pps") returned 4
	[0154.245] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0154.245] lstrlenW (lpString=".ppsm") returned 5
	[0154.245] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0154.245] lstrlenW (lpString=".ppt") returned 4
	[0154.245] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0154.245] lstrlenW (lpString=".pptm") returned 5
	[0154.245] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0154.245] lstrlenW (lpString=".pptx") returned 5
	[0154.245] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0154.245] lstrlenW (lpString=".prn") returned 4
	[0154.245] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0154.245] lstrlenW (lpString=".ps") returned 3
	[0154.245] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0154.245] lstrlenW (lpString=".psb") returned 4
	[0154.245] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0154.246] lstrlenW (lpString=".psd") returned 4
	[0154.246] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0154.246] lstrlenW (lpString=".pst") returned 4
	[0154.246] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0154.246] lstrlenW (lpString=".ptx") returned 4
	[0154.246] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0154.246] lstrlenW (lpString=".pub") returned 4
	[0154.246] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0154.246] lstrlenW (lpString=".pwm") returned 4
	[0154.246] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0154.246] lstrlenW (lpString=".pxr") returned 4
	[0154.246] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0154.246] lstrlenW (lpString=".py") returned 3
	[0154.246] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0154.246] lstrlenW (lpString=".qt") returned 3
	[0154.246] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0154.246] lstrlenW (lpString=".r3d") returned 4
	[0154.246] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0154.246] lstrlenW (lpString=".raf") returned 4
	[0154.246] lstrcmpiW (lpString1=".raf", lpString2="oney") returned -1
	[0154.246] lstrlenW (lpString=".rar") returned 4
	[0154.246] lstrcmpiW (lpString1=".rar", lpString2="oney") returned -1
	[0154.246] lstrlenW (lpString=".raw") returned 4
	[0154.246] lstrcmpiW (lpString1=".raw", lpString2="oney") returned -1
	[0154.246] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd876e0d4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd876e0d4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xfffff0cf, dwReserved1=0x12d1, cFileName="desktop.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DESKTO~1.MON")) returned 0
	[0154.246] FindClose (in: hFindFile=0x4ef150 | out: hFindFile=0x4ef150) returned 1
	[0154.247] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.247] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5010a3e, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x5010a3e, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0154.247] FindClose (in: hFindFile=0x4ef110 | out: hFindFile=0x4ef110) returned 1
	[0154.247] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0154.248] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0154.248] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xdd798e9e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdd798e9e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0154.248] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e30060
	[0154.248] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xdd798e9e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdd798e9e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName=".", cAlternateFileName="")) returned 0x4ef110
	[0154.256] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xdd798e9e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdd798e9e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.256] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1025", cAlternateFileName="")) returned 1
	[0154.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0154.256] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1
	[0154.256] lstrlenW (lpString="1025") returned 4
	[0154.256] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1
	[0154.256] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0154.257] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4ef150
	[0154.258] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.258] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8b27fef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8b27fef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8b7402a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.258] lstrlenW (lpString="eula.rtf.id-B4197730.[admin@stex777.com].money") returned 46
	[0154.258] lstrlenW (lpString=".1cd") returned 4
	[0154.258] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0154.258] lstrlenW (lpString=".3ds") returned 4
	[0154.258] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0154.258] lstrlenW (lpString=".3fr") returned 4
	[0154.258] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0154.258] lstrlenW (lpString=".3g2") returned 4
	[0154.259] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0154.259] lstrlenW (lpString=".3gp") returned 4
	[0154.259] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0154.259] lstrlenW (lpString=".7z") returned 3
	[0154.259] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0154.259] lstrlenW (lpString=".accda") returned 6
	[0154.259] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0154.259] lstrlenW (lpString=".accdb") returned 6
	[0154.259] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0154.259] lstrlenW (lpString=".accdc") returned 6
	[0154.259] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0154.259] lstrlenW (lpString=".accde") returned 6
	[0154.259] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0154.259] lstrlenW (lpString=".accdt") returned 6
	[0154.259] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0154.259] lstrlenW (lpString=".accdw") returned 6
	[0154.259] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0154.260] lstrlenW (lpString=".adb") returned 4
	[0154.260] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0154.260] lstrlenW (lpString=".adp") returned 4
	[0154.260] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0154.260] lstrlenW (lpString=".ai") returned 3
	[0154.260] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0154.260] lstrlenW (lpString=".ai3") returned 4
	[0154.260] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0154.260] lstrlenW (lpString=".ai4") returned 4
	[0154.260] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0154.260] lstrlenW (lpString=".ai5") returned 4
	[0154.260] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0154.260] lstrlenW (lpString=".ai6") returned 4
	[0154.260] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0154.260] lstrlenW (lpString=".ai7") returned 4
	[0154.260] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0154.260] lstrlenW (lpString=".ai8") returned 4
	[0154.260] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0154.261] lstrlenW (lpString=".anim") returned 5
	[0154.261] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0154.261] lstrlenW (lpString=".arw") returned 4
	[0154.261] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0154.261] lstrlenW (lpString=".as") returned 3
	[0154.261] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0154.261] lstrlenW (lpString=".asa") returned 4
	[0154.261] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0154.261] lstrlenW (lpString=".asc") returned 4
	[0154.261] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0154.261] lstrlenW (lpString=".ascx") returned 5
	[0154.261] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0154.261] lstrlenW (lpString=".asm") returned 4
	[0154.261] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0154.261] lstrlenW (lpString=".asmx") returned 5
	[0154.261] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0154.261] lstrlenW (lpString=".asp") returned 4
	[0154.261] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0154.261] lstrlenW (lpString=".aspx") returned 5
	[0154.261] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0154.261] lstrlenW (lpString=".asr") returned 4
	[0154.261] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0154.261] lstrlenW (lpString=".asx") returned 4
	[0154.261] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0154.261] lstrlenW (lpString=".avi") returned 4
	[0154.261] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0154.261] lstrlenW (lpString=".avs") returned 4
	[0154.261] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0154.262] lstrlenW (lpString=".backup") returned 7
	[0154.262] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0154.262] lstrlenW (lpString=".bak") returned 4
	[0154.262] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0154.262] lstrlenW (lpString=".bay") returned 4
	[0154.262] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0154.262] lstrlenW (lpString=".bd") returned 3
	[0154.262] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0154.262] lstrlenW (lpString=".bin") returned 4
	[0154.262] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0154.262] lstrlenW (lpString=".bmp") returned 4
	[0154.262] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0154.262] lstrlenW (lpString=".bz2") returned 4
	[0154.262] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0154.262] lstrlenW (lpString=".c") returned 2
	[0154.262] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0154.262] lstrlenW (lpString=".cdr") returned 4
	[0154.262] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0154.262] lstrlenW (lpString=".cer") returned 4
	[0154.262] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0154.262] lstrlenW (lpString=".cf") returned 3
	[0154.262] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0154.262] lstrlenW (lpString=".cfc") returned 4
	[0154.262] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0154.262] lstrlenW (lpString=".cfm") returned 4
	[0154.262] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0154.262] lstrlenW (lpString=".cfml") returned 5
	[0154.262] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0154.262] lstrlenW (lpString=".cfu") returned 4
	[0154.263] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".chm") returned 4
	[0154.263] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".cin") returned 4
	[0154.263] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".class") returned 6
	[0154.263] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0154.263] lstrlenW (lpString=".clx") returned 4
	[0154.263] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".config") returned 7
	[0154.263] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0154.263] lstrlenW (lpString=".cpp") returned 4
	[0154.263] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".cr2") returned 4
	[0154.263] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".crt") returned 4
	[0154.263] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".crw") returned 4
	[0154.263] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".cs") returned 3
	[0154.263] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0154.263] lstrlenW (lpString=".css") returned 4
	[0154.263] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".csv") returned 4
	[0154.263] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".cub") returned 4
	[0154.263] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".dae") returned 4
	[0154.263] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0154.263] lstrlenW (lpString=".dat") returned 4
	[0154.263] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".db") returned 3
	[0154.264] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0154.264] lstrlenW (lpString=".dbf") returned 4
	[0154.264] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".dbx") returned 4
	[0154.264] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".dc3") returned 4
	[0154.264] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".dcm") returned 4
	[0154.264] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".dcr") returned 4
	[0154.264] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".der") returned 4
	[0154.264] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".dib") returned 4
	[0154.264] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".dic") returned 4
	[0154.264] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".dif") returned 4
	[0154.264] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".divx") returned 5
	[0154.264] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0154.264] lstrlenW (lpString=".djvu") returned 5
	[0154.264] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0154.264] lstrlenW (lpString=".dng") returned 4
	[0154.264] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".doc") returned 4
	[0154.264] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0154.264] lstrlenW (lpString=".docm") returned 5
	[0154.265] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0154.265] lstrlenW (lpString=".docx") returned 5
	[0154.265] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0154.265] lstrlenW (lpString=".dot") returned 4
	[0154.265] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0154.265] lstrlenW (lpString=".dotm") returned 5
	[0154.265] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0154.265] lstrlenW (lpString=".dotx") returned 5
	[0154.265] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0154.265] lstrlenW (lpString=".dpx") returned 4
	[0154.265] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0154.265] lstrlenW (lpString=".dqy") returned 4
	[0154.265] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0154.265] lstrlenW (lpString=".dsn") returned 4
	[0154.265] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0154.265] lstrlenW (lpString=".dt") returned 3
	[0154.265] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0154.265] lstrlenW (lpString=".dtd") returned 4
	[0154.265] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0154.265] lstrlenW (lpString=".dwg") returned 4
	[0154.265] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0154.265] lstrlenW (lpString=".dwt") returned 4
	[0154.265] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0154.265] lstrlenW (lpString=".dx") returned 3
	[0154.265] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0154.265] lstrlenW (lpString=".dxf") returned 4
	[0154.265] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0154.265] lstrlenW (lpString=".edml") returned 5
	[0154.265] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0154.266] lstrlenW (lpString=".efd") returned 4
	[0154.266] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0154.266] lstrlenW (lpString=".elf") returned 4
	[0154.266] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0154.266] lstrlenW (lpString=".emf") returned 4
	[0154.266] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0154.266] lstrlenW (lpString=".emz") returned 4
	[0154.266] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0154.266] lstrlenW (lpString=".epf") returned 4
	[0154.266] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0154.266] lstrlenW (lpString=".eps") returned 4
	[0154.266] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0154.266] lstrlenW (lpString=".epsf") returned 5
	[0154.266] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0154.266] lstrlenW (lpString=".epsp") returned 5
	[0154.266] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0154.266] lstrlenW (lpString=".erf") returned 4
	[0154.266] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0154.266] lstrlenW (lpString=".exr") returned 4
	[0154.266] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0154.266] lstrlenW (lpString=".f4v") returned 4
	[0154.266] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0154.266] lstrlenW (lpString=".fido") returned 5
	[0154.266] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0154.266] lstrlenW (lpString=".flm") returned 4
	[0154.266] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0154.266] lstrlenW (lpString=".flv") returned 4
	[0154.266] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0154.266] lstrlenW (lpString=".frm") returned 4
	[0154.266] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".fxg") returned 4
	[0154.267] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".geo") returned 4
	[0154.267] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".gif") returned 4
	[0154.267] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".grs") returned 4
	[0154.267] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".gz") returned 3
	[0154.267] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0154.267] lstrlenW (lpString=".h") returned 2
	[0154.267] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0154.267] lstrlenW (lpString=".hdr") returned 4
	[0154.267] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".hpp") returned 4
	[0154.267] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".hta") returned 4
	[0154.267] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".htc") returned 4
	[0154.267] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".htm") returned 4
	[0154.267] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".html") returned 5
	[0154.267] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0154.267] lstrlenW (lpString=".icb") returned 4
	[0154.267] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".ics") returned 4
	[0154.267] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0154.267] lstrlenW (lpString=".iff") returned 4
	[0154.267] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".inc") returned 4
	[0154.268] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".indd") returned 5
	[0154.268] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0154.268] lstrlenW (lpString=".ini") returned 4
	[0154.268] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".iqy") returned 4
	[0154.268] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".j2c") returned 4
	[0154.268] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".j2k") returned 4
	[0154.268] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".java") returned 5
	[0154.268] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0154.268] lstrlenW (lpString=".jp2") returned 4
	[0154.268] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".jpc") returned 4
	[0154.268] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".jpe") returned 4
	[0154.268] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".jpeg") returned 5
	[0154.268] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0154.268] lstrlenW (lpString=".jpf") returned 4
	[0154.268] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".jpg") returned 4
	[0154.268] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".jpx") returned 4
	[0154.268] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0154.268] lstrlenW (lpString=".js") returned 3
	[0154.269] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0154.269] lstrlenW (lpString=".jsf") returned 4
	[0154.269] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0154.269] lstrlenW (lpString=".json") returned 5
	[0154.269] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0154.269] lstrlenW (lpString=".jsp") returned 4
	[0154.269] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0154.269] lstrlenW (lpString=".kdc") returned 4
	[0154.269] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0154.269] lstrlenW (lpString=".kmz") returned 4
	[0154.269] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0154.269] lstrlenW (lpString=".kwm") returned 4
	[0154.269] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0154.269] lstrlenW (lpString=".lasso") returned 6
	[0154.269] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0154.269] lstrlenW (lpString=".lbi") returned 4
	[0154.269] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0154.269] lstrlenW (lpString=".lgf") returned 4
	[0154.269] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0154.269] lstrlenW (lpString=".lgp") returned 4
	[0154.269] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0154.269] lstrlenW (lpString=".log") returned 4
	[0154.269] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0154.269] lstrlenW (lpString=".m1v") returned 4
	[0154.269] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0154.269] lstrlenW (lpString=".m4a") returned 4
	[0154.269] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0154.269] lstrlenW (lpString=".m4v") returned 4
	[0154.269] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0154.270] lstrlenW (lpString=".max") returned 4
	[0154.270] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0154.270] lstrlenW (lpString=".md") returned 3
	[0154.270] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0154.270] lstrlenW (lpString=".mda") returned 4
	[0154.270] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0154.270] lstrlenW (lpString=".mdb") returned 4
	[0154.270] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0154.270] lstrlenW (lpString=".mde") returned 4
	[0154.270] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0154.270] lstrlenW (lpString=".mdf") returned 4
	[0154.270] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0154.270] lstrlenW (lpString=".mdw") returned 4
	[0154.270] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0154.270] lstrlenW (lpString=".mef") returned 4
	[0154.270] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0154.270] lstrlenW (lpString=".mft") returned 4
	[0154.270] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0154.270] lstrlenW (lpString=".mfw") returned 4
	[0154.270] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0154.270] lstrlenW (lpString=".mht") returned 4
	[0154.270] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".mhtml") returned 6
	[0154.271] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0154.271] lstrlenW (lpString=".mka") returned 4
	[0154.271] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".mkidx") returned 6
	[0154.271] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0154.271] lstrlenW (lpString=".mkv") returned 4
	[0154.271] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".mos") returned 4
	[0154.271] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".mov") returned 4
	[0154.271] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".mp3") returned 4
	[0154.271] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".mp4") returned 4
	[0154.271] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".mpeg") returned 5
	[0154.271] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0154.271] lstrlenW (lpString=".mpg") returned 4
	[0154.271] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".mpv") returned 4
	[0154.271] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".mrw") returned 4
	[0154.271] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".msg") returned 4
	[0154.271] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".mxl") returned 4
	[0154.271] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".myd") returned 4
	[0154.271] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0154.271] lstrlenW (lpString=".myi") returned 4
	[0154.271] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".nef") returned 4
	[0154.272] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".nrw") returned 4
	[0154.272] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".obj") returned 4
	[0154.272] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".odb") returned 4
	[0154.272] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".odc") returned 4
	[0154.272] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".odm") returned 4
	[0154.272] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".odp") returned 4
	[0154.272] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".ods") returned 4
	[0154.272] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".oft") returned 4
	[0154.272] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".one") returned 4
	[0154.272] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".onepkg") returned 7
	[0154.272] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0154.272] lstrlenW (lpString=".onetoc2") returned 8
	[0154.272] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0154.272] lstrlenW (lpString=".opt") returned 4
	[0154.272] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".oqy") returned 4
	[0154.272] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".orf") returned 4
	[0154.272] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0154.272] lstrlenW (lpString=".p12") returned 4
	[0154.273] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".p7b") returned 4
	[0154.273] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".p7c") returned 4
	[0154.273] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pam") returned 4
	[0154.273] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pbm") returned 4
	[0154.273] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pct") returned 4
	[0154.273] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pcx") returned 4
	[0154.273] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pdd") returned 4
	[0154.273] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pdf") returned 4
	[0154.273] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pdp") returned 4
	[0154.273] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pef") returned 4
	[0154.273] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pem") returned 4
	[0154.273] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pff") returned 4
	[0154.273] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pfm") returned 4
	[0154.273] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pfx") returned 4
	[0154.273] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".pgm") returned 4
	[0154.273] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0154.273] lstrlenW (lpString=".php") returned 4
	[0154.274] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0154.274] lstrlenW (lpString=".php3") returned 5
	[0154.274] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0154.274] lstrlenW (lpString=".php4") returned 5
	[0154.274] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0154.274] lstrlenW (lpString=".php5") returned 5
	[0154.274] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0154.274] lstrlenW (lpString=".phtml") returned 6
	[0154.274] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0154.274] lstrlenW (lpString=".pict") returned 5
	[0154.274] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0154.274] lstrlenW (lpString=".pl") returned 3
	[0154.274] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0154.274] lstrlenW (lpString=".pls") returned 4
	[0154.274] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0154.274] lstrlenW (lpString=".pm") returned 3
	[0154.274] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0154.274] lstrlenW (lpString=".png") returned 4
	[0154.274] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0154.274] lstrlenW (lpString=".pnm") returned 4
	[0154.274] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0154.274] lstrlenW (lpString=".pot") returned 4
	[0154.274] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0154.274] lstrlenW (lpString=".potm") returned 5
	[0154.274] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0154.274] lstrlenW (lpString=".potx") returned 5
	[0154.274] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0154.274] lstrlenW (lpString=".ppa") returned 4
	[0154.274] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0154.274] lstrlenW (lpString=".ppam") returned 5
	[0154.274] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0154.274] lstrlenW (lpString=".ppm") returned 4
	[0154.274] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0154.274] lstrlenW (lpString=".pps") returned 4
	[0154.275] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0154.275] lstrlenW (lpString=".ppsm") returned 5
	[0154.275] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0154.275] lstrlenW (lpString=".ppt") returned 4
	[0154.275] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0154.275] lstrlenW (lpString=".pptm") returned 5
	[0154.275] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0154.275] lstrlenW (lpString=".pptx") returned 5
	[0154.275] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0154.275] lstrlenW (lpString=".prn") returned 4
	[0154.275] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0154.275] lstrlenW (lpString=".ps") returned 3
	[0154.275] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0154.275] lstrlenW (lpString=".psb") returned 4
	[0154.275] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0154.275] lstrlenW (lpString=".psd") returned 4
	[0154.275] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0154.275] lstrlenW (lpString=".pst") returned 4
	[0154.275] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0154.275] lstrlenW (lpString=".ptx") returned 4
	[0154.275] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0154.275] lstrlenW (lpString=".pub") returned 4
	[0154.275] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0154.275] lstrlenW (lpString=".pwm") returned 4
	[0154.275] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0154.275] lstrlenW (lpString=".pxr") returned 4
	[0154.275] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0154.275] lstrlenW (lpString=".py") returned 3
	[0154.275] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0154.275] lstrlenW (lpString=".qt") returned 3
	[0154.275] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0154.275] lstrlenW (lpString=".r3d") returned 4
	[0154.275] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0154.276] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8be6b3b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8be6b3b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c0c941, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.276] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c7f0c4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ca52be, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.276] FindNextFileW (in: hFindFile=0x4ef150, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c7f0c4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ca52be, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.276] FindClose (in: hFindFile=0x4ef150 | out: hFindFile=0x4ef150) returned 1
	[0154.277] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.277] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1028", cAlternateFileName="")) returned 1
	[0154.277] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.277] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70eb0
	[0154.440] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.440] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8b27fef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8b27fef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8b4de2a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.440] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8b7402a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8b7402a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ba3ef8, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.440] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8ca52be, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8ca52be, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ca52be, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.440] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8ca52be, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8ca52be, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ca52be, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.440] FindClose (in: hFindFile=0x3e70eb0 | out: hFindFile=0x3e70eb0) returned 1
	[0154.441] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.441] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8bc0527, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8bc0527, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1029", cAlternateFileName="")) returned 1
	[0154.441] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.441] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8bc0527, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8bc0527, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70d70
	[0154.443] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8bc0527, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8bc0527, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.443] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8b7402a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8b7402a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ba3ef8, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.443] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8bc0527, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8bc0527, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8bc0527, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.443] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd924ef58, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd924ef58, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9274e6a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.443] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd924ef58, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd924ef58, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9274e6a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.443] FindClose (in: hFindFile=0x3e70d70 | out: hFindFile=0x3e70d70) returned 1
	[0154.444] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.444] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c32d6d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1030", cAlternateFileName="")) returned 1
	[0154.444] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.444] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c32d6d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70b30
	[0154.446] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c32d6d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.446] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c32d6d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c32d6d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.446] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c0c941, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c0c941, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9143c0c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.447] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9274e6a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9274e6a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9274e6a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.447] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9274e6a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9274e6a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9274e6a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.447] FindClose (in: hFindFile=0x3e70b30 | out: hFindFile=0x3e70b30) returned 1
	[0154.447] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.447] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c7f0c4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1031", cAlternateFileName="")) returned 1
	[0154.447] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.448] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c7f0c4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70af0
	[0154.450] FindNextFileW (in: hFindFile=0x3e70af0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c7f0c4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.450] FindNextFileW (in: hFindFile=0x3e70af0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c32d6d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c58e7d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.450] FindNextFileW (in: hFindFile=0x3e70af0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c58e7d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c58e7d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c58e7d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.450] FindNextFileW (in: hFindFile=0x3e70af0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd929b3c8, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd929b3c8, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd929b3c8, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.451] FindNextFileW (in: hFindFile=0x3e70af0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd929b3c8, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd929b3c8, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd929b3c8, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.451] FindClose (in: hFindFile=0x3e70af0 | out: hFindFile=0x3e70af0) returned 1
	[0154.451] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.451] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd90d1785, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd90d1785, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1032", cAlternateFileName="")) returned 1
	[0154.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.451] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd90d1785, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd90d1785, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70f70
	[0154.453] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd90d1785, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd90d1785, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.453] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd90ab659, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd90ab659, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd90ab659, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.453] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd90d1785, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd90d1785, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd90d1785, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.454] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd94d7644, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd94d7644, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd94fd7fa, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.454] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd94d7644, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd94d7644, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd94fd7fa, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.454] FindClose (in: hFindFile=0x3e70f70 | out: hFindFile=0x3e70f70) returned 1
	[0154.454] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.454] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9143c0c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9143c0c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1033", cAlternateFileName="")) returned 1
	[0154.455] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.455] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9143c0c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9143c0c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70eb0
	[0154.456] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9143c0c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9143c0c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.456] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd90f7ae6, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd90f7ae6, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd911dc06, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.457] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd911dc06, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd911dc06, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd911dc06, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.457] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd94fd7fa, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd94fd7fa, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd985369f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.457] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd94fd7fa, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd94fd7fa, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd985369f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.457] FindClose (in: hFindFile=0x3e70eb0 | out: hFindFile=0x3e70eb0) returned 1
	[0154.457] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.457] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd95e30ce, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd95e30ce, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1035", cAlternateFileName="")) returned 1
	[0154.458] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.458] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd95e30ce, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd95e30ce, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70f30
	[0154.460] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd95e30ce, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd95e30ce, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.460] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd95c9487, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd95c9487, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd95d5a18, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.460] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd95e30ce, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd95e30ce, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd95e30ce, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.460] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd985369f, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd985369f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd985369f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.460] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd985369f, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd985369f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd985369f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.460] FindClose (in: hFindFile=0x3e70f30 | out: hFindFile=0x3e70f30) returned 1
	[0154.461] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.461] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1036", cAlternateFileName="")) returned 1
	[0154.461] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.461] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70eb0
	[0154.463] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.463] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd960976b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.463] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd960976b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd99120d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.463] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd98798c0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd98798c0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd98798c0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.463] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd98798c0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd98798c0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd98798c0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.463] FindClose (in: hFindFile=0x3e70eb0 | out: hFindFile=0x3e70eb0) returned 1
	[0154.464] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.464] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e6f59b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e6f59b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1037", cAlternateFileName="")) returned 1
	[0154.464] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.464] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e6f59b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e6f59b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70bf0
	[0154.466] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e6f59b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e6f59b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.466] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d18114, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d18114, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e493d9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.466] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d18114, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d18114, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d3e206, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.466] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e493d9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e493d9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e493d9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.466] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e493d9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e493d9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e493d9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.466] FindClose (in: hFindFile=0x3e70bf0 | out: hFindFile=0x3e70bf0) returned 1
	[0154.467] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.467] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a433e3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a433e3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1038", cAlternateFileName="")) returned 1
	[0154.467] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.467] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a433e3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a433e3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70cf0
	[0154.469] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a433e3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a433e3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.469] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd99d0df5, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd99d0df5, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a1d1bf, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.469] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a1d1bf, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a1d1bf, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a433e3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.469] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9fc6ae2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9fc6ae2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fc6ae2, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.469] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9fc6ae2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9fc6ae2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fc6ae2, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.469] FindClose (in: hFindFile=0x3e70cf0 | out: hFindFile=0x3e70cf0) returned 1
	[0154.470] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.470] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a8faca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a8faca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1040", cAlternateFileName="")) returned 1
	[0154.470] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.470] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a8faca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a8faca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e709b0
	[0154.472] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a8faca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a8faca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.472] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a433e3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a433e3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a6964c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.472] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a433e3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a433e3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a6964c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.472] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda418e98, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda418e98, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda43f0d0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.472] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda418e98, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda418e98, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda43f0d0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.472] FindClose (in: hFindFile=0x3e709b0 | out: hFindFile=0x3e709b0) returned 1
	[0154.473] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.473] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9fecd0a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fecd0a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1041", cAlternateFileName="")) returned 1
	[0154.473] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.473] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9fecd0a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fecd0a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70db0
	[0154.475] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9fecd0a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fecd0a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.475] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a6964c, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a6964c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a8faca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.475] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a8faca, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a8faca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fecd0a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.476] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda43f0d0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda43f0d0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda43f0d0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.476] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda43f0d0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda43f0d0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda43f0d0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.476] FindClose (in: hFindFile=0x3e70db0 | out: hFindFile=0x3e70db0) returned 1
	[0154.476] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.476] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9adbde1, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9adbde1, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1042", cAlternateFileName="")) returned 1
	[0154.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.477] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9adbde1, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9adbde1, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70db0
	[0154.648] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9adbde1, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9adbde1, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.655] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9ab5b33, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9ab5b33, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9ab5b33, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.658] lstrlenW (lpString="eula.rtf.id-B4197730.[admin@stex777.com].money") returned 46
	[0154.661] lstrlenW (lpString=".1cd") returned 4
	[0154.675] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0154.681] lstrlenW (lpString=".3ds") returned 4
	[0154.681] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0154.683] lstrlenW (lpString=".3fr") returned 4
	[0154.683] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0154.683] lstrlenW (lpString=".3g2") returned 4
	[0154.683] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0154.683] lstrlenW (lpString=".3gp") returned 4
	[0154.683] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0154.683] lstrlenW (lpString=".7z") returned 3
	[0154.683] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0154.683] lstrlenW (lpString=".accda") returned 6
	[0154.683] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0154.683] lstrlenW (lpString=".accdb") returned 6
	[0154.683] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0154.683] lstrlenW (lpString=".accdc") returned 6
	[0154.683] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0154.683] lstrlenW (lpString=".accde") returned 6
	[0154.683] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0154.683] lstrlenW (lpString=".accdt") returned 6
	[0154.683] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0154.683] lstrlenW (lpString=".accdw") returned 6
	[0154.683] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0154.683] lstrlenW (lpString=".adb") returned 4
	[0154.683] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".adp") returned 4
	[0154.684] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".ai") returned 3
	[0154.684] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0154.684] lstrlenW (lpString=".ai3") returned 4
	[0154.684] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".ai4") returned 4
	[0154.684] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".ai5") returned 4
	[0154.684] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".ai6") returned 4
	[0154.684] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".ai7") returned 4
	[0154.684] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".ai8") returned 4
	[0154.684] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".anim") returned 5
	[0154.684] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0154.684] lstrlenW (lpString=".arw") returned 4
	[0154.684] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".as") returned 3
	[0154.684] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0154.684] lstrlenW (lpString=".asa") returned 4
	[0154.684] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".asc") returned 4
	[0154.684] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".ascx") returned 5
	[0154.684] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0154.684] lstrlenW (lpString=".asm") returned 4
	[0154.684] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0154.684] lstrlenW (lpString=".asmx") returned 5
	[0154.685] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0154.685] lstrlenW (lpString=".asp") returned 4
	[0154.685] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".aspx") returned 5
	[0154.685] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0154.685] lstrlenW (lpString=".asr") returned 4
	[0154.685] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".asx") returned 4
	[0154.685] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".avi") returned 4
	[0154.685] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".avs") returned 4
	[0154.685] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".backup") returned 7
	[0154.685] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0154.685] lstrlenW (lpString=".bak") returned 4
	[0154.685] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".bay") returned 4
	[0154.685] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".bd") returned 3
	[0154.685] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0154.685] lstrlenW (lpString=".bin") returned 4
	[0154.685] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".bmp") returned 4
	[0154.685] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".bz2") returned 4
	[0154.685] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".c") returned 2
	[0154.685] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0154.685] lstrlenW (lpString=".cdr") returned 4
	[0154.685] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".cer") returned 4
	[0154.685] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0154.685] lstrlenW (lpString=".cf") returned 3
	[0154.686] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0154.686] lstrlenW (lpString=".cfc") returned 4
	[0154.686] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0154.686] lstrlenW (lpString=".cfm") returned 4
	[0154.686] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0154.686] lstrlenW (lpString=".cfml") returned 5
	[0154.686] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0154.686] lstrlenW (lpString=".cfu") returned 4
	[0154.686] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0154.686] lstrlenW (lpString=".chm") returned 4
	[0154.686] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0154.686] lstrlenW (lpString=".cin") returned 4
	[0154.686] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0154.686] lstrlenW (lpString=".class") returned 6
	[0154.686] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0154.686] lstrlenW (lpString=".clx") returned 4
	[0154.686] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0154.686] lstrlenW (lpString=".config") returned 7
	[0154.686] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0154.686] lstrlenW (lpString=".cpp") returned 4
	[0154.686] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0154.686] lstrlenW (lpString=".cr2") returned 4
	[0154.686] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0154.686] lstrlenW (lpString=".crt") returned 4
	[0154.686] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0154.686] lstrlenW (lpString=".crw") returned 4
	[0154.686] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0154.686] lstrlenW (lpString=".cs") returned 3
	[0154.686] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0154.686] lstrlenW (lpString=".css") returned 4
	[0154.686] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0154.686] lstrlenW (lpString=".csv") returned 4
	[0154.687] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".cub") returned 4
	[0154.687] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".dae") returned 4
	[0154.687] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".dat") returned 4
	[0154.687] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".db") returned 3
	[0154.687] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0154.687] lstrlenW (lpString=".dbf") returned 4
	[0154.687] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".dbx") returned 4
	[0154.687] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".dc3") returned 4
	[0154.687] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".dcm") returned 4
	[0154.687] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".dcr") returned 4
	[0154.687] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".der") returned 4
	[0154.687] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".dib") returned 4
	[0154.687] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".dic") returned 4
	[0154.687] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".dif") returned 4
	[0154.687] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0154.687] lstrlenW (lpString=".divx") returned 5
	[0154.687] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0154.687] lstrlenW (lpString=".djvu") returned 5
	[0154.687] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0154.687] lstrlenW (lpString=".dng") returned 4
	[0154.687] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0154.688] lstrlenW (lpString=".doc") returned 4
	[0154.688] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0154.688] lstrlenW (lpString=".docm") returned 5
	[0154.688] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0154.688] lstrlenW (lpString=".docx") returned 5
	[0154.688] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0154.688] lstrlenW (lpString=".dot") returned 4
	[0154.688] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0154.688] lstrlenW (lpString=".dotm") returned 5
	[0154.688] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0154.688] lstrlenW (lpString=".dotx") returned 5
	[0154.688] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0154.688] lstrlenW (lpString=".dpx") returned 4
	[0154.688] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0154.688] lstrlenW (lpString=".dqy") returned 4
	[0154.688] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0154.688] lstrlenW (lpString=".dsn") returned 4
	[0154.688] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0154.688] lstrlenW (lpString=".dt") returned 3
	[0154.688] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0154.688] lstrlenW (lpString=".dtd") returned 4
	[0154.688] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0154.688] lstrlenW (lpString=".dwg") returned 4
	[0154.688] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0154.688] lstrlenW (lpString=".dwt") returned 4
	[0154.688] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0154.688] lstrlenW (lpString=".dx") returned 3
	[0154.688] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0154.688] lstrlenW (lpString=".dxf") returned 4
	[0154.688] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0154.688] lstrlenW (lpString=".edml") returned 5
	[0154.688] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0154.689] lstrlenW (lpString=".efd") returned 4
	[0154.689] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".elf") returned 4
	[0154.689] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".emf") returned 4
	[0154.689] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".emz") returned 4
	[0154.689] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".epf") returned 4
	[0154.689] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".eps") returned 4
	[0154.689] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".epsf") returned 5
	[0154.689] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0154.689] lstrlenW (lpString=".epsp") returned 5
	[0154.689] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0154.689] lstrlenW (lpString=".erf") returned 4
	[0154.689] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".exr") returned 4
	[0154.689] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".f4v") returned 4
	[0154.689] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".fido") returned 5
	[0154.689] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0154.689] lstrlenW (lpString=".flm") returned 4
	[0154.689] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".flv") returned 4
	[0154.689] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".frm") returned 4
	[0154.689] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".fxg") returned 4
	[0154.689] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0154.689] lstrlenW (lpString=".geo") returned 4
	[0154.690] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".gif") returned 4
	[0154.690] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".grs") returned 4
	[0154.690] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".gz") returned 3
	[0154.690] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0154.690] lstrlenW (lpString=".h") returned 2
	[0154.690] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0154.690] lstrlenW (lpString=".hdr") returned 4
	[0154.690] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".hpp") returned 4
	[0154.690] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".hta") returned 4
	[0154.690] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".htc") returned 4
	[0154.690] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".htm") returned 4
	[0154.690] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".html") returned 5
	[0154.690] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0154.690] lstrlenW (lpString=".icb") returned 4
	[0154.690] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".ics") returned 4
	[0154.690] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".iff") returned 4
	[0154.690] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".inc") returned 4
	[0154.690] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0154.690] lstrlenW (lpString=".indd") returned 5
	[0154.690] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0154.690] lstrlenW (lpString=".ini") returned 4
	[0154.690] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".iqy") returned 4
	[0154.691] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".j2c") returned 4
	[0154.691] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".j2k") returned 4
	[0154.691] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".java") returned 5
	[0154.691] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0154.691] lstrlenW (lpString=".jp2") returned 4
	[0154.691] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".jpc") returned 4
	[0154.691] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".jpe") returned 4
	[0154.691] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".jpeg") returned 5
	[0154.691] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0154.691] lstrlenW (lpString=".jpf") returned 4
	[0154.691] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".jpg") returned 4
	[0154.691] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".jpx") returned 4
	[0154.691] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".js") returned 3
	[0154.691] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0154.691] lstrlenW (lpString=".jsf") returned 4
	[0154.691] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".json") returned 5
	[0154.691] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0154.691] lstrlenW (lpString=".jsp") returned 4
	[0154.691] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0154.691] lstrlenW (lpString=".kdc") returned 4
	[0154.691] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".kmz") returned 4
	[0154.692] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".kwm") returned 4
	[0154.692] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".lasso") returned 6
	[0154.692] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0154.692] lstrlenW (lpString=".lbi") returned 4
	[0154.692] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".lgf") returned 4
	[0154.692] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".lgp") returned 4
	[0154.692] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".log") returned 4
	[0154.692] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".m1v") returned 4
	[0154.692] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".m4a") returned 4
	[0154.692] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".m4v") returned 4
	[0154.692] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".max") returned 4
	[0154.692] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".md") returned 3
	[0154.692] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0154.692] lstrlenW (lpString=".mda") returned 4
	[0154.692] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".mdb") returned 4
	[0154.692] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".mde") returned 4
	[0154.692] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0154.692] lstrlenW (lpString=".mdf") returned 4
	[0154.693] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mdw") returned 4
	[0154.693] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mef") returned 4
	[0154.693] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mft") returned 4
	[0154.693] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mfw") returned 4
	[0154.693] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mht") returned 4
	[0154.693] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mhtml") returned 6
	[0154.693] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0154.693] lstrlenW (lpString=".mka") returned 4
	[0154.693] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mkidx") returned 6
	[0154.693] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0154.693] lstrlenW (lpString=".mkv") returned 4
	[0154.693] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mos") returned 4
	[0154.693] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mov") returned 4
	[0154.693] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mp3") returned 4
	[0154.693] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mp4") returned 4
	[0154.693] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mpeg") returned 5
	[0154.693] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0154.693] lstrlenW (lpString=".mpg") returned 4
	[0154.693] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0154.693] lstrlenW (lpString=".mpv") returned 4
	[0154.694] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".mrw") returned 4
	[0154.694] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".msg") returned 4
	[0154.694] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".mxl") returned 4
	[0154.694] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".myd") returned 4
	[0154.694] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".myi") returned 4
	[0154.694] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".nef") returned 4
	[0154.694] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".nrw") returned 4
	[0154.694] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".obj") returned 4
	[0154.694] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".odb") returned 4
	[0154.694] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".odc") returned 4
	[0154.694] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".odm") returned 4
	[0154.694] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".odp") returned 4
	[0154.694] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".ods") returned 4
	[0154.694] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".oft") returned 4
	[0154.694] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".one") returned 4
	[0154.694] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0154.694] lstrlenW (lpString=".onepkg") returned 7
	[0154.694] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0154.695] lstrlenW (lpString=".onetoc2") returned 8
	[0154.695] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0154.695] lstrlenW (lpString=".opt") returned 4
	[0154.695] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".oqy") returned 4
	[0154.695] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".orf") returned 4
	[0154.695] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".p12") returned 4
	[0154.695] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".p7b") returned 4
	[0154.695] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".p7c") returned 4
	[0154.695] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".pam") returned 4
	[0154.695] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".pbm") returned 4
	[0154.695] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".pct") returned 4
	[0154.695] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".pcx") returned 4
	[0154.695] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".pdd") returned 4
	[0154.695] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".pdf") returned 4
	[0154.695] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".pdp") returned 4
	[0154.695] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".pef") returned 4
	[0154.695] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0154.695] lstrlenW (lpString=".pem") returned 4
	[0154.696] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0154.696] lstrlenW (lpString=".pff") returned 4
	[0154.696] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0154.696] lstrlenW (lpString=".pfm") returned 4
	[0154.696] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0154.696] lstrlenW (lpString=".pfx") returned 4
	[0154.696] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0154.696] lstrlenW (lpString=".pgm") returned 4
	[0154.696] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0154.696] lstrlenW (lpString=".php") returned 4
	[0154.696] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0154.696] lstrlenW (lpString=".php3") returned 5
	[0154.696] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0154.696] lstrlenW (lpString=".php4") returned 5
	[0154.696] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0154.696] lstrlenW (lpString=".php5") returned 5
	[0154.696] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0154.696] lstrlenW (lpString=".phtml") returned 6
	[0154.696] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0154.696] lstrlenW (lpString=".pict") returned 5
	[0154.696] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0154.696] lstrlenW (lpString=".pl") returned 3
	[0154.696] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0154.696] lstrlenW (lpString=".pls") returned 4
	[0154.696] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0154.696] lstrlenW (lpString=".pm") returned 3
	[0154.696] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0154.696] lstrlenW (lpString=".png") returned 4
	[0154.696] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0154.696] lstrlenW (lpString=".pnm") returned 4
	[0154.696] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0154.696] lstrlenW (lpString=".pot") returned 4
	[0154.697] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0154.697] lstrlenW (lpString=".potm") returned 5
	[0154.697] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0154.697] lstrlenW (lpString=".potx") returned 5
	[0154.697] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0154.697] lstrlenW (lpString=".ppa") returned 4
	[0154.697] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0154.697] lstrlenW (lpString=".ppam") returned 5
	[0154.697] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0154.697] lstrlenW (lpString=".ppm") returned 4
	[0154.697] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0154.697] lstrlenW (lpString=".pps") returned 4
	[0154.697] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0154.697] lstrlenW (lpString=".ppsm") returned 5
	[0154.697] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0154.697] lstrlenW (lpString=".ppt") returned 4
	[0154.697] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0154.697] lstrlenW (lpString=".pptm") returned 5
	[0154.697] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0154.697] lstrlenW (lpString=".pptx") returned 5
	[0154.697] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0154.697] lstrlenW (lpString=".prn") returned 4
	[0154.697] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0154.697] lstrlenW (lpString=".ps") returned 3
	[0154.697] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0154.697] lstrlenW (lpString=".psb") returned 4
	[0154.697] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0154.697] lstrlenW (lpString=".psd") returned 4
	[0154.697] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0154.697] lstrlenW (lpString=".pst") returned 4
	[0154.697] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0154.697] lstrlenW (lpString=".ptx") returned 4
	[0154.697] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0154.698] lstrlenW (lpString=".pub") returned 4
	[0154.698] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0154.698] lstrlenW (lpString=".pwm") returned 4
	[0154.698] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0154.698] lstrlenW (lpString=".pxr") returned 4
	[0154.698] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0154.698] lstrlenW (lpString=".py") returned 3
	[0154.698] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0154.698] lstrlenW (lpString=".qt") returned 3
	[0154.698] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0154.698] lstrlenW (lpString=".r3d") returned 4
	[0154.698] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0154.698] lstrlenW (lpString=".raf") returned 4
	[0154.698] lstrcmpiW (lpString1=".raf", lpString2="oney") returned -1
	[0154.698] lstrlenW (lpString=".rar") returned 4
	[0154.698] lstrcmpiW (lpString1=".rar", lpString2="oney") returned -1
	[0154.698] lstrlenW (lpString=".raw") returned 4
	[0154.698] lstrcmpiW (lpString1=".raw", lpString2="oney") returned -1
	[0154.698] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9ab5b33, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9ab5b33, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9adbde1, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.698] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda4656d3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda4656d3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda4656d3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.698] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda4656d3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda4656d3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda4656d3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.698] FindClose (in: hFindFile=0x3e70db0 | out: hFindFile=0x3e70db0) returned 1
	[0154.699] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.699] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9d8a7e4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d8a7e4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1043", cAlternateFileName="")) returned 1
	[0154.699] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.699] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9d8a7e4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d8a7e4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70f70
	[0154.700] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9d8a7e4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d8a7e4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.700] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d64483, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d64483, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d8a7e4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.700] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d3e206, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d3e206, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d64483, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.700] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda4656d3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda4656d3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda4656d3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.700] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda4656d3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda4656d3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda4656d3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.700] FindClose (in: hFindFile=0x3e70f70 | out: hFindFile=0x3e70f70) returned 1
	[0154.701] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.701] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dd6d2c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dd6d2c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1044", cAlternateFileName="")) returned 1
	[0154.701] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.701] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dd6d2c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dd6d2c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70a70
	[0154.702] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dd6d2c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dd6d2c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.702] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d8a7e4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d8a7e4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9db0b47, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.702] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d8a7e4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d8a7e4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9db0b47, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.702] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa0edc9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa0edc9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa815e2, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.702] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa0edc9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa0edc9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa815e2, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.702] FindClose (in: hFindFile=0x3e70a70 | out: hFindFile=0x3e70a70) returned 1
	[0154.703] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.703] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dfcfe0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dfcfe0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1045", cAlternateFileName="")) returned 1
	[0154.703] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.703] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dfcfe0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dfcfe0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70eb0
	[0154.704] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dfcfe0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dfcfe0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.704] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9db0b47, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9db0b47, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dfcfe0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.704] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9dd6d2c, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9dd6d2c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dd6d2c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.704] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda48b6e0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda48b6e0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5bcb62, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.704] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda48b6e0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda48b6e0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5bcb62, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.704] FindClose (in: hFindFile=0x3e70eb0 | out: hFindFile=0x3e70eb0) returned 1
	[0154.705] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.705] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e2309f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e2309f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1046", cAlternateFileName="")) returned 1
	[0154.705] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.705] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e2309f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e2309f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70f30
	[0154.706] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e2309f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e2309f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.706] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9dfcfe0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9dfcfe0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dfcfe0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.706] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e2309f, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e2309f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e2309f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.706] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5bcb62, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5bcb62, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5bcb62, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.706] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5bcb62, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5bcb62, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5bcb62, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.707] FindClose (in: hFindFile=0x3e70f30 | out: hFindFile=0x3e70f30) returned 1
	[0154.707] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.707] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f2e3fb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f2e3fb, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1049", cAlternateFileName="")) returned 1
	[0154.707] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.707] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f2e3fb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f2e3fb, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70db0
	[0154.708] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f2e3fb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f2e3fb, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.708] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e493d9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e493d9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f07f1e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.708] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e6f59b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e6f59b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e6f59b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.708] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5e2aef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5e2aef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5e2aef, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.709] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5e2aef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5e2aef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5e2aef, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.709] FindClose (in: hFindFile=0x3e70db0 | out: hFindFile=0x3e70db0) returned 1
	[0154.709] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.709] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda275802, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda275802, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1053", cAlternateFileName="")) returned 1
	[0154.709] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.709] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda275802, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda275802, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70a70
	[0154.710] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda275802, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda275802, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.710] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e957fd, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e957fd, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e957fd, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.710] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e957fd, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e957fd, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda275802, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.710] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5e2aef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5e2aef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda608fd0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.711] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5e2aef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5e2aef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda608fd0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.711] FindClose (in: hFindFile=0x3e70a70 | out: hFindFile=0x3e70a70) returned 1
	[0154.711] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.711] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f54614, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f54614, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="1055", cAlternateFileName="")) returned 1
	[0154.711] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.711] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f54614, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f54614, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e71030
	[0154.712] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f54614, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f54614, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.712] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9f2e3fb, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9f2e3fb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f2e3fb, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.712] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9f2e3fb, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9f2e3fb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f54614, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.712] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda608fd0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda608fd0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaaa765b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.713] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda608fd0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda608fd0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaaa765b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.713] FindClose (in: hFindFile=0x3e71030 | out: hFindFile=0x3e71030) returned 1
	[0154.713] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.713] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda334073, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda334073, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="2052", cAlternateFileName="")) returned 1
	[0154.713] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.713] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda334073, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda334073, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e71030
	[0154.714] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda334073, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda334073, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.714] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9f54614, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9f54614, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2e7e05, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.714] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda30deac, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda334073, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.714] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda950364, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda950364, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda950364, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.715] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda950364, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda950364, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda950364, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.715] FindClose (in: hFindFile=0x3e71030 | out: hFindFile=0x3e71030) returned 1
	[0154.715] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.715] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda22a896, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda22a896, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="2070", cAlternateFileName="")) returned 1
	[0154.715] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.715] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda22a896, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda22a896, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70e30
	[0154.716] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda22a896, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda22a896, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.716] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda1dccce, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda1dccce, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda202e2f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.716] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda202e2f, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda202e2f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda202e2f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.716] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda97642e, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda97642e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda97642e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.717] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda97642e, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda97642e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda97642e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.717] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0154.717] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.717] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda29b80c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda29b80c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="3076", cAlternateFileName="")) returned 1
	[0154.717] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.717] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda29b80c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda29b80c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e709b0
	[0154.718] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda29b80c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda29b80c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.718] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda22a896, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda22a896, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda22a896, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.718] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda275802, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda275802, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda29b80c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.718] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda97642e, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda97642e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda97642e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.719] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda97642e, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda97642e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda97642e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.719] FindClose (in: hFindFile=0x3e709b0 | out: hFindFile=0x3e709b0) returned 1
	[0154.719] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.719] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda2c19df, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2c19df, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="3082", cAlternateFileName="")) returned 1
	[0154.719] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.719] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda2c19df, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2c19df, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70ab0
	[0154.720] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda2c19df, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2c19df, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.720] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda29b80c, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda29b80c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2c19df, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.720] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda76053d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda76053d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda76053d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.720] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda99c5ca, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda99c5ca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda99c5ca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.721] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda99c5ca, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda99c5ca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda99c5ca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.721] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0154.721] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.721] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda30deac, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Client", cAlternateFileName="")) returned 1
	[0154.721] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.721] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda30deac, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70d30
	[0154.871] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda30deac, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.871] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda2e7e05, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda2e7e05, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2e7e05, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARAME~1.MON")) returned 1
	[0154.872] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda30deac, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7ac959, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="UIINFO~1.MON")) returned 1
	[0154.872] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda30deac, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7ac959, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="UIINFO~1.MON")) returned 0
	[0154.872] FindClose (in: hFindFile=0x3e70d30 | out: hFindFile=0x3e70d30) returned 1
	[0154.872] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.872] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda334073, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda334073, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda334073, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="DHtmlHeader.html.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DHTMLH~1.MON")) returned 1
	[0154.873] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdae611a5, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdae611a5, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdae8746a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="DisplayIcon.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DISPLA~1.MON")) returned 1
	[0154.873] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda81eec4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda81eec4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Extended", cAlternateFileName="")) returned 1
	[0154.873] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.873] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda81eec4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda81eec4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70b30
	[0154.874] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda81eec4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda81eec4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.874] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda35b1c3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda35b1c3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda35b1c3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARAME~1.MON")) returned 1
	[0154.874] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda3805e2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda3805e2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda89181c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="UIINFO~1.MON")) returned 1
	[0154.874] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda3805e2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda3805e2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda89181c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="UIINFO~1.MON")) returned 0
	[0154.875] FindClose (in: hFindFile=0x3e70b30 | out: hFindFile=0x3e70b30) returned 1
	[0154.875] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.875] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0154.875] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.875] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e709b0
	[0154.877] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.878] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa0edc9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa0edc9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa0edc9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PRINTI~1.MON")) returned 1
	[0154.878] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa0edc9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa0edc9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa350c3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="ROTATE~1.MON")) returned 1
	[0154.878] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa350c3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa350c3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa350c3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="ROTATE~2.MON")) returned 1
	[0154.878] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa815e2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa815e2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa815e2, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="ROTATE~3.MON")) returned 1
	[0154.878] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa815e2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa815e2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaf9248a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="ROTATE~4.MON")) returned 1
	[0154.878] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaaa765b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaaa765b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaacda84, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="ROB1B7~1.MON")) returned 1
	[0154.878] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaacda84, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaacda84, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaacda84, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="RO3937~1.MON")) returned 1
	[0154.879] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaacda84, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaacda84, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaaf3b65, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="RO591E~1.MON")) returned 1
	[0154.879] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaed3878, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaed3878, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaed3878, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="RO9DE5~1.MON")) returned 1
	[0154.879] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdae8746a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdae8746a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaead790, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SAVEIC~1.MON")) returned 1
	[0154.879] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaead790, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaead790, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaead790, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPI~1.MON")) returned 1
	[0154.879] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaed3878, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaed3878, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaed3878, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="STOPIC~1.MON")) returned 1
	[0154.879] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaefbd26, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaefbd26, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaefbd26, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SYSREQ~1.MON")) returned 1
	[0154.879] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaf1fda9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaf1fda9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdb2caa4d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SYSREQ~2.MON")) returned 1
	[0154.879] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaf1fda9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaf1fda9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaf1fda9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WARNIC~1.MON")) returned 1
	[0154.880] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaf1fda9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaf1fda9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaf1fda9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WARNIC~1.MON")) returned 0
	[0154.880] FindClose (in: hFindFile=0x3e709b0 | out: hFindFile=0x3e709b0) returned 1
	[0154.880] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.880] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda67b7b7, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda67b7b7, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda6a17a0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="header.bmp.id-B4197730.[admin@stex777.com].money", cAlternateFileName="HEADER~1.MON")) returned 1
	[0154.881] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xdd13096f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="netfx_Core.mzz.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NETFX_~1.MON")) returned 1
	[0154.881] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xdbc5405a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="netfx_Core_x64.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NETFX_~2.MON")) returned 1
	[0154.881] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdb1be6cf, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdb1be6cf, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdb5531fc, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="netfx_Core_x86.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NETFX_~3.MON")) returned 1
	[0154.882] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xdd798e9e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="netfx_Extended.mzz.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NETFX_~4.MON")) returned 1
	[0154.882] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdb97f1b4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdb97f1b4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdbf4eca5, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="netfx_Extended_x64.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NE0B87~1.MON")) returned 1
	[0154.882] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdbc5405a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdbc5405a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdbdf7798, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="netfx_Extended_x86.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NE563F~1.MON")) returned 1
	[0154.882] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda6a17a0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda6a17a0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda6c7b45, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="ParameterInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARAME~1.MON")) returned 1
	[0154.882] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdbf9b228, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdbf9b228, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdcb60bf7, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="RGB9RAST_x64.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="RGB9RA~1.MON")) returned 1
	[0154.882] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc1d7516, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdc1d7516, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdc1d7516, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="RGB9Rast_x86.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="RGB9RA~2.MON")) returned 1
	[0154.883] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc1d7516, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdc1d7516, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdc1ff6cb, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Setup.exe.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPE~1.MON")) returned 1
	[0154.883] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc1ff6cb, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdc1ff6cb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdcb3a9ce, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="SetupEngine.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPE~2.MON")) returned 1
	[0154.883] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdcb60bf7, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdcb60bf7, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdcb8744b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="SetupUi.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPU~2.MON")) returned 1
	[0154.883] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda6edc88, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda6edc88, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaaf3b65, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="SetupUi.xsd.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPU~1.MON")) returned 1
	[0154.883] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdcbae0b1, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdcbae0b1, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdd04b973, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="SetupUtility.exe.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPU~3.MON")) returned 1
	[0154.883] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda7868ac, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda7868ac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7868ac, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="SplashScreen.bmp.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SPLASH~1.MON")) returned 1
	[0154.883] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdcfd94f6, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdcfd94f6, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdcfd94f6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="sqmapi.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SQMAPI~1.MON")) returned 1
	[0154.883] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda7868ac, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda7868ac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7868ac, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Strings.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="STRING~1.MON")) returned 1
	[0154.883] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdab1c36b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdab1c36b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdab1c36b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="UiInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="UIINFO~1.MON")) returned 1
	[0154.884] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda7d2c66, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda7d2c66, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7d2c66, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="watermark.bmp.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WATERM~1.MON")) returned 1
	[0154.884] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xde63697c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WINDOW~1.MON")) returned 1
	[0154.884] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xddec302a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WINDOW~2.MON")) returned 1
	[0154.884] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xde822da6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WINDOW~3.MON")) returned 1
	[0154.884] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xde5dca31, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WINDOW~4.MON")) returned 1
	[0154.884] FindNextFileW (in: hFindFile=0x4ef110, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xde5dca31, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WINDOW~4.MON")) returned 0
	[0154.884] FindClose (in: hFindFile=0x4ef110 | out: hFindFile=0x4ef110) returned 1
	[0154.884] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0154.884] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xda7f8d37, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7f8d37, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0154.884] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e30060
	[0154.884] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xda7f8d37, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7f8d37, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName=".", cAlternateFileName="")) returned 0x3e70b70
	[0154.885] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xda7f8d37, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7f8d37, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.886] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0154.890] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0154.890] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0154.890] lstrlenW (lpString="BCD.LOG1") returned 8
	[0154.890] lstrlenW (lpString=".1cd") returned 4
	[0154.891] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0154.891] lstrlenW (lpString=".3ds") returned 4
	[0154.891] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1
	[0154.891] lstrlenW (lpString=".3fr") returned 4
	[0154.891] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1
	[0154.891] lstrlenW (lpString=".3g2") returned 4
	[0154.891] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1
	[0154.891] lstrlenW (lpString=".3gp") returned 4
	[0154.891] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1
	[0154.891] lstrlenW (lpString=".7z") returned 3
	[0154.891] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0154.891] lstrlenW (lpString=".accda") returned 6
	[0154.891] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1
	[0154.891] lstrlenW (lpString=".accdb") returned 6
	[0154.891] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1
	[0154.891] lstrlenW (lpString=".accdc") returned 6
	[0154.891] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1
	[0154.891] lstrlenW (lpString=".accde") returned 6
	[0154.891] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1
	[0154.891] lstrlenW (lpString=".accdt") returned 6
	[0154.891] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1
	[0154.891] lstrlenW (lpString=".accdw") returned 6
	[0154.891] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1
	[0154.891] lstrlenW (lpString=".adb") returned 4
	[0154.891] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1
	[0154.891] lstrlenW (lpString=".adp") returned 4
	[0154.891] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1
	[0154.891] lstrlenW (lpString=".ai") returned 3
	[0154.891] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1
	[0154.891] lstrlenW (lpString=".ai3") returned 4
	[0154.891] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1
	[0154.891] lstrlenW (lpString=".ai4") returned 4
	[0154.891] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1
	[0154.892] lstrlenW (lpString=".ai5") returned 4
	[0154.892] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1
	[0154.892] lstrlenW (lpString=".ai6") returned 4
	[0154.892] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1
	[0154.892] lstrlenW (lpString=".ai7") returned 4
	[0154.892] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1
	[0154.892] lstrlenW (lpString=".ai8") returned 4
	[0154.892] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1
	[0154.892] lstrlenW (lpString=".anim") returned 5
	[0154.892] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1
	[0154.892] lstrlenW (lpString=".arw") returned 4
	[0154.892] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1
	[0154.892] lstrlenW (lpString=".as") returned 3
	[0154.892] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1
	[0154.892] lstrlenW (lpString=".asa") returned 4
	[0154.892] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1
	[0154.892] lstrlenW (lpString=".asc") returned 4
	[0154.892] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1
	[0154.892] lstrlenW (lpString=".ascx") returned 5
	[0154.892] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1
	[0154.892] lstrlenW (lpString=".asm") returned 4
	[0154.892] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1
	[0154.892] lstrlenW (lpString=".asmx") returned 5
	[0154.892] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1
	[0154.892] lstrlenW (lpString=".asp") returned 4
	[0154.892] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1
	[0154.892] lstrlenW (lpString=".aspx") returned 5
	[0154.892] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1
	[0154.892] lstrlenW (lpString=".asr") returned 4
	[0154.892] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".asx") returned 4
	[0154.893] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".avi") returned 4
	[0154.893] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".avs") returned 4
	[0154.893] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".backup") returned 7
	[0154.893] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1
	[0154.893] lstrlenW (lpString=".bak") returned 4
	[0154.893] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".bay") returned 4
	[0154.893] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".bd") returned 3
	[0154.893] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1
	[0154.893] lstrlenW (lpString=".bin") returned 4
	[0154.893] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".bmp") returned 4
	[0154.893] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".bz2") returned 4
	[0154.893] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".c") returned 2
	[0154.893] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1
	[0154.893] lstrlenW (lpString=".cdr") returned 4
	[0154.893] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".cer") returned 4
	[0154.893] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".cf") returned 3
	[0154.893] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1
	[0154.893] lstrlenW (lpString=".cfc") returned 4
	[0154.893] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".cfm") returned 4
	[0154.893] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1
	[0154.893] lstrlenW (lpString=".cfml") returned 5
	[0154.893] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1
	[0154.894] lstrlenW (lpString=".cfu") returned 4
	[0154.894] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".chm") returned 4
	[0154.894] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".cin") returned 4
	[0154.894] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".class") returned 6
	[0154.894] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1
	[0154.894] lstrlenW (lpString=".clx") returned 4
	[0154.894] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".config") returned 7
	[0154.894] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1
	[0154.894] lstrlenW (lpString=".cpp") returned 4
	[0154.894] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".cr2") returned 4
	[0154.894] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".crt") returned 4
	[0154.894] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".crw") returned 4
	[0154.894] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".cs") returned 3
	[0154.894] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1
	[0154.894] lstrlenW (lpString=".css") returned 4
	[0154.894] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".csv") returned 4
	[0154.894] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".cub") returned 4
	[0154.894] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".dae") returned 4
	[0154.894] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1
	[0154.894] lstrlenW (lpString=".dat") returned 4
	[0154.894] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".db") returned 3
	[0154.895] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1
	[0154.895] lstrlenW (lpString=".dbf") returned 4
	[0154.895] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".dbx") returned 4
	[0154.895] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".dc3") returned 4
	[0154.895] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".dcm") returned 4
	[0154.895] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".dcr") returned 4
	[0154.895] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".der") returned 4
	[0154.895] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".dib") returned 4
	[0154.895] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".dic") returned 4
	[0154.895] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".dif") returned 4
	[0154.895] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".divx") returned 5
	[0154.895] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1
	[0154.895] lstrlenW (lpString=".djvu") returned 5
	[0154.895] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1
	[0154.895] lstrlenW (lpString=".dng") returned 4
	[0154.895] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".doc") returned 4
	[0154.895] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0154.895] lstrlenW (lpString=".docm") returned 5
	[0154.895] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1
	[0154.895] lstrlenW (lpString=".docx") returned 5
	[0154.895] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0154.896] lstrlenW (lpString=".dot") returned 4
	[0154.896] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1
	[0154.896] lstrlenW (lpString=".dotm") returned 5
	[0154.896] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1
	[0154.896] lstrlenW (lpString=".dotx") returned 5
	[0154.896] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1
	[0154.896] lstrlenW (lpString=".dpx") returned 4
	[0154.896] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1
	[0154.896] lstrlenW (lpString=".dqy") returned 4
	[0154.896] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1
	[0154.896] lstrlenW (lpString=".dsn") returned 4
	[0154.896] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1
	[0154.896] lstrlenW (lpString=".dt") returned 3
	[0154.896] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1
	[0154.896] lstrlenW (lpString=".dtd") returned 4
	[0154.896] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1
	[0154.896] lstrlenW (lpString=".dwg") returned 4
	[0154.896] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1
	[0154.896] lstrlenW (lpString=".dwt") returned 4
	[0154.896] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1
	[0154.896] lstrlenW (lpString=".dx") returned 3
	[0154.896] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1
	[0154.896] lstrlenW (lpString=".dxf") returned 4
	[0154.896] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1
	[0154.896] lstrlenW (lpString=".edml") returned 5
	[0154.896] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1
	[0154.896] lstrlenW (lpString=".efd") returned 4
	[0154.896] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1
	[0154.896] lstrlenW (lpString=".elf") returned 4
	[0154.896] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1
	[0154.896] lstrlenW (lpString=".emf") returned 4
	[0154.897] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".emz") returned 4
	[0154.897] lstrcmpiW (lpString1=".emz", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".epf") returned 4
	[0154.897] lstrcmpiW (lpString1=".epf", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".eps") returned 4
	[0154.897] lstrcmpiW (lpString1=".eps", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".epsf") returned 5
	[0154.897] lstrcmpiW (lpString1=".epsf", lpString2=".LOG1") returned -1
	[0154.897] lstrlenW (lpString=".epsp") returned 5
	[0154.897] lstrcmpiW (lpString1=".epsp", lpString2=".LOG1") returned -1
	[0154.897] lstrlenW (lpString=".erf") returned 4
	[0154.897] lstrcmpiW (lpString1=".erf", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".exr") returned 4
	[0154.897] lstrcmpiW (lpString1=".exr", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".f4v") returned 4
	[0154.897] lstrcmpiW (lpString1=".f4v", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".fido") returned 5
	[0154.897] lstrcmpiW (lpString1=".fido", lpString2=".LOG1") returned -1
	[0154.897] lstrlenW (lpString=".flm") returned 4
	[0154.897] lstrcmpiW (lpString1=".flm", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".flv") returned 4
	[0154.897] lstrcmpiW (lpString1=".flv", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".frm") returned 4
	[0154.897] lstrcmpiW (lpString1=".frm", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".fxg") returned 4
	[0154.897] lstrcmpiW (lpString1=".fxg", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".geo") returned 4
	[0154.897] lstrcmpiW (lpString1=".geo", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".gif") returned 4
	[0154.897] lstrcmpiW (lpString1=".gif", lpString2="LOG1") returned -1
	[0154.897] lstrlenW (lpString=".grs") returned 4
	[0154.898] lstrcmpiW (lpString1=".grs", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".gz") returned 3
	[0154.898] lstrcmpiW (lpString1=".gz", lpString2="OG1") returned -1
	[0154.898] lstrlenW (lpString=".h") returned 2
	[0154.898] lstrcmpiW (lpString1=".h", lpString2="G1") returned -1
	[0154.898] lstrlenW (lpString=".hdr") returned 4
	[0154.898] lstrcmpiW (lpString1=".hdr", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".hpp") returned 4
	[0154.898] lstrcmpiW (lpString1=".hpp", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".hta") returned 4
	[0154.898] lstrcmpiW (lpString1=".hta", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".htc") returned 4
	[0154.898] lstrcmpiW (lpString1=".htc", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".htm") returned 4
	[0154.898] lstrcmpiW (lpString1=".htm", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".html") returned 5
	[0154.898] lstrcmpiW (lpString1=".html", lpString2=".LOG1") returned -1
	[0154.898] lstrlenW (lpString=".icb") returned 4
	[0154.898] lstrcmpiW (lpString1=".icb", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".ics") returned 4
	[0154.898] lstrcmpiW (lpString1=".ics", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".iff") returned 4
	[0154.898] lstrcmpiW (lpString1=".iff", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".inc") returned 4
	[0154.898] lstrcmpiW (lpString1=".inc", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".indd") returned 5
	[0154.898] lstrcmpiW (lpString1=".indd", lpString2=".LOG1") returned -1
	[0154.898] lstrlenW (lpString=".ini") returned 4
	[0154.898] lstrcmpiW (lpString1=".ini", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".iqy") returned 4
	[0154.898] lstrcmpiW (lpString1=".iqy", lpString2="LOG1") returned -1
	[0154.898] lstrlenW (lpString=".j2c") returned 4
	[0154.898] lstrcmpiW (lpString1=".j2c", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".j2k") returned 4
	[0154.899] lstrcmpiW (lpString1=".j2k", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".java") returned 5
	[0154.899] lstrcmpiW (lpString1=".java", lpString2=".LOG1") returned -1
	[0154.899] lstrlenW (lpString=".jp2") returned 4
	[0154.899] lstrcmpiW (lpString1=".jp2", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".jpc") returned 4
	[0154.899] lstrcmpiW (lpString1=".jpc", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".jpe") returned 4
	[0154.899] lstrcmpiW (lpString1=".jpe", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".jpeg") returned 5
	[0154.899] lstrcmpiW (lpString1=".jpeg", lpString2=".LOG1") returned -1
	[0154.899] lstrlenW (lpString=".jpf") returned 4
	[0154.899] lstrcmpiW (lpString1=".jpf", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".jpg") returned 4
	[0154.899] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".jpx") returned 4
	[0154.899] lstrcmpiW (lpString1=".jpx", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".js") returned 3
	[0154.899] lstrcmpiW (lpString1=".js", lpString2="OG1") returned -1
	[0154.899] lstrlenW (lpString=".jsf") returned 4
	[0154.899] lstrcmpiW (lpString1=".jsf", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".json") returned 5
	[0154.899] lstrcmpiW (lpString1=".json", lpString2=".LOG1") returned -1
	[0154.899] lstrlenW (lpString=".jsp") returned 4
	[0154.899] lstrcmpiW (lpString1=".jsp", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".kdc") returned 4
	[0154.899] lstrcmpiW (lpString1=".kdc", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".kmz") returned 4
	[0154.899] lstrcmpiW (lpString1=".kmz", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".kwm") returned 4
	[0154.899] lstrcmpiW (lpString1=".kwm", lpString2="LOG1") returned -1
	[0154.899] lstrlenW (lpString=".lasso") returned 6
	[0154.900] lstrcmpiW (lpString1=".lasso", lpString2="D.LOG1") returned -1
	[0154.900] lstrlenW (lpString=".lbi") returned 4
	[0154.900] lstrcmpiW (lpString1=".lbi", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".lgf") returned 4
	[0154.900] lstrcmpiW (lpString1=".lgf", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".lgp") returned 4
	[0154.900] lstrcmpiW (lpString1=".lgp", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".log") returned 4
	[0154.900] lstrcmpiW (lpString1=".log", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".m1v") returned 4
	[0154.900] lstrcmpiW (lpString1=".m1v", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".m4a") returned 4
	[0154.900] lstrcmpiW (lpString1=".m4a", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".m4v") returned 4
	[0154.900] lstrcmpiW (lpString1=".m4v", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".max") returned 4
	[0154.900] lstrcmpiW (lpString1=".max", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".md") returned 3
	[0154.900] lstrcmpiW (lpString1=".md", lpString2="OG1") returned -1
	[0154.900] lstrlenW (lpString=".mda") returned 4
	[0154.900] lstrcmpiW (lpString1=".mda", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".mdb") returned 4
	[0154.900] lstrcmpiW (lpString1=".mdb", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".mde") returned 4
	[0154.900] lstrcmpiW (lpString1=".mde", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".mdf") returned 4
	[0154.900] lstrcmpiW (lpString1=".mdf", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".mdw") returned 4
	[0154.900] lstrcmpiW (lpString1=".mdw", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".mef") returned 4
	[0154.900] lstrcmpiW (lpString1=".mef", lpString2="LOG1") returned -1
	[0154.900] lstrlenW (lpString=".mft") returned 4
	[0154.900] lstrcmpiW (lpString1=".mft", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mfw") returned 4
	[0154.901] lstrcmpiW (lpString1=".mfw", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mht") returned 4
	[0154.901] lstrcmpiW (lpString1=".mht", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mhtml") returned 6
	[0154.901] lstrcmpiW (lpString1=".mhtml", lpString2="D.LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mka") returned 4
	[0154.901] lstrcmpiW (lpString1=".mka", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mkidx") returned 6
	[0154.901] lstrcmpiW (lpString1=".mkidx", lpString2="D.LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mkv") returned 4
	[0154.901] lstrcmpiW (lpString1=".mkv", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mos") returned 4
	[0154.901] lstrcmpiW (lpString1=".mos", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mov") returned 4
	[0154.901] lstrcmpiW (lpString1=".mov", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mp3") returned 4
	[0154.901] lstrcmpiW (lpString1=".mp3", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mp4") returned 4
	[0154.901] lstrcmpiW (lpString1=".mp4", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mpeg") returned 5
	[0154.901] lstrcmpiW (lpString1=".mpeg", lpString2=".LOG1") returned 1
	[0154.901] lstrlenW (lpString=".mpg") returned 4
	[0154.901] lstrcmpiW (lpString1=".mpg", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mpv") returned 4
	[0154.901] lstrcmpiW (lpString1=".mpv", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mrw") returned 4
	[0154.901] lstrcmpiW (lpString1=".mrw", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".msg") returned 4
	[0154.901] lstrcmpiW (lpString1=".msg", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".mxl") returned 4
	[0154.901] lstrcmpiW (lpString1=".mxl", lpString2="LOG1") returned -1
	[0154.901] lstrlenW (lpString=".myd") returned 4
	[0154.902] lstrcmpiW (lpString1=".myd", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".myi") returned 4
	[0154.902] lstrcmpiW (lpString1=".myi", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".nef") returned 4
	[0154.902] lstrcmpiW (lpString1=".nef", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".nrw") returned 4
	[0154.902] lstrcmpiW (lpString1=".nrw", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".obj") returned 4
	[0154.902] lstrcmpiW (lpString1=".obj", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".odb") returned 4
	[0154.902] lstrcmpiW (lpString1=".odb", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".odc") returned 4
	[0154.902] lstrcmpiW (lpString1=".odc", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".odm") returned 4
	[0154.902] lstrcmpiW (lpString1=".odm", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".odp") returned 4
	[0154.902] lstrcmpiW (lpString1=".odp", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".ods") returned 4
	[0154.902] lstrcmpiW (lpString1=".ods", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".oft") returned 4
	[0154.902] lstrcmpiW (lpString1=".oft", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".one") returned 4
	[0154.902] lstrcmpiW (lpString1=".one", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".onepkg") returned 7
	[0154.902] lstrcmpiW (lpString1=".onepkg", lpString2="CD.LOG1") returned -1
	[0154.902] lstrlenW (lpString=".onetoc2") returned 8
	[0154.902] lstrcmpiW (lpString1=".onetoc2", lpString2="BCD.LOG1") returned -1
	[0154.902] lstrlenW (lpString=".opt") returned 4
	[0154.902] lstrcmpiW (lpString1=".opt", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".oqy") returned 4
	[0154.902] lstrcmpiW (lpString1=".oqy", lpString2="LOG1") returned -1
	[0154.902] lstrlenW (lpString=".orf") returned 4
	[0154.902] lstrcmpiW (lpString1=".orf", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".p12") returned 4
	[0154.903] lstrcmpiW (lpString1=".p12", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".p7b") returned 4
	[0154.903] lstrcmpiW (lpString1=".p7b", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".p7c") returned 4
	[0154.903] lstrcmpiW (lpString1=".p7c", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pam") returned 4
	[0154.903] lstrcmpiW (lpString1=".pam", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pbm") returned 4
	[0154.903] lstrcmpiW (lpString1=".pbm", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pct") returned 4
	[0154.903] lstrcmpiW (lpString1=".pct", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pcx") returned 4
	[0154.903] lstrcmpiW (lpString1=".pcx", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pdd") returned 4
	[0154.903] lstrcmpiW (lpString1=".pdd", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pdf") returned 4
	[0154.903] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pdp") returned 4
	[0154.903] lstrcmpiW (lpString1=".pdp", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pef") returned 4
	[0154.903] lstrcmpiW (lpString1=".pef", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pem") returned 4
	[0154.903] lstrcmpiW (lpString1=".pem", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pff") returned 4
	[0154.903] lstrcmpiW (lpString1=".pff", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pfm") returned 4
	[0154.903] lstrcmpiW (lpString1=".pfm", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pfx") returned 4
	[0154.903] lstrcmpiW (lpString1=".pfx", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".pgm") returned 4
	[0154.903] lstrcmpiW (lpString1=".pgm", lpString2="LOG1") returned -1
	[0154.903] lstrlenW (lpString=".php") returned 4
	[0154.904] lstrcmpiW (lpString1=".php", lpString2="LOG1") returned -1
	[0154.904] lstrlenW (lpString=".php3") returned 5
	[0154.904] lstrcmpiW (lpString1=".php3", lpString2=".LOG1") returned 1
	[0154.904] lstrlenW (lpString=".php4") returned 5
	[0154.904] lstrcmpiW (lpString1=".php4", lpString2=".LOG1") returned 1
	[0154.904] lstrlenW (lpString=".php5") returned 5
	[0154.904] lstrcmpiW (lpString1=".php5", lpString2=".LOG1") returned 1
	[0154.904] lstrlenW (lpString=".phtml") returned 6
	[0154.904] lstrcmpiW (lpString1=".phtml", lpString2="D.LOG1") returned -1
	[0154.904] lstrlenW (lpString=".pict") returned 5
	[0154.904] lstrcmpiW (lpString1=".pict", lpString2=".LOG1") returned 1
	[0154.904] lstrlenW (lpString=".pl") returned 3
	[0154.904] lstrcmpiW (lpString1=".pl", lpString2="OG1") returned -1
	[0154.904] lstrlenW (lpString=".pls") returned 4
	[0154.904] lstrcmpiW (lpString1=".pls", lpString2="LOG1") returned -1
	[0154.904] lstrlenW (lpString=".pm") returned 3
	[0154.904] lstrcmpiW (lpString1=".pm", lpString2="OG1") returned -1
	[0154.904] lstrlenW (lpString=".png") returned 4
	[0154.904] lstrcmpiW (lpString1=".png", lpString2="LOG1") returned -1
	[0154.904] lstrlenW (lpString=".pnm") returned 4
	[0154.904] lstrcmpiW (lpString1=".pnm", lpString2="LOG1") returned -1
	[0154.904] lstrlenW (lpString=".pot") returned 4
	[0154.904] lstrcmpiW (lpString1=".pot", lpString2="LOG1") returned -1
	[0154.904] lstrlenW (lpString=".potm") returned 5
	[0154.904] lstrcmpiW (lpString1=".potm", lpString2=".LOG1") returned 1
	[0154.904] lstrlenW (lpString=".potx") returned 5
	[0154.904] lstrcmpiW (lpString1=".potx", lpString2=".LOG1") returned 1
	[0154.904] lstrlenW (lpString=".ppa") returned 4
	[0154.904] lstrcmpiW (lpString1=".ppa", lpString2="LOG1") returned -1
	[0154.904] lstrlenW (lpString=".ppam") returned 5
	[0154.904] lstrcmpiW (lpString1=".ppam", lpString2=".LOG1") returned 1
	[0154.904] lstrlenW (lpString=".ppm") returned 4
	[0154.904] lstrcmpiW (lpString1=".ppm", lpString2="LOG1") returned -1
	[0154.905] lstrlenW (lpString=".pps") returned 4
	[0154.905] lstrcmpiW (lpString1=".pps", lpString2="LOG1") returned -1
	[0154.905] lstrlenW (lpString=".ppsm") returned 5
	[0154.905] lstrcmpiW (lpString1=".ppsm", lpString2=".LOG1") returned 1
	[0154.905] lstrlenW (lpString=".ppt") returned 4
	[0154.905] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0154.905] lstrlenW (lpString=".pptm") returned 5
	[0154.905] lstrcmpiW (lpString1=".pptm", lpString2=".LOG1") returned 1
	[0154.905] lstrlenW (lpString=".pptx") returned 5
	[0154.905] lstrcmpiW (lpString1=".pptx", lpString2=".LOG1") returned 1
	[0154.905] lstrlenW (lpString=".prn") returned 4
	[0154.905] lstrcmpiW (lpString1=".prn", lpString2="LOG1") returned -1
	[0154.905] lstrlenW (lpString=".ps") returned 3
	[0154.905] lstrcmpiW (lpString1=".ps", lpString2="OG1") returned -1
	[0154.905] lstrlenW (lpString=".psb") returned 4
	[0154.905] lstrcmpiW (lpString1=".psb", lpString2="LOG1") returned -1
	[0154.905] lstrlenW (lpString=".psd") returned 4
	[0154.905] lstrcmpiW (lpString1=".psd", lpString2="LOG1") returned -1
	[0154.905] lstrlenW (lpString=".pst") returned 4
	[0154.905] lstrcmpiW (lpString1=".pst", lpString2="LOG1") returned -1
	[0154.905] lstrlenW (lpString=".ptx") returned 4
	[0154.905] lstrcmpiW (lpString1=".ptx", lpString2="LOG1") returned -1
	[0154.905] lstrlenW (lpString=".pub") returned 4
	[0154.905] lstrcmpiW (lpString1=".pub", lpString2="LOG1") returned -1
	[0154.905] lstrlenW (lpString=".pwm") returned 4
	[0154.905] lstrcmpiW (lpString1=".pwm", lpString2="LOG1") returned -1
	[0154.905] lstrlenW (lpString=".pxr") returned 4
	[0154.905] lstrcmpiW (lpString1=".pxr", lpString2="LOG1") returned -1
	[0154.905] lstrlenW (lpString=".py") returned 3
	[0154.905] lstrcmpiW (lpString1=".py", lpString2="OG1") returned -1
	[0154.905] lstrlenW (lpString=".qt") returned 3
	[0154.905] lstrcmpiW (lpString1=".qt", lpString2="OG1") returned -1
	[0154.905] lstrlenW (lpString=".r3d") returned 4
	[0154.905] lstrcmpiW (lpString1=".r3d", lpString2="LOG1") returned -1
	[0154.906] lstrlenW (lpString=".raf") returned 4
	[0154.906] lstrcmpiW (lpString1=".raf", lpString2="LOG1") returned -1
	[0154.906] lstrlenW (lpString=".rar") returned 4
	[0154.906] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0154.906] lstrlenW (lpString=".raw") returned 4
	[0154.906] lstrcmpiW (lpString1=".raw", lpString2="LOG1") returned -1
	[0154.906] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0154.906] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0154.906] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.906] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70cf0
	[0154.906] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0154.906] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0154.906] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0154.906] FindClose (in: hFindFile=0x3e70cf0 | out: hFindFile=0x3e70cf0) returned 1
	[0154.907] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0154.907] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0154.907] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xda7f8d37, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda7f8d37, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7f8d37, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="BOOTSTAT.DAT.id-B4197730.[admin@stex777.com].money", cAlternateFileName="BOOTST~1.MON")) returned 1
	[0154.907] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0154.907] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0154.907] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0154.907] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70a70
	[0155.161] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.161] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.161] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.162] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.162] FindClose (in: hFindFile=0x3e70a70 | out: hFindFile=0x3e70a70) returned 1
	[0155.162] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.162] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0155.162] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.162] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70d70
	[0155.163] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.163] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.163] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.163] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.163] FindClose (in: hFindFile=0x3e70d70 | out: hFindFile=0x3e70d70) returned 1
	[0155.163] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.163] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0155.163] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.163] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70eb0
	[0155.163] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.164] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.164] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.164] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.164] FindClose (in: hFindFile=0x3e70eb0 | out: hFindFile=0x3e70eb0) returned 1
	[0155.164] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.164] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0155.164] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.164] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70f70
	[0155.165] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.165] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.165] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.165] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.165] FindClose (in: hFindFile=0x3e70f70 | out: hFindFile=0x3e70f70) returned 1
	[0155.165] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.165] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0155.165] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.165] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70930
	[0155.166] FindNextFileW (in: hFindFile=0x3e70930, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.166] FindNextFileW (in: hFindFile=0x3e70930, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.166] FindNextFileW (in: hFindFile=0x3e70930, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.166] FindClose (in: hFindFile=0x3e70930 | out: hFindFile=0x3e70930) returned 1
	[0155.166] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.166] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0155.167] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.167] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70ab0
	[0155.167] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.167] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.167] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.167] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.167] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0155.167] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.167] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0155.167] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.167] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70ef0
	[0155.168] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.168] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.168] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.168] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.168] FindClose (in: hFindFile=0x3e70ef0 | out: hFindFile=0x3e70ef0) returned 1
	[0155.168] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.168] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0155.169] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.169] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70bf0
	[0155.169] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.169] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.169] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.169] FindClose (in: hFindFile=0x3e70bf0 | out: hFindFile=0x3e70bf0) returned 1
	[0155.170] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.170] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0155.170] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.170] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70f70
	[0155.170] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.170] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.170] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.170] FindClose (in: hFindFile=0x3e70f70 | out: hFindFile=0x3e70f70) returned 1
	[0155.170] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.170] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0155.170] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.170] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70930
	[0155.171] FindNextFileW (in: hFindFile=0x3e70930, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.171] FindNextFileW (in: hFindFile=0x3e70930, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.172] FindNextFileW (in: hFindFile=0x3e70930, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.172] FindNextFileW (in: hFindFile=0x3e70930, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.172] FindClose (in: hFindFile=0x3e70930 | out: hFindFile=0x3e70930) returned 1
	[0155.172] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.172] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0155.172] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.172] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70b30
	[0155.177] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.178] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0155.178] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0155.178] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0155.178] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0155.178] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1
	[0155.178] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1
	[0155.178] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1
	[0155.179] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1
	[0155.179] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1
	[0155.179] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1
	[0155.179] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1
	[0155.179] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1
	[0155.180] lstrlenW (lpString="msyh_boot.ttf") returned 13
	[0155.180] lstrlenW (lpString=".1cd") returned 4
	[0155.180] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0155.180] lstrlenW (lpString=".3ds") returned 4
	[0155.180] lstrcmpiW (lpString1=".3ds", lpString2=".ttf") returned -1
	[0155.180] lstrlenW (lpString=".3fr") returned 4
	[0155.180] lstrcmpiW (lpString1=".3fr", lpString2=".ttf") returned -1
	[0155.180] lstrlenW (lpString=".3g2") returned 4
	[0155.180] lstrcmpiW (lpString1=".3g2", lpString2=".ttf") returned -1
	[0155.180] lstrlenW (lpString=".3gp") returned 4
	[0155.180] lstrcmpiW (lpString1=".3gp", lpString2=".ttf") returned -1
	[0155.180] lstrlenW (lpString=".7z") returned 3
	[0155.180] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0155.180] lstrlenW (lpString=".accda") returned 6
	[0155.180] lstrcmpiW (lpString1=".accda", lpString2="ot.ttf") returned -1
	[0155.180] lstrlenW (lpString=".accdb") returned 6
	[0155.180] lstrcmpiW (lpString1=".accdb", lpString2="ot.ttf") returned -1
	[0155.180] lstrlenW (lpString=".accdc") returned 6
	[0155.180] lstrcmpiW (lpString1=".accdc", lpString2="ot.ttf") returned -1
	[0155.180] lstrlenW (lpString=".accde") returned 6
	[0155.180] lstrcmpiW (lpString1=".accde", lpString2="ot.ttf") returned -1
	[0155.180] lstrlenW (lpString=".accdt") returned 6
	[0155.180] lstrcmpiW (lpString1=".accdt", lpString2="ot.ttf") returned -1
	[0155.180] lstrlenW (lpString=".accdw") returned 6
	[0155.181] lstrcmpiW (lpString1=".accdw", lpString2="ot.ttf") returned -1
	[0155.181] lstrlenW (lpString=".adb") returned 4
	[0155.181] lstrcmpiW (lpString1=".adb", lpString2=".ttf") returned -1
	[0155.181] lstrlenW (lpString=".adp") returned 4
	[0155.181] lstrcmpiW (lpString1=".adp", lpString2=".ttf") returned -1
	[0155.181] lstrlenW (lpString=".ai") returned 3
	[0155.181] lstrcmpiW (lpString1=".ai", lpString2="ttf") returned -1
	[0155.181] lstrlenW (lpString=".ai3") returned 4
	[0155.181] lstrcmpiW (lpString1=".ai3", lpString2=".ttf") returned -1
	[0155.181] lstrlenW (lpString=".ai4") returned 4
	[0155.181] lstrcmpiW (lpString1=".ai4", lpString2=".ttf") returned -1
	[0155.181] lstrlenW (lpString=".ai5") returned 4
	[0155.181] lstrcmpiW (lpString1=".ai5", lpString2=".ttf") returned -1
	[0155.181] lstrlenW (lpString=".ai6") returned 4
	[0155.181] lstrcmpiW (lpString1=".ai6", lpString2=".ttf") returned -1
	[0155.181] lstrlenW (lpString=".ai7") returned 4
	[0155.181] lstrcmpiW (lpString1=".ai7", lpString2=".ttf") returned -1
	[0155.181] lstrlenW (lpString=".ai8") returned 4
	[0155.181] lstrcmpiW (lpString1=".ai8", lpString2=".ttf") returned -1
	[0155.181] lstrlenW (lpString=".anim") returned 5
	[0155.181] lstrcmpiW (lpString1=".anim", lpString2="t.ttf") returned -1
	[0155.181] lstrlenW (lpString=".arw") returned 4
	[0155.181] lstrcmpiW (lpString1=".arw", lpString2=".ttf") returned -1
	[0155.181] lstrlenW (lpString=".as") returned 3
	[0155.181] lstrcmpiW (lpString1=".as", lpString2="ttf") returned -1
	[0155.181] lstrlenW (lpString=".asa") returned 4
	[0155.181] lstrcmpiW (lpString1=".asa", lpString2=".ttf") returned -1
	[0155.181] lstrlenW (lpString=".asc") returned 4
	[0155.181] lstrcmpiW (lpString1=".asc", lpString2=".ttf") returned -1
	[0155.182] lstrlenW (lpString=".ascx") returned 5
	[0155.182] lstrcmpiW (lpString1=".ascx", lpString2="t.ttf") returned -1
	[0155.182] lstrlenW (lpString=".asm") returned 4
	[0155.182] lstrcmpiW (lpString1=".asm", lpString2=".ttf") returned -1
	[0155.182] lstrlenW (lpString=".asmx") returned 5
	[0155.182] lstrcmpiW (lpString1=".asmx", lpString2="t.ttf") returned -1
	[0155.182] lstrlenW (lpString=".asp") returned 4
	[0155.182] lstrcmpiW (lpString1=".asp", lpString2=".ttf") returned -1
	[0155.182] lstrlenW (lpString=".aspx") returned 5
	[0155.182] lstrcmpiW (lpString1=".aspx", lpString2="t.ttf") returned -1
	[0155.182] lstrlenW (lpString=".asr") returned 4
	[0155.182] lstrcmpiW (lpString1=".asr", lpString2=".ttf") returned -1
	[0155.182] lstrlenW (lpString=".asx") returned 4
	[0155.182] lstrcmpiW (lpString1=".asx", lpString2=".ttf") returned -1
	[0155.182] lstrlenW (lpString=".avi") returned 4
	[0155.182] lstrcmpiW (lpString1=".avi", lpString2=".ttf") returned -1
	[0155.182] lstrlenW (lpString=".avs") returned 4
	[0155.182] lstrcmpiW (lpString1=".avs", lpString2=".ttf") returned -1
	[0155.182] lstrlenW (lpString=".backup") returned 7
	[0155.182] lstrcmpiW (lpString1=".backup", lpString2="oot.ttf") returned -1
	[0155.182] lstrlenW (lpString=".bak") returned 4
	[0155.182] lstrcmpiW (lpString1=".bak", lpString2=".ttf") returned -1
	[0155.182] lstrlenW (lpString=".bay") returned 4
	[0155.183] lstrcmpiW (lpString1=".bay", lpString2=".ttf") returned -1
	[0155.183] lstrlenW (lpString=".bd") returned 3
	[0155.183] lstrcmpiW (lpString1=".bd", lpString2="ttf") returned -1
	[0155.183] lstrlenW (lpString=".bin") returned 4
	[0155.183] lstrcmpiW (lpString1=".bin", lpString2=".ttf") returned -1
	[0155.183] lstrlenW (lpString=".bmp") returned 4
	[0155.183] lstrcmpiW (lpString1=".bmp", lpString2=".ttf") returned -1
	[0155.183] lstrlenW (lpString=".bz2") returned 4
	[0155.183] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0155.183] lstrlenW (lpString=".c") returned 2
	[0155.183] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0155.183] lstrlenW (lpString=".cdr") returned 4
	[0155.183] lstrcmpiW (lpString1=".cdr", lpString2=".ttf") returned -1
	[0155.183] lstrlenW (lpString=".cer") returned 4
	[0155.183] lstrcmpiW (lpString1=".cer", lpString2=".ttf") returned -1
	[0155.183] lstrlenW (lpString=".cf") returned 3
	[0155.183] lstrcmpiW (lpString1=".cf", lpString2="ttf") returned -1
	[0155.183] lstrlenW (lpString=".cfc") returned 4
	[0155.183] lstrcmpiW (lpString1=".cfc", lpString2=".ttf") returned -1
	[0155.183] lstrlenW (lpString=".cfm") returned 4
	[0155.183] lstrcmpiW (lpString1=".cfm", lpString2=".ttf") returned -1
	[0155.183] lstrlenW (lpString=".cfml") returned 5
	[0155.183] lstrcmpiW (lpString1=".cfml", lpString2="t.ttf") returned -1
	[0155.183] lstrlenW (lpString=".cfu") returned 4
	[0155.183] lstrcmpiW (lpString1=".cfu", lpString2=".ttf") returned -1
	[0155.183] lstrlenW (lpString=".chm") returned 4
	[0155.183] lstrcmpiW (lpString1=".chm", lpString2=".ttf") returned -1
	[0155.183] lstrlenW (lpString=".cin") returned 4
	[0155.183] lstrcmpiW (lpString1=".cin", lpString2=".ttf") returned -1
	[0155.183] lstrlenW (lpString=".class") returned 6
	[0155.184] lstrcmpiW (lpString1=".class", lpString2="ot.ttf") returned -1
	[0155.184] lstrlenW (lpString=".clx") returned 4
	[0155.184] lstrcmpiW (lpString1=".clx", lpString2=".ttf") returned -1
	[0155.184] lstrlenW (lpString=".config") returned 7
	[0155.184] lstrcmpiW (lpString1=".config", lpString2="oot.ttf") returned -1
	[0155.184] lstrlenW (lpString=".cpp") returned 4
	[0155.184] lstrcmpiW (lpString1=".cpp", lpString2=".ttf") returned -1
	[0155.184] lstrlenW (lpString=".cr2") returned 4
	[0155.184] lstrcmpiW (lpString1=".cr2", lpString2=".ttf") returned -1
	[0155.184] lstrlenW (lpString=".crt") returned 4
	[0155.184] lstrcmpiW (lpString1=".crt", lpString2=".ttf") returned -1
	[0155.184] lstrlenW (lpString=".crw") returned 4
	[0155.184] lstrcmpiW (lpString1=".crw", lpString2=".ttf") returned -1
	[0155.184] lstrlenW (lpString=".cs") returned 3
	[0155.184] lstrcmpiW (lpString1=".cs", lpString2="ttf") returned -1
	[0155.184] lstrlenW (lpString=".css") returned 4
	[0155.184] lstrcmpiW (lpString1=".css", lpString2=".ttf") returned -1
	[0155.184] lstrlenW (lpString=".csv") returned 4
	[0155.184] lstrcmpiW (lpString1=".csv", lpString2=".ttf") returned -1
	[0155.184] lstrlenW (lpString=".cub") returned 4
	[0155.184] lstrcmpiW (lpString1=".cub", lpString2=".ttf") returned -1
	[0155.184] lstrlenW (lpString=".dae") returned 4
	[0155.184] lstrcmpiW (lpString1=".dae", lpString2=".ttf") returned -1
	[0155.185] lstrlenW (lpString=".dat") returned 4
	[0155.185] lstrcmpiW (lpString1=".dat", lpString2=".ttf") returned -1
	[0155.185] lstrlenW (lpString=".db") returned 3
	[0155.185] lstrcmpiW (lpString1=".db", lpString2="ttf") returned -1
	[0155.185] lstrlenW (lpString=".dbf") returned 4
	[0155.185] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0155.185] lstrlenW (lpString=".dbx") returned 4
	[0155.185] lstrcmpiW (lpString1=".dbx", lpString2=".ttf") returned -1
	[0155.185] lstrlenW (lpString=".dc3") returned 4
	[0155.185] lstrcmpiW (lpString1=".dc3", lpString2=".ttf") returned -1
	[0155.185] lstrlenW (lpString=".dcm") returned 4
	[0155.185] lstrcmpiW (lpString1=".dcm", lpString2=".ttf") returned -1
	[0155.185] lstrlenW (lpString=".dcr") returned 4
	[0155.185] lstrcmpiW (lpString1=".dcr", lpString2=".ttf") returned -1
	[0155.185] lstrlenW (lpString=".der") returned 4
	[0155.185] lstrcmpiW (lpString1=".der", lpString2=".ttf") returned -1
	[0155.185] lstrlenW (lpString=".dib") returned 4
	[0155.185] lstrcmpiW (lpString1=".dib", lpString2=".ttf") returned -1
	[0155.185] lstrlenW (lpString=".dic") returned 4
	[0155.185] lstrcmpiW (lpString1=".dic", lpString2=".ttf") returned -1
	[0155.185] lstrlenW (lpString=".dif") returned 4
	[0155.185] lstrcmpiW (lpString1=".dif", lpString2=".ttf") returned -1
	[0155.185] lstrlenW (lpString=".divx") returned 5
	[0155.185] lstrcmpiW (lpString1=".divx", lpString2="t.ttf") returned -1
	[0155.185] lstrlenW (lpString=".djvu") returned 5
	[0155.185] lstrcmpiW (lpString1=".djvu", lpString2="t.ttf") returned -1
	[0155.185] lstrlenW (lpString=".dng") returned 4
	[0155.185] lstrcmpiW (lpString1=".dng", lpString2=".ttf") returned -1
	[0155.186] lstrlenW (lpString=".doc") returned 4
	[0155.186] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0155.186] lstrlenW (lpString=".docm") returned 5
	[0155.186] lstrcmpiW (lpString1=".docm", lpString2="t.ttf") returned -1
	[0155.186] lstrlenW (lpString=".docx") returned 5
	[0155.186] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0155.186] lstrlenW (lpString=".dot") returned 4
	[0155.186] lstrcmpiW (lpString1=".dot", lpString2=".ttf") returned -1
	[0155.186] lstrlenW (lpString=".dotm") returned 5
	[0155.186] lstrcmpiW (lpString1=".dotm", lpString2="t.ttf") returned -1
	[0155.186] lstrlenW (lpString=".dotx") returned 5
	[0155.186] lstrcmpiW (lpString1=".dotx", lpString2="t.ttf") returned -1
	[0155.186] lstrlenW (lpString=".dpx") returned 4
	[0155.186] lstrcmpiW (lpString1=".dpx", lpString2=".ttf") returned -1
	[0155.186] lstrlenW (lpString=".dqy") returned 4
	[0155.186] lstrcmpiW (lpString1=".dqy", lpString2=".ttf") returned -1
	[0155.186] lstrlenW (lpString=".dsn") returned 4
	[0155.186] lstrcmpiW (lpString1=".dsn", lpString2=".ttf") returned -1
	[0155.186] lstrlenW (lpString=".dt") returned 3
	[0155.186] lstrcmpiW (lpString1=".dt", lpString2="ttf") returned -1
	[0155.186] lstrlenW (lpString=".dtd") returned 4
	[0155.186] lstrcmpiW (lpString1=".dtd", lpString2=".ttf") returned -1
	[0155.186] lstrlenW (lpString=".dwg") returned 4
	[0155.186] lstrcmpiW (lpString1=".dwg", lpString2=".ttf") returned -1
	[0155.186] lstrlenW (lpString=".dwt") returned 4
	[0155.186] lstrcmpiW (lpString1=".dwt", lpString2=".ttf") returned -1
	[0155.186] lstrlenW (lpString=".dx") returned 3
	[0155.186] lstrcmpiW (lpString1=".dx", lpString2="ttf") returned -1
	[0155.186] lstrlenW (lpString=".dxf") returned 4
	[0155.187] lstrcmpiW (lpString1=".dxf", lpString2=".ttf") returned -1
	[0155.187] lstrlenW (lpString=".edml") returned 5
	[0155.187] lstrcmpiW (lpString1=".edml", lpString2="t.ttf") returned -1
	[0155.187] lstrlenW (lpString=".efd") returned 4
	[0155.187] lstrcmpiW (lpString1=".efd", lpString2=".ttf") returned -1
	[0155.187] lstrlenW (lpString=".elf") returned 4
	[0155.187] lstrcmpiW (lpString1=".elf", lpString2=".ttf") returned -1
	[0155.187] lstrlenW (lpString=".emf") returned 4
	[0155.187] lstrcmpiW (lpString1=".emf", lpString2=".ttf") returned -1
	[0155.187] lstrlenW (lpString=".emz") returned 4
	[0155.187] lstrcmpiW (lpString1=".emz", lpString2=".ttf") returned -1
	[0155.187] lstrlenW (lpString=".epf") returned 4
	[0155.187] lstrcmpiW (lpString1=".epf", lpString2=".ttf") returned -1
	[0155.187] lstrlenW (lpString=".eps") returned 4
	[0155.187] lstrcmpiW (lpString1=".eps", lpString2=".ttf") returned -1
	[0155.187] lstrlenW (lpString=".epsf") returned 5
	[0155.187] lstrcmpiW (lpString1=".epsf", lpString2="t.ttf") returned -1
	[0155.187] lstrlenW (lpString=".epsp") returned 5
	[0155.187] lstrcmpiW (lpString1=".epsp", lpString2="t.ttf") returned -1
	[0155.187] lstrlenW (lpString=".erf") returned 4
	[0155.187] lstrcmpiW (lpString1=".erf", lpString2=".ttf") returned -1
	[0155.187] lstrlenW (lpString=".exr") returned 4
	[0155.187] lstrcmpiW (lpString1=".exr", lpString2=".ttf") returned -1
	[0155.187] lstrlenW (lpString=".f4v") returned 4
	[0155.187] lstrcmpiW (lpString1=".f4v", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".fido") returned 5
	[0155.188] lstrcmpiW (lpString1=".fido", lpString2="t.ttf") returned -1
	[0155.188] lstrlenW (lpString=".flm") returned 4
	[0155.188] lstrcmpiW (lpString1=".flm", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".flv") returned 4
	[0155.188] lstrcmpiW (lpString1=".flv", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".frm") returned 4
	[0155.188] lstrcmpiW (lpString1=".frm", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".fxg") returned 4
	[0155.188] lstrcmpiW (lpString1=".fxg", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".geo") returned 4
	[0155.188] lstrcmpiW (lpString1=".geo", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".gif") returned 4
	[0155.188] lstrcmpiW (lpString1=".gif", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".grs") returned 4
	[0155.188] lstrcmpiW (lpString1=".grs", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".gz") returned 3
	[0155.188] lstrcmpiW (lpString1=".gz", lpString2="ttf") returned -1
	[0155.188] lstrlenW (lpString=".h") returned 2
	[0155.188] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0155.188] lstrlenW (lpString=".hdr") returned 4
	[0155.188] lstrcmpiW (lpString1=".hdr", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".hpp") returned 4
	[0155.188] lstrcmpiW (lpString1=".hpp", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".hta") returned 4
	[0155.188] lstrcmpiW (lpString1=".hta", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".htc") returned 4
	[0155.188] lstrcmpiW (lpString1=".htc", lpString2=".ttf") returned -1
	[0155.188] lstrlenW (lpString=".htm") returned 4
	[0155.189] lstrcmpiW (lpString1=".htm", lpString2=".ttf") returned -1
	[0155.189] lstrlenW (lpString=".html") returned 5
	[0155.189] lstrcmpiW (lpString1=".html", lpString2="t.ttf") returned -1
	[0155.189] lstrlenW (lpString=".icb") returned 4
	[0155.189] lstrcmpiW (lpString1=".icb", lpString2=".ttf") returned -1
	[0155.189] lstrlenW (lpString=".ics") returned 4
	[0155.189] lstrcmpiW (lpString1=".ics", lpString2=".ttf") returned -1
	[0155.189] lstrlenW (lpString=".iff") returned 4
	[0155.189] lstrcmpiW (lpString1=".iff", lpString2=".ttf") returned -1
	[0155.189] lstrlenW (lpString=".inc") returned 4
	[0155.189] lstrcmpiW (lpString1=".inc", lpString2=".ttf") returned -1
	[0155.189] lstrlenW (lpString=".indd") returned 5
	[0155.189] lstrcmpiW (lpString1=".indd", lpString2="t.ttf") returned -1
	[0155.189] lstrlenW (lpString=".ini") returned 4
	[0155.189] lstrcmpiW (lpString1=".ini", lpString2=".ttf") returned -1
	[0155.189] lstrlenW (lpString=".iqy") returned 4
	[0155.189] lstrcmpiW (lpString1=".iqy", lpString2=".ttf") returned -1
	[0155.189] lstrlenW (lpString=".j2c") returned 4
	[0155.189] lstrcmpiW (lpString1=".j2c", lpString2=".ttf") returned -1
	[0155.189] lstrlenW (lpString=".j2k") returned 4
	[0155.189] lstrcmpiW (lpString1=".j2k", lpString2=".ttf") returned -1
	[0155.189] lstrlenW (lpString=".java") returned 5
	[0155.189] lstrcmpiW (lpString1=".java", lpString2="t.ttf") returned -1
	[0155.190] lstrlenW (lpString=".jp2") returned 4
	[0155.190] lstrcmpiW (lpString1=".jp2", lpString2=".ttf") returned -1
	[0155.190] lstrlenW (lpString=".jpc") returned 4
	[0155.190] lstrcmpiW (lpString1=".jpc", lpString2=".ttf") returned -1
	[0155.190] lstrlenW (lpString=".jpe") returned 4
	[0155.190] lstrcmpiW (lpString1=".jpe", lpString2=".ttf") returned -1
	[0155.190] lstrlenW (lpString=".jpeg") returned 5
	[0155.190] lstrcmpiW (lpString1=".jpeg", lpString2="t.ttf") returned -1
	[0155.190] lstrlenW (lpString=".jpf") returned 4
	[0155.190] lstrcmpiW (lpString1=".jpf", lpString2=".ttf") returned -1
	[0155.190] lstrlenW (lpString=".jpg") returned 4
	[0155.190] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0155.190] lstrlenW (lpString=".jpx") returned 4
	[0155.190] lstrcmpiW (lpString1=".jpx", lpString2=".ttf") returned -1
	[0155.190] lstrlenW (lpString=".js") returned 3
	[0155.190] lstrcmpiW (lpString1=".js", lpString2="ttf") returned -1
	[0155.190] lstrlenW (lpString=".jsf") returned 4
	[0155.190] lstrcmpiW (lpString1=".jsf", lpString2=".ttf") returned -1
	[0155.190] lstrlenW (lpString=".json") returned 5
	[0155.190] lstrcmpiW (lpString1=".json", lpString2="t.ttf") returned -1
	[0155.190] lstrlenW (lpString=".jsp") returned 4
	[0155.190] lstrcmpiW (lpString1=".jsp", lpString2=".ttf") returned -1
	[0155.190] lstrlenW (lpString=".kdc") returned 4
	[0155.190] lstrcmpiW (lpString1=".kdc", lpString2=".ttf") returned -1
	[0155.190] lstrlenW (lpString=".kmz") returned 4
	[0155.190] lstrcmpiW (lpString1=".kmz", lpString2=".ttf") returned -1
	[0155.190] lstrlenW (lpString=".kwm") returned 4
	[0155.191] lstrcmpiW (lpString1=".kwm", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".lasso") returned 6
	[0155.191] lstrcmpiW (lpString1=".lasso", lpString2="ot.ttf") returned -1
	[0155.191] lstrlenW (lpString=".lbi") returned 4
	[0155.191] lstrcmpiW (lpString1=".lbi", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".lgf") returned 4
	[0155.191] lstrcmpiW (lpString1=".lgf", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".lgp") returned 4
	[0155.191] lstrcmpiW (lpString1=".lgp", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".log") returned 4
	[0155.191] lstrcmpiW (lpString1=".log", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".m1v") returned 4
	[0155.191] lstrcmpiW (lpString1=".m1v", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".m4a") returned 4
	[0155.191] lstrcmpiW (lpString1=".m4a", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".m4v") returned 4
	[0155.191] lstrcmpiW (lpString1=".m4v", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".max") returned 4
	[0155.191] lstrcmpiW (lpString1=".max", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".md") returned 3
	[0155.191] lstrcmpiW (lpString1=".md", lpString2="ttf") returned -1
	[0155.191] lstrlenW (lpString=".mda") returned 4
	[0155.191] lstrcmpiW (lpString1=".mda", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".mdb") returned 4
	[0155.191] lstrcmpiW (lpString1=".mdb", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".mde") returned 4
	[0155.191] lstrcmpiW (lpString1=".mde", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".mdf") returned 4
	[0155.191] lstrcmpiW (lpString1=".mdf", lpString2=".ttf") returned -1
	[0155.191] lstrlenW (lpString=".mdw") returned 4
	[0155.192] lstrcmpiW (lpString1=".mdw", lpString2=".ttf") returned -1
	[0155.192] lstrlenW (lpString=".mef") returned 4
	[0155.192] lstrcmpiW (lpString1=".mef", lpString2=".ttf") returned -1
	[0155.192] lstrlenW (lpString=".mft") returned 4
	[0155.192] lstrcmpiW (lpString1=".mft", lpString2=".ttf") returned -1
	[0155.192] lstrlenW (lpString=".mfw") returned 4
	[0155.192] lstrcmpiW (lpString1=".mfw", lpString2=".ttf") returned -1
	[0155.192] lstrlenW (lpString=".mht") returned 4
	[0155.192] lstrcmpiW (lpString1=".mht", lpString2=".ttf") returned -1
	[0155.192] lstrlenW (lpString=".mhtml") returned 6
	[0155.192] lstrcmpiW (lpString1=".mhtml", lpString2="ot.ttf") returned -1
	[0155.192] lstrlenW (lpString=".mka") returned 4
	[0155.192] lstrcmpiW (lpString1=".mka", lpString2=".ttf") returned -1
	[0155.192] lstrlenW (lpString=".mkidx") returned 6
	[0155.192] lstrcmpiW (lpString1=".mkidx", lpString2="ot.ttf") returned -1
	[0155.192] lstrlenW (lpString=".mkv") returned 4
	[0155.192] lstrcmpiW (lpString1=".mkv", lpString2=".ttf") returned -1
	[0155.192] lstrlenW (lpString=".mos") returned 4
	[0155.192] lstrcmpiW (lpString1=".mos", lpString2=".ttf") returned -1
	[0155.192] lstrlenW (lpString=".mov") returned 4
	[0155.192] lstrcmpiW (lpString1=".mov", lpString2=".ttf") returned -1
	[0155.192] lstrlenW (lpString=".mp3") returned 4
	[0155.192] lstrcmpiW (lpString1=".mp3", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".mp4") returned 4
	[0155.193] lstrcmpiW (lpString1=".mp4", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".mpeg") returned 5
	[0155.193] lstrcmpiW (lpString1=".mpeg", lpString2="t.ttf") returned -1
	[0155.193] lstrlenW (lpString=".mpg") returned 4
	[0155.193] lstrcmpiW (lpString1=".mpg", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".mpv") returned 4
	[0155.193] lstrcmpiW (lpString1=".mpv", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".mrw") returned 4
	[0155.193] lstrcmpiW (lpString1=".mrw", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".msg") returned 4
	[0155.193] lstrcmpiW (lpString1=".msg", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".mxl") returned 4
	[0155.193] lstrcmpiW (lpString1=".mxl", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".myd") returned 4
	[0155.193] lstrcmpiW (lpString1=".myd", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".myi") returned 4
	[0155.193] lstrcmpiW (lpString1=".myi", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".nef") returned 4
	[0155.193] lstrcmpiW (lpString1=".nef", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".nrw") returned 4
	[0155.193] lstrcmpiW (lpString1=".nrw", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".obj") returned 4
	[0155.193] lstrcmpiW (lpString1=".obj", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".odb") returned 4
	[0155.193] lstrcmpiW (lpString1=".odb", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".odc") returned 4
	[0155.193] lstrcmpiW (lpString1=".odc", lpString2=".ttf") returned -1
	[0155.193] lstrlenW (lpString=".odm") returned 4
	[0155.194] lstrcmpiW (lpString1=".odm", lpString2=".ttf") returned -1
	[0155.194] lstrlenW (lpString=".odp") returned 4
	[0155.194] lstrcmpiW (lpString1=".odp", lpString2=".ttf") returned -1
	[0155.194] lstrlenW (lpString=".ods") returned 4
	[0155.194] lstrcmpiW (lpString1=".ods", lpString2=".ttf") returned -1
	[0155.194] lstrlenW (lpString=".oft") returned 4
	[0155.194] lstrcmpiW (lpString1=".oft", lpString2=".ttf") returned -1
	[0155.194] lstrlenW (lpString=".one") returned 4
	[0155.194] lstrcmpiW (lpString1=".one", lpString2=".ttf") returned -1
	[0155.194] lstrlenW (lpString=".onepkg") returned 7
	[0155.194] lstrcmpiW (lpString1=".onepkg", lpString2="oot.ttf") returned -1
	[0155.194] lstrlenW (lpString=".onetoc2") returned 8
	[0155.194] lstrcmpiW (lpString1=".onetoc2", lpString2="boot.ttf") returned -1
	[0155.194] lstrlenW (lpString=".opt") returned 4
	[0155.195] lstrcmpiW (lpString1=".opt", lpString2=".ttf") returned -1
	[0155.195] lstrlenW (lpString=".oqy") returned 4
	[0155.195] lstrcmpiW (lpString1=".oqy", lpString2=".ttf") returned -1
	[0155.195] lstrlenW (lpString=".orf") returned 4
	[0155.195] lstrcmpiW (lpString1=".orf", lpString2=".ttf") returned -1
	[0155.195] lstrlenW (lpString=".p12") returned 4
	[0155.195] lstrcmpiW (lpString1=".p12", lpString2=".ttf") returned -1
	[0155.195] lstrlenW (lpString=".p7b") returned 4
	[0155.195] lstrcmpiW (lpString1=".p7b", lpString2=".ttf") returned -1
	[0155.195] lstrlenW (lpString=".p7c") returned 4
	[0155.195] lstrcmpiW (lpString1=".p7c", lpString2=".ttf") returned -1
	[0155.195] lstrlenW (lpString=".pam") returned 4
	[0155.195] lstrcmpiW (lpString1=".pam", lpString2=".ttf") returned -1
	[0155.195] lstrlenW (lpString=".pbm") returned 4
	[0155.195] lstrcmpiW (lpString1=".pbm", lpString2=".ttf") returned -1
	[0155.195] lstrlenW (lpString=".pct") returned 4
	[0155.195] lstrcmpiW (lpString1=".pct", lpString2=".ttf") returned -1
	[0155.195] lstrlenW (lpString=".pcx") returned 4
	[0155.195] lstrcmpiW (lpString1=".pcx", lpString2=".ttf") returned -1
	[0155.195] lstrlenW (lpString=".pdd") returned 4
	[0155.195] lstrcmpiW (lpString1=".pdd", lpString2=".ttf") returned -1
	[0155.195] lstrlenW (lpString=".pdf") returned 4
	[0155.195] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0155.196] lstrlenW (lpString=".pdp") returned 4
	[0155.196] lstrcmpiW (lpString1=".pdp", lpString2=".ttf") returned -1
	[0155.196] lstrlenW (lpString=".pef") returned 4
	[0155.196] lstrcmpiW (lpString1=".pef", lpString2=".ttf") returned -1
	[0155.196] lstrlenW (lpString=".pem") returned 4
	[0155.196] lstrcmpiW (lpString1=".pem", lpString2=".ttf") returned -1
	[0155.196] lstrlenW (lpString=".pff") returned 4
	[0155.196] lstrcmpiW (lpString1=".pff", lpString2=".ttf") returned -1
	[0155.196] lstrlenW (lpString=".pfm") returned 4
	[0155.196] lstrcmpiW (lpString1=".pfm", lpString2=".ttf") returned -1
	[0155.196] lstrlenW (lpString=".pfx") returned 4
	[0155.196] lstrcmpiW (lpString1=".pfx", lpString2=".ttf") returned -1
	[0155.196] lstrlenW (lpString=".pgm") returned 4
	[0155.196] lstrcmpiW (lpString1=".pgm", lpString2=".ttf") returned -1
	[0155.196] lstrlenW (lpString=".php") returned 4
	[0155.196] lstrcmpiW (lpString1=".php", lpString2=".ttf") returned -1
	[0155.196] lstrlenW (lpString=".php3") returned 5
	[0155.196] lstrcmpiW (lpString1=".php3", lpString2="t.ttf") returned -1
	[0155.196] lstrlenW (lpString=".php4") returned 5
	[0155.196] lstrcmpiW (lpString1=".php4", lpString2="t.ttf") returned -1
	[0155.196] lstrlenW (lpString=".php5") returned 5
	[0155.196] lstrcmpiW (lpString1=".php5", lpString2="t.ttf") returned -1
	[0155.196] lstrlenW (lpString=".phtml") returned 6
	[0155.196] lstrcmpiW (lpString1=".phtml", lpString2="ot.ttf") returned -1
	[0155.196] lstrlenW (lpString=".pict") returned 5
	[0155.196] lstrcmpiW (lpString1=".pict", lpString2="t.ttf") returned -1
	[0155.196] lstrlenW (lpString=".pl") returned 3
	[0155.196] lstrcmpiW (lpString1=".pl", lpString2="ttf") returned -1
	[0155.196] lstrlenW (lpString=".pls") returned 4
	[0155.196] lstrcmpiW (lpString1=".pls", lpString2=".ttf") returned -1
	[0155.197] lstrlenW (lpString=".pm") returned 3
	[0155.197] lstrcmpiW (lpString1=".pm", lpString2="ttf") returned -1
	[0155.197] lstrlenW (lpString=".png") returned 4
	[0155.197] lstrcmpiW (lpString1=".png", lpString2=".ttf") returned -1
	[0155.197] lstrlenW (lpString=".pnm") returned 4
	[0155.197] lstrcmpiW (lpString1=".pnm", lpString2=".ttf") returned -1
	[0155.197] lstrlenW (lpString=".pot") returned 4
	[0155.198] lstrcmpiW (lpString1=".pot", lpString2=".ttf") returned -1
	[0155.198] lstrlenW (lpString=".potm") returned 5
	[0155.198] lstrcmpiW (lpString1=".potm", lpString2="t.ttf") returned -1
	[0155.198] lstrlenW (lpString=".potx") returned 5
	[0155.198] lstrcmpiW (lpString1=".potx", lpString2="t.ttf") returned -1
	[0155.198] lstrlenW (lpString=".ppa") returned 4
	[0155.198] lstrcmpiW (lpString1=".ppa", lpString2=".ttf") returned -1
	[0155.198] lstrlenW (lpString=".ppam") returned 5
	[0155.198] lstrcmpiW (lpString1=".ppam", lpString2="t.ttf") returned -1
	[0155.198] lstrlenW (lpString=".ppm") returned 4
	[0155.198] lstrcmpiW (lpString1=".ppm", lpString2=".ttf") returned -1
	[0155.198] lstrlenW (lpString=".pps") returned 4
	[0155.198] lstrcmpiW (lpString1=".pps", lpString2=".ttf") returned -1
	[0155.198] lstrlenW (lpString=".ppsm") returned 5
	[0155.198] lstrcmpiW (lpString1=".ppsm", lpString2="t.ttf") returned -1
	[0155.198] lstrlenW (lpString=".ppt") returned 4
	[0155.198] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0155.198] lstrlenW (lpString=".pptm") returned 5
	[0155.198] lstrcmpiW (lpString1=".pptm", lpString2="t.ttf") returned -1
	[0155.198] lstrlenW (lpString=".pptx") returned 5
	[0155.198] lstrcmpiW (lpString1=".pptx", lpString2="t.ttf") returned -1
	[0155.198] lstrlenW (lpString=".prn") returned 4
	[0155.198] lstrcmpiW (lpString1=".prn", lpString2=".ttf") returned -1
	[0155.198] lstrlenW (lpString=".ps") returned 3
	[0155.198] lstrcmpiW (lpString1=".ps", lpString2="ttf") returned -1
	[0155.198] lstrlenW (lpString=".psb") returned 4
	[0155.198] lstrcmpiW (lpString1=".psb", lpString2=".ttf") returned -1
	[0155.199] lstrlenW (lpString=".psd") returned 4
	[0155.199] lstrcmpiW (lpString1=".psd", lpString2=".ttf") returned -1
	[0155.199] lstrlenW (lpString=".pst") returned 4
	[0155.199] lstrcmpiW (lpString1=".pst", lpString2=".ttf") returned -1
	[0155.199] lstrlenW (lpString=".ptx") returned 4
	[0155.199] lstrcmpiW (lpString1=".ptx", lpString2=".ttf") returned -1
	[0155.199] lstrlenW (lpString=".pub") returned 4
	[0155.199] lstrcmpiW (lpString1=".pub", lpString2=".ttf") returned -1
	[0155.199] lstrlenW (lpString=".pwm") returned 4
	[0155.199] lstrcmpiW (lpString1=".pwm", lpString2=".ttf") returned -1
	[0155.199] lstrlenW (lpString=".pxr") returned 4
	[0155.199] lstrcmpiW (lpString1=".pxr", lpString2=".ttf") returned -1
	[0155.199] lstrlenW (lpString=".py") returned 3
	[0155.199] lstrcmpiW (lpString1=".py", lpString2="ttf") returned -1
	[0155.199] lstrlenW (lpString=".qt") returned 3
	[0155.199] lstrcmpiW (lpString1=".qt", lpString2="ttf") returned -1
	[0155.199] lstrlenW (lpString=".r3d") returned 4
	[0155.199] lstrcmpiW (lpString1=".r3d", lpString2=".ttf") returned -1
	[0155.199] lstrlenW (lpString=".raf") returned 4
	[0155.199] lstrcmpiW (lpString1=".raf", lpString2=".ttf") returned -1
	[0155.199] lstrlenW (lpString=".rar") returned 4
	[0155.199] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0155.199] lstrlenW (lpString=".raw") returned 4
	[0155.199] lstrcmpiW (lpString1=".raw", lpString2=".ttf") returned -1
	[0155.200] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1
	[0155.200] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1
	[0155.200] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1
	[0155.200] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0155.434] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0155.435] FindClose (in: hFindFile=0x3e70b30 | out: hFindFile=0x3e70b30) returned 1
	[0155.435] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.435] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0155.435] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.435] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70d70
	[0155.436] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.436] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.436] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.436] lstrlenW (lpString=".1cd") returned 4
	[0155.436] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.436] lstrlenW (lpString=".3ds") returned 4
	[0155.436] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.437] lstrlenW (lpString=".3fr") returned 4
	[0155.437] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.437] lstrlenW (lpString=".3g2") returned 4
	[0155.437] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.437] lstrlenW (lpString=".3gp") returned 4
	[0155.437] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.437] lstrlenW (lpString=".7z") returned 3
	[0155.437] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.437] lstrlenW (lpString=".accda") returned 6
	[0155.437] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0155.437] lstrlenW (lpString=".accdb") returned 6
	[0155.437] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0155.437] lstrlenW (lpString=".accdc") returned 6
	[0155.437] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0155.437] lstrlenW (lpString=".accde") returned 6
	[0155.437] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0155.437] lstrlenW (lpString=".accdt") returned 6
	[0155.437] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0155.437] lstrlenW (lpString=".accdw") returned 6
	[0155.437] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0155.437] lstrlenW (lpString=".adb") returned 4
	[0155.437] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.437] lstrlenW (lpString=".adp") returned 4
	[0155.437] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.437] lstrlenW (lpString=".ai") returned 3
	[0155.437] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.437] lstrlenW (lpString=".ai3") returned 4
	[0155.437] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.437] lstrlenW (lpString=".ai4") returned 4
	[0155.437] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.437] lstrlenW (lpString=".ai5") returned 4
	[0155.437] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".ai6") returned 4
	[0155.438] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".ai7") returned 4
	[0155.438] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".ai8") returned 4
	[0155.438] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".anim") returned 5
	[0155.438] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0155.438] lstrlenW (lpString=".arw") returned 4
	[0155.438] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".as") returned 3
	[0155.438] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.438] lstrlenW (lpString=".asa") returned 4
	[0155.438] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".asc") returned 4
	[0155.438] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".ascx") returned 5
	[0155.438] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0155.438] lstrlenW (lpString=".asm") returned 4
	[0155.438] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".asmx") returned 5
	[0155.438] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0155.438] lstrlenW (lpString=".asp") returned 4
	[0155.438] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".aspx") returned 5
	[0155.438] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0155.438] lstrlenW (lpString=".asr") returned 4
	[0155.438] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".asx") returned 4
	[0155.438] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".avi") returned 4
	[0155.438] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.438] lstrlenW (lpString=".avs") returned 4
	[0155.439] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.439] lstrlenW (lpString=".backup") returned 7
	[0155.439] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0155.439] lstrlenW (lpString=".bak") returned 4
	[0155.439] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0155.439] lstrlenW (lpString=".bay") returned 4
	[0155.439] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0155.439] lstrlenW (lpString=".bd") returned 3
	[0155.439] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0155.439] lstrlenW (lpString=".bin") returned 4
	[0155.439] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0155.439] lstrlenW (lpString=".bmp") returned 4
	[0155.439] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0155.439] lstrlenW (lpString=".bz2") returned 4
	[0155.439] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.439] lstrlenW (lpString=".c") returned 2
	[0155.439] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0155.439] lstrlenW (lpString=".cdr") returned 4
	[0155.439] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0155.439] lstrlenW (lpString=".cer") returned 4
	[0155.439] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0155.439] lstrlenW (lpString=".cf") returned 3
	[0155.439] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0155.439] lstrlenW (lpString=".cfc") returned 4
	[0155.439] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0155.439] lstrlenW (lpString=".cfm") returned 4
	[0155.439] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0155.439] lstrlenW (lpString=".cfml") returned 5
	[0155.439] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0155.439] lstrlenW (lpString=".cfu") returned 4
	[0155.439] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0155.439] lstrlenW (lpString=".chm") returned 4
	[0155.440] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".cin") returned 4
	[0155.440] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".class") returned 6
	[0155.440] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0155.440] lstrlenW (lpString=".clx") returned 4
	[0155.440] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".config") returned 7
	[0155.440] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0155.440] lstrlenW (lpString=".cpp") returned 4
	[0155.440] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".cr2") returned 4
	[0155.440] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".crt") returned 4
	[0155.440] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".crw") returned 4
	[0155.440] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".cs") returned 3
	[0155.440] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0155.440] lstrlenW (lpString=".css") returned 4
	[0155.440] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".csv") returned 4
	[0155.440] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".cub") returned 4
	[0155.440] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".dae") returned 4
	[0155.440] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".dat") returned 4
	[0155.440] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0155.440] lstrlenW (lpString=".db") returned 3
	[0155.440] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0155.441] lstrlenW (lpString=".dbf") returned 4
	[0155.441] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".dbx") returned 4
	[0155.441] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".dc3") returned 4
	[0155.441] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".dcm") returned 4
	[0155.441] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".dcr") returned 4
	[0155.441] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".der") returned 4
	[0155.441] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".dib") returned 4
	[0155.441] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".dic") returned 4
	[0155.441] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".dif") returned 4
	[0155.441] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".divx") returned 5
	[0155.441] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0155.441] lstrlenW (lpString=".djvu") returned 5
	[0155.441] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0155.441] lstrlenW (lpString=".dng") returned 4
	[0155.441] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".doc") returned 4
	[0155.441] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".docm") returned 5
	[0155.441] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0155.441] lstrlenW (lpString=".docx") returned 5
	[0155.441] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.441] lstrlenW (lpString=".dot") returned 4
	[0155.441] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0155.441] lstrlenW (lpString=".dotm") returned 5
	[0155.442] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0155.442] lstrlenW (lpString=".dotx") returned 5
	[0155.442] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0155.442] lstrlenW (lpString=".dpx") returned 4
	[0155.442] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0155.442] lstrlenW (lpString=".dqy") returned 4
	[0155.442] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0155.442] lstrlenW (lpString=".dsn") returned 4
	[0155.442] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0155.442] lstrlenW (lpString=".dt") returned 3
	[0155.442] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0155.442] lstrlenW (lpString=".dtd") returned 4
	[0155.442] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0155.442] lstrlenW (lpString=".dwg") returned 4
	[0155.442] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0155.442] lstrlenW (lpString=".dwt") returned 4
	[0155.442] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0155.442] lstrlenW (lpString=".dx") returned 3
	[0155.442] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0155.442] lstrlenW (lpString=".dxf") returned 4
	[0155.442] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0155.442] lstrlenW (lpString=".edml") returned 5
	[0155.442] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0155.442] lstrlenW (lpString=".efd") returned 4
	[0155.442] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0155.442] lstrlenW (lpString=".elf") returned 4
	[0155.442] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0155.442] lstrlenW (lpString=".emf") returned 4
	[0155.442] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0155.442] lstrlenW (lpString=".emz") returned 4
	[0155.442] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0155.442] lstrlenW (lpString=".epf") returned 4
	[0155.443] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".eps") returned 4
	[0155.443] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".epsf") returned 5
	[0155.443] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0155.443] lstrlenW (lpString=".epsp") returned 5
	[0155.443] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0155.443] lstrlenW (lpString=".erf") returned 4
	[0155.443] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".exr") returned 4
	[0155.443] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".f4v") returned 4
	[0155.443] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".fido") returned 5
	[0155.443] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0155.443] lstrlenW (lpString=".flm") returned 4
	[0155.443] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".flv") returned 4
	[0155.443] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".frm") returned 4
	[0155.443] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".fxg") returned 4
	[0155.443] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".geo") returned 4
	[0155.443] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".gif") returned 4
	[0155.443] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".grs") returned 4
	[0155.443] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0155.443] lstrlenW (lpString=".gz") returned 3
	[0155.443] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0155.443] lstrlenW (lpString=".h") returned 2
	[0155.443] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0155.444] lstrlenW (lpString=".hdr") returned 4
	[0155.444] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".hpp") returned 4
	[0155.444] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".hta") returned 4
	[0155.444] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".htc") returned 4
	[0155.444] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".htm") returned 4
	[0155.444] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".html") returned 5
	[0155.444] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0155.444] lstrlenW (lpString=".icb") returned 4
	[0155.444] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".ics") returned 4
	[0155.444] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".iff") returned 4
	[0155.444] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".inc") returned 4
	[0155.444] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".indd") returned 5
	[0155.444] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0155.444] lstrlenW (lpString=".ini") returned 4
	[0155.444] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".iqy") returned 4
	[0155.444] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".j2c") returned 4
	[0155.444] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".j2k") returned 4
	[0155.444] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0155.444] lstrlenW (lpString=".java") returned 5
	[0155.444] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0155.445] lstrlenW (lpString=".jp2") returned 4
	[0155.445] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0155.445] lstrlenW (lpString=".jpc") returned 4
	[0155.445] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0155.445] lstrlenW (lpString=".jpe") returned 4
	[0155.445] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0155.445] lstrlenW (lpString=".jpeg") returned 5
	[0155.445] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0155.445] lstrlenW (lpString=".jpf") returned 4
	[0155.445] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0155.445] lstrlenW (lpString=".jpg") returned 4
	[0155.445] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.445] lstrlenW (lpString=".jpx") returned 4
	[0155.445] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0155.445] lstrlenW (lpString=".js") returned 3
	[0155.445] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0155.445] lstrlenW (lpString=".jsf") returned 4
	[0155.445] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0155.445] lstrlenW (lpString=".json") returned 5
	[0155.445] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0155.445] lstrlenW (lpString=".jsp") returned 4
	[0155.445] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0155.445] lstrlenW (lpString=".kdc") returned 4
	[0155.445] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0155.445] lstrlenW (lpString=".kmz") returned 4
	[0155.445] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0155.445] lstrlenW (lpString=".kwm") returned 4
	[0155.445] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0155.445] lstrlenW (lpString=".lasso") returned 6
	[0155.445] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0155.445] lstrlenW (lpString=".lbi") returned 4
	[0155.446] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".lgf") returned 4
	[0155.446] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".lgp") returned 4
	[0155.446] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".log") returned 4
	[0155.446] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".m1v") returned 4
	[0155.446] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".m4a") returned 4
	[0155.446] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".m4v") returned 4
	[0155.446] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".max") returned 4
	[0155.446] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".md") returned 3
	[0155.446] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0155.446] lstrlenW (lpString=".mda") returned 4
	[0155.446] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".mdb") returned 4
	[0155.446] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".mde") returned 4
	[0155.446] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".mdf") returned 4
	[0155.446] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".mdw") returned 4
	[0155.446] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".mef") returned 4
	[0155.446] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".mft") returned 4
	[0155.446] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0155.446] lstrlenW (lpString=".mfw") returned 4
	[0155.447] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".mht") returned 4
	[0155.447] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".mhtml") returned 6
	[0155.447] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0155.447] lstrlenW (lpString=".mka") returned 4
	[0155.447] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".mkidx") returned 6
	[0155.447] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0155.447] lstrlenW (lpString=".mkv") returned 4
	[0155.447] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".mos") returned 4
	[0155.447] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".mov") returned 4
	[0155.447] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".mp3") returned 4
	[0155.447] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".mp4") returned 4
	[0155.447] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".mpeg") returned 5
	[0155.447] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0155.447] lstrlenW (lpString=".mpg") returned 4
	[0155.447] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".mpv") returned 4
	[0155.447] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".mrw") returned 4
	[0155.447] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".msg") returned 4
	[0155.447] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0155.447] lstrlenW (lpString=".mxl") returned 4
	[0155.447] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".myd") returned 4
	[0155.448] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".myi") returned 4
	[0155.448] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".nef") returned 4
	[0155.448] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".nrw") returned 4
	[0155.448] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".obj") returned 4
	[0155.448] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".odb") returned 4
	[0155.448] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".odc") returned 4
	[0155.448] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".odm") returned 4
	[0155.448] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".odp") returned 4
	[0155.448] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".ods") returned 4
	[0155.448] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".oft") returned 4
	[0155.448] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".one") returned 4
	[0155.448] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0155.448] lstrlenW (lpString=".onepkg") returned 7
	[0155.449] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0155.449] lstrlenW (lpString=".onetoc2") returned 8
	[0155.449] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0155.449] lstrlenW (lpString=".opt") returned 4
	[0155.449] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".oqy") returned 4
	[0155.449] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".orf") returned 4
	[0155.449] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".p12") returned 4
	[0155.449] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".p7b") returned 4
	[0155.449] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".p7c") returned 4
	[0155.449] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".pam") returned 4
	[0155.449] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".pbm") returned 4
	[0155.449] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".pct") returned 4
	[0155.449] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".pcx") returned 4
	[0155.449] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".pdd") returned 4
	[0155.449] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".pdf") returned 4
	[0155.449] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".pdp") returned 4
	[0155.449] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0155.449] lstrlenW (lpString=".pef") returned 4
	[0155.449] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0155.450] lstrlenW (lpString=".pem") returned 4
	[0155.450] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0155.450] lstrlenW (lpString=".pff") returned 4
	[0155.450] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0155.450] lstrlenW (lpString=".pfm") returned 4
	[0155.450] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0155.450] lstrlenW (lpString=".pfx") returned 4
	[0155.450] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0155.450] lstrlenW (lpString=".pgm") returned 4
	[0155.450] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0155.450] lstrlenW (lpString=".php") returned 4
	[0155.450] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0155.450] lstrlenW (lpString=".php3") returned 5
	[0155.450] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0155.450] lstrlenW (lpString=".php4") returned 5
	[0155.450] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0155.450] lstrlenW (lpString=".php5") returned 5
	[0155.450] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0155.450] lstrlenW (lpString=".phtml") returned 6
	[0155.450] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0155.450] lstrlenW (lpString=".pict") returned 5
	[0155.450] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0155.450] lstrlenW (lpString=".pl") returned 3
	[0155.450] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0155.450] lstrlenW (lpString=".pls") returned 4
	[0155.450] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0155.450] lstrlenW (lpString=".pm") returned 3
	[0155.450] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0155.450] lstrlenW (lpString=".png") returned 4
	[0155.450] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0155.450] lstrlenW (lpString=".pnm") returned 4
	[0155.450] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0155.450] lstrlenW (lpString=".pot") returned 4
	[0155.451] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0155.451] lstrlenW (lpString=".potm") returned 5
	[0155.451] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0155.451] lstrlenW (lpString=".potx") returned 5
	[0155.451] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0155.451] lstrlenW (lpString=".ppa") returned 4
	[0155.451] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0155.451] lstrlenW (lpString=".ppam") returned 5
	[0155.451] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0155.451] lstrlenW (lpString=".ppm") returned 4
	[0155.451] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0155.451] lstrlenW (lpString=".pps") returned 4
	[0155.451] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0155.451] lstrlenW (lpString=".ppsm") returned 5
	[0155.451] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0155.451] lstrlenW (lpString=".ppt") returned 4
	[0155.451] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.451] lstrlenW (lpString=".pptm") returned 5
	[0155.451] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0155.451] lstrlenW (lpString=".pptx") returned 5
	[0155.451] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0155.451] lstrlenW (lpString=".prn") returned 4
	[0155.451] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0155.451] lstrlenW (lpString=".ps") returned 3
	[0155.451] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0155.451] lstrlenW (lpString=".psb") returned 4
	[0155.451] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0155.451] lstrlenW (lpString=".psd") returned 4
	[0155.451] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0155.451] lstrlenW (lpString=".pst") returned 4
	[0155.451] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0155.451] lstrlenW (lpString=".ptx") returned 4
	[0155.452] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0155.452] lstrlenW (lpString=".pub") returned 4
	[0155.452] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0155.452] lstrlenW (lpString=".pwm") returned 4
	[0155.452] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0155.452] lstrlenW (lpString=".pxr") returned 4
	[0155.452] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0155.452] lstrlenW (lpString=".py") returned 3
	[0155.452] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0155.452] lstrlenW (lpString=".qt") returned 3
	[0155.452] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0155.452] lstrlenW (lpString=".r3d") returned 4
	[0155.452] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0155.452] lstrlenW (lpString=".raf") returned 4
	[0155.452] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0155.452] lstrlenW (lpString=".rar") returned 4
	[0155.452] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.452] lstrlenW (lpString=".raw") returned 4
	[0155.452] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1
	[0155.452] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.452] FindClose (in: hFindFile=0x3e70d70 | out: hFindFile=0x3e70d70) returned 1
	[0155.452] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.452] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0155.452] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.452] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70eb0
	[0155.453] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.453] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.453] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.453] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.453] FindClose (in: hFindFile=0x3e70eb0 | out: hFindFile=0x3e70eb0) returned 1
	[0155.453] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.453] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0155.453] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.453] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70d70
	[0155.454] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.454] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.454] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.454] FindClose (in: hFindFile=0x3e70d70 | out: hFindFile=0x3e70d70) returned 1
	[0155.454] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.454] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0155.455] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.455] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70a30
	[0155.455] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.455] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.455] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.455] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.455] FindClose (in: hFindFile=0x3e70a30 | out: hFindFile=0x3e70a30) returned 1
	[0155.455] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.455] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0155.455] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.455] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70cf0
	[0155.456] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.456] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.456] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.456] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.456] FindClose (in: hFindFile=0x3e70cf0 | out: hFindFile=0x3e70cf0) returned 1
	[0155.457] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.457] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0155.457] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.457] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70c30
	[0155.457] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.457] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.458] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.458] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.458] FindClose (in: hFindFile=0x3e70c30 | out: hFindFile=0x3e70c30) returned 1
	[0155.458] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.458] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0155.458] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.458] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e71030
	[0155.459] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.459] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.459] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.459] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.459] FindClose (in: hFindFile=0x3e71030 | out: hFindFile=0x3e71030) returned 1
	[0155.459] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.459] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0155.459] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.459] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70a30
	[0155.459] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.460] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.460] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.460] FindClose (in: hFindFile=0x3e70a30 | out: hFindFile=0x3e70a30) returned 1
	[0155.460] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.460] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0155.460] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.460] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70cf0
	[0155.461] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.461] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.461] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.461] FindClose (in: hFindFile=0x3e70cf0 | out: hFindFile=0x3e70cf0) returned 1
	[0155.461] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.461] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0155.461] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0155.461] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.461] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70d70
	[0155.462] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.462] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.462] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.462] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.462] FindClose (in: hFindFile=0x3e70d70 | out: hFindFile=0x3e70d70) returned 1
	[0155.462] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.462] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0155.462] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.463] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70e30
	[0155.463] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.463] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.463] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.463] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.463] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0155.463] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.463] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0155.463] lstrlenW (lpString="C:\\Boot\\pl-PL") returned 13
	[0155.464] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Boot\\pl-PL") returned 1
	[0155.464] lstrlenW (lpString="pl-PL") returned 5
	[0155.464] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="pl-PL") returned -1
	[0155.464] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.464] lstrlenW (lpString="C:\\Boot\\pl-PL") returned 13
	[0155.464] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70f30
	[0155.464] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.464] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.465] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.465] lstrlenW (lpString=".1cd") returned 4
	[0155.465] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.465] lstrlenW (lpString=".3ds") returned 4
	[0155.465] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.465] lstrlenW (lpString=".3fr") returned 4
	[0155.465] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.465] lstrlenW (lpString=".3g2") returned 4
	[0155.465] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.465] lstrlenW (lpString=".3gp") returned 4
	[0155.465] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.465] lstrlenW (lpString=".7z") returned 3
	[0155.465] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.465] lstrlenW (lpString=".accda") returned 6
	[0155.465] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0155.465] lstrlenW (lpString=".accdb") returned 6
	[0155.465] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0155.465] lstrlenW (lpString=".accdc") returned 6
	[0155.465] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0155.465] lstrlenW (lpString=".accde") returned 6
	[0155.465] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0155.465] lstrlenW (lpString=".accdt") returned 6
	[0155.465] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0155.465] lstrlenW (lpString=".accdw") returned 6
	[0155.465] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0155.465] lstrlenW (lpString=".adb") returned 4
	[0155.465] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.465] lstrlenW (lpString=".adp") returned 4
	[0155.465] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.465] lstrlenW (lpString=".ai") returned 3
	[0155.465] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.465] lstrlenW (lpString=".ai3") returned 4
	[0155.466] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.466] lstrlenW (lpString=".ai4") returned 4
	[0155.466] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.466] lstrlenW (lpString=".ai5") returned 4
	[0155.466] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.466] lstrlenW (lpString=".ai6") returned 4
	[0155.466] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.466] lstrlenW (lpString=".ai7") returned 4
	[0155.466] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.466] lstrlenW (lpString=".ai8") returned 4
	[0155.466] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.466] lstrlenW (lpString=".anim") returned 5
	[0155.466] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0155.466] lstrlenW (lpString=".arw") returned 4
	[0155.466] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.466] lstrlenW (lpString=".as") returned 3
	[0155.466] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.466] lstrlenW (lpString=".asa") returned 4
	[0155.466] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.466] lstrlenW (lpString=".asc") returned 4
	[0155.466] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.466] lstrlenW (lpString=".ascx") returned 5
	[0155.466] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0155.466] lstrlenW (lpString=".asm") returned 4
	[0155.466] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.466] lstrlenW (lpString=".asmx") returned 5
	[0155.466] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0155.466] lstrlenW (lpString=".asp") returned 4
	[0155.466] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.466] lstrlenW (lpString=".aspx") returned 5
	[0155.466] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0155.466] lstrlenW (lpString=".asr") returned 4
	[0155.467] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.467] lstrlenW (lpString=".asx") returned 4
	[0155.467] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.467] lstrlenW (lpString=".avi") returned 4
	[0155.467] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.467] lstrlenW (lpString=".avs") returned 4
	[0155.467] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.467] lstrlenW (lpString=".backup") returned 7
	[0155.467] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0155.467] lstrlenW (lpString=".bak") returned 4
	[0155.467] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0155.467] lstrlenW (lpString=".bay") returned 4
	[0155.467] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0155.467] lstrlenW (lpString=".bd") returned 3
	[0155.467] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0155.467] lstrlenW (lpString=".bin") returned 4
	[0155.467] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0155.467] lstrlenW (lpString=".bmp") returned 4
	[0155.467] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0155.467] lstrlenW (lpString=".bz2") returned 4
	[0155.467] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.467] lstrlenW (lpString=".c") returned 2
	[0155.467] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0155.467] lstrlenW (lpString=".cdr") returned 4
	[0155.467] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0155.467] lstrlenW (lpString=".cer") returned 4
	[0155.467] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0155.467] lstrlenW (lpString=".cf") returned 3
	[0155.467] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0155.467] lstrlenW (lpString=".cfc") returned 4
	[0155.467] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".cfm") returned 4
	[0155.468] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".cfml") returned 5
	[0155.468] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0155.468] lstrlenW (lpString=".cfu") returned 4
	[0155.468] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".chm") returned 4
	[0155.468] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".cin") returned 4
	[0155.468] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".class") returned 6
	[0155.468] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0155.468] lstrlenW (lpString=".clx") returned 4
	[0155.468] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".config") returned 7
	[0155.468] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0155.468] lstrlenW (lpString=".cpp") returned 4
	[0155.468] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".cr2") returned 4
	[0155.468] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".crt") returned 4
	[0155.468] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".crw") returned 4
	[0155.468] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".cs") returned 3
	[0155.468] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0155.468] lstrlenW (lpString=".css") returned 4
	[0155.468] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".csv") returned 4
	[0155.468] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0155.468] lstrlenW (lpString=".cub") returned 4
	[0155.469] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".dae") returned 4
	[0155.469] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".dat") returned 4
	[0155.469] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".db") returned 3
	[0155.469] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0155.469] lstrlenW (lpString=".dbf") returned 4
	[0155.469] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".dbx") returned 4
	[0155.469] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".dc3") returned 4
	[0155.469] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".dcm") returned 4
	[0155.469] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".dcr") returned 4
	[0155.469] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".der") returned 4
	[0155.469] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".dib") returned 4
	[0155.469] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".dic") returned 4
	[0155.469] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".dif") returned 4
	[0155.469] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0155.469] lstrlenW (lpString=".divx") returned 5
	[0155.469] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0155.469] lstrlenW (lpString=".djvu") returned 5
	[0155.469] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0155.469] lstrlenW (lpString=".dng") returned 4
	[0155.469] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0155.470] lstrlenW (lpString=".doc") returned 4
	[0155.470] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.470] lstrlenW (lpString=".docm") returned 5
	[0155.470] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0155.470] lstrlenW (lpString=".docx") returned 5
	[0155.470] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.470] lstrlenW (lpString=".dot") returned 4
	[0155.470] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0155.470] lstrlenW (lpString=".dotm") returned 5
	[0155.470] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0155.470] lstrlenW (lpString=".dotx") returned 5
	[0155.470] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0155.470] lstrlenW (lpString=".dpx") returned 4
	[0155.470] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0155.470] lstrlenW (lpString=".dqy") returned 4
	[0155.470] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0155.470] lstrlenW (lpString=".dsn") returned 4
	[0155.470] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0155.470] lstrlenW (lpString=".dt") returned 3
	[0155.470] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0155.470] lstrlenW (lpString=".dtd") returned 4
	[0155.470] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0155.470] lstrlenW (lpString=".dwg") returned 4
	[0155.470] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0155.470] lstrlenW (lpString=".dwt") returned 4
	[0155.470] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0155.470] lstrlenW (lpString=".dx") returned 3
	[0155.470] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0155.470] lstrlenW (lpString=".dxf") returned 4
	[0155.470] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0155.470] lstrlenW (lpString=".edml") returned 5
	[0155.471] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0155.471] lstrlenW (lpString=".efd") returned 4
	[0155.471] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0155.471] lstrlenW (lpString=".elf") returned 4
	[0155.471] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0155.471] lstrlenW (lpString=".emf") returned 4
	[0155.471] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0155.471] lstrlenW (lpString=".emz") returned 4
	[0155.471] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0155.471] lstrlenW (lpString=".epf") returned 4
	[0155.471] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0155.471] lstrlenW (lpString=".eps") returned 4
	[0155.471] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0155.471] lstrlenW (lpString=".epsf") returned 5
	[0155.471] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0155.471] lstrlenW (lpString=".epsp") returned 5
	[0155.471] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0155.471] lstrlenW (lpString=".erf") returned 4
	[0155.471] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0155.471] lstrlenW (lpString=".exr") returned 4
	[0155.471] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0155.471] lstrlenW (lpString=".f4v") returned 4
	[0155.471] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0155.471] lstrlenW (lpString=".fido") returned 5
	[0155.471] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0155.471] lstrlenW (lpString=".flm") returned 4
	[0155.471] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0155.471] lstrlenW (lpString=".flv") returned 4
	[0155.471] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0155.471] lstrlenW (lpString=".frm") returned 4
	[0155.471] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".fxg") returned 4
	[0155.472] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".geo") returned 4
	[0155.472] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".gif") returned 4
	[0155.472] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".grs") returned 4
	[0155.472] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".gz") returned 3
	[0155.472] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0155.472] lstrlenW (lpString=".h") returned 2
	[0155.472] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0155.472] lstrlenW (lpString=".hdr") returned 4
	[0155.472] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".hpp") returned 4
	[0155.472] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".hta") returned 4
	[0155.472] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".htc") returned 4
	[0155.472] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".htm") returned 4
	[0155.472] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".html") returned 5
	[0155.472] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0155.472] lstrlenW (lpString=".icb") returned 4
	[0155.472] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".ics") returned 4
	[0155.472] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".iff") returned 4
	[0155.472] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0155.472] lstrlenW (lpString=".inc") returned 4
	[0155.473] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".indd") returned 5
	[0155.473] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0155.473] lstrlenW (lpString=".ini") returned 4
	[0155.473] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".iqy") returned 4
	[0155.473] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".j2c") returned 4
	[0155.473] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".j2k") returned 4
	[0155.473] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".java") returned 5
	[0155.473] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0155.473] lstrlenW (lpString=".jp2") returned 4
	[0155.473] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".jpc") returned 4
	[0155.473] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".jpe") returned 4
	[0155.473] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".jpeg") returned 5
	[0155.473] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0155.473] lstrlenW (lpString=".jpf") returned 4
	[0155.473] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".jpg") returned 4
	[0155.473] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".jpx") returned 4
	[0155.473] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".js") returned 3
	[0155.473] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0155.473] lstrlenW (lpString=".jsf") returned 4
	[0155.473] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0155.473] lstrlenW (lpString=".json") returned 5
	[0155.474] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0155.474] lstrlenW (lpString=".jsp") returned 4
	[0155.474] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".kdc") returned 4
	[0155.474] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".kmz") returned 4
	[0155.474] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".kwm") returned 4
	[0155.474] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".lasso") returned 6
	[0155.474] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0155.474] lstrlenW (lpString=".lbi") returned 4
	[0155.474] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".lgf") returned 4
	[0155.474] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".lgp") returned 4
	[0155.474] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".log") returned 4
	[0155.474] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".m1v") returned 4
	[0155.474] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".m4a") returned 4
	[0155.474] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".m4v") returned 4
	[0155.474] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".max") returned 4
	[0155.474] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0155.474] lstrlenW (lpString=".md") returned 3
	[0155.474] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0155.474] lstrlenW (lpString=".mda") returned 4
	[0155.474] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mdb") returned 4
	[0155.475] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mde") returned 4
	[0155.475] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mdf") returned 4
	[0155.475] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mdw") returned 4
	[0155.475] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mef") returned 4
	[0155.475] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mft") returned 4
	[0155.475] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mfw") returned 4
	[0155.475] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mht") returned 4
	[0155.475] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mhtml") returned 6
	[0155.475] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0155.475] lstrlenW (lpString=".mka") returned 4
	[0155.475] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mkidx") returned 6
	[0155.475] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0155.475] lstrlenW (lpString=".mkv") returned 4
	[0155.475] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mos") returned 4
	[0155.475] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mov") returned 4
	[0155.475] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mp3") returned 4
	[0155.475] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0155.475] lstrlenW (lpString=".mp4") returned 4
	[0155.475] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0155.476] lstrlenW (lpString=".mpeg") returned 5
	[0155.476] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0155.476] lstrlenW (lpString=".mpg") returned 4
	[0155.476] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0155.476] lstrlenW (lpString=".mpv") returned 4
	[0155.476] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0155.476] lstrlenW (lpString=".mrw") returned 4
	[0155.476] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0155.476] lstrlenW (lpString=".msg") returned 4
	[0155.476] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0155.476] lstrlenW (lpString=".mxl") returned 4
	[0155.476] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0155.476] lstrlenW (lpString=".myd") returned 4
	[0155.476] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0155.476] lstrlenW (lpString=".myi") returned 4
	[0155.476] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0155.476] lstrlenW (lpString=".nef") returned 4
	[0155.476] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0155.476] lstrlenW (lpString=".nrw") returned 4
	[0155.476] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0155.476] lstrlenW (lpString=".obj") returned 4
	[0155.476] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0155.476] lstrlenW (lpString=".odb") returned 4
	[0155.476] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0155.476] lstrlenW (lpString=".odc") returned 4
	[0155.476] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0155.476] lstrlenW (lpString=".odm") returned 4
	[0155.476] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0155.476] lstrlenW (lpString=".odp") returned 4
	[0155.476] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0155.476] lstrlenW (lpString=".ods") returned 4
	[0155.476] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".oft") returned 4
	[0155.477] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".one") returned 4
	[0155.477] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".onepkg") returned 7
	[0155.477] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0155.477] lstrlenW (lpString=".onetoc2") returned 8
	[0155.477] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0155.477] lstrlenW (lpString=".opt") returned 4
	[0155.477] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".oqy") returned 4
	[0155.477] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".orf") returned 4
	[0155.477] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".p12") returned 4
	[0155.477] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".p7b") returned 4
	[0155.477] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".p7c") returned 4
	[0155.477] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".pam") returned 4
	[0155.477] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".pbm") returned 4
	[0155.477] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".pct") returned 4
	[0155.477] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".pcx") returned 4
	[0155.477] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".pdd") returned 4
	[0155.477] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0155.477] lstrlenW (lpString=".pdf") returned 4
	[0155.478] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.478] lstrlenW (lpString=".pdp") returned 4
	[0155.478] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0155.478] lstrlenW (lpString=".pef") returned 4
	[0155.478] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0155.478] lstrlenW (lpString=".pem") returned 4
	[0155.478] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0155.478] lstrlenW (lpString=".pff") returned 4
	[0155.478] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0155.478] lstrlenW (lpString=".pfm") returned 4
	[0155.478] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0155.478] lstrlenW (lpString=".pfx") returned 4
	[0155.478] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0155.478] lstrlenW (lpString=".pgm") returned 4
	[0155.478] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0155.478] lstrlenW (lpString=".php") returned 4
	[0155.478] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0155.478] lstrlenW (lpString=".php3") returned 5
	[0155.478] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0155.478] lstrlenW (lpString=".php4") returned 5
	[0155.478] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0155.478] lstrlenW (lpString=".php5") returned 5
	[0155.478] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0155.478] lstrlenW (lpString=".phtml") returned 6
	[0155.478] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0155.478] lstrlenW (lpString=".pict") returned 5
	[0155.478] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0155.478] lstrlenW (lpString=".pl") returned 3
	[0155.478] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0155.478] lstrlenW (lpString=".pls") returned 4
	[0155.478] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0155.478] lstrlenW (lpString=".pm") returned 3
	[0155.479] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0155.479] lstrlenW (lpString=".png") returned 4
	[0155.479] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0155.479] lstrlenW (lpString=".pnm") returned 4
	[0155.479] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0155.479] lstrlenW (lpString=".pot") returned 4
	[0155.479] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0155.479] lstrlenW (lpString=".potm") returned 5
	[0155.479] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0155.479] lstrlenW (lpString=".potx") returned 5
	[0155.573] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0155.573] lstrlenW (lpString=".ppa") returned 4
	[0155.573] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0155.573] lstrlenW (lpString=".ppam") returned 5
	[0155.573] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0155.573] lstrlenW (lpString=".ppm") returned 4
	[0155.573] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0155.573] lstrlenW (lpString=".pps") returned 4
	[0155.573] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0155.573] lstrlenW (lpString=".ppsm") returned 5
	[0155.573] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0155.573] lstrlenW (lpString=".ppt") returned 4
	[0155.574] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.574] lstrlenW (lpString=".pptm") returned 5
	[0155.574] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0155.574] lstrlenW (lpString=".pptx") returned 5
	[0155.574] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0155.574] lstrlenW (lpString=".prn") returned 4
	[0155.574] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0155.574] lstrlenW (lpString=".ps") returned 3
	[0155.574] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0155.574] lstrlenW (lpString=".psb") returned 4
	[0155.574] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0155.574] lstrlenW (lpString=".psd") returned 4
	[0155.574] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0155.574] lstrlenW (lpString=".pst") returned 4
	[0155.574] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0155.574] lstrlenW (lpString=".ptx") returned 4
	[0155.574] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0155.574] lstrlenW (lpString=".pub") returned 4
	[0155.574] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0155.574] lstrlenW (lpString=".pwm") returned 4
	[0155.574] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0155.574] lstrlenW (lpString=".pxr") returned 4
	[0155.574] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0155.574] lstrlenW (lpString=".py") returned 3
	[0155.574] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0155.574] lstrlenW (lpString=".qt") returned 3
	[0155.574] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0155.574] lstrlenW (lpString=".r3d") returned 4
	[0155.574] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0155.574] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.575] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.575] FindClose (in: hFindFile=0x3e70f30 | out: hFindFile=0x3e70f30) returned 1
	[0155.575] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.575] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0155.575] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.575] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70ef0
	[0155.576] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.576] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.576] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.576] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.576] FindClose (in: hFindFile=0x3e70ef0 | out: hFindFile=0x3e70ef0) returned 1
	[0155.576] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.576] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0155.576] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.576] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70c70
	[0155.577] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.577] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.577] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.577] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.577] FindClose (in: hFindFile=0x3e70c70 | out: hFindFile=0x3e70c70) returned 1
	[0155.577] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.577] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0155.578] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.578] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e71030
	[0155.578] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.578] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.578] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.578] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.578] FindClose (in: hFindFile=0x3e71030 | out: hFindFile=0x3e71030) returned 1
	[0155.578] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.578] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0155.578] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.578] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70eb0
	[0155.579] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.579] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1
	[0155.579] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0155.579] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x44a5fc0
	[0155.581] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e70db0
	[0155.581] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.581] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1
	[0155.581] lstrlenW (lpString="bootres.dll.mui") returned 15
	[0155.581] lstrlenW (lpString=".1cd") returned 4
	[0155.581] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.581] lstrlenW (lpString=".3ds") returned 4
	[0155.581] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.581] lstrlenW (lpString=".3fr") returned 4
	[0155.581] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.581] lstrlenW (lpString=".3g2") returned 4
	[0155.581] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.581] lstrlenW (lpString=".3gp") returned 4
	[0155.581] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.581] lstrlenW (lpString=".7z") returned 3
	[0155.581] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.581] lstrlenW (lpString=".accda") returned 6
	[0155.581] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1
	[0155.582] lstrlenW (lpString=".accdb") returned 6
	[0155.582] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1
	[0155.582] lstrlenW (lpString=".accdc") returned 6
	[0155.582] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1
	[0155.582] lstrlenW (lpString=".accde") returned 6
	[0155.582] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1
	[0155.582] lstrlenW (lpString=".accdt") returned 6
	[0155.582] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1
	[0155.582] lstrlenW (lpString=".accdw") returned 6
	[0155.582] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1
	[0155.582] lstrlenW (lpString=".adb") returned 4
	[0155.582] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.582] lstrlenW (lpString=".adp") returned 4
	[0155.582] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.582] lstrlenW (lpString=".ai") returned 3
	[0155.582] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.582] lstrlenW (lpString=".ai3") returned 4
	[0155.582] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.582] lstrlenW (lpString=".ai4") returned 4
	[0155.582] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.582] lstrlenW (lpString=".ai5") returned 4
	[0155.582] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.582] lstrlenW (lpString=".ai6") returned 4
	[0155.582] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.582] lstrlenW (lpString=".ai7") returned 4
	[0155.582] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.582] lstrlenW (lpString=".ai8") returned 4
	[0155.582] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.582] lstrlenW (lpString=".anim") returned 5
	[0155.582] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1
	[0155.582] lstrlenW (lpString=".arw") returned 4
	[0155.582] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.583] lstrlenW (lpString=".as") returned 3
	[0155.583] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.583] lstrlenW (lpString=".asa") returned 4
	[0155.583] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.583] lstrlenW (lpString=".asc") returned 4
	[0155.583] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.583] lstrlenW (lpString=".ascx") returned 5
	[0155.583] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1
	[0155.583] lstrlenW (lpString=".asm") returned 4
	[0155.583] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.583] lstrlenW (lpString=".asmx") returned 5
	[0155.583] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1
	[0155.583] lstrlenW (lpString=".asp") returned 4
	[0155.583] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.583] lstrlenW (lpString=".aspx") returned 5
	[0155.583] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1
	[0155.583] lstrlenW (lpString=".asr") returned 4
	[0155.583] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.583] lstrlenW (lpString=".asx") returned 4
	[0155.583] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.583] lstrlenW (lpString=".avi") returned 4
	[0155.583] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.583] lstrlenW (lpString=".avs") returned 4
	[0155.583] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.583] lstrlenW (lpString=".backup") returned 7
	[0155.583] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1
	[0155.583] lstrlenW (lpString=".bak") returned 4
	[0155.583] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0155.583] lstrlenW (lpString=".bay") returned 4
	[0155.583] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0155.583] lstrlenW (lpString=".bd") returned 3
	[0155.583] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0155.584] lstrlenW (lpString=".bin") returned 4
	[0155.584] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0155.584] lstrlenW (lpString=".bmp") returned 4
	[0155.584] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0155.584] lstrlenW (lpString=".bz2") returned 4
	[0155.584] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.584] lstrlenW (lpString=".c") returned 2
	[0155.584] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0155.584] lstrlenW (lpString=".cdr") returned 4
	[0155.584] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0155.584] lstrlenW (lpString=".cer") returned 4
	[0155.584] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0155.584] lstrlenW (lpString=".cf") returned 3
	[0155.584] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0155.584] lstrlenW (lpString=".cfc") returned 4
	[0155.584] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0155.584] lstrlenW (lpString=".cfm") returned 4
	[0155.584] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0155.584] lstrlenW (lpString=".cfml") returned 5
	[0155.584] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1
	[0155.584] lstrlenW (lpString=".cfu") returned 4
	[0155.584] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0155.584] lstrlenW (lpString=".chm") returned 4
	[0155.584] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0155.584] lstrlenW (lpString=".cin") returned 4
	[0155.584] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0155.584] lstrlenW (lpString=".class") returned 6
	[0155.584] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1
	[0155.584] lstrlenW (lpString=".clx") returned 4
	[0155.584] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0155.584] lstrlenW (lpString=".config") returned 7
	[0155.585] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1
	[0155.585] lstrlenW (lpString=".cpp") returned 4
	[0155.585] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".cr2") returned 4
	[0155.585] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".crt") returned 4
	[0155.585] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".crw") returned 4
	[0155.585] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".cs") returned 3
	[0155.585] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0155.585] lstrlenW (lpString=".css") returned 4
	[0155.585] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".csv") returned 4
	[0155.585] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".cub") returned 4
	[0155.585] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".dae") returned 4
	[0155.585] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".dat") returned 4
	[0155.585] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".db") returned 3
	[0155.585] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0155.585] lstrlenW (lpString=".dbf") returned 4
	[0155.585] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".dbx") returned 4
	[0155.585] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".dc3") returned 4
	[0155.585] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".dcm") returned 4
	[0155.585] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0155.585] lstrlenW (lpString=".dcr") returned 4
	[0155.585] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0155.586] lstrlenW (lpString=".der") returned 4
	[0155.586] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0155.586] lstrlenW (lpString=".dib") returned 4
	[0155.586] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0155.586] lstrlenW (lpString=".dic") returned 4
	[0155.586] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0155.586] lstrlenW (lpString=".dif") returned 4
	[0155.586] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0155.586] lstrlenW (lpString=".divx") returned 5
	[0155.586] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1
	[0155.586] lstrlenW (lpString=".djvu") returned 5
	[0155.586] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1
	[0155.586] lstrlenW (lpString=".dng") returned 4
	[0155.586] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0155.586] lstrlenW (lpString=".doc") returned 4
	[0155.586] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.586] lstrlenW (lpString=".docm") returned 5
	[0155.586] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1
	[0155.586] lstrlenW (lpString=".docx") returned 5
	[0155.586] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0155.586] lstrlenW (lpString=".dot") returned 4
	[0155.586] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0155.586] lstrlenW (lpString=".dotm") returned 5
	[0155.586] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1
	[0155.586] lstrlenW (lpString=".dotx") returned 5
	[0155.586] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1
	[0155.586] lstrlenW (lpString=".dpx") returned 4
	[0155.586] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0155.586] lstrlenW (lpString=".dqy") returned 4
	[0155.586] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0155.586] lstrlenW (lpString=".dsn") returned 4
	[0155.586] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0155.587] lstrlenW (lpString=".dt") returned 3
	[0155.587] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0155.587] lstrlenW (lpString=".dtd") returned 4
	[0155.587] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0155.587] lstrlenW (lpString=".dwg") returned 4
	[0155.587] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0155.587] lstrlenW (lpString=".dwt") returned 4
	[0155.587] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0155.587] lstrlenW (lpString=".dx") returned 3
	[0155.587] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0155.587] lstrlenW (lpString=".dxf") returned 4
	[0155.587] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0155.587] lstrlenW (lpString=".edml") returned 5
	[0155.587] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1
	[0155.587] lstrlenW (lpString=".efd") returned 4
	[0155.587] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0155.587] lstrlenW (lpString=".elf") returned 4
	[0155.587] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0155.587] lstrlenW (lpString=".emf") returned 4
	[0155.587] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0155.587] lstrlenW (lpString=".emz") returned 4
	[0155.587] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0155.587] lstrlenW (lpString=".epf") returned 4
	[0155.587] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0155.587] lstrlenW (lpString=".eps") returned 4
	[0155.587] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0155.587] lstrlenW (lpString=".epsf") returned 5
	[0155.587] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1
	[0155.587] lstrlenW (lpString=".epsp") returned 5
	[0155.587] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1
	[0155.587] lstrlenW (lpString=".erf") returned 4
	[0155.587] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".exr") returned 4
	[0155.588] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".f4v") returned 4
	[0155.588] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".fido") returned 5
	[0155.588] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1
	[0155.588] lstrlenW (lpString=".flm") returned 4
	[0155.588] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".flv") returned 4
	[0155.588] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".frm") returned 4
	[0155.588] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".fxg") returned 4
	[0155.588] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".geo") returned 4
	[0155.588] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".gif") returned 4
	[0155.588] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".grs") returned 4
	[0155.588] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".gz") returned 3
	[0155.588] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0155.588] lstrlenW (lpString=".h") returned 2
	[0155.588] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0155.588] lstrlenW (lpString=".hdr") returned 4
	[0155.588] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".hpp") returned 4
	[0155.588] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0155.588] lstrlenW (lpString=".hta") returned 4
	[0155.589] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0155.589] lstrlenW (lpString=".htc") returned 4
	[0155.589] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0155.589] lstrlenW (lpString=".htm") returned 4
	[0155.589] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0155.589] lstrlenW (lpString=".html") returned 5
	[0155.589] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1
	[0155.589] lstrlenW (lpString=".icb") returned 4
	[0155.589] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0155.589] lstrlenW (lpString=".ics") returned 4
	[0155.589] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0155.589] lstrlenW (lpString=".iff") returned 4
	[0155.589] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0155.589] lstrlenW (lpString=".inc") returned 4
	[0155.589] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0155.589] lstrlenW (lpString=".indd") returned 5
	[0155.589] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1
	[0155.589] lstrlenW (lpString=".ini") returned 4
	[0155.589] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0155.589] lstrlenW (lpString=".iqy") returned 4
	[0155.589] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0155.589] lstrlenW (lpString=".j2c") returned 4
	[0155.589] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0155.589] lstrlenW (lpString=".j2k") returned 4
	[0155.589] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0155.589] lstrlenW (lpString=".java") returned 5
	[0155.589] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1
	[0155.589] lstrlenW (lpString=".jp2") returned 4
	[0155.589] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".jpc") returned 4
	[0155.590] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".jpe") returned 4
	[0155.590] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".jpeg") returned 5
	[0155.590] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1
	[0155.590] lstrlenW (lpString=".jpf") returned 4
	[0155.590] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".jpg") returned 4
	[0155.590] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".jpx") returned 4
	[0155.590] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".js") returned 3
	[0155.590] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0155.590] lstrlenW (lpString=".jsf") returned 4
	[0155.590] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".json") returned 5
	[0155.590] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1
	[0155.590] lstrlenW (lpString=".jsp") returned 4
	[0155.590] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".kdc") returned 4
	[0155.590] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".kmz") returned 4
	[0155.590] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".kwm") returned 4
	[0155.590] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".lasso") returned 6
	[0155.590] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1
	[0155.590] lstrlenW (lpString=".lbi") returned 4
	[0155.590] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0155.590] lstrlenW (lpString=".lgf") returned 4
	[0155.591] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".lgp") returned 4
	[0155.591] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".log") returned 4
	[0155.591] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".m1v") returned 4
	[0155.591] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".m4a") returned 4
	[0155.591] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".m4v") returned 4
	[0155.591] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".max") returned 4
	[0155.591] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".md") returned 3
	[0155.591] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0155.591] lstrlenW (lpString=".mda") returned 4
	[0155.591] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".mdb") returned 4
	[0155.591] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".mde") returned 4
	[0155.591] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".mdf") returned 4
	[0155.591] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".mdw") returned 4
	[0155.591] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".mef") returned 4
	[0155.591] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".mft") returned 4
	[0155.591] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".mfw") returned 4
	[0155.591] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0155.591] lstrlenW (lpString=".mht") returned 4
	[0155.592] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0155.592] lstrlenW (lpString=".mhtml") returned 6
	[0155.592] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1
	[0155.592] lstrlenW (lpString=".mka") returned 4
	[0155.592] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0155.592] lstrlenW (lpString=".mkidx") returned 6
	[0155.592] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1
	[0155.592] lstrlenW (lpString=".mkv") returned 4
	[0155.592] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0155.592] lstrlenW (lpString=".mos") returned 4
	[0155.592] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0155.592] lstrlenW (lpString=".mov") returned 4
	[0155.592] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0155.592] lstrlenW (lpString=".mp3") returned 4
	[0155.592] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0155.592] lstrlenW (lpString=".mp4") returned 4
	[0155.592] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0155.592] lstrlenW (lpString=".mpeg") returned 5
	[0155.592] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1
	[0155.592] lstrlenW (lpString=".mpg") returned 4
	[0155.592] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0155.592] lstrlenW (lpString=".mpv") returned 4
	[0155.592] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0155.592] lstrlenW (lpString=".mrw") returned 4
	[0155.592] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0155.592] lstrlenW (lpString=".msg") returned 4
	[0155.592] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0155.592] lstrlenW (lpString=".mxl") returned 4
	[0155.592] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0155.592] lstrlenW (lpString=".myd") returned 4
	[0155.592] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0155.592] lstrlenW (lpString=".myi") returned 4
	[0155.593] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".nef") returned 4
	[0155.593] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".nrw") returned 4
	[0155.593] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".obj") returned 4
	[0155.593] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".odb") returned 4
	[0155.593] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".odc") returned 4
	[0155.593] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".odm") returned 4
	[0155.593] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".odp") returned 4
	[0155.593] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".ods") returned 4
	[0155.593] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".oft") returned 4
	[0155.593] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".one") returned 4
	[0155.593] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".onepkg") returned 7
	[0155.593] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1
	[0155.593] lstrlenW (lpString=".onetoc2") returned 8
	[0155.593] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1
	[0155.593] lstrlenW (lpString=".opt") returned 4
	[0155.593] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".oqy") returned 4
	[0155.593] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0155.593] lstrlenW (lpString=".orf") returned 4
	[0155.593] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".p12") returned 4
	[0155.594] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".p7b") returned 4
	[0155.594] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".p7c") returned 4
	[0155.594] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pam") returned 4
	[0155.594] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pbm") returned 4
	[0155.594] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pct") returned 4
	[0155.594] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pcx") returned 4
	[0155.594] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pdd") returned 4
	[0155.594] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pdf") returned 4
	[0155.594] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pdp") returned 4
	[0155.594] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pef") returned 4
	[0155.594] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pem") returned 4
	[0155.594] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pff") returned 4
	[0155.594] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pfm") returned 4
	[0155.594] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pfx") returned 4
	[0155.594] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0155.594] lstrlenW (lpString=".pgm") returned 4
	[0155.594] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0155.595] lstrlenW (lpString=".php") returned 4
	[0155.595] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0155.595] lstrlenW (lpString=".php3") returned 5
	[0155.595] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1
	[0155.595] lstrlenW (lpString=".php4") returned 5
	[0155.595] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1
	[0155.595] lstrlenW (lpString=".php5") returned 5
	[0155.595] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1
	[0155.595] lstrlenW (lpString=".phtml") returned 6
	[0155.595] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1
	[0155.595] lstrlenW (lpString=".pict") returned 5
	[0155.595] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1
	[0155.595] lstrlenW (lpString=".pl") returned 3
	[0155.595] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0155.595] lstrlenW (lpString=".pls") returned 4
	[0155.595] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0155.595] lstrlenW (lpString=".pm") returned 3
	[0155.595] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0155.595] lstrlenW (lpString=".png") returned 4
	[0155.595] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0155.595] lstrlenW (lpString=".pnm") returned 4
	[0155.595] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0155.595] lstrlenW (lpString=".pot") returned 4
	[0155.595] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0155.595] lstrlenW (lpString=".potm") returned 5
	[0155.595] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1
	[0155.595] lstrlenW (lpString=".potx") returned 5
	[0155.595] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1
	[0155.595] lstrlenW (lpString=".ppa") returned 4
	[0155.595] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0155.595] lstrlenW (lpString=".ppam") returned 5
	[0155.595] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1
	[0155.596] lstrlenW (lpString=".ppm") returned 4
	[0155.596] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0155.596] lstrlenW (lpString=".pps") returned 4
	[0155.596] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0155.596] lstrlenW (lpString=".ppsm") returned 5
	[0155.596] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1
	[0155.596] lstrlenW (lpString=".ppt") returned 4
	[0155.596] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.596] lstrlenW (lpString=".pptm") returned 5
	[0155.596] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1
	[0155.596] lstrlenW (lpString=".pptx") returned 5
	[0155.596] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1
	[0155.596] lstrlenW (lpString=".prn") returned 4
	[0155.596] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0155.596] lstrlenW (lpString=".ps") returned 3
	[0155.596] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0155.596] lstrlenW (lpString=".psb") returned 4
	[0155.596] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0155.596] lstrlenW (lpString=".psd") returned 4
	[0155.596] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0155.596] lstrlenW (lpString=".pst") returned 4
	[0155.596] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0155.596] lstrlenW (lpString=".ptx") returned 4
	[0155.596] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0155.596] lstrlenW (lpString=".pub") returned 4
	[0155.596] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0155.596] lstrlenW (lpString=".pwm") returned 4
	[0155.596] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0155.596] lstrlenW (lpString=".pxr") returned 4
	[0155.596] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0155.596] lstrlenW (lpString=".py") returned 3
	[0155.596] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0155.597] lstrlenW (lpString=".qt") returned 3
	[0155.597] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0155.597] lstrlenW (lpString=".r3d") returned 4
	[0155.597] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0155.597] lstrlenW (lpString=".raf") returned 4
	[0155.597] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0155.597] lstrlenW (lpString=".rar") returned 4
	[0155.597] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.597] lstrlenW (lpString=".raw") returned 4
	[0155.597] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1
	[0155.597] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0
	[0155.597] FindClose (in: hFindFile=0x3e70db0 | out: hFindFile=0x3e70db0) returned 1
	[0155.597] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0155.597] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0155.597] FindClose (in: hFindFile=0x3e70eb0 | out: hFindFile=0x3e70eb0) returned 1
	[0155.597] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.597] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0155.597] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.597] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70a30
	[0155.598] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.598] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.598] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.598] FindClose (in: hFindFile=0x3e70a30 | out: hFindFile=0x3e70a30) returned 1
	[0155.598] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.598] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0155.599] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.599] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70c30
	[0155.599] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.599] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.599] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.600] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.600] FindClose (in: hFindFile=0x3e70c30 | out: hFindFile=0x3e70c30) returned 1
	[0155.600] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.600] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0155.600] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.600] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70eb0
	[0155.600] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.600] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.600] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.600] FindClose (in: hFindFile=0x3e70eb0 | out: hFindFile=0x3e70eb0) returned 1
	[0155.600] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.600] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0155.600] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.601] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70a30
	[0155.601] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.601] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.601] FindNextFileW (in: hFindFile=0x3e70a30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.601] FindClose (in: hFindFile=0x3e70a30 | out: hFindFile=0x3e70a30) returned 1
	[0155.602] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.602] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0155.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.602] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70d30
	[0155.602] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.602] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.602] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.602] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.602] FindClose (in: hFindFile=0x3e70d30 | out: hFindFile=0x3e70d30) returned 1
	[0155.602] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.602] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0155.602] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.602] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70b30
	[0155.603] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.603] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.603] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.603] FindClose (in: hFindFile=0x3e70b30 | out: hFindFile=0x3e70b30) returned 1
	[0155.604] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.604] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0155.604] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.604] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70c30
	[0155.605] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.605] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.605] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.605] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.605] FindClose (in: hFindFile=0x3e70c30 | out: hFindFile=0x3e70c30) returned 1
	[0155.605] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.605] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0155.605] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.605] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e71030
	[0155.606] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.606] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.606] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.606] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.606] FindClose (in: hFindFile=0x3e71030 | out: hFindFile=0x3e71030) returned 1
	[0155.606] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.606] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0155.606] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.606] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70d30
	[0155.607] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.607] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.607] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.607] FindClose (in: hFindFile=0x3e70d30 | out: hFindFile=0x3e70d30) returned 1
	[0155.607] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.607] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0155.607] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0155.607] lstrlenW (lpString="C:\\Boot\\zh-CN") returned 13
	[0155.608] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Boot\\zh-CN") returned 1
	[0155.608] lstrlenW (lpString="zh-CN") returned 5
	[0155.608] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-CN") returned -1
	[0155.608] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.608] lstrlenW (lpString="C:\\Boot\\zh-CN") returned 13
	[0155.608] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70b30
	[0155.613] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.613] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.613] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.613] lstrlenW (lpString=".1cd") returned 4
	[0155.613] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.613] lstrlenW (lpString=".3ds") returned 4
	[0155.613] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.613] lstrlenW (lpString=".3fr") returned 4
	[0155.613] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.613] lstrlenW (lpString=".3g2") returned 4
	[0155.613] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.613] lstrlenW (lpString=".3gp") returned 4
	[0155.613] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.613] lstrlenW (lpString=".7z") returned 3
	[0155.613] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.613] lstrlenW (lpString=".accda") returned 6
	[0155.613] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0155.613] lstrlenW (lpString=".accdb") returned 6
	[0155.613] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0155.613] lstrlenW (lpString=".accdc") returned 6
	[0155.613] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0155.613] lstrlenW (lpString=".accde") returned 6
	[0155.613] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0155.613] lstrlenW (lpString=".accdt") returned 6
	[0155.613] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0155.613] lstrlenW (lpString=".accdw") returned 6
	[0155.614] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0155.614] lstrlenW (lpString=".adb") returned 4
	[0155.614] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.614] lstrlenW (lpString=".adp") returned 4
	[0155.614] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.614] lstrlenW (lpString=".ai") returned 3
	[0155.614] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.614] lstrlenW (lpString=".ai3") returned 4
	[0155.614] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.614] lstrlenW (lpString=".ai4") returned 4
	[0155.614] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.614] lstrlenW (lpString=".ai5") returned 4
	[0155.614] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.614] lstrlenW (lpString=".ai6") returned 4
	[0155.614] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.614] lstrlenW (lpString=".ai7") returned 4
	[0155.614] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.614] lstrlenW (lpString=".ai8") returned 4
	[0155.614] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.614] lstrlenW (lpString=".anim") returned 5
	[0155.614] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0155.614] lstrlenW (lpString=".arw") returned 4
	[0155.614] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.614] lstrlenW (lpString=".as") returned 3
	[0155.614] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.614] lstrlenW (lpString=".asa") returned 4
	[0155.614] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.614] lstrlenW (lpString=".asc") returned 4
	[0155.614] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.614] lstrlenW (lpString=".ascx") returned 5
	[0155.614] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0155.614] lstrlenW (lpString=".asm") returned 4
	[0155.615] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.615] lstrlenW (lpString=".asmx") returned 5
	[0155.615] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0155.615] lstrlenW (lpString=".asp") returned 4
	[0155.615] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.615] lstrlenW (lpString=".aspx") returned 5
	[0155.615] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0155.615] lstrlenW (lpString=".asr") returned 4
	[0155.615] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.615] lstrlenW (lpString=".asx") returned 4
	[0155.615] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.615] lstrlenW (lpString=".avi") returned 4
	[0155.615] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.615] lstrlenW (lpString=".avs") returned 4
	[0155.615] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.615] lstrlenW (lpString=".backup") returned 7
	[0155.615] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0155.615] lstrlenW (lpString=".bak") returned 4
	[0155.615] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0155.615] lstrlenW (lpString=".bay") returned 4
	[0155.615] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0155.615] lstrlenW (lpString=".bd") returned 3
	[0155.615] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0155.615] lstrlenW (lpString=".bin") returned 4
	[0155.615] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0155.615] lstrlenW (lpString=".bmp") returned 4
	[0155.615] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0155.615] lstrlenW (lpString=".bz2") returned 4
	[0155.615] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.615] lstrlenW (lpString=".c") returned 2
	[0155.615] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0155.615] lstrlenW (lpString=".cdr") returned 4
	[0155.616] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".cer") returned 4
	[0155.616] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".cf") returned 3
	[0155.616] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0155.616] lstrlenW (lpString=".cfc") returned 4
	[0155.616] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".cfm") returned 4
	[0155.616] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".cfml") returned 5
	[0155.616] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0155.616] lstrlenW (lpString=".cfu") returned 4
	[0155.616] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".chm") returned 4
	[0155.616] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".cin") returned 4
	[0155.616] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".class") returned 6
	[0155.616] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0155.616] lstrlenW (lpString=".clx") returned 4
	[0155.616] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".config") returned 7
	[0155.616] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0155.616] lstrlenW (lpString=".cpp") returned 4
	[0155.616] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".cr2") returned 4
	[0155.616] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".crt") returned 4
	[0155.616] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".crw") returned 4
	[0155.616] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0155.616] lstrlenW (lpString=".cs") returned 3
	[0155.616] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0155.617] lstrlenW (lpString=".css") returned 4
	[0155.617] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".csv") returned 4
	[0155.617] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".cub") returned 4
	[0155.617] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".dae") returned 4
	[0155.617] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".dat") returned 4
	[0155.617] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".db") returned 3
	[0155.617] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0155.617] lstrlenW (lpString=".dbf") returned 4
	[0155.617] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".dbx") returned 4
	[0155.617] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".dc3") returned 4
	[0155.617] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".dcm") returned 4
	[0155.617] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".dcr") returned 4
	[0155.617] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".der") returned 4
	[0155.617] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".dib") returned 4
	[0155.617] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".dic") returned 4
	[0155.617] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".dif") returned 4
	[0155.617] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0155.617] lstrlenW (lpString=".divx") returned 5
	[0155.617] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0155.618] lstrlenW (lpString=".djvu") returned 5
	[0155.618] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0155.618] lstrlenW (lpString=".dng") returned 4
	[0155.618] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0155.618] lstrlenW (lpString=".doc") returned 4
	[0155.618] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.618] lstrlenW (lpString=".docm") returned 5
	[0155.618] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0155.618] lstrlenW (lpString=".docx") returned 5
	[0155.618] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.618] lstrlenW (lpString=".dot") returned 4
	[0155.618] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0155.618] lstrlenW (lpString=".dotm") returned 5
	[0155.618] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0155.618] lstrlenW (lpString=".dotx") returned 5
	[0155.618] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0155.618] lstrlenW (lpString=".dpx") returned 4
	[0155.618] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0155.618] lstrlenW (lpString=".dqy") returned 4
	[0155.618] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0155.618] lstrlenW (lpString=".dsn") returned 4
	[0155.618] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0155.618] lstrlenW (lpString=".dt") returned 3
	[0155.618] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0155.618] lstrlenW (lpString=".dtd") returned 4
	[0155.618] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0155.618] lstrlenW (lpString=".dwg") returned 4
	[0155.618] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0155.618] lstrlenW (lpString=".dwt") returned 4
	[0155.618] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0155.618] lstrlenW (lpString=".dx") returned 3
	[0155.619] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0155.619] lstrlenW (lpString=".dxf") returned 4
	[0155.619] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0155.619] lstrlenW (lpString=".edml") returned 5
	[0155.619] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0155.619] lstrlenW (lpString=".efd") returned 4
	[0155.619] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0155.619] lstrlenW (lpString=".elf") returned 4
	[0155.619] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0155.619] lstrlenW (lpString=".emf") returned 4
	[0155.619] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0155.619] lstrlenW (lpString=".emz") returned 4
	[0155.619] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0155.619] lstrlenW (lpString=".epf") returned 4
	[0155.619] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0155.619] lstrlenW (lpString=".eps") returned 4
	[0155.619] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0155.619] lstrlenW (lpString=".epsf") returned 5
	[0155.619] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0155.619] lstrlenW (lpString=".epsp") returned 5
	[0155.619] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0155.619] lstrlenW (lpString=".erf") returned 4
	[0155.619] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0155.619] lstrlenW (lpString=".exr") returned 4
	[0155.619] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0155.619] lstrlenW (lpString=".f4v") returned 4
	[0155.619] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0155.619] lstrlenW (lpString=".fido") returned 5
	[0155.619] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0155.619] lstrlenW (lpString=".flm") returned 4
	[0155.619] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".flv") returned 4
	[0155.620] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".frm") returned 4
	[0155.620] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".fxg") returned 4
	[0155.620] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".geo") returned 4
	[0155.620] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".gif") returned 4
	[0155.620] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".grs") returned 4
	[0155.620] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".gz") returned 3
	[0155.620] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0155.620] lstrlenW (lpString=".h") returned 2
	[0155.620] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0155.620] lstrlenW (lpString=".hdr") returned 4
	[0155.620] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".hpp") returned 4
	[0155.620] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".hta") returned 4
	[0155.620] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".htc") returned 4
	[0155.620] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".htm") returned 4
	[0155.620] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".html") returned 5
	[0155.620] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0155.620] lstrlenW (lpString=".icb") returned 4
	[0155.620] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0155.620] lstrlenW (lpString=".ics") returned 4
	[0155.621] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".iff") returned 4
	[0155.621] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".inc") returned 4
	[0155.621] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".indd") returned 5
	[0155.621] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0155.621] lstrlenW (lpString=".ini") returned 4
	[0155.621] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".iqy") returned 4
	[0155.621] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".j2c") returned 4
	[0155.621] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".j2k") returned 4
	[0155.621] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".java") returned 5
	[0155.621] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0155.621] lstrlenW (lpString=".jp2") returned 4
	[0155.621] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".jpc") returned 4
	[0155.621] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".jpe") returned 4
	[0155.621] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".jpeg") returned 5
	[0155.621] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0155.621] lstrlenW (lpString=".jpf") returned 4
	[0155.621] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".jpg") returned 4
	[0155.621] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".jpx") returned 4
	[0155.621] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0155.621] lstrlenW (lpString=".js") returned 3
	[0155.622] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0155.622] lstrlenW (lpString=".jsf") returned 4
	[0155.622] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".json") returned 5
	[0155.622] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0155.622] lstrlenW (lpString=".jsp") returned 4
	[0155.622] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".kdc") returned 4
	[0155.622] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".kmz") returned 4
	[0155.622] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".kwm") returned 4
	[0155.622] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".lasso") returned 6
	[0155.622] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0155.622] lstrlenW (lpString=".lbi") returned 4
	[0155.622] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".lgf") returned 4
	[0155.622] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".lgp") returned 4
	[0155.622] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".log") returned 4
	[0155.622] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".m1v") returned 4
	[0155.622] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".m4a") returned 4
	[0155.622] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".m4v") returned 4
	[0155.622] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".max") returned 4
	[0155.622] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0155.622] lstrlenW (lpString=".md") returned 3
	[0155.623] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0155.623] lstrlenW (lpString=".mda") returned 4
	[0155.623] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mdb") returned 4
	[0155.623] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mde") returned 4
	[0155.623] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mdf") returned 4
	[0155.623] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mdw") returned 4
	[0155.623] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mef") returned 4
	[0155.623] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mft") returned 4
	[0155.623] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mfw") returned 4
	[0155.623] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mht") returned 4
	[0155.623] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mhtml") returned 6
	[0155.623] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0155.623] lstrlenW (lpString=".mka") returned 4
	[0155.623] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mkidx") returned 6
	[0155.623] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0155.623] lstrlenW (lpString=".mkv") returned 4
	[0155.623] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mos") returned 4
	[0155.623] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mov") returned 4
	[0155.623] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0155.623] lstrlenW (lpString=".mp3") returned 4
	[0155.624] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0155.624] lstrlenW (lpString=".mp4") returned 4
	[0155.624] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0155.624] lstrlenW (lpString=".mpeg") returned 5
	[0155.624] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0155.624] lstrlenW (lpString=".mpg") returned 4
	[0155.624] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0155.624] lstrlenW (lpString=".mpv") returned 4
	[0155.624] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0155.624] lstrlenW (lpString=".mrw") returned 4
	[0155.624] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0155.624] lstrlenW (lpString=".msg") returned 4
	[0155.624] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0155.624] lstrlenW (lpString=".mxl") returned 4
	[0155.624] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0155.624] lstrlenW (lpString=".myd") returned 4
	[0155.624] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0155.624] lstrlenW (lpString=".myi") returned 4
	[0155.624] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0155.624] lstrlenW (lpString=".nef") returned 4
	[0155.624] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0155.624] lstrlenW (lpString=".nrw") returned 4
	[0155.624] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0155.624] lstrlenW (lpString=".obj") returned 4
	[0155.624] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0155.624] lstrlenW (lpString=".odb") returned 4
	[0155.624] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0155.624] lstrlenW (lpString=".odc") returned 4
	[0155.624] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0155.624] lstrlenW (lpString=".odm") returned 4
	[0155.624] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0155.624] lstrlenW (lpString=".odp") returned 4
	[0155.625] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".ods") returned 4
	[0155.625] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".oft") returned 4
	[0155.625] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".one") returned 4
	[0155.625] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".onepkg") returned 7
	[0155.625] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0155.625] lstrlenW (lpString=".onetoc2") returned 8
	[0155.625] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0155.625] lstrlenW (lpString=".opt") returned 4
	[0155.625] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".oqy") returned 4
	[0155.625] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".orf") returned 4
	[0155.625] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".p12") returned 4
	[0155.625] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".p7b") returned 4
	[0155.625] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".p7c") returned 4
	[0155.625] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".pam") returned 4
	[0155.625] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".pbm") returned 4
	[0155.625] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".pct") returned 4
	[0155.625] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".pcx") returned 4
	[0155.625] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0155.625] lstrlenW (lpString=".pdd") returned 4
	[0155.626] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0155.626] lstrlenW (lpString=".pdf") returned 4
	[0155.626] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.626] lstrlenW (lpString=".pdp") returned 4
	[0155.626] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0155.626] lstrlenW (lpString=".pef") returned 4
	[0155.626] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0155.626] lstrlenW (lpString=".pem") returned 4
	[0155.626] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0155.626] lstrlenW (lpString=".pff") returned 4
	[0155.626] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0155.626] lstrlenW (lpString=".pfm") returned 4
	[0155.626] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0155.626] lstrlenW (lpString=".pfx") returned 4
	[0155.626] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0155.626] lstrlenW (lpString=".pgm") returned 4
	[0155.626] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0155.626] lstrlenW (lpString=".php") returned 4
	[0155.626] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0155.626] lstrlenW (lpString=".php3") returned 5
	[0155.626] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0155.626] lstrlenW (lpString=".php4") returned 5
	[0155.626] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0155.626] lstrlenW (lpString=".php5") returned 5
	[0155.626] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0155.626] lstrlenW (lpString=".phtml") returned 6
	[0155.626] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0155.626] lstrlenW (lpString=".pict") returned 5
	[0155.626] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0155.626] lstrlenW (lpString=".pl") returned 3
	[0155.626] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0155.627] lstrlenW (lpString=".pls") returned 4
	[0155.627] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0155.627] lstrlenW (lpString=".pm") returned 3
	[0155.627] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0155.627] lstrlenW (lpString=".png") returned 4
	[0155.627] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0155.627] lstrlenW (lpString=".pnm") returned 4
	[0155.627] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0155.627] lstrlenW (lpString=".pot") returned 4
	[0155.627] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0155.627] lstrlenW (lpString=".potm") returned 5
	[0155.627] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0155.627] lstrlenW (lpString=".potx") returned 5
	[0155.627] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0155.627] lstrlenW (lpString=".ppa") returned 4
	[0155.627] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0155.627] lstrlenW (lpString=".ppam") returned 5
	[0155.627] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0155.627] lstrlenW (lpString=".ppm") returned 4
	[0155.627] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0155.627] lstrlenW (lpString=".pps") returned 4
	[0155.627] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0155.627] lstrlenW (lpString=".ppsm") returned 5
	[0155.627] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0155.627] lstrlenW (lpString=".ppt") returned 4
	[0155.627] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.627] lstrlenW (lpString=".pptm") returned 5
	[0155.627] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0155.627] lstrlenW (lpString=".pptx") returned 5
	[0155.627] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0155.627] lstrlenW (lpString=".prn") returned 4
	[0155.628] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0155.628] lstrlenW (lpString=".ps") returned 3
	[0155.628] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0155.628] lstrlenW (lpString=".psb") returned 4
	[0155.628] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0155.628] lstrlenW (lpString=".psd") returned 4
	[0155.628] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0155.628] lstrlenW (lpString=".pst") returned 4
	[0155.628] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0155.628] lstrlenW (lpString=".ptx") returned 4
	[0155.628] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0155.628] lstrlenW (lpString=".pub") returned 4
	[0155.628] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0155.628] lstrlenW (lpString=".pwm") returned 4
	[0155.628] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0155.628] lstrlenW (lpString=".pxr") returned 4
	[0155.628] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0155.628] lstrlenW (lpString=".py") returned 3
	[0155.628] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0155.628] lstrlenW (lpString=".qt") returned 3
	[0155.628] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0155.628] lstrlenW (lpString=".r3d") returned 4
	[0155.628] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0155.628] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.628] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.628] FindClose (in: hFindFile=0x3e70b30 | out: hFindFile=0x3e70b30) returned 1
	[0155.629] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.629] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0155.629] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.629] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70c30
	[0155.629] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.629] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.629] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.629] FindNextFileW (in: hFindFile=0x3e70c30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.629] FindClose (in: hFindFile=0x3e70c30 | out: hFindFile=0x3e70c30) returned 1
	[0155.629] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.629] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0155.629] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e60078
	[0155.630] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e70b30
	[0155.630] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.630] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.630] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.631] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.631] FindClose (in: hFindFile=0x3e70b30 | out: hFindFile=0x3e70b30) returned 1
	[0155.631] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.631] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0155.631] FindClose (in: hFindFile=0x3e70b70 | out: hFindFile=0x3e70b70) returned 1
	[0155.631] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0155.632] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0155.632] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xde311d52, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xde311d52, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xde311d52, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="BOOTNXT.id-B4197730.[admin@stex777.com].money", cAlternateFileName="BOOTNX~1.MON")) returned 1
	[0155.632] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xda8b7a6f, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda8b7a6f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda8b7a6f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x20fc, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="BOOTSECT.BAK.id-B4197730.[admin@stex777.com].money", cAlternateFileName="BOOTSE~1.MON")) returned 1
	[0155.633] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0155.633] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e30060
	[0155.633] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="zh-TW", cAlternateFileName="?S\x16")) returned 0xffffffff
	[0155.634] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0155.634] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0155.634] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e30060
	[0155.634] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName=".", cAlternateFileName="")) returned 0x3e70e30
	[0155.643] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.643] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="..", cAlternateFileName="")) returned 0
	[0155.643] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0155.643] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0155.643] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xef0d5076, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0155.643] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xdf204531, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf204531, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0155.643] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3e30060
	[0155.643] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xdf204531, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf204531, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName=".", cAlternateFileName="")) returned 0x3e709b0
	[0155.778] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xdf204531, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf204531, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="..", cAlternateFileName="")) returned 1
	[0155.784] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde907cf6, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xde907cf6, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdeb6b936, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11104, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Application.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="APPLIC~1.MON")) returned 1
	[0155.784] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde907cf6, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xde907cf6, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xde907cf6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1110a, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="HardwareEvents.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="HARDWA~1.MON")) returned 1
	[0155.784] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb1dd97, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdeb1dd97, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdeb1dd97, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11110, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Internet Explorer.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="INTERN~1.MON")) returned 1
	[0155.784] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb1dd97, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdeb1dd97, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdebdcb00, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1111a, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Key Management Service.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="KEYMAN~1.MON")) returned 1
	[0155.785] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde92df4b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xde92df4b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xde92df4b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MICROS~1.MON")) returned 1
	[0155.785] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde954331, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xde954331, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xde954331, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11180, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MICROS~2.MON")) returned 1
	[0155.785] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef54d39, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdef54d39, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf9c3366, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x101172, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI6C4A~1.MON")) returned 1
	[0155.785] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb542e8, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdeb542e8, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdeb542e8, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1113e, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MICROS~3.MON")) returned 1
	[0155.785] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb6b936, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdeb6b936, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf1912c3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11144, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MICROS~4.MON")) returned 1
	[0155.785] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb9068a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdeb9068a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdeb9068a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11156, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI7C3D~1.MON")) returned 1
	[0155.785] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdebb6704, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdebb6704, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdebb6704, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11154, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI9A73~1.MON")) returned 1
	[0155.785] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdebdcb00, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdebdcb00, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdec02b01, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11140, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI5D99~1.MON")) returned 1
	[0155.786] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdec02b01, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdec02b01, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdec28d61, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MIDE32~1.MON")) returned 1
	[0155.786] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1912c3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf1912c3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf609736, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x111144, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MIEE43~1.MON")) returned 1
	[0155.786] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf24fcea, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf24fcea, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf24fcea, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11148, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MICE9F~1.MON")) returned 1
	[0155.786] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xe0811434, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2d115c, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI03EC~1.MON")) returned 1
	[0155.786] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf275f03, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf275f03, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf275f03, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11152, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI3428~1.MON")) returned 1
	[0155.786] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf275f03, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf275f03, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf29c2d3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI6798~1.MON")) returned 1
	[0155.786] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf90456e, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf90456e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf90456e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11164, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MIAAD7~1.MON")) returned 1
	[0155.787] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf950ae9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf950ae9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf976d53, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI0052~1.MON")) returned 1
	[0155.787] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf92a871, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf92a871, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf92a871, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI0833~1.MON")) returned 1
	[0155.787] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf92a871, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf92a871, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf950ae9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11162, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MIDFD0~1.MON")) returned 1
	[0155.787] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf950ae9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf950ae9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdfbff4b1, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI4B03~1.MON")) returned 1
	[0155.787] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf976d53, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf976d53, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdf99ce84, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11144, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI891A~1.MON")) returned 1
	[0155.787] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf99ce84, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf99ce84, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdfcbe294, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x101180, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MIE145~1.MON")) returned 1
	[0155.787] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9e9465, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdf9e9465, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdfa0f551, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11144, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI2AE1~1.MON")) returned 1
	[0155.787] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa0f551, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdfa0f551, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdfce44df, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11150, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI7A2D~1.MON")) returned 1
	[0155.788] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc25820, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdfc25820, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdfc25820, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11136, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI8366~1.MON")) returned 1
	[0155.788] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc25820, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdfc25820, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdfc4b9b9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1113a, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI4A63~1.MON")) returned 1
	[0155.788] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe021b7dd, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xe021b7dd, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xe021b7dd, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI1272~1.MON")) returned 1
	[0155.789] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe01f52aa, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xe01f52aa, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xe01f52aa, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1115a, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI8185~1.MON")) returned 1
	[0155.789] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe021b7dd, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xe021b7dd, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xe0693db5, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MIC741~1.MON")) returned 1
	[0155.789] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02417a4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xe02417a4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xe02417a4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI3727~1.MON")) returned 1
	[0155.789] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0267bdf, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xe0267bdf, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xe0267bdf, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1114a, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MIB369~1.MON")) returned 1
	[0155.789] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe03bf00f, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xe03bf00f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xe03bf00f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-International%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MIF3FE~1.MON")) returned 1
	[0155.789] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe03bf00f, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xe03bf00f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xe079ef8d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MI6265~1.MON")) returned 1
	[0155.790] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe06ba06e, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xe06ba06e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xe06ba06e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[admin@stex777.com].money", cAlternateFileName="MIEE2C~1.MON")) returned 1
	[0155.795] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0155.943] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0155.971] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e9000 | out: hHeap=0x4c0000) returned 1
	[0155.974] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44fa010 | out: hHeap=0x4c0000) returned 1
	[0155.974] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.974] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.974] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.974] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.975] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.975] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.975] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.977] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.977] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.977] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.977] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.977] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.977] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0155.977] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.166] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.167] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.167] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.170] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.172] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.172] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.172] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.173] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.173] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.173] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.174] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.174] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.175] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.176] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52a860, Size=0x4000) returned 0x3e69b70
	[0156.177] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.179] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.179] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.180] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.180] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.182] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.182] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.182] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.184] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.184] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.184] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.185] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.185] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.185] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.186] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.186] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.187] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450b020 | out: hHeap=0x4c0000) returned 1
	[0156.187] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44fa010 | out: hHeap=0x4c0000) returned 1
	[0156.188] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44fa010 | out: hHeap=0x4c0000) returned 1
	[0156.188] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.191] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44fa010 | out: hHeap=0x4c0000) returned 1
	[0156.191] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.192] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.193] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.195] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.195] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44fa010 | out: hHeap=0x4c0000) returned 1
	[0156.195] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.196] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44fa010 | out: hHeap=0x4c0000) returned 1
	[0156.196] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.199] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.199] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.275] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x450a018 | out: hHeap=0x4c0000) returned 1
	[0156.275] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44fa010 | out: hHeap=0x4c0000) returned 1
	[0156.276] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.276] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e9000 | out: hHeap=0x4c0000) returned 1
	[0156.277] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.324] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b5fc8 | out: hHeap=0x4c0000) returned 1
	[0156.325] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.325] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.327] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b5fc8 | out: hHeap=0x4c0000) returned 1
	[0156.328] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.329] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b5fc8 | out: hHeap=0x4c0000) returned 1
	[0156.329] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.330] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.332] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0156.335] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.335] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.335] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.335] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.343] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.347] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.348] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.349] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0156.353] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.353] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.354] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.358] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.360] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.363] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.471] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4508008 | out: hHeap=0x4c0000) returned 1
	[0156.472] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.472] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.475] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.478] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0156.478] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0156.479] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b5fc8 | out: hHeap=0x4c0000) returned 1
	[0156.480] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.484] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b5fc8 | out: hHeap=0x4c0000) returned 1
	[0156.490] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b5fc8 | out: hHeap=0x4c0000) returned 1
	[0156.495] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4508008 | out: hHeap=0x4c0000) returned 1
	[0156.801] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x3e69b70, Size=0x4000) returned 0x44e7ff8
	[0156.804] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x44e7ff8, Size=0x8000) returned 0x44e7ff8
	[0157.011] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x44e7ff8, Size=0x10000) returned 0x44e7ff8
	[0157.023] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x44e7ff8, Size=0x20000) returned 0x44e7ff8
	[0157.046] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x44e7ff8, Size=0x40000) returned 0x454d000
	[0157.195] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0157.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0157.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0157.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4508008 | out: hHeap=0x4c0000) returned 1
	[0157.439] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0157.442] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0157.446] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0157.446] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0157.451] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0157.453] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0157.460] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0158.127] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0158.352] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0158.360] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0158.361] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0158.361] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0158.365] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0158.365] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0158.371] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0158.375] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0158.392] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0158.654] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0158.657] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0158.676] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0158.677] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0158.677] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0158.678] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0158.681] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0158.689] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.691] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.866] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.870] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.875] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.878] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.882] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.887] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.891] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.897] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.900] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.903] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0158.906] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.184] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.186] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.189] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.192] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.195] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.198] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.200] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.203] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.207] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.212] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.215] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.218] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.367] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.369] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.372] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.374] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.378] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.381] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.384] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.386] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.389] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.392] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.395] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.397] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.400] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.403] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.562] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.566] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.568] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.568] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.569] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0159.573] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0159.579] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.584] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.587] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.590] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.593] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.596] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.599] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.702] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.710] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.723] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.725] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.727] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.730] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.734] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.737] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.741] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.744] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.746] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.748] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.751] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0159.754] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.128] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.130] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.133] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.136] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.139] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.141] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.143] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.146] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.149] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.153] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.157] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.160] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.163] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.692] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.786] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.792] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.798] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.801] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.804] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.809] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.812] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.816] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.818] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.818] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0160.881] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.887] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.890] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.893] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.897] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.900] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.904] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.907] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.908] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.911] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.915] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.918] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.934] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.941] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.944] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.947] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.951] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.954] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.958] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.962] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.965] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.968] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0160.973] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.033] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.039] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.042] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.049] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.053] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.057] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.060] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.064] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.089] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.091] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.092] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.093] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.093] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.114] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.459] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.461] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.461] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.463] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.463] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.464] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.465] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.466] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.466] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.468] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.468] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.469] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.473] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.473] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.474] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.474] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.475] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.476] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.477] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.477] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.478] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.479] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.479] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.480] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.480] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.481] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.482] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.483] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.483] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.484] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.485] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.486] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.487] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.488] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.488] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.489] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.490] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.490] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.491] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.492] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.492] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.498] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.501] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.555] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.563] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.566] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.579] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.583] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.586] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.590] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.592] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.708] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.711] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.715] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.717] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.718] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0161.718] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0161.722] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0161.725] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0161.725] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0161.728] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0161.730] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0161.735] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0161.735] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0161.737] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0161.737] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0161.737] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0161.746] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0161.746] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0162.147] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea00 | out: hHeap=0x4c0000) returned 1
	[0162.149] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea00 | out: hHeap=0x4c0000) returned 1
	[0162.149] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea00 | out: hHeap=0x4c0000) returned 1
	[0162.149] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0162.152] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea00 | out: hHeap=0x4c0000) returned 1
	[0162.152] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0162.152] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.155] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0162.158] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0162.160] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0162.160] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.164] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.168] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x454d000, Size=0x80000) returned 0x5198020
	[0162.176] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea00 | out: hHeap=0x4c0000) returned 1
	[0162.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea00 | out: hHeap=0x4c0000) returned 1
	[0162.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0162.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.182] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0162.581] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.582] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.582] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0162.635] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0162.894] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0162.942] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.942] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.943] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.944] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.945] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.945] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.946] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.947] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.947] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.948] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.949] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.950] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.950] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.951] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.952] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.952] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.953] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.954] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.954] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.955] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.956] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.957] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.957] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.958] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.958] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.959] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.960] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.961] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.961] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.962] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.963] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.963] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.964] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.965] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.965] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.965] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.966] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.966] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.967] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.967] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.968] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.968] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.969] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0163.257] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0163.257] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0163.257] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.308] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.315] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.323] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.326] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0163.327] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0163.328] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0163.329] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.332] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.719] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0163.720] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0163.721] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0163.723] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0164.403] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0164.403] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0164.405] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0164.405] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0164.415] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0164.418] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0164.418] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0164.424] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0164.427] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0164.427] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0164.431] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0164.433] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0164.433] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0164.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0164.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0164.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0164.437] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0164.437] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0164.553] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0164.554] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0164.554] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0164.554] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0164.559] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0164.559] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0164.566] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0164.566] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0164.580] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0164.580] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0164.581] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0164.584] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0164.584] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0164.587] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0164.588] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0164.589] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0164.638] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.281] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.284] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.285] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.289] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.291] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.296] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0165.299] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0165.299] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0165.299] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.299] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.302] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0165.302] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.302] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.303] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.305] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.307] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0165.307] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.307] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.308] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.308] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.311] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.311] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.312] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.312] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.313] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.314] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.315] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.316] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.317] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.317] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.318] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.353] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.354] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.354] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.355] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.356] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.357] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.357] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.358] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.359] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.360] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.361] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.361] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.362] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.363] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.364] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.365] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.365] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.366] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.366] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.368] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.369] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.369] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.370] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.371] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.372] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.374] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.375] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.375] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.376] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.377] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.378] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.379] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.379] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.380] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.380] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.383] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.383] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.384] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.385] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.385] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.387] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0165.387] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.387] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.392] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0165.392] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0165.392] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0165.392] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.394] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0166.095] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0166.095] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0166.097] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.097] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.098] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.098] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.098] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.362] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.366] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.367] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.367] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.367] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.368] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.368] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.370] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.370] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.371] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.371] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.372] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.372] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.376] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.377] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.378] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.378] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.379] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.379] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.380] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.384] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0166.384] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.384] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.385] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0166.385] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.385] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.385] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.399] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0166.399] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0166.400] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0166.400] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.400] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.401] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.403] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.478] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.478] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.480] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.482] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.482] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.482] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.482] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.489] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.490] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.490] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.491] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.491] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.492] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.500] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.506] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.510] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.513] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.515] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.515] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.518] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.518] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.518] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.525] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.525] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.525] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.527] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.527] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.527] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.534] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.538] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.541] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.541] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.541] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.545] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.545] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.546] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.546] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.548] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.548] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.549] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.549] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.550] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.550] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.550] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.551] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.551] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.551] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.553] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.554] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.554] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.555] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.556] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.556] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.556] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.557] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.558] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.558] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0166.558] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.559] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.559] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.560] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0166.561] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b5fc8 | out: hHeap=0x4c0000) returned 1
	[0166.561] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0166.564] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0166.564] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0166.597] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.599] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.600] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.600] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0166.605] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.605] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0166.606] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0166.607] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0166.608] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.608] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0166.610] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0166.610] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0166.616] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0166.616] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0166.616] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.616] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0166.616] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0166.622] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.622] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0166.625] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.626] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0166.626] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.626] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0166.628] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0166.835] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0166.835] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0166.848] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0166.861] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.864] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.867] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.871] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.873] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.876] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.880] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.145] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.187] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.190] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.194] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.197] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.200] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.203] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.206] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.209] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.212] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.215] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.217] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.220] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.223] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.333] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.616] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.620] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.622] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.625] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.628] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.633] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.636] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.639] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.642] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.645] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.649] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0167.654] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0168.450] lstrlenW (lpString="index.html") returned 10
	[0168.450] lstrlenW (lpString=".1cd") returned 4
	[0168.450] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0168.451] lstrlenW (lpString=".3ds") returned 4
	[0168.451] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0168.451] lstrlenW (lpString=".3fr") returned 4
	[0168.451] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0168.451] lstrlenW (lpString=".3g2") returned 4
	[0168.451] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0168.451] lstrlenW (lpString=".3gp") returned 4
	[0168.451] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0168.451] lstrlenW (lpString=".7z") returned 3
	[0168.451] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0168.451] lstrlenW (lpString=".accda") returned 6
	[0168.451] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1
	[0168.451] lstrlenW (lpString=".accdb") returned 6
	[0168.451] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1
	[0168.451] lstrlenW (lpString=".accdc") returned 6
	[0168.451] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1
	[0168.451] lstrlenW (lpString=".accde") returned 6
	[0168.451] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1
	[0168.451] lstrlenW (lpString=".accdt") returned 6
	[0168.451] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1
	[0168.452] lstrlenW (lpString=".accdw") returned 6
	[0168.452] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1
	[0168.452] lstrlenW (lpString=".adb") returned 4
	[0168.452] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0168.452] lstrlenW (lpString=".adp") returned 4
	[0168.452] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0168.452] lstrlenW (lpString=".ai") returned 3
	[0168.452] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0168.452] lstrlenW (lpString=".ai3") returned 4
	[0168.452] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0168.452] lstrlenW (lpString=".ai4") returned 4
	[0168.452] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0168.452] lstrlenW (lpString=".ai5") returned 4
	[0168.452] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0168.452] lstrlenW (lpString=".ai6") returned 4
	[0168.452] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0168.452] lstrlenW (lpString=".ai7") returned 4
	[0168.452] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0168.452] lstrlenW (lpString=".ai8") returned 4
	[0168.452] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0168.452] lstrlenW (lpString=".anim") returned 5
	[0168.452] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0168.452] lstrlenW (lpString=".arw") returned 4
	[0168.452] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0168.452] lstrlenW (lpString=".as") returned 3
	[0168.452] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0168.453] lstrlenW (lpString=".asa") returned 4
	[0168.453] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0168.453] lstrlenW (lpString=".asc") returned 4
	[0168.453] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0168.453] lstrlenW (lpString=".ascx") returned 5
	[0168.453] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0168.453] lstrlenW (lpString=".asm") returned 4
	[0168.453] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0168.453] lstrlenW (lpString=".asmx") returned 5
	[0168.453] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0168.453] lstrlenW (lpString=".asp") returned 4
	[0168.453] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0168.453] lstrlenW (lpString=".aspx") returned 5
	[0168.453] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0168.453] lstrlenW (lpString=".asr") returned 4
	[0168.453] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0168.453] lstrlenW (lpString=".asx") returned 4
	[0168.453] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0168.453] lstrlenW (lpString=".avi") returned 4
	[0168.453] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0168.453] lstrlenW (lpString=".avs") returned 4
	[0168.453] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0168.453] lstrlenW (lpString=".backup") returned 7
	[0168.453] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1
	[0168.453] lstrlenW (lpString=".bak") returned 4
	[0168.453] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0168.454] lstrlenW (lpString=".bay") returned 4
	[0168.454] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0168.454] lstrlenW (lpString=".bd") returned 3
	[0168.454] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0168.454] lstrlenW (lpString=".bin") returned 4
	[0168.454] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0168.454] lstrlenW (lpString=".bmp") returned 4
	[0168.454] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0168.454] lstrlenW (lpString=".bz2") returned 4
	[0168.454] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0168.454] lstrlenW (lpString=".c") returned 2
	[0168.454] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0168.454] lstrlenW (lpString=".cdr") returned 4
	[0168.454] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0168.454] lstrlenW (lpString=".cer") returned 4
	[0168.454] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0168.454] lstrlenW (lpString=".cf") returned 3
	[0168.454] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0168.454] lstrlenW (lpString=".cfc") returned 4
	[0168.454] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0168.454] lstrlenW (lpString=".cfm") returned 4
	[0168.454] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0168.454] lstrlenW (lpString=".cfml") returned 5
	[0168.454] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0168.454] lstrlenW (lpString=".cfu") returned 4
	[0168.454] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0168.454] lstrlenW (lpString=".chm") returned 4
	[0168.455] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0168.455] lstrlenW (lpString=".cin") returned 4
	[0168.455] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0168.455] lstrlenW (lpString=".class") returned 6
	[0168.455] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1
	[0168.455] lstrlenW (lpString=".clx") returned 4
	[0168.455] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0168.455] lstrlenW (lpString=".config") returned 7
	[0168.455] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1
	[0168.455] lstrlenW (lpString=".cpp") returned 4
	[0168.455] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0168.455] lstrlenW (lpString=".cr2") returned 4
	[0168.455] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0168.455] lstrlenW (lpString=".crt") returned 4
	[0168.455] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0168.455] lstrlenW (lpString=".crw") returned 4
	[0168.455] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0168.455] lstrlenW (lpString=".cs") returned 3
	[0168.455] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0168.455] lstrlenW (lpString=".css") returned 4
	[0168.455] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0168.455] lstrlenW (lpString=".csv") returned 4
	[0168.455] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0168.455] lstrlenW (lpString=".cub") returned 4
	[0168.455] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0168.455] lstrlenW (lpString=".dae") returned 4
	[0168.455] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0168.455] lstrlenW (lpString=".dat") returned 4
	[0168.456] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0168.456] lstrlenW (lpString=".db") returned 3
	[0168.456] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0168.456] lstrlenW (lpString=".dbf") returned 4
	[0168.456] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0168.456] lstrlenW (lpString=".dbx") returned 4
	[0168.456] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0168.456] lstrlenW (lpString=".dc3") returned 4
	[0168.456] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0168.456] lstrlenW (lpString=".dcm") returned 4
	[0168.456] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0168.456] lstrlenW (lpString=".dcr") returned 4
	[0168.456] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0168.456] lstrlenW (lpString=".der") returned 4
	[0168.456] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0168.456] lstrlenW (lpString=".dib") returned 4
	[0168.456] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0168.456] lstrlenW (lpString=".dic") returned 4
	[0168.456] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0168.456] lstrlenW (lpString=".dif") returned 4
	[0168.456] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0168.456] lstrlenW (lpString=".divx") returned 5
	[0168.456] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0168.456] lstrlenW (lpString=".djvu") returned 5
	[0168.456] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0168.456] lstrlenW (lpString=".dng") returned 4
	[0168.456] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0168.456] lstrlenW (lpString=".doc") returned 4
	[0168.456] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0168.457] lstrlenW (lpString=".docm") returned 5
	[0168.457] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0168.457] lstrlenW (lpString=".docx") returned 5
	[0168.457] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0168.457] lstrlenW (lpString=".dot") returned 4
	[0168.457] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0168.457] lstrlenW (lpString=".dotm") returned 5
	[0168.457] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0168.457] lstrlenW (lpString=".dotx") returned 5
	[0168.457] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0168.457] lstrlenW (lpString=".dpx") returned 4
	[0168.457] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0168.457] lstrlenW (lpString=".dqy") returned 4
	[0168.457] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0168.457] lstrlenW (lpString=".dsn") returned 4
	[0168.457] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0168.457] lstrlenW (lpString=".dt") returned 3
	[0168.457] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0168.457] lstrlenW (lpString=".dtd") returned 4
	[0168.457] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0168.457] lstrlenW (lpString=".dwg") returned 4
	[0168.457] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0168.457] lstrlenW (lpString=".dwt") returned 4
	[0168.457] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0168.457] lstrlenW (lpString=".dx") returned 3
	[0168.457] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0168.457] lstrlenW (lpString=".dxf") returned 4
	[0168.458] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0168.458] lstrlenW (lpString=".edml") returned 5
	[0168.458] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0168.458] lstrlenW (lpString=".efd") returned 4
	[0168.458] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0168.458] lstrlenW (lpString=".elf") returned 4
	[0168.458] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0168.458] lstrlenW (lpString=".emf") returned 4
	[0168.458] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0168.458] lstrlenW (lpString=".emz") returned 4
	[0168.458] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0168.458] lstrlenW (lpString=".epf") returned 4
	[0168.458] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0168.458] lstrlenW (lpString=".eps") returned 4
	[0168.458] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0168.458] lstrlenW (lpString=".epsf") returned 5
	[0168.458] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0168.458] lstrlenW (lpString=".epsp") returned 5
	[0168.458] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0168.458] lstrlenW (lpString=".erf") returned 4
	[0168.458] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0168.458] lstrlenW (lpString=".exr") returned 4
	[0168.458] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0168.458] lstrlenW (lpString=".f4v") returned 4
	[0168.458] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0168.458] lstrlenW (lpString=".fido") returned 5
	[0168.458] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0168.458] lstrlenW (lpString=".flm") returned 4
	[0168.458] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".flv") returned 4
	[0168.459] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".frm") returned 4
	[0168.459] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".fxg") returned 4
	[0168.459] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".geo") returned 4
	[0168.459] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".gif") returned 4
	[0168.459] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".grs") returned 4
	[0168.459] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".gz") returned 3
	[0168.459] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0168.459] lstrlenW (lpString=".h") returned 2
	[0168.459] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0168.459] lstrlenW (lpString=".hdr") returned 4
	[0168.459] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".hpp") returned 4
	[0168.459] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".hta") returned 4
	[0168.459] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".htc") returned 4
	[0168.459] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".htm") returned 4
	[0168.459] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0168.459] lstrlenW (lpString=".html") returned 5
	[0168.460] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0168.460] lstrlenW (lpString="index.html") returned 10
	[0168.460] lstrlenW (lpString=".money") returned 6
	[0168.460] lstrcmpiW (lpString1=".money", lpString2="x.html") returned -1
	[0168.460] lstrlenW (lpString="index.html") returned 10
	[0168.460] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1
	[0168.460] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1
	[0168.460] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1
	[0168.460] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1
	[0168.460] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1
	[0168.460] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1
	[0168.460] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1
	[0168.460] lstrcmpiW (lpString1="d2.exe", lpString2="index.html") returned -1
	[0168.460] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html") returned 111
	[0168.460] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0168.460] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0168.460] lstrlenW (lpString=".1cd") returned 4
	[0168.460] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.460] lstrlenW (lpString=".3ds") returned 4
	[0168.460] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0168.460] lstrlenW (lpString=".3fr") returned 4
	[0168.461] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0168.461] lstrlenW (lpString=".3g2") returned 4
	[0168.461] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0168.461] lstrlenW (lpString=".3gp") returned 4
	[0168.461] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0168.461] lstrlenW (lpString=".7z") returned 3
	[0168.461] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.461] lstrlenW (lpString=".accda") returned 6
	[0168.461] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1
	[0168.461] lstrlenW (lpString=".accdb") returned 6
	[0168.461] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1
	[0168.461] lstrlenW (lpString=".accdc") returned 6
	[0168.461] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1
	[0168.461] lstrlenW (lpString=".accde") returned 6
	[0168.461] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1
	[0168.461] lstrlenW (lpString=".accdt") returned 6
	[0168.461] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1
	[0168.461] lstrlenW (lpString=".accdw") returned 6
	[0168.461] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1
	[0168.462] lstrlenW (lpString=".adb") returned 4
	[0168.462] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0168.462] lstrlenW (lpString=".adp") returned 4
	[0168.462] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0168.462] lstrlenW (lpString=".ai") returned 3
	[0168.462] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0168.462] lstrlenW (lpString=".ai3") returned 4
	[0168.462] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0168.462] lstrlenW (lpString=".ai4") returned 4
	[0168.462] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0168.462] lstrlenW (lpString=".ai5") returned 4
	[0168.462] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0168.462] lstrlenW (lpString=".ai6") returned 4
	[0168.462] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0168.462] lstrlenW (lpString=".ai7") returned 4
	[0168.462] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0168.462] lstrlenW (lpString=".ai8") returned 4
	[0168.462] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0168.462] lstrlenW (lpString=".anim") returned 5
	[0168.462] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0168.462] lstrlenW (lpString=".arw") returned 4
	[0168.462] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0168.462] lstrlenW (lpString=".as") returned 3
	[0168.462] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0168.462] lstrlenW (lpString=".asa") returned 4
	[0168.463] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0168.463] lstrlenW (lpString=".asc") returned 4
	[0168.463] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0168.463] lstrlenW (lpString=".ascx") returned 5
	[0168.463] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0168.463] lstrlenW (lpString=".asm") returned 4
	[0168.463] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0168.463] lstrlenW (lpString=".asmx") returned 5
	[0168.463] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0168.463] lstrlenW (lpString=".asp") returned 4
	[0168.463] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0168.463] lstrlenW (lpString=".aspx") returned 5
	[0168.463] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0168.463] lstrlenW (lpString=".asr") returned 4
	[0168.463] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0168.463] lstrlenW (lpString=".asx") returned 4
	[0168.463] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0168.463] lstrlenW (lpString=".avi") returned 4
	[0168.463] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0168.463] lstrlenW (lpString=".avs") returned 4
	[0168.463] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0168.463] lstrlenW (lpString=".backup") returned 7
	[0168.463] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1
	[0168.463] lstrlenW (lpString=".bak") returned 4
	[0168.463] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0168.463] lstrlenW (lpString=".bay") returned 4
	[0168.463] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0168.464] lstrlenW (lpString=".bd") returned 3
	[0168.464] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0168.464] lstrlenW (lpString=".bin") returned 4
	[0168.464] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0168.464] lstrlenW (lpString=".bmp") returned 4
	[0168.464] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0168.464] lstrlenW (lpString=".bz2") returned 4
	[0168.464] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.464] lstrlenW (lpString=".c") returned 2
	[0168.464] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0168.464] lstrlenW (lpString=".cdr") returned 4
	[0168.464] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0168.464] lstrlenW (lpString=".cer") returned 4
	[0168.464] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0168.464] lstrlenW (lpString=".cf") returned 3
	[0168.464] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0168.464] lstrlenW (lpString=".cfc") returned 4
	[0168.464] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0168.464] lstrlenW (lpString=".cfm") returned 4
	[0168.464] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0168.464] lstrlenW (lpString=".cfml") returned 5
	[0168.464] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0168.464] lstrlenW (lpString=".cfu") returned 4
	[0168.464] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0168.464] lstrlenW (lpString=".chm") returned 4
	[0168.464] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0168.464] lstrlenW (lpString=".cin") returned 4
	[0168.465] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0168.465] lstrlenW (lpString=".class") returned 6
	[0168.465] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1
	[0168.465] lstrlenW (lpString=".clx") returned 4
	[0168.465] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0168.465] lstrlenW (lpString=".config") returned 7
	[0168.465] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1
	[0168.465] lstrlenW (lpString=".cpp") returned 4
	[0168.465] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0168.465] lstrlenW (lpString=".cr2") returned 4
	[0168.465] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0168.465] lstrlenW (lpString=".crt") returned 4
	[0168.465] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0168.465] lstrlenW (lpString=".crw") returned 4
	[0168.465] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0168.465] lstrlenW (lpString=".cs") returned 3
	[0168.465] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0168.465] lstrlenW (lpString=".css") returned 4
	[0168.465] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0168.465] lstrlenW (lpString=".csv") returned 4
	[0168.465] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0168.465] lstrlenW (lpString=".cub") returned 4
	[0168.465] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0168.465] lstrlenW (lpString=".dae") returned 4
	[0168.465] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0168.465] lstrlenW (lpString=".dat") returned 4
	[0168.465] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0168.465] lstrlenW (lpString=".db") returned 3
	[0168.465] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0168.466] lstrlenW (lpString=".dbf") returned 4
	[0168.466] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.466] lstrlenW (lpString=".dbx") returned 4
	[0168.466] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0168.466] lstrlenW (lpString=".dc3") returned 4
	[0168.466] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0168.466] lstrlenW (lpString=".dcm") returned 4
	[0168.466] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0168.466] lstrlenW (lpString=".dcr") returned 4
	[0168.466] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0168.466] lstrlenW (lpString=".der") returned 4
	[0168.466] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0168.466] lstrlenW (lpString=".dib") returned 4
	[0168.466] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0168.466] lstrlenW (lpString=".dic") returned 4
	[0168.466] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0168.466] lstrlenW (lpString=".dif") returned 4
	[0168.466] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0168.466] lstrlenW (lpString=".divx") returned 5
	[0168.466] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0168.466] lstrlenW (lpString=".djvu") returned 5
	[0168.466] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0168.466] lstrlenW (lpString=".dng") returned 4
	[0168.466] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0168.466] lstrlenW (lpString=".doc") returned 4
	[0168.466] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.466] lstrlenW (lpString=".docm") returned 5
	[0168.467] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0168.467] lstrlenW (lpString=".docx") returned 5
	[0168.467] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0168.467] lstrlenW (lpString=".dot") returned 4
	[0168.467] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0168.467] lstrlenW (lpString=".dotm") returned 5
	[0168.467] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0168.467] lstrlenW (lpString=".dotx") returned 5
	[0168.467] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0168.467] lstrlenW (lpString=".dpx") returned 4
	[0168.467] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0168.467] lstrlenW (lpString=".dqy") returned 4
	[0168.467] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0168.467] lstrlenW (lpString=".dsn") returned 4
	[0168.467] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0168.467] lstrlenW (lpString=".dt") returned 3
	[0168.467] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0168.467] lstrlenW (lpString=".dtd") returned 4
	[0168.467] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0168.467] lstrlenW (lpString=".dwg") returned 4
	[0168.467] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0168.467] lstrlenW (lpString=".dwt") returned 4
	[0168.467] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0168.467] lstrlenW (lpString=".dx") returned 3
	[0168.467] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0168.467] lstrlenW (lpString=".dxf") returned 4
	[0168.467] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0168.467] lstrlenW (lpString=".edml") returned 5
	[0168.468] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0168.468] lstrlenW (lpString=".efd") returned 4
	[0168.468] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0168.468] lstrlenW (lpString=".elf") returned 4
	[0168.468] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0168.468] lstrlenW (lpString=".emf") returned 4
	[0168.468] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0168.468] lstrlenW (lpString=".emz") returned 4
	[0168.468] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0168.468] lstrlenW (lpString=".epf") returned 4
	[0168.468] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0168.468] lstrlenW (lpString=".eps") returned 4
	[0168.468] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0168.468] lstrlenW (lpString=".epsf") returned 5
	[0168.468] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0168.468] lstrlenW (lpString=".epsp") returned 5
	[0168.468] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0168.468] lstrlenW (lpString=".erf") returned 4
	[0168.468] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0168.468] lstrlenW (lpString=".exr") returned 4
	[0168.468] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0168.468] lstrlenW (lpString=".f4v") returned 4
	[0168.468] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0168.468] lstrlenW (lpString=".fido") returned 5
	[0168.468] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0168.468] lstrlenW (lpString=".flm") returned 4
	[0168.468] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0168.468] lstrlenW (lpString=".flv") returned 4
	[0168.469] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0168.469] lstrlenW (lpString=".frm") returned 4
	[0168.469] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0168.469] lstrlenW (lpString=".fxg") returned 4
	[0168.469] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0168.469] lstrlenW (lpString=".geo") returned 4
	[0168.469] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0168.469] lstrlenW (lpString=".gif") returned 4
	[0168.469] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0168.469] lstrlenW (lpString=".grs") returned 4
	[0168.469] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0168.469] lstrlenW (lpString=".gz") returned 3
	[0168.469] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0168.469] lstrlenW (lpString=".h") returned 2
	[0168.469] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0168.469] lstrlenW (lpString=".hdr") returned 4
	[0168.469] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0168.469] lstrlenW (lpString=".hpp") returned 4
	[0168.469] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0168.469] lstrlenW (lpString=".hta") returned 4
	[0168.469] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0168.469] lstrlenW (lpString=".htc") returned 4
	[0168.469] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0168.469] lstrlenW (lpString=".htm") returned 4
	[0168.470] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0168.470] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24
	[0168.470] lstrlenW (lpString=".1cd") returned 4
	[0168.470] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0168.470] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0168.470] FindClose (in: hFindFile=0x3e70770 | out: hFindFile=0x3e70770) returned 1
	[0168.471] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0168.471] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0168.471] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x451cfe8
	[0168.471] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR") returned 100
	[0168.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\*", lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e70870
	[0168.474] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0168.474] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0168.474] lstrlenW (lpString="index.html") returned 10
	[0168.474] lstrlenW (lpString=".1cd") returned 4
	[0168.474] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0168.474] lstrlenW (lpString=".3ds") returned 4
	[0168.474] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0168.474] lstrlenW (lpString=".3fr") returned 4
	[0168.474] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0168.474] lstrlenW (lpString=".3g2") returned 4
	[0168.474] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0168.474] lstrlenW (lpString=".3gp") returned 4
	[0168.474] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0168.474] lstrlenW (lpString=".7z") returned 3
	[0168.474] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0168.474] lstrlenW (lpString=".accda") returned 6
	[0168.474] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1
	[0168.474] lstrlenW (lpString=".accdb") returned 6
	[0168.474] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1
	[0168.474] lstrlenW (lpString=".accdc") returned 6
	[0168.474] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1
	[0168.474] lstrlenW (lpString=".accde") returned 6
	[0168.474] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1
	[0168.475] lstrlenW (lpString=".accdt") returned 6
	[0168.475] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1
	[0168.475] lstrlenW (lpString=".accdw") returned 6
	[0168.475] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1
	[0168.475] lstrlenW (lpString=".adb") returned 4
	[0168.475] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0168.475] lstrlenW (lpString=".adp") returned 4
	[0168.475] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0168.475] lstrlenW (lpString=".ai") returned 3
	[0168.475] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0168.475] lstrlenW (lpString=".ai3") returned 4
	[0168.475] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0168.475] lstrlenW (lpString=".ai4") returned 4
	[0168.475] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0168.475] lstrlenW (lpString=".ai5") returned 4
	[0168.475] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0168.475] lstrlenW (lpString=".ai6") returned 4
	[0168.475] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0168.475] lstrlenW (lpString=".ai7") returned 4
	[0168.475] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0168.475] lstrlenW (lpString=".ai8") returned 4
	[0168.475] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0168.475] lstrlenW (lpString=".anim") returned 5
	[0168.475] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0168.475] lstrlenW (lpString=".arw") returned 4
	[0168.475] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0168.475] lstrlenW (lpString=".as") returned 3
	[0168.476] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0168.476] lstrlenW (lpString=".asa") returned 4
	[0168.476] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0168.476] lstrlenW (lpString=".asc") returned 4
	[0168.476] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0168.476] lstrlenW (lpString=".ascx") returned 5
	[0168.476] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0168.476] lstrlenW (lpString=".asm") returned 4
	[0168.476] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0168.476] lstrlenW (lpString=".asmx") returned 5
	[0168.476] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0168.476] lstrlenW (lpString=".asp") returned 4
	[0168.476] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0168.476] lstrlenW (lpString=".aspx") returned 5
	[0168.476] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0168.476] lstrlenW (lpString=".asr") returned 4
	[0168.476] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0168.476] lstrlenW (lpString=".asx") returned 4
	[0168.476] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0168.476] lstrlenW (lpString=".avi") returned 4
	[0168.476] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0168.476] lstrlenW (lpString=".avs") returned 4
	[0168.476] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0168.476] lstrlenW (lpString=".backup") returned 7
	[0168.476] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1
	[0168.476] lstrlenW (lpString=".bak") returned 4
	[0168.476] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0168.476] lstrlenW (lpString=".bay") returned 4
	[0168.477] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0168.477] lstrlenW (lpString=".bd") returned 3
	[0168.477] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0168.477] lstrlenW (lpString=".bin") returned 4
	[0168.477] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0168.477] lstrlenW (lpString=".bmp") returned 4
	[0168.477] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0168.477] lstrlenW (lpString=".bz2") returned 4
	[0168.477] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0168.477] lstrlenW (lpString=".c") returned 2
	[0168.477] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0168.477] lstrlenW (lpString=".cdr") returned 4
	[0168.477] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0168.477] lstrlenW (lpString=".cer") returned 4
	[0168.477] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0168.477] lstrlenW (lpString=".cf") returned 3
	[0168.477] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0168.477] lstrlenW (lpString=".cfc") returned 4
	[0168.477] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0168.477] lstrlenW (lpString=".cfm") returned 4
	[0168.477] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0168.477] lstrlenW (lpString=".cfml") returned 5
	[0168.477] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0168.477] lstrlenW (lpString=".cfu") returned 4
	[0168.477] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0168.477] lstrlenW (lpString=".chm") returned 4
	[0168.477] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0168.477] lstrlenW (lpString=".cin") returned 4
	[0168.478] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0168.478] lstrlenW (lpString=".class") returned 6
	[0168.478] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1
	[0168.478] lstrlenW (lpString=".clx") returned 4
	[0168.478] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0168.478] lstrlenW (lpString=".config") returned 7
	[0168.478] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1
	[0168.478] lstrlenW (lpString=".cpp") returned 4
	[0168.478] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0168.478] lstrlenW (lpString=".cr2") returned 4
	[0168.478] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0168.478] lstrlenW (lpString=".crt") returned 4
	[0168.478] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0168.478] lstrlenW (lpString=".crw") returned 4
	[0168.478] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0168.478] lstrlenW (lpString=".cs") returned 3
	[0168.478] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0168.478] lstrlenW (lpString=".css") returned 4
	[0168.478] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0168.478] lstrlenW (lpString=".csv") returned 4
	[0168.478] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0168.478] lstrlenW (lpString=".cub") returned 4
	[0168.478] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0168.478] lstrlenW (lpString=".dae") returned 4
	[0168.478] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0168.478] lstrlenW (lpString=".dat") returned 4
	[0168.478] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0168.478] lstrlenW (lpString=".db") returned 3
	[0168.479] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0168.479] lstrlenW (lpString=".dbf") returned 4
	[0168.479] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0168.479] lstrlenW (lpString=".dbx") returned 4
	[0168.479] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0168.479] lstrlenW (lpString=".dc3") returned 4
	[0168.479] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0168.479] lstrlenW (lpString=".dcm") returned 4
	[0168.479] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0168.479] lstrlenW (lpString=".dcr") returned 4
	[0168.479] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0168.479] lstrlenW (lpString=".der") returned 4
	[0168.479] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0168.479] lstrlenW (lpString=".dib") returned 4
	[0168.479] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0168.479] lstrlenW (lpString=".dic") returned 4
	[0168.479] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0168.479] lstrlenW (lpString=".dif") returned 4
	[0168.479] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0168.479] lstrlenW (lpString=".divx") returned 5
	[0168.479] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0168.479] lstrlenW (lpString=".djvu") returned 5
	[0168.479] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0168.479] lstrlenW (lpString=".dng") returned 4
	[0168.479] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0168.479] lstrlenW (lpString=".doc") returned 4
	[0168.479] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0168.479] lstrlenW (lpString=".docm") returned 5
	[0168.480] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0168.480] lstrlenW (lpString=".docx") returned 5
	[0168.480] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0168.480] lstrlenW (lpString=".dot") returned 4
	[0168.480] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0168.480] lstrlenW (lpString=".dotm") returned 5
	[0168.480] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0168.480] lstrlenW (lpString=".dotx") returned 5
	[0168.480] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0168.480] lstrlenW (lpString=".dpx") returned 4
	[0168.480] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0168.480] lstrlenW (lpString=".dqy") returned 4
	[0168.480] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0168.480] lstrlenW (lpString=".dsn") returned 4
	[0168.480] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0168.480] lstrlenW (lpString=".dt") returned 3
	[0168.480] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0168.480] lstrlenW (lpString=".dtd") returned 4
	[0168.480] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0168.480] lstrlenW (lpString=".dwg") returned 4
	[0168.480] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0168.480] lstrlenW (lpString=".dwt") returned 4
	[0168.480] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0168.480] lstrlenW (lpString=".dx") returned 3
	[0168.480] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0168.480] lstrlenW (lpString=".dxf") returned 4
	[0168.480] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0168.480] lstrlenW (lpString=".edml") returned 5
	[0168.481] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0168.481] lstrlenW (lpString=".efd") returned 4
	[0168.481] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0168.481] lstrlenW (lpString=".elf") returned 4
	[0168.481] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0168.481] lstrlenW (lpString=".emf") returned 4
	[0168.481] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0168.481] lstrlenW (lpString=".emz") returned 4
	[0168.481] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0168.481] lstrlenW (lpString=".epf") returned 4
	[0168.481] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0168.481] lstrlenW (lpString=".eps") returned 4
	[0168.481] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0168.481] lstrlenW (lpString=".epsf") returned 5
	[0168.481] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0168.481] lstrlenW (lpString=".epsp") returned 5
	[0168.481] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0168.481] lstrlenW (lpString=".erf") returned 4
	[0168.481] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0168.481] lstrlenW (lpString=".exr") returned 4
	[0168.481] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0168.481] lstrlenW (lpString=".f4v") returned 4
	[0168.481] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0168.481] lstrlenW (lpString=".fido") returned 5
	[0168.482] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0168.482] lstrlenW (lpString=".flm") returned 4
	[0168.482] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0168.482] lstrlenW (lpString=".flv") returned 4
	[0168.482] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0168.482] lstrlenW (lpString=".frm") returned 4
	[0168.482] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0168.482] lstrlenW (lpString=".fxg") returned 4
	[0168.482] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0168.482] lstrlenW (lpString=".geo") returned 4
	[0168.482] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0168.482] lstrlenW (lpString=".gif") returned 4
	[0168.482] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0168.482] lstrlenW (lpString=".grs") returned 4
	[0168.482] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0168.482] lstrlenW (lpString=".gz") returned 3
	[0168.482] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0168.482] lstrlenW (lpString=".h") returned 2
	[0168.482] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0168.482] lstrlenW (lpString=".hdr") returned 4
	[0168.482] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0168.482] lstrlenW (lpString=".hpp") returned 4
	[0168.482] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0168.482] lstrlenW (lpString=".hta") returned 4
	[0168.482] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0168.482] lstrlenW (lpString=".htc") returned 4
	[0168.482] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0168.483] lstrlenW (lpString=".htm") returned 4
	[0168.483] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0168.483] lstrlenW (lpString=".html") returned 5
	[0168.483] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0168.483] lstrlenW (lpString="index.html") returned 10
	[0168.483] lstrlenW (lpString=".money") returned 6
	[0168.483] lstrcmpiW (lpString1=".money", lpString2="x.html") returned -1
	[0168.483] lstrlenW (lpString="index.html") returned 10
	[0168.483] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1
	[0168.483] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1
	[0168.483] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1
	[0168.483] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1
	[0168.483] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1
	[0168.483] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1
	[0168.483] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1
	[0168.483] lstrcmpiW (lpString1="d2.exe", lpString2="index.html") returned -1
	[0168.483] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html") returned 111
	[0168.483] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0168.483] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0168.483] lstrlenW (lpString=".1cd") returned 4
	[0168.483] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.484] lstrlenW (lpString=".3ds") returned 4
	[0168.484] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0168.484] lstrlenW (lpString=".3fr") returned 4
	[0168.484] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0168.484] lstrlenW (lpString=".3g2") returned 4
	[0168.484] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0168.484] lstrlenW (lpString=".3gp") returned 4
	[0168.484] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0168.484] lstrlenW (lpString=".7z") returned 3
	[0168.484] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.484] lstrlenW (lpString=".accda") returned 6
	[0168.484] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1
	[0168.484] lstrlenW (lpString=".accdb") returned 6
	[0168.576] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1
	[0168.576] lstrlenW (lpString=".accdc") returned 6
	[0168.576] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1
	[0168.576] lstrlenW (lpString=".accde") returned 6
	[0168.576] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1
	[0168.576] lstrlenW (lpString=".accdt") returned 6
	[0168.576] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1
	[0168.576] lstrlenW (lpString=".accdw") returned 6
	[0168.576] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1
	[0168.576] lstrlenW (lpString=".adb") returned 4
	[0168.576] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0168.576] lstrlenW (lpString=".adp") returned 4
	[0168.576] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0168.576] lstrlenW (lpString=".ai") returned 3
	[0168.576] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0168.577] lstrlenW (lpString=".ai3") returned 4
	[0168.577] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0168.577] lstrlenW (lpString=".ai4") returned 4
	[0168.577] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0168.577] lstrlenW (lpString=".ai5") returned 4
	[0168.577] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0168.577] lstrlenW (lpString=".ai6") returned 4
	[0168.577] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0168.577] lstrlenW (lpString=".ai7") returned 4
	[0168.577] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0168.577] lstrlenW (lpString=".ai8") returned 4
	[0168.577] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0168.577] lstrlenW (lpString=".anim") returned 5
	[0168.577] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0168.577] lstrlenW (lpString=".arw") returned 4
	[0168.577] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0168.577] lstrlenW (lpString=".as") returned 3
	[0168.577] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0168.577] lstrlenW (lpString=".asa") returned 4
	[0168.577] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0168.577] lstrlenW (lpString=".asc") returned 4
	[0168.577] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0168.577] lstrlenW (lpString=".ascx") returned 5
	[0168.577] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0168.577] lstrlenW (lpString=".asm") returned 4
	[0168.577] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0168.577] lstrlenW (lpString=".asmx") returned 5
	[0168.577] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0168.578] lstrlenW (lpString=".asp") returned 4
	[0168.578] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0168.578] lstrlenW (lpString=".aspx") returned 5
	[0168.578] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0168.578] lstrlenW (lpString=".asr") returned 4
	[0168.578] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0168.578] lstrlenW (lpString=".asx") returned 4
	[0168.578] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0168.578] lstrlenW (lpString=".avi") returned 4
	[0168.578] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0168.578] lstrlenW (lpString=".avs") returned 4
	[0168.578] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0168.578] lstrlenW (lpString=".backup") returned 7
	[0168.578] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1
	[0168.578] lstrlenW (lpString=".bak") returned 4
	[0168.578] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0168.578] lstrlenW (lpString=".bay") returned 4
	[0168.578] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0168.578] lstrlenW (lpString=".bd") returned 3
	[0168.578] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0168.578] lstrlenW (lpString=".bin") returned 4
	[0168.578] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0168.578] lstrlenW (lpString=".bmp") returned 4
	[0168.578] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0168.578] lstrlenW (lpString=".bz2") returned 4
	[0168.578] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.578] lstrlenW (lpString=".c") returned 2
	[0168.578] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0168.579] lstrlenW (lpString=".cdr") returned 4
	[0168.579] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0168.579] lstrlenW (lpString=".cer") returned 4
	[0168.579] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0168.579] lstrlenW (lpString=".cf") returned 3
	[0168.579] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0168.579] lstrlenW (lpString=".cfc") returned 4
	[0168.579] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0168.579] lstrlenW (lpString=".cfm") returned 4
	[0168.579] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0168.579] lstrlenW (lpString=".cfml") returned 5
	[0168.579] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0168.579] lstrlenW (lpString=".cfu") returned 4
	[0168.579] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0168.579] lstrlenW (lpString=".chm") returned 4
	[0168.579] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0168.579] lstrlenW (lpString=".cin") returned 4
	[0168.579] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0168.579] lstrlenW (lpString=".class") returned 6
	[0168.579] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1
	[0168.579] lstrlenW (lpString=".clx") returned 4
	[0168.579] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0168.579] lstrlenW (lpString=".config") returned 7
	[0168.579] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1
	[0168.579] lstrlenW (lpString=".cpp") returned 4
	[0168.579] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0168.579] lstrlenW (lpString=".cr2") returned 4
	[0168.579] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0168.579] lstrlenW (lpString=".crt") returned 4
	[0168.580] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".crw") returned 4
	[0168.580] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".cs") returned 3
	[0168.580] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0168.580] lstrlenW (lpString=".css") returned 4
	[0168.580] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".csv") returned 4
	[0168.580] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".cub") returned 4
	[0168.580] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".dae") returned 4
	[0168.580] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".dat") returned 4
	[0168.580] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".db") returned 3
	[0168.580] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0168.580] lstrlenW (lpString=".dbf") returned 4
	[0168.580] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".dbx") returned 4
	[0168.580] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".dc3") returned 4
	[0168.580] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".dcm") returned 4
	[0168.580] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".dcr") returned 4
	[0168.580] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0168.580] lstrlenW (lpString=".der") returned 4
	[0168.581] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0168.581] lstrlenW (lpString=".dib") returned 4
	[0168.581] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0168.581] lstrlenW (lpString=".dic") returned 4
	[0168.581] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0168.581] lstrlenW (lpString=".dif") returned 4
	[0168.581] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0168.581] lstrlenW (lpString=".divx") returned 5
	[0168.581] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0168.581] lstrlenW (lpString=".djvu") returned 5
	[0168.581] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0168.581] lstrlenW (lpString=".dng") returned 4
	[0168.581] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0168.581] lstrlenW (lpString=".doc") returned 4
	[0168.581] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.581] lstrlenW (lpString=".docm") returned 5
	[0168.581] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0168.581] lstrlenW (lpString=".docx") returned 5
	[0168.581] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0168.581] lstrlenW (lpString=".dot") returned 4
	[0168.581] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0168.581] lstrlenW (lpString=".dotm") returned 5
	[0168.581] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0168.581] lstrlenW (lpString=".dotx") returned 5
	[0168.581] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0168.581] lstrlenW (lpString=".dpx") returned 4
	[0168.581] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0168.581] lstrlenW (lpString=".dqy") returned 4
	[0168.582] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0168.582] lstrlenW (lpString=".dsn") returned 4
	[0168.582] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0168.582] lstrlenW (lpString=".dt") returned 3
	[0168.582] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0168.582] lstrlenW (lpString=".dtd") returned 4
	[0168.582] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0168.582] lstrlenW (lpString=".dwg") returned 4
	[0168.582] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0168.582] lstrlenW (lpString=".dwt") returned 4
	[0168.582] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0168.582] lstrlenW (lpString=".dx") returned 3
	[0168.582] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0168.582] lstrlenW (lpString=".dxf") returned 4
	[0168.582] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0168.582] lstrlenW (lpString=".edml") returned 5
	[0168.582] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0168.582] lstrlenW (lpString=".efd") returned 4
	[0168.582] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0168.582] lstrlenW (lpString=".elf") returned 4
	[0168.582] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0168.582] lstrlenW (lpString=".emf") returned 4
	[0168.582] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0168.582] lstrlenW (lpString=".emz") returned 4
	[0168.582] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0168.582] lstrlenW (lpString=".epf") returned 4
	[0168.582] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0168.583] lstrlenW (lpString=".eps") returned 4
	[0168.583] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0168.583] lstrlenW (lpString=".epsf") returned 5
	[0168.583] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0168.583] lstrlenW (lpString=".epsp") returned 5
	[0168.583] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0168.583] lstrlenW (lpString=".erf") returned 4
	[0168.583] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0168.583] lstrlenW (lpString=".exr") returned 4
	[0168.583] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0168.583] lstrlenW (lpString=".f4v") returned 4
	[0168.583] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0168.583] lstrlenW (lpString=".fido") returned 5
	[0168.583] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0168.583] lstrlenW (lpString=".flm") returned 4
	[0168.583] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0168.583] lstrlenW (lpString=".flv") returned 4
	[0168.583] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0168.583] lstrlenW (lpString=".frm") returned 4
	[0168.583] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0168.583] lstrlenW (lpString=".fxg") returned 4
	[0168.583] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0168.583] lstrlenW (lpString=".geo") returned 4
	[0168.583] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0168.583] lstrlenW (lpString=".gif") returned 4
	[0168.583] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0168.583] lstrlenW (lpString=".grs") returned 4
	[0168.584] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0168.584] lstrlenW (lpString=".gz") returned 3
	[0168.584] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0168.584] lstrlenW (lpString=".h") returned 2
	[0168.584] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0168.584] lstrlenW (lpString=".hdr") returned 4
	[0168.584] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0168.584] lstrlenW (lpString=".hpp") returned 4
	[0168.584] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0168.584] lstrlenW (lpString=".hta") returned 4
	[0168.584] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0168.584] lstrlenW (lpString=".htc") returned 4
	[0168.584] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0168.584] lstrlenW (lpString=".htm") returned 4
	[0168.584] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0168.584] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24
	[0168.585] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0168.585] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0168.585] FindClose (in: hFindFile=0x3e70870 | out: hFindFile=0x3e70870) returned 1
	[0168.586] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.586] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-XF", cAlternateFileName="")) returned 1
	[0168.586] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x451cfe8
	[0168.586] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF") returned 100
	[0168.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\*", lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e705b0
	[0168.989] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0168.989] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0168.989] lstrlenW (lpString="index.html") returned 10
	[0168.989] lstrlenW (lpString=".1cd") returned 4
	[0168.989] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0168.989] lstrlenW (lpString=".3ds") returned 4
	[0168.989] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0168.989] lstrlenW (lpString=".3fr") returned 4
	[0168.989] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0168.989] lstrlenW (lpString=".3g2") returned 4
	[0168.989] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0168.989] lstrlenW (lpString=".3gp") returned 4
	[0168.989] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0168.989] lstrlenW (lpString=".7z") returned 3
	[0168.989] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0168.989] lstrlenW (lpString=".accda") returned 6
	[0168.989] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1
	[0168.989] lstrlenW (lpString=".accdb") returned 6
	[0168.989] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1
	[0168.990] lstrlenW (lpString=".accdc") returned 6
	[0168.990] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1
	[0168.990] lstrlenW (lpString=".accde") returned 6
	[0168.990] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1
	[0168.990] lstrlenW (lpString=".accdt") returned 6
	[0168.990] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1
	[0168.990] lstrlenW (lpString=".accdw") returned 6
	[0168.990] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1
	[0168.990] lstrlenW (lpString=".adb") returned 4
	[0168.990] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0168.990] lstrlenW (lpString=".adp") returned 4
	[0168.990] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0168.990] lstrlenW (lpString=".ai") returned 3
	[0168.990] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0168.990] lstrlenW (lpString=".ai3") returned 4
	[0168.990] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0168.990] lstrlenW (lpString=".ai4") returned 4
	[0168.990] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0168.990] lstrlenW (lpString=".ai5") returned 4
	[0168.990] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0168.990] lstrlenW (lpString=".ai6") returned 4
	[0168.990] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0168.990] lstrlenW (lpString=".ai7") returned 4
	[0168.990] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0168.990] lstrlenW (lpString=".ai8") returned 4
	[0168.990] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0168.990] lstrlenW (lpString=".anim") returned 5
	[0168.991] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0168.991] lstrlenW (lpString=".arw") returned 4
	[0168.991] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0168.991] lstrlenW (lpString=".as") returned 3
	[0168.991] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0168.991] lstrlenW (lpString=".asa") returned 4
	[0168.991] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0168.991] lstrlenW (lpString=".asc") returned 4
	[0168.991] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0168.991] lstrlenW (lpString=".ascx") returned 5
	[0168.991] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0168.991] lstrlenW (lpString=".asm") returned 4
	[0168.991] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0168.991] lstrlenW (lpString=".asmx") returned 5
	[0168.991] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0168.991] lstrlenW (lpString=".asp") returned 4
	[0168.991] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0168.991] lstrlenW (lpString=".aspx") returned 5
	[0168.991] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0168.991] lstrlenW (lpString=".asr") returned 4
	[0168.991] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0168.991] lstrlenW (lpString=".asx") returned 4
	[0168.991] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0168.991] lstrlenW (lpString=".avi") returned 4
	[0168.991] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0168.991] lstrlenW (lpString=".avs") returned 4
	[0168.991] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0168.991] lstrlenW (lpString=".backup") returned 7
	[0168.992] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1
	[0168.992] lstrlenW (lpString=".bak") returned 4
	[0168.992] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0168.992] lstrlenW (lpString=".bay") returned 4
	[0168.992] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0168.992] lstrlenW (lpString=".bd") returned 3
	[0168.992] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0168.992] lstrlenW (lpString=".bin") returned 4
	[0168.992] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0168.992] lstrlenW (lpString=".bmp") returned 4
	[0168.992] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0168.992] lstrlenW (lpString=".bz2") returned 4
	[0168.992] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0168.992] lstrlenW (lpString=".c") returned 2
	[0168.992] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0168.992] lstrlenW (lpString=".cdr") returned 4
	[0168.992] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0168.992] lstrlenW (lpString=".cer") returned 4
	[0168.992] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0168.992] lstrlenW (lpString=".cf") returned 3
	[0168.992] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0168.992] lstrlenW (lpString=".cfc") returned 4
	[0168.992] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0168.992] lstrlenW (lpString=".cfm") returned 4
	[0168.992] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0168.992] lstrlenW (lpString=".cfml") returned 5
	[0168.992] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0168.992] lstrlenW (lpString=".cfu") returned 4
	[0168.992] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".chm") returned 4
	[0168.993] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".cin") returned 4
	[0168.993] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".class") returned 6
	[0168.993] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1
	[0168.993] lstrlenW (lpString=".clx") returned 4
	[0168.993] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".config") returned 7
	[0168.993] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1
	[0168.993] lstrlenW (lpString=".cpp") returned 4
	[0168.993] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".cr2") returned 4
	[0168.993] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".crt") returned 4
	[0168.993] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".crw") returned 4
	[0168.993] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".cs") returned 3
	[0168.993] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0168.993] lstrlenW (lpString=".css") returned 4
	[0168.993] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".csv") returned 4
	[0168.993] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".cub") returned 4
	[0168.993] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".dae") returned 4
	[0168.993] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0168.993] lstrlenW (lpString=".dat") returned 4
	[0168.994] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0168.994] lstrlenW (lpString=".db") returned 3
	[0168.994] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0168.994] lstrlenW (lpString=".dbf") returned 4
	[0168.994] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0168.994] lstrlenW (lpString=".dbx") returned 4
	[0168.994] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0168.994] lstrlenW (lpString=".dc3") returned 4
	[0168.994] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0168.994] lstrlenW (lpString=".dcm") returned 4
	[0168.994] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0168.994] lstrlenW (lpString=".dcr") returned 4
	[0168.994] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0168.994] lstrlenW (lpString=".der") returned 4
	[0168.994] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0168.994] lstrlenW (lpString=".dib") returned 4
	[0168.994] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0168.994] lstrlenW (lpString=".dic") returned 4
	[0168.994] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0168.994] lstrlenW (lpString=".dif") returned 4
	[0168.994] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0168.994] lstrlenW (lpString=".divx") returned 5
	[0168.994] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0168.994] lstrlenW (lpString=".djvu") returned 5
	[0168.994] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0168.994] lstrlenW (lpString=".dng") returned 4
	[0168.994] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0168.994] lstrlenW (lpString=".doc") returned 4
	[0168.995] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0168.995] lstrlenW (lpString=".docm") returned 5
	[0168.995] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0168.995] lstrlenW (lpString=".docx") returned 5
	[0168.995] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0168.995] lstrlenW (lpString=".dot") returned 4
	[0168.995] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0168.995] lstrlenW (lpString=".dotm") returned 5
	[0168.995] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0168.995] lstrlenW (lpString=".dotx") returned 5
	[0168.995] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0168.995] lstrlenW (lpString=".dpx") returned 4
	[0168.995] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0168.995] lstrlenW (lpString=".dqy") returned 4
	[0168.995] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0168.995] lstrlenW (lpString=".dsn") returned 4
	[0168.995] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0168.995] lstrlenW (lpString=".dt") returned 3
	[0168.995] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0168.995] lstrlenW (lpString=".dtd") returned 4
	[0168.995] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0168.995] lstrlenW (lpString=".dwg") returned 4
	[0168.995] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0168.995] lstrlenW (lpString=".dwt") returned 4
	[0168.995] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0168.995] lstrlenW (lpString=".dx") returned 3
	[0168.995] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0168.995] lstrlenW (lpString=".dxf") returned 4
	[0168.995] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0168.996] lstrlenW (lpString=".edml") returned 5
	[0168.996] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0168.996] lstrlenW (lpString=".efd") returned 4
	[0168.996] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0168.996] lstrlenW (lpString=".elf") returned 4
	[0168.996] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0168.996] lstrlenW (lpString=".emf") returned 4
	[0168.996] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0168.996] lstrlenW (lpString=".emz") returned 4
	[0168.996] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0168.996] lstrlenW (lpString=".epf") returned 4
	[0168.996] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0168.996] lstrlenW (lpString=".eps") returned 4
	[0168.996] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0168.996] lstrlenW (lpString=".epsf") returned 5
	[0168.996] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0168.996] lstrlenW (lpString=".epsp") returned 5
	[0168.996] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0168.996] lstrlenW (lpString=".erf") returned 4
	[0168.996] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0168.996] lstrlenW (lpString=".exr") returned 4
	[0168.996] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0168.996] lstrlenW (lpString=".f4v") returned 4
	[0168.996] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0168.996] lstrlenW (lpString=".fido") returned 5
	[0168.996] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0168.996] lstrlenW (lpString=".flm") returned 4
	[0168.996] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".flv") returned 4
	[0168.997] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".frm") returned 4
	[0168.997] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".fxg") returned 4
	[0168.997] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".geo") returned 4
	[0168.997] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".gif") returned 4
	[0168.997] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".grs") returned 4
	[0168.997] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".gz") returned 3
	[0168.997] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0168.997] lstrlenW (lpString=".h") returned 2
	[0168.997] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0168.997] lstrlenW (lpString=".hdr") returned 4
	[0168.997] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".hpp") returned 4
	[0168.997] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".hta") returned 4
	[0168.997] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".htc") returned 4
	[0168.997] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".htm") returned 4
	[0168.997] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0168.997] lstrlenW (lpString=".html") returned 5
	[0168.997] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0168.998] lstrlenW (lpString="index.html") returned 10
	[0168.998] lstrlenW (lpString=".money") returned 6
	[0168.998] lstrcmpiW (lpString1=".money", lpString2="x.html") returned -1
	[0168.998] lstrlenW (lpString="index.html") returned 10
	[0168.998] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1
	[0168.998] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1
	[0168.998] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1
	[0168.998] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1
	[0168.998] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1
	[0168.998] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1
	[0168.998] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1
	[0168.998] lstrcmpiW (lpString1="d2.exe", lpString2="index.html") returned -1
	[0168.998] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html") returned 111
	[0168.998] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0168.998] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0168.998] lstrlenW (lpString=".1cd") returned 4
	[0168.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.998] lstrlenW (lpString=".3ds") returned 4
	[0168.998] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0168.998] lstrlenW (lpString=".3fr") returned 4
	[0168.998] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0168.999] lstrlenW (lpString=".3g2") returned 4
	[0168.999] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0168.999] lstrlenW (lpString=".3gp") returned 4
	[0168.999] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0168.999] lstrlenW (lpString=".7z") returned 3
	[0168.999] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.999] lstrlenW (lpString=".accda") returned 6
	[0168.999] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1
	[0168.999] lstrlenW (lpString=".accdb") returned 6
	[0168.999] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1
	[0168.999] lstrlenW (lpString=".accdc") returned 6
	[0168.999] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1
	[0168.999] lstrlenW (lpString=".accde") returned 6
	[0168.999] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1
	[0168.999] lstrlenW (lpString=".accdt") returned 6
	[0168.999] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1
	[0168.999] lstrlenW (lpString=".accdw") returned 6
	[0168.999] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1
	[0168.999] lstrlenW (lpString=".adb") returned 4
	[0168.999] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0168.999] lstrlenW (lpString=".adp") returned 4
	[0168.999] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0168.999] lstrlenW (lpString=".ai") returned 3
	[0168.999] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0168.999] lstrlenW (lpString=".ai3") returned 4
	[0168.999] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0168.999] lstrlenW (lpString=".ai4") returned 4
	[0168.999] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0169.000] lstrlenW (lpString=".ai5") returned 4
	[0169.000] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0169.000] lstrlenW (lpString=".ai6") returned 4
	[0169.000] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0169.000] lstrlenW (lpString=".ai7") returned 4
	[0169.000] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0169.000] lstrlenW (lpString=".ai8") returned 4
	[0169.000] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0169.000] lstrlenW (lpString=".anim") returned 5
	[0169.000] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0169.000] lstrlenW (lpString=".arw") returned 4
	[0169.000] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0169.000] lstrlenW (lpString=".as") returned 3
	[0169.000] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0169.000] lstrlenW (lpString=".asa") returned 4
	[0169.000] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0169.000] lstrlenW (lpString=".asc") returned 4
	[0169.000] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0169.000] lstrlenW (lpString=".ascx") returned 5
	[0169.000] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0169.000] lstrlenW (lpString=".asm") returned 4
	[0169.000] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0169.000] lstrlenW (lpString=".asmx") returned 5
	[0169.000] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0169.000] lstrlenW (lpString=".asp") returned 4
	[0169.000] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0169.000] lstrlenW (lpString=".aspx") returned 5
	[0169.001] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0169.001] lstrlenW (lpString=".asr") returned 4
	[0169.001] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0169.001] lstrlenW (lpString=".asx") returned 4
	[0169.001] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0169.001] lstrlenW (lpString=".avi") returned 4
	[0169.001] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0169.001] lstrlenW (lpString=".avs") returned 4
	[0169.001] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0169.001] lstrlenW (lpString=".backup") returned 7
	[0169.001] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1
	[0169.001] lstrlenW (lpString=".bak") returned 4
	[0169.001] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0169.001] lstrlenW (lpString=".bay") returned 4
	[0169.001] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0169.001] lstrlenW (lpString=".bd") returned 3
	[0169.001] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0169.001] lstrlenW (lpString=".bin") returned 4
	[0169.001] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0169.001] lstrlenW (lpString=".bmp") returned 4
	[0169.001] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0169.001] lstrlenW (lpString=".bz2") returned 4
	[0169.001] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0169.001] lstrlenW (lpString=".c") returned 2
	[0169.001] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0169.001] lstrlenW (lpString=".cdr") returned 4
	[0169.001] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0169.002] lstrlenW (lpString=".cer") returned 4
	[0169.002] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0169.002] lstrlenW (lpString=".cf") returned 3
	[0169.002] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0169.002] lstrlenW (lpString=".cfc") returned 4
	[0169.002] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0169.002] lstrlenW (lpString=".cfm") returned 4
	[0169.002] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0169.002] lstrlenW (lpString=".cfml") returned 5
	[0169.002] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0169.002] lstrlenW (lpString=".cfu") returned 4
	[0169.002] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0169.002] lstrlenW (lpString=".chm") returned 4
	[0169.002] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0169.002] lstrlenW (lpString=".cin") returned 4
	[0169.002] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0169.002] lstrlenW (lpString=".class") returned 6
	[0169.002] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1
	[0169.002] lstrlenW (lpString=".clx") returned 4
	[0169.002] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0169.002] lstrlenW (lpString=".config") returned 7
	[0169.002] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1
	[0169.002] lstrlenW (lpString=".cpp") returned 4
	[0169.002] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0169.002] lstrlenW (lpString=".cr2") returned 4
	[0169.002] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0169.002] lstrlenW (lpString=".crt") returned 4
	[0169.002] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0169.002] lstrlenW (lpString=".crw") returned 4
	[0169.003] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0169.003] lstrlenW (lpString=".cs") returned 3
	[0169.003] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0169.003] lstrlenW (lpString=".css") returned 4
	[0169.003] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0169.003] lstrlenW (lpString=".csv") returned 4
	[0169.003] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0169.003] lstrlenW (lpString=".cub") returned 4
	[0169.003] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0169.003] lstrlenW (lpString=".dae") returned 4
	[0169.003] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0169.003] lstrlenW (lpString=".dat") returned 4
	[0169.003] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0169.003] lstrlenW (lpString=".db") returned 3
	[0169.003] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0169.003] lstrlenW (lpString=".dbf") returned 4
	[0169.003] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0169.003] lstrlenW (lpString=".dbx") returned 4
	[0169.003] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0169.003] lstrlenW (lpString=".dc3") returned 4
	[0169.003] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0169.003] lstrlenW (lpString=".dcm") returned 4
	[0169.003] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0169.003] lstrlenW (lpString=".dcr") returned 4
	[0169.003] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0169.003] lstrlenW (lpString=".der") returned 4
	[0169.004] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0169.004] lstrlenW (lpString=".dib") returned 4
	[0169.004] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0169.004] lstrlenW (lpString=".dic") returned 4
	[0169.004] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0169.004] lstrlenW (lpString=".dif") returned 4
	[0169.004] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0169.004] lstrlenW (lpString=".divx") returned 5
	[0169.004] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0169.004] lstrlenW (lpString=".djvu") returned 5
	[0169.004] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0169.004] lstrlenW (lpString=".dng") returned 4
	[0169.004] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0169.004] lstrlenW (lpString=".doc") returned 4
	[0169.004] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0169.004] lstrlenW (lpString=".docm") returned 5
	[0169.004] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0169.004] lstrlenW (lpString=".docx") returned 5
	[0169.004] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0169.004] lstrlenW (lpString=".dot") returned 4
	[0169.004] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0169.004] lstrlenW (lpString=".dotm") returned 5
	[0169.004] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0169.004] lstrlenW (lpString=".dotx") returned 5
	[0169.004] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0169.005] lstrlenW (lpString=".dpx") returned 4
	[0169.005] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0169.005] lstrlenW (lpString=".dqy") returned 4
	[0169.005] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0169.005] lstrlenW (lpString=".dsn") returned 4
	[0169.005] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0169.005] lstrlenW (lpString=".dt") returned 3
	[0169.005] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0169.005] lstrlenW (lpString=".dtd") returned 4
	[0169.005] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0169.005] lstrlenW (lpString=".dwg") returned 4
	[0169.005] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0169.005] lstrlenW (lpString=".dwt") returned 4
	[0169.005] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0169.005] lstrlenW (lpString=".dx") returned 3
	[0169.005] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0169.005] lstrlenW (lpString=".dxf") returned 4
	[0169.005] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0169.005] lstrlenW (lpString=".edml") returned 5
	[0169.005] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0169.005] lstrlenW (lpString=".efd") returned 4
	[0169.005] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0169.005] lstrlenW (lpString=".elf") returned 4
	[0169.005] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0169.005] lstrlenW (lpString=".emf") returned 4
	[0169.005] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0169.005] lstrlenW (lpString=".emz") returned 4
	[0169.005] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".epf") returned 4
	[0169.006] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".eps") returned 4
	[0169.006] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".epsf") returned 5
	[0169.006] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0169.006] lstrlenW (lpString=".epsp") returned 5
	[0169.006] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0169.006] lstrlenW (lpString=".erf") returned 4
	[0169.006] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".exr") returned 4
	[0169.006] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".f4v") returned 4
	[0169.006] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".fido") returned 5
	[0169.006] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0169.006] lstrlenW (lpString=".flm") returned 4
	[0169.006] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".flv") returned 4
	[0169.006] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".frm") returned 4
	[0169.006] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".fxg") returned 4
	[0169.006] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".geo") returned 4
	[0169.006] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".gif") returned 4
	[0169.006] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0169.006] lstrlenW (lpString=".grs") returned 4
	[0169.007] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0169.007] lstrlenW (lpString=".gz") returned 3
	[0169.007] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0169.007] lstrlenW (lpString=".h") returned 2
	[0169.007] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0169.007] lstrlenW (lpString=".hdr") returned 4
	[0169.007] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0169.007] lstrlenW (lpString=".hpp") returned 4
	[0169.007] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0169.007] lstrlenW (lpString=".hta") returned 4
	[0169.007] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0169.007] lstrlenW (lpString=".htc") returned 4
	[0169.007] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0169.007] lstrlenW (lpString=".htm") returned 4
	[0169.007] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0169.007] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24
	[0169.007] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0169.007] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0169.008] FindClose (in: hFindFile=0x3e705b0 | out: hFindFile=0x3e705b0) returned 1
	[0169.008] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.011] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl-ES", cAlternateFileName="")) returned 1
	[0169.011] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x451cfe8
	[0169.012] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES") returned 100
	[0169.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\*", lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e701b0
	[0169.014] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.014] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.014] lstrlenW (lpString="index.html") returned 10
	[0169.014] lstrlenW (lpString=".1cd") returned 4
	[0169.014] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0169.014] lstrlenW (lpString=".3ds") returned 4
	[0169.014] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0169.014] lstrlenW (lpString=".3fr") returned 4
	[0169.014] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0169.014] lstrlenW (lpString=".3g2") returned 4
	[0169.014] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0169.014] lstrlenW (lpString=".3gp") returned 4
	[0169.014] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0169.014] lstrlenW (lpString=".7z") returned 3
	[0169.014] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0169.014] lstrlenW (lpString=".accda") returned 6
	[0169.014] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1
	[0169.014] lstrlenW (lpString=".accdb") returned 6
	[0169.014] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1
	[0169.014] lstrlenW (lpString=".accdc") returned 6
	[0169.015] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1
	[0169.015] lstrlenW (lpString=".accde") returned 6
	[0169.015] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1
	[0169.015] lstrlenW (lpString=".accdt") returned 6
	[0169.015] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1
	[0169.015] lstrlenW (lpString=".accdw") returned 6
	[0169.015] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1
	[0169.015] lstrlenW (lpString=".adb") returned 4
	[0169.015] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0169.015] lstrlenW (lpString=".adp") returned 4
	[0169.015] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0169.015] lstrlenW (lpString=".ai") returned 3
	[0169.015] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0169.015] lstrlenW (lpString=".ai3") returned 4
	[0169.015] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0169.015] lstrlenW (lpString=".ai4") returned 4
	[0169.015] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0169.015] lstrlenW (lpString=".ai5") returned 4
	[0169.015] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0169.015] lstrlenW (lpString=".ai6") returned 4
	[0169.015] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0169.015] lstrlenW (lpString=".ai7") returned 4
	[0169.015] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0169.015] lstrlenW (lpString=".ai8") returned 4
	[0169.015] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0169.015] lstrlenW (lpString=".anim") returned 5
	[0169.015] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0169.015] lstrlenW (lpString=".arw") returned 4
	[0169.015] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0169.015] lstrlenW (lpString=".as") returned 3
	[0169.016] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0169.016] lstrlenW (lpString=".asa") returned 4
	[0169.016] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0169.016] lstrlenW (lpString=".asc") returned 4
	[0169.016] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0169.016] lstrlenW (lpString=".ascx") returned 5
	[0169.016] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0169.016] lstrlenW (lpString=".asm") returned 4
	[0169.016] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0169.016] lstrlenW (lpString=".asmx") returned 5
	[0169.016] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0169.016] lstrlenW (lpString=".asp") returned 4
	[0169.016] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0169.016] lstrlenW (lpString=".aspx") returned 5
	[0169.016] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0169.016] lstrlenW (lpString=".asr") returned 4
	[0169.016] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0169.016] lstrlenW (lpString=".asx") returned 4
	[0169.016] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0169.016] lstrlenW (lpString=".avi") returned 4
	[0169.016] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0169.016] lstrlenW (lpString=".avs") returned 4
	[0169.016] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0169.016] lstrlenW (lpString=".backup") returned 7
	[0169.016] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1
	[0169.016] lstrlenW (lpString=".bak") returned 4
	[0169.016] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0169.016] lstrlenW (lpString=".bay") returned 4
	[0169.016] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0169.017] lstrlenW (lpString=".bd") returned 3
	[0169.017] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0169.017] lstrlenW (lpString=".bin") returned 4
	[0169.017] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0169.017] lstrlenW (lpString=".bmp") returned 4
	[0169.017] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0169.017] lstrlenW (lpString=".bz2") returned 4
	[0169.017] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0169.017] lstrlenW (lpString=".c") returned 2
	[0169.017] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0169.017] lstrlenW (lpString=".cdr") returned 4
	[0169.017] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0169.017] lstrlenW (lpString=".cer") returned 4
	[0169.017] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0169.017] lstrlenW (lpString=".cf") returned 3
	[0169.017] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0169.017] lstrlenW (lpString=".cfc") returned 4
	[0169.017] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0169.017] lstrlenW (lpString=".cfm") returned 4
	[0169.017] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0169.017] lstrlenW (lpString=".cfml") returned 5
	[0169.017] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0169.017] lstrlenW (lpString=".cfu") returned 4
	[0169.017] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0169.017] lstrlenW (lpString=".chm") returned 4
	[0169.017] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0169.017] lstrlenW (lpString=".cin") returned 4
	[0169.017] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0169.018] lstrlenW (lpString=".class") returned 6
	[0169.018] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1
	[0169.018] lstrlenW (lpString=".clx") returned 4
	[0169.018] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0169.018] lstrlenW (lpString=".config") returned 7
	[0169.018] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1
	[0169.018] lstrlenW (lpString=".cpp") returned 4
	[0169.018] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0169.018] lstrlenW (lpString=".cr2") returned 4
	[0169.018] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0169.018] lstrlenW (lpString=".crt") returned 4
	[0169.018] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0169.018] lstrlenW (lpString=".crw") returned 4
	[0169.018] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0169.018] lstrlenW (lpString=".cs") returned 3
	[0169.018] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0169.018] lstrlenW (lpString=".css") returned 4
	[0169.018] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0169.018] lstrlenW (lpString=".csv") returned 4
	[0169.018] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0169.018] lstrlenW (lpString=".cub") returned 4
	[0169.018] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0169.018] lstrlenW (lpString=".dae") returned 4
	[0169.018] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0169.018] lstrlenW (lpString=".dat") returned 4
	[0169.018] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0169.018] lstrlenW (lpString=".db") returned 3
	[0169.019] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0169.019] lstrlenW (lpString=".dbf") returned 4
	[0169.019] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0169.019] lstrlenW (lpString=".dbx") returned 4
	[0169.019] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0169.019] lstrlenW (lpString=".dc3") returned 4
	[0169.019] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0169.019] lstrlenW (lpString=".dcm") returned 4
	[0169.019] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0169.019] lstrlenW (lpString=".dcr") returned 4
	[0169.019] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0169.019] lstrlenW (lpString=".der") returned 4
	[0169.019] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0169.019] lstrlenW (lpString=".dib") returned 4
	[0169.019] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0169.019] lstrlenW (lpString=".dic") returned 4
	[0169.019] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0169.019] lstrlenW (lpString=".dif") returned 4
	[0169.019] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0169.019] lstrlenW (lpString=".divx") returned 5
	[0169.019] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0169.019] lstrlenW (lpString=".djvu") returned 5
	[0169.019] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0169.020] lstrlenW (lpString=".dng") returned 4
	[0169.020] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0169.020] lstrlenW (lpString=".doc") returned 4
	[0169.020] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0169.020] lstrlenW (lpString=".docm") returned 5
	[0169.020] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0169.020] lstrlenW (lpString=".docx") returned 5
	[0169.020] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0169.020] lstrlenW (lpString=".dot") returned 4
	[0169.020] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0169.020] lstrlenW (lpString=".dotm") returned 5
	[0169.020] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0169.020] lstrlenW (lpString=".dotx") returned 5
	[0169.020] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0169.020] lstrlenW (lpString=".dpx") returned 4
	[0169.020] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0169.020] lstrlenW (lpString=".dqy") returned 4
	[0169.020] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0169.020] lstrlenW (lpString=".dsn") returned 4
	[0169.020] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0169.020] lstrlenW (lpString=".dt") returned 3
	[0169.020] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0169.020] lstrlenW (lpString=".dtd") returned 4
	[0169.020] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0169.020] lstrlenW (lpString=".dwg") returned 4
	[0169.020] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0169.020] lstrlenW (lpString=".dwt") returned 4
	[0169.021] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0169.021] lstrlenW (lpString=".dx") returned 3
	[0169.021] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0169.021] lstrlenW (lpString=".dxf") returned 4
	[0169.021] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0169.021] lstrlenW (lpString=".edml") returned 5
	[0169.021] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0169.021] lstrlenW (lpString=".efd") returned 4
	[0169.021] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0169.021] lstrlenW (lpString=".elf") returned 4
	[0169.021] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0169.021] lstrlenW (lpString=".emf") returned 4
	[0169.021] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0169.021] lstrlenW (lpString=".emz") returned 4
	[0169.021] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0169.021] lstrlenW (lpString=".epf") returned 4
	[0169.021] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0169.021] lstrlenW (lpString=".eps") returned 4
	[0169.021] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0169.021] lstrlenW (lpString=".epsf") returned 5
	[0169.021] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0169.021] lstrlenW (lpString=".epsp") returned 5
	[0169.021] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0169.021] lstrlenW (lpString=".erf") returned 4
	[0169.021] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0169.021] lstrlenW (lpString=".exr") returned 4
	[0169.021] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0169.021] lstrlenW (lpString=".f4v") returned 4
	[0169.022] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0169.022] lstrlenW (lpString=".fido") returned 5
	[0169.022] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0169.022] lstrlenW (lpString=".flm") returned 4
	[0169.022] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0169.022] lstrlenW (lpString=".flv") returned 4
	[0169.022] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0169.022] lstrlenW (lpString=".frm") returned 4
	[0169.022] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0169.022] lstrlenW (lpString=".fxg") returned 4
	[0169.022] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0169.022] lstrlenW (lpString=".geo") returned 4
	[0169.120] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0169.120] lstrlenW (lpString=".gif") returned 4
	[0169.120] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0169.120] lstrlenW (lpString=".grs") returned 4
	[0169.120] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0169.120] lstrlenW (lpString=".gz") returned 3
	[0169.120] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0169.120] lstrlenW (lpString=".h") returned 2
	[0169.120] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0169.120] lstrlenW (lpString=".hdr") returned 4
	[0169.120] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0169.120] lstrlenW (lpString=".hpp") returned 4
	[0169.120] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0169.120] lstrlenW (lpString=".hta") returned 4
	[0169.120] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0169.120] lstrlenW (lpString=".htc") returned 4
	[0169.120] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0169.120] lstrlenW (lpString=".htm") returned 4
	[0169.120] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0169.120] lstrlenW (lpString=".html") returned 5
	[0169.121] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0169.121] lstrlenW (lpString="index.html") returned 10
	[0169.121] lstrlenW (lpString=".money") returned 6
	[0169.121] lstrcmpiW (lpString1=".money", lpString2="x.html") returned -1
	[0169.121] lstrlenW (lpString="index.html") returned 10
	[0169.121] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1
	[0169.121] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1
	[0169.121] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1
	[0169.121] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1
	[0169.121] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1
	[0169.121] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1
	[0169.121] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1
	[0169.121] lstrcmpiW (lpString1="d2.exe", lpString2="index.html") returned -1
	[0169.121] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html") returned 111
	[0169.121] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0169.121] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0169.121] lstrlenW (lpString=".1cd") returned 4
	[0169.121] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0169.121] lstrlenW (lpString=".3ds") returned 4
	[0169.121] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0169.121] lstrlenW (lpString=".3fr") returned 4
	[0169.121] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0169.121] lstrlenW (lpString=".3g2") returned 4
	[0169.122] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0169.122] lstrlenW (lpString=".3gp") returned 4
	[0169.122] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0169.122] lstrlenW (lpString=".7z") returned 3
	[0169.122] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0169.122] lstrlenW (lpString=".accda") returned 6
	[0169.122] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1
	[0169.122] lstrlenW (lpString=".accdb") returned 6
	[0169.122] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1
	[0169.122] lstrlenW (lpString=".accdc") returned 6
	[0169.122] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1
	[0169.122] lstrlenW (lpString=".accde") returned 6
	[0169.122] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1
	[0169.122] lstrlenW (lpString=".accdt") returned 6
	[0169.122] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1
	[0169.122] lstrlenW (lpString=".accdw") returned 6
	[0169.122] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1
	[0169.122] lstrlenW (lpString=".adb") returned 4
	[0169.122] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0169.122] lstrlenW (lpString=".adp") returned 4
	[0169.122] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0169.122] lstrlenW (lpString=".ai") returned 3
	[0169.122] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0169.122] lstrlenW (lpString=".ai3") returned 4
	[0169.122] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0169.122] lstrlenW (lpString=".ai4") returned 4
	[0169.122] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0169.122] lstrlenW (lpString=".ai5") returned 4
	[0169.123] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0169.123] lstrlenW (lpString=".ai6") returned 4
	[0169.123] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0169.123] lstrlenW (lpString=".ai7") returned 4
	[0169.123] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0169.123] lstrlenW (lpString=".ai8") returned 4
	[0169.123] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0169.123] lstrlenW (lpString=".anim") returned 5
	[0169.123] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0169.123] lstrlenW (lpString=".arw") returned 4
	[0169.123] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0169.123] lstrlenW (lpString=".as") returned 3
	[0169.123] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0169.123] lstrlenW (lpString=".asa") returned 4
	[0169.123] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0169.123] lstrlenW (lpString=".asc") returned 4
	[0169.123] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0169.123] lstrlenW (lpString=".ascx") returned 5
	[0169.123] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0169.123] lstrlenW (lpString=".asm") returned 4
	[0169.123] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0169.123] lstrlenW (lpString=".asmx") returned 5
	[0169.123] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0169.123] lstrlenW (lpString=".asp") returned 4
	[0169.123] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0169.123] lstrlenW (lpString=".aspx") returned 5
	[0169.123] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0169.123] lstrlenW (lpString=".asr") returned 4
	[0169.124] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0169.124] lstrlenW (lpString=".asx") returned 4
	[0169.124] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0169.124] lstrlenW (lpString=".avi") returned 4
	[0169.124] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0169.124] lstrlenW (lpString=".avs") returned 4
	[0169.124] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0169.124] lstrlenW (lpString=".backup") returned 7
	[0169.124] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1
	[0169.124] lstrlenW (lpString=".bak") returned 4
	[0169.124] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0169.124] lstrlenW (lpString=".bay") returned 4
	[0169.124] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0169.124] lstrlenW (lpString=".bd") returned 3
	[0169.124] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0169.124] lstrlenW (lpString=".bin") returned 4
	[0169.124] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0169.124] lstrlenW (lpString=".bmp") returned 4
	[0169.124] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0169.124] lstrlenW (lpString=".bz2") returned 4
	[0169.124] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0169.124] lstrlenW (lpString=".c") returned 2
	[0169.124] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0169.124] lstrlenW (lpString=".cdr") returned 4
	[0169.124] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0169.124] lstrlenW (lpString=".cer") returned 4
	[0169.124] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0169.125] lstrlenW (lpString=".cf") returned 3
	[0169.125] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0169.125] lstrlenW (lpString=".cfc") returned 4
	[0169.125] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0169.125] lstrlenW (lpString=".cfm") returned 4
	[0169.125] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0169.125] lstrlenW (lpString=".cfml") returned 5
	[0169.125] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0169.125] lstrlenW (lpString=".cfu") returned 4
	[0169.125] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0169.125] lstrlenW (lpString=".chm") returned 4
	[0169.125] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0169.125] lstrlenW (lpString=".cin") returned 4
	[0169.125] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0169.125] lstrlenW (lpString=".class") returned 6
	[0169.125] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1
	[0169.125] lstrlenW (lpString=".clx") returned 4
	[0169.125] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0169.125] lstrlenW (lpString=".config") returned 7
	[0169.125] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1
	[0169.125] lstrlenW (lpString=".cpp") returned 4
	[0169.125] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0169.125] lstrlenW (lpString=".cr2") returned 4
	[0169.125] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0169.125] lstrlenW (lpString=".crt") returned 4
	[0169.125] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0169.125] lstrlenW (lpString=".crw") returned 4
	[0169.125] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0169.125] lstrlenW (lpString=".cs") returned 3
	[0169.126] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0169.126] lstrlenW (lpString=".css") returned 4
	[0169.126] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".csv") returned 4
	[0169.126] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".cub") returned 4
	[0169.126] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".dae") returned 4
	[0169.126] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".dat") returned 4
	[0169.126] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".db") returned 3
	[0169.126] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0169.126] lstrlenW (lpString=".dbf") returned 4
	[0169.126] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".dbx") returned 4
	[0169.126] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".dc3") returned 4
	[0169.126] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".dcm") returned 4
	[0169.126] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".dcr") returned 4
	[0169.126] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".der") returned 4
	[0169.126] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".dib") returned 4
	[0169.126] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0169.126] lstrlenW (lpString=".dic") returned 4
	[0169.126] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0169.127] lstrlenW (lpString=".dif") returned 4
	[0169.127] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0169.127] lstrlenW (lpString=".divx") returned 5
	[0169.127] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0169.127] lstrlenW (lpString=".djvu") returned 5
	[0169.127] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0169.127] lstrlenW (lpString=".dng") returned 4
	[0169.127] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0169.127] lstrlenW (lpString=".doc") returned 4
	[0169.127] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0169.127] lstrlenW (lpString=".docm") returned 5
	[0169.127] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0169.127] lstrlenW (lpString=".docx") returned 5
	[0169.127] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0169.127] lstrlenW (lpString=".dot") returned 4
	[0169.127] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0169.127] lstrlenW (lpString=".dotm") returned 5
	[0169.127] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0169.127] lstrlenW (lpString=".dotx") returned 5
	[0169.127] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0169.127] lstrlenW (lpString=".dpx") returned 4
	[0169.127] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0169.127] lstrlenW (lpString=".dqy") returned 4
	[0169.127] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0169.127] lstrlenW (lpString=".dsn") returned 4
	[0169.127] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0169.127] lstrlenW (lpString=".dt") returned 3
	[0169.128] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0169.128] lstrlenW (lpString=".dtd") returned 4
	[0169.128] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0169.128] lstrlenW (lpString=".dwg") returned 4
	[0169.128] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0169.128] lstrlenW (lpString=".dwt") returned 4
	[0169.128] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0169.128] lstrlenW (lpString=".dx") returned 3
	[0169.128] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0169.128] lstrlenW (lpString=".dxf") returned 4
	[0169.128] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0169.128] lstrlenW (lpString=".edml") returned 5
	[0169.128] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0169.128] lstrlenW (lpString=".efd") returned 4
	[0169.128] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0169.128] lstrlenW (lpString=".elf") returned 4
	[0169.128] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0169.128] lstrlenW (lpString=".emf") returned 4
	[0169.128] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0169.128] lstrlenW (lpString=".emz") returned 4
	[0169.128] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0169.128] lstrlenW (lpString=".epf") returned 4
	[0169.128] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0169.128] lstrlenW (lpString=".eps") returned 4
	[0169.128] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0169.128] lstrlenW (lpString=".epsf") returned 5
	[0169.128] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0169.128] lstrlenW (lpString=".epsp") returned 5
	[0169.129] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0169.129] lstrlenW (lpString=".erf") returned 4
	[0169.129] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0169.129] lstrlenW (lpString=".exr") returned 4
	[0169.129] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0169.129] lstrlenW (lpString=".f4v") returned 4
	[0169.129] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0169.129] lstrlenW (lpString=".fido") returned 5
	[0169.129] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0169.129] lstrlenW (lpString=".flm") returned 4
	[0169.129] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0169.129] lstrlenW (lpString=".flv") returned 4
	[0169.129] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0169.129] lstrlenW (lpString=".frm") returned 4
	[0169.129] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0169.129] lstrlenW (lpString=".fxg") returned 4
	[0169.129] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0169.129] lstrlenW (lpString=".geo") returned 4
	[0169.129] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0169.129] lstrlenW (lpString=".gif") returned 4
	[0169.129] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0169.129] lstrlenW (lpString=".grs") returned 4
	[0169.129] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0169.129] lstrlenW (lpString=".gz") returned 3
	[0169.129] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0169.129] lstrlenW (lpString=".h") returned 2
	[0169.129] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0169.129] lstrlenW (lpString=".hdr") returned 4
	[0169.129] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0169.129] lstrlenW (lpString=".hpp") returned 4
	[0169.130] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0169.130] lstrlenW (lpString=".hta") returned 4
	[0169.130] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0169.130] lstrlenW (lpString=".htc") returned 4
	[0169.130] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0169.130] lstrlenW (lpString=".htm") returned 4
	[0169.130] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0169.130] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24
	[0169.130] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0169.130] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0169.130] FindClose (in: hFindFile=0x3e701b0 | out: hFindFile=0x3e701b0) returned 1
	[0169.131] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.131] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0169.132] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x451cfe8
	[0169.132] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL") returned 100
	[0169.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\*", lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e706b0
	[0169.614] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.615] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xac78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.615] lstrlenW (lpString="index.html") returned 10
	[0169.615] lstrlenW (lpString=".1cd") returned 4
	[0169.615] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0169.615] lstrlenW (lpString=".3ds") returned 4
	[0169.615] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0169.615] lstrlenW (lpString=".3fr") returned 4
	[0169.615] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0169.615] lstrlenW (lpString=".3g2") returned 4
	[0169.615] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0169.615] lstrlenW (lpString=".3gp") returned 4
	[0169.615] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0169.615] lstrlenW (lpString=".7z") returned 3
	[0169.615] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0169.615] lstrlenW (lpString=".accda") returned 6
	[0169.615] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1
	[0169.615] lstrlenW (lpString=".accdb") returned 6
	[0169.615] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1
	[0169.615] lstrlenW (lpString=".accdc") returned 6
	[0169.615] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1
	[0169.615] lstrlenW (lpString=".accde") returned 6
	[0169.615] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1
	[0169.615] lstrlenW (lpString=".accdt") returned 6
	[0169.616] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1
	[0169.616] lstrlenW (lpString=".accdw") returned 6
	[0169.616] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1
	[0169.616] lstrlenW (lpString=".adb") returned 4
	[0169.616] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0169.616] lstrlenW (lpString=".adp") returned 4
	[0169.616] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0169.616] lstrlenW (lpString=".ai") returned 3
	[0169.616] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0169.616] lstrlenW (lpString=".ai3") returned 4
	[0169.616] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0169.616] lstrlenW (lpString=".ai4") returned 4
	[0169.616] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0169.616] lstrlenW (lpString=".ai5") returned 4
	[0169.616] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0169.616] lstrlenW (lpString=".ai6") returned 4
	[0169.616] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0169.616] lstrlenW (lpString=".ai7") returned 4
	[0169.616] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0169.616] lstrlenW (lpString=".ai8") returned 4
	[0169.616] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0169.616] lstrlenW (lpString=".anim") returned 5
	[0169.616] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0169.616] lstrlenW (lpString=".arw") returned 4
	[0169.616] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0169.616] lstrlenW (lpString=".as") returned 3
	[0169.616] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0169.617] lstrlenW (lpString=".asa") returned 4
	[0169.617] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0169.617] lstrlenW (lpString=".asc") returned 4
	[0169.617] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0169.617] lstrlenW (lpString=".ascx") returned 5
	[0169.617] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0169.617] lstrlenW (lpString=".asm") returned 4
	[0169.617] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0169.617] lstrlenW (lpString=".asmx") returned 5
	[0169.617] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0169.617] lstrlenW (lpString=".asp") returned 4
	[0169.617] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0169.617] lstrlenW (lpString=".aspx") returned 5
	[0169.617] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0169.617] lstrlenW (lpString=".asr") returned 4
	[0169.617] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0169.617] lstrlenW (lpString=".asx") returned 4
	[0169.617] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0169.617] lstrlenW (lpString=".avi") returned 4
	[0169.617] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0169.617] lstrlenW (lpString=".avs") returned 4
	[0169.617] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0169.617] lstrlenW (lpString=".backup") returned 7
	[0169.617] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1
	[0169.617] lstrlenW (lpString=".bak") returned 4
	[0169.617] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0169.617] lstrlenW (lpString=".bay") returned 4
	[0169.617] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0169.617] lstrlenW (lpString=".bd") returned 3
	[0169.618] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0169.618] lstrlenW (lpString=".bin") returned 4
	[0169.618] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0169.618] lstrlenW (lpString=".bmp") returned 4
	[0169.618] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0169.618] lstrlenW (lpString=".bz2") returned 4
	[0169.618] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0169.618] lstrlenW (lpString=".c") returned 2
	[0169.618] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0169.618] lstrlenW (lpString=".cdr") returned 4
	[0169.618] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0169.618] lstrlenW (lpString=".cer") returned 4
	[0169.618] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0169.618] lstrlenW (lpString=".cf") returned 3
	[0169.618] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0169.618] lstrlenW (lpString=".cfc") returned 4
	[0169.618] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0169.618] lstrlenW (lpString=".cfm") returned 4
	[0169.618] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0169.618] lstrlenW (lpString=".cfml") returned 5
	[0169.618] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0169.618] lstrlenW (lpString=".cfu") returned 4
	[0169.618] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0169.618] lstrlenW (lpString=".chm") returned 4
	[0169.618] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0169.618] lstrlenW (lpString=".cin") returned 4
	[0169.618] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0169.618] lstrlenW (lpString=".class") returned 6
	[0169.618] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1
	[0169.619] lstrlenW (lpString=".clx") returned 4
	[0169.619] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0169.619] lstrlenW (lpString=".config") returned 7
	[0169.619] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1
	[0169.619] lstrlenW (lpString=".cpp") returned 4
	[0169.619] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0169.619] lstrlenW (lpString=".cr2") returned 4
	[0169.619] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0169.619] lstrlenW (lpString=".crt") returned 4
	[0169.619] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0169.619] lstrlenW (lpString=".crw") returned 4
	[0169.619] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0169.619] lstrlenW (lpString=".cs") returned 3
	[0169.619] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0169.619] lstrlenW (lpString=".css") returned 4
	[0169.619] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0169.619] lstrlenW (lpString=".csv") returned 4
	[0169.619] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0169.619] lstrlenW (lpString=".cub") returned 4
	[0169.619] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0169.619] lstrlenW (lpString=".dae") returned 4
	[0169.619] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0169.619] lstrlenW (lpString=".dat") returned 4
	[0169.619] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0169.619] lstrlenW (lpString=".db") returned 3
	[0169.619] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0169.619] lstrlenW (lpString=".dbf") returned 4
	[0169.619] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0169.620] lstrlenW (lpString=".dbx") returned 4
	[0169.620] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0169.620] lstrlenW (lpString=".dc3") returned 4
	[0169.620] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0169.620] lstrlenW (lpString=".dcm") returned 4
	[0169.620] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0169.620] lstrlenW (lpString=".dcr") returned 4
	[0169.620] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0169.620] lstrlenW (lpString=".der") returned 4
	[0169.620] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0169.620] lstrlenW (lpString=".dib") returned 4
	[0169.620] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0169.620] lstrlenW (lpString=".dic") returned 4
	[0169.620] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0169.620] lstrlenW (lpString=".dif") returned 4
	[0169.620] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0169.620] lstrlenW (lpString=".divx") returned 5
	[0169.620] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0169.620] lstrlenW (lpString=".djvu") returned 5
	[0169.620] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0169.620] lstrlenW (lpString=".dng") returned 4
	[0169.620] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0169.620] lstrlenW (lpString=".doc") returned 4
	[0169.620] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0169.620] lstrlenW (lpString=".docm") returned 5
	[0169.620] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0169.620] lstrlenW (lpString=".docx") returned 5
	[0169.620] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0169.621] lstrlenW (lpString=".dot") returned 4
	[0169.621] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0169.621] lstrlenW (lpString=".dotm") returned 5
	[0169.621] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0169.621] lstrlenW (lpString=".dotx") returned 5
	[0169.621] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0169.621] lstrlenW (lpString=".dpx") returned 4
	[0169.621] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0169.621] lstrlenW (lpString=".dqy") returned 4
	[0169.621] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0169.621] lstrlenW (lpString=".dsn") returned 4
	[0169.621] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0169.621] lstrlenW (lpString=".dt") returned 3
	[0169.621] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0169.621] lstrlenW (lpString=".dtd") returned 4
	[0169.621] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0169.621] lstrlenW (lpString=".dwg") returned 4
	[0169.621] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0169.621] lstrlenW (lpString=".dwt") returned 4
	[0169.621] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0169.621] lstrlenW (lpString=".dx") returned 3
	[0169.621] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0169.621] lstrlenW (lpString=".dxf") returned 4
	[0169.621] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0169.621] lstrlenW (lpString=".edml") returned 5
	[0169.621] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0169.621] lstrlenW (lpString=".efd") returned 4
	[0169.621] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0169.621] lstrlenW (lpString=".elf") returned 4
	[0169.622] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0169.622] lstrlenW (lpString=".emf") returned 4
	[0169.622] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0169.622] lstrlenW (lpString=".emz") returned 4
	[0169.622] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0169.622] lstrlenW (lpString=".epf") returned 4
	[0169.622] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0169.622] lstrlenW (lpString=".eps") returned 4
	[0169.622] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0169.622] lstrlenW (lpString=".epsf") returned 5
	[0169.622] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0169.622] lstrlenW (lpString=".epsp") returned 5
	[0169.622] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0169.622] lstrlenW (lpString=".erf") returned 4
	[0169.622] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0169.622] lstrlenW (lpString=".exr") returned 4
	[0169.622] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0169.622] lstrlenW (lpString=".f4v") returned 4
	[0169.622] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0169.622] lstrlenW (lpString=".fido") returned 5
	[0169.622] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0169.622] lstrlenW (lpString=".flm") returned 4
	[0169.622] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0169.622] lstrlenW (lpString=".flv") returned 4
	[0169.622] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0169.622] lstrlenW (lpString=".frm") returned 4
	[0169.622] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0169.622] lstrlenW (lpString=".fxg") returned 4
	[0169.622] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0169.623] lstrlenW (lpString=".geo") returned 4
	[0169.623] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0169.623] lstrlenW (lpString=".gif") returned 4
	[0169.623] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0169.623] lstrlenW (lpString=".grs") returned 4
	[0169.623] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0169.623] lstrlenW (lpString=".gz") returned 3
	[0169.623] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0169.623] lstrlenW (lpString=".h") returned 2
	[0169.623] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0169.623] lstrlenW (lpString=".hdr") returned 4
	[0169.623] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0169.623] lstrlenW (lpString=".hpp") returned 4
	[0169.623] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0169.623] lstrlenW (lpString=".hta") returned 4
	[0169.623] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0169.623] lstrlenW (lpString=".htc") returned 4
	[0169.623] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0169.624] lstrlenW (lpString=".htm") returned 4
	[0169.624] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0169.624] lstrlenW (lpString=".html") returned 5
	[0169.624] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0169.624] lstrlenW (lpString="index.html") returned 10
	[0169.624] lstrlenW (lpString=".money") returned 6
	[0169.624] lstrcmpiW (lpString1=".money", lpString2="x.html") returned -1
	[0169.624] lstrlenW (lpString="index.html") returned 10
	[0169.624] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1
	[0169.624] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1
	[0169.624] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1
	[0169.624] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1
	[0169.624] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1
	[0169.624] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1
	[0169.624] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1
	[0169.624] lstrcmpiW (lpString1="d2.exe", lpString2="index.html") returned -1
	[0169.624] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html") returned 111
	[0169.624] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0169.624] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0169.624] lstrlenW (lpString=".1cd") returned 4
	[0169.624] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0169.624] lstrlenW (lpString=".3ds") returned 4
	[0169.624] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0169.624] lstrlenW (lpString=".3fr") returned 4
	[0169.624] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0169.624] lstrlenW (lpString=".3g2") returned 4
	[0169.625] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0169.625] lstrlenW (lpString=".3gp") returned 4
	[0169.625] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0169.625] lstrlenW (lpString=".7z") returned 3
	[0169.625] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0169.625] lstrlenW (lpString=".accda") returned 6
	[0169.625] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1
	[0169.625] lstrlenW (lpString=".accdb") returned 6
	[0169.625] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1
	[0169.625] lstrlenW (lpString=".accdc") returned 6
	[0169.625] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1
	[0169.625] lstrlenW (lpString=".accde") returned 6
	[0169.625] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1
	[0169.625] lstrlenW (lpString=".accdt") returned 6
	[0169.625] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1
	[0169.625] lstrlenW (lpString=".accdw") returned 6
	[0169.625] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1
	[0169.625] lstrlenW (lpString=".adb") returned 4
	[0169.625] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0169.625] lstrlenW (lpString=".adp") returned 4
	[0169.625] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0169.625] lstrlenW (lpString=".ai") returned 3
	[0169.625] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0169.625] lstrlenW (lpString=".ai3") returned 4
	[0169.625] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0169.625] lstrlenW (lpString=".ai4") returned 4
	[0169.625] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0169.626] lstrlenW (lpString=".ai5") returned 4
	[0169.626] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0169.626] lstrlenW (lpString=".ai6") returned 4
	[0169.626] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0169.626] lstrlenW (lpString=".ai7") returned 4
	[0169.626] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0169.626] lstrlenW (lpString=".ai8") returned 4
	[0169.626] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0169.626] lstrlenW (lpString=".anim") returned 5
	[0169.626] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0169.626] lstrlenW (lpString=".arw") returned 4
	[0169.626] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0169.626] lstrlenW (lpString=".as") returned 3
	[0169.626] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0169.626] lstrlenW (lpString=".asa") returned 4
	[0169.626] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0169.626] lstrlenW (lpString=".asc") returned 4
	[0169.626] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0169.626] lstrlenW (lpString=".ascx") returned 5
	[0169.626] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0169.626] lstrlenW (lpString=".asm") returned 4
	[0169.626] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0169.626] lstrlenW (lpString=".asmx") returned 5
	[0169.626] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0169.626] lstrlenW (lpString=".asp") returned 4
	[0169.626] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0169.626] lstrlenW (lpString=".aspx") returned 5
	[0169.626] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0169.626] lstrlenW (lpString=".asr") returned 4
	[0169.627] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0169.627] lstrlenW (lpString=".asx") returned 4
	[0169.627] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0169.627] lstrlenW (lpString=".avi") returned 4
	[0169.627] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0169.627] lstrlenW (lpString=".avs") returned 4
	[0169.627] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0169.627] lstrlenW (lpString=".backup") returned 7
	[0169.627] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1
	[0169.627] lstrlenW (lpString=".bak") returned 4
	[0169.627] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0169.627] lstrlenW (lpString=".bay") returned 4
	[0169.627] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0169.627] lstrlenW (lpString=".bd") returned 3
	[0169.627] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0169.627] lstrlenW (lpString=".bin") returned 4
	[0169.627] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0169.627] lstrlenW (lpString=".bmp") returned 4
	[0169.627] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0169.627] lstrlenW (lpString=".bz2") returned 4
	[0169.627] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0169.627] lstrlenW (lpString=".c") returned 2
	[0169.627] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0169.627] lstrlenW (lpString=".cdr") returned 4
	[0169.627] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0169.627] lstrlenW (lpString=".cer") returned 4
	[0169.627] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0169.627] lstrlenW (lpString=".cf") returned 3
	[0169.627] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0169.627] lstrlenW (lpString=".cfc") returned 4
	[0169.628] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0169.628] lstrlenW (lpString=".cfm") returned 4
	[0169.628] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0169.628] lstrlenW (lpString=".cfml") returned 5
	[0169.628] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0169.628] lstrlenW (lpString=".cfu") returned 4
	[0169.628] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0169.628] lstrlenW (lpString=".chm") returned 4
	[0169.628] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0169.628] lstrlenW (lpString=".cin") returned 4
	[0169.628] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0169.628] lstrlenW (lpString=".class") returned 6
	[0169.628] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1
	[0169.628] lstrlenW (lpString=".clx") returned 4
	[0169.628] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0169.628] lstrlenW (lpString=".config") returned 7
	[0169.628] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1
	[0169.628] lstrlenW (lpString=".cpp") returned 4
	[0169.628] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0169.628] lstrlenW (lpString=".cr2") returned 4
	[0169.628] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0169.628] lstrlenW (lpString=".crt") returned 4
	[0169.628] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0169.628] lstrlenW (lpString=".crw") returned 4
	[0169.628] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0169.628] lstrlenW (lpString=".cs") returned 3
	[0169.628] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0169.629] lstrlenW (lpString=".css") returned 4
	[0169.629] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".csv") returned 4
	[0169.629] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".cub") returned 4
	[0169.629] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".dae") returned 4
	[0169.629] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".dat") returned 4
	[0169.629] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".db") returned 3
	[0169.629] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0169.629] lstrlenW (lpString=".dbf") returned 4
	[0169.629] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".dbx") returned 4
	[0169.629] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".dc3") returned 4
	[0169.629] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".dcm") returned 4
	[0169.629] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".dcr") returned 4
	[0169.629] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".der") returned 4
	[0169.629] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".dib") returned 4
	[0169.629] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".dic") returned 4
	[0169.629] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0169.629] lstrlenW (lpString=".dif") returned 4
	[0169.630] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0169.630] lstrlenW (lpString=".divx") returned 5
	[0169.630] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0169.630] lstrlenW (lpString=".djvu") returned 5
	[0169.630] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0169.630] lstrlenW (lpString=".dng") returned 4
	[0169.630] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0169.630] lstrlenW (lpString=".doc") returned 4
	[0169.630] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0169.630] lstrlenW (lpString=".docm") returned 5
	[0169.630] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0169.630] lstrlenW (lpString=".docx") returned 5
	[0169.630] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0169.630] lstrlenW (lpString=".dot") returned 4
	[0169.630] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0169.630] lstrlenW (lpString=".dotm") returned 5
	[0169.630] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0169.630] lstrlenW (lpString=".dotx") returned 5
	[0169.630] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0169.630] lstrlenW (lpString=".dpx") returned 4
	[0169.630] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0169.630] lstrlenW (lpString=".dqy") returned 4
	[0169.630] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0169.630] lstrlenW (lpString=".dsn") returned 4
	[0169.630] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0169.630] lstrlenW (lpString=".dt") returned 3
	[0169.630] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0169.631] lstrlenW (lpString=".dtd") returned 4
	[0169.631] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0169.631] lstrlenW (lpString=".dwg") returned 4
	[0169.631] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0169.631] lstrlenW (lpString=".dwt") returned 4
	[0169.631] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0169.631] lstrlenW (lpString=".dx") returned 3
	[0169.631] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0169.631] lstrlenW (lpString=".dxf") returned 4
	[0169.631] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0169.631] lstrlenW (lpString=".edml") returned 5
	[0169.631] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0169.631] lstrlenW (lpString=".efd") returned 4
	[0169.631] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0169.631] lstrlenW (lpString=".elf") returned 4
	[0169.631] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0169.631] lstrlenW (lpString=".emf") returned 4
	[0169.631] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0169.631] lstrlenW (lpString=".emz") returned 4
	[0169.631] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0169.631] lstrlenW (lpString=".epf") returned 4
	[0169.631] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0169.631] lstrlenW (lpString=".eps") returned 4
	[0169.631] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0169.631] lstrlenW (lpString=".epsf") returned 5
	[0169.631] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0169.631] lstrlenW (lpString=".epsp") returned 5
	[0169.631] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0169.631] lstrlenW (lpString=".erf") returned 4
	[0169.632] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0169.632] lstrlenW (lpString=".exr") returned 4
	[0169.632] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0169.632] lstrlenW (lpString=".f4v") returned 4
	[0169.632] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0169.632] lstrlenW (lpString=".fido") returned 5
	[0169.632] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0169.632] lstrlenW (lpString=".flm") returned 4
	[0169.632] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0169.632] lstrlenW (lpString=".flv") returned 4
	[0169.632] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0169.632] lstrlenW (lpString=".frm") returned 4
	[0169.632] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0169.632] lstrlenW (lpString=".fxg") returned 4
	[0169.632] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0169.632] lstrlenW (lpString=".geo") returned 4
	[0169.632] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0169.632] lstrlenW (lpString=".gif") returned 4
	[0169.632] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0169.632] lstrlenW (lpString=".grs") returned 4
	[0169.632] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0169.632] lstrlenW (lpString=".gz") returned 3
	[0169.632] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0169.632] lstrlenW (lpString=".h") returned 2
	[0169.632] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0169.632] lstrlenW (lpString=".hdr") returned 4
	[0169.632] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0169.632] lstrlenW (lpString=".hpp") returned 4
	[0169.632] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0169.633] lstrlenW (lpString=".hta") returned 4
	[0169.633] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0169.633] lstrlenW (lpString=".htc") returned 4
	[0169.633] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0169.633] lstrlenW (lpString=".htm") returned 4
	[0169.633] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0169.633] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24
	[0169.633] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0169.633] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0169.633] FindClose (in: hFindFile=0x3e706b0 | out: hFindFile=0x3e706b0) returned 1
	[0169.634] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.634] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0169.634] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x451cfe8
	[0169.634] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR") returned 100
	[0169.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\*", lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e700b0
	[0169.637] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.637] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x98b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.637] lstrlenW (lpString="index.html") returned 10
	[0169.637] lstrlenW (lpString=".1cd") returned 4
	[0169.637] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0169.637] lstrlenW (lpString=".3ds") returned 4
	[0169.637] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0169.637] lstrlenW (lpString=".3fr") returned 4
	[0169.637] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0169.637] lstrlenW (lpString=".3g2") returned 4
	[0169.637] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0169.637] lstrlenW (lpString=".3gp") returned 4
	[0169.637] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0169.637] lstrlenW (lpString=".7z") returned 3
	[0169.637] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0169.637] lstrlenW (lpString=".accda") returned 6
	[0169.637] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1
	[0169.637] lstrlenW (lpString=".accdb") returned 6
	[0169.637] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1
	[0169.637] lstrlenW (lpString=".accdc") returned 6
	[0169.637] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1
	[0169.637] lstrlenW (lpString=".accde") returned 6
	[0169.637] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1
	[0169.637] lstrlenW (lpString=".accdt") returned 6
	[0169.638] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1
	[0169.638] lstrlenW (lpString=".accdw") returned 6
	[0169.638] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1
	[0169.638] lstrlenW (lpString=".adb") returned 4
	[0169.638] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0169.638] lstrlenW (lpString=".adp") returned 4
	[0169.638] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0169.638] lstrlenW (lpString=".ai") returned 3
	[0169.638] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0169.638] lstrlenW (lpString=".ai3") returned 4
	[0169.638] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0169.638] lstrlenW (lpString=".ai4") returned 4
	[0169.638] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0169.638] lstrlenW (lpString=".ai5") returned 4
	[0169.638] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0169.638] lstrlenW (lpString=".ai6") returned 4
	[0169.638] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0169.638] lstrlenW (lpString=".ai7") returned 4
	[0169.638] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0169.638] lstrlenW (lpString=".ai8") returned 4
	[0169.638] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0169.638] lstrlenW (lpString=".anim") returned 5
	[0169.638] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0169.638] lstrlenW (lpString=".arw") returned 4
	[0169.638] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0169.638] lstrlenW (lpString=".as") returned 3
	[0169.638] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0169.638] lstrlenW (lpString=".asa") returned 4
	[0169.638] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0169.638] lstrlenW (lpString=".asc") returned 4
	[0169.638] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0169.638] lstrlenW (lpString=".ascx") returned 5
	[0169.638] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0169.639] lstrlenW (lpString=".asm") returned 4
	[0169.639] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0169.639] lstrlenW (lpString=".asmx") returned 5
	[0169.639] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0169.639] lstrlenW (lpString=".asp") returned 4
	[0169.639] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0169.639] lstrlenW (lpString=".aspx") returned 5
	[0169.639] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0169.639] lstrlenW (lpString=".asr") returned 4
	[0169.639] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0169.639] lstrlenW (lpString=".asx") returned 4
	[0169.639] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0169.639] lstrlenW (lpString=".avi") returned 4
	[0169.639] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0169.639] lstrlenW (lpString=".avs") returned 4
	[0169.639] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0169.639] lstrlenW (lpString=".backup") returned 7
	[0169.639] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1
	[0169.639] lstrlenW (lpString=".bak") returned 4
	[0169.639] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0169.639] lstrlenW (lpString=".bay") returned 4
	[0169.639] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0169.639] lstrlenW (lpString=".bd") returned 3
	[0169.639] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0169.639] lstrlenW (lpString=".bin") returned 4
	[0169.639] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0169.639] lstrlenW (lpString=".bmp") returned 4
	[0169.639] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0169.639] lstrlenW (lpString=".bz2") returned 4
	[0169.639] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0169.639] lstrlenW (lpString=".c") returned 2
	[0169.639] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0169.640] lstrlenW (lpString=".cdr") returned 4
	[0169.640] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0169.640] lstrlenW (lpString=".cer") returned 4
	[0169.640] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0169.640] lstrlenW (lpString=".cf") returned 3
	[0169.640] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0169.640] lstrlenW (lpString=".cfc") returned 4
	[0169.640] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0169.640] lstrlenW (lpString=".cfm") returned 4
	[0169.640] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0169.640] lstrlenW (lpString=".cfml") returned 5
	[0169.640] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0169.640] lstrlenW (lpString=".cfu") returned 4
	[0169.641] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0169.641] lstrlenW (lpString=".chm") returned 4
	[0169.641] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0169.641] lstrlenW (lpString=".cin") returned 4
	[0169.641] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0169.641] lstrlenW (lpString=".class") returned 6
	[0169.641] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1
	[0169.641] lstrlenW (lpString=".clx") returned 4
	[0169.641] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0169.641] lstrlenW (lpString=".config") returned 7
	[0169.641] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1
	[0169.641] lstrlenW (lpString=".cpp") returned 4
	[0169.641] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0169.641] lstrlenW (lpString=".cr2") returned 4
	[0169.641] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0169.641] lstrlenW (lpString=".crt") returned 4
	[0169.641] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0169.641] lstrlenW (lpString=".crw") returned 4
	[0169.641] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0169.641] lstrlenW (lpString=".cs") returned 3
	[0169.641] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0169.641] lstrlenW (lpString=".css") returned 4
	[0169.641] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0169.641] lstrlenW (lpString=".csv") returned 4
	[0169.641] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0169.641] lstrlenW (lpString=".cub") returned 4
	[0169.641] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0169.641] lstrlenW (lpString=".dae") returned 4
	[0169.641] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".dat") returned 4
	[0169.642] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".db") returned 3
	[0169.642] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0169.642] lstrlenW (lpString=".dbf") returned 4
	[0169.642] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".dbx") returned 4
	[0169.642] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".dc3") returned 4
	[0169.642] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".dcm") returned 4
	[0169.642] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".dcr") returned 4
	[0169.642] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".der") returned 4
	[0169.642] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".dib") returned 4
	[0169.642] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".dic") returned 4
	[0169.642] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".dif") returned 4
	[0169.642] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".divx") returned 5
	[0169.642] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0169.642] lstrlenW (lpString=".djvu") returned 5
	[0169.642] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0169.642] lstrlenW (lpString=".dng") returned 4
	[0169.642] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0169.642] lstrlenW (lpString=".doc") returned 4
	[0169.643] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0169.643] lstrlenW (lpString=".docm") returned 5
	[0169.643] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0169.643] lstrlenW (lpString=".docx") returned 5
	[0169.643] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0169.643] lstrlenW (lpString=".dot") returned 4
	[0169.643] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0169.643] lstrlenW (lpString=".dotm") returned 5
	[0169.643] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0169.643] lstrlenW (lpString=".dotx") returned 5
	[0169.643] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0169.643] lstrlenW (lpString=".dpx") returned 4
	[0169.643] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0169.643] lstrlenW (lpString=".dqy") returned 4
	[0169.643] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0169.643] lstrlenW (lpString=".dsn") returned 4
	[0169.643] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0169.643] lstrlenW (lpString=".dt") returned 3
	[0169.643] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0169.643] lstrlenW (lpString=".dtd") returned 4
	[0169.643] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0169.643] lstrlenW (lpString=".dwg") returned 4
	[0169.643] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0169.643] lstrlenW (lpString=".dwt") returned 4
	[0169.643] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0169.644] lstrlenW (lpString=".dx") returned 3
	[0169.644] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0169.644] lstrlenW (lpString=".dxf") returned 4
	[0169.644] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0169.644] lstrlenW (lpString=".edml") returned 5
	[0169.644] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0169.644] lstrlenW (lpString=".efd") returned 4
	[0169.644] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0169.644] lstrlenW (lpString=".elf") returned 4
	[0169.644] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0169.644] lstrlenW (lpString=".emf") returned 4
	[0169.644] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0169.644] lstrlenW (lpString=".emz") returned 4
	[0169.644] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0169.644] lstrlenW (lpString=".epf") returned 4
	[0169.644] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0169.644] lstrlenW (lpString=".eps") returned 4
	[0169.644] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0169.644] lstrlenW (lpString=".epsf") returned 5
	[0169.644] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0169.644] lstrlenW (lpString=".epsp") returned 5
	[0169.644] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0169.644] lstrlenW (lpString=".erf") returned 4
	[0169.644] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0169.644] lstrlenW (lpString=".exr") returned 4
	[0169.644] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0169.644] lstrlenW (lpString=".f4v") returned 4
	[0169.644] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0169.644] lstrlenW (lpString=".fido") returned 5
	[0169.645] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0169.645] lstrlenW (lpString=".flm") returned 4
	[0169.645] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0169.645] lstrlenW (lpString=".flv") returned 4
	[0169.645] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0169.645] lstrlenW (lpString=".frm") returned 4
	[0169.645] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0169.645] lstrlenW (lpString=".fxg") returned 4
	[0169.645] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0169.645] lstrlenW (lpString=".geo") returned 4
	[0169.645] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0169.645] lstrlenW (lpString=".gif") returned 4
	[0169.645] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0169.645] lstrlenW (lpString=".grs") returned 4
	[0169.645] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0169.645] lstrlenW (lpString=".gz") returned 3
	[0169.645] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0169.645] lstrlenW (lpString=".h") returned 2
	[0169.645] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0169.645] lstrlenW (lpString=".hdr") returned 4
	[0169.645] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0169.645] lstrlenW (lpString=".hpp") returned 4
	[0169.645] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0169.645] lstrlenW (lpString=".hta") returned 4
	[0169.645] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0169.645] lstrlenW (lpString=".htc") returned 4
	[0169.645] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0169.646] lstrlenW (lpString=".htm") returned 4
	[0169.646] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0169.646] lstrlenW (lpString=".html") returned 5
	[0169.646] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0169.646] lstrlenW (lpString="index.html") returned 10
	[0169.646] lstrlenW (lpString=".money") returned 6
	[0169.646] lstrcmpiW (lpString1=".money", lpString2="x.html") returned -1
	[0169.646] lstrlenW (lpString="index.html") returned 10
	[0169.646] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1
	[0169.646] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1
	[0169.646] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1
	[0169.646] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1
	[0169.646] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1
	[0169.646] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1
	[0169.646] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1
	[0169.646] lstrcmpiW (lpString1="d2.exe", lpString2="index.html") returned -1
	[0169.646] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html") returned 111
	[0169.646] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0169.646] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0169.646] lstrlenW (lpString=".1cd") returned 4
	[0169.646] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0169.646] lstrlenW (lpString=".3ds") returned 4
	[0169.646] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0169.646] lstrlenW (lpString=".3fr") returned 4
	[0169.646] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0169.647] lstrlenW (lpString=".3g2") returned 4
	[0169.647] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0169.647] lstrlenW (lpString=".3gp") returned 4
	[0169.647] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0169.647] lstrlenW (lpString=".7z") returned 3
	[0169.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0169.647] lstrlenW (lpString=".accda") returned 6
	[0169.647] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1
	[0169.647] lstrlenW (lpString=".accdb") returned 6
	[0169.647] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1
	[0169.647] lstrlenW (lpString=".accdc") returned 6
	[0169.647] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1
	[0169.647] lstrlenW (lpString=".accde") returned 6
	[0169.647] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1
	[0169.647] lstrlenW (lpString=".accdt") returned 6
	[0169.647] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1
	[0169.647] lstrlenW (lpString=".accdw") returned 6
	[0169.647] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1
	[0169.647] lstrlenW (lpString=".adb") returned 4
	[0169.647] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0169.647] lstrlenW (lpString=".adp") returned 4
	[0169.647] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0169.647] lstrlenW (lpString=".ai") returned 3
	[0169.647] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0169.647] lstrlenW (lpString=".ai3") returned 4
	[0169.647] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0169.647] lstrlenW (lpString=".ai4") returned 4
	[0169.647] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0169.647] lstrlenW (lpString=".ai5") returned 4
	[0169.647] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0169.647] lstrlenW (lpString=".ai6") returned 4
	[0169.648] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0169.648] lstrlenW (lpString=".ai7") returned 4
	[0169.648] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0169.648] lstrlenW (lpString=".ai8") returned 4
	[0169.648] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0169.648] lstrlenW (lpString=".anim") returned 5
	[0169.648] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0169.648] lstrlenW (lpString=".arw") returned 4
	[0169.648] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0169.762] lstrlenW (lpString=".as") returned 3
	[0169.762] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0169.762] lstrlenW (lpString=".asa") returned 4
	[0169.762] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0169.763] lstrlenW (lpString=".asc") returned 4
	[0169.763] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0169.763] lstrlenW (lpString=".ascx") returned 5
	[0169.763] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0169.763] lstrlenW (lpString=".asm") returned 4
	[0169.763] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0169.763] lstrlenW (lpString=".asmx") returned 5
	[0169.763] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0169.763] lstrlenW (lpString=".asp") returned 4
	[0169.763] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0169.763] lstrlenW (lpString=".aspx") returned 5
	[0169.763] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0169.763] lstrlenW (lpString=".asr") returned 4
	[0169.763] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0169.763] lstrlenW (lpString=".asx") returned 4
	[0169.763] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0169.763] lstrlenW (lpString=".avi") returned 4
	[0169.763] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0169.763] lstrlenW (lpString=".avs") returned 4
	[0169.763] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0169.763] lstrlenW (lpString=".backup") returned 7
	[0169.763] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1
	[0169.764] lstrlenW (lpString=".bak") returned 4
	[0169.764] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0169.764] lstrlenW (lpString=".bay") returned 4
	[0169.764] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0169.764] lstrlenW (lpString=".bd") returned 3
	[0169.764] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0169.764] lstrlenW (lpString=".bin") returned 4
	[0169.764] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0169.764] lstrlenW (lpString=".bmp") returned 4
	[0169.764] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0169.764] lstrlenW (lpString=".bz2") returned 4
	[0169.764] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0169.764] lstrlenW (lpString=".c") returned 2
	[0169.764] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0169.764] lstrlenW (lpString=".cdr") returned 4
	[0169.764] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0169.764] lstrlenW (lpString=".cer") returned 4
	[0169.764] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0169.764] lstrlenW (lpString=".cf") returned 3
	[0169.764] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0169.764] lstrlenW (lpString=".cfc") returned 4
	[0169.764] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0169.764] lstrlenW (lpString=".cfm") returned 4
	[0169.764] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0169.764] lstrlenW (lpString=".cfml") returned 5
	[0169.764] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0169.764] lstrlenW (lpString=".cfu") returned 4
	[0169.764] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0169.764] lstrlenW (lpString=".chm") returned 4
	[0169.765] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0169.765] lstrlenW (lpString=".cin") returned 4
	[0169.765] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0169.765] lstrlenW (lpString=".class") returned 6
	[0169.765] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1
	[0169.765] lstrlenW (lpString=".clx") returned 4
	[0169.765] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0169.765] lstrlenW (lpString=".config") returned 7
	[0169.765] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1
	[0169.765] lstrlenW (lpString=".cpp") returned 4
	[0169.765] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0169.765] lstrlenW (lpString=".cr2") returned 4
	[0169.765] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0169.765] lstrlenW (lpString=".crt") returned 4
	[0169.765] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0169.765] lstrlenW (lpString=".crw") returned 4
	[0169.765] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0169.765] lstrlenW (lpString=".cs") returned 3
	[0169.765] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0169.765] lstrlenW (lpString=".css") returned 4
	[0169.765] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0169.765] lstrlenW (lpString=".csv") returned 4
	[0169.765] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0169.765] lstrlenW (lpString=".cub") returned 4
	[0169.765] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0169.765] lstrlenW (lpString=".dae") returned 4
	[0169.766] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".dat") returned 4
	[0169.766] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".db") returned 3
	[0169.766] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0169.766] lstrlenW (lpString=".dbf") returned 4
	[0169.766] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".dbx") returned 4
	[0169.766] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".dc3") returned 4
	[0169.766] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".dcm") returned 4
	[0169.766] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".dcr") returned 4
	[0169.766] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".der") returned 4
	[0169.766] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".dib") returned 4
	[0169.766] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".dic") returned 4
	[0169.766] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".dif") returned 4
	[0169.766] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".divx") returned 5
	[0169.766] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0169.766] lstrlenW (lpString=".djvu") returned 5
	[0169.766] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0169.766] lstrlenW (lpString=".dng") returned 4
	[0169.766] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0169.766] lstrlenW (lpString=".doc") returned 4
	[0169.767] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0169.767] lstrlenW (lpString=".docm") returned 5
	[0169.767] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0169.767] lstrlenW (lpString=".docx") returned 5
	[0169.767] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0169.767] lstrlenW (lpString=".dot") returned 4
	[0169.767] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0169.767] lstrlenW (lpString=".dotm") returned 5
	[0169.767] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0169.767] lstrlenW (lpString=".dotx") returned 5
	[0169.767] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0169.767] lstrlenW (lpString=".dpx") returned 4
	[0169.767] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0169.767] lstrlenW (lpString=".dqy") returned 4
	[0169.767] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0169.767] lstrlenW (lpString=".dsn") returned 4
	[0169.767] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0169.767] lstrlenW (lpString=".dt") returned 3
	[0169.767] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0169.767] lstrlenW (lpString=".dtd") returned 4
	[0169.767] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0169.767] lstrlenW (lpString=".dwg") returned 4
	[0169.767] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0169.767] lstrlenW (lpString=".dwt") returned 4
	[0169.767] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0169.767] lstrlenW (lpString=".dx") returned 3
	[0169.767] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0169.767] lstrlenW (lpString=".dxf") returned 4
	[0169.767] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0169.767] lstrlenW (lpString=".edml") returned 5
	[0169.767] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0169.768] lstrlenW (lpString=".efd") returned 4
	[0169.768] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".elf") returned 4
	[0169.768] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".emf") returned 4
	[0169.768] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".emz") returned 4
	[0169.768] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".epf") returned 4
	[0169.768] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".eps") returned 4
	[0169.768] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".epsf") returned 5
	[0169.768] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0169.768] lstrlenW (lpString=".epsp") returned 5
	[0169.768] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0169.768] lstrlenW (lpString=".erf") returned 4
	[0169.768] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".exr") returned 4
	[0169.768] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".f4v") returned 4
	[0169.768] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".fido") returned 5
	[0169.768] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0169.768] lstrlenW (lpString=".flm") returned 4
	[0169.768] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".flv") returned 4
	[0169.768] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".frm") returned 4
	[0169.768] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0169.768] lstrlenW (lpString=".fxg") returned 4
	[0169.769] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0169.769] lstrlenW (lpString=".geo") returned 4
	[0169.769] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0169.769] lstrlenW (lpString=".gif") returned 4
	[0169.769] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0169.769] lstrlenW (lpString=".grs") returned 4
	[0169.769] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0169.769] lstrlenW (lpString=".gz") returned 3
	[0169.769] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0169.769] lstrlenW (lpString=".h") returned 2
	[0169.769] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0169.769] lstrlenW (lpString=".hdr") returned 4
	[0169.769] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0169.769] lstrlenW (lpString=".hpp") returned 4
	[0169.769] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0169.769] lstrlenW (lpString=".hta") returned 4
	[0169.769] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0169.769] lstrlenW (lpString=".htc") returned 4
	[0169.769] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0169.769] lstrlenW (lpString=".htm") returned 4
	[0169.772] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.772] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0169.772] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU") returned 100
	[0169.776] FindNextFileW (in: hFindFile=0x3e70830, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.776] FindNextFileW (in: hFindFile=0x3e70830, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa80d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.776] FindNextFileW (in: hFindFile=0x3e70830, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0169.777] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.777] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.780] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.780] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.781] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.781] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0169.783] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.783] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9d9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.784] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.784] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0169.786] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.786] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xaa3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.787] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.787] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0169.789] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.789] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9fa2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.789] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0169.790] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.790] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xee2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageSelector.js", cAlternateFileName="LANGUA~1.JS")) returned 1
	[0169.792] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.793] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.793] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.793] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0169.796] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.796] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c77, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.797] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.797] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0169.799] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.799] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa07c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.800] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.800] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata.json", cAlternateFileName="METADA~1.JSO")) returned 1
	[0169.974] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.975] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0169.975] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0169.975] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0169.975] lstrlenW (lpString=".1cd") returned 4
	[0169.975] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0169.975] lstrlenW (lpString=".3ds") returned 4
	[0169.975] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0169.975] lstrlenW (lpString=".3fr") returned 4
	[0169.975] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0169.975] lstrlenW (lpString=".3g2") returned 4
	[0169.975] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0169.975] lstrlenW (lpString=".3gp") returned 4
	[0169.975] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0169.976] lstrlenW (lpString=".7z") returned 3
	[0169.976] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0169.976] lstrlenW (lpString=".accda") returned 6
	[0169.976] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1
	[0169.976] lstrlenW (lpString=".accdb") returned 6
	[0169.976] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1
	[0169.976] lstrlenW (lpString=".accdc") returned 6
	[0169.976] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1
	[0169.976] lstrlenW (lpString=".accde") returned 6
	[0169.976] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1
	[0169.976] lstrlenW (lpString=".accdt") returned 6
	[0169.976] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1
	[0169.976] lstrlenW (lpString=".accdw") returned 6
	[0169.976] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1
	[0169.976] lstrlenW (lpString=".adb") returned 4
	[0169.976] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0169.976] lstrlenW (lpString=".adp") returned 4
	[0169.976] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0169.976] lstrlenW (lpString=".ai") returned 3
	[0169.976] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0169.976] lstrlenW (lpString=".ai3") returned 4
	[0169.976] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0169.976] lstrlenW (lpString=".ai4") returned 4
	[0169.976] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0169.976] lstrlenW (lpString=".ai5") returned 4
	[0169.976] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0169.976] lstrlenW (lpString=".ai6") returned 4
	[0169.976] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0169.976] lstrlenW (lpString=".ai7") returned 4
	[0169.977] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0169.977] lstrlenW (lpString=".ai8") returned 4
	[0169.977] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0169.977] lstrlenW (lpString=".anim") returned 5
	[0169.977] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0169.977] lstrlenW (lpString=".arw") returned 4
	[0169.977] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0169.977] lstrlenW (lpString=".as") returned 3
	[0169.977] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0169.977] lstrlenW (lpString=".asa") returned 4
	[0169.977] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0169.977] lstrlenW (lpString=".asc") returned 4
	[0169.977] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0169.977] lstrlenW (lpString=".ascx") returned 5
	[0169.977] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0169.977] lstrlenW (lpString=".asm") returned 4
	[0169.977] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0169.977] lstrlenW (lpString=".asmx") returned 5
	[0169.977] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0169.977] lstrlenW (lpString=".asp") returned 4
	[0169.977] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0169.977] lstrlenW (lpString=".aspx") returned 5
	[0169.977] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0169.977] lstrlenW (lpString=".asr") returned 4
	[0169.977] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0169.977] lstrlenW (lpString=".asx") returned 4
	[0169.977] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0169.977] lstrlenW (lpString=".avi") returned 4
	[0169.977] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0169.978] lstrlenW (lpString=".avs") returned 4
	[0169.978] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0169.978] lstrlenW (lpString=".backup") returned 7
	[0169.978] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1
	[0169.978] lstrlenW (lpString=".bak") returned 4
	[0169.978] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0169.978] lstrlenW (lpString=".bay") returned 4
	[0169.978] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0169.978] lstrlenW (lpString=".bd") returned 3
	[0169.978] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0169.978] lstrlenW (lpString=".bin") returned 4
	[0169.978] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0169.978] lstrlenW (lpString=".bmp") returned 4
	[0169.978] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0169.978] lstrlenW (lpString=".bz2") returned 4
	[0169.978] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0169.978] lstrlenW (lpString=".c") returned 2
	[0169.978] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0169.978] lstrlenW (lpString=".cdr") returned 4
	[0169.978] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0169.978] lstrlenW (lpString=".cer") returned 4
	[0169.978] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0169.978] lstrlenW (lpString=".cf") returned 3
	[0169.978] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0169.978] lstrlenW (lpString=".cfc") returned 4
	[0169.978] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0169.978] lstrlenW (lpString=".cfm") returned 4
	[0169.979] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0169.979] lstrlenW (lpString=".cfml") returned 5
	[0169.979] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0169.979] lstrlenW (lpString=".cfu") returned 4
	[0169.979] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0169.979] lstrlenW (lpString=".chm") returned 4
	[0169.979] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0169.979] lstrlenW (lpString=".cin") returned 4
	[0169.979] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0169.979] lstrlenW (lpString=".class") returned 6
	[0169.979] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1
	[0169.979] lstrlenW (lpString=".clx") returned 4
	[0169.979] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0169.979] lstrlenW (lpString=".config") returned 7
	[0169.979] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1
	[0169.979] lstrlenW (lpString=".cpp") returned 4
	[0169.979] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0169.979] lstrlenW (lpString=".cr2") returned 4
	[0169.979] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0169.979] lstrlenW (lpString=".crt") returned 4
	[0169.979] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0169.979] lstrlenW (lpString=".crw") returned 4
	[0169.979] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0169.979] lstrlenW (lpString=".cs") returned 3
	[0169.979] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0169.979] lstrlenW (lpString=".css") returned 4
	[0169.979] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0169.979] lstrlenW (lpString=".csv") returned 4
	[0169.980] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0169.980] lstrlenW (lpString=".cub") returned 4
	[0169.980] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0169.980] lstrlenW (lpString=".dae") returned 4
	[0169.980] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0169.980] lstrlenW (lpString=".dat") returned 4
	[0169.980] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0169.980] lstrlenW (lpString=".db") returned 3
	[0169.980] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0169.980] lstrlenW (lpString=".dbf") returned 4
	[0169.980] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0169.980] lstrlenW (lpString=".dbx") returned 4
	[0169.980] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0169.980] lstrlenW (lpString=".dc3") returned 4
	[0169.980] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0169.980] lstrlenW (lpString=".dcm") returned 4
	[0169.980] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0169.980] lstrlenW (lpString=".dcr") returned 4
	[0169.980] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0169.980] lstrlenW (lpString=".der") returned 4
	[0169.980] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0169.980] lstrlenW (lpString=".dib") returned 4
	[0169.980] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0169.981] lstrlenW (lpString=".dic") returned 4
	[0169.981] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0169.981] lstrlenW (lpString=".dif") returned 4
	[0169.981] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0169.981] lstrlenW (lpString=".divx") returned 5
	[0169.981] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0169.981] lstrlenW (lpString=".djvu") returned 5
	[0169.981] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0169.981] lstrlenW (lpString=".dng") returned 4
	[0169.981] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0169.981] lstrlenW (lpString=".doc") returned 4
	[0169.981] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0169.981] lstrlenW (lpString=".docm") returned 5
	[0169.981] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0169.981] lstrlenW (lpString=".docx") returned 5
	[0169.981] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0169.981] lstrlenW (lpString=".dot") returned 4
	[0169.981] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0169.981] lstrlenW (lpString=".dotm") returned 5
	[0169.981] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0169.981] lstrlenW (lpString=".dotx") returned 5
	[0169.981] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0169.981] lstrlenW (lpString=".dpx") returned 4
	[0169.981] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0169.981] lstrlenW (lpString=".dqy") returned 4
	[0169.982] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0169.982] lstrlenW (lpString=".dsn") returned 4
	[0169.982] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0169.982] lstrlenW (lpString=".dt") returned 3
	[0169.982] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0169.982] lstrlenW (lpString=".dtd") returned 4
	[0169.982] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0169.982] lstrlenW (lpString=".dwg") returned 4
	[0169.982] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0169.982] lstrlenW (lpString=".dwt") returned 4
	[0169.982] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0169.982] lstrlenW (lpString=".dx") returned 3
	[0169.982] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0169.982] lstrlenW (lpString=".dxf") returned 4
	[0169.982] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0169.982] lstrlenW (lpString=".edml") returned 5
	[0169.982] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0169.982] lstrlenW (lpString=".efd") returned 4
	[0169.982] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0169.982] lstrlenW (lpString=".elf") returned 4
	[0169.982] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0169.982] lstrlenW (lpString=".emf") returned 4
	[0169.982] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0169.982] lstrlenW (lpString=".emz") returned 4
	[0169.982] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0169.982] lstrlenW (lpString=".epf") returned 4
	[0169.982] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0169.982] lstrlenW (lpString=".eps") returned 4
	[0169.982] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0169.983] lstrlenW (lpString=".epsf") returned 5
	[0169.983] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0169.983] lstrlenW (lpString=".epsp") returned 5
	[0169.983] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0169.983] lstrlenW (lpString=".erf") returned 4
	[0169.983] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0169.983] lstrlenW (lpString=".exr") returned 4
	[0169.983] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0169.983] lstrlenW (lpString=".f4v") returned 4
	[0169.983] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0169.983] lstrlenW (lpString=".fido") returned 5
	[0169.983] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0169.983] lstrlenW (lpString=".flm") returned 4
	[0169.983] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0169.983] lstrlenW (lpString=".flv") returned 4
	[0169.983] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0169.983] lstrlenW (lpString=".frm") returned 4
	[0169.983] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0169.983] lstrlenW (lpString=".fxg") returned 4
	[0169.983] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0169.983] lstrlenW (lpString=".geo") returned 4
	[0169.983] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0169.983] lstrlenW (lpString=".gif") returned 4
	[0169.983] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0169.983] lstrlenW (lpString=".grs") returned 4
	[0169.984] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0169.984] lstrlenW (lpString=".gz") returned 3
	[0169.984] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0169.984] lstrlenW (lpString=".h") returned 2
	[0169.984] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0169.984] lstrlenW (lpString=".hdr") returned 4
	[0169.984] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0169.984] lstrlenW (lpString=".hpp") returned 4
	[0169.984] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0169.984] lstrlenW (lpString=".hta") returned 4
	[0169.984] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0169.984] lstrlenW (lpString=".htc") returned 4
	[0169.984] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0169.984] lstrlenW (lpString=".htm") returned 4
	[0169.984] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1
	[0169.984] lstrlenW (lpString=".html") returned 5
	[0169.984] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1
	[0169.984] lstrlenW (lpString=".icb") returned 4
	[0169.984] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1
	[0169.984] lstrlenW (lpString=".ics") returned 4
	[0169.984] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1
	[0169.984] lstrlenW (lpString=".iff") returned 4
	[0169.984] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1
	[0169.984] lstrlenW (lpString=".inc") returned 4
	[0169.984] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1
	[0169.984] lstrlenW (lpString=".indd") returned 5
	[0169.984] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1
	[0169.984] lstrlenW (lpString=".ini") returned 4
	[0169.985] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1
	[0169.985] lstrlenW (lpString=".iqy") returned 4
	[0169.985] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1
	[0169.985] lstrlenW (lpString=".j2c") returned 4
	[0169.985] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1
	[0169.985] lstrlenW (lpString=".j2k") returned 4
	[0169.985] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1
	[0169.985] lstrlenW (lpString=".java") returned 5
	[0169.985] lstrcmpiW (lpString1=".java", lpString2="e.xml") returned -1
	[0169.985] lstrlenW (lpString=".jp2") returned 4
	[0169.985] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1
	[0169.985] lstrlenW (lpString=".jpc") returned 4
	[0169.985] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1
	[0169.985] lstrlenW (lpString=".jpe") returned 4
	[0169.985] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1
	[0169.985] lstrlenW (lpString=".jpeg") returned 5
	[0169.985] lstrcmpiW (lpString1=".jpeg", lpString2="e.xml") returned -1
	[0169.985] lstrlenW (lpString=".jpf") returned 4
	[0169.985] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1
	[0169.985] lstrlenW (lpString=".jpg") returned 4
	[0169.985] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0169.985] lstrlenW (lpString=".jpx") returned 4
	[0169.985] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1
	[0169.985] lstrlenW (lpString=".js") returned 3
	[0169.985] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1
	[0169.986] lstrlenW (lpString=".jsf") returned 4
	[0169.986] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1
	[0169.986] lstrlenW (lpString=".json") returned 5
	[0169.986] lstrcmpiW (lpString1=".json", lpString2="e.xml") returned -1
	[0169.986] lstrlenW (lpString=".jsp") returned 4
	[0169.986] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1
	[0169.986] lstrlenW (lpString=".kdc") returned 4
	[0169.986] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1
	[0169.986] lstrlenW (lpString=".kmz") returned 4
	[0169.986] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1
	[0169.986] lstrlenW (lpString=".kwm") returned 4
	[0169.986] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1
	[0169.986] lstrlenW (lpString=".lasso") returned 6
	[0169.986] lstrcmpiW (lpString1=".lasso", lpString2="de.xml") returned -1
	[0169.986] lstrlenW (lpString=".lbi") returned 4
	[0169.986] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1
	[0169.986] lstrlenW (lpString=".lgf") returned 4
	[0169.986] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1
	[0169.986] lstrlenW (lpString=".lgp") returned 4
	[0169.986] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1
	[0169.986] lstrlenW (lpString=".log") returned 4
	[0169.986] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1
	[0169.986] lstrlenW (lpString=".m1v") returned 4
	[0169.986] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1
	[0169.986] lstrlenW (lpString=".m4a") returned 4
	[0169.986] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1
	[0169.986] lstrlenW (lpString=".m4v") returned 4
	[0169.986] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".max") returned 4
	[0169.987] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".md") returned 3
	[0169.987] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1
	[0169.987] lstrlenW (lpString=".mda") returned 4
	[0169.987] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".mdb") returned 4
	[0169.987] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".mde") returned 4
	[0169.987] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".mdf") returned 4
	[0169.987] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".mdw") returned 4
	[0169.987] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".mef") returned 4
	[0169.987] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".mft") returned 4
	[0169.987] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".mfw") returned 4
	[0169.987] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".mht") returned 4
	[0169.987] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".mhtml") returned 6
	[0169.987] lstrcmpiW (lpString1=".mhtml", lpString2="de.xml") returned -1
	[0169.987] lstrlenW (lpString=".mka") returned 4
	[0169.987] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1
	[0169.987] lstrlenW (lpString=".mkidx") returned 6
	[0169.988] lstrcmpiW (lpString1=".mkidx", lpString2="de.xml") returned -1
	[0169.988] lstrlenW (lpString=".mkv") returned 4
	[0169.988] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".mos") returned 4
	[0169.988] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".mov") returned 4
	[0169.988] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".mp3") returned 4
	[0169.988] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".mp4") returned 4
	[0169.988] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".mpeg") returned 5
	[0169.988] lstrcmpiW (lpString1=".mpeg", lpString2="e.xml") returned -1
	[0169.988] lstrlenW (lpString=".mpg") returned 4
	[0169.988] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".mpv") returned 4
	[0169.988] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".mrw") returned 4
	[0169.988] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".msg") returned 4
	[0169.988] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".mxl") returned 4
	[0169.988] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".myd") returned 4
	[0169.988] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".myi") returned 4
	[0169.988] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1
	[0169.988] lstrlenW (lpString=".nef") returned 4
	[0169.989] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1
	[0169.989] lstrlenW (lpString=".nrw") returned 4
	[0169.989] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1
	[0169.989] lstrlenW (lpString=".obj") returned 4
	[0169.989] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1
	[0169.989] lstrlenW (lpString=".odb") returned 4
	[0169.989] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1
	[0169.989] lstrlenW (lpString=".odc") returned 4
	[0169.989] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1
	[0169.989] lstrlenW (lpString=".odm") returned 4
	[0169.989] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1
	[0169.989] lstrlenW (lpString=".odp") returned 4
	[0169.989] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1
	[0169.989] lstrlenW (lpString=".ods") returned 4
	[0169.989] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1
	[0169.989] lstrlenW (lpString=".oft") returned 4
	[0169.989] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1
	[0169.989] lstrlenW (lpString=".one") returned 4
	[0169.989] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1
	[0169.989] lstrlenW (lpString=".onepkg") returned 7
	[0169.989] lstrcmpiW (lpString1=".onepkg", lpString2="ade.xml") returned -1
	[0169.989] lstrlenW (lpString=".onetoc2") returned 8
	[0169.989] lstrcmpiW (lpString1=".onetoc2", lpString2="rade.xml") returned -1
	[0169.989] lstrlenW (lpString=".opt") returned 4
	[0169.989] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1
	[0169.989] lstrlenW (lpString=".oqy") returned 4
	[0169.989] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".orf") returned 4
	[0169.990] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".p12") returned 4
	[0169.990] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".p7b") returned 4
	[0169.990] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".p7c") returned 4
	[0169.990] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".pam") returned 4
	[0169.990] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".pbm") returned 4
	[0169.990] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".pct") returned 4
	[0169.990] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".pcx") returned 4
	[0169.990] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".pdd") returned 4
	[0169.990] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".pdf") returned 4
	[0169.990] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".pdp") returned 4
	[0169.990] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".pef") returned 4
	[0169.990] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".pem") returned 4
	[0169.990] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1
	[0169.990] lstrlenW (lpString=".pff") returned 4
	[0169.990] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1
	[0169.991] lstrlenW (lpString=".pfm") returned 4
	[0169.991] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1
	[0169.991] lstrlenW (lpString=".pfx") returned 4
	[0169.991] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1
	[0169.991] lstrlenW (lpString=".pgm") returned 4
	[0169.991] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1
	[0169.991] lstrlenW (lpString=".php") returned 4
	[0169.991] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1
	[0169.991] lstrlenW (lpString=".php3") returned 5
	[0169.991] lstrcmpiW (lpString1=".php3", lpString2="e.xml") returned -1
	[0169.991] lstrlenW (lpString=".php4") returned 5
	[0169.991] lstrcmpiW (lpString1=".php4", lpString2="e.xml") returned -1
	[0169.991] lstrlenW (lpString=".php5") returned 5
	[0169.991] lstrcmpiW (lpString1=".php5", lpString2="e.xml") returned -1
	[0169.991] lstrlenW (lpString=".phtml") returned 6
	[0169.991] lstrcmpiW (lpString1=".phtml", lpString2="de.xml") returned -1
	[0169.991] lstrlenW (lpString=".pict") returned 5
	[0169.991] lstrcmpiW (lpString1=".pict", lpString2="e.xml") returned -1
	[0169.991] lstrlenW (lpString=".pl") returned 3
	[0169.991] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1
	[0169.991] lstrlenW (lpString=".pls") returned 4
	[0169.991] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1
	[0169.991] lstrlenW (lpString=".pm") returned 3
	[0169.991] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1
	[0169.991] lstrlenW (lpString=".png") returned 4
	[0169.991] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1
	[0169.991] lstrlenW (lpString=".pnm") returned 4
	[0169.991] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1
	[0169.991] lstrlenW (lpString=".pot") returned 4
	[0169.992] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1
	[0169.992] lstrlenW (lpString=".potm") returned 5
	[0169.992] lstrcmpiW (lpString1=".potm", lpString2="e.xml") returned -1
	[0169.992] lstrlenW (lpString=".potx") returned 5
	[0169.992] lstrcmpiW (lpString1=".potx", lpString2="e.xml") returned -1
	[0169.992] lstrlenW (lpString=".ppa") returned 4
	[0169.992] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1
	[0169.992] lstrlenW (lpString=".ppam") returned 5
	[0169.992] lstrcmpiW (lpString1=".ppam", lpString2="e.xml") returned -1
	[0169.992] lstrlenW (lpString=".ppm") returned 4
	[0169.992] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1
	[0169.992] lstrlenW (lpString=".pps") returned 4
	[0169.992] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1
	[0169.992] lstrlenW (lpString=".ppsm") returned 5
	[0169.992] lstrcmpiW (lpString1=".ppsm", lpString2="e.xml") returned -1
	[0169.992] lstrlenW (lpString=".ppt") returned 4
	[0169.992] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0169.992] lstrlenW (lpString=".pptm") returned 5
	[0169.992] lstrcmpiW (lpString1=".pptm", lpString2="e.xml") returned -1
	[0169.992] lstrlenW (lpString=".pptx") returned 5
	[0169.992] lstrcmpiW (lpString1=".pptx", lpString2="e.xml") returned -1
	[0169.992] lstrlenW (lpString=".prn") returned 4
	[0169.992] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1
	[0169.992] lstrlenW (lpString=".ps") returned 3
	[0169.992] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1
	[0169.992] lstrlenW (lpString=".psb") returned 4
	[0169.992] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1
	[0169.993] lstrlenW (lpString=".psd") returned 4
	[0169.993] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1
	[0169.993] lstrlenW (lpString=".pst") returned 4
	[0169.993] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1
	[0169.993] lstrlenW (lpString=".ptx") returned 4
	[0169.993] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1
	[0169.993] lstrlenW (lpString=".pub") returned 4
	[0169.993] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1
	[0169.993] lstrlenW (lpString=".pwm") returned 4
	[0169.993] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1
	[0169.993] lstrlenW (lpString=".pxr") returned 4
	[0169.993] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1
	[0169.993] lstrlenW (lpString=".py") returned 3
	[0169.993] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1
	[0169.993] lstrlenW (lpString=".qt") returned 3
	[0169.993] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1
	[0169.993] lstrlenW (lpString=".r3d") returned 4
	[0169.993] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1
	[0169.993] lstrlenW (lpString=".raf") returned 4
	[0169.993] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1
	[0169.993] lstrlenW (lpString=".rar") returned 4
	[0169.993] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0169.993] lstrlenW (lpString=".raw") returned 4
	[0169.993] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1
	[0169.994] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0169.994] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0169.999] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.999] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0170.000] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.000] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-BE", cAlternateFileName="")) returned 1
	[0170.002] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0170.002] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0170.003] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.003] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0170.005] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0170.005] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0170.006] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.006] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-NO", cAlternateFileName="")) returned 1
	[0170.008] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0170.008] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0170.009] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0170.009] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.009] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0170.117] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0170.118] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0170.118] lstrlenW (lpString="index.html") returned 10
	[0170.118] lstrlenW (lpString=".1cd") returned 4
	[0170.118] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0170.118] lstrlenW (lpString=".3ds") returned 4
	[0170.118] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0170.118] lstrlenW (lpString=".3fr") returned 4
	[0170.118] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0170.118] lstrlenW (lpString=".3g2") returned 4
	[0170.118] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0170.118] lstrlenW (lpString=".3gp") returned 4
	[0170.118] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0170.118] lstrlenW (lpString=".7z") returned 3
	[0170.118] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0170.118] lstrlenW (lpString=".accda") returned 6
	[0170.118] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1
	[0170.118] lstrlenW (lpString=".accdb") returned 6
	[0170.118] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1
	[0170.118] lstrlenW (lpString=".accdc") returned 6
	[0170.118] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1
	[0170.118] lstrlenW (lpString=".accde") returned 6
	[0170.118] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1
	[0170.118] lstrlenW (lpString=".accdt") returned 6
	[0170.118] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1
	[0170.119] lstrlenW (lpString=".accdw") returned 6
	[0170.119] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1
	[0170.119] lstrlenW (lpString=".adb") returned 4
	[0170.119] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0170.119] lstrlenW (lpString=".adp") returned 4
	[0170.119] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0170.119] lstrlenW (lpString=".ai") returned 3
	[0170.119] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0170.119] lstrlenW (lpString=".ai3") returned 4
	[0170.119] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0170.119] lstrlenW (lpString=".ai4") returned 4
	[0170.119] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0170.119] lstrlenW (lpString=".ai5") returned 4
	[0170.119] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0170.119] lstrlenW (lpString=".ai6") returned 4
	[0170.119] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0170.119] lstrlenW (lpString=".ai7") returned 4
	[0170.119] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0170.119] lstrlenW (lpString=".ai8") returned 4
	[0170.119] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0170.119] lstrlenW (lpString=".anim") returned 5
	[0170.119] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0170.119] lstrlenW (lpString=".arw") returned 4
	[0170.119] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0170.119] lstrlenW (lpString=".as") returned 3
	[0170.119] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0170.119] lstrlenW (lpString=".asa") returned 4
	[0170.119] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0170.120] lstrlenW (lpString=".asc") returned 4
	[0170.120] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0170.120] lstrlenW (lpString=".ascx") returned 5
	[0170.120] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0170.120] lstrlenW (lpString=".asm") returned 4
	[0170.120] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0170.120] lstrlenW (lpString=".asmx") returned 5
	[0170.120] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0170.120] lstrlenW (lpString=".asp") returned 4
	[0170.120] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0170.120] lstrlenW (lpString=".aspx") returned 5
	[0170.120] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0170.120] lstrlenW (lpString=".asr") returned 4
	[0170.120] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0170.120] lstrlenW (lpString=".asx") returned 4
	[0170.120] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0170.120] lstrlenW (lpString=".avi") returned 4
	[0170.120] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0170.120] lstrlenW (lpString=".avs") returned 4
	[0170.120] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0170.120] lstrlenW (lpString=".backup") returned 7
	[0170.120] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1
	[0170.120] lstrlenW (lpString=".bak") returned 4
	[0170.120] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0170.120] lstrlenW (lpString=".bay") returned 4
	[0170.120] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0170.120] lstrlenW (lpString=".bd") returned 3
	[0170.120] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0170.121] lstrlenW (lpString=".bin") returned 4
	[0170.121] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0170.121] lstrlenW (lpString=".bmp") returned 4
	[0170.121] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0170.121] lstrlenW (lpString=".bz2") returned 4
	[0170.121] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0170.121] lstrlenW (lpString=".c") returned 2
	[0170.121] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0170.121] lstrlenW (lpString=".cdr") returned 4
	[0170.121] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0170.121] lstrlenW (lpString=".cer") returned 4
	[0170.121] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0170.121] lstrlenW (lpString=".cf") returned 3
	[0170.121] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0170.121] lstrlenW (lpString=".cfc") returned 4
	[0170.121] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0170.121] lstrlenW (lpString=".cfm") returned 4
	[0170.121] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0170.121] lstrlenW (lpString=".cfml") returned 5
	[0170.121] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0170.121] lstrlenW (lpString=".cfu") returned 4
	[0170.121] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0170.121] lstrlenW (lpString=".chm") returned 4
	[0170.121] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0170.121] lstrlenW (lpString=".cin") returned 4
	[0170.121] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0170.121] lstrlenW (lpString=".class") returned 6
	[0170.121] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1
	[0170.121] lstrlenW (lpString=".clx") returned 4
	[0170.122] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0170.122] lstrlenW (lpString=".config") returned 7
	[0170.122] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1
	[0170.122] lstrlenW (lpString=".cpp") returned 4
	[0170.122] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0170.122] lstrlenW (lpString=".cr2") returned 4
	[0170.122] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0170.122] lstrlenW (lpString=".crt") returned 4
	[0170.122] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0170.122] lstrlenW (lpString=".crw") returned 4
	[0170.122] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0170.122] lstrlenW (lpString=".cs") returned 3
	[0170.122] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0170.122] lstrlenW (lpString=".css") returned 4
	[0170.122] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0170.122] lstrlenW (lpString=".csv") returned 4
	[0170.122] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0170.122] lstrlenW (lpString=".cub") returned 4
	[0170.122] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0170.122] lstrlenW (lpString=".dae") returned 4
	[0170.122] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0170.122] lstrlenW (lpString=".dat") returned 4
	[0170.122] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0170.122] lstrlenW (lpString=".db") returned 3
	[0170.122] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0170.122] lstrlenW (lpString=".dbf") returned 4
	[0170.122] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0170.122] lstrlenW (lpString=".dbx") returned 4
	[0170.123] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0170.123] lstrlenW (lpString=".dc3") returned 4
	[0170.123] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0170.123] lstrlenW (lpString=".dcm") returned 4
	[0170.123] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0170.123] lstrlenW (lpString=".dcr") returned 4
	[0170.123] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0170.123] lstrlenW (lpString=".der") returned 4
	[0170.123] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0170.123] lstrlenW (lpString=".dib") returned 4
	[0170.123] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0170.123] lstrlenW (lpString=".dic") returned 4
	[0170.123] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0170.123] lstrlenW (lpString=".dif") returned 4
	[0170.123] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0170.123] lstrlenW (lpString=".divx") returned 5
	[0170.123] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0170.123] lstrlenW (lpString=".djvu") returned 5
	[0170.123] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0170.123] lstrlenW (lpString=".dng") returned 4
	[0170.123] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0170.123] lstrlenW (lpString=".doc") returned 4
	[0170.123] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0170.123] lstrlenW (lpString=".docm") returned 5
	[0170.123] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0170.123] lstrlenW (lpString=".docx") returned 5
	[0170.123] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0170.123] lstrlenW (lpString=".dot") returned 4
	[0170.124] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0170.124] lstrlenW (lpString=".dotm") returned 5
	[0170.124] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0170.124] lstrlenW (lpString=".dotx") returned 5
	[0170.124] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0170.124] lstrlenW (lpString=".dpx") returned 4
	[0170.124] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0170.124] lstrlenW (lpString=".dqy") returned 4
	[0170.124] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0170.124] lstrlenW (lpString=".dsn") returned 4
	[0170.124] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0170.124] lstrlenW (lpString=".dt") returned 3
	[0170.124] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0170.124] lstrlenW (lpString=".dtd") returned 4
	[0170.124] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0170.124] lstrlenW (lpString=".dwg") returned 4
	[0170.124] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0170.124] lstrlenW (lpString=".dwt") returned 4
	[0170.124] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0170.124] lstrlenW (lpString=".dx") returned 3
	[0170.124] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0170.124] lstrlenW (lpString=".dxf") returned 4
	[0170.124] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0170.124] lstrlenW (lpString=".edml") returned 5
	[0170.124] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0170.124] lstrlenW (lpString=".efd") returned 4
	[0170.124] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0170.124] lstrlenW (lpString=".elf") returned 4
	[0170.125] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0170.125] lstrlenW (lpString=".emf") returned 4
	[0170.125] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0170.125] lstrlenW (lpString=".emz") returned 4
	[0170.125] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0170.125] lstrlenW (lpString=".epf") returned 4
	[0170.125] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0170.125] lstrlenW (lpString=".eps") returned 4
	[0170.125] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0170.125] lstrlenW (lpString=".epsf") returned 5
	[0170.125] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0170.125] lstrlenW (lpString=".epsp") returned 5
	[0170.125] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0170.125] lstrlenW (lpString=".erf") returned 4
	[0170.125] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0170.125] lstrlenW (lpString=".exr") returned 4
	[0170.125] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0170.125] lstrlenW (lpString=".f4v") returned 4
	[0170.125] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0170.125] lstrlenW (lpString=".fido") returned 5
	[0170.125] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0170.125] lstrlenW (lpString=".flm") returned 4
	[0170.125] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0170.125] lstrlenW (lpString=".flv") returned 4
	[0170.125] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0170.125] lstrlenW (lpString=".frm") returned 4
	[0170.125] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0170.126] lstrlenW (lpString=".fxg") returned 4
	[0170.126] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0170.126] lstrlenW (lpString=".geo") returned 4
	[0170.126] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0170.126] lstrlenW (lpString=".gif") returned 4
	[0170.126] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0170.126] lstrlenW (lpString=".grs") returned 4
	[0170.126] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0170.126] lstrlenW (lpString=".gz") returned 3
	[0170.126] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0170.126] lstrlenW (lpString=".h") returned 2
	[0170.126] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0170.126] lstrlenW (lpString=".hdr") returned 4
	[0170.126] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0170.126] lstrlenW (lpString=".hpp") returned 4
	[0170.126] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0170.126] lstrlenW (lpString=".hta") returned 4
	[0170.126] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0170.126] lstrlenW (lpString=".htc") returned 4
	[0170.126] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0170.126] lstrlenW (lpString=".htm") returned 4
	[0170.126] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0170.126] lstrlenW (lpString=".html") returned 5
	[0170.126] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0170.127] lstrlenW (lpString="index.html") returned 10
	[0170.127] lstrlenW (lpString=".money") returned 6
	[0170.127] lstrcmpiW (lpString1=".money", lpString2="x.html") returned -1
	[0170.127] lstrlenW (lpString="index.html") returned 10
	[0170.127] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1
	[0170.127] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1
	[0170.127] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1
	[0170.127] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1
	[0170.127] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1
	[0170.127] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1
	[0170.127] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1
	[0170.127] lstrcmpiW (lpString1="d2.exe", lpString2="index.html") returned -1
	[0170.127] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html") returned 111
	[0170.127] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0170.127] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0170.127] lstrlenW (lpString=".1cd") returned 4
	[0170.127] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0170.127] lstrlenW (lpString=".3ds") returned 4
	[0170.127] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0170.127] lstrlenW (lpString=".3fr") returned 4
	[0170.127] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0170.127] lstrlenW (lpString=".3g2") returned 4
	[0170.127] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0170.127] lstrlenW (lpString=".3gp") returned 4
	[0170.127] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0170.128] lstrlenW (lpString=".7z") returned 3
	[0170.128] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0170.128] lstrlenW (lpString=".accda") returned 6
	[0170.128] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1
	[0170.128] lstrlenW (lpString=".accdb") returned 6
	[0170.128] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1
	[0170.128] lstrlenW (lpString=".accdc") returned 6
	[0170.128] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1
	[0170.128] lstrlenW (lpString=".accde") returned 6
	[0170.128] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1
	[0170.128] lstrlenW (lpString=".accdt") returned 6
	[0170.128] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1
	[0170.128] lstrlenW (lpString=".accdw") returned 6
	[0170.128] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1
	[0170.128] lstrlenW (lpString=".adb") returned 4
	[0170.128] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0170.128] lstrlenW (lpString=".adp") returned 4
	[0170.128] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0170.128] lstrlenW (lpString=".ai") returned 3
	[0170.128] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0170.128] lstrlenW (lpString=".ai3") returned 4
	[0170.128] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0170.128] lstrlenW (lpString=".ai4") returned 4
	[0170.128] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0170.128] lstrlenW (lpString=".ai5") returned 4
	[0170.129] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0170.129] lstrlenW (lpString=".ai6") returned 4
	[0170.129] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0170.129] lstrlenW (lpString=".ai7") returned 4
	[0170.129] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0170.129] lstrlenW (lpString=".ai8") returned 4
	[0170.129] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0170.129] lstrlenW (lpString=".anim") returned 5
	[0170.129] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0170.129] lstrlenW (lpString=".arw") returned 4
	[0170.129] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0170.129] lstrlenW (lpString=".as") returned 3
	[0170.129] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0170.129] lstrlenW (lpString=".asa") returned 4
	[0170.129] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0170.129] lstrlenW (lpString=".asc") returned 4
	[0170.129] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0170.129] lstrlenW (lpString=".ascx") returned 5
	[0170.129] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0170.129] lstrlenW (lpString=".asm") returned 4
	[0170.129] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0170.129] lstrlenW (lpString=".asmx") returned 5
	[0170.129] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0170.129] lstrlenW (lpString=".asp") returned 4
	[0170.129] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0170.129] lstrlenW (lpString=".aspx") returned 5
	[0170.129] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0170.129] lstrlenW (lpString=".asr") returned 4
	[0170.129] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0170.130] lstrlenW (lpString=".asx") returned 4
	[0170.130] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0170.130] lstrlenW (lpString=".avi") returned 4
	[0170.130] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0170.130] lstrlenW (lpString=".avs") returned 4
	[0170.130] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0170.130] lstrlenW (lpString=".backup") returned 7
	[0170.130] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1
	[0170.130] lstrlenW (lpString=".bak") returned 4
	[0170.130] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0170.130] lstrlenW (lpString=".bay") returned 4
	[0170.130] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0170.130] lstrlenW (lpString=".bd") returned 3
	[0170.130] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0170.130] lstrlenW (lpString=".bin") returned 4
	[0170.130] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0170.130] lstrlenW (lpString=".bmp") returned 4
	[0170.130] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0170.130] lstrlenW (lpString=".bz2") returned 4
	[0170.130] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0170.130] lstrlenW (lpString=".c") returned 2
	[0170.130] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0170.130] lstrlenW (lpString=".cdr") returned 4
	[0170.130] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0170.130] lstrlenW (lpString=".cer") returned 4
	[0170.130] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0170.130] lstrlenW (lpString=".cf") returned 3
	[0170.130] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0170.131] lstrlenW (lpString=".cfc") returned 4
	[0170.131] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0170.131] lstrlenW (lpString=".cfm") returned 4
	[0170.131] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0170.131] lstrlenW (lpString=".cfml") returned 5
	[0170.131] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0170.131] lstrlenW (lpString=".cfu") returned 4
	[0170.131] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0170.131] lstrlenW (lpString=".chm") returned 4
	[0170.131] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0170.131] lstrlenW (lpString=".cin") returned 4
	[0170.131] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0170.131] lstrlenW (lpString=".class") returned 6
	[0170.131] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1
	[0170.131] lstrlenW (lpString=".clx") returned 4
	[0170.131] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0170.131] lstrlenW (lpString=".config") returned 7
	[0170.131] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1
	[0170.131] lstrlenW (lpString=".cpp") returned 4
	[0170.131] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0170.131] lstrlenW (lpString=".cr2") returned 4
	[0170.131] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0170.131] lstrlenW (lpString=".crt") returned 4
	[0170.131] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0170.131] lstrlenW (lpString=".crw") returned 4
	[0170.131] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0170.131] lstrlenW (lpString=".cs") returned 3
	[0170.132] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0170.132] lstrlenW (lpString=".css") returned 4
	[0170.132] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".csv") returned 4
	[0170.132] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".cub") returned 4
	[0170.132] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".dae") returned 4
	[0170.132] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".dat") returned 4
	[0170.132] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".db") returned 3
	[0170.132] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0170.132] lstrlenW (lpString=".dbf") returned 4
	[0170.132] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".dbx") returned 4
	[0170.132] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".dc3") returned 4
	[0170.132] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".dcm") returned 4
	[0170.132] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".dcr") returned 4
	[0170.132] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".der") returned 4
	[0170.132] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".dib") returned 4
	[0170.132] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0170.132] lstrlenW (lpString=".dic") returned 4
	[0170.133] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0170.133] lstrlenW (lpString=".dif") returned 4
	[0170.133] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0170.133] lstrlenW (lpString=".divx") returned 5
	[0170.133] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0170.133] lstrlenW (lpString=".djvu") returned 5
	[0170.133] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0170.133] lstrlenW (lpString=".dng") returned 4
	[0170.133] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0170.133] lstrlenW (lpString=".doc") returned 4
	[0170.133] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0170.133] lstrlenW (lpString=".docm") returned 5
	[0170.133] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0170.133] lstrlenW (lpString=".docx") returned 5
	[0170.133] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0170.133] lstrlenW (lpString=".dot") returned 4
	[0170.133] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0170.133] lstrlenW (lpString=".dotm") returned 5
	[0170.133] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0170.133] lstrlenW (lpString=".dotx") returned 5
	[0170.133] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0170.133] lstrlenW (lpString=".dpx") returned 4
	[0170.133] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0170.133] lstrlenW (lpString=".dqy") returned 4
	[0170.133] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0170.133] lstrlenW (lpString=".dsn") returned 4
	[0170.133] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0170.133] lstrlenW (lpString=".dt") returned 3
	[0170.133] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0170.134] lstrlenW (lpString=".dtd") returned 4
	[0170.134] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0170.134] lstrlenW (lpString=".dwg") returned 4
	[0170.134] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0170.134] lstrlenW (lpString=".dwt") returned 4
	[0170.134] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0170.134] lstrlenW (lpString=".dx") returned 3
	[0170.134] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0170.134] lstrlenW (lpString=".dxf") returned 4
	[0170.134] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0170.134] lstrlenW (lpString=".edml") returned 5
	[0170.134] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0170.134] lstrlenW (lpString=".efd") returned 4
	[0170.134] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0170.134] lstrlenW (lpString=".elf") returned 4
	[0170.134] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0170.134] lstrlenW (lpString=".emf") returned 4
	[0170.134] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0170.134] lstrlenW (lpString=".emz") returned 4
	[0170.134] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0170.134] lstrlenW (lpString=".epf") returned 4
	[0170.134] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0170.134] lstrlenW (lpString=".eps") returned 4
	[0170.134] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0170.134] lstrlenW (lpString=".epsf") returned 5
	[0170.134] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0170.134] lstrlenW (lpString=".epsp") returned 5
	[0170.135] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0170.135] lstrlenW (lpString=".erf") returned 4
	[0170.135] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0170.135] lstrlenW (lpString=".exr") returned 4
	[0170.135] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0170.135] lstrlenW (lpString=".f4v") returned 4
	[0170.135] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0170.135] lstrlenW (lpString=".fido") returned 5
	[0170.135] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0170.135] lstrlenW (lpString=".flm") returned 4
	[0170.135] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0170.135] lstrlenW (lpString=".flv") returned 4
	[0170.135] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0170.135] lstrlenW (lpString=".frm") returned 4
	[0170.135] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0170.135] lstrlenW (lpString=".fxg") returned 4
	[0170.135] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0170.135] lstrlenW (lpString=".geo") returned 4
	[0170.135] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0170.135] lstrlenW (lpString=".gif") returned 4
	[0170.135] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0170.135] lstrlenW (lpString=".grs") returned 4
	[0170.135] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0170.135] lstrlenW (lpString=".gz") returned 3
	[0170.136] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0170.136] lstrlenW (lpString=".h") returned 2
	[0170.136] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0170.136] lstrlenW (lpString=".hdr") returned 4
	[0170.136] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0170.136] lstrlenW (lpString=".hpp") returned 4
	[0170.136] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0170.136] lstrlenW (lpString=".hta") returned 4
	[0170.136] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0170.136] lstrlenW (lpString=".htc") returned 4
	[0170.136] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0170.136] lstrlenW (lpString=".htm") returned 4
	[0170.137] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.137] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0170.137] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR") returned 100
	[0170.139] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0170.139] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9e86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0170.139] lstrlenW (lpString="index.html") returned 10
	[0170.140] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.140] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0170.142] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0170.142] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa089, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0170.143] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.143] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1
	[0170.145] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0170.145] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x6f0d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="20170517_Lock_200.gif", cAlternateFileName="201705~1.GIF")) returned 1
	[0170.146] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Back_0001_Static.png", cAlternateFileName="BACK_0~2.PNG")) returned 1
	[0170.176] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.176] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0170.178] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0170.178] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa29c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0170.178] lstrlenW (lpString="index.html") returned 10
	[0170.178] lstrlenW (lpString=".1cd") returned 4
	[0170.178] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0170.178] lstrlenW (lpString=".3ds") returned 4
	[0170.178] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0170.178] lstrlenW (lpString=".3fr") returned 4
	[0170.178] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0170.178] lstrlenW (lpString=".3g2") returned 4
	[0170.178] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0170.178] lstrlenW (lpString=".3gp") returned 4
	[0170.178] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0170.178] lstrlenW (lpString=".7z") returned 3
	[0170.179] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0170.179] lstrlenW (lpString=".accda") returned 6
	[0170.179] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1
	[0170.179] lstrlenW (lpString=".accdb") returned 6
	[0170.179] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1
	[0170.179] lstrlenW (lpString=".accdc") returned 6
	[0170.179] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1
	[0170.179] lstrlenW (lpString=".accde") returned 6
	[0170.179] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1
	[0170.179] lstrlenW (lpString=".accdt") returned 6
	[0170.179] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1
	[0170.179] lstrlenW (lpString=".accdw") returned 6
	[0170.179] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1
	[0170.179] lstrlenW (lpString=".adb") returned 4
	[0170.179] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0170.179] lstrlenW (lpString=".adp") returned 4
	[0170.179] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0170.179] lstrlenW (lpString=".ai") returned 3
	[0170.179] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0170.179] lstrlenW (lpString=".ai3") returned 4
	[0170.179] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0170.179] lstrlenW (lpString=".ai4") returned 4
	[0170.179] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0170.179] lstrlenW (lpString=".ai5") returned 4
	[0170.179] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0170.179] lstrlenW (lpString=".ai6") returned 4
	[0170.179] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0170.179] lstrlenW (lpString=".ai7") returned 4
	[0170.179] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0170.180] lstrlenW (lpString=".ai8") returned 4
	[0170.180] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0170.180] lstrlenW (lpString=".anim") returned 5
	[0170.180] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0170.180] lstrlenW (lpString=".arw") returned 4
	[0170.180] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0170.180] lstrlenW (lpString=".as") returned 3
	[0170.180] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0170.180] lstrlenW (lpString=".asa") returned 4
	[0170.180] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0170.180] lstrlenW (lpString=".asc") returned 4
	[0170.180] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0170.180] lstrlenW (lpString=".ascx") returned 5
	[0170.180] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0170.180] lstrlenW (lpString=".asm") returned 4
	[0170.180] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0170.180] lstrlenW (lpString=".asmx") returned 5
	[0170.180] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0170.180] lstrlenW (lpString=".asp") returned 4
	[0170.180] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0170.180] lstrlenW (lpString=".aspx") returned 5
	[0170.180] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0170.180] lstrlenW (lpString=".asr") returned 4
	[0170.180] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0170.180] lstrlenW (lpString=".asx") returned 4
	[0170.180] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0170.180] lstrlenW (lpString=".avi") returned 4
	[0170.180] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0170.180] lstrlenW (lpString=".avs") returned 4
	[0170.181] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0170.181] lstrlenW (lpString=".backup") returned 7
	[0170.181] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1
	[0170.181] lstrlenW (lpString=".bak") returned 4
	[0170.181] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0170.181] lstrlenW (lpString=".bay") returned 4
	[0170.181] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0170.181] lstrlenW (lpString=".bd") returned 3
	[0170.181] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0170.181] lstrlenW (lpString=".bin") returned 4
	[0170.181] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0170.181] lstrlenW (lpString=".bmp") returned 4
	[0170.181] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0170.181] lstrlenW (lpString=".bz2") returned 4
	[0170.181] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0170.181] lstrlenW (lpString=".c") returned 2
	[0170.181] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0170.181] lstrlenW (lpString=".cdr") returned 4
	[0170.181] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0170.181] lstrlenW (lpString=".cer") returned 4
	[0170.377] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0170.377] lstrlenW (lpString=".cf") returned 3
	[0170.377] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0170.377] lstrlenW (lpString=".cfc") returned 4
	[0170.377] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0170.377] lstrlenW (lpString=".cfm") returned 4
	[0170.377] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0170.377] lstrlenW (lpString=".cfml") returned 5
	[0170.377] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0170.377] lstrlenW (lpString=".cfu") returned 4
	[0170.378] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".chm") returned 4
	[0170.378] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".cin") returned 4
	[0170.378] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".class") returned 6
	[0170.378] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1
	[0170.378] lstrlenW (lpString=".clx") returned 4
	[0170.378] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".config") returned 7
	[0170.378] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1
	[0170.378] lstrlenW (lpString=".cpp") returned 4
	[0170.378] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".cr2") returned 4
	[0170.378] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".crt") returned 4
	[0170.378] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".crw") returned 4
	[0170.378] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".cs") returned 3
	[0170.378] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0170.378] lstrlenW (lpString=".css") returned 4
	[0170.378] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".csv") returned 4
	[0170.378] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".cub") returned 4
	[0170.378] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".dae") returned 4
	[0170.378] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0170.378] lstrlenW (lpString=".dat") returned 4
	[0170.379] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".db") returned 3
	[0170.379] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0170.379] lstrlenW (lpString=".dbf") returned 4
	[0170.379] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".dbx") returned 4
	[0170.379] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".dc3") returned 4
	[0170.379] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".dcm") returned 4
	[0170.379] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".dcr") returned 4
	[0170.379] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".der") returned 4
	[0170.379] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".dib") returned 4
	[0170.379] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".dic") returned 4
	[0170.379] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".dif") returned 4
	[0170.379] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".divx") returned 5
	[0170.379] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0170.379] lstrlenW (lpString=".djvu") returned 5
	[0170.379] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0170.379] lstrlenW (lpString=".dng") returned 4
	[0170.379] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".doc") returned 4
	[0170.379] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0170.379] lstrlenW (lpString=".docm") returned 5
	[0170.380] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0170.380] lstrlenW (lpString=".docx") returned 5
	[0170.380] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0170.380] lstrlenW (lpString=".dot") returned 4
	[0170.380] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0170.380] lstrlenW (lpString=".dotm") returned 5
	[0170.380] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0170.380] lstrlenW (lpString=".dotx") returned 5
	[0170.380] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0170.380] lstrlenW (lpString=".dpx") returned 4
	[0170.380] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0170.380] lstrlenW (lpString=".dqy") returned 4
	[0170.380] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0170.380] lstrlenW (lpString=".dsn") returned 4
	[0170.380] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0170.380] lstrlenW (lpString=".dt") returned 3
	[0170.380] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0170.380] lstrlenW (lpString=".dtd") returned 4
	[0170.380] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0170.380] lstrlenW (lpString=".dwg") returned 4
	[0170.380] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0170.380] lstrlenW (lpString=".dwt") returned 4
	[0170.380] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0170.380] lstrlenW (lpString=".dx") returned 3
	[0170.380] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0170.380] lstrlenW (lpString=".dxf") returned 4
	[0170.380] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0170.381] lstrlenW (lpString=".edml") returned 5
	[0170.381] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0170.381] lstrlenW (lpString=".efd") returned 4
	[0170.381] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0170.381] lstrlenW (lpString=".elf") returned 4
	[0170.381] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0170.381] lstrlenW (lpString=".emf") returned 4
	[0170.381] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0170.381] lstrlenW (lpString=".emz") returned 4
	[0170.381] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0170.381] lstrlenW (lpString=".epf") returned 4
	[0170.381] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0170.381] lstrlenW (lpString=".eps") returned 4
	[0170.381] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0170.381] lstrlenW (lpString=".epsf") returned 5
	[0170.381] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0170.381] lstrlenW (lpString=".epsp") returned 5
	[0170.381] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0170.381] lstrlenW (lpString=".erf") returned 4
	[0170.381] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0170.381] lstrlenW (lpString=".exr") returned 4
	[0170.381] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0170.381] lstrlenW (lpString=".f4v") returned 4
	[0170.381] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0170.381] lstrlenW (lpString=".fido") returned 5
	[0170.381] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0170.381] lstrlenW (lpString=".flm") returned 4
	[0170.381] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0170.381] lstrlenW (lpString=".flv") returned 4
	[0170.382] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0170.382] lstrlenW (lpString=".frm") returned 4
	[0170.382] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0170.382] lstrlenW (lpString=".fxg") returned 4
	[0170.382] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0170.382] lstrlenW (lpString=".geo") returned 4
	[0170.382] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0170.382] lstrlenW (lpString=".gif") returned 4
	[0170.382] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0170.382] lstrlenW (lpString=".grs") returned 4
	[0170.382] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0170.382] lstrlenW (lpString=".gz") returned 3
	[0170.382] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0170.382] lstrlenW (lpString=".h") returned 2
	[0170.382] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0170.382] lstrlenW (lpString=".hdr") returned 4
	[0170.382] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0170.382] lstrlenW (lpString=".hpp") returned 4
	[0170.382] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0170.382] lstrlenW (lpString=".hta") returned 4
	[0170.382] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0170.382] lstrlenW (lpString=".htc") returned 4
	[0170.382] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0170.382] lstrlenW (lpString=".htm") returned 4
	[0170.382] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0170.382] lstrlenW (lpString=".html") returned 5
	[0170.382] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0170.382] lstrlenW (lpString="index.html") returned 10
	[0170.383] lstrlenW (lpString=".money") returned 6
	[0170.383] lstrcmpiW (lpString1=".money", lpString2="x.html") returned -1
	[0170.383] lstrlenW (lpString="index.html") returned 10
	[0170.383] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1
	[0170.383] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1
	[0170.383] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1
	[0170.383] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1
	[0170.383] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1
	[0170.383] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1
	[0170.383] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1
	[0170.383] lstrcmpiW (lpString1="d2.exe", lpString2="index.html") returned -1
	[0170.383] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html") returned 111
	[0170.383] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0170.383] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0170.383] lstrlenW (lpString=".1cd") returned 4
	[0170.383] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0170.383] lstrlenW (lpString=".3ds") returned 4
	[0170.383] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0170.383] lstrlenW (lpString=".3fr") returned 4
	[0170.383] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0170.384] lstrlenW (lpString=".3g2") returned 4
	[0170.384] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0170.384] lstrlenW (lpString=".3gp") returned 4
	[0170.384] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0170.384] lstrlenW (lpString=".7z") returned 3
	[0170.384] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0170.384] lstrlenW (lpString=".accda") returned 6
	[0170.384] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1
	[0170.384] lstrlenW (lpString=".accdb") returned 6
	[0170.384] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1
	[0170.384] lstrlenW (lpString=".accdc") returned 6
	[0170.384] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1
	[0170.384] lstrlenW (lpString=".accde") returned 6
	[0170.384] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1
	[0170.384] lstrlenW (lpString=".accdt") returned 6
	[0170.384] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1
	[0170.384] lstrlenW (lpString=".accdw") returned 6
	[0170.384] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1
	[0170.384] lstrlenW (lpString=".adb") returned 4
	[0170.384] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0170.384] lstrlenW (lpString=".adp") returned 4
	[0170.384] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0170.384] lstrlenW (lpString=".ai") returned 3
	[0170.384] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0170.384] lstrlenW (lpString=".ai3") returned 4
	[0170.384] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0170.384] lstrlenW (lpString=".ai4") returned 4
	[0170.384] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0170.385] lstrlenW (lpString=".ai5") returned 4
	[0170.385] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0170.385] lstrlenW (lpString=".ai6") returned 4
	[0170.385] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0170.385] lstrlenW (lpString=".ai7") returned 4
	[0170.385] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0170.385] lstrlenW (lpString=".ai8") returned 4
	[0170.385] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0170.385] lstrlenW (lpString=".anim") returned 5
	[0170.385] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0170.385] lstrlenW (lpString=".arw") returned 4
	[0170.385] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0170.385] lstrlenW (lpString=".as") returned 3
	[0170.385] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0170.385] lstrlenW (lpString=".asa") returned 4
	[0170.385] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0170.385] lstrlenW (lpString=".asc") returned 4
	[0170.385] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0170.385] lstrlenW (lpString=".ascx") returned 5
	[0170.385] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0170.386] lstrlenW (lpString=".asm") returned 4
	[0170.386] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0170.386] lstrlenW (lpString=".asmx") returned 5
	[0170.386] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0170.386] lstrlenW (lpString=".asp") returned 4
	[0170.386] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0170.386] lstrlenW (lpString=".aspx") returned 5
	[0170.386] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0170.386] lstrlenW (lpString=".asr") returned 4
	[0170.386] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0170.386] lstrlenW (lpString=".asx") returned 4
	[0170.386] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0170.386] lstrlenW (lpString=".avi") returned 4
	[0170.386] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0170.386] lstrlenW (lpString=".avs") returned 4
	[0170.386] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0170.386] lstrlenW (lpString=".backup") returned 7
	[0170.386] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1
	[0170.386] lstrlenW (lpString=".bak") returned 4
	[0170.386] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0170.386] lstrlenW (lpString=".bay") returned 4
	[0170.386] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0170.386] lstrlenW (lpString=".bd") returned 3
	[0170.386] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0170.386] lstrlenW (lpString=".bin") returned 4
	[0170.386] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0170.386] lstrlenW (lpString=".bmp") returned 4
	[0170.386] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0170.386] lstrlenW (lpString=".bz2") returned 4
	[0170.386] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0170.387] lstrlenW (lpString=".c") returned 2
	[0170.387] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0170.387] lstrlenW (lpString=".cdr") returned 4
	[0170.387] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0170.387] lstrlenW (lpString=".cer") returned 4
	[0170.387] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0170.387] lstrlenW (lpString=".cf") returned 3
	[0170.387] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0170.387] lstrlenW (lpString=".cfc") returned 4
	[0170.387] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0170.387] lstrlenW (lpString=".cfm") returned 4
	[0170.387] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0170.387] lstrlenW (lpString=".cfml") returned 5
	[0170.387] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0170.387] lstrlenW (lpString=".cfu") returned 4
	[0170.387] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0170.387] lstrlenW (lpString=".chm") returned 4
	[0170.387] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0170.387] lstrlenW (lpString=".cin") returned 4
	[0170.387] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0170.387] lstrlenW (lpString=".class") returned 6
	[0170.387] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1
	[0170.387] lstrlenW (lpString=".clx") returned 4
	[0170.387] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0170.387] lstrlenW (lpString=".config") returned 7
	[0170.387] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1
	[0170.388] lstrlenW (lpString=".cpp") returned 4
	[0170.388] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".cr2") returned 4
	[0170.388] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".crt") returned 4
	[0170.388] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".crw") returned 4
	[0170.388] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".cs") returned 3
	[0170.388] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0170.388] lstrlenW (lpString=".css") returned 4
	[0170.388] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".csv") returned 4
	[0170.388] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".cub") returned 4
	[0170.388] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".dae") returned 4
	[0170.388] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".dat") returned 4
	[0170.388] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".db") returned 3
	[0170.388] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0170.388] lstrlenW (lpString=".dbf") returned 4
	[0170.388] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".dbx") returned 4
	[0170.388] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".dc3") returned 4
	[0170.388] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0170.388] lstrlenW (lpString=".dcm") returned 4
	[0170.388] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0170.389] lstrlenW (lpString=".dcr") returned 4
	[0170.389] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0170.389] lstrlenW (lpString=".der") returned 4
	[0170.389] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0170.389] lstrlenW (lpString=".dib") returned 4
	[0170.389] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0170.389] lstrlenW (lpString=".dic") returned 4
	[0170.389] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0170.389] lstrlenW (lpString=".dif") returned 4
	[0170.389] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0170.389] lstrlenW (lpString=".divx") returned 5
	[0170.389] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0170.389] lstrlenW (lpString=".djvu") returned 5
	[0170.389] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0170.389] lstrlenW (lpString=".dng") returned 4
	[0170.389] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0170.389] lstrlenW (lpString=".doc") returned 4
	[0170.389] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0170.389] lstrlenW (lpString=".docm") returned 5
	[0170.389] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0170.389] lstrlenW (lpString=".docx") returned 5
	[0170.389] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0170.389] lstrlenW (lpString=".dot") returned 4
	[0170.389] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0170.389] lstrlenW (lpString=".dotm") returned 5
	[0170.389] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0170.389] lstrlenW (lpString=".dotx") returned 5
	[0170.389] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0170.389] lstrlenW (lpString=".dpx") returned 4
	[0170.389] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".dqy") returned 4
	[0170.390] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".dsn") returned 4
	[0170.390] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".dt") returned 3
	[0170.390] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0170.390] lstrlenW (lpString=".dtd") returned 4
	[0170.390] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".dwg") returned 4
	[0170.390] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".dwt") returned 4
	[0170.390] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".dx") returned 3
	[0170.390] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0170.390] lstrlenW (lpString=".dxf") returned 4
	[0170.390] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".edml") returned 5
	[0170.390] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0170.390] lstrlenW (lpString=".efd") returned 4
	[0170.390] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".elf") returned 4
	[0170.390] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".emf") returned 4
	[0170.390] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".emz") returned 4
	[0170.390] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".epf") returned 4
	[0170.390] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0170.390] lstrlenW (lpString=".eps") returned 4
	[0170.390] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0170.391] lstrlenW (lpString=".epsf") returned 5
	[0170.391] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0170.391] lstrlenW (lpString=".epsp") returned 5
	[0170.391] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0170.391] lstrlenW (lpString=".erf") returned 4
	[0170.391] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0170.391] lstrlenW (lpString=".exr") returned 4
	[0170.391] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0170.391] lstrlenW (lpString=".f4v") returned 4
	[0170.391] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0170.391] lstrlenW (lpString=".fido") returned 5
	[0170.391] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0170.391] lstrlenW (lpString=".flm") returned 4
	[0170.391] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0170.391] lstrlenW (lpString=".flv") returned 4
	[0170.391] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0170.391] lstrlenW (lpString=".frm") returned 4
	[0170.391] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0170.391] lstrlenW (lpString=".fxg") returned 4
	[0170.391] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0170.391] lstrlenW (lpString=".geo") returned 4
	[0170.391] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0170.391] lstrlenW (lpString=".gif") returned 4
	[0170.391] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0170.391] lstrlenW (lpString=".grs") returned 4
	[0170.391] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0170.391] lstrlenW (lpString=".gz") returned 3
	[0170.391] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0170.391] lstrlenW (lpString=".h") returned 2
	[0170.391] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0170.392] lstrlenW (lpString=".hdr") returned 4
	[0170.392] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0170.392] lstrlenW (lpString=".hpp") returned 4
	[0170.392] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0170.392] lstrlenW (lpString=".hta") returned 4
	[0170.392] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0170.392] lstrlenW (lpString=".htc") returned 4
	[0170.392] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0170.392] lstrlenW (lpString=".htm") returned 4
	[0170.393] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.393] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0170.393] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU") returned 100
	[0170.394] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0170.395] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xdc59, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0170.395] lstrlenW (lpString="index.html") returned 10
	[0170.395] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0170.396] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.396] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0170.396] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK") returned 100
	[0170.396] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK") returned 1
	[0170.396] lstrlenW (lpString="sk-SK") returned 5
	[0170.396] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sk-SK") returned -1
	[0170.396] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x451cfe8
	[0170.396] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK") returned 100
	[0170.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\*", lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e703b0
	[0170.399] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0170.399] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0170.399] lstrlenW (lpString="index.html") returned 10
	[0170.399] lstrlenW (lpString=".1cd") returned 4
	[0170.399] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0170.399] lstrlenW (lpString=".3ds") returned 4
	[0170.399] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0170.399] lstrlenW (lpString=".3fr") returned 4
	[0170.399] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0170.399] lstrlenW (lpString=".3g2") returned 4
	[0170.399] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0170.399] lstrlenW (lpString=".3gp") returned 4
	[0170.399] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0170.399] lstrlenW (lpString=".7z") returned 3
	[0170.399] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0170.399] lstrlenW (lpString=".accda") returned 6
	[0170.399] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1
	[0170.399] lstrlenW (lpString=".accdb") returned 6
	[0170.399] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1
	[0170.399] lstrlenW (lpString=".accdc") returned 6
	[0170.399] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1
	[0170.399] lstrlenW (lpString=".accde") returned 6
	[0170.399] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1
	[0170.400] lstrlenW (lpString=".accdt") returned 6
	[0170.400] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1
	[0170.400] lstrlenW (lpString=".accdw") returned 6
	[0170.400] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1
	[0170.400] lstrlenW (lpString=".adb") returned 4
	[0170.400] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0170.400] lstrlenW (lpString=".adp") returned 4
	[0170.400] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0170.400] lstrlenW (lpString=".ai") returned 3
	[0170.400] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0170.400] lstrlenW (lpString=".ai3") returned 4
	[0170.400] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0170.400] lstrlenW (lpString=".ai4") returned 4
	[0170.400] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0170.400] lstrlenW (lpString=".ai5") returned 4
	[0170.400] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0170.400] lstrlenW (lpString=".ai6") returned 4
	[0170.400] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0170.400] lstrlenW (lpString=".ai7") returned 4
	[0170.400] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0170.400] lstrlenW (lpString=".ai8") returned 4
	[0170.400] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0170.400] lstrlenW (lpString=".anim") returned 5
	[0170.400] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0170.400] lstrlenW (lpString=".arw") returned 4
	[0170.400] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0170.400] lstrlenW (lpString=".as") returned 3
	[0170.400] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0170.401] lstrlenW (lpString=".asa") returned 4
	[0170.401] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0170.401] lstrlenW (lpString=".asc") returned 4
	[0170.401] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0170.401] lstrlenW (lpString=".ascx") returned 5
	[0170.401] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0170.401] lstrlenW (lpString=".asm") returned 4
	[0170.401] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0170.401] lstrlenW (lpString=".asmx") returned 5
	[0170.401] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0170.401] lstrlenW (lpString=".asp") returned 4
	[0170.401] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0170.401] lstrlenW (lpString=".aspx") returned 5
	[0170.401] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0170.401] lstrlenW (lpString=".asr") returned 4
	[0170.401] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0170.401] lstrlenW (lpString=".asx") returned 4
	[0170.401] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0170.401] lstrlenW (lpString=".avi") returned 4
	[0170.401] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0170.401] lstrlenW (lpString=".avs") returned 4
	[0170.401] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0170.401] lstrlenW (lpString=".backup") returned 7
	[0170.401] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1
	[0170.401] lstrlenW (lpString=".bak") returned 4
	[0170.401] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0170.401] lstrlenW (lpString=".bay") returned 4
	[0170.401] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0170.402] lstrlenW (lpString=".bd") returned 3
	[0170.402] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0170.402] lstrlenW (lpString=".bin") returned 4
	[0170.402] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0170.402] lstrlenW (lpString=".bmp") returned 4
	[0170.402] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0170.402] lstrlenW (lpString=".bz2") returned 4
	[0170.402] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0170.402] lstrlenW (lpString=".c") returned 2
	[0170.402] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0170.402] lstrlenW (lpString=".cdr") returned 4
	[0170.402] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0170.402] lstrlenW (lpString=".cer") returned 4
	[0170.402] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0170.402] lstrlenW (lpString=".cf") returned 3
	[0170.402] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0170.402] lstrlenW (lpString=".cfc") returned 4
	[0170.402] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0170.402] lstrlenW (lpString=".cfm") returned 4
	[0170.402] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0170.402] lstrlenW (lpString=".cfml") returned 5
	[0170.402] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0170.402] lstrlenW (lpString=".cfu") returned 4
	[0170.402] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0170.402] lstrlenW (lpString=".chm") returned 4
	[0170.402] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0170.402] lstrlenW (lpString=".cin") returned 4
	[0170.403] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0170.403] lstrlenW (lpString=".class") returned 6
	[0170.403] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1
	[0170.403] lstrlenW (lpString=".clx") returned 4
	[0170.403] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0170.403] lstrlenW (lpString=".config") returned 7
	[0170.403] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1
	[0170.403] lstrlenW (lpString=".cpp") returned 4
	[0170.403] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0170.403] lstrlenW (lpString=".cr2") returned 4
	[0170.403] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0170.403] lstrlenW (lpString=".crt") returned 4
	[0170.403] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0170.403] lstrlenW (lpString=".crw") returned 4
	[0170.403] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0170.403] lstrlenW (lpString=".cs") returned 3
	[0170.403] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0170.403] lstrlenW (lpString=".css") returned 4
	[0170.403] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0170.403] lstrlenW (lpString=".csv") returned 4
	[0170.403] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0170.403] lstrlenW (lpString=".cub") returned 4
	[0170.403] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0170.403] lstrlenW (lpString=".dae") returned 4
	[0170.403] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0170.403] lstrlenW (lpString=".dat") returned 4
	[0170.403] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0170.403] lstrlenW (lpString=".db") returned 3
	[0170.404] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0170.404] lstrlenW (lpString=".dbf") returned 4
	[0170.404] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0170.404] lstrlenW (lpString=".dbx") returned 4
	[0170.404] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0170.404] lstrlenW (lpString=".dc3") returned 4
	[0170.404] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0170.404] lstrlenW (lpString=".dcm") returned 4
	[0170.404] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0170.404] lstrlenW (lpString=".dcr") returned 4
	[0170.404] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0170.404] lstrlenW (lpString=".der") returned 4
	[0170.404] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0170.404] lstrlenW (lpString=".dib") returned 4
	[0170.404] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0170.404] lstrlenW (lpString=".dic") returned 4
	[0170.404] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0170.404] lstrlenW (lpString=".dif") returned 4
	[0170.404] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0170.404] lstrlenW (lpString=".divx") returned 5
	[0170.404] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0170.404] lstrlenW (lpString=".djvu") returned 5
	[0170.404] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0170.404] lstrlenW (lpString=".dng") returned 4
	[0170.404] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0170.404] lstrlenW (lpString=".doc") returned 4
	[0170.404] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0170.404] lstrlenW (lpString=".docm") returned 5
	[0170.405] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0170.405] lstrlenW (lpString=".docx") returned 5
	[0170.405] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0170.405] lstrlenW (lpString=".dot") returned 4
	[0170.405] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0170.405] lstrlenW (lpString=".dotm") returned 5
	[0170.405] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0170.405] lstrlenW (lpString=".dotx") returned 5
	[0170.405] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0170.405] lstrlenW (lpString=".dpx") returned 4
	[0170.405] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0170.405] lstrlenW (lpString=".dqy") returned 4
	[0170.405] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0170.405] lstrlenW (lpString=".dsn") returned 4
	[0170.405] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0170.405] lstrlenW (lpString=".dt") returned 3
	[0170.405] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0170.405] lstrlenW (lpString=".dtd") returned 4
	[0170.405] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0170.405] lstrlenW (lpString=".dwg") returned 4
	[0170.405] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0170.405] lstrlenW (lpString=".dwt") returned 4
	[0170.405] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0170.405] lstrlenW (lpString=".dx") returned 3
	[0170.406] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0170.406] lstrlenW (lpString=".dxf") returned 4
	[0170.406] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0170.406] lstrlenW (lpString=".edml") returned 5
	[0170.406] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0170.406] lstrlenW (lpString=".efd") returned 4
	[0170.406] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0170.406] lstrlenW (lpString=".elf") returned 4
	[0170.406] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0170.406] lstrlenW (lpString=".emf") returned 4
	[0170.406] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0170.406] lstrlenW (lpString=".emz") returned 4
	[0170.406] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0170.406] lstrlenW (lpString=".epf") returned 4
	[0170.406] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0170.406] lstrlenW (lpString=".eps") returned 4
	[0170.406] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0170.406] lstrlenW (lpString=".epsf") returned 5
	[0170.406] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0170.406] lstrlenW (lpString=".epsp") returned 5
	[0170.406] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0170.406] lstrlenW (lpString=".erf") returned 4
	[0170.406] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0170.406] lstrlenW (lpString=".exr") returned 4
	[0170.406] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0170.406] lstrlenW (lpString=".f4v") returned 4
	[0170.406] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0170.406] lstrlenW (lpString=".fido") returned 5
	[0170.406] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0170.407] lstrlenW (lpString=".flm") returned 4
	[0170.407] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0170.407] lstrlenW (lpString=".flv") returned 4
	[0170.407] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0170.407] lstrlenW (lpString=".frm") returned 4
	[0170.407] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0170.407] lstrlenW (lpString=".fxg") returned 4
	[0170.407] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0170.407] lstrlenW (lpString=".geo") returned 4
	[0170.407] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0170.407] lstrlenW (lpString=".gif") returned 4
	[0170.407] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0170.407] lstrlenW (lpString=".grs") returned 4
	[0170.407] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0170.407] lstrlenW (lpString=".gz") returned 3
	[0170.407] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0170.407] lstrlenW (lpString=".h") returned 2
	[0170.407] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0170.407] lstrlenW (lpString=".hdr") returned 4
	[0170.407] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0170.407] lstrlenW (lpString=".hpp") returned 4
	[0170.407] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0170.407] lstrlenW (lpString=".hta") returned 4
	[0170.407] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0170.408] lstrlenW (lpString=".htc") returned 4
	[0170.408] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0170.408] lstrlenW (lpString=".htm") returned 4
	[0170.408] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0170.408] lstrlenW (lpString=".html") returned 5
	[0170.408] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0170.408] lstrlenW (lpString="index.html") returned 10
	[0170.408] lstrlenW (lpString=".money") returned 6
	[0170.408] lstrcmpiW (lpString1=".money", lpString2="x.html") returned -1
	[0170.408] lstrlenW (lpString="index.html") returned 10
	[0170.408] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1
	[0170.408] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1
	[0170.408] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1
	[0170.408] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1
	[0170.408] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1
	[0170.408] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1
	[0170.408] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1
	[0170.408] lstrcmpiW (lpString1="d2.exe", lpString2="index.html") returned -1
	[0170.408] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html") returned 111
	[0170.408] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0170.408] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0170.408] lstrlenW (lpString=".1cd") returned 4
	[0170.408] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0170.408] lstrlenW (lpString=".3ds") returned 4
	[0170.409] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0170.409] lstrlenW (lpString=".3fr") returned 4
	[0170.409] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0170.409] lstrlenW (lpString=".3g2") returned 4
	[0170.409] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0170.409] lstrlenW (lpString=".3gp") returned 4
	[0170.409] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0170.409] lstrlenW (lpString=".7z") returned 3
	[0170.409] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0170.409] lstrlenW (lpString=".accda") returned 6
	[0170.409] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1
	[0170.409] lstrlenW (lpString=".accdb") returned 6
	[0170.409] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1
	[0170.409] lstrlenW (lpString=".accdc") returned 6
	[0170.409] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1
	[0170.409] lstrlenW (lpString=".accde") returned 6
	[0170.409] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1
	[0170.409] lstrlenW (lpString=".accdt") returned 6
	[0170.409] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1
	[0170.409] lstrlenW (lpString=".accdw") returned 6
	[0170.409] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1
	[0170.409] lstrlenW (lpString=".adb") returned 4
	[0170.409] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0170.409] lstrlenW (lpString=".adp") returned 4
	[0170.409] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0170.409] lstrlenW (lpString=".ai") returned 3
	[0170.409] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0170.409] lstrlenW (lpString=".ai3") returned 4
	[0170.410] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0170.410] lstrlenW (lpString=".ai4") returned 4
	[0170.410] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0170.410] lstrlenW (lpString=".ai5") returned 4
	[0170.410] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0170.410] lstrlenW (lpString=".ai6") returned 4
	[0170.410] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0170.410] lstrlenW (lpString=".ai7") returned 4
	[0170.410] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0170.410] lstrlenW (lpString=".ai8") returned 4
	[0170.410] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0170.410] lstrlenW (lpString=".anim") returned 5
	[0170.410] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0170.410] lstrlenW (lpString=".arw") returned 4
	[0170.410] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0170.410] lstrlenW (lpString=".as") returned 3
	[0170.410] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0170.410] lstrlenW (lpString=".asa") returned 4
	[0170.410] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0170.410] lstrlenW (lpString=".asc") returned 4
	[0170.410] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0170.410] lstrlenW (lpString=".ascx") returned 5
	[0170.410] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0170.410] lstrlenW (lpString=".asm") returned 4
	[0170.410] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0170.410] lstrlenW (lpString=".asmx") returned 5
	[0170.410] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0170.410] lstrlenW (lpString=".asp") returned 4
	[0170.410] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0170.411] lstrlenW (lpString=".aspx") returned 5
	[0170.411] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0170.411] lstrlenW (lpString=".asr") returned 4
	[0170.411] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0170.411] lstrlenW (lpString=".asx") returned 4
	[0170.411] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0170.411] lstrlenW (lpString=".avi") returned 4
	[0170.411] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0170.411] lstrlenW (lpString=".avs") returned 4
	[0170.411] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0170.411] lstrlenW (lpString=".backup") returned 7
	[0170.411] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1
	[0170.411] lstrlenW (lpString=".bak") returned 4
	[0170.411] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0170.411] lstrlenW (lpString=".bay") returned 4
	[0170.411] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0170.411] lstrlenW (lpString=".bd") returned 3
	[0170.411] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0170.411] lstrlenW (lpString=".bin") returned 4
	[0170.411] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0170.411] lstrlenW (lpString=".bmp") returned 4
	[0170.411] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0170.411] lstrlenW (lpString=".bz2") returned 4
	[0170.411] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0170.411] lstrlenW (lpString=".c") returned 2
	[0170.411] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0170.411] lstrlenW (lpString=".cdr") returned 4
	[0170.411] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0170.412] lstrlenW (lpString=".cer") returned 4
	[0170.412] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0170.412] lstrlenW (lpString=".cf") returned 3
	[0170.412] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0170.412] lstrlenW (lpString=".cfc") returned 4
	[0170.412] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0170.412] lstrlenW (lpString=".cfm") returned 4
	[0170.412] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0170.412] lstrlenW (lpString=".cfml") returned 5
	[0170.412] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0170.412] lstrlenW (lpString=".cfu") returned 4
	[0170.412] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0170.412] lstrlenW (lpString=".chm") returned 4
	[0170.412] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0170.412] lstrlenW (lpString=".cin") returned 4
	[0170.412] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0170.412] lstrlenW (lpString=".class") returned 6
	[0170.412] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1
	[0170.412] lstrlenW (lpString=".clx") returned 4
	[0170.412] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0170.412] lstrlenW (lpString=".config") returned 7
	[0170.412] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1
	[0170.412] lstrlenW (lpString=".cpp") returned 4
	[0170.412] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0170.921] lstrlenW (lpString=".cr2") returned 4
	[0170.921] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0170.921] lstrlenW (lpString=".crt") returned 4
	[0170.921] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0170.921] lstrlenW (lpString=".crw") returned 4
	[0170.921] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0170.921] lstrlenW (lpString=".cs") returned 3
	[0170.921] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0170.921] lstrlenW (lpString=".css") returned 4
	[0170.921] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0170.921] lstrlenW (lpString=".csv") returned 4
	[0170.921] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0170.921] lstrlenW (lpString=".cub") returned 4
	[0170.922] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0170.922] lstrlenW (lpString=".dae") returned 4
	[0170.922] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0170.922] lstrlenW (lpString=".dat") returned 4
	[0170.922] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0170.922] lstrlenW (lpString=".db") returned 3
	[0170.922] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0170.922] lstrlenW (lpString=".dbf") returned 4
	[0170.922] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0170.922] lstrlenW (lpString=".dbx") returned 4
	[0170.922] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0170.922] lstrlenW (lpString=".dc3") returned 4
	[0170.922] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0170.922] lstrlenW (lpString=".dcm") returned 4
	[0170.922] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0170.922] lstrlenW (lpString=".dcr") returned 4
	[0170.922] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0170.922] lstrlenW (lpString=".der") returned 4
	[0170.922] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0170.922] lstrlenW (lpString=".dib") returned 4
	[0170.922] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0170.922] lstrlenW (lpString=".dic") returned 4
	[0170.922] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0170.922] lstrlenW (lpString=".dif") returned 4
	[0170.923] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0170.923] lstrlenW (lpString=".divx") returned 5
	[0170.923] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0170.923] lstrlenW (lpString=".djvu") returned 5
	[0170.923] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0170.923] lstrlenW (lpString=".dng") returned 4
	[0170.923] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0170.923] lstrlenW (lpString=".doc") returned 4
	[0170.923] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0170.923] lstrlenW (lpString=".docm") returned 5
	[0170.923] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0170.923] lstrlenW (lpString=".docx") returned 5
	[0170.923] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0170.923] lstrlenW (lpString=".dot") returned 4
	[0170.923] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0170.923] lstrlenW (lpString=".dotm") returned 5
	[0170.923] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0170.923] lstrlenW (lpString=".dotx") returned 5
	[0170.923] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0170.923] lstrlenW (lpString=".dpx") returned 4
	[0170.923] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0170.923] lstrlenW (lpString=".dqy") returned 4
	[0170.923] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0170.923] lstrlenW (lpString=".dsn") returned 4
	[0170.923] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0170.923] lstrlenW (lpString=".dt") returned 3
	[0170.923] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0170.923] lstrlenW (lpString=".dtd") returned 4
	[0170.923] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0170.924] lstrlenW (lpString=".dwg") returned 4
	[0170.924] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0170.924] lstrlenW (lpString=".dwt") returned 4
	[0170.924] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0170.924] lstrlenW (lpString=".dx") returned 3
	[0170.924] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0170.924] lstrlenW (lpString=".dxf") returned 4
	[0170.924] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0170.924] lstrlenW (lpString=".edml") returned 5
	[0170.924] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0170.924] lstrlenW (lpString=".efd") returned 4
	[0170.924] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0170.924] lstrlenW (lpString=".elf") returned 4
	[0170.924] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0170.924] lstrlenW (lpString=".emf") returned 4
	[0170.924] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0170.924] lstrlenW (lpString=".emz") returned 4
	[0170.924] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0170.924] lstrlenW (lpString=".epf") returned 4
	[0170.924] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0170.924] lstrlenW (lpString=".eps") returned 4
	[0170.924] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0170.924] lstrlenW (lpString=".epsf") returned 5
	[0170.924] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0170.924] lstrlenW (lpString=".epsp") returned 5
	[0170.924] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0170.924] lstrlenW (lpString=".erf") returned 4
	[0170.924] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0170.924] lstrlenW (lpString=".exr") returned 4
	[0170.925] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0170.925] lstrlenW (lpString=".f4v") returned 4
	[0170.925] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0170.925] lstrlenW (lpString=".fido") returned 5
	[0170.925] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0170.925] lstrlenW (lpString=".flm") returned 4
	[0170.925] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0170.925] lstrlenW (lpString=".flv") returned 4
	[0170.925] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0170.925] lstrlenW (lpString=".frm") returned 4
	[0170.925] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0170.925] lstrlenW (lpString=".fxg") returned 4
	[0170.925] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0170.925] lstrlenW (lpString=".geo") returned 4
	[0170.925] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0170.925] lstrlenW (lpString=".gif") returned 4
	[0170.925] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0170.925] lstrlenW (lpString=".grs") returned 4
	[0170.925] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0170.925] lstrlenW (lpString=".gz") returned 3
	[0170.925] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0170.925] lstrlenW (lpString=".h") returned 2
	[0170.925] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0170.925] lstrlenW (lpString=".hdr") returned 4
	[0170.925] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0170.925] lstrlenW (lpString=".hpp") returned 4
	[0170.925] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0170.925] lstrlenW (lpString=".hta") returned 4
	[0170.926] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.926] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0170.927] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI") returned 100
	[0170.930] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.930] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1
	[0170.933] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.933] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0170.936] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.936] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1
	[0170.939] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.939] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0170.941] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.941] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0170.944] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.944] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1
	[0170.948] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.948] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0170.951] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.951] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0170.954] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.954] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0170.957] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0170.957] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0170.957] FindClose (in: hFindFile=0x3e70f30 | out: hFindFile=0x3e70f30) returned 1
	[0170.957] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0170.957] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1
	[0170.957] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0170.957] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0
	[0170.957] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0170.957] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0170.959] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0
	[0170.959] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0170.959] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.232] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23927120, ftCreationTime.dwHighDateTime=0x1d53142, ftLastAccessTime.dwLowDateTime=0x93a573f0, ftLastAccessTime.dwHighDateTime=0x1d579d0, ftLastWriteTime.dwLowDateTime=0x93a573f0, ftLastWriteTime.dwHighDateTime=0x1d579d0, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="crest-boating.exe", cAlternateFileName="CREST-~1.EXE")) returned 1
	[0171.278] lstrlenW (lpString="crest-boating.exe") returned 17
	[0171.278] lstrlenW (lpString=".1cd") returned 4
	[0171.278] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0171.278] lstrlenW (lpString=".3ds") returned 4
	[0171.279] lstrcmpiW (lpString1=".3ds", lpString2=".exe") returned -1
	[0171.279] lstrlenW (lpString=".3fr") returned 4
	[0171.279] lstrcmpiW (lpString1=".3fr", lpString2=".exe") returned -1
	[0171.279] lstrlenW (lpString=".3g2") returned 4
	[0171.279] lstrcmpiW (lpString1=".3g2", lpString2=".exe") returned -1
	[0171.279] lstrlenW (lpString=".3gp") returned 4
	[0171.279] lstrcmpiW (lpString1=".3gp", lpString2=".exe") returned -1
	[0171.279] lstrlenW (lpString=".7z") returned 3
	[0171.279] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0171.279] lstrlenW (lpString=".accda") returned 6
	[0171.279] lstrcmpiW (lpString1=".accda", lpString2="ng.exe") returned -1
	[0171.279] lstrlenW (lpString=".accdb") returned 6
	[0171.279] lstrcmpiW (lpString1=".accdb", lpString2="ng.exe") returned -1
	[0171.279] lstrlenW (lpString=".accdc") returned 6
	[0171.279] lstrcmpiW (lpString1=".accdc", lpString2="ng.exe") returned -1
	[0171.279] lstrlenW (lpString=".accde") returned 6
	[0171.279] lstrcmpiW (lpString1=".accde", lpString2="ng.exe") returned -1
	[0171.279] lstrlenW (lpString=".accdt") returned 6
	[0171.279] lstrcmpiW (lpString1=".accdt", lpString2="ng.exe") returned -1
	[0171.279] lstrlenW (lpString=".accdw") returned 6
	[0171.279] lstrcmpiW (lpString1=".accdw", lpString2="ng.exe") returned -1
	[0171.279] lstrlenW (lpString=".adb") returned 4
	[0171.279] lstrcmpiW (lpString1=".adb", lpString2=".exe") returned -1
	[0171.279] lstrlenW (lpString=".adp") returned 4
	[0171.279] lstrcmpiW (lpString1=".adp", lpString2=".exe") returned -1
	[0171.279] lstrlenW (lpString=".ai") returned 3
	[0171.279] lstrcmpiW (lpString1=".ai", lpString2="exe") returned -1
	[0171.279] lstrlenW (lpString=".ai3") returned 4
	[0171.280] lstrcmpiW (lpString1=".ai3", lpString2=".exe") returned -1
	[0171.280] lstrlenW (lpString=".ai4") returned 4
	[0171.280] lstrcmpiW (lpString1=".ai4", lpString2=".exe") returned -1
	[0171.280] lstrlenW (lpString=".ai5") returned 4
	[0171.280] lstrcmpiW (lpString1=".ai5", lpString2=".exe") returned -1
	[0171.280] lstrlenW (lpString=".ai6") returned 4
	[0171.280] lstrcmpiW (lpString1=".ai6", lpString2=".exe") returned -1
	[0171.280] lstrlenW (lpString=".ai7") returned 4
	[0171.280] lstrcmpiW (lpString1=".ai7", lpString2=".exe") returned -1
	[0171.280] lstrlenW (lpString=".ai8") returned 4
	[0171.280] lstrcmpiW (lpString1=".ai8", lpString2=".exe") returned -1
	[0171.280] lstrlenW (lpString=".anim") returned 5
	[0171.280] lstrcmpiW (lpString1=".anim", lpString2="g.exe") returned -1
	[0171.280] lstrlenW (lpString=".arw") returned 4
	[0171.280] lstrcmpiW (lpString1=".arw", lpString2=".exe") returned -1
	[0171.280] lstrlenW (lpString=".as") returned 3
	[0171.280] lstrcmpiW (lpString1=".as", lpString2="exe") returned -1
	[0171.280] lstrlenW (lpString=".asa") returned 4
	[0171.280] lstrcmpiW (lpString1=".asa", lpString2=".exe") returned -1
	[0171.280] lstrlenW (lpString=".asc") returned 4
	[0171.280] lstrcmpiW (lpString1=".asc", lpString2=".exe") returned -1
	[0171.280] lstrlenW (lpString=".ascx") returned 5
	[0171.280] lstrcmpiW (lpString1=".ascx", lpString2="g.exe") returned -1
	[0171.280] lstrlenW (lpString=".asm") returned 4
	[0171.280] lstrcmpiW (lpString1=".asm", lpString2=".exe") returned -1
	[0171.280] lstrlenW (lpString=".asmx") returned 5
	[0171.280] lstrcmpiW (lpString1=".asmx", lpString2="g.exe") returned -1
	[0171.280] lstrlenW (lpString=".asp") returned 4
	[0171.281] lstrcmpiW (lpString1=".asp", lpString2=".exe") returned -1
	[0171.281] lstrlenW (lpString=".aspx") returned 5
	[0171.281] lstrcmpiW (lpString1=".aspx", lpString2="g.exe") returned -1
	[0171.281] lstrlenW (lpString=".asr") returned 4
	[0171.281] lstrcmpiW (lpString1=".asr", lpString2=".exe") returned -1
	[0171.281] lstrlenW (lpString=".asx") returned 4
	[0171.281] lstrcmpiW (lpString1=".asx", lpString2=".exe") returned -1
	[0171.281] lstrlenW (lpString=".avi") returned 4
	[0171.281] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1
	[0171.281] lstrlenW (lpString=".avs") returned 4
	[0171.281] lstrcmpiW (lpString1=".avs", lpString2=".exe") returned -1
	[0171.281] lstrlenW (lpString=".backup") returned 7
	[0171.281] lstrcmpiW (lpString1=".backup", lpString2="ing.exe") returned -1
	[0171.281] lstrlenW (lpString=".bak") returned 4
	[0171.281] lstrcmpiW (lpString1=".bak", lpString2=".exe") returned -1
	[0171.281] lstrlenW (lpString=".bay") returned 4
	[0171.281] lstrcmpiW (lpString1=".bay", lpString2=".exe") returned -1
	[0171.281] lstrlenW (lpString=".bd") returned 3
	[0171.281] lstrcmpiW (lpString1=".bd", lpString2="exe") returned -1
	[0171.281] lstrlenW (lpString=".bin") returned 4
	[0171.281] lstrcmpiW (lpString1=".bin", lpString2=".exe") returned -1
	[0171.281] lstrlenW (lpString=".bmp") returned 4
	[0171.281] lstrcmpiW (lpString1=".bmp", lpString2=".exe") returned -1
	[0171.281] lstrlenW (lpString=".bz2") returned 4
	[0171.281] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0171.281] lstrlenW (lpString=".c") returned 2
	[0171.281] lstrcmpiW (lpString1=".c", lpString2="xe") returned -1
	[0171.281] lstrlenW (lpString=".cdr") returned 4
	[0171.281] lstrcmpiW (lpString1=".cdr", lpString2=".exe") returned -1
	[0171.282] lstrlenW (lpString=".cer") returned 4
	[0171.282] lstrcmpiW (lpString1=".cer", lpString2=".exe") returned -1
	[0171.282] lstrlenW (lpString=".cf") returned 3
	[0171.282] lstrcmpiW (lpString1=".cf", lpString2="exe") returned -1
	[0171.282] lstrlenW (lpString=".cfc") returned 4
	[0171.282] lstrcmpiW (lpString1=".cfc", lpString2=".exe") returned -1
	[0171.282] lstrlenW (lpString=".cfm") returned 4
	[0171.282] lstrcmpiW (lpString1=".cfm", lpString2=".exe") returned -1
	[0171.282] lstrlenW (lpString=".cfml") returned 5
	[0171.282] lstrcmpiW (lpString1=".cfml", lpString2="g.exe") returned -1
	[0171.282] lstrlenW (lpString=".cfu") returned 4
	[0171.282] lstrcmpiW (lpString1=".cfu", lpString2=".exe") returned -1
	[0171.282] lstrlenW (lpString=".chm") returned 4
	[0171.282] lstrcmpiW (lpString1=".chm", lpString2=".exe") returned -1
	[0171.282] lstrlenW (lpString=".cin") returned 4
	[0171.282] lstrcmpiW (lpString1=".cin", lpString2=".exe") returned -1
	[0171.282] lstrlenW (lpString=".class") returned 6
	[0171.282] lstrcmpiW (lpString1=".class", lpString2="ng.exe") returned -1
	[0171.282] lstrlenW (lpString=".clx") returned 4
	[0171.282] lstrcmpiW (lpString1=".clx", lpString2=".exe") returned -1
	[0171.282] lstrlenW (lpString=".config") returned 7
	[0171.282] lstrcmpiW (lpString1=".config", lpString2="ing.exe") returned -1
	[0171.282] lstrlenW (lpString=".cpp") returned 4
	[0171.282] lstrcmpiW (lpString1=".cpp", lpString2=".exe") returned -1
	[0171.282] lstrlenW (lpString=".cr2") returned 4
	[0171.282] lstrcmpiW (lpString1=".cr2", lpString2=".exe") returned -1
	[0171.282] lstrlenW (lpString=".crt") returned 4
	[0171.282] lstrcmpiW (lpString1=".crt", lpString2=".exe") returned -1
	[0171.282] lstrlenW (lpString=".crw") returned 4
	[0171.282] lstrcmpiW (lpString1=".crw", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".cs") returned 3
	[0171.283] lstrcmpiW (lpString1=".cs", lpString2="exe") returned -1
	[0171.283] lstrlenW (lpString=".css") returned 4
	[0171.283] lstrcmpiW (lpString1=".css", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".csv") returned 4
	[0171.283] lstrcmpiW (lpString1=".csv", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".cub") returned 4
	[0171.283] lstrcmpiW (lpString1=".cub", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".dae") returned 4
	[0171.283] lstrcmpiW (lpString1=".dae", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".dat") returned 4
	[0171.283] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".db") returned 3
	[0171.283] lstrcmpiW (lpString1=".db", lpString2="exe") returned -1
	[0171.283] lstrlenW (lpString=".dbf") returned 4
	[0171.283] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".dbx") returned 4
	[0171.283] lstrcmpiW (lpString1=".dbx", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".dc3") returned 4
	[0171.283] lstrcmpiW (lpString1=".dc3", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".dcm") returned 4
	[0171.283] lstrcmpiW (lpString1=".dcm", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".dcr") returned 4
	[0171.283] lstrcmpiW (lpString1=".dcr", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".der") returned 4
	[0171.283] lstrcmpiW (lpString1=".der", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".dib") returned 4
	[0171.283] lstrcmpiW (lpString1=".dib", lpString2=".exe") returned -1
	[0171.283] lstrlenW (lpString=".dic") returned 4
	[0171.284] lstrcmpiW (lpString1=".dic", lpString2=".exe") returned -1
	[0171.284] lstrlenW (lpString=".dif") returned 4
	[0171.284] lstrcmpiW (lpString1=".dif", lpString2=".exe") returned -1
	[0171.284] lstrlenW (lpString=".divx") returned 5
	[0171.284] lstrcmpiW (lpString1=".divx", lpString2="g.exe") returned -1
	[0171.284] lstrlenW (lpString=".djvu") returned 5
	[0171.284] lstrcmpiW (lpString1=".djvu", lpString2="g.exe") returned -1
	[0171.284] lstrlenW (lpString=".dng") returned 4
	[0171.284] lstrcmpiW (lpString1=".dng", lpString2=".exe") returned -1
	[0171.284] lstrlenW (lpString=".doc") returned 4
	[0171.284] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0171.284] lstrlenW (lpString=".docm") returned 5
	[0171.284] lstrcmpiW (lpString1=".docm", lpString2="g.exe") returned -1
	[0171.284] lstrlenW (lpString=".docx") returned 5
	[0171.284] lstrcmpiW (lpString1=".docx", lpString2="g.exe") returned -1
	[0171.284] lstrlenW (lpString=".dot") returned 4
	[0171.284] lstrcmpiW (lpString1=".dot", lpString2=".exe") returned -1
	[0171.284] lstrlenW (lpString=".dotm") returned 5
	[0171.284] lstrcmpiW (lpString1=".dotm", lpString2="g.exe") returned -1
	[0171.284] lstrlenW (lpString=".dotx") returned 5
	[0171.284] lstrcmpiW (lpString1=".dotx", lpString2="g.exe") returned -1
	[0171.284] lstrlenW (lpString=".dpx") returned 4
	[0171.284] lstrcmpiW (lpString1=".dpx", lpString2=".exe") returned -1
	[0171.284] lstrlenW (lpString=".dqy") returned 4
	[0171.284] lstrcmpiW (lpString1=".dqy", lpString2=".exe") returned -1
	[0171.284] lstrlenW (lpString=".dsn") returned 4
	[0171.284] lstrcmpiW (lpString1=".dsn", lpString2=".exe") returned -1
	[0171.284] lstrlenW (lpString=".dt") returned 3
	[0171.285] lstrcmpiW (lpString1=".dt", lpString2="exe") returned -1
	[0171.285] lstrlenW (lpString=".dtd") returned 4
	[0171.285] lstrcmpiW (lpString1=".dtd", lpString2=".exe") returned -1
	[0171.285] lstrlenW (lpString=".dwg") returned 4
	[0171.285] lstrcmpiW (lpString1=".dwg", lpString2=".exe") returned -1
	[0171.285] lstrlenW (lpString=".dwt") returned 4
	[0171.285] lstrcmpiW (lpString1=".dwt", lpString2=".exe") returned -1
	[0171.285] lstrlenW (lpString=".dx") returned 3
	[0171.285] lstrcmpiW (lpString1=".dx", lpString2="exe") returned -1
	[0171.285] lstrlenW (lpString=".dxf") returned 4
	[0171.285] lstrcmpiW (lpString1=".dxf", lpString2=".exe") returned -1
	[0171.285] lstrlenW (lpString=".edml") returned 5
	[0171.285] lstrcmpiW (lpString1=".edml", lpString2="g.exe") returned -1
	[0171.285] lstrlenW (lpString=".efd") returned 4
	[0171.285] lstrcmpiW (lpString1=".efd", lpString2=".exe") returned -1
	[0171.285] lstrlenW (lpString=".elf") returned 4
	[0171.285] lstrcmpiW (lpString1=".elf", lpString2=".exe") returned -1
	[0171.285] lstrlenW (lpString=".emf") returned 4
	[0171.285] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1
	[0171.285] lstrlenW (lpString=".emz") returned 4
	[0171.285] lstrcmpiW (lpString1=".emz", lpString2=".exe") returned -1
	[0171.285] lstrlenW (lpString=".epf") returned 4
	[0171.285] lstrcmpiW (lpString1=".epf", lpString2=".exe") returned -1
	[0171.285] lstrlenW (lpString=".eps") returned 4
	[0171.285] lstrcmpiW (lpString1=".eps", lpString2=".exe") returned -1
	[0171.285] lstrlenW (lpString=".epsf") returned 5
	[0171.285] lstrcmpiW (lpString1=".epsf", lpString2="g.exe") returned -1
	[0171.285] lstrlenW (lpString=".epsp") returned 5
	[0171.286] lstrcmpiW (lpString1=".epsp", lpString2="g.exe") returned -1
	[0171.286] lstrlenW (lpString=".erf") returned 4
	[0171.286] lstrcmpiW (lpString1=".erf", lpString2=".exe") returned -1
	[0171.286] lstrlenW (lpString=".exr") returned 4
	[0171.286] lstrcmpiW (lpString1=".exr", lpString2=".exe") returned 1
	[0171.286] lstrlenW (lpString=".f4v") returned 4
	[0171.286] lstrcmpiW (lpString1=".f4v", lpString2=".exe") returned 1
	[0171.286] lstrlenW (lpString=".fido") returned 5
	[0171.286] lstrcmpiW (lpString1=".fido", lpString2="g.exe") returned -1
	[0171.286] lstrlenW (lpString=".flm") returned 4
	[0171.286] lstrcmpiW (lpString1=".flm", lpString2=".exe") returned 1
	[0171.286] lstrlenW (lpString=".flv") returned 4
	[0171.286] lstrcmpiW (lpString1=".flv", lpString2=".exe") returned 1
	[0171.286] lstrlenW (lpString=".frm") returned 4
	[0171.286] lstrcmpiW (lpString1=".frm", lpString2=".exe") returned 1
	[0171.286] lstrlenW (lpString=".fxg") returned 4
	[0171.286] lstrcmpiW (lpString1=".fxg", lpString2=".exe") returned 1
	[0171.286] lstrlenW (lpString=".geo") returned 4
	[0171.286] lstrcmpiW (lpString1=".geo", lpString2=".exe") returned 1
	[0171.286] lstrlenW (lpString=".gif") returned 4
	[0171.286] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1
	[0171.286] lstrlenW (lpString=".grs") returned 4
	[0171.286] lstrcmpiW (lpString1=".grs", lpString2=".exe") returned 1
	[0171.286] lstrlenW (lpString=".gz") returned 3
	[0171.287] lstrcmpiW (lpString1=".gz", lpString2="exe") returned -1
	[0171.287] lstrlenW (lpString=".h") returned 2
	[0171.287] lstrcmpiW (lpString1=".h", lpString2="xe") returned -1
	[0171.287] lstrlenW (lpString=".hdr") returned 4
	[0171.287] lstrcmpiW (lpString1=".hdr", lpString2=".exe") returned 1
	[0171.287] lstrlenW (lpString=".hpp") returned 4
	[0171.287] lstrcmpiW (lpString1=".hpp", lpString2=".exe") returned 1
	[0171.287] lstrlenW (lpString=".hta") returned 4
	[0171.287] lstrcmpiW (lpString1=".hta", lpString2=".exe") returned 1
	[0171.287] lstrlenW (lpString=".htc") returned 4
	[0171.287] lstrcmpiW (lpString1=".htc", lpString2=".exe") returned 1
	[0171.287] lstrlenW (lpString=".htm") returned 4
	[0171.287] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1
	[0171.287] lstrlenW (lpString=".html") returned 5
	[0171.287] lstrcmpiW (lpString1=".html", lpString2="g.exe") returned -1
	[0171.287] lstrlenW (lpString=".icb") returned 4
	[0171.287] lstrcmpiW (lpString1=".icb", lpString2=".exe") returned 1
	[0171.287] lstrlenW (lpString=".ics") returned 4
	[0171.287] lstrcmpiW (lpString1=".ics", lpString2=".exe") returned 1
	[0171.287] lstrlenW (lpString=".iff") returned 4
	[0171.287] lstrcmpiW (lpString1=".iff", lpString2=".exe") returned 1
	[0171.287] lstrlenW (lpString=".inc") returned 4
	[0171.287] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1
	[0171.287] lstrlenW (lpString=".indd") returned 5
	[0171.287] lstrcmpiW (lpString1=".indd", lpString2="g.exe") returned -1
	[0171.287] lstrlenW (lpString=".ini") returned 4
	[0171.287] lstrcmpiW (lpString1=".ini", lpString2=".exe") returned 1
	[0171.287] lstrlenW (lpString=".iqy") returned 4
	[0171.287] lstrcmpiW (lpString1=".iqy", lpString2=".exe") returned 1
	[0171.288] lstrlenW (lpString=".j2c") returned 4
	[0171.288] lstrcmpiW (lpString1=".j2c", lpString2=".exe") returned 1
	[0171.288] lstrlenW (lpString=".j2k") returned 4
	[0171.288] lstrcmpiW (lpString1=".j2k", lpString2=".exe") returned 1
	[0171.288] lstrlenW (lpString=".java") returned 5
	[0171.288] lstrcmpiW (lpString1=".java", lpString2="g.exe") returned -1
	[0171.288] lstrlenW (lpString=".jp2") returned 4
	[0171.288] lstrcmpiW (lpString1=".jp2", lpString2=".exe") returned 1
	[0171.288] lstrlenW (lpString=".jpc") returned 4
	[0171.288] lstrcmpiW (lpString1=".jpc", lpString2=".exe") returned 1
	[0171.288] lstrlenW (lpString=".jpe") returned 4
	[0171.288] lstrcmpiW (lpString1=".jpe", lpString2=".exe") returned 1
	[0171.288] lstrlenW (lpString=".jpeg") returned 5
	[0171.288] lstrcmpiW (lpString1=".jpeg", lpString2="g.exe") returned -1
	[0171.288] lstrlenW (lpString=".jpf") returned 4
	[0171.288] lstrcmpiW (lpString1=".jpf", lpString2=".exe") returned 1
	[0171.288] lstrlenW (lpString=".jpg") returned 4
	[0171.288] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0171.288] lstrlenW (lpString=".jpx") returned 4
	[0171.288] lstrcmpiW (lpString1=".jpx", lpString2=".exe") returned 1
	[0171.288] lstrlenW (lpString=".js") returned 3
	[0171.288] lstrcmpiW (lpString1=".js", lpString2="exe") returned -1
	[0171.288] lstrlenW (lpString=".jsf") returned 4
	[0171.288] lstrcmpiW (lpString1=".jsf", lpString2=".exe") returned 1
	[0171.288] lstrlenW (lpString=".json") returned 5
	[0171.288] lstrcmpiW (lpString1=".json", lpString2="g.exe") returned -1
	[0171.289] lstrlenW (lpString=".jsp") returned 4
	[0171.289] lstrcmpiW (lpString1=".jsp", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".kdc") returned 4
	[0171.289] lstrcmpiW (lpString1=".kdc", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".kmz") returned 4
	[0171.289] lstrcmpiW (lpString1=".kmz", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".kwm") returned 4
	[0171.289] lstrcmpiW (lpString1=".kwm", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".lasso") returned 6
	[0171.289] lstrcmpiW (lpString1=".lasso", lpString2="ng.exe") returned -1
	[0171.289] lstrlenW (lpString=".lbi") returned 4
	[0171.289] lstrcmpiW (lpString1=".lbi", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".lgf") returned 4
	[0171.289] lstrcmpiW (lpString1=".lgf", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".lgp") returned 4
	[0171.289] lstrcmpiW (lpString1=".lgp", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".log") returned 4
	[0171.289] lstrcmpiW (lpString1=".log", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".m1v") returned 4
	[0171.289] lstrcmpiW (lpString1=".m1v", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".m4a") returned 4
	[0171.289] lstrcmpiW (lpString1=".m4a", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".m4v") returned 4
	[0171.289] lstrcmpiW (lpString1=".m4v", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".max") returned 4
	[0171.289] lstrcmpiW (lpString1=".max", lpString2=".exe") returned 1
	[0171.289] lstrlenW (lpString=".md") returned 3
	[0171.290] lstrcmpiW (lpString1=".md", lpString2="exe") returned -1
	[0171.290] lstrlenW (lpString=".mda") returned 4
	[0171.290] lstrcmpiW (lpString1=".mda", lpString2=".exe") returned 1
	[0171.290] lstrlenW (lpString=".mdb") returned 4
	[0171.290] lstrcmpiW (lpString1=".mdb", lpString2=".exe") returned 1
	[0171.290] lstrlenW (lpString=".mde") returned 4
	[0171.290] lstrcmpiW (lpString1=".mde", lpString2=".exe") returned 1
	[0171.290] lstrlenW (lpString=".mdf") returned 4
	[0171.290] lstrcmpiW (lpString1=".mdf", lpString2=".exe") returned 1
	[0171.290] lstrlenW (lpString=".mdw") returned 4
	[0171.290] lstrcmpiW (lpString1=".mdw", lpString2=".exe") returned 1
	[0171.290] lstrlenW (lpString=".mef") returned 4
	[0171.290] lstrcmpiW (lpString1=".mef", lpString2=".exe") returned 1
	[0171.290] lstrlenW (lpString=".mft") returned 4
	[0171.290] lstrcmpiW (lpString1=".mft", lpString2=".exe") returned 1
	[0171.290] lstrlenW (lpString=".mfw") returned 4
	[0171.290] lstrcmpiW (lpString1=".mfw", lpString2=".exe") returned 1
	[0171.290] lstrlenW (lpString=".mht") returned 4
	[0171.290] lstrcmpiW (lpString1=".mht", lpString2=".exe") returned 1
	[0171.290] lstrlenW (lpString=".mhtml") returned 6
	[0171.290] lstrcmpiW (lpString1=".mhtml", lpString2="ng.exe") returned -1
	[0171.290] lstrlenW (lpString=".mka") returned 4
	[0171.290] lstrcmpiW (lpString1=".mka", lpString2=".exe") returned 1
	[0171.290] lstrlenW (lpString=".mkidx") returned 6
	[0171.291] lstrcmpiW (lpString1=".mkidx", lpString2="ng.exe") returned -1
	[0171.291] lstrlenW (lpString=".mkv") returned 4
	[0171.291] lstrcmpiW (lpString1=".mkv", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".mos") returned 4
	[0171.291] lstrcmpiW (lpString1=".mos", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".mov") returned 4
	[0171.291] lstrcmpiW (lpString1=".mov", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".mp3") returned 4
	[0171.291] lstrcmpiW (lpString1=".mp3", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".mp4") returned 4
	[0171.291] lstrcmpiW (lpString1=".mp4", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".mpeg") returned 5
	[0171.291] lstrcmpiW (lpString1=".mpeg", lpString2="g.exe") returned -1
	[0171.291] lstrlenW (lpString=".mpg") returned 4
	[0171.291] lstrcmpiW (lpString1=".mpg", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".mpv") returned 4
	[0171.291] lstrcmpiW (lpString1=".mpv", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".mrw") returned 4
	[0171.291] lstrcmpiW (lpString1=".mrw", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".msg") returned 4
	[0171.291] lstrcmpiW (lpString1=".msg", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".mxl") returned 4
	[0171.291] lstrcmpiW (lpString1=".mxl", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".myd") returned 4
	[0171.291] lstrcmpiW (lpString1=".myd", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".myi") returned 4
	[0171.291] lstrcmpiW (lpString1=".myi", lpString2=".exe") returned 1
	[0171.291] lstrlenW (lpString=".nef") returned 4
	[0171.292] lstrcmpiW (lpString1=".nef", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".nrw") returned 4
	[0171.292] lstrcmpiW (lpString1=".nrw", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".obj") returned 4
	[0171.292] lstrcmpiW (lpString1=".obj", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".odb") returned 4
	[0171.292] lstrcmpiW (lpString1=".odb", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".odc") returned 4
	[0171.292] lstrcmpiW (lpString1=".odc", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".odm") returned 4
	[0171.292] lstrcmpiW (lpString1=".odm", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".odp") returned 4
	[0171.292] lstrcmpiW (lpString1=".odp", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".ods") returned 4
	[0171.292] lstrcmpiW (lpString1=".ods", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".oft") returned 4
	[0171.292] lstrcmpiW (lpString1=".oft", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".one") returned 4
	[0171.292] lstrcmpiW (lpString1=".one", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".onepkg") returned 7
	[0171.292] lstrcmpiW (lpString1=".onepkg", lpString2="ing.exe") returned -1
	[0171.292] lstrlenW (lpString=".onetoc2") returned 8
	[0171.292] lstrcmpiW (lpString1=".onetoc2", lpString2="ting.exe") returned -1
	[0171.292] lstrlenW (lpString=".opt") returned 4
	[0171.292] lstrcmpiW (lpString1=".opt", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".oqy") returned 4
	[0171.292] lstrcmpiW (lpString1=".oqy", lpString2=".exe") returned 1
	[0171.292] lstrlenW (lpString=".orf") returned 4
	[0171.292] lstrcmpiW (lpString1=".orf", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".p12") returned 4
	[0171.293] lstrcmpiW (lpString1=".p12", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".p7b") returned 4
	[0171.293] lstrcmpiW (lpString1=".p7b", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".p7c") returned 4
	[0171.293] lstrcmpiW (lpString1=".p7c", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pam") returned 4
	[0171.293] lstrcmpiW (lpString1=".pam", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pbm") returned 4
	[0171.293] lstrcmpiW (lpString1=".pbm", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pct") returned 4
	[0171.293] lstrcmpiW (lpString1=".pct", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pcx") returned 4
	[0171.293] lstrcmpiW (lpString1=".pcx", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pdd") returned 4
	[0171.293] lstrcmpiW (lpString1=".pdd", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pdf") returned 4
	[0171.293] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pdp") returned 4
	[0171.293] lstrcmpiW (lpString1=".pdp", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pef") returned 4
	[0171.293] lstrcmpiW (lpString1=".pef", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pem") returned 4
	[0171.293] lstrcmpiW (lpString1=".pem", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pff") returned 4
	[0171.293] lstrcmpiW (lpString1=".pff", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pfm") returned 4
	[0171.293] lstrcmpiW (lpString1=".pfm", lpString2=".exe") returned 1
	[0171.293] lstrlenW (lpString=".pfx") returned 4
	[0171.294] lstrcmpiW (lpString1=".pfx", lpString2=".exe") returned 1
	[0171.294] lstrlenW (lpString=".pgm") returned 4
	[0171.294] lstrcmpiW (lpString1=".pgm", lpString2=".exe") returned 1
	[0171.294] lstrlenW (lpString=".php") returned 4
	[0171.294] lstrcmpiW (lpString1=".php", lpString2=".exe") returned 1
	[0171.294] lstrlenW (lpString=".php3") returned 5
	[0171.294] lstrcmpiW (lpString1=".php3", lpString2="g.exe") returned -1
	[0171.294] lstrlenW (lpString=".php4") returned 5
	[0171.294] lstrcmpiW (lpString1=".php4", lpString2="g.exe") returned -1
	[0171.294] lstrlenW (lpString=".php5") returned 5
	[0171.294] lstrcmpiW (lpString1=".php5", lpString2="g.exe") returned -1
	[0171.294] lstrlenW (lpString=".phtml") returned 6
	[0171.294] lstrcmpiW (lpString1=".phtml", lpString2="ng.exe") returned -1
	[0171.294] lstrlenW (lpString=".pict") returned 5
	[0171.294] lstrcmpiW (lpString1=".pict", lpString2="g.exe") returned -1
	[0171.294] lstrlenW (lpString=".pl") returned 3
	[0171.294] lstrcmpiW (lpString1=".pl", lpString2="exe") returned -1
	[0171.294] lstrlenW (lpString=".pls") returned 4
	[0171.294] lstrcmpiW (lpString1=".pls", lpString2=".exe") returned 1
	[0171.294] lstrlenW (lpString=".pm") returned 3
	[0171.294] lstrcmpiW (lpString1=".pm", lpString2="exe") returned -1
	[0171.294] lstrlenW (lpString=".png") returned 4
	[0171.294] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1
	[0171.294] lstrlenW (lpString=".pnm") returned 4
	[0171.294] lstrcmpiW (lpString1=".pnm", lpString2=".exe") returned 1
	[0171.294] lstrlenW (lpString=".pot") returned 4
	[0171.294] lstrcmpiW (lpString1=".pot", lpString2=".exe") returned 1
	[0171.294] lstrlenW (lpString=".potm") returned 5
	[0171.295] lstrcmpiW (lpString1=".potm", lpString2="g.exe") returned -1
	[0171.295] lstrlenW (lpString=".potx") returned 5
	[0171.295] lstrcmpiW (lpString1=".potx", lpString2="g.exe") returned -1
	[0171.295] lstrlenW (lpString=".ppa") returned 4
	[0171.295] lstrcmpiW (lpString1=".ppa", lpString2=".exe") returned 1
	[0171.295] lstrlenW (lpString=".ppam") returned 5
	[0171.295] lstrcmpiW (lpString1=".ppam", lpString2="g.exe") returned -1
	[0171.295] lstrlenW (lpString=".ppm") returned 4
	[0171.295] lstrcmpiW (lpString1=".ppm", lpString2=".exe") returned 1
	[0171.295] lstrlenW (lpString=".pps") returned 4
	[0171.295] lstrcmpiW (lpString1=".pps", lpString2=".exe") returned 1
	[0171.295] lstrlenW (lpString=".ppsm") returned 5
	[0171.295] lstrcmpiW (lpString1=".ppsm", lpString2="g.exe") returned -1
	[0171.295] lstrlenW (lpString=".ppt") returned 4
	[0171.295] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0171.295] lstrlenW (lpString=".pptm") returned 5
	[0171.295] lstrcmpiW (lpString1=".pptm", lpString2="g.exe") returned -1
	[0171.295] lstrlenW (lpString=".pptx") returned 5
	[0171.295] lstrcmpiW (lpString1=".pptx", lpString2="g.exe") returned -1
	[0171.295] lstrlenW (lpString=".prn") returned 4
	[0171.295] lstrcmpiW (lpString1=".prn", lpString2=".exe") returned 1
	[0171.295] lstrlenW (lpString=".ps") returned 3
	[0171.295] lstrcmpiW (lpString1=".ps", lpString2="exe") returned -1
	[0171.295] lstrlenW (lpString=".psb") returned 4
	[0171.295] lstrcmpiW (lpString1=".psb", lpString2=".exe") returned 1
	[0171.295] lstrlenW (lpString=".psd") returned 4
	[0171.295] lstrcmpiW (lpString1=".psd", lpString2=".exe") returned 1
	[0171.295] lstrlenW (lpString=".pst") returned 4
	[0171.296] lstrcmpiW (lpString1=".pst", lpString2=".exe") returned 1
	[0171.296] lstrlenW (lpString=".ptx") returned 4
	[0171.296] lstrcmpiW (lpString1=".ptx", lpString2=".exe") returned 1
	[0171.296] lstrlenW (lpString=".pub") returned 4
	[0171.296] lstrcmpiW (lpString1=".pub", lpString2=".exe") returned 1
	[0171.296] lstrlenW (lpString=".pwm") returned 4
	[0171.296] lstrcmpiW (lpString1=".pwm", lpString2=".exe") returned 1
	[0171.296] lstrlenW (lpString=".pxr") returned 4
	[0171.296] lstrcmpiW (lpString1=".pxr", lpString2=".exe") returned 1
	[0171.296] lstrlenW (lpString=".py") returned 3
	[0171.296] lstrcmpiW (lpString1=".py", lpString2="exe") returned -1
	[0171.296] lstrlenW (lpString=".qt") returned 3
	[0171.296] lstrcmpiW (lpString1=".qt", lpString2="exe") returned -1
	[0171.296] lstrlenW (lpString=".r3d") returned 4
	[0171.296] lstrcmpiW (lpString1=".r3d", lpString2=".exe") returned 1
	[0171.296] lstrlenW (lpString=".raf") returned 4
	[0171.296] lstrcmpiW (lpString1=".raf", lpString2=".exe") returned 1
	[0171.296] lstrlenW (lpString=".rar") returned 4
	[0171.296] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0171.296] lstrlenW (lpString=".raw") returned 4
	[0171.296] lstrcmpiW (lpString1=".raw", lpString2=".exe") returned 1
	[0171.300] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.300] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 1
	[0171.300] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.300] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8f11cc1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x711dc3b4, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0171.304] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.304] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1
	[0171.306] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.306] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x851a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1
	[0171.306] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.306] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde0ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1
	[0171.309] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.309] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe304e38c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe304e38c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3bb568, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsSense.exe", cAlternateFileName="")) returned 1
	[0171.309] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.309] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9f1c58, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xbb9f1c58, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1
	[0171.311] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.311] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f1bd6c0, ftCreationTime.dwHighDateTime=0x1d560d5, ftLastAccessTime.dwLowDateTime=0x4bcaab30, ftLastAccessTime.dwHighDateTime=0x1d5425e, ftLastWriteTime.dwLowDateTime=0x4bcaab30, ftLastWriteTime.dwHighDateTime=0x1d5425e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ix-telephony-religion.exe", cAlternateFileName="IX-TEL~1.EXE")) returned 1
	[0171.311] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.311] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9123675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1
	[0171.316] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.316] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1
	[0171.611] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.611] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1
	[0171.614] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.614] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc4f45c00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1
	[0171.617] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.617] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88286500, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x1c0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1
	[0171.617] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.617] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1
	[0171.618] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.618] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb49bb00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1
	[0171.618] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.618] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xba8610cd, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xba8610cd, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1
	[0171.621] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.621] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1
	[0171.622] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.622] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cb7852, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbe78b154, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x47cb7852, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x448600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1
	[0171.622] lstrlenW (lpString="wordpad.exe") returned 11
	[0171.622] lstrlenW (lpString=".1cd") returned 4
	[0171.622] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0171.622] lstrlenW (lpString=".3ds") returned 4
	[0171.622] lstrcmpiW (lpString1=".3ds", lpString2=".exe") returned -1
	[0171.622] lstrlenW (lpString=".3fr") returned 4
	[0171.622] lstrcmpiW (lpString1=".3fr", lpString2=".exe") returned -1
	[0171.622] lstrlenW (lpString=".3g2") returned 4
	[0171.622] lstrcmpiW (lpString1=".3g2", lpString2=".exe") returned -1
	[0171.622] lstrlenW (lpString=".3gp") returned 4
	[0171.622] lstrcmpiW (lpString1=".3gp", lpString2=".exe") returned -1
	[0171.622] lstrlenW (lpString=".7z") returned 3
	[0171.622] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0171.622] lstrlenW (lpString=".accda") returned 6
	[0171.622] lstrcmpiW (lpString1=".accda", lpString2="ad.exe") returned -1
	[0171.622] lstrlenW (lpString=".accdb") returned 6
	[0171.622] lstrcmpiW (lpString1=".accdb", lpString2="ad.exe") returned -1
	[0171.622] lstrlenW (lpString=".accdc") returned 6
	[0171.622] lstrcmpiW (lpString1=".accdc", lpString2="ad.exe") returned -1
	[0171.623] lstrlenW (lpString=".accde") returned 6
	[0171.623] lstrcmpiW (lpString1=".accde", lpString2="ad.exe") returned -1
	[0171.623] lstrlenW (lpString=".accdt") returned 6
	[0171.623] lstrcmpiW (lpString1=".accdt", lpString2="ad.exe") returned -1
	[0171.623] lstrlenW (lpString=".accdw") returned 6
	[0171.623] lstrcmpiW (lpString1=".accdw", lpString2="ad.exe") returned -1
	[0171.623] lstrlenW (lpString=".adb") returned 4
	[0171.623] lstrcmpiW (lpString1=".adb", lpString2=".exe") returned -1
	[0171.623] lstrlenW (lpString=".adp") returned 4
	[0171.623] lstrcmpiW (lpString1=".adp", lpString2=".exe") returned -1
	[0171.623] lstrlenW (lpString=".ai") returned 3
	[0171.623] lstrcmpiW (lpString1=".ai", lpString2="exe") returned -1
	[0171.623] lstrlenW (lpString=".ai3") returned 4
	[0171.623] lstrcmpiW (lpString1=".ai3", lpString2=".exe") returned -1
	[0171.623] lstrlenW (lpString=".ai4") returned 4
	[0171.623] lstrcmpiW (lpString1=".ai4", lpString2=".exe") returned -1
	[0171.623] lstrlenW (lpString=".ai5") returned 4
	[0171.623] lstrcmpiW (lpString1=".ai5", lpString2=".exe") returned -1
	[0171.623] lstrlenW (lpString=".ai6") returned 4
	[0171.623] lstrcmpiW (lpString1=".ai6", lpString2=".exe") returned -1
	[0171.623] lstrlenW (lpString=".ai7") returned 4
	[0171.623] lstrcmpiW (lpString1=".ai7", lpString2=".exe") returned -1
	[0171.623] lstrlenW (lpString=".ai8") returned 4
	[0171.623] lstrcmpiW (lpString1=".ai8", lpString2=".exe") returned -1
	[0171.623] lstrlenW (lpString=".anim") returned 5
	[0171.623] lstrcmpiW (lpString1=".anim", lpString2="d.exe") returned -1
	[0171.623] lstrlenW (lpString=".arw") returned 4
	[0171.624] lstrcmpiW (lpString1=".arw", lpString2=".exe") returned -1
	[0171.624] lstrlenW (lpString=".as") returned 3
	[0171.624] lstrcmpiW (lpString1=".as", lpString2="exe") returned -1
	[0171.624] lstrlenW (lpString=".asa") returned 4
	[0171.624] lstrcmpiW (lpString1=".asa", lpString2=".exe") returned -1
	[0171.624] lstrlenW (lpString=".asc") returned 4
	[0171.624] lstrcmpiW (lpString1=".asc", lpString2=".exe") returned -1
	[0171.624] lstrlenW (lpString=".ascx") returned 5
	[0171.624] lstrcmpiW (lpString1=".ascx", lpString2="d.exe") returned -1
	[0171.624] lstrlenW (lpString=".asm") returned 4
	[0171.624] lstrcmpiW (lpString1=".asm", lpString2=".exe") returned -1
	[0171.624] lstrlenW (lpString=".asmx") returned 5
	[0171.624] lstrcmpiW (lpString1=".asmx", lpString2="d.exe") returned -1
	[0171.624] lstrlenW (lpString=".asp") returned 4
	[0171.624] lstrcmpiW (lpString1=".asp", lpString2=".exe") returned -1
	[0171.624] lstrlenW (lpString=".aspx") returned 5
	[0171.624] lstrcmpiW (lpString1=".aspx", lpString2="d.exe") returned -1
	[0171.624] lstrlenW (lpString=".asr") returned 4
	[0171.624] lstrcmpiW (lpString1=".asr", lpString2=".exe") returned -1
	[0171.624] lstrlenW (lpString=".asx") returned 4
	[0171.624] lstrcmpiW (lpString1=".asx", lpString2=".exe") returned -1
	[0171.624] lstrlenW (lpString=".avi") returned 4
	[0171.624] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1
	[0171.624] lstrlenW (lpString=".avs") returned 4
	[0171.624] lstrcmpiW (lpString1=".avs", lpString2=".exe") returned -1
	[0171.624] lstrlenW (lpString=".backup") returned 7
	[0171.624] lstrcmpiW (lpString1=".backup", lpString2="pad.exe") returned -1
	[0171.625] lstrlenW (lpString=".bak") returned 4
	[0171.625] lstrcmpiW (lpString1=".bak", lpString2=".exe") returned -1
	[0171.625] lstrlenW (lpString=".bay") returned 4
	[0171.625] lstrcmpiW (lpString1=".bay", lpString2=".exe") returned -1
	[0171.625] lstrlenW (lpString=".bd") returned 3
	[0171.625] lstrcmpiW (lpString1=".bd", lpString2="exe") returned -1
	[0171.625] lstrlenW (lpString=".bin") returned 4
	[0171.625] lstrcmpiW (lpString1=".bin", lpString2=".exe") returned -1
	[0171.625] lstrlenW (lpString=".bmp") returned 4
	[0171.625] lstrcmpiW (lpString1=".bmp", lpString2=".exe") returned -1
	[0171.625] lstrlenW (lpString=".bz2") returned 4
	[0171.625] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0171.625] lstrlenW (lpString=".c") returned 2
	[0171.625] lstrcmpiW (lpString1=".c", lpString2="xe") returned -1
	[0171.625] lstrlenW (lpString=".cdr") returned 4
	[0171.625] lstrcmpiW (lpString1=".cdr", lpString2=".exe") returned -1
	[0171.625] lstrlenW (lpString=".cer") returned 4
	[0171.625] lstrcmpiW (lpString1=".cer", lpString2=".exe") returned -1
	[0171.625] lstrlenW (lpString=".cf") returned 3
	[0171.625] lstrcmpiW (lpString1=".cf", lpString2="exe") returned -1
	[0171.625] lstrlenW (lpString=".cfc") returned 4
	[0171.625] lstrcmpiW (lpString1=".cfc", lpString2=".exe") returned -1
	[0171.625] lstrlenW (lpString=".cfm") returned 4
	[0171.625] lstrcmpiW (lpString1=".cfm", lpString2=".exe") returned -1
	[0171.625] lstrlenW (lpString=".cfml") returned 5
	[0171.625] lstrcmpiW (lpString1=".cfml", lpString2="d.exe") returned -1
	[0171.625] lstrlenW (lpString=".cfu") returned 4
	[0171.625] lstrcmpiW (lpString1=".cfu", lpString2=".exe") returned -1
	[0171.626] lstrlenW (lpString=".chm") returned 4
	[0171.626] lstrcmpiW (lpString1=".chm", lpString2=".exe") returned -1
	[0171.626] lstrlenW (lpString=".cin") returned 4
	[0171.626] lstrcmpiW (lpString1=".cin", lpString2=".exe") returned -1
	[0171.626] lstrlenW (lpString=".class") returned 6
	[0171.626] lstrcmpiW (lpString1=".class", lpString2="ad.exe") returned -1
	[0171.626] lstrlenW (lpString=".clx") returned 4
	[0171.626] lstrcmpiW (lpString1=".clx", lpString2=".exe") returned -1
	[0171.626] lstrlenW (lpString=".config") returned 7
	[0171.626] lstrcmpiW (lpString1=".config", lpString2="pad.exe") returned -1
	[0171.626] lstrlenW (lpString=".cpp") returned 4
	[0171.626] lstrcmpiW (lpString1=".cpp", lpString2=".exe") returned -1
	[0171.626] lstrlenW (lpString=".cr2") returned 4
	[0171.626] lstrcmpiW (lpString1=".cr2", lpString2=".exe") returned -1
	[0171.626] lstrlenW (lpString=".crt") returned 4
	[0171.626] lstrcmpiW (lpString1=".crt", lpString2=".exe") returned -1
	[0171.626] lstrlenW (lpString=".crw") returned 4
	[0171.626] lstrcmpiW (lpString1=".crw", lpString2=".exe") returned -1
	[0171.626] lstrlenW (lpString=".cs") returned 3
	[0171.626] lstrcmpiW (lpString1=".cs", lpString2="exe") returned -1
	[0171.626] lstrlenW (lpString=".css") returned 4
	[0171.626] lstrcmpiW (lpString1=".css", lpString2=".exe") returned -1
	[0171.626] lstrlenW (lpString=".csv") returned 4
	[0171.626] lstrcmpiW (lpString1=".csv", lpString2=".exe") returned -1
	[0171.626] lstrlenW (lpString=".cub") returned 4
	[0171.627] lstrcmpiW (lpString1=".cub", lpString2=".exe") returned -1
	[0171.627] lstrlenW (lpString=".dae") returned 4
	[0171.627] lstrcmpiW (lpString1=".dae", lpString2=".exe") returned -1
	[0171.627] lstrlenW (lpString=".dat") returned 4
	[0171.627] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1
	[0171.627] lstrlenW (lpString=".db") returned 3
	[0171.627] lstrcmpiW (lpString1=".db", lpString2="exe") returned -1
	[0171.627] lstrlenW (lpString=".dbf") returned 4
	[0171.627] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0171.627] lstrlenW (lpString=".dbx") returned 4
	[0171.627] lstrcmpiW (lpString1=".dbx", lpString2=".exe") returned -1
	[0171.627] lstrlenW (lpString=".dc3") returned 4
	[0171.627] lstrcmpiW (lpString1=".dc3", lpString2=".exe") returned -1
	[0171.627] lstrlenW (lpString=".dcm") returned 4
	[0171.627] lstrcmpiW (lpString1=".dcm", lpString2=".exe") returned -1
	[0171.627] lstrlenW (lpString=".dcr") returned 4
	[0171.627] lstrcmpiW (lpString1=".dcr", lpString2=".exe") returned -1
	[0171.627] lstrlenW (lpString=".der") returned 4
	[0171.627] lstrcmpiW (lpString1=".der", lpString2=".exe") returned -1
	[0171.627] lstrlenW (lpString=".dib") returned 4
	[0171.627] lstrcmpiW (lpString1=".dib", lpString2=".exe") returned -1
	[0171.627] lstrlenW (lpString=".dic") returned 4
	[0171.627] lstrcmpiW (lpString1=".dic", lpString2=".exe") returned -1
	[0171.627] lstrlenW (lpString=".dif") returned 4
	[0171.628] lstrcmpiW (lpString1=".dif", lpString2=".exe") returned -1
	[0171.628] lstrlenW (lpString=".divx") returned 5
	[0171.628] lstrcmpiW (lpString1=".divx", lpString2="d.exe") returned -1
	[0171.628] lstrlenW (lpString=".djvu") returned 5
	[0171.628] lstrcmpiW (lpString1=".djvu", lpString2="d.exe") returned -1
	[0171.628] lstrlenW (lpString=".dng") returned 4
	[0171.628] lstrcmpiW (lpString1=".dng", lpString2=".exe") returned -1
	[0171.628] lstrlenW (lpString=".doc") returned 4
	[0171.628] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0171.628] lstrlenW (lpString=".docm") returned 5
	[0171.628] lstrcmpiW (lpString1=".docm", lpString2="d.exe") returned -1
	[0171.628] lstrlenW (lpString=".docx") returned 5
	[0171.628] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1
	[0171.628] lstrlenW (lpString=".dot") returned 4
	[0171.628] lstrcmpiW (lpString1=".dot", lpString2=".exe") returned -1
	[0171.628] lstrlenW (lpString=".dotm") returned 5
	[0171.628] lstrcmpiW (lpString1=".dotm", lpString2="d.exe") returned -1
	[0171.628] lstrlenW (lpString=".dotx") returned 5
	[0171.628] lstrcmpiW (lpString1=".dotx", lpString2="d.exe") returned -1
	[0171.628] lstrlenW (lpString=".dpx") returned 4
	[0171.628] lstrcmpiW (lpString1=".dpx", lpString2=".exe") returned -1
	[0171.628] lstrlenW (lpString=".dqy") returned 4
	[0171.628] lstrcmpiW (lpString1=".dqy", lpString2=".exe") returned -1
	[0171.628] lstrlenW (lpString=".dsn") returned 4
	[0171.628] lstrcmpiW (lpString1=".dsn", lpString2=".exe") returned -1
	[0171.629] lstrlenW (lpString=".dt") returned 3
	[0171.629] lstrcmpiW (lpString1=".dt", lpString2="exe") returned -1
	[0171.629] lstrlenW (lpString=".dtd") returned 4
	[0171.629] lstrcmpiW (lpString1=".dtd", lpString2=".exe") returned -1
	[0171.629] lstrlenW (lpString=".dwg") returned 4
	[0171.629] lstrcmpiW (lpString1=".dwg", lpString2=".exe") returned -1
	[0171.629] lstrlenW (lpString=".dwt") returned 4
	[0171.629] lstrcmpiW (lpString1=".dwt", lpString2=".exe") returned -1
	[0171.629] lstrlenW (lpString=".dx") returned 3
	[0171.629] lstrcmpiW (lpString1=".dx", lpString2="exe") returned -1
	[0171.629] lstrlenW (lpString=".dxf") returned 4
	[0171.629] lstrcmpiW (lpString1=".dxf", lpString2=".exe") returned -1
	[0171.629] lstrlenW (lpString=".edml") returned 5
	[0171.629] lstrcmpiW (lpString1=".edml", lpString2="d.exe") returned -1
	[0171.629] lstrlenW (lpString=".efd") returned 4
	[0171.629] lstrcmpiW (lpString1=".efd", lpString2=".exe") returned -1
	[0171.629] lstrlenW (lpString=".elf") returned 4
	[0171.629] lstrcmpiW (lpString1=".elf", lpString2=".exe") returned -1
	[0171.629] lstrlenW (lpString=".emf") returned 4
	[0171.629] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1
	[0171.629] lstrlenW (lpString=".emz") returned 4
	[0171.629] lstrcmpiW (lpString1=".emz", lpString2=".exe") returned -1
	[0171.629] lstrlenW (lpString=".epf") returned 4
	[0171.629] lstrcmpiW (lpString1=".epf", lpString2=".exe") returned -1
	[0171.629] lstrlenW (lpString=".eps") returned 4
	[0171.629] lstrcmpiW (lpString1=".eps", lpString2=".exe") returned -1
	[0171.629] lstrlenW (lpString=".epsf") returned 5
	[0171.629] lstrcmpiW (lpString1=".epsf", lpString2="d.exe") returned -1
	[0171.630] lstrlenW (lpString=".epsp") returned 5
	[0171.630] lstrcmpiW (lpString1=".epsp", lpString2="d.exe") returned -1
	[0171.630] lstrlenW (lpString=".erf") returned 4
	[0171.630] lstrcmpiW (lpString1=".erf", lpString2=".exe") returned -1
	[0171.630] lstrlenW (lpString=".exr") returned 4
	[0171.630] lstrcmpiW (lpString1=".exr", lpString2=".exe") returned 1
	[0171.630] lstrlenW (lpString=".f4v") returned 4
	[0171.630] lstrcmpiW (lpString1=".f4v", lpString2=".exe") returned 1
	[0171.630] lstrlenW (lpString=".fido") returned 5
	[0171.630] lstrcmpiW (lpString1=".fido", lpString2="d.exe") returned -1
	[0171.630] lstrlenW (lpString=".flm") returned 4
	[0171.630] lstrcmpiW (lpString1=".flm", lpString2=".exe") returned 1
	[0171.630] lstrlenW (lpString=".flv") returned 4
	[0171.630] lstrcmpiW (lpString1=".flv", lpString2=".exe") returned 1
	[0171.630] lstrlenW (lpString=".frm") returned 4
	[0171.630] lstrcmpiW (lpString1=".frm", lpString2=".exe") returned 1
	[0171.630] lstrlenW (lpString=".fxg") returned 4
	[0171.630] lstrcmpiW (lpString1=".fxg", lpString2=".exe") returned 1
	[0171.630] lstrlenW (lpString=".geo") returned 4
	[0171.630] lstrcmpiW (lpString1=".geo", lpString2=".exe") returned 1
	[0171.630] lstrlenW (lpString=".gif") returned 4
	[0171.630] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1
	[0171.630] lstrlenW (lpString=".grs") returned 4
	[0171.630] lstrcmpiW (lpString1=".grs", lpString2=".exe") returned 1
	[0171.630] lstrlenW (lpString=".gz") returned 3
	[0171.630] lstrcmpiW (lpString1=".gz", lpString2="exe") returned -1
	[0171.630] lstrlenW (lpString=".h") returned 2
	[0171.630] lstrcmpiW (lpString1=".h", lpString2="xe") returned -1
	[0171.630] lstrlenW (lpString=".hdr") returned 4
	[0171.631] lstrcmpiW (lpString1=".hdr", lpString2=".exe") returned 1
	[0171.631] lstrlenW (lpString=".hpp") returned 4
	[0171.631] lstrcmpiW (lpString1=".hpp", lpString2=".exe") returned 1
	[0171.631] lstrlenW (lpString=".hta") returned 4
	[0171.631] lstrcmpiW (lpString1=".hta", lpString2=".exe") returned 1
	[0171.631] lstrlenW (lpString=".htc") returned 4
	[0171.631] lstrcmpiW (lpString1=".htc", lpString2=".exe") returned 1
	[0171.631] lstrlenW (lpString=".htm") returned 4
	[0171.631] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1
	[0171.631] lstrlenW (lpString=".html") returned 5
	[0171.631] lstrcmpiW (lpString1=".html", lpString2="d.exe") returned -1
	[0171.631] lstrlenW (lpString=".icb") returned 4
	[0171.631] lstrcmpiW (lpString1=".icb", lpString2=".exe") returned 1
	[0171.631] lstrlenW (lpString=".ics") returned 4
	[0171.631] lstrcmpiW (lpString1=".ics", lpString2=".exe") returned 1
	[0171.631] lstrlenW (lpString=".iff") returned 4
	[0171.631] lstrcmpiW (lpString1=".iff", lpString2=".exe") returned 1
	[0171.631] lstrlenW (lpString=".inc") returned 4
	[0171.631] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1
	[0171.631] lstrlenW (lpString=".indd") returned 5
	[0171.631] lstrcmpiW (lpString1=".indd", lpString2="d.exe") returned -1
	[0171.631] lstrlenW (lpString=".ini") returned 4
	[0171.631] lstrcmpiW (lpString1=".ini", lpString2=".exe") returned 1
	[0171.631] lstrlenW (lpString=".iqy") returned 4
	[0171.631] lstrcmpiW (lpString1=".iqy", lpString2=".exe") returned 1
	[0171.631] lstrlenW (lpString=".j2c") returned 4
	[0171.632] lstrcmpiW (lpString1=".j2c", lpString2=".exe") returned 1
	[0171.632] lstrlenW (lpString=".j2k") returned 4
	[0171.632] lstrcmpiW (lpString1=".j2k", lpString2=".exe") returned 1
	[0171.632] lstrlenW (lpString=".java") returned 5
	[0171.632] lstrcmpiW (lpString1=".java", lpString2="d.exe") returned -1
	[0171.632] lstrlenW (lpString=".jp2") returned 4
	[0171.632] lstrcmpiW (lpString1=".jp2", lpString2=".exe") returned 1
	[0171.632] lstrlenW (lpString=".jpc") returned 4
	[0171.632] lstrcmpiW (lpString1=".jpc", lpString2=".exe") returned 1
	[0171.632] lstrlenW (lpString=".jpe") returned 4
	[0171.632] lstrcmpiW (lpString1=".jpe", lpString2=".exe") returned 1
	[0171.632] lstrlenW (lpString=".jpeg") returned 5
	[0171.632] lstrcmpiW (lpString1=".jpeg", lpString2="d.exe") returned -1
	[0171.632] lstrlenW (lpString=".jpf") returned 4
	[0171.632] lstrcmpiW (lpString1=".jpf", lpString2=".exe") returned 1
	[0171.632] lstrlenW (lpString=".jpg") returned 4
	[0171.632] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0171.632] lstrlenW (lpString=".jpx") returned 4
	[0171.632] lstrcmpiW (lpString1=".jpx", lpString2=".exe") returned 1
	[0171.632] lstrlenW (lpString=".js") returned 3
	[0171.632] lstrcmpiW (lpString1=".js", lpString2="exe") returned -1
	[0171.632] lstrlenW (lpString=".jsf") returned 4
	[0171.632] lstrcmpiW (lpString1=".jsf", lpString2=".exe") returned 1
	[0171.632] lstrlenW (lpString=".json") returned 5
	[0171.632] lstrcmpiW (lpString1=".json", lpString2="d.exe") returned -1
	[0171.632] lstrlenW (lpString=".jsp") returned 4
	[0171.632] lstrcmpiW (lpString1=".jsp", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".kdc") returned 4
	[0171.633] lstrcmpiW (lpString1=".kdc", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".kmz") returned 4
	[0171.633] lstrcmpiW (lpString1=".kmz", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".kwm") returned 4
	[0171.633] lstrcmpiW (lpString1=".kwm", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".lasso") returned 6
	[0171.633] lstrcmpiW (lpString1=".lasso", lpString2="ad.exe") returned -1
	[0171.633] lstrlenW (lpString=".lbi") returned 4
	[0171.633] lstrcmpiW (lpString1=".lbi", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".lgf") returned 4
	[0171.633] lstrcmpiW (lpString1=".lgf", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".lgp") returned 4
	[0171.633] lstrcmpiW (lpString1=".lgp", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".log") returned 4
	[0171.633] lstrcmpiW (lpString1=".log", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".m1v") returned 4
	[0171.633] lstrcmpiW (lpString1=".m1v", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".m4a") returned 4
	[0171.633] lstrcmpiW (lpString1=".m4a", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".m4v") returned 4
	[0171.633] lstrcmpiW (lpString1=".m4v", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".max") returned 4
	[0171.633] lstrcmpiW (lpString1=".max", lpString2=".exe") returned 1
	[0171.633] lstrlenW (lpString=".md") returned 3
	[0171.634] lstrcmpiW (lpString1=".md", lpString2="exe") returned -1
	[0171.634] lstrlenW (lpString=".mda") returned 4
	[0171.634] lstrcmpiW (lpString1=".mda", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mdb") returned 4
	[0171.634] lstrcmpiW (lpString1=".mdb", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mde") returned 4
	[0171.634] lstrcmpiW (lpString1=".mde", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mdf") returned 4
	[0171.634] lstrcmpiW (lpString1=".mdf", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mdw") returned 4
	[0171.634] lstrcmpiW (lpString1=".mdw", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mef") returned 4
	[0171.634] lstrcmpiW (lpString1=".mef", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mft") returned 4
	[0171.634] lstrcmpiW (lpString1=".mft", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mfw") returned 4
	[0171.634] lstrcmpiW (lpString1=".mfw", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mht") returned 4
	[0171.634] lstrcmpiW (lpString1=".mht", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mhtml") returned 6
	[0171.634] lstrcmpiW (lpString1=".mhtml", lpString2="ad.exe") returned -1
	[0171.634] lstrlenW (lpString=".mka") returned 4
	[0171.634] lstrcmpiW (lpString1=".mka", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mkidx") returned 6
	[0171.634] lstrcmpiW (lpString1=".mkidx", lpString2="ad.exe") returned -1
	[0171.634] lstrlenW (lpString=".mkv") returned 4
	[0171.634] lstrcmpiW (lpString1=".mkv", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mos") returned 4
	[0171.634] lstrcmpiW (lpString1=".mos", lpString2=".exe") returned 1
	[0171.634] lstrlenW (lpString=".mov") returned 4
	[0171.635] lstrcmpiW (lpString1=".mov", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".mp3") returned 4
	[0171.635] lstrcmpiW (lpString1=".mp3", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".mp4") returned 4
	[0171.635] lstrcmpiW (lpString1=".mp4", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".mpeg") returned 5
	[0171.635] lstrcmpiW (lpString1=".mpeg", lpString2="d.exe") returned -1
	[0171.635] lstrlenW (lpString=".mpg") returned 4
	[0171.635] lstrcmpiW (lpString1=".mpg", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".mpv") returned 4
	[0171.635] lstrcmpiW (lpString1=".mpv", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".mrw") returned 4
	[0171.635] lstrcmpiW (lpString1=".mrw", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".msg") returned 4
	[0171.635] lstrcmpiW (lpString1=".msg", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".mxl") returned 4
	[0171.635] lstrcmpiW (lpString1=".mxl", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".myd") returned 4
	[0171.635] lstrcmpiW (lpString1=".myd", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".myi") returned 4
	[0171.635] lstrcmpiW (lpString1=".myi", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".nef") returned 4
	[0171.635] lstrcmpiW (lpString1=".nef", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".nrw") returned 4
	[0171.635] lstrcmpiW (lpString1=".nrw", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".obj") returned 4
	[0171.635] lstrcmpiW (lpString1=".obj", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".odb") returned 4
	[0171.635] lstrcmpiW (lpString1=".odb", lpString2=".exe") returned 1
	[0171.635] lstrlenW (lpString=".odc") returned 4
	[0171.636] lstrcmpiW (lpString1=".odc", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".odm") returned 4
	[0171.636] lstrcmpiW (lpString1=".odm", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".odp") returned 4
	[0171.636] lstrcmpiW (lpString1=".odp", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".ods") returned 4
	[0171.636] lstrcmpiW (lpString1=".ods", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".oft") returned 4
	[0171.636] lstrcmpiW (lpString1=".oft", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".one") returned 4
	[0171.636] lstrcmpiW (lpString1=".one", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".onepkg") returned 7
	[0171.636] lstrcmpiW (lpString1=".onepkg", lpString2="pad.exe") returned -1
	[0171.636] lstrlenW (lpString=".onetoc2") returned 8
	[0171.636] lstrcmpiW (lpString1=".onetoc2", lpString2="dpad.exe") returned -1
	[0171.636] lstrlenW (lpString=".opt") returned 4
	[0171.636] lstrcmpiW (lpString1=".opt", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".oqy") returned 4
	[0171.636] lstrcmpiW (lpString1=".oqy", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".orf") returned 4
	[0171.636] lstrcmpiW (lpString1=".orf", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".p12") returned 4
	[0171.636] lstrcmpiW (lpString1=".p12", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".p7b") returned 4
	[0171.636] lstrcmpiW (lpString1=".p7b", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".p7c") returned 4
	[0171.636] lstrcmpiW (lpString1=".p7c", lpString2=".exe") returned 1
	[0171.636] lstrlenW (lpString=".pam") returned 4
	[0171.636] lstrcmpiW (lpString1=".pam", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pbm") returned 4
	[0171.637] lstrcmpiW (lpString1=".pbm", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pct") returned 4
	[0171.637] lstrcmpiW (lpString1=".pct", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pcx") returned 4
	[0171.637] lstrcmpiW (lpString1=".pcx", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pdd") returned 4
	[0171.637] lstrcmpiW (lpString1=".pdd", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pdf") returned 4
	[0171.637] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pdp") returned 4
	[0171.637] lstrcmpiW (lpString1=".pdp", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pef") returned 4
	[0171.637] lstrcmpiW (lpString1=".pef", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pem") returned 4
	[0171.637] lstrcmpiW (lpString1=".pem", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pff") returned 4
	[0171.637] lstrcmpiW (lpString1=".pff", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pfm") returned 4
	[0171.637] lstrcmpiW (lpString1=".pfm", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pfx") returned 4
	[0171.637] lstrcmpiW (lpString1=".pfx", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".pgm") returned 4
	[0171.637] lstrcmpiW (lpString1=".pgm", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".php") returned 4
	[0171.637] lstrcmpiW (lpString1=".php", lpString2=".exe") returned 1
	[0171.637] lstrlenW (lpString=".php3") returned 5
	[0171.637] lstrcmpiW (lpString1=".php3", lpString2="d.exe") returned -1
	[0171.637] lstrlenW (lpString=".php4") returned 5
	[0171.638] lstrcmpiW (lpString1=".php4", lpString2="d.exe") returned -1
	[0171.638] lstrlenW (lpString=".php5") returned 5
	[0171.638] lstrcmpiW (lpString1=".php5", lpString2="d.exe") returned -1
	[0171.638] lstrlenW (lpString=".phtml") returned 6
	[0171.638] lstrcmpiW (lpString1=".phtml", lpString2="ad.exe") returned -1
	[0171.638] lstrlenW (lpString=".pict") returned 5
	[0171.638] lstrcmpiW (lpString1=".pict", lpString2="d.exe") returned -1
	[0171.638] lstrlenW (lpString=".pl") returned 3
	[0171.638] lstrcmpiW (lpString1=".pl", lpString2="exe") returned -1
	[0171.638] lstrlenW (lpString=".pls") returned 4
	[0171.638] lstrcmpiW (lpString1=".pls", lpString2=".exe") returned 1
	[0171.638] lstrlenW (lpString=".pm") returned 3
	[0171.638] lstrcmpiW (lpString1=".pm", lpString2="exe") returned -1
	[0171.638] lstrlenW (lpString=".png") returned 4
	[0171.638] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1
	[0171.638] lstrlenW (lpString=".pnm") returned 4
	[0171.638] lstrcmpiW (lpString1=".pnm", lpString2=".exe") returned 1
	[0171.638] lstrlenW (lpString=".pot") returned 4
	[0171.638] lstrcmpiW (lpString1=".pot", lpString2=".exe") returned 1
	[0171.638] lstrlenW (lpString=".potm") returned 5
	[0171.638] lstrcmpiW (lpString1=".potm", lpString2="d.exe") returned -1
	[0171.638] lstrlenW (lpString=".potx") returned 5
	[0171.638] lstrcmpiW (lpString1=".potx", lpString2="d.exe") returned -1
	[0171.638] lstrlenW (lpString=".ppa") returned 4
	[0171.638] lstrcmpiW (lpString1=".ppa", lpString2=".exe") returned 1
	[0171.638] lstrlenW (lpString=".ppam") returned 5
	[0171.638] lstrcmpiW (lpString1=".ppam", lpString2="d.exe") returned -1
	[0171.638] lstrlenW (lpString=".ppm") returned 4
	[0171.638] lstrcmpiW (lpString1=".ppm", lpString2=".exe") returned 1
	[0171.638] lstrlenW (lpString=".pps") returned 4
	[0171.639] lstrcmpiW (lpString1=".pps", lpString2=".exe") returned 1
	[0171.639] lstrlenW (lpString=".ppsm") returned 5
	[0171.639] lstrcmpiW (lpString1=".ppsm", lpString2="d.exe") returned -1
	[0171.639] lstrlenW (lpString=".ppt") returned 4
	[0171.639] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0171.639] lstrlenW (lpString=".pptm") returned 5
	[0171.639] lstrcmpiW (lpString1=".pptm", lpString2="d.exe") returned -1
	[0171.639] lstrlenW (lpString=".pptx") returned 5
	[0171.639] lstrcmpiW (lpString1=".pptx", lpString2="d.exe") returned -1
	[0171.639] lstrlenW (lpString=".prn") returned 4
	[0171.639] lstrcmpiW (lpString1=".prn", lpString2=".exe") returned 1
	[0171.639] lstrlenW (lpString=".ps") returned 3
	[0171.639] lstrcmpiW (lpString1=".ps", lpString2="exe") returned -1
	[0171.639] lstrlenW (lpString=".psb") returned 4
	[0171.639] lstrcmpiW (lpString1=".psb", lpString2=".exe") returned 1
	[0171.639] lstrlenW (lpString=".psd") returned 4
	[0171.639] lstrcmpiW (lpString1=".psd", lpString2=".exe") returned 1
	[0171.639] lstrlenW (lpString=".pst") returned 4
	[0171.639] lstrcmpiW (lpString1=".pst", lpString2=".exe") returned 1
	[0171.639] lstrlenW (lpString=".ptx") returned 4
	[0171.639] lstrcmpiW (lpString1=".ptx", lpString2=".exe") returned 1
	[0171.639] lstrlenW (lpString=".pub") returned 4
	[0171.639] lstrcmpiW (lpString1=".pub", lpString2=".exe") returned 1
	[0171.639] lstrlenW (lpString=".pwm") returned 4
	[0171.639] lstrcmpiW (lpString1=".pwm", lpString2=".exe") returned 1
	[0171.639] lstrlenW (lpString=".pxr") returned 4
	[0171.639] lstrcmpiW (lpString1=".pxr", lpString2=".exe") returned 1
	[0171.639] lstrlenW (lpString=".py") returned 3
	[0171.639] lstrcmpiW (lpString1=".py", lpString2="exe") returned -1
	[0171.639] lstrlenW (lpString=".qt") returned 3
	[0171.639] lstrcmpiW (lpString1=".qt", lpString2="exe") returned -1
	[0171.639] lstrlenW (lpString=".r3d") returned 4
	[0171.640] lstrcmpiW (lpString1=".r3d", lpString2=".exe") returned 1
	[0171.640] lstrlenW (lpString=".raf") returned 4
	[0171.640] lstrcmpiW (lpString1=".raf", lpString2=".exe") returned 1
	[0171.640] lstrlenW (lpString=".rar") returned 4
	[0171.640] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0171.640] lstrlenW (lpString=".raw") returned 4
	[0171.640] lstrcmpiW (lpString1=".raw", lpString2=".exe") returned 1
	[0171.640] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.640] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1
	[0171.642] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.642] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b88afa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b88afa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b88afa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1
	[0171.642] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.642] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0
	[0171.642] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0171.642] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.642] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1
	[0171.645] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.645] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19940, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1
	[0171.645] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.645] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ac52c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a51df28, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1
	[0171.646] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.646] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1
	[0171.801] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0171.801] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 1
	[0171.801] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.801] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore", cAlternateFileName="BROWSE~1")) returned 0
	[0171.801] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0171.801] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.801] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1
	[0171.802] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.802] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1
	[0171.802] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.802] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0
	[0171.802] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0171.802] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.802] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1
	[0171.802] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0171.802] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1
	[0171.804] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0171.804] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 1
	[0171.804] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0171.804] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 0
	[0171.804] FindClose (in: hFindFile=0x3e709b0 | out: hFindFile=0x3e709b0) returned 1
	[0171.804] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.804] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1
	[0171.811] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0171.811] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1
	[0171.811] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0171.811] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0171.812] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0171.812] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0171.812] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1
	[0171.815] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0171.815] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 0
	[0171.815] FindClose (in: hFindFile=0x3e70430 | out: hFindFile=0x3e70430) returned 1
	[0171.815] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0171.815] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0
	[0171.815] FindClose (in: hFindFile=0x3e70570 | out: hFindFile=0x3e70570) returned 1
	[0171.815] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0171.815] FindNextFileW (in: hFindFile=0x3e70830, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1
	[0171.819] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45eea00 | out: hHeap=0x4c0000) returned 1
	[0171.819] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0171.819] FindClose (in: hFindFile=0x3e70770 | out: hFindFile=0x3e70770) returned 1
	[0171.819] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0171.819] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1
	[0171.819] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0171.819] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0
	[0171.819] FindClose (in: hFindFile=0x3e70470 | out: hFindFile=0x3e70470) returned 1
	[0171.819] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0171.821] FindNextFileW (in: hFindFile=0x3e70830, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1
	[0171.823] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0171.823] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0171.823] FindClose (in: hFindFile=0x3e70470 | out: hFindFile=0x3e70470) returned 1
	[0171.823] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0171.823] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0
	[0171.823] FindClose (in: hFindFile=0x3e70770 | out: hFindFile=0x3e70770) returned 1
	[0171.823] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0171.823] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1
	[0171.825] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0171.825] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0171.825] FindClose (in: hFindFile=0x3e700b0 | out: hFindFile=0x3e700b0) returned 1
	[0171.825] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0171.825] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0
	[0171.825] FindClose (in: hFindFile=0x3e701f0 | out: hFindFile=0x3e701f0) returned 1
	[0171.825] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0171.825] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0
	[0171.825] FindClose (in: hFindFile=0x3e70430 | out: hFindFile=0x3e70430) returned 1
	[0171.825] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45eea00 | out: hHeap=0x4c0000) returned 1
	[0171.826] FindNextFileW (in: hFindFile=0x3e70830, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0
	[0171.826] FindClose (in: hFindFile=0x3e70830 | out: hFindFile=0x3e70830) returned 1
	[0171.826] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0171.827] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0
	[0171.827] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0171.827] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0171.828] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 0
	[0171.828] FindClose (in: hFindFile=0x3e70f30 | out: hFindFile=0x3e70f30) returned 1
	[0171.828] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0171.828] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0
	[0171.828] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0171.828] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0171.829] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1
	[0171.835] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0171.835] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0171.836] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0171.836] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0
	[0171.836] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0171.836] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45eea00 | out: hHeap=0x4c0000) returned 1
	[0171.836] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester", cAlternateFileName="")) returned 1
	[0172.034] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0172.034] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1
	[0172.404] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0172.404] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1
	[0172.405] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.406] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1
	[0172.406] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.406] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0
	[0172.406] FindClose (in: hFindFile=0x3e703f0 | out: hFindFile=0x3e703f0) returned 1
	[0172.406] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0172.406] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1
	[0172.406] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions") returned 65
	[0172.406] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions") returned 1
	[0172.406] lstrlenW (lpString="Functions") returned 9
	[0172.406] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Functions") returned -1
	[0172.406] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x44b2a98
	[0172.406] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions") returned 65
	[0172.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\*", lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e706b0
	[0172.408] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.408] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524d244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x326cf05, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assertions", cAlternateFileName="ASSERT~1")) returned 1
	[0172.408] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions") returned 76
	[0172.408] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions") returned 1
	[0172.408] lstrlenW (lpString="Assertions") returned 10
	[0172.408] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Assertions") returned 1
	[0172.408] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x44e7ff8
	[0172.408] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions") returned 76
	[0172.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions\\*", lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524d244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x326cf05, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e70570
	[0172.410] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524d244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x326cf05, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0172.410] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5ac187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5ac187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5ac187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x356e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.ps1", cAlternateFileName="")) returned 1
	[0172.410] lstrlenW (lpString="Be.ps1") returned 6
	[0172.411] lstrlenW (lpString=".1cd") returned 4
	[0172.411] lstrcmpiW (lpString1=".1cd", lpString2=".ps1") returned -1
	[0172.411] lstrlenW (lpString=".3ds") returned 4
	[0172.411] lstrcmpiW (lpString1=".3ds", lpString2=".ps1") returned -1
	[0172.411] lstrlenW (lpString=".3fr") returned 4
	[0172.411] lstrcmpiW (lpString1=".3fr", lpString2=".ps1") returned -1
	[0172.411] lstrlenW (lpString=".3g2") returned 4
	[0172.411] lstrcmpiW (lpString1=".3g2", lpString2=".ps1") returned -1
	[0172.411] lstrlenW (lpString=".3gp") returned 4
	[0172.411] lstrcmpiW (lpString1=".3gp", lpString2=".ps1") returned -1
	[0172.411] lstrlenW (lpString=".7z") returned 3
	[0172.411] lstrcmpiW (lpString1=".7z", lpString2="ps1") returned -1
	[0172.411] lstrlenW (lpString=".accda") returned 6
	[0172.411] lstrcmpiW (lpString1=".accda", lpString2="Be.ps1") returned -1
	[0172.411] lstrlenW (lpString=".accdb") returned 6
	[0172.412] lstrcmpiW (lpString1=".accdb", lpString2="Be.ps1") returned -1
	[0172.412] lstrlenW (lpString=".accdc") returned 6
	[0172.412] lstrcmpiW (lpString1=".accdc", lpString2="Be.ps1") returned -1
	[0172.412] lstrlenW (lpString=".accde") returned 6
	[0172.412] lstrcmpiW (lpString1=".accde", lpString2="Be.ps1") returned -1
	[0172.412] lstrlenW (lpString=".accdt") returned 6
	[0172.412] lstrcmpiW (lpString1=".accdt", lpString2="Be.ps1") returned -1
	[0172.412] lstrlenW (lpString=".accdw") returned 6
	[0172.412] lstrcmpiW (lpString1=".accdw", lpString2="Be.ps1") returned -1
	[0172.412] lstrlenW (lpString=".adb") returned 4
	[0172.412] lstrcmpiW (lpString1=".adb", lpString2=".ps1") returned -1
	[0172.412] lstrlenW (lpString=".adp") returned 4
	[0172.412] lstrcmpiW (lpString1=".adp", lpString2=".ps1") returned -1
	[0172.412] lstrlenW (lpString=".ai") returned 3
	[0172.412] lstrcmpiW (lpString1=".ai", lpString2="ps1") returned -1
	[0172.412] lstrlenW (lpString=".ai3") returned 4
	[0172.412] lstrcmpiW (lpString1=".ai3", lpString2=".ps1") returned -1
	[0172.412] lstrlenW (lpString=".ai4") returned 4
	[0172.412] lstrcmpiW (lpString1=".ai4", lpString2=".ps1") returned -1
	[0172.412] lstrlenW (lpString=".ai5") returned 4
	[0172.412] lstrcmpiW (lpString1=".ai5", lpString2=".ps1") returned -1
	[0172.412] lstrlenW (lpString=".ai6") returned 4
	[0172.412] lstrcmpiW (lpString1=".ai6", lpString2=".ps1") returned -1
	[0172.412] lstrlenW (lpString=".ai7") returned 4
	[0172.413] lstrcmpiW (lpString1=".ai7", lpString2=".ps1") returned -1
	[0172.413] lstrlenW (lpString=".ai8") returned 4
	[0172.413] lstrcmpiW (lpString1=".ai8", lpString2=".ps1") returned -1
	[0172.413] lstrlenW (lpString=".anim") returned 5
	[0172.413] lstrcmpiW (lpString1=".anim", lpString2="e.ps1") returned -1
	[0172.413] lstrlenW (lpString=".arw") returned 4
	[0172.413] lstrcmpiW (lpString1=".arw", lpString2=".ps1") returned -1
	[0172.413] lstrlenW (lpString=".as") returned 3
	[0172.413] lstrcmpiW (lpString1=".as", lpString2="ps1") returned -1
	[0172.413] lstrlenW (lpString=".asa") returned 4
	[0172.413] lstrcmpiW (lpString1=".asa", lpString2=".ps1") returned -1
	[0172.413] lstrlenW (lpString=".asc") returned 4
	[0172.413] lstrcmpiW (lpString1=".asc", lpString2=".ps1") returned -1
	[0172.413] lstrlenW (lpString=".ascx") returned 5
	[0172.413] lstrcmpiW (lpString1=".ascx", lpString2="e.ps1") returned -1
	[0172.413] lstrlenW (lpString=".asm") returned 4
	[0172.413] lstrcmpiW (lpString1=".asm", lpString2=".ps1") returned -1
	[0172.413] lstrlenW (lpString=".asmx") returned 5
	[0172.413] lstrcmpiW (lpString1=".asmx", lpString2="e.ps1") returned -1
	[0172.413] lstrlenW (lpString=".asp") returned 4
	[0172.413] lstrcmpiW (lpString1=".asp", lpString2=".ps1") returned -1
	[0172.413] lstrlenW (lpString=".aspx") returned 5
	[0172.413] lstrcmpiW (lpString1=".aspx", lpString2="e.ps1") returned -1
	[0172.413] lstrlenW (lpString=".asr") returned 4
	[0172.413] lstrcmpiW (lpString1=".asr", lpString2=".ps1") returned -1
	[0172.413] lstrlenW (lpString=".asx") returned 4
	[0172.413] lstrcmpiW (lpString1=".asx", lpString2=".ps1") returned -1
	[0172.413] lstrlenW (lpString=".avi") returned 4
	[0172.414] lstrcmpiW (lpString1=".avi", lpString2=".ps1") returned -1
	[0172.414] lstrlenW (lpString=".avs") returned 4
	[0172.414] lstrcmpiW (lpString1=".avs", lpString2=".ps1") returned -1
	[0172.414] lstrlenW (lpString=".backup") returned 7
	[0172.414] lstrcmpiW (lpString1=".backup", lpString2=".Be.ps1") returned -1
	[0172.414] lstrlenW (lpString=".bak") returned 4
	[0172.414] lstrcmpiW (lpString1=".bak", lpString2=".ps1") returned -1
	[0172.414] lstrlenW (lpString=".bay") returned 4
	[0172.414] lstrcmpiW (lpString1=".bay", lpString2=".ps1") returned -1
	[0172.414] lstrlenW (lpString=".bd") returned 3
	[0172.414] lstrcmpiW (lpString1=".bd", lpString2="ps1") returned -1
	[0172.414] lstrlenW (lpString=".bin") returned 4
	[0172.414] lstrcmpiW (lpString1=".bin", lpString2=".ps1") returned -1
	[0172.414] lstrlenW (lpString=".bmp") returned 4
	[0172.414] lstrcmpiW (lpString1=".bmp", lpString2=".ps1") returned -1
	[0172.414] lstrlenW (lpString=".bz2") returned 4
	[0172.414] lstrcmpiW (lpString1=".bz2", lpString2=".ps1") returned -1
	[0172.414] lstrlenW (lpString=".c") returned 2
	[0172.414] lstrcmpiW (lpString1=".c", lpString2="s1") returned -1
	[0172.414] lstrlenW (lpString=".cdr") returned 4
	[0172.414] lstrcmpiW (lpString1=".cdr", lpString2=".ps1") returned -1
	[0172.414] lstrlenW (lpString=".cer") returned 4
	[0172.414] lstrcmpiW (lpString1=".cer", lpString2=".ps1") returned -1
	[0172.414] lstrlenW (lpString=".cf") returned 3
	[0172.414] lstrcmpiW (lpString1=".cf", lpString2="ps1") returned -1
	[0172.414] lstrlenW (lpString=".cfc") returned 4
	[0172.415] lstrcmpiW (lpString1=".cfc", lpString2=".ps1") returned -1
	[0172.415] lstrlenW (lpString=".cfm") returned 4
	[0172.415] lstrcmpiW (lpString1=".cfm", lpString2=".ps1") returned -1
	[0172.415] lstrlenW (lpString=".cfml") returned 5
	[0172.415] lstrcmpiW (lpString1=".cfml", lpString2="e.ps1") returned -1
	[0172.415] lstrlenW (lpString=".cfu") returned 4
	[0172.415] lstrcmpiW (lpString1=".cfu", lpString2=".ps1") returned -1
	[0172.415] lstrlenW (lpString=".chm") returned 4
	[0172.415] lstrcmpiW (lpString1=".chm", lpString2=".ps1") returned -1
	[0172.415] lstrlenW (lpString=".cin") returned 4
	[0172.415] lstrcmpiW (lpString1=".cin", lpString2=".ps1") returned -1
	[0172.415] lstrlenW (lpString=".class") returned 6
	[0172.415] lstrcmpiW (lpString1=".class", lpString2="Be.ps1") returned -1
	[0172.415] lstrlenW (lpString=".clx") returned 4
	[0172.415] lstrcmpiW (lpString1=".clx", lpString2=".ps1") returned -1
	[0172.415] lstrlenW (lpString=".config") returned 7
	[0172.415] lstrcmpiW (lpString1=".config", lpString2=".Be.ps1") returned 1
	[0172.415] lstrlenW (lpString=".cpp") returned 4
	[0172.415] lstrcmpiW (lpString1=".cpp", lpString2=".ps1") returned -1
	[0172.415] lstrlenW (lpString=".cr2") returned 4
	[0172.415] lstrcmpiW (lpString1=".cr2", lpString2=".ps1") returned -1
	[0172.415] lstrlenW (lpString=".crt") returned 4
	[0172.415] lstrcmpiW (lpString1=".crt", lpString2=".ps1") returned -1
	[0172.415] lstrlenW (lpString=".crw") returned 4
	[0172.415] lstrcmpiW (lpString1=".crw", lpString2=".ps1") returned -1
	[0172.415] lstrlenW (lpString=".cs") returned 3
	[0172.415] lstrcmpiW (lpString1=".cs", lpString2="ps1") returned -1
	[0172.415] lstrlenW (lpString=".css") returned 4
	[0172.416] lstrcmpiW (lpString1=".css", lpString2=".ps1") returned -1
	[0172.416] lstrlenW (lpString=".csv") returned 4
	[0172.416] lstrcmpiW (lpString1=".csv", lpString2=".ps1") returned -1
	[0172.416] lstrlenW (lpString=".cub") returned 4
	[0172.416] lstrcmpiW (lpString1=".cub", lpString2=".ps1") returned -1
	[0172.416] lstrlenW (lpString=".dae") returned 4
	[0172.416] lstrcmpiW (lpString1=".dae", lpString2=".ps1") returned -1
	[0172.416] lstrlenW (lpString=".dat") returned 4
	[0172.416] lstrcmpiW (lpString1=".dat", lpString2=".ps1") returned -1
	[0172.416] lstrlenW (lpString=".db") returned 3
	[0172.416] lstrcmpiW (lpString1=".db", lpString2="ps1") returned -1
	[0172.416] lstrlenW (lpString=".dbf") returned 4
	[0172.416] lstrcmpiW (lpString1=".dbf", lpString2=".ps1") returned -1
	[0172.416] lstrlenW (lpString=".dbx") returned 4
	[0172.416] lstrcmpiW (lpString1=".dbx", lpString2=".ps1") returned -1
	[0172.416] lstrlenW (lpString=".dc3") returned 4
	[0172.416] lstrcmpiW (lpString1=".dc3", lpString2=".ps1") returned -1
	[0172.416] lstrlenW (lpString=".dcm") returned 4
	[0172.416] lstrcmpiW (lpString1=".dcm", lpString2=".ps1") returned -1
	[0172.416] lstrlenW (lpString=".dcr") returned 4
	[0172.416] lstrcmpiW (lpString1=".dcr", lpString2=".ps1") returned -1
	[0172.417] lstrlenW (lpString=".der") returned 4
	[0172.417] lstrcmpiW (lpString1=".der", lpString2=".ps1") returned -1
	[0172.417] lstrlenW (lpString=".dib") returned 4
	[0172.417] lstrcmpiW (lpString1=".dib", lpString2=".ps1") returned -1
	[0172.417] lstrlenW (lpString=".dic") returned 4
	[0172.417] lstrcmpiW (lpString1=".dic", lpString2=".ps1") returned -1
	[0172.417] lstrlenW (lpString=".dif") returned 4
	[0172.417] lstrcmpiW (lpString1=".dif", lpString2=".ps1") returned -1
	[0172.417] lstrlenW (lpString=".divx") returned 5
	[0172.417] lstrcmpiW (lpString1=".divx", lpString2="e.ps1") returned -1
	[0172.417] lstrlenW (lpString=".djvu") returned 5
	[0172.417] lstrcmpiW (lpString1=".djvu", lpString2="e.ps1") returned -1
	[0172.417] lstrlenW (lpString=".dng") returned 4
	[0172.417] lstrcmpiW (lpString1=".dng", lpString2=".ps1") returned -1
	[0172.417] lstrlenW (lpString=".doc") returned 4
	[0172.417] lstrcmpiW (lpString1=".doc", lpString2=".ps1") returned -1
	[0172.417] lstrlenW (lpString=".docm") returned 5
	[0172.417] lstrcmpiW (lpString1=".docm", lpString2="e.ps1") returned -1
	[0172.417] lstrlenW (lpString=".docx") returned 5
	[0172.417] lstrcmpiW (lpString1=".docx", lpString2="e.ps1") returned -1
	[0172.417] lstrlenW (lpString=".dot") returned 4
	[0172.417] lstrcmpiW (lpString1=".dot", lpString2=".ps1") returned -1
	[0172.417] lstrlenW (lpString=".dotm") returned 5
	[0172.417] lstrcmpiW (lpString1=".dotm", lpString2="e.ps1") returned -1
	[0172.417] lstrlenW (lpString=".dotx") returned 5
	[0172.417] lstrcmpiW (lpString1=".dotx", lpString2="e.ps1") returned -1
	[0172.417] lstrlenW (lpString=".dpx") returned 4
	[0172.417] lstrcmpiW (lpString1=".dpx", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".dqy") returned 4
	[0172.418] lstrcmpiW (lpString1=".dqy", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".dsn") returned 4
	[0172.418] lstrcmpiW (lpString1=".dsn", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".dt") returned 3
	[0172.418] lstrcmpiW (lpString1=".dt", lpString2="ps1") returned -1
	[0172.418] lstrlenW (lpString=".dtd") returned 4
	[0172.418] lstrcmpiW (lpString1=".dtd", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".dwg") returned 4
	[0172.418] lstrcmpiW (lpString1=".dwg", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".dwt") returned 4
	[0172.418] lstrcmpiW (lpString1=".dwt", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".dx") returned 3
	[0172.418] lstrcmpiW (lpString1=".dx", lpString2="ps1") returned -1
	[0172.418] lstrlenW (lpString=".dxf") returned 4
	[0172.418] lstrcmpiW (lpString1=".dxf", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".edml") returned 5
	[0172.418] lstrcmpiW (lpString1=".edml", lpString2="e.ps1") returned -1
	[0172.418] lstrlenW (lpString=".efd") returned 4
	[0172.418] lstrcmpiW (lpString1=".efd", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".elf") returned 4
	[0172.418] lstrcmpiW (lpString1=".elf", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".emf") returned 4
	[0172.418] lstrcmpiW (lpString1=".emf", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".emz") returned 4
	[0172.418] lstrcmpiW (lpString1=".emz", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".epf") returned 4
	[0172.418] lstrcmpiW (lpString1=".epf", lpString2=".ps1") returned -1
	[0172.418] lstrlenW (lpString=".eps") returned 4
	[0172.418] lstrcmpiW (lpString1=".eps", lpString2=".ps1") returned -1
	[0172.419] lstrlenW (lpString=".epsf") returned 5
	[0172.419] lstrcmpiW (lpString1=".epsf", lpString2="e.ps1") returned -1
	[0172.419] lstrlenW (lpString=".epsp") returned 5
	[0172.419] lstrcmpiW (lpString1=".epsp", lpString2="e.ps1") returned -1
	[0172.419] lstrlenW (lpString=".erf") returned 4
	[0172.419] lstrcmpiW (lpString1=".erf", lpString2=".ps1") returned -1
	[0172.419] lstrlenW (lpString=".exr") returned 4
	[0172.419] lstrcmpiW (lpString1=".exr", lpString2=".ps1") returned -1
	[0172.419] lstrlenW (lpString=".f4v") returned 4
	[0172.419] lstrcmpiW (lpString1=".f4v", lpString2=".ps1") returned -1
	[0172.419] lstrlenW (lpString=".fido") returned 5
	[0172.419] lstrcmpiW (lpString1=".fido", lpString2="e.ps1") returned -1
	[0172.419] lstrlenW (lpString=".flm") returned 4
	[0172.419] lstrcmpiW (lpString1=".flm", lpString2=".ps1") returned -1
	[0172.419] lstrlenW (lpString=".flv") returned 4
	[0172.419] lstrcmpiW (lpString1=".flv", lpString2=".ps1") returned -1
	[0172.419] lstrlenW (lpString=".frm") returned 4
	[0172.419] lstrcmpiW (lpString1=".frm", lpString2=".ps1") returned -1
	[0172.419] lstrlenW (lpString=".fxg") returned 4
	[0172.419] lstrcmpiW (lpString1=".fxg", lpString2=".ps1") returned -1
	[0172.419] lstrlenW (lpString=".geo") returned 4
	[0172.419] lstrcmpiW (lpString1=".geo", lpString2=".ps1") returned -1
	[0172.419] lstrlenW (lpString=".gif") returned 4
	[0172.419] lstrcmpiW (lpString1=".gif", lpString2=".ps1") returned -1
	[0172.419] lstrlenW (lpString=".grs") returned 4
	[0172.419] lstrcmpiW (lpString1=".grs", lpString2=".ps1") returned -1
	[0172.419] lstrlenW (lpString=".gz") returned 3
	[0172.419] lstrcmpiW (lpString1=".gz", lpString2="ps1") returned -1
	[0172.419] lstrlenW (lpString=".h") returned 2
	[0172.420] lstrcmpiW (lpString1=".h", lpString2="s1") returned -1
	[0172.420] lstrlenW (lpString=".hdr") returned 4
	[0172.420] lstrcmpiW (lpString1=".hdr", lpString2=".ps1") returned -1
	[0172.420] lstrlenW (lpString=".hpp") returned 4
	[0172.420] lstrcmpiW (lpString1=".hpp", lpString2=".ps1") returned -1
	[0172.420] lstrlenW (lpString=".hta") returned 4
	[0172.420] lstrcmpiW (lpString1=".hta", lpString2=".ps1") returned -1
	[0172.420] lstrlenW (lpString=".htc") returned 4
	[0172.420] lstrcmpiW (lpString1=".htc", lpString2=".ps1") returned -1
	[0172.420] lstrlenW (lpString=".htm") returned 4
	[0172.420] lstrcmpiW (lpString1=".htm", lpString2=".ps1") returned -1
	[0172.420] lstrlenW (lpString=".html") returned 5
	[0172.420] lstrcmpiW (lpString1=".html", lpString2="e.ps1") returned -1
	[0172.420] lstrlenW (lpString=".icb") returned 4
	[0172.420] lstrcmpiW (lpString1=".icb", lpString2=".ps1") returned -1
	[0172.420] lstrlenW (lpString=".ics") returned 4
	[0172.420] lstrcmpiW (lpString1=".ics", lpString2=".ps1") returned -1
	[0172.420] lstrlenW (lpString=".iff") returned 4
	[0172.420] lstrcmpiW (lpString1=".iff", lpString2=".ps1") returned -1
	[0172.420] lstrlenW (lpString=".inc") returned 4
	[0172.420] lstrcmpiW (lpString1=".inc", lpString2=".ps1") returned -1
	[0172.420] lstrlenW (lpString=".indd") returned 5
	[0172.420] lstrcmpiW (lpString1=".indd", lpString2="e.ps1") returned -1
	[0172.420] lstrlenW (lpString=".ini") returned 4
	[0172.420] lstrcmpiW (lpString1=".ini", lpString2=".ps1") returned -1
	[0172.420] lstrlenW (lpString=".iqy") returned 4
	[0172.420] lstrcmpiW (lpString1=".iqy", lpString2=".ps1") returned -1
	[0172.420] lstrlenW (lpString=".j2c") returned 4
	[0172.421] lstrcmpiW (lpString1=".j2c", lpString2=".ps1") returned -1
	[0172.421] lstrlenW (lpString=".j2k") returned 4
	[0172.421] lstrcmpiW (lpString1=".j2k", lpString2=".ps1") returned -1
	[0172.421] lstrlenW (lpString=".java") returned 5
	[0172.421] lstrcmpiW (lpString1=".java", lpString2="e.ps1") returned -1
	[0172.421] lstrlenW (lpString=".jp2") returned 4
	[0172.421] lstrcmpiW (lpString1=".jp2", lpString2=".ps1") returned -1
	[0172.421] lstrlenW (lpString=".jpc") returned 4
	[0172.421] lstrcmpiW (lpString1=".jpc", lpString2=".ps1") returned -1
	[0172.421] lstrlenW (lpString=".jpe") returned 4
	[0172.421] lstrcmpiW (lpString1=".jpe", lpString2=".ps1") returned -1
	[0172.421] lstrlenW (lpString=".jpeg") returned 5
	[0172.421] lstrcmpiW (lpString1=".jpeg", lpString2="e.ps1") returned -1
	[0172.421] lstrlenW (lpString=".jpf") returned 4
	[0172.421] lstrcmpiW (lpString1=".jpf", lpString2=".ps1") returned -1
	[0172.421] lstrlenW (lpString=".jpg") returned 4
	[0172.421] lstrcmpiW (lpString1=".jpg", lpString2=".ps1") returned -1
	[0172.421] lstrlenW (lpString=".jpx") returned 4
	[0172.422] lstrcmpiW (lpString1=".jpx", lpString2=".ps1") returned -1
	[0172.422] lstrlenW (lpString=".js") returned 3
	[0172.422] lstrcmpiW (lpString1=".js", lpString2="ps1") returned -1
	[0172.422] lstrlenW (lpString=".jsf") returned 4
	[0172.422] lstrcmpiW (lpString1=".jsf", lpString2=".ps1") returned -1
	[0172.422] lstrlenW (lpString=".json") returned 5
	[0172.422] lstrcmpiW (lpString1=".json", lpString2="e.ps1") returned -1
	[0172.422] lstrlenW (lpString=".jsp") returned 4
	[0172.422] lstrcmpiW (lpString1=".jsp", lpString2=".ps1") returned -1
	[0172.422] lstrlenW (lpString=".kdc") returned 4
	[0172.422] lstrcmpiW (lpString1=".kdc", lpString2=".ps1") returned -1
	[0172.422] lstrlenW (lpString=".kmz") returned 4
	[0172.422] lstrcmpiW (lpString1=".kmz", lpString2=".ps1") returned -1
	[0172.422] lstrlenW (lpString=".kwm") returned 4
	[0172.422] lstrcmpiW (lpString1=".kwm", lpString2=".ps1") returned -1
	[0172.422] lstrlenW (lpString=".lasso") returned 6
	[0172.422] lstrcmpiW (lpString1=".lasso", lpString2="Be.ps1") returned -1
	[0172.422] lstrlenW (lpString=".lbi") returned 4
	[0172.422] lstrcmpiW (lpString1=".lbi", lpString2=".ps1") returned -1
	[0172.422] lstrlenW (lpString=".lgf") returned 4
	[0172.422] lstrcmpiW (lpString1=".lgf", lpString2=".ps1") returned -1
	[0172.422] lstrlenW (lpString=".lgp") returned 4
	[0172.422] lstrcmpiW (lpString1=".lgp", lpString2=".ps1") returned -1
	[0172.422] lstrlenW (lpString=".log") returned 4
	[0172.422] lstrcmpiW (lpString1=".log", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".m1v") returned 4
	[0172.423] lstrcmpiW (lpString1=".m1v", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".m4a") returned 4
	[0172.423] lstrcmpiW (lpString1=".m4a", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".m4v") returned 4
	[0172.423] lstrcmpiW (lpString1=".m4v", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".max") returned 4
	[0172.423] lstrcmpiW (lpString1=".max", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".md") returned 3
	[0172.423] lstrcmpiW (lpString1=".md", lpString2="ps1") returned -1
	[0172.423] lstrlenW (lpString=".mda") returned 4
	[0172.423] lstrcmpiW (lpString1=".mda", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".mdb") returned 4
	[0172.423] lstrcmpiW (lpString1=".mdb", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".mde") returned 4
	[0172.423] lstrcmpiW (lpString1=".mde", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".mdf") returned 4
	[0172.423] lstrcmpiW (lpString1=".mdf", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".mdw") returned 4
	[0172.423] lstrcmpiW (lpString1=".mdw", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".mef") returned 4
	[0172.423] lstrcmpiW (lpString1=".mef", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".mft") returned 4
	[0172.423] lstrcmpiW (lpString1=".mft", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".mfw") returned 4
	[0172.423] lstrcmpiW (lpString1=".mfw", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".mht") returned 4
	[0172.423] lstrcmpiW (lpString1=".mht", lpString2=".ps1") returned -1
	[0172.423] lstrlenW (lpString=".mhtml") returned 6
	[0172.424] lstrcmpiW (lpString1=".mhtml", lpString2="Be.ps1") returned -1
	[0172.424] lstrlenW (lpString=".mka") returned 4
	[0172.424] lstrcmpiW (lpString1=".mka", lpString2=".ps1") returned -1
	[0172.424] lstrlenW (lpString=".mkidx") returned 6
	[0172.424] lstrcmpiW (lpString1=".mkidx", lpString2="Be.ps1") returned -1
	[0172.424] lstrlenW (lpString=".mkv") returned 4
	[0172.424] lstrcmpiW (lpString1=".mkv", lpString2=".ps1") returned -1
	[0172.424] lstrlenW (lpString=".mos") returned 4
	[0172.424] lstrcmpiW (lpString1=".mos", lpString2=".ps1") returned -1
	[0172.424] lstrlenW (lpString=".mov") returned 4
	[0172.424] lstrcmpiW (lpString1=".mov", lpString2=".ps1") returned -1
	[0172.424] lstrlenW (lpString=".mp3") returned 4
	[0172.424] lstrcmpiW (lpString1=".mp3", lpString2=".ps1") returned -1
	[0172.424] lstrlenW (lpString=".mp4") returned 4
	[0172.424] lstrcmpiW (lpString1=".mp4", lpString2=".ps1") returned -1
	[0172.424] lstrlenW (lpString=".mpeg") returned 5
	[0172.424] lstrcmpiW (lpString1=".mpeg", lpString2="e.ps1") returned -1
	[0172.424] lstrlenW (lpString=".mpg") returned 4
	[0172.424] lstrcmpiW (lpString1=".mpg", lpString2=".ps1") returned -1
	[0172.424] lstrlenW (lpString=".mpv") returned 4
	[0172.424] lstrcmpiW (lpString1=".mpv", lpString2=".ps1") returned -1
	[0172.424] lstrlenW (lpString=".mrw") returned 4
	[0172.424] lstrcmpiW (lpString1=".mrw", lpString2=".ps1") returned -1
	[0172.424] lstrlenW (lpString=".msg") returned 4
	[0172.424] lstrcmpiW (lpString1=".msg", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".mxl") returned 4
	[0172.425] lstrcmpiW (lpString1=".mxl", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".myd") returned 4
	[0172.425] lstrcmpiW (lpString1=".myd", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".myi") returned 4
	[0172.425] lstrcmpiW (lpString1=".myi", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".nef") returned 4
	[0172.425] lstrcmpiW (lpString1=".nef", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".nrw") returned 4
	[0172.425] lstrcmpiW (lpString1=".nrw", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".obj") returned 4
	[0172.425] lstrcmpiW (lpString1=".obj", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".odb") returned 4
	[0172.425] lstrcmpiW (lpString1=".odb", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".odc") returned 4
	[0172.425] lstrcmpiW (lpString1=".odc", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".odm") returned 4
	[0172.425] lstrcmpiW (lpString1=".odm", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".odp") returned 4
	[0172.425] lstrcmpiW (lpString1=".odp", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".ods") returned 4
	[0172.425] lstrcmpiW (lpString1=".ods", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".oft") returned 4
	[0172.425] lstrcmpiW (lpString1=".oft", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".one") returned 4
	[0172.425] lstrcmpiW (lpString1=".one", lpString2=".ps1") returned -1
	[0172.425] lstrlenW (lpString=".onepkg") returned 7
	[0172.425] lstrcmpiW (lpString1=".onepkg", lpString2=".Be.ps1") returned 1
	[0172.426] lstrlenW (lpString=".onetoc2") returned 8
	[0172.426] lstrcmpiW (lpString1=".onetoc2", lpString2="") returned 1
	[0172.426] lstrlenW (lpString=".opt") returned 4
	[0172.426] lstrcmpiW (lpString1=".opt", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".oqy") returned 4
	[0172.426] lstrcmpiW (lpString1=".oqy", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".orf") returned 4
	[0172.426] lstrcmpiW (lpString1=".orf", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".p12") returned 4
	[0172.426] lstrcmpiW (lpString1=".p12", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".p7b") returned 4
	[0172.426] lstrcmpiW (lpString1=".p7b", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".p7c") returned 4
	[0172.426] lstrcmpiW (lpString1=".p7c", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".pam") returned 4
	[0172.426] lstrcmpiW (lpString1=".pam", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".pbm") returned 4
	[0172.426] lstrcmpiW (lpString1=".pbm", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".pct") returned 4
	[0172.426] lstrcmpiW (lpString1=".pct", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".pcx") returned 4
	[0172.426] lstrcmpiW (lpString1=".pcx", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".pdd") returned 4
	[0172.426] lstrcmpiW (lpString1=".pdd", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".pdf") returned 4
	[0172.426] lstrcmpiW (lpString1=".pdf", lpString2=".ps1") returned -1
	[0172.426] lstrlenW (lpString=".pdp") returned 4
	[0172.426] lstrcmpiW (lpString1=".pdp", lpString2=".ps1") returned -1
	[0172.427] lstrlenW (lpString=".pef") returned 4
	[0172.427] lstrcmpiW (lpString1=".pef", lpString2=".ps1") returned -1
	[0172.427] lstrlenW (lpString=".pem") returned 4
	[0172.427] lstrcmpiW (lpString1=".pem", lpString2=".ps1") returned -1
	[0172.427] lstrlenW (lpString=".pff") returned 4
	[0172.427] lstrcmpiW (lpString1=".pff", lpString2=".ps1") returned -1
	[0172.427] lstrlenW (lpString=".pfm") returned 4
	[0172.427] lstrcmpiW (lpString1=".pfm", lpString2=".ps1") returned -1
	[0172.427] lstrlenW (lpString=".pfx") returned 4
	[0172.427] lstrcmpiW (lpString1=".pfx", lpString2=".ps1") returned -1
	[0172.427] lstrlenW (lpString=".pgm") returned 4
	[0172.427] lstrcmpiW (lpString1=".pgm", lpString2=".ps1") returned -1
	[0172.427] lstrlenW (lpString=".php") returned 4
	[0172.427] lstrcmpiW (lpString1=".php", lpString2=".ps1") returned -1
	[0172.427] lstrlenW (lpString=".php3") returned 5
	[0172.427] lstrcmpiW (lpString1=".php3", lpString2="e.ps1") returned -1
	[0172.427] lstrlenW (lpString=".php4") returned 5
	[0172.427] lstrcmpiW (lpString1=".php4", lpString2="e.ps1") returned -1
	[0172.427] lstrlenW (lpString=".php5") returned 5
	[0172.427] lstrcmpiW (lpString1=".php5", lpString2="e.ps1") returned -1
	[0172.427] lstrlenW (lpString=".phtml") returned 6
	[0172.427] lstrcmpiW (lpString1=".phtml", lpString2="Be.ps1") returned -1
	[0172.427] lstrlenW (lpString=".pict") returned 5
	[0172.427] lstrcmpiW (lpString1=".pict", lpString2="e.ps1") returned -1
	[0172.427] lstrlenW (lpString=".pl") returned 3
	[0172.428] lstrcmpiW (lpString1=".pl", lpString2="ps1") returned -1
	[0172.428] lstrlenW (lpString=".pls") returned 4
	[0172.428] lstrcmpiW (lpString1=".pls", lpString2=".ps1") returned -1
	[0172.428] lstrlenW (lpString=".pm") returned 3
	[0172.428] lstrcmpiW (lpString1=".pm", lpString2="ps1") returned -1
	[0172.428] lstrlenW (lpString=".png") returned 4
	[0172.428] lstrcmpiW (lpString1=".png", lpString2=".ps1") returned -1
	[0172.428] lstrlenW (lpString=".pnm") returned 4
	[0172.428] lstrcmpiW (lpString1=".pnm", lpString2=".ps1") returned -1
	[0172.428] lstrlenW (lpString=".pot") returned 4
	[0172.428] lstrcmpiW (lpString1=".pot", lpString2=".ps1") returned -1
	[0172.428] lstrlenW (lpString=".potm") returned 5
	[0172.428] lstrcmpiW (lpString1=".potm", lpString2="e.ps1") returned -1
	[0172.428] lstrlenW (lpString=".potx") returned 5
	[0172.428] lstrcmpiW (lpString1=".potx", lpString2="e.ps1") returned -1
	[0172.428] lstrlenW (lpString=".ppa") returned 4
	[0172.428] lstrcmpiW (lpString1=".ppa", lpString2=".ps1") returned -1
	[0172.428] lstrlenW (lpString=".ppam") returned 5
	[0172.428] lstrcmpiW (lpString1=".ppam", lpString2="e.ps1") returned -1
	[0172.428] lstrlenW (lpString=".ppm") returned 4
	[0172.428] lstrcmpiW (lpString1=".ppm", lpString2=".ps1") returned -1
	[0172.428] lstrlenW (lpString=".pps") returned 4
	[0172.428] lstrcmpiW (lpString1=".pps", lpString2=".ps1") returned -1
	[0172.428] lstrlenW (lpString=".ppsm") returned 5
	[0172.428] lstrcmpiW (lpString1=".ppsm", lpString2="e.ps1") returned -1
	[0172.428] lstrlenW (lpString=".ppt") returned 4
	[0172.428] lstrcmpiW (lpString1=".ppt", lpString2=".ps1") returned -1
	[0172.428] lstrlenW (lpString=".pptm") returned 5
	[0172.429] lstrcmpiW (lpString1=".pptm", lpString2="e.ps1") returned -1
	[0172.429] lstrlenW (lpString=".pptx") returned 5
	[0172.429] lstrcmpiW (lpString1=".pptx", lpString2="e.ps1") returned -1
	[0172.429] lstrlenW (lpString=".prn") returned 4
	[0172.429] lstrcmpiW (lpString1=".prn", lpString2=".ps1") returned -1
	[0172.429] lstrlenW (lpString=".ps") returned 3
	[0172.429] lstrcmpiW (lpString1=".ps", lpString2="ps1") returned -1
	[0172.429] lstrlenW (lpString=".psb") returned 4
	[0172.429] lstrcmpiW (lpString1=".psb", lpString2=".ps1") returned 1
	[0172.429] lstrlenW (lpString=".psd") returned 4
	[0172.429] lstrcmpiW (lpString1=".psd", lpString2=".ps1") returned 1
	[0172.429] lstrlenW (lpString=".pst") returned 4
	[0172.429] lstrcmpiW (lpString1=".pst", lpString2=".ps1") returned 1
	[0172.429] lstrlenW (lpString=".ptx") returned 4
	[0172.429] lstrcmpiW (lpString1=".ptx", lpString2=".ps1") returned 1
	[0172.429] lstrlenW (lpString=".pub") returned 4
	[0172.429] lstrcmpiW (lpString1=".pub", lpString2=".ps1") returned 1
	[0172.429] lstrlenW (lpString=".pwm") returned 4
	[0172.429] lstrcmpiW (lpString1=".pwm", lpString2=".ps1") returned 1
	[0172.429] lstrlenW (lpString=".pxr") returned 4
	[0172.429] lstrcmpiW (lpString1=".pxr", lpString2=".ps1") returned 1
	[0172.431] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.431] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1
	[0172.432] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0172.432] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0172.435] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0172.435] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0
	[0172.435] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0172.436] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.437] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1
	[0172.440] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.440] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Build.bat", cAlternateFileName="")) returned 1
	[0172.544] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.544] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1
	[0172.545] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0172.545] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1
	[0172.546] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0172.546] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0
	[0172.546] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0172.546] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.546] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1
	[0172.552] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0172.552] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1
	[0172.553] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.553] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0172.556] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.556] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0
	[0172.556] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0172.556] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0172.556] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0
	[0172.556] FindClose (in: hFindFile=0x3e70f30 | out: hFindFile=0x3e70f30) returned 1
	[0172.557] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45eea00 | out: hHeap=0x4c0000) returned 1
	[0172.558] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1
	[0172.561] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.561] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1
	[0172.562] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45eea00 | out: hHeap=0x4c0000) returned 1
	[0172.562] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0
	[0172.562] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0172.562] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0172.564] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1
	[0172.567] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.567] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0172.567] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45eea00 | out: hHeap=0x4c0000) returned 1
	[0172.567] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1
	[0172.569] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.569] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0172.569] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45eea00 | out: hHeap=0x4c0000) returned 1
	[0172.569] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 0
	[0172.569] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0172.569] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0172.571] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0
	[0172.571] FindClose (in: hFindFile=0x3e709b0 | out: hFindFile=0x3e709b0) returned 1
	[0172.571] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0172.572] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f800 | out: lpFindFileData=0x359f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0
	[0172.572] FindClose (in: hFindFile=0x3e70ef0 | out: hFindFile=0x3e70ef0) returned 1
	[0172.572] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0172.572] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359fa7c | out: lpFindFileData=0x359fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0xffffdff0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0
	[0172.572] FindClose (in: hFindFile=0x3e70b70 | out: hFindFile=0x3e70b70) returned 1
	[0172.572] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fe8 | out: hHeap=0x4c0000) returned 1
	[0172.574] FindNextFileW (in: hFindFile=0x4eee10, lpFindFileData=0x359fcf8 | out: lpFindFileData=0x359fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1
	[0172.576] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.576] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x359f584 | out: lpFindFileData=0x359f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 1
	[0172.583] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.583] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0
	[0172.583] FindClose (in: hFindFile=0x3e70f30 | out: hFindFile=0x3e70f30) returned 1
	[0172.583] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.583] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d5caac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x465f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1
	[0172.603] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.603] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaaadbf3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1
	[0172.603] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.603] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1abe0524, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x134b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1
	[0172.604] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.604] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37a46528, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x152a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="arh.exe", cAlternateFileName="")) returned 1
	[0172.605] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.605] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WCChromeExtn", cAlternateFileName="WCCHRO~1")) returned 0
	[0172.605] FindClose (in: hFindFile=0x3e70b70 | out: hFindFile=0x3e70b70) returned 1
	[0172.605] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.605] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec3e62f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x35200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_asym.dll", cAlternateFileName="CCME_A~1.DLL")) returned 1
	[0172.608] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.608] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0
	[0172.608] FindClose (in: hFindFile=0x3e70b70 | out: hFindFile=0x3e70b70) returned 1
	[0172.608] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.608] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1
	[0172.609] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.609] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf981782, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xbc1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1
	[0172.610] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.610] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0
	[0172.610] FindClose (in: hFindFile=0x3e70b70 | out: hFindFile=0x3e70b70) returned 1
	[0172.610] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.610] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1
	[0172.611] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.611] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en_US", cAlternateFileName="")) returned 0
	[0172.612] FindClose (in: hFindFile=0x3e70f30 | out: hFindFile=0x3e70f30) returned 1
	[0172.612] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.612] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1fa1b97a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x62050, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1
	[0172.615] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0172.615] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0
	[0172.615] FindClose (in: hFindFile=0x3e70b70 | out: hFindFile=0x3e70b70) returned 1
	[0172.616] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.616] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe024c29f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xcb0e63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AcroForm.api", cAlternateFileName="")) returned 1
	[0172.617] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.617] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Words.pdf", cAlternateFileName="")) returned 1
	[0172.617] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0172.617] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0
	[0172.617] FindClose (in: hFindFile=0x3e70b70 | out: hFindFile=0x3e70b70) returned 1
	[0172.617] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.618] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfdd3bd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x71bc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Annots.api", cAlternateFileName="")) returned 1
	[0172.620] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0172.620] FindNextFileW (in: hFindFile=0x3e70b70, lpFindFileData=0x359ee10 | out: lpFindFileData=0x359ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 0
	[0172.620] FindClose (in: hFindFile=0x3e70b70 | out: hFindFile=0x3e70b70) returned 1
	[0172.620] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.620] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc5641f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x179063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1
	[0172.621] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.621] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe05dfab0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x6edc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PPKLite.api", cAlternateFileName="")) returned 1
	[0172.622] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.623] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1
	[0172.626] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0172.626] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x359f08c | out: lpFindFileData=0x359f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfbe3d1f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2437f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prcr.x3d", cAlternateFileName="")) returned 1
	[0172.626] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.626] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37adee54, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1
	[0172.630] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.630] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIThemes", cAlternateFileName="")) returned 1
	[0172.631] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.631] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x359f308 | out: lpFindFileData=0x359f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b050b7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x42a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1
	[0172.765] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.766] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1
	[0172.766] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.766] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0
	[0172.766] FindClose (in: hFindFile=0x3e705f0 | out: hFindFile=0x3e705f0) returned 1
	[0172.766] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.766] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0172.766] FindClose (in: hFindFile=0x3e70870 | out: hFindFile=0x3e70870) returned 1
	[0172.766] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.766] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="core", cAlternateFileName="")) returned 1
	[0172.771] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.771] FindNextFileW (in: hFindFile=0x3e70670, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1
	[0172.771] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.771] FindNextFileW (in: hFindFile=0x3e70670, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0
	[0172.771] FindClose (in: hFindFile=0x3e70670 | out: hFindFile=0x3e70670) returned 1
	[0172.772] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.772] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0172.772] FindClose (in: hFindFile=0x3e707f0 | out: hFindFile=0x3e707f0) returned 1
	[0172.772] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.772] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="files", cAlternateFileName="")) returned 1
	[0172.773] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.773] FindNextFileW (in: hFindFile=0x3e70830, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1
	[0172.773] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.773] FindNextFileW (in: hFindFile=0x3e70830, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0
	[0172.773] FindClose (in: hFindFile=0x3e70830 | out: hFindFile=0x3e70830) returned 1
	[0172.773] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.773] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0172.773] FindClose (in: hFindFile=0x3e70570 | out: hFindFile=0x3e70570) returned 1
	[0172.773] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.773] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-mac.css", cAlternateFileName="MAIN-C~2.CSS")) returned 1
	[0172.774] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.775] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1
	[0172.783] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.783] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1
	[0172.785] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.785] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0172.785] FindClose (in: hFindFile=0x3e703b0 | out: hFindFile=0x3e703b0) returned 1
	[0172.786] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.786] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0172.786] FindClose (in: hFindFile=0x3e700b0 | out: hFindFile=0x3e700b0) returned 1
	[0172.786] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.786] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi_contrast", cAlternateFileName="HI_CON~1")) returned 1
	[0172.788] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.788] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1185, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1
	[0172.792] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.792] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0
	[0172.792] FindClose (in: hFindFile=0x3e703b0 | out: hFindFile=0x3e703b0) returned 1
	[0172.793] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.793] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win-scrollbar", cAlternateFileName="WIN-SC~1")) returned 1
	[0172.798] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.798] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0172.798] FindClose (in: hFindFile=0x3e705b0 | out: hFindFile=0x3e705b0) returned 1
	[0172.798] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.798] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vscroll-thumb.png", cAlternateFileName="VSCROL~1.PNG")) returned 1
	[0172.798] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.798] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 1
	[0172.803] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.803] FindNextFileW (in: hFindFile=0x3e70830, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0172.803] FindClose (in: hFindFile=0x3e70830 | out: hFindFile=0x3e70830) returned 1
	[0172.803] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.803] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0172.803] FindClose (in: hFindFile=0x3e707f0 | out: hFindFile=0x3e707f0) returned 1
	[0172.803] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.803] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 0
	[0172.803] FindClose (in: hFindFile=0x3e701b0 | out: hFindFile=0x3e701b0) returned 1
	[0172.803] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.805] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x359eb94 | out: lpFindFileData=0x359eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1
	[0173.002] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.002] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0173.002] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.002] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0173.003] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.003] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0173.003] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.004] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1
	[0173.004] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.004] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0173.005] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.005] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0173.006] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.006] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1
	[0173.007] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.007] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1
	[0173.007] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.007] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0173.008] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.008] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0173.009] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.009] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0173.009] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.010] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0173.013] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.013] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1
	[0173.014] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.014] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0173.014] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.014] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0173.015] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.015] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1
	[0173.015] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.015] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0173.016] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.016] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0173.016] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.016] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0173.017] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.017] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0173.017] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.017] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0173.018] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.018] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0173.018] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.018] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0173.019] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.019] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1
	[0173.019] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.019] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0173.019] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.019] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0173.020] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.020] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0173.021] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.021] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0173.021] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.021] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0173.022] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.022] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0173.022] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.022] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0173.022] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.022] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0173.023] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.023] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0173.034] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.034] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0173.034] FindClose (in: hFindFile=0x3e701f0 | out: hFindFile=0x3e701f0) returned 1
	[0173.034] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f7fe0 | out: hHeap=0x4c0000) returned 1
	[0173.034] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0
	[0173.034] FindClose (in: hFindFile=0x3e703f0 | out: hFindFile=0x3e703f0) returned 1
	[0173.034] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0173.034] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0173.034] FindClose (in: hFindFile=0x3e705b0 | out: hFindFile=0x3e705b0) returned 1
	[0173.034] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.035] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="app-api", cAlternateFileName="")) returned 1
	[0173.066] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0173.066] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0173.066] FindClose (in: hFindFile=0x3e70870 | out: hFindFile=0x3e70870) returned 1
	[0173.066] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.066] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x593, dwReserved0=0x0, dwReserved1=0x0, cFileName="config.js", cAlternateFileName="")) returned 1
	[0173.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.171] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0173.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.181] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0173.184] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.185] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0173.185] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.185] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1
	[0173.195] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.195] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0173.196] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.196] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0173.197] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.197] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1
	[0173.198] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.198] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1
	[0173.198] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.198] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0173.199] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.199] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0173.199] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.200] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0173.200] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.200] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0173.201] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.201] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1
	[0173.202] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.202] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0173.202] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.203] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0173.203] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.203] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1
	[0173.204] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.204] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0173.204] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.204] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0173.205] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.205] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0173.205] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.205] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0173.206] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.206] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0173.207] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.207] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0173.207] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.208] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0173.208] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.208] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1
	[0173.209] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.209] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0173.209] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.209] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0173.210] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.210] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0173.210] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.210] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0173.211] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.211] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0173.211] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.211] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0173.211] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.211] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0173.212] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.212] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0173.212] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.212] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0173.212] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.213] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0173.213] FindClose (in: hFindFile=0x3e701f0 | out: hFindFile=0x3e701f0) returned 1
	[0173.213] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f7fe0 | out: hHeap=0x4c0000) returned 1
	[0173.213] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0
	[0173.213] FindClose (in: hFindFile=0x3e703f0 | out: hFindFile=0x3e703f0) returned 1
	[0173.213] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0173.213] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0173.213] FindClose (in: hFindFile=0x3e702b0 | out: hFindFile=0x3e702b0) returned 1
	[0173.213] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.214] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.js", cAlternateFileName="")) returned 1
	[0173.218] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.218] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0173.219] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.219] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0173.219] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.220] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0173.220] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.220] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1
	[0173.221] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.221] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0173.222] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.222] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0173.222] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.222] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1
	[0173.223] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.223] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1
	[0173.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.224] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0173.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.224] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0173.619] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.619] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0173.621] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.621] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0173.621] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.622] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1
	[0173.622] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.622] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0173.622] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.622] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0173.623] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.623] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1
	[0173.624] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.624] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0173.625] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.625] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0173.626] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.626] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0173.626] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.626] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0173.627] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.627] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0173.628] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.628] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0173.628] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.628] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0173.629] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.629] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1
	[0173.629] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.629] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0173.630] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.630] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0173.631] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.631] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0173.631] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.631] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0173.631] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.631] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0173.632] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.632] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0173.632] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.632] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0173.632] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.632] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0173.633] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.633] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0173.633] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.633] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0173.633] FindClose (in: hFindFile=0x3e700b0 | out: hFindFile=0x3e700b0) returned 1
	[0173.633] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f7fe0 | out: hHeap=0x4c0000) returned 1
	[0173.633] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0
	[0173.633] FindClose (in: hFindFile=0x3e707f0 | out: hFindFile=0x3e707f0) returned 1
	[0173.633] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0173.634] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0173.634] FindClose (in: hFindFile=0x3e705b0 | out: hFindFile=0x3e705b0) returned 1
	[0173.634] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.635] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1
	[0173.636] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0173.636] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.2.2", cAlternateFileName="020A5B~1.2")) returned 0
	[0173.636] FindClose (in: hFindFile=0x3e707f0 | out: hFindFile=0x3e707f0) returned 1
	[0173.636] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0173.636] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 1
	[0173.637] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0173.637] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.1.15", cAlternateFileName="211994~1.15")) returned 0
	[0173.637] FindClose (in: hFindFile=0x3e702b0 | out: hFindFile=0x3e702b0) returned 1
	[0173.637] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0173.637] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 0
	[0173.637] FindClose (in: hFindFile=0x3e703f0 | out: hFindFile=0x3e703f0) returned 1
	[0173.637] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0173.637] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc", cAlternateFileName="")) returned 1
	[0173.638] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0173.638] FindNextFileW (in: hFindFile=0x3e706b0, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1
	[0173.657] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0173.657] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0173.687] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.687] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0173.687] FindClose (in: hFindFile=0x3e70870 | out: hFindFile=0x3e70870) returned 1
	[0173.687] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.687] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0173.687] FindClose (in: hFindFile=0x3e70430 | out: hFindFile=0x3e70430) returned 1
	[0173.687] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0173.687] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0173.708] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.708] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0173.709] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.709] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0173.709] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.709] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0173.710] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.710] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0173.714] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.714] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0173.717] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.717] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0173.717] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.717] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0173.724] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.724] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0173.728] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.729] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0173.891] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.894] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0173.895] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.895] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0173.896] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.896] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0173.896] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.896] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0173.897] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.897] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0173.897] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.897] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0173.906] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.906] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0173.907] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.907] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0173.908] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.908] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0173.908] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.909] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0173.909] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.909] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0173.910] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.910] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0173.911] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.911] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0173.911] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.911] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0173.911] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.911] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0173.912] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.912] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0173.913] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.913] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0173.913] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.913] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0173.914] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.914] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0173.914] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.914] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0173.914] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.914] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0173.915] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.915] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0173.915] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.915] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0173.915] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.916] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0173.916] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.916] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0173.916] FindClose (in: hFindFile=0x3e702b0 | out: hFindFile=0x3e702b0) returned 1
	[0173.916] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.916] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9838, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0173.916] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0173.916] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0173.916] FindClose (in: hFindFile=0x3e703f0 | out: hFindFile=0x3e703f0) returned 1
	[0173.916] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0173.916] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add-account-select", cAlternateFileName="ADD-AC~2")) returned 1
	[0173.920] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0173.920] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0173.921] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0173.921] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0173.921] FindClose (in: hFindFile=0x3e70570 | out: hFindFile=0x3e70570) returned 1
	[0173.921] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.922] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aicuc", cAlternateFileName="")) returned 1
	[0173.925] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0173.925] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0173.930] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.930] FindNextFileW (in: hFindFile=0x3e70830, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0173.930] FindClose (in: hFindFile=0x3e70830 | out: hFindFile=0x3e70830) returned 1
	[0173.930] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0173.930] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.png", cAlternateFileName="")) returned 1
	[0173.930] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0173.930] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0173.933] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.933] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0173.934] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.934] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0173.934] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.934] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0173.935] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.935] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0173.935] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.936] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0173.936] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.936] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0173.937] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.937] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0173.938] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.938] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0173.938] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.938] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0173.939] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.939] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0173.939] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.939] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0173.940] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.940] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0173.940] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.940] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0173.940] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0173.940] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1
	[0173.987] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.987] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 1
	[0173.988] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.988] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359dcac | out: lpFindFileData=0x359dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 1
	[0173.989] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0173.989] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x359dcac | out: lpFindFileData=0x359dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 0
	[0173.989] FindClose (in: hFindFile=0x3e701f0 | out: hFindFile=0x3e701f0) returned 1
	[0173.989] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.989] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 0
	[0173.989] FindClose (in: hFindFile=0x3e703b0 | out: hFindFile=0x3e703b0) returned 1
	[0173.989] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0173.989] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0
	[0173.989] FindClose (in: hFindFile=0x3e702b0 | out: hFindFile=0x3e702b0) returned 1
	[0173.989] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0173.990] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0173.990] FindClose (in: hFindFile=0x3e70430 | out: hFindFile=0x3e70430) returned 1
	[0173.990] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.990] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf", cAlternateFileName="COMBIN~1")) returned 1
	[0173.993] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0173.993] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0173.998] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.998] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0173.998] FindClose (in: hFindFile=0x3e700b0 | out: hFindFile=0x3e700b0) returned 1
	[0173.998] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0173.998] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0173.998] FindClose (in: hFindFile=0x3e703f0 | out: hFindFile=0x3e703f0) returned 1
	[0173.998] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0173.998] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0174.002] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.002] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0174.003] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.003] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0174.003] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.003] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0174.004] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.004] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0174.007] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.007] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0174.008] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.008] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0174.008] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.008] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0174.009] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.009] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0174.009] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.009] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0174.010] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.010] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0174.011] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.011] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0174.011] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.011] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0174.012] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.012] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0174.013] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.013] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0174.013] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.013] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0174.014] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.014] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0174.014] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.014] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0174.015] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.015] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0174.016] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.016] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0174.016] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.016] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0174.017] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.017] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0174.017] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.017] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0174.018] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.018] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0174.019] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.019] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0174.019] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.019] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0174.020] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.020] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0174.021] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.021] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0174.021] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.021] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0174.021] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.022] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0174.022] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.022] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0174.022] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.022] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0174.023] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.023] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0174.024] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.024] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0174.025] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.025] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0174.025] FindClose (in: hFindFile=0x3e707f0 | out: hFindFile=0x3e707f0) returned 1
	[0174.025] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0174.025] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0174.106] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.106] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0
	[0174.107] FindClose (in: hFindFile=0x3e703f0 | out: hFindFile=0x3e703f0) returned 1
	[0174.107] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0174.107] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0
	[0174.107] FindClose (in: hFindFile=0x3e70430 | out: hFindFile=0x3e70430) returned 1
	[0174.107] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0174.107] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0174.107] FindClose (in: hFindFile=0x3e70570 | out: hFindFile=0x3e70570) returned 1
	[0174.107] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0174.108] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="createpdfupsell-app", cAlternateFileName="CREATE~1")) returned 1
	[0174.110] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0174.110] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0174.115] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.115] FindNextFileW (in: hFindFile=0x3e70870, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0174.115] FindClose (in: hFindFile=0x3e70870 | out: hFindFile=0x3e70870) returned 1
	[0174.115] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460ea10 | out: hHeap=0x4c0000) returned 1
	[0174.115] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0174.115] FindClose (in: hFindFile=0x3e705f0 | out: hFindFile=0x3e705f0) returned 1
	[0174.115] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0174.115] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0174.118] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.118] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0174.119] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.119] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0174.120] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.120] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0174.120] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.120] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0174.121] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.121] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0174.122] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.122] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0174.122] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.122] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0174.123] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.123] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0174.123] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.123] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0174.124] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.124] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0174.125] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.125] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0174.126] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.126] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0174.127] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.127] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0174.127] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.127] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0174.128] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.128] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0174.129] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.129] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0174.129] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.129] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0174.129] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.129] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0174.130] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.130] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0174.131] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.131] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0174.131] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.131] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0174.131] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.131] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0174.132] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.132] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0174.133] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.133] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0174.133] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.133] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0174.134] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.134] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0174.134] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.134] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0174.135] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.135] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0174.137] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.137] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0174.137] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.137] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0174.138] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.138] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0174.138] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.138] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0174.138] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.138] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0174.139] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.139] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0174.139] FindClose (in: hFindFile=0x3e705f0 | out: hFindFile=0x3e705f0) returned 1
	[0174.139] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460ea10 | out: hHeap=0x4c0000) returned 1
	[0174.139] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0174.140] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.140] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x359df28 | out: lpFindFileData=0x359df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0
	[0174.140] FindClose (in: hFindFile=0x3e707f0 | out: hFindFile=0x3e707f0) returned 1
	[0174.140] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460ea10 | out: hHeap=0x4c0000) returned 1
	[0174.140] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x359e1a4 | out: lpFindFileData=0x359e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0
	[0174.140] FindClose (in: hFindFile=0x3e701b0 | out: hFindFile=0x3e701b0) returned 1
	[0174.140] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0174.140] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0174.140] FindClose (in: hFindFile=0x3e70570 | out: hFindFile=0x3e70570) returned 1
	[0174.140] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0174.142] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dc-annotations", cAlternateFileName="DC-ANN~1")) returned 1
	[0174.144] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0174.144] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0174.144] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0174.144] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x359e420 | out: lpFindFileData=0x359e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0174.144] FindClose (in: hFindFile=0x3e70470 | out: hFindFile=0x3e70470) returned 1
	[0174.144] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0174.144] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x359e69c | out: lpFindFileData=0x359e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files", cAlternateFileName="DESKTO~2")) returned 1
	[0186.048] FindNextFileW (in: hFindFile=0x3e70830, lpFindFileData=0x359e918 | out: lpFindFileData=0x359e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc7a3c0a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfc7a3c0a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfc7a3c0a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.svg", cAlternateFileName="")) returned 1
	[0186.048] lstrlenW (lpString="folder.svg") returned 10
	[0186.048] lstrlenW (lpString=".1cd") returned 4
	[0186.048] lstrcmpiW (lpString1=".1cd", lpString2=".svg") returned -1
	[0186.048] lstrlenW (lpString=".3ds") returned 4
	[0186.048] lstrcmpiW (lpString1=".3ds", lpString2=".svg") returned -1
	[0186.048] lstrlenW (lpString=".3fr") returned 4
	[0186.048] lstrcmpiW (lpString1=".3fr", lpString2=".svg") returned -1
	[0186.048] lstrlenW (lpString=".3g2") returned 4
	[0186.048] lstrcmpiW (lpString1=".3g2", lpString2=".svg") returned -1
	[0186.048] lstrlenW (lpString=".3gp") returned 4
	[0186.048] lstrcmpiW (lpString1=".3gp", lpString2=".svg") returned -1
	[0186.048] lstrlenW (lpString=".7z") returned 3
	[0186.048] lstrcmpiW (lpString1=".7z", lpString2="svg") returned -1
	[0186.048] lstrlenW (lpString=".accda") returned 6
	[0186.048] lstrcmpiW (lpString1=".accda", lpString2="er.svg") returned -1
	[0186.048] lstrlenW (lpString=".accdb") returned 6
	[0186.048] lstrcmpiW (lpString1=".accdb", lpString2="er.svg") returned -1
	[0186.048] lstrlenW (lpString=".accdc") returned 6
	[0186.048] lstrcmpiW (lpString1=".accdc", lpString2="er.svg") returned -1
	[0186.048] lstrlenW (lpString=".accde") returned 6
	[0186.048] lstrcmpiW (lpString1=".accde", lpString2="er.svg") returned -1
	[0186.048] lstrlenW (lpString=".accdt") returned 6
	[0186.048] lstrcmpiW (lpString1=".accdt", lpString2="er.svg") returned -1
	[0186.049] lstrlenW (lpString=".accdw") returned 6
	[0186.049] lstrcmpiW (lpString1=".accdw", lpString2="er.svg") returned -1
	[0186.049] lstrlenW (lpString=".adb") returned 4
	[0186.049] lstrcmpiW (lpString1=".adb", lpString2=".svg") returned -1
	[0186.049] lstrlenW (lpString=".adp") returned 4
	[0186.049] lstrcmpiW (lpString1=".adp", lpString2=".svg") returned -1
	[0186.049] lstrlenW (lpString=".ai") returned 3
	[0186.049] lstrcmpiW (lpString1=".ai", lpString2="svg") returned -1
	[0186.049] lstrlenW (lpString=".ai3") returned 4
	[0186.049] lstrcmpiW (lpString1=".ai3", lpString2=".svg") returned -1
	[0186.049] lstrlenW (lpString=".ai4") returned 4
	[0186.049] lstrcmpiW (lpString1=".ai4", lpString2=".svg") returned -1
	[0186.049] lstrlenW (lpString=".ai5") returned 4
	[0186.049] lstrcmpiW (lpString1=".ai5", lpString2=".svg") returned -1
	[0186.049] lstrlenW (lpString=".ai6") returned 4
	[0186.049] lstrcmpiW (lpString1=".ai6", lpString2=".svg") returned -1
	[0186.049] lstrlenW (lpString=".ai7") returned 4
	[0186.049] lstrcmpiW (lpString1=".ai7", lpString2=".svg") returned -1
	[0186.049] lstrlenW (lpString=".ai8") returned 4
	[0186.049] lstrcmpiW (lpString1=".ai8", lpString2=".svg") returned -1
	[0186.049] lstrlenW (lpString=".anim") returned 5
	[0186.049] lstrcmpiW (lpString1=".anim", lpString2="r.svg") returned -1
	[0186.049] lstrlenW (lpString=".arw") returned 4
	[0186.049] lstrcmpiW (lpString1=".arw", lpString2=".svg") returned -1
	[0186.049] lstrlenW (lpString=".as") returned 3
	[0186.049] lstrcmpiW (lpString1=".as", lpString2="svg") returned -1
	[0186.049] lstrlenW (lpString=".asa") returned 4
	[0186.049] lstrcmpiW (lpString1=".asa", lpString2=".svg") returned -1
	[0186.049] lstrlenW (lpString=".asc") returned 4
	[0186.049] lstrcmpiW (lpString1=".asc", lpString2=".svg") returned -1
	[0186.049] lstrlenW (lpString=".ascx") returned 5
	[0186.050] lstrcmpiW (lpString1=".ascx", lpString2="r.svg") returned -1
	[0186.050] lstrlenW (lpString=".asm") returned 4
	[0186.050] lstrcmpiW (lpString1=".asm", lpString2=".svg") returned -1
	[0186.050] lstrlenW (lpString=".asmx") returned 5
	[0186.050] lstrcmpiW (lpString1=".asmx", lpString2="r.svg") returned -1
	[0186.050] lstrlenW (lpString=".asp") returned 4
	[0186.050] lstrcmpiW (lpString1=".asp", lpString2=".svg") returned -1
	[0186.050] lstrlenW (lpString=".aspx") returned 5
	[0186.050] lstrcmpiW (lpString1=".aspx", lpString2="r.svg") returned -1
	[0186.050] lstrlenW (lpString=".asr") returned 4
	[0186.050] lstrcmpiW (lpString1=".asr", lpString2=".svg") returned -1
	[0186.050] lstrlenW (lpString=".asx") returned 4
	[0186.050] lstrcmpiW (lpString1=".asx", lpString2=".svg") returned -1
	[0186.050] lstrlenW (lpString=".avi") returned 4
	[0186.050] lstrcmpiW (lpString1=".avi", lpString2=".svg") returned -1
	[0186.050] lstrlenW (lpString=".avs") returned 4
	[0186.050] lstrcmpiW (lpString1=".avs", lpString2=".svg") returned -1
	[0186.050] lstrlenW (lpString=".backup") returned 7
	[0186.050] lstrcmpiW (lpString1=".backup", lpString2="der.svg") returned -1
	[0186.050] lstrlenW (lpString=".bak") returned 4
	[0186.050] lstrcmpiW (lpString1=".bak", lpString2=".svg") returned -1
	[0186.050] lstrlenW (lpString=".bay") returned 4
	[0186.050] lstrcmpiW (lpString1=".bay", lpString2=".svg") returned -1
	[0186.050] lstrlenW (lpString=".bd") returned 3
	[0186.050] lstrcmpiW (lpString1=".bd", lpString2="svg") returned -1
	[0186.050] lstrlenW (lpString=".bin") returned 4
	[0186.050] lstrcmpiW (lpString1=".bin", lpString2=".svg") returned -1
	[0186.050] lstrlenW (lpString=".bmp") returned 4
	[0186.050] lstrcmpiW (lpString1=".bmp", lpString2=".svg") returned -1
	[0186.050] lstrlenW (lpString=".bz2") returned 4
	[0186.050] lstrcmpiW (lpString1=".bz2", lpString2=".svg") returned -1
	[0186.050] lstrlenW (lpString=".c") returned 2
	[0186.051] lstrcmpiW (lpString1=".c", lpString2="vg") returned -1
	[0186.051] lstrlenW (lpString=".cdr") returned 4
	[0186.051] lstrcmpiW (lpString1=".cdr", lpString2=".svg") returned -1
	[0186.051] lstrlenW (lpString=".cer") returned 4
	[0186.051] lstrcmpiW (lpString1=".cer", lpString2=".svg") returned -1
	[0186.051] lstrlenW (lpString=".cf") returned 3
	[0186.051] lstrcmpiW (lpString1=".cf", lpString2="svg") returned -1
	[0186.051] lstrlenW (lpString=".cfc") returned 4
	[0186.051] lstrcmpiW (lpString1=".cfc", lpString2=".svg") returned -1
	[0186.051] lstrlenW (lpString=".cfm") returned 4
	[0186.051] lstrcmpiW (lpString1=".cfm", lpString2=".svg") returned -1
	[0186.051] lstrlenW (lpString=".cfml") returned 5
	[0186.051] lstrcmpiW (lpString1=".cfml", lpString2="r.svg") returned -1
	[0186.051] lstrlenW (lpString=".cfu") returned 4
	[0186.051] lstrcmpiW (lpString1=".cfu", lpString2=".svg") returned -1
	[0186.051] lstrlenW (lpString=".chm") returned 4
	[0186.051] lstrcmpiW (lpString1=".chm", lpString2=".svg") returned -1
	[0186.051] lstrlenW (lpString=".cin") returned 4
	[0186.051] lstrcmpiW (lpString1=".cin", lpString2=".svg") returned -1
	[0186.051] lstrlenW (lpString=".class") returned 6
	[0186.051] lstrcmpiW (lpString1=".class", lpString2="er.svg") returned -1
	[0186.051] lstrlenW (lpString=".clx") returned 4
	[0186.051] lstrcmpiW (lpString1=".clx", lpString2=".svg") returned -1
	[0186.051] lstrlenW (lpString=".config") returned 7
	[0186.051] lstrcmpiW (lpString1=".config", lpString2="der.svg") returned -1
	[0186.051] lstrlenW (lpString=".cpp") returned 4
	[0186.051] lstrcmpiW (lpString1=".cpp", lpString2=".svg") returned -1
	[0186.051] lstrlenW (lpString=".cr2") returned 4
	[0186.051] lstrcmpiW (lpString1=".cr2", lpString2=".svg") returned -1
	[0186.051] lstrlenW (lpString=".crt") returned 4
	[0186.051] lstrcmpiW (lpString1=".crt", lpString2=".svg") returned -1
	[0186.051] lstrlenW (lpString=".crw") returned 4
	[0186.052] lstrcmpiW (lpString1=".crw", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".cs") returned 3
	[0186.052] lstrcmpiW (lpString1=".cs", lpString2="svg") returned -1
	[0186.052] lstrlenW (lpString=".css") returned 4
	[0186.052] lstrcmpiW (lpString1=".css", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".csv") returned 4
	[0186.052] lstrcmpiW (lpString1=".csv", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".cub") returned 4
	[0186.052] lstrcmpiW (lpString1=".cub", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".dae") returned 4
	[0186.052] lstrcmpiW (lpString1=".dae", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".dat") returned 4
	[0186.052] lstrcmpiW (lpString1=".dat", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".db") returned 3
	[0186.052] lstrcmpiW (lpString1=".db", lpString2="svg") returned -1
	[0186.052] lstrlenW (lpString=".dbf") returned 4
	[0186.052] lstrcmpiW (lpString1=".dbf", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".dbx") returned 4
	[0186.052] lstrcmpiW (lpString1=".dbx", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".dc3") returned 4
	[0186.052] lstrcmpiW (lpString1=".dc3", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".dcm") returned 4
	[0186.052] lstrcmpiW (lpString1=".dcm", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".dcr") returned 4
	[0186.052] lstrcmpiW (lpString1=".dcr", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".der") returned 4
	[0186.052] lstrcmpiW (lpString1=".der", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".dib") returned 4
	[0186.052] lstrcmpiW (lpString1=".dib", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".dic") returned 4
	[0186.052] lstrcmpiW (lpString1=".dic", lpString2=".svg") returned -1
	[0186.052] lstrlenW (lpString=".dif") returned 4
	[0186.053] lstrcmpiW (lpString1=".dif", lpString2=".svg") returned -1
	[0186.053] lstrlenW (lpString=".divx") returned 5
	[0186.053] lstrcmpiW (lpString1=".divx", lpString2="r.svg") returned -1
	[0186.053] lstrlenW (lpString=".djvu") returned 5
	[0186.053] lstrcmpiW (lpString1=".djvu", lpString2="r.svg") returned -1
	[0186.053] lstrlenW (lpString=".dng") returned 4
	[0186.053] lstrcmpiW (lpString1=".dng", lpString2=".svg") returned -1
	[0186.053] lstrlenW (lpString=".doc") returned 4
	[0186.053] lstrcmpiW (lpString1=".doc", lpString2=".svg") returned -1
	[0186.053] lstrlenW (lpString=".docm") returned 5
	[0186.053] lstrcmpiW (lpString1=".docm", lpString2="r.svg") returned -1
	[0186.053] lstrlenW (lpString=".docx") returned 5
	[0186.053] lstrcmpiW (lpString1=".docx", lpString2="r.svg") returned -1
	[0186.053] lstrlenW (lpString=".dot") returned 4
	[0186.053] lstrcmpiW (lpString1=".dot", lpString2=".svg") returned -1
	[0186.053] lstrlenW (lpString=".dotm") returned 5
	[0186.053] lstrcmpiW (lpString1=".dotm", lpString2="r.svg") returned -1
	[0186.053] lstrlenW (lpString=".dotx") returned 5
	[0186.053] lstrcmpiW (lpString1=".dotx", lpString2="r.svg") returned -1
	[0186.053] lstrlenW (lpString=".dpx") returned 4
	[0186.053] lstrcmpiW (lpString1=".dpx", lpString2=".svg") returned -1
	[0186.053] lstrlenW (lpString=".dqy") returned 4
	[0186.053] lstrcmpiW (lpString1=".dqy", lpString2=".svg") returned -1
	[0186.053] lstrlenW (lpString=".dsn") returned 4
	[0186.053] lstrcmpiW (lpString1=".dsn", lpString2=".svg") returned -1
	[0186.053] lstrlenW (lpString=".dt") returned 3
	[0186.053] lstrcmpiW (lpString1=".dt", lpString2="svg") returned -1
	[0186.053] lstrlenW (lpString=".dtd") returned 4
	[0186.053] lstrcmpiW (lpString1=".dtd", lpString2=".svg") returned -1
	[0186.053] lstrlenW (lpString=".dwg") returned 4
	[0186.053] lstrcmpiW (lpString1=".dwg", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".dwt") returned 4
	[0186.054] lstrcmpiW (lpString1=".dwt", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".dx") returned 3
	[0186.054] lstrcmpiW (lpString1=".dx", lpString2="svg") returned -1
	[0186.054] lstrlenW (lpString=".dxf") returned 4
	[0186.054] lstrcmpiW (lpString1=".dxf", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".edml") returned 5
	[0186.054] lstrcmpiW (lpString1=".edml", lpString2="r.svg") returned -1
	[0186.054] lstrlenW (lpString=".efd") returned 4
	[0186.054] lstrcmpiW (lpString1=".efd", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".elf") returned 4
	[0186.054] lstrcmpiW (lpString1=".elf", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".emf") returned 4
	[0186.054] lstrcmpiW (lpString1=".emf", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".emz") returned 4
	[0186.054] lstrcmpiW (lpString1=".emz", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".epf") returned 4
	[0186.054] lstrcmpiW (lpString1=".epf", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".eps") returned 4
	[0186.054] lstrcmpiW (lpString1=".eps", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".epsf") returned 5
	[0186.054] lstrcmpiW (lpString1=".epsf", lpString2="r.svg") returned -1
	[0186.054] lstrlenW (lpString=".epsp") returned 5
	[0186.054] lstrcmpiW (lpString1=".epsp", lpString2="r.svg") returned -1
	[0186.054] lstrlenW (lpString=".erf") returned 4
	[0186.054] lstrcmpiW (lpString1=".erf", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".exr") returned 4
	[0186.054] lstrcmpiW (lpString1=".exr", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".f4v") returned 4
	[0186.054] lstrcmpiW (lpString1=".f4v", lpString2=".svg") returned -1
	[0186.054] lstrlenW (lpString=".fido") returned 5
	[0186.054] lstrcmpiW (lpString1=".fido", lpString2="r.svg") returned -1
	[0186.054] lstrlenW (lpString=".flm") returned 4
	[0186.055] lstrcmpiW (lpString1=".flm", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".flv") returned 4
	[0186.055] lstrcmpiW (lpString1=".flv", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".frm") returned 4
	[0186.055] lstrcmpiW (lpString1=".frm", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".fxg") returned 4
	[0186.055] lstrcmpiW (lpString1=".fxg", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".geo") returned 4
	[0186.055] lstrcmpiW (lpString1=".geo", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".gif") returned 4
	[0186.055] lstrcmpiW (lpString1=".gif", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".grs") returned 4
	[0186.055] lstrcmpiW (lpString1=".grs", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".gz") returned 3
	[0186.055] lstrcmpiW (lpString1=".gz", lpString2="svg") returned -1
	[0186.055] lstrlenW (lpString=".h") returned 2
	[0186.055] lstrcmpiW (lpString1=".h", lpString2="vg") returned -1
	[0186.055] lstrlenW (lpString=".hdr") returned 4
	[0186.055] lstrcmpiW (lpString1=".hdr", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".hpp") returned 4
	[0186.055] lstrcmpiW (lpString1=".hpp", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".hta") returned 4
	[0186.055] lstrcmpiW (lpString1=".hta", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".htc") returned 4
	[0186.055] lstrcmpiW (lpString1=".htc", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".htm") returned 4
	[0186.055] lstrcmpiW (lpString1=".htm", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".html") returned 5
	[0186.055] lstrcmpiW (lpString1=".html", lpString2="r.svg") returned -1
	[0186.055] lstrlenW (lpString=".icb") returned 4
	[0186.055] lstrcmpiW (lpString1=".icb", lpString2=".svg") returned -1
	[0186.055] lstrlenW (lpString=".ics") returned 4
	[0186.056] lstrcmpiW (lpString1=".ics", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".iff") returned 4
	[0186.056] lstrcmpiW (lpString1=".iff", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".inc") returned 4
	[0186.056] lstrcmpiW (lpString1=".inc", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".indd") returned 5
	[0186.056] lstrcmpiW (lpString1=".indd", lpString2="r.svg") returned -1
	[0186.056] lstrlenW (lpString=".ini") returned 4
	[0186.056] lstrcmpiW (lpString1=".ini", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".iqy") returned 4
	[0186.056] lstrcmpiW (lpString1=".iqy", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".j2c") returned 4
	[0186.056] lstrcmpiW (lpString1=".j2c", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".j2k") returned 4
	[0186.056] lstrcmpiW (lpString1=".j2k", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".java") returned 5
	[0186.056] lstrcmpiW (lpString1=".java", lpString2="r.svg") returned -1
	[0186.056] lstrlenW (lpString=".jp2") returned 4
	[0186.056] lstrcmpiW (lpString1=".jp2", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".jpc") returned 4
	[0186.056] lstrcmpiW (lpString1=".jpc", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".jpe") returned 4
	[0186.056] lstrcmpiW (lpString1=".jpe", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".jpeg") returned 5
	[0186.056] lstrcmpiW (lpString1=".jpeg", lpString2="r.svg") returned -1
	[0186.056] lstrlenW (lpString=".jpf") returned 4
	[0186.056] lstrcmpiW (lpString1=".jpf", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".jpg") returned 4
	[0186.056] lstrcmpiW (lpString1=".jpg", lpString2=".svg") returned -1
	[0186.056] lstrlenW (lpString=".jpx") returned 4
	[0186.056] lstrcmpiW (lpString1=".jpx", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".js") returned 3
	[0186.057] lstrcmpiW (lpString1=".js", lpString2="svg") returned -1
	[0186.057] lstrlenW (lpString=".jsf") returned 4
	[0186.057] lstrcmpiW (lpString1=".jsf", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".json") returned 5
	[0186.057] lstrcmpiW (lpString1=".json", lpString2="r.svg") returned -1
	[0186.057] lstrlenW (lpString=".jsp") returned 4
	[0186.057] lstrcmpiW (lpString1=".jsp", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".kdc") returned 4
	[0186.057] lstrcmpiW (lpString1=".kdc", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".kmz") returned 4
	[0186.057] lstrcmpiW (lpString1=".kmz", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".kwm") returned 4
	[0186.057] lstrcmpiW (lpString1=".kwm", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".lasso") returned 6
	[0186.057] lstrcmpiW (lpString1=".lasso", lpString2="er.svg") returned -1
	[0186.057] lstrlenW (lpString=".lbi") returned 4
	[0186.057] lstrcmpiW (lpString1=".lbi", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".lgf") returned 4
	[0186.057] lstrcmpiW (lpString1=".lgf", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".lgp") returned 4
	[0186.057] lstrcmpiW (lpString1=".lgp", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".log") returned 4
	[0186.057] lstrcmpiW (lpString1=".log", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".m1v") returned 4
	[0186.057] lstrcmpiW (lpString1=".m1v", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".m4a") returned 4
	[0186.057] lstrcmpiW (lpString1=".m4a", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".m4v") returned 4
	[0186.057] lstrcmpiW (lpString1=".m4v", lpString2=".svg") returned -1
	[0186.057] lstrlenW (lpString=".max") returned 4
	[0186.057] lstrcmpiW (lpString1=".max", lpString2=".svg") returned -1
	[0186.058] lstrlenW (lpString=".md") returned 3
	[0186.058] lstrcmpiW (lpString1=".md", lpString2="svg") returned -1
	[0186.058] lstrlenW (lpString=".mda") returned 4
	[0186.058] lstrcmpiW (lpString1=".mda", lpString2=".svg") returned -1
	[0186.058] lstrlenW (lpString=".mdb") returned 4
	[0186.058] lstrcmpiW (lpString1=".mdb", lpString2=".svg") returned -1
	[0186.058] lstrlenW (lpString=".mde") returned 4
	[0186.058] lstrcmpiW (lpString1=".mde", lpString2=".svg") returned -1
	[0186.058] lstrlenW (lpString=".mdf") returned 4
	[0186.058] lstrcmpiW (lpString1=".mdf", lpString2=".svg") returned -1
	[0186.058] lstrlenW (lpString=".mdw") returned 4
	[0186.058] lstrcmpiW (lpString1=".mdw", lpString2=".svg") returned -1
	[0186.058] lstrlenW (lpString=".mef") returned 4
	[0186.058] lstrcmpiW (lpString1=".mef", lpString2=".svg") returned -1
	[0186.058] lstrlenW (lpString=".mft") returned 4
	[0186.058] lstrcmpiW (lpString1=".mft", lpString2=".svg") returned -1
	[0186.058] lstrlenW (lpString=".mfw") returned 4
	[0186.058] lstrcmpiW (lpString1=".mfw", lpString2=".svg") returned -1
	[0186.058] lstrlenW (lpString=".mht") returned 4
	[0186.058] lstrcmpiW (lpString1=".mht", lpString2=".svg") returned -1
	[0186.058] lstrlenW (lpString=".mhtml") returned 6
	[0186.058] lstrcmpiW (lpString1=".mhtml", lpString2="er.svg") returned -1
	[0186.058] lstrlenW (lpString=".mka") returned 4
	[0186.059] lstrcmpiW (lpString1=".mka", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".mkidx") returned 6
	[0186.059] lstrcmpiW (lpString1=".mkidx", lpString2="er.svg") returned -1
	[0186.059] lstrlenW (lpString=".mkv") returned 4
	[0186.059] lstrcmpiW (lpString1=".mkv", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".mos") returned 4
	[0186.059] lstrcmpiW (lpString1=".mos", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".mov") returned 4
	[0186.059] lstrcmpiW (lpString1=".mov", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".mp3") returned 4
	[0186.059] lstrcmpiW (lpString1=".mp3", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".mp4") returned 4
	[0186.059] lstrcmpiW (lpString1=".mp4", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".mpeg") returned 5
	[0186.059] lstrcmpiW (lpString1=".mpeg", lpString2="r.svg") returned -1
	[0186.059] lstrlenW (lpString=".mpg") returned 4
	[0186.059] lstrcmpiW (lpString1=".mpg", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".mpv") returned 4
	[0186.059] lstrcmpiW (lpString1=".mpv", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".mrw") returned 4
	[0186.059] lstrcmpiW (lpString1=".mrw", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".msg") returned 4
	[0186.059] lstrcmpiW (lpString1=".msg", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".mxl") returned 4
	[0186.059] lstrcmpiW (lpString1=".mxl", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".myd") returned 4
	[0186.059] lstrcmpiW (lpString1=".myd", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".myi") returned 4
	[0186.059] lstrcmpiW (lpString1=".myi", lpString2=".svg") returned -1
	[0186.059] lstrlenW (lpString=".nef") returned 4
	[0186.060] lstrcmpiW (lpString1=".nef", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".nrw") returned 4
	[0186.060] lstrcmpiW (lpString1=".nrw", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".obj") returned 4
	[0186.060] lstrcmpiW (lpString1=".obj", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".odb") returned 4
	[0186.060] lstrcmpiW (lpString1=".odb", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".odc") returned 4
	[0186.060] lstrcmpiW (lpString1=".odc", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".odm") returned 4
	[0186.060] lstrcmpiW (lpString1=".odm", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".odp") returned 4
	[0186.060] lstrcmpiW (lpString1=".odp", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".ods") returned 4
	[0186.060] lstrcmpiW (lpString1=".ods", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".oft") returned 4
	[0186.060] lstrcmpiW (lpString1=".oft", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".one") returned 4
	[0186.060] lstrcmpiW (lpString1=".one", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".onepkg") returned 7
	[0186.060] lstrcmpiW (lpString1=".onepkg", lpString2="der.svg") returned -1
	[0186.060] lstrlenW (lpString=".onetoc2") returned 8
	[0186.060] lstrcmpiW (lpString1=".onetoc2", lpString2="lder.svg") returned -1
	[0186.060] lstrlenW (lpString=".opt") returned 4
	[0186.060] lstrcmpiW (lpString1=".opt", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".oqy") returned 4
	[0186.060] lstrcmpiW (lpString1=".oqy", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".orf") returned 4
	[0186.060] lstrcmpiW (lpString1=".orf", lpString2=".svg") returned -1
	[0186.060] lstrlenW (lpString=".p12") returned 4
	[0186.060] lstrcmpiW (lpString1=".p12", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".p7b") returned 4
	[0186.061] lstrcmpiW (lpString1=".p7b", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".p7c") returned 4
	[0186.061] lstrcmpiW (lpString1=".p7c", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pam") returned 4
	[0186.061] lstrcmpiW (lpString1=".pam", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pbm") returned 4
	[0186.061] lstrcmpiW (lpString1=".pbm", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pct") returned 4
	[0186.061] lstrcmpiW (lpString1=".pct", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pcx") returned 4
	[0186.061] lstrcmpiW (lpString1=".pcx", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pdd") returned 4
	[0186.061] lstrcmpiW (lpString1=".pdd", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pdf") returned 4
	[0186.061] lstrcmpiW (lpString1=".pdf", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pdp") returned 4
	[0186.061] lstrcmpiW (lpString1=".pdp", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pef") returned 4
	[0186.061] lstrcmpiW (lpString1=".pef", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pem") returned 4
	[0186.061] lstrcmpiW (lpString1=".pem", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pff") returned 4
	[0186.061] lstrcmpiW (lpString1=".pff", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pfm") returned 4
	[0186.061] lstrcmpiW (lpString1=".pfm", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pfx") returned 4
	[0186.061] lstrcmpiW (lpString1=".pfx", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".pgm") returned 4
	[0186.061] lstrcmpiW (lpString1=".pgm", lpString2=".svg") returned -1
	[0186.061] lstrlenW (lpString=".php") returned 4
	[0186.061] lstrcmpiW (lpString1=".php", lpString2=".svg") returned -1
	[0186.062] lstrlenW (lpString=".php3") returned 5
	[0186.062] lstrcmpiW (lpString1=".php3", lpString2="r.svg") returned -1
	[0186.062] lstrlenW (lpString=".php4") returned 5
	[0186.062] lstrcmpiW (lpString1=".php4", lpString2="r.svg") returned -1
	[0186.062] lstrlenW (lpString=".php5") returned 5
	[0186.062] lstrcmpiW (lpString1=".php5", lpString2="r.svg") returned -1
	[0186.062] lstrlenW (lpString=".phtml") returned 6
	[0186.062] lstrcmpiW (lpString1=".phtml", lpString2="er.svg") returned -1
	[0186.062] lstrlenW (lpString=".pict") returned 5
	[0186.062] lstrcmpiW (lpString1=".pict", lpString2="r.svg") returned -1
	[0186.062] lstrlenW (lpString=".pl") returned 3
	[0186.062] lstrcmpiW (lpString1=".pl", lpString2="svg") returned -1
	[0186.062] lstrlenW (lpString=".pls") returned 4
	[0186.062] lstrcmpiW (lpString1=".pls", lpString2=".svg") returned -1
	[0186.062] lstrlenW (lpString=".pm") returned 3
	[0186.062] lstrcmpiW (lpString1=".pm", lpString2="svg") returned -1
	[0186.062] lstrlenW (lpString=".png") returned 4
	[0186.062] lstrcmpiW (lpString1=".png", lpString2=".svg") returned -1
	[0186.062] lstrlenW (lpString=".pnm") returned 4
	[0186.062] lstrcmpiW (lpString1=".pnm", lpString2=".svg") returned -1
	[0186.062] lstrlenW (lpString=".pot") returned 4
	[0186.062] lstrcmpiW (lpString1=".pot", lpString2=".svg") returned -1
	[0186.062] lstrlenW (lpString=".potm") returned 5
	[0186.062] lstrcmpiW (lpString1=".potm", lpString2="r.svg") returned -1
	[0186.062] lstrlenW (lpString=".potx") returned 5
	[0186.062] lstrcmpiW (lpString1=".potx", lpString2="r.svg") returned -1
	[0186.062] lstrlenW (lpString=".ppa") returned 4
	[0186.062] lstrcmpiW (lpString1=".ppa", lpString2=".svg") returned -1
	[0186.062] lstrlenW (lpString=".ppam") returned 5
	[0186.062] lstrcmpiW (lpString1=".ppam", lpString2="r.svg") returned -1
	[0186.062] lstrlenW (lpString=".ppm") returned 4
	[0186.062] lstrcmpiW (lpString1=".ppm", lpString2=".svg") returned -1
	[0186.063] lstrlenW (lpString=".pps") returned 4
	[0186.063] lstrcmpiW (lpString1=".pps", lpString2=".svg") returned -1
	[0186.063] lstrlenW (lpString=".ppsm") returned 5
	[0186.063] lstrcmpiW (lpString1=".ppsm", lpString2="r.svg") returned -1
	[0186.063] lstrlenW (lpString=".ppt") returned 4
	[0186.063] lstrcmpiW (lpString1=".ppt", lpString2=".svg") returned -1
	[0186.063] lstrlenW (lpString=".pptm") returned 5
	[0186.063] lstrcmpiW (lpString1=".pptm", lpString2="r.svg") returned -1
	[0186.063] lstrlenW (lpString=".pptx") returned 5
	[0186.063] lstrcmpiW (lpString1=".pptx", lpString2="r.svg") returned -1
	[0186.063] lstrlenW (lpString=".prn") returned 4
	[0186.063] lstrcmpiW (lpString1=".prn", lpString2=".svg") returned -1
	[0186.063] lstrlenW (lpString=".ps") returned 3
	[0186.063] lstrcmpiW (lpString1=".ps", lpString2="svg") returned -1
	[0186.063] lstrlenW (lpString=".psb") returned 4
	[0186.063] lstrcmpiW (lpString1=".psb", lpString2=".svg") returned -1
	[0186.063] lstrlenW (lpString=".psd") returned 4
	[0186.063] lstrcmpiW (lpString1=".psd", lpString2=".svg") returned -1
	[0186.063] lstrlenW (lpString=".pst") returned 4
	[0186.063] lstrcmpiW (lpString1=".pst", lpString2=".svg") returned -1
	[0186.063] lstrlenW (lpString=".ptx") returned 4
	[0186.063] lstrcmpiW (lpString1=".ptx", lpString2=".svg") returned -1
	[0186.063] lstrlenW (lpString=".pub") returned 4
	[0186.063] lstrcmpiW (lpString1=".pub", lpString2=".svg") returned -1
	[0186.063] lstrlenW (lpString=".pwm") returned 4
	[0186.063] lstrcmpiW (lpString1=".pwm", lpString2=".svg") returned -1
	[0186.063] lstrlenW (lpString=".pxr") returned 4
	[0186.063] lstrcmpiW (lpString1=".pxr", lpString2=".svg") returned -1
	[0186.063] lstrlenW (lpString=".py") returned 3
	[0186.063] lstrcmpiW (lpString1=".py", lpString2="svg") returned -1
	[0186.063] lstrlenW (lpString=".qt") returned 3
	[0186.063] lstrcmpiW (lpString1=".qt", lpString2="svg") returned -1
	[0186.064] lstrlenW (lpString=".r3d") returned 4
	[0186.064] lstrcmpiW (lpString1=".r3d", lpString2=".svg") returned -1
	[0186.064] lstrlenW (lpString=".raf") returned 4
	[0186.064] lstrcmpiW (lpString1=".raf", lpString2=".svg") returned -1
	[0186.064] lstrlenW (lpString=".rar") returned 4
	[0186.064] lstrcmpiW (lpString1=".rar", lpString2=".svg") returned -1
	[0186.064] lstrlenW (lpString=".raw") returned 4
	[0186.064] lstrcmpiW (lpString1=".raw", lpString2=".svg") returned -1

Thread:
	id = 47
	os_tid = 0xe20

	[0153.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3e71088
	[0153.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3e81090
	[0153.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e6d8
	[0153.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x571d20
	[0153.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e6f0
	[0153.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x412d020
	[0153.949] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e540
	[0153.949] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e540, Size=0x20) returned 0x4f27f8
	[0153.949] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e708
	[0153.949] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e708, Size=0x20) returned 0x4f2668
	[0153.949] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0153.949] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0153.949] Wow64DisableWow64FsRedirection (in: OldValue=0x36dff50 | out: OldValue=0x36dff50*=0x0) returned 1
	[0153.949] lstrlenW (lpString="kernel32.dll") returned 12
	[0153.949] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f27f8 | out: hHeap=0x4c0000) returned 1
	[0153.949] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0153.950] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2668 | out: hHeap=0x4c0000) returned 1
	[0153.950] Sleep (dwMilliseconds=0x64) 
	[0154.283] Sleep (dwMilliseconds=0x64) 
	[0154.438] Sleep (dwMilliseconds=0x64) 
	[0154.722] Sleep (dwMilliseconds=0x64) 
	[0155.029] Sleep (dwMilliseconds=0x64) 
	[0155.391] Sleep (dwMilliseconds=0x64) 
	[0155.647] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.647] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0155.647] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0155.902] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=45472) returned 1
	[0155.902] CloseHandle (hObject=0x3ac) returned 1
	[0155.902] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20
	[0155.902] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.902] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.903] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.903] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.903] lstrlenW (lpString=".doc") returned 4
	[0155.903] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.903] lstrlenW (lpString=".docx") returned 5
	[0155.903] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.903] lstrlenW (lpString=".pdf") returned 4
	[0155.903] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.903] lstrlenW (lpString=".xls") returned 4
	[0155.903] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.903] lstrlenW (lpString=".xlsx") returned 5
	[0155.903] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.903] lstrlenW (lpString=".ppt") returned 4
	[0155.903] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.903] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.903] lstrlenW (lpString=".zip") returned 4
	[0155.903] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.903] lstrlenW (lpString=".rar") returned 4
	[0155.903] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.903] lstrlenW (lpString=".bz2") returned 4
	[0155.903] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.903] lstrlenW (lpString=".7z") returned 3
	[0155.903] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.903] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.903] lstrlenW (lpString=".dbf") returned 4
	[0155.903] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.903] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.903] lstrlenW (lpString=".1cd") returned 4
	[0155.903] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.903] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.904] lstrlenW (lpString=".jpg") returned 4
	[0155.904] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.904] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.904] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.904] lstrlenW (lpString=".doc") returned 4
	[0155.904] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.904] lstrlenW (lpString=".docx") returned 5
	[0155.904] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.904] lstrlenW (lpString=".pdf") returned 4
	[0155.904] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.904] lstrlenW (lpString=".xls") returned 4
	[0155.904] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.904] lstrlenW (lpString=".xlsx") returned 5
	[0155.904] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.904] lstrlenW (lpString=".ppt") returned 4
	[0155.904] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.904] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.904] lstrlenW (lpString=".zip") returned 4
	[0155.904] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.904] lstrlenW (lpString=".rar") returned 4
	[0155.904] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.904] lstrlenW (lpString=".bz2") returned 4
	[0155.904] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.904] lstrlenW (lpString=".7z") returned 3
	[0155.904] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.904] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.904] lstrlenW (lpString=".dbf") returned 4
	[0155.904] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.905] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.905] lstrlenW (lpString=".1cd") returned 4
	[0155.905] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.905] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29
	[0155.905] lstrlenW (lpString=".jpg") returned 4
	[0155.905] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.905] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.905] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.905] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0155.905] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=77664) returned 1
	[0155.905] CloseHandle (hObject=0x3ac) returned 1
	[0155.905] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20
	[0155.906] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.906] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.906] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.906] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.906] lstrlenW (lpString=".doc") returned 4
	[0155.906] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.906] lstrlenW (lpString=".docx") returned 5
	[0155.906] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.906] lstrlenW (lpString=".pdf") returned 4
	[0155.906] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.906] lstrlenW (lpString=".xls") returned 4
	[0155.906] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.906] lstrlenW (lpString=".xlsx") returned 5
	[0155.906] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.906] lstrlenW (lpString=".ppt") returned 4
	[0155.906] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.906] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.906] lstrlenW (lpString=".zip") returned 4
	[0155.906] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.906] lstrlenW (lpString=".rar") returned 4
	[0155.906] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.906] lstrlenW (lpString=".bz2") returned 4
	[0155.906] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.906] lstrlenW (lpString=".7z") returned 3
	[0155.906] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.906] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.906] lstrlenW (lpString=".dbf") returned 4
	[0155.907] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.907] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.907] lstrlenW (lpString=".1cd") returned 4
	[0155.907] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.907] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.907] lstrlenW (lpString=".jpg") returned 4
	[0155.907] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.907] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.907] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.907] lstrlenW (lpString=".doc") returned 4
	[0155.907] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.907] lstrlenW (lpString=".docx") returned 5
	[0155.907] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.907] lstrlenW (lpString=".pdf") returned 4
	[0155.907] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.907] lstrlenW (lpString=".xls") returned 4
	[0155.907] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.907] lstrlenW (lpString=".xlsx") returned 5
	[0155.907] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.907] lstrlenW (lpString=".ppt") returned 4
	[0155.907] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.907] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.907] lstrlenW (lpString=".zip") returned 4
	[0155.907] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.907] lstrlenW (lpString=".rar") returned 4
	[0155.907] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.907] lstrlenW (lpString=".bz2") returned 4
	[0155.907] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.907] lstrlenW (lpString=".7z") returned 3
	[0155.907] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.907] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.908] lstrlenW (lpString=".dbf") returned 4
	[0155.908] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.908] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.908] lstrlenW (lpString=".1cd") returned 4
	[0155.908] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.908] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0155.908] lstrlenW (lpString=".jpg") returned 4
	[0155.908] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.908] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.908] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0155.908] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0155.908] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=45984) returned 1
	[0155.908] CloseHandle (hObject=0x3ac) returned 1
	[0155.908] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20
	[0155.908] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.909] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.909] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.909] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.909] lstrlenW (lpString=".doc") returned 4
	[0155.909] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.909] lstrlenW (lpString=".docx") returned 5
	[0155.909] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.909] lstrlenW (lpString=".pdf") returned 4
	[0155.909] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.909] lstrlenW (lpString=".xls") returned 4
	[0155.909] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.909] lstrlenW (lpString=".xlsx") returned 5
	[0155.909] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.909] lstrlenW (lpString=".ppt") returned 4
	[0155.909] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.909] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.909] lstrlenW (lpString=".zip") returned 4
	[0155.909] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.909] lstrlenW (lpString=".rar") returned 4
	[0155.909] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.909] lstrlenW (lpString=".bz2") returned 4
	[0155.909] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.909] lstrlenW (lpString=".7z") returned 3
	[0155.909] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.909] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.909] lstrlenW (lpString=".dbf") returned 4
	[0155.909] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.909] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.910] lstrlenW (lpString=".1cd") returned 4
	[0155.910] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.910] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.910] lstrlenW (lpString=".jpg") returned 4
	[0155.910] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.910] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.910] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.910] lstrlenW (lpString=".doc") returned 4
	[0155.910] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.910] lstrlenW (lpString=".docx") returned 5
	[0155.910] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.910] lstrlenW (lpString=".pdf") returned 4
	[0155.910] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.910] lstrlenW (lpString=".xls") returned 4
	[0155.910] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.910] lstrlenW (lpString=".xlsx") returned 5
	[0155.910] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.910] lstrlenW (lpString=".ppt") returned 4
	[0155.910] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.910] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.910] lstrlenW (lpString=".zip") returned 4
	[0155.910] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.910] lstrlenW (lpString=".rar") returned 4
	[0155.910] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.910] lstrlenW (lpString=".bz2") returned 4
	[0155.910] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.910] lstrlenW (lpString=".7z") returned 3
	[0155.910] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.910] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.910] lstrlenW (lpString=".dbf") returned 4
	[0155.910] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.911] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.911] lstrlenW (lpString=".1cd") returned 4
	[0155.911] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.911] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0155.911] lstrlenW (lpString=".jpg") returned 4
	[0155.911] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.911] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.911] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.911] CreateFileW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0155.911] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=77664) returned 1
	[0155.911] CloseHandle (hObject=0x3ac) returned 1
	[0155.911] GetFileAttributesW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20
	[0155.911] GetFileAttributesW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.912] CreateFileW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.912] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.912] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.912] lstrlenW (lpString=".doc") returned 4
	[0155.912] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.912] lstrlenW (lpString=".docx") returned 5
	[0155.912] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.912] lstrlenW (lpString=".pdf") returned 4
	[0155.912] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.912] lstrlenW (lpString=".xls") returned 4
	[0155.912] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.912] lstrlenW (lpString=".xlsx") returned 5
	[0155.912] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.912] lstrlenW (lpString=".ppt") returned 4
	[0155.912] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.912] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.912] lstrlenW (lpString=".zip") returned 4
	[0155.912] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.912] lstrlenW (lpString=".rar") returned 4
	[0155.912] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.912] lstrlenW (lpString=".bz2") returned 4
	[0155.912] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.912] lstrlenW (lpString=".7z") returned 3
	[0155.912] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.912] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.912] lstrlenW (lpString=".dbf") returned 4
	[0155.913] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.913] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.913] lstrlenW (lpString=".1cd") returned 4
	[0155.913] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.913] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.913] lstrlenW (lpString=".jpg") returned 4
	[0155.913] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.913] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.913] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.913] lstrlenW (lpString=".doc") returned 4
	[0155.913] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.913] lstrlenW (lpString=".docx") returned 5
	[0155.913] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.913] lstrlenW (lpString=".pdf") returned 4
	[0155.913] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.913] lstrlenW (lpString=".xls") returned 4
	[0155.913] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.913] lstrlenW (lpString=".xlsx") returned 5
	[0155.913] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.913] lstrlenW (lpString=".ppt") returned 4
	[0155.913] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.913] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.913] lstrlenW (lpString=".zip") returned 4
	[0155.913] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.913] lstrlenW (lpString=".rar") returned 4
	[0155.913] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.913] lstrlenW (lpString=".bz2") returned 4
	[0155.913] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.913] lstrlenW (lpString=".7z") returned 3
	[0155.913] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.914] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.914] lstrlenW (lpString=".dbf") returned 4
	[0155.914] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.914] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.914] lstrlenW (lpString=".1cd") returned 4
	[0155.914] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.914] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0155.914] lstrlenW (lpString=".jpg") returned 4
	[0155.914] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.914] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.914] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.914] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0155.914] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=75104) returned 1
	[0155.914] CloseHandle (hObject=0x3ac) returned 1
	[0155.914] GetFileAttributesW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20
	[0155.914] GetFileAttributesW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.915] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.915] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.915] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.915] lstrlenW (lpString=".doc") returned 4
	[0155.915] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.915] lstrlenW (lpString=".docx") returned 5
	[0155.915] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.915] lstrlenW (lpString=".pdf") returned 4
	[0155.915] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.915] lstrlenW (lpString=".xls") returned 4
	[0155.915] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.915] lstrlenW (lpString=".xlsx") returned 5
	[0155.915] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.915] lstrlenW (lpString=".ppt") returned 4
	[0155.915] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.915] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.915] lstrlenW (lpString=".zip") returned 4
	[0155.915] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.915] lstrlenW (lpString=".rar") returned 4
	[0155.915] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.915] lstrlenW (lpString=".bz2") returned 4
	[0155.915] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.915] lstrlenW (lpString=".7z") returned 3
	[0155.915] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.915] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.915] lstrlenW (lpString=".dbf") returned 4
	[0155.915] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.916] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.916] lstrlenW (lpString=".1cd") returned 4
	[0155.916] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.916] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.916] lstrlenW (lpString=".jpg") returned 4
	[0155.916] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.916] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.916] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.916] lstrlenW (lpString=".doc") returned 4
	[0155.916] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.916] lstrlenW (lpString=".docx") returned 5
	[0155.916] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.916] lstrlenW (lpString=".pdf") returned 4
	[0155.916] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.916] lstrlenW (lpString=".xls") returned 4
	[0155.916] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.916] lstrlenW (lpString=".xlsx") returned 5
	[0155.916] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.916] lstrlenW (lpString=".ppt") returned 4
	[0155.916] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.916] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.916] lstrlenW (lpString=".zip") returned 4
	[0155.916] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.916] lstrlenW (lpString=".rar") returned 4
	[0155.916] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.916] lstrlenW (lpString=".bz2") returned 4
	[0155.916] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.916] lstrlenW (lpString=".7z") returned 3
	[0155.917] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.917] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.917] lstrlenW (lpString=".dbf") returned 4
	[0155.917] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.917] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.917] lstrlenW (lpString=".1cd") returned 4
	[0155.917] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.917] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0155.917] lstrlenW (lpString=".jpg") returned 4
	[0155.917] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.917] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.917] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.917] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0155.917] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=76640) returned 1
	[0155.917] CloseHandle (hObject=0x3ac) returned 1
	[0155.917] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20
	[0155.917] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.918] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.918] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.918] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.918] lstrlenW (lpString=".doc") returned 4
	[0155.918] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.918] lstrlenW (lpString=".docx") returned 5
	[0155.918] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.918] lstrlenW (lpString=".pdf") returned 4
	[0155.918] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.918] lstrlenW (lpString=".xls") returned 4
	[0155.918] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.918] lstrlenW (lpString=".xlsx") returned 5
	[0155.918] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.918] lstrlenW (lpString=".ppt") returned 4
	[0155.918] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.918] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.918] lstrlenW (lpString=".zip") returned 4
	[0155.918] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.918] lstrlenW (lpString=".rar") returned 4
	[0155.918] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.918] lstrlenW (lpString=".bz2") returned 4
	[0155.918] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.918] lstrlenW (lpString=".7z") returned 3
	[0155.918] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.918] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.918] lstrlenW (lpString=".dbf") returned 4
	[0155.918] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.918] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.919] lstrlenW (lpString=".1cd") returned 4
	[0155.919] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.919] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.919] lstrlenW (lpString=".jpg") returned 4
	[0155.919] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.919] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.919] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.919] lstrlenW (lpString=".doc") returned 4
	[0155.919] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.919] lstrlenW (lpString=".docx") returned 5
	[0155.919] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.919] lstrlenW (lpString=".pdf") returned 4
	[0155.919] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.919] lstrlenW (lpString=".xls") returned 4
	[0155.919] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.919] lstrlenW (lpString=".xlsx") returned 5
	[0155.919] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.919] lstrlenW (lpString=".ppt") returned 4
	[0155.919] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.919] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.919] lstrlenW (lpString=".zip") returned 4
	[0155.919] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.919] lstrlenW (lpString=".rar") returned 4
	[0155.919] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.919] lstrlenW (lpString=".bz2") returned 4
	[0155.919] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.919] lstrlenW (lpString=".7z") returned 3
	[0155.919] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.919] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.919] lstrlenW (lpString=".dbf") returned 4
	[0155.919] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.920] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.920] lstrlenW (lpString=".1cd") returned 4
	[0155.920] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.920] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0155.920] lstrlenW (lpString=".jpg") returned 4
	[0155.920] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.920] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.920] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0155.920] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0155.920] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=45472) returned 1
	[0155.920] CloseHandle (hObject=0x3ac) returned 1
	[0155.920] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20
	[0155.920] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.920] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.921] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0155.921] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0155.921] lstrlenW (lpString=".doc") returned 4
	[0155.921] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.921] lstrlenW (lpString=".docx") returned 5
	[0155.921] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.921] lstrlenW (lpString=".pdf") returned 4
	[0155.921] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.921] lstrlenW (lpString=".xls") returned 4
	[0155.921] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.921] lstrlenW (lpString=".xlsx") returned 5
	[0155.921] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.921] lstrlenW (lpString=".ppt") returned 4
	[0155.921] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.921] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0155.921] lstrlenW (lpString=".zip") returned 4
	[0155.921] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.921] lstrlenW (lpString=".rar") returned 4
	[0155.921] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.921] lstrlenW (lpString=".bz2") returned 4
	[0155.921] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.921] lstrlenW (lpString=".7z") returned 3
	[0155.921] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.921] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0155.925] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0
	[0155.926] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0
	[0155.928] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0
	[0155.930] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.300] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x3e62088, Size=0x2000) returned 0x3e62088
	[0156.300] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0156.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0157.132] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=634) returned 1
	[0157.132] CloseHandle (hObject=0x4a0) returned 1
	[0157.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20
	[0157.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0157.566] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0158.253] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.253] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.253] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0159.873] GetLastError () returned 0x0
	[0159.873] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x27a, lpOverlapped=0x0) returned 1
	[0159.887] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x280, lpOverlapped=0x0) returned 1
	[0159.888] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.888] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xe2, lpOverlapped=0x0) returned 1
	[0159.888] SetEndOfFile (hFile=0x538) returned 1
	[0159.888] CloseHandle (hObject=0x538) returned 1
	[0159.889] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.889] SetEndOfFile (hFile=0x4b8) returned 1
	[0159.891] CloseHandle (hObject=0x4b8) returned 1
	[0159.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0159.892] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1
	[0159.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.893] lstrlenW (lpString=".doc") returned 4
	[0159.893] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1
	[0159.893] lstrlenW (lpString=".docx") returned 5
	[0159.893] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1
	[0159.893] lstrlenW (lpString=".pdf") returned 4
	[0159.893] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1
	[0159.893] lstrlenW (lpString=".xls") returned 4
	[0159.893] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1
	[0159.893] lstrlenW (lpString=".xlsx") returned 5
	[0159.893] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1
	[0159.893] lstrlenW (lpString=".ppt") returned 4
	[0159.893] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1
	[0159.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.893] lstrlenW (lpString=".zip") returned 4
	[0159.893] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1
	[0159.893] lstrlenW (lpString=".rar") returned 4
	[0159.893] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1
	[0159.893] lstrlenW (lpString=".bz2") returned 4
	[0159.893] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1
	[0159.893] lstrlenW (lpString=".7z") returned 3
	[0159.893] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1
	[0159.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.893] lstrlenW (lpString=".dbf") returned 4
	[0159.893] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1
	[0159.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.893] lstrlenW (lpString=".1cd") returned 4
	[0159.893] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1
	[0159.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.893] lstrlenW (lpString=".jpg") returned 4
	[0159.894] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1
	[0159.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.894] lstrlenW (lpString=".doc") returned 4
	[0159.894] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1
	[0159.894] lstrlenW (lpString=".docx") returned 5
	[0159.894] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1
	[0159.894] lstrlenW (lpString=".pdf") returned 4
	[0159.894] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1
	[0159.894] lstrlenW (lpString=".xls") returned 4
	[0159.894] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1
	[0159.894] lstrlenW (lpString=".xlsx") returned 5
	[0159.894] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1
	[0159.894] lstrlenW (lpString=".ppt") returned 4
	[0159.894] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1
	[0159.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.894] lstrlenW (lpString=".zip") returned 4
	[0159.894] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1
	[0159.894] lstrlenW (lpString=".rar") returned 4
	[0159.894] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1
	[0159.894] lstrlenW (lpString=".bz2") returned 4
	[0159.894] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1
	[0159.894] lstrlenW (lpString=".7z") returned 3
	[0159.894] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1
	[0159.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.894] lstrlenW (lpString=".dbf") returned 4
	[0159.894] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1
	[0159.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.894] lstrlenW (lpString=".1cd") returned 4
	[0159.894] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1
	[0159.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0159.895] lstrlenW (lpString=".jpg") returned 4
	[0159.895] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1
	[0159.895] lstrcmpiW (lpString1=".pf", lpString2=".money") returned 1
	[0159.895] lstrlenW (lpString="sRGB.pf") returned 7
	[0159.895] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0159.895] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=3144) returned 1
	[0159.896] CloseHandle (hObject=0x4b8) returned 1
	[0159.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20
	[0159.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.896] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0159.896] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.896] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.896] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0159.897] GetLastError () returned 0x0
	[0159.897] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xc48, lpOverlapped=0x0) returned 1
	[0159.898] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xc50, lpOverlapped=0x0) returned 1
	[0159.899] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.899] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xe2, lpOverlapped=0x0) returned 1
	[0159.899] SetEndOfFile (hFile=0x538) returned 1
	[0159.899] CloseHandle (hObject=0x538) returned 1
	[0159.899] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.900] SetEndOfFile (hFile=0x4b8) returned 1
	[0159.902] CloseHandle (hObject=0x4b8) returned 1
	[0159.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0159.902] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1
	[0159.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.903] lstrlenW (lpString=".doc") returned 4
	[0159.903] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0159.903] lstrlenW (lpString=".docx") returned 5
	[0159.903] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0159.903] lstrlenW (lpString=".pdf") returned 4
	[0159.903] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0159.903] lstrlenW (lpString=".xls") returned 4
	[0159.903] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0159.903] lstrlenW (lpString=".xlsx") returned 5
	[0159.903] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0159.903] lstrlenW (lpString=".ppt") returned 4
	[0159.903] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0159.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.903] lstrlenW (lpString=".zip") returned 4
	[0159.903] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0159.903] lstrlenW (lpString=".rar") returned 4
	[0159.903] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0159.903] lstrlenW (lpString=".bz2") returned 4
	[0159.903] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0159.903] lstrlenW (lpString=".7z") returned 3
	[0159.903] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0159.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.904] lstrlenW (lpString=".dbf") returned 4
	[0159.904] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0159.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.904] lstrlenW (lpString=".1cd") returned 4
	[0159.904] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0159.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.904] lstrlenW (lpString=".jpg") returned 4
	[0159.904] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0159.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.904] lstrlenW (lpString=".doc") returned 4
	[0159.904] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0159.904] lstrlenW (lpString=".docx") returned 5
	[0159.904] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0159.904] lstrlenW (lpString=".pdf") returned 4
	[0159.904] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0159.904] lstrlenW (lpString=".xls") returned 4
	[0159.904] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0159.904] lstrlenW (lpString=".xlsx") returned 5
	[0159.904] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0159.904] lstrlenW (lpString=".ppt") returned 4
	[0159.904] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0159.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.904] lstrlenW (lpString=".zip") returned 4
	[0159.904] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0159.904] lstrlenW (lpString=".rar") returned 4
	[0159.904] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0159.904] lstrlenW (lpString=".bz2") returned 4
	[0159.904] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0159.904] lstrlenW (lpString=".7z") returned 3
	[0159.905] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0159.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.905] lstrlenW (lpString=".dbf") returned 4
	[0159.905] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0159.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.905] lstrlenW (lpString=".1cd") returned 4
	[0159.905] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0159.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0159.905] lstrlenW (lpString=".jpg") returned 4
	[0159.905] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0159.905] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0159.905] lstrlenW (lpString="content-types.properties") returned 24
	[0159.905] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0159.906] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=5548) returned 1
	[0159.906] CloseHandle (hObject=0x4b8) returned 1
	[0159.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20
	[0159.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.906] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0159.906] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.906] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.906] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0159.907] GetLastError () returned 0x0
	[0159.907] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x15ac, lpOverlapped=0x0) returned 1
	[0160.288] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x15b0, lpOverlapped=0x0) returned 1
	[0160.289] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.289] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x104, lpOverlapped=0x0) returned 1
	[0160.289] SetEndOfFile (hFile=0x538) returned 1
	[0160.289] CloseHandle (hObject=0x538) returned 1
	[0160.289] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.289] SetEndOfFile (hFile=0x4b8) returned 1
	[0160.292] CloseHandle (hObject=0x4b8) returned 1
	[0160.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.292] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1
	[0160.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.293] lstrlenW (lpString=".doc") returned 4
	[0160.293] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.293] lstrlenW (lpString=".docx") returned 5
	[0160.293] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.293] lstrlenW (lpString=".pdf") returned 4
	[0160.293] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.293] lstrlenW (lpString=".xls") returned 4
	[0160.293] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.293] lstrlenW (lpString=".xlsx") returned 5
	[0160.293] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.293] lstrlenW (lpString=".ppt") returned 4
	[0160.293] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.293] lstrlenW (lpString=".zip") returned 4
	[0160.293] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.293] lstrlenW (lpString=".rar") returned 4
	[0160.293] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.293] lstrlenW (lpString=".bz2") returned 4
	[0160.293] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.293] lstrlenW (lpString=".7z") returned 3
	[0160.293] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.293] lstrlenW (lpString=".dbf") returned 4
	[0160.293] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.294] lstrlenW (lpString=".1cd") returned 4
	[0160.294] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.294] lstrlenW (lpString=".jpg") returned 4
	[0160.294] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.294] lstrlenW (lpString=".doc") returned 4
	[0160.294] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.294] lstrlenW (lpString=".docx") returned 5
	[0160.294] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.294] lstrlenW (lpString=".pdf") returned 4
	[0160.294] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.294] lstrlenW (lpString=".xls") returned 4
	[0160.294] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.294] lstrlenW (lpString=".xlsx") returned 5
	[0160.294] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.294] lstrlenW (lpString=".ppt") returned 4
	[0160.294] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.294] lstrlenW (lpString=".zip") returned 4
	[0160.294] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.294] lstrlenW (lpString=".rar") returned 4
	[0160.294] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.294] lstrlenW (lpString=".bz2") returned 4
	[0160.294] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.294] lstrlenW (lpString=".7z") returned 3
	[0160.294] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.294] lstrlenW (lpString=".dbf") returned 4
	[0160.294] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.295] lstrlenW (lpString=".1cd") returned 4
	[0160.295] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0160.295] lstrlenW (lpString=".jpg") returned 4
	[0160.295] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.295] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0160.295] lstrlenW (lpString="messages_fr.properties") returned 22
	[0160.295] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0160.295] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=3409) returned 1
	[0160.296] CloseHandle (hObject=0x4b8) returned 1
	[0160.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20
	[0160.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.296] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0160.296] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.296] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.296] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0160.297] GetLastError () returned 0x0
	[0160.297] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xd51, lpOverlapped=0x0) returned 1
	[0160.298] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xd60, lpOverlapped=0x0) returned 1
	[0160.300] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.300] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x100, lpOverlapped=0x0) returned 1
	[0160.300] SetEndOfFile (hFile=0x538) returned 1
	[0160.300] CloseHandle (hObject=0x538) returned 1
	[0160.300] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.300] SetEndOfFile (hFile=0x4b8) returned 1
	[0160.303] CloseHandle (hObject=0x4b8) returned 1
	[0160.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.303] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1
	[0160.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.303] lstrlenW (lpString=".doc") returned 4
	[0160.303] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.303] lstrlenW (lpString=".docx") returned 5
	[0160.304] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.304] lstrlenW (lpString=".pdf") returned 4
	[0160.304] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.304] lstrlenW (lpString=".xls") returned 4
	[0160.304] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.304] lstrlenW (lpString=".xlsx") returned 5
	[0160.304] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.304] lstrlenW (lpString=".ppt") returned 4
	[0160.304] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.304] lstrlenW (lpString=".zip") returned 4
	[0160.304] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.304] lstrlenW (lpString=".rar") returned 4
	[0160.304] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.304] lstrlenW (lpString=".bz2") returned 4
	[0160.304] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.304] lstrlenW (lpString=".7z") returned 3
	[0160.304] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.304] lstrlenW (lpString=".dbf") returned 4
	[0160.304] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.304] lstrlenW (lpString=".1cd") returned 4
	[0160.304] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.304] lstrlenW (lpString=".jpg") returned 4
	[0160.304] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.305] lstrlenW (lpString=".doc") returned 4
	[0160.305] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.305] lstrlenW (lpString=".docx") returned 5
	[0160.305] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.305] lstrlenW (lpString=".pdf") returned 4
	[0160.305] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.305] lstrlenW (lpString=".xls") returned 4
	[0160.305] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.305] lstrlenW (lpString=".xlsx") returned 5
	[0160.305] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.305] lstrlenW (lpString=".ppt") returned 4
	[0160.305] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.305] lstrlenW (lpString=".zip") returned 4
	[0160.305] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.305] lstrlenW (lpString=".rar") returned 4
	[0160.305] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.305] lstrlenW (lpString=".bz2") returned 4
	[0160.305] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.305] lstrlenW (lpString=".7z") returned 3
	[0160.305] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.305] lstrlenW (lpString=".dbf") returned 4
	[0160.305] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.305] lstrlenW (lpString=".1cd") returned 4
	[0160.305] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0160.305] lstrlenW (lpString=".jpg") returned 4
	[0160.305] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.306] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0160.306] lstrlenW (lpString="messages_it.properties") returned 22
	[0160.306] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0160.306] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=3223) returned 1
	[0160.306] CloseHandle (hObject=0x4b8) returned 1
	[0160.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20
	[0160.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.307] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0160.307] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.307] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.307] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0160.307] GetLastError () returned 0x0
	[0160.307] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xc97, lpOverlapped=0x0) returned 1
	[0160.309] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xca0, lpOverlapped=0x0) returned 1
	[0160.310] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.310] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x100, lpOverlapped=0x0) returned 1
	[0160.310] SetEndOfFile (hFile=0x538) returned 1
	[0160.310] CloseHandle (hObject=0x538) returned 1
	[0160.310] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.310] SetEndOfFile (hFile=0x4b8) returned 1
	[0160.313] CloseHandle (hObject=0x4b8) returned 1
	[0160.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.313] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1
	[0160.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.314] lstrlenW (lpString=".doc") returned 4
	[0160.314] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.314] lstrlenW (lpString=".docx") returned 5
	[0160.314] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.314] lstrlenW (lpString=".pdf") returned 4
	[0160.314] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.314] lstrlenW (lpString=".xls") returned 4
	[0160.314] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.314] lstrlenW (lpString=".xlsx") returned 5
	[0160.314] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.314] lstrlenW (lpString=".ppt") returned 4
	[0160.314] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.314] lstrlenW (lpString=".zip") returned 4
	[0160.314] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.315] lstrlenW (lpString=".rar") returned 4
	[0160.315] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.315] lstrlenW (lpString=".bz2") returned 4
	[0160.315] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.315] lstrlenW (lpString=".7z") returned 3
	[0160.315] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.315] lstrlenW (lpString=".dbf") returned 4
	[0160.315] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.315] lstrlenW (lpString=".1cd") returned 4
	[0160.315] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.315] lstrlenW (lpString=".jpg") returned 4
	[0160.315] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.315] lstrlenW (lpString=".doc") returned 4
	[0160.315] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.315] lstrlenW (lpString=".docx") returned 5
	[0160.315] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.315] lstrlenW (lpString=".pdf") returned 4
	[0160.315] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.315] lstrlenW (lpString=".xls") returned 4
	[0160.315] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.315] lstrlenW (lpString=".xlsx") returned 5
	[0160.315] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.315] lstrlenW (lpString=".ppt") returned 4
	[0160.315] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.315] lstrlenW (lpString=".zip") returned 4
	[0160.315] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.316] lstrlenW (lpString=".rar") returned 4
	[0160.316] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.316] lstrlenW (lpString=".bz2") returned 4
	[0160.316] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.316] lstrlenW (lpString=".7z") returned 3
	[0160.316] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.316] lstrlenW (lpString=".dbf") returned 4
	[0160.316] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.316] lstrlenW (lpString=".1cd") returned 4
	[0160.316] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0160.316] lstrlenW (lpString=".jpg") returned 4
	[0160.316] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.316] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0160.316] lstrlenW (lpString="messages_ja.properties") returned 22
	[0160.316] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0160.317] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=6349) returned 1
	[0160.317] CloseHandle (hObject=0x4b8) returned 1
	[0160.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20
	[0160.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.318] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0160.318] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.318] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.318] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0160.318] GetLastError () returned 0x0
	[0160.318] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x18cd, lpOverlapped=0x0) returned 1
	[0160.320] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x18d0, lpOverlapped=0x0) returned 1
	[0160.321] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.321] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x100, lpOverlapped=0x0) returned 1
	[0160.321] SetEndOfFile (hFile=0x538) returned 1
	[0160.321] CloseHandle (hObject=0x538) returned 1
	[0160.321] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.321] SetEndOfFile (hFile=0x4b8) returned 1
	[0160.324] CloseHandle (hObject=0x4b8) returned 1
	[0160.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.324] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1
	[0160.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.325] lstrlenW (lpString=".doc") returned 4
	[0160.325] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.325] lstrlenW (lpString=".docx") returned 5
	[0160.325] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.325] lstrlenW (lpString=".pdf") returned 4
	[0160.325] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.325] lstrlenW (lpString=".xls") returned 4
	[0160.325] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.325] lstrlenW (lpString=".xlsx") returned 5
	[0160.325] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.325] lstrlenW (lpString=".ppt") returned 4
	[0160.325] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.325] lstrlenW (lpString=".zip") returned 4
	[0160.325] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.325] lstrlenW (lpString=".rar") returned 4
	[0160.325] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.325] lstrlenW (lpString=".bz2") returned 4
	[0160.325] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.325] lstrlenW (lpString=".7z") returned 3
	[0160.325] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.325] lstrlenW (lpString=".dbf") returned 4
	[0160.326] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.326] lstrlenW (lpString=".1cd") returned 4
	[0160.326] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.326] lstrlenW (lpString=".jpg") returned 4
	[0160.326] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.326] lstrlenW (lpString=".doc") returned 4
	[0160.326] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.326] lstrlenW (lpString=".docx") returned 5
	[0160.326] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.326] lstrlenW (lpString=".pdf") returned 4
	[0160.326] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.326] lstrlenW (lpString=".xls") returned 4
	[0160.326] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.326] lstrlenW (lpString=".xlsx") returned 5
	[0160.326] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.326] lstrlenW (lpString=".ppt") returned 4
	[0160.326] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.326] lstrlenW (lpString=".zip") returned 4
	[0160.326] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.326] lstrlenW (lpString=".rar") returned 4
	[0160.326] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.326] lstrlenW (lpString=".bz2") returned 4
	[0160.326] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.326] lstrlenW (lpString=".7z") returned 3
	[0160.326] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.326] lstrlenW (lpString=".dbf") returned 4
	[0160.327] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.327] lstrlenW (lpString=".1cd") returned 4
	[0160.327] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0160.327] lstrlenW (lpString=".jpg") returned 4
	[0160.327] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.327] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0160.327] lstrlenW (lpString="messages_ko.properties") returned 22
	[0160.327] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0160.327] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=5712) returned 1
	[0160.327] CloseHandle (hObject=0x4b8) returned 1
	[0160.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20
	[0160.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.328] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0160.328] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.328] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.328] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0160.329] GetLastError () returned 0x0
	[0160.329] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x1650, lpOverlapped=0x0) returned 1
	[0160.460] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x1660, lpOverlapped=0x0) returned 1
	[0160.601] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.601] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x100, lpOverlapped=0x0) returned 1
	[0160.601] SetEndOfFile (hFile=0x538) returned 1
	[0160.601] CloseHandle (hObject=0x538) returned 1
	[0160.601] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.601] SetEndOfFile (hFile=0x4b8) returned 1
	[0160.603] CloseHandle (hObject=0x4b8) returned 1
	[0160.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.753] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1
	[0161.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.019] lstrlenW (lpString=".doc") returned 4
	[0161.019] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0161.019] lstrlenW (lpString=".docx") returned 5
	[0161.019] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0161.019] lstrlenW (lpString=".pdf") returned 4
	[0161.019] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0161.019] lstrlenW (lpString=".xls") returned 4
	[0161.019] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0161.019] lstrlenW (lpString=".xlsx") returned 5
	[0161.019] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0161.019] lstrlenW (lpString=".ppt") returned 4
	[0161.019] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0161.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.019] lstrlenW (lpString=".zip") returned 4
	[0161.020] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0161.020] lstrlenW (lpString=".rar") returned 4
	[0161.020] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0161.020] lstrlenW (lpString=".bz2") returned 4
	[0161.020] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0161.020] lstrlenW (lpString=".7z") returned 3
	[0161.020] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0161.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.020] lstrlenW (lpString=".dbf") returned 4
	[0161.020] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0161.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.020] lstrlenW (lpString=".1cd") returned 4
	[0161.020] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0161.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.020] lstrlenW (lpString=".jpg") returned 4
	[0161.020] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0161.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.020] lstrlenW (lpString=".doc") returned 4
	[0161.020] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0161.020] lstrlenW (lpString=".docx") returned 5
	[0161.020] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0161.020] lstrlenW (lpString=".pdf") returned 4
	[0161.020] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0161.020] lstrlenW (lpString=".xls") returned 4
	[0161.020] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0161.020] lstrlenW (lpString=".xlsx") returned 5
	[0161.020] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0161.020] lstrlenW (lpString=".ppt") returned 4
	[0161.020] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0161.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.021] lstrlenW (lpString=".zip") returned 4
	[0161.021] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0161.021] lstrlenW (lpString=".rar") returned 4
	[0161.021] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0161.021] lstrlenW (lpString=".bz2") returned 4
	[0161.021] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0161.021] lstrlenW (lpString=".7z") returned 3
	[0161.021] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0161.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.021] lstrlenW (lpString=".dbf") returned 4
	[0161.021] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0161.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.021] lstrlenW (lpString=".1cd") returned 4
	[0161.021] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0161.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0161.021] lstrlenW (lpString=".jpg") returned 4
	[0161.021] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0161.021] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0161.021] lstrlenW (lpString="dnsns.jar") returned 9
	[0161.021] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.112] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=8286) returned 1
	[0161.112] CloseHandle (hObject=0x51c) returned 1
	[0161.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20
	[0161.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.503] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.928] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.928] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.928] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0161.928] GetLastError () returned 0x0
	[0161.928] ReadFile (in: hFile=0x548, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x205e, lpOverlapped=0x0) returned 1
	[0161.931] WriteFile (in: hFile=0x54c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2060, lpOverlapped=0x0) returned 1
	[0161.932] ReadFile (in: hFile=0x548, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.932] WriteFile (in: hFile=0x54c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xe6, lpOverlapped=0x0) returned 1
	[0161.932] SetEndOfFile (hFile=0x54c) returned 1
	[0161.933] CloseHandle (hObject=0x54c) returned 1
	[0161.933] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.933] SetEndOfFile (hFile=0x548) returned 1
	[0161.935] CloseHandle (hObject=0x548) returned 1
	[0161.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0161.935] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1
	[0161.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.936] lstrlenW (lpString=".doc") returned 4
	[0161.936] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.936] lstrlenW (lpString=".docx") returned 5
	[0161.936] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0161.936] lstrlenW (lpString=".pdf") returned 4
	[0161.936] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.936] lstrlenW (lpString=".xls") returned 4
	[0161.936] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.936] lstrlenW (lpString=".xlsx") returned 5
	[0161.936] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0161.936] lstrlenW (lpString=".ppt") returned 4
	[0161.936] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.936] lstrlenW (lpString=".zip") returned 4
	[0161.936] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.936] lstrlenW (lpString=".rar") returned 4
	[0161.936] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.937] lstrlenW (lpString=".bz2") returned 4
	[0161.937] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.937] lstrlenW (lpString=".7z") returned 3
	[0161.937] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.937] lstrlenW (lpString=".dbf") returned 4
	[0161.937] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.937] lstrlenW (lpString=".1cd") returned 4
	[0161.937] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.937] lstrlenW (lpString=".jpg") returned 4
	[0161.937] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.937] lstrlenW (lpString=".doc") returned 4
	[0161.937] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.937] lstrlenW (lpString=".docx") returned 5
	[0161.937] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0161.937] lstrlenW (lpString=".pdf") returned 4
	[0161.937] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.937] lstrlenW (lpString=".xls") returned 4
	[0161.937] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.937] lstrlenW (lpString=".xlsx") returned 5
	[0161.937] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0161.937] lstrlenW (lpString=".ppt") returned 4
	[0161.937] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.937] lstrlenW (lpString=".zip") returned 4
	[0161.937] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.937] lstrlenW (lpString=".rar") returned 4
	[0161.938] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.938] lstrlenW (lpString=".bz2") returned 4
	[0161.938] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.938] lstrlenW (lpString=".7z") returned 3
	[0161.938] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.938] lstrlenW (lpString=".dbf") returned 4
	[0161.938] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.938] lstrlenW (lpString=".1cd") returned 4
	[0161.938] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0161.938] lstrlenW (lpString=".jpg") returned 4
	[0161.938] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0162.024] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0162.024] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22
	[0162.024] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0162.025] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=80856) returned 1
	[0162.025] CloseHandle (hObject=0x4b8) returned 1
	[0162.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20
	[0162.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.025] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0162.026] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.026] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.026] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0162.027] GetLastError () returned 0x0
	[0162.027] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x13bd8, lpOverlapped=0x0) returned 1
	[0162.038] WriteFile (in: hFile=0x550, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x13be0, lpOverlapped=0x0) returned 1
	[0162.040] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.040] WriteFile (in: hFile=0x550, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x100, lpOverlapped=0x0) returned 1
	[0162.040] SetEndOfFile (hFile=0x550) returned 1
	[0162.046] CloseHandle (hObject=0x550) returned 1
	[0162.050] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.050] SetEndOfFile (hFile=0x4b8) returned 1
	[0162.058] CloseHandle (hObject=0x4b8) returned 1
	[0162.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0162.456] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1
	[0162.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.457] lstrlenW (lpString=".doc") returned 4
	[0162.457] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.457] lstrlenW (lpString=".docx") returned 5
	[0162.457] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0162.457] lstrlenW (lpString=".pdf") returned 4
	[0162.457] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.457] lstrlenW (lpString=".xls") returned 4
	[0162.457] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.457] lstrlenW (lpString=".xlsx") returned 5
	[0162.457] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0162.457] lstrlenW (lpString=".ppt") returned 4
	[0162.457] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.457] lstrlenW (lpString=".zip") returned 4
	[0162.457] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.457] lstrlenW (lpString=".rar") returned 4
	[0162.457] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.457] lstrlenW (lpString=".bz2") returned 4
	[0162.457] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.457] lstrlenW (lpString=".7z") returned 3
	[0162.457] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.457] lstrlenW (lpString=".dbf") returned 4
	[0162.458] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.458] lstrlenW (lpString=".1cd") returned 4
	[0162.458] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.458] lstrlenW (lpString=".jpg") returned 4
	[0162.458] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.458] lstrlenW (lpString=".doc") returned 4
	[0162.458] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.458] lstrlenW (lpString=".docx") returned 5
	[0162.458] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0162.458] lstrlenW (lpString=".pdf") returned 4
	[0162.458] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.458] lstrlenW (lpString=".xls") returned 4
	[0162.458] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.458] lstrlenW (lpString=".xlsx") returned 5
	[0162.458] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0162.458] lstrlenW (lpString=".ppt") returned 4
	[0162.458] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.458] lstrlenW (lpString=".zip") returned 4
	[0162.458] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.458] lstrlenW (lpString=".rar") returned 4
	[0162.458] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.458] lstrlenW (lpString=".bz2") returned 4
	[0162.458] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.458] lstrlenW (lpString=".7z") returned 3
	[0162.458] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.459] lstrlenW (lpString=".dbf") returned 4
	[0162.459] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.459] lstrlenW (lpString=".1cd") returned 4
	[0162.459] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0162.459] lstrlenW (lpString=".jpg") returned 4
	[0162.459] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.459] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0162.459] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24
	[0162.459] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0162.460] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=234068) returned 1
	[0162.460] CloseHandle (hObject=0x54c) returned 1
	[0162.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20
	[0162.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.460] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0162.460] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.460] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.460] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0162.461] GetLastError () returned 0x0
	[0162.461] ReadFile (in: hFile=0x54c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x39254, lpOverlapped=0x0) returned 1
	[0162.468] WriteFile (in: hFile=0x554, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x39260, lpOverlapped=0x0) returned 1
	[0162.826] ReadFile (in: hFile=0x54c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.826] WriteFile (in: hFile=0x554, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x104, lpOverlapped=0x0) returned 1
	[0162.826] SetEndOfFile (hFile=0x554) returned 1
	[0162.897] CloseHandle (hObject=0x554) returned 1
	[0162.897] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.897] SetEndOfFile (hFile=0x54c) returned 1
	[0162.904] CloseHandle (hObject=0x54c) returned 1
	[0162.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0162.904] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1
	[0162.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.905] lstrlenW (lpString=".doc") returned 4
	[0162.905] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.905] lstrlenW (lpString=".docx") returned 5
	[0162.905] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0162.905] lstrlenW (lpString=".pdf") returned 4
	[0162.905] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.905] lstrlenW (lpString=".xls") returned 4
	[0162.905] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.905] lstrlenW (lpString=".xlsx") returned 5
	[0162.905] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0162.905] lstrlenW (lpString=".ppt") returned 4
	[0162.905] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.905] lstrlenW (lpString=".zip") returned 4
	[0162.905] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.905] lstrlenW (lpString=".rar") returned 4
	[0162.905] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.905] lstrlenW (lpString=".bz2") returned 4
	[0162.906] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.906] lstrlenW (lpString=".7z") returned 3
	[0162.906] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.906] lstrlenW (lpString=".dbf") returned 4
	[0162.906] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.906] lstrlenW (lpString=".1cd") returned 4
	[0162.906] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.906] lstrlenW (lpString=".jpg") returned 4
	[0162.906] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.906] lstrlenW (lpString=".doc") returned 4
	[0162.906] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.906] lstrlenW (lpString=".docx") returned 5
	[0162.906] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0162.906] lstrlenW (lpString=".pdf") returned 4
	[0162.906] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.906] lstrlenW (lpString=".xls") returned 4
	[0162.906] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.906] lstrlenW (lpString=".xlsx") returned 5
	[0162.906] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0162.906] lstrlenW (lpString=".ppt") returned 4
	[0162.906] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.906] lstrlenW (lpString=".zip") returned 4
	[0162.906] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.906] lstrlenW (lpString=".rar") returned 4
	[0162.906] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.907] lstrlenW (lpString=".bz2") returned 4
	[0162.907] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.907] lstrlenW (lpString=".7z") returned 3
	[0162.907] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.907] lstrlenW (lpString=".dbf") returned 4
	[0162.907] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.907] lstrlenW (lpString=".1cd") returned 4
	[0162.907] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0162.907] lstrlenW (lpString=".jpg") returned 4
	[0162.907] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0163.000] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0163.000] lstrlenW (lpString="javafx.properties") returned 17
	[0163.000] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0163.029] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=56) returned 1
	[0163.029] CloseHandle (hObject=0x520) returned 1
	[0163.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20
	[0163.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.043] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0163.043] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.043] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.043] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0163.050] GetLastError () returned 0x0
	[0163.050] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x38, lpOverlapped=0x0) returned 1
	[0163.051] WriteFile (in: hFile=0x54c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x40, lpOverlapped=0x0) returned 1
	[0163.052] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.052] WriteFile (in: hFile=0x54c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0163.052] SetEndOfFile (hFile=0x54c) returned 1
	[0163.053] CloseHandle (hObject=0x54c) returned 1
	[0163.053] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.053] SetEndOfFile (hFile=0x4b8) returned 1
	[0163.058] CloseHandle (hObject=0x4b8) returned 1
	[0163.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0163.059] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1
	[0163.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.059] lstrlenW (lpString=".doc") returned 4
	[0163.060] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0163.060] lstrlenW (lpString=".docx") returned 5
	[0163.060] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0163.060] lstrlenW (lpString=".pdf") returned 4
	[0163.060] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0163.060] lstrlenW (lpString=".xls") returned 4
	[0163.060] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0163.060] lstrlenW (lpString=".xlsx") returned 5
	[0163.060] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0163.060] lstrlenW (lpString=".ppt") returned 4
	[0163.060] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0163.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.060] lstrlenW (lpString=".zip") returned 4
	[0163.060] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0163.060] lstrlenW (lpString=".rar") returned 4
	[0163.060] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0163.060] lstrlenW (lpString=".bz2") returned 4
	[0163.060] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0163.060] lstrlenW (lpString=".7z") returned 3
	[0163.060] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0163.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.060] lstrlenW (lpString=".dbf") returned 4
	[0163.060] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0163.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.060] lstrlenW (lpString=".1cd") returned 4
	[0163.060] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0163.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.060] lstrlenW (lpString=".jpg") returned 4
	[0163.060] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0163.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.061] lstrlenW (lpString=".doc") returned 4
	[0163.061] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0163.061] lstrlenW (lpString=".docx") returned 5
	[0163.061] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0163.061] lstrlenW (lpString=".pdf") returned 4
	[0163.061] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0163.061] lstrlenW (lpString=".xls") returned 4
	[0163.061] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0163.061] lstrlenW (lpString=".xlsx") returned 5
	[0163.061] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0163.061] lstrlenW (lpString=".ppt") returned 4
	[0163.061] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0163.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.061] lstrlenW (lpString=".zip") returned 4
	[0163.061] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0163.061] lstrlenW (lpString=".rar") returned 4
	[0163.061] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0163.061] lstrlenW (lpString=".bz2") returned 4
	[0163.061] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0163.061] lstrlenW (lpString=".7z") returned 3
	[0163.061] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0163.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.061] lstrlenW (lpString=".dbf") returned 4
	[0163.061] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0163.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.061] lstrlenW (lpString=".1cd") returned 4
	[0163.061] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0163.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0163.061] lstrlenW (lpString=".jpg") returned 4
	[0163.061] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0163.062] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0163.062] lstrlenW (lpString="javaws.jar") returned 10
	[0163.062] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0163.064] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=944167) returned 1
	[0163.064] CloseHandle (hObject=0x500) returned 1
	[0163.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20
	[0163.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0163.065] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.065] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0163.066] GetLastError () returned 0x0
	[0163.066] ReadFile (in: hFile=0x500, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xe6827, lpOverlapped=0x0) returned 1
	[0163.503] WriteFile (in: hFile=0x4b8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xe6830, lpOverlapped=0x0) returned 1
	[0163.519] ReadFile (in: hFile=0x500, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.519] WriteFile (in: hFile=0x4b8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xe8, lpOverlapped=0x0) returned 1
	[0163.520] SetEndOfFile (hFile=0x4b8) returned 1
	[0163.520] CloseHandle (hObject=0x4b8) returned 1
	[0163.520] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.520] SetEndOfFile (hFile=0x500) returned 1
	[0163.874] CloseHandle (hObject=0x500) returned 1
	[0163.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0163.875] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1
	[0163.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.876] lstrlenW (lpString=".doc") returned 4
	[0163.876] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0163.876] lstrlenW (lpString=".docx") returned 5
	[0163.876] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0163.876] lstrlenW (lpString=".pdf") returned 4
	[0163.876] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0163.876] lstrlenW (lpString=".xls") returned 4
	[0163.876] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0163.876] lstrlenW (lpString=".xlsx") returned 5
	[0163.876] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0163.876] lstrlenW (lpString=".ppt") returned 4
	[0163.876] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0163.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.876] lstrlenW (lpString=".zip") returned 4
	[0163.876] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0163.876] lstrlenW (lpString=".rar") returned 4
	[0163.876] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0163.876] lstrlenW (lpString=".bz2") returned 4
	[0163.876] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0163.876] lstrlenW (lpString=".7z") returned 3
	[0163.876] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0163.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.876] lstrlenW (lpString=".dbf") returned 4
	[0163.876] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0163.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.876] lstrlenW (lpString=".1cd") returned 4
	[0163.876] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0163.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.876] lstrlenW (lpString=".jpg") returned 4
	[0163.876] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0163.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.877] lstrlenW (lpString=".doc") returned 4
	[0163.877] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0163.877] lstrlenW (lpString=".docx") returned 5
	[0163.877] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0163.877] lstrlenW (lpString=".pdf") returned 4
	[0163.877] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0163.877] lstrlenW (lpString=".xls") returned 4
	[0163.877] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0163.877] lstrlenW (lpString=".xlsx") returned 5
	[0163.877] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0163.877] lstrlenW (lpString=".ppt") returned 4
	[0163.877] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0163.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.877] lstrlenW (lpString=".zip") returned 4
	[0163.877] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0163.877] lstrlenW (lpString=".rar") returned 4
	[0163.877] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0163.877] lstrlenW (lpString=".bz2") returned 4
	[0163.877] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0163.877] lstrlenW (lpString=".7z") returned 3
	[0163.877] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0163.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.877] lstrlenW (lpString=".dbf") returned 4
	[0163.877] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0163.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.878] lstrlenW (lpString=".1cd") returned 4
	[0163.878] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0163.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0163.878] lstrlenW (lpString=".jpg") returned 4
	[0163.878] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0164.148] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0164.148] lstrlenW (lpString="management.properties") returned 21
	[0164.148] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.149] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=14630) returned 1
	[0164.149] CloseHandle (hObject=0x4b8) returned 1
	[0164.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20
	[0164.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.149] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.149] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.150] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.150] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0164.150] GetLastError () returned 0x0
	[0164.150] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x3926, lpOverlapped=0x0) returned 1
	[0164.152] WriteFile (in: hFile=0x4f0, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x3930, lpOverlapped=0x0) returned 1
	[0164.153] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.153] WriteFile (in: hFile=0x4f0, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xfe, lpOverlapped=0x0) returned 1
	[0164.154] SetEndOfFile (hFile=0x4f0) returned 1
	[0164.154] CloseHandle (hObject=0x4f0) returned 1
	[0164.154] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.154] SetEndOfFile (hFile=0x4b8) returned 1
	[0164.172] CloseHandle (hObject=0x4b8) returned 1
	[0164.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0164.173] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1
	[0164.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.174] lstrlenW (lpString=".doc") returned 4
	[0164.174] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0164.174] lstrlenW (lpString=".docx") returned 5
	[0164.174] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0164.174] lstrlenW (lpString=".pdf") returned 4
	[0164.174] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0164.174] lstrlenW (lpString=".xls") returned 4
	[0164.174] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0164.174] lstrlenW (lpString=".xlsx") returned 5
	[0164.174] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0164.174] lstrlenW (lpString=".ppt") returned 4
	[0164.175] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0164.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.175] lstrlenW (lpString=".zip") returned 4
	[0164.175] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0164.175] lstrlenW (lpString=".rar") returned 4
	[0164.175] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0164.175] lstrlenW (lpString=".bz2") returned 4
	[0164.175] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0164.175] lstrlenW (lpString=".7z") returned 3
	[0164.175] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0164.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.175] lstrlenW (lpString=".dbf") returned 4
	[0164.175] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0164.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.175] lstrlenW (lpString=".1cd") returned 4
	[0164.175] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0164.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.175] lstrlenW (lpString=".jpg") returned 4
	[0164.175] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0164.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.175] lstrlenW (lpString=".doc") returned 4
	[0164.175] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0164.175] lstrlenW (lpString=".docx") returned 5
	[0164.175] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0164.175] lstrlenW (lpString=".pdf") returned 4
	[0164.176] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0164.176] lstrlenW (lpString=".xls") returned 4
	[0164.176] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0164.176] lstrlenW (lpString=".xlsx") returned 5
	[0164.176] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0164.176] lstrlenW (lpString=".ppt") returned 4
	[0164.176] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0164.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.176] lstrlenW (lpString=".zip") returned 4
	[0164.176] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0164.176] lstrlenW (lpString=".rar") returned 4
	[0164.176] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0164.176] lstrlenW (lpString=".bz2") returned 4
	[0164.176] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0164.176] lstrlenW (lpString=".7z") returned 3
	[0164.176] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0164.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.176] lstrlenW (lpString=".dbf") returned 4
	[0164.176] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0164.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.176] lstrlenW (lpString=".1cd") returned 4
	[0164.176] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0164.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0164.177] lstrlenW (lpString=".jpg") returned 4
	[0164.177] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0164.177] lstrcmpiW (lpString1=".template", lpString2=".money") returned 1
	[0164.177] lstrlenW (lpString="snmp.acl.template") returned 17
	[0164.177] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.178] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=3376) returned 1
	[0164.178] CloseHandle (hObject=0x4b8) returned 1
	[0164.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20
	[0164.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.178] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.179] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.179] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.180] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0164.180] GetLastError () returned 0x0
	[0164.180] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xd30, lpOverlapped=0x0) returned 1
	[0164.182] WriteFile (in: hFile=0x4f0, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xd40, lpOverlapped=0x0) returned 1
	[0164.183] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.184] WriteFile (in: hFile=0x4f0, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0164.184] SetEndOfFile (hFile=0x4f0) returned 1
	[0164.184] CloseHandle (hObject=0x4f0) returned 1
	[0164.184] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.184] SetEndOfFile (hFile=0x4b8) returned 1
	[0164.187] CloseHandle (hObject=0x4b8) returned 1
	[0164.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0164.187] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1
	[0164.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.188] lstrlenW (lpString=".doc") returned 4
	[0164.188] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0164.188] lstrlenW (lpString=".docx") returned 5
	[0164.188] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0164.188] lstrlenW (lpString=".pdf") returned 4
	[0164.188] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0164.397] lstrlenW (lpString=".xls") returned 4
	[0164.398] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0164.408] lstrlenW (lpString=".xlsx") returned 5
	[0164.409] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0164.409] lstrlenW (lpString=".ppt") returned 4
	[0164.410] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0164.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.418] lstrlenW (lpString=".zip") returned 4
	[0164.418] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0164.419] lstrlenW (lpString=".rar") returned 4
	[0164.420] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0164.420] lstrlenW (lpString=".bz2") returned 4
	[0164.420] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0164.420] lstrlenW (lpString=".7z") returned 3
	[0164.423] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0164.423] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.423] lstrlenW (lpString=".dbf") returned 4
	[0164.423] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0164.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.431] lstrlenW (lpString=".1cd") returned 4
	[0164.431] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0164.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.438] lstrlenW (lpString=".jpg") returned 4
	[0164.438] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0164.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.438] lstrlenW (lpString=".doc") returned 4
	[0164.438] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0164.438] lstrlenW (lpString=".docx") returned 5
	[0164.438] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0164.438] lstrlenW (lpString=".pdf") returned 4
	[0164.438] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0164.438] lstrlenW (lpString=".xls") returned 4
	[0164.438] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0164.438] lstrlenW (lpString=".xlsx") returned 5
	[0164.438] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0164.439] lstrlenW (lpString=".ppt") returned 4
	[0164.439] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0164.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.439] lstrlenW (lpString=".zip") returned 4
	[0164.439] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0164.439] lstrlenW (lpString=".rar") returned 4
	[0164.439] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0164.439] lstrlenW (lpString=".bz2") returned 4
	[0164.439] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0164.439] lstrlenW (lpString=".7z") returned 3
	[0164.439] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0164.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.439] lstrlenW (lpString=".dbf") returned 4
	[0164.439] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0164.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.439] lstrlenW (lpString=".1cd") returned 4
	[0164.439] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0164.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0164.439] lstrlenW (lpString=".jpg") returned 4
	[0164.439] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0164.439] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0164.439] lstrlenW (lpString="net.properties") returned 14
	[0164.439] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.471] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=4464) returned 1
	[0164.471] CloseHandle (hObject=0x500) returned 1
	[0164.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20
	[0164.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.598] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.815] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.815] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.815] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.816] GetLastError () returned 0x0
	[0165.816] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x1170, lpOverlapped=0x0) returned 1
	[0165.818] WriteFile (in: hFile=0x55c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x1180, lpOverlapped=0x0) returned 1
	[0165.819] ReadFile (in: hFile=0x4b8, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.819] WriteFile (in: hFile=0x55c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xf0, lpOverlapped=0x0) returned 1
	[0165.819] SetEndOfFile (hFile=0x55c) returned 1
	[0165.819] CloseHandle (hObject=0x55c) returned 1
	[0165.820] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.820] SetEndOfFile (hFile=0x4b8) returned 1
	[0166.092] CloseHandle (hObject=0x4b8) returned 1
	[0166.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0166.462] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1
	[0166.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.828] lstrlenW (lpString=".doc") returned 4
	[0166.828] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0166.828] lstrlenW (lpString=".docx") returned 5
	[0166.828] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0166.828] lstrlenW (lpString=".pdf") returned 4
	[0166.828] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0166.828] lstrlenW (lpString=".xls") returned 4
	[0166.828] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0166.829] lstrlenW (lpString=".xlsx") returned 5
	[0166.829] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0166.829] lstrlenW (lpString=".ppt") returned 4
	[0166.829] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0166.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.829] lstrlenW (lpString=".zip") returned 4
	[0166.829] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0166.829] lstrlenW (lpString=".rar") returned 4
	[0166.829] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0166.829] lstrlenW (lpString=".bz2") returned 4
	[0166.829] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0166.829] lstrlenW (lpString=".7z") returned 3
	[0166.829] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0166.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.829] lstrlenW (lpString=".dbf") returned 4
	[0166.829] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0166.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.829] lstrlenW (lpString=".1cd") returned 4
	[0166.829] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0166.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.829] lstrlenW (lpString=".jpg") returned 4
	[0166.829] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0166.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.829] lstrlenW (lpString=".doc") returned 4
	[0166.829] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0166.829] lstrlenW (lpString=".docx") returned 5
	[0166.830] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0166.830] lstrlenW (lpString=".pdf") returned 4
	[0166.830] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0166.830] lstrlenW (lpString=".xls") returned 4
	[0166.830] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0166.830] lstrlenW (lpString=".xlsx") returned 5
	[0166.830] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0166.830] lstrlenW (lpString=".ppt") returned 4
	[0166.830] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0166.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.830] lstrlenW (lpString=".zip") returned 4
	[0166.830] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0166.830] lstrlenW (lpString=".rar") returned 4
	[0166.830] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0166.830] lstrlenW (lpString=".bz2") returned 4
	[0166.830] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0166.830] lstrlenW (lpString=".7z") returned 3
	[0166.830] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0166.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.830] lstrlenW (lpString=".dbf") returned 4
	[0166.830] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0166.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.830] lstrlenW (lpString=".1cd") returned 4
	[0166.830] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0166.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0166.830] lstrlenW (lpString=".jpg") returned 4
	[0166.830] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0166.831] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.831] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36
	[0166.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0167.234] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=20672) returned 1
	[0167.234] CloseHandle (hObject=0x4e4) returned 1
	[0167.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220
	[0167.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.235] lstrlenW (lpString=".doc") returned 4
	[0167.235] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0167.235] lstrlenW (lpString=".docx") returned 5
	[0167.235] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0167.235] lstrlenW (lpString=".pdf") returned 4
	[0167.235] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0167.235] lstrlenW (lpString=".xls") returned 4
	[0167.235] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0167.235] lstrlenW (lpString=".xlsx") returned 5
	[0167.235] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0167.235] lstrlenW (lpString=".ppt") returned 4
	[0167.235] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.235] lstrlenW (lpString=".zip") returned 4
	[0167.235] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0167.235] lstrlenW (lpString=".rar") returned 4
	[0167.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0167.235] lstrlenW (lpString=".bz2") returned 4
	[0167.235] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0167.235] lstrlenW (lpString=".7z") returned 3
	[0167.235] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.235] lstrlenW (lpString=".dbf") returned 4
	[0167.235] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.235] lstrlenW (lpString=".1cd") returned 4
	[0167.235] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.235] lstrlenW (lpString=".jpg") returned 4
	[0167.236] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0167.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.236] lstrlenW (lpString=".doc") returned 4
	[0167.236] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0167.236] lstrlenW (lpString=".docx") returned 5
	[0167.236] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0167.236] lstrlenW (lpString=".pdf") returned 4
	[0167.236] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0167.236] lstrlenW (lpString=".xls") returned 4
	[0167.236] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0167.236] lstrlenW (lpString=".xlsx") returned 5
	[0167.236] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0167.236] lstrlenW (lpString=".ppt") returned 4
	[0167.236] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0167.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.249] lstrlenW (lpString=".zip") returned 4
	[0167.249] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0167.249] lstrlenW (lpString=".rar") returned 4
	[0167.249] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0167.249] lstrlenW (lpString=".bz2") returned 4
	[0167.249] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0167.249] lstrlenW (lpString=".7z") returned 3
	[0167.249] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0167.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.249] lstrlenW (lpString=".dbf") returned 4
	[0167.249] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0167.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.249] lstrlenW (lpString=".1cd") returned 4
	[0167.249] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0167.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0167.249] lstrlenW (lpString=".jpg") returned 4
	[0167.249] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0167.250] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0167.250] lstrlenW (lpString="FALL_01.MID") returned 11
	[0167.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.540] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=4846) returned 1
	[0167.540] CloseHandle (hObject=0x514) returned 1
	[0167.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220
	[0167.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.541] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.541] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0167.542] GetLastError () returned 0x0
	[0167.542] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x12ee, lpOverlapped=0x0) returned 1
	[0167.545] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x12f0, lpOverlapped=0x0) returned 1
	[0167.546] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.546] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xea, lpOverlapped=0x0) returned 1
	[0167.546] SetEndOfFile (hFile=0x4e4) returned 1
	[0167.546] CloseHandle (hObject=0x4e4) returned 1
	[0167.546] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.546] SetEndOfFile (hFile=0x514) returned 1
	[0167.549] CloseHandle (hObject=0x514) returned 1
	[0167.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1
	[0167.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.551] lstrlenW (lpString=".doc") returned 4
	[0167.551] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.551] lstrlenW (lpString=".docx") returned 5
	[0167.551] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.551] lstrlenW (lpString=".pdf") returned 4
	[0167.551] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.551] lstrlenW (lpString=".xls") returned 4
	[0167.551] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.551] lstrlenW (lpString=".xlsx") returned 5
	[0167.551] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.551] lstrlenW (lpString=".ppt") returned 4
	[0167.551] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.551] lstrlenW (lpString=".zip") returned 4
	[0167.551] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.551] lstrlenW (lpString=".rar") returned 4
	[0167.551] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.551] lstrlenW (lpString=".bz2") returned 4
	[0167.551] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.551] lstrlenW (lpString=".7z") returned 3
	[0167.551] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.551] lstrlenW (lpString=".dbf") returned 4
	[0167.552] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.552] lstrlenW (lpString=".1cd") returned 4
	[0167.552] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.552] lstrlenW (lpString=".jpg") returned 4
	[0167.552] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.552] lstrlenW (lpString=".doc") returned 4
	[0167.552] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.552] lstrlenW (lpString=".docx") returned 5
	[0167.552] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.552] lstrlenW (lpString=".pdf") returned 4
	[0167.552] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.552] lstrlenW (lpString=".xls") returned 4
	[0167.552] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.552] lstrlenW (lpString=".xlsx") returned 5
	[0167.552] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.552] lstrlenW (lpString=".ppt") returned 4
	[0167.552] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.552] lstrlenW (lpString=".zip") returned 4
	[0167.552] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.552] lstrlenW (lpString=".rar") returned 4
	[0167.552] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.552] lstrlenW (lpString=".bz2") returned 4
	[0167.553] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.553] lstrlenW (lpString=".7z") returned 3
	[0167.553] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.553] lstrlenW (lpString=".dbf") returned 4
	[0167.553] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.553] lstrlenW (lpString=".1cd") returned 4
	[0167.553] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0167.553] lstrlenW (lpString=".jpg") returned 4
	[0167.553] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.553] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0167.553] lstrlenW (lpString="GRDEN_01.MID") returned 12
	[0167.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.555] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=7567) returned 1
	[0167.555] CloseHandle (hObject=0x514) returned 1
	[0167.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220
	[0167.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.555] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.555] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0167.556] GetLastError () returned 0x0
	[0167.556] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x1d8f, lpOverlapped=0x0) returned 1
	[0167.558] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x1d90, lpOverlapped=0x0) returned 1
	[0167.559] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.559] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.559] SetEndOfFile (hFile=0x4e4) returned 1
	[0167.560] CloseHandle (hObject=0x4e4) returned 1
	[0167.560] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.560] SetEndOfFile (hFile=0x514) returned 1
	[0167.563] CloseHandle (hObject=0x514) returned 1
	[0167.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1
	[0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.570] lstrlenW (lpString=".doc") returned 4
	[0167.570] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.570] lstrlenW (lpString=".docx") returned 5
	[0167.570] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.570] lstrlenW (lpString=".pdf") returned 4
	[0167.570] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.570] lstrlenW (lpString=".xls") returned 4
	[0167.570] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.570] lstrlenW (lpString=".xlsx") returned 5
	[0167.570] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.570] lstrlenW (lpString=".ppt") returned 4
	[0167.570] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.570] lstrlenW (lpString=".zip") returned 4
	[0167.570] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.570] lstrlenW (lpString=".rar") returned 4
	[0167.570] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.570] lstrlenW (lpString=".bz2") returned 4
	[0167.570] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.570] lstrlenW (lpString=".7z") returned 3
	[0167.570] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.570] lstrlenW (lpString=".dbf") returned 4
	[0167.570] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.571] lstrlenW (lpString=".1cd") returned 4
	[0167.571] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.571] lstrlenW (lpString=".jpg") returned 4
	[0167.571] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.571] lstrlenW (lpString=".doc") returned 4
	[0167.571] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.571] lstrlenW (lpString=".docx") returned 5
	[0167.571] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.571] lstrlenW (lpString=".pdf") returned 4
	[0167.571] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.571] lstrlenW (lpString=".xls") returned 4
	[0167.571] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.571] lstrlenW (lpString=".xlsx") returned 5
	[0167.571] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.571] lstrlenW (lpString=".ppt") returned 4
	[0167.571] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.571] lstrlenW (lpString=".zip") returned 4
	[0167.571] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.571] lstrlenW (lpString=".rar") returned 4
	[0167.571] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.572] lstrlenW (lpString=".bz2") returned 4
	[0167.572] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.572] lstrlenW (lpString=".7z") returned 3
	[0167.572] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.572] lstrlenW (lpString=".dbf") returned 4
	[0167.572] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.572] lstrlenW (lpString=".1cd") returned 4
	[0167.572] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0167.572] lstrlenW (lpString=".jpg") returned 4
	[0167.572] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.572] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0167.572] lstrlenW (lpString="GRID_01.MID") returned 11
	[0167.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.575] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=6331) returned 1
	[0167.575] CloseHandle (hObject=0x514) returned 1
	[0167.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220
	[0167.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.576] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.576] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0167.576] GetLastError () returned 0x0
	[0167.576] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x18bb, lpOverlapped=0x0) returned 1
	[0168.400] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x18c0, lpOverlapped=0x0) returned 1
	[0168.401] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.401] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xea, lpOverlapped=0x0) returned 1
	[0168.401] SetEndOfFile (hFile=0x4e4) returned 1
	[0168.401] CloseHandle (hObject=0x4e4) returned 1
	[0168.401] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.401] SetEndOfFile (hFile=0x514) returned 1
	[0168.404] CloseHandle (hObject=0x514) returned 1
	[0168.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1
	[0168.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.405] lstrlenW (lpString=".doc") returned 4
	[0168.405] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.405] lstrlenW (lpString=".docx") returned 5
	[0168.405] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.405] lstrlenW (lpString=".pdf") returned 4
	[0168.405] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.405] lstrlenW (lpString=".xls") returned 4
	[0168.405] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.405] lstrlenW (lpString=".xlsx") returned 5
	[0168.405] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.405] lstrlenW (lpString=".ppt") returned 4
	[0168.405] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.405] lstrlenW (lpString=".zip") returned 4
	[0168.405] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.405] lstrlenW (lpString=".rar") returned 4
	[0168.405] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.405] lstrlenW (lpString=".bz2") returned 4
	[0168.406] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.406] lstrlenW (lpString=".7z") returned 3
	[0168.406] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.406] lstrlenW (lpString=".dbf") returned 4
	[0168.406] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.406] lstrlenW (lpString=".1cd") returned 4
	[0168.406] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.406] lstrlenW (lpString=".jpg") returned 4
	[0168.406] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.406] lstrlenW (lpString=".doc") returned 4
	[0168.406] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.406] lstrlenW (lpString=".docx") returned 5
	[0168.406] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.406] lstrlenW (lpString=".pdf") returned 4
	[0168.406] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.406] lstrlenW (lpString=".xls") returned 4
	[0168.406] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.406] lstrlenW (lpString=".xlsx") returned 5
	[0168.406] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.406] lstrlenW (lpString=".ppt") returned 4
	[0168.406] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.407] lstrlenW (lpString=".zip") returned 4
	[0168.407] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.407] lstrlenW (lpString=".rar") returned 4
	[0168.407] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.407] lstrlenW (lpString=".bz2") returned 4
	[0168.407] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.407] lstrlenW (lpString=".7z") returned 3
	[0168.407] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.407] lstrlenW (lpString=".dbf") returned 4
	[0168.407] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.407] lstrlenW (lpString=".1cd") returned 4
	[0168.407] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0168.407] lstrlenW (lpString=".jpg") returned 4
	[0168.407] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.407] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0168.407] lstrlenW (lpString="OCEAN_01.MID") returned 12
	[0168.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0168.408] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=5440) returned 1
	[0168.408] CloseHandle (hObject=0x514) returned 1
	[0168.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220
	[0168.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0168.412] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.412] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.770] GetLastError () returned 0x0
	[0168.770] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x1540, lpOverlapped=0x0) returned 1
	[0168.772] WriteFile (in: hFile=0x4e0, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x1550, lpOverlapped=0x0) returned 1
	[0168.773] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.773] WriteFile (in: hFile=0x4e0, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.773] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.774] CloseHandle (hObject=0x4e0) returned 1
	[0168.774] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.774] SetEndOfFile (hFile=0x514) returned 1
	[0168.776] CloseHandle (hObject=0x514) returned 1
	[0168.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1
	[0168.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.777] lstrlenW (lpString=".doc") returned 4
	[0168.777] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.777] lstrlenW (lpString=".docx") returned 5
	[0168.778] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.778] lstrlenW (lpString=".pdf") returned 4
	[0168.778] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.778] lstrlenW (lpString=".xls") returned 4
	[0168.778] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.778] lstrlenW (lpString=".xlsx") returned 5
	[0168.778] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.778] lstrlenW (lpString=".ppt") returned 4
	[0168.778] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.778] lstrlenW (lpString=".zip") returned 4
	[0168.778] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.778] lstrlenW (lpString=".rar") returned 4
	[0168.778] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.778] lstrlenW (lpString=".bz2") returned 4
	[0168.778] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.778] lstrlenW (lpString=".7z") returned 3
	[0168.778] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.778] lstrlenW (lpString=".dbf") returned 4
	[0168.778] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.778] lstrlenW (lpString=".1cd") returned 4
	[0168.778] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.778] lstrlenW (lpString=".jpg") returned 4
	[0168.778] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.779] lstrlenW (lpString=".doc") returned 4
	[0168.779] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.779] lstrlenW (lpString=".docx") returned 5
	[0168.779] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.779] lstrlenW (lpString=".pdf") returned 4
	[0168.779] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.779] lstrlenW (lpString=".xls") returned 4
	[0168.779] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.779] lstrlenW (lpString=".xlsx") returned 5
	[0168.779] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.779] lstrlenW (lpString=".ppt") returned 4
	[0168.779] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.779] lstrlenW (lpString=".zip") returned 4
	[0168.779] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.779] lstrlenW (lpString=".rar") returned 4
	[0168.779] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.779] lstrlenW (lpString=".bz2") returned 4
	[0168.779] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.779] lstrlenW (lpString=".7z") returned 3
	[0168.779] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.779] lstrlenW (lpString=".dbf") returned 4
	[0168.779] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.779] lstrlenW (lpString=".1cd") returned 4
	[0168.779] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0168.780] lstrlenW (lpString=".jpg") returned 4
	[0168.780] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.780] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0168.780] lstrlenW (lpString="PARNT_01.MID") returned 12
	[0168.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0168.781] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=6491) returned 1
	[0168.781] CloseHandle (hObject=0x514) returned 1
	[0168.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220
	[0168.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0168.784] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.784] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.785] GetLastError () returned 0x0
	[0168.785] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x195b, lpOverlapped=0x0) returned 1
	[0168.786] WriteFile (in: hFile=0x4e0, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x1960, lpOverlapped=0x0) returned 1
	[0168.787] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.787] WriteFile (in: hFile=0x4e0, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.788] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.788] CloseHandle (hObject=0x4e0) returned 1
	[0168.788] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.788] SetEndOfFile (hFile=0x514) returned 1
	[0168.791] CloseHandle (hObject=0x514) returned 1
	[0168.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1
	[0168.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.792] lstrlenW (lpString=".doc") returned 4
	[0168.792] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.792] lstrlenW (lpString=".docx") returned 5
	[0168.792] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.792] lstrlenW (lpString=".pdf") returned 4
	[0168.792] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.792] lstrlenW (lpString=".xls") returned 4
	[0168.792] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.792] lstrlenW (lpString=".xlsx") returned 5
	[0168.792] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.792] lstrlenW (lpString=".ppt") returned 4
	[0168.792] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.792] lstrlenW (lpString=".zip") returned 4
	[0168.792] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.792] lstrlenW (lpString=".rar") returned 4
	[0168.792] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.792] lstrlenW (lpString=".bz2") returned 4
	[0168.792] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.792] lstrlenW (lpString=".7z") returned 3
	[0168.792] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.792] lstrlenW (lpString=".dbf") returned 4
	[0168.792] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.792] lstrlenW (lpString=".1cd") returned 4
	[0168.792] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.793] lstrlenW (lpString=".jpg") returned 4
	[0168.793] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.793] lstrlenW (lpString=".doc") returned 4
	[0168.793] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.793] lstrlenW (lpString=".docx") returned 5
	[0168.793] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.793] lstrlenW (lpString=".pdf") returned 4
	[0168.793] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.793] lstrlenW (lpString=".xls") returned 4
	[0168.793] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.793] lstrlenW (lpString=".xlsx") returned 5
	[0168.793] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.793] lstrlenW (lpString=".ppt") returned 4
	[0168.793] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.793] lstrlenW (lpString=".zip") returned 4
	[0168.793] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.793] lstrlenW (lpString=".rar") returned 4
	[0168.793] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.793] lstrlenW (lpString=".bz2") returned 4
	[0168.793] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.793] lstrlenW (lpString=".7z") returned 3
	[0168.793] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.793] lstrlenW (lpString=".dbf") returned 4
	[0168.793] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.793] lstrlenW (lpString=".1cd") returned 4
	[0168.794] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0168.794] lstrlenW (lpString=".jpg") returned 4
	[0168.794] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.794] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0168.794] lstrlenW (lpString="PARNT_02.MID") returned 12
	[0168.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0168.795] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=5714) returned 1
	[0168.795] CloseHandle (hObject=0x514) returned 1
	[0168.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220
	[0168.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0168.796] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.796] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.797] GetLastError () returned 0x0
	[0168.797] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x1652, lpOverlapped=0x0) returned 1
	[0168.798] WriteFile (in: hFile=0x4e0, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x1660, lpOverlapped=0x0) returned 1
	[0168.799] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.799] WriteFile (in: hFile=0x4e0, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.799] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.800] CloseHandle (hObject=0x4e0) returned 1
	[0168.800] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.800] SetEndOfFile (hFile=0x514) returned 1
	[0168.803] CloseHandle (hObject=0x514) returned 1
	[0168.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1
	[0168.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.804] lstrlenW (lpString=".doc") returned 4
	[0168.804] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.804] lstrlenW (lpString=".docx") returned 5
	[0168.804] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0168.804] lstrlenW (lpString=".pdf") returned 4
	[0168.804] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.804] lstrlenW (lpString=".xls") returned 4
	[0168.804] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.805] lstrlenW (lpString=".xlsx") returned 5
	[0168.805] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0168.805] lstrlenW (lpString=".ppt") returned 4
	[0168.805] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.805] lstrlenW (lpString=".zip") returned 4
	[0168.805] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.805] lstrlenW (lpString=".rar") returned 4
	[0168.805] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.805] lstrlenW (lpString=".bz2") returned 4
	[0168.805] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.805] lstrlenW (lpString=".7z") returned 3
	[0168.805] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.805] lstrlenW (lpString=".dbf") returned 4
	[0168.805] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.805] lstrlenW (lpString=".1cd") returned 4
	[0168.805] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.805] lstrlenW (lpString=".jpg") returned 4
	[0168.805] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.805] lstrlenW (lpString=".doc") returned 4
	[0168.805] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.805] lstrlenW (lpString=".docx") returned 5
	[0168.806] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0168.806] lstrlenW (lpString=".pdf") returned 4
	[0168.806] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.806] lstrlenW (lpString=".xls") returned 4
	[0168.806] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.806] lstrlenW (lpString=".xlsx") returned 5
	[0168.806] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0168.806] lstrlenW (lpString=".ppt") returned 4
	[0168.806] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.806] lstrlenW (lpString=".zip") returned 4
	[0168.806] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.806] lstrlenW (lpString=".rar") returned 4
	[0168.806] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.806] lstrlenW (lpString=".bz2") returned 4
	[0168.806] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.806] lstrlenW (lpString=".7z") returned 3
	[0168.806] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.806] lstrlenW (lpString=".dbf") returned 4
	[0168.806] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.806] lstrlenW (lpString=".1cd") returned 4
	[0168.806] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0168.807] lstrlenW (lpString=".jpg") returned 4
	[0168.807] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.807] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0168.807] lstrlenW (lpString="PARNT_03.MID") returned 12
	[0168.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0168.807] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=8538) returned 1
	[0169.100] CloseHandle (hObject=0x514) returned 1
	[0169.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220
	[0169.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.344] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.344] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0169.345] GetLastError () returned 0x0
	[0169.345] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x215a, lpOverlapped=0x0) returned 1
	[0169.347] WriteFile (in: hFile=0x36c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2160, lpOverlapped=0x0) returned 1
	[0169.348] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.348] WriteFile (in: hFile=0x36c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.348] SetEndOfFile (hFile=0x36c) returned 1
	[0169.348] CloseHandle (hObject=0x36c) returned 1
	[0169.348] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.348] SetEndOfFile (hFile=0x534) returned 1
	[0169.351] CloseHandle (hObject=0x534) returned 1
	[0169.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1
	[0169.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.352] lstrlenW (lpString=".doc") returned 4
	[0169.352] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.352] lstrlenW (lpString=".docx") returned 5
	[0169.352] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1
	[0169.352] lstrlenW (lpString=".pdf") returned 4
	[0169.352] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.352] lstrlenW (lpString=".xls") returned 4
	[0169.352] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.352] lstrlenW (lpString=".xlsx") returned 5
	[0169.353] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1
	[0169.353] lstrlenW (lpString=".ppt") returned 4
	[0169.353] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.353] lstrlenW (lpString=".zip") returned 4
	[0169.353] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.353] lstrlenW (lpString=".rar") returned 4
	[0169.353] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.353] lstrlenW (lpString=".bz2") returned 4
	[0169.353] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.353] lstrlenW (lpString=".7z") returned 3
	[0169.353] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.353] lstrlenW (lpString=".dbf") returned 4
	[0169.353] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.353] lstrlenW (lpString=".1cd") returned 4
	[0169.353] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.353] lstrlenW (lpString=".jpg") returned 4
	[0169.353] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.353] lstrlenW (lpString=".doc") returned 4
	[0169.353] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.353] lstrlenW (lpString=".docx") returned 5
	[0169.353] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1
	[0169.354] lstrlenW (lpString=".pdf") returned 4
	[0169.354] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.354] lstrlenW (lpString=".xls") returned 4
	[0169.354] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.354] lstrlenW (lpString=".xlsx") returned 5
	[0169.354] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1
	[0169.354] lstrlenW (lpString=".ppt") returned 4
	[0169.354] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.354] lstrlenW (lpString=".zip") returned 4
	[0169.354] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.354] lstrlenW (lpString=".rar") returned 4
	[0169.354] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.354] lstrlenW (lpString=".bz2") returned 4
	[0169.354] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.354] lstrlenW (lpString=".7z") returned 3
	[0169.354] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.354] lstrlenW (lpString=".dbf") returned 4
	[0169.354] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.354] lstrlenW (lpString=".1cd") returned 4
	[0169.354] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0169.355] lstrlenW (lpString=".jpg") returned 4
	[0169.355] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.355] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.355] lstrlenW (lpString="SUMER_01.MID") returned 12
	[0169.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.356] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=14044) returned 1
	[0169.356] CloseHandle (hObject=0x534) returned 1
	[0169.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220
	[0169.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.358] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.358] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0169.359] GetLastError () returned 0x0
	[0169.359] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x36dc, lpOverlapped=0x0) returned 1
	[0169.361] WriteFile (in: hFile=0x36c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x36e0, lpOverlapped=0x0) returned 1
	[0169.362] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.362] WriteFile (in: hFile=0x36c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.362] SetEndOfFile (hFile=0x36c) returned 1
	[0169.362] CloseHandle (hObject=0x36c) returned 1
	[0169.362] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.362] SetEndOfFile (hFile=0x534) returned 1
	[0169.365] CloseHandle (hObject=0x534) returned 1
	[0169.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1
	[0169.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.366] lstrlenW (lpString=".doc") returned 4
	[0169.366] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.366] lstrlenW (lpString=".docx") returned 5
	[0169.367] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.367] lstrlenW (lpString=".pdf") returned 4
	[0169.367] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.367] lstrlenW (lpString=".xls") returned 4
	[0169.367] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.367] lstrlenW (lpString=".xlsx") returned 5
	[0169.367] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.367] lstrlenW (lpString=".ppt") returned 4
	[0169.367] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.367] lstrlenW (lpString=".zip") returned 4
	[0169.367] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.367] lstrlenW (lpString=".rar") returned 4
	[0169.367] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.367] lstrlenW (lpString=".bz2") returned 4
	[0169.367] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.367] lstrlenW (lpString=".7z") returned 3
	[0169.367] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.367] lstrlenW (lpString=".dbf") returned 4
	[0169.367] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.367] lstrlenW (lpString=".1cd") returned 4
	[0169.367] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.367] lstrlenW (lpString=".jpg") returned 4
	[0169.367] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.368] lstrlenW (lpString=".doc") returned 4
	[0169.368] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.368] lstrlenW (lpString=".docx") returned 5
	[0169.368] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.368] lstrlenW (lpString=".pdf") returned 4
	[0169.368] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.368] lstrlenW (lpString=".xls") returned 4
	[0169.368] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.368] lstrlenW (lpString=".xlsx") returned 5
	[0169.368] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.368] lstrlenW (lpString=".ppt") returned 4
	[0169.368] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.368] lstrlenW (lpString=".zip") returned 4
	[0169.368] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.368] lstrlenW (lpString=".rar") returned 4
	[0169.368] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.368] lstrlenW (lpString=".bz2") returned 4
	[0169.368] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.368] lstrlenW (lpString=".7z") returned 3
	[0169.368] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.368] lstrlenW (lpString=".dbf") returned 4
	[0169.368] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.368] lstrlenW (lpString=".1cd") returned 4
	[0169.368] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0169.369] lstrlenW (lpString=".jpg") returned 4
	[0169.369] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.369] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.369] lstrlenW (lpString="SWEST_01.MID") returned 12
	[0169.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.370] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=8501) returned 1
	[0169.370] CloseHandle (hObject=0x534) returned 1
	[0169.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220
	[0169.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.371] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.371] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0169.371] GetLastError () returned 0x0
	[0169.371] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2135, lpOverlapped=0x0) returned 1
	[0169.373] WriteFile (in: hFile=0x36c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2140, lpOverlapped=0x0) returned 1
	[0169.374] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.374] WriteFile (in: hFile=0x36c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.374] SetEndOfFile (hFile=0x36c) returned 1
	[0169.374] CloseHandle (hObject=0x36c) returned 1
	[0169.375] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.375] SetEndOfFile (hFile=0x534) returned 1
	[0169.380] CloseHandle (hObject=0x534) returned 1
	[0169.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1
	[0169.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.382] lstrlenW (lpString=".doc") returned 4
	[0169.382] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.382] lstrlenW (lpString=".docx") returned 5
	[0169.382] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.382] lstrlenW (lpString=".pdf") returned 4
	[0169.382] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.382] lstrlenW (lpString=".xls") returned 4
	[0169.382] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.382] lstrlenW (lpString=".xlsx") returned 5
	[0169.382] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.382] lstrlenW (lpString=".ppt") returned 4
	[0169.382] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.382] lstrlenW (lpString=".zip") returned 4
	[0169.382] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.382] lstrlenW (lpString=".rar") returned 4
	[0169.382] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.382] lstrlenW (lpString=".bz2") returned 4
	[0169.382] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.382] lstrlenW (lpString=".7z") returned 3
	[0169.382] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.382] lstrlenW (lpString=".dbf") returned 4
	[0169.382] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.383] lstrlenW (lpString=".1cd") returned 4
	[0169.383] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.383] lstrlenW (lpString=".jpg") returned 4
	[0169.383] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.383] lstrlenW (lpString=".doc") returned 4
	[0169.383] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.383] lstrlenW (lpString=".docx") returned 5
	[0169.383] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.383] lstrlenW (lpString=".pdf") returned 4
	[0169.383] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.383] lstrlenW (lpString=".xls") returned 4
	[0169.383] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.522] lstrlenW (lpString=".xlsx") returned 5
	[0169.522] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.522] lstrlenW (lpString=".ppt") returned 4
	[0169.522] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.522] lstrlenW (lpString=".zip") returned 4
	[0169.522] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.522] lstrlenW (lpString=".rar") returned 4
	[0169.522] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.522] lstrlenW (lpString=".bz2") returned 4
	[0169.522] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.522] lstrlenW (lpString=".7z") returned 3
	[0169.523] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.523] lstrlenW (lpString=".dbf") returned 4
	[0169.523] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.523] lstrlenW (lpString=".1cd") returned 4
	[0169.523] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0169.523] lstrlenW (lpString=".jpg") returned 4
	[0169.523] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.523] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.523] lstrlenW (lpString="VCTRN_01.MID") returned 12
	[0169.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.686] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=4961) returned 1
	[0169.686] CloseHandle (hObject=0x55c) returned 1
	[0169.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220
	[0169.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.687] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.687] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.688] GetLastError () returned 0x0
	[0169.688] ReadFile (in: hFile=0x55c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x1361, lpOverlapped=0x0) returned 1
	[0169.690] WriteFile (in: hFile=0x534, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x1370, lpOverlapped=0x0) returned 1
	[0169.691] ReadFile (in: hFile=0x55c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.691] WriteFile (in: hFile=0x534, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.691] SetEndOfFile (hFile=0x534) returned 1
	[0169.691] CloseHandle (hObject=0x534) returned 1
	[0169.691] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.691] SetEndOfFile (hFile=0x55c) returned 1
	[0169.694] CloseHandle (hObject=0x55c) returned 1
	[0169.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1
	[0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.695] lstrlenW (lpString=".doc") returned 4
	[0169.695] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.695] lstrlenW (lpString=".docx") returned 5
	[0169.695] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.695] lstrlenW (lpString=".pdf") returned 4
	[0169.695] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.695] lstrlenW (lpString=".xls") returned 4
	[0169.695] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.695] lstrlenW (lpString=".xlsx") returned 5
	[0169.695] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.695] lstrlenW (lpString=".ppt") returned 4
	[0169.695] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.695] lstrlenW (lpString=".zip") returned 4
	[0169.695] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.695] lstrlenW (lpString=".rar") returned 4
	[0169.696] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.696] lstrlenW (lpString=".bz2") returned 4
	[0169.696] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.696] lstrlenW (lpString=".7z") returned 3
	[0169.696] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.696] lstrlenW (lpString=".dbf") returned 4
	[0169.696] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.696] lstrlenW (lpString=".1cd") returned 4
	[0169.696] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.696] lstrlenW (lpString=".jpg") returned 4
	[0169.696] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.696] lstrlenW (lpString=".doc") returned 4
	[0169.696] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.696] lstrlenW (lpString=".docx") returned 5
	[0169.696] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.696] lstrlenW (lpString=".pdf") returned 4
	[0169.696] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.696] lstrlenW (lpString=".xls") returned 4
	[0169.697] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.697] lstrlenW (lpString=".xlsx") returned 5
	[0169.697] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.697] lstrlenW (lpString=".ppt") returned 4
	[0169.697] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.697] lstrlenW (lpString=".zip") returned 4
	[0169.697] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.697] lstrlenW (lpString=".rar") returned 4
	[0169.697] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.697] lstrlenW (lpString=".bz2") returned 4
	[0169.697] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.697] lstrlenW (lpString=".7z") returned 3
	[0169.697] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.697] lstrlenW (lpString=".dbf") returned 4
	[0169.697] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.697] lstrlenW (lpString=".1cd") returned 4
	[0169.697] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0169.697] lstrlenW (lpString=".jpg") returned 4
	[0169.697] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.697] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.698] lstrlenW (lpString="WNTER_01.MID") returned 12
	[0169.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.699] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=6915) returned 1
	[0169.699] CloseHandle (hObject=0x55c) returned 1
	[0169.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220
	[0169.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.700] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.700] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.701] GetLastError () returned 0x0
	[0169.701] ReadFile (in: hFile=0x55c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x1b03, lpOverlapped=0x0) returned 1
	[0169.705] WriteFile (in: hFile=0x534, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x1b10, lpOverlapped=0x0) returned 1
	[0169.706] ReadFile (in: hFile=0x55c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.706] WriteFile (in: hFile=0x534, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.706] SetEndOfFile (hFile=0x534) returned 1
	[0169.707] CloseHandle (hObject=0x534) returned 1
	[0169.707] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.707] SetEndOfFile (hFile=0x55c) returned 1
	[0169.710] CloseHandle (hObject=0x55c) returned 1
	[0169.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1
	[0169.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.711] lstrlenW (lpString=".doc") returned 4
	[0169.711] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.711] lstrlenW (lpString=".docx") returned 5
	[0169.711] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.711] lstrlenW (lpString=".pdf") returned 4
	[0169.711] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.711] lstrlenW (lpString=".xls") returned 4
	[0169.711] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.711] lstrlenW (lpString=".xlsx") returned 5
	[0169.711] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.711] lstrlenW (lpString=".ppt") returned 4
	[0169.711] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.712] lstrlenW (lpString=".zip") returned 4
	[0169.712] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.712] lstrlenW (lpString=".rar") returned 4
	[0169.712] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.712] lstrlenW (lpString=".bz2") returned 4
	[0169.712] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.712] lstrlenW (lpString=".7z") returned 3
	[0169.712] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.712] lstrlenW (lpString=".dbf") returned 4
	[0169.712] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.712] lstrlenW (lpString=".1cd") returned 4
	[0169.712] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.712] lstrlenW (lpString=".jpg") returned 4
	[0169.712] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.712] lstrlenW (lpString=".doc") returned 4
	[0169.712] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.712] lstrlenW (lpString=".docx") returned 5
	[0169.712] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.712] lstrlenW (lpString=".pdf") returned 4
	[0169.712] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.712] lstrlenW (lpString=".xls") returned 4
	[0169.713] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.713] lstrlenW (lpString=".xlsx") returned 5
	[0169.713] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.713] lstrlenW (lpString=".ppt") returned 4
	[0169.713] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.713] lstrlenW (lpString=".zip") returned 4
	[0169.713] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.713] lstrlenW (lpString=".rar") returned 4
	[0169.713] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.713] lstrlenW (lpString=".bz2") returned 4
	[0169.713] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.713] lstrlenW (lpString=".7z") returned 3
	[0169.713] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.713] lstrlenW (lpString=".dbf") returned 4
	[0169.713] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.713] lstrlenW (lpString=".1cd") returned 4
	[0169.713] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0169.713] lstrlenW (lpString=".jpg") returned 4
	[0169.713] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.714] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0169.714] lstrlenW (lpString="Banded Edge.eftx") returned 16
	[0169.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.717] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=47851) returned 1
	[0169.717] CloseHandle (hObject=0x55c) returned 1
	[0169.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220
	[0169.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.718] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.718] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.720] GetLastError () returned 0x0
	[0169.720] ReadFile (in: hFile=0x55c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xbaeb, lpOverlapped=0x0) returned 1
	[0169.723] WriteFile (in: hFile=0x534, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xbaf0, lpOverlapped=0x0) returned 1
	[0169.849] ReadFile (in: hFile=0x55c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.849] WriteFile (in: hFile=0x534, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xf4, lpOverlapped=0x0) returned 1
	[0169.849] SetEndOfFile (hFile=0x534) returned 1
	[0169.849] CloseHandle (hObject=0x534) returned 1
	[0169.850] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.850] SetEndOfFile (hFile=0x55c) returned 1
	[0169.854] CloseHandle (hObject=0x55c) returned 1
	[0169.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1
	[0169.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.855] lstrlenW (lpString=".doc") returned 4
	[0169.855] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0169.855] lstrlenW (lpString=".docx") returned 5
	[0169.855] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0169.855] lstrlenW (lpString=".pdf") returned 4
	[0169.855] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0169.855] lstrlenW (lpString=".xls") returned 4
	[0169.855] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0169.855] lstrlenW (lpString=".xlsx") returned 5
	[0169.856] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0169.856] lstrlenW (lpString=".ppt") returned 4
	[0169.856] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0169.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.856] lstrlenW (lpString=".zip") returned 4
	[0169.856] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0169.856] lstrlenW (lpString=".rar") returned 4
	[0169.856] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0169.856] lstrlenW (lpString=".bz2") returned 4
	[0169.856] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0169.856] lstrlenW (lpString=".7z") returned 3
	[0169.856] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0169.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.856] lstrlenW (lpString=".dbf") returned 4
	[0169.856] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0169.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.856] lstrlenW (lpString=".1cd") returned 4
	[0169.856] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0169.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.856] lstrlenW (lpString=".jpg") returned 4
	[0169.856] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0169.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.857] lstrlenW (lpString=".doc") returned 4
	[0169.857] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0169.857] lstrlenW (lpString=".docx") returned 5
	[0169.857] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0169.857] lstrlenW (lpString=".pdf") returned 4
	[0169.857] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0169.857] lstrlenW (lpString=".xls") returned 4
	[0169.857] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0169.857] lstrlenW (lpString=".xlsx") returned 5
	[0169.857] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0169.857] lstrlenW (lpString=".ppt") returned 4
	[0169.857] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0169.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.857] lstrlenW (lpString=".zip") returned 4
	[0169.857] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0169.857] lstrlenW (lpString=".rar") returned 4
	[0169.857] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0169.857] lstrlenW (lpString=".bz2") returned 4
	[0169.857] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0169.857] lstrlenW (lpString=".7z") returned 3
	[0169.857] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0169.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.857] lstrlenW (lpString=".dbf") returned 4
	[0169.857] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0169.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.857] lstrlenW (lpString=".1cd") returned 4
	[0169.858] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0169.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0169.858] lstrlenW (lpString=".jpg") returned 4
	[0169.858] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0169.858] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0169.858] lstrlenW (lpString="Extreme Shadow.eftx") returned 19
	[0169.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.859] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=340217) returned 1
	[0169.859] CloseHandle (hObject=0x55c) returned 1
	[0169.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220
	[0169.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.860] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.860] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.862] GetLastError () returned 0x0
	[0169.862] ReadFile (in: hFile=0x55c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x530f9, lpOverlapped=0x0) returned 1
	[0169.875] WriteFile (in: hFile=0x534, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x53100, lpOverlapped=0x0) returned 1
	[0169.882] ReadFile (in: hFile=0x55c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.882] WriteFile (in: hFile=0x534, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xfa, lpOverlapped=0x0) returned 1
	[0169.882] SetEndOfFile (hFile=0x534) returned 1
	[0169.882] CloseHandle (hObject=0x534) returned 1
	[0169.882] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.882] SetEndOfFile (hFile=0x55c) returned 1
	[0170.031] CloseHandle (hObject=0x55c) returned 1
	[0170.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1
	[0170.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.499] lstrlenW (lpString=".doc") returned 4
	[0170.499] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.499] lstrlenW (lpString=".docx") returned 5
	[0170.499] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.499] lstrlenW (lpString=".pdf") returned 4
	[0170.500] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.500] lstrlenW (lpString=".xls") returned 4
	[0170.500] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.500] lstrlenW (lpString=".xlsx") returned 5
	[0170.500] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.500] lstrlenW (lpString=".ppt") returned 4
	[0170.500] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.500] lstrlenW (lpString=".zip") returned 4
	[0170.500] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.500] lstrlenW (lpString=".rar") returned 4
	[0170.500] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.500] lstrlenW (lpString=".bz2") returned 4
	[0170.500] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.500] lstrlenW (lpString=".7z") returned 3
	[0170.500] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.500] lstrlenW (lpString=".dbf") returned 4
	[0170.500] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.500] lstrlenW (lpString=".1cd") returned 4
	[0170.500] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.500] lstrlenW (lpString=".jpg") returned 4
	[0170.500] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.501] lstrlenW (lpString=".doc") returned 4
	[0170.501] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.501] lstrlenW (lpString=".docx") returned 5
	[0170.501] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.501] lstrlenW (lpString=".pdf") returned 4
	[0170.501] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.501] lstrlenW (lpString=".xls") returned 4
	[0170.501] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.501] lstrlenW (lpString=".xlsx") returned 5
	[0170.501] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.501] lstrlenW (lpString=".ppt") returned 4
	[0170.501] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.501] lstrlenW (lpString=".zip") returned 4
	[0170.501] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.501] lstrlenW (lpString=".rar") returned 4
	[0170.501] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.501] lstrlenW (lpString=".bz2") returned 4
	[0170.501] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.501] lstrlenW (lpString=".7z") returned 3
	[0170.501] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.501] lstrlenW (lpString=".dbf") returned 4
	[0170.501] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.501] lstrlenW (lpString=".1cd") returned 4
	[0170.501] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0170.501] lstrlenW (lpString=".jpg") returned 4
	[0170.502] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.502] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0170.502] lstrlenW (lpString="Inset.eftx") returned 10
	[0170.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0170.502] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=44971) returned 1
	[0170.502] CloseHandle (hObject=0x36c) returned 1
	[0170.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220
	[0170.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0170.503] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.503] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0170.504] GetLastError () returned 0x0
	[0170.504] ReadFile (in: hFile=0x36c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xafab, lpOverlapped=0x0) returned 1
	[0170.507] WriteFile (in: hFile=0x554, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xafb0, lpOverlapped=0x0) returned 1
	[0170.509] ReadFile (in: hFile=0x36c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.509] WriteFile (in: hFile=0x554, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xe8, lpOverlapped=0x0) returned 1
	[0170.509] SetEndOfFile (hFile=0x554) returned 1
	[0170.509] CloseHandle (hObject=0x554) returned 1
	[0170.509] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.509] SetEndOfFile (hFile=0x36c) returned 1
	[0170.513] CloseHandle (hObject=0x36c) returned 1
	[0170.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1
	[0170.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.514] lstrlenW (lpString=".doc") returned 4
	[0170.514] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.514] lstrlenW (lpString=".docx") returned 5
	[0170.514] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.514] lstrlenW (lpString=".pdf") returned 4
	[0170.514] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.514] lstrlenW (lpString=".xls") returned 4
	[0170.514] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.514] lstrlenW (lpString=".xlsx") returned 5
	[0170.514] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.514] lstrlenW (lpString=".ppt") returned 4
	[0170.514] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.514] lstrlenW (lpString=".zip") returned 4
	[0170.514] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.514] lstrlenW (lpString=".rar") returned 4
	[0170.514] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.514] lstrlenW (lpString=".bz2") returned 4
	[0170.514] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.514] lstrlenW (lpString=".7z") returned 3
	[0170.514] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.514] lstrlenW (lpString=".dbf") returned 4
	[0170.514] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.515] lstrlenW (lpString=".1cd") returned 4
	[0170.515] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.515] lstrlenW (lpString=".jpg") returned 4
	[0170.515] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.515] lstrlenW (lpString=".doc") returned 4
	[0170.515] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.515] lstrlenW (lpString=".docx") returned 5
	[0170.515] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.515] lstrlenW (lpString=".pdf") returned 4
	[0170.515] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.515] lstrlenW (lpString=".xls") returned 4
	[0170.515] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.515] lstrlenW (lpString=".xlsx") returned 5
	[0170.515] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.515] lstrlenW (lpString=".ppt") returned 4
	[0170.515] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.515] lstrlenW (lpString=".zip") returned 4
	[0170.515] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.515] lstrlenW (lpString=".rar") returned 4
	[0170.515] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.515] lstrlenW (lpString=".bz2") returned 4
	[0170.515] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.515] lstrlenW (lpString=".7z") returned 3
	[0170.516] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.516] lstrlenW (lpString=".dbf") returned 4
	[0170.516] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.516] lstrlenW (lpString=".1cd") returned 4
	[0170.516] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0170.516] lstrlenW (lpString=".jpg") returned 4
	[0170.516] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.516] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0170.516] lstrlenW (lpString="Milk Glass.eftx") returned 15
	[0170.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0170.517] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=46403) returned 1
	[0170.517] CloseHandle (hObject=0x36c) returned 1
	[0170.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220
	[0170.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0170.518] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.518] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0170.518] GetLastError () returned 0x0
	[0170.518] ReadFile (in: hFile=0x36c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xb543, lpOverlapped=0x0) returned 1
	[0170.521] WriteFile (in: hFile=0x554, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xb550, lpOverlapped=0x0) returned 1
	[0170.962] ReadFile (in: hFile=0x36c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.962] WriteFile (in: hFile=0x554, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xf2, lpOverlapped=0x0) returned 1
	[0170.962] SetEndOfFile (hFile=0x554) returned 1
	[0170.962] CloseHandle (hObject=0x554) returned 1
	[0170.962] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.963] SetEndOfFile (hFile=0x36c) returned 1
	[0170.966] CloseHandle (hObject=0x36c) returned 1
	[0170.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1
	[0171.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.225] lstrlenW (lpString=".doc") returned 4
	[0171.225] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.225] lstrlenW (lpString=".docx") returned 5
	[0171.225] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.225] lstrlenW (lpString=".pdf") returned 4
	[0171.225] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.225] lstrlenW (lpString=".xls") returned 4
	[0171.225] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.225] lstrlenW (lpString=".xlsx") returned 5
	[0171.226] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.226] lstrlenW (lpString=".ppt") returned 4
	[0171.226] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.226] lstrlenW (lpString=".zip") returned 4
	[0171.226] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.226] lstrlenW (lpString=".rar") returned 4
	[0171.226] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.226] lstrlenW (lpString=".bz2") returned 4
	[0171.226] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.226] lstrlenW (lpString=".7z") returned 3
	[0171.226] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.226] lstrlenW (lpString=".dbf") returned 4
	[0171.226] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.226] lstrlenW (lpString=".1cd") returned 4
	[0171.226] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.226] lstrlenW (lpString=".jpg") returned 4
	[0171.226] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.226] lstrlenW (lpString=".doc") returned 4
	[0171.226] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.226] lstrlenW (lpString=".docx") returned 5
	[0171.227] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.227] lstrlenW (lpString=".pdf") returned 4
	[0171.227] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.227] lstrlenW (lpString=".xls") returned 4
	[0171.227] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.227] lstrlenW (lpString=".xlsx") returned 5
	[0171.227] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.227] lstrlenW (lpString=".ppt") returned 4
	[0171.227] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.227] lstrlenW (lpString=".zip") returned 4
	[0171.227] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.227] lstrlenW (lpString=".rar") returned 4
	[0171.227] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.227] lstrlenW (lpString=".bz2") returned 4
	[0171.227] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.227] lstrlenW (lpString=".7z") returned 3
	[0171.227] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.227] lstrlenW (lpString=".dbf") returned 4
	[0171.227] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.227] lstrlenW (lpString=".1cd") returned 4
	[0171.227] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0171.227] lstrlenW (lpString=".jpg") returned 4
	[0171.227] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.228] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0171.228] lstrlenW (lpString="Top Shadow.eftx") returned 15
	[0171.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.229] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=56944) returned 1
	[0171.229] CloseHandle (hObject=0x36c) returned 1
	[0171.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220
	[0171.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.230] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.230] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0171.231] GetLastError () returned 0x0
	[0171.231] ReadFile (in: hFile=0x36c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xde70, lpOverlapped=0x0) returned 1
	[0171.234] WriteFile (in: hFile=0x554, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xde80, lpOverlapped=0x0) returned 1
	[0171.236] ReadFile (in: hFile=0x36c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.236] WriteFile (in: hFile=0x554, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xf2, lpOverlapped=0x0) returned 1
	[0171.236] SetEndOfFile (hFile=0x554) returned 1
	[0171.236] CloseHandle (hObject=0x554) returned 1
	[0171.236] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.236] SetEndOfFile (hFile=0x36c) returned 1
	[0171.266] CloseHandle (hObject=0x36c) returned 1
	[0171.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1
	[0171.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.268] lstrlenW (lpString=".doc") returned 4
	[0171.268] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.268] lstrlenW (lpString=".docx") returned 5
	[0171.268] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.268] lstrlenW (lpString=".pdf") returned 4
	[0171.268] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.268] lstrlenW (lpString=".xls") returned 4
	[0171.268] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.268] lstrlenW (lpString=".xlsx") returned 5
	[0171.268] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.269] lstrlenW (lpString=".ppt") returned 4
	[0171.269] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.269] lstrlenW (lpString=".zip") returned 4
	[0171.269] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.269] lstrlenW (lpString=".rar") returned 4
	[0171.269] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.269] lstrlenW (lpString=".bz2") returned 4
	[0171.269] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.269] lstrlenW (lpString=".7z") returned 3
	[0171.269] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.269] lstrlenW (lpString=".dbf") returned 4
	[0171.269] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.269] lstrlenW (lpString=".1cd") returned 4
	[0171.269] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.269] lstrlenW (lpString=".jpg") returned 4
	[0171.269] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.269] lstrlenW (lpString=".doc") returned 4
	[0171.269] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.269] lstrlenW (lpString=".docx") returned 5
	[0171.269] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.270] lstrlenW (lpString=".pdf") returned 4
	[0171.270] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.270] lstrlenW (lpString=".xls") returned 4
	[0171.270] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.270] lstrlenW (lpString=".xlsx") returned 5
	[0171.270] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.270] lstrlenW (lpString=".ppt") returned 4
	[0171.270] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.270] lstrlenW (lpString=".zip") returned 4
	[0171.270] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.270] lstrlenW (lpString=".rar") returned 4
	[0171.270] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.270] lstrlenW (lpString=".bz2") returned 4
	[0171.270] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.270] lstrlenW (lpString=".7z") returned 3
	[0171.270] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.270] lstrlenW (lpString=".dbf") returned 4
	[0171.270] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.270] lstrlenW (lpString=".1cd") returned 4
	[0171.270] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0171.270] lstrlenW (lpString=".jpg") returned 4
	[0171.270] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.271] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.271] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31
	[0171.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0171.275] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=18624) returned 1
	[0171.275] CloseHandle (hObject=0x36c) returned 1
	[0171.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220
	[0171.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.276] lstrlenW (lpString=".doc") returned 4
	[0171.276] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.276] lstrlenW (lpString=".docx") returned 5
	[0171.276] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0171.276] lstrlenW (lpString=".pdf") returned 4
	[0171.276] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.276] lstrlenW (lpString=".xls") returned 4
	[0171.276] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.276] lstrlenW (lpString=".xlsx") returned 5
	[0171.276] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0171.276] lstrlenW (lpString=".ppt") returned 4
	[0171.276] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.276] lstrlenW (lpString=".zip") returned 4
	[0171.276] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.276] lstrlenW (lpString=".rar") returned 4
	[0171.276] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.276] lstrlenW (lpString=".bz2") returned 4
	[0171.276] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.277] lstrlenW (lpString=".7z") returned 3
	[0171.277] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.277] lstrlenW (lpString=".dbf") returned 4
	[0171.277] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.277] lstrlenW (lpString=".1cd") returned 4
	[0171.277] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.277] lstrlenW (lpString=".jpg") returned 4
	[0171.277] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.277] lstrlenW (lpString=".doc") returned 4
	[0171.277] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.277] lstrlenW (lpString=".docx") returned 5
	[0171.277] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0171.277] lstrlenW (lpString=".pdf") returned 4
	[0171.277] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.277] lstrlenW (lpString=".xls") returned 4
	[0171.277] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.277] lstrlenW (lpString=".xlsx") returned 5
	[0171.277] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0171.277] lstrlenW (lpString=".ppt") returned 4
	[0171.277] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.277] lstrlenW (lpString=".zip") returned 4
	[0171.277] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.278] lstrlenW (lpString=".rar") returned 4
	[0171.278] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.278] lstrlenW (lpString=".bz2") returned 4
	[0171.278] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.278] lstrlenW (lpString=".7z") returned 3
	[0171.278] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.278] lstrlenW (lpString=".dbf") returned 4
	[0171.278] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.278] lstrlenW (lpString=".1cd") returned 4
	[0171.278] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0171.278] lstrlenW (lpString=".jpg") returned 4
	[0171.278] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.566] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.566] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31
	[0171.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.567] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=18624) returned 1
	[0171.567] CloseHandle (hObject=0x53c) returned 1
	[0171.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220
	[0171.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.568] lstrlenW (lpString=".doc") returned 4
	[0171.568] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.568] lstrlenW (lpString=".docx") returned 5
	[0171.568] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0171.568] lstrlenW (lpString=".pdf") returned 4
	[0171.568] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.568] lstrlenW (lpString=".xls") returned 4
	[0171.568] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.568] lstrlenW (lpString=".xlsx") returned 5
	[0171.568] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0171.568] lstrlenW (lpString=".ppt") returned 4
	[0171.568] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.568] lstrlenW (lpString=".zip") returned 4
	[0171.568] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.568] lstrlenW (lpString=".rar") returned 4
	[0171.568] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.568] lstrlenW (lpString=".bz2") returned 4
	[0171.568] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.568] lstrlenW (lpString=".7z") returned 3
	[0171.568] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.569] lstrlenW (lpString=".dbf") returned 4
	[0171.569] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.569] lstrlenW (lpString=".1cd") returned 4
	[0171.569] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.569] lstrlenW (lpString=".jpg") returned 4
	[0171.569] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.569] lstrlenW (lpString=".doc") returned 4
	[0171.569] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.569] lstrlenW (lpString=".docx") returned 5
	[0171.569] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0171.569] lstrlenW (lpString=".pdf") returned 4
	[0171.569] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.569] lstrlenW (lpString=".xls") returned 4
	[0171.569] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.569] lstrlenW (lpString=".xlsx") returned 5
	[0171.569] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0171.569] lstrlenW (lpString=".ppt") returned 4
	[0171.569] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.569] lstrlenW (lpString=".zip") returned 4
	[0171.569] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.569] lstrlenW (lpString=".rar") returned 4
	[0171.569] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.570] lstrlenW (lpString=".bz2") returned 4
	[0171.570] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.570] lstrlenW (lpString=".7z") returned 3
	[0171.570] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.570] lstrlenW (lpString=".dbf") returned 4
	[0171.574] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.574] lstrlenW (lpString=".1cd") returned 4
	[0171.574] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0171.574] lstrlenW (lpString=".jpg") returned 4
	[0171.574] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.574] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.574] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39
	[0171.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.576] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=21184) returned 1
	[0171.576] CloseHandle (hObject=0x53c) returned 1
	[0171.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220
	[0171.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.578] lstrlenW (lpString=".doc") returned 4
	[0171.578] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.578] lstrlenW (lpString=".docx") returned 5
	[0171.578] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0171.578] lstrlenW (lpString=".pdf") returned 4
	[0171.578] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.578] lstrlenW (lpString=".xls") returned 4
	[0171.578] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.578] lstrlenW (lpString=".xlsx") returned 5
	[0171.578] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0171.578] lstrlenW (lpString=".ppt") returned 4
	[0171.579] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.579] lstrlenW (lpString=".zip") returned 4
	[0171.579] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.579] lstrlenW (lpString=".rar") returned 4
	[0171.579] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.579] lstrlenW (lpString=".bz2") returned 4
	[0171.579] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.579] lstrlenW (lpString=".7z") returned 3
	[0171.579] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.579] lstrlenW (lpString=".dbf") returned 4
	[0171.579] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.579] lstrlenW (lpString=".1cd") returned 4
	[0171.579] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.579] lstrlenW (lpString=".jpg") returned 4
	[0171.579] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.579] lstrlenW (lpString=".doc") returned 4
	[0171.579] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.579] lstrlenW (lpString=".docx") returned 5
	[0171.579] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0171.579] lstrlenW (lpString=".pdf") returned 4
	[0171.580] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.580] lstrlenW (lpString=".xls") returned 4
	[0171.580] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.580] lstrlenW (lpString=".xlsx") returned 5
	[0171.580] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0171.580] lstrlenW (lpString=".ppt") returned 4
	[0171.580] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.580] lstrlenW (lpString=".zip") returned 4
	[0171.580] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.580] lstrlenW (lpString=".rar") returned 4
	[0171.580] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.580] lstrlenW (lpString=".bz2") returned 4
	[0171.580] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.580] lstrlenW (lpString=".7z") returned 3
	[0171.580] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.580] lstrlenW (lpString=".dbf") returned 4
	[0171.580] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.580] lstrlenW (lpString=".1cd") returned 4
	[0171.580] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0171.580] lstrlenW (lpString=".jpg") returned 4
	[0171.580] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.581] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.581] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41
	[0171.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.581] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=19136) returned 1
	[0171.581] CloseHandle (hObject=0x53c) returned 1
	[0171.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220
	[0171.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.582] lstrlenW (lpString=".doc") returned 4
	[0171.582] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.582] lstrlenW (lpString=".docx") returned 5
	[0171.582] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0171.582] lstrlenW (lpString=".pdf") returned 4
	[0171.582] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.582] lstrlenW (lpString=".xls") returned 4
	[0171.582] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.582] lstrlenW (lpString=".xlsx") returned 5
	[0171.582] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0171.582] lstrlenW (lpString=".ppt") returned 4
	[0171.582] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.582] lstrlenW (lpString=".zip") returned 4
	[0171.582] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.582] lstrlenW (lpString=".rar") returned 4
	[0171.582] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.582] lstrlenW (lpString=".bz2") returned 4
	[0171.583] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.583] lstrlenW (lpString=".7z") returned 3
	[0171.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.583] lstrlenW (lpString=".dbf") returned 4
	[0171.583] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.583] lstrlenW (lpString=".1cd") returned 4
	[0171.583] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.583] lstrlenW (lpString=".jpg") returned 4
	[0171.583] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.583] lstrlenW (lpString=".doc") returned 4
	[0171.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.583] lstrlenW (lpString=".docx") returned 5
	[0171.583] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0171.583] lstrlenW (lpString=".pdf") returned 4
	[0171.583] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.583] lstrlenW (lpString=".xls") returned 4
	[0171.583] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.583] lstrlenW (lpString=".xlsx") returned 5
	[0171.583] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0171.584] lstrlenW (lpString=".ppt") returned 4
	[0171.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.584] lstrlenW (lpString=".zip") returned 4
	[0171.584] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.584] lstrlenW (lpString=".rar") returned 4
	[0171.584] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.584] lstrlenW (lpString=".bz2") returned 4
	[0171.584] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.584] lstrlenW (lpString=".7z") returned 3
	[0171.584] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.584] lstrlenW (lpString=".dbf") returned 4
	[0171.584] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.584] lstrlenW (lpString=".1cd") returned 4
	[0171.584] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0171.584] lstrlenW (lpString=".jpg") returned 4
	[0171.584] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.584] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.584] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32
	[0171.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.586] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=19136) returned 1
	[0171.586] CloseHandle (hObject=0x53c) returned 1
	[0171.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220
	[0171.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.586] lstrlenW (lpString=".doc") returned 4
	[0171.586] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.586] lstrlenW (lpString=".docx") returned 5
	[0171.586] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0171.586] lstrlenW (lpString=".pdf") returned 4
	[0171.586] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.586] lstrlenW (lpString=".xls") returned 4
	[0171.587] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.587] lstrlenW (lpString=".xlsx") returned 5
	[0171.587] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0171.587] lstrlenW (lpString=".ppt") returned 4
	[0171.587] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.587] lstrlenW (lpString=".zip") returned 4
	[0171.587] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.587] lstrlenW (lpString=".rar") returned 4
	[0171.587] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.587] lstrlenW (lpString=".bz2") returned 4
	[0171.587] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.587] lstrlenW (lpString=".7z") returned 3
	[0171.587] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.587] lstrlenW (lpString=".dbf") returned 4
	[0171.587] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.587] lstrlenW (lpString=".1cd") returned 4
	[0171.587] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.587] lstrlenW (lpString=".jpg") returned 4
	[0171.587] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.587] lstrlenW (lpString=".doc") returned 4
	[0171.587] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.587] lstrlenW (lpString=".docx") returned 5
	[0171.588] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0171.588] lstrlenW (lpString=".pdf") returned 4
	[0171.588] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.588] lstrlenW (lpString=".xls") returned 4
	[0171.588] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.588] lstrlenW (lpString=".xlsx") returned 5
	[0171.588] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0171.588] lstrlenW (lpString=".ppt") returned 4
	[0171.588] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.588] lstrlenW (lpString=".zip") returned 4
	[0171.588] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.588] lstrlenW (lpString=".rar") returned 4
	[0171.588] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.588] lstrlenW (lpString=".bz2") returned 4
	[0171.588] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.588] lstrlenW (lpString=".7z") returned 3
	[0171.588] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.588] lstrlenW (lpString=".dbf") returned 4
	[0171.588] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.588] lstrlenW (lpString=".1cd") returned 4
	[0171.588] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0171.588] lstrlenW (lpString=".jpg") returned 4
	[0171.588] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.589] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.589] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35
	[0171.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.590] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=18624) returned 1
	[0171.590] CloseHandle (hObject=0x53c) returned 1
	[0171.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220
	[0171.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0171.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0171.590] lstrlenW (lpString=".doc") returned 4
	[0171.590] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.590] lstrlenW (lpString=".docx") returned 5
	[0171.590] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0171.590] lstrlenW (lpString=".pdf") returned 4
	[0171.590] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.590] lstrlenW (lpString=".xls") returned 4
	[0171.590] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.590] lstrlenW (lpString=".xlsx") returned 5
	[0171.590] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0171.590] lstrlenW (lpString=".ppt") returned 4
	[0171.591] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0171.591] lstrlenW (lpString=".zip") returned 4
	[0171.591] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.591] lstrlenW (lpString=".rar") returned 4
	[0171.591] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.591] lstrlenW (lpString=".bz2") returned 4
	[0171.591] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.591] lstrlenW (lpString=".7z") returned 3
	[0171.591] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0171.591] lstrlenW (lpString=".dbf") returned 4
	[0171.591] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0171.609] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.609] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.729] GetLastError () returned 0x0
	[0171.729] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x221, lpOverlapped=0x0) returned 1
	[0171.730] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x230, lpOverlapped=0x0) returned 1
	[0171.731] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.731] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0171.731] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.731] CloseHandle (hObject=0x4e4) returned 1
	[0171.731] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.731] SetEndOfFile (hFile=0x53c) returned 1
	[0171.736] CloseHandle (hObject=0x53c) returned 1
	[0171.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1
	[0171.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.737] lstrlenW (lpString=".doc") returned 4
	[0171.737] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0171.737] lstrlenW (lpString=".docx") returned 5
	[0171.737] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0171.737] lstrlenW (lpString=".pdf") returned 4
	[0171.737] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0171.737] lstrlenW (lpString=".xls") returned 4
	[0171.737] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0171.737] lstrlenW (lpString=".xlsx") returned 5
	[0171.737] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0171.737] lstrlenW (lpString=".ppt") returned 4
	[0171.737] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0171.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.737] lstrlenW (lpString=".zip") returned 4
	[0171.737] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0171.737] lstrlenW (lpString=".rar") returned 4
	[0171.737] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0171.737] lstrlenW (lpString=".bz2") returned 4
	[0171.737] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0171.737] lstrlenW (lpString=".7z") returned 3
	[0171.737] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0171.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.738] lstrlenW (lpString=".dbf") returned 4
	[0171.738] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0171.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.738] lstrlenW (lpString=".1cd") returned 4
	[0171.738] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0171.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.738] lstrlenW (lpString=".jpg") returned 4
	[0171.738] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0171.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.738] lstrlenW (lpString=".doc") returned 4
	[0171.738] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0171.738] lstrlenW (lpString=".docx") returned 5
	[0171.738] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0171.738] lstrlenW (lpString=".pdf") returned 4
	[0171.738] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0171.738] lstrlenW (lpString=".xls") returned 4
	[0171.738] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0171.738] lstrlenW (lpString=".xlsx") returned 5
	[0171.738] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0171.738] lstrlenW (lpString=".ppt") returned 4
	[0171.738] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0171.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.738] lstrlenW (lpString=".zip") returned 4
	[0171.738] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0171.739] lstrlenW (lpString=".rar") returned 4
	[0171.739] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0171.739] lstrlenW (lpString=".bz2") returned 4
	[0171.739] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0171.739] lstrlenW (lpString=".7z") returned 3
	[0171.739] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0171.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.739] lstrlenW (lpString=".dbf") returned 4
	[0171.739] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0171.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.739] lstrlenW (lpString=".1cd") returned 4
	[0171.739] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0171.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0171.739] lstrlenW (lpString=".jpg") returned 4
	[0171.739] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0171.739] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.739] lstrlenW (lpString="AppVPackaging.dll") returned 17
	[0171.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.741] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=578264) returned 1
	[0171.741] CloseHandle (hObject=0x53c) returned 1
	[0171.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 0x220
	[0171.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.742] lstrlenW (lpString=".doc") returned 4
	[0171.742] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.742] lstrlenW (lpString=".docx") returned 5
	[0171.742] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0171.742] lstrlenW (lpString=".pdf") returned 4
	[0171.742] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.742] lstrlenW (lpString=".xls") returned 4
	[0171.742] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.742] lstrlenW (lpString=".xlsx") returned 5
	[0171.742] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0171.742] lstrlenW (lpString=".ppt") returned 4
	[0171.742] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.742] lstrlenW (lpString=".zip") returned 4
	[0171.742] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.742] lstrlenW (lpString=".rar") returned 4
	[0171.742] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.742] lstrlenW (lpString=".bz2") returned 4
	[0171.742] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.742] lstrlenW (lpString=".7z") returned 3
	[0171.742] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.743] lstrlenW (lpString=".dbf") returned 4
	[0171.743] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.743] lstrlenW (lpString=".1cd") returned 4
	[0171.743] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.743] lstrlenW (lpString=".jpg") returned 4
	[0171.743] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.743] lstrlenW (lpString=".doc") returned 4
	[0171.743] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.743] lstrlenW (lpString=".docx") returned 5
	[0171.743] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0171.743] lstrlenW (lpString=".pdf") returned 4
	[0171.743] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.743] lstrlenW (lpString=".xls") returned 4
	[0171.743] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.743] lstrlenW (lpString=".xlsx") returned 5
	[0171.743] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0171.743] lstrlenW (lpString=".ppt") returned 4
	[0171.743] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.743] lstrlenW (lpString=".zip") returned 4
	[0171.743] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.743] lstrlenW (lpString=".rar") returned 4
	[0171.744] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.744] lstrlenW (lpString=".bz2") returned 4
	[0171.744] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.744] lstrlenW (lpString=".7z") returned 3
	[0171.744] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.744] lstrlenW (lpString=".dbf") returned 4
	[0171.744] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.744] lstrlenW (lpString=".1cd") returned 4
	[0171.744] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0171.744] lstrlenW (lpString=".jpg") returned 4
	[0171.744] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.744] lstrcmpiW (lpString1=".manifest", lpString2=".money") returned -1
	[0171.744] lstrlenW (lpString="AppVPackaging.dll.manifest") returned 26
	[0171.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.745] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=707) returned 1
	[0171.745] CloseHandle (hObject=0x53c) returned 1
	[0171.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 0x220
	[0171.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.746] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.746] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.746] GetLastError () returned 0x0
	[0171.746] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2c3, lpOverlapped=0x0) returned 1
	[0171.748] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d0, lpOverlapped=0x0) returned 1
	[0171.749] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.749] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x108, lpOverlapped=0x0) returned 1
	[0171.749] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.749] CloseHandle (hObject=0x4e4) returned 1
	[0171.749] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.749] SetEndOfFile (hFile=0x53c) returned 1
	[0171.752] CloseHandle (hObject=0x53c) returned 1
	[0171.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1
	[0171.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.753] lstrlenW (lpString=".doc") returned 4
	[0171.753] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0171.753] lstrlenW (lpString=".docx") returned 5
	[0171.753] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0171.753] lstrlenW (lpString=".pdf") returned 4
	[0171.753] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0171.753] lstrlenW (lpString=".xls") returned 4
	[0171.753] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0171.753] lstrlenW (lpString=".xlsx") returned 5
	[0171.753] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0171.753] lstrlenW (lpString=".ppt") returned 4
	[0171.753] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0171.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.754] lstrlenW (lpString=".zip") returned 4
	[0171.754] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0171.754] lstrlenW (lpString=".rar") returned 4
	[0171.754] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0171.754] lstrlenW (lpString=".bz2") returned 4
	[0171.754] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0171.754] lstrlenW (lpString=".7z") returned 3
	[0171.754] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0171.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.754] lstrlenW (lpString=".dbf") returned 4
	[0171.754] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0171.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.754] lstrlenW (lpString=".1cd") returned 4
	[0171.754] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0171.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.754] lstrlenW (lpString=".jpg") returned 4
	[0171.754] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0171.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.754] lstrlenW (lpString=".doc") returned 4
	[0171.754] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0171.755] lstrlenW (lpString=".docx") returned 5
	[0171.755] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0171.755] lstrlenW (lpString=".pdf") returned 4
	[0171.755] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0171.755] lstrlenW (lpString=".xls") returned 4
	[0171.755] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0171.755] lstrlenW (lpString=".xlsx") returned 5
	[0171.755] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0171.755] lstrlenW (lpString=".ppt") returned 4
	[0171.755] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.755] lstrlenW (lpString=".zip") returned 4
	[0171.755] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0171.755] lstrlenW (lpString=".rar") returned 4
	[0171.755] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0171.755] lstrlenW (lpString=".bz2") returned 4
	[0171.755] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0171.755] lstrlenW (lpString=".7z") returned 3
	[0171.755] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.755] lstrlenW (lpString=".dbf") returned 4
	[0171.755] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.755] lstrlenW (lpString=".1cd") returned 4
	[0171.755] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0171.755] lstrlenW (lpString=".jpg") returned 4
	[0171.755] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0171.756] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.756] lstrlenW (lpString="AppVStreamMap.dll") returned 17
	[0171.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.757] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=194776) returned 1
	[0171.757] CloseHandle (hObject=0x53c) returned 1
	[0171.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 0x220
	[0171.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.757] lstrlenW (lpString=".doc") returned 4
	[0171.757] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.758] lstrlenW (lpString=".docx") returned 5
	[0171.758] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0171.758] lstrlenW (lpString=".pdf") returned 4
	[0171.758] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.758] lstrlenW (lpString=".xls") returned 4
	[0171.758] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.758] lstrlenW (lpString=".xlsx") returned 5
	[0171.758] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0171.758] lstrlenW (lpString=".ppt") returned 4
	[0171.758] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.758] lstrlenW (lpString=".zip") returned 4
	[0171.758] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.758] lstrlenW (lpString=".rar") returned 4
	[0171.758] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.758] lstrlenW (lpString=".bz2") returned 4
	[0171.758] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.758] lstrlenW (lpString=".7z") returned 3
	[0171.758] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.758] lstrlenW (lpString=".dbf") returned 4
	[0171.758] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.758] lstrlenW (lpString=".1cd") returned 4
	[0171.758] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.758] lstrlenW (lpString=".jpg") returned 4
	[0171.758] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.759] lstrlenW (lpString=".doc") returned 4
	[0171.759] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.759] lstrlenW (lpString=".docx") returned 5
	[0171.759] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0171.759] lstrlenW (lpString=".pdf") returned 4
	[0171.759] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.759] lstrlenW (lpString=".xls") returned 4
	[0171.759] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.759] lstrlenW (lpString=".xlsx") returned 5
	[0171.759] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0171.759] lstrlenW (lpString=".ppt") returned 4
	[0171.759] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.759] lstrlenW (lpString=".zip") returned 4
	[0171.759] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.759] lstrlenW (lpString=".rar") returned 4
	[0171.759] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.759] lstrlenW (lpString=".bz2") returned 4
	[0171.759] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.759] lstrlenW (lpString=".7z") returned 3
	[0171.759] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.759] lstrlenW (lpString=".dbf") returned 4
	[0171.759] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.759] lstrlenW (lpString=".1cd") returned 4
	[0171.760] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0171.760] lstrlenW (lpString=".jpg") returned 4
	[0171.760] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.760] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.760] lstrlenW (lpString="concrt140.dll") returned 13
	[0171.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0171.761] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=243520) returned 1
	[0171.761] CloseHandle (hObject=0x53c) returned 1
	[0171.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll")) returned 0x220
	[0171.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0171.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0171.761] lstrlenW (lpString=".doc") returned 4
	[0171.761] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.762] lstrlenW (lpString=".docx") returned 5
	[0171.762] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0171.762] lstrlenW (lpString=".pdf") returned 4
	[0171.762] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.762] lstrlenW (lpString=".xls") returned 4
	[0171.762] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.762] lstrlenW (lpString=".xlsx") returned 5
	[0171.762] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0171.762] lstrlenW (lpString=".ppt") returned 4
	[0171.762] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0171.762] lstrlenW (lpString=".zip") returned 4
	[0171.762] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.762] lstrlenW (lpString=".rar") returned 4
	[0171.762] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.762] lstrlenW (lpString=".bz2") returned 4
	[0171.762] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.762] lstrlenW (lpString=".7z") returned 3
	[0171.762] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0171.762] lstrlenW (lpString=".dbf") returned 4
	[0171.762] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0171.762] lstrlenW (lpString=".1cd") returned 4
	[0171.762] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0171.763] lstrlenW (lpString=".jpg") returned 4
	[0171.763] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0171.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0171.763] lstrlenW (lpString=".doc") returned 4
	[0171.763] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.763] lstrlenW (lpString=".docx") returned 5
	[0171.763] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0171.763] lstrlenW (lpString=".pdf") returned 4
	[0171.763] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.763] lstrlenW (lpString=".xls") returned 4
	[0171.763] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.763] lstrlenW (lpString=".xlsx") returned 5
	[0171.763] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0171.763] lstrlenW (lpString=".ppt") returned 4
	[0171.763] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0171.763] lstrlenW (lpString=".zip") returned 4
	[0172.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0172.027] lstrlenW (lpString=".rar") returned 4
	[0172.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0172.027] lstrlenW (lpString=".bz2") returned 4
	[0172.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0172.027] lstrlenW (lpString=".7z") returned 3
	[0172.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0172.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0172.027] lstrlenW (lpString=".dbf") returned 4
	[0172.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0172.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0172.028] lstrlenW (lpString=".1cd") returned 4
	[0172.028] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0172.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0172.028] lstrlenW (lpString=".jpg") returned 4
	[0172.028] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0172.028] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0172.028] lstrlenW (lpString="OneDriveSetup.exe") returned 17
	[0172.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0172.158] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=7217832) returned 1
	[0172.158] CloseHandle (hObject=0x370) returned 1
	[0172.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe")) returned 0x220
	[0172.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[admin@stex777.com].money")) returned 0
	[0172.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.442] lstrlenW (lpString=".doc") returned 4
	[0172.442] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0172.442] lstrlenW (lpString=".docx") returned 5
	[0172.442] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0172.442] lstrlenW (lpString=".pdf") returned 4
	[0172.442] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0172.442] lstrlenW (lpString=".xls") returned 4
	[0172.442] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0172.442] lstrlenW (lpString=".xlsx") returned 5
	[0172.442] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0172.442] lstrlenW (lpString=".ppt") returned 4
	[0172.442] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0172.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.442] lstrlenW (lpString=".zip") returned 4
	[0172.442] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0172.442] lstrlenW (lpString=".rar") returned 4
	[0172.442] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0172.442] lstrlenW (lpString=".bz2") returned 4
	[0172.442] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0172.442] lstrlenW (lpString=".7z") returned 3
	[0172.442] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0172.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.443] lstrlenW (lpString=".dbf") returned 4
	[0172.443] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0172.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.443] lstrlenW (lpString=".1cd") returned 4
	[0172.443] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0172.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.443] lstrlenW (lpString=".jpg") returned 4
	[0172.443] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0172.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.443] lstrlenW (lpString=".doc") returned 4
	[0172.443] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0172.443] lstrlenW (lpString=".docx") returned 5
	[0172.443] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0172.443] lstrlenW (lpString=".pdf") returned 4
	[0172.443] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0172.443] lstrlenW (lpString=".xls") returned 4
	[0172.443] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0172.443] lstrlenW (lpString=".xlsx") returned 5
	[0172.443] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0172.443] lstrlenW (lpString=".ppt") returned 4
	[0172.443] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0172.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.443] lstrlenW (lpString=".zip") returned 4
	[0172.443] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0172.443] lstrlenW (lpString=".rar") returned 4
	[0172.444] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0172.444] lstrlenW (lpString=".bz2") returned 4
	[0172.444] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0172.444] lstrlenW (lpString=".7z") returned 3
	[0172.444] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0172.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.444] lstrlenW (lpString=".dbf") returned 4
	[0172.444] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0172.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.444] lstrlenW (lpString=".1cd") returned 4
	[0172.444] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0172.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0172.444] lstrlenW (lpString=".jpg") returned 4
	[0172.444] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0172.444] lstrcmpiW (lpString1=".msu", lpString2=".money") returned 1
	[0172.444] lstrlenW (lpString="Windows6.1-KB2999226-x86.msu") returned 28
	[0172.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0172.446] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=621986) returned 1
	[0172.446] CloseHandle (hObject=0x4bc) returned 1
	[0172.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 0x220
	[0172.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0172.446] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.446] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0172.808] GetLastError () returned 0x0
	[0172.808] ReadFile (in: hFile=0x4bc, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x97da2, lpOverlapped=0x0) returned 1
	[0172.828] WriteFile (in: hFile=0x548, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x97db0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x97db0, lpOverlapped=0x0) returned 1
	[0172.838] ReadFile (in: hFile=0x4bc, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.838] WriteFile (in: hFile=0x548, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0172.839] SetEndOfFile (hFile=0x548) returned 1
	[0172.839] CloseHandle (hObject=0x548) returned 1
	[0172.839] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.839] SetEndOfFile (hFile=0x4bc) returned 1
	[0173.127] CloseHandle (hObject=0x4bc) returned 1
	[0173.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 1
	[0173.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.137] lstrlenW (lpString=".doc") returned 4
	[0173.137] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0173.137] lstrlenW (lpString=".docx") returned 5
	[0173.137] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0173.137] lstrlenW (lpString=".pdf") returned 4
	[0173.137] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0173.137] lstrlenW (lpString=".xls") returned 4
	[0173.137] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0173.137] lstrlenW (lpString=".xlsx") returned 5
	[0173.137] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0173.137] lstrlenW (lpString=".ppt") returned 4
	[0173.137] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0173.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.137] lstrlenW (lpString=".zip") returned 4
	[0173.137] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0173.137] lstrlenW (lpString=".rar") returned 4
	[0173.137] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0173.137] lstrlenW (lpString=".bz2") returned 4
	[0173.137] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0173.137] lstrlenW (lpString=".7z") returned 3
	[0173.137] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0173.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.137] lstrlenW (lpString=".dbf") returned 4
	[0173.137] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0173.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.138] lstrlenW (lpString=".1cd") returned 4
	[0173.138] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0173.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.138] lstrlenW (lpString=".jpg") returned 4
	[0173.138] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0173.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.138] lstrlenW (lpString=".doc") returned 4
	[0173.138] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0173.138] lstrlenW (lpString=".docx") returned 5
	[0173.138] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0173.138] lstrlenW (lpString=".pdf") returned 4
	[0173.138] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0173.138] lstrlenW (lpString=".xls") returned 4
	[0173.138] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0173.138] lstrlenW (lpString=".xlsx") returned 5
	[0173.138] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0173.138] lstrlenW (lpString=".ppt") returned 4
	[0173.138] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0173.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.138] lstrlenW (lpString=".zip") returned 4
	[0173.138] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0173.138] lstrlenW (lpString=".rar") returned 4
	[0173.138] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0173.138] lstrlenW (lpString=".bz2") returned 4
	[0173.138] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0173.138] lstrlenW (lpString=".7z") returned 3
	[0173.138] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0173.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.138] lstrlenW (lpString=".dbf") returned 4
	[0173.139] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0173.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.139] lstrlenW (lpString=".1cd") returned 4
	[0173.139] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0173.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0173.139] lstrlenW (lpString=".jpg") returned 4
	[0173.139] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0173.139] lstrcmpiW (lpString1=".msu", lpString2=".money") returned 1
	[0173.139] lstrlenW (lpString="Windows8.1-KB2999226-x64.msu") returned 28
	[0173.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0173.152] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=994589) returned 1
	[0173.152] CloseHandle (hObject=0x4f0) returned 1
	[0173.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 0x220
	[0173.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0173.152] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.152] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0173.153] GetLastError () returned 0x0
	[0173.153] ReadFile (in: hFile=0x4f0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xf2d1d, lpOverlapped=0x0) returned 1
	[0173.464] WriteFile (in: hFile=0x54c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xf2d20, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xf2d20, lpOverlapped=0x0) returned 1
	[0173.481] ReadFile (in: hFile=0x4f0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.481] WriteFile (in: hFile=0x54c, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0173.481] SetEndOfFile (hFile=0x54c) returned 1
	[0173.481] CloseHandle (hObject=0x54c) returned 1
	[0173.481] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.482] SetEndOfFile (hFile=0x4f0) returned 1
	[0173.853] CloseHandle (hObject=0x4f0) returned 1
	[0173.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 1
	[0174.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.370] lstrlenW (lpString=".doc") returned 4
	[0174.370] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0174.370] lstrlenW (lpString=".docx") returned 5
	[0174.370] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0174.370] lstrlenW (lpString=".pdf") returned 4
	[0174.370] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0174.370] lstrlenW (lpString=".xls") returned 4
	[0174.370] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0174.370] lstrlenW (lpString=".xlsx") returned 5
	[0174.370] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0174.370] lstrlenW (lpString=".ppt") returned 4
	[0174.370] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0174.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.370] lstrlenW (lpString=".zip") returned 4
	[0174.370] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0174.370] lstrlenW (lpString=".rar") returned 4
	[0174.370] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0174.370] lstrlenW (lpString=".bz2") returned 4
	[0174.370] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0174.370] lstrlenW (lpString=".7z") returned 3
	[0174.370] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0174.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.370] lstrlenW (lpString=".dbf") returned 4
	[0174.370] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0174.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.370] lstrlenW (lpString=".1cd") returned 4
	[0174.370] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0174.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.370] lstrlenW (lpString=".jpg") returned 4
	[0174.370] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0174.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.371] lstrlenW (lpString=".doc") returned 4
	[0174.371] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0174.371] lstrlenW (lpString=".docx") returned 5
	[0174.371] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0174.371] lstrlenW (lpString=".pdf") returned 4
	[0174.371] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0174.371] lstrlenW (lpString=".xls") returned 4
	[0174.371] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0174.371] lstrlenW (lpString=".xlsx") returned 5
	[0174.371] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0174.371] lstrlenW (lpString=".ppt") returned 4
	[0174.371] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0174.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.371] lstrlenW (lpString=".zip") returned 4
	[0174.371] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0174.371] lstrlenW (lpString=".rar") returned 4
	[0174.371] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0174.371] lstrlenW (lpString=".bz2") returned 4
	[0174.371] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0174.371] lstrlenW (lpString=".7z") returned 3
	[0174.371] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0174.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.371] lstrlenW (lpString=".dbf") returned 4
	[0174.371] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0174.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.371] lstrlenW (lpString=".1cd") returned 4
	[0174.371] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0174.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0174.371] lstrlenW (lpString=".jpg") returned 4
	[0174.371] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0174.372] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0174.372] lstrlenW (lpString="AccessR_OEM_Perp-ppd.xrm-ms") returned 27
	[0174.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0174.652] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=20780) returned 1
	[0174.652] CloseHandle (hObject=0x538) returned 1
	[0174.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0174.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0175.024] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.024] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0175.445] GetLastError () returned 0x0
	[0175.445] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x512c, lpOverlapped=0x0) returned 1
	[0175.447] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x5130, lpOverlapped=0x0) returned 1
	[0175.449] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.449] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0175.449] SetEndOfFile (hFile=0x3e8) returned 1
	[0175.449] CloseHandle (hObject=0x3e8) returned 1
	[0175.449] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.449] SetEndOfFile (hFile=0x514) returned 1
	[0175.452] CloseHandle (hObject=0x514) returned 1
	[0175.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 1
	[0175.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.455] lstrlenW (lpString=".doc") returned 4
	[0175.456] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.456] lstrlenW (lpString=".docx") returned 5
	[0175.456] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.456] lstrlenW (lpString=".pdf") returned 4
	[0175.456] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.456] lstrlenW (lpString=".xls") returned 4
	[0175.456] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.456] lstrlenW (lpString=".xlsx") returned 5
	[0175.456] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.456] lstrlenW (lpString=".ppt") returned 4
	[0175.456] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.456] lstrlenW (lpString=".zip") returned 4
	[0175.456] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.456] lstrlenW (lpString=".rar") returned 4
	[0175.456] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.456] lstrlenW (lpString=".bz2") returned 4
	[0175.456] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.456] lstrlenW (lpString=".7z") returned 3
	[0175.456] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.456] lstrlenW (lpString=".dbf") returned 4
	[0175.456] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.456] lstrlenW (lpString=".1cd") returned 4
	[0175.456] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.456] lstrlenW (lpString=".jpg") returned 4
	[0175.456] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.457] lstrlenW (lpString=".doc") returned 4
	[0175.457] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.457] lstrlenW (lpString=".docx") returned 5
	[0175.457] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.457] lstrlenW (lpString=".pdf") returned 4
	[0175.457] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.457] lstrlenW (lpString=".xls") returned 4
	[0175.457] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.457] lstrlenW (lpString=".xlsx") returned 5
	[0175.457] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.457] lstrlenW (lpString=".ppt") returned 4
	[0175.457] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.457] lstrlenW (lpString=".zip") returned 4
	[0175.457] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.457] lstrlenW (lpString=".rar") returned 4
	[0175.457] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.457] lstrlenW (lpString=".bz2") returned 4
	[0175.457] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.457] lstrlenW (lpString=".7z") returned 3
	[0175.457] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.457] lstrlenW (lpString=".dbf") returned 4
	[0175.457] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.457] lstrlenW (lpString=".1cd") returned 4
	[0175.457] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0175.457] lstrlenW (lpString=".jpg") returned 4
	[0175.457] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.458] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.458] lstrlenW (lpString="AccessVL_KMS_Client-ul.xrm-ms") returned 29
	[0175.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0175.459] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=9606) returned 1
	[0175.459] CloseHandle (hObject=0x514) returned 1
	[0175.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220
	[0175.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0175.459] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.459] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0175.460] GetLastError () returned 0x0
	[0175.460] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2586, lpOverlapped=0x0) returned 1
	[0175.462] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2590, lpOverlapped=0x0) returned 1
	[0175.463] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.463] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0175.463] SetEndOfFile (hFile=0x3e8) returned 1
	[0175.463] CloseHandle (hObject=0x3e8) returned 1
	[0175.463] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.463] SetEndOfFile (hFile=0x514) returned 1
	[0175.466] CloseHandle (hObject=0x514) returned 1
	[0175.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 1
	[0175.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.468] lstrlenW (lpString=".doc") returned 4
	[0175.468] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.468] lstrlenW (lpString=".docx") returned 5
	[0175.468] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.468] lstrlenW (lpString=".pdf") returned 4
	[0175.468] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.468] lstrlenW (lpString=".xls") returned 4
	[0175.468] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.468] lstrlenW (lpString=".xlsx") returned 5
	[0175.468] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.468] lstrlenW (lpString=".ppt") returned 4
	[0175.468] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.468] lstrlenW (lpString=".zip") returned 4
	[0175.468] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.468] lstrlenW (lpString=".rar") returned 4
	[0175.468] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.468] lstrlenW (lpString=".bz2") returned 4
	[0175.468] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.469] lstrlenW (lpString=".7z") returned 3
	[0175.469] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.469] lstrlenW (lpString=".dbf") returned 4
	[0175.469] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.469] lstrlenW (lpString=".1cd") returned 4
	[0175.469] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.469] lstrlenW (lpString=".jpg") returned 4
	[0175.469] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.469] lstrlenW (lpString=".doc") returned 4
	[0175.469] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.469] lstrlenW (lpString=".docx") returned 5
	[0175.469] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.469] lstrlenW (lpString=".pdf") returned 4
	[0175.469] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.469] lstrlenW (lpString=".xls") returned 4
	[0175.469] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.469] lstrlenW (lpString=".xlsx") returned 5
	[0175.469] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.469] lstrlenW (lpString=".ppt") returned 4
	[0175.469] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.469] lstrlenW (lpString=".zip") returned 4
	[0175.469] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.469] lstrlenW (lpString=".rar") returned 4
	[0175.469] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.469] lstrlenW (lpString=".bz2") returned 4
	[0175.470] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.470] lstrlenW (lpString=".7z") returned 3
	[0175.470] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.470] lstrlenW (lpString=".dbf") returned 4
	[0175.470] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.470] lstrlenW (lpString=".1cd") returned 4
	[0175.470] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0175.470] lstrlenW (lpString=".jpg") returned 4
	[0175.470] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.470] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.470] lstrlenW (lpString="AccessVL_MAK-pl.xrm-ms") returned 22
	[0175.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0175.471] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=10623) returned 1
	[0175.471] CloseHandle (hObject=0x514) returned 1
	[0175.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220
	[0175.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0175.471] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.472] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0175.472] GetLastError () returned 0x0
	[0175.472] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x297f, lpOverlapped=0x0) returned 1
	[0175.474] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2980, lpOverlapped=0x0) returned 1
	[0175.475] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.475] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x100, lpOverlapped=0x0) returned 1
	[0175.475] SetEndOfFile (hFile=0x3e8) returned 1
	[0175.475] CloseHandle (hObject=0x3e8) returned 1
	[0175.475] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.475] SetEndOfFile (hFile=0x514) returned 1
	[0175.478] CloseHandle (hObject=0x514) returned 1
	[0175.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 1
	[0175.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.719] lstrlenW (lpString=".doc") returned 4
	[0175.719] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.719] lstrlenW (lpString=".docx") returned 5
	[0175.719] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.719] lstrlenW (lpString=".pdf") returned 4
	[0175.719] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.719] lstrlenW (lpString=".xls") returned 4
	[0175.719] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.719] lstrlenW (lpString=".xlsx") returned 5
	[0175.719] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.719] lstrlenW (lpString=".ppt") returned 4
	[0175.719] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.719] lstrlenW (lpString=".zip") returned 4
	[0175.719] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.719] lstrlenW (lpString=".rar") returned 4
	[0175.719] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.719] lstrlenW (lpString=".bz2") returned 4
	[0175.719] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.719] lstrlenW (lpString=".7z") returned 3
	[0175.719] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.719] lstrlenW (lpString=".dbf") returned 4
	[0175.719] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.719] lstrlenW (lpString=".1cd") returned 4
	[0175.719] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.719] lstrlenW (lpString=".jpg") returned 4
	[0175.719] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.720] lstrlenW (lpString=".doc") returned 4
	[0175.720] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.720] lstrlenW (lpString=".docx") returned 5
	[0175.720] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.720] lstrlenW (lpString=".pdf") returned 4
	[0175.720] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.720] lstrlenW (lpString=".xls") returned 4
	[0175.720] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.720] lstrlenW (lpString=".xlsx") returned 5
	[0175.720] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.720] lstrlenW (lpString=".ppt") returned 4
	[0175.720] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.720] lstrlenW (lpString=".zip") returned 4
	[0175.720] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.720] lstrlenW (lpString=".rar") returned 4
	[0175.720] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.720] lstrlenW (lpString=".bz2") returned 4
	[0175.720] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.720] lstrlenW (lpString=".7z") returned 3
	[0175.720] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.720] lstrlenW (lpString=".dbf") returned 4
	[0175.720] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.720] lstrlenW (lpString=".1cd") returned 4
	[0175.720] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0175.721] lstrlenW (lpString=".jpg") returned 4
	[0175.721] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.721] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.721] lstrlenW (lpString="client-issuance-root.xrm-ms") returned 27
	[0175.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.793] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=3103) returned 1
	[0175.793] CloseHandle (hObject=0x324) returned 1
	[0175.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220
	[0175.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.794] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.794] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.797] GetLastError () returned 0x0
	[0175.797] ReadFile (in: hFile=0x324, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xc1f, lpOverlapped=0x0) returned 1
	[0175.799] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xc20, lpOverlapped=0x0) returned 1
	[0175.800] ReadFile (in: hFile=0x324, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.800] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0175.800] SetEndOfFile (hFile=0x538) returned 1
	[0175.800] CloseHandle (hObject=0x538) returned 1
	[0175.800] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.800] SetEndOfFile (hFile=0x324) returned 1
	[0175.803] CloseHandle (hObject=0x324) returned 1
	[0175.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 1
	[0175.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.804] lstrlenW (lpString=".doc") returned 4
	[0175.804] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.804] lstrlenW (lpString=".docx") returned 5
	[0175.804] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.804] lstrlenW (lpString=".pdf") returned 4
	[0175.804] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.804] lstrlenW (lpString=".xls") returned 4
	[0175.804] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.804] lstrlenW (lpString=".xlsx") returned 5
	[0175.804] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.804] lstrlenW (lpString=".ppt") returned 4
	[0175.805] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.805] lstrlenW (lpString=".zip") returned 4
	[0175.805] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.805] lstrlenW (lpString=".rar") returned 4
	[0175.805] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.805] lstrlenW (lpString=".bz2") returned 4
	[0175.805] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.805] lstrlenW (lpString=".7z") returned 3
	[0175.805] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.805] lstrlenW (lpString=".dbf") returned 4
	[0175.805] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.805] lstrlenW (lpString=".1cd") returned 4
	[0175.805] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.805] lstrlenW (lpString=".jpg") returned 4
	[0175.805] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.805] lstrlenW (lpString=".doc") returned 4
	[0175.805] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.805] lstrlenW (lpString=".docx") returned 5
	[0175.805] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.805] lstrlenW (lpString=".pdf") returned 4
	[0175.805] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.805] lstrlenW (lpString=".xls") returned 4
	[0175.805] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.805] lstrlenW (lpString=".xlsx") returned 5
	[0175.806] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.806] lstrlenW (lpString=".ppt") returned 4
	[0175.806] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.806] lstrlenW (lpString=".zip") returned 4
	[0175.806] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.806] lstrlenW (lpString=".rar") returned 4
	[0175.806] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.806] lstrlenW (lpString=".bz2") returned 4
	[0175.806] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.806] lstrlenW (lpString=".7z") returned 3
	[0175.806] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.806] lstrlenW (lpString=".dbf") returned 4
	[0175.806] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.806] lstrlenW (lpString=".1cd") returned 4
	[0175.806] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0175.806] lstrlenW (lpString=".jpg") returned 4
	[0175.806] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.806] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.806] lstrlenW (lpString="client-issuance-stil.xrm-ms") returned 27
	[0175.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.807] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=3380) returned 1
	[0175.807] CloseHandle (hObject=0x324) returned 1
	[0175.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220
	[0175.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.808] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.808] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.809] GetLastError () returned 0x0
	[0175.809] ReadFile (in: hFile=0x324, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0xd34, lpOverlapped=0x0) returned 1
	[0175.810] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xd40, lpOverlapped=0x0) returned 1
	[0175.811] ReadFile (in: hFile=0x324, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.811] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0175.811] SetEndOfFile (hFile=0x538) returned 1
	[0175.811] CloseHandle (hObject=0x538) returned 1
	[0175.812] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.812] SetEndOfFile (hFile=0x324) returned 1
	[0175.815] CloseHandle (hObject=0x324) returned 1
	[0175.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 1
	[0175.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.816] lstrlenW (lpString=".doc") returned 4
	[0175.816] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.816] lstrlenW (lpString=".docx") returned 5
	[0175.816] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.816] lstrlenW (lpString=".pdf") returned 4
	[0175.816] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.816] lstrlenW (lpString=".xls") returned 4
	[0175.816] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.816] lstrlenW (lpString=".xlsx") returned 5
	[0175.816] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.816] lstrlenW (lpString=".ppt") returned 4
	[0175.816] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.816] lstrlenW (lpString=".zip") returned 4
	[0175.816] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.816] lstrlenW (lpString=".rar") returned 4
	[0175.816] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.816] lstrlenW (lpString=".bz2") returned 4
	[0175.816] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.816] lstrlenW (lpString=".7z") returned 3
	[0175.816] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.816] lstrlenW (lpString=".dbf") returned 4
	[0175.816] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.816] lstrlenW (lpString=".1cd") returned 4
	[0175.816] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.817] lstrlenW (lpString=".jpg") returned 4
	[0175.817] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.817] lstrlenW (lpString=".doc") returned 4
	[0175.817] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.817] lstrlenW (lpString=".docx") returned 5
	[0175.817] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.817] lstrlenW (lpString=".pdf") returned 4
	[0175.817] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.817] lstrlenW (lpString=".xls") returned 4
	[0175.817] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.817] lstrlenW (lpString=".xlsx") returned 5
	[0175.817] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.817] lstrlenW (lpString=".ppt") returned 4
	[0175.817] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.817] lstrlenW (lpString=".zip") returned 4
	[0175.817] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.817] lstrlenW (lpString=".rar") returned 4
	[0175.817] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.817] lstrlenW (lpString=".bz2") returned 4
	[0175.817] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.817] lstrlenW (lpString=".7z") returned 3
	[0175.817] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.817] lstrlenW (lpString=".dbf") returned 4
	[0175.817] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.818] lstrlenW (lpString=".1cd") returned 4
	[0175.818] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0175.818] lstrlenW (lpString=".jpg") returned 4
	[0175.818] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.818] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.818] lstrlenW (lpString="client-issuance-ul-oob.xrm-ms") returned 29
	[0175.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.818] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=4392) returned 1
	[0175.818] CloseHandle (hObject=0x324) returned 1
	[0175.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220
	[0175.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.819] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.819] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.820] GetLastError () returned 0x0
	[0175.820] ReadFile (in: hFile=0x324, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x1128, lpOverlapped=0x0) returned 1
	[0175.821] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x1130, lpOverlapped=0x0) returned 1
	[0175.822] ReadFile (in: hFile=0x324, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.822] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0175.822] SetEndOfFile (hFile=0x538) returned 1
	[0175.822] CloseHandle (hObject=0x538) returned 1
	[0175.822] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.822] SetEndOfFile (hFile=0x324) returned 1
	[0175.825] CloseHandle (hObject=0x324) returned 1
	[0175.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 1
	[0175.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.826] lstrlenW (lpString=".doc") returned 4
	[0175.826] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.826] lstrlenW (lpString=".docx") returned 5
	[0175.826] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.826] lstrlenW (lpString=".pdf") returned 4
	[0175.826] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.826] lstrlenW (lpString=".xls") returned 4
	[0175.826] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.826] lstrlenW (lpString=".xlsx") returned 5
	[0175.826] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.826] lstrlenW (lpString=".ppt") returned 4
	[0175.826] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.826] lstrlenW (lpString=".zip") returned 4
	[0175.826] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.826] lstrlenW (lpString=".rar") returned 4
	[0175.826] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.826] lstrlenW (lpString=".bz2") returned 4
	[0175.826] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.826] lstrlenW (lpString=".7z") returned 3
	[0175.826] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.827] lstrlenW (lpString=".dbf") returned 4
	[0175.827] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.827] lstrlenW (lpString=".1cd") returned 4
	[0175.827] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.827] lstrlenW (lpString=".jpg") returned 4
	[0175.827] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.827] lstrlenW (lpString=".doc") returned 4
	[0175.827] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.827] lstrlenW (lpString=".docx") returned 5
	[0175.827] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.827] lstrlenW (lpString=".pdf") returned 4
	[0175.827] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.827] lstrlenW (lpString=".xls") returned 4
	[0175.827] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.827] lstrlenW (lpString=".xlsx") returned 5
	[0175.827] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.981] lstrlenW (lpString=".ppt") returned 4
	[0175.981] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.981] lstrlenW (lpString=".zip") returned 4
	[0175.981] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.981] lstrlenW (lpString=".rar") returned 4
	[0175.981] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.981] lstrlenW (lpString=".bz2") returned 4
	[0175.981] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.981] lstrlenW (lpString=".7z") returned 3
	[0175.981] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.981] lstrlenW (lpString=".dbf") returned 4
	[0175.981] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.981] lstrlenW (lpString=".1cd") returned 4
	[0175.981] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0175.981] lstrlenW (lpString=".jpg") returned 4
	[0175.981] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.981] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.981] lstrlenW (lpString="client-issuance-ul.xrm-ms") returned 25
	[0175.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.214] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=4208) returned 1
	[0176.214] CloseHandle (hObject=0x514) returned 1
	[0176.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220
	[0176.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.216] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.216] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0176.217] GetLastError () returned 0x0
	[0176.217] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x1070, lpOverlapped=0x0) returned 1
	[0176.219] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x1080, lpOverlapped=0x0) returned 1
	[0176.220] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.220] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x106, lpOverlapped=0x0) returned 1
	[0176.220] SetEndOfFile (hFile=0x538) returned 1
	[0176.220] CloseHandle (hObject=0x538) returned 1
	[0176.221] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.221] SetEndOfFile (hFile=0x514) returned 1
	[0176.223] CloseHandle (hObject=0x514) returned 1
	[0176.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 1
	[0176.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.224] lstrlenW (lpString=".doc") returned 4
	[0176.224] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.224] lstrlenW (lpString=".docx") returned 5
	[0176.224] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.224] lstrlenW (lpString=".pdf") returned 4
	[0176.224] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.224] lstrlenW (lpString=".xls") returned 4
	[0176.225] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.225] lstrlenW (lpString=".xlsx") returned 5
	[0176.225] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.225] lstrlenW (lpString=".ppt") returned 4
	[0176.225] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.225] lstrlenW (lpString=".zip") returned 4
	[0176.225] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.225] lstrlenW (lpString=".rar") returned 4
	[0176.225] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.225] lstrlenW (lpString=".bz2") returned 4
	[0176.225] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.225] lstrlenW (lpString=".7z") returned 3
	[0176.225] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.225] lstrlenW (lpString=".dbf") returned 4
	[0176.225] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.225] lstrlenW (lpString=".1cd") returned 4
	[0176.225] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.225] lstrlenW (lpString=".jpg") returned 4
	[0176.225] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.225] lstrlenW (lpString=".doc") returned 4
	[0176.225] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.225] lstrlenW (lpString=".docx") returned 5
	[0176.225] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.225] lstrlenW (lpString=".pdf") returned 4
	[0176.226] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.226] lstrlenW (lpString=".xls") returned 4
	[0176.226] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.226] lstrlenW (lpString=".xlsx") returned 5
	[0176.226] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.226] lstrlenW (lpString=".ppt") returned 4
	[0176.226] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.226] lstrlenW (lpString=".zip") returned 4
	[0176.226] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.226] lstrlenW (lpString=".rar") returned 4
	[0176.226] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.226] lstrlenW (lpString=".bz2") returned 4
	[0176.226] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.226] lstrlenW (lpString=".7z") returned 3
	[0176.226] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.226] lstrlenW (lpString=".dbf") returned 4
	[0176.226] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.226] lstrlenW (lpString=".1cd") returned 4
	[0176.226] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0176.226] lstrlenW (lpString=".jpg") returned 4
	[0176.226] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.226] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.227] lstrlenW (lpString="ExcelR_Grace-ul-oob.xrm-ms") returned 26
	[0176.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.227] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11589) returned 1
	[0176.227] CloseHandle (hObject=0x514) returned 1
	[0176.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220
	[0176.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.228] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.228] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0176.229] GetLastError () returned 0x0
	[0176.229] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d45, lpOverlapped=0x0) returned 1
	[0176.230] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0176.231] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.231] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x108, lpOverlapped=0x0) returned 1
	[0176.231] SetEndOfFile (hFile=0x538) returned 1
	[0176.232] CloseHandle (hObject=0x538) returned 1
	[0176.232] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.232] SetEndOfFile (hFile=0x514) returned 1
	[0176.235] CloseHandle (hObject=0x514) returned 1
	[0176.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 1
	[0176.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.236] lstrlenW (lpString=".doc") returned 4
	[0176.236] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.236] lstrlenW (lpString=".docx") returned 5
	[0176.236] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.236] lstrlenW (lpString=".pdf") returned 4
	[0176.236] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.236] lstrlenW (lpString=".xls") returned 4
	[0176.236] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.236] lstrlenW (lpString=".xlsx") returned 5
	[0176.236] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.236] lstrlenW (lpString=".ppt") returned 4
	[0176.236] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.236] lstrlenW (lpString=".zip") returned 4
	[0176.236] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.236] lstrlenW (lpString=".rar") returned 4
	[0176.237] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.237] lstrlenW (lpString=".bz2") returned 4
	[0176.237] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.237] lstrlenW (lpString=".7z") returned 3
	[0176.237] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.237] lstrlenW (lpString=".dbf") returned 4
	[0176.237] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.237] lstrlenW (lpString=".1cd") returned 4
	[0176.237] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.237] lstrlenW (lpString=".jpg") returned 4
	[0176.237] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.237] lstrlenW (lpString=".doc") returned 4
	[0176.237] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.237] lstrlenW (lpString=".docx") returned 5
	[0176.237] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.237] lstrlenW (lpString=".pdf") returned 4
	[0176.237] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.237] lstrlenW (lpString=".xls") returned 4
	[0176.237] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.237] lstrlenW (lpString=".xlsx") returned 5
	[0176.237] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.237] lstrlenW (lpString=".ppt") returned 4
	[0176.237] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.237] lstrlenW (lpString=".zip") returned 4
	[0176.238] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.238] lstrlenW (lpString=".rar") returned 4
	[0176.238] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.238] lstrlenW (lpString=".bz2") returned 4
	[0176.238] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.238] lstrlenW (lpString=".7z") returned 3
	[0176.238] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.238] lstrlenW (lpString=".dbf") returned 4
	[0176.238] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.238] lstrlenW (lpString=".1cd") returned 4
	[0176.238] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0176.238] lstrlenW (lpString=".jpg") returned 4
	[0176.238] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.238] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.238] lstrlenW (lpString="ExcelR_OEM_Perp-pl.xrm-ms") returned 25
	[0176.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.246] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=10635) returned 1
	[0176.246] CloseHandle (hObject=0x514) returned 1
	[0176.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220
	[0176.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.247] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.247] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0176.248] GetLastError () returned 0x0
	[0176.248] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x298b, lpOverlapped=0x0) returned 1
	[0176.485] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2990, lpOverlapped=0x0) returned 1
	[0176.486] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.486] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x106, lpOverlapped=0x0) returned 1
	[0176.486] SetEndOfFile (hFile=0x538) returned 1
	[0176.487] CloseHandle (hObject=0x538) returned 1
	[0176.487] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.487] SetEndOfFile (hFile=0x514) returned 1
	[0176.490] CloseHandle (hObject=0x514) returned 1
	[0176.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 1
	[0176.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.491] lstrlenW (lpString=".doc") returned 4
	[0176.491] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.491] lstrlenW (lpString=".docx") returned 5
	[0176.491] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.491] lstrlenW (lpString=".pdf") returned 4
	[0176.491] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.491] lstrlenW (lpString=".xls") returned 4
	[0176.491] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.491] lstrlenW (lpString=".xlsx") returned 5
	[0176.491] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.491] lstrlenW (lpString=".ppt") returned 4
	[0176.491] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.491] lstrlenW (lpString=".zip") returned 4
	[0176.491] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.491] lstrlenW (lpString=".rar") returned 4
	[0176.491] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.491] lstrlenW (lpString=".bz2") returned 4
	[0176.492] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.492] lstrlenW (lpString=".7z") returned 3
	[0176.492] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.492] lstrlenW (lpString=".dbf") returned 4
	[0176.492] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.492] lstrlenW (lpString=".1cd") returned 4
	[0176.492] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.492] lstrlenW (lpString=".jpg") returned 4
	[0176.492] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.492] lstrlenW (lpString=".doc") returned 4
	[0176.492] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.492] lstrlenW (lpString=".docx") returned 5
	[0176.492] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.492] lstrlenW (lpString=".pdf") returned 4
	[0176.492] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.492] lstrlenW (lpString=".xls") returned 4
	[0176.492] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.492] lstrlenW (lpString=".xlsx") returned 5
	[0176.492] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.492] lstrlenW (lpString=".ppt") returned 4
	[0176.492] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.492] lstrlenW (lpString=".zip") returned 4
	[0176.492] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.492] lstrlenW (lpString=".rar") returned 4
	[0176.493] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.493] lstrlenW (lpString=".bz2") returned 4
	[0176.493] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.493] lstrlenW (lpString=".7z") returned 3
	[0176.493] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.493] lstrlenW (lpString=".dbf") returned 4
	[0176.493] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.493] lstrlenW (lpString=".1cd") returned 4
	[0176.493] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0176.493] lstrlenW (lpString=".jpg") returned 4
	[0176.493] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.493] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.493] lstrlenW (lpString="ExcelR_Retail-pl.xrm-ms") returned 23
	[0176.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.494] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=10627) returned 1
	[0176.494] CloseHandle (hObject=0x514) returned 1
	[0176.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220
	[0176.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.494] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.494] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0176.495] GetLastError () returned 0x0
	[0176.495] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2983, lpOverlapped=0x0) returned 1
	[0176.497] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2990, lpOverlapped=0x0) returned 1
	[0176.498] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.498] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x102, lpOverlapped=0x0) returned 1
	[0176.498] SetEndOfFile (hFile=0x538) returned 1
	[0176.498] CloseHandle (hObject=0x538) returned 1
	[0176.498] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.498] SetEndOfFile (hFile=0x514) returned 1
	[0176.501] CloseHandle (hObject=0x514) returned 1
	[0176.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 1
	[0176.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.502] lstrlenW (lpString=".doc") returned 4
	[0176.502] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.502] lstrlenW (lpString=".docx") returned 5
	[0176.502] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.502] lstrlenW (lpString=".pdf") returned 4
	[0176.502] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.502] lstrlenW (lpString=".xls") returned 4
	[0176.502] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.502] lstrlenW (lpString=".xlsx") returned 5
	[0176.502] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.502] lstrlenW (lpString=".ppt") returned 4
	[0176.503] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.503] lstrlenW (lpString=".zip") returned 4
	[0176.503] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.503] lstrlenW (lpString=".rar") returned 4
	[0176.503] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.503] lstrlenW (lpString=".bz2") returned 4
	[0176.503] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.503] lstrlenW (lpString=".7z") returned 3
	[0176.503] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.503] lstrlenW (lpString=".dbf") returned 4
	[0176.503] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.503] lstrlenW (lpString=".1cd") returned 4
	[0176.503] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.503] lstrlenW (lpString=".jpg") returned 4
	[0176.503] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.503] lstrlenW (lpString=".doc") returned 4
	[0176.503] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.503] lstrlenW (lpString=".docx") returned 5
	[0176.503] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.503] lstrlenW (lpString=".pdf") returned 4
	[0176.503] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.503] lstrlenW (lpString=".xls") returned 4
	[0176.503] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.503] lstrlenW (lpString=".xlsx") returned 5
	[0176.503] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.503] lstrlenW (lpString=".ppt") returned 4
	[0176.504] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.504] lstrlenW (lpString=".zip") returned 4
	[0176.504] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.504] lstrlenW (lpString=".rar") returned 4
	[0176.504] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.504] lstrlenW (lpString=".bz2") returned 4
	[0176.504] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.504] lstrlenW (lpString=".7z") returned 3
	[0176.504] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.504] lstrlenW (lpString=".dbf") returned 4
	[0176.504] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.504] lstrlenW (lpString=".1cd") returned 4
	[0176.504] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0176.504] lstrlenW (lpString=".jpg") returned 4
	[0176.504] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.504] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.504] lstrlenW (lpString="ExcelR_Retail-ppd.xrm-ms") returned 24
	[0176.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.505] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=20844) returned 1
	[0176.505] CloseHandle (hObject=0x514) returned 1
	[0176.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220
	[0176.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.506] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.506] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0176.507] GetLastError () returned 0x0
	[0176.507] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x516c, lpOverlapped=0x0) returned 1
	[0176.509] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x5170, lpOverlapped=0x0) returned 1
	[0176.510] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.510] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x104, lpOverlapped=0x0) returned 1
	[0176.510] SetEndOfFile (hFile=0x538) returned 1
	[0176.510] CloseHandle (hObject=0x538) returned 1
	[0176.510] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.510] SetEndOfFile (hFile=0x514) returned 1
	[0176.513] CloseHandle (hObject=0x514) returned 1
	[0176.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 1
	[0176.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.514] lstrlenW (lpString=".doc") returned 4
	[0176.514] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.514] lstrlenW (lpString=".docx") returned 5
	[0176.514] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.514] lstrlenW (lpString=".pdf") returned 4
	[0176.514] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.514] lstrlenW (lpString=".xls") returned 4
	[0176.514] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.514] lstrlenW (lpString=".xlsx") returned 5
	[0176.514] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.514] lstrlenW (lpString=".ppt") returned 4
	[0176.514] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.515] lstrlenW (lpString=".zip") returned 4
	[0176.515] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.515] lstrlenW (lpString=".rar") returned 4
	[0176.515] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.515] lstrlenW (lpString=".bz2") returned 4
	[0176.515] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.515] lstrlenW (lpString=".7z") returned 3
	[0176.515] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.515] lstrlenW (lpString=".dbf") returned 4
	[0176.515] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.515] lstrlenW (lpString=".1cd") returned 4
	[0176.515] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.515] lstrlenW (lpString=".jpg") returned 4
	[0176.515] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.515] lstrlenW (lpString=".doc") returned 4
	[0176.515] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.515] lstrlenW (lpString=".docx") returned 5
	[0176.516] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.516] lstrlenW (lpString=".pdf") returned 4
	[0176.516] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString=".xls") returned 4
	[0176.516] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString=".xlsx") returned 5
	[0176.516] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.516] lstrlenW (lpString=".ppt") returned 4
	[0176.516] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.516] lstrlenW (lpString=".zip") returned 4
	[0176.516] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString=".rar") returned 4
	[0176.516] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString=".bz2") returned 4
	[0176.516] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString=".7z") returned 3
	[0176.516] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.516] lstrlenW (lpString=".dbf") returned 4
	[0176.516] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.516] lstrlenW (lpString=".1cd") returned 4
	[0176.516] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0176.516] lstrlenW (lpString=".jpg") returned 4
	[0176.516] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.517] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.517] lstrlenW (lpString="ExcelR_Retail-ul-oob.xrm-ms") returned 27
	[0176.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.517] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11574) returned 1
	[0176.517] CloseHandle (hObject=0x514) returned 1
	[0176.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220
	[0176.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0176.518] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.518] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0176.519] GetLastError () returned 0x0
	[0176.519] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d36, lpOverlapped=0x0) returned 1
	[0176.724] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0176.725] ReadFile (in: hFile=0x514, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.725] WriteFile (in: hFile=0x538, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0176.725] SetEndOfFile (hFile=0x538) returned 1
	[0176.725] CloseHandle (hObject=0x538) returned 1
	[0176.725] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.725] SetEndOfFile (hFile=0x514) returned 1
	[0176.728] CloseHandle (hObject=0x514) returned 1
	[0176.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 1
	[0177.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.570] lstrlenW (lpString=".doc") returned 4
	[0177.570] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.570] lstrlenW (lpString=".docx") returned 5
	[0177.570] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.570] lstrlenW (lpString=".pdf") returned 4
	[0177.570] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.570] lstrlenW (lpString=".xls") returned 4
	[0177.570] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.570] lstrlenW (lpString=".xlsx") returned 5
	[0177.570] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.570] lstrlenW (lpString=".ppt") returned 4
	[0177.570] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.570] lstrlenW (lpString=".zip") returned 4
	[0177.570] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.570] lstrlenW (lpString=".rar") returned 4
	[0177.570] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.571] lstrlenW (lpString=".bz2") returned 4
	[0177.571] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.571] lstrlenW (lpString=".7z") returned 3
	[0177.571] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.571] lstrlenW (lpString=".dbf") returned 4
	[0177.571] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.571] lstrlenW (lpString=".1cd") returned 4
	[0177.571] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.571] lstrlenW (lpString=".jpg") returned 4
	[0177.571] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.571] lstrlenW (lpString=".doc") returned 4
	[0177.571] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.571] lstrlenW (lpString=".docx") returned 5
	[0177.571] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.571] lstrlenW (lpString=".pdf") returned 4
	[0177.571] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.571] lstrlenW (lpString=".xls") returned 4
	[0177.572] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.572] lstrlenW (lpString=".xlsx") returned 5
	[0177.572] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.572] lstrlenW (lpString=".ppt") returned 4
	[0177.572] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.572] lstrlenW (lpString=".zip") returned 4
	[0177.572] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.572] lstrlenW (lpString=".rar") returned 4
	[0177.572] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.572] lstrlenW (lpString=".bz2") returned 4
	[0177.572] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.572] lstrlenW (lpString=".7z") returned 3
	[0177.572] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.572] lstrlenW (lpString=".dbf") returned 4
	[0177.572] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.572] lstrlenW (lpString=".1cd") returned 4
	[0177.572] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0177.572] lstrlenW (lpString=".jpg") returned 4
	[0177.572] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.572] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0177.572] lstrlenW (lpString="ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 32
	[0177.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0177.573] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11609) returned 1
	[0177.573] CloseHandle (hObject=0x370) returned 1
	[0177.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220
	[0177.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0177.574] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.574] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0177.575] GetLastError () returned 0x0
	[0177.575] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d59, lpOverlapped=0x0) returned 1
	[0177.577] WriteFile (in: hFile=0x4b8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0177.578] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.578] WriteFile (in: hFile=0x4b8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x114, lpOverlapped=0x0) returned 1
	[0177.578] SetEndOfFile (hFile=0x4b8) returned 1
	[0177.578] CloseHandle (hObject=0x4b8) returned 1
	[0177.578] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.578] SetEndOfFile (hFile=0x370) returned 1
	[0177.581] CloseHandle (hObject=0x370) returned 1
	[0177.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 1
	[0177.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.582] lstrlenW (lpString=".doc") returned 4
	[0177.582] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.582] lstrlenW (lpString=".docx") returned 5
	[0177.583] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.583] lstrlenW (lpString=".pdf") returned 4
	[0177.583] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString=".xls") returned 4
	[0177.583] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString=".xlsx") returned 5
	[0177.583] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.583] lstrlenW (lpString=".ppt") returned 4
	[0177.583] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.583] lstrlenW (lpString=".zip") returned 4
	[0177.583] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString=".rar") returned 4
	[0177.583] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString=".bz2") returned 4
	[0177.583] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString=".7z") returned 3
	[0177.583] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.583] lstrlenW (lpString=".dbf") returned 4
	[0177.583] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.583] lstrlenW (lpString=".1cd") returned 4
	[0177.583] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.583] lstrlenW (lpString=".jpg") returned 4
	[0177.583] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.584] lstrlenW (lpString=".doc") returned 4
	[0177.584] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.584] lstrlenW (lpString=".docx") returned 5
	[0177.584] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.584] lstrlenW (lpString=".pdf") returned 4
	[0177.584] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.584] lstrlenW (lpString=".xls") returned 4
	[0177.584] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.584] lstrlenW (lpString=".xlsx") returned 5
	[0177.584] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.584] lstrlenW (lpString=".ppt") returned 4
	[0177.584] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.584] lstrlenW (lpString=".zip") returned 4
	[0177.584] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.584] lstrlenW (lpString=".rar") returned 4
	[0177.584] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.584] lstrlenW (lpString=".bz2") returned 4
	[0177.584] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.584] lstrlenW (lpString=".7z") returned 3
	[0177.584] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.584] lstrlenW (lpString=".dbf") returned 4
	[0177.584] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.584] lstrlenW (lpString=".1cd") returned 4
	[0177.584] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0177.584] lstrlenW (lpString=".jpg") returned 4
	[0177.584] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.585] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0177.585] lstrlenW (lpString="ExcelVL_KMS_Client-ul.xrm-ms") returned 28
	[0177.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0177.585] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=9601) returned 1
	[0177.585] CloseHandle (hObject=0x370) returned 1
	[0177.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220
	[0177.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0177.586] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.586] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0177.587] GetLastError () returned 0x0
	[0177.587] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2581, lpOverlapped=0x0) returned 1
	[0177.589] WriteFile (in: hFile=0x4b8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2590, lpOverlapped=0x0) returned 1
	[0177.590] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.590] WriteFile (in: hFile=0x4b8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0177.590] SetEndOfFile (hFile=0x4b8) returned 1
	[0177.590] CloseHandle (hObject=0x4b8) returned 1
	[0177.590] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.590] SetEndOfFile (hFile=0x370) returned 1
	[0177.593] CloseHandle (hObject=0x370) returned 1
	[0177.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 1
	[0177.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.594] lstrlenW (lpString=".doc") returned 4
	[0177.594] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.594] lstrlenW (lpString=".docx") returned 5
	[0177.594] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.594] lstrlenW (lpString=".pdf") returned 4
	[0177.594] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.594] lstrlenW (lpString=".xls") returned 4
	[0177.594] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.594] lstrlenW (lpString=".xlsx") returned 5
	[0177.595] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.595] lstrlenW (lpString=".ppt") returned 4
	[0177.595] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.595] lstrlenW (lpString=".zip") returned 4
	[0177.595] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.595] lstrlenW (lpString=".rar") returned 4
	[0177.595] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.595] lstrlenW (lpString=".bz2") returned 4
	[0177.595] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.595] lstrlenW (lpString=".7z") returned 3
	[0177.595] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.595] lstrlenW (lpString=".dbf") returned 4
	[0177.595] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.595] lstrlenW (lpString=".1cd") returned 4
	[0177.595] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.595] lstrlenW (lpString=".jpg") returned 4
	[0177.595] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.595] lstrlenW (lpString=".doc") returned 4
	[0177.595] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.595] lstrlenW (lpString=".docx") returned 5
	[0177.595] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.595] lstrlenW (lpString=".pdf") returned 4
	[0177.595] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.595] lstrlenW (lpString=".xls") returned 4
	[0177.596] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.596] lstrlenW (lpString=".xlsx") returned 5
	[0177.596] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.596] lstrlenW (lpString=".ppt") returned 4
	[0177.596] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.596] lstrlenW (lpString=".zip") returned 4
	[0177.596] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.596] lstrlenW (lpString=".rar") returned 4
	[0177.596] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.596] lstrlenW (lpString=".bz2") returned 4
	[0177.596] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.596] lstrlenW (lpString=".7z") returned 3
	[0177.596] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.596] lstrlenW (lpString=".dbf") returned 4
	[0177.596] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.596] lstrlenW (lpString=".1cd") returned 4
	[0177.596] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0177.596] lstrlenW (lpString=".jpg") returned 4
	[0177.596] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.596] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0177.596] lstrlenW (lpString="ExcelVL_MAK-pl.xrm-ms") returned 21
	[0177.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0177.597] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=10619) returned 1
	[0177.597] CloseHandle (hObject=0x370) returned 1
	[0177.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220
	[0177.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0177.598] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.598] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0177.599] GetLastError () returned 0x0
	[0177.599] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x297b, lpOverlapped=0x0) returned 1
	[0178.025] WriteFile (in: hFile=0x4b8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2980, lpOverlapped=0x0) returned 1
	[0178.026] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.026] WriteFile (in: hFile=0x4b8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0xfe, lpOverlapped=0x0) returned 1
	[0178.026] SetEndOfFile (hFile=0x4b8) returned 1
	[0178.027] CloseHandle (hObject=0x4b8) returned 1
	[0178.027] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.027] SetEndOfFile (hFile=0x370) returned 1
	[0178.030] CloseHandle (hObject=0x370) returned 1
	[0178.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 1
	[0178.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.032] lstrlenW (lpString=".doc") returned 4
	[0178.032] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.032] lstrlenW (lpString=".docx") returned 5
	[0178.032] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.032] lstrlenW (lpString=".pdf") returned 4
	[0178.032] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.032] lstrlenW (lpString=".xls") returned 4
	[0178.032] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.032] lstrlenW (lpString=".xlsx") returned 5
	[0178.032] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.032] lstrlenW (lpString=".ppt") returned 4
	[0178.032] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.032] lstrlenW (lpString=".zip") returned 4
	[0178.032] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.032] lstrlenW (lpString=".rar") returned 4
	[0178.032] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.032] lstrlenW (lpString=".bz2") returned 4
	[0178.033] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.033] lstrlenW (lpString=".7z") returned 3
	[0178.033] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.033] lstrlenW (lpString=".dbf") returned 4
	[0178.033] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.033] lstrlenW (lpString=".1cd") returned 4
	[0178.033] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.033] lstrlenW (lpString=".jpg") returned 4
	[0178.033] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.033] lstrlenW (lpString=".doc") returned 4
	[0178.033] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.033] lstrlenW (lpString=".docx") returned 5
	[0178.033] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.033] lstrlenW (lpString=".pdf") returned 4
	[0178.033] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.033] lstrlenW (lpString=".xls") returned 4
	[0178.033] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.033] lstrlenW (lpString=".xlsx") returned 5
	[0178.033] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.033] lstrlenW (lpString=".ppt") returned 4
	[0178.033] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.033] lstrlenW (lpString=".zip") returned 4
	[0178.033] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.033] lstrlenW (lpString=".rar") returned 4
	[0178.034] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.034] lstrlenW (lpString=".bz2") returned 4
	[0178.034] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.034] lstrlenW (lpString=".7z") returned 3
	[0178.034] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.034] lstrlenW (lpString=".dbf") returned 4
	[0178.034] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.034] lstrlenW (lpString=".1cd") returned 4
	[0178.034] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0178.034] lstrlenW (lpString=".jpg") returned 4
	[0178.034] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.094] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.094] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 37
	[0178.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.310] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=21977) returned 1
	[0178.310] CloseHandle (hObject=0x4e4) returned 1
	[0178.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0178.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.311] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.311] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.321] GetLastError () returned 0x0
	[0178.321] ReadFile (in: hFile=0x4e4, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x55d9, lpOverlapped=0x0) returned 1
	[0178.337] WriteFile (in: hFile=0x514, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x55e0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x55e0, lpOverlapped=0x0) returned 1
	[0178.338] ReadFile (in: hFile=0x4e4, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.338] WriteFile (in: hFile=0x514, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0178.339] SetEndOfFile (hFile=0x514) returned 1
	[0178.339] CloseHandle (hObject=0x514) returned 1
	[0178.339] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.339] SetEndOfFile (hFile=0x4e4) returned 1
	[0178.342] CloseHandle (hObject=0x4e4) returned 1
	[0178.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 1
	[0178.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.343] lstrlenW (lpString=".doc") returned 4
	[0178.343] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.343] lstrlenW (lpString=".docx") returned 5
	[0178.343] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.343] lstrlenW (lpString=".pdf") returned 4
	[0178.343] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.343] lstrlenW (lpString=".xls") returned 4
	[0178.343] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.343] lstrlenW (lpString=".xlsx") returned 5
	[0178.343] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.343] lstrlenW (lpString=".ppt") returned 4
	[0178.343] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.343] lstrlenW (lpString=".zip") returned 4
	[0178.343] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.343] lstrlenW (lpString=".rar") returned 4
	[0178.343] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.343] lstrlenW (lpString=".bz2") returned 4
	[0178.343] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.343] lstrlenW (lpString=".7z") returned 3
	[0178.343] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.343] lstrlenW (lpString=".dbf") returned 4
	[0178.343] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.343] lstrlenW (lpString=".1cd") returned 4
	[0178.344] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.344] lstrlenW (lpString=".jpg") returned 4
	[0178.344] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.344] lstrlenW (lpString=".doc") returned 4
	[0178.344] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.344] lstrlenW (lpString=".docx") returned 5
	[0178.344] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.344] lstrlenW (lpString=".pdf") returned 4
	[0178.344] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.344] lstrlenW (lpString=".xls") returned 4
	[0178.344] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.344] lstrlenW (lpString=".xlsx") returned 5
	[0178.344] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.344] lstrlenW (lpString=".ppt") returned 4
	[0178.344] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.344] lstrlenW (lpString=".zip") returned 4
	[0178.344] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.344] lstrlenW (lpString=".rar") returned 4
	[0178.344] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.344] lstrlenW (lpString=".bz2") returned 4
	[0178.344] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.344] lstrlenW (lpString=".7z") returned 3
	[0178.344] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.344] lstrlenW (lpString=".dbf") returned 4
	[0178.344] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.345] lstrlenW (lpString=".1cd") returned 4
	[0178.345] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0178.345] lstrlenW (lpString=".jpg") returned 4
	[0178.345] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.345] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.345] lstrlenW (lpString="HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 32
	[0178.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.345] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=10663) returned 1
	[0178.346] CloseHandle (hObject=0x4e4) returned 1
	[0178.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220
	[0178.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.346] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.346] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.347] GetLastError () returned 0x0
	[0178.347] ReadFile (in: hFile=0x4e4, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x29a7, lpOverlapped=0x0) returned 1
	[0178.348] WriteFile (in: hFile=0x514, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0178.349] ReadFile (in: hFile=0x4e4, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.349] WriteFile (in: hFile=0x514, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x114, lpOverlapped=0x0) returned 1
	[0178.350] SetEndOfFile (hFile=0x514) returned 1
	[0178.350] CloseHandle (hObject=0x514) returned 1
	[0178.350] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.350] SetEndOfFile (hFile=0x4e4) returned 1
	[0178.353] CloseHandle (hObject=0x4e4) returned 1
	[0178.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 1
	[0178.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.355] lstrlenW (lpString=".doc") returned 4
	[0178.355] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.355] lstrlenW (lpString=".docx") returned 5
	[0178.355] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.355] lstrlenW (lpString=".pdf") returned 4
	[0178.355] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.355] lstrlenW (lpString=".xls") returned 4
	[0178.355] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.355] lstrlenW (lpString=".xlsx") returned 5
	[0178.355] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.355] lstrlenW (lpString=".ppt") returned 4
	[0178.355] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.355] lstrlenW (lpString=".zip") returned 4
	[0178.355] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.355] lstrlenW (lpString=".rar") returned 4
	[0178.355] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.355] lstrlenW (lpString=".bz2") returned 4
	[0178.355] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.355] lstrlenW (lpString=".7z") returned 3
	[0178.355] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.355] lstrlenW (lpString=".dbf") returned 4
	[0178.355] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.355] lstrlenW (lpString=".1cd") returned 4
	[0178.355] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.355] lstrlenW (lpString=".jpg") returned 4
	[0178.355] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.356] lstrlenW (lpString=".doc") returned 4
	[0178.356] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.356] lstrlenW (lpString=".docx") returned 5
	[0178.356] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.356] lstrlenW (lpString=".pdf") returned 4
	[0178.356] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.356] lstrlenW (lpString=".xls") returned 4
	[0178.356] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.356] lstrlenW (lpString=".xlsx") returned 5
	[0178.356] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.356] lstrlenW (lpString=".ppt") returned 4
	[0178.356] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.356] lstrlenW (lpString=".zip") returned 4
	[0178.356] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.356] lstrlenW (lpString=".rar") returned 4
	[0178.356] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.356] lstrlenW (lpString=".bz2") returned 4
	[0178.356] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.356] lstrlenW (lpString=".7z") returned 3
	[0178.356] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.356] lstrlenW (lpString=".dbf") returned 4
	[0178.356] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.356] lstrlenW (lpString=".1cd") returned 4
	[0178.356] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0178.356] lstrlenW (lpString=".jpg") returned 4
	[0178.356] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.357] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.357] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 33
	[0178.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.357] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=22093) returned 1
	[0178.357] CloseHandle (hObject=0x4e4) returned 1
	[0178.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0178.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.358] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.358] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.359] GetLastError () returned 0x0
	[0178.359] ReadFile (in: hFile=0x4e4, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x564d, lpOverlapped=0x0) returned 1
	[0178.360] WriteFile (in: hFile=0x514, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x5650, lpOverlapped=0x0) returned 1
	[0178.362] ReadFile (in: hFile=0x4e4, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.362] WriteFile (in: hFile=0x514, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x116, lpOverlapped=0x0) returned 1
	[0178.362] SetEndOfFile (hFile=0x514) returned 1
	[0178.362] CloseHandle (hObject=0x514) returned 1
	[0178.362] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.362] SetEndOfFile (hFile=0x4e4) returned 1
	[0178.365] CloseHandle (hObject=0x4e4) returned 1
	[0178.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 1
	[0178.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.366] lstrlenW (lpString=".doc") returned 4
	[0178.366] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.366] lstrlenW (lpString=".docx") returned 5
	[0178.366] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.366] lstrlenW (lpString=".pdf") returned 4
	[0178.366] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.366] lstrlenW (lpString=".xls") returned 4
	[0178.366] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.366] lstrlenW (lpString=".xlsx") returned 5
	[0178.366] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.366] lstrlenW (lpString=".ppt") returned 4
	[0178.366] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.366] lstrlenW (lpString=".zip") returned 4
	[0178.366] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.366] lstrlenW (lpString=".rar") returned 4
	[0178.366] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.367] lstrlenW (lpString=".bz2") returned 4
	[0178.367] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.367] lstrlenW (lpString=".7z") returned 3
	[0178.367] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.367] lstrlenW (lpString=".dbf") returned 4
	[0178.367] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.367] lstrlenW (lpString=".1cd") returned 4
	[0178.367] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.367] lstrlenW (lpString=".jpg") returned 4
	[0178.367] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.367] lstrlenW (lpString=".doc") returned 4
	[0178.367] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.367] lstrlenW (lpString=".docx") returned 5
	[0178.367] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.367] lstrlenW (lpString=".pdf") returned 4
	[0178.367] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.367] lstrlenW (lpString=".xls") returned 4
	[0178.367] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.367] lstrlenW (lpString=".xlsx") returned 5
	[0178.367] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.367] lstrlenW (lpString=".ppt") returned 4
	[0178.367] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.367] lstrlenW (lpString=".zip") returned 4
	[0178.367] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.368] lstrlenW (lpString=".rar") returned 4
	[0178.368] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.368] lstrlenW (lpString=".bz2") returned 4
	[0178.368] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.368] lstrlenW (lpString=".7z") returned 3
	[0178.368] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.368] lstrlenW (lpString=".dbf") returned 4
	[0178.368] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.368] lstrlenW (lpString=".1cd") returned 4
	[0178.368] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0178.368] lstrlenW (lpString=".jpg") returned 4
	[0178.368] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.368] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.368] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 36
	[0178.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0178.545] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11617) returned 1
	[0178.545] CloseHandle (hObject=0x540) returned 1
	[0178.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0178.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.765] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.765] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.803] GetLastError () returned 0x0
	[0179.803] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d61, lpOverlapped=0x0) returned 1
	[0179.805] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0179.807] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.807] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0179.807] SetEndOfFile (hFile=0x4e4) returned 1
	[0179.807] CloseHandle (hObject=0x4e4) returned 1
	[0179.807] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.807] SetEndOfFile (hFile=0x370) returned 1
	[0179.814] CloseHandle (hObject=0x370) returned 1
	[0179.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0179.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.815] lstrlenW (lpString=".doc") returned 4
	[0179.815] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.815] lstrlenW (lpString=".docx") returned 5
	[0179.815] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.815] lstrlenW (lpString=".pdf") returned 4
	[0179.815] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.815] lstrlenW (lpString=".xls") returned 4
	[0179.815] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.816] lstrlenW (lpString=".xlsx") returned 5
	[0179.816] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.816] lstrlenW (lpString=".ppt") returned 4
	[0179.816] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.816] lstrlenW (lpString=".zip") returned 4
	[0179.816] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.816] lstrlenW (lpString=".rar") returned 4
	[0179.816] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.816] lstrlenW (lpString=".bz2") returned 4
	[0179.816] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.816] lstrlenW (lpString=".7z") returned 3
	[0179.816] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.816] lstrlenW (lpString=".dbf") returned 4
	[0179.816] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.816] lstrlenW (lpString=".1cd") returned 4
	[0179.816] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.816] lstrlenW (lpString=".jpg") returned 4
	[0179.816] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.817] lstrlenW (lpString=".doc") returned 4
	[0179.817] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.817] lstrlenW (lpString=".docx") returned 5
	[0179.817] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.817] lstrlenW (lpString=".pdf") returned 4
	[0179.817] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.817] lstrlenW (lpString=".xls") returned 4
	[0179.817] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.817] lstrlenW (lpString=".xlsx") returned 5
	[0179.817] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.817] lstrlenW (lpString=".ppt") returned 4
	[0179.817] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.817] lstrlenW (lpString=".zip") returned 4
	[0179.817] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.817] lstrlenW (lpString=".rar") returned 4
	[0179.817] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.817] lstrlenW (lpString=".bz2") returned 4
	[0179.817] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.817] lstrlenW (lpString=".7z") returned 3
	[0179.817] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.817] lstrlenW (lpString=".dbf") returned 4
	[0179.817] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.817] lstrlenW (lpString=".1cd") returned 4
	[0179.818] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0179.818] lstrlenW (lpString=".jpg") returned 4
	[0179.818] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.818] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0179.818] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 37
	[0179.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.819] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=19966) returned 1
	[0179.819] CloseHandle (hObject=0x370) returned 1
	[0179.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 0x220
	[0179.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.819] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.819] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.820] GetLastError () returned 0x0
	[0179.820] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x4dfe, lpOverlapped=0x0) returned 1
	[0179.823] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0179.824] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.825] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0179.825] SetEndOfFile (hFile=0x4e4) returned 1
	[0179.825] CloseHandle (hObject=0x4e4) returned 1
	[0179.825] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.825] SetEndOfFile (hFile=0x370) returned 1
	[0179.829] CloseHandle (hObject=0x370) returned 1
	[0179.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 1
	[0179.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.830] lstrlenW (lpString=".doc") returned 4
	[0179.830] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.830] lstrlenW (lpString=".docx") returned 5
	[0179.830] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.830] lstrlenW (lpString=".pdf") returned 4
	[0179.830] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.830] lstrlenW (lpString=".xls") returned 4
	[0179.831] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.831] lstrlenW (lpString=".xlsx") returned 5
	[0179.831] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.831] lstrlenW (lpString=".ppt") returned 4
	[0179.831] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.831] lstrlenW (lpString=".zip") returned 4
	[0179.831] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.831] lstrlenW (lpString=".rar") returned 4
	[0179.831] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.831] lstrlenW (lpString=".bz2") returned 4
	[0179.831] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.831] lstrlenW (lpString=".7z") returned 3
	[0179.831] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.831] lstrlenW (lpString=".dbf") returned 4
	[0179.831] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.831] lstrlenW (lpString=".1cd") returned 4
	[0179.831] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.831] lstrlenW (lpString=".jpg") returned 4
	[0179.831] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.831] lstrlenW (lpString=".doc") returned 4
	[0179.831] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.831] lstrlenW (lpString=".docx") returned 5
	[0179.831] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.831] lstrlenW (lpString=".pdf") returned 4
	[0179.832] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.832] lstrlenW (lpString=".xls") returned 4
	[0179.832] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.832] lstrlenW (lpString=".xlsx") returned 5
	[0179.832] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.832] lstrlenW (lpString=".ppt") returned 4
	[0179.832] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.832] lstrlenW (lpString=".zip") returned 4
	[0179.832] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.832] lstrlenW (lpString=".rar") returned 4
	[0179.832] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.832] lstrlenW (lpString=".bz2") returned 4
	[0179.832] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.832] lstrlenW (lpString=".7z") returned 3
	[0179.832] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.832] lstrlenW (lpString=".dbf") returned 4
	[0179.832] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.832] lstrlenW (lpString=".1cd") returned 4
	[0179.832] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0179.832] lstrlenW (lpString=".jpg") returned 4
	[0179.832] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.832] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0179.833] lstrlenW (lpString="HomeBusinessR_Retail-pl.xrm-ms") returned 30
	[0179.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.833] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=10655) returned 1
	[0179.833] CloseHandle (hObject=0x370) returned 1
	[0179.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 0x220
	[0179.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.834] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.834] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.835] GetLastError () returned 0x0
	[0179.835] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x299f, lpOverlapped=0x0) returned 1
	[0180.080] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x29a0, lpOverlapped=0x0) returned 1
	[0180.081] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.082] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x110, lpOverlapped=0x0) returned 1
	[0180.082] SetEndOfFile (hFile=0x4e4) returned 1
	[0180.082] CloseHandle (hObject=0x4e4) returned 1
	[0180.082] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.082] SetEndOfFile (hFile=0x370) returned 1
	[0180.084] CloseHandle (hObject=0x370) returned 1
	[0180.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 1
	[0180.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.089] lstrlenW (lpString=".doc") returned 4
	[0180.089] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.089] lstrlenW (lpString=".docx") returned 5
	[0180.089] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.089] lstrlenW (lpString=".pdf") returned 4
	[0180.089] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.089] lstrlenW (lpString=".xls") returned 4
	[0180.089] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.089] lstrlenW (lpString=".xlsx") returned 5
	[0180.089] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.090] lstrlenW (lpString=".ppt") returned 4
	[0180.090] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.090] lstrlenW (lpString=".zip") returned 4
	[0180.090] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.090] lstrlenW (lpString=".rar") returned 4
	[0180.090] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.090] lstrlenW (lpString=".bz2") returned 4
	[0180.090] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.090] lstrlenW (lpString=".7z") returned 3
	[0180.090] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.090] lstrlenW (lpString=".dbf") returned 4
	[0180.090] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.090] lstrlenW (lpString=".1cd") returned 4
	[0180.090] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.090] lstrlenW (lpString=".jpg") returned 4
	[0180.090] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.090] lstrlenW (lpString=".doc") returned 4
	[0180.090] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.090] lstrlenW (lpString=".docx") returned 5
	[0180.090] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.090] lstrlenW (lpString=".pdf") returned 4
	[0180.090] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.090] lstrlenW (lpString=".xls") returned 4
	[0180.090] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.091] lstrlenW (lpString=".xlsx") returned 5
	[0180.091] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.091] lstrlenW (lpString=".ppt") returned 4
	[0180.091] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.091] lstrlenW (lpString=".zip") returned 4
	[0180.091] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.091] lstrlenW (lpString=".rar") returned 4
	[0180.091] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.091] lstrlenW (lpString=".bz2") returned 4
	[0180.091] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.091] lstrlenW (lpString=".7z") returned 3
	[0180.091] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.091] lstrlenW (lpString=".dbf") returned 4
	[0180.091] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.091] lstrlenW (lpString=".1cd") returned 4
	[0180.091] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0180.091] lstrlenW (lpString=".jpg") returned 4
	[0180.091] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.091] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.091] lstrlenW (lpString="HomeBusinessR_Retail-ppd.xrm-ms") returned 31
	[0180.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0180.092] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=22091) returned 1
	[0180.092] CloseHandle (hObject=0x370) returned 1
	[0180.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 0x220
	[0180.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0180.093] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.093] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0180.094] GetLastError () returned 0x0
	[0180.094] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x564b, lpOverlapped=0x0) returned 1
	[0180.096] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x5650, lpOverlapped=0x0) returned 1
	[0180.097] ReadFile (in: hFile=0x370, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.097] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x112, lpOverlapped=0x0) returned 1
	[0180.097] SetEndOfFile (hFile=0x4e4) returned 1
	[0180.097] CloseHandle (hObject=0x4e4) returned 1
	[0180.097] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.097] SetEndOfFile (hFile=0x370) returned 1
	[0180.100] CloseHandle (hObject=0x370) returned 1
	[0180.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 1
	[0180.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.101] lstrlenW (lpString=".doc") returned 4
	[0180.101] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.101] lstrlenW (lpString=".docx") returned 5
	[0180.101] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.101] lstrlenW (lpString=".pdf") returned 4
	[0180.101] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.101] lstrlenW (lpString=".xls") returned 4
	[0180.101] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.101] lstrlenW (lpString=".xlsx") returned 5
	[0180.101] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.101] lstrlenW (lpString=".ppt") returned 4
	[0180.101] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.102] lstrlenW (lpString=".zip") returned 4
	[0180.102] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.102] lstrlenW (lpString=".rar") returned 4
	[0180.102] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.102] lstrlenW (lpString=".bz2") returned 4
	[0180.102] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.102] lstrlenW (lpString=".7z") returned 3
	[0180.102] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.102] lstrlenW (lpString=".dbf") returned 4
	[0180.102] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.102] lstrlenW (lpString=".1cd") returned 4
	[0180.102] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.102] lstrlenW (lpString=".jpg") returned 4
	[0180.102] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.102] lstrlenW (lpString=".doc") returned 4
	[0180.102] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.102] lstrlenW (lpString=".docx") returned 5
	[0180.102] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.102] lstrlenW (lpString=".pdf") returned 4
	[0180.102] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.102] lstrlenW (lpString=".xls") returned 4
	[0180.102] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.103] lstrlenW (lpString=".xlsx") returned 5
	[0180.103] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.103] lstrlenW (lpString=".ppt") returned 4
	[0180.103] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.103] lstrlenW (lpString=".zip") returned 4
	[0180.103] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.103] lstrlenW (lpString=".rar") returned 4
	[0180.103] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.103] lstrlenW (lpString=".bz2") returned 4
	[0180.103] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.103] lstrlenW (lpString=".7z") returned 3
	[0180.103] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.103] lstrlenW (lpString=".dbf") returned 4
	[0180.103] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.103] lstrlenW (lpString=".1cd") returned 4
	[0180.103] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0180.103] lstrlenW (lpString=".jpg") returned 4
	[0180.103] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.103] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.103] lstrlenW (lpString="HomeBusinessR_Retail-ul-oob.xrm-ms") returned 34
	[0180.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0180.181] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11609) returned 1
	[0180.181] CloseHandle (hObject=0x500) returned 1
	[0180.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 0x220
	[0180.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0180.181] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.182] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0180.182] GetLastError () returned 0x0
	[0180.182] ReadFile (in: hFile=0x500, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d59, lpOverlapped=0x0) returned 1
	[0180.190] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0180.191] ReadFile (in: hFile=0x500, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.191] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x118, lpOverlapped=0x0) returned 1
	[0180.191] SetEndOfFile (hFile=0x4e4) returned 1
	[0180.191] CloseHandle (hObject=0x4e4) returned 1
	[0180.192] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.192] SetEndOfFile (hFile=0x500) returned 1
	[0180.194] CloseHandle (hObject=0x500) returned 1
	[0180.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 1
	[0180.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.195] lstrlenW (lpString=".doc") returned 4
	[0180.195] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.195] lstrlenW (lpString=".docx") returned 5
	[0180.195] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.195] lstrlenW (lpString=".pdf") returned 4
	[0180.195] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.195] lstrlenW (lpString=".xls") returned 4
	[0180.195] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.195] lstrlenW (lpString=".xlsx") returned 5
	[0180.195] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.195] lstrlenW (lpString=".ppt") returned 4
	[0180.195] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.196] lstrlenW (lpString=".zip") returned 4
	[0180.196] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.196] lstrlenW (lpString=".rar") returned 4
	[0180.196] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.196] lstrlenW (lpString=".bz2") returned 4
	[0180.196] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.196] lstrlenW (lpString=".7z") returned 3
	[0180.196] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.196] lstrlenW (lpString=".dbf") returned 4
	[0180.196] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.196] lstrlenW (lpString=".1cd") returned 4
	[0180.196] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.196] lstrlenW (lpString=".jpg") returned 4
	[0180.196] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.196] lstrlenW (lpString=".doc") returned 4
	[0180.196] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.196] lstrlenW (lpString=".docx") returned 5
	[0180.196] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.196] lstrlenW (lpString=".pdf") returned 4
	[0180.196] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.196] lstrlenW (lpString=".xls") returned 4
	[0180.196] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.197] lstrlenW (lpString=".xlsx") returned 5
	[0180.197] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.197] lstrlenW (lpString=".ppt") returned 4
	[0180.197] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.197] lstrlenW (lpString=".zip") returned 4
	[0180.197] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.197] lstrlenW (lpString=".rar") returned 4
	[0180.197] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.197] lstrlenW (lpString=".bz2") returned 4
	[0180.197] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.197] lstrlenW (lpString=".7z") returned 3
	[0180.197] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.197] lstrlenW (lpString=".dbf") returned 4
	[0180.197] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.197] lstrlenW (lpString=".1cd") returned 4
	[0180.197] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0180.197] lstrlenW (lpString=".jpg") returned 4
	[0180.197] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.197] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.197] lstrlenW (lpString="HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 35
	[0180.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0180.198] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11613) returned 1
	[0180.198] CloseHandle (hObject=0x500) returned 1
	[0180.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 0x220
	[0180.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0180.199] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.199] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0180.199] GetLastError () returned 0x0
	[0180.200] ReadFile (in: hFile=0x500, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d5d, lpOverlapped=0x0) returned 1
	[0180.215] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0180.216] ReadFile (in: hFile=0x500, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.217] WriteFile (in: hFile=0x4e4, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x11a, lpOverlapped=0x0) returned 1
	[0180.217] SetEndOfFile (hFile=0x4e4) returned 1
	[0180.217] CloseHandle (hObject=0x4e4) returned 1
	[0180.217] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.217] SetEndOfFile (hFile=0x500) returned 1
	[0180.223] CloseHandle (hObject=0x500) returned 1
	[0180.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 1
	[0180.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.228] lstrlenW (lpString=".doc") returned 4
	[0180.228] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.228] lstrlenW (lpString=".docx") returned 5
	[0180.228] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.228] lstrlenW (lpString=".pdf") returned 4
	[0180.228] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.228] lstrlenW (lpString=".xls") returned 4
	[0180.228] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.228] lstrlenW (lpString=".xlsx") returned 5
	[0180.228] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.228] lstrlenW (lpString=".ppt") returned 4
	[0180.228] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.228] lstrlenW (lpString=".zip") returned 4
	[0180.228] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.228] lstrlenW (lpString=".rar") returned 4
	[0180.228] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.228] lstrlenW (lpString=".bz2") returned 4
	[0180.228] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.228] lstrlenW (lpString=".7z") returned 3
	[0180.228] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.228] lstrlenW (lpString=".dbf") returned 4
	[0180.229] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.229] lstrlenW (lpString=".1cd") returned 4
	[0180.229] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.229] lstrlenW (lpString=".jpg") returned 4
	[0180.229] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.229] lstrlenW (lpString=".doc") returned 4
	[0180.229] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.229] lstrlenW (lpString=".docx") returned 5
	[0180.229] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.229] lstrlenW (lpString=".pdf") returned 4
	[0180.229] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.229] lstrlenW (lpString=".xls") returned 4
	[0180.229] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.229] lstrlenW (lpString=".xlsx") returned 5
	[0180.229] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.229] lstrlenW (lpString=".ppt") returned 4
	[0180.229] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.229] lstrlenW (lpString=".zip") returned 4
	[0180.229] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.229] lstrlenW (lpString=".rar") returned 4
	[0180.229] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.229] lstrlenW (lpString=".bz2") returned 4
	[0180.229] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.229] lstrlenW (lpString=".7z") returned 3
	[0180.229] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.230] lstrlenW (lpString=".dbf") returned 4
	[0180.230] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.230] lstrlenW (lpString=".1cd") returned 4
	[0180.230] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0180.230] lstrlenW (lpString=".jpg") returned 4
	[0180.230] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.230] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.230] lstrlenW (lpString="HomeBusinessR_Trial-pl.xrm-ms") returned 29
	[0180.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0180.231] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11167) returned 1
	[0180.231] CloseHandle (hObject=0x424) returned 1
	[0180.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 0x220
	[0180.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0180.232] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.232] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0180.233] GetLastError () returned 0x0
	[0180.233] ReadFile (in: hFile=0x424, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2b9f, lpOverlapped=0x0) returned 1
	[0180.271] WriteFile (in: hFile=0x500, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0180.283] ReadFile (in: hFile=0x424, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.283] WriteFile (in: hFile=0x500, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0180.284] SetEndOfFile (hFile=0x500) returned 1
	[0180.284] CloseHandle (hObject=0x500) returned 1
	[0180.284] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.284] SetEndOfFile (hFile=0x424) returned 1
	[0180.286] CloseHandle (hObject=0x424) returned 1
	[0180.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 1
	[0180.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.288] lstrlenW (lpString=".doc") returned 4
	[0180.288] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.288] lstrlenW (lpString=".docx") returned 5
	[0180.288] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.288] lstrlenW (lpString=".pdf") returned 4
	[0180.288] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.288] lstrlenW (lpString=".xls") returned 4
	[0180.288] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.288] lstrlenW (lpString=".xlsx") returned 5
	[0180.288] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.288] lstrlenW (lpString=".ppt") returned 4
	[0180.288] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.288] lstrlenW (lpString=".zip") returned 4
	[0180.288] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.288] lstrlenW (lpString=".rar") returned 4
	[0180.288] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.289] lstrlenW (lpString=".bz2") returned 4
	[0180.289] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.289] lstrlenW (lpString=".7z") returned 3
	[0180.289] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.289] lstrlenW (lpString=".dbf") returned 4
	[0180.289] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.289] lstrlenW (lpString=".1cd") returned 4
	[0180.289] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.289] lstrlenW (lpString=".jpg") returned 4
	[0180.289] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.289] lstrlenW (lpString=".doc") returned 4
	[0180.289] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.289] lstrlenW (lpString=".docx") returned 5
	[0180.289] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.289] lstrlenW (lpString=".pdf") returned 4
	[0180.289] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.289] lstrlenW (lpString=".xls") returned 4
	[0180.289] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.289] lstrlenW (lpString=".xlsx") returned 5
	[0180.470] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.470] lstrlenW (lpString=".ppt") returned 4
	[0180.470] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.470] lstrlenW (lpString=".zip") returned 4
	[0180.470] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.470] lstrlenW (lpString=".rar") returned 4
	[0180.470] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.470] lstrlenW (lpString=".bz2") returned 4
	[0180.471] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.471] lstrlenW (lpString=".7z") returned 3
	[0180.471] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.471] lstrlenW (lpString=".dbf") returned 4
	[0180.471] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.471] lstrlenW (lpString=".1cd") returned 4
	[0180.471] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0180.471] lstrlenW (lpString=".jpg") returned 4
	[0180.471] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.471] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.471] lstrlenW (lpString="HomeBusinessR_Trial-ul-oob.xrm-ms") returned 33
	[0180.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0180.835] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11621) returned 1
	[0180.835] CloseHandle (hObject=0x51c) returned 1
	[0180.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 0x220
	[0181.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0181.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0181.509] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.509] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0181.510] GetLastError () returned 0x0
	[0181.511] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0181.512] WriteFile (in: hFile=0x500, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0181.513] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.513] WriteFile (in: hFile=0x500, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x116, lpOverlapped=0x0) returned 1
	[0181.513] SetEndOfFile (hFile=0x500) returned 1
	[0181.513] CloseHandle (hObject=0x500) returned 1
	[0181.514] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.514] SetEndOfFile (hFile=0x534) returned 1
	[0181.520] CloseHandle (hObject=0x534) returned 1
	[0181.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0181.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 1
	[0181.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.522] lstrlenW (lpString=".doc") returned 4
	[0181.522] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.522] lstrlenW (lpString=".docx") returned 5
	[0181.522] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.522] lstrlenW (lpString=".pdf") returned 4
	[0181.522] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.522] lstrlenW (lpString=".xls") returned 4
	[0181.522] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.522] lstrlenW (lpString=".xlsx") returned 5
	[0181.522] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.522] lstrlenW (lpString=".ppt") returned 4
	[0181.522] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.522] lstrlenW (lpString=".zip") returned 4
	[0181.522] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.522] lstrlenW (lpString=".rar") returned 4
	[0181.522] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.522] lstrlenW (lpString=".bz2") returned 4
	[0181.522] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.522] lstrlenW (lpString=".7z") returned 3
	[0181.522] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.522] lstrlenW (lpString=".dbf") returned 4
	[0181.522] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.522] lstrlenW (lpString=".1cd") returned 4
	[0181.522] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.523] lstrlenW (lpString=".jpg") returned 4
	[0181.523] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.523] lstrlenW (lpString=".doc") returned 4
	[0181.523] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.523] lstrlenW (lpString=".docx") returned 5
	[0181.523] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.523] lstrlenW (lpString=".pdf") returned 4
	[0181.523] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.523] lstrlenW (lpString=".xls") returned 4
	[0181.523] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.523] lstrlenW (lpString=".xlsx") returned 5
	[0181.523] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.523] lstrlenW (lpString=".ppt") returned 4
	[0181.523] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.523] lstrlenW (lpString=".zip") returned 4
	[0181.523] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.523] lstrlenW (lpString=".rar") returned 4
	[0181.523] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.523] lstrlenW (lpString=".bz2") returned 4
	[0181.523] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.523] lstrlenW (lpString=".7z") returned 3
	[0181.523] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.523] lstrlenW (lpString=".dbf") returned 4
	[0181.523] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.523] lstrlenW (lpString=".1cd") returned 4
	[0181.523] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0181.524] lstrlenW (lpString=".jpg") returned 4
	[0181.524] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.524] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0181.524] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 41
	[0181.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0181.525] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11215) returned 1
	[0181.525] CloseHandle (hObject=0x534) returned 1
	[0181.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0181.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0181.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0181.525] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.525] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0181.526] GetLastError () returned 0x0
	[0181.526] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2bcf, lpOverlapped=0x0) returned 1
	[0181.528] WriteFile (in: hFile=0x500, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2bd0, lpOverlapped=0x0) returned 1
	[0181.529] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.529] WriteFile (in: hFile=0x500, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x126, lpOverlapped=0x0) returned 1
	[0181.529] SetEndOfFile (hFile=0x500) returned 1
	[0181.529] CloseHandle (hObject=0x500) returned 1
	[0181.529] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.529] SetEndOfFile (hFile=0x534) returned 1
	[0181.532] CloseHandle (hObject=0x534) returned 1
	[0181.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0181.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0181.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.533] lstrlenW (lpString=".doc") returned 4
	[0181.533] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.533] lstrlenW (lpString=".docx") returned 5
	[0181.533] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.533] lstrlenW (lpString=".pdf") returned 4
	[0181.533] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.533] lstrlenW (lpString=".xls") returned 4
	[0181.533] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.533] lstrlenW (lpString=".xlsx") returned 5
	[0181.533] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.533] lstrlenW (lpString=".ppt") returned 4
	[0181.533] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.533] lstrlenW (lpString=".zip") returned 4
	[0181.533] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.533] lstrlenW (lpString=".rar") returned 4
	[0181.533] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.533] lstrlenW (lpString=".bz2") returned 4
	[0181.533] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.533] lstrlenW (lpString=".7z") returned 3
	[0181.533] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.533] lstrlenW (lpString=".dbf") returned 4
	[0181.534] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.534] lstrlenW (lpString=".1cd") returned 4
	[0181.534] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.534] lstrlenW (lpString=".jpg") returned 4
	[0181.534] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.534] lstrlenW (lpString=".doc") returned 4
	[0181.534] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.534] lstrlenW (lpString=".docx") returned 5
	[0181.534] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.534] lstrlenW (lpString=".pdf") returned 4
	[0181.534] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.534] lstrlenW (lpString=".xls") returned 4
	[0181.534] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.534] lstrlenW (lpString=".xlsx") returned 5
	[0181.534] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.534] lstrlenW (lpString=".ppt") returned 4
	[0181.534] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.534] lstrlenW (lpString=".zip") returned 4
	[0181.534] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.534] lstrlenW (lpString=".rar") returned 4
	[0181.534] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.534] lstrlenW (lpString=".bz2") returned 4
	[0181.534] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.534] lstrlenW (lpString=".7z") returned 3
	[0181.534] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.535] lstrlenW (lpString=".dbf") returned 4
	[0181.535] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.535] lstrlenW (lpString=".1cd") returned 4
	[0181.535] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0181.535] lstrlenW (lpString=".jpg") returned 4
	[0181.535] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.535] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0181.535] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 42
	[0181.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0181.536] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=21737) returned 1
	[0181.536] CloseHandle (hObject=0x534) returned 1
	[0181.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0181.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0181.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0181.536] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.536] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0181.537] GetLastError () returned 0x0
	[0181.537] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x54e9, lpOverlapped=0x0) returned 1
	[0181.539] WriteFile (in: hFile=0x500, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x54f0, lpOverlapped=0x0) returned 1
	[0181.540] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.540] WriteFile (in: hFile=0x500, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x128, lpOverlapped=0x0) returned 1
	[0181.540] SetEndOfFile (hFile=0x500) returned 1
	[0181.541] CloseHandle (hObject=0x500) returned 1
	[0181.541] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.541] SetEndOfFile (hFile=0x534) returned 1
	[0181.544] CloseHandle (hObject=0x534) returned 1
	[0181.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0181.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0181.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.546] lstrlenW (lpString=".doc") returned 4
	[0181.546] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.546] lstrlenW (lpString=".docx") returned 5
	[0181.546] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.546] lstrlenW (lpString=".pdf") returned 4
	[0181.546] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.546] lstrlenW (lpString=".xls") returned 4
	[0181.546] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.546] lstrlenW (lpString=".xlsx") returned 5
	[0181.546] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.546] lstrlenW (lpString=".ppt") returned 4
	[0181.546] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.546] lstrlenW (lpString=".zip") returned 4
	[0181.546] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.546] lstrlenW (lpString=".rar") returned 4
	[0181.546] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.546] lstrlenW (lpString=".bz2") returned 4
	[0181.546] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.546] lstrlenW (lpString=".7z") returned 3
	[0181.546] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.546] lstrlenW (lpString=".dbf") returned 4
	[0181.546] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.546] lstrlenW (lpString=".1cd") returned 4
	[0181.546] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.546] lstrlenW (lpString=".jpg") returned 4
	[0181.546] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.547] lstrlenW (lpString=".doc") returned 4
	[0181.547] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.547] lstrlenW (lpString=".docx") returned 5
	[0181.547] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.547] lstrlenW (lpString=".pdf") returned 4
	[0181.547] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.547] lstrlenW (lpString=".xls") returned 4
	[0181.547] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.547] lstrlenW (lpString=".xlsx") returned 5
	[0181.547] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.547] lstrlenW (lpString=".ppt") returned 4
	[0181.547] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.547] lstrlenW (lpString=".zip") returned 4
	[0181.547] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.547] lstrlenW (lpString=".rar") returned 4
	[0181.547] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.547] lstrlenW (lpString=".bz2") returned 4
	[0181.547] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.547] lstrlenW (lpString=".7z") returned 3
	[0181.547] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.547] lstrlenW (lpString=".dbf") returned 4
	[0181.547] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.547] lstrlenW (lpString=".1cd") returned 4
	[0181.547] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0181.547] lstrlenW (lpString=".jpg") returned 4
	[0181.548] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.548] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0181.548] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 45
	[0181.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0181.548] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11669) returned 1
	[0181.548] CloseHandle (hObject=0x534) returned 1
	[0181.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0181.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0181.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0181.549] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.549] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0181.550] GetLastError () returned 0x0
	[0181.550] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d95, lpOverlapped=0x0) returned 1
	[0182.010] WriteFile (in: hFile=0x500, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0182.011] ReadFile (in: hFile=0x534, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.011] WriteFile (in: hFile=0x500, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x12e, lpOverlapped=0x0) returned 1
	[0182.011] SetEndOfFile (hFile=0x500) returned 1
	[0182.011] CloseHandle (hObject=0x500) returned 1
	[0182.012] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.012] SetEndOfFile (hFile=0x534) returned 1
	[0182.014] CloseHandle (hObject=0x534) returned 1
	[0182.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0183.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.079] lstrlenW (lpString=".doc") returned 4
	[0183.080] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.080] lstrlenW (lpString=".docx") returned 5
	[0183.080] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.080] lstrlenW (lpString=".pdf") returned 4
	[0183.080] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.080] lstrlenW (lpString=".xls") returned 4
	[0183.080] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.080] lstrlenW (lpString=".xlsx") returned 5
	[0183.080] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.080] lstrlenW (lpString=".ppt") returned 4
	[0183.080] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.080] lstrlenW (lpString=".zip") returned 4
	[0183.080] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.080] lstrlenW (lpString=".rar") returned 4
	[0183.080] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.080] lstrlenW (lpString=".bz2") returned 4
	[0183.080] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.080] lstrlenW (lpString=".7z") returned 3
	[0183.080] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.080] lstrlenW (lpString=".dbf") returned 4
	[0183.080] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.080] lstrlenW (lpString=".1cd") returned 4
	[0183.080] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.080] lstrlenW (lpString=".jpg") returned 4
	[0183.080] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.081] lstrlenW (lpString=".doc") returned 4
	[0183.081] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.081] lstrlenW (lpString=".docx") returned 5
	[0183.081] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.081] lstrlenW (lpString=".pdf") returned 4
	[0183.081] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.081] lstrlenW (lpString=".xls") returned 4
	[0183.081] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.081] lstrlenW (lpString=".xlsx") returned 5
	[0183.081] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.081] lstrlenW (lpString=".ppt") returned 4
	[0183.081] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.081] lstrlenW (lpString=".zip") returned 4
	[0183.081] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.081] lstrlenW (lpString=".rar") returned 4
	[0183.081] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.081] lstrlenW (lpString=".bz2") returned 4
	[0183.081] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.081] lstrlenW (lpString=".7z") returned 3
	[0183.081] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.081] lstrlenW (lpString=".dbf") returned 4
	[0183.081] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.081] lstrlenW (lpString=".1cd") returned 4
	[0183.081] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0183.081] lstrlenW (lpString=".jpg") returned 4
	[0183.081] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.082] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.082] lstrlenW (lpString="HomeStudentR_Trial-pl.xrm-ms") returned 28
	[0183.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0183.082] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11163) returned 1
	[0183.082] CloseHandle (hObject=0x4e0) returned 1
	[0183.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 0x220
	[0183.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0183.083] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.083] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0183.084] GetLastError () returned 0x0
	[0183.084] ReadFile (in: hFile=0x4e0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2b9b, lpOverlapped=0x0) returned 1
	[0183.121] WriteFile (in: hFile=0x4bc, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0183.123] ReadFile (in: hFile=0x4e0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.123] WriteFile (in: hFile=0x4bc, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0183.123] SetEndOfFile (hFile=0x4bc) returned 1
	[0183.123] CloseHandle (hObject=0x4bc) returned 1
	[0183.123] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.123] SetEndOfFile (hFile=0x4e0) returned 1
	[0183.126] CloseHandle (hObject=0x4e0) returned 1
	[0183.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 1
	[0183.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.127] lstrlenW (lpString=".doc") returned 4
	[0183.127] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.127] lstrlenW (lpString=".docx") returned 5
	[0183.127] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.127] lstrlenW (lpString=".pdf") returned 4
	[0183.127] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.127] lstrlenW (lpString=".xls") returned 4
	[0183.127] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.127] lstrlenW (lpString=".xlsx") returned 5
	[0183.127] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.128] lstrlenW (lpString=".ppt") returned 4
	[0183.128] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.128] lstrlenW (lpString=".zip") returned 4
	[0183.128] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.128] lstrlenW (lpString=".rar") returned 4
	[0183.128] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.128] lstrlenW (lpString=".bz2") returned 4
	[0183.128] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.128] lstrlenW (lpString=".7z") returned 3
	[0183.128] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.128] lstrlenW (lpString=".dbf") returned 4
	[0183.128] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.128] lstrlenW (lpString=".1cd") returned 4
	[0183.128] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.128] lstrlenW (lpString=".jpg") returned 4
	[0183.128] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.128] lstrlenW (lpString=".doc") returned 4
	[0183.128] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.128] lstrlenW (lpString=".docx") returned 5
	[0183.128] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.128] lstrlenW (lpString=".pdf") returned 4
	[0183.128] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.128] lstrlenW (lpString=".xls") returned 4
	[0183.128] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.129] lstrlenW (lpString=".xlsx") returned 5
	[0183.129] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.129] lstrlenW (lpString=".ppt") returned 4
	[0183.129] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.129] lstrlenW (lpString=".zip") returned 4
	[0183.129] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.129] lstrlenW (lpString=".rar") returned 4
	[0183.129] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.129] lstrlenW (lpString=".bz2") returned 4
	[0183.129] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.129] lstrlenW (lpString=".7z") returned 3
	[0183.129] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.129] lstrlenW (lpString=".dbf") returned 4
	[0183.129] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.129] lstrlenW (lpString=".1cd") returned 4
	[0183.129] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0183.129] lstrlenW (lpString=".jpg") returned 4
	[0183.129] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.129] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.129] lstrlenW (lpString="HomeStudentR_Trial-ppd.xrm-ms") returned 29
	[0183.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0183.130] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=21727) returned 1
	[0183.130] CloseHandle (hObject=0x4e0) returned 1
	[0183.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 0x220
	[0183.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0183.131] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.131] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0183.131] GetLastError () returned 0x0
	[0183.131] ReadFile (in: hFile=0x4e0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x54df, lpOverlapped=0x0) returned 1
	[0183.133] WriteFile (in: hFile=0x4bc, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x54e0, lpOverlapped=0x0) returned 1
	[0183.135] ReadFile (in: hFile=0x4e0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.135] WriteFile (in: hFile=0x4bc, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0183.135] SetEndOfFile (hFile=0x4bc) returned 1
	[0183.135] CloseHandle (hObject=0x4bc) returned 1
	[0183.135] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.135] SetEndOfFile (hFile=0x4e0) returned 1
	[0183.138] CloseHandle (hObject=0x4e0) returned 1
	[0183.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 1
	[0183.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.139] lstrlenW (lpString=".doc") returned 4
	[0183.139] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.139] lstrlenW (lpString=".docx") returned 5
	[0183.139] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.139] lstrlenW (lpString=".pdf") returned 4
	[0183.139] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.139] lstrlenW (lpString=".xls") returned 4
	[0183.139] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.139] lstrlenW (lpString=".xlsx") returned 5
	[0183.139] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.139] lstrlenW (lpString=".ppt") returned 4
	[0183.139] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.139] lstrlenW (lpString=".zip") returned 4
	[0183.139] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.139] lstrlenW (lpString=".rar") returned 4
	[0183.139] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.139] lstrlenW (lpString=".bz2") returned 4
	[0183.140] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.140] lstrlenW (lpString=".7z") returned 3
	[0183.140] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.140] lstrlenW (lpString=".dbf") returned 4
	[0183.140] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.140] lstrlenW (lpString=".1cd") returned 4
	[0183.140] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.140] lstrlenW (lpString=".jpg") returned 4
	[0183.140] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.140] lstrlenW (lpString=".doc") returned 4
	[0183.140] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.140] lstrlenW (lpString=".docx") returned 5
	[0183.140] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.140] lstrlenW (lpString=".pdf") returned 4
	[0183.140] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.140] lstrlenW (lpString=".xls") returned 4
	[0183.140] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.140] lstrlenW (lpString=".xlsx") returned 5
	[0183.140] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.140] lstrlenW (lpString=".ppt") returned 4
	[0183.140] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.140] lstrlenW (lpString=".zip") returned 4
	[0183.140] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.140] lstrlenW (lpString=".rar") returned 4
	[0183.141] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.141] lstrlenW (lpString=".bz2") returned 4
	[0183.141] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.141] lstrlenW (lpString=".7z") returned 3
	[0183.141] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.141] lstrlenW (lpString=".dbf") returned 4
	[0183.141] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.141] lstrlenW (lpString=".1cd") returned 4
	[0183.141] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0183.141] lstrlenW (lpString=".jpg") returned 4
	[0183.141] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.141] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.141] lstrlenW (lpString="HomeStudentR_Trial-ul-oob.xrm-ms") returned 32
	[0183.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0183.142] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11616) returned 1
	[0183.142] CloseHandle (hObject=0x4e0) returned 1
	[0183.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 0x220
	[0183.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0183.142] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.142] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc
	[0183.143] GetLastError () returned 0x0
	[0183.143] ReadFile (in: hFile=0x4e0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d60, lpOverlapped=0x0) returned 1
	[0183.145] WriteFile (in: hFile=0x4bc, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0183.146] ReadFile (in: hFile=0x4e0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.146] WriteFile (in: hFile=0x4bc, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x114, lpOverlapped=0x0) returned 1
	[0183.146] SetEndOfFile (hFile=0x4bc) returned 1
	[0183.146] CloseHandle (hObject=0x4bc) returned 1
	[0183.146] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.146] SetEndOfFile (hFile=0x4e0) returned 1
	[0183.149] CloseHandle (hObject=0x4e0) returned 1
	[0183.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 1
	[0183.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.150] lstrlenW (lpString=".doc") returned 4
	[0183.150] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.150] lstrlenW (lpString=".docx") returned 5
	[0183.150] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.150] lstrlenW (lpString=".pdf") returned 4
	[0183.150] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.150] lstrlenW (lpString=".xls") returned 4
	[0183.150] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.150] lstrlenW (lpString=".xlsx") returned 5
	[0183.150] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.150] lstrlenW (lpString=".ppt") returned 4
	[0183.151] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.151] lstrlenW (lpString=".zip") returned 4
	[0183.151] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.151] lstrlenW (lpString=".rar") returned 4
	[0183.151] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.151] lstrlenW (lpString=".bz2") returned 4
	[0183.151] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.151] lstrlenW (lpString=".7z") returned 3
	[0183.151] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.151] lstrlenW (lpString=".dbf") returned 4
	[0183.151] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.151] lstrlenW (lpString=".1cd") returned 4
	[0183.151] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.151] lstrlenW (lpString=".jpg") returned 4
	[0183.151] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.151] lstrlenW (lpString=".doc") returned 4
	[0183.151] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.151] lstrlenW (lpString=".docx") returned 5
	[0183.151] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.151] lstrlenW (lpString=".pdf") returned 4
	[0183.151] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.151] lstrlenW (lpString=".xls") returned 4
	[0183.151] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.151] lstrlenW (lpString=".xlsx") returned 5
	[0183.152] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.152] lstrlenW (lpString=".ppt") returned 4
	[0183.152] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.152] lstrlenW (lpString=".zip") returned 4
	[0183.152] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.152] lstrlenW (lpString=".rar") returned 4
	[0183.152] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.152] lstrlenW (lpString=".bz2") returned 4
	[0183.152] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.152] lstrlenW (lpString=".7z") returned 3
	[0183.152] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.407] lstrlenW (lpString=".dbf") returned 4
	[0183.407] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.407] lstrlenW (lpString=".1cd") returned 4
	[0183.407] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0183.407] lstrlenW (lpString=".jpg") returned 4
	[0183.407] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.408] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.408] lstrlenW (lpString="MondoR_KMS_Automation-ppd.xrm-ms") returned 32
	[0183.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0183.973] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=12416) returned 1
	[0183.980] CloseHandle (hObject=0x4f0) returned 1
	[0183.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 0x220
	[0183.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0183.981] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.981] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.982] GetLastError () returned 0x0
	[0183.982] ReadFile (in: hFile=0x4f0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x3080, lpOverlapped=0x0) returned 1
	[0183.984] WriteFile (in: hFile=0x3ac, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x3090, lpOverlapped=0x0) returned 1
	[0183.985] ReadFile (in: hFile=0x4f0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.985] WriteFile (in: hFile=0x3ac, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x114, lpOverlapped=0x0) returned 1
	[0183.985] SetEndOfFile (hFile=0x3ac) returned 1
	[0183.985] CloseHandle (hObject=0x3ac) returned 1
	[0183.985] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.985] SetEndOfFile (hFile=0x4f0) returned 1
	[0183.988] CloseHandle (hObject=0x4f0) returned 1
	[0183.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 1
	[0183.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.989] lstrlenW (lpString=".doc") returned 4
	[0183.989] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.989] lstrlenW (lpString=".docx") returned 5
	[0183.989] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.989] lstrlenW (lpString=".pdf") returned 4
	[0183.989] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.989] lstrlenW (lpString=".xls") returned 4
	[0183.989] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.989] lstrlenW (lpString=".xlsx") returned 5
	[0183.990] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.990] lstrlenW (lpString=".ppt") returned 4
	[0183.990] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.990] lstrlenW (lpString=".zip") returned 4
	[0183.990] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.990] lstrlenW (lpString=".rar") returned 4
	[0183.990] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.990] lstrlenW (lpString=".bz2") returned 4
	[0183.990] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.990] lstrlenW (lpString=".7z") returned 3
	[0183.990] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.990] lstrlenW (lpString=".dbf") returned 4
	[0183.990] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.990] lstrlenW (lpString=".1cd") returned 4
	[0183.990] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.990] lstrlenW (lpString=".jpg") returned 4
	[0183.990] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.990] lstrlenW (lpString=".doc") returned 4
	[0183.990] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.990] lstrlenW (lpString=".docx") returned 5
	[0183.990] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.990] lstrlenW (lpString=".pdf") returned 4
	[0183.990] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.990] lstrlenW (lpString=".xls") returned 4
	[0183.991] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.991] lstrlenW (lpString=".xlsx") returned 5
	[0183.991] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.991] lstrlenW (lpString=".ppt") returned 4
	[0183.991] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.991] lstrlenW (lpString=".zip") returned 4
	[0183.991] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.991] lstrlenW (lpString=".rar") returned 4
	[0183.991] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.991] lstrlenW (lpString=".bz2") returned 4
	[0183.991] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.991] lstrlenW (lpString=".7z") returned 3
	[0183.991] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.991] lstrlenW (lpString=".dbf") returned 4
	[0183.991] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.991] lstrlenW (lpString=".1cd") returned 4
	[0183.991] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0183.991] lstrlenW (lpString=".jpg") returned 4
	[0183.991] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.991] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.991] lstrlenW (lpString="MondoR_OEM_Perp-ppd.xrm-ms") returned 26
	[0183.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0183.992] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=26464) returned 1
	[0183.992] CloseHandle (hObject=0x4f0) returned 1
	[0183.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 0x220
	[0183.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0183.993] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.993] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.994] GetLastError () returned 0x0
	[0183.994] ReadFile (in: hFile=0x4f0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x6760, lpOverlapped=0x0) returned 1
	[0183.996] WriteFile (in: hFile=0x3ac, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x6770, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x6770, lpOverlapped=0x0) returned 1
	[0183.998] ReadFile (in: hFile=0x4f0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.998] WriteFile (in: hFile=0x3ac, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x108, lpOverlapped=0x0) returned 1
	[0183.998] SetEndOfFile (hFile=0x3ac) returned 1
	[0183.998] CloseHandle (hObject=0x3ac) returned 1
	[0183.998] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.998] SetEndOfFile (hFile=0x4f0) returned 1
	[0184.001] CloseHandle (hObject=0x4f0) returned 1
	[0184.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 1
	[0184.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.002] lstrlenW (lpString=".doc") returned 4
	[0184.002] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0184.002] lstrlenW (lpString=".docx") returned 5
	[0184.002] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0184.002] lstrlenW (lpString=".pdf") returned 4
	[0184.002] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0184.002] lstrlenW (lpString=".xls") returned 4
	[0184.002] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0184.002] lstrlenW (lpString=".xlsx") returned 5
	[0184.002] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0184.002] lstrlenW (lpString=".ppt") returned 4
	[0184.002] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0184.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.002] lstrlenW (lpString=".zip") returned 4
	[0184.002] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0184.002] lstrlenW (lpString=".rar") returned 4
	[0184.002] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0184.002] lstrlenW (lpString=".bz2") returned 4
	[0184.002] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0184.003] lstrlenW (lpString=".7z") returned 3
	[0184.003] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0184.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.003] lstrlenW (lpString=".dbf") returned 4
	[0184.003] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0184.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.003] lstrlenW (lpString=".1cd") returned 4
	[0184.003] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0184.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.003] lstrlenW (lpString=".jpg") returned 4
	[0184.003] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0184.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.003] lstrlenW (lpString=".doc") returned 4
	[0184.003] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0184.003] lstrlenW (lpString=".docx") returned 5
	[0184.003] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0184.003] lstrlenW (lpString=".pdf") returned 4
	[0184.003] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0184.003] lstrlenW (lpString=".xls") returned 4
	[0184.003] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0184.003] lstrlenW (lpString=".xlsx") returned 5
	[0184.003] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0184.003] lstrlenW (lpString=".ppt") returned 4
	[0184.003] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0184.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.003] lstrlenW (lpString=".zip") returned 4
	[0184.003] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0184.003] lstrlenW (lpString=".rar") returned 4
	[0184.003] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0184.004] lstrlenW (lpString=".bz2") returned 4
	[0184.004] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0184.004] lstrlenW (lpString=".7z") returned 3
	[0184.004] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0184.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.004] lstrlenW (lpString=".dbf") returned 4
	[0184.004] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0184.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.004] lstrlenW (lpString=".1cd") returned 4
	[0184.004] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0184.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0184.004] lstrlenW (lpString=".jpg") returned 4
	[0184.004] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0184.004] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0184.004] lstrlenW (lpString="MondoR_OEM_Perp-ul-oob.xrm-ms") returned 29
	[0184.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0184.005] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11582) returned 1
	[0184.005] CloseHandle (hObject=0x4f0) returned 1
	[0184.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0184.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0184.005] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.005] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0184.006] GetLastError () returned 0x0
	[0184.006] ReadFile (in: hFile=0x4f0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d3e, lpOverlapped=0x0) returned 1
	[0184.008] WriteFile (in: hFile=0x3ac, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0184.009] ReadFile (in: hFile=0x4f0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.009] WriteFile (in: hFile=0x3ac, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0184.010] SetEndOfFile (hFile=0x3ac) returned 1
	[0184.010] CloseHandle (hObject=0x3ac) returned 1
	[0184.010] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.010] SetEndOfFile (hFile=0x4f0) returned 1
	[0184.014] CloseHandle (hObject=0x4f0) returned 1
	[0184.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 1
	[0184.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.015] lstrlenW (lpString=".doc") returned 4
	[0184.015] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0184.015] lstrlenW (lpString=".docx") returned 5
	[0184.015] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0184.015] lstrlenW (lpString=".pdf") returned 4
	[0184.015] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0184.015] lstrlenW (lpString=".xls") returned 4
	[0184.015] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0184.015] lstrlenW (lpString=".xlsx") returned 5
	[0184.015] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0184.015] lstrlenW (lpString=".ppt") returned 4
	[0184.015] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0184.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.015] lstrlenW (lpString=".zip") returned 4
	[0184.015] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0184.015] lstrlenW (lpString=".rar") returned 4
	[0184.015] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0184.015] lstrlenW (lpString=".bz2") returned 4
	[0184.015] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0184.015] lstrlenW (lpString=".7z") returned 3
	[0184.015] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0184.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.015] lstrlenW (lpString=".dbf") returned 4
	[0184.015] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0184.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.015] lstrlenW (lpString=".1cd") returned 4
	[0184.015] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0184.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.016] lstrlenW (lpString=".jpg") returned 4
	[0184.016] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0184.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.016] lstrlenW (lpString=".doc") returned 4
	[0184.016] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0184.016] lstrlenW (lpString=".docx") returned 5
	[0184.016] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0184.016] lstrlenW (lpString=".pdf") returned 4
	[0184.016] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0184.016] lstrlenW (lpString=".xls") returned 4
	[0184.016] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0184.016] lstrlenW (lpString=".xlsx") returned 5
	[0184.016] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0184.016] lstrlenW (lpString=".ppt") returned 4
	[0184.016] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0184.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.016] lstrlenW (lpString=".zip") returned 4
	[0184.016] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0184.016] lstrlenW (lpString=".rar") returned 4
	[0184.016] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0184.016] lstrlenW (lpString=".bz2") returned 4
	[0184.016] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0184.016] lstrlenW (lpString=".7z") returned 3
	[0184.016] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0184.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.016] lstrlenW (lpString=".dbf") returned 4
	[0184.016] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0184.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.017] lstrlenW (lpString=".1cd") returned 4
	[0184.017] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0184.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0184.017] lstrlenW (lpString=".jpg") returned 4
	[0184.017] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0184.017] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0184.017] lstrlenW (lpString="MondoR_OEM_Perp-ul-phn.xrm-ms") returned 29
	[0184.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0184.018] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=19927) returned 1
	[0184.018] CloseHandle (hObject=0x4f0) returned 1
	[0184.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0184.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0184.018] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.019] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0184.019] GetLastError () returned 0x0
	[0184.019] ReadFile (in: hFile=0x4f0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x4dd7, lpOverlapped=0x0) returned 1
	[0184.447] WriteFile (in: hFile=0x3ac, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0184.574] ReadFile (in: hFile=0x4f0, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.574] WriteFile (in: hFile=0x3ac, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0184.575] SetEndOfFile (hFile=0x3ac) returned 1
	[0184.575] CloseHandle (hObject=0x3ac) returned 1
	[0184.575] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.575] SetEndOfFile (hFile=0x4f0) returned 1
	[0184.577] CloseHandle (hObject=0x4f0) returned 1
	[0184.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 1
	[0185.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.138] lstrlenW (lpString=".doc") returned 4
	[0185.138] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.138] lstrlenW (lpString=".docx") returned 5
	[0185.138] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.138] lstrlenW (lpString=".pdf") returned 4
	[0185.138] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.138] lstrlenW (lpString=".xls") returned 4
	[0185.138] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.138] lstrlenW (lpString=".xlsx") returned 5
	[0185.138] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.138] lstrlenW (lpString=".ppt") returned 4
	[0185.138] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.138] lstrlenW (lpString=".zip") returned 4
	[0185.138] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.138] lstrlenW (lpString=".rar") returned 4
	[0185.139] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.139] lstrlenW (lpString=".bz2") returned 4
	[0185.139] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.139] lstrlenW (lpString=".7z") returned 3
	[0185.139] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.139] lstrlenW (lpString=".dbf") returned 4
	[0185.139] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.139] lstrlenW (lpString=".1cd") returned 4
	[0185.139] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.139] lstrlenW (lpString=".jpg") returned 4
	[0185.139] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.139] lstrlenW (lpString=".doc") returned 4
	[0185.139] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.139] lstrlenW (lpString=".docx") returned 5
	[0185.139] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.139] lstrlenW (lpString=".pdf") returned 4
	[0185.139] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.139] lstrlenW (lpString=".xls") returned 4
	[0185.139] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.139] lstrlenW (lpString=".xlsx") returned 5
	[0185.139] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.139] lstrlenW (lpString=".ppt") returned 4
	[0185.139] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.139] lstrlenW (lpString=".zip") returned 4
	[0185.139] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.139] lstrlenW (lpString=".rar") returned 4
	[0185.139] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.139] lstrlenW (lpString=".bz2") returned 4
	[0185.139] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.140] lstrlenW (lpString=".7z") returned 3
	[0185.140] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.140] lstrlenW (lpString=".dbf") returned 4
	[0185.140] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.140] lstrlenW (lpString=".1cd") returned 4
	[0185.140] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0185.140] lstrlenW (lpString=".jpg") returned 4
	[0185.140] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.140] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.140] lstrlenW (lpString="MondoR_Subscription-ppd.xrm-ms") returned 30
	[0185.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.541] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=32361) returned 1
	[0185.552] CloseHandle (hObject=0x538) returned 1
	[0185.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 0x220
	[0185.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.553] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.553] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0185.554] GetLastError () returned 0x0
	[0185.554] ReadFile (in: hFile=0x538, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x7e69, lpOverlapped=0x0) returned 1
	[0185.556] WriteFile (in: hFile=0x444, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x7e70, lpOverlapped=0x0) returned 1
	[0185.557] ReadFile (in: hFile=0x538, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.557] WriteFile (in: hFile=0x444, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x110, lpOverlapped=0x0) returned 1
	[0185.557] SetEndOfFile (hFile=0x444) returned 1
	[0185.558] CloseHandle (hObject=0x444) returned 1
	[0185.558] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.558] SetEndOfFile (hFile=0x538) returned 1
	[0185.561] CloseHandle (hObject=0x538) returned 1
	[0185.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 1
	[0185.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.563] lstrlenW (lpString=".doc") returned 4
	[0185.563] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.563] lstrlenW (lpString=".docx") returned 5
	[0185.563] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.563] lstrlenW (lpString=".pdf") returned 4
	[0185.563] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.563] lstrlenW (lpString=".xls") returned 4
	[0185.563] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.563] lstrlenW (lpString=".xlsx") returned 5
	[0185.563] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.563] lstrlenW (lpString=".ppt") returned 4
	[0185.563] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.563] lstrlenW (lpString=".zip") returned 4
	[0185.563] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.563] lstrlenW (lpString=".rar") returned 4
	[0185.563] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.563] lstrlenW (lpString=".bz2") returned 4
	[0185.563] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.563] lstrlenW (lpString=".7z") returned 3
	[0185.563] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.563] lstrlenW (lpString=".dbf") returned 4
	[0185.563] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.563] lstrlenW (lpString=".1cd") returned 4
	[0185.564] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.564] lstrlenW (lpString=".jpg") returned 4
	[0185.564] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.564] lstrlenW (lpString=".doc") returned 4
	[0185.564] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.564] lstrlenW (lpString=".docx") returned 5
	[0185.564] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.564] lstrlenW (lpString=".pdf") returned 4
	[0185.564] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.564] lstrlenW (lpString=".xls") returned 4
	[0185.564] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.564] lstrlenW (lpString=".xlsx") returned 5
	[0185.564] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.564] lstrlenW (lpString=".ppt") returned 4
	[0185.564] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.564] lstrlenW (lpString=".zip") returned 4
	[0185.564] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.564] lstrlenW (lpString=".rar") returned 4
	[0185.564] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.564] lstrlenW (lpString=".bz2") returned 4
	[0185.564] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.564] lstrlenW (lpString=".7z") returned 3
	[0185.564] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.564] lstrlenW (lpString=".dbf") returned 4
	[0185.564] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.565] lstrlenW (lpString=".1cd") returned 4
	[0185.565] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0185.565] lstrlenW (lpString=".jpg") returned 4
	[0185.565] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.565] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.565] lstrlenW (lpString="MondoR_SubTest2-pl.xrm-ms") returned 25
	[0185.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.565] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11151) returned 1
	[0185.565] CloseHandle (hObject=0x538) returned 1
	[0185.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 0x220
	[0185.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.566] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.566] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0185.567] GetLastError () returned 0x0
	[0185.567] ReadFile (in: hFile=0x538, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2b8f, lpOverlapped=0x0) returned 1
	[0185.569] WriteFile (in: hFile=0x444, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0185.570] ReadFile (in: hFile=0x538, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.570] WriteFile (in: hFile=0x444, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x106, lpOverlapped=0x0) returned 1
	[0185.570] SetEndOfFile (hFile=0x444) returned 1
	[0185.570] CloseHandle (hObject=0x444) returned 1
	[0185.570] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.570] SetEndOfFile (hFile=0x538) returned 1
	[0185.573] CloseHandle (hObject=0x538) returned 1
	[0185.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 1
	[0185.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.574] lstrlenW (lpString=".doc") returned 4
	[0185.574] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.574] lstrlenW (lpString=".docx") returned 5
	[0185.574] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.574] lstrlenW (lpString=".pdf") returned 4
	[0185.574] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.574] lstrlenW (lpString=".xls") returned 4
	[0185.574] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.574] lstrlenW (lpString=".xlsx") returned 5
	[0185.574] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.574] lstrlenW (lpString=".ppt") returned 4
	[0185.574] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.574] lstrlenW (lpString=".zip") returned 4
	[0185.574] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.574] lstrlenW (lpString=".rar") returned 4
	[0185.574] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.574] lstrlenW (lpString=".bz2") returned 4
	[0185.574] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.574] lstrlenW (lpString=".7z") returned 3
	[0185.575] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.575] lstrlenW (lpString=".dbf") returned 4
	[0185.575] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.575] lstrlenW (lpString=".1cd") returned 4
	[0185.575] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.575] lstrlenW (lpString=".jpg") returned 4
	[0185.575] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.575] lstrlenW (lpString=".doc") returned 4
	[0185.575] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.575] lstrlenW (lpString=".docx") returned 5
	[0185.575] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.575] lstrlenW (lpString=".pdf") returned 4
	[0185.575] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.575] lstrlenW (lpString=".xls") returned 4
	[0185.575] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.575] lstrlenW (lpString=".xlsx") returned 5
	[0185.575] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.575] lstrlenW (lpString=".ppt") returned 4
	[0185.575] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.575] lstrlenW (lpString=".zip") returned 4
	[0185.575] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.575] lstrlenW (lpString=".rar") returned 4
	[0185.575] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.575] lstrlenW (lpString=".bz2") returned 4
	[0185.575] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.576] lstrlenW (lpString=".7z") returned 3
	[0185.576] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.576] lstrlenW (lpString=".dbf") returned 4
	[0185.576] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.576] lstrlenW (lpString=".1cd") returned 4
	[0185.576] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0185.576] lstrlenW (lpString=".jpg") returned 4
	[0185.576] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.576] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.576] lstrlenW (lpString="MondoR_SubTest2-ppd.xrm-ms") returned 26
	[0185.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.577] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=26525) returned 1
	[0185.577] CloseHandle (hObject=0x538) returned 1
	[0185.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 0x220
	[0185.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.577] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.577] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0185.578] GetLastError () returned 0x0
	[0185.578] ReadFile (in: hFile=0x538, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x679d, lpOverlapped=0x0) returned 1
	[0185.580] WriteFile (in: hFile=0x444, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0185.582] ReadFile (in: hFile=0x538, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.582] WriteFile (in: hFile=0x444, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x108, lpOverlapped=0x0) returned 1
	[0185.582] SetEndOfFile (hFile=0x444) returned 1
	[0185.582] CloseHandle (hObject=0x444) returned 1
	[0185.582] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.582] SetEndOfFile (hFile=0x538) returned 1
	[0185.585] CloseHandle (hObject=0x538) returned 1
	[0185.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 1
	[0185.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.586] lstrlenW (lpString=".doc") returned 4
	[0185.586] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.586] lstrlenW (lpString=".docx") returned 5
	[0185.586] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.586] lstrlenW (lpString=".pdf") returned 4
	[0185.586] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.587] lstrlenW (lpString=".xls") returned 4
	[0185.587] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.587] lstrlenW (lpString=".xlsx") returned 5
	[0185.587] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.587] lstrlenW (lpString=".ppt") returned 4
	[0185.587] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.587] lstrlenW (lpString=".zip") returned 4
	[0185.587] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.587] lstrlenW (lpString=".rar") returned 4
	[0185.587] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.587] lstrlenW (lpString=".bz2") returned 4
	[0185.587] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.587] lstrlenW (lpString=".7z") returned 3
	[0185.587] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.587] lstrlenW (lpString=".dbf") returned 4
	[0185.587] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.587] lstrlenW (lpString=".1cd") returned 4
	[0185.587] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.587] lstrlenW (lpString=".jpg") returned 4
	[0185.587] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.587] lstrlenW (lpString=".doc") returned 4
	[0185.587] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.587] lstrlenW (lpString=".docx") returned 5
	[0185.587] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.587] lstrlenW (lpString=".pdf") returned 4
	[0185.588] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.588] lstrlenW (lpString=".xls") returned 4
	[0185.588] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.588] lstrlenW (lpString=".xlsx") returned 5
	[0185.588] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.588] lstrlenW (lpString=".ppt") returned 4
	[0185.588] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.588] lstrlenW (lpString=".zip") returned 4
	[0185.588] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.588] lstrlenW (lpString=".rar") returned 4
	[0185.588] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.588] lstrlenW (lpString=".bz2") returned 4
	[0185.588] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.588] lstrlenW (lpString=".7z") returned 3
	[0185.588] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.588] lstrlenW (lpString=".dbf") returned 4
	[0185.588] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.588] lstrlenW (lpString=".1cd") returned 4
	[0185.588] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0185.588] lstrlenW (lpString=".jpg") returned 4
	[0185.588] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.588] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.589] lstrlenW (lpString="MondoR_SubTest2-ul-oob.xrm-ms") returned 29
	[0185.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.589] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11595) returned 1
	[0185.589] CloseHandle (hObject=0x538) returned 1
	[0185.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 0x220
	[0185.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.278] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.278] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0186.279] GetLastError () returned 0x0
	[0186.279] ReadFile (in: hFile=0x558, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d4b, lpOverlapped=0x0) returned 1
	[0186.280] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0186.282] ReadFile (in: hFile=0x558, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.282] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0186.282] SetEndOfFile (hFile=0x3e8) returned 1
	[0186.282] CloseHandle (hObject=0x3e8) returned 1
	[0186.282] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.282] SetEndOfFile (hFile=0x558) returned 1
	[0186.285] CloseHandle (hObject=0x558) returned 1
	[0186.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 1
	[0186.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.286] lstrlenW (lpString=".doc") returned 4
	[0186.286] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.286] lstrlenW (lpString=".docx") returned 5
	[0186.286] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.286] lstrlenW (lpString=".pdf") returned 4
	[0186.286] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.286] lstrlenW (lpString=".xls") returned 4
	[0186.286] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.286] lstrlenW (lpString=".xlsx") returned 5
	[0186.286] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.286] lstrlenW (lpString=".ppt") returned 4
	[0186.286] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.286] lstrlenW (lpString=".zip") returned 4
	[0186.286] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.286] lstrlenW (lpString=".rar") returned 4
	[0186.286] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.286] lstrlenW (lpString=".bz2") returned 4
	[0186.286] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.286] lstrlenW (lpString=".7z") returned 3
	[0186.286] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.287] lstrlenW (lpString=".dbf") returned 4
	[0186.287] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.287] lstrlenW (lpString=".1cd") returned 4
	[0186.287] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.287] lstrlenW (lpString=".jpg") returned 4
	[0186.287] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.287] lstrlenW (lpString=".doc") returned 4
	[0186.287] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.287] lstrlenW (lpString=".docx") returned 5
	[0186.287] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.287] lstrlenW (lpString=".pdf") returned 4
	[0186.287] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.287] lstrlenW (lpString=".xls") returned 4
	[0186.287] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.287] lstrlenW (lpString=".xlsx") returned 5
	[0186.287] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.287] lstrlenW (lpString=".ppt") returned 4
	[0186.287] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.287] lstrlenW (lpString=".zip") returned 4
	[0186.287] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.287] lstrlenW (lpString=".rar") returned 4
	[0186.287] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.287] lstrlenW (lpString=".bz2") returned 4
	[0186.287] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.287] lstrlenW (lpString=".7z") returned 3
	[0186.288] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.288] lstrlenW (lpString=".dbf") returned 4
	[0186.288] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.288] lstrlenW (lpString=".1cd") returned 4
	[0186.288] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0186.288] lstrlenW (lpString=".jpg") returned 4
	[0186.288] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.288] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.288] lstrlenW (lpString="MondoR_SubTrial-ppd.xrm-ms") returned 26
	[0186.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.289] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=26525) returned 1
	[0186.289] CloseHandle (hObject=0x558) returned 1
	[0186.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 0x220
	[0186.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.289] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.289] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0186.290] GetLastError () returned 0x0
	[0186.290] ReadFile (in: hFile=0x558, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x679d, lpOverlapped=0x0) returned 1
	[0186.292] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0186.293] ReadFile (in: hFile=0x558, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.294] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x108, lpOverlapped=0x0) returned 1
	[0186.294] SetEndOfFile (hFile=0x3e8) returned 1
	[0186.294] CloseHandle (hObject=0x3e8) returned 1
	[0186.294] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.294] SetEndOfFile (hFile=0x558) returned 1
	[0186.297] CloseHandle (hObject=0x558) returned 1
	[0186.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 1
	[0186.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.299] lstrlenW (lpString=".doc") returned 4
	[0186.299] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.299] lstrlenW (lpString=".docx") returned 5
	[0186.299] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.299] lstrlenW (lpString=".pdf") returned 4
	[0186.299] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.299] lstrlenW (lpString=".xls") returned 4
	[0186.299] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.299] lstrlenW (lpString=".xlsx") returned 5
	[0186.299] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.299] lstrlenW (lpString=".ppt") returned 4
	[0186.299] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.299] lstrlenW (lpString=".zip") returned 4
	[0186.299] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.299] lstrlenW (lpString=".rar") returned 4
	[0186.299] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.299] lstrlenW (lpString=".bz2") returned 4
	[0186.299] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.299] lstrlenW (lpString=".7z") returned 3
	[0186.299] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.299] lstrlenW (lpString=".dbf") returned 4
	[0186.299] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.299] lstrlenW (lpString=".1cd") returned 4
	[0186.299] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.299] lstrlenW (lpString=".jpg") returned 4
	[0186.299] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.300] lstrlenW (lpString=".doc") returned 4
	[0186.300] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.300] lstrlenW (lpString=".docx") returned 5
	[0186.300] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.300] lstrlenW (lpString=".pdf") returned 4
	[0186.300] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.300] lstrlenW (lpString=".xls") returned 4
	[0186.300] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.300] lstrlenW (lpString=".xlsx") returned 5
	[0186.300] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.300] lstrlenW (lpString=".ppt") returned 4
	[0186.300] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.300] lstrlenW (lpString=".zip") returned 4
	[0186.300] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.300] lstrlenW (lpString=".rar") returned 4
	[0186.300] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.300] lstrlenW (lpString=".bz2") returned 4
	[0186.300] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.300] lstrlenW (lpString=".7z") returned 3
	[0186.300] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.300] lstrlenW (lpString=".dbf") returned 4
	[0186.300] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.300] lstrlenW (lpString=".1cd") returned 4
	[0186.300] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0186.301] lstrlenW (lpString=".jpg") returned 4
	[0186.301] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.301] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.301] lstrlenW (lpString="MondoR_SubTrial-ul-oob.xrm-ms") returned 29
	[0186.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.301] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11596) returned 1
	[0186.301] CloseHandle (hObject=0x558) returned 1
	[0186.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 0x220
	[0186.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.302] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.302] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0186.303] GetLastError () returned 0x0
	[0186.303] ReadFile (in: hFile=0x558, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d4c, lpOverlapped=0x0) returned 1
	[0186.304] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0186.306] ReadFile (in: hFile=0x558, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.306] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0186.306] SetEndOfFile (hFile=0x3e8) returned 1
	[0186.306] CloseHandle (hObject=0x3e8) returned 1
	[0186.306] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.306] SetEndOfFile (hFile=0x558) returned 1
	[0186.309] CloseHandle (hObject=0x558) returned 1
	[0186.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 1
	[0186.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.310] lstrlenW (lpString=".doc") returned 4
	[0186.310] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.310] lstrlenW (lpString=".docx") returned 5
	[0186.310] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.310] lstrlenW (lpString=".pdf") returned 4
	[0186.310] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.310] lstrlenW (lpString=".xls") returned 4
	[0186.310] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.310] lstrlenW (lpString=".xlsx") returned 5
	[0186.310] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.310] lstrlenW (lpString=".ppt") returned 4
	[0186.310] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.310] lstrlenW (lpString=".zip") returned 4
	[0186.310] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.310] lstrlenW (lpString=".rar") returned 4
	[0186.310] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.310] lstrlenW (lpString=".bz2") returned 4
	[0186.310] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.310] lstrlenW (lpString=".7z") returned 3
	[0186.310] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.311] lstrlenW (lpString=".dbf") returned 4
	[0186.311] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.311] lstrlenW (lpString=".1cd") returned 4
	[0186.311] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.311] lstrlenW (lpString=".jpg") returned 4
	[0186.311] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.311] lstrlenW (lpString=".doc") returned 4
	[0186.311] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.311] lstrlenW (lpString=".docx") returned 5
	[0186.311] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.311] lstrlenW (lpString=".pdf") returned 4
	[0186.311] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.311] lstrlenW (lpString=".xls") returned 4
	[0186.311] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.311] lstrlenW (lpString=".xlsx") returned 5
	[0186.311] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.311] lstrlenW (lpString=".ppt") returned 4
	[0186.311] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.311] lstrlenW (lpString=".zip") returned 4
	[0186.311] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.311] lstrlenW (lpString=".rar") returned 4
	[0186.311] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.311] lstrlenW (lpString=".bz2") returned 4
	[0186.311] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.311] lstrlenW (lpString=".7z") returned 3
	[0186.312] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.312] lstrlenW (lpString=".dbf") returned 4
	[0186.312] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.312] lstrlenW (lpString=".1cd") returned 4
	[0186.312] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0186.312] lstrlenW (lpString=".jpg") returned 4
	[0186.312] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.312] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.312] lstrlenW (lpString="MondoR_SubTrial2-pl.xrm-ms") returned 26
	[0186.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.313] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11155) returned 1
	[0186.313] CloseHandle (hObject=0x558) returned 1
	[0186.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 0x220
	[0186.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.313] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.313] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0186.314] GetLastError () returned 0x0
	[0186.314] ReadFile (in: hFile=0x558, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2b93, lpOverlapped=0x0) returned 1
	[0186.495] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0186.496] ReadFile (in: hFile=0x558, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.496] WriteFile (in: hFile=0x3e8, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x108, lpOverlapped=0x0) returned 1
	[0186.496] SetEndOfFile (hFile=0x3e8) returned 1
	[0186.591] CloseHandle (hObject=0x3e8) returned 1
	[0186.592] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.592] SetEndOfFile (hFile=0x558) returned 1
	[0186.598] CloseHandle (hObject=0x558) returned 1
	[0186.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 1
	[0186.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.604] lstrlenW (lpString=".doc") returned 4
	[0186.604] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.605] lstrlenW (lpString=".docx") returned 5
	[0186.605] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.605] lstrlenW (lpString=".pdf") returned 4
	[0186.605] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.605] lstrlenW (lpString=".xls") returned 4
	[0186.605] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.605] lstrlenW (lpString=".xlsx") returned 5
	[0186.605] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.605] lstrlenW (lpString=".ppt") returned 4
	[0186.605] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.605] lstrlenW (lpString=".zip") returned 4
	[0186.605] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.605] lstrlenW (lpString=".rar") returned 4
	[0186.605] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.605] lstrlenW (lpString=".bz2") returned 4
	[0186.605] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.605] lstrlenW (lpString=".7z") returned 3
	[0186.605] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.605] lstrlenW (lpString=".dbf") returned 4
	[0186.605] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.605] lstrlenW (lpString=".1cd") returned 4
	[0186.606] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.606] lstrlenW (lpString=".jpg") returned 4
	[0186.606] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.606] lstrlenW (lpString=".doc") returned 4
	[0186.606] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.606] lstrlenW (lpString=".docx") returned 5
	[0186.606] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.606] lstrlenW (lpString=".pdf") returned 4
	[0186.606] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.606] lstrlenW (lpString=".xls") returned 4
	[0186.606] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.606] lstrlenW (lpString=".xlsx") returned 5
	[0186.606] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.606] lstrlenW (lpString=".ppt") returned 4
	[0186.606] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.606] lstrlenW (lpString=".zip") returned 4
	[0186.606] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.606] lstrlenW (lpString=".rar") returned 4
	[0186.606] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.606] lstrlenW (lpString=".bz2") returned 4
	[0186.606] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.606] lstrlenW (lpString=".7z") returned 3
	[0186.606] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.606] lstrlenW (lpString=".dbf") returned 4
	[0186.606] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.607] lstrlenW (lpString=".1cd") returned 4
	[0186.607] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0186.607] lstrlenW (lpString=".jpg") returned 4
	[0186.607] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.607] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.607] lstrlenW (lpString="MondoR_Trial-ppd.xrm-ms") returned 23
	[0186.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.608] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=26585) returned 1
	[0186.608] CloseHandle (hObject=0x53c) returned 1
	[0186.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 0x220
	[0186.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.609] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.609] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.609] GetLastError () returned 0x0
	[0186.609] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x67d9, lpOverlapped=0x0) returned 1
	[0186.611] WriteFile (in: hFile=0x558, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x67e0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x67e0, lpOverlapped=0x0) returned 1
	[0186.613] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.613] WriteFile (in: hFile=0x558, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x102, lpOverlapped=0x0) returned 1
	[0186.613] SetEndOfFile (hFile=0x558) returned 1
	[0186.613] CloseHandle (hObject=0x558) returned 1
	[0186.613] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.613] SetEndOfFile (hFile=0x53c) returned 1
	[0186.616] CloseHandle (hObject=0x53c) returned 1
	[0186.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 1
	[0186.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.617] lstrlenW (lpString=".doc") returned 4
	[0186.617] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.617] lstrlenW (lpString=".docx") returned 5
	[0186.617] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.617] lstrlenW (lpString=".pdf") returned 4
	[0186.617] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.617] lstrlenW (lpString=".xls") returned 4
	[0186.617] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.617] lstrlenW (lpString=".xlsx") returned 5
	[0186.617] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.617] lstrlenW (lpString=".ppt") returned 4
	[0186.617] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.617] lstrlenW (lpString=".zip") returned 4
	[0186.617] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.617] lstrlenW (lpString=".rar") returned 4
	[0186.617] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.617] lstrlenW (lpString=".bz2") returned 4
	[0186.617] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.617] lstrlenW (lpString=".7z") returned 3
	[0186.618] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.618] lstrlenW (lpString=".dbf") returned 4
	[0186.618] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.618] lstrlenW (lpString=".1cd") returned 4
	[0186.618] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.618] lstrlenW (lpString=".jpg") returned 4
	[0186.618] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.618] lstrlenW (lpString=".doc") returned 4
	[0186.618] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.618] lstrlenW (lpString=".docx") returned 5
	[0186.618] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.618] lstrlenW (lpString=".pdf") returned 4
	[0186.618] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.618] lstrlenW (lpString=".xls") returned 4
	[0186.618] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.618] lstrlenW (lpString=".xlsx") returned 5
	[0186.618] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.618] lstrlenW (lpString=".ppt") returned 4
	[0186.618] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.618] lstrlenW (lpString=".zip") returned 4
	[0186.618] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.618] lstrlenW (lpString=".rar") returned 4
	[0186.618] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.618] lstrlenW (lpString=".bz2") returned 4
	[0186.618] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.619] lstrlenW (lpString=".7z") returned 3
	[0186.619] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.619] lstrlenW (lpString=".dbf") returned 4
	[0186.619] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.619] lstrlenW (lpString=".1cd") returned 4
	[0186.619] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0186.619] lstrlenW (lpString=".jpg") returned 4
	[0186.619] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.619] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.619] lstrlenW (lpString="MondoR_Trial-ul-oob.xrm-ms") returned 26
	[0186.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.620] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11586) returned 1
	[0186.620] CloseHandle (hObject=0x53c) returned 1
	[0186.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 0x220
	[0186.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.620] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.620] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.621] GetLastError () returned 0x0
	[0186.621] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d42, lpOverlapped=0x0) returned 1
	[0186.623] WriteFile (in: hFile=0x558, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0186.624] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.624] WriteFile (in: hFile=0x558, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x108, lpOverlapped=0x0) returned 1
	[0186.624] SetEndOfFile (hFile=0x558) returned 1
	[0186.624] CloseHandle (hObject=0x558) returned 1
	[0186.624] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.624] SetEndOfFile (hFile=0x53c) returned 1
	[0186.627] CloseHandle (hObject=0x53c) returned 1
	[0186.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 1
	[0186.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.628] lstrlenW (lpString=".doc") returned 4
	[0186.628] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.628] lstrlenW (lpString=".docx") returned 5
	[0186.628] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.628] lstrlenW (lpString=".pdf") returned 4
	[0186.628] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.628] lstrlenW (lpString=".xls") returned 4
	[0186.628] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.628] lstrlenW (lpString=".xlsx") returned 5
	[0186.628] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.628] lstrlenW (lpString=".ppt") returned 4
	[0186.628] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.628] lstrlenW (lpString=".zip") returned 4
	[0186.628] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.628] lstrlenW (lpString=".rar") returned 4
	[0186.628] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.628] lstrlenW (lpString=".bz2") returned 4
	[0186.628] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.628] lstrlenW (lpString=".7z") returned 3
	[0186.628] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.628] lstrlenW (lpString=".dbf") returned 4
	[0186.628] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.628] lstrlenW (lpString=".1cd") returned 4
	[0186.628] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.629] lstrlenW (lpString=".jpg") returned 4
	[0186.629] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.629] lstrlenW (lpString=".doc") returned 4
	[0186.629] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.629] lstrlenW (lpString=".docx") returned 5
	[0186.629] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.629] lstrlenW (lpString=".pdf") returned 4
	[0186.629] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.629] lstrlenW (lpString=".xls") returned 4
	[0186.629] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.629] lstrlenW (lpString=".xlsx") returned 5
	[0186.629] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.629] lstrlenW (lpString=".ppt") returned 4
	[0186.629] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.629] lstrlenW (lpString=".zip") returned 4
	[0186.629] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.629] lstrlenW (lpString=".rar") returned 4
	[0186.629] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.629] lstrlenW (lpString=".bz2") returned 4
	[0186.629] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.629] lstrlenW (lpString=".7z") returned 3
	[0186.629] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.629] lstrlenW (lpString=".dbf") returned 4
	[0186.629] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.629] lstrlenW (lpString=".1cd") returned 4
	[0186.629] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0186.630] lstrlenW (lpString=".jpg") returned 4
	[0186.630] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.630] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.630] lstrlenW (lpString="MondoVL_KMS_Client-ppd.xrm-ms") returned 29
	[0186.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.737] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=12479) returned 1
	[0186.737] CloseHandle (hObject=0x53c) returned 1
	[0186.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 0x220
	[0186.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.738] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.738] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0186.739] GetLastError () returned 0x0
	[0186.739] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x30bf, lpOverlapped=0x0) returned 1
	[0186.741] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x30c0, lpOverlapped=0x0) returned 1
	[0186.742] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.742] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0186.742] SetEndOfFile (hFile=0x290) returned 1
	[0186.743] CloseHandle (hObject=0x290) returned 1
	[0186.743] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.743] SetEndOfFile (hFile=0x53c) returned 1
	[0186.745] CloseHandle (hObject=0x53c) returned 1
	[0186.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.746] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 1
	[0186.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.747] lstrlenW (lpString=".doc") returned 4
	[0186.747] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.747] lstrlenW (lpString=".docx") returned 5
	[0186.747] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.747] lstrlenW (lpString=".pdf") returned 4
	[0186.747] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.747] lstrlenW (lpString=".xls") returned 4
	[0186.747] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.747] lstrlenW (lpString=".xlsx") returned 5
	[0186.747] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.747] lstrlenW (lpString=".ppt") returned 4
	[0186.747] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.747] lstrlenW (lpString=".zip") returned 4
	[0186.747] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.747] lstrlenW (lpString=".rar") returned 4
	[0186.747] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.747] lstrlenW (lpString=".bz2") returned 4
	[0186.747] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.747] lstrlenW (lpString=".7z") returned 3
	[0186.747] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.747] lstrlenW (lpString=".dbf") returned 4
	[0186.747] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.747] lstrlenW (lpString=".1cd") returned 4
	[0186.747] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.747] lstrlenW (lpString=".jpg") returned 4
	[0186.747] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.748] lstrlenW (lpString=".doc") returned 4
	[0186.748] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.748] lstrlenW (lpString=".docx") returned 5
	[0186.748] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.748] lstrlenW (lpString=".pdf") returned 4
	[0186.748] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.748] lstrlenW (lpString=".xls") returned 4
	[0186.748] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.748] lstrlenW (lpString=".xlsx") returned 5
	[0186.748] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.748] lstrlenW (lpString=".ppt") returned 4
	[0186.748] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.748] lstrlenW (lpString=".zip") returned 4
	[0186.748] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.748] lstrlenW (lpString=".rar") returned 4
	[0186.748] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.748] lstrlenW (lpString=".bz2") returned 4
	[0186.748] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.748] lstrlenW (lpString=".7z") returned 3
	[0186.748] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.748] lstrlenW (lpString=".dbf") returned 4
	[0186.748] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.748] lstrlenW (lpString=".1cd") returned 4
	[0186.748] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0186.748] lstrlenW (lpString=".jpg") returned 4
	[0186.749] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.749] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.749] lstrlenW (lpString="MondoVL_MAK-ul-oob.xrm-ms") returned 25
	[0186.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.749] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11576) returned 1
	[0186.749] CloseHandle (hObject=0x53c) returned 1
	[0186.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 0x220
	[0186.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.750] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.750] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0186.751] GetLastError () returned 0x0
	[0186.751] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d38, lpOverlapped=0x0) returned 1
	[0186.752] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0186.753] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.753] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x106, lpOverlapped=0x0) returned 1
	[0186.754] SetEndOfFile (hFile=0x290) returned 1
	[0186.754] CloseHandle (hObject=0x290) returned 1
	[0186.754] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.754] SetEndOfFile (hFile=0x53c) returned 1
	[0186.757] CloseHandle (hObject=0x53c) returned 1
	[0186.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 1
	[0186.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.758] lstrlenW (lpString=".doc") returned 4
	[0186.758] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.758] lstrlenW (lpString=".docx") returned 5
	[0186.758] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.758] lstrlenW (lpString=".pdf") returned 4
	[0186.758] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.758] lstrlenW (lpString=".xls") returned 4
	[0186.758] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.758] lstrlenW (lpString=".xlsx") returned 5
	[0186.758] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.758] lstrlenW (lpString=".ppt") returned 4
	[0186.758] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.759] lstrlenW (lpString=".zip") returned 4
	[0186.759] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.759] lstrlenW (lpString=".rar") returned 4
	[0186.759] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.759] lstrlenW (lpString=".bz2") returned 4
	[0186.759] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.759] lstrlenW (lpString=".7z") returned 3
	[0186.759] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.759] lstrlenW (lpString=".dbf") returned 4
	[0186.759] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.759] lstrlenW (lpString=".1cd") returned 4
	[0186.759] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.759] lstrlenW (lpString=".jpg") returned 4
	[0186.759] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.759] lstrlenW (lpString=".doc") returned 4
	[0186.759] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.759] lstrlenW (lpString=".docx") returned 5
	[0186.759] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.759] lstrlenW (lpString=".pdf") returned 4
	[0186.759] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.759] lstrlenW (lpString=".xls") returned 4
	[0186.759] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.759] lstrlenW (lpString=".xlsx") returned 5
	[0186.759] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.759] lstrlenW (lpString=".ppt") returned 4
	[0186.760] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.760] lstrlenW (lpString=".zip") returned 4
	[0186.760] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.760] lstrlenW (lpString=".rar") returned 4
	[0186.760] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.760] lstrlenW (lpString=".bz2") returned 4
	[0186.760] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.760] lstrlenW (lpString=".7z") returned 3
	[0186.760] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.760] lstrlenW (lpString=".dbf") returned 4
	[0186.760] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.760] lstrlenW (lpString=".1cd") returned 4
	[0186.760] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0186.760] lstrlenW (lpString=".jpg") returned 4
	[0186.760] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.760] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.760] lstrlenW (lpString="MondoVL_MAK-ul-phn.xrm-ms") returned 25
	[0186.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.761] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=19921) returned 1
	[0186.761] CloseHandle (hObject=0x53c) returned 1
	[0186.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 0x220
	[0186.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.762] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.762] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0186.763] GetLastError () returned 0x0
	[0186.763] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x4dd1, lpOverlapped=0x0) returned 1
	[0186.764] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0186.765] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.765] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x106, lpOverlapped=0x0) returned 1
	[0186.766] SetEndOfFile (hFile=0x290) returned 1
	[0186.766] CloseHandle (hObject=0x290) returned 1
	[0186.766] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.766] SetEndOfFile (hFile=0x53c) returned 1
	[0186.768] CloseHandle (hObject=0x53c) returned 1
	[0186.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 1
	[0186.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.769] lstrlenW (lpString=".doc") returned 4
	[0186.769] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.769] lstrlenW (lpString=".docx") returned 5
	[0186.769] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.770] lstrlenW (lpString=".pdf") returned 4
	[0186.770] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.770] lstrlenW (lpString=".xls") returned 4
	[0186.770] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.770] lstrlenW (lpString=".xlsx") returned 5
	[0186.770] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.770] lstrlenW (lpString=".ppt") returned 4
	[0186.770] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.770] lstrlenW (lpString=".zip") returned 4
	[0186.770] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.770] lstrlenW (lpString=".rar") returned 4
	[0186.770] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.770] lstrlenW (lpString=".bz2") returned 4
	[0186.770] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.770] lstrlenW (lpString=".7z") returned 3
	[0186.770] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.770] lstrlenW (lpString=".dbf") returned 4
	[0186.770] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.770] lstrlenW (lpString=".1cd") returned 4
	[0186.770] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.770] lstrlenW (lpString=".jpg") returned 4
	[0186.770] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.770] lstrlenW (lpString=".doc") returned 4
	[0186.770] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.770] lstrlenW (lpString=".docx") returned 5
	[0186.771] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.771] lstrlenW (lpString=".pdf") returned 4
	[0186.771] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.771] lstrlenW (lpString=".xls") returned 4
	[0186.771] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.771] lstrlenW (lpString=".xlsx") returned 5
	[0186.771] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.771] lstrlenW (lpString=".ppt") returned 4
	[0186.771] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.771] lstrlenW (lpString=".zip") returned 4
	[0186.771] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.771] lstrlenW (lpString=".rar") returned 4
	[0186.771] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.771] lstrlenW (lpString=".bz2") returned 4
	[0186.771] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.771] lstrlenW (lpString=".7z") returned 3
	[0186.771] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.771] lstrlenW (lpString=".dbf") returned 4
	[0186.771] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.771] lstrlenW (lpString=".1cd") returned 4
	[0186.771] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0186.771] lstrlenW (lpString=".jpg") returned 4
	[0186.771] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.771] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.772] lstrlenW (lpString="O365BusinessR_Grace-ppd.xrm-ms") returned 30
	[0186.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.772] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=22400) returned 1
	[0186.772] CloseHandle (hObject=0x53c) returned 1
	[0186.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 0x220
	[0186.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.773] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.773] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0186.774] GetLastError () returned 0x0
	[0186.774] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x5780, lpOverlapped=0x0) returned 1
	[0186.971] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x5790, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x5790, lpOverlapped=0x0) returned 1
	[0186.974] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.974] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x110, lpOverlapped=0x0) returned 1
	[0186.974] SetEndOfFile (hFile=0x290) returned 1
	[0187.078] CloseHandle (hObject=0x290) returned 1
	[0187.087] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.087] SetEndOfFile (hFile=0x53c) returned 1
	[0187.090] CloseHandle (hObject=0x53c) returned 1
	[0187.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 1
	[0187.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.091] lstrlenW (lpString=".doc") returned 4
	[0187.091] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.091] lstrlenW (lpString=".docx") returned 5
	[0187.091] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.091] lstrlenW (lpString=".pdf") returned 4
	[0187.091] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.092] lstrlenW (lpString=".xls") returned 4
	[0187.092] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.092] lstrlenW (lpString=".xlsx") returned 5
	[0187.092] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.092] lstrlenW (lpString=".ppt") returned 4
	[0187.092] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.092] lstrlenW (lpString=".zip") returned 4
	[0187.092] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.092] lstrlenW (lpString=".rar") returned 4
	[0187.092] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.092] lstrlenW (lpString=".bz2") returned 4
	[0187.092] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.092] lstrlenW (lpString=".7z") returned 3
	[0187.092] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.092] lstrlenW (lpString=".dbf") returned 4
	[0187.092] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.092] lstrlenW (lpString=".1cd") returned 4
	[0187.092] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.092] lstrlenW (lpString=".jpg") returned 4
	[0187.092] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.092] lstrlenW (lpString=".doc") returned 4
	[0187.092] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.092] lstrlenW (lpString=".docx") returned 5
	[0187.092] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.093] lstrlenW (lpString=".pdf") returned 4
	[0187.093] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.093] lstrlenW (lpString=".xls") returned 4
	[0187.093] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.093] lstrlenW (lpString=".xlsx") returned 5
	[0187.093] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.093] lstrlenW (lpString=".ppt") returned 4
	[0187.093] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.093] lstrlenW (lpString=".zip") returned 4
	[0187.093] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.093] lstrlenW (lpString=".rar") returned 4
	[0187.093] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.093] lstrlenW (lpString=".bz2") returned 4
	[0187.093] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.093] lstrlenW (lpString=".7z") returned 3
	[0187.093] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.093] lstrlenW (lpString=".dbf") returned 4
	[0187.093] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.093] lstrlenW (lpString=".1cd") returned 4
	[0187.093] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0187.093] lstrlenW (lpString=".jpg") returned 4
	[0187.093] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.093] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.094] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 42
	[0187.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.094] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11219) returned 1
	[0187.094] CloseHandle (hObject=0x53c) returned 1
	[0187.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0187.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.095] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.095] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0187.096] GetLastError () returned 0x0
	[0187.096] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2bd3, lpOverlapped=0x0) returned 1
	[0187.097] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0187.098] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.099] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x128, lpOverlapped=0x0) returned 1
	[0187.099] SetEndOfFile (hFile=0x290) returned 1
	[0187.099] CloseHandle (hObject=0x290) returned 1
	[0187.099] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.099] SetEndOfFile (hFile=0x53c) returned 1
	[0187.101] CloseHandle (hObject=0x53c) returned 1
	[0187.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0187.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.106] lstrlenW (lpString=".doc") returned 4
	[0187.106] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.106] lstrlenW (lpString=".docx") returned 5
	[0187.106] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.106] lstrlenW (lpString=".pdf") returned 4
	[0187.107] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.107] lstrlenW (lpString=".xls") returned 4
	[0187.107] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.107] lstrlenW (lpString=".xlsx") returned 5
	[0187.107] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.107] lstrlenW (lpString=".ppt") returned 4
	[0187.107] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.107] lstrlenW (lpString=".zip") returned 4
	[0187.107] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.107] lstrlenW (lpString=".rar") returned 4
	[0187.107] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.107] lstrlenW (lpString=".bz2") returned 4
	[0187.107] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.107] lstrlenW (lpString=".7z") returned 3
	[0187.107] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.107] lstrlenW (lpString=".dbf") returned 4
	[0187.107] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.107] lstrlenW (lpString=".1cd") returned 4
	[0187.107] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.107] lstrlenW (lpString=".jpg") returned 4
	[0187.107] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.107] lstrlenW (lpString=".doc") returned 4
	[0187.107] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.107] lstrlenW (lpString=".docx") returned 5
	[0187.108] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.108] lstrlenW (lpString=".pdf") returned 4
	[0187.108] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.108] lstrlenW (lpString=".xls") returned 4
	[0187.108] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.108] lstrlenW (lpString=".xlsx") returned 5
	[0187.108] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.108] lstrlenW (lpString=".ppt") returned 4
	[0187.108] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.108] lstrlenW (lpString=".zip") returned 4
	[0187.108] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.108] lstrlenW (lpString=".rar") returned 4
	[0187.108] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.108] lstrlenW (lpString=".bz2") returned 4
	[0187.108] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.108] lstrlenW (lpString=".7z") returned 3
	[0187.108] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.108] lstrlenW (lpString=".dbf") returned 4
	[0187.108] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.108] lstrlenW (lpString=".1cd") returned 4
	[0187.108] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0187.108] lstrlenW (lpString=".jpg") returned 4
	[0187.108] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.109] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.109] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 43
	[0187.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.109] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=23207) returned 1
	[0187.109] CloseHandle (hObject=0x53c) returned 1
	[0187.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0187.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.110] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.110] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0187.111] GetLastError () returned 0x0
	[0187.111] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x5aa7, lpOverlapped=0x0) returned 1
	[0187.113] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x5ab0, lpOverlapped=0x0) returned 1
	[0187.114] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.114] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x12a, lpOverlapped=0x0) returned 1
	[0187.114] SetEndOfFile (hFile=0x290) returned 1
	[0187.115] CloseHandle (hObject=0x290) returned 1
	[0187.115] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.115] SetEndOfFile (hFile=0x53c) returned 1
	[0187.118] CloseHandle (hObject=0x53c) returned 1
	[0187.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0187.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.119] lstrlenW (lpString=".doc") returned 4
	[0187.119] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.119] lstrlenW (lpString=".docx") returned 5
	[0187.119] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.119] lstrlenW (lpString=".pdf") returned 4
	[0187.119] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.119] lstrlenW (lpString=".xls") returned 4
	[0187.119] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.119] lstrlenW (lpString=".xlsx") returned 5
	[0187.120] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.120] lstrlenW (lpString=".ppt") returned 4
	[0187.120] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.120] lstrlenW (lpString=".zip") returned 4
	[0187.120] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.120] lstrlenW (lpString=".rar") returned 4
	[0187.120] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.120] lstrlenW (lpString=".bz2") returned 4
	[0187.120] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.120] lstrlenW (lpString=".7z") returned 3
	[0187.120] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.120] lstrlenW (lpString=".dbf") returned 4
	[0187.120] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.120] lstrlenW (lpString=".1cd") returned 4
	[0187.120] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.120] lstrlenW (lpString=".jpg") returned 4
	[0187.120] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.120] lstrlenW (lpString=".doc") returned 4
	[0187.120] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.120] lstrlenW (lpString=".docx") returned 5
	[0187.120] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.120] lstrlenW (lpString=".pdf") returned 4
	[0187.120] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.120] lstrlenW (lpString=".xls") returned 4
	[0187.121] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.121] lstrlenW (lpString=".xlsx") returned 5
	[0187.121] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.121] lstrlenW (lpString=".ppt") returned 4
	[0187.121] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.121] lstrlenW (lpString=".zip") returned 4
	[0187.121] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.121] lstrlenW (lpString=".rar") returned 4
	[0187.121] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.121] lstrlenW (lpString=".bz2") returned 4
	[0187.121] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.121] lstrlenW (lpString=".7z") returned 3
	[0187.121] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.121] lstrlenW (lpString=".dbf") returned 4
	[0187.121] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.121] lstrlenW (lpString=".1cd") returned 4
	[0187.121] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0187.121] lstrlenW (lpString=".jpg") returned 4
	[0187.121] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.121] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.121] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46
	[0187.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.122] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11674) returned 1
	[0187.122] CloseHandle (hObject=0x53c) returned 1
	[0187.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0187.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.123] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.123] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0187.123] GetLastError () returned 0x0
	[0187.123] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d9a, lpOverlapped=0x0) returned 1
	[0187.354] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0187.355] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.355] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x130, lpOverlapped=0x0) returned 1
	[0187.355] SetEndOfFile (hFile=0x290) returned 1
	[0187.355] CloseHandle (hObject=0x290) returned 1
	[0187.355] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.355] SetEndOfFile (hFile=0x53c) returned 1
	[0187.358] CloseHandle (hObject=0x53c) returned 1
	[0187.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0187.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.359] lstrlenW (lpString=".doc") returned 4
	[0187.359] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.359] lstrlenW (lpString=".docx") returned 5
	[0187.359] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.359] lstrlenW (lpString=".pdf") returned 4
	[0187.359] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.359] lstrlenW (lpString=".xls") returned 4
	[0187.359] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.359] lstrlenW (lpString=".xlsx") returned 5
	[0187.359] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.359] lstrlenW (lpString=".ppt") returned 4
	[0187.359] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.359] lstrlenW (lpString=".zip") returned 4
	[0187.359] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.360] lstrlenW (lpString=".rar") returned 4
	[0187.360] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.360] lstrlenW (lpString=".bz2") returned 4
	[0187.360] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.360] lstrlenW (lpString=".7z") returned 3
	[0187.360] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.360] lstrlenW (lpString=".dbf") returned 4
	[0187.360] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.360] lstrlenW (lpString=".1cd") returned 4
	[0187.360] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.360] lstrlenW (lpString=".jpg") returned 4
	[0187.360] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.360] lstrlenW (lpString=".doc") returned 4
	[0187.360] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.360] lstrlenW (lpString=".docx") returned 5
	[0187.360] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.360] lstrlenW (lpString=".pdf") returned 4
	[0187.360] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.360] lstrlenW (lpString=".xls") returned 4
	[0187.360] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.360] lstrlenW (lpString=".xlsx") returned 5
	[0187.360] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.360] lstrlenW (lpString=".ppt") returned 4
	[0187.360] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.361] lstrlenW (lpString=".zip") returned 4
	[0187.361] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.361] lstrlenW (lpString=".rar") returned 4
	[0187.361] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.361] lstrlenW (lpString=".bz2") returned 4
	[0187.361] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.361] lstrlenW (lpString=".7z") returned 3
	[0187.361] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.361] lstrlenW (lpString=".dbf") returned 4
	[0187.361] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.361] lstrlenW (lpString=".1cd") returned 4
	[0187.361] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0187.361] lstrlenW (lpString=".jpg") returned 4
	[0187.361] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.361] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.361] lstrlenW (lpString="O365HomePremR_Subscription3-ppd.xrm-ms") returned 38
	[0187.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.362] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=26541) returned 1
	[0187.362] CloseHandle (hObject=0x53c) returned 1
	[0187.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 0x220
	[0187.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.362] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.363] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0187.363] GetLastError () returned 0x0
	[0187.363] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0187.365] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0187.366] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.367] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x120, lpOverlapped=0x0) returned 1
	[0187.367] SetEndOfFile (hFile=0x290) returned 1
	[0187.367] CloseHandle (hObject=0x290) returned 1
	[0187.367] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.367] SetEndOfFile (hFile=0x53c) returned 1
	[0187.381] CloseHandle (hObject=0x53c) returned 1
	[0187.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 1
	[0187.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.382] lstrlenW (lpString=".doc") returned 4
	[0187.382] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.382] lstrlenW (lpString=".docx") returned 5
	[0187.383] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.383] lstrlenW (lpString=".pdf") returned 4
	[0187.383] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.383] lstrlenW (lpString=".xls") returned 4
	[0187.383] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.383] lstrlenW (lpString=".xlsx") returned 5
	[0187.383] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.383] lstrlenW (lpString=".ppt") returned 4
	[0187.383] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.383] lstrlenW (lpString=".zip") returned 4
	[0187.383] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.383] lstrlenW (lpString=".rar") returned 4
	[0187.383] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.383] lstrlenW (lpString=".bz2") returned 4
	[0187.383] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.383] lstrlenW (lpString=".7z") returned 3
	[0187.383] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.383] lstrlenW (lpString=".dbf") returned 4
	[0187.383] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.383] lstrlenW (lpString=".1cd") returned 4
	[0187.383] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.383] lstrlenW (lpString=".jpg") returned 4
	[0187.383] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.383] lstrlenW (lpString=".doc") returned 4
	[0187.383] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.384] lstrlenW (lpString=".docx") returned 5
	[0187.384] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.384] lstrlenW (lpString=".pdf") returned 4
	[0187.384] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.384] lstrlenW (lpString=".xls") returned 4
	[0187.384] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.384] lstrlenW (lpString=".xlsx") returned 5
	[0187.384] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.384] lstrlenW (lpString=".ppt") returned 4
	[0187.384] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.384] lstrlenW (lpString=".zip") returned 4
	[0187.384] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.384] lstrlenW (lpString=".rar") returned 4
	[0187.384] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.384] lstrlenW (lpString=".bz2") returned 4
	[0187.384] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.384] lstrlenW (lpString=".7z") returned 3
	[0187.384] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.384] lstrlenW (lpString=".dbf") returned 4
	[0187.384] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.384] lstrlenW (lpString=".1cd") returned 4
	[0187.384] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0187.384] lstrlenW (lpString=".jpg") returned 4
	[0187.384] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.385] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.385] lstrlenW (lpString="O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 41
	[0187.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.385] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11651) returned 1
	[0187.385] CloseHandle (hObject=0x53c) returned 1
	[0187.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 0x220
	[0187.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.386] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.386] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0187.387] GetLastError () returned 0x0
	[0187.387] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0187.719] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0187.721] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.721] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x126, lpOverlapped=0x0) returned 1
	[0187.721] SetEndOfFile (hFile=0x290) returned 1
	[0187.721] CloseHandle (hObject=0x290) returned 1
	[0187.721] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.721] SetEndOfFile (hFile=0x53c) returned 1
	[0187.723] CloseHandle (hObject=0x53c) returned 1
	[0187.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 1
	[0187.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.725] lstrlenW (lpString=".doc") returned 4
	[0187.725] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.725] lstrlenW (lpString=".docx") returned 5
	[0187.725] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.725] lstrlenW (lpString=".pdf") returned 4
	[0187.725] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.725] lstrlenW (lpString=".xls") returned 4
	[0187.725] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.725] lstrlenW (lpString=".xlsx") returned 5
	[0187.725] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.725] lstrlenW (lpString=".ppt") returned 4
	[0187.725] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.725] lstrlenW (lpString=".zip") returned 4
	[0187.725] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.725] lstrlenW (lpString=".rar") returned 4
	[0187.725] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.725] lstrlenW (lpString=".bz2") returned 4
	[0187.725] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.725] lstrlenW (lpString=".7z") returned 3
	[0187.725] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.725] lstrlenW (lpString=".dbf") returned 4
	[0187.725] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.725] lstrlenW (lpString=".1cd") returned 4
	[0187.726] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.726] lstrlenW (lpString=".jpg") returned 4
	[0187.726] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.726] lstrlenW (lpString=".doc") returned 4
	[0187.726] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.726] lstrlenW (lpString=".docx") returned 5
	[0187.726] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.726] lstrlenW (lpString=".pdf") returned 4
	[0187.726] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.726] lstrlenW (lpString=".xls") returned 4
	[0187.726] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.726] lstrlenW (lpString=".xlsx") returned 5
	[0187.726] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.726] lstrlenW (lpString=".ppt") returned 4
	[0187.726] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.726] lstrlenW (lpString=".zip") returned 4
	[0187.726] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.726] lstrlenW (lpString=".rar") returned 4
	[0187.726] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.726] lstrlenW (lpString=".bz2") returned 4
	[0187.726] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.726] lstrlenW (lpString=".7z") returned 3
	[0187.726] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.726] lstrlenW (lpString=".dbf") returned 4
	[0187.726] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.727] lstrlenW (lpString=".1cd") returned 4
	[0187.727] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0187.727] lstrlenW (lpString=".jpg") returned 4
	[0187.727] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.727] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.727] lstrlenW (lpString="O365HomePremR_SubTest2-pl.xrm-ms") returned 32
	[0187.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.727] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11179) returned 1
	[0187.728] CloseHandle (hObject=0x53c) returned 1
	[0187.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 0x220
	[0187.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.728] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.728] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0187.729] GetLastError () returned 0x0
	[0187.729] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0187.732] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0187.733] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.733] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x114, lpOverlapped=0x0) returned 1
	[0187.733] SetEndOfFile (hFile=0x290) returned 1
	[0187.733] CloseHandle (hObject=0x290) returned 1
	[0187.733] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.733] SetEndOfFile (hFile=0x53c) returned 1
	[0187.736] CloseHandle (hObject=0x53c) returned 1
	[0187.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 1
	[0187.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.737] lstrlenW (lpString=".doc") returned 4
	[0187.737] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.737] lstrlenW (lpString=".docx") returned 5
	[0187.737] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.737] lstrlenW (lpString=".pdf") returned 4
	[0187.737] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.737] lstrlenW (lpString=".xls") returned 4
	[0187.737] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.737] lstrlenW (lpString=".xlsx") returned 5
	[0187.737] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.738] lstrlenW (lpString=".ppt") returned 4
	[0187.738] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.738] lstrlenW (lpString=".zip") returned 4
	[0187.738] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.738] lstrlenW (lpString=".rar") returned 4
	[0187.738] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.738] lstrlenW (lpString=".bz2") returned 4
	[0187.738] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.738] lstrlenW (lpString=".7z") returned 3
	[0187.738] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.738] lstrlenW (lpString=".dbf") returned 4
	[0187.738] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.738] lstrlenW (lpString=".1cd") returned 4
	[0187.738] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.738] lstrlenW (lpString=".jpg") returned 4
	[0187.738] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.738] lstrlenW (lpString=".doc") returned 4
	[0187.738] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.738] lstrlenW (lpString=".docx") returned 5
	[0187.738] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.738] lstrlenW (lpString=".pdf") returned 4
	[0187.738] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.738] lstrlenW (lpString=".xls") returned 4
	[0187.738] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.738] lstrlenW (lpString=".xlsx") returned 5
	[0187.739] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.739] lstrlenW (lpString=".ppt") returned 4
	[0187.739] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.739] lstrlenW (lpString=".zip") returned 4
	[0187.739] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.739] lstrlenW (lpString=".rar") returned 4
	[0187.739] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.739] lstrlenW (lpString=".bz2") returned 4
	[0187.739] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.739] lstrlenW (lpString=".7z") returned 3
	[0187.739] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.739] lstrlenW (lpString=".dbf") returned 4
	[0187.739] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.739] lstrlenW (lpString=".1cd") returned 4
	[0187.739] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0187.739] lstrlenW (lpString=".jpg") returned 4
	[0187.739] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.739] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.739] lstrlenW (lpString="O365HomePremR_SubTest2-ppd.xrm-ms") returned 33
	[0187.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.740] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=23134) returned 1
	[0187.740] CloseHandle (hObject=0x53c) returned 1
	[0187.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 0x220
	[0187.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.741] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.741] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0187.742] GetLastError () returned 0x0
	[0187.742] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0187.744] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0187.745] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.745] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x116, lpOverlapped=0x0) returned 1
	[0187.745] SetEndOfFile (hFile=0x290) returned 1
	[0187.745] CloseHandle (hObject=0x290) returned 1
	[0187.745] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.745] SetEndOfFile (hFile=0x53c) returned 1
	[0187.749] CloseHandle (hObject=0x53c) returned 1
	[0187.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 1
	[0187.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.750] lstrlenW (lpString=".doc") returned 4
	[0187.750] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.750] lstrlenW (lpString=".docx") returned 5
	[0187.750] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.750] lstrlenW (lpString=".pdf") returned 4
	[0187.750] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.750] lstrlenW (lpString=".xls") returned 4
	[0187.750] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.750] lstrlenW (lpString=".xlsx") returned 5
	[0187.750] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.750] lstrlenW (lpString=".ppt") returned 4
	[0187.750] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.750] lstrlenW (lpString=".zip") returned 4
	[0187.750] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.750] lstrlenW (lpString=".rar") returned 4
	[0187.750] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.750] lstrlenW (lpString=".bz2") returned 4
	[0187.750] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.750] lstrlenW (lpString=".7z") returned 3
	[0187.751] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.751] lstrlenW (lpString=".dbf") returned 4
	[0187.751] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.751] lstrlenW (lpString=".1cd") returned 4
	[0187.751] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.751] lstrlenW (lpString=".jpg") returned 4
	[0187.751] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.751] lstrlenW (lpString=".doc") returned 4
	[0187.751] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.751] lstrlenW (lpString=".docx") returned 5
	[0187.751] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.751] lstrlenW (lpString=".pdf") returned 4
	[0187.751] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.751] lstrlenW (lpString=".xls") returned 4
	[0187.751] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.751] lstrlenW (lpString=".xlsx") returned 5
	[0187.751] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.751] lstrlenW (lpString=".ppt") returned 4
	[0187.751] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.751] lstrlenW (lpString=".zip") returned 4
	[0187.751] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.751] lstrlenW (lpString=".rar") returned 4
	[0187.751] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.752] lstrlenW (lpString=".bz2") returned 4
	[0187.752] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.752] lstrlenW (lpString=".7z") returned 3
	[0187.752] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.752] lstrlenW (lpString=".dbf") returned 4
	[0187.752] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.752] lstrlenW (lpString=".1cd") returned 4
	[0187.752] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0187.752] lstrlenW (lpString=".jpg") returned 4
	[0187.752] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.752] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.752] lstrlenW (lpString="O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 36
	[0187.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.753] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11630) returned 1
	[0187.753] CloseHandle (hObject=0x53c) returned 1
	[0187.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 0x220
	[0187.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0187.753] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.754] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0187.754] GetLastError () returned 0x0
	[0187.754] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0188.079] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0188.080] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.080] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0188.080] SetEndOfFile (hFile=0x290) returned 1
	[0188.080] CloseHandle (hObject=0x290) returned 1
	[0188.080] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.080] SetEndOfFile (hFile=0x53c) returned 1
	[0188.083] CloseHandle (hObject=0x53c) returned 1
	[0188.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 1
	[0188.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.084] lstrlenW (lpString=".doc") returned 4
	[0188.084] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.084] lstrlenW (lpString=".docx") returned 5
	[0188.084] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.084] lstrlenW (lpString=".pdf") returned 4
	[0188.084] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.084] lstrlenW (lpString=".xls") returned 4
	[0188.084] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.084] lstrlenW (lpString=".xlsx") returned 5
	[0188.085] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.085] lstrlenW (lpString=".ppt") returned 4
	[0188.085] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.085] lstrlenW (lpString=".zip") returned 4
	[0188.085] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.085] lstrlenW (lpString=".rar") returned 4
	[0188.085] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.085] lstrlenW (lpString=".bz2") returned 4
	[0188.085] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.085] lstrlenW (lpString=".7z") returned 3
	[0188.085] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.085] lstrlenW (lpString=".dbf") returned 4
	[0188.085] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.085] lstrlenW (lpString=".1cd") returned 4
	[0188.085] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.085] lstrlenW (lpString=".jpg") returned 4
	[0188.085] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.085] lstrlenW (lpString=".doc") returned 4
	[0188.085] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.085] lstrlenW (lpString=".docx") returned 5
	[0188.085] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.085] lstrlenW (lpString=".pdf") returned 4
	[0188.085] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.085] lstrlenW (lpString=".xls") returned 4
	[0188.086] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.086] lstrlenW (lpString=".xlsx") returned 5
	[0188.086] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.086] lstrlenW (lpString=".ppt") returned 4
	[0188.086] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.086] lstrlenW (lpString=".zip") returned 4
	[0188.086] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.086] lstrlenW (lpString=".rar") returned 4
	[0188.086] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.086] lstrlenW (lpString=".bz2") returned 4
	[0188.086] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.086] lstrlenW (lpString=".7z") returned 3
	[0188.086] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.086] lstrlenW (lpString=".dbf") returned 4
	[0188.086] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.086] lstrlenW (lpString=".1cd") returned 4
	[0188.086] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0188.086] lstrlenW (lpString=".jpg") returned 4
	[0188.086] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.086] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0188.086] lstrlenW (lpString="O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 36
	[0188.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0188.087] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11630) returned 1
	[0188.087] CloseHandle (hObject=0x53c) returned 1
	[0188.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 0x220
	[0188.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0188.088] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.088] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0188.089] GetLastError () returned 0x0
	[0188.089] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0188.090] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0188.091] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.091] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0188.091] SetEndOfFile (hFile=0x290) returned 1
	[0188.092] CloseHandle (hObject=0x290) returned 1
	[0188.092] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.092] SetEndOfFile (hFile=0x53c) returned 1
	[0188.098] CloseHandle (hObject=0x53c) returned 1
	[0188.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 1
	[0188.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.100] lstrlenW (lpString=".doc") returned 4
	[0188.100] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.100] lstrlenW (lpString=".docx") returned 5
	[0188.100] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.100] lstrlenW (lpString=".pdf") returned 4
	[0188.100] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.100] lstrlenW (lpString=".xls") returned 4
	[0188.100] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.100] lstrlenW (lpString=".xlsx") returned 5
	[0188.100] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.100] lstrlenW (lpString=".ppt") returned 4
	[0188.100] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.100] lstrlenW (lpString=".zip") returned 4
	[0188.100] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.100] lstrlenW (lpString=".rar") returned 4
	[0188.100] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.100] lstrlenW (lpString=".bz2") returned 4
	[0188.100] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.100] lstrlenW (lpString=".7z") returned 3
	[0188.100] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.100] lstrlenW (lpString=".dbf") returned 4
	[0188.100] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.100] lstrlenW (lpString=".1cd") returned 4
	[0188.100] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.100] lstrlenW (lpString=".jpg") returned 4
	[0188.101] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.101] lstrlenW (lpString=".doc") returned 4
	[0188.101] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.101] lstrlenW (lpString=".docx") returned 5
	[0188.101] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.101] lstrlenW (lpString=".pdf") returned 4
	[0188.101] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.101] lstrlenW (lpString=".xls") returned 4
	[0188.101] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.101] lstrlenW (lpString=".xlsx") returned 5
	[0188.101] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.101] lstrlenW (lpString=".ppt") returned 4
	[0188.101] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.101] lstrlenW (lpString=".zip") returned 4
	[0188.101] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.101] lstrlenW (lpString=".rar") returned 4
	[0188.101] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.101] lstrlenW (lpString=".bz2") returned 4
	[0188.101] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.101] lstrlenW (lpString=".7z") returned 3
	[0188.101] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.101] lstrlenW (lpString=".dbf") returned 4
	[0188.101] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.101] lstrlenW (lpString=".1cd") returned 4
	[0188.101] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0188.102] lstrlenW (lpString=".jpg") returned 4
	[0188.102] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.102] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0188.102] lstrlenW (lpString="O365HomePremR_SubTrial1-pl.xrm-ms") returned 33
	[0188.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0188.102] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=11183) returned 1
	[0188.102] CloseHandle (hObject=0x53c) returned 1
	[0188.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 0x220
	[0188.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0188.103] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.103] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0188.104] GetLastError () returned 0x0
	[0188.104] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0188.105] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0188.106] ReadFile (in: hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesRead=0x36dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.106] WriteFile (in: hFile=0x290, lpBuffer=0x412d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x36dfc94, lpOverlapped=0x0 | out: lpBuffer=0x412d020*, lpNumberOfBytesWritten=0x36dfc94*=0x116, lpOverlapped=0x0) returned 1
	[0188.107] SetEndOfFile (hFile=0x290) returned 1
	[0188.107] CloseHandle (hObject=0x290) returned 1
	[0188.107] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.107] SetEndOfFile (hFile=0x53c) returned 1
	[0188.110] CloseHandle (hObject=0x53c) returned 1
	[0188.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 1
	[0188.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.111] lstrlenW (lpString=".doc") returned 4
	[0188.112] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.112] lstrlenW (lpString=".docx") returned 5
	[0188.112] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.112] lstrlenW (lpString=".pdf") returned 4
	[0188.112] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.112] lstrlenW (lpString=".xls") returned 4
	[0188.112] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.112] lstrlenW (lpString=".xlsx") returned 5
	[0188.112] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.112] lstrlenW (lpString=".ppt") returned 4
	[0188.112] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.112] lstrlenW (lpString=".zip") returned 4
	[0188.112] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.112] lstrlenW (lpString=".rar") returned 4
	[0188.112] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.112] lstrlenW (lpString=".bz2") returned 4
	[0188.112] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.112] lstrlenW (lpString=".7z") returned 3
	[0188.112] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.112] lstrlenW (lpString=".dbf") returned 4
	[0188.112] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.112] lstrlenW (lpString=".1cd") returned 4
	[0188.112] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.112] lstrlenW (lpString=".jpg") returned 4
	[0188.112] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.113] lstrlenW (lpString=".doc") returned 4
	[0188.113] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.113] lstrlenW (lpString=".docx") returned 5
	[0188.113] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.113] lstrlenW (lpString=".pdf") returned 4
	[0188.113] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.113] lstrlenW (lpString=".xls") returned 4
	[0188.113] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.113] lstrlenW (lpString=".xlsx") returned 5
	[0188.113] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.113] lstrlenW (lpString=".ppt") returned 4
	[0188.113] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.113] lstrlenW (lpString=".zip") returned 4
	[0188.113] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.113] lstrlenW (lpString=".rar") returned 4
	[0188.113] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.113] lstrlenW (lpString=".bz2") returned 4
	[0188.113] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.113] lstrlenW (lpString=".7z") returned 3
	[0188.113] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.113] lstrlenW (lpString=".dbf") returned 4
	[0188.113] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.113] lstrlenW (lpString=".1cd") returned 4
	[0188.113] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0188.113] lstrlenW (lpString=".jpg") returned 4
	[0188.113] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.114] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0188.114] lstrlenW (lpString="O365HomePremR_SubTrial1-ppd.xrm-ms") returned 34
	[0188.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0188.114] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36dff14 | out: lpFileSize=0x36dff14*=23135) returned 1
	[0188.114] CloseHandle (hObject=0x53c) returned 1
	[0188.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 0x220
	[0188.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0188.115] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.115] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0188.116] GetLastError () returned 0x0
	[0188.116] ReadFile (hFile=0x53c, lpBuffer=0x412d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36dfecc, lpOverlapped=0x0) 

Thread:
	id = 48
	os_tid = 0xe24

	[0153.951] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3e91978
	[0153.952] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3ea1980
	[0153.952] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e708
	[0153.952] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x571fb0
	[0153.952] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e720
	[0153.952] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x4234020
	[0153.955] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e540
	[0153.955] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e540, Size=0x20) returned 0x4f27f8
	[0153.955] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e738
	[0153.955] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e738, Size=0x20) returned 0x4f2668
	[0153.955] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0153.955] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0153.955] Wow64DisableWow64FsRedirection (in: OldValue=0x381ff50 | out: OldValue=0x381ff50*=0x0) returned 1
	[0153.955] lstrlenW (lpString="kernel32.dll") returned 12
	[0153.955] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f27f8 | out: hHeap=0x4c0000) returned 1
	[0153.955] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0153.955] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2668 | out: hHeap=0x4c0000) returned 1
	[0153.955] Sleep (dwMilliseconds=0x64) 
	[0154.277] lstrcmpiW (lpString1=".MARKER", lpString2=".money") returned -1
	[0154.277] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30
	[0154.277] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0154.280] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=0) returned 1
	[0154.280] CloseHandle (hObject=0x334) returned 1
	[0154.280] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.280] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.280] lstrlenW (lpString=".doc") returned 4
	[0154.280] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0154.281] lstrlenW (lpString=".docx") returned 5
	[0154.281] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0154.281] lstrlenW (lpString=".pdf") returned 4
	[0154.281] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0154.281] lstrlenW (lpString=".xls") returned 4
	[0154.281] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0154.281] lstrlenW (lpString=".xlsx") returned 5
	[0154.281] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0154.281] lstrlenW (lpString=".ppt") returned 4
	[0154.281] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0154.281] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.281] lstrlenW (lpString=".zip") returned 4
	[0154.281] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0154.281] lstrlenW (lpString=".rar") returned 4
	[0154.281] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0154.281] lstrlenW (lpString=".bz2") returned 4
	[0154.281] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0154.281] lstrlenW (lpString=".7z") returned 3
	[0154.281] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0154.281] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.281] lstrlenW (lpString=".dbf") returned 4
	[0154.281] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0154.281] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.281] lstrlenW (lpString=".1cd") returned 4
	[0154.281] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0154.281] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.281] lstrlenW (lpString=".jpg") returned 4
	[0154.281] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0154.281] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.281] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.282] lstrlenW (lpString=".doc") returned 4
	[0154.282] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0154.282] lstrlenW (lpString=".docx") returned 5
	[0154.282] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0154.282] lstrlenW (lpString=".pdf") returned 4
	[0154.282] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0154.282] lstrlenW (lpString=".xls") returned 4
	[0154.282] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0154.282] lstrlenW (lpString=".xlsx") returned 5
	[0154.282] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0154.282] lstrlenW (lpString=".ppt") returned 4
	[0154.282] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0154.282] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.282] lstrlenW (lpString=".zip") returned 4
	[0154.282] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0154.282] lstrlenW (lpString=".rar") returned 4
	[0154.282] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0154.282] lstrlenW (lpString=".bz2") returned 4
	[0154.282] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0154.282] lstrlenW (lpString=".7z") returned 3
	[0154.282] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0154.282] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.282] lstrlenW (lpString=".dbf") returned 4
	[0154.282] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0154.282] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.282] lstrlenW (lpString=".1cd") returned 4
	[0154.282] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0154.282] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0154.282] lstrlenW (lpString=".jpg") returned 4
	[0154.282] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0154.283] Sleep (dwMilliseconds=0x64) 
	[0154.438] Sleep (dwMilliseconds=0x64) 
	[0154.722] Sleep (dwMilliseconds=0x64) 
	[0155.029] Sleep (dwMilliseconds=0x64) 
	[0155.379] lstrlenW (lpString="BCD") returned 3
	[0155.379] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.379] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.379] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.379] lstrlenW (lpString=".doc") returned 4
	[0155.380] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0155.380] lstrlenW (lpString=".docx") returned 5
	[0155.380] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0155.380] lstrlenW (lpString=".pdf") returned 4
	[0155.380] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0155.380] lstrlenW (lpString=".xls") returned 4
	[0155.380] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0155.380] lstrlenW (lpString=".xlsx") returned 5
	[0155.380] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0155.380] lstrlenW (lpString=".ppt") returned 4
	[0155.380] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0155.380] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.380] lstrlenW (lpString=".zip") returned 4
	[0155.380] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0155.380] lstrlenW (lpString=".rar") returned 4
	[0155.380] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0155.380] lstrlenW (lpString=".bz2") returned 4
	[0155.380] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0155.380] lstrlenW (lpString=".7z") returned 3
	[0155.380] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0155.380] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.380] lstrlenW (lpString=".dbf") returned 4
	[0155.380] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0155.380] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.380] lstrlenW (lpString=".1cd") returned 4
	[0155.380] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0155.380] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.380] lstrlenW (lpString=".jpg") returned 4
	[0155.380] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0155.380] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.380] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.381] lstrlenW (lpString=".doc") returned 4
	[0155.381] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0155.381] lstrlenW (lpString=".docx") returned 5
	[0155.381] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0155.381] lstrlenW (lpString=".pdf") returned 4
	[0155.381] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0155.381] lstrlenW (lpString=".xls") returned 4
	[0155.381] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0155.381] lstrlenW (lpString=".xlsx") returned 5
	[0155.381] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0155.381] lstrlenW (lpString=".ppt") returned 4
	[0155.381] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0155.381] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.381] lstrlenW (lpString=".zip") returned 4
	[0155.381] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0155.381] lstrlenW (lpString=".rar") returned 4
	[0155.381] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0155.381] lstrlenW (lpString=".bz2") returned 4
	[0155.381] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0155.381] lstrlenW (lpString=".7z") returned 3
	[0155.381] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0155.381] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.381] lstrlenW (lpString=".dbf") returned 4
	[0155.381] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0155.381] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.381] lstrlenW (lpString=".1cd") returned 4
	[0155.381] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0155.381] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0155.381] lstrlenW (lpString=".jpg") returned 4
	[0155.381] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0155.382] lstrcmpiW (lpString1=".LOG1", lpString2=".money") returned -1
	[0155.382] lstrlenW (lpString="BCD.LOG1") returned 8
	[0155.382] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0155.383] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=0) returned 1
	[0155.383] CloseHandle (hObject=0x3ac) returned 1
	[0155.383] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.383] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.383] lstrlenW (lpString=".doc") returned 4
	[0155.383] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0155.383] lstrlenW (lpString=".docx") returned 5
	[0155.383] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0155.383] lstrlenW (lpString=".pdf") returned 4
	[0155.383] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0155.383] lstrlenW (lpString=".xls") returned 4
	[0155.383] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0155.383] lstrlenW (lpString=".xlsx") returned 5
	[0155.383] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0155.383] lstrlenW (lpString=".ppt") returned 4
	[0155.383] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0155.383] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.383] lstrlenW (lpString=".zip") returned 4
	[0155.383] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0155.383] lstrlenW (lpString=".rar") returned 4
	[0155.383] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0155.383] lstrlenW (lpString=".bz2") returned 4
	[0155.383] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0155.383] lstrlenW (lpString=".7z") returned 3
	[0155.383] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0155.383] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.383] lstrlenW (lpString=".dbf") returned 4
	[0155.384] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0155.384] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.384] lstrlenW (lpString=".1cd") returned 4
	[0155.384] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0155.384] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.384] lstrlenW (lpString=".jpg") returned 4
	[0155.384] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0155.384] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.384] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.384] lstrlenW (lpString=".doc") returned 4
	[0155.384] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0155.384] lstrlenW (lpString=".docx") returned 5
	[0155.384] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0155.384] lstrlenW (lpString=".pdf") returned 4
	[0155.384] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0155.384] lstrlenW (lpString=".xls") returned 4
	[0155.384] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0155.384] lstrlenW (lpString=".xlsx") returned 5
	[0155.384] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0155.384] lstrlenW (lpString=".ppt") returned 4
	[0155.384] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0155.384] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.384] lstrlenW (lpString=".zip") returned 4
	[0155.384] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0155.384] lstrlenW (lpString=".rar") returned 4
	[0155.384] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0155.384] lstrlenW (lpString=".bz2") returned 4
	[0155.384] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0155.384] lstrlenW (lpString=".7z") returned 3
	[0155.384] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0155.384] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.385] lstrlenW (lpString=".dbf") returned 4
	[0155.385] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0155.385] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.385] lstrlenW (lpString=".1cd") returned 4
	[0155.385] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0155.385] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0155.385] lstrlenW (lpString=".jpg") returned 4
	[0155.385] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0155.385] lstrcmpiW (lpString1=".LOG2", lpString2=".money") returned -1
	[0155.385] lstrlenW (lpString="BCD.LOG2") returned 8
	[0155.385] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0155.385] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=0) returned 1
	[0155.385] CloseHandle (hObject=0x3ac) returned 1
	[0155.385] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.385] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.385] lstrlenW (lpString=".doc") returned 4
	[0155.386] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0155.386] lstrlenW (lpString=".docx") returned 5
	[0155.386] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0155.386] lstrlenW (lpString=".pdf") returned 4
	[0155.386] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0155.386] lstrlenW (lpString=".xls") returned 4
	[0155.386] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0155.386] lstrlenW (lpString=".xlsx") returned 5
	[0155.386] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0155.386] lstrlenW (lpString=".ppt") returned 4
	[0155.386] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0155.386] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.386] lstrlenW (lpString=".zip") returned 4
	[0155.386] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0155.386] lstrlenW (lpString=".rar") returned 4
	[0155.386] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0155.386] lstrlenW (lpString=".bz2") returned 4
	[0155.386] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0155.386] lstrlenW (lpString=".7z") returned 3
	[0155.386] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0155.386] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.386] lstrlenW (lpString=".dbf") returned 4
	[0155.386] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0155.386] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.386] lstrlenW (lpString=".1cd") returned 4
	[0155.386] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0155.386] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.386] lstrlenW (lpString=".jpg") returned 4
	[0155.386] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0155.386] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.387] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.387] lstrlenW (lpString=".doc") returned 4
	[0155.387] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0155.387] lstrlenW (lpString=".docx") returned 5
	[0155.387] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0155.387] lstrlenW (lpString=".pdf") returned 4
	[0155.387] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0155.387] lstrlenW (lpString=".xls") returned 4
	[0155.387] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0155.387] lstrlenW (lpString=".xlsx") returned 5
	[0155.387] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0155.387] lstrlenW (lpString=".ppt") returned 4
	[0155.387] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0155.387] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.387] lstrlenW (lpString=".zip") returned 4
	[0155.387] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0155.387] lstrlenW (lpString=".rar") returned 4
	[0155.387] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0155.387] lstrlenW (lpString=".bz2") returned 4
	[0155.387] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0155.387] lstrlenW (lpString=".7z") returned 3
	[0155.387] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0155.387] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.387] lstrlenW (lpString=".dbf") returned 4
	[0155.387] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0155.387] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.387] lstrlenW (lpString=".1cd") returned 4
	[0155.387] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0155.387] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0155.387] lstrlenW (lpString=".jpg") returned 4
	[0155.387] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0155.388] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.388] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.388] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0155.388] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=77664) returned 1
	[0155.388] CloseHandle (hObject=0x3ac) returned 1
	[0155.388] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20
	[0155.388] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.388] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.388] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.388] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.388] lstrlenW (lpString=".doc") returned 4
	[0155.388] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.388] lstrlenW (lpString=".docx") returned 5
	[0155.388] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.389] lstrlenW (lpString=".pdf") returned 4
	[0155.389] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.389] lstrlenW (lpString=".xls") returned 4
	[0155.389] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.389] lstrlenW (lpString=".xlsx") returned 5
	[0155.389] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.389] lstrlenW (lpString=".ppt") returned 4
	[0155.389] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.389] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.389] lstrlenW (lpString=".zip") returned 4
	[0155.389] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.389] lstrlenW (lpString=".rar") returned 4
	[0155.389] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.389] lstrlenW (lpString=".bz2") returned 4
	[0155.389] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.389] lstrlenW (lpString=".7z") returned 3
	[0155.389] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.389] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.389] lstrlenW (lpString=".dbf") returned 4
	[0155.389] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.389] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.389] lstrlenW (lpString=".1cd") returned 4
	[0155.389] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.389] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.389] lstrlenW (lpString=".jpg") returned 4
	[0155.389] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.389] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.389] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.389] lstrlenW (lpString=".doc") returned 4
	[0155.389] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.389] lstrlenW (lpString=".docx") returned 5
	[0155.389] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.390] lstrlenW (lpString=".pdf") returned 4
	[0155.390] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.390] lstrlenW (lpString=".xls") returned 4
	[0155.390] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.390] lstrlenW (lpString=".xlsx") returned 5
	[0155.390] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.390] lstrlenW (lpString=".ppt") returned 4
	[0155.390] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.390] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.390] lstrlenW (lpString=".zip") returned 4
	[0155.390] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.390] lstrlenW (lpString=".rar") returned 4
	[0155.390] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.390] lstrlenW (lpString=".bz2") returned 4
	[0155.390] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.390] lstrlenW (lpString=".7z") returned 3
	[0155.390] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.390] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.390] lstrlenW (lpString=".dbf") returned 4
	[0155.390] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.390] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.390] lstrlenW (lpString=".1cd") returned 4
	[0155.390] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.390] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0155.390] lstrlenW (lpString=".jpg") returned 4
	[0155.390] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.390] Sleep (dwMilliseconds=0x64) 
	[0155.647] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.647] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.647] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0155.749] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=75616) returned 1
	[0155.749] CloseHandle (hObject=0x3e4) returned 1
	[0155.749] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20
	[0155.749] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.749] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.749] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.749] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.749] lstrlenW (lpString=".doc") returned 4
	[0155.749] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.749] lstrlenW (lpString=".docx") returned 5
	[0155.749] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.749] lstrlenW (lpString=".pdf") returned 4
	[0155.750] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.750] lstrlenW (lpString=".xls") returned 4
	[0155.750] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.750] lstrlenW (lpString=".xlsx") returned 5
	[0155.750] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.750] lstrlenW (lpString=".ppt") returned 4
	[0155.750] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.750] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.750] lstrlenW (lpString=".zip") returned 4
	[0155.750] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.750] lstrlenW (lpString=".rar") returned 4
	[0155.750] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.750] lstrlenW (lpString=".bz2") returned 4
	[0155.750] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.750] lstrlenW (lpString=".7z") returned 3
	[0155.750] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.750] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.750] lstrlenW (lpString=".dbf") returned 4
	[0155.750] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.750] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.750] lstrlenW (lpString=".1cd") returned 4
	[0155.750] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.750] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.750] lstrlenW (lpString=".jpg") returned 4
	[0155.750] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.750] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.750] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.750] lstrlenW (lpString=".doc") returned 4
	[0155.750] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.751] lstrlenW (lpString=".docx") returned 5
	[0155.751] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.751] lstrlenW (lpString=".pdf") returned 4
	[0155.751] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.751] lstrlenW (lpString=".xls") returned 4
	[0155.751] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.751] lstrlenW (lpString=".xlsx") returned 5
	[0155.751] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.751] lstrlenW (lpString=".ppt") returned 4
	[0155.751] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.751] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.751] lstrlenW (lpString=".zip") returned 4
	[0155.751] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.751] lstrlenW (lpString=".rar") returned 4
	[0155.751] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.751] lstrlenW (lpString=".bz2") returned 4
	[0155.751] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.751] lstrlenW (lpString=".7z") returned 3
	[0155.751] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.751] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.751] lstrlenW (lpString=".dbf") returned 4
	[0155.751] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.751] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.751] lstrlenW (lpString=".1cd") returned 4
	[0155.751] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.751] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0155.751] lstrlenW (lpString=".jpg") returned 4
	[0155.751] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.752] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.752] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.752] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0155.752] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=79200) returned 1
	[0155.752] CloseHandle (hObject=0x3e4) returned 1
	[0155.752] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20
	[0155.752] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.752] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.752] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.752] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.752] lstrlenW (lpString=".doc") returned 4
	[0155.753] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.753] lstrlenW (lpString=".docx") returned 5
	[0155.753] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.753] lstrlenW (lpString=".pdf") returned 4
	[0155.753] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.753] lstrlenW (lpString=".xls") returned 4
	[0155.753] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.753] lstrlenW (lpString=".xlsx") returned 5
	[0155.753] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.753] lstrlenW (lpString=".ppt") returned 4
	[0155.753] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.753] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.753] lstrlenW (lpString=".zip") returned 4
	[0155.753] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.753] lstrlenW (lpString=".rar") returned 4
	[0155.753] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.753] lstrlenW (lpString=".bz2") returned 4
	[0155.753] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.753] lstrlenW (lpString=".7z") returned 3
	[0155.753] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.753] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.753] lstrlenW (lpString=".dbf") returned 4
	[0155.753] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.753] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.753] lstrlenW (lpString=".1cd") returned 4
	[0155.753] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.753] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.753] lstrlenW (lpString=".jpg") returned 4
	[0155.753] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.753] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.754] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.754] lstrlenW (lpString=".doc") returned 4
	[0155.754] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.754] lstrlenW (lpString=".docx") returned 5
	[0155.754] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.754] lstrlenW (lpString=".pdf") returned 4
	[0155.754] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.754] lstrlenW (lpString=".xls") returned 4
	[0155.754] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.754] lstrlenW (lpString=".xlsx") returned 5
	[0155.754] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.754] lstrlenW (lpString=".ppt") returned 4
	[0155.754] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.754] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.754] lstrlenW (lpString=".zip") returned 4
	[0155.754] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.754] lstrlenW (lpString=".rar") returned 4
	[0155.754] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.754] lstrlenW (lpString=".bz2") returned 4
	[0155.754] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.754] lstrlenW (lpString=".7z") returned 3
	[0155.754] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.754] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.754] lstrlenW (lpString=".dbf") returned 4
	[0155.754] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.754] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.754] lstrlenW (lpString=".1cd") returned 4
	[0155.754] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.754] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0155.754] lstrlenW (lpString=".jpg") returned 4
	[0155.754] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.755] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.755] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0155.755] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0155.758] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=45984) returned 1
	[0155.758] CloseHandle (hObject=0x3e4) returned 1
	[0155.758] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20
	[0155.758] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.758] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.758] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29
	[0155.758] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29
	[0155.758] lstrlenW (lpString=".doc") returned 4
	[0155.758] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.758] lstrlenW (lpString=".docx") returned 5
	[0155.758] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.758] lstrlenW (lpString=".pdf") returned 4
	[0155.758] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.758] lstrlenW (lpString=".xls") returned 4
	[0155.758] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.758] lstrlenW (lpString=".xlsx") returned 5
	[0155.758] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.758] lstrlenW (lpString=".ppt") returned 4
	[0155.758] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.758] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29
	[0155.759] lstrlenW (lpString=".zip") returned 4
	[0155.759] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.759] lstrlenW (lpString=".rar") returned 4
	[0155.759] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.759] lstrlenW (lpString=".bz2") returned 4
	[0155.759] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.759] lstrlenW (lpString=".7z") returned 3
	[0155.759] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.759] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29
	[0155.759] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.759] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0155.773] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=46496) returned 1
	[0155.773] CloseHandle (hObject=0x3e4) returned 1
	[0155.773] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20
	[0155.773] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.773] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.773] Sleep (dwMilliseconds=0x64) 
	[0156.047] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0156.047] lstrlenW (lpString="msjh_boot.ttf") returned 13
	[0156.047] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.098] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=164347) returned 1
	[0156.100] CloseHandle (hObject=0x438) returned 1
	[0156.101] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20
	[0156.110] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.114] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.121] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.121] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.121] lstrlenW (lpString=".doc") returned 4
	[0156.121] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0156.121] lstrlenW (lpString=".docx") returned 5
	[0156.121] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0156.121] lstrlenW (lpString=".pdf") returned 4
	[0156.121] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0156.121] lstrlenW (lpString=".xls") returned 4
	[0156.121] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0156.121] lstrlenW (lpString=".xlsx") returned 5
	[0156.122] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0156.122] lstrlenW (lpString=".ppt") returned 4
	[0156.122] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0156.122] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.122] lstrlenW (lpString=".zip") returned 4
	[0156.122] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0156.122] lstrlenW (lpString=".rar") returned 4
	[0156.122] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0156.122] lstrlenW (lpString=".bz2") returned 4
	[0156.122] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0156.122] lstrlenW (lpString=".7z") returned 3
	[0156.122] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0156.122] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.122] lstrlenW (lpString=".dbf") returned 4
	[0156.122] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0156.122] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.122] lstrlenW (lpString=".1cd") returned 4
	[0156.122] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0156.122] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.122] lstrlenW (lpString=".jpg") returned 4
	[0156.122] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0156.122] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.122] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.122] lstrlenW (lpString=".doc") returned 4
	[0156.122] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0156.122] lstrlenW (lpString=".docx") returned 5
	[0156.122] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0156.122] lstrlenW (lpString=".pdf") returned 4
	[0156.122] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0156.122] lstrlenW (lpString=".xls") returned 4
	[0156.122] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0156.123] lstrlenW (lpString=".xlsx") returned 5
	[0156.123] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0156.123] lstrlenW (lpString=".ppt") returned 4
	[0156.123] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0156.123] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.123] lstrlenW (lpString=".zip") returned 4
	[0156.123] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0156.123] lstrlenW (lpString=".rar") returned 4
	[0156.123] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0156.123] lstrlenW (lpString=".bz2") returned 4
	[0156.123] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0156.123] lstrlenW (lpString=".7z") returned 3
	[0156.123] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0156.123] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.123] lstrlenW (lpString=".dbf") returned 4
	[0156.123] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0156.123] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.123] lstrlenW (lpString=".1cd") returned 4
	[0156.123] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0156.123] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0156.123] lstrlenW (lpString=".jpg") returned 4
	[0156.123] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0156.123] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0156.123] lstrlenW (lpString="FlickLearningWizard.exe") returned 23
	[0156.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.124] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=804864) returned 1
	[0156.124] CloseHandle (hObject=0x438) returned 1
	[0156.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20
	[0156.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.125] lstrlenW (lpString=".doc") returned 4
	[0156.125] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0156.125] lstrlenW (lpString=".docx") returned 5
	[0156.125] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1
	[0156.125] lstrlenW (lpString=".pdf") returned 4
	[0156.125] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0156.125] lstrlenW (lpString=".xls") returned 4
	[0156.125] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0156.125] lstrlenW (lpString=".xlsx") returned 5
	[0156.125] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1
	[0156.125] lstrlenW (lpString=".ppt") returned 4
	[0156.125] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0156.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.125] lstrlenW (lpString=".zip") returned 4
	[0156.125] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0156.125] lstrlenW (lpString=".rar") returned 4
	[0156.125] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0156.125] lstrlenW (lpString=".bz2") returned 4
	[0156.125] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0156.125] lstrlenW (lpString=".7z") returned 3
	[0156.125] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0156.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.125] lstrlenW (lpString=".dbf") returned 4
	[0156.126] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0156.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.126] lstrlenW (lpString=".1cd") returned 4
	[0156.126] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0156.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.126] lstrlenW (lpString=".jpg") returned 4
	[0156.126] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0156.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.126] lstrlenW (lpString=".doc") returned 4
	[0156.126] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0156.126] lstrlenW (lpString=".docx") returned 5
	[0156.126] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1
	[0156.126] lstrlenW (lpString=".pdf") returned 4
	[0156.126] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0156.126] lstrlenW (lpString=".xls") returned 4
	[0156.126] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0156.126] lstrlenW (lpString=".xlsx") returned 5
	[0156.126] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1
	[0156.126] lstrlenW (lpString=".ppt") returned 4
	[0156.126] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0156.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.126] lstrlenW (lpString=".zip") returned 4
	[0156.126] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0156.126] lstrlenW (lpString=".rar") returned 4
	[0156.126] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0156.126] lstrlenW (lpString=".bz2") returned 4
	[0156.126] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0156.126] lstrlenW (lpString=".7z") returned 3
	[0156.126] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0156.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.126] lstrlenW (lpString=".dbf") returned 4
	[0156.127] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0156.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.127] lstrlenW (lpString=".1cd") returned 4
	[0156.127] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0156.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74
	[0156.127] lstrlenW (lpString=".jpg") returned 4
	[0156.127] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0156.127] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0156.127] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0156.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0156.128] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11264) returned 1
	[0156.128] CloseHandle (hObject=0x43c) returned 1
	[0156.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20
	[0156.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.128] lstrlenW (lpString=".doc") returned 4
	[0156.128] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0156.128] lstrlenW (lpString=".docx") returned 5
	[0156.128] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0156.128] lstrlenW (lpString=".pdf") returned 4
	[0156.129] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0156.129] lstrlenW (lpString=".xls") returned 4
	[0156.129] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0156.129] lstrlenW (lpString=".xlsx") returned 5
	[0156.129] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0156.129] lstrlenW (lpString=".ppt") returned 4
	[0156.129] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0156.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.129] lstrlenW (lpString=".zip") returned 4
	[0156.129] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0156.129] lstrlenW (lpString=".rar") returned 4
	[0156.129] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0156.129] lstrlenW (lpString=".bz2") returned 4
	[0156.129] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0156.129] lstrlenW (lpString=".7z") returned 3
	[0156.129] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0156.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.129] lstrlenW (lpString=".dbf") returned 4
	[0156.129] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0156.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.129] lstrlenW (lpString=".1cd") returned 4
	[0156.129] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0156.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.129] lstrlenW (lpString=".jpg") returned 4
	[0156.129] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0156.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.129] lstrlenW (lpString=".doc") returned 4
	[0156.129] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0156.129] lstrlenW (lpString=".docx") returned 5
	[0156.129] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0156.129] lstrlenW (lpString=".pdf") returned 4
	[0156.130] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0156.130] lstrlenW (lpString=".xls") returned 4
	[0156.130] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0156.130] lstrlenW (lpString=".xlsx") returned 5
	[0156.130] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0156.130] lstrlenW (lpString=".ppt") returned 4
	[0156.130] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0156.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.130] lstrlenW (lpString=".zip") returned 4
	[0156.130] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0156.130] lstrlenW (lpString=".rar") returned 4
	[0156.130] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0156.130] lstrlenW (lpString=".bz2") returned 4
	[0156.130] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0156.130] lstrlenW (lpString=".7z") returned 3
	[0156.130] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0156.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.130] lstrlenW (lpString=".dbf") returned 4
	[0156.130] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0156.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.130] lstrlenW (lpString=".1cd") returned 4
	[0156.130] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0156.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0156.130] lstrlenW (lpString=".jpg") returned 4
	[0156.130] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0156.130] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0156.130] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0156.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0156.131] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11264) returned 1
	[0156.131] CloseHandle (hObject=0x43c) returned 1
	[0156.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20
	[0156.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.132] lstrlenW (lpString=".doc") returned 4
	[0156.132] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0156.132] lstrlenW (lpString=".docx") returned 5
	[0156.132] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0156.132] lstrlenW (lpString=".pdf") returned 4
	[0156.132] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0156.132] lstrlenW (lpString=".xls") returned 4
	[0156.132] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0156.132] lstrlenW (lpString=".xlsx") returned 5
	[0156.132] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0156.132] lstrlenW (lpString=".ppt") returned 4
	[0156.132] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0156.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.132] lstrlenW (lpString=".zip") returned 4
	[0156.132] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0156.132] lstrlenW (lpString=".rar") returned 4
	[0156.132] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0156.132] lstrlenW (lpString=".bz2") returned 4
	[0156.132] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0156.132] lstrlenW (lpString=".7z") returned 3
	[0156.132] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0156.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.132] lstrlenW (lpString=".dbf") returned 4
	[0156.133] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0156.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.133] lstrlenW (lpString=".1cd") returned 4
	[0156.133] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0156.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.133] lstrlenW (lpString=".jpg") returned 4
	[0156.133] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0156.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.133] lstrlenW (lpString=".doc") returned 4
	[0156.133] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0156.133] lstrlenW (lpString=".docx") returned 5
	[0156.133] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0156.133] lstrlenW (lpString=".pdf") returned 4
	[0156.133] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0156.133] lstrlenW (lpString=".xls") returned 4
	[0156.133] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0156.133] lstrlenW (lpString=".xlsx") returned 5
	[0156.133] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0156.133] lstrlenW (lpString=".ppt") returned 4
	[0156.133] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0156.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.133] lstrlenW (lpString=".zip") returned 4
	[0156.133] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0156.133] lstrlenW (lpString=".rar") returned 4
	[0156.133] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0156.133] lstrlenW (lpString=".bz2") returned 4
	[0156.133] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0156.133] lstrlenW (lpString=".7z") returned 3
	[0156.133] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0156.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.134] lstrlenW (lpString=".dbf") returned 4
	[0156.134] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0156.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.134] lstrlenW (lpString=".1cd") returned 4
	[0156.134] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0156.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72
	[0156.134] lstrlenW (lpString=".jpg") returned 4
	[0156.134] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0156.134] Sleep (dwMilliseconds=0x64) 
	[0156.382] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0156.384] lstrlenW (lpString="msadcor.dll.mui") returned 15
	[0156.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0156.398] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=6144) returned 1
	[0156.398] CloseHandle (hObject=0x44c) returned 1
	[0156.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20
	[0156.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.399] lstrlenW (lpString=".doc") returned 4
	[0156.399] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0156.399] lstrlenW (lpString=".docx") returned 5
	[0156.399] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0156.399] lstrlenW (lpString=".pdf") returned 4
	[0156.399] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0156.399] lstrlenW (lpString=".xls") returned 4
	[0156.399] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0156.399] lstrlenW (lpString=".xlsx") returned 5
	[0156.399] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0156.399] lstrlenW (lpString=".ppt") returned 4
	[0156.399] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0156.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.399] lstrlenW (lpString=".zip") returned 4
	[0156.399] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0156.399] lstrlenW (lpString=".rar") returned 4
	[0156.399] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0156.399] lstrlenW (lpString=".bz2") returned 4
	[0156.399] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0156.399] lstrlenW (lpString=".7z") returned 3
	[0156.399] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0156.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.399] lstrlenW (lpString=".dbf") returned 4
	[0156.399] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0156.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.399] lstrlenW (lpString=".1cd") returned 4
	[0156.399] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0156.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.400] lstrlenW (lpString=".jpg") returned 4
	[0156.400] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0156.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.400] lstrlenW (lpString=".doc") returned 4
	[0156.400] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0156.400] lstrlenW (lpString=".docx") returned 5
	[0156.400] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0156.400] lstrlenW (lpString=".pdf") returned 4
	[0156.400] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0156.400] lstrlenW (lpString=".xls") returned 4
	[0156.400] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0156.400] lstrlenW (lpString=".xlsx") returned 5
	[0156.400] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0156.400] lstrlenW (lpString=".ppt") returned 4
	[0156.400] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0156.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.400] lstrlenW (lpString=".zip") returned 4
	[0156.400] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0156.400] lstrlenW (lpString=".rar") returned 4
	[0156.400] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0156.400] lstrlenW (lpString=".bz2") returned 4
	[0156.400] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0156.400] lstrlenW (lpString=".7z") returned 3
	[0156.400] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0156.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.400] lstrlenW (lpString=".dbf") returned 4
	[0156.400] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0156.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.400] lstrlenW (lpString=".1cd") returned 4
	[0156.401] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0156.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64
	[0156.401] lstrlenW (lpString=".jpg") returned 4
	[0156.401] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0156.401] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0156.401] lstrlenW (lpString="wab32res.dll") returned 12
	[0156.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0156.403] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=964096) returned 1
	[0156.403] CloseHandle (hObject=0x44c) returned 1
	[0156.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20
	[0156.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.403] lstrlenW (lpString=".doc") returned 4
	[0156.403] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.403] lstrlenW (lpString=".docx") returned 5
	[0156.403] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0156.403] lstrlenW (lpString=".pdf") returned 4
	[0156.403] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.403] lstrlenW (lpString=".xls") returned 4
	[0156.403] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.404] lstrlenW (lpString=".xlsx") returned 5
	[0156.404] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0156.404] lstrlenW (lpString=".ppt") returned 4
	[0156.404] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.404] lstrlenW (lpString=".zip") returned 4
	[0156.404] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.404] lstrlenW (lpString=".rar") returned 4
	[0156.404] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.404] lstrlenW (lpString=".bz2") returned 4
	[0156.404] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.404] lstrlenW (lpString=".7z") returned 3
	[0156.404] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.404] lstrlenW (lpString=".dbf") returned 4
	[0156.404] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.404] lstrlenW (lpString=".1cd") returned 4
	[0156.404] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.404] lstrlenW (lpString=".jpg") returned 4
	[0156.404] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.404] lstrlenW (lpString=".doc") returned 4
	[0156.404] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.404] lstrlenW (lpString=".docx") returned 5
	[0156.404] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0156.404] lstrlenW (lpString=".pdf") returned 4
	[0156.404] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.404] lstrlenW (lpString=".xls") returned 4
	[0156.405] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.405] lstrlenW (lpString=".xlsx") returned 5
	[0156.405] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0156.405] lstrlenW (lpString=".ppt") returned 4
	[0156.405] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.405] lstrlenW (lpString=".zip") returned 4
	[0156.405] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.405] lstrlenW (lpString=".rar") returned 4
	[0156.405] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.405] lstrlenW (lpString=".bz2") returned 4
	[0156.405] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.405] lstrlenW (lpString=".7z") returned 3
	[0156.405] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.405] lstrlenW (lpString=".dbf") returned 4
	[0156.405] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.405] lstrlenW (lpString=".1cd") returned 4
	[0156.405] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49
	[0156.405] lstrlenW (lpString=".jpg") returned 4
	[0156.405] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.405] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0156.405] lstrlenW (lpString="iexplore.exe.mui") returned 16
	[0156.405] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0156.406] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=5632) returned 1
	[0156.406] CloseHandle (hObject=0x44c) returned 1
	[0156.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20
	[0156.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.407] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.407] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57
	[0156.407] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57
	[0156.407] lstrlenW (lpString=".doc") returned 4
	[0156.407] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0156.407] lstrlenW (lpString=".docx") returned 5
	[0156.407] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0156.407] lstrlenW (lpString=".pdf") returned 4
	[0156.407] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0156.407] lstrlenW (lpString=".xls") returned 4
	[0156.407] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0156.407] lstrlenW (lpString=".xlsx") returned 5
	[0156.407] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0156.407] lstrlenW (lpString=".ppt") returned 4
	[0156.407] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0156.407] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57
	[0156.407] lstrlenW (lpString=".zip") returned 4
	[0156.407] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0156.407] lstrlenW (lpString=".rar") returned 4
	[0156.407] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0156.407] lstrlenW (lpString=".bz2") returned 4
	[0156.407] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0156.407] lstrlenW (lpString=".7z") returned 3
	[0156.407] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0156.407] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57
	[0156.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1
	[0160.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[admin@stex777.com].money")) returned 1
	[0160.577] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0160.578] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fc64 | out: lpNewFilePointer=0x0) returned 1
	[0160.578] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fc24 | out: lpNewFilePointer=0x0) returned 1
	[0160.578] ReadFile (in: hFile=0x44c, lpBuffer=0x4234058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x381fc30, lpOverlapped=0x0 | out: lpBuffer=0x4234058*, lpNumberOfBytesRead=0x381fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0160.587] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x381fc24 | out: lpNewFilePointer=0x0) returned 1
	[0160.587] ReadFile (in: hFile=0x44c, lpBuffer=0x4274058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x381fc30, lpOverlapped=0x0 | out: lpBuffer=0x4274058*, lpNumberOfBytesRead=0x381fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0160.595] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x381fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0160.595] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x381fc24 | out: lpNewFilePointer=0x0) returned 1
	[0160.595] ReadFile (in: hFile=0x44c, lpBuffer=0x42b4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x381fc30, lpOverlapped=0x0 | out: lpBuffer=0x42b4058*, lpNumberOfBytesRead=0x381fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0160.733] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.733] WriteFile (in: hFile=0x44c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x381fca8, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fca8*=0xc0102, lpOverlapped=0x0) returned 1
	[0160.750] SetEndOfFile (hFile=0x44c) returned 1
	[0160.750] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x45fe9f0
	[0160.772] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fc74 | out: lpNewFilePointer=0x0) returned 1
	[0160.772] WriteFile (in: hFile=0x44c, lpBuffer=0x45fe9f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x381fc80, lpOverlapped=0x0 | out: lpBuffer=0x45fe9f0*, lpNumberOfBytesWritten=0x381fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0160.773] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x381fc74 | out: lpNewFilePointer=0x0) returned 1
	[0160.773] WriteFile (in: hFile=0x44c, lpBuffer=0x45fe9f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x381fc80, lpOverlapped=0x0 | out: lpBuffer=0x45fe9f0*, lpNumberOfBytesWritten=0x381fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0160.778] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x381fc74 | out: lpNewFilePointer=0x0) returned 1
	[0160.778] WriteFile (in: hFile=0x44c, lpBuffer=0x45fe9f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x381fc80, lpOverlapped=0x0 | out: lpBuffer=0x45fe9f0*, lpNumberOfBytesWritten=0x381fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0160.780] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45fe9f0 | out: hHeap=0x4c0000) returned 1
	[0160.782] CloseHandle (hObject=0x44c) returned 1
	[0160.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x21) returned 1
	[0161.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.108] lstrlenW (lpString=".doc") returned 4
	[0161.108] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1
	[0161.108] lstrlenW (lpString=".docx") returned 5
	[0161.108] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1
	[0161.108] lstrlenW (lpString=".pdf") returned 4
	[0161.108] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1
	[0161.108] lstrlenW (lpString=".xls") returned 4
	[0161.108] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1
	[0161.108] lstrlenW (lpString=".xlsx") returned 5
	[0161.108] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1
	[0161.108] lstrlenW (lpString=".ppt") returned 4
	[0161.108] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1
	[0161.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.109] lstrlenW (lpString=".zip") returned 4
	[0161.109] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1
	[0161.109] lstrlenW (lpString=".rar") returned 4
	[0161.109] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1
	[0161.109] lstrlenW (lpString=".bz2") returned 4
	[0161.109] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1
	[0161.109] lstrlenW (lpString=".7z") returned 3
	[0161.109] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1
	[0161.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.109] lstrlenW (lpString=".dbf") returned 4
	[0161.109] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1
	[0161.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.109] lstrlenW (lpString=".1cd") returned 4
	[0161.109] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1
	[0161.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.109] lstrlenW (lpString=".jpg") returned 4
	[0161.109] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1
	[0161.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.109] lstrlenW (lpString=".doc") returned 4
	[0161.109] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1
	[0161.109] lstrlenW (lpString=".docx") returned 5
	[0161.109] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1
	[0161.109] lstrlenW (lpString=".pdf") returned 4
	[0161.109] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1
	[0161.109] lstrlenW (lpString=".xls") returned 4
	[0161.109] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1
	[0161.109] lstrlenW (lpString=".xlsx") returned 5
	[0161.109] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1
	[0161.110] lstrlenW (lpString=".ppt") returned 4
	[0161.110] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1
	[0161.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.110] lstrlenW (lpString=".zip") returned 4
	[0161.110] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1
	[0161.110] lstrlenW (lpString=".rar") returned 4
	[0161.110] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1
	[0161.110] lstrlenW (lpString=".bz2") returned 4
	[0161.110] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1
	[0161.110] lstrlenW (lpString=".7z") returned 3
	[0161.110] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1
	[0161.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.110] lstrlenW (lpString=".dbf") returned 4
	[0161.110] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1
	[0161.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.110] lstrlenW (lpString=".1cd") returned 4
	[0161.110] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1
	[0161.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0161.110] lstrlenW (lpString=".jpg") returned 4
	[0161.110] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1
	[0161.110] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0161.110] lstrlenW (lpString="jaccess.jar") returned 11
	[0161.110] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.267] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=44516) returned 1
	[0161.267] CloseHandle (hObject=0x51c) returned 1
	[0161.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20
	[0161.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.270] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.271] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.271] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.271] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0161.379] GetLastError () returned 0x0
	[0161.379] ReadFile (in: hFile=0x51c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0xade4, lpOverlapped=0x0) returned 1
	[0161.384] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xadf0, lpOverlapped=0x0) returned 1
	[0161.385] ReadFile (in: hFile=0x51c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.385] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xea, lpOverlapped=0x0) returned 1
	[0161.385] SetEndOfFile (hFile=0x520) returned 1
	[0161.386] CloseHandle (hObject=0x520) returned 1
	[0161.386] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.386] SetEndOfFile (hFile=0x51c) returned 1
	[0161.389] CloseHandle (hObject=0x51c) returned 1
	[0161.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0161.389] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1
	[0161.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.390] lstrlenW (lpString=".doc") returned 4
	[0161.390] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.390] lstrlenW (lpString=".docx") returned 5
	[0161.390] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0161.390] lstrlenW (lpString=".pdf") returned 4
	[0161.390] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.390] lstrlenW (lpString=".xls") returned 4
	[0161.390] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.390] lstrlenW (lpString=".xlsx") returned 5
	[0161.390] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0161.390] lstrlenW (lpString=".ppt") returned 4
	[0161.390] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.391] lstrlenW (lpString=".zip") returned 4
	[0161.391] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.391] lstrlenW (lpString=".rar") returned 4
	[0161.391] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.391] lstrlenW (lpString=".bz2") returned 4
	[0161.391] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.391] lstrlenW (lpString=".7z") returned 3
	[0161.391] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.391] lstrlenW (lpString=".dbf") returned 4
	[0161.391] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.391] lstrlenW (lpString=".1cd") returned 4
	[0161.391] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.391] lstrlenW (lpString=".jpg") returned 4
	[0161.391] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.391] lstrlenW (lpString=".doc") returned 4
	[0161.391] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.391] lstrlenW (lpString=".docx") returned 5
	[0161.391] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0161.391] lstrlenW (lpString=".pdf") returned 4
	[0161.391] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.391] lstrlenW (lpString=".xls") returned 4
	[0161.391] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.391] lstrlenW (lpString=".xlsx") returned 5
	[0161.392] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0161.392] lstrlenW (lpString=".ppt") returned 4
	[0161.392] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.392] lstrlenW (lpString=".zip") returned 4
	[0161.392] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.392] lstrlenW (lpString=".rar") returned 4
	[0161.392] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.392] lstrlenW (lpString=".bz2") returned 4
	[0161.392] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.392] lstrlenW (lpString=".7z") returned 3
	[0161.392] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.392] lstrlenW (lpString=".dbf") returned 4
	[0161.392] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.392] lstrlenW (lpString=".1cd") returned 4
	[0161.392] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0161.392] lstrlenW (lpString=".jpg") returned 4
	[0161.392] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.392] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0161.392] lstrlenW (lpString="jfxrt.jar") returned 9
	[0161.392] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.393] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=18246297) returned 1
	[0161.393] CloseHandle (hObject=0x51c) returned 1
	[0161.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20
	[0161.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[admin@stex777.com].money")) returned 0
	[0161.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.394] lstrlenW (lpString=".doc") returned 4
	[0161.394] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.394] lstrlenW (lpString=".docx") returned 5
	[0161.394] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0161.394] lstrlenW (lpString=".pdf") returned 4
	[0161.394] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.394] lstrlenW (lpString=".xls") returned 4
	[0161.394] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.394] lstrlenW (lpString=".xlsx") returned 5
	[0161.394] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0161.394] lstrlenW (lpString=".ppt") returned 4
	[0161.394] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.394] lstrlenW (lpString=".zip") returned 4
	[0161.394] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.394] lstrlenW (lpString=".rar") returned 4
	[0161.394] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.394] lstrlenW (lpString=".bz2") returned 4
	[0161.394] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.394] lstrlenW (lpString=".7z") returned 3
	[0161.394] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.394] lstrlenW (lpString=".dbf") returned 4
	[0161.395] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.395] lstrlenW (lpString=".1cd") returned 4
	[0161.395] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.395] lstrlenW (lpString=".jpg") returned 4
	[0161.395] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.395] lstrlenW (lpString=".doc") returned 4
	[0161.395] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.395] lstrlenW (lpString=".docx") returned 5
	[0161.395] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0161.395] lstrlenW (lpString=".pdf") returned 4
	[0161.395] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.395] lstrlenW (lpString=".xls") returned 4
	[0161.395] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.395] lstrlenW (lpString=".xlsx") returned 5
	[0161.395] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0161.395] lstrlenW (lpString=".ppt") returned 4
	[0161.395] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.395] lstrlenW (lpString=".zip") returned 4
	[0161.395] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.395] lstrlenW (lpString=".rar") returned 4
	[0161.395] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.395] lstrlenW (lpString=".bz2") returned 4
	[0161.395] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.395] lstrlenW (lpString=".7z") returned 3
	[0161.396] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.396] lstrlenW (lpString=".dbf") returned 4
	[0161.396] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.396] lstrlenW (lpString=".1cd") returned 4
	[0161.396] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0161.396] lstrlenW (lpString=".jpg") returned 4
	[0161.396] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.396] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0161.396] lstrlenW (lpString="localedata.jar") returned 14
	[0161.396] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.397] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=2204781) returned 1
	[0161.397] CloseHandle (hObject=0x51c) returned 1
	[0161.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20
	[0161.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[admin@stex777.com].money")) returned 0
	[0161.398] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.398] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.398] lstrlenW (lpString=".doc") returned 4
	[0161.398] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.398] lstrlenW (lpString=".docx") returned 5
	[0161.398] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0161.398] lstrlenW (lpString=".pdf") returned 4
	[0161.398] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.398] lstrlenW (lpString=".xls") returned 4
	[0161.398] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.398] lstrlenW (lpString=".xlsx") returned 5
	[0161.398] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0161.398] lstrlenW (lpString=".ppt") returned 4
	[0161.398] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.398] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.398] lstrlenW (lpString=".zip") returned 4
	[0161.398] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.398] lstrlenW (lpString=".rar") returned 4
	[0161.398] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.398] lstrlenW (lpString=".bz2") returned 4
	[0161.398] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.398] lstrlenW (lpString=".7z") returned 3
	[0161.398] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.398] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.398] lstrlenW (lpString=".dbf") returned 4
	[0161.398] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.399] lstrlenW (lpString=".1cd") returned 4
	[0161.399] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.399] lstrlenW (lpString=".jpg") returned 4
	[0161.399] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.399] lstrlenW (lpString=".doc") returned 4
	[0161.399] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.399] lstrlenW (lpString=".docx") returned 5
	[0161.399] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0161.399] lstrlenW (lpString=".pdf") returned 4
	[0161.399] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.399] lstrlenW (lpString=".xls") returned 4
	[0161.399] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.399] lstrlenW (lpString=".xlsx") returned 5
	[0161.399] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0161.399] lstrlenW (lpString=".ppt") returned 4
	[0161.399] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.399] lstrlenW (lpString=".zip") returned 4
	[0161.399] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.399] lstrlenW (lpString=".rar") returned 4
	[0161.399] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.399] lstrlenW (lpString=".bz2") returned 4
	[0161.399] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.399] lstrlenW (lpString=".7z") returned 3
	[0161.399] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.400] lstrlenW (lpString=".dbf") returned 4
	[0161.400] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.400] lstrlenW (lpString=".1cd") returned 4
	[0161.400] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0161.400] lstrlenW (lpString=".jpg") returned 4
	[0161.400] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.400] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".money") returned -1
	[0161.400] lstrlenW (lpString="meta-index") returned 10
	[0161.400] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.401] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=1461) returned 1
	[0161.401] CloseHandle (hObject=0x51c) returned 1
	[0161.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20
	[0161.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.401] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.401] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.401] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.401] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0161.402] GetLastError () returned 0x0
	[0161.402] ReadFile (in: hFile=0x51c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x5b5, lpOverlapped=0x0) returned 1
	[0161.403] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0161.404] ReadFile (in: hFile=0x51c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.404] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0161.404] SetEndOfFile (hFile=0x520) returned 1
	[0161.405] CloseHandle (hObject=0x520) returned 1
	[0161.405] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.405] SetEndOfFile (hFile=0x51c) returned 1
	[0161.408] CloseHandle (hObject=0x51c) returned 1
	[0161.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0161.409] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1
	[0161.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.410] lstrlenW (lpString=".doc") returned 4
	[0161.410] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0161.410] lstrlenW (lpString=".docx") returned 5
	[0161.410] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0161.410] lstrlenW (lpString=".pdf") returned 4
	[0161.410] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0161.410] lstrlenW (lpString=".xls") returned 4
	[0161.410] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0161.410] lstrlenW (lpString=".xlsx") returned 5
	[0161.410] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0161.410] lstrlenW (lpString=".ppt") returned 4
	[0161.410] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0161.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.410] lstrlenW (lpString=".zip") returned 4
	[0161.410] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0161.410] lstrlenW (lpString=".rar") returned 4
	[0161.410] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0161.410] lstrlenW (lpString=".bz2") returned 4
	[0161.410] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0161.410] lstrlenW (lpString=".7z") returned 3
	[0161.410] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0161.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.410] lstrlenW (lpString=".dbf") returned 4
	[0161.410] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0161.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.410] lstrlenW (lpString=".1cd") returned 4
	[0161.410] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0161.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.410] lstrlenW (lpString=".jpg") returned 4
	[0161.410] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0161.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.411] lstrlenW (lpString=".doc") returned 4
	[0161.411] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0161.411] lstrlenW (lpString=".docx") returned 5
	[0161.411] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0161.411] lstrlenW (lpString=".pdf") returned 4
	[0161.411] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0161.411] lstrlenW (lpString=".xls") returned 4
	[0161.411] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0161.411] lstrlenW (lpString=".xlsx") returned 5
	[0161.411] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0161.411] lstrlenW (lpString=".ppt") returned 4
	[0161.411] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0161.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.411] lstrlenW (lpString=".zip") returned 4
	[0161.411] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0161.411] lstrlenW (lpString=".rar") returned 4
	[0161.411] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0161.411] lstrlenW (lpString=".bz2") returned 4
	[0161.411] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0161.411] lstrlenW (lpString=".7z") returned 3
	[0161.411] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0161.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.411] lstrlenW (lpString=".dbf") returned 4
	[0161.411] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0161.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.411] lstrlenW (lpString=".1cd") returned 4
	[0161.411] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0161.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0161.412] lstrlenW (lpString=".jpg") returned 4
	[0161.412] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0161.412] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0161.412] lstrlenW (lpString="nashorn.jar") returned 11
	[0161.412] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.413] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=2022734) returned 1
	[0161.413] CloseHandle (hObject=0x51c) returned 1
	[0161.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20
	[0161.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[admin@stex777.com].money")) returned 0
	[0161.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.413] lstrlenW (lpString=".doc") returned 4
	[0161.413] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.413] lstrlenW (lpString=".docx") returned 5
	[0161.413] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0161.413] lstrlenW (lpString=".pdf") returned 4
	[0161.413] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.414] lstrlenW (lpString=".xls") returned 4
	[0161.414] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.414] lstrlenW (lpString=".xlsx") returned 5
	[0161.414] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0161.414] lstrlenW (lpString=".ppt") returned 4
	[0161.414] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.414] lstrlenW (lpString=".zip") returned 4
	[0161.414] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.414] lstrlenW (lpString=".rar") returned 4
	[0161.414] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.414] lstrlenW (lpString=".bz2") returned 4
	[0161.414] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.414] lstrlenW (lpString=".7z") returned 3
	[0161.414] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.414] lstrlenW (lpString=".dbf") returned 4
	[0161.414] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.414] lstrlenW (lpString=".1cd") returned 4
	[0161.414] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.414] lstrlenW (lpString=".jpg") returned 4
	[0161.414] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.414] lstrlenW (lpString=".doc") returned 4
	[0161.414] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.414] lstrlenW (lpString=".docx") returned 5
	[0161.414] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0161.414] lstrlenW (lpString=".pdf") returned 4
	[0161.415] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.415] lstrlenW (lpString=".xls") returned 4
	[0161.415] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.415] lstrlenW (lpString=".xlsx") returned 5
	[0161.415] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0161.415] lstrlenW (lpString=".ppt") returned 4
	[0161.415] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.415] lstrlenW (lpString=".zip") returned 4
	[0161.415] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.415] lstrlenW (lpString=".rar") returned 4
	[0161.415] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.415] lstrlenW (lpString=".bz2") returned 4
	[0161.415] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.415] lstrlenW (lpString=".7z") returned 3
	[0161.415] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.415] lstrlenW (lpString=".dbf") returned 4
	[0161.415] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.415] lstrlenW (lpString=".1cd") returned 4
	[0161.415] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0161.415] lstrlenW (lpString=".jpg") returned 4
	[0161.415] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.415] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0161.415] lstrlenW (lpString="sunec.jar") returned 9
	[0161.416] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.416] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=42185) returned 1
	[0161.416] CloseHandle (hObject=0x51c) returned 1
	[0161.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20
	[0161.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.417] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.417] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.417] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.417] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0161.418] GetLastError () returned 0x0
	[0161.418] ReadFile (in: hFile=0x51c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0xa4c9, lpOverlapped=0x0) returned 1
	[0161.420] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xa4d0, lpOverlapped=0x0) returned 1
	[0161.422] ReadFile (in: hFile=0x51c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.422] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0161.422] SetEndOfFile (hFile=0x520) returned 1
	[0161.422] CloseHandle (hObject=0x520) returned 1
	[0161.422] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.422] SetEndOfFile (hFile=0x51c) returned 1
	[0161.425] CloseHandle (hObject=0x51c) returned 1
	[0161.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0161.426] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1
	[0161.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.426] lstrlenW (lpString=".doc") returned 4
	[0161.427] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.427] lstrlenW (lpString=".docx") returned 5
	[0161.427] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1
	[0161.427] lstrlenW (lpString=".pdf") returned 4
	[0161.427] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.427] lstrlenW (lpString=".xls") returned 4
	[0161.427] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.427] lstrlenW (lpString=".xlsx") returned 5
	[0161.427] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1
	[0161.427] lstrlenW (lpString=".ppt") returned 4
	[0161.427] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.427] lstrlenW (lpString=".zip") returned 4
	[0161.427] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.427] lstrlenW (lpString=".rar") returned 4
	[0161.427] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.427] lstrlenW (lpString=".bz2") returned 4
	[0161.427] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.427] lstrlenW (lpString=".7z") returned 3
	[0161.427] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.427] lstrlenW (lpString=".dbf") returned 4
	[0161.427] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.427] lstrlenW (lpString=".1cd") returned 4
	[0161.427] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.427] lstrlenW (lpString=".jpg") returned 4
	[0161.427] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.428] lstrlenW (lpString=".doc") returned 4
	[0161.428] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.428] lstrlenW (lpString=".docx") returned 5
	[0161.428] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1
	[0161.428] lstrlenW (lpString=".pdf") returned 4
	[0161.428] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.428] lstrlenW (lpString=".xls") returned 4
	[0161.428] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.428] lstrlenW (lpString=".xlsx") returned 5
	[0161.428] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1
	[0161.428] lstrlenW (lpString=".ppt") returned 4
	[0161.428] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.428] lstrlenW (lpString=".zip") returned 4
	[0161.428] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.428] lstrlenW (lpString=".rar") returned 4
	[0161.428] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.428] lstrlenW (lpString=".bz2") returned 4
	[0161.428] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.428] lstrlenW (lpString=".7z") returned 3
	[0161.428] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.428] lstrlenW (lpString=".dbf") returned 4
	[0161.428] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.428] lstrlenW (lpString=".1cd") returned 4
	[0161.428] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0161.428] lstrlenW (lpString=".jpg") returned 4
	[0161.428] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.429] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0161.429] lstrlenW (lpString="sunjce_provider.jar") returned 19
	[0161.429] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.430] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=280161) returned 1
	[0161.430] CloseHandle (hObject=0x51c) returned 1
	[0161.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20
	[0161.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.430] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.430] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.431] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.431] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0161.431] GetLastError () returned 0x0
	[0161.431] ReadFile (in: hFile=0x51c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x44661, lpOverlapped=0x0) returned 1
	[0161.441] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x44670, lpOverlapped=0x0) returned 1
	[0161.446] ReadFile (in: hFile=0x51c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.446] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0161.447] SetEndOfFile (hFile=0x520) returned 1
	[0161.447] CloseHandle (hObject=0x520) returned 1
	[0161.447] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.447] SetEndOfFile (hFile=0x51c) returned 1
	[0161.455] CloseHandle (hObject=0x51c) returned 1
	[0161.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0161.925] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1
	[0161.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.925] lstrlenW (lpString=".doc") returned 4
	[0161.925] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.925] lstrlenW (lpString=".docx") returned 5
	[0161.925] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0161.925] lstrlenW (lpString=".pdf") returned 4
	[0161.925] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.925] lstrlenW (lpString=".xls") returned 4
	[0161.925] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.925] lstrlenW (lpString=".xlsx") returned 5
	[0161.926] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0161.926] lstrlenW (lpString=".ppt") returned 4
	[0161.926] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.926] lstrlenW (lpString=".zip") returned 4
	[0161.926] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.926] lstrlenW (lpString=".rar") returned 4
	[0161.926] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.926] lstrlenW (lpString=".bz2") returned 4
	[0161.926] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.926] lstrlenW (lpString=".7z") returned 3
	[0161.926] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.926] lstrlenW (lpString=".dbf") returned 4
	[0161.926] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.926] lstrlenW (lpString=".1cd") returned 4
	[0161.926] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.926] lstrlenW (lpString=".jpg") returned 4
	[0161.926] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.926] lstrlenW (lpString=".doc") returned 4
	[0161.926] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.926] lstrlenW (lpString=".docx") returned 5
	[0161.926] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0161.926] lstrlenW (lpString=".pdf") returned 4
	[0161.926] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.926] lstrlenW (lpString=".xls") returned 4
	[0161.926] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.927] lstrlenW (lpString=".xlsx") returned 5
	[0161.927] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0161.927] lstrlenW (lpString=".ppt") returned 4
	[0161.927] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.927] lstrlenW (lpString=".zip") returned 4
	[0161.927] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.927] lstrlenW (lpString=".rar") returned 4
	[0161.927] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.927] lstrlenW (lpString=".bz2") returned 4
	[0161.927] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.927] lstrlenW (lpString=".7z") returned 3
	[0161.927] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.927] lstrlenW (lpString=".dbf") returned 4
	[0161.927] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.927] lstrlenW (lpString=".1cd") returned 4
	[0161.927] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0161.927] lstrlenW (lpString=".jpg") returned 4
	[0161.927] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.960] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0161.960] lstrlenW (lpString="zipfs.jar") returned 9
	[0161.960] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0161.961] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=68924) returned 1
	[0161.961] CloseHandle (hObject=0x534) returned 1
	[0161.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20
	[0161.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.961] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0161.962] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.962] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.962] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0161.962] GetLastError () returned 0x0
	[0161.962] ReadFile (in: hFile=0x534, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x10d3c, lpOverlapped=0x0) returned 1
	[0161.966] WriteFile (in: hFile=0x4b8, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x10d40, lpOverlapped=0x0) returned 1
	[0161.968] ReadFile (in: hFile=0x534, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.968] WriteFile (in: hFile=0x4b8, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0161.968] SetEndOfFile (hFile=0x4b8) returned 1
	[0161.968] CloseHandle (hObject=0x4b8) returned 1
	[0161.969] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.969] SetEndOfFile (hFile=0x534) returned 1
	[0161.974] CloseHandle (hObject=0x534) returned 1
	[0161.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0161.975] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1
	[0161.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.976] lstrlenW (lpString=".doc") returned 4
	[0161.976] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.976] lstrlenW (lpString=".docx") returned 5
	[0161.976] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0161.976] lstrlenW (lpString=".pdf") returned 4
	[0161.976] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.976] lstrlenW (lpString=".xls") returned 4
	[0161.976] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.976] lstrlenW (lpString=".xlsx") returned 5
	[0161.976] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0161.976] lstrlenW (lpString=".ppt") returned 4
	[0161.976] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.976] lstrlenW (lpString=".zip") returned 4
	[0161.976] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.976] lstrlenW (lpString=".rar") returned 4
	[0161.976] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.976] lstrlenW (lpString=".bz2") returned 4
	[0161.976] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.976] lstrlenW (lpString=".7z") returned 3
	[0161.976] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.977] lstrlenW (lpString=".dbf") returned 4
	[0161.977] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.977] lstrlenW (lpString=".1cd") returned 4
	[0161.977] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.977] lstrlenW (lpString=".jpg") returned 4
	[0161.977] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.977] lstrlenW (lpString=".doc") returned 4
	[0161.977] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.977] lstrlenW (lpString=".docx") returned 5
	[0161.977] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0161.977] lstrlenW (lpString=".pdf") returned 4
	[0161.977] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.977] lstrlenW (lpString=".xls") returned 4
	[0161.977] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.977] lstrlenW (lpString=".xlsx") returned 5
	[0161.977] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0161.977] lstrlenW (lpString=".ppt") returned 4
	[0161.977] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.978] lstrlenW (lpString=".zip") returned 4
	[0161.978] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.978] lstrlenW (lpString=".rar") returned 4
	[0161.978] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.978] lstrlenW (lpString=".bz2") returned 4
	[0161.978] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.978] lstrlenW (lpString=".7z") returned 3
	[0161.978] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.978] lstrlenW (lpString=".dbf") returned 4
	[0161.978] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.978] lstrlenW (lpString=".1cd") returned 4
	[0161.978] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0161.978] lstrlenW (lpString=".jpg") returned 4
	[0161.978] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.978] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0161.978] lstrlenW (lpString="flavormap.properties") returned 20
	[0161.979] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0161.979] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=3928) returned 1
	[0161.979] CloseHandle (hObject=0x534) returned 1
	[0161.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20
	[0161.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0161.980] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.980] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0161.981] GetLastError () returned 0x0
	[0161.981] ReadFile (in: hFile=0x534, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0xf58, lpOverlapped=0x0) returned 1
	[0161.987] WriteFile (in: hFile=0x4b8, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xf60, lpOverlapped=0x0) returned 1
	[0161.988] ReadFile (in: hFile=0x534, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.988] WriteFile (in: hFile=0x4b8, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0161.989] SetEndOfFile (hFile=0x4b8) returned 1
	[0161.989] CloseHandle (hObject=0x4b8) returned 1
	[0161.989] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.989] SetEndOfFile (hFile=0x534) returned 1
	[0161.995] CloseHandle (hObject=0x534) returned 1
	[0161.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0161.999] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1
	[0162.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.001] lstrlenW (lpString=".doc") returned 4
	[0162.001] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0162.001] lstrlenW (lpString=".docx") returned 5
	[0162.001] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0162.001] lstrlenW (lpString=".pdf") returned 4
	[0162.001] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0162.001] lstrlenW (lpString=".xls") returned 4
	[0162.002] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0162.002] lstrlenW (lpString=".xlsx") returned 5
	[0162.002] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0162.002] lstrlenW (lpString=".ppt") returned 4
	[0162.002] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0162.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.002] lstrlenW (lpString=".zip") returned 4
	[0162.002] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0162.002] lstrlenW (lpString=".rar") returned 4
	[0162.002] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0162.002] lstrlenW (lpString=".bz2") returned 4
	[0162.002] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0162.002] lstrlenW (lpString=".7z") returned 3
	[0162.002] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0162.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.002] lstrlenW (lpString=".dbf") returned 4
	[0162.002] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0162.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.003] lstrlenW (lpString=".1cd") returned 4
	[0162.003] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0162.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.003] lstrlenW (lpString=".jpg") returned 4
	[0162.003] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0162.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.003] lstrlenW (lpString=".doc") returned 4
	[0162.003] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0162.003] lstrlenW (lpString=".docx") returned 5
	[0162.003] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0162.003] lstrlenW (lpString=".pdf") returned 4
	[0162.003] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0162.003] lstrlenW (lpString=".xls") returned 4
	[0162.003] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0162.003] lstrlenW (lpString=".xlsx") returned 5
	[0162.003] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0162.003] lstrlenW (lpString=".ppt") returned 4
	[0162.003] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0162.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.003] lstrlenW (lpString=".zip") returned 4
	[0162.003] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0162.003] lstrlenW (lpString=".rar") returned 4
	[0162.003] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0162.003] lstrlenW (lpString=".bz2") returned 4
	[0162.004] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0162.004] lstrlenW (lpString=".7z") returned 3
	[0162.004] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0162.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.004] lstrlenW (lpString=".dbf") returned 4
	[0162.004] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0162.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.004] lstrlenW (lpString=".1cd") returned 4
	[0162.004] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0162.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0162.004] lstrlenW (lpString=".jpg") returned 4
	[0162.004] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0162.004] lstrcmpiW (lpString1=".src", lpString2=".money") returned 1
	[0162.004] lstrlenW (lpString="fontconfig.properties.src") returned 25
	[0162.004] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0162.382] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=10568) returned 1
	[0162.382] CloseHandle (hObject=0x4f0) returned 1
	[0162.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20
	[0162.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0162.382] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.383] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.383] GetLastError () returned 0x0
	[0162.383] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2948, lpOverlapped=0x0) returned 1
	[0162.385] WriteFile (in: hFile=0x52c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2950, lpOverlapped=0x0) returned 1
	[0162.386] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.386] WriteFile (in: hFile=0x52c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x106, lpOverlapped=0x0) returned 1
	[0162.386] SetEndOfFile (hFile=0x52c) returned 1
	[0162.386] CloseHandle (hObject=0x52c) returned 1
	[0162.386] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.386] SetEndOfFile (hFile=0x4f0) returned 1
	[0162.388] CloseHandle (hObject=0x4f0) returned 1
	[0162.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0162.389] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1
	[0162.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.389] lstrlenW (lpString=".doc") returned 4
	[0162.389] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1
	[0162.390] lstrlenW (lpString=".docx") returned 5
	[0162.390] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1
	[0162.390] lstrlenW (lpString=".pdf") returned 4
	[0162.390] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1
	[0162.390] lstrlenW (lpString=".xls") returned 4
	[0162.390] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1
	[0162.390] lstrlenW (lpString=".xlsx") returned 5
	[0162.390] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1
	[0162.390] lstrlenW (lpString=".ppt") returned 4
	[0162.390] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1
	[0162.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.390] lstrlenW (lpString=".zip") returned 4
	[0162.390] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1
	[0162.390] lstrlenW (lpString=".rar") returned 4
	[0162.390] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1
	[0162.390] lstrlenW (lpString=".bz2") returned 4
	[0162.390] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1
	[0162.390] lstrlenW (lpString=".7z") returned 3
	[0162.390] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1
	[0162.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.390] lstrlenW (lpString=".dbf") returned 4
	[0162.390] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1
	[0162.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.390] lstrlenW (lpString=".1cd") returned 4
	[0162.390] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1
	[0162.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.390] lstrlenW (lpString=".jpg") returned 4
	[0162.390] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1
	[0162.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.390] lstrlenW (lpString=".doc") returned 4
	[0162.391] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1
	[0162.391] lstrlenW (lpString=".docx") returned 5
	[0162.391] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1
	[0162.391] lstrlenW (lpString=".pdf") returned 4
	[0162.391] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1
	[0162.391] lstrlenW (lpString=".xls") returned 4
	[0162.391] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1
	[0162.391] lstrlenW (lpString=".xlsx") returned 5
	[0162.391] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1
	[0162.391] lstrlenW (lpString=".ppt") returned 4
	[0162.391] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1
	[0162.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.391] lstrlenW (lpString=".zip") returned 4
	[0162.391] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1
	[0162.391] lstrlenW (lpString=".rar") returned 4
	[0162.391] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1
	[0162.391] lstrlenW (lpString=".bz2") returned 4
	[0162.391] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1
	[0162.391] lstrlenW (lpString=".7z") returned 3
	[0162.391] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1
	[0162.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.391] lstrlenW (lpString=".dbf") returned 4
	[0162.391] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1
	[0162.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.391] lstrlenW (lpString=".1cd") returned 4
	[0162.391] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1
	[0162.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0162.391] lstrlenW (lpString=".jpg") returned 4
	[0162.391] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1
	[0162.392] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0162.392] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22
	[0162.392] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0162.392] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=317896) returned 1
	[0162.392] CloseHandle (hObject=0x4f0) returned 1
	[0162.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20
	[0162.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0162.393] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.393] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.411] GetLastError () returned 0x0
	[0162.411] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x4d9c8, lpOverlapped=0x0) returned 1
	[0162.788] WriteFile (in: hFile=0x52c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x4d9d0, lpOverlapped=0x0) returned 1
	[0162.794] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.794] WriteFile (in: hFile=0x52c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x100, lpOverlapped=0x0) returned 1
	[0162.794] SetEndOfFile (hFile=0x52c) returned 1
	[0162.794] CloseHandle (hObject=0x52c) returned 1
	[0162.795] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.795] SetEndOfFile (hFile=0x4f0) returned 1
	[0162.803] CloseHandle (hObject=0x4f0) returned 1
	[0162.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0162.804] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1
	[0162.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.804] lstrlenW (lpString=".doc") returned 4
	[0162.804] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.804] lstrlenW (lpString=".docx") returned 5
	[0162.804] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0162.804] lstrlenW (lpString=".pdf") returned 4
	[0162.804] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.804] lstrlenW (lpString=".xls") returned 4
	[0162.804] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.804] lstrlenW (lpString=".xlsx") returned 5
	[0162.804] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0162.805] lstrlenW (lpString=".ppt") returned 4
	[0162.805] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.805] lstrlenW (lpString=".zip") returned 4
	[0162.805] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.805] lstrlenW (lpString=".rar") returned 4
	[0162.805] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.805] lstrlenW (lpString=".bz2") returned 4
	[0162.805] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.805] lstrlenW (lpString=".7z") returned 3
	[0162.805] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.805] lstrlenW (lpString=".dbf") returned 4
	[0162.805] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.805] lstrlenW (lpString=".1cd") returned 4
	[0162.805] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.805] lstrlenW (lpString=".jpg") returned 4
	[0162.805] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.805] lstrlenW (lpString=".doc") returned 4
	[0162.805] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.805] lstrlenW (lpString=".docx") returned 5
	[0162.805] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0162.805] lstrlenW (lpString=".pdf") returned 4
	[0162.805] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.805] lstrlenW (lpString=".xls") returned 4
	[0162.806] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.806] lstrlenW (lpString=".xlsx") returned 5
	[0162.806] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0162.806] lstrlenW (lpString=".ppt") returned 4
	[0162.806] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.806] lstrlenW (lpString=".zip") returned 4
	[0162.806] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.806] lstrlenW (lpString=".rar") returned 4
	[0162.806] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.806] lstrlenW (lpString=".bz2") returned 4
	[0162.806] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.806] lstrlenW (lpString=".7z") returned 3
	[0162.806] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.806] lstrlenW (lpString=".dbf") returned 4
	[0162.806] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.806] lstrlenW (lpString=".1cd") returned 4
	[0162.806] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0162.806] lstrlenW (lpString=".jpg") returned 4
	[0162.806] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.806] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0162.806] lstrlenW (lpString="cursors.properties") returned 18
	[0162.806] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0162.809] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=1280) returned 1
	[0162.809] CloseHandle (hObject=0x4f0) returned 1
	[0162.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20
	[0162.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.809] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0162.810] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.810] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.810] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0163.155] GetLastError () returned 0x0
	[0163.155] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x500, lpOverlapped=0x0) returned 1
	[0163.157] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x510, lpOverlapped=0x0) returned 1
	[0163.158] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.158] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0163.158] SetEndOfFile (hFile=0x54c) returned 1
	[0163.158] CloseHandle (hObject=0x54c) returned 1
	[0163.158] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.158] SetEndOfFile (hFile=0x4f0) returned 1
	[0163.161] CloseHandle (hObject=0x4f0) returned 1
	[0163.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0163.161] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1
	[0163.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.162] lstrlenW (lpString=".doc") returned 4
	[0163.162] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0163.162] lstrlenW (lpString=".docx") returned 5
	[0163.162] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0163.162] lstrlenW (lpString=".pdf") returned 4
	[0163.162] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0163.162] lstrlenW (lpString=".xls") returned 4
	[0163.162] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0163.162] lstrlenW (lpString=".xlsx") returned 5
	[0163.162] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0163.162] lstrlenW (lpString=".ppt") returned 4
	[0163.163] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0163.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.163] lstrlenW (lpString=".zip") returned 4
	[0163.163] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0163.163] lstrlenW (lpString=".rar") returned 4
	[0163.163] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0163.163] lstrlenW (lpString=".bz2") returned 4
	[0163.163] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0163.163] lstrlenW (lpString=".7z") returned 3
	[0163.163] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0163.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.163] lstrlenW (lpString=".dbf") returned 4
	[0163.163] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0163.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.163] lstrlenW (lpString=".1cd") returned 4
	[0163.163] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0163.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.163] lstrlenW (lpString=".jpg") returned 4
	[0163.163] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0163.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.163] lstrlenW (lpString=".doc") returned 4
	[0163.163] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0163.163] lstrlenW (lpString=".docx") returned 5
	[0163.163] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0163.163] lstrlenW (lpString=".pdf") returned 4
	[0163.163] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0163.163] lstrlenW (lpString=".xls") returned 4
	[0163.163] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0163.163] lstrlenW (lpString=".xlsx") returned 5
	[0163.164] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0163.164] lstrlenW (lpString=".ppt") returned 4
	[0163.164] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0163.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.164] lstrlenW (lpString=".zip") returned 4
	[0163.164] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0163.164] lstrlenW (lpString=".rar") returned 4
	[0163.164] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0163.164] lstrlenW (lpString=".bz2") returned 4
	[0163.164] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0163.164] lstrlenW (lpString=".7z") returned 3
	[0163.164] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0163.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.164] lstrlenW (lpString=".dbf") returned 4
	[0163.164] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0163.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.164] lstrlenW (lpString=".1cd") returned 4
	[0163.164] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0163.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0163.164] lstrlenW (lpString=".jpg") returned 4
	[0163.164] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0163.164] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0163.164] lstrlenW (lpString="jce.jar") returned 7
	[0163.164] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0163.165] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=116446) returned 1
	[0163.165] CloseHandle (hObject=0x4f0) returned 1
	[0163.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20
	[0163.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.166] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0163.166] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.166] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.166] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.167] GetLastError () returned 0x0
	[0163.167] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x1c6de, lpOverlapped=0x0) returned 1
	[0163.172] WriteFile (in: hFile=0x554, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x1c6e0, lpOverlapped=0x0) returned 1
	[0163.175] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.175] WriteFile (in: hFile=0x554, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0163.175] SetEndOfFile (hFile=0x554) returned 1
	[0163.176] CloseHandle (hObject=0x554) returned 1
	[0163.176] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.176] SetEndOfFile (hFile=0x4f0) returned 1
	[0163.180] CloseHandle (hObject=0x4f0) returned 1
	[0163.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0163.181] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1
	[0163.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.181] lstrlenW (lpString=".doc") returned 4
	[0163.181] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0163.181] lstrlenW (lpString=".docx") returned 5
	[0163.181] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0163.181] lstrlenW (lpString=".pdf") returned 4
	[0163.181] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0163.181] lstrlenW (lpString=".xls") returned 4
	[0163.181] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0163.182] lstrlenW (lpString=".xlsx") returned 5
	[0163.182] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0163.182] lstrlenW (lpString=".ppt") returned 4
	[0163.182] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0163.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.182] lstrlenW (lpString=".zip") returned 4
	[0163.182] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0163.182] lstrlenW (lpString=".rar") returned 4
	[0163.182] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0163.182] lstrlenW (lpString=".bz2") returned 4
	[0163.182] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0163.182] lstrlenW (lpString=".7z") returned 3
	[0163.182] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0163.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.182] lstrlenW (lpString=".dbf") returned 4
	[0163.182] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0163.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.182] lstrlenW (lpString=".1cd") returned 4
	[0163.182] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0163.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.182] lstrlenW (lpString=".jpg") returned 4
	[0163.182] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0163.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.182] lstrlenW (lpString=".doc") returned 4
	[0163.182] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0163.182] lstrlenW (lpString=".docx") returned 5
	[0163.182] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0163.182] lstrlenW (lpString=".pdf") returned 4
	[0163.182] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0163.183] lstrlenW (lpString=".xls") returned 4
	[0163.183] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0163.183] lstrlenW (lpString=".xlsx") returned 5
	[0163.183] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0163.183] lstrlenW (lpString=".ppt") returned 4
	[0163.183] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0163.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.183] lstrlenW (lpString=".zip") returned 4
	[0163.183] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0163.183] lstrlenW (lpString=".rar") returned 4
	[0163.183] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0163.183] lstrlenW (lpString=".bz2") returned 4
	[0163.183] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0163.183] lstrlenW (lpString=".7z") returned 3
	[0163.183] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0163.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.183] lstrlenW (lpString=".dbf") returned 4
	[0163.183] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0163.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.183] lstrlenW (lpString=".1cd") returned 4
	[0163.183] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0163.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0163.183] lstrlenW (lpString=".jpg") returned 4
	[0163.183] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0163.183] lstrcmpiW (lpString1=".jfc", lpString2=".money") returned -1
	[0163.184] lstrlenW (lpString="default.jfc") returned 11
	[0163.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0163.184] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=20109) returned 1
	[0163.184] CloseHandle (hObject=0x4f0) returned 1
	[0163.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20
	[0163.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0163.185] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.185] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.185] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.189] GetLastError () returned 0x0
	[0163.189] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x4e8d, lpOverlapped=0x0) returned 1
	[0163.193] WriteFile (in: hFile=0x554, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x4e90, lpOverlapped=0x0) returned 1
	[0163.194] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.194] WriteFile (in: hFile=0x554, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xea, lpOverlapped=0x0) returned 1
	[0163.194] SetEndOfFile (hFile=0x554) returned 1
	[0163.195] CloseHandle (hObject=0x554) returned 1
	[0163.195] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.195] SetEndOfFile (hFile=0x4f0) returned 1
	[0163.198] CloseHandle (hObject=0x4f0) returned 1
	[0163.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0163.199] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1
	[0163.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.200] lstrlenW (lpString=".doc") returned 4
	[0163.200] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0163.200] lstrlenW (lpString=".docx") returned 5
	[0163.200] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1
	[0163.200] lstrlenW (lpString=".pdf") returned 4
	[0163.200] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0163.200] lstrlenW (lpString=".xls") returned 4
	[0163.200] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0163.200] lstrlenW (lpString=".xlsx") returned 5
	[0163.200] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1
	[0163.200] lstrlenW (lpString=".ppt") returned 4
	[0163.200] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0163.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.200] lstrlenW (lpString=".zip") returned 4
	[0163.200] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0163.200] lstrlenW (lpString=".rar") returned 4
	[0163.200] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0163.200] lstrlenW (lpString=".bz2") returned 4
	[0163.200] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0163.200] lstrlenW (lpString=".7z") returned 3
	[0163.200] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0163.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.200] lstrlenW (lpString=".dbf") returned 4
	[0163.200] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0163.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.200] lstrlenW (lpString=".1cd") returned 4
	[0163.200] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0163.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.201] lstrlenW (lpString=".jpg") returned 4
	[0163.201] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0163.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.201] lstrlenW (lpString=".doc") returned 4
	[0163.201] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0163.201] lstrlenW (lpString=".docx") returned 5
	[0163.201] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1
	[0163.201] lstrlenW (lpString=".pdf") returned 4
	[0163.201] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0163.201] lstrlenW (lpString=".xls") returned 4
	[0163.201] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0163.201] lstrlenW (lpString=".xlsx") returned 5
	[0163.201] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1
	[0163.201] lstrlenW (lpString=".ppt") returned 4
	[0163.201] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0163.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.201] lstrlenW (lpString=".zip") returned 4
	[0163.201] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0163.201] lstrlenW (lpString=".rar") returned 4
	[0163.201] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0163.201] lstrlenW (lpString=".bz2") returned 4
	[0163.201] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0163.201] lstrlenW (lpString=".7z") returned 3
	[0163.201] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0163.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.201] lstrlenW (lpString=".dbf") returned 4
	[0163.201] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0163.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.201] lstrlenW (lpString=".1cd") returned 4
	[0163.202] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0163.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0163.202] lstrlenW (lpString=".jpg") returned 4
	[0163.202] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0163.202] lstrcmpiW (lpString1=".jfc", lpString2=".money") returned -1
	[0163.202] lstrlenW (lpString="profile.jfc") returned 11
	[0163.202] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0163.202] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=20065) returned 1
	[0163.202] CloseHandle (hObject=0x4f0) returned 1
	[0163.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20
	[0163.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.203] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0163.203] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.203] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.203] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.204] GetLastError () returned 0x0
	[0163.204] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x4e61, lpOverlapped=0x0) returned 1
	[0163.206] WriteFile (in: hFile=0x554, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x4e70, lpOverlapped=0x0) returned 1
	[0163.207] ReadFile (in: hFile=0x4f0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.207] WriteFile (in: hFile=0x554, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xea, lpOverlapped=0x0) returned 1
	[0163.207] SetEndOfFile (hFile=0x554) returned 1
	[0163.208] CloseHandle (hObject=0x554) returned 1
	[0163.208] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.208] SetEndOfFile (hFile=0x4f0) returned 1
	[0163.940] CloseHandle (hObject=0x4f0) returned 1
	[0163.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0163.941] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1
	[0163.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.941] lstrlenW (lpString=".doc") returned 4
	[0163.942] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0163.942] lstrlenW (lpString=".docx") returned 5
	[0163.942] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1
	[0163.942] lstrlenW (lpString=".pdf") returned 4
	[0163.942] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0163.942] lstrlenW (lpString=".xls") returned 4
	[0163.942] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0163.942] lstrlenW (lpString=".xlsx") returned 5
	[0163.942] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1
	[0163.942] lstrlenW (lpString=".ppt") returned 4
	[0163.942] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0163.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.942] lstrlenW (lpString=".zip") returned 4
	[0163.942] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0163.942] lstrlenW (lpString=".rar") returned 4
	[0163.942] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0163.942] lstrlenW (lpString=".bz2") returned 4
	[0163.942] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0163.942] lstrlenW (lpString=".7z") returned 3
	[0163.942] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0163.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.942] lstrlenW (lpString=".dbf") returned 4
	[0163.942] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0163.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.942] lstrlenW (lpString=".1cd") returned 4
	[0163.942] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0163.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.942] lstrlenW (lpString=".jpg") returned 4
	[0163.942] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0163.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.943] lstrlenW (lpString=".doc") returned 4
	[0163.943] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0163.943] lstrlenW (lpString=".docx") returned 5
	[0163.943] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1
	[0163.943] lstrlenW (lpString=".pdf") returned 4
	[0163.943] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0163.943] lstrlenW (lpString=".xls") returned 4
	[0163.943] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0163.943] lstrlenW (lpString=".xlsx") returned 5
	[0163.943] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1
	[0163.943] lstrlenW (lpString=".ppt") returned 4
	[0163.943] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0163.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.943] lstrlenW (lpString=".zip") returned 4
	[0163.943] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0163.943] lstrlenW (lpString=".rar") returned 4
	[0163.943] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0163.943] lstrlenW (lpString=".bz2") returned 4
	[0163.943] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0163.943] lstrlenW (lpString=".7z") returned 3
	[0163.943] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0163.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.943] lstrlenW (lpString=".dbf") returned 4
	[0163.943] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0163.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.943] lstrlenW (lpString=".1cd") returned 4
	[0163.943] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0163.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0163.943] lstrlenW (lpString=".jpg") returned 4
	[0163.943] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0164.190] lstrcmpiW (lpString1=".0_144\\lib\\meta-index", lpString2=".money") returned -1
	[0164.190] lstrlenW (lpString="meta-index") returned 10
	[0164.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.472] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=2126) returned 1
	[0164.472] CloseHandle (hObject=0x500) returned 1
	[0164.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20
	[0164.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.645] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0165.319] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.319] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0165.320] GetLastError () returned 0x0
	[0165.320] ReadFile (in: hFile=0x500, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x84e, lpOverlapped=0x0) returned 1
	[0165.322] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x850, lpOverlapped=0x0) returned 1
	[0165.323] ReadFile (in: hFile=0x500, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.323] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0165.323] SetEndOfFile (hFile=0x520) returned 1
	[0165.323] CloseHandle (hObject=0x520) returned 1
	[0165.323] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.323] SetEndOfFile (hFile=0x500) returned 1
	[0165.326] CloseHandle (hObject=0x500) returned 1
	[0165.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.327] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1
	[0165.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.327] lstrlenW (lpString=".doc") returned 4
	[0165.327] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0165.327] lstrlenW (lpString=".docx") returned 5
	[0165.328] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0165.328] lstrlenW (lpString=".pdf") returned 4
	[0165.328] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0165.328] lstrlenW (lpString=".xls") returned 4
	[0165.328] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0165.328] lstrlenW (lpString=".xlsx") returned 5
	[0165.328] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0165.328] lstrlenW (lpString=".ppt") returned 4
	[0165.328] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0165.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.328] lstrlenW (lpString=".zip") returned 4
	[0165.328] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0165.328] lstrlenW (lpString=".rar") returned 4
	[0165.328] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0165.328] lstrlenW (lpString=".bz2") returned 4
	[0165.328] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0165.328] lstrlenW (lpString=".7z") returned 3
	[0165.328] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0165.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.328] lstrlenW (lpString=".dbf") returned 4
	[0165.328] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0165.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.328] lstrlenW (lpString=".1cd") returned 4
	[0165.328] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0165.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.328] lstrlenW (lpString=".jpg") returned 4
	[0165.328] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0165.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.329] lstrlenW (lpString=".doc") returned 4
	[0165.329] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0165.329] lstrlenW (lpString=".docx") returned 5
	[0165.329] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0165.329] lstrlenW (lpString=".pdf") returned 4
	[0165.329] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0165.329] lstrlenW (lpString=".xls") returned 4
	[0165.329] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0165.329] lstrlenW (lpString=".xlsx") returned 5
	[0165.329] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0165.329] lstrlenW (lpString=".ppt") returned 4
	[0165.329] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0165.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.329] lstrlenW (lpString=".zip") returned 4
	[0165.329] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0165.329] lstrlenW (lpString=".rar") returned 4
	[0165.329] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0165.329] lstrlenW (lpString=".bz2") returned 4
	[0165.329] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0165.329] lstrlenW (lpString=".7z") returned 3
	[0165.329] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0165.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.329] lstrlenW (lpString=".dbf") returned 4
	[0165.329] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0165.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.329] lstrlenW (lpString=".1cd") returned 4
	[0165.329] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0165.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0165.329] lstrlenW (lpString=".jpg") returned 4
	[0165.329] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0165.330] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".money") returned -1
	[0165.330] lstrlenW (lpString="cacerts") returned 7
	[0165.330] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0165.330] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=114923) returned 1
	[0165.330] CloseHandle (hObject=0x500) returned 1
	[0165.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20
	[0165.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.331] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0165.331] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.331] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.331] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0165.333] GetLastError () returned 0x0
	[0165.333] ReadFile (in: hFile=0x500, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x1c0eb, lpOverlapped=0x0) returned 1
	[0165.338] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x1c0f0, lpOverlapped=0x0) returned 1
	[0165.340] ReadFile (in: hFile=0x500, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.341] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0165.341] SetEndOfFile (hFile=0x520) returned 1
	[0165.341] CloseHandle (hObject=0x520) returned 1
	[0165.341] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.341] SetEndOfFile (hFile=0x500) returned 1
	[0165.345] CloseHandle (hObject=0x500) returned 1
	[0165.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.345] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1
	[0165.346] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.346] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.346] lstrlenW (lpString=".doc") returned 4
	[0165.346] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0165.346] lstrlenW (lpString=".docx") returned 5
	[0165.346] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0165.346] lstrlenW (lpString=".pdf") returned 4
	[0165.346] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0165.346] lstrlenW (lpString=".xls") returned 4
	[0165.346] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0165.346] lstrlenW (lpString=".xlsx") returned 5
	[0165.347] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0165.347] lstrlenW (lpString=".ppt") returned 4
	[0165.347] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0165.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.347] lstrlenW (lpString=".zip") returned 4
	[0165.347] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0165.347] lstrlenW (lpString=".rar") returned 4
	[0165.347] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0165.347] lstrlenW (lpString=".bz2") returned 4
	[0165.347] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0165.347] lstrlenW (lpString=".7z") returned 3
	[0165.347] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0165.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.347] lstrlenW (lpString=".dbf") returned 4
	[0165.347] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0165.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.347] lstrlenW (lpString=".1cd") returned 4
	[0165.347] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0165.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.347] lstrlenW (lpString=".jpg") returned 4
	[0165.347] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0165.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.348] lstrlenW (lpString=".doc") returned 4
	[0165.348] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0165.348] lstrlenW (lpString=".docx") returned 5
	[0165.348] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0165.348] lstrlenW (lpString=".pdf") returned 4
	[0165.348] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0165.348] lstrlenW (lpString=".xls") returned 4
	[0165.348] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0165.348] lstrlenW (lpString=".xlsx") returned 5
	[0165.348] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0165.348] lstrlenW (lpString=".ppt") returned 4
	[0165.348] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0165.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.348] lstrlenW (lpString=".zip") returned 4
	[0165.348] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0165.348] lstrlenW (lpString=".rar") returned 4
	[0165.348] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0165.348] lstrlenW (lpString=".bz2") returned 4
	[0165.348] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0165.348] lstrlenW (lpString=".7z") returned 3
	[0165.348] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0165.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.348] lstrlenW (lpString=".dbf") returned 4
	[0165.348] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0165.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.348] lstrlenW (lpString=".1cd") returned 4
	[0165.348] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0165.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0165.348] lstrlenW (lpString=".jpg") returned 4
	[0165.348] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0165.349] lstrcmpiW (lpString1=".policy", lpString2=".money") returned 1
	[0165.349] lstrlenW (lpString="java.policy") returned 11
	[0165.349] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0165.350] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=2466) returned 1
	[0165.350] CloseHandle (hObject=0x500) returned 1
	[0165.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20
	[0165.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.350] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0165.350] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.350] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.350] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0165.351] GetLastError () returned 0x0
	[0165.351] ReadFile (in: hFile=0x500, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x9a2, lpOverlapped=0x0) returned 1
	[0165.877] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x9b0, lpOverlapped=0x0) returned 1
	[0165.879] ReadFile (in: hFile=0x500, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.879] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xea, lpOverlapped=0x0) returned 1
	[0165.879] SetEndOfFile (hFile=0x520) returned 1
	[0165.879] CloseHandle (hObject=0x520) returned 1
	[0165.880] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.880] SetEndOfFile (hFile=0x500) returned 1
	[0165.883] CloseHandle (hObject=0x500) returned 1
	[0165.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.884] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1
	[0165.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.885] lstrlenW (lpString=".doc") returned 4
	[0165.885] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0165.885] lstrlenW (lpString=".docx") returned 5
	[0165.885] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0165.885] lstrlenW (lpString=".pdf") returned 4
	[0165.885] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0165.885] lstrlenW (lpString=".xls") returned 4
	[0165.885] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0165.885] lstrlenW (lpString=".xlsx") returned 5
	[0165.885] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0165.885] lstrlenW (lpString=".ppt") returned 4
	[0165.885] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0165.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.885] lstrlenW (lpString=".zip") returned 4
	[0165.885] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0165.885] lstrlenW (lpString=".rar") returned 4
	[0165.885] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0165.885] lstrlenW (lpString=".bz2") returned 4
	[0165.885] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0165.885] lstrlenW (lpString=".7z") returned 3
	[0165.885] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0165.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.885] lstrlenW (lpString=".dbf") returned 4
	[0165.885] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0165.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.885] lstrlenW (lpString=".1cd") returned 4
	[0165.885] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0165.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.886] lstrlenW (lpString=".jpg") returned 4
	[0165.886] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0165.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.886] lstrlenW (lpString=".doc") returned 4
	[0165.886] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0165.886] lstrlenW (lpString=".docx") returned 5
	[0165.886] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0165.886] lstrlenW (lpString=".pdf") returned 4
	[0165.886] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0165.886] lstrlenW (lpString=".xls") returned 4
	[0165.886] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0165.886] lstrlenW (lpString=".xlsx") returned 5
	[0165.886] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0165.886] lstrlenW (lpString=".ppt") returned 4
	[0165.886] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0165.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.886] lstrlenW (lpString=".zip") returned 4
	[0165.886] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0165.886] lstrlenW (lpString=".rar") returned 4
	[0165.886] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0165.886] lstrlenW (lpString=".bz2") returned 4
	[0165.886] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0165.886] lstrlenW (lpString=".7z") returned 3
	[0165.886] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0165.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.886] lstrlenW (lpString=".dbf") returned 4
	[0165.887] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0165.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.887] lstrlenW (lpString=".1cd") returned 4
	[0165.887] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0165.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0165.887] lstrlenW (lpString=".jpg") returned 4
	[0165.887] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0165.887] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".money") returned -1
	[0165.887] lstrlenW (lpString="LICENSE") returned 7
	[0165.887] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0165.888] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=40) returned 1
	[0165.888] CloseHandle (hObject=0x500) returned 1
	[0165.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20
	[0165.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.888] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0165.888] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.888] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.888] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0165.889] GetLastError () returned 0x0
	[0165.889] ReadFile (in: hFile=0x500, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x28, lpOverlapped=0x0) returned 1
	[0165.890] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x30, lpOverlapped=0x0) returned 1
	[0165.892] ReadFile (in: hFile=0x500, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.892] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0165.892] SetEndOfFile (hFile=0x520) returned 1
	[0165.892] CloseHandle (hObject=0x520) returned 1
	[0165.892] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.892] SetEndOfFile (hFile=0x500) returned 1
	[0165.895] CloseHandle (hObject=0x500) returned 1
	[0165.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.896] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1
	[0165.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.896] lstrlenW (lpString=".doc") returned 4
	[0165.896] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1
	[0165.896] lstrlenW (lpString=".docx") returned 5
	[0165.896] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1
	[0165.896] lstrlenW (lpString=".pdf") returned 4
	[0165.896] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1
	[0165.896] lstrlenW (lpString=".xls") returned 4
	[0165.896] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1
	[0165.896] lstrlenW (lpString=".xlsx") returned 5
	[0165.897] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1
	[0165.897] lstrlenW (lpString=".ppt") returned 4
	[0165.897] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1
	[0165.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.897] lstrlenW (lpString=".zip") returned 4
	[0165.897] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1
	[0165.897] lstrlenW (lpString=".rar") returned 4
	[0165.897] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1
	[0165.897] lstrlenW (lpString=".bz2") returned 4
	[0165.897] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1
	[0165.897] lstrlenW (lpString=".7z") returned 3
	[0165.897] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1
	[0165.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.897] lstrlenW (lpString=".dbf") returned 4
	[0165.897] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1
	[0165.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.897] lstrlenW (lpString=".1cd") returned 4
	[0165.897] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1
	[0165.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.897] lstrlenW (lpString=".jpg") returned 4
	[0165.897] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1
	[0165.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.898] lstrlenW (lpString=".doc") returned 4
	[0165.898] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1
	[0165.898] lstrlenW (lpString=".docx") returned 5
	[0165.898] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1
	[0165.898] lstrlenW (lpString=".pdf") returned 4
	[0165.898] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1
	[0165.898] lstrlenW (lpString=".xls") returned 4
	[0165.898] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1
	[0165.898] lstrlenW (lpString=".xlsx") returned 5
	[0165.898] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1
	[0165.898] lstrlenW (lpString=".ppt") returned 4
	[0165.898] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1
	[0165.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.898] lstrlenW (lpString=".zip") returned 4
	[0165.898] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1
	[0165.898] lstrlenW (lpString=".rar") returned 4
	[0165.898] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1
	[0165.898] lstrlenW (lpString=".bz2") returned 4
	[0165.898] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1
	[0165.898] lstrlenW (lpString=".7z") returned 3
	[0165.898] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1
	[0165.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.898] lstrlenW (lpString=".dbf") returned 4
	[0165.898] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1
	[0165.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.898] lstrlenW (lpString=".1cd") returned 4
	[0165.898] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1
	[0165.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0165.899] lstrlenW (lpString=".jpg") returned 4
	[0165.899] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1
	[0165.899] lstrcmpiW (lpString1=".0_144\\release", lpString2=".money") returned -1
	[0165.899] lstrlenW (lpString="release") returned 7
	[0165.899] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0165.899] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=528) returned 1
	[0165.899] CloseHandle (hObject=0x500) returned 1
	[0165.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20
	[0165.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.900] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0165.900] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.900] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.900] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0165.901] GetLastError () returned 0x0
	[0165.901] ReadFile (in: hFile=0x500, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x210, lpOverlapped=0x0) returned 1
	[0165.902] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x220, lpOverlapped=0x0) returned 1
	[0165.903] ReadFile (in: hFile=0x500, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.903] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0165.903] SetEndOfFile (hFile=0x520) returned 1
	[0165.903] CloseHandle (hObject=0x520) returned 1
	[0165.904] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.904] SetEndOfFile (hFile=0x500) returned 1
	[0165.906] CloseHandle (hObject=0x500) returned 1
	[0165.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.907] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1
	[0165.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.908] lstrlenW (lpString=".doc") returned 4
	[0165.908] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1
	[0165.908] lstrlenW (lpString=".docx") returned 5
	[0165.908] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1
	[0165.908] lstrlenW (lpString=".pdf") returned 4
	[0165.908] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1
	[0165.908] lstrlenW (lpString=".xls") returned 4
	[0165.908] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1
	[0165.908] lstrlenW (lpString=".xlsx") returned 5
	[0165.908] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1
	[0165.908] lstrlenW (lpString=".ppt") returned 4
	[0165.908] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1
	[0165.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.908] lstrlenW (lpString=".zip") returned 4
	[0165.908] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1
	[0165.908] lstrlenW (lpString=".rar") returned 4
	[0165.908] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1
	[0165.908] lstrlenW (lpString=".bz2") returned 4
	[0165.908] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1
	[0165.908] lstrlenW (lpString=".7z") returned 3
	[0165.908] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1
	[0165.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.908] lstrlenW (lpString=".dbf") returned 4
	[0165.908] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1
	[0165.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.909] lstrlenW (lpString=".1cd") returned 4
	[0165.909] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1
	[0165.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.909] lstrlenW (lpString=".jpg") returned 4
	[0165.909] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1
	[0165.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.909] lstrlenW (lpString=".doc") returned 4
	[0165.909] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1
	[0165.909] lstrlenW (lpString=".docx") returned 5
	[0165.909] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1
	[0165.909] lstrlenW (lpString=".pdf") returned 4
	[0165.909] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1
	[0165.909] lstrlenW (lpString=".xls") returned 4
	[0165.909] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1
	[0165.909] lstrlenW (lpString=".xlsx") returned 5
	[0165.909] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1
	[0165.909] lstrlenW (lpString=".ppt") returned 4
	[0165.909] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1
	[0165.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.909] lstrlenW (lpString=".zip") returned 4
	[0165.909] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1
	[0165.909] lstrlenW (lpString=".rar") returned 4
	[0165.909] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1
	[0165.909] lstrlenW (lpString=".bz2") returned 4
	[0165.909] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1
	[0165.909] lstrlenW (lpString=".7z") returned 3
	[0165.910] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1
	[0165.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.910] lstrlenW (lpString=".dbf") returned 4
	[0165.910] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1
	[0165.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.910] lstrlenW (lpString=".1cd") returned 4
	[0165.910] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1
	[0165.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0165.910] lstrlenW (lpString=".jpg") returned 4
	[0165.910] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1
	[0165.910] lstrcmpiW (lpString1=".EXE", lpString2=".money") returned -1
	[0165.910] lstrlenW (lpString="OSPPREARM.EXE") returned 13
	[0165.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0166.107] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=27200) returned 1
	[0166.107] CloseHandle (hObject=0x55c) returned 1
	[0166.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20
	[0166.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.473] lstrlenW (lpString=".doc") returned 4
	[0166.473] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0166.473] lstrlenW (lpString=".docx") returned 5
	[0166.473] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1
	[0166.473] lstrlenW (lpString=".pdf") returned 4
	[0166.473] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0166.473] lstrlenW (lpString=".xls") returned 4
	[0166.474] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0166.474] lstrlenW (lpString=".xlsx") returned 5
	[0166.474] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1
	[0166.474] lstrlenW (lpString=".ppt") returned 4
	[0166.474] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0166.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.474] lstrlenW (lpString=".zip") returned 4
	[0166.474] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0166.474] lstrlenW (lpString=".rar") returned 4
	[0166.474] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0166.474] lstrlenW (lpString=".bz2") returned 4
	[0166.474] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0166.474] lstrlenW (lpString=".7z") returned 3
	[0166.474] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0166.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.474] lstrlenW (lpString=".dbf") returned 4
	[0166.474] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0166.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.474] lstrlenW (lpString=".1cd") returned 4
	[0166.474] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0166.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.474] lstrlenW (lpString=".jpg") returned 4
	[0166.474] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0166.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.474] lstrlenW (lpString=".doc") returned 4
	[0166.474] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0166.475] lstrlenW (lpString=".docx") returned 5
	[0166.475] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1
	[0166.475] lstrlenW (lpString=".pdf") returned 4
	[0166.475] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0166.475] lstrlenW (lpString=".xls") returned 4
	[0166.475] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0166.475] lstrlenW (lpString=".xlsx") returned 5
	[0166.475] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1
	[0166.475] lstrlenW (lpString=".ppt") returned 4
	[0166.475] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0166.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.475] lstrlenW (lpString=".zip") returned 4
	[0166.475] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0166.475] lstrlenW (lpString=".rar") returned 4
	[0166.475] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0166.475] lstrlenW (lpString=".bz2") returned 4
	[0166.475] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0166.475] lstrlenW (lpString=".7z") returned 3
	[0166.475] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0166.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.475] lstrlenW (lpString=".dbf") returned 4
	[0166.475] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0166.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.475] lstrlenW (lpString=".1cd") returned 4
	[0166.475] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0166.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0166.475] lstrlenW (lpString=".jpg") returned 4
	[0166.475] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0166.476] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.476] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31
	[0166.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0166.477] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=19648) returned 1
	[0166.477] CloseHandle (hObject=0x538) returned 1
	[0166.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220
	[0166.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.631] lstrlenW (lpString=".doc") returned 4
	[0166.631] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.631] lstrlenW (lpString=".docx") returned 5
	[0166.631] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.631] lstrlenW (lpString=".pdf") returned 4
	[0166.632] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.632] lstrlenW (lpString=".xls") returned 4
	[0166.632] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.632] lstrlenW (lpString=".xlsx") returned 5
	[0166.632] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.632] lstrlenW (lpString=".ppt") returned 4
	[0166.632] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.632] lstrlenW (lpString=".zip") returned 4
	[0166.632] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.632] lstrlenW (lpString=".rar") returned 4
	[0166.632] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.632] lstrlenW (lpString=".bz2") returned 4
	[0166.632] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.632] lstrlenW (lpString=".7z") returned 3
	[0166.632] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.632] lstrlenW (lpString=".dbf") returned 4
	[0166.632] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.632] lstrlenW (lpString=".1cd") returned 4
	[0166.632] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.632] lstrlenW (lpString=".jpg") returned 4
	[0166.632] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.632] lstrlenW (lpString=".doc") returned 4
	[0166.633] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.633] lstrlenW (lpString=".docx") returned 5
	[0166.633] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.633] lstrlenW (lpString=".pdf") returned 4
	[0166.633] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.633] lstrlenW (lpString=".xls") returned 4
	[0166.633] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.633] lstrlenW (lpString=".xlsx") returned 5
	[0166.633] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.633] lstrlenW (lpString=".ppt") returned 4
	[0166.633] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.633] lstrlenW (lpString=".zip") returned 4
	[0166.633] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.633] lstrlenW (lpString=".rar") returned 4
	[0166.633] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.633] lstrlenW (lpString=".bz2") returned 4
	[0166.633] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.633] lstrlenW (lpString=".7z") returned 3
	[0166.633] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.633] lstrlenW (lpString=".dbf") returned 4
	[0166.633] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.633] lstrlenW (lpString=".1cd") returned 4
	[0166.633] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0166.633] lstrlenW (lpString=".jpg") returned 4
	[0166.633] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.634] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.634] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33
	[0166.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0166.888] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=22720) returned 1
	[0166.888] CloseHandle (hObject=0x4b8) returned 1
	[0166.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220
	[0166.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.889] lstrlenW (lpString=".doc") returned 4
	[0166.889] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.889] lstrlenW (lpString=".docx") returned 5
	[0166.889] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.889] lstrlenW (lpString=".pdf") returned 4
	[0166.889] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.889] lstrlenW (lpString=".xls") returned 4
	[0166.889] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.889] lstrlenW (lpString=".xlsx") returned 5
	[0166.889] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.889] lstrlenW (lpString=".ppt") returned 4
	[0166.889] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.889] lstrlenW (lpString=".zip") returned 4
	[0166.889] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.889] lstrlenW (lpString=".rar") returned 4
	[0166.889] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.889] lstrlenW (lpString=".bz2") returned 4
	[0166.889] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.889] lstrlenW (lpString=".7z") returned 3
	[0166.889] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.890] lstrlenW (lpString=".dbf") returned 4
	[0166.890] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.890] lstrlenW (lpString=".1cd") returned 4
	[0166.890] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.890] lstrlenW (lpString=".jpg") returned 4
	[0166.890] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.890] lstrlenW (lpString=".doc") returned 4
	[0166.890] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.890] lstrlenW (lpString=".docx") returned 5
	[0166.890] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.890] lstrlenW (lpString=".pdf") returned 4
	[0166.890] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.890] lstrlenW (lpString=".xls") returned 4
	[0166.890] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.890] lstrlenW (lpString=".xlsx") returned 5
	[0166.890] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.890] lstrlenW (lpString=".ppt") returned 4
	[0166.890] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.890] lstrlenW (lpString=".zip") returned 4
	[0166.890] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.890] lstrlenW (lpString=".rar") returned 4
	[0166.891] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.891] lstrlenW (lpString=".bz2") returned 4
	[0166.891] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.891] lstrlenW (lpString=".7z") returned 3
	[0166.891] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.891] lstrlenW (lpString=".dbf") returned 4
	[0166.891] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.891] lstrlenW (lpString=".1cd") returned 4
	[0166.891] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79
	[0166.891] lstrlenW (lpString=".jpg") returned 4
	[0166.891] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.891] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.891] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30
	[0166.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0166.892] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=19648) returned 1
	[0166.892] CloseHandle (hObject=0x4b8) returned 1
	[0166.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220
	[0166.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.893] lstrlenW (lpString=".doc") returned 4
	[0166.893] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.893] lstrlenW (lpString=".docx") returned 5
	[0166.893] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.893] lstrlenW (lpString=".pdf") returned 4
	[0166.893] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.893] lstrlenW (lpString=".xls") returned 4
	[0166.893] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.893] lstrlenW (lpString=".xlsx") returned 5
	[0166.893] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.893] lstrlenW (lpString=".ppt") returned 4
	[0166.893] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.893] lstrlenW (lpString=".zip") returned 4
	[0166.894] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.894] lstrlenW (lpString=".rar") returned 4
	[0166.894] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.894] lstrlenW (lpString=".bz2") returned 4
	[0166.894] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.894] lstrlenW (lpString=".7z") returned 3
	[0166.894] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.894] lstrlenW (lpString=".dbf") returned 4
	[0166.894] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.894] lstrlenW (lpString=".1cd") returned 4
	[0166.894] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.894] lstrlenW (lpString=".jpg") returned 4
	[0166.894] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.894] lstrlenW (lpString=".doc") returned 4
	[0166.894] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.894] lstrlenW (lpString=".docx") returned 5
	[0166.894] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.894] lstrlenW (lpString=".pdf") returned 4
	[0166.894] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.894] lstrlenW (lpString=".xls") returned 4
	[0166.894] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.894] lstrlenW (lpString=".xlsx") returned 5
	[0166.894] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.895] lstrlenW (lpString=".ppt") returned 4
	[0166.895] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.895] lstrlenW (lpString=".zip") returned 4
	[0166.895] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.895] lstrlenW (lpString=".rar") returned 4
	[0166.895] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.895] lstrlenW (lpString=".bz2") returned 4
	[0166.895] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.895] lstrlenW (lpString=".7z") returned 3
	[0166.895] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.895] lstrlenW (lpString=".dbf") returned 4
	[0166.895] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.895] lstrlenW (lpString=".1cd") returned 4
	[0166.895] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0166.895] lstrlenW (lpString=".jpg") returned 4
	[0166.895] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.895] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.895] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32
	[0166.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0166.896] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=19136) returned 1
	[0166.896] CloseHandle (hObject=0x4b8) returned 1
	[0166.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220
	[0166.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.897] lstrlenW (lpString=".doc") returned 4
	[0166.897] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.897] lstrlenW (lpString=".docx") returned 5
	[0166.897] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.897] lstrlenW (lpString=".pdf") returned 4
	[0166.897] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.897] lstrlenW (lpString=".xls") returned 4
	[0166.897] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.897] lstrlenW (lpString=".xlsx") returned 5
	[0166.898] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.898] lstrlenW (lpString=".ppt") returned 4
	[0166.898] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.898] lstrlenW (lpString=".zip") returned 4
	[0166.898] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.898] lstrlenW (lpString=".rar") returned 4
	[0166.898] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.898] lstrlenW (lpString=".bz2") returned 4
	[0166.898] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.898] lstrlenW (lpString=".7z") returned 3
	[0166.898] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.898] lstrlenW (lpString=".dbf") returned 4
	[0166.898] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.898] lstrlenW (lpString=".1cd") returned 4
	[0166.898] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.898] lstrlenW (lpString=".jpg") returned 4
	[0166.898] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.898] lstrlenW (lpString=".doc") returned 4
	[0166.898] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.898] lstrlenW (lpString=".docx") returned 5
	[0166.898] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.899] lstrlenW (lpString=".pdf") returned 4
	[0166.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.899] lstrlenW (lpString=".xls") returned 4
	[0166.899] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.899] lstrlenW (lpString=".xlsx") returned 5
	[0166.899] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.899] lstrlenW (lpString=".ppt") returned 4
	[0166.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.899] lstrlenW (lpString=".zip") returned 4
	[0166.899] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.899] lstrlenW (lpString=".rar") returned 4
	[0166.899] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.899] lstrlenW (lpString=".bz2") returned 4
	[0166.899] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.899] lstrlenW (lpString=".7z") returned 3
	[0166.899] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.899] lstrlenW (lpString=".dbf") returned 4
	[0166.899] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.899] lstrlenW (lpString=".1cd") returned 4
	[0166.899] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0166.899] lstrlenW (lpString=".jpg") returned 4
	[0166.899] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.900] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.900] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30
	[0166.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0166.901] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=27840) returned 1
	[0166.901] CloseHandle (hObject=0x4b8) returned 1
	[0166.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220
	[0166.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0166.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0166.902] lstrlenW (lpString=".doc") returned 4
	[0166.902] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.902] lstrlenW (lpString=".docx") returned 5
	[0166.902] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.902] lstrlenW (lpString=".pdf") returned 4
	[0166.902] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.902] lstrlenW (lpString=".xls") returned 4
	[0166.902] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.902] lstrlenW (lpString=".xlsx") returned 5
	[0166.902] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.902] lstrlenW (lpString=".ppt") returned 4
	[0166.902] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0166.902] lstrlenW (lpString=".zip") returned 4
	[0166.902] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.902] lstrlenW (lpString=".rar") returned 4
	[0166.902] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.902] lstrlenW (lpString=".bz2") returned 4
	[0166.902] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.902] lstrlenW (lpString=".7z") returned 3
	[0166.902] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0166.902] lstrlenW (lpString=".dbf") returned 4
	[0166.902] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0166.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0166.919] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.920] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0166.920] GetLastError () returned 0x0
	[0166.920] ReadFile (in: hFile=0x4b8, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x1cd8, lpOverlapped=0x0) returned 1
	[0166.922] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x1ce0, lpOverlapped=0x0) returned 1
	[0166.923] ReadFile (in: hFile=0x4b8, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.923] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xea, lpOverlapped=0x0) returned 1
	[0166.923] SetEndOfFile (hFile=0x54c) returned 1
	[0166.923] CloseHandle (hObject=0x54c) returned 1
	[0166.924] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.924] SetEndOfFile (hFile=0x4b8) returned 1
	[0167.398] CloseHandle (hObject=0x4b8) returned 1
	[0167.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1
	[0167.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.407] lstrlenW (lpString=".doc") returned 4
	[0167.407] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.407] lstrlenW (lpString=".docx") returned 5
	[0167.407] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.407] lstrlenW (lpString=".pdf") returned 4
	[0167.407] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.407] lstrlenW (lpString=".xls") returned 4
	[0167.407] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.407] lstrlenW (lpString=".xlsx") returned 5
	[0167.407] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.407] lstrlenW (lpString=".ppt") returned 4
	[0167.407] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.407] lstrlenW (lpString=".zip") returned 4
	[0167.407] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.407] lstrlenW (lpString=".rar") returned 4
	[0167.407] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.407] lstrlenW (lpString=".bz2") returned 4
	[0167.407] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.407] lstrlenW (lpString=".7z") returned 3
	[0167.407] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.407] lstrlenW (lpString=".dbf") returned 4
	[0167.407] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.407] lstrlenW (lpString=".1cd") returned 4
	[0167.407] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.408] lstrlenW (lpString=".jpg") returned 4
	[0167.408] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.408] lstrlenW (lpString=".doc") returned 4
	[0167.408] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.408] lstrlenW (lpString=".docx") returned 5
	[0167.408] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.408] lstrlenW (lpString=".pdf") returned 4
	[0167.408] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.408] lstrlenW (lpString=".xls") returned 4
	[0167.408] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.408] lstrlenW (lpString=".xlsx") returned 5
	[0167.408] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.408] lstrlenW (lpString=".ppt") returned 4
	[0167.408] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.408] lstrlenW (lpString=".zip") returned 4
	[0167.408] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.408] lstrlenW (lpString=".rar") returned 4
	[0167.408] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.408] lstrlenW (lpString=".bz2") returned 4
	[0167.408] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.408] lstrlenW (lpString=".7z") returned 3
	[0167.408] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.408] lstrlenW (lpString=".dbf") returned 4
	[0167.409] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.409] lstrlenW (lpString=".1cd") returned 4
	[0167.409] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0167.409] lstrlenW (lpString=".jpg") returned 4
	[0167.409] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.409] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0167.409] lstrlenW (lpString="FINCL_01.MID") returned 12
	[0167.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0167.411] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=12981) returned 1
	[0167.411] CloseHandle (hObject=0x54c) returned 1
	[0167.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220
	[0167.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0167.411] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.412] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.412] GetLastError () returned 0x0
	[0167.412] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x32b5, lpOverlapped=0x0) returned 1
	[0167.436] WriteFile (in: hFile=0x550, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x32c0, lpOverlapped=0x0) returned 1
	[0167.437] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.437] WriteFile (in: hFile=0x550, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.437] SetEndOfFile (hFile=0x550) returned 1
	[0167.438] CloseHandle (hObject=0x550) returned 1
	[0167.457] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.457] SetEndOfFile (hFile=0x54c) returned 1
	[0167.460] CloseHandle (hObject=0x54c) returned 1
	[0167.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1
	[0167.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.463] lstrlenW (lpString=".doc") returned 4
	[0167.463] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.463] lstrlenW (lpString=".docx") returned 5
	[0167.463] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.463] lstrlenW (lpString=".pdf") returned 4
	[0167.463] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.463] lstrlenW (lpString=".xls") returned 4
	[0167.463] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.463] lstrlenW (lpString=".xlsx") returned 5
	[0167.463] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.463] lstrlenW (lpString=".ppt") returned 4
	[0167.463] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.463] lstrlenW (lpString=".zip") returned 4
	[0167.464] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.464] lstrlenW (lpString=".rar") returned 4
	[0167.464] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.464] lstrlenW (lpString=".bz2") returned 4
	[0167.464] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.464] lstrlenW (lpString=".7z") returned 3
	[0167.464] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.464] lstrlenW (lpString=".dbf") returned 4
	[0167.464] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.464] lstrlenW (lpString=".1cd") returned 4
	[0167.464] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.464] lstrlenW (lpString=".jpg") returned 4
	[0167.464] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.464] lstrlenW (lpString=".doc") returned 4
	[0167.464] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.464] lstrlenW (lpString=".docx") returned 5
	[0167.464] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.464] lstrlenW (lpString=".pdf") returned 4
	[0167.464] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.464] lstrlenW (lpString=".xls") returned 4
	[0167.464] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.464] lstrlenW (lpString=".xlsx") returned 5
	[0167.465] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.465] lstrlenW (lpString=".ppt") returned 4
	[0167.465] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.465] lstrlenW (lpString=".zip") returned 4
	[0167.465] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.465] lstrlenW (lpString=".rar") returned 4
	[0167.465] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.465] lstrlenW (lpString=".bz2") returned 4
	[0167.465] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.465] lstrlenW (lpString=".7z") returned 3
	[0167.465] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.465] lstrlenW (lpString=".dbf") returned 4
	[0167.465] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.465] lstrlenW (lpString=".1cd") returned 4
	[0167.465] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0167.465] lstrlenW (lpString=".jpg") returned 4
	[0167.465] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.466] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0167.466] lstrlenW (lpString="FINCL_02.MID") returned 12
	[0167.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0167.467] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=9318) returned 1
	[0167.467] CloseHandle (hObject=0x54c) returned 1
	[0167.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220
	[0167.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0167.468] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.468] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0167.769] GetLastError () returned 0x0
	[0167.769] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2466, lpOverlapped=0x0) returned 1
	[0167.771] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2470, lpOverlapped=0x0) returned 1
	[0167.772] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.772] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.772] SetEndOfFile (hFile=0x520) returned 1
	[0167.772] CloseHandle (hObject=0x520) returned 1
	[0167.772] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.772] SetEndOfFile (hFile=0x54c) returned 1
	[0167.776] CloseHandle (hObject=0x54c) returned 1
	[0167.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1
	[0167.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.777] lstrlenW (lpString=".doc") returned 4
	[0167.777] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.779] lstrlenW (lpString=".docx") returned 5
	[0167.779] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0167.779] lstrlenW (lpString=".pdf") returned 4
	[0167.779] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.779] lstrlenW (lpString=".xls") returned 4
	[0167.779] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.779] lstrlenW (lpString=".xlsx") returned 5
	[0167.780] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0167.780] lstrlenW (lpString=".ppt") returned 4
	[0167.780] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.780] lstrlenW (lpString=".zip") returned 4
	[0167.780] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.780] lstrlenW (lpString=".rar") returned 4
	[0167.780] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.780] lstrlenW (lpString=".bz2") returned 4
	[0167.780] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.780] lstrlenW (lpString=".7z") returned 3
	[0167.780] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.780] lstrlenW (lpString=".dbf") returned 4
	[0167.780] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.780] lstrlenW (lpString=".1cd") returned 4
	[0167.780] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.780] lstrlenW (lpString=".jpg") returned 4
	[0167.780] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.780] lstrlenW (lpString=".doc") returned 4
	[0167.780] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.780] lstrlenW (lpString=".docx") returned 5
	[0167.781] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0167.781] lstrlenW (lpString=".pdf") returned 4
	[0167.781] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.781] lstrlenW (lpString=".xls") returned 4
	[0167.781] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.781] lstrlenW (lpString=".xlsx") returned 5
	[0167.781] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0167.781] lstrlenW (lpString=".ppt") returned 4
	[0167.781] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.781] lstrlenW (lpString=".zip") returned 4
	[0167.781] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.781] lstrlenW (lpString=".rar") returned 4
	[0167.781] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.781] lstrlenW (lpString=".bz2") returned 4
	[0167.781] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.781] lstrlenW (lpString=".7z") returned 3
	[0167.781] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.781] lstrlenW (lpString=".dbf") returned 4
	[0167.781] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.781] lstrlenW (lpString=".1cd") returned 4
	[0167.781] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0167.781] lstrlenW (lpString=".jpg") returned 4
	[0167.781] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.782] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0167.782] lstrlenW (lpString="JAVA_01.MID") returned 11
	[0167.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0167.784] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=9797) returned 1
	[0167.784] CloseHandle (hObject=0x54c) returned 1
	[0167.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220
	[0167.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0167.784] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.785] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0167.785] GetLastError () returned 0x0
	[0167.785] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2645, lpOverlapped=0x0) returned 1
	[0167.787] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2650, lpOverlapped=0x0) returned 1
	[0167.788] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.788] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xea, lpOverlapped=0x0) returned 1
	[0167.789] SetEndOfFile (hFile=0x520) returned 1
	[0167.789] CloseHandle (hObject=0x520) returned 1
	[0167.789] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.789] SetEndOfFile (hFile=0x54c) returned 1
	[0168.308] CloseHandle (hObject=0x54c) returned 1
	[0168.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1
	[0168.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.310] lstrlenW (lpString=".doc") returned 4
	[0168.310] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.310] lstrlenW (lpString=".docx") returned 5
	[0168.310] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.310] lstrlenW (lpString=".pdf") returned 4
	[0168.310] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.310] lstrlenW (lpString=".xls") returned 4
	[0168.310] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.310] lstrlenW (lpString=".xlsx") returned 5
	[0168.310] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.310] lstrlenW (lpString=".ppt") returned 4
	[0168.310] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.310] lstrlenW (lpString=".zip") returned 4
	[0168.310] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.310] lstrlenW (lpString=".rar") returned 4
	[0168.310] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.310] lstrlenW (lpString=".bz2") returned 4
	[0168.310] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.310] lstrlenW (lpString=".7z") returned 3
	[0168.311] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.311] lstrlenW (lpString=".dbf") returned 4
	[0168.311] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.311] lstrlenW (lpString=".1cd") returned 4
	[0168.311] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.311] lstrlenW (lpString=".jpg") returned 4
	[0168.311] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.311] lstrlenW (lpString=".doc") returned 4
	[0168.311] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.311] lstrlenW (lpString=".docx") returned 5
	[0168.311] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.311] lstrlenW (lpString=".pdf") returned 4
	[0168.311] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.311] lstrlenW (lpString=".xls") returned 4
	[0168.311] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.311] lstrlenW (lpString=".xlsx") returned 5
	[0168.311] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.311] lstrlenW (lpString=".ppt") returned 4
	[0168.311] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.312] lstrlenW (lpString=".zip") returned 4
	[0168.312] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.312] lstrlenW (lpString=".rar") returned 4
	[0168.312] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.312] lstrlenW (lpString=".bz2") returned 4
	[0168.312] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.312] lstrlenW (lpString=".7z") returned 3
	[0168.312] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.312] lstrlenW (lpString=".dbf") returned 4
	[0168.312] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.312] lstrlenW (lpString=".1cd") returned 4
	[0168.312] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0168.312] lstrlenW (lpString=".jpg") returned 4
	[0168.312] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.312] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0168.312] lstrlenW (lpString="JNGLE_01.MID") returned 12
	[0168.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0168.313] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=5843) returned 1
	[0168.313] CloseHandle (hObject=0x54c) returned 1
	[0168.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220
	[0168.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0168.314] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.314] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0168.315] GetLastError () returned 0x0
	[0168.315] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x16d3, lpOverlapped=0x0) returned 1
	[0168.319] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x16e0, lpOverlapped=0x0) returned 1
	[0168.320] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.320] WriteFile (in: hFile=0x520, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.320] SetEndOfFile (hFile=0x520) returned 1
	[0168.320] CloseHandle (hObject=0x520) returned 1
	[0168.320] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.321] SetEndOfFile (hFile=0x54c) returned 1
	[0168.323] CloseHandle (hObject=0x54c) returned 1
	[0168.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1
	[0169.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.023] lstrlenW (lpString=".doc") returned 4
	[0169.023] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.023] lstrlenW (lpString=".docx") returned 5
	[0169.023] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.023] lstrlenW (lpString=".pdf") returned 4
	[0169.023] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.023] lstrlenW (lpString=".xls") returned 4
	[0169.023] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.023] lstrlenW (lpString=".xlsx") returned 5
	[0169.023] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.023] lstrlenW (lpString=".ppt") returned 4
	[0169.023] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.023] lstrlenW (lpString=".zip") returned 4
	[0169.023] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.023] lstrlenW (lpString=".rar") returned 4
	[0169.023] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.023] lstrlenW (lpString=".bz2") returned 4
	[0169.023] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.023] lstrlenW (lpString=".7z") returned 3
	[0169.023] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.023] lstrlenW (lpString=".dbf") returned 4
	[0169.023] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.024] lstrlenW (lpString=".1cd") returned 4
	[0169.024] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.024] lstrlenW (lpString=".jpg") returned 4
	[0169.024] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.024] lstrlenW (lpString=".doc") returned 4
	[0169.024] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.024] lstrlenW (lpString=".docx") returned 5
	[0169.024] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.024] lstrlenW (lpString=".pdf") returned 4
	[0169.024] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.024] lstrlenW (lpString=".xls") returned 4
	[0169.024] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.024] lstrlenW (lpString=".xlsx") returned 5
	[0169.024] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.024] lstrlenW (lpString=".ppt") returned 4
	[0169.024] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.024] lstrlenW (lpString=".zip") returned 4
	[0169.024] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.024] lstrlenW (lpString=".rar") returned 4
	[0169.024] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.024] lstrlenW (lpString=".bz2") returned 4
	[0169.024] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.024] lstrlenW (lpString=".7z") returned 3
	[0169.025] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.025] lstrlenW (lpString=".dbf") returned 4
	[0169.025] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.025] lstrlenW (lpString=".1cd") returned 4
	[0169.025] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0169.025] lstrlenW (lpString=".jpg") returned 4
	[0169.025] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.025] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.025] lstrlenW (lpString="PARNT_06.MID") returned 12
	[0169.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.026] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=7768) returned 1
	[0169.026] CloseHandle (hObject=0x55c) returned 1
	[0169.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220
	[0169.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.027] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.027] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.028] GetLastError () returned 0x0
	[0169.028] ReadFile (in: hFile=0x55c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x1e58, lpOverlapped=0x0) returned 1
	[0169.029] WriteFile (in: hFile=0x550, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x1e60, lpOverlapped=0x0) returned 1
	[0169.030] ReadFile (in: hFile=0x55c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.030] WriteFile (in: hFile=0x550, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.031] SetEndOfFile (hFile=0x550) returned 1
	[0169.031] CloseHandle (hObject=0x550) returned 1
	[0169.031] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.031] SetEndOfFile (hFile=0x55c) returned 1
	[0169.034] CloseHandle (hObject=0x55c) returned 1
	[0169.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1
	[0169.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.035] lstrlenW (lpString=".doc") returned 4
	[0169.035] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.035] lstrlenW (lpString=".docx") returned 5
	[0169.035] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1
	[0169.035] lstrlenW (lpString=".pdf") returned 4
	[0169.035] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.035] lstrlenW (lpString=".xls") returned 4
	[0169.035] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.035] lstrlenW (lpString=".xlsx") returned 5
	[0169.035] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1
	[0169.035] lstrlenW (lpString=".ppt") returned 4
	[0169.035] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.035] lstrlenW (lpString=".zip") returned 4
	[0169.035] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.035] lstrlenW (lpString=".rar") returned 4
	[0169.035] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.035] lstrlenW (lpString=".bz2") returned 4
	[0169.035] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.035] lstrlenW (lpString=".7z") returned 3
	[0169.035] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.035] lstrlenW (lpString=".dbf") returned 4
	[0169.035] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.036] lstrlenW (lpString=".1cd") returned 4
	[0169.036] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.036] lstrlenW (lpString=".jpg") returned 4
	[0169.036] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.036] lstrlenW (lpString=".doc") returned 4
	[0169.036] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.036] lstrlenW (lpString=".docx") returned 5
	[0169.036] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1
	[0169.036] lstrlenW (lpString=".pdf") returned 4
	[0169.036] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.036] lstrlenW (lpString=".xls") returned 4
	[0169.036] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.036] lstrlenW (lpString=".xlsx") returned 5
	[0169.036] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1
	[0169.036] lstrlenW (lpString=".ppt") returned 4
	[0169.036] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.036] lstrlenW (lpString=".zip") returned 4
	[0169.036] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.036] lstrlenW (lpString=".rar") returned 4
	[0169.036] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.036] lstrlenW (lpString=".bz2") returned 4
	[0169.037] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.037] lstrlenW (lpString=".7z") returned 3
	[0169.037] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.037] lstrlenW (lpString=".dbf") returned 4
	[0169.037] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.037] lstrlenW (lpString=".1cd") returned 4
	[0169.037] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0169.037] lstrlenW (lpString=".jpg") returned 4
	[0169.037] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.037] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.037] lstrlenW (lpString="PARNT_07.MID") returned 12
	[0169.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.038] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=6564) returned 1
	[0169.038] CloseHandle (hObject=0x55c) returned 1
	[0169.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220
	[0169.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.038] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.038] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.040] GetLastError () returned 0x0
	[0169.040] ReadFile (in: hFile=0x55c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x19a4, lpOverlapped=0x0) returned 1
	[0169.041] WriteFile (in: hFile=0x550, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x19b0, lpOverlapped=0x0) returned 1
	[0169.042] ReadFile (in: hFile=0x55c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.042] WriteFile (in: hFile=0x550, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.042] SetEndOfFile (hFile=0x550) returned 1
	[0169.042] CloseHandle (hObject=0x550) returned 1
	[0169.043] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.043] SetEndOfFile (hFile=0x55c) returned 1
	[0169.046] CloseHandle (hObject=0x55c) returned 1
	[0169.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1
	[0169.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.047] lstrlenW (lpString=".doc") returned 4
	[0169.047] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.047] lstrlenW (lpString=".docx") returned 5
	[0169.047] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1
	[0169.047] lstrlenW (lpString=".pdf") returned 4
	[0169.047] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.047] lstrlenW (lpString=".xls") returned 4
	[0169.047] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.047] lstrlenW (lpString=".xlsx") returned 5
	[0169.047] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1
	[0169.047] lstrlenW (lpString=".ppt") returned 4
	[0169.047] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.047] lstrlenW (lpString=".zip") returned 4
	[0169.047] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.047] lstrlenW (lpString=".rar") returned 4
	[0169.047] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.047] lstrlenW (lpString=".bz2") returned 4
	[0169.047] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.047] lstrlenW (lpString=".7z") returned 3
	[0169.047] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.047] lstrlenW (lpString=".dbf") returned 4
	[0169.047] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.047] lstrlenW (lpString=".1cd") returned 4
	[0169.048] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.048] lstrlenW (lpString=".jpg") returned 4
	[0169.048] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.048] lstrlenW (lpString=".doc") returned 4
	[0169.048] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.048] lstrlenW (lpString=".docx") returned 5
	[0169.048] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1
	[0169.048] lstrlenW (lpString=".pdf") returned 4
	[0169.048] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.048] lstrlenW (lpString=".xls") returned 4
	[0169.048] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.048] lstrlenW (lpString=".xlsx") returned 5
	[0169.048] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1
	[0169.048] lstrlenW (lpString=".ppt") returned 4
	[0169.048] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.048] lstrlenW (lpString=".zip") returned 4
	[0169.048] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.048] lstrlenW (lpString=".rar") returned 4
	[0169.048] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.048] lstrlenW (lpString=".bz2") returned 4
	[0169.048] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.048] lstrlenW (lpString=".7z") returned 3
	[0169.048] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.049] lstrlenW (lpString=".dbf") returned 4
	[0169.049] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.049] lstrlenW (lpString=".1cd") returned 4
	[0169.049] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0169.049] lstrlenW (lpString=".jpg") returned 4
	[0169.049] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.049] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.049] lstrlenW (lpString="PARNT_08.MID") returned 12
	[0169.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.050] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=7347) returned 1
	[0169.050] CloseHandle (hObject=0x55c) returned 1
	[0169.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220
	[0169.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.051] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.051] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.054] GetLastError () returned 0x0
	[0169.054] ReadFile (in: hFile=0x55c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x1cb3, lpOverlapped=0x0) returned 1
	[0169.055] WriteFile (in: hFile=0x550, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x1cc0, lpOverlapped=0x0) returned 1
	[0169.056] ReadFile (in: hFile=0x55c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.056] WriteFile (in: hFile=0x550, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.056] SetEndOfFile (hFile=0x550) returned 1
	[0169.056] CloseHandle (hObject=0x550) returned 1
	[0169.057] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.057] SetEndOfFile (hFile=0x55c) returned 1
	[0169.134] CloseHandle (hObject=0x55c) returned 1
	[0169.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1
	[0170.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.190] lstrlenW (lpString=".doc") returned 4
	[0170.190] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0170.191] lstrlenW (lpString=".docx") returned 5
	[0170.191] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1
	[0170.191] lstrlenW (lpString=".pdf") returned 4
	[0170.191] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0170.191] lstrlenW (lpString=".xls") returned 4
	[0170.191] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0170.191] lstrlenW (lpString=".xlsx") returned 5
	[0170.191] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1
	[0170.191] lstrlenW (lpString=".ppt") returned 4
	[0170.191] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0170.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.191] lstrlenW (lpString=".zip") returned 4
	[0170.191] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0170.191] lstrlenW (lpString=".rar") returned 4
	[0170.191] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0170.191] lstrlenW (lpString=".bz2") returned 4
	[0170.191] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0170.191] lstrlenW (lpString=".7z") returned 3
	[0170.191] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0170.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.191] lstrlenW (lpString=".dbf") returned 4
	[0170.191] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0170.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.191] lstrlenW (lpString=".1cd") returned 4
	[0170.191] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0170.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.192] lstrlenW (lpString=".jpg") returned 4
	[0170.192] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0170.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.192] lstrlenW (lpString=".doc") returned 4
	[0170.192] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0170.192] lstrlenW (lpString=".docx") returned 5
	[0170.192] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1
	[0170.192] lstrlenW (lpString=".pdf") returned 4
	[0170.192] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0170.192] lstrlenW (lpString=".xls") returned 4
	[0170.192] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0170.192] lstrlenW (lpString=".xlsx") returned 5
	[0170.192] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1
	[0170.192] lstrlenW (lpString=".ppt") returned 4
	[0170.192] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0170.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.192] lstrlenW (lpString=".zip") returned 4
	[0170.192] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0170.192] lstrlenW (lpString=".rar") returned 4
	[0170.192] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0170.192] lstrlenW (lpString=".bz2") returned 4
	[0170.192] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0170.192] lstrlenW (lpString=".7z") returned 3
	[0170.192] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0170.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.193] lstrlenW (lpString=".dbf") returned 4
	[0170.193] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0170.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.193] lstrlenW (lpString=".1cd") returned 4
	[0170.193] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0170.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0170.193] lstrlenW (lpString=".jpg") returned 4
	[0170.193] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0170.193] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0170.193] lstrlenW (lpString="Glossy.eftx") returned 11
	[0170.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0170.469] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=335038) returned 1
	[0170.469] CloseHandle (hObject=0x534) returned 1
	[0170.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220
	[0170.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0170.469] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.469] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0170.470] GetLastError () returned 0x0
	[0170.470] ReadFile (in: hFile=0x534, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x51cbe, lpOverlapped=0x0) returned 1
	[0170.482] WriteFile (in: hFile=0x36c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x51cc0, lpOverlapped=0x0) returned 1
	[0170.489] ReadFile (in: hFile=0x534, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.489] WriteFile (in: hFile=0x36c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xea, lpOverlapped=0x0) returned 1
	[0170.489] SetEndOfFile (hFile=0x36c) returned 1
	[0170.489] CloseHandle (hObject=0x36c) returned 1
	[0170.489] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.490] SetEndOfFile (hFile=0x534) returned 1
	[0170.961] CloseHandle (hObject=0x534) returned 1
	[0170.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1
	[0171.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.874] lstrlenW (lpString=".doc") returned 4
	[0171.874] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.874] lstrlenW (lpString=".docx") returned 5
	[0171.874] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.874] lstrlenW (lpString=".pdf") returned 4
	[0171.874] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.874] lstrlenW (lpString=".xls") returned 4
	[0171.874] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.874] lstrlenW (lpString=".xlsx") returned 5
	[0171.874] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.874] lstrlenW (lpString=".ppt") returned 4
	[0171.874] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.874] lstrlenW (lpString=".zip") returned 4
	[0171.874] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.874] lstrlenW (lpString=".rar") returned 4
	[0171.874] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.875] lstrlenW (lpString=".bz2") returned 4
	[0171.875] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.875] lstrlenW (lpString=".7z") returned 3
	[0171.875] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.875] lstrlenW (lpString=".dbf") returned 4
	[0171.875] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.875] lstrlenW (lpString=".1cd") returned 4
	[0171.875] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.875] lstrlenW (lpString=".jpg") returned 4
	[0171.875] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.875] lstrlenW (lpString=".doc") returned 4
	[0171.875] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.875] lstrlenW (lpString=".docx") returned 5
	[0171.875] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.875] lstrlenW (lpString=".pdf") returned 4
	[0171.875] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.875] lstrlenW (lpString=".xls") returned 4
	[0171.875] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.875] lstrlenW (lpString=".xlsx") returned 5
	[0171.875] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.875] lstrlenW (lpString=".ppt") returned 4
	[0171.875] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.876] lstrlenW (lpString=".zip") returned 4
	[0171.876] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.876] lstrlenW (lpString=".rar") returned 4
	[0171.876] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.876] lstrlenW (lpString=".bz2") returned 4
	[0171.876] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.876] lstrlenW (lpString=".7z") returned 3
	[0171.876] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.876] lstrlenW (lpString=".dbf") returned 4
	[0171.876] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.876] lstrlenW (lpString=".1cd") returned 4
	[0171.876] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0171.876] lstrlenW (lpString=".jpg") returned 4
	[0171.876] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.876] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.876] lstrlenW (lpString="Microsoft.AppV.Eventing.dll") returned 27
	[0171.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0171.878] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=96472) returned 1
	[0171.878] CloseHandle (hObject=0x548) returned 1
	[0171.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll")) returned 0x220
	[0171.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.878] lstrlenW (lpString=".doc") returned 4
	[0171.878] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.878] lstrlenW (lpString=".docx") returned 5
	[0171.878] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0171.878] lstrlenW (lpString=".pdf") returned 4
	[0171.878] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.878] lstrlenW (lpString=".xls") returned 4
	[0171.878] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.879] lstrlenW (lpString=".xlsx") returned 5
	[0171.879] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0171.879] lstrlenW (lpString=".ppt") returned 4
	[0171.879] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.879] lstrlenW (lpString=".zip") returned 4
	[0171.879] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.879] lstrlenW (lpString=".rar") returned 4
	[0171.879] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.879] lstrlenW (lpString=".bz2") returned 4
	[0171.879] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.879] lstrlenW (lpString=".7z") returned 3
	[0171.879] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.879] lstrlenW (lpString=".dbf") returned 4
	[0171.879] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.879] lstrlenW (lpString=".1cd") returned 4
	[0171.879] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.879] lstrlenW (lpString=".jpg") returned 4
	[0171.879] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.879] lstrlenW (lpString=".doc") returned 4
	[0171.880] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.880] lstrlenW (lpString=".docx") returned 5
	[0171.880] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0171.880] lstrlenW (lpString=".pdf") returned 4
	[0171.880] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.880] lstrlenW (lpString=".xls") returned 4
	[0171.880] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.880] lstrlenW (lpString=".xlsx") returned 5
	[0171.880] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0171.880] lstrlenW (lpString=".ppt") returned 4
	[0171.880] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.880] lstrlenW (lpString=".zip") returned 4
	[0171.880] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.880] lstrlenW (lpString=".rar") returned 4
	[0171.880] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.880] lstrlenW (lpString=".bz2") returned 4
	[0171.880] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.880] lstrlenW (lpString=".7z") returned 3
	[0171.880] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.880] lstrlenW (lpString=".dbf") returned 4
	[0171.880] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.880] lstrlenW (lpString=".1cd") returned 4
	[0171.880] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0171.880] lstrlenW (lpString=".jpg") returned 4
	[0171.880] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.881] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.881] lstrlenW (lpString="Microsoft.AppV.Modernizer.Common.dll") returned 36
	[0171.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0171.881] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=49368) returned 1
	[0171.881] CloseHandle (hObject=0x548) returned 1
	[0171.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll")) returned 0x220
	[0171.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.882] lstrlenW (lpString=".doc") returned 4
	[0171.882] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.882] lstrlenW (lpString=".docx") returned 5
	[0171.882] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0171.882] lstrlenW (lpString=".pdf") returned 4
	[0171.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.882] lstrlenW (lpString=".xls") returned 4
	[0171.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.882] lstrlenW (lpString=".xlsx") returned 5
	[0171.882] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0171.882] lstrlenW (lpString=".ppt") returned 4
	[0171.882] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.883] lstrlenW (lpString=".zip") returned 4
	[0171.883] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.883] lstrlenW (lpString=".rar") returned 4
	[0171.883] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.883] lstrlenW (lpString=".bz2") returned 4
	[0171.883] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.883] lstrlenW (lpString=".7z") returned 3
	[0171.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.883] lstrlenW (lpString=".dbf") returned 4
	[0171.883] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.883] lstrlenW (lpString=".1cd") returned 4
	[0171.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.883] lstrlenW (lpString=".jpg") returned 4
	[0171.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.883] lstrlenW (lpString=".doc") returned 4
	[0171.883] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.883] lstrlenW (lpString=".docx") returned 5
	[0171.883] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0171.883] lstrlenW (lpString=".pdf") returned 4
	[0171.883] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.883] lstrlenW (lpString=".xls") returned 4
	[0171.884] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.884] lstrlenW (lpString=".xlsx") returned 5
	[0171.884] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0171.884] lstrlenW (lpString=".ppt") returned 4
	[0171.884] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.884] lstrlenW (lpString=".zip") returned 4
	[0171.884] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.884] lstrlenW (lpString=".rar") returned 4
	[0171.884] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.884] lstrlenW (lpString=".bz2") returned 4
	[0171.884] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.884] lstrlenW (lpString=".7z") returned 3
	[0171.884] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.884] lstrlenW (lpString=".dbf") returned 4
	[0171.884] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.884] lstrlenW (lpString=".1cd") returned 4
	[0171.884] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0171.885] lstrlenW (lpString=".jpg") returned 4
	[0171.885] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.885] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.885] lstrlenW (lpString="Microsoft.AppV.Modernizer.CSharp.dll") returned 36
	[0171.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0171.885] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=363736) returned 1
	[0171.885] CloseHandle (hObject=0x548) returned 1
	[0171.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll")) returned 0x220
	[0171.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.886] lstrlenW (lpString=".doc") returned 4
	[0171.886] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.886] lstrlenW (lpString=".docx") returned 5
	[0171.886] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0171.886] lstrlenW (lpString=".pdf") returned 4
	[0171.886] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.886] lstrlenW (lpString=".xls") returned 4
	[0171.886] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.886] lstrlenW (lpString=".xlsx") returned 5
	[0171.886] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0171.886] lstrlenW (lpString=".ppt") returned 4
	[0171.886] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.887] lstrlenW (lpString=".zip") returned 4
	[0171.887] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.887] lstrlenW (lpString=".rar") returned 4
	[0171.887] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.887] lstrlenW (lpString=".bz2") returned 4
	[0171.887] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.887] lstrlenW (lpString=".7z") returned 3
	[0171.887] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.887] lstrlenW (lpString=".dbf") returned 4
	[0171.887] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.887] lstrlenW (lpString=".1cd") returned 4
	[0171.887] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.887] lstrlenW (lpString=".jpg") returned 4
	[0171.887] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.887] lstrlenW (lpString=".doc") returned 4
	[0171.887] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.887] lstrlenW (lpString=".docx") returned 5
	[0171.887] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0171.887] lstrlenW (lpString=".pdf") returned 4
	[0171.887] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.887] lstrlenW (lpString=".xls") returned 4
	[0171.888] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.888] lstrlenW (lpString=".xlsx") returned 5
	[0171.888] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0171.888] lstrlenW (lpString=".ppt") returned 4
	[0171.888] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.888] lstrlenW (lpString=".zip") returned 4
	[0171.888] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.888] lstrlenW (lpString=".rar") returned 4
	[0171.888] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.888] lstrlenW (lpString=".bz2") returned 4
	[0171.888] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.888] lstrlenW (lpString=".7z") returned 3
	[0171.888] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.888] lstrlenW (lpString=".dbf") returned 4
	[0171.888] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.888] lstrlenW (lpString=".1cd") returned 4
	[0171.888] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0171.888] lstrlenW (lpString=".jpg") returned 4
	[0171.888] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.888] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.888] lstrlenW (lpString="Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 40
	[0171.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0171.890] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=6890712) returned 1
	[0171.890] CloseHandle (hObject=0x548) returned 1
	[0171.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll")) returned 0x220
	[0171.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0171.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.890] lstrlenW (lpString=".doc") returned 4
	[0171.890] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.890] lstrlenW (lpString=".docx") returned 5
	[0171.890] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0171.890] lstrlenW (lpString=".pdf") returned 4
	[0171.890] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.890] lstrlenW (lpString=".xls") returned 4
	[0171.890] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.891] lstrlenW (lpString=".xlsx") returned 5
	[0171.891] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0171.891] lstrlenW (lpString=".ppt") returned 4
	[0171.891] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.891] lstrlenW (lpString=".zip") returned 4
	[0171.891] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.891] lstrlenW (lpString=".rar") returned 4
	[0171.891] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.891] lstrlenW (lpString=".bz2") returned 4
	[0171.891] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.891] lstrlenW (lpString=".7z") returned 3
	[0171.891] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.891] lstrlenW (lpString=".dbf") returned 4
	[0171.891] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.891] lstrlenW (lpString=".1cd") returned 4
	[0171.891] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.891] lstrlenW (lpString=".jpg") returned 4
	[0171.891] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.891] lstrlenW (lpString=".doc") returned 4
	[0171.891] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.891] lstrlenW (lpString=".docx") returned 5
	[0171.892] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0171.892] lstrlenW (lpString=".pdf") returned 4
	[0171.892] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.892] lstrlenW (lpString=".xls") returned 4
	[0171.892] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.892] lstrlenW (lpString=".xlsx") returned 5
	[0171.892] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0171.892] lstrlenW (lpString=".ppt") returned 4
	[0171.892] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.892] lstrlenW (lpString=".zip") returned 4
	[0171.892] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.892] lstrlenW (lpString=".rar") returned 4
	[0171.892] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.892] lstrlenW (lpString=".bz2") returned 4
	[0171.892] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.892] lstrlenW (lpString=".7z") returned 3
	[0171.892] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.892] lstrlenW (lpString=".dbf") returned 4
	[0171.892] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.892] lstrlenW (lpString=".1cd") returned 4
	[0171.892] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0171.892] lstrlenW (lpString=".jpg") returned 4
	[0171.892] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.893] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.893] lstrlenW (lpString="Microsoft.Tools.BinaryStore.dll") returned 31
	[0171.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0171.894] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=73312) returned 1
	[0171.894] CloseHandle (hObject=0x548) returned 1
	[0171.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll")) returned 0x220
	[0171.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.894] lstrlenW (lpString=".doc") returned 4
	[0171.894] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.895] lstrlenW (lpString=".docx") returned 5
	[0171.895] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0171.895] lstrlenW (lpString=".pdf") returned 4
	[0171.895] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.895] lstrlenW (lpString=".xls") returned 4
	[0171.895] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.895] lstrlenW (lpString=".xlsx") returned 5
	[0171.895] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0171.895] lstrlenW (lpString=".ppt") returned 4
	[0171.895] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.895] lstrlenW (lpString=".zip") returned 4
	[0171.895] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.895] lstrlenW (lpString=".rar") returned 4
	[0171.895] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.895] lstrlenW (lpString=".bz2") returned 4
	[0171.895] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.895] lstrlenW (lpString=".7z") returned 3
	[0171.895] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.895] lstrlenW (lpString=".dbf") returned 4
	[0171.895] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.895] lstrlenW (lpString=".1cd") returned 4
	[0171.895] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.895] lstrlenW (lpString=".jpg") returned 4
	[0171.895] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.896] lstrlenW (lpString=".doc") returned 4
	[0171.896] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.896] lstrlenW (lpString=".docx") returned 5
	[0171.896] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0171.896] lstrlenW (lpString=".pdf") returned 4
	[0171.896] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.896] lstrlenW (lpString=".xls") returned 4
	[0171.896] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.896] lstrlenW (lpString=".xlsx") returned 5
	[0171.896] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0171.896] lstrlenW (lpString=".ppt") returned 4
	[0171.896] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.896] lstrlenW (lpString=".zip") returned 4
	[0171.896] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.896] lstrlenW (lpString=".rar") returned 4
	[0171.897] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.897] lstrlenW (lpString=".bz2") returned 4
	[0171.897] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.897] lstrlenW (lpString=".7z") returned 3
	[0171.897] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.897] lstrlenW (lpString=".dbf") returned 4
	[0171.897] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.897] lstrlenW (lpString=".1cd") returned 4
	[0171.897] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0171.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0171.897] lstrlenW (lpString=".jpg") returned 4
	[0171.897] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0171.897] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0171.897] lstrlenW (lpString="Microsoft.Tools.Office.C2R.Common.dll") returned 37
	[0171.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0171.898] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=31328) returned 1
	[0171.898] CloseHandle (hObject=0x548) returned 1
	[0171.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll")) returned 0x220
	[0171.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0171.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0171.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0171.899] lstrlenW (lpString=".doc") returned 4
	[0171.899] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0171.899] lstrlenW (lpString=".docx") returned 5
	[0171.899] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0171.899] lstrlenW (lpString=".pdf") returned 4
	[0171.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0171.899] lstrlenW (lpString=".xls") returned 4
	[0171.899] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0171.899] lstrlenW (lpString=".xlsx") returned 5
	[0171.899] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0171.899] lstrlenW (lpString=".ppt") returned 4
	[0171.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0171.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0171.899] lstrlenW (lpString=".zip") returned 4
	[0171.899] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0171.899] lstrlenW (lpString=".rar") returned 4
	[0171.899] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0171.899] lstrlenW (lpString=".bz2") returned 4
	[0171.900] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0171.900] lstrlenW (lpString=".7z") returned 3
	[0171.900] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0171.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0171.900] lstrlenW (lpString=".dbf") returned 4
	[0171.900] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0171.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[admin@stex777.com].money")) returned 0
	[0172.231] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=25876480) returned 1
	[0172.232] CloseHandle (hObject=0x370) returned 1
	[0172.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp")) returned 0x220
	[0172.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[admin@stex777.com].money")) returned 0
	[0172.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[admin@stex777.com].money")) returned 0
	[0172.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[admin@stex777.com].money")) returned 0
	[0172.283] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.284] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0173.345] GetLastError () returned 0x0
	[0173.345] ReadFile (in: hFile=0x370, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0xfa976, lpOverlapped=0x0) returned 1
	[0173.376] WriteFile (in: hFile=0x540, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xfa980, lpOverlapped=0x0) returned 1
	[0173.566] ReadFile (in: hFile=0x370, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.566] WriteFile (in: hFile=0x540, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0173.566] SetEndOfFile (hFile=0x540) returned 1
	[0173.566] CloseHandle (hObject=0x540) returned 1
	[0173.566] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.566] SetEndOfFile (hFile=0x370) returned 1
	[0173.588] CloseHandle (hObject=0x370) returned 1
	[0173.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 1
	[0173.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.643] lstrlenW (lpString=".doc") returned 4
	[0173.643] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0173.643] lstrlenW (lpString=".docx") returned 5
	[0173.643] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0173.643] lstrlenW (lpString=".pdf") returned 4
	[0173.643] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0173.643] lstrlenW (lpString=".xls") returned 4
	[0173.643] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0173.643] lstrlenW (lpString=".xlsx") returned 5
	[0173.643] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0173.643] lstrlenW (lpString=".ppt") returned 4
	[0173.643] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0173.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.643] lstrlenW (lpString=".zip") returned 4
	[0173.643] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0173.643] lstrlenW (lpString=".rar") returned 4
	[0173.643] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0173.643] lstrlenW (lpString=".bz2") returned 4
	[0173.643] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0173.643] lstrlenW (lpString=".7z") returned 3
	[0173.643] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0173.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.644] lstrlenW (lpString=".dbf") returned 4
	[0173.644] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0173.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.644] lstrlenW (lpString=".1cd") returned 4
	[0173.644] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0173.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.644] lstrlenW (lpString=".jpg") returned 4
	[0173.644] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0173.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.644] lstrlenW (lpString=".doc") returned 4
	[0173.644] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0173.644] lstrlenW (lpString=".docx") returned 5
	[0173.644] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0173.644] lstrlenW (lpString=".pdf") returned 4
	[0173.644] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0173.644] lstrlenW (lpString=".xls") returned 4
	[0173.644] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0173.644] lstrlenW (lpString=".xlsx") returned 5
	[0173.644] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0173.644] lstrlenW (lpString=".ppt") returned 4
	[0173.644] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0173.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.644] lstrlenW (lpString=".zip") returned 4
	[0173.644] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0173.644] lstrlenW (lpString=".rar") returned 4
	[0173.644] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0173.644] lstrlenW (lpString=".bz2") returned 4
	[0173.645] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0173.645] lstrlenW (lpString=".7z") returned 3
	[0173.645] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0173.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.645] lstrlenW (lpString=".dbf") returned 4
	[0173.645] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0173.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.645] lstrlenW (lpString=".1cd") returned 4
	[0173.645] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0173.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0173.645] lstrlenW (lpString=".jpg") returned 4
	[0173.645] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0173.645] lstrcmpiW (lpString1=".msu", lpString2=".money") returned 1
	[0173.645] lstrlenW (lpString="Windows8.1-KB2999226-x86.msu") returned 28
	[0173.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0173.647] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=595977) returned 1
	[0173.647] CloseHandle (hObject=0x4e0) returned 1
	[0173.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 0x220
	[0173.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0173.648] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.648] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0173.649] GetLastError () returned 0x0
	[0173.649] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x91809, lpOverlapped=0x0) returned 1
	[0173.670] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x91810, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x91810, lpOverlapped=0x0) returned 1
	[0173.681] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.681] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0173.681] SetEndOfFile (hFile=0x54c) returned 1
	[0173.681] CloseHandle (hObject=0x54c) returned 1
	[0173.682] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.682] SetEndOfFile (hFile=0x4e0) returned 1
	[0173.809] CloseHandle (hObject=0x4e0) returned 1
	[0173.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 1
	[0173.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.810] lstrlenW (lpString=".doc") returned 4
	[0173.810] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0173.810] lstrlenW (lpString=".docx") returned 5
	[0173.810] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0173.810] lstrlenW (lpString=".pdf") returned 4
	[0173.810] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0173.810] lstrlenW (lpString=".xls") returned 4
	[0173.810] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0173.810] lstrlenW (lpString=".xlsx") returned 5
	[0173.810] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0173.810] lstrlenW (lpString=".ppt") returned 4
	[0173.810] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0173.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.810] lstrlenW (lpString=".zip") returned 4
	[0173.810] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0173.810] lstrlenW (lpString=".rar") returned 4
	[0173.810] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0173.810] lstrlenW (lpString=".bz2") returned 4
	[0173.810] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0173.811] lstrlenW (lpString=".7z") returned 3
	[0173.811] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.811] lstrlenW (lpString=".dbf") returned 4
	[0173.811] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.811] lstrlenW (lpString=".1cd") returned 4
	[0173.811] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.811] lstrlenW (lpString=".jpg") returned 4
	[0173.811] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.811] lstrlenW (lpString=".doc") returned 4
	[0173.811] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0173.811] lstrlenW (lpString=".docx") returned 5
	[0173.811] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0173.811] lstrlenW (lpString=".pdf") returned 4
	[0173.811] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0173.811] lstrlenW (lpString=".xls") returned 4
	[0173.811] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0173.811] lstrlenW (lpString=".xlsx") returned 5
	[0173.811] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0173.811] lstrlenW (lpString=".ppt") returned 4
	[0173.811] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.811] lstrlenW (lpString=".zip") returned 4
	[0173.811] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0173.811] lstrlenW (lpString=".rar") returned 4
	[0173.811] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0173.811] lstrlenW (lpString=".bz2") returned 4
	[0173.812] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0173.812] lstrlenW (lpString=".7z") returned 3
	[0173.812] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0173.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.812] lstrlenW (lpString=".dbf") returned 4
	[0173.812] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0173.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.812] lstrlenW (lpString=".1cd") returned 4
	[0173.812] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0173.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0173.812] lstrlenW (lpString=".jpg") returned 4
	[0173.812] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0173.812] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0173.812] lstrlenW (lpString="AccessR_Grace-ul-oob.xrm-ms") returned 27
	[0173.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0174.063] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11594) returned 1
	[0174.063] CloseHandle (hObject=0x4b8) returned 1
	[0174.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 0x220
	[0174.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0174.896] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.897] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0174.904] GetLastError () returned 0x0
	[0174.904] ReadFile (in: hFile=0x520, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d4a, lpOverlapped=0x0) returned 1
	[0174.906] WriteFile (in: hFile=0x36c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0174.907] ReadFile (in: hFile=0x520, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.907] WriteFile (in: hFile=0x36c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0174.907] SetEndOfFile (hFile=0x36c) returned 1
	[0174.907] CloseHandle (hObject=0x36c) returned 1
	[0174.908] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.908] SetEndOfFile (hFile=0x520) returned 1
	[0174.910] CloseHandle (hObject=0x520) returned 1
	[0174.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 1
	[0174.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.915] lstrlenW (lpString=".doc") returned 4
	[0174.915] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.915] lstrlenW (lpString=".docx") returned 5
	[0174.915] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.915] lstrlenW (lpString=".pdf") returned 4
	[0174.915] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.915] lstrlenW (lpString=".xls") returned 4
	[0174.915] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.915] lstrlenW (lpString=".xlsx") returned 5
	[0174.915] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.915] lstrlenW (lpString=".ppt") returned 4
	[0174.916] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.916] lstrlenW (lpString=".zip") returned 4
	[0174.916] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.916] lstrlenW (lpString=".rar") returned 4
	[0174.916] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.916] lstrlenW (lpString=".bz2") returned 4
	[0174.916] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.916] lstrlenW (lpString=".7z") returned 3
	[0174.916] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.916] lstrlenW (lpString=".dbf") returned 4
	[0174.916] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.916] lstrlenW (lpString=".1cd") returned 4
	[0174.916] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.916] lstrlenW (lpString=".jpg") returned 4
	[0174.916] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.916] lstrlenW (lpString=".doc") returned 4
	[0174.916] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.916] lstrlenW (lpString=".docx") returned 5
	[0174.916] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.916] lstrlenW (lpString=".pdf") returned 4
	[0174.916] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.916] lstrlenW (lpString=".xls") returned 4
	[0174.916] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.916] lstrlenW (lpString=".xlsx") returned 5
	[0174.916] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.917] lstrlenW (lpString=".ppt") returned 4
	[0174.917] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.917] lstrlenW (lpString=".zip") returned 4
	[0174.917] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.917] lstrlenW (lpString=".rar") returned 4
	[0174.917] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.917] lstrlenW (lpString=".bz2") returned 4
	[0174.917] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.917] lstrlenW (lpString=".7z") returned 3
	[0174.917] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.917] lstrlenW (lpString=".dbf") returned 4
	[0174.917] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.917] lstrlenW (lpString=".1cd") returned 4
	[0174.917] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0174.917] lstrlenW (lpString=".jpg") returned 4
	[0174.917] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.917] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0174.917] lstrlenW (lpString="AccessR_Retail-ul-oob.xrm-ms") returned 28
	[0174.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0174.918] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11579) returned 1
	[0174.918] CloseHandle (hObject=0x520) returned 1
	[0174.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220
	[0174.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0174.919] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.919] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0174.919] GetLastError () returned 0x0
	[0174.919] ReadFile (in: hFile=0x520, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d3b, lpOverlapped=0x0) returned 1
	[0174.921] WriteFile (in: hFile=0x36c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0174.922] ReadFile (in: hFile=0x520, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.922] WriteFile (in: hFile=0x36c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0174.922] SetEndOfFile (hFile=0x36c) returned 1
	[0174.922] CloseHandle (hObject=0x36c) returned 1
	[0174.922] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.922] SetEndOfFile (hFile=0x520) returned 1
	[0174.925] CloseHandle (hObject=0x520) returned 1
	[0174.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 1
	[0174.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.926] lstrlenW (lpString=".doc") returned 4
	[0174.926] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.926] lstrlenW (lpString=".docx") returned 5
	[0174.926] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.926] lstrlenW (lpString=".pdf") returned 4
	[0174.926] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.926] lstrlenW (lpString=".xls") returned 4
	[0174.926] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.926] lstrlenW (lpString=".xlsx") returned 5
	[0174.927] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.927] lstrlenW (lpString=".ppt") returned 4
	[0174.927] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.927] lstrlenW (lpString=".zip") returned 4
	[0174.927] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.927] lstrlenW (lpString=".rar") returned 4
	[0174.927] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.927] lstrlenW (lpString=".bz2") returned 4
	[0174.927] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.927] lstrlenW (lpString=".7z") returned 3
	[0174.927] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.927] lstrlenW (lpString=".dbf") returned 4
	[0174.927] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.927] lstrlenW (lpString=".1cd") returned 4
	[0174.927] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.927] lstrlenW (lpString=".jpg") returned 4
	[0174.927] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.927] lstrlenW (lpString=".doc") returned 4
	[0174.927] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.927] lstrlenW (lpString=".docx") returned 5
	[0174.927] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.927] lstrlenW (lpString=".pdf") returned 4
	[0174.927] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.927] lstrlenW (lpString=".xls") returned 4
	[0174.927] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.928] lstrlenW (lpString=".xlsx") returned 5
	[0174.928] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.928] lstrlenW (lpString=".ppt") returned 4
	[0174.928] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.928] lstrlenW (lpString=".zip") returned 4
	[0174.928] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.928] lstrlenW (lpString=".rar") returned 4
	[0174.928] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.928] lstrlenW (lpString=".bz2") returned 4
	[0174.928] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.928] lstrlenW (lpString=".7z") returned 3
	[0174.928] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.928] lstrlenW (lpString=".dbf") returned 4
	[0174.928] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.928] lstrlenW (lpString=".1cd") returned 4
	[0174.928] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0174.928] lstrlenW (lpString=".jpg") returned 4
	[0174.928] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.928] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0174.928] lstrlenW (lpString="AccessR_Retail-ul-phn.xrm-ms") returned 28
	[0174.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0174.929] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=19924) returned 1
	[0174.929] CloseHandle (hObject=0x520) returned 1
	[0174.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 0x220
	[0174.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0174.930] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.930] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0174.930] GetLastError () returned 0x0
	[0174.930] ReadFile (in: hFile=0x520, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x4dd4, lpOverlapped=0x0) returned 1
	[0174.932] WriteFile (in: hFile=0x36c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0174.933] ReadFile (in: hFile=0x520, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.933] WriteFile (in: hFile=0x36c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0174.934] SetEndOfFile (hFile=0x36c) returned 1
	[0174.934] CloseHandle (hObject=0x36c) returned 1
	[0174.934] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.934] SetEndOfFile (hFile=0x520) returned 1
	[0174.936] CloseHandle (hObject=0x520) returned 1
	[0174.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 1
	[0174.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.938] lstrlenW (lpString=".doc") returned 4
	[0174.938] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.938] lstrlenW (lpString=".docx") returned 5
	[0174.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.938] lstrlenW (lpString=".pdf") returned 4
	[0174.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.938] lstrlenW (lpString=".xls") returned 4
	[0174.938] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.938] lstrlenW (lpString=".xlsx") returned 5
	[0174.938] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.938] lstrlenW (lpString=".ppt") returned 4
	[0174.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.938] lstrlenW (lpString=".zip") returned 4
	[0174.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.938] lstrlenW (lpString=".rar") returned 4
	[0174.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.938] lstrlenW (lpString=".bz2") returned 4
	[0174.938] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.939] lstrlenW (lpString=".7z") returned 3
	[0174.939] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.939] lstrlenW (lpString=".dbf") returned 4
	[0174.939] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.939] lstrlenW (lpString=".1cd") returned 4
	[0174.939] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.939] lstrlenW (lpString=".jpg") returned 4
	[0174.939] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.939] lstrlenW (lpString=".doc") returned 4
	[0174.939] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.939] lstrlenW (lpString=".docx") returned 5
	[0174.939] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.939] lstrlenW (lpString=".pdf") returned 4
	[0174.939] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.939] lstrlenW (lpString=".xls") returned 4
	[0174.939] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.939] lstrlenW (lpString=".xlsx") returned 5
	[0174.939] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.939] lstrlenW (lpString=".ppt") returned 4
	[0174.939] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.939] lstrlenW (lpString=".zip") returned 4
	[0174.939] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.939] lstrlenW (lpString=".rar") returned 4
	[0174.939] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.940] lstrlenW (lpString=".bz2") returned 4
	[0174.940] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.940] lstrlenW (lpString=".7z") returned 3
	[0174.940] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.940] lstrlenW (lpString=".dbf") returned 4
	[0174.940] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.940] lstrlenW (lpString=".1cd") returned 4
	[0174.940] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0174.940] lstrlenW (lpString=".jpg") returned 4
	[0174.940] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.940] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0174.940] lstrlenW (lpString="AccessR_Trial-pl.xrm-ms") returned 23
	[0174.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0175.025] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11143) returned 1
	[0175.025] CloseHandle (hObject=0x51c) returned 1
	[0175.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220
	[0175.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.652] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.652] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0175.654] GetLastError () returned 0x0
	[0175.654] ReadFile (in: hFile=0x524, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2b87, lpOverlapped=0x0) returned 1
	[0175.656] WriteFile (in: hFile=0x514, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0175.661] ReadFile (in: hFile=0x524, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.661] WriteFile (in: hFile=0x514, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x102, lpOverlapped=0x0) returned 1
	[0175.661] SetEndOfFile (hFile=0x514) returned 1
	[0175.661] CloseHandle (hObject=0x514) returned 1
	[0175.662] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.662] SetEndOfFile (hFile=0x524) returned 1
	[0175.664] CloseHandle (hObject=0x524) returned 1
	[0175.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 1
	[0175.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.665] lstrlenW (lpString=".doc") returned 4
	[0175.665] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.665] lstrlenW (lpString=".docx") returned 5
	[0175.666] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.666] lstrlenW (lpString=".pdf") returned 4
	[0175.666] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.666] lstrlenW (lpString=".xls") returned 4
	[0175.667] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.667] lstrlenW (lpString=".xlsx") returned 5
	[0175.667] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.667] lstrlenW (lpString=".ppt") returned 4
	[0175.667] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.667] lstrlenW (lpString=".zip") returned 4
	[0175.667] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.668] lstrlenW (lpString=".rar") returned 4
	[0175.668] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.668] lstrlenW (lpString=".bz2") returned 4
	[0175.668] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.668] lstrlenW (lpString=".7z") returned 3
	[0175.668] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.668] lstrlenW (lpString=".dbf") returned 4
	[0175.668] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.668] lstrlenW (lpString=".1cd") returned 4
	[0175.668] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.668] lstrlenW (lpString=".jpg") returned 4
	[0175.668] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.668] lstrlenW (lpString=".doc") returned 4
	[0175.668] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.668] lstrlenW (lpString=".docx") returned 5
	[0175.668] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.668] lstrlenW (lpString=".pdf") returned 4
	[0175.668] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.668] lstrlenW (lpString=".xls") returned 4
	[0175.668] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.668] lstrlenW (lpString=".xlsx") returned 5
	[0175.668] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.668] lstrlenW (lpString=".ppt") returned 4
	[0175.668] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.669] lstrlenW (lpString=".zip") returned 4
	[0175.669] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString=".rar") returned 4
	[0175.669] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString=".bz2") returned 4
	[0175.669] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString=".7z") returned 3
	[0175.669] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.669] lstrlenW (lpString=".dbf") returned 4
	[0175.669] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.669] lstrlenW (lpString=".1cd") returned 4
	[0175.669] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0175.669] lstrlenW (lpString=".jpg") returned 4
	[0175.669] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.669] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.669] lstrlenW (lpString="client-issuance-bridge-office.xrm-ms") returned 36
	[0175.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.670] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=3211) returned 1
	[0175.670] CloseHandle (hObject=0x524) returned 1
	[0175.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220
	[0175.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0175.671] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.671] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0175.672] GetLastError () returned 0x0
	[0175.672] ReadFile (in: hFile=0x524, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0xc8b, lpOverlapped=0x0) returned 1
	[0175.673] WriteFile (in: hFile=0x514, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xc90, lpOverlapped=0x0) returned 1
	[0175.674] ReadFile (in: hFile=0x524, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.674] WriteFile (in: hFile=0x514, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0175.675] SetEndOfFile (hFile=0x514) returned 1
	[0175.675] CloseHandle (hObject=0x514) returned 1
	[0175.675] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.675] SetEndOfFile (hFile=0x524) returned 1
	[0175.678] CloseHandle (hObject=0x524) returned 1
	[0175.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 1
	[0175.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.679] lstrlenW (lpString=".doc") returned 4
	[0175.679] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.679] lstrlenW (lpString=".docx") returned 5
	[0175.679] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.679] lstrlenW (lpString=".pdf") returned 4
	[0175.679] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.679] lstrlenW (lpString=".xls") returned 4
	[0175.679] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.679] lstrlenW (lpString=".xlsx") returned 5
	[0175.679] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.679] lstrlenW (lpString=".ppt") returned 4
	[0175.679] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.679] lstrlenW (lpString=".zip") returned 4
	[0175.679] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.679] lstrlenW (lpString=".rar") returned 4
	[0175.679] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.679] lstrlenW (lpString=".bz2") returned 4
	[0175.679] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.679] lstrlenW (lpString=".7z") returned 3
	[0175.679] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.679] lstrlenW (lpString=".dbf") returned 4
	[0175.679] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.679] lstrlenW (lpString=".1cd") returned 4
	[0175.679] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.679] lstrlenW (lpString=".jpg") returned 4
	[0175.679] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.680] lstrlenW (lpString=".doc") returned 4
	[0175.680] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.680] lstrlenW (lpString=".docx") returned 5
	[0175.680] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.680] lstrlenW (lpString=".pdf") returned 4
	[0175.680] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.680] lstrlenW (lpString=".xls") returned 4
	[0175.680] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.680] lstrlenW (lpString=".xlsx") returned 5
	[0175.680] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.680] lstrlenW (lpString=".ppt") returned 4
	[0175.680] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.680] lstrlenW (lpString=".zip") returned 4
	[0175.680] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.680] lstrlenW (lpString=".rar") returned 4
	[0175.680] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.680] lstrlenW (lpString=".bz2") returned 4
	[0175.680] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.680] lstrlenW (lpString=".7z") returned 3
	[0175.680] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.681] lstrlenW (lpString=".dbf") returned 4
	[0175.681] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.681] lstrlenW (lpString=".1cd") returned 4
	[0175.681] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0175.681] lstrlenW (lpString=".jpg") returned 4
	[0175.681] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.681] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.681] lstrlenW (lpString="client-issuance-root-bridge-test.xrm-ms") returned 39
	[0175.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.796] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=3219) returned 1
	[0175.796] CloseHandle (hObject=0x538) returned 1
	[0175.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220
	[0175.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0176.933] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.933] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.601] GetLastError () returned 0x0
	[0177.601] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0xc93, lpOverlapped=0x0) returned 1
	[0177.603] WriteFile (in: hFile=0x514, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xca0, lpOverlapped=0x0) returned 1
	[0177.603] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.603] WriteFile (in: hFile=0x514, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x122, lpOverlapped=0x0) returned 1
	[0177.604] SetEndOfFile (hFile=0x514) returned 1
	[0177.604] CloseHandle (hObject=0x514) returned 1
	[0177.604] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.604] SetEndOfFile (hFile=0x54c) returned 1
	[0177.606] CloseHandle (hObject=0x54c) returned 1
	[0177.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 1
	[0177.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.607] lstrlenW (lpString=".doc") returned 4
	[0177.607] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.607] lstrlenW (lpString=".docx") returned 5
	[0177.607] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.607] lstrlenW (lpString=".pdf") returned 4
	[0177.607] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.607] lstrlenW (lpString=".xls") returned 4
	[0177.607] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.607] lstrlenW (lpString=".xlsx") returned 5
	[0177.608] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.608] lstrlenW (lpString=".ppt") returned 4
	[0177.608] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.608] lstrlenW (lpString=".zip") returned 4
	[0177.608] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.608] lstrlenW (lpString=".rar") returned 4
	[0177.608] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.608] lstrlenW (lpString=".bz2") returned 4
	[0177.608] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.608] lstrlenW (lpString=".7z") returned 3
	[0177.608] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.608] lstrlenW (lpString=".dbf") returned 4
	[0177.608] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.608] lstrlenW (lpString=".1cd") returned 4
	[0177.608] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.608] lstrlenW (lpString=".jpg") returned 4
	[0177.608] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.608] lstrlenW (lpString=".doc") returned 4
	[0177.608] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.608] lstrlenW (lpString=".docx") returned 5
	[0177.608] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.608] lstrlenW (lpString=".pdf") returned 4
	[0177.608] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.608] lstrlenW (lpString=".xls") returned 4
	[0177.609] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.609] lstrlenW (lpString=".xlsx") returned 5
	[0177.609] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.609] lstrlenW (lpString=".ppt") returned 4
	[0177.609] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.609] lstrlenW (lpString=".zip") returned 4
	[0177.609] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.609] lstrlenW (lpString=".rar") returned 4
	[0177.609] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.609] lstrlenW (lpString=".bz2") returned 4
	[0177.609] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.609] lstrlenW (lpString=".7z") returned 3
	[0177.609] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.609] lstrlenW (lpString=".dbf") returned 4
	[0177.609] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.609] lstrlenW (lpString=".1cd") returned 4
	[0177.609] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0177.609] lstrlenW (lpString=".jpg") returned 4
	[0177.609] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.609] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0177.609] lstrlenW (lpString="ExcelVL_MAK-ppd.xrm-ms") returned 22
	[0177.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0177.610] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=6795) returned 1
	[0177.610] CloseHandle (hObject=0x54c) returned 1
	[0177.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220
	[0177.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0177.611] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.611] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.611] GetLastError () returned 0x0
	[0177.611] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x1a8b, lpOverlapped=0x0) returned 1
	[0177.613] WriteFile (in: hFile=0x514, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x1a90, lpOverlapped=0x0) returned 1
	[0177.614] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.614] WriteFile (in: hFile=0x514, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x100, lpOverlapped=0x0) returned 1
	[0177.614] SetEndOfFile (hFile=0x514) returned 1
	[0177.614] CloseHandle (hObject=0x514) returned 1
	[0177.614] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.614] SetEndOfFile (hFile=0x54c) returned 1
	[0177.617] CloseHandle (hObject=0x54c) returned 1
	[0177.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 1
	[0177.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.618] lstrlenW (lpString=".doc") returned 4
	[0177.618] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.618] lstrlenW (lpString=".docx") returned 5
	[0177.618] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.618] lstrlenW (lpString=".pdf") returned 4
	[0177.618] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.618] lstrlenW (lpString=".xls") returned 4
	[0177.618] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.618] lstrlenW (lpString=".xlsx") returned 5
	[0177.618] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.618] lstrlenW (lpString=".ppt") returned 4
	[0177.618] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.618] lstrlenW (lpString=".zip") returned 4
	[0177.618] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.618] lstrlenW (lpString=".rar") returned 4
	[0177.618] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.618] lstrlenW (lpString=".bz2") returned 4
	[0177.618] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.618] lstrlenW (lpString=".7z") returned 3
	[0177.618] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.618] lstrlenW (lpString=".dbf") returned 4
	[0177.619] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.619] lstrlenW (lpString=".1cd") returned 4
	[0177.619] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.619] lstrlenW (lpString=".jpg") returned 4
	[0177.619] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.619] lstrlenW (lpString=".doc") returned 4
	[0177.619] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.619] lstrlenW (lpString=".docx") returned 5
	[0177.619] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.619] lstrlenW (lpString=".pdf") returned 4
	[0177.619] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.619] lstrlenW (lpString=".xls") returned 4
	[0177.619] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.619] lstrlenW (lpString=".xlsx") returned 5
	[0177.619] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.619] lstrlenW (lpString=".ppt") returned 4
	[0177.619] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.619] lstrlenW (lpString=".zip") returned 4
	[0177.619] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.619] lstrlenW (lpString=".rar") returned 4
	[0177.619] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.619] lstrlenW (lpString=".bz2") returned 4
	[0177.619] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.619] lstrlenW (lpString=".7z") returned 3
	[0177.619] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.620] lstrlenW (lpString=".dbf") returned 4
	[0177.620] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.620] lstrlenW (lpString=".1cd") returned 4
	[0177.620] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0177.620] lstrlenW (lpString=".jpg") returned 4
	[0177.620] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.620] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0177.620] lstrlenW (lpString="ExcelVL_MAK-ul-oob.xrm-ms") returned 25
	[0177.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0177.621] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11576) returned 1
	[0177.621] CloseHandle (hObject=0x54c) returned 1
	[0177.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220
	[0177.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0177.621] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.621] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.622] GetLastError () returned 0x0
	[0177.622] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d38, lpOverlapped=0x0) returned 1
	[0177.624] WriteFile (in: hFile=0x514, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0177.625] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.625] WriteFile (in: hFile=0x514, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x106, lpOverlapped=0x0) returned 1
	[0177.625] SetEndOfFile (hFile=0x514) returned 1
	[0177.625] CloseHandle (hObject=0x514) returned 1
	[0177.625] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.625] SetEndOfFile (hFile=0x54c) returned 1
	[0177.640] CloseHandle (hObject=0x54c) returned 1
	[0177.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 1
	[0177.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.641] lstrlenW (lpString=".doc") returned 4
	[0177.641] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.641] lstrlenW (lpString=".docx") returned 5
	[0177.641] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.641] lstrlenW (lpString=".pdf") returned 4
	[0177.641] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.641] lstrlenW (lpString=".xls") returned 4
	[0177.641] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.641] lstrlenW (lpString=".xlsx") returned 5
	[0177.641] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.641] lstrlenW (lpString=".ppt") returned 4
	[0177.641] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.642] lstrlenW (lpString=".zip") returned 4
	[0177.642] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.642] lstrlenW (lpString=".rar") returned 4
	[0177.642] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.642] lstrlenW (lpString=".bz2") returned 4
	[0177.642] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.642] lstrlenW (lpString=".7z") returned 3
	[0177.642] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.642] lstrlenW (lpString=".dbf") returned 4
	[0177.642] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.642] lstrlenW (lpString=".1cd") returned 4
	[0177.642] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.642] lstrlenW (lpString=".jpg") returned 4
	[0177.642] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.642] lstrlenW (lpString=".doc") returned 4
	[0177.642] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.642] lstrlenW (lpString=".docx") returned 5
	[0177.642] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.642] lstrlenW (lpString=".pdf") returned 4
	[0177.642] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.642] lstrlenW (lpString=".xls") returned 4
	[0177.642] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.642] lstrlenW (lpString=".xlsx") returned 5
	[0177.642] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.642] lstrlenW (lpString=".ppt") returned 4
	[0177.643] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.643] lstrlenW (lpString=".zip") returned 4
	[0177.643] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.643] lstrlenW (lpString=".rar") returned 4
	[0177.643] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.643] lstrlenW (lpString=".bz2") returned 4
	[0177.643] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.643] lstrlenW (lpString=".7z") returned 3
	[0177.643] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.643] lstrlenW (lpString=".dbf") returned 4
	[0177.643] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.643] lstrlenW (lpString=".1cd") returned 4
	[0177.643] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0177.643] lstrlenW (lpString=".jpg") returned 4
	[0177.643] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.643] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0177.643] lstrlenW (lpString="ExcelVL_MAK-ul-phn.xrm-ms") returned 25
	[0177.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0177.644] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=19921) returned 1
	[0177.644] CloseHandle (hObject=0x54c) returned 1
	[0177.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220
	[0177.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0177.645] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.645] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0177.645] GetLastError () returned 0x0
	[0177.645] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x4dd1, lpOverlapped=0x0) returned 1
	[0178.036] WriteFile (in: hFile=0x51c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0178.037] ReadFile (in: hFile=0x54c, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.037] WriteFile (in: hFile=0x51c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x106, lpOverlapped=0x0) returned 1
	[0178.037] SetEndOfFile (hFile=0x51c) returned 1
	[0178.037] CloseHandle (hObject=0x51c) returned 1
	[0178.037] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.037] SetEndOfFile (hFile=0x54c) returned 1
	[0178.040] CloseHandle (hObject=0x54c) returned 1
	[0178.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 1
	[0178.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.042] lstrlenW (lpString=".doc") returned 4
	[0178.042] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.042] lstrlenW (lpString=".docx") returned 5
	[0178.042] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.042] lstrlenW (lpString=".pdf") returned 4
	[0178.042] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.042] lstrlenW (lpString=".xls") returned 4
	[0178.042] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.042] lstrlenW (lpString=".xlsx") returned 5
	[0178.042] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.042] lstrlenW (lpString=".ppt") returned 4
	[0178.042] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.042] lstrlenW (lpString=".zip") returned 4
	[0178.042] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.042] lstrlenW (lpString=".rar") returned 4
	[0178.042] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.042] lstrlenW (lpString=".bz2") returned 4
	[0178.042] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.042] lstrlenW (lpString=".7z") returned 3
	[0178.042] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.042] lstrlenW (lpString=".dbf") returned 4
	[0178.042] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.042] lstrlenW (lpString=".1cd") returned 4
	[0178.042] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.042] lstrlenW (lpString=".jpg") returned 4
	[0178.042] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.043] lstrlenW (lpString=".doc") returned 4
	[0178.043] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.043] lstrlenW (lpString=".docx") returned 5
	[0178.043] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.043] lstrlenW (lpString=".pdf") returned 4
	[0178.043] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.043] lstrlenW (lpString=".xls") returned 4
	[0178.043] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.043] lstrlenW (lpString=".xlsx") returned 5
	[0178.043] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.043] lstrlenW (lpString=".ppt") returned 4
	[0178.043] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.043] lstrlenW (lpString=".zip") returned 4
	[0178.043] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.043] lstrlenW (lpString=".rar") returned 4
	[0178.043] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.043] lstrlenW (lpString=".bz2") returned 4
	[0178.043] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.043] lstrlenW (lpString=".7z") returned 3
	[0178.043] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.043] lstrlenW (lpString=".dbf") returned 4
	[0178.043] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.043] lstrlenW (lpString=".1cd") returned 4
	[0178.043] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0178.044] lstrlenW (lpString=".jpg") returned 4
	[0178.044] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.092] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.092] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 36
	[0178.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.098] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=10679) returned 1
	[0178.098] CloseHandle (hObject=0x514) returned 1
	[0178.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220
	[0178.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.103] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.103] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0178.104] GetLastError () returned 0x0
	[0178.104] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x29b7, lpOverlapped=0x0) returned 1
	[0178.106] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x29c0, lpOverlapped=0x0) returned 1
	[0178.107] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.107] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0178.107] SetEndOfFile (hFile=0x54c) returned 1
	[0178.107] CloseHandle (hObject=0x54c) returned 1
	[0178.107] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.107] SetEndOfFile (hFile=0x4e0) returned 1
	[0178.111] CloseHandle (hObject=0x4e0) returned 1
	[0178.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 1
	[0178.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.112] lstrlenW (lpString=".doc") returned 4
	[0178.112] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.112] lstrlenW (lpString=".docx") returned 5
	[0178.112] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.112] lstrlenW (lpString=".pdf") returned 4
	[0178.112] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.112] lstrlenW (lpString=".xls") returned 4
	[0178.112] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.112] lstrlenW (lpString=".xlsx") returned 5
	[0178.112] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.112] lstrlenW (lpString=".ppt") returned 4
	[0178.112] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.112] lstrlenW (lpString=".zip") returned 4
	[0178.112] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.112] lstrlenW (lpString=".rar") returned 4
	[0178.112] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.112] lstrlenW (lpString=".bz2") returned 4
	[0178.112] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.112] lstrlenW (lpString=".7z") returned 3
	[0178.112] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.113] lstrlenW (lpString=".dbf") returned 4
	[0178.113] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.113] lstrlenW (lpString=".1cd") returned 4
	[0178.113] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.113] lstrlenW (lpString=".jpg") returned 4
	[0178.113] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.113] lstrlenW (lpString=".doc") returned 4
	[0178.113] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.113] lstrlenW (lpString=".docx") returned 5
	[0178.113] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.113] lstrlenW (lpString=".pdf") returned 4
	[0178.113] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.113] lstrlenW (lpString=".xls") returned 4
	[0178.113] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.113] lstrlenW (lpString=".xlsx") returned 5
	[0178.113] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.113] lstrlenW (lpString=".ppt") returned 4
	[0178.113] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.113] lstrlenW (lpString=".zip") returned 4
	[0178.113] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.113] lstrlenW (lpString=".rar") returned 4
	[0178.113] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.113] lstrlenW (lpString=".bz2") returned 4
	[0178.113] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.114] lstrlenW (lpString=".7z") returned 3
	[0178.114] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.114] lstrlenW (lpString=".dbf") returned 4
	[0178.114] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.114] lstrlenW (lpString=".1cd") returned 4
	[0178.114] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0178.114] lstrlenW (lpString=".jpg") returned 4
	[0178.114] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.114] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.114] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 40
	[0178.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.115] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11637) returned 1
	[0178.115] CloseHandle (hObject=0x4e0) returned 1
	[0178.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0178.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.115] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.115] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0178.116] GetLastError () returned 0x0
	[0178.116] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d75, lpOverlapped=0x0) returned 1
	[0178.118] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0178.119] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.119] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x124, lpOverlapped=0x0) returned 1
	[0178.119] SetEndOfFile (hFile=0x54c) returned 1
	[0178.119] CloseHandle (hObject=0x54c) returned 1
	[0178.119] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.119] SetEndOfFile (hFile=0x4e0) returned 1
	[0178.122] CloseHandle (hObject=0x4e0) returned 1
	[0178.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0178.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.123] lstrlenW (lpString=".doc") returned 4
	[0178.123] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.123] lstrlenW (lpString=".docx") returned 5
	[0178.123] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.123] lstrlenW (lpString=".pdf") returned 4
	[0178.123] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.123] lstrlenW (lpString=".xls") returned 4
	[0178.123] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.123] lstrlenW (lpString=".xlsx") returned 5
	[0178.123] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.124] lstrlenW (lpString=".ppt") returned 4
	[0178.124] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.124] lstrlenW (lpString=".zip") returned 4
	[0178.124] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.124] lstrlenW (lpString=".rar") returned 4
	[0178.124] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.124] lstrlenW (lpString=".bz2") returned 4
	[0178.124] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.124] lstrlenW (lpString=".7z") returned 3
	[0178.124] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.124] lstrlenW (lpString=".dbf") returned 4
	[0178.124] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.124] lstrlenW (lpString=".1cd") returned 4
	[0178.124] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.124] lstrlenW (lpString=".jpg") returned 4
	[0178.124] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.124] lstrlenW (lpString=".doc") returned 4
	[0178.124] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.124] lstrlenW (lpString=".docx") returned 5
	[0178.124] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.124] lstrlenW (lpString=".pdf") returned 4
	[0178.124] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.124] lstrlenW (lpString=".xls") returned 4
	[0178.124] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.125] lstrlenW (lpString=".xlsx") returned 5
	[0178.125] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.125] lstrlenW (lpString=".ppt") returned 4
	[0178.125] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.125] lstrlenW (lpString=".zip") returned 4
	[0178.125] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.125] lstrlenW (lpString=".rar") returned 4
	[0178.125] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.125] lstrlenW (lpString=".bz2") returned 4
	[0178.125] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.125] lstrlenW (lpString=".7z") returned 3
	[0178.125] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.125] lstrlenW (lpString=".dbf") returned 4
	[0178.125] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.125] lstrlenW (lpString=".1cd") returned 4
	[0178.125] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0178.125] lstrlenW (lpString=".jpg") returned 4
	[0178.125] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.125] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.125] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 40
	[0178.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.126] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=19982) returned 1
	[0178.126] CloseHandle (hObject=0x4e0) returned 1
	[0178.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0178.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.127] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.127] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0178.128] GetLastError () returned 0x0
	[0178.128] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x4e0e, lpOverlapped=0x0) returned 1
	[0178.130] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x4e10, lpOverlapped=0x0) returned 1
	[0178.131] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.131] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x124, lpOverlapped=0x0) returned 1
	[0178.131] SetEndOfFile (hFile=0x54c) returned 1
	[0178.131] CloseHandle (hObject=0x54c) returned 1
	[0178.131] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.131] SetEndOfFile (hFile=0x4e0) returned 1
	[0178.134] CloseHandle (hObject=0x4e0) returned 1
	[0178.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0178.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.136] lstrlenW (lpString=".doc") returned 4
	[0178.136] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.136] lstrlenW (lpString=".docx") returned 5
	[0178.136] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.136] lstrlenW (lpString=".pdf") returned 4
	[0178.136] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.136] lstrlenW (lpString=".xls") returned 4
	[0178.136] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.136] lstrlenW (lpString=".xlsx") returned 5
	[0178.136] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.136] lstrlenW (lpString=".ppt") returned 4
	[0178.136] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.136] lstrlenW (lpString=".zip") returned 4
	[0178.136] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.136] lstrlenW (lpString=".rar") returned 4
	[0178.136] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.136] lstrlenW (lpString=".bz2") returned 4
	[0178.136] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.136] lstrlenW (lpString=".7z") returned 3
	[0178.136] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.136] lstrlenW (lpString=".dbf") returned 4
	[0178.136] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.136] lstrlenW (lpString=".1cd") returned 4
	[0178.136] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.137] lstrlenW (lpString=".jpg") returned 4
	[0178.137] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.137] lstrlenW (lpString=".doc") returned 4
	[0178.137] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.137] lstrlenW (lpString=".docx") returned 5
	[0178.137] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.137] lstrlenW (lpString=".pdf") returned 4
	[0178.137] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.137] lstrlenW (lpString=".xls") returned 4
	[0178.137] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.137] lstrlenW (lpString=".xlsx") returned 5
	[0178.137] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.137] lstrlenW (lpString=".ppt") returned 4
	[0178.137] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.137] lstrlenW (lpString=".zip") returned 4
	[0178.137] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.137] lstrlenW (lpString=".rar") returned 4
	[0178.137] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.137] lstrlenW (lpString=".bz2") returned 4
	[0178.137] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.137] lstrlenW (lpString=".7z") returned 3
	[0178.137] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.137] lstrlenW (lpString=".dbf") returned 4
	[0178.137] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.137] lstrlenW (lpString=".1cd") returned 4
	[0178.138] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0178.138] lstrlenW (lpString=".jpg") returned 4
	[0178.138] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.138] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.138] lstrlenW (lpString="HomeBusinessR_Grace-ppd.xrm-ms") returned 30
	[0178.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.138] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=22033) returned 1
	[0178.138] CloseHandle (hObject=0x4e0) returned 1
	[0178.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220
	[0178.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.139] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.139] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0178.140] GetLastError () returned 0x0
	[0178.140] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x5611, lpOverlapped=0x0) returned 1
	[0178.370] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x5620, lpOverlapped=0x0) returned 1
	[0178.371] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.371] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x110, lpOverlapped=0x0) returned 1
	[0178.372] SetEndOfFile (hFile=0x54c) returned 1
	[0178.372] CloseHandle (hObject=0x54c) returned 1
	[0178.372] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.372] SetEndOfFile (hFile=0x4e0) returned 1
	[0178.375] CloseHandle (hObject=0x4e0) returned 1
	[0178.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 1
	[0178.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.376] lstrlenW (lpString=".doc") returned 4
	[0178.376] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.376] lstrlenW (lpString=".docx") returned 5
	[0178.376] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.376] lstrlenW (lpString=".pdf") returned 4
	[0178.376] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.376] lstrlenW (lpString=".xls") returned 4
	[0178.376] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.376] lstrlenW (lpString=".xlsx") returned 5
	[0178.376] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.376] lstrlenW (lpString=".ppt") returned 4
	[0178.376] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.376] lstrlenW (lpString=".zip") returned 4
	[0178.376] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.376] lstrlenW (lpString=".rar") returned 4
	[0178.376] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.376] lstrlenW (lpString=".bz2") returned 4
	[0178.376] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.376] lstrlenW (lpString=".7z") returned 3
	[0178.376] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.376] lstrlenW (lpString=".dbf") returned 4
	[0178.376] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.377] lstrlenW (lpString=".1cd") returned 4
	[0178.377] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.377] lstrlenW (lpString=".jpg") returned 4
	[0178.377] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.377] lstrlenW (lpString=".doc") returned 4
	[0178.377] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.377] lstrlenW (lpString=".docx") returned 5
	[0178.377] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.377] lstrlenW (lpString=".pdf") returned 4
	[0178.377] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.377] lstrlenW (lpString=".xls") returned 4
	[0178.377] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.377] lstrlenW (lpString=".xlsx") returned 5
	[0178.377] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.377] lstrlenW (lpString=".ppt") returned 4
	[0178.377] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.377] lstrlenW (lpString=".zip") returned 4
	[0178.377] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.377] lstrlenW (lpString=".rar") returned 4
	[0178.377] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.377] lstrlenW (lpString=".bz2") returned 4
	[0178.377] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.377] lstrlenW (lpString=".7z") returned 3
	[0178.377] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.377] lstrlenW (lpString=".dbf") returned 4
	[0178.377] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.378] lstrlenW (lpString=".1cd") returned 4
	[0178.378] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0178.378] lstrlenW (lpString=".jpg") returned 4
	[0178.378] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.378] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.378] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 36
	[0178.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.379] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=19962) returned 1
	[0178.379] CloseHandle (hObject=0x4e0) returned 1
	[0178.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0178.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.379] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.379] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0178.380] GetLastError () returned 0x0
	[0178.380] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x4dfa, lpOverlapped=0x0) returned 1
	[0178.383] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0178.384] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.384] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0178.384] SetEndOfFile (hFile=0x54c) returned 1
	[0178.384] CloseHandle (hObject=0x54c) returned 1
	[0178.384] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.384] SetEndOfFile (hFile=0x4e0) returned 1
	[0178.387] CloseHandle (hObject=0x4e0) returned 1
	[0178.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0178.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.388] lstrlenW (lpString=".doc") returned 4
	[0178.388] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.388] lstrlenW (lpString=".docx") returned 5
	[0178.388] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.388] lstrlenW (lpString=".pdf") returned 4
	[0178.388] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.388] lstrlenW (lpString=".xls") returned 4
	[0178.388] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.388] lstrlenW (lpString=".xlsx") returned 5
	[0178.388] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.388] lstrlenW (lpString=".ppt") returned 4
	[0178.388] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.389] lstrlenW (lpString=".zip") returned 4
	[0178.389] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.389] lstrlenW (lpString=".rar") returned 4
	[0178.389] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.389] lstrlenW (lpString=".bz2") returned 4
	[0178.389] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.389] lstrlenW (lpString=".7z") returned 3
	[0178.389] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.389] lstrlenW (lpString=".dbf") returned 4
	[0178.389] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.389] lstrlenW (lpString=".1cd") returned 4
	[0178.389] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.389] lstrlenW (lpString=".jpg") returned 4
	[0178.389] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.389] lstrlenW (lpString=".doc") returned 4
	[0178.389] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.389] lstrlenW (lpString=".docx") returned 5
	[0178.389] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.389] lstrlenW (lpString=".pdf") returned 4
	[0178.389] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.389] lstrlenW (lpString=".xls") returned 4
	[0178.389] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.389] lstrlenW (lpString=".xlsx") returned 5
	[0178.389] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.389] lstrlenW (lpString=".ppt") returned 4
	[0178.390] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.390] lstrlenW (lpString=".zip") returned 4
	[0178.390] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.390] lstrlenW (lpString=".rar") returned 4
	[0178.390] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.390] lstrlenW (lpString=".bz2") returned 4
	[0178.390] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.390] lstrlenW (lpString=".7z") returned 3
	[0178.390] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.390] lstrlenW (lpString=".dbf") returned 4
	[0178.390] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.390] lstrlenW (lpString=".1cd") returned 4
	[0178.390] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0178.390] lstrlenW (lpString=".jpg") returned 4
	[0178.390] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.390] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.390] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 33
	[0178.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.391] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=10667) returned 1
	[0178.391] CloseHandle (hObject=0x4e0) returned 1
	[0178.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220
	[0178.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.391] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.392] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0178.392] GetLastError () returned 0x0
	[0178.392] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x29ab, lpOverlapped=0x0) returned 1
	[0178.395] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0178.396] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.396] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x116, lpOverlapped=0x0) returned 1
	[0178.396] SetEndOfFile (hFile=0x54c) returned 1
	[0178.396] CloseHandle (hObject=0x54c) returned 1
	[0178.396] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.396] SetEndOfFile (hFile=0x4e0) returned 1
	[0178.399] CloseHandle (hObject=0x4e0) returned 1
	[0178.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 1
	[0178.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.400] lstrlenW (lpString=".doc") returned 4
	[0178.400] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.400] lstrlenW (lpString=".docx") returned 5
	[0178.400] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.400] lstrlenW (lpString=".pdf") returned 4
	[0178.400] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.400] lstrlenW (lpString=".xls") returned 4
	[0178.400] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.400] lstrlenW (lpString=".xlsx") returned 5
	[0178.400] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.400] lstrlenW (lpString=".ppt") returned 4
	[0178.400] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.400] lstrlenW (lpString=".zip") returned 4
	[0178.400] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.400] lstrlenW (lpString=".rar") returned 4
	[0178.400] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.400] lstrlenW (lpString=".bz2") returned 4
	[0178.400] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.400] lstrlenW (lpString=".7z") returned 3
	[0178.400] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.401] lstrlenW (lpString=".dbf") returned 4
	[0178.401] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.401] lstrlenW (lpString=".1cd") returned 4
	[0178.401] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.401] lstrlenW (lpString=".jpg") returned 4
	[0178.401] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.401] lstrlenW (lpString=".doc") returned 4
	[0178.401] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.401] lstrlenW (lpString=".docx") returned 5
	[0178.401] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.401] lstrlenW (lpString=".pdf") returned 4
	[0178.401] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.401] lstrlenW (lpString=".xls") returned 4
	[0178.401] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.401] lstrlenW (lpString=".xlsx") returned 5
	[0178.401] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.401] lstrlenW (lpString=".ppt") returned 4
	[0178.401] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.401] lstrlenW (lpString=".zip") returned 4
	[0178.401] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.401] lstrlenW (lpString=".rar") returned 4
	[0178.401] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.401] lstrlenW (lpString=".bz2") returned 4
	[0178.401] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.402] lstrlenW (lpString=".7z") returned 3
	[0178.402] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.402] lstrlenW (lpString=".dbf") returned 4
	[0178.402] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.402] lstrlenW (lpString=".1cd") returned 4
	[0178.402] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0178.402] lstrlenW (lpString=".jpg") returned 4
	[0178.402] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.402] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.402] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 34
	[0178.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.403] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=22094) returned 1
	[0178.403] CloseHandle (hObject=0x4e0) returned 1
	[0178.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220
	[0178.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.403] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.403] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0178.404] GetLastError () returned 0x0
	[0178.404] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x564e, lpOverlapped=0x0) returned 1
	[0178.545] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0178.547] ReadFile (in: hFile=0x4e0, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.547] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x118, lpOverlapped=0x0) returned 1
	[0178.547] SetEndOfFile (hFile=0x54c) returned 1
	[0178.547] CloseHandle (hObject=0x54c) returned 1
	[0178.547] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.547] SetEndOfFile (hFile=0x4e0) returned 1
	[0178.550] CloseHandle (hObject=0x4e0) returned 1
	[0178.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 1
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.137] lstrlenW (lpString=".doc") returned 4
	[0179.137] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.137] lstrlenW (lpString=".docx") returned 5
	[0179.137] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.137] lstrlenW (lpString=".pdf") returned 4
	[0179.137] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.137] lstrlenW (lpString=".xls") returned 4
	[0179.137] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.137] lstrlenW (lpString=".xlsx") returned 5
	[0179.137] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.137] lstrlenW (lpString=".ppt") returned 4
	[0179.137] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.137] lstrlenW (lpString=".zip") returned 4
	[0179.137] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.137] lstrlenW (lpString=".rar") returned 4
	[0179.137] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.137] lstrlenW (lpString=".bz2") returned 4
	[0179.137] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.137] lstrlenW (lpString=".7z") returned 3
	[0179.137] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.137] lstrlenW (lpString=".dbf") returned 4
	[0179.137] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.137] lstrlenW (lpString=".1cd") returned 4
	[0179.137] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.138] lstrlenW (lpString=".jpg") returned 4
	[0179.138] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.138] lstrlenW (lpString=".doc") returned 4
	[0179.138] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.138] lstrlenW (lpString=".docx") returned 5
	[0179.138] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.138] lstrlenW (lpString=".pdf") returned 4
	[0179.138] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.138] lstrlenW (lpString=".xls") returned 4
	[0179.138] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.138] lstrlenW (lpString=".xlsx") returned 5
	[0179.138] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.138] lstrlenW (lpString=".ppt") returned 4
	[0179.138] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.138] lstrlenW (lpString=".zip") returned 4
	[0179.138] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.138] lstrlenW (lpString=".rar") returned 4
	[0179.138] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.138] lstrlenW (lpString=".bz2") returned 4
	[0179.138] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.138] lstrlenW (lpString=".7z") returned 3
	[0179.138] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.138] lstrlenW (lpString=".dbf") returned 4
	[0179.138] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.138] lstrlenW (lpString=".1cd") returned 4
	[0179.139] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0179.139] lstrlenW (lpString=".jpg") returned 4
	[0179.139] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.139] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0179.139] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 37
	[0179.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.140] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=19966) returned 1
	[0179.140] CloseHandle (hObject=0x4e4) returned 1
	[0179.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220
	[0179.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.141] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.141] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.142] GetLastError () returned 0x0
	[0179.142] ReadFile (in: hFile=0x4e4, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x4dfe, lpOverlapped=0x0) returned 1
	[0179.144] WriteFile (in: hFile=0x370, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0179.145] ReadFile (in: hFile=0x4e4, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.145] WriteFile (in: hFile=0x370, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0179.145] SetEndOfFile (hFile=0x370) returned 1
	[0179.146] CloseHandle (hObject=0x370) returned 1
	[0179.146] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.146] SetEndOfFile (hFile=0x4e4) returned 1
	[0179.148] CloseHandle (hObject=0x4e4) returned 1
	[0179.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 1
	[0179.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.150] lstrlenW (lpString=".doc") returned 4
	[0179.150] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.150] lstrlenW (lpString=".docx") returned 5
	[0179.150] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.150] lstrlenW (lpString=".pdf") returned 4
	[0179.150] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.150] lstrlenW (lpString=".xls") returned 4
	[0179.150] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.150] lstrlenW (lpString=".xlsx") returned 5
	[0179.150] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.150] lstrlenW (lpString=".ppt") returned 4
	[0179.150] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.150] lstrlenW (lpString=".zip") returned 4
	[0179.150] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.150] lstrlenW (lpString=".rar") returned 4
	[0179.150] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.150] lstrlenW (lpString=".bz2") returned 4
	[0179.150] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.150] lstrlenW (lpString=".7z") returned 3
	[0179.150] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.150] lstrlenW (lpString=".dbf") returned 4
	[0179.150] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.151] lstrlenW (lpString=".1cd") returned 4
	[0179.151] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.151] lstrlenW (lpString=".jpg") returned 4
	[0179.151] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.151] lstrlenW (lpString=".doc") returned 4
	[0179.151] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.151] lstrlenW (lpString=".docx") returned 5
	[0179.151] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.151] lstrlenW (lpString=".pdf") returned 4
	[0179.151] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.151] lstrlenW (lpString=".xls") returned 4
	[0179.151] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.151] lstrlenW (lpString=".xlsx") returned 5
	[0179.151] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.151] lstrlenW (lpString=".ppt") returned 4
	[0179.151] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.151] lstrlenW (lpString=".zip") returned 4
	[0179.151] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.151] lstrlenW (lpString=".rar") returned 4
	[0179.151] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.151] lstrlenW (lpString=".bz2") returned 4
	[0179.151] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.151] lstrlenW (lpString=".7z") returned 3
	[0179.151] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.152] lstrlenW (lpString=".dbf") returned 4
	[0179.152] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.152] lstrlenW (lpString=".1cd") returned 4
	[0179.152] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0179.152] lstrlenW (lpString=".jpg") returned 4
	[0179.152] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.152] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0179.152] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 33
	[0179.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.153] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=10667) returned 1
	[0179.153] CloseHandle (hObject=0x4e4) returned 1
	[0179.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220
	[0179.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.153] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.153] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.154] GetLastError () returned 0x0
	[0179.154] ReadFile (in: hFile=0x4e4, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x29ab, lpOverlapped=0x0) returned 1
	[0179.156] WriteFile (in: hFile=0x370, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0179.157] ReadFile (in: hFile=0x4e4, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.157] WriteFile (in: hFile=0x370, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x116, lpOverlapped=0x0) returned 1
	[0179.157] SetEndOfFile (hFile=0x370) returned 1
	[0179.157] CloseHandle (hObject=0x370) returned 1
	[0179.157] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.157] SetEndOfFile (hFile=0x4e4) returned 1
	[0179.208] CloseHandle (hObject=0x4e4) returned 1
	[0179.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 1
	[0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.210] lstrlenW (lpString=".doc") returned 4
	[0179.210] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.210] lstrlenW (lpString=".docx") returned 5
	[0179.210] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.210] lstrlenW (lpString=".pdf") returned 4
	[0179.210] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.210] lstrlenW (lpString=".xls") returned 4
	[0179.210] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.210] lstrlenW (lpString=".xlsx") returned 5
	[0179.210] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.210] lstrlenW (lpString=".ppt") returned 4
	[0179.210] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.210] lstrlenW (lpString=".zip") returned 4
	[0179.210] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.210] lstrlenW (lpString=".rar") returned 4
	[0179.210] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.210] lstrlenW (lpString=".bz2") returned 4
	[0179.210] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.210] lstrlenW (lpString=".7z") returned 3
	[0179.210] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.210] lstrlenW (lpString=".dbf") returned 4
	[0179.210] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.211] lstrlenW (lpString=".1cd") returned 4
	[0179.211] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.211] lstrlenW (lpString=".jpg") returned 4
	[0179.211] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.211] lstrlenW (lpString=".doc") returned 4
	[0179.211] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.211] lstrlenW (lpString=".docx") returned 5
	[0179.211] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.211] lstrlenW (lpString=".pdf") returned 4
	[0179.211] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.211] lstrlenW (lpString=".xls") returned 4
	[0179.211] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.211] lstrlenW (lpString=".xlsx") returned 5
	[0179.211] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.211] lstrlenW (lpString=".ppt") returned 4
	[0179.211] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.413] lstrlenW (lpString=".zip") returned 4
	[0179.413] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.413] lstrlenW (lpString=".rar") returned 4
	[0179.413] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.413] lstrlenW (lpString=".bz2") returned 4
	[0179.414] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.414] lstrlenW (lpString=".7z") returned 3
	[0179.414] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.414] lstrlenW (lpString=".dbf") returned 4
	[0179.414] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.414] lstrlenW (lpString=".1cd") returned 4
	[0179.414] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0179.414] lstrlenW (lpString=".jpg") returned 4
	[0179.414] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.414] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0179.414] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 33
	[0179.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0179.516] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=10667) returned 1
	[0179.516] CloseHandle (hObject=0x500) returned 1
	[0179.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 0x220
	[0179.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0180.104] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.105] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0180.105] GetLastError () returned 0x0
	[0180.105] ReadFile (in: hFile=0x370, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x29ab, lpOverlapped=0x0) returned 1
	[0180.112] WriteFile (in: hFile=0x4e4, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0180.113] ReadFile (in: hFile=0x370, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.113] WriteFile (in: hFile=0x4e4, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x116, lpOverlapped=0x0) returned 1
	[0180.113] SetEndOfFile (hFile=0x4e4) returned 1
	[0180.114] CloseHandle (hObject=0x4e4) returned 1
	[0180.115] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.115] SetEndOfFile (hFile=0x370) returned 1
	[0180.118] CloseHandle (hObject=0x370) returned 1
	[0180.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 1
	[0180.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.119] lstrlenW (lpString=".doc") returned 4
	[0180.119] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.119] lstrlenW (lpString=".docx") returned 5
	[0180.119] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.119] lstrlenW (lpString=".pdf") returned 4
	[0180.119] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.119] lstrlenW (lpString=".xls") returned 4
	[0180.119] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.120] lstrlenW (lpString=".xlsx") returned 5
	[0180.120] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.120] lstrlenW (lpString=".ppt") returned 4
	[0180.120] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.120] lstrlenW (lpString=".zip") returned 4
	[0180.120] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.120] lstrlenW (lpString=".rar") returned 4
	[0180.120] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.120] lstrlenW (lpString=".bz2") returned 4
	[0180.120] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.120] lstrlenW (lpString=".7z") returned 3
	[0180.120] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.120] lstrlenW (lpString=".dbf") returned 4
	[0180.120] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.120] lstrlenW (lpString=".1cd") returned 4
	[0180.120] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.120] lstrlenW (lpString=".jpg") returned 4
	[0180.120] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.120] lstrlenW (lpString=".doc") returned 4
	[0180.120] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.120] lstrlenW (lpString=".docx") returned 5
	[0180.120] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.120] lstrlenW (lpString=".pdf") returned 4
	[0180.120] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.121] lstrlenW (lpString=".xls") returned 4
	[0180.121] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.121] lstrlenW (lpString=".xlsx") returned 5
	[0180.121] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.121] lstrlenW (lpString=".ppt") returned 4
	[0180.121] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.121] lstrlenW (lpString=".zip") returned 4
	[0180.121] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.121] lstrlenW (lpString=".rar") returned 4
	[0180.121] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.121] lstrlenW (lpString=".bz2") returned 4
	[0180.121] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.121] lstrlenW (lpString=".7z") returned 3
	[0180.121] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.121] lstrlenW (lpString=".dbf") returned 4
	[0180.121] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.121] lstrlenW (lpString=".1cd") returned 4
	[0180.121] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0180.121] lstrlenW (lpString=".jpg") returned 4
	[0180.121] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.121] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.122] lstrlenW (lpString="HomeBusinessR_Retail2-pl.xrm-ms") returned 31
	[0180.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0180.122] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=10659) returned 1
	[0180.122] CloseHandle (hObject=0x370) returned 1
	[0180.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 0x220
	[0180.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0180.123] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.123] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0180.124] GetLastError () returned 0x0
	[0180.124] ReadFile (in: hFile=0x370, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x29a3, lpOverlapped=0x0) returned 1
	[0180.138] WriteFile (in: hFile=0x444, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0180.139] ReadFile (in: hFile=0x370, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.139] WriteFile (in: hFile=0x444, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x112, lpOverlapped=0x0) returned 1
	[0180.139] SetEndOfFile (hFile=0x444) returned 1
	[0180.139] CloseHandle (hObject=0x444) returned 1
	[0180.139] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.139] SetEndOfFile (hFile=0x370) returned 1
	[0180.142] CloseHandle (hObject=0x370) returned 1
	[0180.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 1
	[0180.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.143] lstrlenW (lpString=".doc") returned 4
	[0180.143] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.143] lstrlenW (lpString=".docx") returned 5
	[0180.143] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.143] lstrlenW (lpString=".pdf") returned 4
	[0180.143] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.143] lstrlenW (lpString=".xls") returned 4
	[0180.143] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.143] lstrlenW (lpString=".xlsx") returned 5
	[0180.143] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.143] lstrlenW (lpString=".ppt") returned 4
	[0180.143] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.143] lstrlenW (lpString=".zip") returned 4
	[0180.143] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.143] lstrlenW (lpString=".rar") returned 4
	[0180.143] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.144] lstrlenW (lpString=".bz2") returned 4
	[0180.144] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.144] lstrlenW (lpString=".7z") returned 3
	[0180.144] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.144] lstrlenW (lpString=".dbf") returned 4
	[0180.144] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.144] lstrlenW (lpString=".1cd") returned 4
	[0180.144] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.144] lstrlenW (lpString=".jpg") returned 4
	[0180.144] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.144] lstrlenW (lpString=".doc") returned 4
	[0180.144] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.144] lstrlenW (lpString=".docx") returned 5
	[0180.144] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.144] lstrlenW (lpString=".pdf") returned 4
	[0180.144] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.144] lstrlenW (lpString=".xls") returned 4
	[0180.144] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.144] lstrlenW (lpString=".xlsx") returned 5
	[0180.144] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.144] lstrlenW (lpString=".ppt") returned 4
	[0180.144] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.144] lstrlenW (lpString=".zip") returned 4
	[0180.144] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.145] lstrlenW (lpString=".rar") returned 4
	[0180.145] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.145] lstrlenW (lpString=".bz2") returned 4
	[0180.145] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.145] lstrlenW (lpString=".7z") returned 3
	[0180.145] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.145] lstrlenW (lpString=".dbf") returned 4
	[0180.145] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.145] lstrlenW (lpString=".1cd") returned 4
	[0180.145] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0180.145] lstrlenW (lpString=".jpg") returned 4
	[0180.145] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.145] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.145] lstrlenW (lpString="HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 35
	[0180.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0180.146] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11613) returned 1
	[0180.146] CloseHandle (hObject=0x370) returned 1
	[0180.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 0x220
	[0180.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0180.147] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.147] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0180.147] GetLastError () returned 0x0
	[0180.147] ReadFile (in: hFile=0x370, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d5d, lpOverlapped=0x0) returned 1
	[0180.161] WriteFile (in: hFile=0x444, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0180.162] ReadFile (in: hFile=0x370, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.162] WriteFile (in: hFile=0x444, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0180.162] SetEndOfFile (hFile=0x444) returned 1
	[0180.162] CloseHandle (hObject=0x444) returned 1
	[0180.162] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.162] SetEndOfFile (hFile=0x370) returned 1
	[0180.165] CloseHandle (hObject=0x370) returned 1
	[0180.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 1
	[0180.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.166] lstrlenW (lpString=".doc") returned 4
	[0180.167] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.167] lstrlenW (lpString=".docx") returned 5
	[0180.167] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.167] lstrlenW (lpString=".pdf") returned 4
	[0180.167] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.167] lstrlenW (lpString=".xls") returned 4
	[0180.167] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.167] lstrlenW (lpString=".xlsx") returned 5
	[0180.167] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.167] lstrlenW (lpString=".ppt") returned 4
	[0180.167] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.167] lstrlenW (lpString=".zip") returned 4
	[0180.167] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.167] lstrlenW (lpString=".rar") returned 4
	[0180.167] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.167] lstrlenW (lpString=".bz2") returned 4
	[0180.167] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.167] lstrlenW (lpString=".7z") returned 3
	[0180.167] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.167] lstrlenW (lpString=".dbf") returned 4
	[0180.167] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.167] lstrlenW (lpString=".1cd") returned 4
	[0180.167] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.167] lstrlenW (lpString=".jpg") returned 4
	[0180.167] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.168] lstrlenW (lpString=".doc") returned 4
	[0180.168] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.168] lstrlenW (lpString=".docx") returned 5
	[0180.168] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.168] lstrlenW (lpString=".pdf") returned 4
	[0180.168] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.168] lstrlenW (lpString=".xls") returned 4
	[0180.168] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.168] lstrlenW (lpString=".xlsx") returned 5
	[0180.168] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.168] lstrlenW (lpString=".ppt") returned 4
	[0180.168] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.168] lstrlenW (lpString=".zip") returned 4
	[0180.168] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.168] lstrlenW (lpString=".rar") returned 4
	[0180.168] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.168] lstrlenW (lpString=".bz2") returned 4
	[0180.168] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.168] lstrlenW (lpString=".7z") returned 3
	[0180.168] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.168] lstrlenW (lpString=".dbf") returned 4
	[0180.168] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.168] lstrlenW (lpString=".1cd") returned 4
	[0180.168] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0180.168] lstrlenW (lpString=".jpg") returned 4
	[0180.168] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.169] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.169] lstrlenW (lpString="HomeBusinessR_Retail3-pl.xrm-ms") returned 31
	[0180.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0180.169] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=10659) returned 1
	[0180.169] CloseHandle (hObject=0x370) returned 1
	[0180.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 0x220
	[0180.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0180.170] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.170] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0180.171] GetLastError () returned 0x0
	[0180.171] ReadFile (in: hFile=0x370, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x29a3, lpOverlapped=0x0) returned 1
	[0180.465] WriteFile (in: hFile=0x444, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0180.466] ReadFile (in: hFile=0x370, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.466] WriteFile (in: hFile=0x444, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x112, lpOverlapped=0x0) returned 1
	[0180.466] SetEndOfFile (hFile=0x444) returned 1
	[0180.466] CloseHandle (hObject=0x444) returned 1
	[0180.466] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.466] SetEndOfFile (hFile=0x370) returned 1
	[0180.469] CloseHandle (hObject=0x370) returned 1
	[0180.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 1
	[0182.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.490] lstrlenW (lpString=".doc") returned 4
	[0182.490] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.490] lstrlenW (lpString=".docx") returned 5
	[0182.490] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.490] lstrlenW (lpString=".pdf") returned 4
	[0182.490] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.490] lstrlenW (lpString=".xls") returned 4
	[0182.490] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.490] lstrlenW (lpString=".xlsx") returned 5
	[0182.490] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.490] lstrlenW (lpString=".ppt") returned 4
	[0182.490] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.490] lstrlenW (lpString=".zip") returned 4
	[0182.491] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.491] lstrlenW (lpString=".rar") returned 4
	[0182.491] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.491] lstrlenW (lpString=".bz2") returned 4
	[0182.491] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.491] lstrlenW (lpString=".7z") returned 3
	[0182.491] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.491] lstrlenW (lpString=".dbf") returned 4
	[0182.491] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.491] lstrlenW (lpString=".1cd") returned 4
	[0182.491] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.491] lstrlenW (lpString=".jpg") returned 4
	[0182.491] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.491] lstrlenW (lpString=".doc") returned 4
	[0182.491] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.491] lstrlenW (lpString=".docx") returned 5
	[0182.491] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.491] lstrlenW (lpString=".pdf") returned 4
	[0182.491] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.491] lstrlenW (lpString=".xls") returned 4
	[0182.491] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.491] lstrlenW (lpString=".xlsx") returned 5
	[0182.491] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.491] lstrlenW (lpString=".ppt") returned 4
	[0182.491] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.492] lstrlenW (lpString=".zip") returned 4
	[0182.492] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.492] lstrlenW (lpString=".rar") returned 4
	[0182.492] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.492] lstrlenW (lpString=".bz2") returned 4
	[0182.492] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.492] lstrlenW (lpString=".7z") returned 3
	[0182.492] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.492] lstrlenW (lpString=".dbf") returned 4
	[0182.492] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.492] lstrlenW (lpString=".1cd") returned 4
	[0182.492] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0182.492] lstrlenW (lpString=".jpg") returned 4
	[0182.492] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.492] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0182.492] lstrlenW (lpString="HomeStudentR_Grace-ppd.xrm-ms") returned 29
	[0182.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.678] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=21546) returned 1
	[0182.678] CloseHandle (hObject=0x444) returned 1
	[0182.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 0x220
	[0182.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.679] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.679] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0182.680] GetLastError () returned 0x0
	[0182.680] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x542a, lpOverlapped=0x0) returned 1
	[0182.683] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x5430, lpOverlapped=0x0) returned 1
	[0182.684] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.684] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0182.684] SetEndOfFile (hFile=0x54c) returned 1
	[0182.684] CloseHandle (hObject=0x54c) returned 1
	[0182.684] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.684] SetEndOfFile (hFile=0x444) returned 1
	[0182.688] CloseHandle (hObject=0x444) returned 1
	[0182.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 1
	[0182.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.689] lstrlenW (lpString=".doc") returned 4
	[0182.689] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.690] lstrlenW (lpString=".docx") returned 5
	[0182.690] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.690] lstrlenW (lpString=".pdf") returned 4
	[0182.690] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.690] lstrlenW (lpString=".xls") returned 4
	[0182.690] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.690] lstrlenW (lpString=".xlsx") returned 5
	[0182.690] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.690] lstrlenW (lpString=".ppt") returned 4
	[0182.690] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.690] lstrlenW (lpString=".zip") returned 4
	[0182.690] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.690] lstrlenW (lpString=".rar") returned 4
	[0182.690] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.690] lstrlenW (lpString=".bz2") returned 4
	[0182.690] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.690] lstrlenW (lpString=".7z") returned 3
	[0182.690] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.690] lstrlenW (lpString=".dbf") returned 4
	[0182.690] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.690] lstrlenW (lpString=".1cd") returned 4
	[0182.691] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.691] lstrlenW (lpString=".jpg") returned 4
	[0182.691] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.691] lstrlenW (lpString=".doc") returned 4
	[0182.691] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.691] lstrlenW (lpString=".docx") returned 5
	[0182.691] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.691] lstrlenW (lpString=".pdf") returned 4
	[0182.691] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.691] lstrlenW (lpString=".xls") returned 4
	[0182.691] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.691] lstrlenW (lpString=".xlsx") returned 5
	[0182.691] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.691] lstrlenW (lpString=".ppt") returned 4
	[0182.691] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.691] lstrlenW (lpString=".zip") returned 4
	[0182.691] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.691] lstrlenW (lpString=".rar") returned 4
	[0182.691] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.691] lstrlenW (lpString=".bz2") returned 4
	[0182.691] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.691] lstrlenW (lpString=".7z") returned 3
	[0182.691] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.692] lstrlenW (lpString=".dbf") returned 4
	[0182.692] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.692] lstrlenW (lpString=".1cd") returned 4
	[0182.692] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0182.692] lstrlenW (lpString=".jpg") returned 4
	[0182.692] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.692] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0182.692] lstrlenW (lpString="HomeStudentR_Grace-ul-oob.xrm-ms") returned 32
	[0182.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.693] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11619) returned 1
	[0182.693] CloseHandle (hObject=0x444) returned 1
	[0182.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 0x220
	[0182.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.694] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.694] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0182.695] GetLastError () returned 0x0
	[0182.695] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d63, lpOverlapped=0x0) returned 1
	[0182.697] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0182.699] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.699] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x114, lpOverlapped=0x0) returned 1
	[0182.699] SetEndOfFile (hFile=0x54c) returned 1
	[0182.700] CloseHandle (hObject=0x54c) returned 1
	[0182.700] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.700] SetEndOfFile (hFile=0x444) returned 1
	[0182.703] CloseHandle (hObject=0x444) returned 1
	[0182.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 1
	[0182.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.704] lstrlenW (lpString=".doc") returned 4
	[0182.704] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.705] lstrlenW (lpString=".docx") returned 5
	[0182.705] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.705] lstrlenW (lpString=".pdf") returned 4
	[0182.705] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.705] lstrlenW (lpString=".xls") returned 4
	[0182.705] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.705] lstrlenW (lpString=".xlsx") returned 5
	[0182.705] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.705] lstrlenW (lpString=".ppt") returned 4
	[0182.705] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.705] lstrlenW (lpString=".zip") returned 4
	[0182.705] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.705] lstrlenW (lpString=".rar") returned 4
	[0182.705] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.705] lstrlenW (lpString=".bz2") returned 4
	[0182.705] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.705] lstrlenW (lpString=".7z") returned 3
	[0182.705] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.705] lstrlenW (lpString=".dbf") returned 4
	[0182.705] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.705] lstrlenW (lpString=".1cd") returned 4
	[0182.705] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.705] lstrlenW (lpString=".jpg") returned 4
	[0182.705] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.706] lstrlenW (lpString=".doc") returned 4
	[0182.706] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.706] lstrlenW (lpString=".docx") returned 5
	[0182.706] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.706] lstrlenW (lpString=".pdf") returned 4
	[0182.706] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.706] lstrlenW (lpString=".xls") returned 4
	[0182.706] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.706] lstrlenW (lpString=".xlsx") returned 5
	[0182.706] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.706] lstrlenW (lpString=".ppt") returned 4
	[0182.706] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.706] lstrlenW (lpString=".zip") returned 4
	[0182.706] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.706] lstrlenW (lpString=".rar") returned 4
	[0182.706] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.706] lstrlenW (lpString=".bz2") returned 4
	[0182.706] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.706] lstrlenW (lpString=".7z") returned 3
	[0182.706] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.706] lstrlenW (lpString=".dbf") returned 4
	[0182.706] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.706] lstrlenW (lpString=".1cd") returned 4
	[0182.706] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0182.707] lstrlenW (lpString=".jpg") returned 4
	[0182.707] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.707] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0182.707] lstrlenW (lpString="HomeStudentR_OEM_Perp-pl.xrm-ms") returned 31
	[0182.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.707] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=10659) returned 1
	[0182.708] CloseHandle (hObject=0x444) returned 1
	[0182.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 0x220
	[0182.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.708] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.708] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0182.709] GetLastError () returned 0x0
	[0182.709] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x29a3, lpOverlapped=0x0) returned 1
	[0182.711] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0182.712] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.712] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x112, lpOverlapped=0x0) returned 1
	[0182.712] SetEndOfFile (hFile=0x54c) returned 1
	[0182.712] CloseHandle (hObject=0x54c) returned 1
	[0182.712] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.712] SetEndOfFile (hFile=0x444) returned 1
	[0182.715] CloseHandle (hObject=0x444) returned 1
	[0182.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 1
	[0182.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.716] lstrlenW (lpString=".doc") returned 4
	[0182.716] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.716] lstrlenW (lpString=".docx") returned 5
	[0182.716] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.716] lstrlenW (lpString=".pdf") returned 4
	[0182.716] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.716] lstrlenW (lpString=".xls") returned 4
	[0182.716] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.716] lstrlenW (lpString=".xlsx") returned 5
	[0182.716] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.716] lstrlenW (lpString=".ppt") returned 4
	[0182.716] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.716] lstrlenW (lpString=".zip") returned 4
	[0182.716] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.716] lstrlenW (lpString=".rar") returned 4
	[0182.716] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.716] lstrlenW (lpString=".bz2") returned 4
	[0182.716] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.716] lstrlenW (lpString=".7z") returned 3
	[0182.716] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.716] lstrlenW (lpString=".dbf") returned 4
	[0182.716] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.717] lstrlenW (lpString=".1cd") returned 4
	[0182.717] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.717] lstrlenW (lpString=".jpg") returned 4
	[0182.717] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.717] lstrlenW (lpString=".doc") returned 4
	[0182.717] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.717] lstrlenW (lpString=".docx") returned 5
	[0182.717] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.717] lstrlenW (lpString=".pdf") returned 4
	[0182.717] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.717] lstrlenW (lpString=".xls") returned 4
	[0182.717] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.717] lstrlenW (lpString=".xlsx") returned 5
	[0182.717] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.717] lstrlenW (lpString=".ppt") returned 4
	[0182.717] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.717] lstrlenW (lpString=".zip") returned 4
	[0182.717] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.717] lstrlenW (lpString=".rar") returned 4
	[0182.717] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.717] lstrlenW (lpString=".bz2") returned 4
	[0182.717] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.717] lstrlenW (lpString=".7z") returned 3
	[0182.717] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.717] lstrlenW (lpString=".dbf") returned 4
	[0182.717] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.718] lstrlenW (lpString=".1cd") returned 4
	[0182.718] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0182.718] lstrlenW (lpString=".jpg") returned 4
	[0182.718] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.718] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0182.718] lstrlenW (lpString="HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 32
	[0182.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.718] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=21606) returned 1
	[0182.719] CloseHandle (hObject=0x444) returned 1
	[0182.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0182.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.719] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.719] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0182.720] GetLastError () returned 0x0
	[0182.720] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x5466, lpOverlapped=0x0) returned 1
	[0182.918] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x5470, lpOverlapped=0x0) returned 1
	[0182.919] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.919] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x114, lpOverlapped=0x0) returned 1
	[0182.919] SetEndOfFile (hFile=0x54c) returned 1
	[0182.919] CloseHandle (hObject=0x54c) returned 1
	[0182.919] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.920] SetEndOfFile (hFile=0x444) returned 1
	[0182.923] CloseHandle (hObject=0x444) returned 1
	[0182.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 1
	[0182.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.924] lstrlenW (lpString=".doc") returned 4
	[0182.924] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.924] lstrlenW (lpString=".docx") returned 5
	[0182.924] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.924] lstrlenW (lpString=".pdf") returned 4
	[0182.924] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.924] lstrlenW (lpString=".xls") returned 4
	[0182.924] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.924] lstrlenW (lpString=".xlsx") returned 5
	[0182.924] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.924] lstrlenW (lpString=".ppt") returned 4
	[0182.924] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.924] lstrlenW (lpString=".zip") returned 4
	[0182.924] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.924] lstrlenW (lpString=".rar") returned 4
	[0182.924] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.924] lstrlenW (lpString=".bz2") returned 4
	[0182.924] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.924] lstrlenW (lpString=".7z") returned 3
	[0182.925] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.925] lstrlenW (lpString=".dbf") returned 4
	[0182.925] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.925] lstrlenW (lpString=".1cd") returned 4
	[0182.925] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.925] lstrlenW (lpString=".jpg") returned 4
	[0182.925] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.925] lstrlenW (lpString=".doc") returned 4
	[0182.925] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.925] lstrlenW (lpString=".docx") returned 5
	[0182.925] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.925] lstrlenW (lpString=".pdf") returned 4
	[0182.925] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.925] lstrlenW (lpString=".xls") returned 4
	[0182.925] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.925] lstrlenW (lpString=".xlsx") returned 5
	[0182.925] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.925] lstrlenW (lpString=".ppt") returned 4
	[0182.925] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.925] lstrlenW (lpString=".zip") returned 4
	[0182.925] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.925] lstrlenW (lpString=".rar") returned 4
	[0182.925] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.925] lstrlenW (lpString=".bz2") returned 4
	[0182.926] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.926] lstrlenW (lpString=".7z") returned 3
	[0182.926] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.926] lstrlenW (lpString=".dbf") returned 4
	[0182.926] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.926] lstrlenW (lpString=".1cd") returned 4
	[0182.926] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0182.926] lstrlenW (lpString=".jpg") returned 4
	[0182.926] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.926] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0182.926] lstrlenW (lpString="HomeStudentR_Retail-ppd.xrm-ms") returned 30
	[0182.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.927] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=21604) returned 1
	[0182.927] CloseHandle (hObject=0x444) returned 1
	[0182.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 0x220
	[0182.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.928] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.928] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0182.928] GetLastError () returned 0x0
	[0182.928] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x5464, lpOverlapped=0x0) returned 1
	[0182.931] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x5470, lpOverlapped=0x0) returned 1
	[0182.932] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.932] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x110, lpOverlapped=0x0) returned 1
	[0182.932] SetEndOfFile (hFile=0x54c) returned 1
	[0182.932] CloseHandle (hObject=0x54c) returned 1
	[0182.932] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.932] SetEndOfFile (hFile=0x444) returned 1
	[0182.936] CloseHandle (hObject=0x444) returned 1
	[0182.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 1
	[0182.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.937] lstrlenW (lpString=".doc") returned 4
	[0182.937] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.937] lstrlenW (lpString=".docx") returned 5
	[0182.937] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.937] lstrlenW (lpString=".pdf") returned 4
	[0182.937] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.937] lstrlenW (lpString=".xls") returned 4
	[0182.937] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.937] lstrlenW (lpString=".xlsx") returned 5
	[0182.937] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.937] lstrlenW (lpString=".ppt") returned 4
	[0182.937] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.937] lstrlenW (lpString=".zip") returned 4
	[0182.937] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.937] lstrlenW (lpString=".rar") returned 4
	[0182.937] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.937] lstrlenW (lpString=".bz2") returned 4
	[0182.937] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.937] lstrlenW (lpString=".7z") returned 3
	[0182.938] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.938] lstrlenW (lpString=".dbf") returned 4
	[0182.938] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.938] lstrlenW (lpString=".1cd") returned 4
	[0182.938] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.938] lstrlenW (lpString=".jpg") returned 4
	[0182.938] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.938] lstrlenW (lpString=".doc") returned 4
	[0182.938] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.938] lstrlenW (lpString=".docx") returned 5
	[0182.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.938] lstrlenW (lpString=".pdf") returned 4
	[0182.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.938] lstrlenW (lpString=".xls") returned 4
	[0182.938] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.938] lstrlenW (lpString=".xlsx") returned 5
	[0182.938] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.938] lstrlenW (lpString=".ppt") returned 4
	[0182.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.938] lstrlenW (lpString=".zip") returned 4
	[0182.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.938] lstrlenW (lpString=".rar") returned 4
	[0182.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.938] lstrlenW (lpString=".bz2") returned 4
	[0182.938] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.938] lstrlenW (lpString=".7z") returned 3
	[0182.939] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.939] lstrlenW (lpString=".dbf") returned 4
	[0182.939] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.939] lstrlenW (lpString=".1cd") returned 4
	[0182.939] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0182.939] lstrlenW (lpString=".jpg") returned 4
	[0182.939] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.939] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0182.939] lstrlenW (lpString="HomeStudentR_Retail-ul-oob.xrm-ms") returned 33
	[0182.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.940] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11604) returned 1
	[0182.940] CloseHandle (hObject=0x444) returned 1
	[0182.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 0x220
	[0182.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.942] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.942] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0182.943] GetLastError () returned 0x0
	[0182.943] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d54, lpOverlapped=0x0) returned 1
	[0182.944] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0182.945] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.946] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x116, lpOverlapped=0x0) returned 1
	[0182.946] SetEndOfFile (hFile=0x54c) returned 1
	[0182.946] CloseHandle (hObject=0x54c) returned 1
	[0182.946] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.946] SetEndOfFile (hFile=0x444) returned 1
	[0182.949] CloseHandle (hObject=0x444) returned 1
	[0182.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 1
	[0182.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.950] lstrlenW (lpString=".doc") returned 4
	[0182.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.950] lstrlenW (lpString=".docx") returned 5
	[0182.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.950] lstrlenW (lpString=".pdf") returned 4
	[0182.950] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.950] lstrlenW (lpString=".xls") returned 4
	[0182.950] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.950] lstrlenW (lpString=".xlsx") returned 5
	[0182.951] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.951] lstrlenW (lpString=".ppt") returned 4
	[0182.951] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.951] lstrlenW (lpString=".zip") returned 4
	[0182.951] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.951] lstrlenW (lpString=".rar") returned 4
	[0182.951] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.951] lstrlenW (lpString=".bz2") returned 4
	[0182.951] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.951] lstrlenW (lpString=".7z") returned 3
	[0182.951] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.951] lstrlenW (lpString=".dbf") returned 4
	[0182.951] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.951] lstrlenW (lpString=".1cd") returned 4
	[0182.951] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.951] lstrlenW (lpString=".jpg") returned 4
	[0182.951] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.951] lstrlenW (lpString=".doc") returned 4
	[0182.951] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.951] lstrlenW (lpString=".docx") returned 5
	[0182.951] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.951] lstrlenW (lpString=".pdf") returned 4
	[0182.951] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.951] lstrlenW (lpString=".xls") returned 4
	[0182.952] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.952] lstrlenW (lpString=".xlsx") returned 5
	[0182.952] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.952] lstrlenW (lpString=".ppt") returned 4
	[0182.952] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.952] lstrlenW (lpString=".zip") returned 4
	[0182.952] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.952] lstrlenW (lpString=".rar") returned 4
	[0182.952] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.952] lstrlenW (lpString=".bz2") returned 4
	[0182.952] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.952] lstrlenW (lpString=".7z") returned 3
	[0182.952] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.952] lstrlenW (lpString=".dbf") returned 4
	[0182.952] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.952] lstrlenW (lpString=".1cd") returned 4
	[0182.952] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0182.952] lstrlenW (lpString=".jpg") returned 4
	[0182.952] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.952] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0182.952] lstrlenW (lpString="HomeStudentR_Retail-ul-phn.xrm-ms") returned 33
	[0182.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.953] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=19949) returned 1
	[0182.953] CloseHandle (hObject=0x444) returned 1
	[0182.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 0x220
	[0182.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0182.954] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.954] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0182.955] GetLastError () returned 0x0
	[0182.955] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x4ded, lpOverlapped=0x0) returned 1
	[0183.293] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x4df0, lpOverlapped=0x0) returned 1
	[0183.295] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.295] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x116, lpOverlapped=0x0) returned 1
	[0183.295] SetEndOfFile (hFile=0x54c) returned 1
	[0183.295] CloseHandle (hObject=0x54c) returned 1
	[0183.295] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.295] SetEndOfFile (hFile=0x444) returned 1
	[0183.298] CloseHandle (hObject=0x444) returned 1
	[0183.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 1
	[0183.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.300] lstrlenW (lpString=".doc") returned 4
	[0183.300] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.300] lstrlenW (lpString=".docx") returned 5
	[0183.300] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.300] lstrlenW (lpString=".pdf") returned 4
	[0183.300] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.300] lstrlenW (lpString=".xls") returned 4
	[0183.300] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.300] lstrlenW (lpString=".xlsx") returned 5
	[0183.300] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.300] lstrlenW (lpString=".ppt") returned 4
	[0183.300] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.300] lstrlenW (lpString=".zip") returned 4
	[0183.300] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.300] lstrlenW (lpString=".rar") returned 4
	[0183.300] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.300] lstrlenW (lpString=".bz2") returned 4
	[0183.300] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.300] lstrlenW (lpString=".7z") returned 3
	[0183.300] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.300] lstrlenW (lpString=".dbf") returned 4
	[0183.300] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.300] lstrlenW (lpString=".1cd") returned 4
	[0183.301] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.301] lstrlenW (lpString=".jpg") returned 4
	[0183.301] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.301] lstrlenW (lpString=".doc") returned 4
	[0183.301] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.301] lstrlenW (lpString=".docx") returned 5
	[0183.301] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.301] lstrlenW (lpString=".pdf") returned 4
	[0183.301] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.301] lstrlenW (lpString=".xls") returned 4
	[0183.301] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.301] lstrlenW (lpString=".xlsx") returned 5
	[0183.301] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.301] lstrlenW (lpString=".ppt") returned 4
	[0183.301] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.301] lstrlenW (lpString=".zip") returned 4
	[0183.301] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.301] lstrlenW (lpString=".rar") returned 4
	[0183.301] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.301] lstrlenW (lpString=".bz2") returned 4
	[0183.301] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.301] lstrlenW (lpString=".7z") returned 3
	[0183.301] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.301] lstrlenW (lpString=".dbf") returned 4
	[0183.301] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.302] lstrlenW (lpString=".1cd") returned 4
	[0183.302] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0183.302] lstrlenW (lpString=".jpg") returned 4
	[0183.302] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.302] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.302] lstrlenW (lpString="MondoR_BypassTrial180-ul-oob.xrm-ms") returned 35
	[0183.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0183.303] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11623) returned 1
	[0183.303] CloseHandle (hObject=0x444) returned 1
	[0183.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0183.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0183.304] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.304] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0183.305] GetLastError () returned 0x0
	[0183.305] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d67, lpOverlapped=0x0) returned 1
	[0183.307] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0183.308] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.308] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0183.308] SetEndOfFile (hFile=0x54c) returned 1
	[0183.308] CloseHandle (hObject=0x54c) returned 1
	[0183.308] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.308] SetEndOfFile (hFile=0x444) returned 1
	[0183.311] CloseHandle (hObject=0x444) returned 1
	[0183.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0183.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.312] lstrlenW (lpString=".doc") returned 4
	[0183.312] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.312] lstrlenW (lpString=".docx") returned 5
	[0183.312] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.312] lstrlenW (lpString=".pdf") returned 4
	[0183.312] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.312] lstrlenW (lpString=".xls") returned 4
	[0183.312] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.312] lstrlenW (lpString=".xlsx") returned 5
	[0183.312] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.312] lstrlenW (lpString=".ppt") returned 4
	[0183.312] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.312] lstrlenW (lpString=".zip") returned 4
	[0183.312] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.313] lstrlenW (lpString=".rar") returned 4
	[0183.313] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.313] lstrlenW (lpString=".bz2") returned 4
	[0183.313] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.313] lstrlenW (lpString=".7z") returned 3
	[0183.313] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.313] lstrlenW (lpString=".dbf") returned 4
	[0183.313] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.313] lstrlenW (lpString=".1cd") returned 4
	[0183.313] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.313] lstrlenW (lpString=".jpg") returned 4
	[0183.313] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.313] lstrlenW (lpString=".doc") returned 4
	[0183.313] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.313] lstrlenW (lpString=".docx") returned 5
	[0183.313] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.313] lstrlenW (lpString=".pdf") returned 4
	[0183.313] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.313] lstrlenW (lpString=".xls") returned 4
	[0183.313] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.313] lstrlenW (lpString=".xlsx") returned 5
	[0183.313] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.313] lstrlenW (lpString=".ppt") returned 4
	[0183.313] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.314] lstrlenW (lpString=".zip") returned 4
	[0183.314] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.314] lstrlenW (lpString=".rar") returned 4
	[0183.314] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.314] lstrlenW (lpString=".bz2") returned 4
	[0183.314] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.314] lstrlenW (lpString=".7z") returned 3
	[0183.314] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.314] lstrlenW (lpString=".dbf") returned 4
	[0183.314] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.314] lstrlenW (lpString=".1cd") returned 4
	[0183.314] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0183.314] lstrlenW (lpString=".jpg") returned 4
	[0183.314] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.314] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.314] lstrlenW (lpString="MondoR_Grace-ppd.xrm-ms") returned 23
	[0183.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0183.315] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=26459) returned 1
	[0183.315] CloseHandle (hObject=0x444) returned 1
	[0183.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 0x220
	[0183.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0183.316] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.316] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0183.316] GetLastError () returned 0x0
	[0183.316] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x675b, lpOverlapped=0x0) returned 1
	[0183.319] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x6760, lpOverlapped=0x0) returned 1
	[0183.320] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.320] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x102, lpOverlapped=0x0) returned 1
	[0183.320] SetEndOfFile (hFile=0x54c) returned 1
	[0183.320] CloseHandle (hObject=0x54c) returned 1
	[0183.320] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.320] SetEndOfFile (hFile=0x444) returned 1
	[0183.323] CloseHandle (hObject=0x444) returned 1
	[0183.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 1
	[0183.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.325] lstrlenW (lpString=".doc") returned 4
	[0183.325] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.325] lstrlenW (lpString=".docx") returned 5
	[0183.325] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.325] lstrlenW (lpString=".pdf") returned 4
	[0183.325] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.325] lstrlenW (lpString=".xls") returned 4
	[0183.325] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.325] lstrlenW (lpString=".xlsx") returned 5
	[0183.325] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.325] lstrlenW (lpString=".ppt") returned 4
	[0183.325] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.325] lstrlenW (lpString=".zip") returned 4
	[0183.325] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.325] lstrlenW (lpString=".rar") returned 4
	[0183.325] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.325] lstrlenW (lpString=".bz2") returned 4
	[0183.325] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.325] lstrlenW (lpString=".7z") returned 3
	[0183.325] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.326] lstrlenW (lpString=".dbf") returned 4
	[0183.326] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.326] lstrlenW (lpString=".1cd") returned 4
	[0183.326] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.326] lstrlenW (lpString=".jpg") returned 4
	[0183.326] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.326] lstrlenW (lpString=".doc") returned 4
	[0183.326] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.326] lstrlenW (lpString=".docx") returned 5
	[0183.326] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.326] lstrlenW (lpString=".pdf") returned 4
	[0183.326] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.326] lstrlenW (lpString=".xls") returned 4
	[0183.326] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.326] lstrlenW (lpString=".xlsx") returned 5
	[0183.326] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.326] lstrlenW (lpString=".ppt") returned 4
	[0183.326] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.326] lstrlenW (lpString=".zip") returned 4
	[0183.326] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.326] lstrlenW (lpString=".rar") returned 4
	[0183.326] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.326] lstrlenW (lpString=".bz2") returned 4
	[0183.326] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.326] lstrlenW (lpString=".7z") returned 3
	[0183.326] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.327] lstrlenW (lpString=".dbf") returned 4
	[0183.327] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.327] lstrlenW (lpString=".1cd") returned 4
	[0183.327] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0183.327] lstrlenW (lpString=".jpg") returned 4
	[0183.327] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.327] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.327] lstrlenW (lpString="MondoR_Grace-ul-oob.xrm-ms") returned 26
	[0183.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0183.328] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11589) returned 1
	[0183.328] CloseHandle (hObject=0x444) returned 1
	[0183.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 0x220
	[0183.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0183.328] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.328] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0183.329] GetLastError () returned 0x0
	[0183.329] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d45, lpOverlapped=0x0) returned 1
	[0183.469] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0183.795] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.795] WriteFile (in: hFile=0x54c, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x108, lpOverlapped=0x0) returned 1
	[0183.795] SetEndOfFile (hFile=0x54c) returned 1
	[0183.795] CloseHandle (hObject=0x54c) returned 1
	[0183.795] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.796] SetEndOfFile (hFile=0x444) returned 1
	[0184.311] CloseHandle (hObject=0x444) returned 1
	[0184.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 1
	[0184.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.313] lstrlenW (lpString=".doc") returned 4
	[0184.313] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0184.313] lstrlenW (lpString=".docx") returned 5
	[0184.313] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0184.313] lstrlenW (lpString=".pdf") returned 4
	[0184.313] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0184.313] lstrlenW (lpString=".xls") returned 4
	[0184.313] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0184.313] lstrlenW (lpString=".xlsx") returned 5
	[0184.313] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0184.313] lstrlenW (lpString=".ppt") returned 4
	[0184.313] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0184.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.313] lstrlenW (lpString=".zip") returned 4
	[0184.313] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0184.313] lstrlenW (lpString=".rar") returned 4
	[0184.313] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0184.313] lstrlenW (lpString=".bz2") returned 4
	[0184.313] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0184.313] lstrlenW (lpString=".7z") returned 3
	[0184.313] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0184.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.314] lstrlenW (lpString=".dbf") returned 4
	[0184.314] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0184.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.314] lstrlenW (lpString=".1cd") returned 4
	[0184.314] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0184.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.314] lstrlenW (lpString=".jpg") returned 4
	[0184.314] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0184.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.314] lstrlenW (lpString=".doc") returned 4
	[0184.314] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0184.314] lstrlenW (lpString=".docx") returned 5
	[0184.314] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0184.314] lstrlenW (lpString=".pdf") returned 4
	[0184.314] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0184.314] lstrlenW (lpString=".xls") returned 4
	[0184.314] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0184.314] lstrlenW (lpString=".xlsx") returned 5
	[0184.314] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0184.314] lstrlenW (lpString=".ppt") returned 4
	[0184.314] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0184.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.314] lstrlenW (lpString=".zip") returned 4
	[0184.314] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0184.314] lstrlenW (lpString=".rar") returned 4
	[0184.314] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0184.314] lstrlenW (lpString=".bz2") returned 4
	[0184.314] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0184.314] lstrlenW (lpString=".7z") returned 3
	[0184.314] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0184.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.315] lstrlenW (lpString=".dbf") returned 4
	[0184.315] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0184.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.315] lstrlenW (lpString=".1cd") returned 4
	[0184.315] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0184.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0184.315] lstrlenW (lpString=".jpg") returned 4
	[0184.315] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0184.315] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0184.315] lstrlenW (lpString="MondoR_Retail-pl.xrm-ms") returned 23
	[0184.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0184.316] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=10627) returned 1
	[0184.316] CloseHandle (hObject=0x444) returned 1
	[0184.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 0x220
	[0184.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0184.317] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.317] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0184.318] GetLastError () returned 0x0
	[0184.318] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2983, lpOverlapped=0x0) returned 1
	[0184.319] WriteFile (in: hFile=0x524, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0184.320] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.321] WriteFile (in: hFile=0x524, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x102, lpOverlapped=0x0) returned 1
	[0184.321] SetEndOfFile (hFile=0x524) returned 1
	[0184.321] CloseHandle (hObject=0x524) returned 1
	[0184.321] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.321] SetEndOfFile (hFile=0x444) returned 1
	[0184.324] CloseHandle (hObject=0x444) returned 1
	[0184.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 1
	[0184.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.326] lstrlenW (lpString=".doc") returned 4
	[0184.326] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0184.326] lstrlenW (lpString=".docx") returned 5
	[0184.326] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0184.326] lstrlenW (lpString=".pdf") returned 4
	[0184.326] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0184.326] lstrlenW (lpString=".xls") returned 4
	[0184.326] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0184.326] lstrlenW (lpString=".xlsx") returned 5
	[0184.326] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0184.326] lstrlenW (lpString=".ppt") returned 4
	[0184.326] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0184.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.326] lstrlenW (lpString=".zip") returned 4
	[0184.326] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0184.326] lstrlenW (lpString=".rar") returned 4
	[0184.326] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0184.326] lstrlenW (lpString=".bz2") returned 4
	[0184.326] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0184.326] lstrlenW (lpString=".7z") returned 3
	[0184.326] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0184.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.326] lstrlenW (lpString=".dbf") returned 4
	[0184.326] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0184.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.326] lstrlenW (lpString=".1cd") returned 4
	[0184.326] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0184.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.326] lstrlenW (lpString=".jpg") returned 4
	[0184.326] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0184.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.327] lstrlenW (lpString=".doc") returned 4
	[0184.327] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0184.327] lstrlenW (lpString=".docx") returned 5
	[0184.327] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0184.327] lstrlenW (lpString=".pdf") returned 4
	[0184.327] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0184.327] lstrlenW (lpString=".xls") returned 4
	[0184.327] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0184.327] lstrlenW (lpString=".xlsx") returned 5
	[0184.327] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0184.327] lstrlenW (lpString=".ppt") returned 4
	[0184.327] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0184.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.327] lstrlenW (lpString=".zip") returned 4
	[0184.327] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0184.327] lstrlenW (lpString=".rar") returned 4
	[0184.327] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0184.327] lstrlenW (lpString=".bz2") returned 4
	[0184.327] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0184.327] lstrlenW (lpString=".7z") returned 3
	[0184.327] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0184.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.327] lstrlenW (lpString=".dbf") returned 4
	[0184.327] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0184.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.327] lstrlenW (lpString=".1cd") returned 4
	[0184.327] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0184.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0184.327] lstrlenW (lpString=".jpg") returned 4
	[0184.327] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0184.328] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0184.328] lstrlenW (lpString="MondoR_Retail-ppd.xrm-ms") returned 24
	[0184.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0184.328] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=26462) returned 1
	[0184.328] CloseHandle (hObject=0x444) returned 1
	[0184.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 0x220
	[0184.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0184.329] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.329] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0184.330] GetLastError () returned 0x0
	[0184.330] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x675e, lpOverlapped=0x0) returned 1
	[0184.332] WriteFile (in: hFile=0x524, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x6760, lpOverlapped=0x0) returned 1
	[0184.333] ReadFile (in: hFile=0x444, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.333] WriteFile (in: hFile=0x524, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x104, lpOverlapped=0x0) returned 1
	[0184.333] SetEndOfFile (hFile=0x524) returned 1
	[0184.334] CloseHandle (hObject=0x524) returned 1
	[0184.334] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.334] SetEndOfFile (hFile=0x444) returned 1
	[0184.337] CloseHandle (hObject=0x444) returned 1
	[0184.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 1
	[0184.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.338] lstrlenW (lpString=".doc") returned 4
	[0184.338] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0184.338] lstrlenW (lpString=".docx") returned 5
	[0184.338] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0184.338] lstrlenW (lpString=".pdf") returned 4
	[0184.338] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0184.338] lstrlenW (lpString=".xls") returned 4
	[0184.338] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0184.338] lstrlenW (lpString=".xlsx") returned 5
	[0184.338] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0184.338] lstrlenW (lpString=".ppt") returned 4
	[0184.338] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0184.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.338] lstrlenW (lpString=".zip") returned 4
	[0184.338] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0184.338] lstrlenW (lpString=".rar") returned 4
	[0184.338] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0184.338] lstrlenW (lpString=".bz2") returned 4
	[0184.338] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0184.338] lstrlenW (lpString=".7z") returned 3
	[0184.338] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0184.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.338] lstrlenW (lpString=".dbf") returned 4
	[0184.339] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0184.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.339] lstrlenW (lpString=".1cd") returned 4
	[0184.339] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0184.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.339] lstrlenW (lpString=".jpg") returned 4
	[0184.339] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0184.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.339] lstrlenW (lpString=".doc") returned 4
	[0184.339] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0184.339] lstrlenW (lpString=".docx") returned 5
	[0184.339] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0184.339] lstrlenW (lpString=".pdf") returned 4
	[0184.339] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0184.339] lstrlenW (lpString=".xls") returned 4
	[0184.339] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0184.339] lstrlenW (lpString=".xlsx") returned 5
	[0184.339] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0184.339] lstrlenW (lpString=".ppt") returned 4
	[0184.339] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0184.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.339] lstrlenW (lpString=".zip") returned 4
	[0184.339] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0184.339] lstrlenW (lpString=".rar") returned 4
	[0184.339] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0184.339] lstrlenW (lpString=".bz2") returned 4
	[0184.339] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0184.339] lstrlenW (lpString=".7z") returned 3
	[0184.339] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0184.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.340] lstrlenW (lpString=".dbf") returned 4
	[0184.340] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0184.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.340] lstrlenW (lpString=".1cd") returned 4
	[0184.340] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0184.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0184.340] lstrlenW (lpString=".jpg") returned 4
	[0184.340] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0184.340] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0184.340] lstrlenW (lpString="MondoR_Retail-ul-oob.xrm-ms") returned 27
	[0184.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0184.348] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11574) returned 1
	[0184.692] CloseHandle (hObject=0x444) returned 1
	[0184.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 0x220
	[0185.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.317] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.317] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0186.318] GetLastError () returned 0x0
	[0186.318] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d36, lpOverlapped=0x0) returned 1
	[0186.320] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0186.321] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.321] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0186.321] SetEndOfFile (hFile=0x290) returned 1
	[0186.321] CloseHandle (hObject=0x290) returned 1
	[0186.321] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.321] SetEndOfFile (hFile=0x504) returned 1
	[0186.324] CloseHandle (hObject=0x504) returned 1
	[0186.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 1
	[0186.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.325] lstrlenW (lpString=".doc") returned 4
	[0186.325] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.325] lstrlenW (lpString=".docx") returned 5
	[0186.325] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.325] lstrlenW (lpString=".pdf") returned 4
	[0186.325] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.325] lstrlenW (lpString=".xls") returned 4
	[0186.325] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.325] lstrlenW (lpString=".xlsx") returned 5
	[0186.325] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.325] lstrlenW (lpString=".ppt") returned 4
	[0186.325] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.325] lstrlenW (lpString=".zip") returned 4
	[0186.325] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.325] lstrlenW (lpString=".rar") returned 4
	[0186.325] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.325] lstrlenW (lpString=".bz2") returned 4
	[0186.325] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.325] lstrlenW (lpString=".7z") returned 3
	[0186.325] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.325] lstrlenW (lpString=".dbf") returned 4
	[0186.325] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.326] lstrlenW (lpString=".1cd") returned 4
	[0186.326] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.326] lstrlenW (lpString=".jpg") returned 4
	[0186.326] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.326] lstrlenW (lpString=".doc") returned 4
	[0186.326] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.326] lstrlenW (lpString=".docx") returned 5
	[0186.326] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.326] lstrlenW (lpString=".pdf") returned 4
	[0186.326] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.326] lstrlenW (lpString=".xls") returned 4
	[0186.326] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.326] lstrlenW (lpString=".xlsx") returned 5
	[0186.326] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.326] lstrlenW (lpString=".ppt") returned 4
	[0186.326] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.326] lstrlenW (lpString=".zip") returned 4
	[0186.326] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.326] lstrlenW (lpString=".rar") returned 4
	[0186.326] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.326] lstrlenW (lpString=".bz2") returned 4
	[0186.326] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.326] lstrlenW (lpString=".7z") returned 3
	[0186.326] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.326] lstrlenW (lpString=".dbf") returned 4
	[0186.327] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.327] lstrlenW (lpString=".1cd") returned 4
	[0186.327] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0186.327] lstrlenW (lpString=".jpg") returned 4
	[0186.327] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.327] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.327] lstrlenW (lpString="MondoR_SubTrial2-ppd.xrm-ms") returned 27
	[0186.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.328] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=26526) returned 1
	[0186.328] CloseHandle (hObject=0x504) returned 1
	[0186.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 0x220
	[0186.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.328] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.328] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0186.329] GetLastError () returned 0x0
	[0186.329] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x679e, lpOverlapped=0x0) returned 1
	[0186.331] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0186.332] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.332] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0186.332] SetEndOfFile (hFile=0x290) returned 1
	[0186.333] CloseHandle (hObject=0x290) returned 1
	[0186.333] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.333] SetEndOfFile (hFile=0x504) returned 1
	[0186.336] CloseHandle (hObject=0x504) returned 1
	[0186.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 1
	[0186.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.337] lstrlenW (lpString=".doc") returned 4
	[0186.337] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.337] lstrlenW (lpString=".docx") returned 5
	[0186.337] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.337] lstrlenW (lpString=".pdf") returned 4
	[0186.337] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.337] lstrlenW (lpString=".xls") returned 4
	[0186.337] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.337] lstrlenW (lpString=".xlsx") returned 5
	[0186.337] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.337] lstrlenW (lpString=".ppt") returned 4
	[0186.337] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.337] lstrlenW (lpString=".zip") returned 4
	[0186.337] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.337] lstrlenW (lpString=".rar") returned 4
	[0186.337] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.337] lstrlenW (lpString=".bz2") returned 4
	[0186.337] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.337] lstrlenW (lpString=".7z") returned 3
	[0186.337] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.337] lstrlenW (lpString=".dbf") returned 4
	[0186.337] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.338] lstrlenW (lpString=".1cd") returned 4
	[0186.338] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.338] lstrlenW (lpString=".jpg") returned 4
	[0186.338] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.338] lstrlenW (lpString=".doc") returned 4
	[0186.338] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.338] lstrlenW (lpString=".docx") returned 5
	[0186.338] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.338] lstrlenW (lpString=".pdf") returned 4
	[0186.338] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.338] lstrlenW (lpString=".xls") returned 4
	[0186.338] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.338] lstrlenW (lpString=".xlsx") returned 5
	[0186.338] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.338] lstrlenW (lpString=".ppt") returned 4
	[0186.338] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.338] lstrlenW (lpString=".zip") returned 4
	[0186.338] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.338] lstrlenW (lpString=".rar") returned 4
	[0186.338] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.338] lstrlenW (lpString=".bz2") returned 4
	[0186.338] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.338] lstrlenW (lpString=".7z") returned 3
	[0186.338] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.339] lstrlenW (lpString=".dbf") returned 4
	[0186.339] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.339] lstrlenW (lpString=".1cd") returned 4
	[0186.339] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0186.339] lstrlenW (lpString=".jpg") returned 4
	[0186.339] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.339] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.339] lstrlenW (lpString="MondoR_SubTrial2-ul-oob.xrm-ms") returned 30
	[0186.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.340] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11600) returned 1
	[0186.340] CloseHandle (hObject=0x504) returned 1
	[0186.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 0x220
	[0186.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.341] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.341] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0186.342] GetLastError () returned 0x0
	[0186.342] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d50, lpOverlapped=0x0) returned 1
	[0186.344] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0186.345] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.345] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x110, lpOverlapped=0x0) returned 1
	[0186.345] SetEndOfFile (hFile=0x290) returned 1
	[0186.345] CloseHandle (hObject=0x290) returned 1
	[0186.345] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.345] SetEndOfFile (hFile=0x504) returned 1
	[0186.348] CloseHandle (hObject=0x504) returned 1
	[0186.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 1
	[0186.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.349] lstrlenW (lpString=".doc") returned 4
	[0186.349] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.349] lstrlenW (lpString=".docx") returned 5
	[0186.349] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.349] lstrlenW (lpString=".pdf") returned 4
	[0186.349] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.349] lstrlenW (lpString=".xls") returned 4
	[0186.349] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.349] lstrlenW (lpString=".xlsx") returned 5
	[0186.349] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.349] lstrlenW (lpString=".ppt") returned 4
	[0186.349] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.349] lstrlenW (lpString=".zip") returned 4
	[0186.349] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.350] lstrlenW (lpString=".rar") returned 4
	[0186.350] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.350] lstrlenW (lpString=".bz2") returned 4
	[0186.350] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.350] lstrlenW (lpString=".7z") returned 3
	[0186.350] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.350] lstrlenW (lpString=".dbf") returned 4
	[0186.350] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.350] lstrlenW (lpString=".1cd") returned 4
	[0186.350] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.350] lstrlenW (lpString=".jpg") returned 4
	[0186.350] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.350] lstrlenW (lpString=".doc") returned 4
	[0186.350] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.350] lstrlenW (lpString=".docx") returned 5
	[0186.350] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.350] lstrlenW (lpString=".pdf") returned 4
	[0186.350] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.350] lstrlenW (lpString=".xls") returned 4
	[0186.350] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.350] lstrlenW (lpString=".xlsx") returned 5
	[0186.350] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.350] lstrlenW (lpString=".ppt") returned 4
	[0186.350] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.350] lstrlenW (lpString=".zip") returned 4
	[0186.351] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.351] lstrlenW (lpString=".rar") returned 4
	[0186.351] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.351] lstrlenW (lpString=".bz2") returned 4
	[0186.351] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.351] lstrlenW (lpString=".7z") returned 3
	[0186.351] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.351] lstrlenW (lpString=".dbf") returned 4
	[0186.351] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.351] lstrlenW (lpString=".1cd") returned 4
	[0186.351] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0186.351] lstrlenW (lpString=".jpg") returned 4
	[0186.351] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.351] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.351] lstrlenW (lpString="MondoR_Trial-pl.xrm-ms") returned 22
	[0186.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.352] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11139) returned 1
	[0186.352] CloseHandle (hObject=0x504) returned 1
	[0186.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 0x220
	[0186.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.352] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.353] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0186.353] GetLastError () returned 0x0
	[0186.353] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2b83, lpOverlapped=0x0) returned 1
	[0186.497] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0186.498] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.498] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x100, lpOverlapped=0x0) returned 1
	[0186.498] SetEndOfFile (hFile=0x290) returned 1
	[0186.630] CloseHandle (hObject=0x290) returned 1
	[0186.631] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.631] SetEndOfFile (hFile=0x504) returned 1
	[0186.633] CloseHandle (hObject=0x504) returned 1
	[0186.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 1
	[0186.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.634] lstrlenW (lpString=".doc") returned 4
	[0186.634] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.634] lstrlenW (lpString=".docx") returned 5
	[0186.634] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.634] lstrlenW (lpString=".pdf") returned 4
	[0186.634] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.634] lstrlenW (lpString=".xls") returned 4
	[0186.634] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.634] lstrlenW (lpString=".xlsx") returned 5
	[0186.635] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.635] lstrlenW (lpString=".ppt") returned 4
	[0186.635] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.635] lstrlenW (lpString=".zip") returned 4
	[0186.635] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.635] lstrlenW (lpString=".rar") returned 4
	[0186.635] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.635] lstrlenW (lpString=".bz2") returned 4
	[0186.635] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.635] lstrlenW (lpString=".7z") returned 3
	[0186.635] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.635] lstrlenW (lpString=".dbf") returned 4
	[0186.635] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.635] lstrlenW (lpString=".1cd") returned 4
	[0186.635] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.635] lstrlenW (lpString=".jpg") returned 4
	[0186.635] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.635] lstrlenW (lpString=".doc") returned 4
	[0186.635] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.635] lstrlenW (lpString=".docx") returned 5
	[0186.635] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.635] lstrlenW (lpString=".pdf") returned 4
	[0186.635] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.635] lstrlenW (lpString=".xls") returned 4
	[0186.635] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.635] lstrlenW (lpString=".xlsx") returned 5
	[0186.636] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.636] lstrlenW (lpString=".ppt") returned 4
	[0186.636] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.636] lstrlenW (lpString=".zip") returned 4
	[0186.636] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.636] lstrlenW (lpString=".rar") returned 4
	[0186.636] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.636] lstrlenW (lpString=".bz2") returned 4
	[0186.636] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.636] lstrlenW (lpString=".7z") returned 3
	[0186.636] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.636] lstrlenW (lpString=".dbf") returned 4
	[0186.636] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.636] lstrlenW (lpString=".1cd") returned 4
	[0186.636] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0186.636] lstrlenW (lpString=".jpg") returned 4
	[0186.636] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.636] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.637] lstrlenW (lpString="MondoVL_KMS_Client-ul-oob.xrm-ms") returned 32
	[0186.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.701] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11609) returned 1
	[0186.702] CloseHandle (hObject=0x504) returned 1
	[0186.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 0x220
	[0186.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.703] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.703] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0186.704] GetLastError () returned 0x0
	[0186.704] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d59, lpOverlapped=0x0) returned 1
	[0186.706] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0186.707] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.707] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x114, lpOverlapped=0x0) returned 1
	[0186.707] SetEndOfFile (hFile=0x290) returned 1
	[0186.707] CloseHandle (hObject=0x290) returned 1
	[0186.707] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.707] SetEndOfFile (hFile=0x504) returned 1
	[0186.710] CloseHandle (hObject=0x504) returned 1
	[0186.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 1
	[0186.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.711] lstrlenW (lpString=".doc") returned 4
	[0186.712] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.712] lstrlenW (lpString=".docx") returned 5
	[0186.712] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.712] lstrlenW (lpString=".pdf") returned 4
	[0186.712] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.712] lstrlenW (lpString=".xls") returned 4
	[0186.712] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.712] lstrlenW (lpString=".xlsx") returned 5
	[0186.712] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.712] lstrlenW (lpString=".ppt") returned 4
	[0186.712] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.712] lstrlenW (lpString=".zip") returned 4
	[0186.712] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.712] lstrlenW (lpString=".rar") returned 4
	[0186.712] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.712] lstrlenW (lpString=".bz2") returned 4
	[0186.712] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.712] lstrlenW (lpString=".7z") returned 3
	[0186.712] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.712] lstrlenW (lpString=".dbf") returned 4
	[0186.712] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.712] lstrlenW (lpString=".1cd") returned 4
	[0186.712] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.712] lstrlenW (lpString=".jpg") returned 4
	[0186.712] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.712] lstrlenW (lpString=".doc") returned 4
	[0186.713] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.713] lstrlenW (lpString=".docx") returned 5
	[0186.713] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.713] lstrlenW (lpString=".pdf") returned 4
	[0186.713] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.713] lstrlenW (lpString=".xls") returned 4
	[0186.713] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.713] lstrlenW (lpString=".xlsx") returned 5
	[0186.713] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.713] lstrlenW (lpString=".ppt") returned 4
	[0186.713] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.713] lstrlenW (lpString=".zip") returned 4
	[0186.713] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.713] lstrlenW (lpString=".rar") returned 4
	[0186.713] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.713] lstrlenW (lpString=".bz2") returned 4
	[0186.713] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.713] lstrlenW (lpString=".7z") returned 3
	[0186.713] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.713] lstrlenW (lpString=".dbf") returned 4
	[0186.713] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.713] lstrlenW (lpString=".1cd") returned 4
	[0186.713] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0186.713] lstrlenW (lpString=".jpg") returned 4
	[0186.713] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.714] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.714] lstrlenW (lpString="MondoVL_KMS_Client-ul.xrm-ms") returned 28
	[0186.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.714] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=9601) returned 1
	[0186.714] CloseHandle (hObject=0x504) returned 1
	[0186.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 0x220
	[0186.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.715] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.715] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0186.716] GetLastError () returned 0x0
	[0186.716] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2581, lpOverlapped=0x0) returned 1
	[0186.717] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2590, lpOverlapped=0x0) returned 1
	[0186.718] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.718] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0186.718] SetEndOfFile (hFile=0x290) returned 1
	[0186.719] CloseHandle (hObject=0x290) returned 1
	[0186.719] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.719] SetEndOfFile (hFile=0x504) returned 1
	[0186.721] CloseHandle (hObject=0x504) returned 1
	[0186.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 1
	[0186.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.722] lstrlenW (lpString=".doc") returned 4
	[0186.722] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.722] lstrlenW (lpString=".docx") returned 5
	[0186.722] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.722] lstrlenW (lpString=".pdf") returned 4
	[0186.722] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.722] lstrlenW (lpString=".xls") returned 4
	[0186.722] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.722] lstrlenW (lpString=".xlsx") returned 5
	[0186.723] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.723] lstrlenW (lpString=".ppt") returned 4
	[0186.723] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.723] lstrlenW (lpString=".zip") returned 4
	[0186.723] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.723] lstrlenW (lpString=".rar") returned 4
	[0186.723] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.723] lstrlenW (lpString=".bz2") returned 4
	[0186.723] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.723] lstrlenW (lpString=".7z") returned 3
	[0186.723] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.723] lstrlenW (lpString=".dbf") returned 4
	[0186.723] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.723] lstrlenW (lpString=".1cd") returned 4
	[0186.723] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.723] lstrlenW (lpString=".jpg") returned 4
	[0186.723] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.723] lstrlenW (lpString=".doc") returned 4
	[0186.723] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.723] lstrlenW (lpString=".docx") returned 5
	[0186.723] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.723] lstrlenW (lpString=".pdf") returned 4
	[0186.723] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.723] lstrlenW (lpString=".xls") returned 4
	[0186.723] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.724] lstrlenW (lpString=".xlsx") returned 5
	[0186.724] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.724] lstrlenW (lpString=".ppt") returned 4
	[0186.724] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.724] lstrlenW (lpString=".zip") returned 4
	[0186.724] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.724] lstrlenW (lpString=".rar") returned 4
	[0186.724] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.724] lstrlenW (lpString=".bz2") returned 4
	[0186.724] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.724] lstrlenW (lpString=".7z") returned 3
	[0186.724] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.724] lstrlenW (lpString=".dbf") returned 4
	[0186.724] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.724] lstrlenW (lpString=".1cd") returned 4
	[0186.724] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0186.724] lstrlenW (lpString=".jpg") returned 4
	[0186.724] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.724] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.724] lstrlenW (lpString="MondoVL_MAK-pl.xrm-ms") returned 21
	[0186.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.725] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=10619) returned 1
	[0186.725] CloseHandle (hObject=0x504) returned 1
	[0186.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 0x220
	[0186.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.726] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.726] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290
	[0186.726] GetLastError () returned 0x0
	[0186.726] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x297b, lpOverlapped=0x0) returned 1
	[0186.728] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2980, lpOverlapped=0x0) returned 1
	[0186.729] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.729] WriteFile (in: hFile=0x290, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0xfe, lpOverlapped=0x0) returned 1
	[0186.729] SetEndOfFile (hFile=0x290) returned 1
	[0186.729] CloseHandle (hObject=0x290) returned 1
	[0186.729] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.729] SetEndOfFile (hFile=0x504) returned 1
	[0186.732] CloseHandle (hObject=0x504) returned 1
	[0186.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 1
	[0186.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.733] lstrlenW (lpString=".doc") returned 4
	[0186.733] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.733] lstrlenW (lpString=".docx") returned 5
	[0186.733] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.733] lstrlenW (lpString=".pdf") returned 4
	[0186.733] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.733] lstrlenW (lpString=".xls") returned 4
	[0186.733] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.733] lstrlenW (lpString=".xlsx") returned 5
	[0186.733] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.733] lstrlenW (lpString=".ppt") returned 4
	[0186.733] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.734] lstrlenW (lpString=".zip") returned 4
	[0186.734] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.734] lstrlenW (lpString=".rar") returned 4
	[0186.734] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.734] lstrlenW (lpString=".bz2") returned 4
	[0186.734] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.734] lstrlenW (lpString=".7z") returned 3
	[0186.734] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.734] lstrlenW (lpString=".dbf") returned 4
	[0186.734] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.734] lstrlenW (lpString=".1cd") returned 4
	[0186.734] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.734] lstrlenW (lpString=".jpg") returned 4
	[0186.734] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.734] lstrlenW (lpString=".doc") returned 4
	[0186.734] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.734] lstrlenW (lpString=".docx") returned 5
	[0186.734] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.734] lstrlenW (lpString=".pdf") returned 4
	[0186.734] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.734] lstrlenW (lpString=".xls") returned 4
	[0186.734] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.734] lstrlenW (lpString=".xlsx") returned 5
	[0186.734] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.734] lstrlenW (lpString=".ppt") returned 4
	[0186.734] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.735] lstrlenW (lpString=".zip") returned 4
	[0186.735] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.735] lstrlenW (lpString=".rar") returned 4
	[0186.735] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.735] lstrlenW (lpString=".bz2") returned 4
	[0186.735] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.735] lstrlenW (lpString=".7z") returned 3
	[0186.735] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.735] lstrlenW (lpString=".dbf") returned 4
	[0186.735] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.735] lstrlenW (lpString=".1cd") returned 4
	[0186.735] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0186.735] lstrlenW (lpString=".jpg") returned 4
	[0186.735] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.735] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.735] lstrlenW (lpString="MondoVL_MAK-ppd.xrm-ms") returned 22
	[0186.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.736] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=12414) returned 1
	[0186.736] CloseHandle (hObject=0x504) returned 1
	[0186.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 0x220
	[0186.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0186.736] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.736] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0186.965] GetLastError () returned 0x0
	[0186.965] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x307e, lpOverlapped=0x0) returned 1
	[0186.967] WriteFile (in: hFile=0x328, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x3080, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x3080, lpOverlapped=0x0) returned 1
	[0186.968] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.968] WriteFile (in: hFile=0x328, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x100, lpOverlapped=0x0) returned 1
	[0186.969] SetEndOfFile (hFile=0x328) returned 1
	[0187.021] CloseHandle (hObject=0x328) returned 1
	[0187.054] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.055] SetEndOfFile (hFile=0x504) returned 1
	[0187.057] CloseHandle (hObject=0x504) returned 1
	[0187.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 1
	[0187.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.058] lstrlenW (lpString=".doc") returned 4
	[0187.058] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.058] lstrlenW (lpString=".docx") returned 5
	[0187.058] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.058] lstrlenW (lpString=".pdf") returned 4
	[0187.058] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.058] lstrlenW (lpString=".xls") returned 4
	[0187.059] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.059] lstrlenW (lpString=".xlsx") returned 5
	[0187.059] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.059] lstrlenW (lpString=".ppt") returned 4
	[0187.059] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.059] lstrlenW (lpString=".zip") returned 4
	[0187.059] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.059] lstrlenW (lpString=".rar") returned 4
	[0187.059] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.059] lstrlenW (lpString=".bz2") returned 4
	[0187.059] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.059] lstrlenW (lpString=".7z") returned 3
	[0187.059] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.059] lstrlenW (lpString=".dbf") returned 4
	[0187.059] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.059] lstrlenW (lpString=".1cd") returned 4
	[0187.059] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.059] lstrlenW (lpString=".jpg") returned 4
	[0187.059] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.059] lstrlenW (lpString=".doc") returned 4
	[0187.059] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.059] lstrlenW (lpString=".docx") returned 5
	[0187.059] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.059] lstrlenW (lpString=".pdf") returned 4
	[0187.059] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.060] lstrlenW (lpString=".xls") returned 4
	[0187.060] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.060] lstrlenW (lpString=".xlsx") returned 5
	[0187.060] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.060] lstrlenW (lpString=".ppt") returned 4
	[0187.060] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.060] lstrlenW (lpString=".zip") returned 4
	[0187.060] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.060] lstrlenW (lpString=".rar") returned 4
	[0187.060] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.060] lstrlenW (lpString=".bz2") returned 4
	[0187.060] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.060] lstrlenW (lpString=".7z") returned 3
	[0187.060] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.060] lstrlenW (lpString=".dbf") returned 4
	[0187.060] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.060] lstrlenW (lpString=".1cd") returned 4
	[0187.060] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0187.060] lstrlenW (lpString=".jpg") returned 4
	[0187.060] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.060] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.060] lstrlenW (lpString="O365BusinessR_SubTrial-pl.xrm-ms") returned 32
	[0187.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.061] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11179) returned 1
	[0187.061] CloseHandle (hObject=0x504) returned 1
	[0187.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 0x220
	[0187.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.062] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.062] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0187.063] GetLastError () returned 0x0
	[0187.063] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0187.064] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0187.065] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.065] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x114, lpOverlapped=0x0) returned 1
	[0187.066] SetEndOfFile (hFile=0x538) returned 1
	[0187.066] CloseHandle (hObject=0x538) returned 1
	[0187.066] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.066] SetEndOfFile (hFile=0x504) returned 1
	[0187.068] CloseHandle (hObject=0x504) returned 1
	[0187.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 1
	[0187.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.069] lstrlenW (lpString=".doc") returned 4
	[0187.069] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.070] lstrlenW (lpString=".docx") returned 5
	[0187.070] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.070] lstrlenW (lpString=".pdf") returned 4
	[0187.070] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.070] lstrlenW (lpString=".xls") returned 4
	[0187.070] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.070] lstrlenW (lpString=".xlsx") returned 5
	[0187.070] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.070] lstrlenW (lpString=".ppt") returned 4
	[0187.070] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.070] lstrlenW (lpString=".zip") returned 4
	[0187.070] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.070] lstrlenW (lpString=".rar") returned 4
	[0187.070] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.070] lstrlenW (lpString=".bz2") returned 4
	[0187.070] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.070] lstrlenW (lpString=".7z") returned 3
	[0187.070] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.070] lstrlenW (lpString=".dbf") returned 4
	[0187.070] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.070] lstrlenW (lpString=".1cd") returned 4
	[0187.070] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.070] lstrlenW (lpString=".jpg") returned 4
	[0187.070] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.070] lstrlenW (lpString=".doc") returned 4
	[0187.071] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.071] lstrlenW (lpString=".docx") returned 5
	[0187.071] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.071] lstrlenW (lpString=".pdf") returned 4
	[0187.071] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.071] lstrlenW (lpString=".xls") returned 4
	[0187.071] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.071] lstrlenW (lpString=".xlsx") returned 5
	[0187.071] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.071] lstrlenW (lpString=".ppt") returned 4
	[0187.071] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.071] lstrlenW (lpString=".zip") returned 4
	[0187.071] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.071] lstrlenW (lpString=".rar") returned 4
	[0187.071] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.071] lstrlenW (lpString=".bz2") returned 4
	[0187.071] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.071] lstrlenW (lpString=".7z") returned 3
	[0187.071] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.071] lstrlenW (lpString=".dbf") returned 4
	[0187.071] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.071] lstrlenW (lpString=".1cd") returned 4
	[0187.071] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0187.071] lstrlenW (lpString=".jpg") returned 4
	[0187.071] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.072] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.072] lstrlenW (lpString="O365BusinessR_SubTrial-ppd.xrm-ms") returned 33
	[0187.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.072] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=22466) returned 1
	[0187.072] CloseHandle (hObject=0x504) returned 1
	[0187.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 0x220
	[0187.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.073] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.073] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0187.074] GetLastError () returned 0x0
	[0187.074] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x57c2, lpOverlapped=0x0) returned 1
	[0187.076] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x57d0, lpOverlapped=0x0) returned 1
	[0187.077] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.077] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x116, lpOverlapped=0x0) returned 1
	[0187.077] SetEndOfFile (hFile=0x538) returned 1
	[0187.077] CloseHandle (hObject=0x538) returned 1
	[0187.077] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.077] SetEndOfFile (hFile=0x504) returned 1
	[0187.081] CloseHandle (hObject=0x504) returned 1
	[0187.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 1
	[0187.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.082] lstrlenW (lpString=".doc") returned 4
	[0187.082] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.082] lstrlenW (lpString=".docx") returned 5
	[0187.082] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.082] lstrlenW (lpString=".pdf") returned 4
	[0187.082] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.082] lstrlenW (lpString=".xls") returned 4
	[0187.082] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.082] lstrlenW (lpString=".xlsx") returned 5
	[0187.082] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.082] lstrlenW (lpString=".ppt") returned 4
	[0187.082] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.082] lstrlenW (lpString=".zip") returned 4
	[0187.082] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.082] lstrlenW (lpString=".rar") returned 4
	[0187.082] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.082] lstrlenW (lpString=".bz2") returned 4
	[0187.082] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.082] lstrlenW (lpString=".7z") returned 3
	[0187.082] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.082] lstrlenW (lpString=".dbf") returned 4
	[0187.082] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.083] lstrlenW (lpString=".1cd") returned 4
	[0187.083] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.083] lstrlenW (lpString=".jpg") returned 4
	[0187.083] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.083] lstrlenW (lpString=".doc") returned 4
	[0187.083] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.083] lstrlenW (lpString=".docx") returned 5
	[0187.083] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.083] lstrlenW (lpString=".pdf") returned 4
	[0187.083] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.083] lstrlenW (lpString=".xls") returned 4
	[0187.083] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.083] lstrlenW (lpString=".xlsx") returned 5
	[0187.083] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.083] lstrlenW (lpString=".ppt") returned 4
	[0187.083] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.083] lstrlenW (lpString=".zip") returned 4
	[0187.083] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.083] lstrlenW (lpString=".rar") returned 4
	[0187.083] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.083] lstrlenW (lpString=".bz2") returned 4
	[0187.083] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.083] lstrlenW (lpString=".7z") returned 3
	[0187.083] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.083] lstrlenW (lpString=".dbf") returned 4
	[0187.083] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.084] lstrlenW (lpString=".1cd") returned 4
	[0187.084] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0187.084] lstrlenW (lpString=".jpg") returned 4
	[0187.084] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.084] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.084] lstrlenW (lpString="O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 36
	[0187.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.085] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11631) returned 1
	[0187.085] CloseHandle (hObject=0x504) returned 1
	[0187.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 0x220
	[0187.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.085] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.085] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0187.086] GetLastError () returned 0x0
	[0187.086] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d6f, lpOverlapped=0x0) returned 1
	[0187.318] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0187.319] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.320] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0187.320] SetEndOfFile (hFile=0x538) returned 1
	[0187.320] CloseHandle (hObject=0x538) returned 1
	[0187.320] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.320] SetEndOfFile (hFile=0x504) returned 1
	[0187.322] CloseHandle (hObject=0x504) returned 1
	[0187.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 1
	[0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.324] lstrlenW (lpString=".doc") returned 4
	[0187.324] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.324] lstrlenW (lpString=".docx") returned 5
	[0187.324] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.324] lstrlenW (lpString=".pdf") returned 4
	[0187.324] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.324] lstrlenW (lpString=".xls") returned 4
	[0187.324] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.324] lstrlenW (lpString=".xlsx") returned 5
	[0187.324] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.324] lstrlenW (lpString=".ppt") returned 4
	[0187.324] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.324] lstrlenW (lpString=".zip") returned 4
	[0187.324] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.324] lstrlenW (lpString=".rar") returned 4
	[0187.324] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.324] lstrlenW (lpString=".bz2") returned 4
	[0187.324] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.324] lstrlenW (lpString=".7z") returned 3
	[0187.324] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.324] lstrlenW (lpString=".dbf") returned 4
	[0187.324] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.324] lstrlenW (lpString=".1cd") returned 4
	[0187.324] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.325] lstrlenW (lpString=".jpg") returned 4
	[0187.325] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.325] lstrlenW (lpString=".doc") returned 4
	[0187.325] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.325] lstrlenW (lpString=".docx") returned 5
	[0187.325] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.325] lstrlenW (lpString=".pdf") returned 4
	[0187.325] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.325] lstrlenW (lpString=".xls") returned 4
	[0187.325] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.325] lstrlenW (lpString=".xlsx") returned 5
	[0187.325] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.325] lstrlenW (lpString=".ppt") returned 4
	[0187.325] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.325] lstrlenW (lpString=".zip") returned 4
	[0187.325] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.325] lstrlenW (lpString=".rar") returned 4
	[0187.325] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.325] lstrlenW (lpString=".bz2") returned 4
	[0187.325] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.325] lstrlenW (lpString=".7z") returned 3
	[0187.325] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.325] lstrlenW (lpString=".dbf") returned 4
	[0187.325] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.325] lstrlenW (lpString=".1cd") returned 4
	[0187.326] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0187.326] lstrlenW (lpString=".jpg") returned 4
	[0187.326] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.326] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.326] lstrlenW (lpString="O365HomePremR_Subscription2-ppd.xrm-ms") returned 38
	[0187.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.326] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=26541) returned 1
	[0187.326] CloseHandle (hObject=0x504) returned 1
	[0187.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 0x220
	[0187.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.327] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.327] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0187.328] GetLastError () returned 0x0
	[0187.328] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0187.330] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0187.331] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.331] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x120, lpOverlapped=0x0) returned 1
	[0187.331] SetEndOfFile (hFile=0x538) returned 1
	[0187.332] CloseHandle (hObject=0x538) returned 1
	[0187.332] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.332] SetEndOfFile (hFile=0x504) returned 1
	[0187.335] CloseHandle (hObject=0x504) returned 1
	[0187.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 1
	[0187.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.336] lstrlenW (lpString=".doc") returned 4
	[0187.336] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.336] lstrlenW (lpString=".docx") returned 5
	[0187.336] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.336] lstrlenW (lpString=".pdf") returned 4
	[0187.336] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.336] lstrlenW (lpString=".xls") returned 4
	[0187.336] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.336] lstrlenW (lpString=".xlsx") returned 5
	[0187.336] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.336] lstrlenW (lpString=".ppt") returned 4
	[0187.336] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.336] lstrlenW (lpString=".zip") returned 4
	[0187.336] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.337] lstrlenW (lpString=".rar") returned 4
	[0187.337] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.337] lstrlenW (lpString=".bz2") returned 4
	[0187.337] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.337] lstrlenW (lpString=".7z") returned 3
	[0187.337] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.337] lstrlenW (lpString=".dbf") returned 4
	[0187.337] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.337] lstrlenW (lpString=".1cd") returned 4
	[0187.337] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.337] lstrlenW (lpString=".jpg") returned 4
	[0187.337] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.337] lstrlenW (lpString=".doc") returned 4
	[0187.337] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.337] lstrlenW (lpString=".docx") returned 5
	[0187.337] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.337] lstrlenW (lpString=".pdf") returned 4
	[0187.337] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.337] lstrlenW (lpString=".xls") returned 4
	[0187.337] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.337] lstrlenW (lpString=".xlsx") returned 5
	[0187.337] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.337] lstrlenW (lpString=".ppt") returned 4
	[0187.337] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.338] lstrlenW (lpString=".zip") returned 4
	[0187.338] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.338] lstrlenW (lpString=".rar") returned 4
	[0187.338] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.338] lstrlenW (lpString=".bz2") returned 4
	[0187.338] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.338] lstrlenW (lpString=".7z") returned 3
	[0187.338] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.338] lstrlenW (lpString=".dbf") returned 4
	[0187.338] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.338] lstrlenW (lpString=".1cd") returned 4
	[0187.338] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0187.338] lstrlenW (lpString=".jpg") returned 4
	[0187.338] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.338] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.338] lstrlenW (lpString="O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 41
	[0187.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.339] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11651) returned 1
	[0187.339] CloseHandle (hObject=0x504) returned 1
	[0187.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 0x220
	[0187.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.339] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.340] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0187.340] GetLastError () returned 0x0
	[0187.340] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0187.342] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0187.343] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.343] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x126, lpOverlapped=0x0) returned 1
	[0187.343] SetEndOfFile (hFile=0x538) returned 1
	[0187.343] CloseHandle (hObject=0x538) returned 1
	[0187.343] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.343] SetEndOfFile (hFile=0x504) returned 1
	[0187.346] CloseHandle (hObject=0x504) returned 1
	[0187.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 1
	[0187.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.348] lstrlenW (lpString=".doc") returned 4
	[0187.348] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.348] lstrlenW (lpString=".docx") returned 5
	[0187.348] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.348] lstrlenW (lpString=".pdf") returned 4
	[0187.348] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.348] lstrlenW (lpString=".xls") returned 4
	[0187.348] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.348] lstrlenW (lpString=".xlsx") returned 5
	[0187.348] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.348] lstrlenW (lpString=".ppt") returned 4
	[0187.348] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.348] lstrlenW (lpString=".zip") returned 4
	[0187.348] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.348] lstrlenW (lpString=".rar") returned 4
	[0187.348] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.348] lstrlenW (lpString=".bz2") returned 4
	[0187.348] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.348] lstrlenW (lpString=".7z") returned 3
	[0187.348] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.348] lstrlenW (lpString=".dbf") returned 4
	[0187.348] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.348] lstrlenW (lpString=".1cd") returned 4
	[0187.348] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.349] lstrlenW (lpString=".jpg") returned 4
	[0187.349] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.349] lstrlenW (lpString=".doc") returned 4
	[0187.349] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.349] lstrlenW (lpString=".docx") returned 5
	[0187.349] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.349] lstrlenW (lpString=".pdf") returned 4
	[0187.349] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.349] lstrlenW (lpString=".xls") returned 4
	[0187.349] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.349] lstrlenW (lpString=".xlsx") returned 5
	[0187.349] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.349] lstrlenW (lpString=".ppt") returned 4
	[0187.349] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.349] lstrlenW (lpString=".zip") returned 4
	[0187.349] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.349] lstrlenW (lpString=".rar") returned 4
	[0187.349] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.349] lstrlenW (lpString=".bz2") returned 4
	[0187.349] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.349] lstrlenW (lpString=".7z") returned 3
	[0187.349] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.349] lstrlenW (lpString=".dbf") returned 4
	[0187.349] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.350] lstrlenW (lpString=".1cd") returned 4
	[0187.350] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0187.350] lstrlenW (lpString=".jpg") returned 4
	[0187.350] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.350] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.350] lstrlenW (lpString="O365HomePremR_Subscription3-pl.xrm-ms") returned 37
	[0187.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.350] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11199) returned 1
	[0187.351] CloseHandle (hObject=0x504) returned 1
	[0187.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 0x220
	[0187.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.351] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.351] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0187.352] GetLastError () returned 0x0
	[0187.352] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0187.683] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0187.684] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.684] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0187.684] SetEndOfFile (hFile=0x538) returned 1
	[0187.684] CloseHandle (hObject=0x538) returned 1
	[0187.684] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.684] SetEndOfFile (hFile=0x504) returned 1
	[0187.687] CloseHandle (hObject=0x504) returned 1
	[0187.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 1
	[0187.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.689] lstrlenW (lpString=".doc") returned 4
	[0187.689] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.689] lstrlenW (lpString=".docx") returned 5
	[0187.689] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.689] lstrlenW (lpString=".pdf") returned 4
	[0187.689] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.689] lstrlenW (lpString=".xls") returned 4
	[0187.689] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.689] lstrlenW (lpString=".xlsx") returned 5
	[0187.689] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.689] lstrlenW (lpString=".ppt") returned 4
	[0187.689] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.689] lstrlenW (lpString=".zip") returned 4
	[0187.689] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.689] lstrlenW (lpString=".rar") returned 4
	[0187.689] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.689] lstrlenW (lpString=".bz2") returned 4
	[0187.689] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.689] lstrlenW (lpString=".7z") returned 3
	[0187.689] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.689] lstrlenW (lpString=".dbf") returned 4
	[0187.689] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.689] lstrlenW (lpString=".1cd") returned 4
	[0187.690] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.690] lstrlenW (lpString=".jpg") returned 4
	[0187.690] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.690] lstrlenW (lpString=".doc") returned 4
	[0187.690] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.690] lstrlenW (lpString=".docx") returned 5
	[0187.690] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.690] lstrlenW (lpString=".pdf") returned 4
	[0187.690] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.690] lstrlenW (lpString=".xls") returned 4
	[0187.690] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.690] lstrlenW (lpString=".xlsx") returned 5
	[0187.690] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.690] lstrlenW (lpString=".ppt") returned 4
	[0187.690] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.690] lstrlenW (lpString=".zip") returned 4
	[0187.690] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.690] lstrlenW (lpString=".rar") returned 4
	[0187.690] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.690] lstrlenW (lpString=".bz2") returned 4
	[0187.690] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.690] lstrlenW (lpString=".7z") returned 3
	[0187.690] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.690] lstrlenW (lpString=".dbf") returned 4
	[0187.690] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.691] lstrlenW (lpString=".1cd") returned 4
	[0187.691] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0187.691] lstrlenW (lpString=".jpg") returned 4
	[0187.691] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.691] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.691] lstrlenW (lpString="O365HomePremR_SubTest1-pl.xrm-ms") returned 32
	[0187.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.692] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11179) returned 1
	[0187.692] CloseHandle (hObject=0x504) returned 1
	[0187.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 0x220
	[0187.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.692] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.692] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0187.694] GetLastError () returned 0x0
	[0187.694] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0187.696] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0187.697] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.697] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x114, lpOverlapped=0x0) returned 1
	[0187.697] SetEndOfFile (hFile=0x538) returned 1
	[0187.697] CloseHandle (hObject=0x538) returned 1
	[0187.697] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.697] SetEndOfFile (hFile=0x504) returned 1
	[0187.700] CloseHandle (hObject=0x504) returned 1
	[0187.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 1
	[0187.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.702] lstrlenW (lpString=".doc") returned 4
	[0187.702] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.702] lstrlenW (lpString=".docx") returned 5
	[0187.702] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.702] lstrlenW (lpString=".pdf") returned 4
	[0187.702] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.702] lstrlenW (lpString=".xls") returned 4
	[0187.702] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.702] lstrlenW (lpString=".xlsx") returned 5
	[0187.702] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.702] lstrlenW (lpString=".ppt") returned 4
	[0187.702] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.702] lstrlenW (lpString=".zip") returned 4
	[0187.702] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.702] lstrlenW (lpString=".rar") returned 4
	[0187.702] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.702] lstrlenW (lpString=".bz2") returned 4
	[0187.702] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.702] lstrlenW (lpString=".7z") returned 3
	[0187.702] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.702] lstrlenW (lpString=".dbf") returned 4
	[0187.702] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.702] lstrlenW (lpString=".1cd") returned 4
	[0187.702] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.703] lstrlenW (lpString=".jpg") returned 4
	[0187.703] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.703] lstrlenW (lpString=".doc") returned 4
	[0187.703] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.703] lstrlenW (lpString=".docx") returned 5
	[0187.703] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.703] lstrlenW (lpString=".pdf") returned 4
	[0187.703] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.703] lstrlenW (lpString=".xls") returned 4
	[0187.703] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.703] lstrlenW (lpString=".xlsx") returned 5
	[0187.703] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.703] lstrlenW (lpString=".ppt") returned 4
	[0187.703] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.703] lstrlenW (lpString=".zip") returned 4
	[0187.703] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.703] lstrlenW (lpString=".rar") returned 4
	[0187.703] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.703] lstrlenW (lpString=".bz2") returned 4
	[0187.703] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.704] lstrlenW (lpString=".7z") returned 3
	[0187.704] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.704] lstrlenW (lpString=".dbf") returned 4
	[0187.704] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.704] lstrlenW (lpString=".1cd") returned 4
	[0187.704] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0187.704] lstrlenW (lpString=".jpg") returned 4
	[0187.704] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.704] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.704] lstrlenW (lpString="O365HomePremR_SubTest1-ppd.xrm-ms") returned 33
	[0187.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.705] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=23134) returned 1
	[0187.705] CloseHandle (hObject=0x504) returned 1
	[0187.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 0x220
	[0187.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.706] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.706] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0187.707] GetLastError () returned 0x0
	[0187.707] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0187.709] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0187.710] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.710] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x116, lpOverlapped=0x0) returned 1
	[0187.710] SetEndOfFile (hFile=0x538) returned 1
	[0187.710] CloseHandle (hObject=0x538) returned 1
	[0187.710] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.710] SetEndOfFile (hFile=0x504) returned 1
	[0187.713] CloseHandle (hObject=0x504) returned 1
	[0187.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 1
	[0187.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.715] lstrlenW (lpString=".doc") returned 4
	[0187.715] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.715] lstrlenW (lpString=".docx") returned 5
	[0187.715] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.715] lstrlenW (lpString=".pdf") returned 4
	[0187.715] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.715] lstrlenW (lpString=".xls") returned 4
	[0187.715] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.715] lstrlenW (lpString=".xlsx") returned 5
	[0187.715] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.715] lstrlenW (lpString=".ppt") returned 4
	[0187.715] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.715] lstrlenW (lpString=".zip") returned 4
	[0187.715] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.715] lstrlenW (lpString=".rar") returned 4
	[0187.715] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.715] lstrlenW (lpString=".bz2") returned 4
	[0187.715] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.715] lstrlenW (lpString=".7z") returned 3
	[0187.715] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.715] lstrlenW (lpString=".dbf") returned 4
	[0187.715] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.715] lstrlenW (lpString=".1cd") returned 4
	[0187.715] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.715] lstrlenW (lpString=".jpg") returned 4
	[0187.715] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.716] lstrlenW (lpString=".doc") returned 4
	[0187.716] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.716] lstrlenW (lpString=".docx") returned 5
	[0187.716] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.716] lstrlenW (lpString=".pdf") returned 4
	[0187.716] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.716] lstrlenW (lpString=".xls") returned 4
	[0187.716] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.716] lstrlenW (lpString=".xlsx") returned 5
	[0187.716] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.716] lstrlenW (lpString=".ppt") returned 4
	[0187.716] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.716] lstrlenW (lpString=".zip") returned 4
	[0187.716] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.716] lstrlenW (lpString=".rar") returned 4
	[0187.716] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.716] lstrlenW (lpString=".bz2") returned 4
	[0187.716] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.716] lstrlenW (lpString=".7z") returned 3
	[0187.716] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.716] lstrlenW (lpString=".dbf") returned 4
	[0187.716] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.716] lstrlenW (lpString=".1cd") returned 4
	[0187.716] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0187.716] lstrlenW (lpString=".jpg") returned 4
	[0187.717] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.717] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.717] lstrlenW (lpString="O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 36
	[0187.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.717] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11630) returned 1
	[0187.717] CloseHandle (hObject=0x504) returned 1
	[0187.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 0x220
	[0187.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0187.718] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.718] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0187.719] GetLastError () returned 0x0
	[0187.719] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0188.047] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0188.048] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.049] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0188.049] SetEndOfFile (hFile=0x538) returned 1
	[0188.049] CloseHandle (hObject=0x538) returned 1
	[0188.049] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.049] SetEndOfFile (hFile=0x504) returned 1
	[0188.052] CloseHandle (hObject=0x504) returned 1
	[0188.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 1
	[0188.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.053] lstrlenW (lpString=".doc") returned 4
	[0188.053] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.054] lstrlenW (lpString=".docx") returned 5
	[0188.054] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.054] lstrlenW (lpString=".pdf") returned 4
	[0188.054] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.054] lstrlenW (lpString=".xls") returned 4
	[0188.054] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.054] lstrlenW (lpString=".xlsx") returned 5
	[0188.054] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.054] lstrlenW (lpString=".ppt") returned 4
	[0188.054] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.054] lstrlenW (lpString=".zip") returned 4
	[0188.054] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.054] lstrlenW (lpString=".rar") returned 4
	[0188.054] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.054] lstrlenW (lpString=".bz2") returned 4
	[0188.054] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.054] lstrlenW (lpString=".7z") returned 3
	[0188.054] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.054] lstrlenW (lpString=".dbf") returned 4
	[0188.054] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.054] lstrlenW (lpString=".1cd") returned 4
	[0188.054] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.054] lstrlenW (lpString=".jpg") returned 4
	[0188.054] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.054] lstrlenW (lpString=".doc") returned 4
	[0188.055] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.055] lstrlenW (lpString=".docx") returned 5
	[0188.055] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.055] lstrlenW (lpString=".pdf") returned 4
	[0188.055] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.055] lstrlenW (lpString=".xls") returned 4
	[0188.055] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.055] lstrlenW (lpString=".xlsx") returned 5
	[0188.055] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.055] lstrlenW (lpString=".ppt") returned 4
	[0188.055] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.055] lstrlenW (lpString=".zip") returned 4
	[0188.055] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.055] lstrlenW (lpString=".rar") returned 4
	[0188.055] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.055] lstrlenW (lpString=".bz2") returned 4
	[0188.055] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.055] lstrlenW (lpString=".7z") returned 3
	[0188.055] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.055] lstrlenW (lpString=".dbf") returned 4
	[0188.055] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.055] lstrlenW (lpString=".1cd") returned 4
	[0188.055] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0188.055] lstrlenW (lpString=".jpg") returned 4
	[0188.055] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.056] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0188.056] lstrlenW (lpString="O365HomePremR_SubTest5-pl.xrm-ms") returned 32
	[0188.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0188.057] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=11179) returned 1
	[0188.057] CloseHandle (hObject=0x504) returned 1
	[0188.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 0x220
	[0188.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0188.057] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.057] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.058] GetLastError () returned 0x0
	[0188.058] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0188.060] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0188.061] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.061] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x114, lpOverlapped=0x0) returned 1
	[0188.061] SetEndOfFile (hFile=0x538) returned 1
	[0188.061] CloseHandle (hObject=0x538) returned 1
	[0188.062] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.062] SetEndOfFile (hFile=0x504) returned 1
	[0188.066] CloseHandle (hObject=0x504) returned 1
	[0188.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 1
	[0188.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.067] lstrlenW (lpString=".doc") returned 4
	[0188.067] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.067] lstrlenW (lpString=".docx") returned 5
	[0188.067] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.067] lstrlenW (lpString=".pdf") returned 4
	[0188.067] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.067] lstrlenW (lpString=".xls") returned 4
	[0188.067] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.067] lstrlenW (lpString=".xlsx") returned 5
	[0188.067] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.067] lstrlenW (lpString=".ppt") returned 4
	[0188.067] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.068] lstrlenW (lpString=".zip") returned 4
	[0188.068] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.068] lstrlenW (lpString=".rar") returned 4
	[0188.068] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.068] lstrlenW (lpString=".bz2") returned 4
	[0188.068] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.068] lstrlenW (lpString=".7z") returned 3
	[0188.068] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.068] lstrlenW (lpString=".dbf") returned 4
	[0188.068] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.068] lstrlenW (lpString=".1cd") returned 4
	[0188.068] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.068] lstrlenW (lpString=".jpg") returned 4
	[0188.068] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.068] lstrlenW (lpString=".doc") returned 4
	[0188.068] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.068] lstrlenW (lpString=".docx") returned 5
	[0188.068] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.068] lstrlenW (lpString=".pdf") returned 4
	[0188.068] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.068] lstrlenW (lpString=".xls") returned 4
	[0188.068] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.068] lstrlenW (lpString=".xlsx") returned 5
	[0188.069] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.069] lstrlenW (lpString=".ppt") returned 4
	[0188.069] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.069] lstrlenW (lpString=".zip") returned 4
	[0188.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.069] lstrlenW (lpString=".rar") returned 4
	[0188.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.069] lstrlenW (lpString=".bz2") returned 4
	[0188.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.069] lstrlenW (lpString=".7z") returned 3
	[0188.069] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.069] lstrlenW (lpString=".dbf") returned 4
	[0188.069] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.069] lstrlenW (lpString=".1cd") returned 4
	[0188.069] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0188.069] lstrlenW (lpString=".jpg") returned 4
	[0188.069] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.069] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0188.069] lstrlenW (lpString="O365HomePremR_SubTest5-ppd.xrm-ms") returned 33
	[0188.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0188.070] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x381ff14 | out: lpFileSize=0x381ff14*=23134) returned 1
	[0188.070] CloseHandle (hObject=0x504) returned 1
	[0188.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 0x220
	[0188.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504
	[0188.071] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.071] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.072] GetLastError () returned 0x0
	[0188.072] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0188.074] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0188.075] ReadFile (in: hFile=0x504, lpBuffer=0x4234020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x381fecc, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesRead=0x381fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.075] WriteFile (in: hFile=0x538, lpBuffer=0x4234020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x381fc94, lpOverlapped=0x0 | out: lpBuffer=0x4234020*, lpNumberOfBytesWritten=0x381fc94*=0x116, lpOverlapped=0x0) returned 1
	[0188.075] SetEndOfFile (hFile=0x538) returned 1
	[0188.075] CloseHandle (hObject=0x538) returned 1
	[0188.075] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x381fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.075] SetEndOfFile (hFile=0x504) 

Thread:
	id = 49
	os_tid = 0xe28

	[0153.975] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3eb2268
	[0153.975] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3ec2270
	[0153.976] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e738
	[0153.976] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x571fc0
	[0153.976] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e750
	[0153.976] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x434b020
	[0153.978] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e540
	[0153.978] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e540, Size=0x20) returned 0x4f27f8
	[0153.979] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e768
	[0153.979] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e768, Size=0x20) returned 0x4f2668
	[0153.979] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0153.979] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0153.979] Wow64DisableWow64FsRedirection (in: OldValue=0x395ff50 | out: OldValue=0x395ff50*=0x0) returned 1
	[0153.979] lstrlenW (lpString="kernel32.dll") returned 12
	[0153.979] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f27f8 | out: hHeap=0x4c0000) returned 1
	[0153.979] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0153.979] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2668 | out: hHeap=0x4c0000) returned 1
	[0153.979] Sleep (dwMilliseconds=0x64) 
	[0154.283] Sleep (dwMilliseconds=0x64) 
	[0154.437] Sleep (dwMilliseconds=0x64) 
	[0154.723] Sleep (dwMilliseconds=0x64) 
	[0155.028] Sleep (dwMilliseconds=0x64) 
	[0155.391] Sleep (dwMilliseconds=0x64) 
	[0155.638] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0155.638] lstrlenW (lpString="bootspaces.dll") returned 14
	[0155.639] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0155.640] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=95648) returned 1
	[0155.640] CloseHandle (hObject=0x330) returned 1
	[0155.640] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20
	[0155.640] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.640] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.640] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.640] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.640] lstrlenW (lpString=".doc") returned 4
	[0155.640] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.641] lstrlenW (lpString=".docx") returned 5
	[0155.641] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0155.641] lstrlenW (lpString=".pdf") returned 4
	[0155.641] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.641] lstrlenW (lpString=".xls") returned 4
	[0155.641] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.641] lstrlenW (lpString=".xlsx") returned 5
	[0155.641] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0155.641] lstrlenW (lpString=".ppt") returned 4
	[0155.641] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.641] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.641] lstrlenW (lpString=".zip") returned 4
	[0155.641] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.641] lstrlenW (lpString=".rar") returned 4
	[0155.641] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.641] lstrlenW (lpString=".bz2") returned 4
	[0155.641] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.641] lstrlenW (lpString=".7z") returned 3
	[0155.641] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.641] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.641] lstrlenW (lpString=".dbf") returned 4
	[0155.641] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.641] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.641] lstrlenW (lpString=".1cd") returned 4
	[0155.641] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.641] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.641] lstrlenW (lpString=".jpg") returned 4
	[0155.641] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.641] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.641] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.642] lstrlenW (lpString=".doc") returned 4
	[0155.642] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.642] lstrlenW (lpString=".docx") returned 5
	[0155.642] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0155.642] lstrlenW (lpString=".pdf") returned 4
	[0155.642] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.642] lstrlenW (lpString=".xls") returned 4
	[0155.642] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.642] lstrlenW (lpString=".xlsx") returned 5
	[0155.642] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0155.642] lstrlenW (lpString=".ppt") returned 4
	[0155.642] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.642] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.642] lstrlenW (lpString=".zip") returned 4
	[0155.642] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.642] lstrlenW (lpString=".rar") returned 4
	[0155.642] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.642] lstrlenW (lpString=".bz2") returned 4
	[0155.642] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.642] lstrlenW (lpString=".7z") returned 3
	[0155.642] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.642] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.642] lstrlenW (lpString=".dbf") returned 4
	[0155.642] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.642] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.642] lstrlenW (lpString=".1cd") returned 4
	[0155.642] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.642] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0155.642] lstrlenW (lpString=".jpg") returned 4
	[0155.642] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.645] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0155.645] lstrlenW (lpString="bootvhd.dll") returned 11
	[0155.645] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0155.745] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=99744) returned 1
	[0155.745] CloseHandle (hObject=0x3e4) returned 1
	[0155.745] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20
	[0155.745] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.745] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.755] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.755] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.755] lstrlenW (lpString=".doc") returned 4
	[0155.755] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.755] lstrlenW (lpString=".docx") returned 5
	[0155.755] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0155.755] lstrlenW (lpString=".pdf") returned 4
	[0155.755] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.755] lstrlenW (lpString=".xls") returned 4
	[0155.755] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.755] lstrlenW (lpString=".xlsx") returned 5
	[0155.755] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0155.755] lstrlenW (lpString=".ppt") returned 4
	[0155.755] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.755] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.755] lstrlenW (lpString=".zip") returned 4
	[0155.756] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.756] lstrlenW (lpString=".rar") returned 4
	[0155.756] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.756] lstrlenW (lpString=".bz2") returned 4
	[0155.756] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.756] lstrlenW (lpString=".7z") returned 3
	[0155.756] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.756] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.756] lstrlenW (lpString=".dbf") returned 4
	[0155.756] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.756] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.756] lstrlenW (lpString=".1cd") returned 4
	[0155.756] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.756] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.756] lstrlenW (lpString=".jpg") returned 4
	[0155.756] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.756] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.756] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.756] lstrlenW (lpString=".doc") returned 4
	[0155.756] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.756] lstrlenW (lpString=".docx") returned 5
	[0155.756] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0155.756] lstrlenW (lpString=".pdf") returned 4
	[0155.756] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.756] lstrlenW (lpString=".xls") returned 4
	[0155.756] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.756] lstrlenW (lpString=".xlsx") returned 5
	[0155.756] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0155.756] lstrlenW (lpString=".ppt") returned 4
	[0155.756] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.756] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.757] lstrlenW (lpString=".zip") returned 4
	[0155.757] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.757] lstrlenW (lpString=".rar") returned 4
	[0155.757] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.757] lstrlenW (lpString=".bz2") returned 4
	[0155.757] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.757] lstrlenW (lpString=".7z") returned 3
	[0155.757] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.757] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.757] lstrlenW (lpString=".dbf") returned 4
	[0155.757] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.757] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.757] lstrlenW (lpString=".1cd") returned 4
	[0155.757] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.757] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0155.757] lstrlenW (lpString=".jpg") returned 4
	[0155.757] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.757] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.757] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.757] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0155.763] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=80224) returned 1
	[0155.763] CloseHandle (hObject=0x3e4) returned 1
	[0155.763] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20
	[0155.763] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.763] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.763] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.763] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.763] lstrlenW (lpString=".doc") returned 4
	[0155.763] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.763] lstrlenW (lpString=".docx") returned 5
	[0155.763] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.763] lstrlenW (lpString=".pdf") returned 4
	[0155.763] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.763] lstrlenW (lpString=".xls") returned 4
	[0155.763] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.763] lstrlenW (lpString=".xlsx") returned 5
	[0155.763] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.763] lstrlenW (lpString=".ppt") returned 4
	[0155.763] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.763] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.763] lstrlenW (lpString=".zip") returned 4
	[0155.763] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.763] lstrlenW (lpString=".rar") returned 4
	[0155.763] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.764] lstrlenW (lpString=".bz2") returned 4
	[0155.764] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.764] lstrlenW (lpString=".7z") returned 3
	[0155.764] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.764] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.764] lstrlenW (lpString=".dbf") returned 4
	[0155.764] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.764] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.764] lstrlenW (lpString=".1cd") returned 4
	[0155.764] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.764] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.764] lstrlenW (lpString=".jpg") returned 4
	[0155.764] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.764] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.764] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.764] lstrlenW (lpString=".doc") returned 4
	[0155.764] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.764] lstrlenW (lpString=".docx") returned 5
	[0155.764] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.764] lstrlenW (lpString=".pdf") returned 4
	[0155.764] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.764] lstrlenW (lpString=".xls") returned 4
	[0155.764] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.764] lstrlenW (lpString=".xlsx") returned 5
	[0155.764] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.764] lstrlenW (lpString=".ppt") returned 4
	[0155.764] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.764] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.764] lstrlenW (lpString=".zip") returned 4
	[0155.764] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.764] lstrlenW (lpString=".rar") returned 4
	[0155.765] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.765] lstrlenW (lpString=".bz2") returned 4
	[0155.765] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.765] lstrlenW (lpString=".7z") returned 3
	[0155.765] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.765] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.765] lstrlenW (lpString=".dbf") returned 4
	[0155.765] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.765] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.765] lstrlenW (lpString=".1cd") returned 4
	[0155.765] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.765] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0155.765] lstrlenW (lpString=".jpg") returned 4
	[0155.765] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.765] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.765] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.765] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0155.767] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=74144) returned 1
	[0155.767] CloseHandle (hObject=0x3e4) returned 1
	[0155.767] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20
	[0155.767] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.767] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.767] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.767] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.767] lstrlenW (lpString=".doc") returned 4
	[0155.767] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.767] lstrlenW (lpString=".docx") returned 5
	[0155.767] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.767] lstrlenW (lpString=".pdf") returned 4
	[0155.767] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.767] lstrlenW (lpString=".xls") returned 4
	[0155.767] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.767] lstrlenW (lpString=".xlsx") returned 5
	[0155.768] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.768] lstrlenW (lpString=".ppt") returned 4
	[0155.768] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.768] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.768] lstrlenW (lpString=".zip") returned 4
	[0155.768] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.768] lstrlenW (lpString=".rar") returned 4
	[0155.768] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.768] lstrlenW (lpString=".bz2") returned 4
	[0155.768] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.768] lstrlenW (lpString=".7z") returned 3
	[0155.768] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.768] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.768] lstrlenW (lpString=".dbf") returned 4
	[0155.768] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.768] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.768] lstrlenW (lpString=".1cd") returned 4
	[0155.768] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.768] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.768] lstrlenW (lpString=".jpg") returned 4
	[0155.768] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.768] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.768] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.768] lstrlenW (lpString=".doc") returned 4
	[0155.768] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.768] lstrlenW (lpString=".docx") returned 5
	[0155.768] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.768] lstrlenW (lpString=".pdf") returned 4
	[0155.768] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.768] lstrlenW (lpString=".xls") returned 4
	[0155.769] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.769] lstrlenW (lpString=".xlsx") returned 5
	[0155.769] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.769] lstrlenW (lpString=".ppt") returned 4
	[0155.769] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.769] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.769] lstrlenW (lpString=".zip") returned 4
	[0155.769] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.769] lstrlenW (lpString=".rar") returned 4
	[0155.769] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.769] lstrlenW (lpString=".bz2") returned 4
	[0155.769] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.769] lstrlenW (lpString=".7z") returned 3
	[0155.769] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.769] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.769] lstrlenW (lpString=".dbf") returned 4
	[0155.769] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.769] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.769] lstrlenW (lpString=".1cd") returned 4
	[0155.769] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.769] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0155.769] lstrlenW (lpString=".jpg") returned 4
	[0155.769] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.769] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.769] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0155.769] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0155.774] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=44960) returned 1
	[0155.774] CloseHandle (hObject=0x3e4) returned 1
	[0155.774] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20
	[0155.774] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.774] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.774] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.774] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.774] lstrlenW (lpString=".doc") returned 4
	[0155.774] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.774] lstrlenW (lpString=".docx") returned 5
	[0155.774] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.774] lstrlenW (lpString=".pdf") returned 4
	[0155.774] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.774] lstrlenW (lpString=".xls") returned 4
	[0155.774] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.774] lstrlenW (lpString=".xlsx") returned 5
	[0155.774] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.774] lstrlenW (lpString=".ppt") returned 4
	[0155.774] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.774] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.774] lstrlenW (lpString=".zip") returned 4
	[0155.774] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.774] lstrlenW (lpString=".rar") returned 4
	[0155.774] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.775] lstrlenW (lpString=".bz2") returned 4
	[0155.775] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.775] lstrlenW (lpString=".7z") returned 3
	[0155.775] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.775] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.775] lstrlenW (lpString=".dbf") returned 4
	[0155.775] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.775] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.775] lstrlenW (lpString=".1cd") returned 4
	[0155.775] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.775] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.775] lstrlenW (lpString=".jpg") returned 4
	[0155.775] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.775] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.775] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.775] lstrlenW (lpString=".doc") returned 4
	[0155.775] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.775] lstrlenW (lpString=".docx") returned 5
	[0155.775] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.775] lstrlenW (lpString=".pdf") returned 4
	[0155.775] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.775] lstrlenW (lpString=".xls") returned 4
	[0155.775] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.775] lstrlenW (lpString=".xlsx") returned 5
	[0155.775] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.775] lstrlenW (lpString=".ppt") returned 4
	[0155.775] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.775] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.775] lstrlenW (lpString=".zip") returned 4
	[0155.775] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.775] lstrlenW (lpString=".rar") returned 4
	[0155.776] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.776] lstrlenW (lpString=".bz2") returned 4
	[0155.776] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.776] lstrlenW (lpString=".7z") returned 3
	[0155.776] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.776] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.776] lstrlenW (lpString=".dbf") returned 4
	[0155.776] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.776] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.776] lstrlenW (lpString=".1cd") returned 4
	[0155.776] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.776] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0155.776] lstrlenW (lpString=".jpg") returned 4
	[0155.776] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.776] Sleep (dwMilliseconds=0x64) 
	[0156.046] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0156.046] lstrlenW (lpString="msjhn_boot.ttf") returned 14
	[0156.046] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.079] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=162331) returned 1
	[0156.079] CloseHandle (hObject=0x438) returned 1
	[0156.079] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20
	[0156.079] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.079] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.079] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.079] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.079] lstrlenW (lpString=".doc") returned 4
	[0156.079] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0156.079] lstrlenW (lpString=".docx") returned 5
	[0156.079] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0156.080] lstrlenW (lpString=".pdf") returned 4
	[0156.080] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0156.080] lstrlenW (lpString=".xls") returned 4
	[0156.080] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0156.080] lstrlenW (lpString=".xlsx") returned 5
	[0156.080] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0156.080] lstrlenW (lpString=".ppt") returned 4
	[0156.080] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0156.080] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.080] lstrlenW (lpString=".zip") returned 4
	[0156.080] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0156.080] lstrlenW (lpString=".rar") returned 4
	[0156.080] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0156.080] lstrlenW (lpString=".bz2") returned 4
	[0156.080] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0156.080] lstrlenW (lpString=".7z") returned 3
	[0156.080] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0156.080] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.080] lstrlenW (lpString=".dbf") returned 4
	[0156.080] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0156.080] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.080] lstrlenW (lpString=".1cd") returned 4
	[0156.080] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0156.080] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.080] lstrlenW (lpString=".jpg") returned 4
	[0156.080] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0156.080] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.080] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.080] lstrlenW (lpString=".doc") returned 4
	[0156.080] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0156.080] lstrlenW (lpString=".docx") returned 5
	[0156.081] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0156.081] lstrlenW (lpString=".pdf") returned 4
	[0156.081] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0156.081] lstrlenW (lpString=".xls") returned 4
	[0156.081] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0156.081] lstrlenW (lpString=".xlsx") returned 5
	[0156.081] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0156.081] lstrlenW (lpString=".ppt") returned 4
	[0156.081] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0156.081] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.081] lstrlenW (lpString=".zip") returned 4
	[0156.081] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0156.081] lstrlenW (lpString=".rar") returned 4
	[0156.081] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0156.081] lstrlenW (lpString=".bz2") returned 4
	[0156.081] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0156.081] lstrlenW (lpString=".7z") returned 3
	[0156.081] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0156.081] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.081] lstrlenW (lpString=".dbf") returned 4
	[0156.081] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0156.081] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.081] lstrlenW (lpString=".1cd") returned 4
	[0156.081] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0156.081] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0156.081] lstrlenW (lpString=".jpg") returned 4
	[0156.081] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0156.082] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0156.082] lstrlenW (lpString="msyh_boot.ttf") returned 13
	[0156.082] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.083] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=156245) returned 1
	[0156.083] CloseHandle (hObject=0x438) returned 1
	[0156.083] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20
	[0156.083] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.083] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.083] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0156.083] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0156.083] lstrlenW (lpString=".doc") returned 4
	[0156.083] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0156.083] lstrlenW (lpString=".docx") returned 5
	[0156.083] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0156.083] lstrlenW (lpString=".pdf") returned 4
	[0156.083] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0156.083] lstrlenW (lpString=".xls") returned 4
	[0156.083] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0156.083] lstrlenW (lpString=".xlsx") returned 5
	[0156.083] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0156.083] lstrlenW (lpString=".ppt") returned 4
	[0156.084] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0156.084] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0156.084] lstrlenW (lpString=".zip") returned 4
	[0156.084] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0156.084] lstrlenW (lpString=".rar") returned 4
	[0156.084] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0156.084] lstrlenW (lpString=".bz2") returned 4
	[0156.084] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0156.084] lstrlenW (lpString=".7z") returned 3
	[0156.084] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0156.084] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0156.099] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0
	[0156.100] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.106] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x3e62088, Size=0x2000) returned 0x3e62088
	[0156.106] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0156.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.630] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=8809536) returned 1
	[0156.631] CloseHandle (hObject=0x494) returned 1
	[0156.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20
	[0156.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[admin@stex777.com].money")) returned 0
	[0156.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.631] lstrlenW (lpString=".doc") returned 4
	[0156.631] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.631] lstrlenW (lpString=".docx") returned 5
	[0156.631] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0156.631] lstrlenW (lpString=".pdf") returned 4
	[0156.631] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.631] lstrlenW (lpString=".xls") returned 4
	[0156.631] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.631] lstrlenW (lpString=".xlsx") returned 5
	[0156.631] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0156.631] lstrlenW (lpString=".ppt") returned 4
	[0156.631] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.632] lstrlenW (lpString=".zip") returned 4
	[0156.632] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.632] lstrlenW (lpString=".rar") returned 4
	[0156.632] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.632] lstrlenW (lpString=".bz2") returned 4
	[0156.632] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.632] lstrlenW (lpString=".7z") returned 3
	[0156.632] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.632] lstrlenW (lpString=".dbf") returned 4
	[0156.632] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.632] lstrlenW (lpString=".1cd") returned 4
	[0156.632] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.632] lstrlenW (lpString=".jpg") returned 4
	[0156.632] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.632] lstrlenW (lpString=".doc") returned 4
	[0156.632] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.632] lstrlenW (lpString=".docx") returned 5
	[0156.632] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0156.632] lstrlenW (lpString=".pdf") returned 4
	[0156.632] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.632] lstrlenW (lpString=".xls") returned 4
	[0156.632] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.632] lstrlenW (lpString=".xlsx") returned 5
	[0156.632] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0156.632] lstrlenW (lpString=".ppt") returned 4
	[0156.632] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.633] lstrlenW (lpString=".zip") returned 4
	[0156.633] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.633] lstrlenW (lpString=".rar") returned 4
	[0156.633] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.633] lstrlenW (lpString=".bz2") returned 4
	[0156.633] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.633] lstrlenW (lpString=".7z") returned 3
	[0156.633] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.633] lstrlenW (lpString=".dbf") returned 4
	[0156.633] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.633] lstrlenW (lpString=".1cd") returned 4
	[0156.633] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53
	[0156.633] lstrlenW (lpString=".jpg") returned 4
	[0156.633] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.633] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0156.633] lstrlenW (lpString="servertool.exe") returned 14
	[0156.633] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0156.634] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=16448) returned 1
	[0156.634] CloseHandle (hObject=0x494) returned 1
	[0156.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20
	[0156.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.634] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.635] lstrlenW (lpString=".doc") returned 4
	[0156.635] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0156.635] lstrlenW (lpString=".docx") returned 5
	[0156.635] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0156.635] lstrlenW (lpString=".pdf") returned 4
	[0156.635] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0156.635] lstrlenW (lpString=".xls") returned 4
	[0156.635] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0156.635] lstrlenW (lpString=".xlsx") returned 5
	[0156.635] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0156.635] lstrlenW (lpString=".ppt") returned 4
	[0156.635] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0156.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.635] lstrlenW (lpString=".zip") returned 4
	[0156.635] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0156.635] lstrlenW (lpString=".rar") returned 4
	[0156.636] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0156.636] lstrlenW (lpString=".bz2") returned 4
	[0156.636] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0156.636] lstrlenW (lpString=".7z") returned 3
	[0156.636] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0156.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.636] lstrlenW (lpString=".dbf") returned 4
	[0156.636] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0156.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.636] lstrlenW (lpString=".1cd") returned 4
	[0156.636] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0156.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.636] lstrlenW (lpString=".jpg") returned 4
	[0156.636] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0156.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.636] lstrlenW (lpString=".doc") returned 4
	[0156.636] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0156.636] lstrlenW (lpString=".docx") returned 5
	[0156.636] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0156.636] lstrlenW (lpString=".pdf") returned 4
	[0156.636] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0156.636] lstrlenW (lpString=".xls") returned 4
	[0156.636] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0156.636] lstrlenW (lpString=".xlsx") returned 5
	[0156.636] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0156.636] lstrlenW (lpString=".ppt") returned 4
	[0156.636] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0156.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.636] lstrlenW (lpString=".zip") returned 4
	[0156.636] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0156.637] lstrlenW (lpString=".rar") returned 4
	[0156.637] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0156.637] lstrlenW (lpString=".bz2") returned 4
	[0156.637] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0156.637] lstrlenW (lpString=".7z") returned 3
	[0156.637] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0156.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.637] lstrlenW (lpString=".dbf") returned 4
	[0156.637] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0156.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.637] lstrlenW (lpString=".1cd") returned 4
	[0156.637] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0156.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53
	[0156.637] lstrlenW (lpString=".jpg") returned 4
	[0156.637] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0156.637] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0156.637] lstrlenW (lpString="splashscreen.dll") returned 16
	[0156.637] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0156.637] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=204864) returned 1
	[0156.638] CloseHandle (hObject=0x494) returned 1
	[0156.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20
	[0156.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.638] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.638] lstrlenW (lpString=".doc") returned 4
	[0156.638] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.638] lstrlenW (lpString=".docx") returned 5
	[0156.638] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0156.638] lstrlenW (lpString=".pdf") returned 4
	[0156.638] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.638] lstrlenW (lpString=".xls") returned 4
	[0156.638] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.638] lstrlenW (lpString=".xlsx") returned 5
	[0156.638] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0156.638] lstrlenW (lpString=".ppt") returned 4
	[0156.638] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.638] lstrlenW (lpString=".zip") returned 4
	[0156.638] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.639] lstrlenW (lpString=".rar") returned 4
	[0156.639] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.639] lstrlenW (lpString=".bz2") returned 4
	[0156.639] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.639] lstrlenW (lpString=".7z") returned 3
	[0156.639] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.639] lstrlenW (lpString=".dbf") returned 4
	[0156.639] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.639] lstrlenW (lpString=".1cd") returned 4
	[0156.639] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.639] lstrlenW (lpString=".jpg") returned 4
	[0156.639] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.639] lstrlenW (lpString=".doc") returned 4
	[0156.639] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.639] lstrlenW (lpString=".docx") returned 5
	[0156.639] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0156.639] lstrlenW (lpString=".pdf") returned 4
	[0156.639] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.639] lstrlenW (lpString=".xls") returned 4
	[0156.639] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.639] lstrlenW (lpString=".xlsx") returned 5
	[0156.639] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0156.639] lstrlenW (lpString=".ppt") returned 4
	[0156.639] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.639] lstrlenW (lpString=".zip") returned 4
	[0156.640] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.640] lstrlenW (lpString=".rar") returned 4
	[0156.640] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.640] lstrlenW (lpString=".bz2") returned 4
	[0156.640] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.640] lstrlenW (lpString=".7z") returned 3
	[0156.640] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.640] lstrlenW (lpString=".dbf") returned 4
	[0156.640] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.640] lstrlenW (lpString=".1cd") returned 4
	[0156.640] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55
	[0156.640] lstrlenW (lpString=".jpg") returned 4
	[0156.640] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.640] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0156.640] lstrlenW (lpString="ssv.dll") returned 7
	[0156.640] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0156.641] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=571968) returned 1
	[0156.641] CloseHandle (hObject=0x494) returned 1
	[0156.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20
	[0156.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.641] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.642] lstrlenW (lpString=".doc") returned 4
	[0156.642] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.642] lstrlenW (lpString=".docx") returned 5
	[0156.642] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1
	[0156.642] lstrlenW (lpString=".pdf") returned 4
	[0156.642] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.642] lstrlenW (lpString=".xls") returned 4
	[0156.642] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.642] lstrlenW (lpString=".xlsx") returned 5
	[0156.642] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1
	[0156.642] lstrlenW (lpString=".ppt") returned 4
	[0156.642] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.642] lstrlenW (lpString=".zip") returned 4
	[0156.642] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.642] lstrlenW (lpString=".rar") returned 4
	[0156.642] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.642] lstrlenW (lpString=".bz2") returned 4
	[0156.642] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.642] lstrlenW (lpString=".7z") returned 3
	[0156.642] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.642] lstrlenW (lpString=".dbf") returned 4
	[0156.642] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.642] lstrlenW (lpString=".1cd") returned 4
	[0156.642] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.643] lstrlenW (lpString=".jpg") returned 4
	[0156.643] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.643] lstrlenW (lpString=".doc") returned 4
	[0156.643] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.643] lstrlenW (lpString=".docx") returned 5
	[0156.643] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1
	[0156.643] lstrlenW (lpString=".pdf") returned 4
	[0156.643] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.643] lstrlenW (lpString=".xls") returned 4
	[0156.643] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.643] lstrlenW (lpString=".xlsx") returned 5
	[0156.643] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1
	[0156.643] lstrlenW (lpString=".ppt") returned 4
	[0156.643] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.643] lstrlenW (lpString=".zip") returned 4
	[0156.643] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.643] lstrlenW (lpString=".rar") returned 4
	[0156.643] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.643] lstrlenW (lpString=".bz2") returned 4
	[0156.643] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.643] lstrlenW (lpString=".7z") returned 3
	[0156.643] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.643] lstrlenW (lpString=".dbf") returned 4
	[0156.643] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.643] lstrlenW (lpString=".1cd") returned 4
	[0156.643] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.644] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46
	[0156.644] lstrlenW (lpString=".jpg") returned 4
	[0156.644] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.644] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0156.644] lstrlenW (lpString="ssvagent.exe") returned 12
	[0156.644] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0156.644] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=70208) returned 1
	[0156.644] CloseHandle (hObject=0x494) returned 1
	[0156.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20
	[0156.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.645] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.645] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.645] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.645] lstrlenW (lpString=".doc") returned 4
	[0156.645] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0156.645] lstrlenW (lpString=".docx") returned 5
	[0156.645] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0156.645] lstrlenW (lpString=".pdf") returned 4
	[0156.645] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0156.645] lstrlenW (lpString=".xls") returned 4
	[0156.645] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0156.645] lstrlenW (lpString=".xlsx") returned 5
	[0156.645] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0156.645] lstrlenW (lpString=".ppt") returned 4
	[0156.645] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0156.645] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.645] lstrlenW (lpString=".zip") returned 4
	[0156.645] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0156.645] lstrlenW (lpString=".rar") returned 4
	[0156.645] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0156.645] lstrlenW (lpString=".bz2") returned 4
	[0156.645] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0156.645] lstrlenW (lpString=".7z") returned 3
	[0156.645] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0156.645] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.645] lstrlenW (lpString=".dbf") returned 4
	[0156.645] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0156.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.646] lstrlenW (lpString=".1cd") returned 4
	[0156.646] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0156.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.646] lstrlenW (lpString=".jpg") returned 4
	[0156.646] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0156.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.646] lstrlenW (lpString=".doc") returned 4
	[0156.646] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0156.646] lstrlenW (lpString=".docx") returned 5
	[0156.646] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0156.646] lstrlenW (lpString=".pdf") returned 4
	[0156.646] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0156.646] lstrlenW (lpString=".xls") returned 4
	[0156.646] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0156.646] lstrlenW (lpString=".xlsx") returned 5
	[0156.646] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0156.646] lstrlenW (lpString=".ppt") returned 4
	[0156.646] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0156.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.646] lstrlenW (lpString=".zip") returned 4
	[0156.646] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0156.646] lstrlenW (lpString=".rar") returned 4
	[0156.646] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0156.646] lstrlenW (lpString=".bz2") returned 4
	[0156.646] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0156.646] lstrlenW (lpString=".7z") returned 3
	[0156.646] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0156.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.646] lstrlenW (lpString=".dbf") returned 4
	[0156.647] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0156.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.647] lstrlenW (lpString=".1cd") returned 4
	[0156.647] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0156.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51
	[0156.647] lstrlenW (lpString=".jpg") returned 4
	[0156.647] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0156.647] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0156.647] lstrlenW (lpString="sunec.dll") returned 9
	[0156.647] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0156.648] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=135744) returned 1
	[0156.648] CloseHandle (hObject=0x494) returned 1
	[0156.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20
	[0156.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.648] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.648] lstrlenW (lpString=".doc") returned 4
	[0156.648] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.648] lstrlenW (lpString=".docx") returned 5
	[0156.648] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0156.648] lstrlenW (lpString=".pdf") returned 4
	[0156.648] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.649] lstrlenW (lpString=".xls") returned 4
	[0156.649] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.649] lstrlenW (lpString=".xlsx") returned 5
	[0156.649] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0156.649] lstrlenW (lpString=".ppt") returned 4
	[0156.649] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.649] lstrlenW (lpString=".zip") returned 4
	[0156.649] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.649] lstrlenW (lpString=".rar") returned 4
	[0156.649] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.649] lstrlenW (lpString=".bz2") returned 4
	[0156.649] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.649] lstrlenW (lpString=".7z") returned 3
	[0156.649] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.649] lstrlenW (lpString=".dbf") returned 4
	[0156.649] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.649] lstrlenW (lpString=".1cd") returned 4
	[0156.649] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.649] lstrlenW (lpString=".jpg") returned 4
	[0156.649] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.649] lstrlenW (lpString=".doc") returned 4
	[0156.649] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.649] lstrlenW (lpString=".docx") returned 5
	[0156.649] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0156.649] lstrlenW (lpString=".pdf") returned 4
	[0156.649] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.650] lstrlenW (lpString=".xls") returned 4
	[0156.650] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.650] lstrlenW (lpString=".xlsx") returned 5
	[0156.650] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0156.650] lstrlenW (lpString=".ppt") returned 4
	[0156.650] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.650] lstrlenW (lpString=".zip") returned 4
	[0156.650] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.650] lstrlenW (lpString=".rar") returned 4
	[0156.650] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.650] lstrlenW (lpString=".bz2") returned 4
	[0156.650] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.650] lstrlenW (lpString=".7z") returned 3
	[0156.650] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.650] lstrlenW (lpString=".dbf") returned 4
	[0156.650] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.650] lstrlenW (lpString=".1cd") returned 4
	[0156.650] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48
	[0156.650] lstrlenW (lpString=".jpg") returned 4
	[0156.650] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.650] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0156.650] lstrlenW (lpString="sunmscapi.dll") returned 13
	[0156.650] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0156.651] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=31808) returned 1
	[0156.651] CloseHandle (hObject=0x494) returned 1
	[0156.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20
	[0156.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0156.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0156.652] lstrlenW (lpString=".doc") returned 4
	[0156.652] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.652] lstrlenW (lpString=".docx") returned 5
	[0156.652] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0156.652] lstrlenW (lpString=".pdf") returned 4
	[0156.652] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.652] lstrlenW (lpString=".xls") returned 4
	[0156.652] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.652] lstrlenW (lpString=".xlsx") returned 5
	[0156.652] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0156.652] lstrlenW (lpString=".ppt") returned 4
	[0156.652] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0156.652] lstrlenW (lpString=".zip") returned 4
	[0156.652] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.652] lstrlenW (lpString=".rar") returned 4
	[0156.652] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.652] lstrlenW (lpString=".bz2") returned 4
	[0156.652] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.652] lstrlenW (lpString=".7z") returned 3
	[0156.652] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52
	[0156.652] lstrlenW (lpString=".dbf") returned 4
	[0156.652] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.659] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.659] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.659] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0156.660] GetLastError () returned 0x0
	[0156.660] ReadFile (in: hFile=0x494, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0xcac, lpOverlapped=0x0) returned 1
	[0156.875] WriteFile (in: hFile=0x498, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xcb0, lpOverlapped=0x0) returned 1
	[0156.876] ReadFile (in: hFile=0x494, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.876] WriteFile (in: hFile=0x498, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0156.876] SetEndOfFile (hFile=0x498) returned 1
	[0156.876] CloseHandle (hObject=0x498) returned 1
	[0156.876] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.876] SetEndOfFile (hFile=0x494) returned 1
	[0156.890] CloseHandle (hObject=0x494) returned 1
	[0156.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0156.891] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1
	[0156.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.892] lstrlenW (lpString=".doc") returned 4
	[0156.892] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1
	[0156.892] lstrlenW (lpString=".docx") returned 5
	[0156.892] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1
	[0156.892] lstrlenW (lpString=".pdf") returned 4
	[0156.892] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1
	[0156.892] lstrlenW (lpString=".xls") returned 4
	[0156.892] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1
	[0156.892] lstrlenW (lpString=".xlsx") returned 5
	[0156.892] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1
	[0156.892] lstrlenW (lpString=".ppt") returned 4
	[0156.892] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1
	[0156.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.892] lstrlenW (lpString=".zip") returned 4
	[0156.892] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1
	[0156.892] lstrlenW (lpString=".rar") returned 4
	[0156.892] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1
	[0156.892] lstrlenW (lpString=".bz2") returned 4
	[0156.892] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1
	[0156.892] lstrlenW (lpString=".7z") returned 3
	[0156.892] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1
	[0156.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.892] lstrlenW (lpString=".dbf") returned 4
	[0156.893] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1
	[0156.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.893] lstrlenW (lpString=".1cd") returned 4
	[0156.893] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1
	[0156.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.893] lstrlenW (lpString=".jpg") returned 4
	[0156.893] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1
	[0156.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.893] lstrlenW (lpString=".doc") returned 4
	[0156.893] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1
	[0156.893] lstrlenW (lpString=".docx") returned 5
	[0156.893] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1
	[0156.893] lstrlenW (lpString=".pdf") returned 4
	[0156.893] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1
	[0156.893] lstrlenW (lpString=".xls") returned 4
	[0156.893] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1
	[0156.893] lstrlenW (lpString=".xlsx") returned 5
	[0156.893] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1
	[0156.893] lstrlenW (lpString=".ppt") returned 4
	[0156.893] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1
	[0156.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.893] lstrlenW (lpString=".zip") returned 4
	[0156.893] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1
	[0156.893] lstrlenW (lpString=".rar") returned 4
	[0156.893] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1
	[0156.893] lstrlenW (lpString=".bz2") returned 4
	[0156.893] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1
	[0156.893] lstrlenW (lpString=".7z") returned 3
	[0156.893] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1
	[0156.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.893] lstrlenW (lpString=".dbf") returned 4
	[0156.894] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1
	[0156.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.894] lstrlenW (lpString=".1cd") returned 4
	[0156.894] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1
	[0156.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0156.894] lstrlenW (lpString=".jpg") returned 4
	[0156.894] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1
	[0156.894] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0156.894] lstrlenW (lpString="calendars.properties") returned 20
	[0156.894] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0156.894] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=1378) returned 1
	[0156.894] CloseHandle (hObject=0x494) returned 1
	[0156.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20
	[0156.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.895] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0156.895] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.895] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.895] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0156.897] GetLastError () returned 0x0
	[0156.897] ReadFile (in: hFile=0x494, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x562, lpOverlapped=0x0) returned 1
	[0156.898] WriteFile (in: hFile=0x498, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x570, lpOverlapped=0x0) returned 1
	[0156.899] ReadFile (in: hFile=0x494, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.899] WriteFile (in: hFile=0x498, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0156.900] SetEndOfFile (hFile=0x498) returned 1
	[0156.900] CloseHandle (hObject=0x498) returned 1
	[0156.900] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.900] SetEndOfFile (hFile=0x494) returned 1
	[0157.134] CloseHandle (hObject=0x494) returned 1
	[0157.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0157.936] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1
	[0158.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.349] lstrlenW (lpString=".doc") returned 4
	[0158.349] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0158.349] lstrlenW (lpString=".docx") returned 5
	[0158.349] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0158.349] lstrlenW (lpString=".pdf") returned 4
	[0158.349] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0158.349] lstrlenW (lpString=".xls") returned 4
	[0158.349] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0158.349] lstrlenW (lpString=".xlsx") returned 5
	[0158.349] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0158.349] lstrlenW (lpString=".ppt") returned 4
	[0158.349] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0158.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.349] lstrlenW (lpString=".zip") returned 4
	[0158.349] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0158.349] lstrlenW (lpString=".rar") returned 4
	[0158.349] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0158.349] lstrlenW (lpString=".bz2") returned 4
	[0158.349] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0158.349] lstrlenW (lpString=".7z") returned 3
	[0158.349] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0158.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.349] lstrlenW (lpString=".dbf") returned 4
	[0158.349] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0158.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.350] lstrlenW (lpString=".1cd") returned 4
	[0158.350] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0158.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.350] lstrlenW (lpString=".jpg") returned 4
	[0158.350] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0158.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.350] lstrlenW (lpString=".doc") returned 4
	[0158.350] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0158.350] lstrlenW (lpString=".docx") returned 5
	[0158.350] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0158.350] lstrlenW (lpString=".pdf") returned 4
	[0158.350] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0158.350] lstrlenW (lpString=".xls") returned 4
	[0158.350] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0158.350] lstrlenW (lpString=".xlsx") returned 5
	[0158.350] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0158.350] lstrlenW (lpString=".ppt") returned 4
	[0158.350] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0158.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.350] lstrlenW (lpString=".zip") returned 4
	[0158.350] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0158.350] lstrlenW (lpString=".rar") returned 4
	[0158.350] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0158.350] lstrlenW (lpString=".bz2") returned 4
	[0158.350] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0158.350] lstrlenW (lpString=".7z") returned 3
	[0158.350] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0158.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.350] lstrlenW (lpString=".dbf") returned 4
	[0158.350] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0158.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.351] lstrlenW (lpString=".1cd") returned 4
	[0158.351] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0158.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0158.351] lstrlenW (lpString=".jpg") returned 4
	[0158.351] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0158.351] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".money") returned -1
	[0158.351] lstrlenW (lpString="classlist") returned 9
	[0158.351] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0158.462] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=84355) returned 1
	[0158.462] CloseHandle (hObject=0x4fc) returned 1
	[0158.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20
	[0159.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.285] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0159.476] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.476] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.476] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0159.673] GetLastError () returned 0x0
	[0159.673] ReadFile (in: hFile=0x518, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x14983, lpOverlapped=0x0) returned 1
	[0159.677] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x14990, lpOverlapped=0x0) returned 1
	[0159.679] ReadFile (in: hFile=0x518, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.679] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0159.679] SetEndOfFile (hFile=0x514) returned 1
	[0159.679] CloseHandle (hObject=0x514) returned 1
	[0159.679] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.679] SetEndOfFile (hFile=0x518) returned 1
	[0159.683] CloseHandle (hObject=0x518) returned 1
	[0159.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0159.684] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1
	[0159.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.685] lstrlenW (lpString=".doc") returned 4
	[0159.685] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0159.685] lstrlenW (lpString=".docx") returned 5
	[0159.685] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1
	[0159.685] lstrlenW (lpString=".pdf") returned 4
	[0159.685] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0159.685] lstrlenW (lpString=".xls") returned 4
	[0159.685] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0159.685] lstrlenW (lpString=".xlsx") returned 5
	[0159.685] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1
	[0159.685] lstrlenW (lpString=".ppt") returned 4
	[0159.685] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0159.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.685] lstrlenW (lpString=".zip") returned 4
	[0159.685] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0159.685] lstrlenW (lpString=".rar") returned 4
	[0159.685] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0159.685] lstrlenW (lpString=".bz2") returned 4
	[0159.685] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0159.685] lstrlenW (lpString=".7z") returned 3
	[0159.685] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0159.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.685] lstrlenW (lpString=".dbf") returned 4
	[0159.685] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0159.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.685] lstrlenW (lpString=".1cd") returned 4
	[0159.686] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0159.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.686] lstrlenW (lpString=".jpg") returned 4
	[0159.686] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0159.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.686] lstrlenW (lpString=".doc") returned 4
	[0159.686] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0159.686] lstrlenW (lpString=".docx") returned 5
	[0159.686] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1
	[0159.686] lstrlenW (lpString=".pdf") returned 4
	[0159.686] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0159.686] lstrlenW (lpString=".xls") returned 4
	[0159.686] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0159.686] lstrlenW (lpString=".xlsx") returned 5
	[0159.686] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1
	[0159.686] lstrlenW (lpString=".ppt") returned 4
	[0159.686] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0159.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.686] lstrlenW (lpString=".zip") returned 4
	[0159.686] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0159.686] lstrlenW (lpString=".rar") returned 4
	[0159.686] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0159.686] lstrlenW (lpString=".bz2") returned 4
	[0159.686] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0159.686] lstrlenW (lpString=".7z") returned 3
	[0159.686] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0159.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.686] lstrlenW (lpString=".dbf") returned 4
	[0159.686] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0159.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.687] lstrlenW (lpString=".1cd") returned 4
	[0159.687] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0159.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0159.687] lstrlenW (lpString=".jpg") returned 4
	[0159.687] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0159.687] lstrcmpiW (lpString1=".pf", lpString2=".money") returned 1
	[0159.687] lstrlenW (lpString="GRAY.pf") returned 7
	[0159.687] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0159.687] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=632) returned 1
	[0159.687] CloseHandle (hObject=0x518) returned 1
	[0159.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20
	[0159.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.688] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0159.688] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.688] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.688] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0159.690] GetLastError () returned 0x0
	[0159.690] ReadFile (in: hFile=0x518, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x278, lpOverlapped=0x0) returned 1
	[0159.691] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x280, lpOverlapped=0x0) returned 1
	[0159.692] ReadFile (in: hFile=0x518, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.692] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0159.692] SetEndOfFile (hFile=0x514) returned 1
	[0159.692] CloseHandle (hObject=0x514) returned 1
	[0159.693] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.693] SetEndOfFile (hFile=0x518) returned 1
	[0159.697] CloseHandle (hObject=0x518) returned 1
	[0159.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0159.697] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1
	[0159.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.698] lstrlenW (lpString=".doc") returned 4
	[0159.698] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1
	[0159.698] lstrlenW (lpString=".docx") returned 5
	[0159.698] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1
	[0159.698] lstrlenW (lpString=".pdf") returned 4
	[0159.698] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1
	[0159.698] lstrlenW (lpString=".xls") returned 4
	[0159.698] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1
	[0159.698] lstrlenW (lpString=".xlsx") returned 5
	[0159.698] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1
	[0159.698] lstrlenW (lpString=".ppt") returned 4
	[0159.698] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1
	[0159.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.698] lstrlenW (lpString=".zip") returned 4
	[0159.698] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1
	[0159.698] lstrlenW (lpString=".rar") returned 4
	[0159.698] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1
	[0159.698] lstrlenW (lpString=".bz2") returned 4
	[0159.698] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1
	[0159.698] lstrlenW (lpString=".7z") returned 3
	[0159.698] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0159.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.698] lstrlenW (lpString=".dbf") returned 4
	[0159.698] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1
	[0159.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.698] lstrlenW (lpString=".1cd") returned 4
	[0159.698] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1
	[0159.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.699] lstrlenW (lpString=".jpg") returned 4
	[0159.699] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1
	[0159.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.699] lstrlenW (lpString=".doc") returned 4
	[0159.699] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1
	[0159.699] lstrlenW (lpString=".docx") returned 5
	[0159.699] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1
	[0159.699] lstrlenW (lpString=".pdf") returned 4
	[0159.699] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1
	[0159.699] lstrlenW (lpString=".xls") returned 4
	[0159.699] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1
	[0159.699] lstrlenW (lpString=".xlsx") returned 5
	[0159.699] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1
	[0159.699] lstrlenW (lpString=".ppt") returned 4
	[0159.699] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1
	[0159.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.699] lstrlenW (lpString=".zip") returned 4
	[0159.699] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1
	[0159.699] lstrlenW (lpString=".rar") returned 4
	[0159.699] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1
	[0159.699] lstrlenW (lpString=".bz2") returned 4
	[0159.699] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1
	[0159.699] lstrlenW (lpString=".7z") returned 3
	[0159.699] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0159.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.699] lstrlenW (lpString=".dbf") returned 4
	[0159.699] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1
	[0159.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.699] lstrlenW (lpString=".1cd") returned 4
	[0159.699] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1
	[0159.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0159.700] lstrlenW (lpString=".jpg") returned 4
	[0159.700] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1
	[0159.700] lstrcmpiW (lpString1=".pf", lpString2=".money") returned 1
	[0159.700] lstrlenW (lpString="LINEAR_RGB.pf") returned 13
	[0159.700] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0159.703] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=1044) returned 1
	[0159.703] CloseHandle (hObject=0x514) returned 1
	[0159.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20
	[0159.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.703] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0159.704] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.704] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.704] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0159.704] GetLastError () returned 0x0
	[0159.704] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x414, lpOverlapped=0x0) returned 1
	[0159.707] WriteFile (in: hFile=0x518, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x420, lpOverlapped=0x0) returned 1
	[0159.708] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.708] WriteFile (in: hFile=0x518, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xee, lpOverlapped=0x0) returned 1
	[0159.708] SetEndOfFile (hFile=0x518) returned 1
	[0159.708] CloseHandle (hObject=0x518) returned 1
	[0159.708] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.708] SetEndOfFile (hFile=0x514) returned 1
	[0159.714] CloseHandle (hObject=0x514) returned 1
	[0159.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0159.714] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1
	[0159.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.715] lstrlenW (lpString=".doc") returned 4
	[0159.715] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0159.715] lstrlenW (lpString=".docx") returned 5
	[0159.715] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0159.715] lstrlenW (lpString=".pdf") returned 4
	[0159.715] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0159.715] lstrlenW (lpString=".xls") returned 4
	[0159.715] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0159.715] lstrlenW (lpString=".xlsx") returned 5
	[0159.715] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0159.715] lstrlenW (lpString=".ppt") returned 4
	[0159.715] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0159.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.715] lstrlenW (lpString=".zip") returned 4
	[0159.715] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0159.715] lstrlenW (lpString=".rar") returned 4
	[0159.715] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0159.715] lstrlenW (lpString=".bz2") returned 4
	[0159.716] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0159.716] lstrlenW (lpString=".7z") returned 3
	[0159.716] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0159.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.716] lstrlenW (lpString=".dbf") returned 4
	[0159.716] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0159.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.716] lstrlenW (lpString=".1cd") returned 4
	[0159.716] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0159.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.716] lstrlenW (lpString=".jpg") returned 4
	[0159.716] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0159.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.716] lstrlenW (lpString=".doc") returned 4
	[0159.716] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0159.716] lstrlenW (lpString=".docx") returned 5
	[0159.716] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0159.716] lstrlenW (lpString=".pdf") returned 4
	[0159.716] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0159.716] lstrlenW (lpString=".xls") returned 4
	[0159.716] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0159.716] lstrlenW (lpString=".xlsx") returned 5
	[0159.716] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0159.716] lstrlenW (lpString=".ppt") returned 4
	[0159.716] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0159.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.716] lstrlenW (lpString=".zip") returned 4
	[0159.716] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0159.716] lstrlenW (lpString=".rar") returned 4
	[0159.717] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0159.717] lstrlenW (lpString=".bz2") returned 4
	[0159.717] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0159.717] lstrlenW (lpString=".7z") returned 3
	[0159.717] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0159.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.717] lstrlenW (lpString=".dbf") returned 4
	[0159.717] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0159.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.717] lstrlenW (lpString=".1cd") returned 4
	[0159.717] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0159.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0159.717] lstrlenW (lpString=".jpg") returned 4
	[0159.717] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0159.717] lstrcmpiW (lpString1=".pf", lpString2=".money") returned 1
	[0159.717] lstrlenW (lpString="PYCC.pf") returned 7
	[0159.717] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0159.718] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=274474) returned 1
	[0159.718] CloseHandle (hObject=0x514) returned 1
	[0159.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20
	[0159.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.718] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0159.718] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.718] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.718] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0159.719] GetLastError () returned 0x0
	[0159.719] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x4302a, lpOverlapped=0x0) returned 1
	[0160.092] WriteFile (in: hFile=0x52c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x43030, lpOverlapped=0x0) returned 1
	[0160.098] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.098] WriteFile (in: hFile=0x52c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0160.098] SetEndOfFile (hFile=0x52c) returned 1
	[0160.098] CloseHandle (hObject=0x52c) returned 1
	[0160.098] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.098] SetEndOfFile (hFile=0x514) returned 1
	[0160.106] CloseHandle (hObject=0x514) returned 1
	[0160.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.106] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1
	[0160.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.109] lstrlenW (lpString=".doc") returned 4
	[0160.109] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1
	[0160.109] lstrlenW (lpString=".docx") returned 5
	[0160.109] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1
	[0160.109] lstrlenW (lpString=".pdf") returned 4
	[0160.109] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1
	[0160.109] lstrlenW (lpString=".xls") returned 4
	[0160.109] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1
	[0160.109] lstrlenW (lpString=".xlsx") returned 5
	[0160.109] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1
	[0160.109] lstrlenW (lpString=".ppt") returned 4
	[0160.109] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1
	[0160.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.109] lstrlenW (lpString=".zip") returned 4
	[0160.109] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1
	[0160.109] lstrlenW (lpString=".rar") returned 4
	[0160.109] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1
	[0160.109] lstrlenW (lpString=".bz2") returned 4
	[0160.109] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1
	[0160.109] lstrlenW (lpString=".7z") returned 3
	[0160.109] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0160.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.109] lstrlenW (lpString=".dbf") returned 4
	[0160.109] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1
	[0160.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.110] lstrlenW (lpString=".1cd") returned 4
	[0160.110] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1
	[0160.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.110] lstrlenW (lpString=".jpg") returned 4
	[0160.110] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1
	[0160.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.110] lstrlenW (lpString=".doc") returned 4
	[0160.110] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1
	[0160.110] lstrlenW (lpString=".docx") returned 5
	[0160.110] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1
	[0160.110] lstrlenW (lpString=".pdf") returned 4
	[0160.110] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1
	[0160.110] lstrlenW (lpString=".xls") returned 4
	[0160.110] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1
	[0160.110] lstrlenW (lpString=".xlsx") returned 5
	[0160.110] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1
	[0160.110] lstrlenW (lpString=".ppt") returned 4
	[0160.110] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1
	[0160.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.110] lstrlenW (lpString=".zip") returned 4
	[0160.110] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1
	[0160.110] lstrlenW (lpString=".rar") returned 4
	[0160.110] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1
	[0160.110] lstrlenW (lpString=".bz2") returned 4
	[0160.110] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1
	[0160.110] lstrlenW (lpString=".7z") returned 3
	[0160.110] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0160.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.111] lstrlenW (lpString=".dbf") returned 4
	[0160.111] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1
	[0160.111] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.111] lstrlenW (lpString=".1cd") returned 4
	[0160.111] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1
	[0160.111] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0160.111] lstrlenW (lpString=".jpg") returned 4
	[0160.111] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1
	[0160.111] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0160.111] lstrlenW (lpString="messages_es.properties") returned 22
	[0160.111] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0160.112] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=3600) returned 1
	[0160.112] CloseHandle (hObject=0x514) returned 1
	[0160.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20
	[0160.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.113] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0160.113] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.113] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.113] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0160.115] GetLastError () returned 0x0
	[0160.115] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0xe10, lpOverlapped=0x0) returned 1
	[0160.116] WriteFile (in: hFile=0x52c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xe20, lpOverlapped=0x0) returned 1
	[0160.123] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.123] WriteFile (in: hFile=0x52c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x100, lpOverlapped=0x0) returned 1
	[0160.123] SetEndOfFile (hFile=0x52c) returned 1
	[0160.123] CloseHandle (hObject=0x52c) returned 1
	[0160.123] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.123] SetEndOfFile (hFile=0x514) returned 1
	[0160.126] CloseHandle (hObject=0x514) returned 1
	[0160.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.126] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1
	[0160.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.413] lstrlenW (lpString=".doc") returned 4
	[0160.413] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.413] lstrlenW (lpString=".docx") returned 5
	[0160.413] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.413] lstrlenW (lpString=".pdf") returned 4
	[0160.413] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.413] lstrlenW (lpString=".xls") returned 4
	[0160.413] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.413] lstrlenW (lpString=".xlsx") returned 5
	[0160.413] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.413] lstrlenW (lpString=".ppt") returned 4
	[0160.413] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.413] lstrlenW (lpString=".zip") returned 4
	[0160.413] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.413] lstrlenW (lpString=".rar") returned 4
	[0160.413] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.413] lstrlenW (lpString=".bz2") returned 4
	[0160.413] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.413] lstrlenW (lpString=".7z") returned 3
	[0160.413] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.414] lstrlenW (lpString=".dbf") returned 4
	[0160.414] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.414] lstrlenW (lpString=".1cd") returned 4
	[0160.414] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.414] lstrlenW (lpString=".jpg") returned 4
	[0160.414] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.414] lstrlenW (lpString=".doc") returned 4
	[0160.414] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.414] lstrlenW (lpString=".docx") returned 5
	[0160.414] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.414] lstrlenW (lpString=".pdf") returned 4
	[0160.414] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.414] lstrlenW (lpString=".xls") returned 4
	[0160.414] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.414] lstrlenW (lpString=".xlsx") returned 5
	[0160.414] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.414] lstrlenW (lpString=".ppt") returned 4
	[0160.414] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.414] lstrlenW (lpString=".zip") returned 4
	[0160.414] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.414] lstrlenW (lpString=".rar") returned 4
	[0160.414] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.414] lstrlenW (lpString=".bz2") returned 4
	[0160.414] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.414] lstrlenW (lpString=".7z") returned 3
	[0160.414] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.415] lstrlenW (lpString=".dbf") returned 4
	[0160.415] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.415] lstrlenW (lpString=".1cd") returned 4
	[0160.415] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0160.415] lstrlenW (lpString=".jpg") returned 4
	[0160.415] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.415] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0160.415] lstrlenW (lpString="messages_zh_HK.properties") returned 25
	[0160.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0160.619] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=3752) returned 1
	[0160.619] CloseHandle (hObject=0x51c) returned 1
	[0160.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20
	[0160.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.620] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0160.621] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.621] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.621] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0160.622] GetLastError () returned 0x0
	[0160.622] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0xea8, lpOverlapped=0x0) returned 1
	[0160.623] WriteFile (in: hFile=0x520, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0160.624] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.624] WriteFile (in: hFile=0x520, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x106, lpOverlapped=0x0) returned 1
	[0160.624] SetEndOfFile (hFile=0x520) returned 1
	[0160.624] CloseHandle (hObject=0x520) returned 1
	[0160.624] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.625] SetEndOfFile (hFile=0x51c) returned 1
	[0160.628] CloseHandle (hObject=0x51c) returned 1
	[0160.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.628] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1
	[0160.629] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.629] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.629] lstrlenW (lpString=".doc") returned 4
	[0160.629] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.629] lstrlenW (lpString=".docx") returned 5
	[0160.629] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.629] lstrlenW (lpString=".pdf") returned 4
	[0160.629] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.629] lstrlenW (lpString=".xls") returned 4
	[0160.629] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.629] lstrlenW (lpString=".xlsx") returned 5
	[0160.629] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.629] lstrlenW (lpString=".ppt") returned 4
	[0160.629] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.629] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.629] lstrlenW (lpString=".zip") returned 4
	[0160.629] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.629] lstrlenW (lpString=".rar") returned 4
	[0160.629] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.629] lstrlenW (lpString=".bz2") returned 4
	[0160.629] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.629] lstrlenW (lpString=".7z") returned 3
	[0160.629] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.629] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.629] lstrlenW (lpString=".dbf") returned 4
	[0160.629] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.629] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.630] lstrlenW (lpString=".1cd") returned 4
	[0160.630] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.630] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.630] lstrlenW (lpString=".jpg") returned 4
	[0160.630] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.630] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.630] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.630] lstrlenW (lpString=".doc") returned 4
	[0160.630] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.630] lstrlenW (lpString=".docx") returned 5
	[0160.630] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.630] lstrlenW (lpString=".pdf") returned 4
	[0160.630] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.630] lstrlenW (lpString=".xls") returned 4
	[0160.630] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.630] lstrlenW (lpString=".xlsx") returned 5
	[0160.630] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.630] lstrlenW (lpString=".ppt") returned 4
	[0160.630] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.630] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.630] lstrlenW (lpString=".zip") returned 4
	[0160.630] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.630] lstrlenW (lpString=".rar") returned 4
	[0160.630] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.630] lstrlenW (lpString=".bz2") returned 4
	[0160.630] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.630] lstrlenW (lpString=".7z") returned 3
	[0160.630] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.630] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.630] lstrlenW (lpString=".dbf") returned 4
	[0160.631] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.631] lstrlenW (lpString=".1cd") returned 4
	[0160.631] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0160.631] lstrlenW (lpString=".jpg") returned 4
	[0160.631] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.631] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0160.631] lstrlenW (lpString="messages_zh_TW.properties") returned 25
	[0160.631] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0160.631] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=3752) returned 1
	[0160.631] CloseHandle (hObject=0x51c) returned 1
	[0160.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20
	[0160.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.632] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0160.632] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.632] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.632] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0160.633] GetLastError () returned 0x0
	[0160.633] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0xea8, lpOverlapped=0x0) returned 1
	[0160.634] WriteFile (in: hFile=0x520, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0160.635] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.635] WriteFile (in: hFile=0x520, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x106, lpOverlapped=0x0) returned 1
	[0160.635] SetEndOfFile (hFile=0x520) returned 1
	[0160.635] CloseHandle (hObject=0x520) returned 1
	[0160.635] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.635] SetEndOfFile (hFile=0x51c) returned 1
	[0160.640] CloseHandle (hObject=0x51c) returned 1
	[0160.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.640] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1
	[0160.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.641] lstrlenW (lpString=".doc") returned 4
	[0160.641] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.641] lstrlenW (lpString=".docx") returned 5
	[0160.641] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.641] lstrlenW (lpString=".pdf") returned 4
	[0160.641] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.641] lstrlenW (lpString=".xls") returned 4
	[0160.641] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.641] lstrlenW (lpString=".xlsx") returned 5
	[0160.641] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.641] lstrlenW (lpString=".ppt") returned 4
	[0160.641] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.641] lstrlenW (lpString=".zip") returned 4
	[0160.641] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.641] lstrlenW (lpString=".rar") returned 4
	[0160.641] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.641] lstrlenW (lpString=".bz2") returned 4
	[0160.641] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.641] lstrlenW (lpString=".7z") returned 3
	[0160.641] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.641] lstrlenW (lpString=".dbf") returned 4
	[0160.641] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.641] lstrlenW (lpString=".1cd") returned 4
	[0160.641] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.642] lstrlenW (lpString=".jpg") returned 4
	[0160.642] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.642] lstrlenW (lpString=".doc") returned 4
	[0160.642] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.642] lstrlenW (lpString=".docx") returned 5
	[0160.642] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.642] lstrlenW (lpString=".pdf") returned 4
	[0160.642] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.642] lstrlenW (lpString=".xls") returned 4
	[0160.642] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.642] lstrlenW (lpString=".xlsx") returned 5
	[0160.642] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.642] lstrlenW (lpString=".ppt") returned 4
	[0160.642] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.642] lstrlenW (lpString=".zip") returned 4
	[0160.642] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.642] lstrlenW (lpString=".rar") returned 4
	[0160.642] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.642] lstrlenW (lpString=".bz2") returned 4
	[0160.642] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.668] lstrlenW (lpString=".7z") returned 3
	[0160.668] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.668] lstrlenW (lpString=".dbf") returned 4
	[0160.668] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.668] lstrlenW (lpString=".1cd") returned 4
	[0160.668] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0160.668] lstrlenW (lpString=".jpg") returned 4
	[0160.668] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.669] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0160.669] lstrlenW (lpString="deploy.jar") returned 10
	[0160.669] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0160.686] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=5040094) returned 1
	[0160.686] CloseHandle (hObject=0x51c) returned 1
	[0160.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20
	[0160.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[admin@stex777.com].money")) returned 0
	[0160.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.686] lstrlenW (lpString=".doc") returned 4
	[0160.686] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0160.687] lstrlenW (lpString=".docx") returned 5
	[0160.687] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0160.687] lstrlenW (lpString=".pdf") returned 4
	[0160.687] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0160.687] lstrlenW (lpString=".xls") returned 4
	[0160.687] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0160.687] lstrlenW (lpString=".xlsx") returned 5
	[0160.687] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0160.687] lstrlenW (lpString=".ppt") returned 4
	[0160.687] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0160.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.687] lstrlenW (lpString=".zip") returned 4
	[0160.687] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0160.687] lstrlenW (lpString=".rar") returned 4
	[0160.687] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0160.687] lstrlenW (lpString=".bz2") returned 4
	[0160.687] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0160.687] lstrlenW (lpString=".7z") returned 3
	[0160.687] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0160.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.687] lstrlenW (lpString=".dbf") returned 4
	[0160.687] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0160.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.687] lstrlenW (lpString=".1cd") returned 4
	[0160.687] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0160.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.687] lstrlenW (lpString=".jpg") returned 4
	[0160.687] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0160.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.688] lstrlenW (lpString=".doc") returned 4
	[0160.688] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0160.688] lstrlenW (lpString=".docx") returned 5
	[0160.688] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0160.688] lstrlenW (lpString=".pdf") returned 4
	[0160.688] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0160.688] lstrlenW (lpString=".xls") returned 4
	[0160.688] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0160.688] lstrlenW (lpString=".xlsx") returned 5
	[0160.688] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0160.688] lstrlenW (lpString=".ppt") returned 4
	[0160.688] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0160.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.688] lstrlenW (lpString=".zip") returned 4
	[0160.688] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0160.688] lstrlenW (lpString=".rar") returned 4
	[0160.688] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0160.688] lstrlenW (lpString=".bz2") returned 4
	[0160.688] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0160.688] lstrlenW (lpString=".7z") returned 3
	[0160.688] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0160.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.688] lstrlenW (lpString=".dbf") returned 4
	[0160.688] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0160.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.688] lstrlenW (lpString=".1cd") returned 4
	[0160.688] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0160.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0160.688] lstrlenW (lpString=".jpg") returned 4
	[0160.688] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0160.689] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0160.689] lstrlenW (lpString="access-bridge-64.jar") returned 20
	[0160.689] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0160.756] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=188024) returned 1
	[0160.756] CloseHandle (hObject=0x51c) returned 1
	[0160.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20
	[0160.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.929] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0161.111] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.111] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.111] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0161.628] GetLastError () returned 0x0
	[0161.628] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2de78, lpOverlapped=0x0) returned 1
	[0161.635] WriteFile (in: hFile=0x4b8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2de80, lpOverlapped=0x0) returned 1
	[0161.639] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.639] WriteFile (in: hFile=0x4b8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0161.639] SetEndOfFile (hFile=0x4b8) returned 1
	[0161.639] CloseHandle (hObject=0x4b8) returned 1
	[0161.639] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.639] SetEndOfFile (hFile=0x534) returned 1
	[0161.646] CloseHandle (hObject=0x534) returned 1
	[0161.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0161.647] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1
	[0161.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.648] lstrlenW (lpString=".doc") returned 4
	[0161.648] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.648] lstrlenW (lpString=".docx") returned 5
	[0161.648] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1
	[0161.648] lstrlenW (lpString=".pdf") returned 4
	[0161.648] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.648] lstrlenW (lpString=".xls") returned 4
	[0161.648] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.648] lstrlenW (lpString=".xlsx") returned 5
	[0161.648] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1
	[0161.648] lstrlenW (lpString=".ppt") returned 4
	[0161.648] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.648] lstrlenW (lpString=".zip") returned 4
	[0161.648] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.648] lstrlenW (lpString=".rar") returned 4
	[0161.648] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.648] lstrlenW (lpString=".bz2") returned 4
	[0161.648] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.648] lstrlenW (lpString=".7z") returned 3
	[0161.648] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.648] lstrlenW (lpString=".dbf") returned 4
	[0161.648] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.648] lstrlenW (lpString=".1cd") returned 4
	[0161.649] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.649] lstrlenW (lpString=".jpg") returned 4
	[0161.649] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.649] lstrlenW (lpString=".doc") returned 4
	[0161.649] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.649] lstrlenW (lpString=".docx") returned 5
	[0161.649] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1
	[0161.649] lstrlenW (lpString=".pdf") returned 4
	[0161.649] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.649] lstrlenW (lpString=".xls") returned 4
	[0161.649] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.649] lstrlenW (lpString=".xlsx") returned 5
	[0161.649] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1
	[0161.649] lstrlenW (lpString=".ppt") returned 4
	[0161.649] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.649] lstrlenW (lpString=".zip") returned 4
	[0161.649] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.649] lstrlenW (lpString=".rar") returned 4
	[0161.649] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.649] lstrlenW (lpString=".bz2") returned 4
	[0161.649] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.649] lstrlenW (lpString=".7z") returned 3
	[0161.649] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.649] lstrlenW (lpString=".dbf") returned 4
	[0161.649] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.650] lstrlenW (lpString=".1cd") returned 4
	[0161.650] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0161.650] lstrlenW (lpString=".jpg") returned 4
	[0161.650] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.650] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0161.650] lstrlenW (lpString="sunmscapi.jar") returned 13
	[0161.650] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0161.650] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=32699) returned 1
	[0161.650] CloseHandle (hObject=0x534) returned 1
	[0161.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20
	[0161.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0161.651] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.651] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0161.652] GetLastError () returned 0x0
	[0161.652] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x7fbb, lpOverlapped=0x0) returned 1
	[0161.654] WriteFile (in: hFile=0x4b8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x7fc0, lpOverlapped=0x0) returned 1
	[0161.655] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.655] WriteFile (in: hFile=0x4b8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xee, lpOverlapped=0x0) returned 1
	[0161.655] SetEndOfFile (hFile=0x4b8) returned 1
	[0161.656] CloseHandle (hObject=0x4b8) returned 1
	[0161.656] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.656] SetEndOfFile (hFile=0x534) returned 1
	[0161.659] CloseHandle (hObject=0x534) returned 1
	[0161.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0161.659] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1
	[0161.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.660] lstrlenW (lpString=".doc") returned 4
	[0161.660] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.660] lstrlenW (lpString=".docx") returned 5
	[0161.660] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1
	[0161.660] lstrlenW (lpString=".pdf") returned 4
	[0161.660] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.660] lstrlenW (lpString=".xls") returned 4
	[0161.660] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.660] lstrlenW (lpString=".xlsx") returned 5
	[0161.660] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1
	[0161.660] lstrlenW (lpString=".ppt") returned 4
	[0161.660] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.660] lstrlenW (lpString=".zip") returned 4
	[0161.660] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.660] lstrlenW (lpString=".rar") returned 4
	[0161.660] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.660] lstrlenW (lpString=".bz2") returned 4
	[0161.660] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.660] lstrlenW (lpString=".7z") returned 3
	[0161.660] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.660] lstrlenW (lpString=".dbf") returned 4
	[0161.660] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.661] lstrlenW (lpString=".1cd") returned 4
	[0161.661] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.661] lstrlenW (lpString=".jpg") returned 4
	[0161.661] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.661] lstrlenW (lpString=".doc") returned 4
	[0161.661] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.661] lstrlenW (lpString=".docx") returned 5
	[0161.661] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1
	[0161.661] lstrlenW (lpString=".pdf") returned 4
	[0161.661] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.661] lstrlenW (lpString=".xls") returned 4
	[0161.661] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.661] lstrlenW (lpString=".xlsx") returned 5
	[0161.661] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1
	[0161.661] lstrlenW (lpString=".ppt") returned 4
	[0161.661] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.661] lstrlenW (lpString=".zip") returned 4
	[0161.661] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.661] lstrlenW (lpString=".rar") returned 4
	[0161.661] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.661] lstrlenW (lpString=".bz2") returned 4
	[0161.661] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.661] lstrlenW (lpString=".7z") returned 3
	[0161.661] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.662] lstrlenW (lpString=".dbf") returned 4
	[0161.662] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.662] lstrlenW (lpString=".1cd") returned 4
	[0161.662] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0161.662] lstrlenW (lpString=".jpg") returned 4
	[0161.662] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.662] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0161.662] lstrlenW (lpString="sunpkcs11.jar") returned 13
	[0161.662] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0161.662] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=251327) returned 1
	[0161.662] CloseHandle (hObject=0x534) returned 1
	[0161.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20
	[0161.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.663] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0161.663] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.663] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.663] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0161.664] GetLastError () returned 0x0
	[0161.664] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x3d5bf, lpOverlapped=0x0) returned 1
	[0161.945] WriteFile (in: hFile=0x4b8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x3d5c0, lpOverlapped=0x0) returned 1
	[0161.949] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.949] WriteFile (in: hFile=0x4b8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xee, lpOverlapped=0x0) returned 1
	[0161.949] SetEndOfFile (hFile=0x4b8) returned 1
	[0161.950] CloseHandle (hObject=0x4b8) returned 1
	[0161.950] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.950] SetEndOfFile (hFile=0x534) returned 1
	[0161.956] CloseHandle (hObject=0x534) returned 1
	[0161.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0161.957] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1
	[0161.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.957] lstrlenW (lpString=".doc") returned 4
	[0161.957] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.957] lstrlenW (lpString=".docx") returned 5
	[0161.957] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1
	[0161.957] lstrlenW (lpString=".pdf") returned 4
	[0161.957] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.957] lstrlenW (lpString=".xls") returned 4
	[0161.957] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.957] lstrlenW (lpString=".xlsx") returned 5
	[0161.957] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1
	[0161.957] lstrlenW (lpString=".ppt") returned 4
	[0161.958] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.958] lstrlenW (lpString=".zip") returned 4
	[0161.958] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.958] lstrlenW (lpString=".rar") returned 4
	[0161.958] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.958] lstrlenW (lpString=".bz2") returned 4
	[0161.958] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.958] lstrlenW (lpString=".7z") returned 3
	[0161.958] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.958] lstrlenW (lpString=".dbf") returned 4
	[0161.958] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.958] lstrlenW (lpString=".1cd") returned 4
	[0161.958] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.958] lstrlenW (lpString=".jpg") returned 4
	[0161.958] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.958] lstrlenW (lpString=".doc") returned 4
	[0161.958] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.958] lstrlenW (lpString=".docx") returned 5
	[0161.958] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1
	[0161.958] lstrlenW (lpString=".pdf") returned 4
	[0161.958] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.958] lstrlenW (lpString=".xls") returned 4
	[0161.958] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.958] lstrlenW (lpString=".xlsx") returned 5
	[0161.959] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1
	[0161.959] lstrlenW (lpString=".ppt") returned 4
	[0161.959] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.959] lstrlenW (lpString=".zip") returned 4
	[0161.959] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.959] lstrlenW (lpString=".rar") returned 4
	[0161.959] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.959] lstrlenW (lpString=".bz2") returned 4
	[0161.959] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.959] lstrlenW (lpString=".7z") returned 3
	[0161.959] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.959] lstrlenW (lpString=".dbf") returned 4
	[0161.959] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.959] lstrlenW (lpString=".1cd") returned 4
	[0161.959] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0161.959] lstrlenW (lpString=".jpg") returned 4
	[0161.959] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.982] lstrcmpiW (lpString1=".bfc", lpString2=".money") returned -1
	[0161.982] lstrlenW (lpString="fontconfig.bfc") returned 14
	[0161.982] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.983] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=3770) returned 1
	[0161.983] CloseHandle (hObject=0x548) returned 1
	[0161.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20
	[0161.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.984] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.984] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.984] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.984] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0161.985] GetLastError () returned 0x0
	[0161.985] ReadFile (in: hFile=0x548, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0xeba, lpOverlapped=0x0) returned 1
	[0161.990] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xec0, lpOverlapped=0x0) returned 1
	[0161.991] ReadFile (in: hFile=0x548, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.991] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0161.991] SetEndOfFile (hFile=0x54c) returned 1
	[0161.992] CloseHandle (hObject=0x54c) returned 1
	[0161.996] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.996] SetEndOfFile (hFile=0x548) returned 1
	[0162.001] CloseHandle (hObject=0x548) returned 1
	[0162.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0162.007] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1
	[0162.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.007] lstrlenW (lpString=".doc") returned 4
	[0162.007] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1
	[0162.008] lstrlenW (lpString=".docx") returned 5
	[0162.008] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1
	[0162.008] lstrlenW (lpString=".pdf") returned 4
	[0162.008] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1
	[0162.008] lstrlenW (lpString=".xls") returned 4
	[0162.008] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1
	[0162.008] lstrlenW (lpString=".xlsx") returned 5
	[0162.008] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1
	[0162.008] lstrlenW (lpString=".ppt") returned 4
	[0162.008] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1
	[0162.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.008] lstrlenW (lpString=".zip") returned 4
	[0162.008] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1
	[0162.008] lstrlenW (lpString=".rar") returned 4
	[0162.008] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1
	[0162.008] lstrlenW (lpString=".bz2") returned 4
	[0162.008] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1
	[0162.008] lstrlenW (lpString=".7z") returned 3
	[0162.008] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1
	[0162.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.008] lstrlenW (lpString=".dbf") returned 4
	[0162.008] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1
	[0162.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.008] lstrlenW (lpString=".1cd") returned 4
	[0162.008] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1
	[0162.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.009] lstrlenW (lpString=".jpg") returned 4
	[0162.009] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1
	[0162.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.009] lstrlenW (lpString=".doc") returned 4
	[0162.009] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1
	[0162.009] lstrlenW (lpString=".docx") returned 5
	[0162.009] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1
	[0162.009] lstrlenW (lpString=".pdf") returned 4
	[0162.009] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1
	[0162.009] lstrlenW (lpString=".xls") returned 4
	[0162.009] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1
	[0162.009] lstrlenW (lpString=".xlsx") returned 5
	[0162.009] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1
	[0162.009] lstrlenW (lpString=".ppt") returned 4
	[0162.009] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1
	[0162.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.009] lstrlenW (lpString=".zip") returned 4
	[0162.009] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1
	[0162.009] lstrlenW (lpString=".rar") returned 4
	[0162.009] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1
	[0162.009] lstrlenW (lpString=".bz2") returned 4
	[0162.010] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1
	[0162.010] lstrlenW (lpString=".7z") returned 3
	[0162.010] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1
	[0162.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.010] lstrlenW (lpString=".dbf") returned 4
	[0162.010] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1
	[0162.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.010] lstrlenW (lpString=".1cd") returned 4
	[0162.010] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1
	[0162.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0162.010] lstrlenW (lpString=".jpg") returned 4
	[0162.010] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1
	[0162.010] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0162.010] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24
	[0162.010] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0162.015] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=75144) returned 1
	[0162.015] CloseHandle (hObject=0x548) returned 1
	[0162.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20
	[0162.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0162.016] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.016] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0162.418] GetLastError () returned 0x0
	[0162.418] ReadFile (in: hFile=0x548, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x12588, lpOverlapped=0x0) returned 1
	[0162.421] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x12590, lpOverlapped=0x0) returned 1
	[0162.423] ReadFile (in: hFile=0x548, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.423] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x104, lpOverlapped=0x0) returned 1
	[0162.423] SetEndOfFile (hFile=0x514) returned 1
	[0162.424] CloseHandle (hObject=0x514) returned 1
	[0162.424] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.424] SetEndOfFile (hFile=0x548) returned 1
	[0162.428] CloseHandle (hObject=0x548) returned 1
	[0162.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0162.428] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1
	[0162.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.429] lstrlenW (lpString=".doc") returned 4
	[0162.429] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.429] lstrlenW (lpString=".docx") returned 5
	[0162.429] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0162.429] lstrlenW (lpString=".pdf") returned 4
	[0162.429] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.429] lstrlenW (lpString=".xls") returned 4
	[0162.429] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.429] lstrlenW (lpString=".xlsx") returned 5
	[0162.429] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0162.429] lstrlenW (lpString=".ppt") returned 4
	[0162.429] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.429] lstrlenW (lpString=".zip") returned 4
	[0162.429] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.429] lstrlenW (lpString=".rar") returned 4
	[0162.429] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.429] lstrlenW (lpString=".bz2") returned 4
	[0162.429] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.429] lstrlenW (lpString=".7z") returned 3
	[0162.429] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.429] lstrlenW (lpString=".dbf") returned 4
	[0162.429] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.429] lstrlenW (lpString=".1cd") returned 4
	[0162.429] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.429] lstrlenW (lpString=".jpg") returned 4
	[0162.429] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.430] lstrlenW (lpString=".doc") returned 4
	[0162.430] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.430] lstrlenW (lpString=".docx") returned 5
	[0162.430] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0162.430] lstrlenW (lpString=".pdf") returned 4
	[0162.430] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.430] lstrlenW (lpString=".xls") returned 4
	[0162.430] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.430] lstrlenW (lpString=".xlsx") returned 5
	[0162.430] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0162.430] lstrlenW (lpString=".ppt") returned 4
	[0162.430] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.430] lstrlenW (lpString=".zip") returned 4
	[0162.430] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.430] lstrlenW (lpString=".rar") returned 4
	[0162.430] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.430] lstrlenW (lpString=".bz2") returned 4
	[0162.430] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.430] lstrlenW (lpString=".7z") returned 3
	[0162.430] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.430] lstrlenW (lpString=".dbf") returned 4
	[0162.430] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.430] lstrlenW (lpString=".1cd") returned 4
	[0162.430] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0162.430] lstrlenW (lpString=".jpg") returned 4
	[0162.431] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.431] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0162.431] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21
	[0162.431] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0162.431] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=698236) returned 1
	[0162.431] CloseHandle (hObject=0x548) returned 1
	[0162.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20
	[0162.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.432] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0162.432] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.432] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.432] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0162.432] GetLastError () returned 0x0
	[0162.432] ReadFile (in: hFile=0x548, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0xaa77c, lpOverlapped=0x0) returned 1
	[0162.454] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xaa780, lpOverlapped=0x0) returned 1
	[0162.823] ReadFile (in: hFile=0x548, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.823] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xfe, lpOverlapped=0x0) returned 1
	[0162.823] SetEndOfFile (hFile=0x514) returned 1
	[0162.854] CloseHandle (hObject=0x514) returned 1
	[0162.854] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.854] SetEndOfFile (hFile=0x548) returned 1
	[0163.016] CloseHandle (hObject=0x548) returned 1
	[0163.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0163.029] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1
	[0163.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.440] lstrlenW (lpString=".doc") returned 4
	[0163.440] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0163.440] lstrlenW (lpString=".docx") returned 5
	[0163.440] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0163.440] lstrlenW (lpString=".pdf") returned 4
	[0163.440] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0163.441] lstrlenW (lpString=".xls") returned 4
	[0163.441] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0163.441] lstrlenW (lpString=".xlsx") returned 5
	[0163.441] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0163.441] lstrlenW (lpString=".ppt") returned 4
	[0163.441] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0163.441] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.441] lstrlenW (lpString=".zip") returned 4
	[0163.441] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0163.441] lstrlenW (lpString=".rar") returned 4
	[0163.441] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0163.441] lstrlenW (lpString=".bz2") returned 4
	[0163.441] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0163.441] lstrlenW (lpString=".7z") returned 3
	[0163.441] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0163.441] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.441] lstrlenW (lpString=".dbf") returned 4
	[0163.441] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0163.441] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.441] lstrlenW (lpString=".1cd") returned 4
	[0163.441] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0163.441] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.441] lstrlenW (lpString=".jpg") returned 4
	[0163.441] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0163.441] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.441] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.441] lstrlenW (lpString=".doc") returned 4
	[0163.441] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0163.441] lstrlenW (lpString=".docx") returned 5
	[0163.441] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0163.441] lstrlenW (lpString=".pdf") returned 4
	[0163.442] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0163.442] lstrlenW (lpString=".xls") returned 4
	[0163.442] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0163.442] lstrlenW (lpString=".xlsx") returned 5
	[0163.442] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0163.442] lstrlenW (lpString=".ppt") returned 4
	[0163.442] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0163.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.442] lstrlenW (lpString=".zip") returned 4
	[0163.442] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0163.442] lstrlenW (lpString=".rar") returned 4
	[0163.442] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0163.442] lstrlenW (lpString=".bz2") returned 4
	[0163.442] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0163.442] lstrlenW (lpString=".7z") returned 3
	[0163.442] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0163.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.442] lstrlenW (lpString=".dbf") returned 4
	[0163.442] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0163.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.442] lstrlenW (lpString=".1cd") returned 4
	[0163.442] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0163.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0163.442] lstrlenW (lpString=".jpg") returned 4
	[0163.442] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0163.442] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0163.442] lstrlenW (lpString="jfxswt.jar") returned 10
	[0163.443] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0163.443] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=33932) returned 1
	[0163.443] CloseHandle (hObject=0x54c) returned 1
	[0163.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20
	[0163.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.444] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0163.444] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.444] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.444] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0163.445] GetLastError () returned 0x0
	[0163.445] ReadFile (in: hFile=0x54c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x848c, lpOverlapped=0x0) returned 1
	[0163.449] WriteFile (in: hFile=0x540, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x8490, lpOverlapped=0x0) returned 1
	[0163.451] ReadFile (in: hFile=0x54c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.451] WriteFile (in: hFile=0x540, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0163.451] SetEndOfFile (hFile=0x540) returned 1
	[0163.451] CloseHandle (hObject=0x540) returned 1
	[0163.451] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.451] SetEndOfFile (hFile=0x54c) returned 1
	[0163.454] CloseHandle (hObject=0x54c) returned 1
	[0163.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0163.454] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1
	[0163.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.455] lstrlenW (lpString=".doc") returned 4
	[0163.455] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0163.455] lstrlenW (lpString=".docx") returned 5
	[0163.455] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0163.455] lstrlenW (lpString=".pdf") returned 4
	[0163.456] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0163.456] lstrlenW (lpString=".xls") returned 4
	[0163.456] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0163.456] lstrlenW (lpString=".xlsx") returned 5
	[0163.456] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0163.456] lstrlenW (lpString=".ppt") returned 4
	[0163.456] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0163.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.456] lstrlenW (lpString=".zip") returned 4
	[0163.456] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0163.456] lstrlenW (lpString=".rar") returned 4
	[0163.456] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0163.456] lstrlenW (lpString=".bz2") returned 4
	[0163.456] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0163.456] lstrlenW (lpString=".7z") returned 3
	[0163.456] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0163.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.456] lstrlenW (lpString=".dbf") returned 4
	[0163.456] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0163.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.456] lstrlenW (lpString=".1cd") returned 4
	[0163.456] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0163.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.456] lstrlenW (lpString=".jpg") returned 4
	[0163.456] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0163.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.456] lstrlenW (lpString=".doc") returned 4
	[0163.456] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0163.456] lstrlenW (lpString=".docx") returned 5
	[0163.456] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0163.457] lstrlenW (lpString=".pdf") returned 4
	[0163.457] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0163.457] lstrlenW (lpString=".xls") returned 4
	[0163.457] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0163.457] lstrlenW (lpString=".xlsx") returned 5
	[0163.457] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0163.457] lstrlenW (lpString=".ppt") returned 4
	[0163.457] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0163.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.457] lstrlenW (lpString=".zip") returned 4
	[0163.457] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0163.457] lstrlenW (lpString=".rar") returned 4
	[0163.457] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0163.457] lstrlenW (lpString=".bz2") returned 4
	[0163.457] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0163.457] lstrlenW (lpString=".7z") returned 3
	[0163.457] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0163.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.457] lstrlenW (lpString=".dbf") returned 4
	[0163.457] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0163.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.457] lstrlenW (lpString=".1cd") returned 4
	[0163.457] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0163.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0163.457] lstrlenW (lpString=".jpg") returned 4
	[0163.457] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0163.457] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0163.458] lstrlenW (lpString="jsse.jar") returned 8
	[0163.458] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0163.458] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=584576) returned 1
	[0163.458] CloseHandle (hObject=0x54c) returned 1
	[0163.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20
	[0163.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.458] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0163.459] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.459] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.459] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0163.459] GetLastError () returned 0x0
	[0163.459] ReadFile (in: hFile=0x54c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x8eb80, lpOverlapped=0x0) returned 1
	[0163.478] WriteFile (in: hFile=0x540, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x8eb90, lpOverlapped=0x0) returned 1
	[0163.859] ReadFile (in: hFile=0x54c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.859] WriteFile (in: hFile=0x540, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0163.859] SetEndOfFile (hFile=0x540) returned 1
	[0163.859] CloseHandle (hObject=0x540) returned 1
	[0163.859] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.860] SetEndOfFile (hFile=0x54c) returned 1
	[0164.466] CloseHandle (hObject=0x54c) returned 1
	[0164.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0164.536] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1
	[0164.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.594] lstrlenW (lpString=".doc") returned 4
	[0164.595] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0164.595] lstrlenW (lpString=".docx") returned 5
	[0164.595] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0164.595] lstrlenW (lpString=".pdf") returned 4
	[0164.595] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0164.595] lstrlenW (lpString=".xls") returned 4
	[0164.595] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0164.595] lstrlenW (lpString=".xlsx") returned 5
	[0164.595] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0164.595] lstrlenW (lpString=".ppt") returned 4
	[0164.595] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0164.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.595] lstrlenW (lpString=".zip") returned 4
	[0164.595] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0164.595] lstrlenW (lpString=".rar") returned 4
	[0164.595] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0164.595] lstrlenW (lpString=".bz2") returned 4
	[0164.595] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0164.595] lstrlenW (lpString=".7z") returned 3
	[0164.595] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0164.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.595] lstrlenW (lpString=".dbf") returned 4
	[0164.595] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0164.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.595] lstrlenW (lpString=".1cd") returned 4
	[0164.595] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0164.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.595] lstrlenW (lpString=".jpg") returned 4
	[0164.595] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0164.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.596] lstrlenW (lpString=".doc") returned 4
	[0164.596] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0164.596] lstrlenW (lpString=".docx") returned 5
	[0164.596] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0164.596] lstrlenW (lpString=".pdf") returned 4
	[0164.596] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0164.596] lstrlenW (lpString=".xls") returned 4
	[0164.596] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0164.596] lstrlenW (lpString=".xlsx") returned 5
	[0164.596] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0164.596] lstrlenW (lpString=".ppt") returned 4
	[0164.596] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0164.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.596] lstrlenW (lpString=".zip") returned 4
	[0164.596] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0164.596] lstrlenW (lpString=".rar") returned 4
	[0164.596] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0164.596] lstrlenW (lpString=".bz2") returned 4
	[0164.596] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0164.596] lstrlenW (lpString=".7z") returned 3
	[0164.596] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0164.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.596] lstrlenW (lpString=".dbf") returned 4
	[0164.596] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0164.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.596] lstrlenW (lpString=".1cd") returned 4
	[0164.596] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0164.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0164.596] lstrlenW (lpString=".jpg") returned 4
	[0164.597] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0164.597] lstrcmpiW (lpString1=".certs", lpString2=".money") returned -1
	[0164.597] lstrlenW (lpString="blacklisted.certs") returned 17
	[0164.597] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.733] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=1253) returned 1
	[0165.733] CloseHandle (hObject=0x4b8) returned 1
	[0165.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20
	[0165.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.733] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.734] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.734] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.734] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.735] GetLastError () returned 0x0
	[0165.735] ReadFile (in: hFile=0x4b8, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x4e5, lpOverlapped=0x0) returned 1
	[0165.737] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0165.739] ReadFile (in: hFile=0x4b8, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.739] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0165.739] SetEndOfFile (hFile=0x55c) returned 1
	[0165.739] CloseHandle (hObject=0x55c) returned 1
	[0165.739] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.739] SetEndOfFile (hFile=0x4b8) returned 1
	[0165.743] CloseHandle (hObject=0x4b8) returned 1
	[0165.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.743] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1
	[0165.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.744] lstrlenW (lpString=".doc") returned 4
	[0165.744] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0165.744] lstrlenW (lpString=".docx") returned 5
	[0165.744] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0165.744] lstrlenW (lpString=".pdf") returned 4
	[0165.744] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0165.744] lstrlenW (lpString=".xls") returned 4
	[0165.744] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0165.744] lstrlenW (lpString=".xlsx") returned 5
	[0165.744] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0165.744] lstrlenW (lpString=".ppt") returned 4
	[0165.744] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0165.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.744] lstrlenW (lpString=".zip") returned 4
	[0165.744] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0165.744] lstrlenW (lpString=".rar") returned 4
	[0165.744] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0165.744] lstrlenW (lpString=".bz2") returned 4
	[0165.744] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0165.744] lstrlenW (lpString=".7z") returned 3
	[0165.745] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0165.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.745] lstrlenW (lpString=".dbf") returned 4
	[0165.745] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0165.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.745] lstrlenW (lpString=".1cd") returned 4
	[0165.745] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0165.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.745] lstrlenW (lpString=".jpg") returned 4
	[0165.745] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0165.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.746] lstrlenW (lpString=".doc") returned 4
	[0165.746] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0165.746] lstrlenW (lpString=".docx") returned 5
	[0165.746] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0165.746] lstrlenW (lpString=".pdf") returned 4
	[0165.746] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0165.746] lstrlenW (lpString=".xls") returned 4
	[0165.746] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0165.746] lstrlenW (lpString=".xlsx") returned 5
	[0165.746] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0165.746] lstrlenW (lpString=".ppt") returned 4
	[0165.746] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0165.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.746] lstrlenW (lpString=".zip") returned 4
	[0165.746] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0165.746] lstrlenW (lpString=".rar") returned 4
	[0165.746] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0165.746] lstrlenW (lpString=".bz2") returned 4
	[0165.746] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0165.746] lstrlenW (lpString=".7z") returned 3
	[0165.746] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0165.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.746] lstrlenW (lpString=".dbf") returned 4
	[0165.746] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0165.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.746] lstrlenW (lpString=".1cd") returned 4
	[0165.746] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0165.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0165.746] lstrlenW (lpString=".jpg") returned 4
	[0165.747] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0165.747] lstrcmpiW (lpString1=".security", lpString2=".money") returned 1
	[0165.747] lstrlenW (lpString="java.security") returned 13
	[0165.747] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.748] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=36524) returned 1
	[0165.748] CloseHandle (hObject=0x4b8) returned 1
	[0165.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20
	[0165.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.749] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.749] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.749] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.749] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.750] GetLastError () returned 0x0
	[0165.750] ReadFile (in: hFile=0x4b8, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x8eac, lpOverlapped=0x0) returned 1
	[0165.754] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x8eb0, lpOverlapped=0x0) returned 1
	[0165.757] ReadFile (in: hFile=0x4b8, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.757] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xee, lpOverlapped=0x0) returned 1
	[0165.757] SetEndOfFile (hFile=0x55c) returned 1
	[0165.757] CloseHandle (hObject=0x55c) returned 1
	[0165.757] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.758] SetEndOfFile (hFile=0x4b8) returned 1
	[0165.769] CloseHandle (hObject=0x4b8) returned 1
	[0165.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.770] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1
	[0165.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.771] lstrlenW (lpString=".doc") returned 4
	[0165.771] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1
	[0165.771] lstrlenW (lpString=".docx") returned 5
	[0165.771] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1
	[0165.771] lstrlenW (lpString=".pdf") returned 4
	[0165.771] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1
	[0165.771] lstrlenW (lpString=".xls") returned 4
	[0165.771] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1
	[0165.771] lstrlenW (lpString=".xlsx") returned 5
	[0165.771] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1
	[0165.771] lstrlenW (lpString=".ppt") returned 4
	[0165.771] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1
	[0165.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.771] lstrlenW (lpString=".zip") returned 4
	[0165.771] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1
	[0165.771] lstrlenW (lpString=".rar") returned 4
	[0165.771] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1
	[0165.771] lstrlenW (lpString=".bz2") returned 4
	[0165.771] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1
	[0165.771] lstrlenW (lpString=".7z") returned 3
	[0165.771] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1
	[0165.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.771] lstrlenW (lpString=".dbf") returned 4
	[0165.771] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1
	[0165.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.771] lstrlenW (lpString=".1cd") returned 4
	[0165.771] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1
	[0165.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.772] lstrlenW (lpString=".jpg") returned 4
	[0165.772] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1
	[0165.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.772] lstrlenW (lpString=".doc") returned 4
	[0165.772] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1
	[0165.772] lstrlenW (lpString=".docx") returned 5
	[0165.772] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1
	[0165.772] lstrlenW (lpString=".pdf") returned 4
	[0165.772] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1
	[0165.772] lstrlenW (lpString=".xls") returned 4
	[0165.772] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1
	[0165.772] lstrlenW (lpString=".xlsx") returned 5
	[0165.772] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1
	[0165.772] lstrlenW (lpString=".ppt") returned 4
	[0165.772] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1
	[0165.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.772] lstrlenW (lpString=".zip") returned 4
	[0165.772] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1
	[0165.772] lstrlenW (lpString=".rar") returned 4
	[0165.772] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1
	[0165.773] lstrlenW (lpString=".bz2") returned 4
	[0165.773] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1
	[0165.773] lstrlenW (lpString=".7z") returned 3
	[0165.773] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1
	[0165.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.773] lstrlenW (lpString=".dbf") returned 4
	[0165.773] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1
	[0165.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.773] lstrlenW (lpString=".1cd") returned 4
	[0165.773] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1
	[0165.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0165.773] lstrlenW (lpString=".jpg") returned 4
	[0165.773] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1
	[0165.773] lstrcmpiW (lpString1=".policy", lpString2=".money") returned 1
	[0165.773] lstrlenW (lpString="javaws.policy") returned 13
	[0165.773] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.774] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=98) returned 1
	[0165.774] CloseHandle (hObject=0x4b8) returned 1
	[0165.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20
	[0165.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.774] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.775] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.775] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.775] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.776] GetLastError () returned 0x0
	[0165.776] ReadFile (in: hFile=0x4b8, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x62, lpOverlapped=0x0) returned 1
	[0165.777] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x70, lpOverlapped=0x0) returned 1
	[0165.778] ReadFile (in: hFile=0x4b8, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.778] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xee, lpOverlapped=0x0) returned 1
	[0165.778] SetEndOfFile (hFile=0x55c) returned 1
	[0165.778] CloseHandle (hObject=0x55c) returned 1
	[0165.779] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.779] SetEndOfFile (hFile=0x4b8) returned 1
	[0165.782] CloseHandle (hObject=0x4b8) returned 1
	[0165.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.783] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1
	[0165.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.784] lstrlenW (lpString=".doc") returned 4
	[0165.784] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0165.784] lstrlenW (lpString=".docx") returned 5
	[0165.784] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0165.784] lstrlenW (lpString=".pdf") returned 4
	[0165.784] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0165.784] lstrlenW (lpString=".xls") returned 4
	[0165.784] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0165.784] lstrlenW (lpString=".xlsx") returned 5
	[0165.784] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0165.784] lstrlenW (lpString=".ppt") returned 4
	[0165.784] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0165.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.784] lstrlenW (lpString=".zip") returned 4
	[0165.784] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0165.784] lstrlenW (lpString=".rar") returned 4
	[0165.785] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0165.785] lstrlenW (lpString=".bz2") returned 4
	[0165.785] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0165.785] lstrlenW (lpString=".7z") returned 3
	[0165.785] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.785] lstrlenW (lpString=".dbf") returned 4
	[0165.785] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.785] lstrlenW (lpString=".1cd") returned 4
	[0165.785] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.785] lstrlenW (lpString=".jpg") returned 4
	[0165.785] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.785] lstrlenW (lpString=".doc") returned 4
	[0165.785] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0165.785] lstrlenW (lpString=".docx") returned 5
	[0165.785] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0165.785] lstrlenW (lpString=".pdf") returned 4
	[0165.785] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0165.785] lstrlenW (lpString=".xls") returned 4
	[0165.785] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0165.785] lstrlenW (lpString=".xlsx") returned 5
	[0165.785] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0165.786] lstrlenW (lpString=".ppt") returned 4
	[0165.786] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0165.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.786] lstrlenW (lpString=".zip") returned 4
	[0165.786] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0165.786] lstrlenW (lpString=".rar") returned 4
	[0165.786] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0165.786] lstrlenW (lpString=".bz2") returned 4
	[0165.786] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0165.786] lstrlenW (lpString=".7z") returned 3
	[0165.786] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0165.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.786] lstrlenW (lpString=".dbf") returned 4
	[0165.786] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0165.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.786] lstrlenW (lpString=".1cd") returned 4
	[0165.786] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0165.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0165.786] lstrlenW (lpString=".jpg") returned 4
	[0165.786] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0165.786] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0165.786] lstrlenW (lpString="local_policy.jar") returned 16
	[0165.786] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.787] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=3527) returned 1
	[0165.787] CloseHandle (hObject=0x4b8) returned 1
	[0165.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20
	[0165.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.790] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.790] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.790] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.791] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.791] GetLastError () returned 0x0
	[0165.791] ReadFile (in: hFile=0x4b8, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0xdc7, lpOverlapped=0x0) returned 1
	[0165.793] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xdd0, lpOverlapped=0x0) returned 1
	[0165.794] ReadFile (in: hFile=0x4b8, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.794] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0165.794] SetEndOfFile (hFile=0x55c) returned 1
	[0165.794] CloseHandle (hObject=0x55c) returned 1
	[0165.794] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.794] SetEndOfFile (hFile=0x4b8) returned 1
	[0165.797] CloseHandle (hObject=0x4b8) returned 1
	[0165.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.798] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1
	[0165.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.799] lstrlenW (lpString=".doc") returned 4
	[0165.799] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0165.799] lstrlenW (lpString=".docx") returned 5
	[0165.799] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0165.799] lstrlenW (lpString=".pdf") returned 4
	[0165.799] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0165.799] lstrlenW (lpString=".xls") returned 4
	[0165.799] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0165.799] lstrlenW (lpString=".xlsx") returned 5
	[0165.799] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0165.799] lstrlenW (lpString=".ppt") returned 4
	[0165.799] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0165.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.799] lstrlenW (lpString=".zip") returned 4
	[0165.799] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0165.799] lstrlenW (lpString=".rar") returned 4
	[0165.799] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0165.799] lstrlenW (lpString=".bz2") returned 4
	[0165.799] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0165.799] lstrlenW (lpString=".7z") returned 3
	[0165.799] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0165.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.799] lstrlenW (lpString=".dbf") returned 4
	[0165.799] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0165.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.799] lstrlenW (lpString=".1cd") returned 4
	[0165.799] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0165.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.800] lstrlenW (lpString=".jpg") returned 4
	[0165.800] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0165.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.800] lstrlenW (lpString=".doc") returned 4
	[0165.800] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0165.800] lstrlenW (lpString=".docx") returned 5
	[0165.800] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0165.800] lstrlenW (lpString=".pdf") returned 4
	[0165.800] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0165.800] lstrlenW (lpString=".xls") returned 4
	[0165.800] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0165.800] lstrlenW (lpString=".xlsx") returned 5
	[0165.800] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0165.800] lstrlenW (lpString=".ppt") returned 4
	[0165.800] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0165.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.800] lstrlenW (lpString=".zip") returned 4
	[0165.800] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0165.800] lstrlenW (lpString=".rar") returned 4
	[0165.800] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0165.800] lstrlenW (lpString=".bz2") returned 4
	[0165.800] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0165.800] lstrlenW (lpString=".7z") returned 3
	[0165.800] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0165.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.801] lstrlenW (lpString=".dbf") returned 4
	[0165.801] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0165.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.801] lstrlenW (lpString=".1cd") returned 4
	[0165.801] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0165.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0165.801] lstrlenW (lpString=".jpg") returned 4
	[0165.801] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0165.801] lstrcmpiW (lpString1=".libraries", lpString2=".money") returned -1
	[0165.801] lstrlenW (lpString="trusted.libraries") returned 17
	[0165.801] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.802] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=0) returned 1
	[0165.802] CloseHandle (hObject=0x4b8) returned 1
	[0165.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.802] lstrlenW (lpString=".doc") returned 4
	[0165.802] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1
	[0165.802] lstrlenW (lpString=".docx") returned 5
	[0165.802] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1
	[0165.802] lstrlenW (lpString=".pdf") returned 4
	[0165.803] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1
	[0165.803] lstrlenW (lpString=".xls") returned 4
	[0165.803] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1
	[0165.803] lstrlenW (lpString=".xlsx") returned 5
	[0165.803] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1
	[0165.803] lstrlenW (lpString=".ppt") returned 4
	[0165.803] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1
	[0165.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.803] lstrlenW (lpString=".zip") returned 4
	[0165.803] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1
	[0165.803] lstrlenW (lpString=".rar") returned 4
	[0165.803] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1
	[0165.803] lstrlenW (lpString=".bz2") returned 4
	[0165.803] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1
	[0165.803] lstrlenW (lpString=".7z") returned 3
	[0165.803] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0165.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.803] lstrlenW (lpString=".dbf") returned 4
	[0165.803] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1
	[0165.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.803] lstrlenW (lpString=".1cd") returned 4
	[0165.803] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1
	[0165.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.803] lstrlenW (lpString=".jpg") returned 4
	[0165.804] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1
	[0165.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.804] lstrlenW (lpString=".doc") returned 4
	[0165.804] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1
	[0165.804] lstrlenW (lpString=".docx") returned 5
	[0165.804] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1
	[0165.804] lstrlenW (lpString=".pdf") returned 4
	[0165.804] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1
	[0165.804] lstrlenW (lpString=".xls") returned 4
	[0165.804] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1
	[0165.804] lstrlenW (lpString=".xlsx") returned 5
	[0165.804] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1
	[0165.804] lstrlenW (lpString=".ppt") returned 4
	[0165.804] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1
	[0165.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.804] lstrlenW (lpString=".zip") returned 4
	[0165.804] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1
	[0165.804] lstrlenW (lpString=".rar") returned 4
	[0165.804] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1
	[0165.804] lstrlenW (lpString=".bz2") returned 4
	[0165.805] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1
	[0165.805] lstrlenW (lpString=".7z") returned 3
	[0165.805] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0165.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.805] lstrlenW (lpString=".dbf") returned 4
	[0165.805] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1
	[0165.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.805] lstrlenW (lpString=".1cd") returned 4
	[0165.805] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1
	[0165.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0165.805] lstrlenW (lpString=".jpg") returned 4
	[0165.805] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1
	[0165.805] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0165.805] lstrlenW (lpString="US_export_policy.jar") returned 20
	[0165.805] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.806] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=3026) returned 1
	[0165.806] CloseHandle (hObject=0x4b8) returned 1
	[0165.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20
	[0165.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.806] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0165.806] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.807] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.807] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.807] GetLastError () returned 0x0
	[0165.807] ReadFile (in: hFile=0x4b8, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0xbd2, lpOverlapped=0x0) returned 1
	[0165.809] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xbe0, lpOverlapped=0x0) returned 1
	[0165.810] ReadFile (in: hFile=0x4b8, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.810] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0165.810] SetEndOfFile (hFile=0x55c) returned 1
	[0165.811] CloseHandle (hObject=0x55c) returned 1
	[0165.811] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.811] SetEndOfFile (hFile=0x4b8) returned 1
	[0165.813] CloseHandle (hObject=0x4b8) returned 1
	[0165.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.814] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1
	[0165.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0165.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0165.815] lstrlenW (lpString=".doc") returned 4
	[0165.815] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0166.087] lstrlenW (lpString=".docx") returned 5
	[0166.087] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0166.087] lstrlenW (lpString=".pdf") returned 4
	[0166.087] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0166.087] lstrlenW (lpString=".xls") returned 4
	[0166.087] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0166.087] lstrlenW (lpString=".xlsx") returned 5
	[0166.088] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0166.088] lstrlenW (lpString=".ppt") returned 4
	[0166.088] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0166.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0166.088] lstrlenW (lpString=".zip") returned 4
	[0166.088] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0166.088] lstrlenW (lpString=".rar") returned 4
	[0166.088] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0166.088] lstrlenW (lpString=".bz2") returned 4
	[0166.088] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0166.088] lstrlenW (lpString=".7z") returned 3
	[0166.088] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0166.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0166.088] lstrlenW (lpString=".dbf") returned 4
	[0166.088] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0166.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0166.088] lstrlenW (lpString=".1cd") returned 4
	[0166.088] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0166.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0166.088] lstrlenW (lpString=".jpg") returned 4
	[0166.088] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0166.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0166.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0166.088] lstrlenW (lpString=".doc") returned 4
	[0166.088] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0166.088] lstrlenW (lpString=".docx") returned 5
	[0166.088] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0166.089] lstrlenW (lpString=".pdf") returned 4
	[0166.089] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0166.089] lstrlenW (lpString=".xls") returned 4
	[0166.089] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0166.089] lstrlenW (lpString=".xlsx") returned 5
	[0166.089] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0166.089] lstrlenW (lpString=".ppt") returned 4
	[0166.089] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0166.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0166.089] lstrlenW (lpString=".zip") returned 4
	[0166.089] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0166.089] lstrlenW (lpString=".rar") returned 4
	[0166.089] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0166.089] lstrlenW (lpString=".bz2") returned 4
	[0166.089] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0166.089] lstrlenW (lpString=".7z") returned 3
	[0166.089] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0166.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0166.089] lstrlenW (lpString=".dbf") returned 4
	[0166.089] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0166.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0166.089] lstrlenW (lpString=".1cd") returned 4
	[0166.089] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0166.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0166.089] lstrlenW (lpString=".jpg") returned 4
	[0166.089] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0166.090] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.090] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31
	[0166.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0166.209] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=18624) returned 1
	[0166.209] CloseHandle (hObject=0x55c) returned 1
	[0166.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220
	[0166.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.212] lstrlenW (lpString=".doc") returned 4
	[0166.213] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.213] lstrlenW (lpString=".docx") returned 5
	[0166.213] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.213] lstrlenW (lpString=".pdf") returned 4
	[0166.213] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.213] lstrlenW (lpString=".xls") returned 4
	[0166.213] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.213] lstrlenW (lpString=".xlsx") returned 5
	[0166.213] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.213] lstrlenW (lpString=".ppt") returned 4
	[0166.213] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.213] lstrlenW (lpString=".zip") returned 4
	[0166.213] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.213] lstrlenW (lpString=".rar") returned 4
	[0166.213] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.213] lstrlenW (lpString=".bz2") returned 4
	[0166.213] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.213] lstrlenW (lpString=".7z") returned 3
	[0166.213] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.213] lstrlenW (lpString=".dbf") returned 4
	[0166.213] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.213] lstrlenW (lpString=".1cd") returned 4
	[0166.214] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.214] lstrlenW (lpString=".jpg") returned 4
	[0166.214] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.214] lstrlenW (lpString=".doc") returned 4
	[0166.214] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.214] lstrlenW (lpString=".docx") returned 5
	[0166.214] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.214] lstrlenW (lpString=".pdf") returned 4
	[0166.214] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.214] lstrlenW (lpString=".xls") returned 4
	[0166.214] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.214] lstrlenW (lpString=".xlsx") returned 5
	[0166.214] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.214] lstrlenW (lpString=".ppt") returned 4
	[0166.214] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.214] lstrlenW (lpString=".zip") returned 4
	[0166.214] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.214] lstrlenW (lpString=".rar") returned 4
	[0166.214] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.214] lstrlenW (lpString=".bz2") returned 4
	[0166.214] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.214] lstrlenW (lpString=".7z") returned 3
	[0166.214] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.215] lstrlenW (lpString=".dbf") returned 4
	[0166.215] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.215] lstrlenW (lpString=".1cd") returned 4
	[0166.215] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0166.215] lstrlenW (lpString=".jpg") returned 4
	[0166.215] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.215] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.215] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31
	[0166.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0166.216] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=18624) returned 1
	[0166.216] CloseHandle (hObject=0x55c) returned 1
	[0166.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220
	[0166.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.217] lstrlenW (lpString=".doc") returned 4
	[0166.217] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.217] lstrlenW (lpString=".docx") returned 5
	[0166.217] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.217] lstrlenW (lpString=".pdf") returned 4
	[0166.217] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.217] lstrlenW (lpString=".xls") returned 4
	[0166.217] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.217] lstrlenW (lpString=".xlsx") returned 5
	[0166.217] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.217] lstrlenW (lpString=".ppt") returned 4
	[0166.217] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.217] lstrlenW (lpString=".zip") returned 4
	[0166.217] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.217] lstrlenW (lpString=".rar") returned 4
	[0166.217] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.218] lstrlenW (lpString=".bz2") returned 4
	[0166.218] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.218] lstrlenW (lpString=".7z") returned 3
	[0166.218] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.218] lstrlenW (lpString=".dbf") returned 4
	[0166.218] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.218] lstrlenW (lpString=".1cd") returned 4
	[0166.218] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.218] lstrlenW (lpString=".jpg") returned 4
	[0166.218] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.218] lstrlenW (lpString=".doc") returned 4
	[0166.218] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.218] lstrlenW (lpString=".docx") returned 5
	[0166.218] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.218] lstrlenW (lpString=".pdf") returned 4
	[0166.218] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.218] lstrlenW (lpString=".xls") returned 4
	[0166.218] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.218] lstrlenW (lpString=".xlsx") returned 5
	[0166.218] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.218] lstrlenW (lpString=".ppt") returned 4
	[0166.218] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.219] lstrlenW (lpString=".zip") returned 4
	[0166.219] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.219] lstrlenW (lpString=".rar") returned 4
	[0166.219] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.219] lstrlenW (lpString=".bz2") returned 4
	[0166.219] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.219] lstrlenW (lpString=".7z") returned 3
	[0166.219] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.219] lstrlenW (lpString=".dbf") returned 4
	[0166.219] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.219] lstrlenW (lpString=".1cd") returned 4
	[0166.219] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0166.219] lstrlenW (lpString=".jpg") returned 4
	[0166.219] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.219] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.219] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39
	[0166.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0166.220] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=21184) returned 1
	[0166.220] CloseHandle (hObject=0x55c) returned 1
	[0166.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220
	[0166.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.221] lstrlenW (lpString=".doc") returned 4
	[0166.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.221] lstrlenW (lpString=".docx") returned 5
	[0166.221] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.221] lstrlenW (lpString=".pdf") returned 4
	[0166.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.221] lstrlenW (lpString=".xls") returned 4
	[0166.221] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.221] lstrlenW (lpString=".xlsx") returned 5
	[0166.221] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.221] lstrlenW (lpString=".ppt") returned 4
	[0166.221] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.221] lstrlenW (lpString=".zip") returned 4
	[0166.221] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.221] lstrlenW (lpString=".rar") returned 4
	[0166.221] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.221] lstrlenW (lpString=".bz2") returned 4
	[0166.221] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.221] lstrlenW (lpString=".7z") returned 3
	[0166.221] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.222] lstrlenW (lpString=".dbf") returned 4
	[0166.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.222] lstrlenW (lpString=".1cd") returned 4
	[0166.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.222] lstrlenW (lpString=".jpg") returned 4
	[0166.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.222] lstrlenW (lpString=".doc") returned 4
	[0166.222] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.222] lstrlenW (lpString=".docx") returned 5
	[0166.222] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.222] lstrlenW (lpString=".pdf") returned 4
	[0166.222] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.222] lstrlenW (lpString=".xls") returned 4
	[0166.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.222] lstrlenW (lpString=".xlsx") returned 5
	[0166.222] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.222] lstrlenW (lpString=".ppt") returned 4
	[0166.222] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.222] lstrlenW (lpString=".zip") returned 4
	[0166.222] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.222] lstrlenW (lpString=".rar") returned 4
	[0166.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.223] lstrlenW (lpString=".bz2") returned 4
	[0166.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.223] lstrlenW (lpString=".7z") returned 3
	[0166.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.223] lstrlenW (lpString=".dbf") returned 4
	[0166.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.223] lstrlenW (lpString=".1cd") returned 4
	[0166.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0166.223] lstrlenW (lpString=".jpg") returned 4
	[0166.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.224] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.224] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41
	[0166.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0166.225] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=19136) returned 1
	[0166.225] CloseHandle (hObject=0x55c) returned 1
	[0166.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220
	[0166.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.225] lstrlenW (lpString=".doc") returned 4
	[0166.225] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.225] lstrlenW (lpString=".docx") returned 5
	[0166.225] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0166.225] lstrlenW (lpString=".pdf") returned 4
	[0166.225] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.225] lstrlenW (lpString=".xls") returned 4
	[0166.226] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.226] lstrlenW (lpString=".xlsx") returned 5
	[0166.226] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0166.226] lstrlenW (lpString=".ppt") returned 4
	[0166.226] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.226] lstrlenW (lpString=".zip") returned 4
	[0166.226] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.226] lstrlenW (lpString=".rar") returned 4
	[0166.226] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.226] lstrlenW (lpString=".bz2") returned 4
	[0166.226] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.226] lstrlenW (lpString=".7z") returned 3
	[0166.226] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.226] lstrlenW (lpString=".dbf") returned 4
	[0166.226] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.226] lstrlenW (lpString=".1cd") returned 4
	[0166.226] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.226] lstrlenW (lpString=".jpg") returned 4
	[0166.226] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.226] lstrlenW (lpString=".doc") returned 4
	[0166.226] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.227] lstrlenW (lpString=".docx") returned 5
	[0166.227] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0166.227] lstrlenW (lpString=".pdf") returned 4
	[0166.227] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.227] lstrlenW (lpString=".xls") returned 4
	[0166.227] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.227] lstrlenW (lpString=".xlsx") returned 5
	[0166.227] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0166.227] lstrlenW (lpString=".ppt") returned 4
	[0166.227] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.227] lstrlenW (lpString=".zip") returned 4
	[0166.227] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.227] lstrlenW (lpString=".rar") returned 4
	[0166.227] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.227] lstrlenW (lpString=".bz2") returned 4
	[0166.227] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.227] lstrlenW (lpString=".7z") returned 3
	[0166.227] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.227] lstrlenW (lpString=".dbf") returned 4
	[0166.227] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.227] lstrlenW (lpString=".1cd") returned 4
	[0166.227] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0166.227] lstrlenW (lpString=".jpg") returned 4
	[0166.227] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.228] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.228] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32
	[0166.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0166.229] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=19136) returned 1
	[0166.229] CloseHandle (hObject=0x55c) returned 1
	[0166.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220
	[0166.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.229] lstrlenW (lpString=".doc") returned 4
	[0166.229] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.229] lstrlenW (lpString=".docx") returned 5
	[0166.229] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.229] lstrlenW (lpString=".pdf") returned 4
	[0166.230] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.230] lstrlenW (lpString=".xls") returned 4
	[0166.230] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.230] lstrlenW (lpString=".xlsx") returned 5
	[0166.230] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.230] lstrlenW (lpString=".ppt") returned 4
	[0166.230] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.230] lstrlenW (lpString=".zip") returned 4
	[0166.230] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.230] lstrlenW (lpString=".rar") returned 4
	[0166.230] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.230] lstrlenW (lpString=".bz2") returned 4
	[0166.230] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.230] lstrlenW (lpString=".7z") returned 3
	[0166.230] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.230] lstrlenW (lpString=".dbf") returned 4
	[0166.230] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.230] lstrlenW (lpString=".1cd") returned 4
	[0166.230] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.230] lstrlenW (lpString=".jpg") returned 4
	[0166.230] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.230] lstrlenW (lpString=".doc") returned 4
	[0166.231] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.231] lstrlenW (lpString=".docx") returned 5
	[0166.231] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.231] lstrlenW (lpString=".pdf") returned 4
	[0166.231] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.231] lstrlenW (lpString=".xls") returned 4
	[0166.231] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.231] lstrlenW (lpString=".xlsx") returned 5
	[0166.231] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.231] lstrlenW (lpString=".ppt") returned 4
	[0166.231] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.231] lstrlenW (lpString=".zip") returned 4
	[0166.231] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.231] lstrlenW (lpString=".rar") returned 4
	[0166.231] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.231] lstrlenW (lpString=".bz2") returned 4
	[0166.231] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.231] lstrlenW (lpString=".7z") returned 3
	[0166.231] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.231] lstrlenW (lpString=".dbf") returned 4
	[0166.231] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.231] lstrlenW (lpString=".1cd") returned 4
	[0166.231] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0166.232] lstrlenW (lpString=".jpg") returned 4
	[0166.232] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.232] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.232] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35
	[0166.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0166.234] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=18624) returned 1
	[0166.234] CloseHandle (hObject=0x55c) returned 1
	[0166.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220
	[0166.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0166.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0166.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0166.235] lstrlenW (lpString=".doc") returned 4
	[0166.235] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.235] lstrlenW (lpString=".docx") returned 5
	[0166.235] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0166.235] lstrlenW (lpString=".pdf") returned 4
	[0166.235] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.235] lstrlenW (lpString=".xls") returned 4
	[0166.235] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.235] lstrlenW (lpString=".xlsx") returned 5
	[0166.235] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0166.235] lstrlenW (lpString=".ppt") returned 4
	[0166.235] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0166.235] lstrlenW (lpString=".zip") returned 4
	[0166.235] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.235] lstrlenW (lpString=".rar") returned 4
	[0166.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.235] lstrlenW (lpString=".bz2") returned 4
	[0166.236] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.236] lstrlenW (lpString=".7z") returned 3
	[0166.236] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0166.236] lstrlenW (lpString=".dbf") returned 4
	[0166.236] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0167.229] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=10562) returned 1
	[0167.229] CloseHandle (hObject=0x53c) returned 1
	[0167.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220
	[0167.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.231] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.231] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0167.691] GetLastError () returned 0x0
	[0167.691] ReadFile (in: hFile=0x53c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2942, lpOverlapped=0x0) returned 1
	[0167.695] WriteFile (in: hFile=0x520, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2950, lpOverlapped=0x0) returned 1
	[0167.696] ReadFile (in: hFile=0x53c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.696] WriteFile (in: hFile=0x520, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.696] SetEndOfFile (hFile=0x520) returned 1
	[0167.696] CloseHandle (hObject=0x520) returned 1
	[0167.696] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.696] SetEndOfFile (hFile=0x53c) returned 1
	[0167.699] CloseHandle (hObject=0x53c) returned 1
	[0167.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1
	[0167.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.701] lstrlenW (lpString=".doc") returned 4
	[0167.701] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.701] lstrlenW (lpString=".docx") returned 5
	[0167.701] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.701] lstrlenW (lpString=".pdf") returned 4
	[0167.701] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.701] lstrlenW (lpString=".xls") returned 4
	[0167.701] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.701] lstrlenW (lpString=".xlsx") returned 5
	[0167.701] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.701] lstrlenW (lpString=".ppt") returned 4
	[0167.701] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.701] lstrlenW (lpString=".zip") returned 4
	[0167.701] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.701] lstrlenW (lpString=".rar") returned 4
	[0167.701] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.701] lstrlenW (lpString=".bz2") returned 4
	[0167.701] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.701] lstrlenW (lpString=".7z") returned 3
	[0167.701] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.701] lstrlenW (lpString=".dbf") returned 4
	[0167.701] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.701] lstrlenW (lpString=".1cd") returned 4
	[0167.701] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.702] lstrlenW (lpString=".jpg") returned 4
	[0167.702] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.702] lstrlenW (lpString=".doc") returned 4
	[0167.702] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.702] lstrlenW (lpString=".docx") returned 5
	[0167.702] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.702] lstrlenW (lpString=".pdf") returned 4
	[0167.702] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.702] lstrlenW (lpString=".xls") returned 4
	[0167.702] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.702] lstrlenW (lpString=".xlsx") returned 5
	[0167.702] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.702] lstrlenW (lpString=".ppt") returned 4
	[0167.702] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.702] lstrlenW (lpString=".zip") returned 4
	[0167.702] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.702] lstrlenW (lpString=".rar") returned 4
	[0167.702] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.702] lstrlenW (lpString=".bz2") returned 4
	[0167.702] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.702] lstrlenW (lpString=".7z") returned 3
	[0167.702] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.703] lstrlenW (lpString=".dbf") returned 4
	[0167.703] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.703] lstrlenW (lpString=".1cd") returned 4
	[0167.703] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0167.703] lstrlenW (lpString=".jpg") returned 4
	[0167.703] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.703] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0167.703] lstrlenW (lpString="HTECH_01.MID") returned 12
	[0167.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.704] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=7178) returned 1
	[0167.704] CloseHandle (hObject=0x53c) returned 1
	[0167.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220
	[0167.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.704] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.704] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0167.705] GetLastError () returned 0x0
	[0167.705] ReadFile (in: hFile=0x53c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x1c0a, lpOverlapped=0x0) returned 1
	[0167.707] WriteFile (in: hFile=0x520, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x1c10, lpOverlapped=0x0) returned 1
	[0167.708] ReadFile (in: hFile=0x53c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.708] WriteFile (in: hFile=0x520, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.708] SetEndOfFile (hFile=0x520) returned 1
	[0167.708] CloseHandle (hObject=0x520) returned 1
	[0167.709] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.709] SetEndOfFile (hFile=0x53c) returned 1
	[0167.711] CloseHandle (hObject=0x53c) returned 1
	[0167.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1
	[0167.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.713] lstrlenW (lpString=".doc") returned 4
	[0167.713] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.713] lstrlenW (lpString=".docx") returned 5
	[0167.713] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.713] lstrlenW (lpString=".pdf") returned 4
	[0167.713] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.713] lstrlenW (lpString=".xls") returned 4
	[0167.713] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.713] lstrlenW (lpString=".xlsx") returned 5
	[0167.713] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.713] lstrlenW (lpString=".ppt") returned 4
	[0167.713] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.713] lstrlenW (lpString=".zip") returned 4
	[0167.713] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.713] lstrlenW (lpString=".rar") returned 4
	[0167.713] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.713] lstrlenW (lpString=".bz2") returned 4
	[0167.713] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.714] lstrlenW (lpString=".7z") returned 3
	[0167.714] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.714] lstrlenW (lpString=".dbf") returned 4
	[0167.714] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.714] lstrlenW (lpString=".1cd") returned 4
	[0167.714] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.714] lstrlenW (lpString=".jpg") returned 4
	[0167.714] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.714] lstrlenW (lpString=".doc") returned 4
	[0167.714] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.714] lstrlenW (lpString=".docx") returned 5
	[0167.714] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.714] lstrlenW (lpString=".pdf") returned 4
	[0167.714] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.714] lstrlenW (lpString=".xls") returned 4
	[0167.714] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.714] lstrlenW (lpString=".xlsx") returned 5
	[0167.714] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.714] lstrlenW (lpString=".ppt") returned 4
	[0167.714] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.714] lstrlenW (lpString=".zip") returned 4
	[0167.715] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.715] lstrlenW (lpString=".rar") returned 4
	[0167.715] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.715] lstrlenW (lpString=".bz2") returned 4
	[0167.715] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.715] lstrlenW (lpString=".7z") returned 3
	[0167.715] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.715] lstrlenW (lpString=".dbf") returned 4
	[0167.715] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.715] lstrlenW (lpString=".1cd") returned 4
	[0167.715] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0167.715] lstrlenW (lpString=".jpg") returned 4
	[0167.715] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.715] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0167.716] lstrlenW (lpString="INDST_01.MID") returned 12
	[0167.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.716] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=8568) returned 1
	[0167.716] CloseHandle (hObject=0x53c) returned 1
	[0167.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220
	[0167.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.717] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.717] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0167.718] GetLastError () returned 0x0
	[0167.718] ReadFile (in: hFile=0x53c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2178, lpOverlapped=0x0) returned 1
	[0167.719] WriteFile (in: hFile=0x520, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2180, lpOverlapped=0x0) returned 1
	[0167.721] ReadFile (in: hFile=0x53c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.721] WriteFile (in: hFile=0x520, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.721] SetEndOfFile (hFile=0x520) returned 1
	[0167.721] CloseHandle (hObject=0x520) returned 1
	[0167.721] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.721] SetEndOfFile (hFile=0x53c) returned 1
	[0167.725] CloseHandle (hObject=0x53c) returned 1
	[0167.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1
	[0167.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0167.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0167.726] lstrlenW (lpString=".doc") returned 4
	[0167.726] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.726] lstrlenW (lpString=".docx") returned 5
	[0167.726] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.726] lstrlenW (lpString=".pdf") returned 4
	[0167.726] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.726] lstrlenW (lpString=".xls") returned 4
	[0167.726] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.726] lstrlenW (lpString=".xlsx") returned 5
	[0167.726] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.726] lstrlenW (lpString=".ppt") returned 4
	[0167.726] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0167.726] lstrlenW (lpString=".zip") returned 4
	[0167.726] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.727] lstrlenW (lpString=".rar") returned 4
	[0167.727] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.727] lstrlenW (lpString=".bz2") returned 4
	[0167.727] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.727] lstrlenW (lpString=".7z") returned 3
	[0167.727] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0167.727] lstrlenW (lpString=".dbf") returned 4
	[0167.727] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0167.727] lstrlenW (lpString=".1cd") returned 4
	[0167.727] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0167.727] lstrlenW (lpString=".jpg") returned 4
	[0167.727] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0167.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0167.727] lstrlenW (lpString=".doc") returned 4
	[0167.727] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.727] lstrlenW (lpString=".docx") returned 5
	[0167.727] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.727] lstrlenW (lpString=".pdf") returned 4
	[0167.727] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.728] lstrlenW (lpString=".xls") returned 4
	[0167.728] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.728] lstrlenW (lpString=".xlsx") returned 5
	[0167.728] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.728] lstrlenW (lpString=".ppt") returned 4
	[0167.728] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0167.728] lstrlenW (lpString=".zip") returned 4
	[0167.728] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.728] lstrlenW (lpString=".rar") returned 4
	[0167.728] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.487] lstrlenW (lpString=".bz2") returned 4
	[0168.487] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.487] lstrlenW (lpString=".7z") returned 3
	[0168.487] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0168.487] lstrlenW (lpString=".dbf") returned 4
	[0168.487] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0168.487] lstrlenW (lpString=".1cd") returned 4
	[0168.487] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0168.487] lstrlenW (lpString=".jpg") returned 4
	[0168.487] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.488] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0168.488] lstrlenW (lpString="OUTDR_01.MID") returned 12
	[0168.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0168.949] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=6644) returned 1
	[0168.949] CloseHandle (hObject=0x534) returned 1
	[0168.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220
	[0168.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0168.950] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.950] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.951] GetLastError () returned 0x0
	[0168.951] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x19f4, lpOverlapped=0x0) returned 1
	[0168.952] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x1a00, lpOverlapped=0x0) returned 1
	[0168.953] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.953] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.953] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.954] CloseHandle (hObject=0x4e0) returned 1
	[0168.954] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.954] SetEndOfFile (hFile=0x534) returned 1
	[0168.956] CloseHandle (hObject=0x534) returned 1
	[0168.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1
	[0168.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.958] lstrlenW (lpString=".doc") returned 4
	[0168.958] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.958] lstrlenW (lpString=".docx") returned 5
	[0168.958] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.958] lstrlenW (lpString=".pdf") returned 4
	[0168.958] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.958] lstrlenW (lpString=".xls") returned 4
	[0168.958] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.958] lstrlenW (lpString=".xlsx") returned 5
	[0168.958] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.958] lstrlenW (lpString=".ppt") returned 4
	[0168.958] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.958] lstrlenW (lpString=".zip") returned 4
	[0168.958] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.958] lstrlenW (lpString=".rar") returned 4
	[0168.958] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.958] lstrlenW (lpString=".bz2") returned 4
	[0168.958] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.958] lstrlenW (lpString=".7z") returned 3
	[0168.958] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.958] lstrlenW (lpString=".dbf") returned 4
	[0168.959] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.959] lstrlenW (lpString=".1cd") returned 4
	[0168.959] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.959] lstrlenW (lpString=".jpg") returned 4
	[0168.959] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.959] lstrlenW (lpString=".doc") returned 4
	[0168.959] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.959] lstrlenW (lpString=".docx") returned 5
	[0168.959] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.959] lstrlenW (lpString=".pdf") returned 4
	[0168.959] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.959] lstrlenW (lpString=".xls") returned 4
	[0168.959] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.959] lstrlenW (lpString=".xlsx") returned 5
	[0168.959] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.959] lstrlenW (lpString=".ppt") returned 4
	[0168.959] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.959] lstrlenW (lpString=".zip") returned 4
	[0168.959] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.959] lstrlenW (lpString=".rar") returned 4
	[0168.959] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.959] lstrlenW (lpString=".bz2") returned 4
	[0168.960] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.960] lstrlenW (lpString=".7z") returned 3
	[0168.960] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.960] lstrlenW (lpString=".dbf") returned 4
	[0168.960] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.960] lstrlenW (lpString=".1cd") returned 4
	[0168.960] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0168.960] lstrlenW (lpString=".jpg") returned 4
	[0168.960] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.960] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0168.960] lstrlenW (lpString="PARNT_04.MID") returned 12
	[0168.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0168.961] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=6070) returned 1
	[0168.961] CloseHandle (hObject=0x534) returned 1
	[0168.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220
	[0168.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0168.962] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.962] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.963] GetLastError () returned 0x0
	[0168.963] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x17b6, lpOverlapped=0x0) returned 1
	[0168.964] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x17c0, lpOverlapped=0x0) returned 1
	[0168.965] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.965] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.966] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.966] CloseHandle (hObject=0x4e0) returned 1
	[0168.966] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.966] SetEndOfFile (hFile=0x534) returned 1
	[0168.973] CloseHandle (hObject=0x534) returned 1
	[0168.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1
	[0168.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.974] lstrlenW (lpString=".doc") returned 4
	[0168.974] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.974] lstrlenW (lpString=".docx") returned 5
	[0168.974] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1
	[0168.974] lstrlenW (lpString=".pdf") returned 4
	[0168.974] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.974] lstrlenW (lpString=".xls") returned 4
	[0168.974] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.974] lstrlenW (lpString=".xlsx") returned 5
	[0168.974] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1
	[0168.974] lstrlenW (lpString=".ppt") returned 4
	[0168.974] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.974] lstrlenW (lpString=".zip") returned 4
	[0168.974] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.974] lstrlenW (lpString=".rar") returned 4
	[0168.974] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.974] lstrlenW (lpString=".bz2") returned 4
	[0168.974] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.974] lstrlenW (lpString=".7z") returned 3
	[0168.974] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.975] lstrlenW (lpString=".dbf") returned 4
	[0168.975] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.975] lstrlenW (lpString=".1cd") returned 4
	[0168.975] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.975] lstrlenW (lpString=".jpg") returned 4
	[0168.975] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.975] lstrlenW (lpString=".doc") returned 4
	[0168.975] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.975] lstrlenW (lpString=".docx") returned 5
	[0168.975] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1
	[0168.975] lstrlenW (lpString=".pdf") returned 4
	[0168.975] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.975] lstrlenW (lpString=".xls") returned 4
	[0168.975] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.975] lstrlenW (lpString=".xlsx") returned 5
	[0168.975] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1
	[0168.975] lstrlenW (lpString=".ppt") returned 4
	[0168.975] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.975] lstrlenW (lpString=".zip") returned 4
	[0168.975] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.975] lstrlenW (lpString=".rar") returned 4
	[0168.975] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.976] lstrlenW (lpString=".bz2") returned 4
	[0168.976] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.976] lstrlenW (lpString=".7z") returned 3
	[0168.976] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.976] lstrlenW (lpString=".dbf") returned 4
	[0168.976] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.976] lstrlenW (lpString=".1cd") returned 4
	[0168.976] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0168.976] lstrlenW (lpString=".jpg") returned 4
	[0168.976] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.976] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0168.976] lstrlenW (lpString="PARNT_05.MID") returned 12
	[0168.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0168.977] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=6020) returned 1
	[0168.977] CloseHandle (hObject=0x534) returned 1
	[0168.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220
	[0168.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0168.978] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.978] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0168.979] GetLastError () returned 0x0
	[0168.979] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x1784, lpOverlapped=0x0) returned 1
	[0168.981] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x1790, lpOverlapped=0x0) returned 1
	[0168.982] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.982] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.982] SetEndOfFile (hFile=0x4e0) returned 1
	[0168.982] CloseHandle (hObject=0x4e0) returned 1
	[0168.982] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.982] SetEndOfFile (hFile=0x534) returned 1
	[0169.119] CloseHandle (hObject=0x534) returned 1
	[0169.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1
	[0169.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.271] lstrlenW (lpString=".doc") returned 4
	[0169.271] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.271] lstrlenW (lpString=".docx") returned 5
	[0169.271] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1
	[0169.271] lstrlenW (lpString=".pdf") returned 4
	[0169.272] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.272] lstrlenW (lpString=".xls") returned 4
	[0169.272] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.272] lstrlenW (lpString=".xlsx") returned 5
	[0169.272] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1
	[0169.272] lstrlenW (lpString=".ppt") returned 4
	[0169.272] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.272] lstrlenW (lpString=".zip") returned 4
	[0169.272] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.272] lstrlenW (lpString=".rar") returned 4
	[0169.272] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.272] lstrlenW (lpString=".bz2") returned 4
	[0169.272] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.272] lstrlenW (lpString=".7z") returned 3
	[0169.272] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.272] lstrlenW (lpString=".dbf") returned 4
	[0169.272] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.272] lstrlenW (lpString=".1cd") returned 4
	[0169.272] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.272] lstrlenW (lpString=".jpg") returned 4
	[0169.272] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.273] lstrlenW (lpString=".doc") returned 4
	[0169.273] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.273] lstrlenW (lpString=".docx") returned 5
	[0169.273] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1
	[0169.273] lstrlenW (lpString=".pdf") returned 4
	[0169.273] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.273] lstrlenW (lpString=".xls") returned 4
	[0169.273] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.273] lstrlenW (lpString=".xlsx") returned 5
	[0169.273] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1
	[0169.273] lstrlenW (lpString=".ppt") returned 4
	[0169.273] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.273] lstrlenW (lpString=".zip") returned 4
	[0169.273] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.273] lstrlenW (lpString=".rar") returned 4
	[0169.273] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.273] lstrlenW (lpString=".bz2") returned 4
	[0169.273] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.273] lstrlenW (lpString=".7z") returned 3
	[0169.273] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.273] lstrlenW (lpString=".dbf") returned 4
	[0169.273] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.274] lstrlenW (lpString=".1cd") returned 4
	[0169.274] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0169.274] lstrlenW (lpString=".jpg") returned 4
	[0169.274] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.274] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.274] lstrlenW (lpString="SHOW_01.MID") returned 11
	[0169.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.275] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=6392) returned 1
	[0169.275] CloseHandle (hObject=0x55c) returned 1
	[0169.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220
	[0169.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.276] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.276] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.276] GetLastError () returned 0x0
	[0169.276] ReadFile (in: hFile=0x55c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x18f8, lpOverlapped=0x0) returned 1
	[0169.278] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x1900, lpOverlapped=0x0) returned 1
	[0169.279] ReadFile (in: hFile=0x55c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.279] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xea, lpOverlapped=0x0) returned 1
	[0169.279] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.279] CloseHandle (hObject=0x4e0) returned 1
	[0169.279] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.279] SetEndOfFile (hFile=0x55c) returned 1
	[0169.282] CloseHandle (hObject=0x55c) returned 1
	[0169.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1
	[0169.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.283] lstrlenW (lpString=".doc") returned 4
	[0169.283] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.283] lstrlenW (lpString=".docx") returned 5
	[0169.283] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.283] lstrlenW (lpString=".pdf") returned 4
	[0169.284] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.284] lstrlenW (lpString=".xls") returned 4
	[0169.284] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.284] lstrlenW (lpString=".xlsx") returned 5
	[0169.284] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.284] lstrlenW (lpString=".ppt") returned 4
	[0169.284] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.284] lstrlenW (lpString=".zip") returned 4
	[0169.284] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.284] lstrlenW (lpString=".rar") returned 4
	[0169.284] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.284] lstrlenW (lpString=".bz2") returned 4
	[0169.284] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.284] lstrlenW (lpString=".7z") returned 3
	[0169.284] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.284] lstrlenW (lpString=".dbf") returned 4
	[0169.284] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.284] lstrlenW (lpString=".1cd") returned 4
	[0169.284] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.284] lstrlenW (lpString=".jpg") returned 4
	[0169.284] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.284] lstrlenW (lpString=".doc") returned 4
	[0169.285] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.285] lstrlenW (lpString=".docx") returned 5
	[0169.285] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.285] lstrlenW (lpString=".pdf") returned 4
	[0169.285] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.285] lstrlenW (lpString=".xls") returned 4
	[0169.285] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.285] lstrlenW (lpString=".xlsx") returned 5
	[0169.285] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.285] lstrlenW (lpString=".ppt") returned 4
	[0169.285] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.285] lstrlenW (lpString=".zip") returned 4
	[0169.285] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.285] lstrlenW (lpString=".rar") returned 4
	[0169.285] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.285] lstrlenW (lpString=".bz2") returned 4
	[0169.285] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.285] lstrlenW (lpString=".7z") returned 3
	[0169.285] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.285] lstrlenW (lpString=".dbf") returned 4
	[0169.285] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.285] lstrlenW (lpString=".1cd") returned 4
	[0169.285] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0169.285] lstrlenW (lpString=".jpg") returned 4
	[0169.285] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.286] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.286] lstrlenW (lpString="SPACE_01.MID") returned 12
	[0169.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.288] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=4219) returned 1
	[0169.288] CloseHandle (hObject=0x55c) returned 1
	[0169.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220
	[0169.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.288] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.288] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.289] GetLastError () returned 0x0
	[0169.289] ReadFile (in: hFile=0x55c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x107b, lpOverlapped=0x0) returned 1
	[0169.290] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x1080, lpOverlapped=0x0) returned 1
	[0169.292] ReadFile (in: hFile=0x55c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.292] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.292] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.292] CloseHandle (hObject=0x4e0) returned 1
	[0169.292] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.292] SetEndOfFile (hFile=0x55c) returned 1
	[0169.295] CloseHandle (hObject=0x55c) returned 1
	[0169.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1
	[0169.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.296] lstrlenW (lpString=".doc") returned 4
	[0169.296] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.296] lstrlenW (lpString=".docx") returned 5
	[0169.296] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.296] lstrlenW (lpString=".pdf") returned 4
	[0169.296] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.296] lstrlenW (lpString=".xls") returned 4
	[0169.296] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.296] lstrlenW (lpString=".xlsx") returned 5
	[0169.296] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.296] lstrlenW (lpString=".ppt") returned 4
	[0169.296] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.296] lstrlenW (lpString=".zip") returned 4
	[0169.296] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.296] lstrlenW (lpString=".rar") returned 4
	[0169.296] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.296] lstrlenW (lpString=".bz2") returned 4
	[0169.297] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.297] lstrlenW (lpString=".7z") returned 3
	[0169.297] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.297] lstrlenW (lpString=".dbf") returned 4
	[0169.297] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.297] lstrlenW (lpString=".1cd") returned 4
	[0169.297] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.297] lstrlenW (lpString=".jpg") returned 4
	[0169.297] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.297] lstrlenW (lpString=".doc") returned 4
	[0169.297] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.297] lstrlenW (lpString=".docx") returned 5
	[0169.297] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.297] lstrlenW (lpString=".pdf") returned 4
	[0169.297] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.297] lstrlenW (lpString=".xls") returned 4
	[0169.297] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.297] lstrlenW (lpString=".xlsx") returned 5
	[0169.297] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.297] lstrlenW (lpString=".ppt") returned 4
	[0169.297] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.297] lstrlenW (lpString=".zip") returned 4
	[0169.298] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.298] lstrlenW (lpString=".rar") returned 4
	[0169.298] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.298] lstrlenW (lpString=".bz2") returned 4
	[0169.298] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.298] lstrlenW (lpString=".7z") returned 3
	[0169.298] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.298] lstrlenW (lpString=".dbf") returned 4
	[0169.298] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.298] lstrlenW (lpString=".1cd") returned 4
	[0169.298] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0169.298] lstrlenW (lpString=".jpg") returned 4
	[0169.298] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.298] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.298] lstrlenW (lpString="SPRNG_01.MID") returned 12
	[0169.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.300] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=6700) returned 1
	[0169.300] CloseHandle (hObject=0x55c) returned 1
	[0169.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220
	[0169.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.300] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.300] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.301] GetLastError () returned 0x0
	[0169.301] ReadFile (in: hFile=0x55c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x1a2c, lpOverlapped=0x0) returned 1
	[0169.303] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x1a30, lpOverlapped=0x0) returned 1
	[0169.304] ReadFile (in: hFile=0x55c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.304] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.304] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.304] CloseHandle (hObject=0x4e0) returned 1
	[0169.304] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.304] SetEndOfFile (hFile=0x55c) returned 1
	[0169.513] CloseHandle (hObject=0x55c) returned 1
	[0169.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1
	[0169.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.886] lstrlenW (lpString=".doc") returned 4
	[0169.886] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.886] lstrlenW (lpString=".docx") returned 5
	[0169.886] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.886] lstrlenW (lpString=".pdf") returned 4
	[0169.886] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.886] lstrlenW (lpString=".xls") returned 4
	[0169.886] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.886] lstrlenW (lpString=".xlsx") returned 5
	[0169.886] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.886] lstrlenW (lpString=".ppt") returned 4
	[0169.886] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.886] lstrlenW (lpString=".zip") returned 4
	[0169.887] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.887] lstrlenW (lpString=".rar") returned 4
	[0169.887] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.887] lstrlenW (lpString=".bz2") returned 4
	[0169.887] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.887] lstrlenW (lpString=".7z") returned 3
	[0169.887] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.887] lstrlenW (lpString=".dbf") returned 4
	[0169.887] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.887] lstrlenW (lpString=".1cd") returned 4
	[0169.887] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.887] lstrlenW (lpString=".jpg") returned 4
	[0169.887] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.887] lstrlenW (lpString=".doc") returned 4
	[0169.887] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.887] lstrlenW (lpString=".docx") returned 5
	[0169.887] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.888] lstrlenW (lpString=".pdf") returned 4
	[0169.888] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.888] lstrlenW (lpString=".xls") returned 4
	[0169.888] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.888] lstrlenW (lpString=".xlsx") returned 5
	[0169.888] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.888] lstrlenW (lpString=".ppt") returned 4
	[0169.888] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.888] lstrlenW (lpString=".zip") returned 4
	[0169.888] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.888] lstrlenW (lpString=".rar") returned 4
	[0169.888] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.888] lstrlenW (lpString=".bz2") returned 4
	[0169.888] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.888] lstrlenW (lpString=".7z") returned 3
	[0169.888] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.888] lstrlenW (lpString=".dbf") returned 4
	[0169.888] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.888] lstrlenW (lpString=".1cd") returned 4
	[0169.888] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0169.888] lstrlenW (lpString=".jpg") returned 4
	[0169.888] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.889] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0169.889] lstrlenW (lpString="Frosted Glass.eftx") returned 18
	[0169.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.889] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=334131) returned 1
	[0169.889] CloseHandle (hObject=0x534) returned 1
	[0169.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 0x220
	[0169.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0169.890] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.890] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.891] GetLastError () returned 0x0
	[0169.891] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x51933, lpOverlapped=0x0) returned 1
	[0169.905] WriteFile (in: hFile=0x550, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x51940, lpOverlapped=0x0) returned 1
	[0169.911] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.911] WriteFile (in: hFile=0x550, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0169.911] SetEndOfFile (hFile=0x550) returned 1
	[0169.912] CloseHandle (hObject=0x550) returned 1
	[0169.912] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.912] SetEndOfFile (hFile=0x534) returned 1
	[0170.034] CloseHandle (hObject=0x534) returned 1
	[0170.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1
	[0170.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.524] lstrlenW (lpString=".doc") returned 4
	[0170.524] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.524] lstrlenW (lpString=".docx") returned 5
	[0170.524] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.524] lstrlenW (lpString=".pdf") returned 4
	[0170.524] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.524] lstrlenW (lpString=".xls") returned 4
	[0170.524] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.524] lstrlenW (lpString=".xlsx") returned 5
	[0170.524] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.524] lstrlenW (lpString=".ppt") returned 4
	[0170.524] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.524] lstrlenW (lpString=".zip") returned 4
	[0170.524] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.524] lstrlenW (lpString=".rar") returned 4
	[0170.524] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.524] lstrlenW (lpString=".bz2") returned 4
	[0170.524] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.524] lstrlenW (lpString=".7z") returned 3
	[0170.524] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.524] lstrlenW (lpString=".dbf") returned 4
	[0170.524] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.525] lstrlenW (lpString=".1cd") returned 4
	[0170.525] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.525] lstrlenW (lpString=".jpg") returned 4
	[0170.525] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.525] lstrlenW (lpString=".doc") returned 4
	[0170.525] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.525] lstrlenW (lpString=".docx") returned 5
	[0170.525] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.525] lstrlenW (lpString=".pdf") returned 4
	[0170.525] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.525] lstrlenW (lpString=".xls") returned 4
	[0170.525] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.525] lstrlenW (lpString=".xlsx") returned 5
	[0170.525] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.525] lstrlenW (lpString=".ppt") returned 4
	[0170.525] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.525] lstrlenW (lpString=".zip") returned 4
	[0170.525] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.525] lstrlenW (lpString=".rar") returned 4
	[0170.525] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.525] lstrlenW (lpString=".bz2") returned 4
	[0170.525] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.525] lstrlenW (lpString=".7z") returned 3
	[0170.526] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.526] lstrlenW (lpString=".dbf") returned 4
	[0170.526] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.526] lstrlenW (lpString=".1cd") returned 4
	[0170.526] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0170.526] lstrlenW (lpString=".jpg") returned 4
	[0170.526] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.526] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0170.526] lstrlenW (lpString="Office 2007 - 2010.eftx") returned 23
	[0170.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0170.527] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=45229) returned 1
	[0170.527] CloseHandle (hObject=0x4e4) returned 1
	[0170.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220
	[0170.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0170.528] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.528] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0170.529] GetLastError () returned 0x0
	[0170.529] ReadFile (in: hFile=0x4e4, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0xb0ad, lpOverlapped=0x0) returned 1
	[0170.532] WriteFile (in: hFile=0x4f0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xb0b0, lpOverlapped=0x0) returned 1
	[0170.533] ReadFile (in: hFile=0x4e4, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.533] WriteFile (in: hFile=0x4f0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x102, lpOverlapped=0x0) returned 1
	[0170.533] SetEndOfFile (hFile=0x4f0) returned 1
	[0170.534] CloseHandle (hObject=0x4f0) returned 1
	[0170.534] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.534] SetEndOfFile (hFile=0x4e4) returned 1
	[0170.537] CloseHandle (hObject=0x4e4) returned 1
	[0170.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1
	[0170.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.538] lstrlenW (lpString=".doc") returned 4
	[0170.538] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.538] lstrlenW (lpString=".docx") returned 5
	[0170.538] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.538] lstrlenW (lpString=".pdf") returned 4
	[0170.538] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.539] lstrlenW (lpString=".xls") returned 4
	[0170.539] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.539] lstrlenW (lpString=".xlsx") returned 5
	[0170.539] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.539] lstrlenW (lpString=".ppt") returned 4
	[0170.539] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.539] lstrlenW (lpString=".zip") returned 4
	[0170.539] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.539] lstrlenW (lpString=".rar") returned 4
	[0170.539] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.539] lstrlenW (lpString=".bz2") returned 4
	[0170.539] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.539] lstrlenW (lpString=".7z") returned 3
	[0170.539] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.539] lstrlenW (lpString=".dbf") returned 4
	[0170.539] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.539] lstrlenW (lpString=".1cd") returned 4
	[0170.539] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.539] lstrlenW (lpString=".jpg") returned 4
	[0170.539] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.540] lstrlenW (lpString=".doc") returned 4
	[0170.540] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.540] lstrlenW (lpString=".docx") returned 5
	[0170.540] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.540] lstrlenW (lpString=".pdf") returned 4
	[0170.540] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.540] lstrlenW (lpString=".xls") returned 4
	[0170.540] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.540] lstrlenW (lpString=".xlsx") returned 5
	[0170.540] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.540] lstrlenW (lpString=".ppt") returned 4
	[0170.540] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.540] lstrlenW (lpString=".zip") returned 4
	[0170.540] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.540] lstrlenW (lpString=".rar") returned 4
	[0170.540] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.540] lstrlenW (lpString=".bz2") returned 4
	[0170.540] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.540] lstrlenW (lpString=".7z") returned 3
	[0170.540] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.540] lstrlenW (lpString=".dbf") returned 4
	[0170.540] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.540] lstrlenW (lpString=".1cd") returned 4
	[0170.540] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0170.540] lstrlenW (lpString=".jpg") returned 4
	[0170.541] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.541] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0170.541] lstrlenW (lpString="Reflection.eftx") returned 15
	[0170.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0170.542] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=48366) returned 1
	[0170.542] CloseHandle (hObject=0x4e4) returned 1
	[0170.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220
	[0170.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0170.543] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.543] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0170.543] GetLastError () returned 0x0
	[0170.543] ReadFile (in: hFile=0x4e4, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0xbcee, lpOverlapped=0x0) returned 1
	[0170.546] WriteFile (in: hFile=0x4f0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xbcf0, lpOverlapped=0x0) returned 1
	[0170.554] ReadFile (in: hFile=0x4e4, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.554] WriteFile (in: hFile=0x4f0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0170.554] SetEndOfFile (hFile=0x4f0) returned 1
	[0170.555] CloseHandle (hObject=0x4f0) returned 1
	[0170.555] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.555] SetEndOfFile (hFile=0x4e4) returned 1
	[0170.967] CloseHandle (hObject=0x4e4) returned 1
	[0170.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1
	[0171.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.165] lstrlenW (lpString=".doc") returned 4
	[0171.165] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.165] lstrlenW (lpString=".docx") returned 5
	[0171.165] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.165] lstrlenW (lpString=".pdf") returned 4
	[0171.165] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.165] lstrlenW (lpString=".xls") returned 4
	[0171.165] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.166] lstrlenW (lpString=".xlsx") returned 5
	[0171.166] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.166] lstrlenW (lpString=".ppt") returned 4
	[0171.166] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.166] lstrlenW (lpString=".zip") returned 4
	[0171.166] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.166] lstrlenW (lpString=".rar") returned 4
	[0171.166] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.166] lstrlenW (lpString=".bz2") returned 4
	[0171.166] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.166] lstrlenW (lpString=".7z") returned 3
	[0171.166] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.166] lstrlenW (lpString=".dbf") returned 4
	[0171.166] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.166] lstrlenW (lpString=".1cd") returned 4
	[0171.166] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.166] lstrlenW (lpString=".jpg") returned 4
	[0171.166] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.166] lstrlenW (lpString=".doc") returned 4
	[0171.166] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.167] lstrlenW (lpString=".docx") returned 5
	[0171.167] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.167] lstrlenW (lpString=".pdf") returned 4
	[0171.167] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.167] lstrlenW (lpString=".xls") returned 4
	[0171.167] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.167] lstrlenW (lpString=".xlsx") returned 5
	[0171.167] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.167] lstrlenW (lpString=".ppt") returned 4
	[0171.167] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.167] lstrlenW (lpString=".zip") returned 4
	[0171.167] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.167] lstrlenW (lpString=".rar") returned 4
	[0171.167] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.167] lstrlenW (lpString=".bz2") returned 4
	[0171.167] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.167] lstrlenW (lpString=".7z") returned 3
	[0171.168] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.168] lstrlenW (lpString=".dbf") returned 4
	[0171.168] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.168] lstrlenW (lpString=".1cd") returned 4
	[0171.168] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0171.168] lstrlenW (lpString=".jpg") returned 4
	[0171.168] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.168] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0171.168] lstrlenW (lpString="Smokey Glass.eftx") returned 17
	[0171.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0171.169] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=186195) returned 1
	[0171.169] CloseHandle (hObject=0x514) returned 1
	[0171.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220
	[0171.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0171.170] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.170] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.171] GetLastError () returned 0x0
	[0171.171] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d753, lpOverlapped=0x0) returned 1
	[0171.178] WriteFile (in: hFile=0x4e4, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d760, lpOverlapped=0x0) returned 1
	[0171.182] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.182] WriteFile (in: hFile=0x4e4, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0171.182] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.182] CloseHandle (hObject=0x4e4) returned 1
	[0171.182] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.184] SetEndOfFile (hFile=0x514) returned 1
	[0171.190] CloseHandle (hObject=0x514) returned 1
	[0171.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1
	[0171.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.191] lstrlenW (lpString=".doc") returned 4
	[0171.191] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.191] lstrlenW (lpString=".docx") returned 5
	[0171.191] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.191] lstrlenW (lpString=".pdf") returned 4
	[0171.191] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.191] lstrlenW (lpString=".xls") returned 4
	[0171.191] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.191] lstrlenW (lpString=".xlsx") returned 5
	[0171.191] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.191] lstrlenW (lpString=".ppt") returned 4
	[0171.191] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.191] lstrlenW (lpString=".zip") returned 4
	[0171.191] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.191] lstrlenW (lpString=".rar") returned 4
	[0171.191] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.192] lstrlenW (lpString=".bz2") returned 4
	[0171.192] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.192] lstrlenW (lpString=".7z") returned 3
	[0171.192] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.192] lstrlenW (lpString=".dbf") returned 4
	[0171.192] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.192] lstrlenW (lpString=".1cd") returned 4
	[0171.192] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.192] lstrlenW (lpString=".jpg") returned 4
	[0171.192] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.192] lstrlenW (lpString=".doc") returned 4
	[0171.192] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.192] lstrlenW (lpString=".docx") returned 5
	[0171.192] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.192] lstrlenW (lpString=".pdf") returned 4
	[0171.192] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.192] lstrlenW (lpString=".xls") returned 4
	[0171.192] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.192] lstrlenW (lpString=".xlsx") returned 5
	[0171.192] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.192] lstrlenW (lpString=".ppt") returned 4
	[0171.192] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.193] lstrlenW (lpString=".zip") returned 4
	[0171.193] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.193] lstrlenW (lpString=".rar") returned 4
	[0171.193] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.193] lstrlenW (lpString=".bz2") returned 4
	[0171.193] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.193] lstrlenW (lpString=".7z") returned 3
	[0171.193] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.193] lstrlenW (lpString=".dbf") returned 4
	[0171.193] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.193] lstrlenW (lpString=".1cd") returned 4
	[0171.193] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0171.193] lstrlenW (lpString=".jpg") returned 4
	[0171.193] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.193] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0171.193] lstrlenW (lpString="Subtle Solids.eftx") returned 18
	[0171.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0171.194] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=45435) returned 1
	[0171.194] CloseHandle (hObject=0x514) returned 1
	[0171.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220
	[0171.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0171.195] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.195] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0171.196] GetLastError () returned 0x0
	[0171.196] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0xb17b, lpOverlapped=0x0) returned 1
	[0171.200] WriteFile (in: hFile=0x4e4, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xb180, lpOverlapped=0x0) returned 1
	[0171.202] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.202] WriteFile (in: hFile=0x4e4, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0171.202] SetEndOfFile (hFile=0x4e4) returned 1
	[0171.202] CloseHandle (hObject=0x4e4) returned 1
	[0171.202] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.202] SetEndOfFile (hFile=0x514) returned 1
	[0172.034] CloseHandle (hObject=0x514) returned 1
	[0172.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0172.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1
	[0173.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.110] lstrlenW (lpString=".doc") returned 4
	[0173.110] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0173.110] lstrlenW (lpString=".docx") returned 5
	[0173.110] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0173.110] lstrlenW (lpString=".pdf") returned 4
	[0173.110] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0173.110] lstrlenW (lpString=".xls") returned 4
	[0173.110] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0173.110] lstrlenW (lpString=".xlsx") returned 5
	[0173.110] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0173.110] lstrlenW (lpString=".ppt") returned 4
	[0173.110] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0173.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.110] lstrlenW (lpString=".zip") returned 4
	[0173.110] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0173.110] lstrlenW (lpString=".rar") returned 4
	[0173.110] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0173.111] lstrlenW (lpString=".bz2") returned 4
	[0173.111] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0173.111] lstrlenW (lpString=".7z") returned 3
	[0173.111] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0173.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.111] lstrlenW (lpString=".dbf") returned 4
	[0173.111] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0173.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.111] lstrlenW (lpString=".1cd") returned 4
	[0173.111] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0173.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.111] lstrlenW (lpString=".jpg") returned 4
	[0173.111] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0173.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.111] lstrlenW (lpString=".doc") returned 4
	[0173.111] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0173.111] lstrlenW (lpString=".docx") returned 5
	[0173.111] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0173.111] lstrlenW (lpString=".pdf") returned 4
	[0173.111] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0173.111] lstrlenW (lpString=".xls") returned 4
	[0173.111] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0173.111] lstrlenW (lpString=".xlsx") returned 5
	[0173.111] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0173.111] lstrlenW (lpString=".ppt") returned 4
	[0173.111] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0173.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.111] lstrlenW (lpString=".zip") returned 4
	[0173.111] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0173.112] lstrlenW (lpString=".rar") returned 4
	[0173.112] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0173.112] lstrlenW (lpString=".bz2") returned 4
	[0173.112] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0173.112] lstrlenW (lpString=".7z") returned 3
	[0173.112] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0173.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.112] lstrlenW (lpString=".dbf") returned 4
	[0173.112] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0173.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.112] lstrlenW (lpString=".1cd") returned 4
	[0173.112] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0173.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0173.112] lstrlenW (lpString=".jpg") returned 4
	[0173.112] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0173.112] lstrcmpiW (lpString1=".msu", lpString2=".money") returned 1
	[0173.112] lstrlenW (lpString="Windows8-RT-KB2999226-x86.msu") returned 29
	[0173.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.235] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=615304) returned 1
	[0173.236] CloseHandle (hObject=0x444) returned 1
	[0173.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220
	[0173.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0173.267] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.267] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0173.268] GetLastError () returned 0x0
	[0173.268] ReadFile (in: hFile=0x444, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x96388, lpOverlapped=0x0) returned 1
	[0173.287] WriteFile (in: hFile=0x4b8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x96390, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x96390, lpOverlapped=0x0) returned 1
	[0173.507] ReadFile (in: hFile=0x444, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.508] WriteFile (in: hFile=0x4b8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0173.508] SetEndOfFile (hFile=0x4b8) returned 1
	[0173.508] CloseHandle (hObject=0x4b8) returned 1
	[0173.508] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.508] SetEndOfFile (hFile=0x444) returned 1
	[0173.522] CloseHandle (hObject=0x444) returned 1
	[0173.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0173.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 1
	[0173.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.689] lstrlenW (lpString=".doc") returned 4
	[0173.689] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0173.689] lstrlenW (lpString=".docx") returned 5
	[0173.689] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0173.689] lstrlenW (lpString=".pdf") returned 4
	[0173.689] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0173.689] lstrlenW (lpString=".xls") returned 4
	[0173.689] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0173.689] lstrlenW (lpString=".xlsx") returned 5
	[0173.689] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0173.689] lstrlenW (lpString=".ppt") returned 4
	[0173.690] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0173.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.690] lstrlenW (lpString=".zip") returned 4
	[0173.690] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0173.690] lstrlenW (lpString=".rar") returned 4
	[0173.690] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0173.690] lstrlenW (lpString=".bz2") returned 4
	[0173.690] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0173.690] lstrlenW (lpString=".7z") returned 3
	[0173.690] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0173.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.690] lstrlenW (lpString=".dbf") returned 4
	[0173.690] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0173.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.690] lstrlenW (lpString=".1cd") returned 4
	[0173.690] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0173.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.690] lstrlenW (lpString=".jpg") returned 4
	[0173.690] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0173.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.690] lstrlenW (lpString=".doc") returned 4
	[0173.690] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0173.690] lstrlenW (lpString=".docx") returned 5
	[0173.690] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0173.690] lstrlenW (lpString=".pdf") returned 4
	[0173.690] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0173.690] lstrlenW (lpString=".xls") returned 4
	[0173.690] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0173.691] lstrlenW (lpString=".xlsx") returned 5
	[0173.691] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0173.691] lstrlenW (lpString=".ppt") returned 4
	[0173.691] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0173.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.691] lstrlenW (lpString=".zip") returned 4
	[0173.691] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0173.691] lstrlenW (lpString=".rar") returned 4
	[0173.691] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0173.691] lstrlenW (lpString=".bz2") returned 4
	[0173.691] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0173.691] lstrlenW (lpString=".7z") returned 3
	[0173.691] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0173.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.691] lstrlenW (lpString=".dbf") returned 4
	[0173.691] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0173.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.691] lstrlenW (lpString=".1cd") returned 4
	[0173.691] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0173.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0173.691] lstrlenW (lpString=".jpg") returned 4
	[0173.691] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0173.691] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0173.691] lstrlenW (lpString="AccessR_Grace-ppd.xrm-ms") returned 24
	[0173.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0173.694] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=20775) returned 1
	[0173.694] CloseHandle (hObject=0x370) returned 1
	[0173.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 0x220
	[0173.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0173.695] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.695] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0173.697] GetLastError () returned 0x0
	[0173.697] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x5127, lpOverlapped=0x0) returned 1
	[0173.701] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x5130, lpOverlapped=0x0) returned 1
	[0173.702] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.702] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x104, lpOverlapped=0x0) returned 1
	[0173.702] SetEndOfFile (hFile=0x54c) returned 1
	[0173.702] CloseHandle (hObject=0x54c) returned 1
	[0173.703] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.703] SetEndOfFile (hFile=0x370) returned 1
	[0173.707] CloseHandle (hObject=0x370) returned 1
	[0173.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 1
	[0174.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.648] lstrlenW (lpString=".doc") returned 4
	[0174.648] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.648] lstrlenW (lpString=".docx") returned 5
	[0174.648] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.648] lstrlenW (lpString=".pdf") returned 4
	[0174.648] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.648] lstrlenW (lpString=".xls") returned 4
	[0174.648] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.648] lstrlenW (lpString=".xlsx") returned 5
	[0174.648] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.648] lstrlenW (lpString=".ppt") returned 4
	[0174.648] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.648] lstrlenW (lpString=".zip") returned 4
	[0174.648] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.648] lstrlenW (lpString=".rar") returned 4
	[0174.648] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.648] lstrlenW (lpString=".bz2") returned 4
	[0174.648] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.649] lstrlenW (lpString=".7z") returned 3
	[0174.649] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.649] lstrlenW (lpString=".dbf") returned 4
	[0174.649] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.649] lstrlenW (lpString=".1cd") returned 4
	[0174.649] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.649] lstrlenW (lpString=".jpg") returned 4
	[0174.649] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.649] lstrlenW (lpString=".doc") returned 4
	[0174.649] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.649] lstrlenW (lpString=".docx") returned 5
	[0174.649] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.649] lstrlenW (lpString=".pdf") returned 4
	[0174.649] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.649] lstrlenW (lpString=".xls") returned 4
	[0174.649] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.649] lstrlenW (lpString=".xlsx") returned 5
	[0174.649] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.649] lstrlenW (lpString=".ppt") returned 4
	[0174.649] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.649] lstrlenW (lpString=".zip") returned 4
	[0174.649] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.649] lstrlenW (lpString=".rar") returned 4
	[0174.649] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.650] lstrlenW (lpString=".bz2") returned 4
	[0174.650] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.650] lstrlenW (lpString=".7z") returned 3
	[0174.650] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.650] lstrlenW (lpString=".dbf") returned 4
	[0174.650] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.650] lstrlenW (lpString=".1cd") returned 4
	[0174.650] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0174.650] lstrlenW (lpString=".jpg") returned 4
	[0174.650] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.650] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0174.650] lstrlenW (lpString="AccessR_OEM_Perp-ul-phn.xrm-ms") returned 30
	[0174.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.664] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=19932) returned 1
	[0174.664] CloseHandle (hObject=0x514) returned 1
	[0174.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0174.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.669] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.669] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0174.670] GetLastError () returned 0x0
	[0174.670] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x4ddc, lpOverlapped=0x0) returned 1
	[0174.672] WriteFile (in: hFile=0x52c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0174.673] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.673] WriteFile (in: hFile=0x52c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x110, lpOverlapped=0x0) returned 1
	[0174.673] SetEndOfFile (hFile=0x52c) returned 1
	[0174.673] CloseHandle (hObject=0x52c) returned 1
	[0174.674] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.674] SetEndOfFile (hFile=0x514) returned 1
	[0174.676] CloseHandle (hObject=0x514) returned 1
	[0174.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0174.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.677] lstrlenW (lpString=".doc") returned 4
	[0174.678] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.678] lstrlenW (lpString=".docx") returned 5
	[0174.678] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.678] lstrlenW (lpString=".pdf") returned 4
	[0174.678] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.678] lstrlenW (lpString=".xls") returned 4
	[0174.678] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.678] lstrlenW (lpString=".xlsx") returned 5
	[0174.678] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.678] lstrlenW (lpString=".ppt") returned 4
	[0174.678] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.678] lstrlenW (lpString=".zip") returned 4
	[0174.678] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.678] lstrlenW (lpString=".rar") returned 4
	[0174.678] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.678] lstrlenW (lpString=".bz2") returned 4
	[0174.678] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.678] lstrlenW (lpString=".7z") returned 3
	[0174.678] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.678] lstrlenW (lpString=".dbf") returned 4
	[0174.678] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.678] lstrlenW (lpString=".1cd") returned 4
	[0174.678] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.678] lstrlenW (lpString=".jpg") returned 4
	[0174.678] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.679] lstrlenW (lpString=".doc") returned 4
	[0174.679] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.679] lstrlenW (lpString=".docx") returned 5
	[0174.679] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.679] lstrlenW (lpString=".pdf") returned 4
	[0174.679] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.679] lstrlenW (lpString=".xls") returned 4
	[0174.679] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.679] lstrlenW (lpString=".xlsx") returned 5
	[0174.679] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.679] lstrlenW (lpString=".ppt") returned 4
	[0174.679] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.679] lstrlenW (lpString=".zip") returned 4
	[0174.679] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.679] lstrlenW (lpString=".rar") returned 4
	[0174.679] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.679] lstrlenW (lpString=".bz2") returned 4
	[0174.679] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.679] lstrlenW (lpString=".7z") returned 3
	[0174.679] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.679] lstrlenW (lpString=".dbf") returned 4
	[0174.679] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.679] lstrlenW (lpString=".1cd") returned 4
	[0174.679] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0174.679] lstrlenW (lpString=".jpg") returned 4
	[0174.679] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.680] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0174.680] lstrlenW (lpString="AccessR_Retail-pl.xrm-ms") returned 24
	[0174.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.680] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=10631) returned 1
	[0174.680] CloseHandle (hObject=0x514) returned 1
	[0174.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220
	[0174.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.684] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.684] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0174.685] GetLastError () returned 0x0
	[0174.685] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2987, lpOverlapped=0x0) returned 1
	[0174.686] WriteFile (in: hFile=0x52c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0174.688] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.688] WriteFile (in: hFile=0x52c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x104, lpOverlapped=0x0) returned 1
	[0174.688] SetEndOfFile (hFile=0x52c) returned 1
	[0174.688] CloseHandle (hObject=0x52c) returned 1
	[0174.688] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.688] SetEndOfFile (hFile=0x514) returned 1
	[0174.690] CloseHandle (hObject=0x514) returned 1
	[0174.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 1
	[0174.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.691] lstrlenW (lpString=".doc") returned 4
	[0174.691] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.691] lstrlenW (lpString=".docx") returned 5
	[0174.691] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.691] lstrlenW (lpString=".pdf") returned 4
	[0174.691] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.691] lstrlenW (lpString=".xls") returned 4
	[0174.692] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.692] lstrlenW (lpString=".xlsx") returned 5
	[0174.692] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.692] lstrlenW (lpString=".ppt") returned 4
	[0174.692] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.692] lstrlenW (lpString=".zip") returned 4
	[0174.692] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.692] lstrlenW (lpString=".rar") returned 4
	[0174.692] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.692] lstrlenW (lpString=".bz2") returned 4
	[0174.692] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.692] lstrlenW (lpString=".7z") returned 3
	[0174.692] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.692] lstrlenW (lpString=".dbf") returned 4
	[0174.692] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.692] lstrlenW (lpString=".1cd") returned 4
	[0174.692] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.692] lstrlenW (lpString=".jpg") returned 4
	[0174.692] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.692] lstrlenW (lpString=".doc") returned 4
	[0174.692] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.692] lstrlenW (lpString=".docx") returned 5
	[0174.692] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.692] lstrlenW (lpString=".pdf") returned 4
	[0174.692] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.693] lstrlenW (lpString=".xls") returned 4
	[0174.693] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.693] lstrlenW (lpString=".xlsx") returned 5
	[0174.693] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.693] lstrlenW (lpString=".ppt") returned 4
	[0174.693] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.693] lstrlenW (lpString=".zip") returned 4
	[0174.693] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.693] lstrlenW (lpString=".rar") returned 4
	[0174.693] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.693] lstrlenW (lpString=".bz2") returned 4
	[0174.693] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.693] lstrlenW (lpString=".7z") returned 3
	[0174.693] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.693] lstrlenW (lpString=".dbf") returned 4
	[0174.693] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.693] lstrlenW (lpString=".1cd") returned 4
	[0174.693] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0174.693] lstrlenW (lpString=".jpg") returned 4
	[0174.693] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.693] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0174.693] lstrlenW (lpString="AccessR_Retail-ppd.xrm-ms") returned 25
	[0174.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.694] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=20778) returned 1
	[0174.694] CloseHandle (hObject=0x514) returned 1
	[0174.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220
	[0174.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0174.695] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.695] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0174.695] GetLastError () returned 0x0
	[0174.695] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x512a, lpOverlapped=0x0) returned 1
	[0174.697] WriteFile (in: hFile=0x52c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x5130, lpOverlapped=0x0) returned 1
	[0174.699] ReadFile (in: hFile=0x514, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.699] WriteFile (in: hFile=0x52c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x106, lpOverlapped=0x0) returned 1
	[0174.699] SetEndOfFile (hFile=0x52c) returned 1
	[0174.699] CloseHandle (hObject=0x52c) returned 1
	[0174.699] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.699] SetEndOfFile (hFile=0x514) returned 1
	[0174.803] CloseHandle (hObject=0x514) returned 1
	[0174.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 1
	[0175.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.067] lstrlenW (lpString=".doc") returned 4
	[0175.067] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.067] lstrlenW (lpString=".docx") returned 5
	[0175.067] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.067] lstrlenW (lpString=".pdf") returned 4
	[0175.067] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.067] lstrlenW (lpString=".xls") returned 4
	[0175.067] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.067] lstrlenW (lpString=".xlsx") returned 5
	[0175.067] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.067] lstrlenW (lpString=".ppt") returned 4
	[0175.067] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.067] lstrlenW (lpString=".zip") returned 4
	[0175.067] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.067] lstrlenW (lpString=".rar") returned 4
	[0175.067] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.067] lstrlenW (lpString=".bz2") returned 4
	[0175.067] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.067] lstrlenW (lpString=".7z") returned 3
	[0175.067] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.067] lstrlenW (lpString=".dbf") returned 4
	[0175.067] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.067] lstrlenW (lpString=".1cd") returned 4
	[0175.067] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.068] lstrlenW (lpString=".jpg") returned 4
	[0175.068] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.068] lstrlenW (lpString=".doc") returned 4
	[0175.068] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.068] lstrlenW (lpString=".docx") returned 5
	[0175.068] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.068] lstrlenW (lpString=".pdf") returned 4
	[0175.068] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.068] lstrlenW (lpString=".xls") returned 4
	[0175.068] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.068] lstrlenW (lpString=".xlsx") returned 5
	[0175.068] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.068] lstrlenW (lpString=".ppt") returned 4
	[0175.068] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.068] lstrlenW (lpString=".zip") returned 4
	[0175.068] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.068] lstrlenW (lpString=".rar") returned 4
	[0175.068] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.068] lstrlenW (lpString=".bz2") returned 4
	[0175.068] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.068] lstrlenW (lpString=".7z") returned 3
	[0175.068] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.068] lstrlenW (lpString=".dbf") returned 4
	[0175.068] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.069] lstrlenW (lpString=".1cd") returned 4
	[0175.069] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0175.069] lstrlenW (lpString=".jpg") returned 4
	[0175.069] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.069] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.069] lstrlenW (lpString="AccessR_Trial-ppd.xrm-ms") returned 24
	[0175.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.361] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=20901) returned 1
	[0175.361] CloseHandle (hObject=0x538) returned 1
	[0175.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220
	[0175.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0175.980] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.980] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.306] GetLastError () returned 0x0
	[0176.306] ReadFile (in: hFile=0x4f0, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x51a5, lpOverlapped=0x0) returned 1
	[0176.308] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x51b0, lpOverlapped=0x0) returned 1
	[0176.309] ReadFile (in: hFile=0x4f0, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.310] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x104, lpOverlapped=0x0) returned 1
	[0176.310] SetEndOfFile (hFile=0x524) returned 1
	[0176.310] CloseHandle (hObject=0x524) returned 1
	[0176.310] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.310] SetEndOfFile (hFile=0x4f0) returned 1
	[0176.313] CloseHandle (hObject=0x4f0) returned 1
	[0176.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 1
	[0176.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.314] lstrlenW (lpString=".doc") returned 4
	[0176.314] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.314] lstrlenW (lpString=".docx") returned 5
	[0176.314] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.314] lstrlenW (lpString=".pdf") returned 4
	[0176.314] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.314] lstrlenW (lpString=".xls") returned 4
	[0176.314] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.314] lstrlenW (lpString=".xlsx") returned 5
	[0176.314] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.315] lstrlenW (lpString=".ppt") returned 4
	[0176.315] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.315] lstrlenW (lpString=".zip") returned 4
	[0176.315] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.315] lstrlenW (lpString=".rar") returned 4
	[0176.315] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.315] lstrlenW (lpString=".bz2") returned 4
	[0176.315] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.315] lstrlenW (lpString=".7z") returned 3
	[0176.315] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.315] lstrlenW (lpString=".dbf") returned 4
	[0176.315] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.315] lstrlenW (lpString=".1cd") returned 4
	[0176.315] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.315] lstrlenW (lpString=".jpg") returned 4
	[0176.315] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.315] lstrlenW (lpString=".doc") returned 4
	[0176.315] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.315] lstrlenW (lpString=".docx") returned 5
	[0176.315] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.315] lstrlenW (lpString=".pdf") returned 4
	[0176.315] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.315] lstrlenW (lpString=".xls") returned 4
	[0176.315] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.316] lstrlenW (lpString=".xlsx") returned 5
	[0176.316] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.316] lstrlenW (lpString=".ppt") returned 4
	[0176.316] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.316] lstrlenW (lpString=".zip") returned 4
	[0176.316] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.316] lstrlenW (lpString=".rar") returned 4
	[0176.316] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.316] lstrlenW (lpString=".bz2") returned 4
	[0176.316] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.316] lstrlenW (lpString=".7z") returned 3
	[0176.316] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.316] lstrlenW (lpString=".dbf") returned 4
	[0176.316] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.316] lstrlenW (lpString=".1cd") returned 4
	[0176.316] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0176.316] lstrlenW (lpString=".jpg") returned 4
	[0176.316] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.316] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.316] lstrlenW (lpString="ExcelR_OEM_Perp-ppd.xrm-ms") returned 26
	[0176.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0176.317] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=20846) returned 1
	[0176.317] CloseHandle (hObject=0x4f0) returned 1
	[0176.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0176.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0176.318] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.318] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.318] GetLastError () returned 0x0
	[0176.318] ReadFile (in: hFile=0x4f0, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x516e, lpOverlapped=0x0) returned 1
	[0176.320] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x5170, lpOverlapped=0x0) returned 1
	[0176.321] ReadFile (in: hFile=0x4f0, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.322] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x108, lpOverlapped=0x0) returned 1
	[0176.322] SetEndOfFile (hFile=0x524) returned 1
	[0176.322] CloseHandle (hObject=0x524) returned 1
	[0176.322] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.322] SetEndOfFile (hFile=0x4f0) returned 1
	[0176.327] CloseHandle (hObject=0x4f0) returned 1
	[0176.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 1
	[0176.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.329] lstrlenW (lpString=".doc") returned 4
	[0176.329] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.329] lstrlenW (lpString=".docx") returned 5
	[0176.329] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.329] lstrlenW (lpString=".pdf") returned 4
	[0176.329] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.329] lstrlenW (lpString=".xls") returned 4
	[0176.329] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.329] lstrlenW (lpString=".xlsx") returned 5
	[0176.329] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.329] lstrlenW (lpString=".ppt") returned 4
	[0176.329] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.329] lstrlenW (lpString=".zip") returned 4
	[0176.329] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.329] lstrlenW (lpString=".rar") returned 4
	[0176.329] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.329] lstrlenW (lpString=".bz2") returned 4
	[0176.329] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.329] lstrlenW (lpString=".7z") returned 3
	[0176.329] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.329] lstrlenW (lpString=".dbf") returned 4
	[0176.329] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.329] lstrlenW (lpString=".1cd") returned 4
	[0176.329] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.329] lstrlenW (lpString=".jpg") returned 4
	[0176.329] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.330] lstrlenW (lpString=".doc") returned 4
	[0176.330] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.330] lstrlenW (lpString=".docx") returned 5
	[0176.330] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.330] lstrlenW (lpString=".pdf") returned 4
	[0176.330] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.330] lstrlenW (lpString=".xls") returned 4
	[0176.330] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.330] lstrlenW (lpString=".xlsx") returned 5
	[0176.330] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.330] lstrlenW (lpString=".ppt") returned 4
	[0176.330] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.330] lstrlenW (lpString=".zip") returned 4
	[0176.330] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.330] lstrlenW (lpString=".rar") returned 4
	[0176.330] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.330] lstrlenW (lpString=".bz2") returned 4
	[0176.330] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.330] lstrlenW (lpString=".7z") returned 3
	[0176.330] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.330] lstrlenW (lpString=".dbf") returned 4
	[0176.330] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.330] lstrlenW (lpString=".1cd") returned 4
	[0176.330] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0176.331] lstrlenW (lpString=".jpg") returned 4
	[0176.331] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.331] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.331] lstrlenW (lpString="ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 29
	[0176.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0176.331] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11582) returned 1
	[0176.331] CloseHandle (hObject=0x4f0) returned 1
	[0176.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0176.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0176.332] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.332] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.333] GetLastError () returned 0x0
	[0176.333] ReadFile (in: hFile=0x4f0, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d3e, lpOverlapped=0x0) returned 1
	[0176.334] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0176.335] ReadFile (in: hFile=0x4f0, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.335] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0176.336] SetEndOfFile (hFile=0x524) returned 1
	[0176.336] CloseHandle (hObject=0x524) returned 1
	[0176.336] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.336] SetEndOfFile (hFile=0x4f0) returned 1
	[0176.338] CloseHandle (hObject=0x4f0) returned 1
	[0176.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0176.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.340] lstrlenW (lpString=".doc") returned 4
	[0176.340] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.340] lstrlenW (lpString=".docx") returned 5
	[0176.340] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.340] lstrlenW (lpString=".pdf") returned 4
	[0176.340] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.340] lstrlenW (lpString=".xls") returned 4
	[0176.340] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.340] lstrlenW (lpString=".xlsx") returned 5
	[0176.340] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.340] lstrlenW (lpString=".ppt") returned 4
	[0176.340] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.340] lstrlenW (lpString=".zip") returned 4
	[0176.340] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.340] lstrlenW (lpString=".rar") returned 4
	[0176.340] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.340] lstrlenW (lpString=".bz2") returned 4
	[0176.340] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.340] lstrlenW (lpString=".7z") returned 3
	[0176.340] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.340] lstrlenW (lpString=".dbf") returned 4
	[0176.340] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.340] lstrlenW (lpString=".1cd") returned 4
	[0176.341] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.341] lstrlenW (lpString=".jpg") returned 4
	[0176.341] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.341] lstrlenW (lpString=".doc") returned 4
	[0176.341] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.341] lstrlenW (lpString=".docx") returned 5
	[0176.341] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.341] lstrlenW (lpString=".pdf") returned 4
	[0176.341] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.341] lstrlenW (lpString=".xls") returned 4
	[0176.341] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.341] lstrlenW (lpString=".xlsx") returned 5
	[0176.341] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.341] lstrlenW (lpString=".ppt") returned 4
	[0176.341] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.341] lstrlenW (lpString=".zip") returned 4
	[0176.341] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.341] lstrlenW (lpString=".rar") returned 4
	[0176.341] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.341] lstrlenW (lpString=".bz2") returned 4
	[0176.341] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.341] lstrlenW (lpString=".7z") returned 3
	[0176.341] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.341] lstrlenW (lpString=".dbf") returned 4
	[0176.341] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.342] lstrlenW (lpString=".1cd") returned 4
	[0176.342] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0176.342] lstrlenW (lpString=".jpg") returned 4
	[0176.342] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.342] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.342] lstrlenW (lpString="ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 29
	[0176.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0176.343] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=19927) returned 1
	[0176.343] CloseHandle (hObject=0x4f0) returned 1
	[0176.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0176.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.521] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.521] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.522] GetLastError () returned 0x0
	[0176.522] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x4dd7, lpOverlapped=0x0) returned 1
	[0176.524] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0176.525] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.525] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0176.525] SetEndOfFile (hFile=0x524) returned 1
	[0176.525] CloseHandle (hObject=0x524) returned 1
	[0176.525] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.525] SetEndOfFile (hFile=0x51c) returned 1
	[0176.528] CloseHandle (hObject=0x51c) returned 1
	[0176.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0176.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.529] lstrlenW (lpString=".doc") returned 4
	[0176.529] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.529] lstrlenW (lpString=".docx") returned 5
	[0176.529] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.529] lstrlenW (lpString=".pdf") returned 4
	[0176.529] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.529] lstrlenW (lpString=".xls") returned 4
	[0176.529] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.529] lstrlenW (lpString=".xlsx") returned 5
	[0176.530] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.530] lstrlenW (lpString=".ppt") returned 4
	[0176.530] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.530] lstrlenW (lpString=".zip") returned 4
	[0176.530] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.530] lstrlenW (lpString=".rar") returned 4
	[0176.530] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.530] lstrlenW (lpString=".bz2") returned 4
	[0176.530] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.530] lstrlenW (lpString=".7z") returned 3
	[0176.530] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.530] lstrlenW (lpString=".dbf") returned 4
	[0176.530] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.530] lstrlenW (lpString=".1cd") returned 4
	[0176.530] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.530] lstrlenW (lpString=".jpg") returned 4
	[0176.530] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.531] lstrlenW (lpString=".doc") returned 4
	[0176.531] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.531] lstrlenW (lpString=".docx") returned 5
	[0176.531] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.531] lstrlenW (lpString=".pdf") returned 4
	[0176.531] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.531] lstrlenW (lpString=".xls") returned 4
	[0176.531] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.531] lstrlenW (lpString=".xlsx") returned 5
	[0176.531] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.531] lstrlenW (lpString=".ppt") returned 4
	[0176.531] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.531] lstrlenW (lpString=".zip") returned 4
	[0176.531] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.531] lstrlenW (lpString=".rar") returned 4
	[0176.531] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.531] lstrlenW (lpString=".bz2") returned 4
	[0176.531] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.531] lstrlenW (lpString=".7z") returned 3
	[0176.531] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.531] lstrlenW (lpString=".dbf") returned 4
	[0176.531] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.531] lstrlenW (lpString=".1cd") returned 4
	[0176.531] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0176.531] lstrlenW (lpString=".jpg") returned 4
	[0176.531] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.532] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.532] lstrlenW (lpString="ExcelR_Retail-ul-phn.xrm-ms") returned 27
	[0176.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.533] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=19919) returned 1
	[0176.533] CloseHandle (hObject=0x51c) returned 1
	[0176.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 0x220
	[0176.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.534] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.534] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.534] GetLastError () returned 0x0
	[0176.534] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x4dcf, lpOverlapped=0x0) returned 1
	[0176.536] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x4dd0, lpOverlapped=0x0) returned 1
	[0176.537] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.538] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0176.538] SetEndOfFile (hFile=0x524) returned 1
	[0176.538] CloseHandle (hObject=0x524) returned 1
	[0176.538] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.538] SetEndOfFile (hFile=0x51c) returned 1
	[0176.541] CloseHandle (hObject=0x51c) returned 1
	[0176.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 1
	[0176.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.542] lstrlenW (lpString=".doc") returned 4
	[0176.542] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.542] lstrlenW (lpString=".docx") returned 5
	[0176.542] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.542] lstrlenW (lpString=".pdf") returned 4
	[0176.542] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.542] lstrlenW (lpString=".xls") returned 4
	[0176.542] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.542] lstrlenW (lpString=".xlsx") returned 5
	[0176.542] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.542] lstrlenW (lpString=".ppt") returned 4
	[0176.542] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.542] lstrlenW (lpString=".zip") returned 4
	[0176.542] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.542] lstrlenW (lpString=".rar") returned 4
	[0176.542] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.542] lstrlenW (lpString=".bz2") returned 4
	[0176.542] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.542] lstrlenW (lpString=".7z") returned 3
	[0176.542] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.542] lstrlenW (lpString=".dbf") returned 4
	[0176.542] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.542] lstrlenW (lpString=".1cd") returned 4
	[0176.542] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.543] lstrlenW (lpString=".jpg") returned 4
	[0176.543] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.543] lstrlenW (lpString=".doc") returned 4
	[0176.543] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.543] lstrlenW (lpString=".docx") returned 5
	[0176.543] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.543] lstrlenW (lpString=".pdf") returned 4
	[0176.543] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.543] lstrlenW (lpString=".xls") returned 4
	[0176.543] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.543] lstrlenW (lpString=".xlsx") returned 5
	[0176.543] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.543] lstrlenW (lpString=".ppt") returned 4
	[0176.543] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.543] lstrlenW (lpString=".zip") returned 4
	[0176.543] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.543] lstrlenW (lpString=".rar") returned 4
	[0176.543] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.543] lstrlenW (lpString=".bz2") returned 4
	[0176.543] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.543] lstrlenW (lpString=".7z") returned 3
	[0176.543] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.543] lstrlenW (lpString=".dbf") returned 4
	[0176.543] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.543] lstrlenW (lpString=".1cd") returned 4
	[0176.544] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0176.544] lstrlenW (lpString=".jpg") returned 4
	[0176.544] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.544] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.544] lstrlenW (lpString="ExcelR_Trial-pl.xrm-ms") returned 22
	[0176.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.544] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11139) returned 1
	[0176.545] CloseHandle (hObject=0x51c) returned 1
	[0176.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220
	[0176.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.545] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.545] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.546] GetLastError () returned 0x0
	[0176.546] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2b83, lpOverlapped=0x0) returned 1
	[0176.548] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0176.549] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.549] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x100, lpOverlapped=0x0) returned 1
	[0176.549] SetEndOfFile (hFile=0x524) returned 1
	[0176.549] CloseHandle (hObject=0x524) returned 1
	[0176.549] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.549] SetEndOfFile (hFile=0x51c) returned 1
	[0176.553] CloseHandle (hObject=0x51c) returned 1
	[0176.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0176.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 1
	[0176.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.554] lstrlenW (lpString=".doc") returned 4
	[0176.554] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.554] lstrlenW (lpString=".docx") returned 5
	[0176.554] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.554] lstrlenW (lpString=".pdf") returned 4
	[0176.554] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.554] lstrlenW (lpString=".xls") returned 4
	[0176.555] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString=".xlsx") returned 5
	[0176.555] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.555] lstrlenW (lpString=".ppt") returned 4
	[0176.555] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.555] lstrlenW (lpString=".zip") returned 4
	[0176.555] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString=".rar") returned 4
	[0176.555] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString=".bz2") returned 4
	[0176.555] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString=".7z") returned 3
	[0176.555] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.555] lstrlenW (lpString=".dbf") returned 4
	[0176.555] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.555] lstrlenW (lpString=".1cd") returned 4
	[0176.555] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.555] lstrlenW (lpString=".jpg") returned 4
	[0176.555] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.555] lstrlenW (lpString=".doc") returned 4
	[0176.555] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString=".docx") returned 5
	[0176.555] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.555] lstrlenW (lpString=".pdf") returned 4
	[0176.555] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString=".xls") returned 4
	[0176.556] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.556] lstrlenW (lpString=".xlsx") returned 5
	[0176.556] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.556] lstrlenW (lpString=".ppt") returned 4
	[0176.556] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.556] lstrlenW (lpString=".zip") returned 4
	[0176.556] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.556] lstrlenW (lpString=".rar") returned 4
	[0176.556] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.556] lstrlenW (lpString=".bz2") returned 4
	[0176.556] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.556] lstrlenW (lpString=".7z") returned 3
	[0176.556] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.556] lstrlenW (lpString=".dbf") returned 4
	[0176.556] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.556] lstrlenW (lpString=".1cd") returned 4
	[0176.556] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0176.556] lstrlenW (lpString=".jpg") returned 4
	[0176.556] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.556] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.556] lstrlenW (lpString="ExcelR_Trial-ppd.xrm-ms") returned 23
	[0176.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.557] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=20967) returned 1
	[0176.557] CloseHandle (hObject=0x51c) returned 1
	[0176.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220
	[0176.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0176.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0176.558] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.558] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0176.558] GetLastError () returned 0x0
	[0176.558] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x51e7, lpOverlapped=0x0) returned 1
	[0176.729] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x51f0, lpOverlapped=0x0) returned 1
	[0176.731] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.731] WriteFile (in: hFile=0x524, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x102, lpOverlapped=0x0) returned 1
	[0176.731] SetEndOfFile (hFile=0x524) returned 1
	[0176.731] CloseHandle (hObject=0x524) returned 1
	[0176.735] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.735] SetEndOfFile (hFile=0x51c) returned 1
	[0176.738] CloseHandle (hObject=0x51c) returned 1
	[0176.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 1
	[0177.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.267] lstrlenW (lpString=".doc") returned 4
	[0177.267] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.267] lstrlenW (lpString=".docx") returned 5
	[0177.267] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.267] lstrlenW (lpString=".pdf") returned 4
	[0177.267] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.267] lstrlenW (lpString=".xls") returned 4
	[0177.267] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.267] lstrlenW (lpString=".xlsx") returned 5
	[0177.268] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.268] lstrlenW (lpString=".ppt") returned 4
	[0177.268] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.268] lstrlenW (lpString=".zip") returned 4
	[0177.268] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.268] lstrlenW (lpString=".rar") returned 4
	[0177.268] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.268] lstrlenW (lpString=".bz2") returned 4
	[0177.268] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.268] lstrlenW (lpString=".7z") returned 3
	[0177.268] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.268] lstrlenW (lpString=".dbf") returned 4
	[0177.268] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.268] lstrlenW (lpString=".1cd") returned 4
	[0177.268] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.268] lstrlenW (lpString=".jpg") returned 4
	[0177.268] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.268] lstrlenW (lpString=".doc") returned 4
	[0177.268] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.268] lstrlenW (lpString=".docx") returned 5
	[0177.268] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.268] lstrlenW (lpString=".pdf") returned 4
	[0177.268] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.268] lstrlenW (lpString=".xls") returned 4
	[0177.269] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.269] lstrlenW (lpString=".xlsx") returned 5
	[0177.269] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.269] lstrlenW (lpString=".ppt") returned 4
	[0177.269] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.269] lstrlenW (lpString=".zip") returned 4
	[0177.269] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.269] lstrlenW (lpString=".rar") returned 4
	[0177.269] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.269] lstrlenW (lpString=".bz2") returned 4
	[0177.269] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.269] lstrlenW (lpString=".7z") returned 3
	[0177.269] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.269] lstrlenW (lpString=".dbf") returned 4
	[0177.269] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.269] lstrlenW (lpString=".1cd") returned 4
	[0177.269] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0177.269] lstrlenW (lpString=".jpg") returned 4
	[0177.269] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.269] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0177.269] lstrlenW (lpString="ExcelR_Trial-ul-oob.xrm-ms") returned 26
	[0177.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0177.457] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11586) returned 1
	[0177.457] CloseHandle (hObject=0x534) returned 1
	[0177.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220
	[0177.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0177.458] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.458] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0177.459] GetLastError () returned 0x0
	[0177.459] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d42, lpOverlapped=0x0) returned 1
	[0177.462] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0177.463] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.463] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x108, lpOverlapped=0x0) returned 1
	[0177.463] SetEndOfFile (hFile=0x55c) returned 1
	[0177.463] CloseHandle (hObject=0x55c) returned 1
	[0177.463] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.463] SetEndOfFile (hFile=0x534) returned 1
	[0177.466] CloseHandle (hObject=0x534) returned 1
	[0177.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 1
	[0177.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.468] lstrlenW (lpString=".doc") returned 4
	[0177.468] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.468] lstrlenW (lpString=".docx") returned 5
	[0177.468] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.468] lstrlenW (lpString=".pdf") returned 4
	[0177.468] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.468] lstrlenW (lpString=".xls") returned 4
	[0177.468] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.468] lstrlenW (lpString=".xlsx") returned 5
	[0177.468] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.468] lstrlenW (lpString=".ppt") returned 4
	[0177.468] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.469] lstrlenW (lpString=".zip") returned 4
	[0177.469] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.469] lstrlenW (lpString=".rar") returned 4
	[0177.469] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.469] lstrlenW (lpString=".bz2") returned 4
	[0177.469] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.469] lstrlenW (lpString=".7z") returned 3
	[0177.469] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.469] lstrlenW (lpString=".dbf") returned 4
	[0177.469] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.469] lstrlenW (lpString=".1cd") returned 4
	[0177.469] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.469] lstrlenW (lpString=".jpg") returned 4
	[0177.469] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.469] lstrlenW (lpString=".doc") returned 4
	[0177.469] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.469] lstrlenW (lpString=".docx") returned 5
	[0177.469] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.469] lstrlenW (lpString=".pdf") returned 4
	[0177.469] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.469] lstrlenW (lpString=".xls") returned 4
	[0177.469] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.469] lstrlenW (lpString=".xlsx") returned 5
	[0177.469] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.470] lstrlenW (lpString=".ppt") returned 4
	[0177.470] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.470] lstrlenW (lpString=".zip") returned 4
	[0177.470] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.470] lstrlenW (lpString=".rar") returned 4
	[0177.470] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.470] lstrlenW (lpString=".bz2") returned 4
	[0177.470] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.470] lstrlenW (lpString=".7z") returned 3
	[0177.470] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.470] lstrlenW (lpString=".dbf") returned 4
	[0177.470] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.470] lstrlenW (lpString=".1cd") returned 4
	[0177.470] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0177.470] lstrlenW (lpString=".jpg") returned 4
	[0177.470] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.470] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0177.470] lstrlenW (lpString="ExcelVL_KMS_Client-ppd.xrm-ms") returned 29
	[0177.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0177.471] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=6860) returned 1
	[0177.471] CloseHandle (hObject=0x534) returned 1
	[0177.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220
	[0177.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0177.472] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.472] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0177.473] GetLastError () returned 0x0
	[0177.473] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x1acc, lpOverlapped=0x0) returned 1
	[0177.474] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x1ad0, lpOverlapped=0x0) returned 1
	[0177.475] ReadFile (in: hFile=0x534, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.475] WriteFile (in: hFile=0x55c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0177.475] SetEndOfFile (hFile=0x55c) returned 1
	[0177.476] CloseHandle (hObject=0x55c) returned 1
	[0177.476] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.476] SetEndOfFile (hFile=0x534) returned 1
	[0177.478] CloseHandle (hObject=0x534) returned 1
	[0177.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 1
	[0177.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.966] lstrlenW (lpString=".doc") returned 4
	[0177.966] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.966] lstrlenW (lpString=".docx") returned 5
	[0177.966] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.966] lstrlenW (lpString=".pdf") returned 4
	[0177.966] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.966] lstrlenW (lpString=".xls") returned 4
	[0177.966] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.966] lstrlenW (lpString=".xlsx") returned 5
	[0177.966] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.966] lstrlenW (lpString=".ppt") returned 4
	[0177.966] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.966] lstrlenW (lpString=".zip") returned 4
	[0177.966] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.966] lstrlenW (lpString=".rar") returned 4
	[0177.966] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.966] lstrlenW (lpString=".bz2") returned 4
	[0177.966] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.966] lstrlenW (lpString=".7z") returned 3
	[0177.966] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.966] lstrlenW (lpString=".dbf") returned 4
	[0177.966] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.966] lstrlenW (lpString=".1cd") returned 4
	[0177.967] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.967] lstrlenW (lpString=".jpg") returned 4
	[0177.967] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.967] lstrlenW (lpString=".doc") returned 4
	[0177.967] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.967] lstrlenW (lpString=".docx") returned 5
	[0177.967] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.967] lstrlenW (lpString=".pdf") returned 4
	[0177.967] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.967] lstrlenW (lpString=".xls") returned 4
	[0177.967] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.967] lstrlenW (lpString=".xlsx") returned 5
	[0177.967] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.967] lstrlenW (lpString=".ppt") returned 4
	[0177.967] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.967] lstrlenW (lpString=".zip") returned 4
	[0177.967] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.967] lstrlenW (lpString=".rar") returned 4
	[0177.967] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.967] lstrlenW (lpString=".bz2") returned 4
	[0177.967] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.967] lstrlenW (lpString=".7z") returned 3
	[0177.967] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.967] lstrlenW (lpString=".dbf") returned 4
	[0177.967] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.968] lstrlenW (lpString=".1cd") returned 4
	[0177.968] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0177.968] lstrlenW (lpString=".jpg") returned 4
	[0177.968] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.069] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.069] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46
	[0178.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.070] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11674) returned 1
	[0178.070] CloseHandle (hObject=0x4e0) returned 1
	[0178.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0178.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.071] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.071] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.072] GetLastError () returned 0x0
	[0178.072] ReadFile (in: hFile=0x4e0, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d9a, lpOverlapped=0x0) returned 1
	[0178.077] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0178.078] ReadFile (in: hFile=0x4e0, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.078] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x130, lpOverlapped=0x0) returned 1
	[0178.078] SetEndOfFile (hFile=0x514) returned 1
	[0178.079] CloseHandle (hObject=0x514) returned 1
	[0178.079] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.079] SetEndOfFile (hFile=0x4e0) returned 1
	[0178.081] CloseHandle (hObject=0x4e0) returned 1
	[0178.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0178.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.082] lstrlenW (lpString=".doc") returned 4
	[0178.082] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.082] lstrlenW (lpString=".docx") returned 5
	[0178.082] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.082] lstrlenW (lpString=".pdf") returned 4
	[0178.083] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.083] lstrlenW (lpString=".xls") returned 4
	[0178.083] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.083] lstrlenW (lpString=".xlsx") returned 5
	[0178.083] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.083] lstrlenW (lpString=".ppt") returned 4
	[0178.083] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.083] lstrlenW (lpString=".zip") returned 4
	[0178.083] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.083] lstrlenW (lpString=".rar") returned 4
	[0178.083] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.083] lstrlenW (lpString=".bz2") returned 4
	[0178.083] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.083] lstrlenW (lpString=".7z") returned 3
	[0178.083] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.083] lstrlenW (lpString=".dbf") returned 4
	[0178.083] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.083] lstrlenW (lpString=".1cd") returned 4
	[0178.083] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.083] lstrlenW (lpString=".jpg") returned 4
	[0178.083] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.083] lstrlenW (lpString=".doc") returned 4
	[0178.083] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.083] lstrlenW (lpString=".docx") returned 5
	[0178.083] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.084] lstrlenW (lpString=".pdf") returned 4
	[0178.084] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.084] lstrlenW (lpString=".xls") returned 4
	[0178.084] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.084] lstrlenW (lpString=".xlsx") returned 5
	[0178.084] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.084] lstrlenW (lpString=".ppt") returned 4
	[0178.084] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.084] lstrlenW (lpString=".zip") returned 4
	[0178.084] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.084] lstrlenW (lpString=".rar") returned 4
	[0178.084] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.084] lstrlenW (lpString=".bz2") returned 4
	[0178.084] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.084] lstrlenW (lpString=".7z") returned 3
	[0178.084] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.084] lstrlenW (lpString=".dbf") returned 4
	[0178.084] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.084] lstrlenW (lpString=".1cd") returned 4
	[0178.084] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0178.084] lstrlenW (lpString=".jpg") returned 4
	[0178.084] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.085] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.085] lstrlenW (lpString="HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 37
	[0178.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.085] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11644) returned 1
	[0178.085] CloseHandle (hObject=0x4e0) returned 1
	[0178.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220
	[0178.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0178.086] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.086] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.087] GetLastError () returned 0x0
	[0178.087] ReadFile (in: hFile=0x4e0, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d7c, lpOverlapped=0x0) returned 1
	[0178.091] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0178.092] ReadFile (in: hFile=0x4e0, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.092] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0178.092] SetEndOfFile (hFile=0x514) returned 1
	[0178.093] CloseHandle (hObject=0x514) returned 1
	[0178.093] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.093] SetEndOfFile (hFile=0x4e0) returned 1
	[0178.102] CloseHandle (hObject=0x4e0) returned 1
	[0178.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 1
	[0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.315] lstrlenW (lpString=".doc") returned 4
	[0178.315] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.315] lstrlenW (lpString=".docx") returned 5
	[0178.315] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.315] lstrlenW (lpString=".pdf") returned 4
	[0178.315] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.315] lstrlenW (lpString=".xls") returned 4
	[0178.315] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.315] lstrlenW (lpString=".xlsx") returned 5
	[0178.315] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.315] lstrlenW (lpString=".ppt") returned 4
	[0178.315] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.315] lstrlenW (lpString=".zip") returned 4
	[0178.315] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.315] lstrlenW (lpString=".rar") returned 4
	[0178.315] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.315] lstrlenW (lpString=".bz2") returned 4
	[0178.315] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.315] lstrlenW (lpString=".7z") returned 3
	[0178.315] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.316] lstrlenW (lpString=".dbf") returned 4
	[0178.316] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.316] lstrlenW (lpString=".1cd") returned 4
	[0178.316] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.316] lstrlenW (lpString=".jpg") returned 4
	[0178.316] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.316] lstrlenW (lpString=".doc") returned 4
	[0178.316] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.316] lstrlenW (lpString=".docx") returned 5
	[0178.316] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.316] lstrlenW (lpString=".pdf") returned 4
	[0178.316] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.316] lstrlenW (lpString=".xls") returned 4
	[0178.316] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.316] lstrlenW (lpString=".xlsx") returned 5
	[0178.316] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.316] lstrlenW (lpString=".ppt") returned 4
	[0178.316] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.316] lstrlenW (lpString=".zip") returned 4
	[0178.316] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.316] lstrlenW (lpString=".rar") returned 4
	[0178.316] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.316] lstrlenW (lpString=".bz2") returned 4
	[0178.316] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.316] lstrlenW (lpString=".7z") returned 3
	[0178.317] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.317] lstrlenW (lpString=".dbf") returned 4
	[0178.317] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.317] lstrlenW (lpString=".1cd") returned 4
	[0178.317] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0178.317] lstrlenW (lpString=".jpg") returned 4
	[0178.317] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.317] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.317] lstrlenW (lpString="HomeBusinessR_Grace-ul-oob.xrm-ms") returned 33
	[0178.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0178.318] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11624) returned 1
	[0178.318] CloseHandle (hObject=0x540) returned 1
	[0178.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 0x220
	[0178.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0178.318] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.318] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0178.319] GetLastError () returned 0x0
	[0178.319] ReadFile (in: hFile=0x540, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d68, lpOverlapped=0x0) returned 1
	[0178.322] WriteFile (in: hFile=0x444, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0178.323] ReadFile (in: hFile=0x540, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.323] WriteFile (in: hFile=0x444, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x116, lpOverlapped=0x0) returned 1
	[0178.324] SetEndOfFile (hFile=0x444) returned 1
	[0178.335] CloseHandle (hObject=0x444) returned 1
	[0178.335] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.335] SetEndOfFile (hFile=0x540) returned 1
	[0178.542] CloseHandle (hObject=0x540) returned 1
	[0178.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 1
	[0179.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.212] lstrlenW (lpString=".doc") returned 4
	[0179.212] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.212] lstrlenW (lpString=".docx") returned 5
	[0179.212] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.212] lstrlenW (lpString=".pdf") returned 4
	[0179.212] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.212] lstrlenW (lpString=".xls") returned 4
	[0179.212] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.213] lstrlenW (lpString=".xlsx") returned 5
	[0179.213] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.213] lstrlenW (lpString=".ppt") returned 4
	[0179.213] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.213] lstrlenW (lpString=".zip") returned 4
	[0179.213] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.213] lstrlenW (lpString=".rar") returned 4
	[0179.213] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.213] lstrlenW (lpString=".bz2") returned 4
	[0179.213] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.213] lstrlenW (lpString=".7z") returned 3
	[0179.213] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.213] lstrlenW (lpString=".dbf") returned 4
	[0179.213] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.213] lstrlenW (lpString=".1cd") returned 4
	[0179.213] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.213] lstrlenW (lpString=".jpg") returned 4
	[0179.213] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.213] lstrlenW (lpString=".doc") returned 4
	[0179.213] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.213] lstrlenW (lpString=".docx") returned 5
	[0179.213] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.213] lstrlenW (lpString=".pdf") returned 4
	[0179.213] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.213] lstrlenW (lpString=".xls") returned 4
	[0179.214] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.214] lstrlenW (lpString=".xlsx") returned 5
	[0179.214] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.214] lstrlenW (lpString=".ppt") returned 4
	[0179.214] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.214] lstrlenW (lpString=".zip") returned 4
	[0179.214] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.214] lstrlenW (lpString=".rar") returned 4
	[0179.214] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.214] lstrlenW (lpString=".bz2") returned 4
	[0179.214] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.214] lstrlenW (lpString=".7z") returned 3
	[0179.214] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.214] lstrlenW (lpString=".dbf") returned 4
	[0179.214] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.214] lstrlenW (lpString=".1cd") returned 4
	[0179.214] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0179.214] lstrlenW (lpString=".jpg") returned 4
	[0179.214] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.214] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0179.214] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 34
	[0179.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.215] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=22094) returned 1
	[0179.215] CloseHandle (hObject=0x4e4) returned 1
	[0179.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220
	[0179.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.216] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.216] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.216] GetLastError () returned 0x0
	[0179.217] ReadFile (in: hFile=0x4e4, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x564e, lpOverlapped=0x0) returned 1
	[0179.219] WriteFile (in: hFile=0x370, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0179.220] ReadFile (in: hFile=0x4e4, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.220] WriteFile (in: hFile=0x370, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x118, lpOverlapped=0x0) returned 1
	[0179.220] SetEndOfFile (hFile=0x370) returned 1
	[0179.220] CloseHandle (hObject=0x370) returned 1
	[0179.220] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.220] SetEndOfFile (hFile=0x4e4) returned 1
	[0179.226] CloseHandle (hObject=0x4e4) returned 1
	[0179.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 1
	[0179.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.227] lstrlenW (lpString=".doc") returned 4
	[0179.227] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.227] lstrlenW (lpString=".docx") returned 5
	[0179.227] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.227] lstrlenW (lpString=".pdf") returned 4
	[0179.227] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.227] lstrlenW (lpString=".xls") returned 4
	[0179.227] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.227] lstrlenW (lpString=".xlsx") returned 5
	[0179.227] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.227] lstrlenW (lpString=".ppt") returned 4
	[0179.227] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.227] lstrlenW (lpString=".zip") returned 4
	[0179.227] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.227] lstrlenW (lpString=".rar") returned 4
	[0179.227] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.227] lstrlenW (lpString=".bz2") returned 4
	[0179.228] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.228] lstrlenW (lpString=".7z") returned 3
	[0179.228] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.228] lstrlenW (lpString=".dbf") returned 4
	[0179.228] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.228] lstrlenW (lpString=".1cd") returned 4
	[0179.228] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.228] lstrlenW (lpString=".jpg") returned 4
	[0179.228] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.228] lstrlenW (lpString=".doc") returned 4
	[0179.228] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.228] lstrlenW (lpString=".docx") returned 5
	[0179.228] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.228] lstrlenW (lpString=".pdf") returned 4
	[0179.228] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.228] lstrlenW (lpString=".xls") returned 4
	[0179.228] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.228] lstrlenW (lpString=".xlsx") returned 5
	[0179.228] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.228] lstrlenW (lpString=".ppt") returned 4
	[0179.228] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.228] lstrlenW (lpString=".zip") returned 4
	[0179.228] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.228] lstrlenW (lpString=".rar") returned 4
	[0179.229] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.229] lstrlenW (lpString=".bz2") returned 4
	[0179.229] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.229] lstrlenW (lpString=".7z") returned 3
	[0179.229] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.229] lstrlenW (lpString=".dbf") returned 4
	[0179.229] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.229] lstrlenW (lpString=".1cd") returned 4
	[0179.229] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0179.229] lstrlenW (lpString=".jpg") returned 4
	[0179.229] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.229] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0179.229] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 37
	[0179.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.230] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11621) returned 1
	[0179.230] CloseHandle (hObject=0x4e4) returned 1
	[0179.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220
	[0179.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.230] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.230] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.231] GetLastError () returned 0x0
	[0179.231] ReadFile (in: hFile=0x4e4, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0179.233] WriteFile (in: hFile=0x370, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0179.234] ReadFile (in: hFile=0x4e4, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.234] WriteFile (in: hFile=0x370, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0179.234] SetEndOfFile (hFile=0x370) returned 1
	[0179.234] CloseHandle (hObject=0x370) returned 1
	[0179.234] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.234] SetEndOfFile (hFile=0x4e4) returned 1
	[0179.237] CloseHandle (hObject=0x4e4) returned 1
	[0179.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 1
	[0179.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.238] lstrlenW (lpString=".doc") returned 4
	[0179.238] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.238] lstrlenW (lpString=".docx") returned 5
	[0179.238] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.238] lstrlenW (lpString=".pdf") returned 4
	[0179.238] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.238] lstrlenW (lpString=".xls") returned 4
	[0179.238] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.238] lstrlenW (lpString=".xlsx") returned 5
	[0179.238] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.238] lstrlenW (lpString=".ppt") returned 4
	[0179.238] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.238] lstrlenW (lpString=".zip") returned 4
	[0179.238] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.238] lstrlenW (lpString=".rar") returned 4
	[0179.238] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.238] lstrlenW (lpString=".bz2") returned 4
	[0179.238] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.238] lstrlenW (lpString=".7z") returned 3
	[0179.238] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.239] lstrlenW (lpString=".dbf") returned 4
	[0179.239] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.239] lstrlenW (lpString=".1cd") returned 4
	[0179.239] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.239] lstrlenW (lpString=".jpg") returned 4
	[0179.239] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.239] lstrlenW (lpString=".doc") returned 4
	[0179.239] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.239] lstrlenW (lpString=".docx") returned 5
	[0179.239] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.239] lstrlenW (lpString=".pdf") returned 4
	[0179.239] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.239] lstrlenW (lpString=".xls") returned 4
	[0179.239] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.239] lstrlenW (lpString=".xlsx") returned 5
	[0179.239] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.239] lstrlenW (lpString=".ppt") returned 4
	[0179.239] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.239] lstrlenW (lpString=".zip") returned 4
	[0179.239] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.239] lstrlenW (lpString=".rar") returned 4
	[0179.239] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.239] lstrlenW (lpString=".bz2") returned 4
	[0179.239] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.239] lstrlenW (lpString=".7z") returned 3
	[0179.240] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.240] lstrlenW (lpString=".dbf") returned 4
	[0179.240] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.240] lstrlenW (lpString=".1cd") returned 4
	[0179.240] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0179.240] lstrlenW (lpString=".jpg") returned 4
	[0179.240] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.240] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0179.240] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 37
	[0179.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.241] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=19966) returned 1
	[0179.241] CloseHandle (hObject=0x4e4) returned 1
	[0179.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 0x220
	[0179.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0179.241] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.241] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0179.242] GetLastError () returned 0x0
	[0179.242] ReadFile (in: hFile=0x4e4, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x4dfe, lpOverlapped=0x0) returned 1
	[0179.415] WriteFile (in: hFile=0x370, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0179.416] ReadFile (in: hFile=0x4e4, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.416] WriteFile (in: hFile=0x370, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0179.416] SetEndOfFile (hFile=0x370) returned 1
	[0179.417] CloseHandle (hObject=0x370) returned 1
	[0179.417] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.417] SetEndOfFile (hFile=0x4e4) returned 1
	[0179.419] CloseHandle (hObject=0x4e4) returned 1
	[0179.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 1
	[0180.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.107] lstrlenW (lpString=".doc") returned 4
	[0180.107] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.107] lstrlenW (lpString=".docx") returned 5
	[0180.107] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.107] lstrlenW (lpString=".pdf") returned 4
	[0180.107] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.107] lstrlenW (lpString=".xls") returned 4
	[0180.107] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.107] lstrlenW (lpString=".xlsx") returned 5
	[0180.107] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.107] lstrlenW (lpString=".ppt") returned 4
	[0180.107] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.108] lstrlenW (lpString=".zip") returned 4
	[0180.108] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.108] lstrlenW (lpString=".rar") returned 4
	[0180.108] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.108] lstrlenW (lpString=".bz2") returned 4
	[0180.108] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.108] lstrlenW (lpString=".7z") returned 3
	[0180.108] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.108] lstrlenW (lpString=".dbf") returned 4
	[0180.108] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.108] lstrlenW (lpString=".1cd") returned 4
	[0180.108] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.108] lstrlenW (lpString=".jpg") returned 4
	[0180.108] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.108] lstrlenW (lpString=".doc") returned 4
	[0180.108] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.108] lstrlenW (lpString=".docx") returned 5
	[0180.108] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.108] lstrlenW (lpString=".pdf") returned 4
	[0180.108] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.108] lstrlenW (lpString=".xls") returned 4
	[0180.108] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.108] lstrlenW (lpString=".xlsx") returned 5
	[0180.108] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.109] lstrlenW (lpString=".ppt") returned 4
	[0180.109] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.109] lstrlenW (lpString=".zip") returned 4
	[0180.109] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.109] lstrlenW (lpString=".rar") returned 4
	[0180.109] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.109] lstrlenW (lpString=".bz2") returned 4
	[0180.109] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.109] lstrlenW (lpString=".7z") returned 3
	[0180.109] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.109] lstrlenW (lpString=".dbf") returned 4
	[0180.109] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.109] lstrlenW (lpString=".1cd") returned 4
	[0180.109] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0180.109] lstrlenW (lpString=".jpg") returned 4
	[0180.109] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.109] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.109] lstrlenW (lpString="HomeBusinessR_Retail-ul-phn.xrm-ms") returned 34
	[0180.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0180.110] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=19954) returned 1
	[0180.110] CloseHandle (hObject=0x500) returned 1
	[0180.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 0x220
	[0180.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0180.111] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.111] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0180.114] GetLastError () returned 0x0
	[0180.114] ReadFile (in: hFile=0x500, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x4df2, lpOverlapped=0x0) returned 1
	[0180.125] WriteFile (in: hFile=0x4e4, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0180.126] ReadFile (in: hFile=0x500, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.126] WriteFile (in: hFile=0x4e4, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x118, lpOverlapped=0x0) returned 1
	[0180.127] SetEndOfFile (hFile=0x4e4) returned 1
	[0180.127] CloseHandle (hObject=0x4e4) returned 1
	[0180.127] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.127] SetEndOfFile (hFile=0x500) returned 1
	[0180.129] CloseHandle (hObject=0x500) returned 1
	[0180.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 1
	[0180.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.130] lstrlenW (lpString=".doc") returned 4
	[0180.130] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.131] lstrlenW (lpString=".docx") returned 5
	[0180.131] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.131] lstrlenW (lpString=".pdf") returned 4
	[0180.131] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.131] lstrlenW (lpString=".xls") returned 4
	[0180.131] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.131] lstrlenW (lpString=".xlsx") returned 5
	[0180.131] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.131] lstrlenW (lpString=".ppt") returned 4
	[0180.131] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.131] lstrlenW (lpString=".zip") returned 4
	[0180.131] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.131] lstrlenW (lpString=".rar") returned 4
	[0180.131] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.131] lstrlenW (lpString=".bz2") returned 4
	[0180.131] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.131] lstrlenW (lpString=".7z") returned 3
	[0180.131] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.131] lstrlenW (lpString=".dbf") returned 4
	[0180.131] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.131] lstrlenW (lpString=".1cd") returned 4
	[0180.131] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.131] lstrlenW (lpString=".jpg") returned 4
	[0180.131] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.131] lstrlenW (lpString=".doc") returned 4
	[0180.132] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.132] lstrlenW (lpString=".docx") returned 5
	[0180.132] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.132] lstrlenW (lpString=".pdf") returned 4
	[0180.132] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.132] lstrlenW (lpString=".xls") returned 4
	[0180.132] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.132] lstrlenW (lpString=".xlsx") returned 5
	[0180.132] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.132] lstrlenW (lpString=".ppt") returned 4
	[0180.132] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.132] lstrlenW (lpString=".zip") returned 4
	[0180.132] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.132] lstrlenW (lpString=".rar") returned 4
	[0180.132] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.132] lstrlenW (lpString=".bz2") returned 4
	[0180.132] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.132] lstrlenW (lpString=".7z") returned 3
	[0180.132] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.132] lstrlenW (lpString=".dbf") returned 4
	[0180.132] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.132] lstrlenW (lpString=".1cd") returned 4
	[0180.132] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0180.132] lstrlenW (lpString=".jpg") returned 4
	[0180.132] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.133] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.133] lstrlenW (lpString="HomeBusinessR_Retail2-ppd.xrm-ms") returned 32
	[0180.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0180.133] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=22092) returned 1
	[0180.133] CloseHandle (hObject=0x500) returned 1
	[0180.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 0x220
	[0180.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0180.134] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.134] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0180.135] GetLastError () returned 0x0
	[0180.135] ReadFile (in: hFile=0x500, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x564c, lpOverlapped=0x0) returned 1
	[0180.149] WriteFile (in: hFile=0x4e4, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0180.150] ReadFile (in: hFile=0x500, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.150] WriteFile (in: hFile=0x4e4, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x114, lpOverlapped=0x0) returned 1
	[0180.151] SetEndOfFile (hFile=0x4e4) returned 1
	[0180.151] CloseHandle (hObject=0x4e4) returned 1
	[0180.151] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.151] SetEndOfFile (hFile=0x500) returned 1
	[0180.154] CloseHandle (hObject=0x500) returned 1
	[0180.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 1
	[0180.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.155] lstrlenW (lpString=".doc") returned 4
	[0180.155] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.155] lstrlenW (lpString=".docx") returned 5
	[0180.155] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.155] lstrlenW (lpString=".pdf") returned 4
	[0180.155] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.155] lstrlenW (lpString=".xls") returned 4
	[0180.155] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.155] lstrlenW (lpString=".xlsx") returned 5
	[0180.155] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.155] lstrlenW (lpString=".ppt") returned 4
	[0180.155] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.155] lstrlenW (lpString=".zip") returned 4
	[0180.155] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.155] lstrlenW (lpString=".rar") returned 4
	[0180.155] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.155] lstrlenW (lpString=".bz2") returned 4
	[0180.155] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.155] lstrlenW (lpString=".7z") returned 3
	[0180.156] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.156] lstrlenW (lpString=".dbf") returned 4
	[0180.156] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.156] lstrlenW (lpString=".1cd") returned 4
	[0180.156] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.156] lstrlenW (lpString=".jpg") returned 4
	[0180.156] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.156] lstrlenW (lpString=".doc") returned 4
	[0180.156] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.156] lstrlenW (lpString=".docx") returned 5
	[0180.156] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.156] lstrlenW (lpString=".pdf") returned 4
	[0180.156] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.156] lstrlenW (lpString=".xls") returned 4
	[0180.156] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.156] lstrlenW (lpString=".xlsx") returned 5
	[0180.156] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.156] lstrlenW (lpString=".ppt") returned 4
	[0180.156] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.156] lstrlenW (lpString=".zip") returned 4
	[0180.156] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.156] lstrlenW (lpString=".rar") returned 4
	[0180.156] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.156] lstrlenW (lpString=".bz2") returned 4
	[0180.157] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.157] lstrlenW (lpString=".7z") returned 3
	[0180.157] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.157] lstrlenW (lpString=".dbf") returned 4
	[0180.157] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.157] lstrlenW (lpString=".1cd") returned 4
	[0180.157] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0180.157] lstrlenW (lpString=".jpg") returned 4
	[0180.157] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.157] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.157] lstrlenW (lpString="HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 35
	[0180.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0180.158] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=19958) returned 1
	[0180.158] CloseHandle (hObject=0x500) returned 1
	[0180.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 0x220
	[0180.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0180.158] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.159] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0180.159] GetLastError () returned 0x0
	[0180.159] ReadFile (in: hFile=0x500, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x4df6, lpOverlapped=0x0) returned 1
	[0180.173] WriteFile (in: hFile=0x4e4, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0180.174] ReadFile (in: hFile=0x500, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.174] WriteFile (in: hFile=0x4e4, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0180.174] SetEndOfFile (hFile=0x4e4) returned 1
	[0180.174] CloseHandle (hObject=0x4e4) returned 1
	[0180.174] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.174] SetEndOfFile (hFile=0x500) returned 1
	[0180.177] CloseHandle (hObject=0x500) returned 1
	[0180.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 1
	[0180.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.178] lstrlenW (lpString=".doc") returned 4
	[0180.178] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.178] lstrlenW (lpString=".docx") returned 5
	[0180.178] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.178] lstrlenW (lpString=".pdf") returned 4
	[0180.178] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.178] lstrlenW (lpString=".xls") returned 4
	[0180.178] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.178] lstrlenW (lpString=".xlsx") returned 5
	[0180.178] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.178] lstrlenW (lpString=".ppt") returned 4
	[0180.178] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.178] lstrlenW (lpString=".zip") returned 4
	[0180.178] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.178] lstrlenW (lpString=".rar") returned 4
	[0180.178] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.178] lstrlenW (lpString=".bz2") returned 4
	[0180.179] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.179] lstrlenW (lpString=".7z") returned 3
	[0180.179] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.179] lstrlenW (lpString=".dbf") returned 4
	[0180.179] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.179] lstrlenW (lpString=".1cd") returned 4
	[0180.179] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.179] lstrlenW (lpString=".jpg") returned 4
	[0180.179] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.179] lstrlenW (lpString=".doc") returned 4
	[0180.179] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.179] lstrlenW (lpString=".docx") returned 5
	[0180.179] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.179] lstrlenW (lpString=".pdf") returned 4
	[0180.179] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.179] lstrlenW (lpString=".xls") returned 4
	[0180.179] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.179] lstrlenW (lpString=".xlsx") returned 5
	[0180.179] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.179] lstrlenW (lpString=".ppt") returned 4
	[0180.179] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.179] lstrlenW (lpString=".zip") returned 4
	[0180.179] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.179] lstrlenW (lpString=".rar") returned 4
	[0180.180] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.180] lstrlenW (lpString=".bz2") returned 4
	[0180.180] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.180] lstrlenW (lpString=".7z") returned 3
	[0180.180] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.180] lstrlenW (lpString=".dbf") returned 4
	[0180.180] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.180] lstrlenW (lpString=".1cd") returned 4
	[0180.180] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0180.180] lstrlenW (lpString=".jpg") returned 4
	[0180.180] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.470] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.470] lstrlenW (lpString="HomeBusinessR_Trial-ppd.xrm-ms") returned 30
	[0180.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0180.833] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=22214) returned 1
	[0180.833] CloseHandle (hObject=0x51c) returned 1
	[0180.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 0x220
	[0180.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0181.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0181.340] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.341] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0181.366] GetLastError () returned 0x0
	[0181.366] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x56c6, lpOverlapped=0x0) returned 1
	[0181.368] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x56d0, lpOverlapped=0x0) returned 1
	[0181.369] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.370] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x110, lpOverlapped=0x0) returned 1
	[0181.370] SetEndOfFile (hFile=0x4e0) returned 1
	[0181.370] CloseHandle (hObject=0x4e0) returned 1
	[0181.370] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.370] SetEndOfFile (hFile=0x51c) returned 1
	[0181.375] CloseHandle (hObject=0x51c) returned 1
	[0181.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0181.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 1
	[0181.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.377] lstrlenW (lpString=".doc") returned 4
	[0181.377] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.377] lstrlenW (lpString=".docx") returned 5
	[0181.377] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.377] lstrlenW (lpString=".pdf") returned 4
	[0181.377] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.377] lstrlenW (lpString=".xls") returned 4
	[0181.377] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.377] lstrlenW (lpString=".xlsx") returned 5
	[0181.377] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.377] lstrlenW (lpString=".ppt") returned 4
	[0181.377] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.377] lstrlenW (lpString=".zip") returned 4
	[0181.377] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.377] lstrlenW (lpString=".rar") returned 4
	[0181.377] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.377] lstrlenW (lpString=".bz2") returned 4
	[0181.377] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.377] lstrlenW (lpString=".7z") returned 3
	[0181.377] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.377] lstrlenW (lpString=".dbf") returned 4
	[0181.377] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.377] lstrlenW (lpString=".1cd") returned 4
	[0181.377] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.377] lstrlenW (lpString=".jpg") returned 4
	[0181.377] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.378] lstrlenW (lpString=".doc") returned 4
	[0181.378] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.378] lstrlenW (lpString=".docx") returned 5
	[0181.378] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.378] lstrlenW (lpString=".pdf") returned 4
	[0181.378] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.378] lstrlenW (lpString=".xls") returned 4
	[0181.378] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.378] lstrlenW (lpString=".xlsx") returned 5
	[0181.378] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.378] lstrlenW (lpString=".ppt") returned 4
	[0181.378] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.378] lstrlenW (lpString=".zip") returned 4
	[0181.378] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.378] lstrlenW (lpString=".rar") returned 4
	[0181.378] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.378] lstrlenW (lpString=".bz2") returned 4
	[0181.378] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.378] lstrlenW (lpString=".7z") returned 3
	[0181.378] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.378] lstrlenW (lpString=".dbf") returned 4
	[0181.378] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.378] lstrlenW (lpString=".1cd") returned 4
	[0181.378] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0181.378] lstrlenW (lpString=".jpg") returned 4
	[0181.378] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.379] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0181.379] lstrlenW (lpString="HomeBusinessR_Trial2-ppd.xrm-ms") returned 31
	[0181.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0181.379] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=22215) returned 1
	[0181.379] CloseHandle (hObject=0x51c) returned 1
	[0181.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 0x220
	[0181.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0181.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0181.380] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.380] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0181.381] GetLastError () returned 0x0
	[0181.381] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x56c7, lpOverlapped=0x0) returned 1
	[0181.383] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x56d0, lpOverlapped=0x0) returned 1
	[0181.384] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.384] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x112, lpOverlapped=0x0) returned 1
	[0181.384] SetEndOfFile (hFile=0x4e0) returned 1
	[0181.385] CloseHandle (hObject=0x4e0) returned 1
	[0181.385] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.385] SetEndOfFile (hFile=0x51c) returned 1
	[0181.387] CloseHandle (hObject=0x51c) returned 1
	[0181.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0181.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 1
	[0181.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.388] lstrlenW (lpString=".doc") returned 4
	[0181.388] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.388] lstrlenW (lpString=".docx") returned 5
	[0181.388] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.389] lstrlenW (lpString=".pdf") returned 4
	[0181.389] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.389] lstrlenW (lpString=".xls") returned 4
	[0181.389] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.389] lstrlenW (lpString=".xlsx") returned 5
	[0181.389] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.389] lstrlenW (lpString=".ppt") returned 4
	[0181.389] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.389] lstrlenW (lpString=".zip") returned 4
	[0181.389] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.389] lstrlenW (lpString=".rar") returned 4
	[0181.389] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.389] lstrlenW (lpString=".bz2") returned 4
	[0181.389] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.389] lstrlenW (lpString=".7z") returned 3
	[0181.389] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.389] lstrlenW (lpString=".dbf") returned 4
	[0181.389] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.389] lstrlenW (lpString=".1cd") returned 4
	[0181.389] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.389] lstrlenW (lpString=".jpg") returned 4
	[0181.389] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.389] lstrlenW (lpString=".doc") returned 4
	[0181.389] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.389] lstrlenW (lpString=".docx") returned 5
	[0181.390] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.390] lstrlenW (lpString=".pdf") returned 4
	[0181.390] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.390] lstrlenW (lpString=".xls") returned 4
	[0181.390] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.390] lstrlenW (lpString=".xlsx") returned 5
	[0181.390] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.390] lstrlenW (lpString=".ppt") returned 4
	[0181.390] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.390] lstrlenW (lpString=".zip") returned 4
	[0181.390] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.390] lstrlenW (lpString=".rar") returned 4
	[0181.390] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.390] lstrlenW (lpString=".bz2") returned 4
	[0181.390] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.390] lstrlenW (lpString=".7z") returned 3
	[0181.390] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.390] lstrlenW (lpString=".dbf") returned 4
	[0181.390] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.390] lstrlenW (lpString=".1cd") returned 4
	[0181.390] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0181.390] lstrlenW (lpString=".jpg") returned 4
	[0181.390] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.390] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0181.391] lstrlenW (lpString="HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 34
	[0181.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0181.391] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11625) returned 1
	[0181.391] CloseHandle (hObject=0x51c) returned 1
	[0181.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 0x220
	[0181.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0181.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0181.392] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.392] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0181.393] GetLastError () returned 0x0
	[0181.393] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d69, lpOverlapped=0x0) returned 1
	[0181.647] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0181.648] ReadFile (in: hFile=0x51c, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.648] WriteFile (in: hFile=0x4e0, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x118, lpOverlapped=0x0) returned 1
	[0181.648] SetEndOfFile (hFile=0x4e0) returned 1
	[0181.648] CloseHandle (hObject=0x4e0) returned 1
	[0181.648] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.648] SetEndOfFile (hFile=0x51c) returned 1
	[0181.651] CloseHandle (hObject=0x51c) returned 1
	[0181.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 1
	[0183.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.193] lstrlenW (lpString=".doc") returned 4
	[0183.193] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.193] lstrlenW (lpString=".docx") returned 5
	[0183.193] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.193] lstrlenW (lpString=".pdf") returned 4
	[0183.193] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.193] lstrlenW (lpString=".xls") returned 4
	[0183.193] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.193] lstrlenW (lpString=".xlsx") returned 5
	[0183.193] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.193] lstrlenW (lpString=".ppt") returned 4
	[0183.193] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.193] lstrlenW (lpString=".zip") returned 4
	[0183.193] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.193] lstrlenW (lpString=".rar") returned 4
	[0183.193] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.193] lstrlenW (lpString=".bz2") returned 4
	[0183.194] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.194] lstrlenW (lpString=".7z") returned 3
	[0183.194] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.194] lstrlenW (lpString=".dbf") returned 4
	[0183.194] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.194] lstrlenW (lpString=".1cd") returned 4
	[0183.194] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.194] lstrlenW (lpString=".jpg") returned 4
	[0183.194] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.194] lstrlenW (lpString=".doc") returned 4
	[0183.194] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.194] lstrlenW (lpString=".docx") returned 5
	[0183.194] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.194] lstrlenW (lpString=".pdf") returned 4
	[0183.194] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.194] lstrlenW (lpString=".xls") returned 4
	[0183.194] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.194] lstrlenW (lpString=".xlsx") returned 5
	[0183.194] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.194] lstrlenW (lpString=".ppt") returned 4
	[0183.194] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.194] lstrlenW (lpString=".zip") returned 4
	[0183.194] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.194] lstrlenW (lpString=".rar") returned 4
	[0183.195] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.195] lstrlenW (lpString=".bz2") returned 4
	[0183.195] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.195] lstrlenW (lpString=".7z") returned 3
	[0183.195] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.195] lstrlenW (lpString=".dbf") returned 4
	[0183.195] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.195] lstrlenW (lpString=".1cd") returned 4
	[0183.195] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0183.195] lstrlenW (lpString=".jpg") returned 4
	[0183.195] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.195] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.195] lstrlenW (lpString="HomeStudentR_Trial2-pl.xrm-ms") returned 29
	[0183.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.196] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11167) returned 1
	[0183.196] CloseHandle (hObject=0x370) returned 1
	[0183.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 0x220
	[0183.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.197] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.197] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.198] GetLastError () returned 0x0
	[0183.198] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2b9f, lpOverlapped=0x0) returned 1
	[0183.199] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0183.200] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.200] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0183.200] SetEndOfFile (hFile=0x514) returned 1
	[0183.201] CloseHandle (hObject=0x514) returned 1
	[0183.207] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.207] SetEndOfFile (hFile=0x370) returned 1
	[0183.211] CloseHandle (hObject=0x370) returned 1
	[0183.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 1
	[0183.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.212] lstrlenW (lpString=".doc") returned 4
	[0183.212] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.212] lstrlenW (lpString=".docx") returned 5
	[0183.212] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.212] lstrlenW (lpString=".pdf") returned 4
	[0183.212] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.212] lstrlenW (lpString=".xls") returned 4
	[0183.212] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.212] lstrlenW (lpString=".xlsx") returned 5
	[0183.212] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.212] lstrlenW (lpString=".ppt") returned 4
	[0183.213] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.213] lstrlenW (lpString=".zip") returned 4
	[0183.213] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.213] lstrlenW (lpString=".rar") returned 4
	[0183.213] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.213] lstrlenW (lpString=".bz2") returned 4
	[0183.213] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.213] lstrlenW (lpString=".7z") returned 3
	[0183.213] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.213] lstrlenW (lpString=".dbf") returned 4
	[0183.213] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.213] lstrlenW (lpString=".1cd") returned 4
	[0183.213] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.213] lstrlenW (lpString=".jpg") returned 4
	[0183.213] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.213] lstrlenW (lpString=".doc") returned 4
	[0183.213] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.213] lstrlenW (lpString=".docx") returned 5
	[0183.213] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.213] lstrlenW (lpString=".pdf") returned 4
	[0183.213] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.213] lstrlenW (lpString=".xls") returned 4
	[0183.213] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.213] lstrlenW (lpString=".xlsx") returned 5
	[0183.214] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.214] lstrlenW (lpString=".ppt") returned 4
	[0183.214] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.214] lstrlenW (lpString=".zip") returned 4
	[0183.214] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.214] lstrlenW (lpString=".rar") returned 4
	[0183.214] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.214] lstrlenW (lpString=".bz2") returned 4
	[0183.214] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.214] lstrlenW (lpString=".7z") returned 3
	[0183.214] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.214] lstrlenW (lpString=".dbf") returned 4
	[0183.214] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.214] lstrlenW (lpString=".1cd") returned 4
	[0183.214] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0183.214] lstrlenW (lpString=".jpg") returned 4
	[0183.214] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.214] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.214] lstrlenW (lpString="HomeStudentR_Trial2-ppd.xrm-ms") returned 30
	[0183.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.215] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=21728) returned 1
	[0183.215] CloseHandle (hObject=0x370) returned 1
	[0183.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 0x220
	[0183.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.216] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.216] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.217] GetLastError () returned 0x0
	[0183.217] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x54e0, lpOverlapped=0x0) returned 1
	[0183.219] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x54f0, lpOverlapped=0x0) returned 1
	[0183.221] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.221] WriteFile (in: hFile=0x514, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x110, lpOverlapped=0x0) returned 1
	[0183.221] SetEndOfFile (hFile=0x514) returned 1
	[0183.221] CloseHandle (hObject=0x514) returned 1
	[0183.221] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.221] SetEndOfFile (hFile=0x370) returned 1
	[0183.224] CloseHandle (hObject=0x370) returned 1
	[0183.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 1
	[0183.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.444] lstrlenW (lpString=".doc") returned 4
	[0183.444] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.444] lstrlenW (lpString=".docx") returned 5
	[0183.444] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.444] lstrlenW (lpString=".pdf") returned 4
	[0183.444] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.444] lstrlenW (lpString=".xls") returned 4
	[0183.444] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.444] lstrlenW (lpString=".xlsx") returned 5
	[0183.444] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.444] lstrlenW (lpString=".ppt") returned 4
	[0183.444] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.444] lstrlenW (lpString=".zip") returned 4
	[0183.444] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.444] lstrlenW (lpString=".rar") returned 4
	[0183.444] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.444] lstrlenW (lpString=".bz2") returned 4
	[0183.444] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.444] lstrlenW (lpString=".7z") returned 3
	[0183.444] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.445] lstrlenW (lpString=".dbf") returned 4
	[0183.445] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.445] lstrlenW (lpString=".1cd") returned 4
	[0183.445] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.445] lstrlenW (lpString=".jpg") returned 4
	[0183.445] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.445] lstrlenW (lpString=".doc") returned 4
	[0183.445] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.445] lstrlenW (lpString=".docx") returned 5
	[0183.445] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.445] lstrlenW (lpString=".pdf") returned 4
	[0183.445] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.445] lstrlenW (lpString=".xls") returned 4
	[0183.445] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.445] lstrlenW (lpString=".xlsx") returned 5
	[0183.445] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.445] lstrlenW (lpString=".ppt") returned 4
	[0183.445] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.445] lstrlenW (lpString=".zip") returned 4
	[0183.445] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.445] lstrlenW (lpString=".rar") returned 4
	[0183.445] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.445] lstrlenW (lpString=".bz2") returned 4
	[0183.445] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.445] lstrlenW (lpString=".7z") returned 3
	[0183.446] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.446] lstrlenW (lpString=".dbf") returned 4
	[0183.446] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.446] lstrlenW (lpString=".1cd") returned 4
	[0183.446] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0183.446] lstrlenW (lpString=".jpg") returned 4
	[0183.446] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.446] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.446] lstrlenW (lpString="MondoR_KMS_Automation-ul-oob.xrm-ms") returned 35
	[0183.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.940] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11621) returned 1
	[0183.940] CloseHandle (hObject=0x3ac) returned 1
	[0183.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 0x220
	[0183.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.942] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.942] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0183.943] GetLastError () returned 0x0
	[0183.943] ReadFile (in: hFile=0x3ac, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0183.945] WriteFile (in: hFile=0x558, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0183.950] ReadFile (in: hFile=0x3ac, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.950] WriteFile (in: hFile=0x558, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0183.950] SetEndOfFile (hFile=0x558) returned 1
	[0183.950] CloseHandle (hObject=0x558) returned 1
	[0183.950] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.951] SetEndOfFile (hFile=0x3ac) returned 1
	[0183.953] CloseHandle (hObject=0x3ac) returned 1
	[0183.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 1
	[0183.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.954] lstrlenW (lpString=".doc") returned 4
	[0183.954] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.955] lstrlenW (lpString=".docx") returned 5
	[0183.955] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.955] lstrlenW (lpString=".pdf") returned 4
	[0183.955] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.955] lstrlenW (lpString=".xls") returned 4
	[0183.955] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.955] lstrlenW (lpString=".xlsx") returned 5
	[0183.955] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.955] lstrlenW (lpString=".ppt") returned 4
	[0183.955] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.955] lstrlenW (lpString=".zip") returned 4
	[0183.955] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.955] lstrlenW (lpString=".rar") returned 4
	[0183.955] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.955] lstrlenW (lpString=".bz2") returned 4
	[0183.955] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.955] lstrlenW (lpString=".7z") returned 3
	[0183.955] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.955] lstrlenW (lpString=".dbf") returned 4
	[0183.955] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.955] lstrlenW (lpString=".1cd") returned 4
	[0183.955] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.955] lstrlenW (lpString=".jpg") returned 4
	[0183.955] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.956] lstrlenW (lpString=".doc") returned 4
	[0183.956] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.956] lstrlenW (lpString=".docx") returned 5
	[0183.956] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.956] lstrlenW (lpString=".pdf") returned 4
	[0183.956] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.956] lstrlenW (lpString=".xls") returned 4
	[0183.956] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.956] lstrlenW (lpString=".xlsx") returned 5
	[0183.956] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.956] lstrlenW (lpString=".ppt") returned 4
	[0183.956] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.956] lstrlenW (lpString=".zip") returned 4
	[0183.956] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.956] lstrlenW (lpString=".rar") returned 4
	[0183.956] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.956] lstrlenW (lpString=".bz2") returned 4
	[0183.956] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.956] lstrlenW (lpString=".7z") returned 3
	[0183.956] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.956] lstrlenW (lpString=".dbf") returned 4
	[0183.956] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.956] lstrlenW (lpString=".1cd") returned 4
	[0183.956] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0183.956] lstrlenW (lpString=".jpg") returned 4
	[0183.956] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.957] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.957] lstrlenW (lpString="MondoR_KMS_Automation-ul.xrm-ms") returned 31
	[0183.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.958] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=9613) returned 1
	[0183.958] CloseHandle (hObject=0x3ac) returned 1
	[0183.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 0x220
	[0183.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.958] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.958] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0183.959] GetLastError () returned 0x0
	[0183.959] ReadFile (in: hFile=0x3ac, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x258d, lpOverlapped=0x0) returned 1
	[0183.961] WriteFile (in: hFile=0x558, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2590, lpOverlapped=0x0) returned 1
	[0183.962] ReadFile (in: hFile=0x3ac, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.962] WriteFile (in: hFile=0x558, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x112, lpOverlapped=0x0) returned 1
	[0183.962] SetEndOfFile (hFile=0x558) returned 1
	[0183.962] CloseHandle (hObject=0x558) returned 1
	[0183.962] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.962] SetEndOfFile (hFile=0x3ac) returned 1
	[0183.966] CloseHandle (hObject=0x3ac) returned 1
	[0183.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 1
	[0183.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.967] lstrlenW (lpString=".doc") returned 4
	[0183.967] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.967] lstrlenW (lpString=".docx") returned 5
	[0183.967] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.967] lstrlenW (lpString=".pdf") returned 4
	[0183.967] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.967] lstrlenW (lpString=".xls") returned 4
	[0183.967] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.967] lstrlenW (lpString=".xlsx") returned 5
	[0183.967] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.967] lstrlenW (lpString=".ppt") returned 4
	[0183.968] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.968] lstrlenW (lpString=".zip") returned 4
	[0183.968] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.968] lstrlenW (lpString=".rar") returned 4
	[0183.968] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.968] lstrlenW (lpString=".bz2") returned 4
	[0183.968] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.968] lstrlenW (lpString=".7z") returned 3
	[0183.968] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.968] lstrlenW (lpString=".dbf") returned 4
	[0183.968] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.968] lstrlenW (lpString=".1cd") returned 4
	[0183.968] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.968] lstrlenW (lpString=".jpg") returned 4
	[0183.968] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.968] lstrlenW (lpString=".doc") returned 4
	[0183.968] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.968] lstrlenW (lpString=".docx") returned 5
	[0183.968] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.968] lstrlenW (lpString=".pdf") returned 4
	[0183.968] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.968] lstrlenW (lpString=".xls") returned 4
	[0183.968] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.968] lstrlenW (lpString=".xlsx") returned 5
	[0183.968] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.969] lstrlenW (lpString=".ppt") returned 4
	[0183.969] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.969] lstrlenW (lpString=".zip") returned 4
	[0183.969] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.969] lstrlenW (lpString=".rar") returned 4
	[0183.969] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.969] lstrlenW (lpString=".bz2") returned 4
	[0183.969] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.969] lstrlenW (lpString=".7z") returned 3
	[0183.969] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.969] lstrlenW (lpString=".dbf") returned 4
	[0183.969] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.969] lstrlenW (lpString=".1cd") returned 4
	[0183.969] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0183.969] lstrlenW (lpString=".jpg") returned 4
	[0183.969] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.969] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.969] lstrlenW (lpString="MondoR_OEM_Perp-pl.xrm-ms") returned 25
	[0183.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.970] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=10635) returned 1
	[0183.970] CloseHandle (hObject=0x3ac) returned 1
	[0183.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 0x220
	[0183.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.971] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.971] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0183.971] GetLastError () returned 0x0
	[0183.971] ReadFile (in: hFile=0x3ac, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x298b, lpOverlapped=0x0) returned 1
	[0183.973] WriteFile (in: hFile=0x558, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0183.974] ReadFile (in: hFile=0x3ac, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.974] WriteFile (in: hFile=0x558, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x106, lpOverlapped=0x0) returned 1
	[0183.974] SetEndOfFile (hFile=0x558) returned 1
	[0183.974] CloseHandle (hObject=0x558) returned 1
	[0183.975] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.975] SetEndOfFile (hFile=0x3ac) returned 1
	[0183.977] CloseHandle (hObject=0x3ac) returned 1
	[0183.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 1
	[0183.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0183.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0183.978] lstrlenW (lpString=".doc") returned 4
	[0183.978] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.978] lstrlenW (lpString=".docx") returned 5
	[0183.978] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.978] lstrlenW (lpString=".pdf") returned 4
	[0183.978] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.978] lstrlenW (lpString=".xls") returned 4
	[0183.978] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.978] lstrlenW (lpString=".xlsx") returned 5
	[0183.979] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.979] lstrlenW (lpString=".ppt") returned 4
	[0183.979] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0183.979] lstrlenW (lpString=".zip") returned 4
	[0183.979] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.979] lstrlenW (lpString=".rar") returned 4
	[0183.979] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.979] lstrlenW (lpString=".bz2") returned 4
	[0183.979] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.979] lstrlenW (lpString=".7z") returned 3
	[0183.979] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0183.979] lstrlenW (lpString=".dbf") returned 4
	[0183.979] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0183.979] lstrlenW (lpString=".1cd") returned 4
	[0183.979] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0183.979] lstrlenW (lpString=".jpg") returned 4
	[0183.979] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0183.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0183.979] lstrlenW (lpString=".doc") returned 4
	[0183.979] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.979] lstrlenW (lpString=".docx") returned 5
	[0183.979] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.979] lstrlenW (lpString=".pdf") returned 4
	[0183.979] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.979] lstrlenW (lpString=".xls") returned 4
	[0183.979] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.980] lstrlenW (lpString=".xlsx") returned 5
	[0183.980] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.980] lstrlenW (lpString=".ppt") returned 4
	[0183.980] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0183.980] lstrlenW (lpString=".zip") returned 4
	[0183.980] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.980] lstrlenW (lpString=".rar") returned 4
	[0183.980] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.980] lstrlenW (lpString=".bz2") returned 4
	[0183.980] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.980] lstrlenW (lpString=".7z") returned 3
	[0183.980] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0183.980] lstrlenW (lpString=".dbf") returned 4
	[0183.980] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0183.980] lstrlenW (lpString=".1cd") returned 4
	[0184.386] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0184.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0184.386] lstrlenW (lpString=".jpg") returned 4
	[0184.386] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0184.386] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0184.386] lstrlenW (lpString="MondoR_Retail-ul-phn.xrm-ms") returned 27
	[0184.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0184.387] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=19919) returned 1
	[0184.387] CloseHandle (hObject=0x524) returned 1
	[0184.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 0x220
	[0184.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0184.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0184.388] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.388] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0184.393] GetLastError () returned 0x0
	[0184.393] ReadFile (in: hFile=0x524, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x4dcf, lpOverlapped=0x0) returned 1
	[0184.435] WriteFile (in: hFile=0x3d8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x4dd0, lpOverlapped=0x0) returned 1
	[0184.446] ReadFile (in: hFile=0x524, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.446] WriteFile (in: hFile=0x3d8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0184.447] SetEndOfFile (hFile=0x3d8) returned 1
	[0184.552] CloseHandle (hObject=0x3d8) returned 1
	[0184.553] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.553] SetEndOfFile (hFile=0x524) returned 1
	[0184.557] CloseHandle (hObject=0x524) returned 1
	[0184.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 1
	[0185.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.092] lstrlenW (lpString=".doc") returned 4
	[0185.092] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.092] lstrlenW (lpString=".docx") returned 5
	[0185.092] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.092] lstrlenW (lpString=".pdf") returned 4
	[0185.092] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.092] lstrlenW (lpString=".xls") returned 4
	[0185.092] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.092] lstrlenW (lpString=".xlsx") returned 5
	[0185.092] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.092] lstrlenW (lpString=".ppt") returned 4
	[0185.092] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.092] lstrlenW (lpString=".zip") returned 4
	[0185.092] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.092] lstrlenW (lpString=".rar") returned 4
	[0185.092] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.092] lstrlenW (lpString=".bz2") returned 4
	[0185.093] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.093] lstrlenW (lpString=".7z") returned 3
	[0185.093] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.093] lstrlenW (lpString=".dbf") returned 4
	[0185.093] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.093] lstrlenW (lpString=".1cd") returned 4
	[0185.093] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.093] lstrlenW (lpString=".jpg") returned 4
	[0185.093] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.093] lstrlenW (lpString=".doc") returned 4
	[0185.093] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.093] lstrlenW (lpString=".docx") returned 5
	[0185.093] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.093] lstrlenW (lpString=".pdf") returned 4
	[0185.093] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.093] lstrlenW (lpString=".xls") returned 4
	[0185.093] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.093] lstrlenW (lpString=".xlsx") returned 5
	[0185.093] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.093] lstrlenW (lpString=".ppt") returned 4
	[0185.093] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.093] lstrlenW (lpString=".zip") returned 4
	[0185.093] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.093] lstrlenW (lpString=".rar") returned 4
	[0185.093] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.093] lstrlenW (lpString=".bz2") returned 4
	[0185.093] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.093] lstrlenW (lpString=".7z") returned 3
	[0185.093] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.094] lstrlenW (lpString=".dbf") returned 4
	[0185.094] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.094] lstrlenW (lpString=".1cd") returned 4
	[0185.094] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0185.094] lstrlenW (lpString=".jpg") returned 4
	[0185.094] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.094] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.094] lstrlenW (lpString="MondoR_Subscription-pl.xrm-ms") returned 29
	[0185.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0185.471] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11167) returned 1
	[0185.471] CloseHandle (hObject=0x324) returned 1
	[0185.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 0x220
	[0185.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0185.474] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.474] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.475] GetLastError () returned 0x0
	[0185.475] ReadFile (in: hFile=0x324, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2b9f, lpOverlapped=0x0) returned 1
	[0185.476] WriteFile (in: hFile=0x538, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0185.478] ReadFile (in: hFile=0x324, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.478] WriteFile (in: hFile=0x538, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0185.478] SetEndOfFile (hFile=0x538) returned 1
	[0185.478] CloseHandle (hObject=0x538) returned 1
	[0185.478] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.478] SetEndOfFile (hFile=0x324) returned 1
	[0185.481] CloseHandle (hObject=0x324) returned 1
	[0185.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 1
	[0185.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.482] lstrlenW (lpString=".doc") returned 4
	[0185.482] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.482] lstrlenW (lpString=".docx") returned 5
	[0185.482] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.482] lstrlenW (lpString=".pdf") returned 4
	[0185.482] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.482] lstrlenW (lpString=".xls") returned 4
	[0185.482] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.482] lstrlenW (lpString=".xlsx") returned 5
	[0185.482] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.482] lstrlenW (lpString=".ppt") returned 4
	[0185.482] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.482] lstrlenW (lpString=".zip") returned 4
	[0185.482] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.482] lstrlenW (lpString=".rar") returned 4
	[0185.482] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.482] lstrlenW (lpString=".bz2") returned 4
	[0185.482] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.482] lstrlenW (lpString=".7z") returned 3
	[0185.483] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.483] lstrlenW (lpString=".dbf") returned 4
	[0185.483] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.483] lstrlenW (lpString=".1cd") returned 4
	[0185.483] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.483] lstrlenW (lpString=".jpg") returned 4
	[0185.483] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.483] lstrlenW (lpString=".doc") returned 4
	[0185.483] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.483] lstrlenW (lpString=".docx") returned 5
	[0185.483] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.483] lstrlenW (lpString=".pdf") returned 4
	[0185.483] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.483] lstrlenW (lpString=".xls") returned 4
	[0185.483] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.483] lstrlenW (lpString=".xlsx") returned 5
	[0185.483] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.483] lstrlenW (lpString=".ppt") returned 4
	[0185.483] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.483] lstrlenW (lpString=".zip") returned 4
	[0185.483] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.483] lstrlenW (lpString=".rar") returned 4
	[0185.483] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.483] lstrlenW (lpString=".bz2") returned 4
	[0185.483] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.484] lstrlenW (lpString=".7z") returned 3
	[0185.484] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.484] lstrlenW (lpString=".dbf") returned 4
	[0185.484] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.484] lstrlenW (lpString=".1cd") returned 4
	[0185.484] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0185.484] lstrlenW (lpString=".jpg") returned 4
	[0185.484] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.484] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.484] lstrlenW (lpString="MondoR_Subscription-ul-oob.xrm-ms") returned 33
	[0185.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0185.485] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11612) returned 1
	[0185.485] CloseHandle (hObject=0x324) returned 1
	[0185.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 0x220
	[0185.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0185.485] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.486] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.486] GetLastError () returned 0x0
	[0185.486] ReadFile (in: hFile=0x324, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d5c, lpOverlapped=0x0) returned 1
	[0185.488] WriteFile (in: hFile=0x538, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0185.489] ReadFile (in: hFile=0x324, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.489] WriteFile (in: hFile=0x538, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x116, lpOverlapped=0x0) returned 1
	[0185.489] SetEndOfFile (hFile=0x538) returned 1
	[0185.489] CloseHandle (hObject=0x538) returned 1
	[0185.490] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.490] SetEndOfFile (hFile=0x324) returned 1
	[0185.492] CloseHandle (hObject=0x324) returned 1
	[0185.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 1
	[0185.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.493] lstrlenW (lpString=".doc") returned 4
	[0185.493] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.493] lstrlenW (lpString=".docx") returned 5
	[0185.493] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.493] lstrlenW (lpString=".pdf") returned 4
	[0185.493] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.493] lstrlenW (lpString=".xls") returned 4
	[0185.493] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.493] lstrlenW (lpString=".xlsx") returned 5
	[0185.493] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.493] lstrlenW (lpString=".ppt") returned 4
	[0185.493] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.494] lstrlenW (lpString=".zip") returned 4
	[0185.494] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.494] lstrlenW (lpString=".rar") returned 4
	[0185.494] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.494] lstrlenW (lpString=".bz2") returned 4
	[0185.494] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.494] lstrlenW (lpString=".7z") returned 3
	[0185.494] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.494] lstrlenW (lpString=".dbf") returned 4
	[0185.494] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.494] lstrlenW (lpString=".1cd") returned 4
	[0185.494] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.494] lstrlenW (lpString=".jpg") returned 4
	[0185.494] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.494] lstrlenW (lpString=".doc") returned 4
	[0185.494] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.494] lstrlenW (lpString=".docx") returned 5
	[0185.494] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.494] lstrlenW (lpString=".pdf") returned 4
	[0185.494] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.494] lstrlenW (lpString=".xls") returned 4
	[0185.494] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.494] lstrlenW (lpString=".xlsx") returned 5
	[0185.494] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.495] lstrlenW (lpString=".ppt") returned 4
	[0185.495] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.495] lstrlenW (lpString=".zip") returned 4
	[0185.495] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.495] lstrlenW (lpString=".rar") returned 4
	[0185.495] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.495] lstrlenW (lpString=".bz2") returned 4
	[0185.495] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.495] lstrlenW (lpString=".7z") returned 3
	[0185.495] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.495] lstrlenW (lpString=".dbf") returned 4
	[0185.495] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.495] lstrlenW (lpString=".1cd") returned 4
	[0185.495] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0185.495] lstrlenW (lpString=".jpg") returned 4
	[0185.495] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.495] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.495] lstrlenW (lpString="MondoR_Subscription2-pl.xrm-ms") returned 30
	[0185.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0185.496] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11171) returned 1
	[0185.496] CloseHandle (hObject=0x324) returned 1
	[0185.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 0x220
	[0185.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0185.497] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.497] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.498] GetLastError () returned 0x0
	[0185.498] ReadFile (in: hFile=0x324, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2ba3, lpOverlapped=0x0) returned 1
	[0185.499] WriteFile (in: hFile=0x538, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0185.500] ReadFile (in: hFile=0x324, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.500] WriteFile (in: hFile=0x538, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x110, lpOverlapped=0x0) returned 1
	[0185.500] SetEndOfFile (hFile=0x538) returned 1
	[0185.501] CloseHandle (hObject=0x538) returned 1
	[0185.501] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.501] SetEndOfFile (hFile=0x324) returned 1
	[0185.507] CloseHandle (hObject=0x324) returned 1
	[0185.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 1
	[0185.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.508] lstrlenW (lpString=".doc") returned 4
	[0185.508] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.508] lstrlenW (lpString=".docx") returned 5
	[0185.508] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.508] lstrlenW (lpString=".pdf") returned 4
	[0185.508] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.508] lstrlenW (lpString=".xls") returned 4
	[0185.508] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.508] lstrlenW (lpString=".xlsx") returned 5
	[0185.508] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.508] lstrlenW (lpString=".ppt") returned 4
	[0185.508] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.508] lstrlenW (lpString=".zip") returned 4
	[0185.508] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.508] lstrlenW (lpString=".rar") returned 4
	[0185.509] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.509] lstrlenW (lpString=".bz2") returned 4
	[0185.509] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.509] lstrlenW (lpString=".7z") returned 3
	[0185.509] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.509] lstrlenW (lpString=".dbf") returned 4
	[0185.509] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.509] lstrlenW (lpString=".1cd") returned 4
	[0185.509] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.509] lstrlenW (lpString=".jpg") returned 4
	[0185.509] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.509] lstrlenW (lpString=".doc") returned 4
	[0185.509] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.509] lstrlenW (lpString=".docx") returned 5
	[0185.509] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.509] lstrlenW (lpString=".pdf") returned 4
	[0185.509] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.509] lstrlenW (lpString=".xls") returned 4
	[0185.509] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.509] lstrlenW (lpString=".xlsx") returned 5
	[0185.509] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.509] lstrlenW (lpString=".ppt") returned 4
	[0185.509] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.509] lstrlenW (lpString=".zip") returned 4
	[0185.510] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.510] lstrlenW (lpString=".rar") returned 4
	[0185.510] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.510] lstrlenW (lpString=".bz2") returned 4
	[0185.510] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.510] lstrlenW (lpString=".7z") returned 3
	[0185.510] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.510] lstrlenW (lpString=".dbf") returned 4
	[0185.510] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.510] lstrlenW (lpString=".1cd") returned 4
	[0185.510] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0185.510] lstrlenW (lpString=".jpg") returned 4
	[0185.510] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.510] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.510] lstrlenW (lpString="MondoR_Subscription2-ppd.xrm-ms") returned 31
	[0185.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0185.511] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=32362) returned 1
	[0185.511] CloseHandle (hObject=0x324) returned 1
	[0185.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 0x220
	[0185.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.644] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.644] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0186.483] GetLastError () returned 0x0
	[0186.483] ReadFile (in: hFile=0x538, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x7e6a, lpOverlapped=0x0) returned 1
	[0186.485] WriteFile (in: hFile=0x548, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x7e70, lpOverlapped=0x0) returned 1
	[0186.487] ReadFile (in: hFile=0x538, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.487] WriteFile (in: hFile=0x548, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x112, lpOverlapped=0x0) returned 1
	[0186.487] SetEndOfFile (hFile=0x548) returned 1
	[0186.487] CloseHandle (hObject=0x548) returned 1
	[0186.487] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.487] SetEndOfFile (hFile=0x538) returned 1
	[0186.490] CloseHandle (hObject=0x538) returned 1
	[0186.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 1
	[0186.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.842] lstrlenW (lpString=".doc") returned 4
	[0186.842] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.842] lstrlenW (lpString=".docx") returned 5
	[0186.842] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.842] lstrlenW (lpString=".pdf") returned 4
	[0186.842] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.842] lstrlenW (lpString=".xls") returned 4
	[0186.842] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.842] lstrlenW (lpString=".xlsx") returned 5
	[0186.842] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.842] lstrlenW (lpString=".ppt") returned 4
	[0186.842] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.842] lstrlenW (lpString=".zip") returned 4
	[0186.842] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.842] lstrlenW (lpString=".rar") returned 4
	[0186.842] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.842] lstrlenW (lpString=".bz2") returned 4
	[0186.842] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.842] lstrlenW (lpString=".7z") returned 3
	[0186.842] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.843] lstrlenW (lpString=".dbf") returned 4
	[0186.843] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.843] lstrlenW (lpString=".1cd") returned 4
	[0186.843] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.843] lstrlenW (lpString=".jpg") returned 4
	[0186.843] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.843] lstrlenW (lpString=".doc") returned 4
	[0186.843] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.843] lstrlenW (lpString=".docx") returned 5
	[0186.843] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.843] lstrlenW (lpString=".pdf") returned 4
	[0186.843] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.843] lstrlenW (lpString=".xls") returned 4
	[0186.843] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.843] lstrlenW (lpString=".xlsx") returned 5
	[0186.843] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.843] lstrlenW (lpString=".ppt") returned 4
	[0186.843] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.843] lstrlenW (lpString=".zip") returned 4
	[0186.843] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.843] lstrlenW (lpString=".rar") returned 4
	[0186.843] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.843] lstrlenW (lpString=".bz2") returned 4
	[0186.843] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.844] lstrlenW (lpString=".7z") returned 3
	[0186.844] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.844] lstrlenW (lpString=".dbf") returned 4
	[0186.844] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.844] lstrlenW (lpString=".1cd") returned 4
	[0186.844] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0186.844] lstrlenW (lpString=".jpg") returned 4
	[0186.844] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.844] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.844] lstrlenW (lpString="O365BusinessR_Grace-ul-oob.xrm-ms") returned 33
	[0186.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.845] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11624) returned 1
	[0186.845] CloseHandle (hObject=0x558) returned 1
	[0186.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 0x220
	[0186.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.846] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.846] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0186.846] GetLastError () returned 0x0
	[0186.846] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d68, lpOverlapped=0x0) returned 1
	[0186.848] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0186.849] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.849] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x116, lpOverlapped=0x0) returned 1
	[0186.849] SetEndOfFile (hFile=0x3e8) returned 1
	[0186.849] CloseHandle (hObject=0x3e8) returned 1
	[0186.849] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.849] SetEndOfFile (hFile=0x558) returned 1
	[0186.852] CloseHandle (hObject=0x558) returned 1
	[0186.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 1
	[0186.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.853] lstrlenW (lpString=".doc") returned 4
	[0186.853] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.853] lstrlenW (lpString=".docx") returned 5
	[0186.853] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.853] lstrlenW (lpString=".pdf") returned 4
	[0186.853] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.853] lstrlenW (lpString=".xls") returned 4
	[0186.853] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.853] lstrlenW (lpString=".xlsx") returned 5
	[0186.853] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.853] lstrlenW (lpString=".ppt") returned 4
	[0186.853] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.853] lstrlenW (lpString=".zip") returned 4
	[0186.853] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.853] lstrlenW (lpString=".rar") returned 4
	[0186.854] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.854] lstrlenW (lpString=".bz2") returned 4
	[0186.854] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.854] lstrlenW (lpString=".7z") returned 3
	[0186.854] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.854] lstrlenW (lpString=".dbf") returned 4
	[0186.854] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.854] lstrlenW (lpString=".1cd") returned 4
	[0186.854] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.854] lstrlenW (lpString=".jpg") returned 4
	[0186.854] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.854] lstrlenW (lpString=".doc") returned 4
	[0186.854] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.854] lstrlenW (lpString=".docx") returned 5
	[0186.854] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.854] lstrlenW (lpString=".pdf") returned 4
	[0186.854] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.854] lstrlenW (lpString=".xls") returned 4
	[0186.854] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.854] lstrlenW (lpString=".xlsx") returned 5
	[0186.854] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.854] lstrlenW (lpString=".ppt") returned 4
	[0186.854] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.854] lstrlenW (lpString=".zip") returned 4
	[0186.854] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.855] lstrlenW (lpString=".rar") returned 4
	[0186.855] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.855] lstrlenW (lpString=".bz2") returned 4
	[0186.855] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.855] lstrlenW (lpString=".7z") returned 3
	[0186.855] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.855] lstrlenW (lpString=".dbf") returned 4
	[0186.855] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.855] lstrlenW (lpString=".1cd") returned 4
	[0186.855] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0186.855] lstrlenW (lpString=".jpg") returned 4
	[0186.855] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.855] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.855] lstrlenW (lpString="O365BusinessR_Subscription-pl.xrm-ms") returned 36
	[0186.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.856] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11195) returned 1
	[0186.856] CloseHandle (hObject=0x558) returned 1
	[0186.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 0x220
	[0186.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.856] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.856] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0186.857] GetLastError () returned 0x0
	[0186.857] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0186.859] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0186.860] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.860] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0186.860] SetEndOfFile (hFile=0x3e8) returned 1
	[0186.860] CloseHandle (hObject=0x3e8) returned 1
	[0186.860] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.860] SetEndOfFile (hFile=0x558) returned 1
	[0186.866] CloseHandle (hObject=0x558) returned 1
	[0186.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 1
	[0186.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.867] lstrlenW (lpString=".doc") returned 4
	[0186.867] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.867] lstrlenW (lpString=".docx") returned 5
	[0186.867] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.867] lstrlenW (lpString=".pdf") returned 4
	[0186.868] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.868] lstrlenW (lpString=".xls") returned 4
	[0186.868] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.868] lstrlenW (lpString=".xlsx") returned 5
	[0186.868] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.868] lstrlenW (lpString=".ppt") returned 4
	[0186.868] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.868] lstrlenW (lpString=".zip") returned 4
	[0186.868] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.868] lstrlenW (lpString=".rar") returned 4
	[0186.868] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.868] lstrlenW (lpString=".bz2") returned 4
	[0186.868] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.868] lstrlenW (lpString=".7z") returned 3
	[0186.868] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.868] lstrlenW (lpString=".dbf") returned 4
	[0186.868] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.868] lstrlenW (lpString=".1cd") returned 4
	[0186.868] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.868] lstrlenW (lpString=".jpg") returned 4
	[0186.868] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.868] lstrlenW (lpString=".doc") returned 4
	[0186.868] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.868] lstrlenW (lpString=".docx") returned 5
	[0186.868] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.869] lstrlenW (lpString=".pdf") returned 4
	[0186.869] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.869] lstrlenW (lpString=".xls") returned 4
	[0186.869] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.869] lstrlenW (lpString=".xlsx") returned 5
	[0186.869] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.869] lstrlenW (lpString=".ppt") returned 4
	[0186.869] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.869] lstrlenW (lpString=".zip") returned 4
	[0186.869] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.869] lstrlenW (lpString=".rar") returned 4
	[0186.869] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.869] lstrlenW (lpString=".bz2") returned 4
	[0186.869] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.869] lstrlenW (lpString=".7z") returned 3
	[0186.869] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.869] lstrlenW (lpString=".dbf") returned 4
	[0186.869] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.869] lstrlenW (lpString=".1cd") returned 4
	[0186.869] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0186.869] lstrlenW (lpString=".jpg") returned 4
	[0186.869] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.869] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.870] lstrlenW (lpString="O365BusinessR_Subscription-ppd.xrm-ms") returned 37
	[0186.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.870] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=25386) returned 1
	[0186.870] CloseHandle (hObject=0x558) returned 1
	[0186.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 0x220
	[0186.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0186.871] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.871] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0186.872] GetLastError () returned 0x0
	[0186.872] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x632a, lpOverlapped=0x0) returned 1
	[0187.017] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x6330, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x6330, lpOverlapped=0x0) returned 1
	[0187.019] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.019] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0187.019] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.125] CloseHandle (hObject=0x3e8) returned 1
	[0187.125] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.125] SetEndOfFile (hFile=0x558) returned 1
	[0187.128] CloseHandle (hObject=0x558) returned 1
	[0187.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 1
	[0187.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.129] lstrlenW (lpString=".doc") returned 4
	[0187.129] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.129] lstrlenW (lpString=".docx") returned 5
	[0187.129] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.129] lstrlenW (lpString=".pdf") returned 4
	[0187.129] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.129] lstrlenW (lpString=".xls") returned 4
	[0187.129] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.129] lstrlenW (lpString=".xlsx") returned 5
	[0187.129] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.129] lstrlenW (lpString=".ppt") returned 4
	[0187.129] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.129] lstrlenW (lpString=".zip") returned 4
	[0187.129] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.130] lstrlenW (lpString=".rar") returned 4
	[0187.130] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.130] lstrlenW (lpString=".bz2") returned 4
	[0187.130] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.130] lstrlenW (lpString=".7z") returned 3
	[0187.130] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.130] lstrlenW (lpString=".dbf") returned 4
	[0187.130] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.130] lstrlenW (lpString=".1cd") returned 4
	[0187.130] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.130] lstrlenW (lpString=".jpg") returned 4
	[0187.130] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.130] lstrlenW (lpString=".doc") returned 4
	[0187.130] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.130] lstrlenW (lpString=".docx") returned 5
	[0187.130] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.130] lstrlenW (lpString=".pdf") returned 4
	[0187.130] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.130] lstrlenW (lpString=".xls") returned 4
	[0187.130] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.130] lstrlenW (lpString=".xlsx") returned 5
	[0187.130] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.130] lstrlenW (lpString=".ppt") returned 4
	[0187.130] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.131] lstrlenW (lpString=".zip") returned 4
	[0187.131] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.131] lstrlenW (lpString=".rar") returned 4
	[0187.131] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.131] lstrlenW (lpString=".bz2") returned 4
	[0187.131] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.131] lstrlenW (lpString=".7z") returned 3
	[0187.131] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.131] lstrlenW (lpString=".dbf") returned 4
	[0187.131] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.131] lstrlenW (lpString=".1cd") returned 4
	[0187.131] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0187.131] lstrlenW (lpString=".jpg") returned 4
	[0187.131] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.131] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.131] lstrlenW (lpString="O365HomePremR_Grace-ppd.xrm-ms") returned 30
	[0187.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.132] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=23068) returned 1
	[0187.132] CloseHandle (hObject=0x558) returned 1
	[0187.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 0x220
	[0187.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.132] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.133] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.133] GetLastError () returned 0x0
	[0187.133] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x5a1c, lpOverlapped=0x0) returned 1
	[0187.135] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x5a20, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x5a20, lpOverlapped=0x0) returned 1
	[0187.136] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.136] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x110, lpOverlapped=0x0) returned 1
	[0187.137] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.137] CloseHandle (hObject=0x3e8) returned 1
	[0187.137] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.137] SetEndOfFile (hFile=0x558) returned 1
	[0187.140] CloseHandle (hObject=0x558) returned 1
	[0187.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 1
	[0187.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.141] lstrlenW (lpString=".doc") returned 4
	[0187.141] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.141] lstrlenW (lpString=".docx") returned 5
	[0187.141] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.141] lstrlenW (lpString=".pdf") returned 4
	[0187.141] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.141] lstrlenW (lpString=".xls") returned 4
	[0187.141] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.141] lstrlenW (lpString=".xlsx") returned 5
	[0187.141] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.141] lstrlenW (lpString=".ppt") returned 4
	[0187.141] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.141] lstrlenW (lpString=".zip") returned 4
	[0187.141] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.141] lstrlenW (lpString=".rar") returned 4
	[0187.141] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.141] lstrlenW (lpString=".bz2") returned 4
	[0187.141] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.141] lstrlenW (lpString=".7z") returned 3
	[0187.141] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.141] lstrlenW (lpString=".dbf") returned 4
	[0187.141] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.142] lstrlenW (lpString=".1cd") returned 4
	[0187.142] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.142] lstrlenW (lpString=".jpg") returned 4
	[0187.142] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.142] lstrlenW (lpString=".doc") returned 4
	[0187.142] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.142] lstrlenW (lpString=".docx") returned 5
	[0187.142] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.142] lstrlenW (lpString=".pdf") returned 4
	[0187.142] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.142] lstrlenW (lpString=".xls") returned 4
	[0187.142] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.142] lstrlenW (lpString=".xlsx") returned 5
	[0187.142] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.142] lstrlenW (lpString=".ppt") returned 4
	[0187.142] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.142] lstrlenW (lpString=".zip") returned 4
	[0187.142] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.142] lstrlenW (lpString=".rar") returned 4
	[0187.142] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.142] lstrlenW (lpString=".bz2") returned 4
	[0187.142] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.142] lstrlenW (lpString=".7z") returned 3
	[0187.142] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.142] lstrlenW (lpString=".dbf") returned 4
	[0187.143] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.143] lstrlenW (lpString=".1cd") returned 4
	[0187.143] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0187.143] lstrlenW (lpString=".jpg") returned 4
	[0187.143] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.143] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.143] lstrlenW (lpString="O365HomePremR_Grace-ul-oob.xrm-ms") returned 33
	[0187.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.144] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11624) returned 1
	[0187.144] CloseHandle (hObject=0x558) returned 1
	[0187.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 0x220
	[0187.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.144] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.144] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.146] GetLastError () returned 0x0
	[0187.146] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d68, lpOverlapped=0x0) returned 1
	[0187.147] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0187.148] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.148] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x116, lpOverlapped=0x0) returned 1
	[0187.148] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.149] CloseHandle (hObject=0x3e8) returned 1
	[0187.149] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.149] SetEndOfFile (hFile=0x558) returned 1
	[0187.151] CloseHandle (hObject=0x558) returned 1
	[0187.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 1
	[0187.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.152] lstrlenW (lpString=".doc") returned 4
	[0187.152] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.152] lstrlenW (lpString=".docx") returned 5
	[0187.152] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.152] lstrlenW (lpString=".pdf") returned 4
	[0187.152] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.152] lstrlenW (lpString=".xls") returned 4
	[0187.153] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.153] lstrlenW (lpString=".xlsx") returned 5
	[0187.153] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.153] lstrlenW (lpString=".ppt") returned 4
	[0187.153] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.153] lstrlenW (lpString=".zip") returned 4
	[0187.153] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.153] lstrlenW (lpString=".rar") returned 4
	[0187.153] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.153] lstrlenW (lpString=".bz2") returned 4
	[0187.153] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.153] lstrlenW (lpString=".7z") returned 3
	[0187.153] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.153] lstrlenW (lpString=".dbf") returned 4
	[0187.153] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.153] lstrlenW (lpString=".1cd") returned 4
	[0187.153] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.153] lstrlenW (lpString=".jpg") returned 4
	[0187.153] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.153] lstrlenW (lpString=".doc") returned 4
	[0187.153] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.153] lstrlenW (lpString=".docx") returned 5
	[0187.153] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.153] lstrlenW (lpString=".pdf") returned 4
	[0187.154] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.154] lstrlenW (lpString=".xls") returned 4
	[0187.154] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.154] lstrlenW (lpString=".xlsx") returned 5
	[0187.154] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.154] lstrlenW (lpString=".ppt") returned 4
	[0187.154] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.154] lstrlenW (lpString=".zip") returned 4
	[0187.154] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.154] lstrlenW (lpString=".rar") returned 4
	[0187.154] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.154] lstrlenW (lpString=".bz2") returned 4
	[0187.154] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.154] lstrlenW (lpString=".7z") returned 3
	[0187.154] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.154] lstrlenW (lpString=".dbf") returned 4
	[0187.154] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.154] lstrlenW (lpString=".1cd") returned 4
	[0187.154] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0187.154] lstrlenW (lpString=".jpg") returned 4
	[0187.154] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.154] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.155] lstrlenW (lpString="O365HomePremR_Subscription1-pl.xrm-ms") returned 37
	[0187.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.155] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11199) returned 1
	[0187.155] CloseHandle (hObject=0x558) returned 1
	[0187.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 0x220
	[0187.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.156] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.156] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.156] GetLastError () returned 0x0
	[0187.389] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0187.391] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0187.392] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.392] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0187.392] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.392] CloseHandle (hObject=0x3e8) returned 1
	[0187.393] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.393] SetEndOfFile (hFile=0x558) returned 1
	[0187.395] CloseHandle (hObject=0x558) returned 1
	[0187.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 1
	[0187.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.396] lstrlenW (lpString=".doc") returned 4
	[0187.396] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.396] lstrlenW (lpString=".docx") returned 5
	[0187.396] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.396] lstrlenW (lpString=".pdf") returned 4
	[0187.396] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.397] lstrlenW (lpString=".xls") returned 4
	[0187.397] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.397] lstrlenW (lpString=".xlsx") returned 5
	[0187.397] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.397] lstrlenW (lpString=".ppt") returned 4
	[0187.397] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.397] lstrlenW (lpString=".zip") returned 4
	[0187.397] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.397] lstrlenW (lpString=".rar") returned 4
	[0187.397] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.397] lstrlenW (lpString=".bz2") returned 4
	[0187.397] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.397] lstrlenW (lpString=".7z") returned 3
	[0187.397] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.397] lstrlenW (lpString=".dbf") returned 4
	[0187.397] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.397] lstrlenW (lpString=".1cd") returned 4
	[0187.397] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.397] lstrlenW (lpString=".jpg") returned 4
	[0187.397] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.397] lstrlenW (lpString=".doc") returned 4
	[0187.397] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.397] lstrlenW (lpString=".docx") returned 5
	[0187.397] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.397] lstrlenW (lpString=".pdf") returned 4
	[0187.398] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.398] lstrlenW (lpString=".xls") returned 4
	[0187.398] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.398] lstrlenW (lpString=".xlsx") returned 5
	[0187.398] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.398] lstrlenW (lpString=".ppt") returned 4
	[0187.398] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.398] lstrlenW (lpString=".zip") returned 4
	[0187.398] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.398] lstrlenW (lpString=".rar") returned 4
	[0187.398] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.398] lstrlenW (lpString=".bz2") returned 4
	[0187.398] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.398] lstrlenW (lpString=".7z") returned 3
	[0187.398] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.398] lstrlenW (lpString=".dbf") returned 4
	[0187.398] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.398] lstrlenW (lpString=".1cd") returned 4
	[0187.398] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0187.398] lstrlenW (lpString=".jpg") returned 4
	[0187.398] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.398] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.398] lstrlenW (lpString="O365HomePremR_Subscription4-pl.xrm-ms") returned 37
	[0187.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.399] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11199) returned 1
	[0187.399] CloseHandle (hObject=0x558) returned 1
	[0187.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 0x220
	[0187.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.400] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.400] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.401] GetLastError () returned 0x0
	[0187.401] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0187.402] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0187.403] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.403] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0187.403] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.404] CloseHandle (hObject=0x3e8) returned 1
	[0187.404] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.404] SetEndOfFile (hFile=0x558) returned 1
	[0187.407] CloseHandle (hObject=0x558) returned 1
	[0187.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 1
	[0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.409] lstrlenW (lpString=".doc") returned 4
	[0187.409] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.409] lstrlenW (lpString=".docx") returned 5
	[0187.409] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.409] lstrlenW (lpString=".pdf") returned 4
	[0187.409] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.409] lstrlenW (lpString=".xls") returned 4
	[0187.409] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.409] lstrlenW (lpString=".xlsx") returned 5
	[0187.409] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.409] lstrlenW (lpString=".ppt") returned 4
	[0187.409] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.409] lstrlenW (lpString=".zip") returned 4
	[0187.409] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.409] lstrlenW (lpString=".rar") returned 4
	[0187.409] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.409] lstrlenW (lpString=".bz2") returned 4
	[0187.409] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.409] lstrlenW (lpString=".7z") returned 3
	[0187.409] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.409] lstrlenW (lpString=".dbf") returned 4
	[0187.409] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.409] lstrlenW (lpString=".1cd") returned 4
	[0187.409] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.409] lstrlenW (lpString=".jpg") returned 4
	[0187.409] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.410] lstrlenW (lpString=".doc") returned 4
	[0187.410] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.410] lstrlenW (lpString=".docx") returned 5
	[0187.410] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.410] lstrlenW (lpString=".pdf") returned 4
	[0187.410] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.410] lstrlenW (lpString=".xls") returned 4
	[0187.410] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.410] lstrlenW (lpString=".xlsx") returned 5
	[0187.410] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.410] lstrlenW (lpString=".ppt") returned 4
	[0187.410] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.410] lstrlenW (lpString=".zip") returned 4
	[0187.410] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.410] lstrlenW (lpString=".rar") returned 4
	[0187.410] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.410] lstrlenW (lpString=".bz2") returned 4
	[0187.410] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.410] lstrlenW (lpString=".7z") returned 3
	[0187.410] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.410] lstrlenW (lpString=".dbf") returned 4
	[0187.410] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.410] lstrlenW (lpString=".1cd") returned 4
	[0187.410] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0187.410] lstrlenW (lpString=".jpg") returned 4
	[0187.411] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.411] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.411] lstrlenW (lpString="O365HomePremR_Subscription4-ppd.xrm-ms") returned 38
	[0187.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.411] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=26541) returned 1
	[0187.411] CloseHandle (hObject=0x558) returned 1
	[0187.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 0x220
	[0187.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.412] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.412] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0187.413] GetLastError () returned 0x0
	[0187.413] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0187.415] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0187.416] ReadFile (in: hFile=0x558, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.416] WriteFile (in: hFile=0x3e8, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x120, lpOverlapped=0x0) returned 1
	[0187.416] SetEndOfFile (hFile=0x3e8) returned 1
	[0187.416] CloseHandle (hObject=0x3e8) returned 1
	[0187.416] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.416] SetEndOfFile (hFile=0x558) returned 1
	[0187.419] CloseHandle (hObject=0x558) returned 1
	[0187.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 1
	[0187.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.420] lstrlenW (lpString=".doc") returned 4
	[0187.420] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.420] lstrlenW (lpString=".docx") returned 5
	[0187.420] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.420] lstrlenW (lpString=".pdf") returned 4
	[0187.420] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.420] lstrlenW (lpString=".xls") returned 4
	[0187.421] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.421] lstrlenW (lpString=".xlsx") returned 5
	[0187.421] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.421] lstrlenW (lpString=".ppt") returned 4
	[0187.421] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.421] lstrlenW (lpString=".zip") returned 4
	[0187.421] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.421] lstrlenW (lpString=".rar") returned 4
	[0187.421] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.421] lstrlenW (lpString=".bz2") returned 4
	[0187.421] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.421] lstrlenW (lpString=".7z") returned 3
	[0187.421] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.421] lstrlenW (lpString=".dbf") returned 4
	[0187.421] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.421] lstrlenW (lpString=".1cd") returned 4
	[0187.421] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.421] lstrlenW (lpString=".jpg") returned 4
	[0187.421] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.421] lstrlenW (lpString=".doc") returned 4
	[0187.421] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.421] lstrlenW (lpString=".docx") returned 5
	[0187.421] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.421] lstrlenW (lpString=".pdf") returned 4
	[0187.421] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.422] lstrlenW (lpString=".xls") returned 4
	[0187.422] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.422] lstrlenW (lpString=".xlsx") returned 5
	[0187.422] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.422] lstrlenW (lpString=".ppt") returned 4
	[0187.422] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.422] lstrlenW (lpString=".zip") returned 4
	[0187.422] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.422] lstrlenW (lpString=".rar") returned 4
	[0187.422] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.422] lstrlenW (lpString=".bz2") returned 4
	[0187.422] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.422] lstrlenW (lpString=".7z") returned 3
	[0187.422] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.422] lstrlenW (lpString=".dbf") returned 4
	[0187.422] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.422] lstrlenW (lpString=".1cd") returned 4
	[0187.422] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0187.422] lstrlenW (lpString=".jpg") returned 4
	[0187.422] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.423] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.423] lstrlenW (lpString="O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 41
	[0187.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0187.423] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11651) returned 1
	[0187.423] CloseHandle (hObject=0x558) returned 1
	[0187.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 0x220
	[0187.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0187.757] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.757] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0187.758] GetLastError () returned 0x0
	[0187.758] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0187.759] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0187.760] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.760] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x126, lpOverlapped=0x0) returned 1
	[0187.761] SetEndOfFile (hFile=0x54c) returned 1
	[0187.761] CloseHandle (hObject=0x54c) returned 1
	[0187.761] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.761] SetEndOfFile (hFile=0x370) returned 1
	[0187.763] CloseHandle (hObject=0x370) returned 1
	[0187.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 1
	[0187.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.765] lstrlenW (lpString=".doc") returned 4
	[0187.765] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.765] lstrlenW (lpString=".docx") returned 5
	[0187.765] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.765] lstrlenW (lpString=".pdf") returned 4
	[0187.765] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.765] lstrlenW (lpString=".xls") returned 4
	[0187.765] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.765] lstrlenW (lpString=".xlsx") returned 5
	[0187.765] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.765] lstrlenW (lpString=".ppt") returned 4
	[0187.765] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.765] lstrlenW (lpString=".zip") returned 4
	[0187.765] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.765] lstrlenW (lpString=".rar") returned 4
	[0187.765] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.765] lstrlenW (lpString=".bz2") returned 4
	[0187.765] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.765] lstrlenW (lpString=".7z") returned 3
	[0187.766] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.766] lstrlenW (lpString=".dbf") returned 4
	[0187.766] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.766] lstrlenW (lpString=".1cd") returned 4
	[0187.766] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.766] lstrlenW (lpString=".jpg") returned 4
	[0187.766] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.766] lstrlenW (lpString=".doc") returned 4
	[0187.766] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.766] lstrlenW (lpString=".docx") returned 5
	[0187.766] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.766] lstrlenW (lpString=".pdf") returned 4
	[0187.766] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.766] lstrlenW (lpString=".xls") returned 4
	[0187.766] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.766] lstrlenW (lpString=".xlsx") returned 5
	[0187.766] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.766] lstrlenW (lpString=".ppt") returned 4
	[0187.767] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.767] lstrlenW (lpString=".zip") returned 4
	[0187.767] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.767] lstrlenW (lpString=".rar") returned 4
	[0187.767] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.767] lstrlenW (lpString=".bz2") returned 4
	[0187.767] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.767] lstrlenW (lpString=".7z") returned 3
	[0187.767] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.767] lstrlenW (lpString=".dbf") returned 4
	[0187.767] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.767] lstrlenW (lpString=".1cd") returned 4
	[0187.767] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0187.767] lstrlenW (lpString=".jpg") returned 4
	[0187.767] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.767] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.767] lstrlenW (lpString="O365HomePremR_SubTest3-pl.xrm-ms") returned 32
	[0187.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0187.769] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11179) returned 1
	[0187.769] CloseHandle (hObject=0x370) returned 1
	[0187.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 0x220
	[0187.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0187.770] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.770] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0187.771] GetLastError () returned 0x0
	[0187.771] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0187.772] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0187.773] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.773] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x114, lpOverlapped=0x0) returned 1
	[0187.774] SetEndOfFile (hFile=0x54c) returned 1
	[0187.774] CloseHandle (hObject=0x54c) returned 1
	[0187.774] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.774] SetEndOfFile (hFile=0x370) returned 1
	[0187.776] CloseHandle (hObject=0x370) returned 1
	[0187.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 1
	[0187.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.778] lstrlenW (lpString=".doc") returned 4
	[0187.778] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.778] lstrlenW (lpString=".docx") returned 5
	[0187.778] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.778] lstrlenW (lpString=".pdf") returned 4
	[0187.778] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.778] lstrlenW (lpString=".xls") returned 4
	[0187.778] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.778] lstrlenW (lpString=".xlsx") returned 5
	[0187.778] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.778] lstrlenW (lpString=".ppt") returned 4
	[0187.778] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.778] lstrlenW (lpString=".zip") returned 4
	[0187.778] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.778] lstrlenW (lpString=".rar") returned 4
	[0187.779] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.779] lstrlenW (lpString=".bz2") returned 4
	[0187.779] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.779] lstrlenW (lpString=".7z") returned 3
	[0187.779] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.779] lstrlenW (lpString=".dbf") returned 4
	[0187.779] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.779] lstrlenW (lpString=".1cd") returned 4
	[0187.779] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.779] lstrlenW (lpString=".jpg") returned 4
	[0187.779] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.779] lstrlenW (lpString=".doc") returned 4
	[0187.779] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.779] lstrlenW (lpString=".docx") returned 5
	[0187.779] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.779] lstrlenW (lpString=".pdf") returned 4
	[0187.779] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.779] lstrlenW (lpString=".xls") returned 4
	[0187.779] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.779] lstrlenW (lpString=".xlsx") returned 5
	[0187.779] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.779] lstrlenW (lpString=".ppt") returned 4
	[0187.779] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.779] lstrlenW (lpString=".zip") returned 4
	[0187.779] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.780] lstrlenW (lpString=".rar") returned 4
	[0187.780] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.780] lstrlenW (lpString=".bz2") returned 4
	[0187.780] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.780] lstrlenW (lpString=".7z") returned 3
	[0187.780] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.780] lstrlenW (lpString=".dbf") returned 4
	[0187.780] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.780] lstrlenW (lpString=".1cd") returned 4
	[0187.780] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0187.780] lstrlenW (lpString=".jpg") returned 4
	[0187.780] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.780] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.780] lstrlenW (lpString="O365HomePremR_SubTest3-ppd.xrm-ms") returned 33
	[0187.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0187.781] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=23134) returned 1
	[0187.781] CloseHandle (hObject=0x370) returned 1
	[0187.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 0x220
	[0187.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0187.782] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.782] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0187.783] GetLastError () returned 0x0
	[0187.783] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0187.785] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0187.786] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.786] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x116, lpOverlapped=0x0) returned 1
	[0187.786] SetEndOfFile (hFile=0x54c) returned 1
	[0187.786] CloseHandle (hObject=0x54c) returned 1
	[0187.786] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.786] SetEndOfFile (hFile=0x370) returned 1
	[0187.790] CloseHandle (hObject=0x370) returned 1
	[0187.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 1
	[0187.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.791] lstrlenW (lpString=".doc") returned 4
	[0187.791] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.791] lstrlenW (lpString=".docx") returned 5
	[0187.791] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.791] lstrlenW (lpString=".pdf") returned 4
	[0187.791] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.791] lstrlenW (lpString=".xls") returned 4
	[0187.791] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.791] lstrlenW (lpString=".xlsx") returned 5
	[0187.791] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.791] lstrlenW (lpString=".ppt") returned 4
	[0187.791] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.791] lstrlenW (lpString=".zip") returned 4
	[0187.791] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.792] lstrlenW (lpString=".rar") returned 4
	[0187.792] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.792] lstrlenW (lpString=".bz2") returned 4
	[0187.792] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.792] lstrlenW (lpString=".7z") returned 3
	[0187.792] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.792] lstrlenW (lpString=".dbf") returned 4
	[0187.792] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.792] lstrlenW (lpString=".1cd") returned 4
	[0187.792] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.792] lstrlenW (lpString=".jpg") returned 4
	[0187.792] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.792] lstrlenW (lpString=".doc") returned 4
	[0187.792] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.792] lstrlenW (lpString=".docx") returned 5
	[0187.792] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.792] lstrlenW (lpString=".pdf") returned 4
	[0187.792] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.792] lstrlenW (lpString=".xls") returned 4
	[0187.792] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.792] lstrlenW (lpString=".xlsx") returned 5
	[0187.792] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.792] lstrlenW (lpString=".ppt") returned 4
	[0187.792] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.793] lstrlenW (lpString=".zip") returned 4
	[0187.793] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.793] lstrlenW (lpString=".rar") returned 4
	[0187.793] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.793] lstrlenW (lpString=".bz2") returned 4
	[0187.793] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.793] lstrlenW (lpString=".7z") returned 3
	[0187.793] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.793] lstrlenW (lpString=".dbf") returned 4
	[0187.793] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.793] lstrlenW (lpString=".1cd") returned 4
	[0187.793] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0187.793] lstrlenW (lpString=".jpg") returned 4
	[0187.793] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.793] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.793] lstrlenW (lpString="O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 36
	[0187.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0187.794] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11630) returned 1
	[0187.794] CloseHandle (hObject=0x370) returned 1
	[0187.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 0x220
	[0187.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0187.795] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.795] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0187.796] GetLastError () returned 0x0
	[0187.796] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0188.118] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0188.119] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.119] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0188.119] SetEndOfFile (hFile=0x54c) returned 1
	[0188.119] CloseHandle (hObject=0x54c) returned 1
	[0188.119] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.119] SetEndOfFile (hFile=0x370) returned 1
	[0188.122] CloseHandle (hObject=0x370) returned 1
	[0188.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 1
	[0188.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.124] lstrlenW (lpString=".doc") returned 4
	[0188.124] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.124] lstrlenW (lpString=".docx") returned 5
	[0188.124] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.124] lstrlenW (lpString=".pdf") returned 4
	[0188.124] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.124] lstrlenW (lpString=".xls") returned 4
	[0188.124] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.124] lstrlenW (lpString=".xlsx") returned 5
	[0188.124] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.124] lstrlenW (lpString=".ppt") returned 4
	[0188.124] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.124] lstrlenW (lpString=".zip") returned 4
	[0188.124] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.124] lstrlenW (lpString=".rar") returned 4
	[0188.124] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.124] lstrlenW (lpString=".bz2") returned 4
	[0188.124] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.124] lstrlenW (lpString=".7z") returned 3
	[0188.124] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.124] lstrlenW (lpString=".dbf") returned 4
	[0188.124] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.124] lstrlenW (lpString=".1cd") returned 4
	[0188.124] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.124] lstrlenW (lpString=".jpg") returned 4
	[0188.124] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.125] lstrlenW (lpString=".doc") returned 4
	[0188.125] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.125] lstrlenW (lpString=".docx") returned 5
	[0188.125] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.125] lstrlenW (lpString=".pdf") returned 4
	[0188.125] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.125] lstrlenW (lpString=".xls") returned 4
	[0188.125] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.125] lstrlenW (lpString=".xlsx") returned 5
	[0188.125] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.125] lstrlenW (lpString=".ppt") returned 4
	[0188.125] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.125] lstrlenW (lpString=".zip") returned 4
	[0188.125] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.125] lstrlenW (lpString=".rar") returned 4
	[0188.125] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.125] lstrlenW (lpString=".bz2") returned 4
	[0188.125] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.125] lstrlenW (lpString=".7z") returned 3
	[0188.125] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.125] lstrlenW (lpString=".dbf") returned 4
	[0188.125] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.125] lstrlenW (lpString=".1cd") returned 4
	[0188.125] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0188.126] lstrlenW (lpString=".jpg") returned 4
	[0188.126] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.126] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0188.126] lstrlenW (lpString="O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 37
	[0188.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0188.126] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11635) returned 1
	[0188.126] CloseHandle (hObject=0x370) returned 1
	[0188.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 0x220
	[0188.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0188.127] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.127] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0188.128] GetLastError () returned 0x0
	[0188.128] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2d73, lpOverlapped=0x0) returned 1
	[0188.130] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0188.131] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.131] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0188.131] SetEndOfFile (hFile=0x54c) returned 1
	[0188.131] CloseHandle (hObject=0x54c) returned 1
	[0188.131] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.131] SetEndOfFile (hFile=0x370) returned 1
	[0188.133] CloseHandle (hObject=0x370) returned 1
	[0188.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 1
	[0188.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.135] lstrlenW (lpString=".doc") returned 4
	[0188.135] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.135] lstrlenW (lpString=".docx") returned 5
	[0188.135] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.135] lstrlenW (lpString=".pdf") returned 4
	[0188.135] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.135] lstrlenW (lpString=".xls") returned 4
	[0188.135] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.135] lstrlenW (lpString=".xlsx") returned 5
	[0188.135] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.135] lstrlenW (lpString=".ppt") returned 4
	[0188.135] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.135] lstrlenW (lpString=".zip") returned 4
	[0188.135] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.135] lstrlenW (lpString=".rar") returned 4
	[0188.135] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.135] lstrlenW (lpString=".bz2") returned 4
	[0188.135] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.135] lstrlenW (lpString=".7z") returned 3
	[0188.135] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.135] lstrlenW (lpString=".dbf") returned 4
	[0188.135] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.135] lstrlenW (lpString=".1cd") returned 4
	[0188.135] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.135] lstrlenW (lpString=".jpg") returned 4
	[0188.135] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.136] lstrlenW (lpString=".doc") returned 4
	[0188.136] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.136] lstrlenW (lpString=".docx") returned 5
	[0188.136] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.136] lstrlenW (lpString=".pdf") returned 4
	[0188.136] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.136] lstrlenW (lpString=".xls") returned 4
	[0188.136] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.136] lstrlenW (lpString=".xlsx") returned 5
	[0188.136] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.136] lstrlenW (lpString=".ppt") returned 4
	[0188.136] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.136] lstrlenW (lpString=".zip") returned 4
	[0188.136] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.136] lstrlenW (lpString=".rar") returned 4
	[0188.136] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.136] lstrlenW (lpString=".bz2") returned 4
	[0188.136] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.136] lstrlenW (lpString=".7z") returned 3
	[0188.136] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.136] lstrlenW (lpString=".dbf") returned 4
	[0188.136] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.136] lstrlenW (lpString=".1cd") returned 4
	[0188.136] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0188.136] lstrlenW (lpString=".jpg") returned 4
	[0188.137] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.137] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0188.137] lstrlenW (lpString="O365HomePremR_SubTrial2-pl.xrm-ms") returned 33
	[0188.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0188.137] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=11183) returned 1
	[0188.137] CloseHandle (hObject=0x370) returned 1
	[0188.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 0x220
	[0188.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0188.138] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.138] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0188.139] GetLastError () returned 0x0
	[0188.139] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0188.141] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0188.142] ReadFile (in: hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesRead=0x395fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.142] WriteFile (in: hFile=0x54c, lpBuffer=0x434b020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x395fc94, lpOverlapped=0x0 | out: lpBuffer=0x434b020*, lpNumberOfBytesWritten=0x395fc94*=0x116, lpOverlapped=0x0) returned 1
	[0188.142] SetEndOfFile (hFile=0x54c) returned 1
	[0188.142] CloseHandle (hObject=0x54c) returned 1
	[0188.142] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.143] SetEndOfFile (hFile=0x370) returned 1
	[0188.145] CloseHandle (hObject=0x370) returned 1
	[0188.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 1
	[0188.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.146] lstrlenW (lpString=".doc") returned 4
	[0188.146] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.146] lstrlenW (lpString=".docx") returned 5
	[0188.146] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.147] lstrlenW (lpString=".pdf") returned 4
	[0188.147] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.147] lstrlenW (lpString=".xls") returned 4
	[0188.147] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.147] lstrlenW (lpString=".xlsx") returned 5
	[0188.147] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.147] lstrlenW (lpString=".ppt") returned 4
	[0188.147] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.147] lstrlenW (lpString=".zip") returned 4
	[0188.147] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.147] lstrlenW (lpString=".rar") returned 4
	[0188.147] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.147] lstrlenW (lpString=".bz2") returned 4
	[0188.147] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.147] lstrlenW (lpString=".7z") returned 3
	[0188.147] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.147] lstrlenW (lpString=".dbf") returned 4
	[0188.147] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.147] lstrlenW (lpString=".1cd") returned 4
	[0188.147] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.147] lstrlenW (lpString=".jpg") returned 4
	[0188.147] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.147] lstrlenW (lpString=".doc") returned 4
	[0188.147] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.147] lstrlenW (lpString=".docx") returned 5
	[0188.148] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.148] lstrlenW (lpString=".pdf") returned 4
	[0188.148] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.148] lstrlenW (lpString=".xls") returned 4
	[0188.148] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.148] lstrlenW (lpString=".xlsx") returned 5
	[0188.148] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.148] lstrlenW (lpString=".ppt") returned 4
	[0188.148] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.148] lstrlenW (lpString=".zip") returned 4
	[0188.148] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.148] lstrlenW (lpString=".rar") returned 4
	[0188.148] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.148] lstrlenW (lpString=".bz2") returned 4
	[0188.148] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.148] lstrlenW (lpString=".7z") returned 3
	[0188.148] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.148] lstrlenW (lpString=".dbf") returned 4
	[0188.148] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.148] lstrlenW (lpString=".1cd") returned 4
	[0188.148] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0188.148] lstrlenW (lpString=".jpg") returned 4
	[0188.148] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.149] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0188.149] lstrlenW (lpString="O365HomePremR_SubTrial2-ppd.xrm-ms") returned 34
	[0188.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0188.149] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x395ff14 | out: lpFileSize=0x395ff14*=23135) returned 1
	[0188.149] CloseHandle (hObject=0x370) returned 1
	[0188.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms")) returned 0x220
	[0188.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0188.150] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.150] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x395fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0188.151] GetLastError () returned 0x0
	[0188.151] ReadFile (hFile=0x370, lpBuffer=0x434b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x395fecc, lpOverlapped=0x0) 

Thread:
	id = 50
	os_tid = 0xe2c

	[0153.981] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3ed4950
	[0153.981] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x4450048
	[0153.982] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e768
	[0153.982] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x571f50
	[0153.982] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e540
	[0153.982] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x465a020
	[0153.985] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e558
	[0153.985] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e558, Size=0x20) returned 0x4f2758
	[0153.985] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x52e558
	[0153.985] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e558, Size=0x20) returned 0x4f2668
	[0153.985] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x760c0000
	[0153.985] GetProcAddress (hModule=0x760c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x760d6b30
	[0153.985] Wow64DisableWow64FsRedirection (in: OldValue=0x3a9ff50 | out: OldValue=0x3a9ff50*=0x0) returned 1
	[0153.985] lstrlenW (lpString="kernel32.dll") returned 12
	[0153.985] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2758 | out: hHeap=0x4c0000) returned 1
	[0153.985] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0153.985] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f2668 | out: hHeap=0x4c0000) returned 1
	[0153.985] Sleep (dwMilliseconds=0x64) 
	[0154.283] Sleep (dwMilliseconds=0x64) 
	[0154.438] Sleep (dwMilliseconds=0x64) 
	[0154.723] Sleep (dwMilliseconds=0x64) 
	[0155.028] Sleep (dwMilliseconds=0x64) 
	[0155.391] Sleep (dwMilliseconds=0x64) 
	[0155.646] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.646] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.646] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0155.746] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=76632) returned 1
	[0155.746] CloseHandle (hObject=0x3e4) returned 1
	[0155.746] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0155.746] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.746] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.746] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.746] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.746] lstrlenW (lpString=".doc") returned 4
	[0155.746] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.746] lstrlenW (lpString=".docx") returned 5
	[0155.746] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.746] lstrlenW (lpString=".pdf") returned 4
	[0155.746] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.746] lstrlenW (lpString=".xls") returned 4
	[0155.747] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.747] lstrlenW (lpString=".xlsx") returned 5
	[0155.747] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.747] lstrlenW (lpString=".ppt") returned 4
	[0155.747] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.747] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.747] lstrlenW (lpString=".zip") returned 4
	[0155.747] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.747] lstrlenW (lpString=".rar") returned 4
	[0155.747] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.747] lstrlenW (lpString=".bz2") returned 4
	[0155.747] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.747] lstrlenW (lpString=".7z") returned 3
	[0155.747] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.747] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.747] lstrlenW (lpString=".dbf") returned 4
	[0155.747] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.747] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.747] lstrlenW (lpString=".1cd") returned 4
	[0155.747] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.747] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.747] lstrlenW (lpString=".jpg") returned 4
	[0155.747] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.747] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.747] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.747] lstrlenW (lpString=".doc") returned 4
	[0155.747] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.747] lstrlenW (lpString=".docx") returned 5
	[0155.747] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.747] lstrlenW (lpString=".pdf") returned 4
	[0155.747] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.748] lstrlenW (lpString=".xls") returned 4
	[0155.748] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.748] lstrlenW (lpString=".xlsx") returned 5
	[0155.748] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.748] lstrlenW (lpString=".ppt") returned 4
	[0155.748] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.748] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.748] lstrlenW (lpString=".zip") returned 4
	[0155.748] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.748] lstrlenW (lpString=".rar") returned 4
	[0155.748] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.748] lstrlenW (lpString=".bz2") returned 4
	[0155.748] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.748] lstrlenW (lpString=".7z") returned 3
	[0155.748] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.748] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.748] lstrlenW (lpString=".dbf") returned 4
	[0155.748] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.748] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.748] lstrlenW (lpString=".1cd") returned 4
	[0155.748] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.748] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0155.748] lstrlenW (lpString=".jpg") returned 4
	[0155.748] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.748] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.749] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0155.749] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0155.759] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=45472) returned 1
	[0155.759] CloseHandle (hObject=0x3e4) returned 1
	[0155.759] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20
	[0155.760] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.760] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.760] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.760] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.760] lstrlenW (lpString=".doc") returned 4
	[0155.760] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.760] lstrlenW (lpString=".docx") returned 5
	[0155.760] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.760] lstrlenW (lpString=".pdf") returned 4
	[0155.760] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.760] lstrlenW (lpString=".xls") returned 4
	[0155.760] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.760] lstrlenW (lpString=".xlsx") returned 5
	[0155.760] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.760] lstrlenW (lpString=".ppt") returned 4
	[0155.760] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.760] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.760] lstrlenW (lpString=".zip") returned 4
	[0155.760] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.760] lstrlenW (lpString=".rar") returned 4
	[0155.760] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.760] lstrlenW (lpString=".bz2") returned 4
	[0155.761] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.761] lstrlenW (lpString=".7z") returned 3
	[0155.761] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.761] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.761] lstrlenW (lpString=".dbf") returned 4
	[0155.761] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.761] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.761] lstrlenW (lpString=".1cd") returned 4
	[0155.761] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.761] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.761] lstrlenW (lpString=".jpg") returned 4
	[0155.761] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.761] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.761] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.761] lstrlenW (lpString=".doc") returned 4
	[0155.761] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.761] lstrlenW (lpString=".docx") returned 5
	[0155.761] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.761] lstrlenW (lpString=".pdf") returned 4
	[0155.761] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.761] lstrlenW (lpString=".xls") returned 4
	[0155.761] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.761] lstrlenW (lpString=".xlsx") returned 5
	[0155.761] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.761] lstrlenW (lpString=".ppt") returned 4
	[0155.761] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.761] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.761] lstrlenW (lpString=".zip") returned 4
	[0155.762] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.762] lstrlenW (lpString=".rar") returned 4
	[0155.762] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.762] lstrlenW (lpString=".bz2") returned 4
	[0155.762] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.762] lstrlenW (lpString=".7z") returned 3
	[0155.762] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.762] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.762] lstrlenW (lpString=".dbf") returned 4
	[0155.762] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.762] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.762] lstrlenW (lpString=".1cd") returned 4
	[0155.762] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.762] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29
	[0155.762] lstrlenW (lpString=".jpg") returned 4
	[0155.762] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.762] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0155.762] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.762] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0155.770] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=74072) returned 1
	[0155.770] CloseHandle (hObject=0x3e4) returned 1
	[0155.770] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20
	[0155.770] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0155.770] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.770] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.770] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.770] lstrlenW (lpString=".doc") returned 4
	[0155.770] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.770] lstrlenW (lpString=".docx") returned 5
	[0155.770] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.770] lstrlenW (lpString=".pdf") returned 4
	[0155.770] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.770] lstrlenW (lpString=".xls") returned 4
	[0155.770] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.771] lstrlenW (lpString=".xlsx") returned 5
	[0155.771] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.771] lstrlenW (lpString=".ppt") returned 4
	[0155.771] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.771] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.771] lstrlenW (lpString=".zip") returned 4
	[0155.771] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.771] lstrlenW (lpString=".rar") returned 4
	[0155.771] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.771] lstrlenW (lpString=".bz2") returned 4
	[0155.771] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.771] lstrlenW (lpString=".7z") returned 3
	[0155.771] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.771] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.771] lstrlenW (lpString=".dbf") returned 4
	[0155.771] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.771] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.771] lstrlenW (lpString=".1cd") returned 4
	[0155.771] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.771] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.771] lstrlenW (lpString=".jpg") returned 4
	[0155.771] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.771] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.771] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.771] lstrlenW (lpString=".doc") returned 4
	[0155.771] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.771] lstrlenW (lpString=".docx") returned 5
	[0155.771] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.771] lstrlenW (lpString=".pdf") returned 4
	[0155.771] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.771] lstrlenW (lpString=".xls") returned 4
	[0155.772] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0155.772] lstrlenW (lpString=".xlsx") returned 5
	[0155.772] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0155.772] lstrlenW (lpString=".ppt") returned 4
	[0155.772] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.772] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.772] lstrlenW (lpString=".zip") returned 4
	[0155.772] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0155.772] lstrlenW (lpString=".rar") returned 4
	[0155.772] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.772] lstrlenW (lpString=".bz2") returned 4
	[0155.772] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.772] lstrlenW (lpString=".7z") returned 3
	[0155.772] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.772] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.772] lstrlenW (lpString=".dbf") returned 4
	[0155.772] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.772] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.772] lstrlenW (lpString=".1cd") returned 4
	[0155.772] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.772] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0155.772] lstrlenW (lpString=".jpg") returned 4
	[0155.772] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.772] Sleep (dwMilliseconds=0x64) 
	[0156.047] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0156.047] lstrlenW (lpString="msyhn_boot.ttf") returned 14
	[0156.047] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0156.131] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=154427) returned 1
	[0156.134] CloseHandle (hObject=0x438) returned 1
	[0156.134] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20
	[0156.134] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.134] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.134] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.134] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.134] lstrlenW (lpString=".doc") returned 4
	[0156.134] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0156.134] lstrlenW (lpString=".docx") returned 5
	[0156.134] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0156.134] lstrlenW (lpString=".pdf") returned 4
	[0156.134] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0156.135] lstrlenW (lpString=".xls") returned 4
	[0156.135] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0156.135] lstrlenW (lpString=".xlsx") returned 5
	[0156.135] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0156.135] lstrlenW (lpString=".ppt") returned 4
	[0156.135] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0156.135] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.135] lstrlenW (lpString=".zip") returned 4
	[0156.135] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0156.135] lstrlenW (lpString=".rar") returned 4
	[0156.135] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0156.135] lstrlenW (lpString=".bz2") returned 4
	[0156.135] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0156.135] lstrlenW (lpString=".7z") returned 3
	[0156.135] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0156.135] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.135] lstrlenW (lpString=".dbf") returned 4
	[0156.135] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0156.135] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.135] lstrlenW (lpString=".1cd") returned 4
	[0156.135] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0156.135] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.135] lstrlenW (lpString=".jpg") returned 4
	[0156.135] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0156.135] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.135] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.135] lstrlenW (lpString=".doc") returned 4
	[0156.135] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0156.136] lstrlenW (lpString=".docx") returned 5
	[0156.136] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0156.136] lstrlenW (lpString=".pdf") returned 4
	[0156.136] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0156.136] lstrlenW (lpString=".xls") returned 4
	[0156.136] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0156.136] lstrlenW (lpString=".xlsx") returned 5
	[0156.136] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0156.136] lstrlenW (lpString=".ppt") returned 4
	[0156.136] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0156.136] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.136] lstrlenW (lpString=".zip") returned 4
	[0156.136] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0156.136] lstrlenW (lpString=".rar") returned 4
	[0156.136] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0156.136] lstrlenW (lpString=".bz2") returned 4
	[0156.136] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0156.136] lstrlenW (lpString=".7z") returned 3
	[0156.136] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0156.136] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.136] lstrlenW (lpString=".dbf") returned 4
	[0156.136] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0156.136] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.136] lstrlenW (lpString=".1cd") returned 4
	[0156.136] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0156.136] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0156.136] lstrlenW (lpString=".jpg") returned 4
	[0156.136] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0156.137] Sleep (dwMilliseconds=0x64) 
	[0156.296] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0156.302] lstrlenW (lpString="mip.exe") returned 7
	[0156.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0156.375] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=1540608) returned 1
	[0156.375] CloseHandle (hObject=0x44c) returned 1
	[0156.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20
	[0156.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.375] lstrlenW (lpString=".doc") returned 4
	[0156.375] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0156.375] lstrlenW (lpString=".docx") returned 5
	[0156.375] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0156.375] lstrlenW (lpString=".pdf") returned 4
	[0156.375] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0156.375] lstrlenW (lpString=".xls") returned 4
	[0156.375] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0156.376] lstrlenW (lpString=".xlsx") returned 5
	[0156.376] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0156.376] lstrlenW (lpString=".ppt") returned 4
	[0156.376] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0156.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.376] lstrlenW (lpString=".zip") returned 4
	[0156.376] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0156.376] lstrlenW (lpString=".rar") returned 4
	[0156.376] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0156.376] lstrlenW (lpString=".bz2") returned 4
	[0156.376] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0156.376] lstrlenW (lpString=".7z") returned 3
	[0156.376] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0156.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.376] lstrlenW (lpString=".dbf") returned 4
	[0156.376] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0156.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.376] lstrlenW (lpString=".1cd") returned 4
	[0156.376] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0156.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.376] lstrlenW (lpString=".jpg") returned 4
	[0156.376] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0156.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.376] lstrlenW (lpString=".doc") returned 4
	[0156.376] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0156.376] lstrlenW (lpString=".docx") returned 5
	[0156.376] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0156.377] lstrlenW (lpString=".pdf") returned 4
	[0156.377] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0156.377] lstrlenW (lpString=".xls") returned 4
	[0156.377] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0156.377] lstrlenW (lpString=".xlsx") returned 5
	[0156.377] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0156.377] lstrlenW (lpString=".ppt") returned 4
	[0156.377] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0156.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.377] lstrlenW (lpString=".zip") returned 4
	[0156.377] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0156.377] lstrlenW (lpString=".rar") returned 4
	[0156.377] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0156.377] lstrlenW (lpString=".bz2") returned 4
	[0156.377] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0156.377] lstrlenW (lpString=".7z") returned 3
	[0156.377] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0156.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.377] lstrlenW (lpString=".dbf") returned 4
	[0156.377] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0156.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.377] lstrlenW (lpString=".1cd") returned 4
	[0156.377] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0156.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58
	[0156.377] lstrlenW (lpString=".jpg") returned 4
	[0156.377] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0156.377] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0156.378] lstrlenW (lpString="msadcer.dll.mui") returned 15
	[0156.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0156.378] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=10240) returned 1
	[0156.379] CloseHandle (hObject=0x44c) returned 1
	[0156.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20
	[0156.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.379] lstrlenW (lpString=".doc") returned 4
	[0156.379] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0156.379] lstrlenW (lpString=".docx") returned 5
	[0156.379] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0156.379] lstrlenW (lpString=".pdf") returned 4
	[0156.379] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0156.379] lstrlenW (lpString=".xls") returned 4
	[0156.379] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0156.379] lstrlenW (lpString=".xlsx") returned 5
	[0156.379] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0156.379] lstrlenW (lpString=".ppt") returned 4
	[0156.379] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0156.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.379] lstrlenW (lpString=".zip") returned 4
	[0156.380] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0156.380] lstrlenW (lpString=".rar") returned 4
	[0156.380] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0156.380] lstrlenW (lpString=".bz2") returned 4
	[0156.380] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0156.380] lstrlenW (lpString=".7z") returned 3
	[0156.380] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0156.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.380] lstrlenW (lpString=".dbf") returned 4
	[0156.380] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0156.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.380] lstrlenW (lpString=".1cd") returned 4
	[0156.380] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0156.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.380] lstrlenW (lpString=".jpg") returned 4
	[0156.380] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0156.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.380] lstrlenW (lpString=".doc") returned 4
	[0156.380] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0156.380] lstrlenW (lpString=".docx") returned 5
	[0156.380] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0156.380] lstrlenW (lpString=".pdf") returned 4
	[0156.380] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0156.380] lstrlenW (lpString=".xls") returned 4
	[0156.380] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0156.380] lstrlenW (lpString=".xlsx") returned 5
	[0156.381] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0156.381] lstrlenW (lpString=".ppt") returned 4
	[0156.381] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0156.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.381] lstrlenW (lpString=".zip") returned 4
	[0156.381] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0156.381] lstrlenW (lpString=".rar") returned 4
	[0156.381] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0156.381] lstrlenW (lpString=".bz2") returned 4
	[0156.381] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0156.381] lstrlenW (lpString=".7z") returned 3
	[0156.381] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0156.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.381] lstrlenW (lpString=".dbf") returned 4
	[0156.381] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0156.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.381] lstrlenW (lpString=".1cd") returned 4
	[0156.381] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0156.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64
	[0156.381] lstrlenW (lpString=".jpg") returned 4
	[0156.381] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0156.381] lstrcmpiW (lpString1=".mui", lpString2=".money") returned 1
	[0156.381] lstrlenW (lpString="msaddsr.dll.mui") returned 15
	[0156.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0156.382] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=14336) returned 1
	[0156.382] CloseHandle (hObject=0x44c) returned 1
	[0156.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20
	[0156.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0156.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 64
	[0156.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 64
	[0156.383] lstrlenW (lpString=".doc") returned 4
	[0156.383] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0156.383] lstrlenW (lpString=".docx") returned 5
	[0156.383] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0156.383] lstrlenW (lpString=".pdf") returned 4
	[0156.383] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0156.383] lstrlenW (lpString=".xls") returned 4
	[0156.383] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0156.383] lstrlenW (lpString=".xlsx") returned 5
	[0156.383] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0156.383] lstrlenW (lpString=".ppt") returned 4
	[0156.383] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0156.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 64
	[0156.383] lstrlenW (lpString=".zip") returned 4
	[0156.383] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0156.383] lstrlenW (lpString=".rar") returned 4
	[0156.383] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0156.383] lstrlenW (lpString=".bz2") returned 4
	[0156.383] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0156.383] lstrlenW (lpString=".7z") returned 3
	[0156.383] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0156.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 64
	[0156.416] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x3e62088, Size=0x2000) returned 0x3e62088
	[0156.416] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0156.669] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.669] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.669] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0156.765] GetLastError () returned 0x0
	[0156.765] ReadFile (in: hFile=0x49c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x95, lpOverlapped=0x0) returned 1
	[0156.786] WriteFile (in: hFile=0x4a4, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0156.809] ReadFile (in: hFile=0x49c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.809] WriteFile (in: hFile=0x4a4, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x104, lpOverlapped=0x0) returned 1
	[0156.809] SetEndOfFile (hFile=0x4a4) returned 1
	[0156.809] CloseHandle (hObject=0x4a4) returned 1
	[0156.810] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.810] SetEndOfFile (hFile=0x49c) returned 1
	[0156.812] CloseHandle (hObject=0x49c) returned 1
	[0156.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0157.132] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1
	[0157.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.564] lstrlenW (lpString=".doc") returned 4
	[0157.564] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0157.564] lstrlenW (lpString=".docx") returned 5
	[0157.564] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0157.564] lstrlenW (lpString=".pdf") returned 4
	[0157.564] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0157.564] lstrlenW (lpString=".xls") returned 4
	[0157.564] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0157.564] lstrlenW (lpString=".xlsx") returned 5
	[0157.564] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0157.564] lstrlenW (lpString=".ppt") returned 4
	[0157.564] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0157.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.564] lstrlenW (lpString=".zip") returned 4
	[0157.564] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0157.564] lstrlenW (lpString=".rar") returned 4
	[0157.564] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0157.564] lstrlenW (lpString=".bz2") returned 4
	[0157.564] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0157.564] lstrlenW (lpString=".7z") returned 3
	[0157.564] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0157.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.564] lstrlenW (lpString=".dbf") returned 4
	[0157.564] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0157.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.564] lstrlenW (lpString=".1cd") returned 4
	[0157.564] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0157.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.564] lstrlenW (lpString=".jpg") returned 4
	[0157.565] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0157.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.565] lstrlenW (lpString=".doc") returned 4
	[0157.565] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0157.565] lstrlenW (lpString=".docx") returned 5
	[0157.565] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0157.565] lstrlenW (lpString=".pdf") returned 4
	[0157.565] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0157.565] lstrlenW (lpString=".xls") returned 4
	[0157.565] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0157.565] lstrlenW (lpString=".xlsx") returned 5
	[0157.565] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0157.565] lstrlenW (lpString=".ppt") returned 4
	[0157.565] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0157.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.565] lstrlenW (lpString=".zip") returned 4
	[0157.565] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0157.565] lstrlenW (lpString=".rar") returned 4
	[0157.565] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0157.565] lstrlenW (lpString=".bz2") returned 4
	[0157.565] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0157.565] lstrlenW (lpString=".7z") returned 3
	[0157.565] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0157.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.565] lstrlenW (lpString=".dbf") returned 4
	[0157.565] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0157.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.565] lstrlenW (lpString=".1cd") returned 4
	[0157.565] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0157.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0157.566] lstrlenW (lpString=".jpg") returned 4
	[0157.566] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0157.566] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0157.566] lstrlenW (lpString="charsets.jar") returned 12
	[0157.566] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414
	[0157.936] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=3036922) returned 1
	[0157.936] CloseHandle (hObject=0x414) returned 1
	[0157.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20
	[0158.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0158.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[admin@stex777.com].money")) returned 0
	[0159.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.007] lstrlenW (lpString=".doc") returned 4
	[0159.007] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0159.007] lstrlenW (lpString=".docx") returned 5
	[0159.007] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0159.007] lstrlenW (lpString=".pdf") returned 4
	[0159.007] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0159.007] lstrlenW (lpString=".xls") returned 4
	[0159.007] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0159.007] lstrlenW (lpString=".xlsx") returned 5
	[0159.007] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0159.007] lstrlenW (lpString=".ppt") returned 4
	[0159.007] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0159.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.007] lstrlenW (lpString=".zip") returned 4
	[0159.007] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0159.008] lstrlenW (lpString=".rar") returned 4
	[0159.008] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0159.008] lstrlenW (lpString=".bz2") returned 4
	[0159.008] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0159.008] lstrlenW (lpString=".7z") returned 3
	[0159.008] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0159.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.008] lstrlenW (lpString=".dbf") returned 4
	[0159.008] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0159.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.008] lstrlenW (lpString=".1cd") returned 4
	[0159.008] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0159.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.008] lstrlenW (lpString=".jpg") returned 4
	[0159.008] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0159.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.008] lstrlenW (lpString=".doc") returned 4
	[0159.008] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0159.008] lstrlenW (lpString=".docx") returned 5
	[0159.008] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0159.008] lstrlenW (lpString=".pdf") returned 4
	[0159.008] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0159.008] lstrlenW (lpString=".xls") returned 4
	[0159.008] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0159.008] lstrlenW (lpString=".xlsx") returned 5
	[0159.008] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0159.008] lstrlenW (lpString=".ppt") returned 4
	[0159.008] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0159.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.009] lstrlenW (lpString=".zip") returned 4
	[0159.009] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0159.009] lstrlenW (lpString=".rar") returned 4
	[0159.009] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0159.009] lstrlenW (lpString=".bz2") returned 4
	[0159.009] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0159.009] lstrlenW (lpString=".7z") returned 3
	[0159.009] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0159.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.009] lstrlenW (lpString=".dbf") returned 4
	[0159.009] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0159.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.009] lstrlenW (lpString=".1cd") returned 4
	[0159.009] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0159.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0159.009] lstrlenW (lpString=".jpg") returned 4
	[0159.009] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0159.009] lstrcmpiW (lpString1=".pf", lpString2=".money") returned 1
	[0159.009] lstrlenW (lpString="CIEXYZ.pf") returned 9
	[0159.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0159.284] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=51236) returned 1
	[0159.284] CloseHandle (hObject=0x518) returned 1
	[0159.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20
	[0159.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.672] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0159.909] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.909] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.909] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0159.910] GetLastError () returned 0x0
	[0159.910] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xc824, lpOverlapped=0x0) returned 1
	[0159.913] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xc830, lpOverlapped=0x0) returned 1
	[0159.914] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.914] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0159.914] SetEndOfFile (hFile=0x540) returned 1
	[0159.915] CloseHandle (hObject=0x540) returned 1
	[0159.915] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.915] SetEndOfFile (hFile=0x53c) returned 1
	[0159.919] CloseHandle (hObject=0x53c) returned 1
	[0159.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0159.919] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1
	[0159.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.920] lstrlenW (lpString=".doc") returned 4
	[0159.920] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1
	[0159.920] lstrlenW (lpString=".docx") returned 5
	[0159.920] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1
	[0159.920] lstrlenW (lpString=".pdf") returned 4
	[0159.920] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1
	[0159.920] lstrlenW (lpString=".xls") returned 4
	[0159.920] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1
	[0159.920] lstrlenW (lpString=".xlsx") returned 5
	[0159.920] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1
	[0159.920] lstrlenW (lpString=".ppt") returned 4
	[0159.920] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1
	[0159.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.920] lstrlenW (lpString=".zip") returned 4
	[0159.920] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1
	[0159.920] lstrlenW (lpString=".rar") returned 4
	[0159.920] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1
	[0159.920] lstrlenW (lpString=".bz2") returned 4
	[0159.920] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1
	[0159.920] lstrlenW (lpString=".7z") returned 3
	[0159.920] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0159.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.920] lstrlenW (lpString=".dbf") returned 4
	[0159.920] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1
	[0159.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.920] lstrlenW (lpString=".1cd") returned 4
	[0159.920] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1
	[0159.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.921] lstrlenW (lpString=".jpg") returned 4
	[0159.921] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1
	[0159.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.921] lstrlenW (lpString=".doc") returned 4
	[0159.921] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1
	[0159.921] lstrlenW (lpString=".docx") returned 5
	[0159.921] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1
	[0159.921] lstrlenW (lpString=".pdf") returned 4
	[0159.921] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1
	[0159.921] lstrlenW (lpString=".xls") returned 4
	[0159.921] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1
	[0159.921] lstrlenW (lpString=".xlsx") returned 5
	[0159.921] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1
	[0159.921] lstrlenW (lpString=".ppt") returned 4
	[0159.921] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1
	[0159.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.921] lstrlenW (lpString=".zip") returned 4
	[0159.921] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1
	[0159.921] lstrlenW (lpString=".rar") returned 4
	[0159.921] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1
	[0159.921] lstrlenW (lpString=".bz2") returned 4
	[0159.921] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1
	[0159.921] lstrlenW (lpString=".7z") returned 3
	[0159.921] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0159.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.921] lstrlenW (lpString=".dbf") returned 4
	[0159.921] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1
	[0159.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.922] lstrlenW (lpString=".1cd") returned 4
	[0159.922] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1
	[0159.922] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0159.922] lstrlenW (lpString=".jpg") returned 4
	[0159.922] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1
	[0159.922] lstrcmpiW (lpString1=".data", lpString2=".money") returned -1
	[0159.922] lstrlenW (lpString="currency.data") returned 13
	[0159.922] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0159.922] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=4122) returned 1
	[0159.923] CloseHandle (hObject=0x53c) returned 1
	[0159.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20
	[0159.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.923] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0159.923] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.923] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.923] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0159.924] GetLastError () returned 0x0
	[0159.924] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x101a, lpOverlapped=0x0) returned 1
	[0159.926] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0159.927] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.927] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xee, lpOverlapped=0x0) returned 1
	[0159.927] SetEndOfFile (hFile=0x540) returned 1
	[0159.927] CloseHandle (hObject=0x540) returned 1
	[0159.927] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.927] SetEndOfFile (hFile=0x53c) returned 1
	[0159.930] CloseHandle (hObject=0x53c) returned 1
	[0159.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0159.930] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1
	[0159.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.931] lstrlenW (lpString=".doc") returned 4
	[0159.931] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1
	[0159.931] lstrlenW (lpString=".docx") returned 5
	[0159.931] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1
	[0159.931] lstrlenW (lpString=".pdf") returned 4
	[0159.931] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1
	[0159.931] lstrlenW (lpString=".xls") returned 4
	[0159.931] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1
	[0159.931] lstrlenW (lpString=".xlsx") returned 5
	[0159.931] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1
	[0159.931] lstrlenW (lpString=".ppt") returned 4
	[0159.931] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1
	[0159.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.931] lstrlenW (lpString=".zip") returned 4
	[0159.931] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1
	[0159.931] lstrlenW (lpString=".rar") returned 4
	[0159.931] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1
	[0159.931] lstrlenW (lpString=".bz2") returned 4
	[0159.931] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1
	[0159.931] lstrlenW (lpString=".7z") returned 3
	[0159.931] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1
	[0159.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.931] lstrlenW (lpString=".dbf") returned 4
	[0159.931] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1
	[0159.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.931] lstrlenW (lpString=".1cd") returned 4
	[0159.931] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1
	[0159.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.932] lstrlenW (lpString=".jpg") returned 4
	[0159.932] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1
	[0159.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.932] lstrlenW (lpString=".doc") returned 4
	[0159.932] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1
	[0159.932] lstrlenW (lpString=".docx") returned 5
	[0159.932] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1
	[0159.932] lstrlenW (lpString=".pdf") returned 4
	[0159.932] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1
	[0159.932] lstrlenW (lpString=".xls") returned 4
	[0159.932] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1
	[0159.932] lstrlenW (lpString=".xlsx") returned 5
	[0159.932] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1
	[0159.932] lstrlenW (lpString=".ppt") returned 4
	[0159.932] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1
	[0159.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.932] lstrlenW (lpString=".zip") returned 4
	[0159.932] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1
	[0159.932] lstrlenW (lpString=".rar") returned 4
	[0159.932] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1
	[0159.932] lstrlenW (lpString=".bz2") returned 4
	[0159.932] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1
	[0159.932] lstrlenW (lpString=".7z") returned 3
	[0159.932] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1
	[0159.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.932] lstrlenW (lpString=".dbf") returned 4
	[0159.932] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1
	[0159.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.933] lstrlenW (lpString=".1cd") returned 4
	[0159.933] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1
	[0159.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0159.933] lstrlenW (lpString=".jpg") returned 4
	[0159.933] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1
	[0159.933] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0159.933] lstrlenW (lpString="messages.properties") returned 19
	[0159.933] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0159.936] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=2860) returned 1
	[0159.936] CloseHandle (hObject=0x53c) returned 1
	[0159.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20
	[0159.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.936] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0159.936] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.936] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.936] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0159.938] GetLastError () returned 0x0
	[0159.938] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xb2c, lpOverlapped=0x0) returned 1
	[0159.940] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xb30, lpOverlapped=0x0) returned 1
	[0159.941] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.941] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0159.941] SetEndOfFile (hFile=0x540) returned 1
	[0159.941] CloseHandle (hObject=0x540) returned 1
	[0159.941] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.941] SetEndOfFile (hFile=0x53c) returned 1
	[0159.943] CloseHandle (hObject=0x53c) returned 1
	[0159.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0159.944] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1
	[0159.944] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.944] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.944] lstrlenW (lpString=".doc") returned 4
	[0159.944] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0159.944] lstrlenW (lpString=".docx") returned 5
	[0159.944] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0159.944] lstrlenW (lpString=".pdf") returned 4
	[0159.945] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0159.945] lstrlenW (lpString=".xls") returned 4
	[0159.945] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0159.945] lstrlenW (lpString=".xlsx") returned 5
	[0159.945] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0159.945] lstrlenW (lpString=".ppt") returned 4
	[0159.945] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0159.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.945] lstrlenW (lpString=".zip") returned 4
	[0159.945] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0159.945] lstrlenW (lpString=".rar") returned 4
	[0159.945] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0159.945] lstrlenW (lpString=".bz2") returned 4
	[0159.945] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0159.945] lstrlenW (lpString=".7z") returned 3
	[0159.945] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0159.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.945] lstrlenW (lpString=".dbf") returned 4
	[0159.945] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0159.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.945] lstrlenW (lpString=".1cd") returned 4
	[0159.945] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0159.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.945] lstrlenW (lpString=".jpg") returned 4
	[0159.945] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0159.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.945] lstrlenW (lpString=".doc") returned 4
	[0159.945] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0159.945] lstrlenW (lpString=".docx") returned 5
	[0159.946] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0159.946] lstrlenW (lpString=".pdf") returned 4
	[0159.946] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0159.946] lstrlenW (lpString=".xls") returned 4
	[0159.946] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0159.946] lstrlenW (lpString=".xlsx") returned 5
	[0159.946] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0159.946] lstrlenW (lpString=".ppt") returned 4
	[0159.946] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0159.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.946] lstrlenW (lpString=".zip") returned 4
	[0159.946] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0159.946] lstrlenW (lpString=".rar") returned 4
	[0159.946] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0159.946] lstrlenW (lpString=".bz2") returned 4
	[0159.946] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0159.946] lstrlenW (lpString=".7z") returned 3
	[0159.946] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0159.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.946] lstrlenW (lpString=".dbf") returned 4
	[0159.946] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0159.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.946] lstrlenW (lpString=".1cd") returned 4
	[0159.946] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0159.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0159.946] lstrlenW (lpString=".jpg") returned 4
	[0159.946] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0159.946] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0159.947] lstrlenW (lpString="messages_de.properties") returned 22
	[0159.947] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0159.947] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=3306) returned 1
	[0159.947] CloseHandle (hObject=0x53c) returned 1
	[0159.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20
	[0159.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0159.947] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0159.948] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.948] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.948] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0159.948] GetLastError () returned 0x0
	[0159.948] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xcea, lpOverlapped=0x0) returned 1
	[0160.331] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xcf0, lpOverlapped=0x0) returned 1
	[0160.332] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.332] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x100, lpOverlapped=0x0) returned 1
	[0160.332] SetEndOfFile (hFile=0x540) returned 1
	[0160.332] CloseHandle (hObject=0x540) returned 1
	[0160.333] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.333] SetEndOfFile (hFile=0x53c) returned 1
	[0160.337] CloseHandle (hObject=0x53c) returned 1
	[0160.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.337] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1
	[0160.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.338] lstrlenW (lpString=".doc") returned 4
	[0160.338] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.338] lstrlenW (lpString=".docx") returned 5
	[0160.338] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.338] lstrlenW (lpString=".pdf") returned 4
	[0160.338] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.338] lstrlenW (lpString=".xls") returned 4
	[0160.338] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.338] lstrlenW (lpString=".xlsx") returned 5
	[0160.338] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.338] lstrlenW (lpString=".ppt") returned 4
	[0160.338] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.338] lstrlenW (lpString=".zip") returned 4
	[0160.338] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.338] lstrlenW (lpString=".rar") returned 4
	[0160.338] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.338] lstrlenW (lpString=".bz2") returned 4
	[0160.338] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.338] lstrlenW (lpString=".7z") returned 3
	[0160.338] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.339] lstrlenW (lpString=".dbf") returned 4
	[0160.339] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.339] lstrlenW (lpString=".1cd") returned 4
	[0160.339] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.339] lstrlenW (lpString=".jpg") returned 4
	[0160.339] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.339] lstrlenW (lpString=".doc") returned 4
	[0160.339] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.339] lstrlenW (lpString=".docx") returned 5
	[0160.339] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.339] lstrlenW (lpString=".pdf") returned 4
	[0160.339] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.339] lstrlenW (lpString=".xls") returned 4
	[0160.339] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.339] lstrlenW (lpString=".xlsx") returned 5
	[0160.339] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.339] lstrlenW (lpString=".ppt") returned 4
	[0160.339] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.339] lstrlenW (lpString=".zip") returned 4
	[0160.339] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.339] lstrlenW (lpString=".rar") returned 4
	[0160.339] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.339] lstrlenW (lpString=".bz2") returned 4
	[0160.339] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.339] lstrlenW (lpString=".7z") returned 3
	[0160.339] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.340] lstrlenW (lpString=".dbf") returned 4
	[0160.340] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.340] lstrlenW (lpString=".1cd") returned 4
	[0160.340] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0160.340] lstrlenW (lpString=".jpg") returned 4
	[0160.340] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.340] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0160.340] lstrlenW (lpString="messages_pt_BR.properties") returned 25
	[0160.340] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0160.341] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=3285) returned 1
	[0160.341] CloseHandle (hObject=0x53c) returned 1
	[0160.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20
	[0160.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.341] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0160.342] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.342] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.342] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0160.342] GetLastError () returned 0x0
	[0160.342] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xcd5, lpOverlapped=0x0) returned 1
	[0160.344] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xce0, lpOverlapped=0x0) returned 1
	[0160.345] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.345] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x106, lpOverlapped=0x0) returned 1
	[0160.345] SetEndOfFile (hFile=0x540) returned 1
	[0160.345] CloseHandle (hObject=0x540) returned 1
	[0160.345] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.345] SetEndOfFile (hFile=0x53c) returned 1
	[0160.348] CloseHandle (hObject=0x53c) returned 1
	[0160.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.349] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1
	[0160.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.349] lstrlenW (lpString=".doc") returned 4
	[0160.349] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.349] lstrlenW (lpString=".docx") returned 5
	[0160.349] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.349] lstrlenW (lpString=".pdf") returned 4
	[0160.350] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.350] lstrlenW (lpString=".xls") returned 4
	[0160.350] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.350] lstrlenW (lpString=".xlsx") returned 5
	[0160.350] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.350] lstrlenW (lpString=".ppt") returned 4
	[0160.350] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.350] lstrlenW (lpString=".zip") returned 4
	[0160.350] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.350] lstrlenW (lpString=".rar") returned 4
	[0160.350] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.350] lstrlenW (lpString=".bz2") returned 4
	[0160.350] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.350] lstrlenW (lpString=".7z") returned 3
	[0160.350] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.350] lstrlenW (lpString=".dbf") returned 4
	[0160.350] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.350] lstrlenW (lpString=".1cd") returned 4
	[0160.350] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.350] lstrlenW (lpString=".jpg") returned 4
	[0160.350] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.350] lstrlenW (lpString=".doc") returned 4
	[0160.350] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.350] lstrlenW (lpString=".docx") returned 5
	[0160.350] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.351] lstrlenW (lpString=".pdf") returned 4
	[0160.351] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.351] lstrlenW (lpString=".xls") returned 4
	[0160.351] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.351] lstrlenW (lpString=".xlsx") returned 5
	[0160.351] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.351] lstrlenW (lpString=".ppt") returned 4
	[0160.351] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.351] lstrlenW (lpString=".zip") returned 4
	[0160.351] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.351] lstrlenW (lpString=".rar") returned 4
	[0160.351] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.351] lstrlenW (lpString=".bz2") returned 4
	[0160.351] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.351] lstrlenW (lpString=".7z") returned 3
	[0160.351] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.351] lstrlenW (lpString=".dbf") returned 4
	[0160.351] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.351] lstrlenW (lpString=".1cd") returned 4
	[0160.351] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0160.351] lstrlenW (lpString=".jpg") returned 4
	[0160.351] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.351] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0160.351] lstrlenW (lpString="messages_sv.properties") returned 22
	[0160.352] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0160.352] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=3409) returned 1
	[0160.352] CloseHandle (hObject=0x53c) returned 1
	[0160.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20
	[0160.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.352] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0160.353] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.353] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.353] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0160.353] GetLastError () returned 0x0
	[0160.353] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xd51, lpOverlapped=0x0) returned 1
	[0160.355] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xd60, lpOverlapped=0x0) returned 1
	[0160.356] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.356] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x100, lpOverlapped=0x0) returned 1
	[0160.356] SetEndOfFile (hFile=0x540) returned 1
	[0160.356] CloseHandle (hObject=0x540) returned 1
	[0160.356] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.356] SetEndOfFile (hFile=0x53c) returned 1
	[0160.359] CloseHandle (hObject=0x53c) returned 1
	[0160.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.359] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1
	[0160.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.359] lstrlenW (lpString=".doc") returned 4
	[0160.359] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.360] lstrlenW (lpString=".docx") returned 5
	[0160.360] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.360] lstrlenW (lpString=".pdf") returned 4
	[0160.360] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.360] lstrlenW (lpString=".xls") returned 4
	[0160.360] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.360] lstrlenW (lpString=".xlsx") returned 5
	[0160.360] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.360] lstrlenW (lpString=".ppt") returned 4
	[0160.360] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.360] lstrlenW (lpString=".zip") returned 4
	[0160.360] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.360] lstrlenW (lpString=".rar") returned 4
	[0160.360] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.360] lstrlenW (lpString=".bz2") returned 4
	[0160.360] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.360] lstrlenW (lpString=".7z") returned 3
	[0160.360] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.360] lstrlenW (lpString=".dbf") returned 4
	[0160.360] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.360] lstrlenW (lpString=".1cd") returned 4
	[0160.360] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.360] lstrlenW (lpString=".jpg") returned 4
	[0160.360] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.360] lstrlenW (lpString=".doc") returned 4
	[0160.360] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.361] lstrlenW (lpString=".docx") returned 5
	[0160.361] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.361] lstrlenW (lpString=".pdf") returned 4
	[0160.361] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.361] lstrlenW (lpString=".xls") returned 4
	[0160.361] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.361] lstrlenW (lpString=".xlsx") returned 5
	[0160.361] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.361] lstrlenW (lpString=".ppt") returned 4
	[0160.361] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.361] lstrlenW (lpString=".zip") returned 4
	[0160.361] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.361] lstrlenW (lpString=".rar") returned 4
	[0160.361] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.361] lstrlenW (lpString=".bz2") returned 4
	[0160.361] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.361] lstrlenW (lpString=".7z") returned 3
	[0160.361] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.361] lstrlenW (lpString=".dbf") returned 4
	[0160.361] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.361] lstrlenW (lpString=".1cd") returned 4
	[0160.361] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0160.362] lstrlenW (lpString=".jpg") returned 4
	[0160.362] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.362] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0160.362] lstrlenW (lpString="messages_zh_CN.properties") returned 25
	[0160.362] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0160.362] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=4072) returned 1
	[0160.362] CloseHandle (hObject=0x53c) returned 1
	[0160.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20
	[0160.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0160.363] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0160.363] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.363] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.363] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0160.364] GetLastError () returned 0x0
	[0160.364] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xfe8, lpOverlapped=0x0) returned 1
	[0160.461] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xff0, lpOverlapped=0x0) returned 1
	[0160.596] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.597] WriteFile (in: hFile=0x540, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x106, lpOverlapped=0x0) returned 1
	[0160.597] SetEndOfFile (hFile=0x540) returned 1
	[0160.597] CloseHandle (hObject=0x540) returned 1
	[0160.597] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.597] SetEndOfFile (hFile=0x53c) returned 1
	[0160.599] CloseHandle (hObject=0x53c) returned 1
	[0160.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0160.752] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1
	[0160.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.927] lstrlenW (lpString=".doc") returned 4
	[0160.927] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.927] lstrlenW (lpString=".docx") returned 5
	[0160.927] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.927] lstrlenW (lpString=".pdf") returned 4
	[0160.927] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.927] lstrlenW (lpString=".xls") returned 4
	[0160.927] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.927] lstrlenW (lpString=".xlsx") returned 5
	[0160.927] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.927] lstrlenW (lpString=".ppt") returned 4
	[0160.927] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.927] lstrlenW (lpString=".zip") returned 4
	[0160.927] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.927] lstrlenW (lpString=".rar") returned 4
	[0160.927] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.927] lstrlenW (lpString=".bz2") returned 4
	[0160.927] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.927] lstrlenW (lpString=".7z") returned 3
	[0160.927] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.927] lstrlenW (lpString=".dbf") returned 4
	[0160.927] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.927] lstrlenW (lpString=".1cd") returned 4
	[0160.927] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.928] lstrlenW (lpString=".jpg") returned 4
	[0160.928] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.928] lstrlenW (lpString=".doc") returned 4
	[0160.928] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0160.928] lstrlenW (lpString=".docx") returned 5
	[0160.928] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0160.928] lstrlenW (lpString=".pdf") returned 4
	[0160.928] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0160.928] lstrlenW (lpString=".xls") returned 4
	[0160.928] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0160.928] lstrlenW (lpString=".xlsx") returned 5
	[0160.928] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0160.928] lstrlenW (lpString=".ppt") returned 4
	[0160.928] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0160.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.928] lstrlenW (lpString=".zip") returned 4
	[0160.928] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0160.928] lstrlenW (lpString=".rar") returned 4
	[0160.928] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0160.928] lstrlenW (lpString=".bz2") returned 4
	[0160.928] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0160.928] lstrlenW (lpString=".7z") returned 3
	[0160.928] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0160.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.928] lstrlenW (lpString=".dbf") returned 4
	[0160.928] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0160.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.928] lstrlenW (lpString=".1cd") returned 4
	[0160.929] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0160.929] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0160.929] lstrlenW (lpString=".jpg") returned 4
	[0160.929] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0160.929] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0160.929] lstrlenW (lpString="cldrdata.jar") returned 12
	[0160.929] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.022] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=3860502) returned 1
	[0161.022] CloseHandle (hObject=0x51c) returned 1
	[0161.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20
	[0161.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0161.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[admin@stex777.com].money")) returned 0
	[0161.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.938] lstrlenW (lpString=".doc") returned 4
	[0161.938] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.938] lstrlenW (lpString=".docx") returned 5
	[0161.938] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0161.938] lstrlenW (lpString=".pdf") returned 4
	[0161.938] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.938] lstrlenW (lpString=".xls") returned 4
	[0161.939] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.939] lstrlenW (lpString=".xlsx") returned 5
	[0161.939] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0161.939] lstrlenW (lpString=".ppt") returned 4
	[0161.939] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.939] lstrlenW (lpString=".zip") returned 4
	[0161.939] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.939] lstrlenW (lpString=".rar") returned 4
	[0161.939] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.939] lstrlenW (lpString=".bz2") returned 4
	[0161.939] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.939] lstrlenW (lpString=".7z") returned 3
	[0161.939] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.939] lstrlenW (lpString=".dbf") returned 4
	[0161.939] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.939] lstrlenW (lpString=".1cd") returned 4
	[0161.939] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.939] lstrlenW (lpString=".jpg") returned 4
	[0161.940] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0161.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.940] lstrlenW (lpString=".doc") returned 4
	[0161.940] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0161.940] lstrlenW (lpString=".docx") returned 5
	[0161.940] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0161.940] lstrlenW (lpString=".pdf") returned 4
	[0161.940] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0161.940] lstrlenW (lpString=".xls") returned 4
	[0161.940] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0161.940] lstrlenW (lpString=".xlsx") returned 5
	[0161.940] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0161.940] lstrlenW (lpString=".ppt") returned 4
	[0161.940] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0161.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.940] lstrlenW (lpString=".zip") returned 4
	[0161.940] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0161.940] lstrlenW (lpString=".rar") returned 4
	[0161.940] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0161.940] lstrlenW (lpString=".bz2") returned 4
	[0161.940] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0161.940] lstrlenW (lpString=".7z") returned 3
	[0161.940] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0161.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.940] lstrlenW (lpString=".dbf") returned 4
	[0161.940] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0161.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.940] lstrlenW (lpString=".1cd") returned 4
	[0161.940] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0161.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0161.941] lstrlenW (lpString=".jpg") returned 4
	[0161.941] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0162.018] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0162.018] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26
	[0162.018] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0162.019] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=75124) returned 1
	[0162.019] CloseHandle (hObject=0x534) returned 1
	[0162.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20
	[0162.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.019] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0162.019] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.019] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.019] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0162.021] GetLastError () returned 0x0
	[0162.021] ReadFile (in: hFile=0x534, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x12574, lpOverlapped=0x0) returned 1
	[0162.032] WriteFile (in: hFile=0x54c, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x12580, lpOverlapped=0x0) returned 1
	[0162.035] ReadFile (in: hFile=0x534, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.035] WriteFile (in: hFile=0x54c, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x108, lpOverlapped=0x0) returned 1
	[0162.035] SetEndOfFile (hFile=0x54c) returned 1
	[0162.035] CloseHandle (hObject=0x54c) returned 1
	[0162.036] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.036] SetEndOfFile (hFile=0x534) returned 1
	[0162.050] CloseHandle (hObject=0x534) returned 1
	[0162.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0162.051] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1
	[0162.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.056] lstrlenW (lpString=".doc") returned 4
	[0162.056] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.056] lstrlenW (lpString=".docx") returned 5
	[0162.056] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0162.056] lstrlenW (lpString=".pdf") returned 4
	[0162.056] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.056] lstrlenW (lpString=".xls") returned 4
	[0162.056] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.056] lstrlenW (lpString=".xlsx") returned 5
	[0162.056] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0162.056] lstrlenW (lpString=".ppt") returned 4
	[0162.056] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.056] lstrlenW (lpString=".zip") returned 4
	[0162.056] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.056] lstrlenW (lpString=".rar") returned 4
	[0162.056] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.056] lstrlenW (lpString=".bz2") returned 4
	[0162.056] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.056] lstrlenW (lpString=".7z") returned 3
	[0162.056] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.056] lstrlenW (lpString=".dbf") returned 4
	[0162.056] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.057] lstrlenW (lpString=".1cd") returned 4
	[0162.057] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.057] lstrlenW (lpString=".jpg") returned 4
	[0162.057] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.057] lstrlenW (lpString=".doc") returned 4
	[0162.057] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.057] lstrlenW (lpString=".docx") returned 5
	[0162.057] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0162.057] lstrlenW (lpString=".pdf") returned 4
	[0162.057] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.057] lstrlenW (lpString=".xls") returned 4
	[0162.057] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.057] lstrlenW (lpString=".xlsx") returned 5
	[0162.057] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0162.057] lstrlenW (lpString=".ppt") returned 4
	[0162.057] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.057] lstrlenW (lpString=".zip") returned 4
	[0162.057] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.057] lstrlenW (lpString=".rar") returned 4
	[0162.057] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.057] lstrlenW (lpString=".bz2") returned 4
	[0162.057] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.057] lstrlenW (lpString=".7z") returned 3
	[0162.057] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.057] lstrlenW (lpString=".dbf") returned 4
	[0162.058] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.058] lstrlenW (lpString=".1cd") returned 4
	[0162.058] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0162.058] lstrlenW (lpString=".jpg") returned 4
	[0162.058] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.058] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0162.058] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23
	[0162.058] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0162.060] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=344908) returned 1
	[0162.060] CloseHandle (hObject=0x4b8) returned 1
	[0162.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20
	[0162.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.095] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0162.095] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.095] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.096] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0162.096] GetLastError () returned 0x0
	[0162.096] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x5434c, lpOverlapped=0x0) returned 1
	[0162.108] WriteFile (in: hFile=0x534, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x54350, lpOverlapped=0x0) returned 1
	[0162.473] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.473] WriteFile (in: hFile=0x534, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x102, lpOverlapped=0x0) returned 1
	[0162.473] SetEndOfFile (hFile=0x534) returned 1
	[0162.474] CloseHandle (hObject=0x534) returned 1
	[0162.474] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.474] SetEndOfFile (hFile=0x4b8) returned 1
	[0162.482] CloseHandle (hObject=0x4b8) returned 1
	[0162.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0162.483] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1
	[0162.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.483] lstrlenW (lpString=".doc") returned 4
	[0162.483] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.483] lstrlenW (lpString=".docx") returned 5
	[0162.483] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0162.483] lstrlenW (lpString=".pdf") returned 4
	[0162.483] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.483] lstrlenW (lpString=".xls") returned 4
	[0162.483] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.483] lstrlenW (lpString=".xlsx") returned 5
	[0162.484] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0162.484] lstrlenW (lpString=".ppt") returned 4
	[0162.484] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.484] lstrlenW (lpString=".zip") returned 4
	[0162.484] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.484] lstrlenW (lpString=".rar") returned 4
	[0162.484] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.484] lstrlenW (lpString=".bz2") returned 4
	[0162.484] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.484] lstrlenW (lpString=".7z") returned 3
	[0162.484] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.484] lstrlenW (lpString=".dbf") returned 4
	[0162.484] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.484] lstrlenW (lpString=".1cd") returned 4
	[0162.484] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.484] lstrlenW (lpString=".jpg") returned 4
	[0162.484] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.484] lstrlenW (lpString=".doc") returned 4
	[0162.484] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.484] lstrlenW (lpString=".docx") returned 5
	[0162.484] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0162.484] lstrlenW (lpString=".pdf") returned 4
	[0162.484] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.484] lstrlenW (lpString=".xls") returned 4
	[0162.485] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.485] lstrlenW (lpString=".xlsx") returned 5
	[0162.485] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0162.485] lstrlenW (lpString=".ppt") returned 4
	[0162.485] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.485] lstrlenW (lpString=".zip") returned 4
	[0162.485] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.485] lstrlenW (lpString=".rar") returned 4
	[0162.485] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.485] lstrlenW (lpString=".bz2") returned 4
	[0162.485] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.485] lstrlenW (lpString=".7z") returned 3
	[0162.485] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.485] lstrlenW (lpString=".dbf") returned 4
	[0162.485] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.485] lstrlenW (lpString=".1cd") returned 4
	[0162.485] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0162.485] lstrlenW (lpString=".jpg") returned 4
	[0162.485] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.485] lstrcmpiW (lpString1=".ttf", lpString2=".money") returned 1
	[0162.485] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27
	[0162.485] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0162.486] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=242700) returned 1
	[0162.486] CloseHandle (hObject=0x4b8) returned 1
	[0162.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20
	[0162.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.488] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0162.488] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.488] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.488] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0162.489] GetLastError () returned 0x0
	[0162.489] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x3b40c, lpOverlapped=0x0) returned 1
	[0162.497] WriteFile (in: hFile=0x534, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x3b410, lpOverlapped=0x0) returned 1
	[0162.502] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.502] WriteFile (in: hFile=0x534, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0162.502] SetEndOfFile (hFile=0x534) returned 1
	[0162.502] CloseHandle (hObject=0x534) returned 1
	[0162.502] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.502] SetEndOfFile (hFile=0x4b8) returned 1
	[0162.508] CloseHandle (hObject=0x4b8) returned 1
	[0162.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0162.508] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1
	[0162.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.509] lstrlenW (lpString=".doc") returned 4
	[0162.509] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.509] lstrlenW (lpString=".docx") returned 5
	[0162.509] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0162.509] lstrlenW (lpString=".pdf") returned 4
	[0162.509] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.509] lstrlenW (lpString=".xls") returned 4
	[0162.509] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.509] lstrlenW (lpString=".xlsx") returned 5
	[0162.509] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0162.509] lstrlenW (lpString=".ppt") returned 4
	[0162.509] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.510] lstrlenW (lpString=".zip") returned 4
	[0162.510] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.510] lstrlenW (lpString=".rar") returned 4
	[0162.510] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.510] lstrlenW (lpString=".bz2") returned 4
	[0162.510] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.510] lstrlenW (lpString=".7z") returned 3
	[0162.510] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.510] lstrlenW (lpString=".dbf") returned 4
	[0162.510] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.510] lstrlenW (lpString=".1cd") returned 4
	[0162.510] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.510] lstrlenW (lpString=".jpg") returned 4
	[0162.510] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.510] lstrlenW (lpString=".doc") returned 4
	[0162.510] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0162.510] lstrlenW (lpString=".docx") returned 5
	[0162.510] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0162.510] lstrlenW (lpString=".pdf") returned 4
	[0162.510] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0162.510] lstrlenW (lpString=".xls") returned 4
	[0162.510] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0162.510] lstrlenW (lpString=".xlsx") returned 5
	[0162.510] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0162.510] lstrlenW (lpString=".ppt") returned 4
	[0162.511] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0162.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.511] lstrlenW (lpString=".zip") returned 4
	[0162.511] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0162.511] lstrlenW (lpString=".rar") returned 4
	[0162.511] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0162.511] lstrlenW (lpString=".bz2") returned 4
	[0162.511] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0162.511] lstrlenW (lpString=".7z") returned 3
	[0162.511] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0162.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.511] lstrlenW (lpString=".dbf") returned 4
	[0162.511] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0162.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.511] lstrlenW (lpString=".1cd") returned 4
	[0162.511] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0162.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0162.511] lstrlenW (lpString=".jpg") returned 4
	[0162.511] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0162.511] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0162.511] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33
	[0162.511] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0162.512] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=13962) returned 1
	[0162.512] CloseHandle (hObject=0x4b8) returned 1
	[0162.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20
	[0162.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0162.512] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0162.512] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.513] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.513] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0162.513] GetLastError () returned 0x0
	[0162.513] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x368a, lpOverlapped=0x0) returned 1
	[0162.826] WriteFile (in: hFile=0x534, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x3690, lpOverlapped=0x0) returned 1
	[0162.829] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.829] WriteFile (in: hFile=0x534, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x116, lpOverlapped=0x0) returned 1
	[0162.829] SetEndOfFile (hFile=0x534) returned 1
	[0162.966] CloseHandle (hObject=0x534) returned 1
	[0162.970] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.970] SetEndOfFile (hFile=0x4b8) returned 1
	[0162.973] CloseHandle (hObject=0x4b8) returned 1
	[0162.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0162.973] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1
	[0162.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.974] lstrlenW (lpString=".doc") returned 4
	[0162.974] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0162.974] lstrlenW (lpString=".docx") returned 5
	[0162.974] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0162.974] lstrlenW (lpString=".pdf") returned 4
	[0162.974] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0162.974] lstrlenW (lpString=".xls") returned 4
	[0162.974] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0162.974] lstrlenW (lpString=".xlsx") returned 5
	[0162.974] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0162.974] lstrlenW (lpString=".ppt") returned 4
	[0162.974] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0162.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.974] lstrlenW (lpString=".zip") returned 4
	[0162.974] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0162.974] lstrlenW (lpString=".rar") returned 4
	[0162.974] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0162.974] lstrlenW (lpString=".bz2") returned 4
	[0162.974] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0162.974] lstrlenW (lpString=".7z") returned 3
	[0162.975] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0162.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.975] lstrlenW (lpString=".dbf") returned 4
	[0162.975] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0162.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.975] lstrlenW (lpString=".1cd") returned 4
	[0162.975] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0162.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.975] lstrlenW (lpString=".jpg") returned 4
	[0162.975] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0162.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.975] lstrlenW (lpString=".doc") returned 4
	[0162.975] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0162.975] lstrlenW (lpString=".docx") returned 5
	[0162.975] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0162.975] lstrlenW (lpString=".pdf") returned 4
	[0162.975] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0162.975] lstrlenW (lpString=".xls") returned 4
	[0162.975] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0162.975] lstrlenW (lpString=".xlsx") returned 5
	[0162.975] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0162.975] lstrlenW (lpString=".ppt") returned 4
	[0162.975] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0162.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.975] lstrlenW (lpString=".zip") returned 4
	[0162.975] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0162.975] lstrlenW (lpString=".rar") returned 4
	[0162.975] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0162.975] lstrlenW (lpString=".bz2") returned 4
	[0162.976] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0162.976] lstrlenW (lpString=".7z") returned 3
	[0162.976] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0162.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.976] lstrlenW (lpString=".dbf") returned 4
	[0162.976] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0162.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.976] lstrlenW (lpString=".1cd") returned 4
	[0162.976] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0162.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0162.976] lstrlenW (lpString=".jpg") returned 4
	[0162.976] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0163.260] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0163.260] lstrlenW (lpString="jfr.jar") returned 7
	[0163.260] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0163.261] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=560581) returned 1
	[0163.261] CloseHandle (hObject=0x4e4) returned 1
	[0163.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20
	[0163.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.261] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0163.261] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.261] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.261] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0163.262] GetLastError () returned 0x0
	[0163.262] ReadFile (in: hFile=0x4e4, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x88dc5, lpOverlapped=0x0) returned 1
	[0163.281] WriteFile (in: hFile=0x548, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x88dd0, lpOverlapped=0x0) returned 1
	[0163.292] ReadFile (in: hFile=0x4e4, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.292] WriteFile (in: hFile=0x548, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0163.292] SetEndOfFile (hFile=0x548) returned 1
	[0163.292] CloseHandle (hObject=0x548) returned 1
	[0163.292] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.292] SetEndOfFile (hFile=0x4e4) returned 1
	[0163.679] CloseHandle (hObject=0x4e4) returned 1
	[0163.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0163.679] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1
	[0163.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.680] lstrlenW (lpString=".doc") returned 4
	[0163.680] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0163.680] lstrlenW (lpString=".docx") returned 5
	[0163.680] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0163.680] lstrlenW (lpString=".pdf") returned 4
	[0163.680] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0163.680] lstrlenW (lpString=".xls") returned 4
	[0163.680] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0163.680] lstrlenW (lpString=".xlsx") returned 5
	[0163.680] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0163.680] lstrlenW (lpString=".ppt") returned 4
	[0163.680] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0163.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.680] lstrlenW (lpString=".zip") returned 4
	[0163.680] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0163.680] lstrlenW (lpString=".rar") returned 4
	[0163.680] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0163.681] lstrlenW (lpString=".bz2") returned 4
	[0163.681] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0163.681] lstrlenW (lpString=".7z") returned 3
	[0163.681] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0163.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.681] lstrlenW (lpString=".dbf") returned 4
	[0163.681] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0163.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.681] lstrlenW (lpString=".1cd") returned 4
	[0163.681] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0163.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.681] lstrlenW (lpString=".jpg") returned 4
	[0163.681] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0163.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.681] lstrlenW (lpString=".doc") returned 4
	[0163.681] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0163.681] lstrlenW (lpString=".docx") returned 5
	[0163.681] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0163.681] lstrlenW (lpString=".pdf") returned 4
	[0163.681] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0163.681] lstrlenW (lpString=".xls") returned 4
	[0163.681] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0163.681] lstrlenW (lpString=".xlsx") returned 5
	[0163.681] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0163.681] lstrlenW (lpString=".ppt") returned 4
	[0163.681] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0163.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.681] lstrlenW (lpString=".zip") returned 4
	[0163.681] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0163.681] lstrlenW (lpString=".rar") returned 4
	[0163.682] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0163.682] lstrlenW (lpString=".bz2") returned 4
	[0163.682] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0163.682] lstrlenW (lpString=".7z") returned 3
	[0163.682] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0163.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.682] lstrlenW (lpString=".dbf") returned 4
	[0163.682] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0163.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.682] lstrlenW (lpString=".1cd") returned 4
	[0163.682] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0163.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0163.682] lstrlenW (lpString=".jpg") returned 4
	[0163.682] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0163.682] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0163.682] lstrlenW (lpString="logging.properties") returned 18
	[0163.682] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0163.683] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=2455) returned 1
	[0163.683] CloseHandle (hObject=0x4e4) returned 1
	[0163.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20
	[0163.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.683] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0163.683] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.683] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.684] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0163.685] GetLastError () returned 0x0
	[0163.685] ReadFile (in: hFile=0x4e4, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x997, lpOverlapped=0x0) returned 1
	[0163.686] WriteFile (in: hFile=0x4b8, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x9a0, lpOverlapped=0x0) returned 1
	[0163.687] ReadFile (in: hFile=0x4e4, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.687] WriteFile (in: hFile=0x4b8, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0163.687] SetEndOfFile (hFile=0x4b8) returned 1
	[0163.687] CloseHandle (hObject=0x4b8) returned 1
	[0163.687] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.687] SetEndOfFile (hFile=0x4e4) returned 1
	[0163.690] CloseHandle (hObject=0x4e4) returned 1
	[0163.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0163.694] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1
	[0163.694] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.694] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.694] lstrlenW (lpString=".doc") returned 4
	[0163.694] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0163.695] lstrlenW (lpString=".docx") returned 5
	[0163.695] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0163.695] lstrlenW (lpString=".pdf") returned 4
	[0163.695] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0163.695] lstrlenW (lpString=".xls") returned 4
	[0163.695] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0163.695] lstrlenW (lpString=".xlsx") returned 5
	[0163.695] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0163.695] lstrlenW (lpString=".ppt") returned 4
	[0163.695] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0163.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.695] lstrlenW (lpString=".zip") returned 4
	[0163.695] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0163.695] lstrlenW (lpString=".rar") returned 4
	[0163.695] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0163.695] lstrlenW (lpString=".bz2") returned 4
	[0163.695] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0163.695] lstrlenW (lpString=".7z") returned 3
	[0163.695] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0163.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.695] lstrlenW (lpString=".dbf") returned 4
	[0163.695] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0163.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.695] lstrlenW (lpString=".1cd") returned 4
	[0163.695] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0163.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.695] lstrlenW (lpString=".jpg") returned 4
	[0163.695] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0163.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.695] lstrlenW (lpString=".doc") returned 4
	[0163.696] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0163.696] lstrlenW (lpString=".docx") returned 5
	[0163.696] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0163.696] lstrlenW (lpString=".pdf") returned 4
	[0163.696] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0163.696] lstrlenW (lpString=".xls") returned 4
	[0163.696] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0163.696] lstrlenW (lpString=".xlsx") returned 5
	[0163.696] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0163.696] lstrlenW (lpString=".ppt") returned 4
	[0163.696] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0163.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.696] lstrlenW (lpString=".zip") returned 4
	[0163.696] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0163.696] lstrlenW (lpString=".rar") returned 4
	[0163.696] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0163.696] lstrlenW (lpString=".bz2") returned 4
	[0163.696] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0163.696] lstrlenW (lpString=".7z") returned 3
	[0163.696] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0163.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.696] lstrlenW (lpString=".dbf") returned 4
	[0163.696] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0163.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.696] lstrlenW (lpString=".1cd") returned 4
	[0163.696] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0163.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0163.696] lstrlenW (lpString=".jpg") returned 4
	[0163.696] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0163.697] lstrcmpiW (lpString1=".access", lpString2=".money") returned -1
	[0163.697] lstrlenW (lpString="jmxremote.access") returned 16
	[0163.697] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0163.699] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=3998) returned 1
	[0163.699] CloseHandle (hObject=0x4e4) returned 1
	[0163.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20
	[0163.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0163.699] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0163.700] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.700] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.700] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0163.701] GetLastError () returned 0x0
	[0163.701] ReadFile (in: hFile=0x4e4, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xf9e, lpOverlapped=0x0) returned 1
	[0163.702] WriteFile (in: hFile=0x4b8, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xfa0, lpOverlapped=0x0) returned 1
	[0163.703] ReadFile (in: hFile=0x4e4, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.703] WriteFile (in: hFile=0x4b8, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0163.704] SetEndOfFile (hFile=0x4b8) returned 1
	[0163.704] CloseHandle (hObject=0x4b8) returned 1
	[0163.704] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.704] SetEndOfFile (hFile=0x4e4) returned 1
	[0163.707] CloseHandle (hObject=0x4e4) returned 1
	[0163.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0163.708] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1
	[0163.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.710] lstrlenW (lpString=".doc") returned 4
	[0163.710] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1
	[0163.710] lstrlenW (lpString=".docx") returned 5
	[0163.710] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1
	[0163.710] lstrlenW (lpString=".pdf") returned 4
	[0163.710] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1
	[0163.710] lstrlenW (lpString=".xls") returned 4
	[0163.710] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1
	[0163.710] lstrlenW (lpString=".xlsx") returned 5
	[0163.710] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1
	[0163.710] lstrlenW (lpString=".ppt") returned 4
	[0163.710] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1
	[0163.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.710] lstrlenW (lpString=".zip") returned 4
	[0163.710] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1
	[0163.710] lstrlenW (lpString=".rar") returned 4
	[0163.710] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1
	[0163.710] lstrlenW (lpString=".bz2") returned 4
	[0163.710] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1
	[0163.710] lstrlenW (lpString=".7z") returned 3
	[0163.710] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1
	[0163.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.710] lstrlenW (lpString=".dbf") returned 4
	[0163.710] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1
	[0163.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.710] lstrlenW (lpString=".1cd") returned 4
	[0163.710] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1
	[0163.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.710] lstrlenW (lpString=".jpg") returned 4
	[0163.710] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1
	[0163.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.711] lstrlenW (lpString=".doc") returned 4
	[0163.711] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1
	[0163.711] lstrlenW (lpString=".docx") returned 5
	[0163.711] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1
	[0163.711] lstrlenW (lpString=".pdf") returned 4
	[0163.711] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1
	[0163.711] lstrlenW (lpString=".xls") returned 4
	[0163.711] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1
	[0163.711] lstrlenW (lpString=".xlsx") returned 5
	[0163.711] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1
	[0163.711] lstrlenW (lpString=".ppt") returned 4
	[0163.711] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1
	[0163.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.711] lstrlenW (lpString=".zip") returned 4
	[0163.711] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1
	[0163.711] lstrlenW (lpString=".rar") returned 4
	[0163.711] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1
	[0163.711] lstrlenW (lpString=".bz2") returned 4
	[0163.711] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1
	[0163.711] lstrlenW (lpString=".7z") returned 3
	[0163.711] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1
	[0163.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.711] lstrlenW (lpString=".dbf") returned 4
	[0163.711] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1
	[0163.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.711] lstrlenW (lpString=".1cd") returned 4
	[0163.711] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1
	[0163.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0163.712] lstrlenW (lpString=".jpg") returned 4
	[0163.712] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1
	[0163.712] lstrcmpiW (lpString1=".template", lpString2=".money") returned 1
	[0163.712] lstrlenW (lpString="jmxremote.password.template") returned 27
	[0163.712] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0164.027] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=2856) returned 1
	[0164.027] CloseHandle (hObject=0x4f0) returned 1
	[0164.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20
	[0164.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0164.028] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.028] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0164.030] GetLastError () returned 0x0
	[0164.030] ReadFile (in: hFile=0x4f0, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xb28, lpOverlapped=0x0) returned 1
	[0164.032] WriteFile (in: hFile=0x520, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xb30, lpOverlapped=0x0) returned 1
	[0164.033] ReadFile (in: hFile=0x4f0, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.033] WriteFile (in: hFile=0x520, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0164.033] SetEndOfFile (hFile=0x520) returned 1
	[0164.033] CloseHandle (hObject=0x520) returned 1
	[0164.033] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.033] SetEndOfFile (hFile=0x4f0) returned 1
	[0164.037] CloseHandle (hObject=0x4f0) returned 1
	[0164.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0164.038] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1
	[0164.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.039] lstrlenW (lpString=".doc") returned 4
	[0164.039] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0164.039] lstrlenW (lpString=".docx") returned 5
	[0164.039] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0164.039] lstrlenW (lpString=".pdf") returned 4
	[0164.039] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0164.039] lstrlenW (lpString=".xls") returned 4
	[0164.039] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0164.039] lstrlenW (lpString=".xlsx") returned 5
	[0164.039] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0164.039] lstrlenW (lpString=".ppt") returned 4
	[0164.039] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0164.039] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.039] lstrlenW (lpString=".zip") returned 4
	[0164.039] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0164.039] lstrlenW (lpString=".rar") returned 4
	[0164.039] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0164.039] lstrlenW (lpString=".bz2") returned 4
	[0164.039] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0164.039] lstrlenW (lpString=".7z") returned 3
	[0164.039] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0164.039] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.039] lstrlenW (lpString=".dbf") returned 4
	[0164.039] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0164.039] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.039] lstrlenW (lpString=".1cd") returned 4
	[0164.039] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0164.039] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.039] lstrlenW (lpString=".jpg") returned 4
	[0164.039] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0164.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.040] lstrlenW (lpString=".doc") returned 4
	[0164.040] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0164.040] lstrlenW (lpString=".docx") returned 5
	[0164.040] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0164.040] lstrlenW (lpString=".pdf") returned 4
	[0164.040] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0164.040] lstrlenW (lpString=".xls") returned 4
	[0164.040] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0164.040] lstrlenW (lpString=".xlsx") returned 5
	[0164.040] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0164.040] lstrlenW (lpString=".ppt") returned 4
	[0164.040] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0164.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.040] lstrlenW (lpString=".zip") returned 4
	[0164.040] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0164.040] lstrlenW (lpString=".rar") returned 4
	[0164.040] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0164.040] lstrlenW (lpString=".bz2") returned 4
	[0164.040] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0164.040] lstrlenW (lpString=".7z") returned 3
	[0164.040] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0164.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.040] lstrlenW (lpString=".dbf") returned 4
	[0164.040] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0164.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.040] lstrlenW (lpString=".1cd") returned 4
	[0164.040] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0164.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0164.040] lstrlenW (lpString=".jpg") returned 4
	[0164.040] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0164.188] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0164.188] lstrlenW (lpString="management-agent.jar") returned 20
	[0164.188] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.189] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=381) returned 1
	[0164.189] CloseHandle (hObject=0x4b8) returned 1
	[0164.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20
	[0164.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.189] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.190] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.190] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.472] GetLastError () returned 0x0
	[0164.472] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x17d, lpOverlapped=0x0) returned 1
	[0164.474] WriteFile (in: hFile=0x500, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x180, lpOverlapped=0x0) returned 1
	[0164.476] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.476] WriteFile (in: hFile=0x500, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0164.477] SetEndOfFile (hFile=0x500) returned 1
	[0164.477] CloseHandle (hObject=0x500) returned 1
	[0164.477] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.477] SetEndOfFile (hFile=0x4b8) returned 1
	[0164.480] CloseHandle (hObject=0x4b8) returned 1
	[0164.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0164.484] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1
	[0164.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.484] lstrlenW (lpString=".doc") returned 4
	[0164.484] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0164.484] lstrlenW (lpString=".docx") returned 5
	[0164.484] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0164.484] lstrlenW (lpString=".pdf") returned 4
	[0164.485] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0164.485] lstrlenW (lpString=".xls") returned 4
	[0164.485] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0164.485] lstrlenW (lpString=".xlsx") returned 5
	[0164.485] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0164.485] lstrlenW (lpString=".ppt") returned 4
	[0164.485] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0164.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.485] lstrlenW (lpString=".zip") returned 4
	[0164.485] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0164.485] lstrlenW (lpString=".rar") returned 4
	[0164.485] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0164.485] lstrlenW (lpString=".bz2") returned 4
	[0164.485] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0164.485] lstrlenW (lpString=".7z") returned 3
	[0164.485] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0164.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.485] lstrlenW (lpString=".dbf") returned 4
	[0164.485] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0164.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.485] lstrlenW (lpString=".1cd") returned 4
	[0164.485] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0164.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.485] lstrlenW (lpString=".jpg") returned 4
	[0164.485] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0164.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.485] lstrlenW (lpString=".doc") returned 4
	[0164.485] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0164.486] lstrlenW (lpString=".docx") returned 5
	[0164.486] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0164.486] lstrlenW (lpString=".pdf") returned 4
	[0164.486] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0164.486] lstrlenW (lpString=".xls") returned 4
	[0164.486] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0164.486] lstrlenW (lpString=".xlsx") returned 5
	[0164.486] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0164.486] lstrlenW (lpString=".ppt") returned 4
	[0164.486] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0164.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.486] lstrlenW (lpString=".zip") returned 4
	[0164.486] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0164.486] lstrlenW (lpString=".rar") returned 4
	[0164.486] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0164.486] lstrlenW (lpString=".bz2") returned 4
	[0164.486] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0164.486] lstrlenW (lpString=".7z") returned 3
	[0164.486] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0164.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.486] lstrlenW (lpString=".dbf") returned 4
	[0164.486] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0164.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.486] lstrlenW (lpString=".1cd") returned 4
	[0164.486] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0164.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0164.486] lstrlenW (lpString=".jpg") returned 4
	[0164.486] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0164.487] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0164.487] lstrlenW (lpString="plugin.jar") returned 10
	[0164.487] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.487] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=1923211) returned 1
	[0164.487] CloseHandle (hObject=0x4b8) returned 1
	[0164.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20
	[0164.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[admin@stex777.com].money")) returned 0
	[0164.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.488] lstrlenW (lpString=".doc") returned 4
	[0164.488] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0164.488] lstrlenW (lpString=".docx") returned 5
	[0164.488] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0164.488] lstrlenW (lpString=".pdf") returned 4
	[0164.488] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0164.488] lstrlenW (lpString=".xls") returned 4
	[0164.488] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0164.488] lstrlenW (lpString=".xlsx") returned 5
	[0164.488] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0164.488] lstrlenW (lpString=".ppt") returned 4
	[0164.488] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0164.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.488] lstrlenW (lpString=".zip") returned 4
	[0164.488] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0164.488] lstrlenW (lpString=".rar") returned 4
	[0164.488] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0164.488] lstrlenW (lpString=".bz2") returned 4
	[0164.488] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0164.488] lstrlenW (lpString=".7z") returned 3
	[0164.488] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0164.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.488] lstrlenW (lpString=".dbf") returned 4
	[0164.488] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0164.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.489] lstrlenW (lpString=".1cd") returned 4
	[0164.489] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0164.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.489] lstrlenW (lpString=".jpg") returned 4
	[0164.489] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0164.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.489] lstrlenW (lpString=".doc") returned 4
	[0164.489] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0164.489] lstrlenW (lpString=".docx") returned 5
	[0164.489] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0164.489] lstrlenW (lpString=".pdf") returned 4
	[0164.489] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0164.489] lstrlenW (lpString=".xls") returned 4
	[0164.489] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0164.489] lstrlenW (lpString=".xlsx") returned 5
	[0164.489] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0164.489] lstrlenW (lpString=".ppt") returned 4
	[0164.489] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0164.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.489] lstrlenW (lpString=".zip") returned 4
	[0164.489] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0164.489] lstrlenW (lpString=".rar") returned 4
	[0164.489] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0164.489] lstrlenW (lpString=".bz2") returned 4
	[0164.489] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0164.489] lstrlenW (lpString=".7z") returned 3
	[0164.489] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0164.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.490] lstrlenW (lpString=".dbf") returned 4
	[0164.490] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0164.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.490] lstrlenW (lpString=".1cd") returned 4
	[0164.490] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0164.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0164.490] lstrlenW (lpString=".jpg") returned 4
	[0164.490] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0164.490] lstrcmpiW (lpString1=".ja", lpString2=".money") returned -1
	[0164.490] lstrlenW (lpString="psfont.properties.ja") returned 20
	[0164.490] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.491] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=2796) returned 1
	[0164.491] CloseHandle (hObject=0x4b8) returned 1
	[0164.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20
	[0164.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.491] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.492] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.492] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.492] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.492] GetLastError () returned 0x0
	[0164.493] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xaec, lpOverlapped=0x0) returned 1
	[0164.494] WriteFile (in: hFile=0x500, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xaf0, lpOverlapped=0x0) returned 1
	[0164.495] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.495] WriteFile (in: hFile=0x500, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0164.495] SetEndOfFile (hFile=0x500) returned 1
	[0164.495] CloseHandle (hObject=0x500) returned 1
	[0164.495] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.495] SetEndOfFile (hFile=0x4b8) returned 1
	[0164.498] CloseHandle (hObject=0x4b8) returned 1
	[0164.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0164.498] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1
	[0164.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.499] lstrlenW (lpString=".doc") returned 4
	[0164.499] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1
	[0164.499] lstrlenW (lpString=".docx") returned 5
	[0164.499] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1
	[0164.499] lstrlenW (lpString=".pdf") returned 4
	[0164.499] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1
	[0164.499] lstrlenW (lpString=".xls") returned 4
	[0164.499] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1
	[0164.499] lstrlenW (lpString=".xlsx") returned 5
	[0164.499] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1
	[0164.499] lstrlenW (lpString=".ppt") returned 4
	[0164.499] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1
	[0164.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.499] lstrlenW (lpString=".zip") returned 4
	[0164.499] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1
	[0164.499] lstrlenW (lpString=".rar") returned 4
	[0164.499] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1
	[0164.499] lstrlenW (lpString=".bz2") returned 4
	[0164.499] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1
	[0164.499] lstrlenW (lpString=".7z") returned 3
	[0164.499] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1
	[0164.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.500] lstrlenW (lpString=".dbf") returned 4
	[0164.500] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1
	[0164.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.500] lstrlenW (lpString=".1cd") returned 4
	[0164.500] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1
	[0164.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.500] lstrlenW (lpString=".jpg") returned 4
	[0164.500] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1
	[0164.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.500] lstrlenW (lpString=".doc") returned 4
	[0164.500] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1
	[0164.500] lstrlenW (lpString=".docx") returned 5
	[0164.500] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1
	[0164.500] lstrlenW (lpString=".pdf") returned 4
	[0164.500] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1
	[0164.500] lstrlenW (lpString=".xls") returned 4
	[0164.500] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1
	[0164.500] lstrlenW (lpString=".xlsx") returned 5
	[0164.500] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1
	[0164.500] lstrlenW (lpString=".ppt") returned 4
	[0164.500] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1
	[0164.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.500] lstrlenW (lpString=".zip") returned 4
	[0164.500] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1
	[0164.500] lstrlenW (lpString=".rar") returned 4
	[0164.500] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1
	[0164.500] lstrlenW (lpString=".bz2") returned 4
	[0164.500] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1
	[0164.501] lstrlenW (lpString=".7z") returned 3
	[0164.501] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1
	[0164.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.501] lstrlenW (lpString=".dbf") returned 4
	[0164.501] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1
	[0164.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.501] lstrlenW (lpString=".1cd") returned 4
	[0164.501] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1
	[0164.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0164.501] lstrlenW (lpString=".jpg") returned 4
	[0164.501] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1
	[0164.501] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0164.501] lstrlenW (lpString="psfontj2d.properties") returned 20
	[0164.501] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.502] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=10393) returned 1
	[0164.502] CloseHandle (hObject=0x4b8) returned 1
	[0164.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20
	[0164.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.502] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.502] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.502] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.502] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0164.503] GetLastError () returned 0x0
	[0164.503] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2899, lpOverlapped=0x0) returned 1
	[0164.504] WriteFile (in: hFile=0x500, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x28a0, lpOverlapped=0x0) returned 1
	[0164.506] ReadFile (in: hFile=0x4b8, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.506] WriteFile (in: hFile=0x500, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0164.506] SetEndOfFile (hFile=0x500) returned 1
	[0164.506] CloseHandle (hObject=0x500) returned 1
	[0164.506] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.506] SetEndOfFile (hFile=0x4b8) returned 1
	[0164.512] CloseHandle (hObject=0x4b8) returned 1
	[0164.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0164.512] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1
	[0164.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.513] lstrlenW (lpString=".doc") returned 4
	[0164.513] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0164.513] lstrlenW (lpString=".docx") returned 5
	[0164.513] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0164.513] lstrlenW (lpString=".pdf") returned 4
	[0164.513] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0164.513] lstrlenW (lpString=".xls") returned 4
	[0164.513] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0164.513] lstrlenW (lpString=".xlsx") returned 5
	[0164.513] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0164.513] lstrlenW (lpString=".ppt") returned 4
	[0164.513] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0164.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.513] lstrlenW (lpString=".zip") returned 4
	[0164.513] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0164.513] lstrlenW (lpString=".rar") returned 4
	[0164.513] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0164.513] lstrlenW (lpString=".bz2") returned 4
	[0164.513] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0164.513] lstrlenW (lpString=".7z") returned 3
	[0164.513] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0164.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.513] lstrlenW (lpString=".dbf") returned 4
	[0164.514] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0164.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.514] lstrlenW (lpString=".1cd") returned 4
	[0164.514] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0164.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.514] lstrlenW (lpString=".jpg") returned 4
	[0164.514] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0164.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.514] lstrlenW (lpString=".doc") returned 4
	[0164.514] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0164.514] lstrlenW (lpString=".docx") returned 5
	[0164.514] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0164.514] lstrlenW (lpString=".pdf") returned 4
	[0164.514] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0164.514] lstrlenW (lpString=".xls") returned 4
	[0164.514] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0164.514] lstrlenW (lpString=".xlsx") returned 5
	[0164.514] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0164.514] lstrlenW (lpString=".ppt") returned 4
	[0164.514] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0164.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.514] lstrlenW (lpString=".zip") returned 4
	[0164.514] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0164.514] lstrlenW (lpString=".rar") returned 4
	[0164.514] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0164.514] lstrlenW (lpString=".bz2") returned 4
	[0164.514] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0164.514] lstrlenW (lpString=".7z") returned 3
	[0164.514] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0164.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.514] lstrlenW (lpString=".dbf") returned 4
	[0164.515] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0164.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.515] lstrlenW (lpString=".1cd") returned 4
	[0164.515] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0164.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0164.515] lstrlenW (lpString=".jpg") returned 4
	[0164.515] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0164.515] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0164.515] lstrlenW (lpString="resources.jar") returned 13
	[0164.515] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.515] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=3492573) returned 1
	[0164.515] CloseHandle (hObject=0x4b8) returned 1
	[0164.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20
	[0164.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[admin@stex777.com].money")) returned 0
	[0164.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.516] lstrlenW (lpString=".doc") returned 4
	[0164.516] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0164.516] lstrlenW (lpString=".docx") returned 5
	[0164.516] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0164.516] lstrlenW (lpString=".pdf") returned 4
	[0164.516] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0164.516] lstrlenW (lpString=".xls") returned 4
	[0164.516] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0164.516] lstrlenW (lpString=".xlsx") returned 5
	[0164.516] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0164.516] lstrlenW (lpString=".ppt") returned 4
	[0164.516] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0164.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.516] lstrlenW (lpString=".zip") returned 4
	[0164.516] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0164.517] lstrlenW (lpString=".rar") returned 4
	[0164.517] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0164.517] lstrlenW (lpString=".bz2") returned 4
	[0164.517] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0164.517] lstrlenW (lpString=".7z") returned 3
	[0164.517] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0164.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.517] lstrlenW (lpString=".dbf") returned 4
	[0164.517] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0164.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.517] lstrlenW (lpString=".1cd") returned 4
	[0164.517] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0164.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.517] lstrlenW (lpString=".jpg") returned 4
	[0164.517] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0164.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.517] lstrlenW (lpString=".doc") returned 4
	[0164.517] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0164.517] lstrlenW (lpString=".docx") returned 5
	[0164.517] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0164.517] lstrlenW (lpString=".pdf") returned 4
	[0164.517] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0164.517] lstrlenW (lpString=".xls") returned 4
	[0164.517] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0164.517] lstrlenW (lpString=".xlsx") returned 5
	[0164.517] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0164.517] lstrlenW (lpString=".ppt") returned 4
	[0164.517] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0164.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.517] lstrlenW (lpString=".zip") returned 4
	[0164.517] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0164.518] lstrlenW (lpString=".rar") returned 4
	[0164.518] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0164.518] lstrlenW (lpString=".bz2") returned 4
	[0164.518] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0164.518] lstrlenW (lpString=".7z") returned 3
	[0164.518] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0164.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.518] lstrlenW (lpString=".dbf") returned 4
	[0164.518] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0164.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.518] lstrlenW (lpString=".1cd") returned 4
	[0164.518] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0164.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0164.518] lstrlenW (lpString=".jpg") returned 4
	[0164.518] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0164.518] lstrcmpiW (lpString1=".jar", lpString2=".money") returned -1
	[0164.518] lstrlenW (lpString="rt.jar") returned 6
	[0164.518] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.519] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=54560347) returned 1
	[0164.519] CloseHandle (hObject=0x4b8) returned 1
	[0164.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20
	[0164.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0164.519] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[admin@stex777.com].money")) returned 0
	[0164.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.519] lstrlenW (lpString=".doc") returned 4
	[0164.519] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0164.519] lstrlenW (lpString=".docx") returned 5
	[0164.519] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0164.519] lstrlenW (lpString=".pdf") returned 4
	[0164.519] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0164.519] lstrlenW (lpString=".xls") returned 4
	[0164.520] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0164.520] lstrlenW (lpString=".xlsx") returned 5
	[0164.520] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0164.520] lstrlenW (lpString=".ppt") returned 4
	[0164.520] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0164.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.520] lstrlenW (lpString=".zip") returned 4
	[0164.520] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0164.520] lstrlenW (lpString=".rar") returned 4
	[0164.520] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0164.520] lstrlenW (lpString=".bz2") returned 4
	[0164.520] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0164.520] lstrlenW (lpString=".7z") returned 3
	[0164.520] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0164.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.520] lstrlenW (lpString=".dbf") returned 4
	[0164.520] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0164.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.520] lstrlenW (lpString=".1cd") returned 4
	[0164.520] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0164.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.520] lstrlenW (lpString=".jpg") returned 4
	[0164.520] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0164.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.520] lstrlenW (lpString=".doc") returned 4
	[0164.520] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0164.520] lstrlenW (lpString=".docx") returned 5
	[0164.520] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0164.520] lstrlenW (lpString=".pdf") returned 4
	[0164.520] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0164.521] lstrlenW (lpString=".xls") returned 4
	[0164.521] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0164.521] lstrlenW (lpString=".xlsx") returned 5
	[0164.521] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0164.521] lstrlenW (lpString=".ppt") returned 4
	[0164.521] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0164.521] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.537] lstrlenW (lpString=".zip") returned 4
	[0164.537] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0164.538] lstrlenW (lpString=".rar") returned 4
	[0164.538] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0164.538] lstrlenW (lpString=".bz2") returned 4
	[0164.538] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0164.538] lstrlenW (lpString=".7z") returned 3
	[0164.538] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0164.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.538] lstrlenW (lpString=".dbf") returned 4
	[0164.538] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0164.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.538] lstrlenW (lpString=".1cd") returned 4
	[0164.538] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0164.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0164.538] lstrlenW (lpString=".jpg") returned 4
	[0164.538] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0164.538] lstrcmpiW (lpString1=".0_144\\lib\\security\\blacklist", lpString2=".money") returned -1
	[0164.538] lstrlenW (lpString="blacklist") returned 9
	[0164.538] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0164.600] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=4054) returned 1
	[0164.600] CloseHandle (hObject=0x4b8) returned 1
	[0164.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20
	[0165.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.823] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.824] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.824] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.824] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0165.829] GetLastError () returned 0x0
	[0165.829] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xfd6, lpOverlapped=0x0) returned 1
	[0165.830] WriteFile (in: hFile=0x4f0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xfe0, lpOverlapped=0x0) returned 1
	[0165.831] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.831] WriteFile (in: hFile=0x4f0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0165.832] SetEndOfFile (hFile=0x4f0) returned 1
	[0165.832] CloseHandle (hObject=0x4f0) returned 1
	[0165.832] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.832] SetEndOfFile (hFile=0x55c) returned 1
	[0165.835] CloseHandle (hObject=0x55c) returned 1
	[0165.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.835] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1
	[0165.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.836] lstrlenW (lpString=".doc") returned 4
	[0165.836] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0165.836] lstrlenW (lpString=".docx") returned 5
	[0165.836] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1
	[0165.836] lstrlenW (lpString=".pdf") returned 4
	[0165.836] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0165.836] lstrlenW (lpString=".xls") returned 4
	[0165.836] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0165.836] lstrlenW (lpString=".xlsx") returned 5
	[0165.836] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1
	[0165.836] lstrlenW (lpString=".ppt") returned 4
	[0165.836] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0165.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.836] lstrlenW (lpString=".zip") returned 4
	[0165.837] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0165.837] lstrlenW (lpString=".rar") returned 4
	[0165.837] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0165.837] lstrlenW (lpString=".bz2") returned 4
	[0165.837] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0165.837] lstrlenW (lpString=".7z") returned 3
	[0165.837] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0165.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.837] lstrlenW (lpString=".dbf") returned 4
	[0165.837] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0165.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.837] lstrlenW (lpString=".1cd") returned 4
	[0165.837] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0165.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.837] lstrlenW (lpString=".jpg") returned 4
	[0165.837] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0165.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.837] lstrlenW (lpString=".doc") returned 4
	[0165.837] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0165.837] lstrlenW (lpString=".docx") returned 5
	[0165.837] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1
	[0165.837] lstrlenW (lpString=".pdf") returned 4
	[0165.837] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0165.837] lstrlenW (lpString=".xls") returned 4
	[0165.837] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0165.837] lstrlenW (lpString=".xlsx") returned 5
	[0165.838] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1
	[0165.838] lstrlenW (lpString=".ppt") returned 4
	[0165.838] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0165.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.838] lstrlenW (lpString=".zip") returned 4
	[0165.838] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0165.838] lstrlenW (lpString=".rar") returned 4
	[0165.838] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0165.838] lstrlenW (lpString=".bz2") returned 4
	[0165.838] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0165.838] lstrlenW (lpString=".7z") returned 3
	[0165.838] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0165.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.838] lstrlenW (lpString=".dbf") returned 4
	[0165.838] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0165.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.838] lstrlenW (lpString=".1cd") returned 4
	[0165.838] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0165.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0165.838] lstrlenW (lpString=".jpg") returned 4
	[0165.838] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0165.838] lstrcmpiW (lpString1=".properties", lpString2=".money") returned 1
	[0165.838] lstrlenW (lpString="sound.properties") returned 16
	[0165.839] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.839] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=1210) returned 1
	[0165.839] CloseHandle (hObject=0x55c) returned 1
	[0165.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20
	[0165.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.840] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.840] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.840] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.840] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0165.840] GetLastError () returned 0x0
	[0165.840] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x4ba, lpOverlapped=0x0) returned 1
	[0165.842] WriteFile (in: hFile=0x4f0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x4c0, lpOverlapped=0x0) returned 1
	[0165.843] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.843] WriteFile (in: hFile=0x4f0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0165.843] SetEndOfFile (hFile=0x4f0) returned 1
	[0165.843] CloseHandle (hObject=0x4f0) returned 1
	[0165.843] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.844] SetEndOfFile (hFile=0x55c) returned 1
	[0165.846] CloseHandle (hObject=0x55c) returned 1
	[0165.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0165.847] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1
	[0165.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.847] lstrlenW (lpString=".doc") returned 4
	[0165.847] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0165.848] lstrlenW (lpString=".docx") returned 5
	[0165.848] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0165.848] lstrlenW (lpString=".pdf") returned 4
	[0165.848] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0165.848] lstrlenW (lpString=".xls") returned 4
	[0165.848] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0165.848] lstrlenW (lpString=".xlsx") returned 5
	[0165.848] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0165.848] lstrlenW (lpString=".ppt") returned 4
	[0165.848] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0165.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.848] lstrlenW (lpString=".zip") returned 4
	[0165.848] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0165.848] lstrlenW (lpString=".rar") returned 4
	[0165.848] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0165.848] lstrlenW (lpString=".bz2") returned 4
	[0165.848] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0165.848] lstrlenW (lpString=".7z") returned 3
	[0165.848] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0165.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.848] lstrlenW (lpString=".dbf") returned 4
	[0165.848] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0165.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.848] lstrlenW (lpString=".1cd") returned 4
	[0165.848] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0165.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.848] lstrlenW (lpString=".jpg") returned 4
	[0165.848] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0165.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.849] lstrlenW (lpString=".doc") returned 4
	[0165.849] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0165.849] lstrlenW (lpString=".docx") returned 5
	[0165.849] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0165.849] lstrlenW (lpString=".pdf") returned 4
	[0165.849] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0165.849] lstrlenW (lpString=".xls") returned 4
	[0165.849] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0165.849] lstrlenW (lpString=".xlsx") returned 5
	[0165.849] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0165.849] lstrlenW (lpString=".ppt") returned 4
	[0165.849] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0165.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.849] lstrlenW (lpString=".zip") returned 4
	[0165.849] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0165.849] lstrlenW (lpString=".rar") returned 4
	[0165.849] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0165.849] lstrlenW (lpString=".bz2") returned 4
	[0165.849] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0165.849] lstrlenW (lpString=".7z") returned 3
	[0165.849] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0165.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.849] lstrlenW (lpString=".dbf") returned 4
	[0165.849] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0165.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.850] lstrlenW (lpString=".1cd") returned 4
	[0165.850] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0165.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0165.850] lstrlenW (lpString=".jpg") returned 4
	[0165.850] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0165.850] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".money") returned -1
	[0165.850] lstrlenW (lpString="tzmappings") returned 10
	[0165.850] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.850] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=8400) returned 1
	[0165.851] CloseHandle (hObject=0x55c) returned 1
	[0165.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20
	[0165.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0165.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0165.852] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.852] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0165.854] GetLastError () returned 0x0
	[0165.854] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x20d0, lpOverlapped=0x0) returned 1
	[0165.872] WriteFile (in: hFile=0x4f0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x20e0, lpOverlapped=0x0) returned 1
	[0165.873] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.874] WriteFile (in: hFile=0x4f0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0165.874] SetEndOfFile (hFile=0x4f0) returned 1
	[0165.874] CloseHandle (hObject=0x4f0) returned 1
	[0165.874] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.874] SetEndOfFile (hFile=0x55c) returned 1
	[0166.093] CloseHandle (hObject=0x55c) returned 1
	[0166.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x20) returned 1
	[0166.411] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1
	[0166.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.687] lstrlenW (lpString=".doc") returned 4
	[0166.687] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1
	[0166.687] lstrlenW (lpString=".docx") returned 5
	[0166.687] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1
	[0166.687] lstrlenW (lpString=".pdf") returned 4
	[0166.688] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1
	[0166.688] lstrlenW (lpString=".xls") returned 4
	[0166.688] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1
	[0166.688] lstrlenW (lpString=".xlsx") returned 5
	[0166.688] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1
	[0166.688] lstrlenW (lpString=".ppt") returned 4
	[0166.688] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1
	[0166.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.688] lstrlenW (lpString=".zip") returned 4
	[0166.688] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1
	[0166.688] lstrlenW (lpString=".rar") returned 4
	[0166.688] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1
	[0166.688] lstrlenW (lpString=".bz2") returned 4
	[0166.688] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1
	[0166.688] lstrlenW (lpString=".7z") returned 3
	[0166.688] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1
	[0166.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.688] lstrlenW (lpString=".dbf") returned 4
	[0166.688] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1
	[0166.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.688] lstrlenW (lpString=".1cd") returned 4
	[0166.688] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1
	[0166.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.688] lstrlenW (lpString=".jpg") returned 4
	[0166.688] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1
	[0166.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.688] lstrlenW (lpString=".doc") returned 4
	[0166.689] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1
	[0166.689] lstrlenW (lpString=".docx") returned 5
	[0166.689] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1
	[0166.689] lstrlenW (lpString=".pdf") returned 4
	[0166.689] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1
	[0166.689] lstrlenW (lpString=".xls") returned 4
	[0166.689] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1
	[0166.689] lstrlenW (lpString=".xlsx") returned 5
	[0166.689] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1
	[0166.689] lstrlenW (lpString=".ppt") returned 4
	[0166.689] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1
	[0166.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.689] lstrlenW (lpString=".zip") returned 4
	[0166.689] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1
	[0166.689] lstrlenW (lpString=".rar") returned 4
	[0166.689] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1
	[0166.689] lstrlenW (lpString=".bz2") returned 4
	[0166.689] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1
	[0166.689] lstrlenW (lpString=".7z") returned 3
	[0166.689] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1
	[0166.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.689] lstrlenW (lpString=".dbf") returned 4
	[0166.689] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1
	[0166.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.689] lstrlenW (lpString=".1cd") returned 4
	[0166.689] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1
	[0166.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0166.689] lstrlenW (lpString=".jpg") returned 4
	[0166.690] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1
	[0166.690] lstrcmpiW (lpString1=".dll", lpString2=".money") returned -1
	[0166.690] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37
	[0166.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.109] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=19136) returned 1
	[0167.109] CloseHandle (hObject=0x554) returned 1
	[0167.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220
	[0167.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.110] lstrlenW (lpString=".doc") returned 4
	[0167.110] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0167.110] lstrlenW (lpString=".docx") returned 5
	[0167.110] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0167.110] lstrlenW (lpString=".pdf") returned 4
	[0167.110] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0167.110] lstrlenW (lpString=".xls") returned 4
	[0167.110] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0167.110] lstrlenW (lpString=".xlsx") returned 5
	[0167.110] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0167.110] lstrlenW (lpString=".ppt") returned 4
	[0167.110] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0167.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.110] lstrlenW (lpString=".zip") returned 4
	[0167.110] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0167.110] lstrlenW (lpString=".rar") returned 4
	[0167.110] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0167.111] lstrlenW (lpString=".bz2") returned 4
	[0167.111] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0167.111] lstrlenW (lpString=".7z") returned 3
	[0167.111] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0167.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.111] lstrlenW (lpString=".dbf") returned 4
	[0167.111] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0167.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.111] lstrlenW (lpString=".1cd") returned 4
	[0167.111] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0167.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.111] lstrlenW (lpString=".jpg") returned 4
	[0167.111] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0167.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.111] lstrlenW (lpString=".doc") returned 4
	[0167.111] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0167.111] lstrlenW (lpString=".docx") returned 5
	[0167.111] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0167.111] lstrlenW (lpString=".pdf") returned 4
	[0167.111] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0167.111] lstrlenW (lpString=".xls") returned 4
	[0167.111] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0167.111] lstrlenW (lpString=".xlsx") returned 5
	[0167.111] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0167.111] lstrlenW (lpString=".ppt") returned 4
	[0167.112] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0167.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.112] lstrlenW (lpString=".zip") returned 4
	[0167.112] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0167.112] lstrlenW (lpString=".rar") returned 4
	[0167.112] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0167.112] lstrlenW (lpString=".bz2") returned 4
	[0167.112] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0167.112] lstrlenW (lpString=".7z") returned 3
	[0167.112] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0167.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.112] lstrlenW (lpString=".dbf") returned 4
	[0167.112] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0167.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.112] lstrlenW (lpString=".1cd") returned 4
	[0167.112] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0167.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0167.112] lstrlenW (lpString=".jpg") returned 4
	[0167.112] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0167.113] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0167.113] lstrlenW (lpString="CARBN_01.MID") returned 12
	[0167.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.114] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=9322) returned 1
	[0167.114] CloseHandle (hObject=0x554) returned 1
	[0167.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220
	[0167.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.115] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.115] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.116] GetLastError () returned 0x0
	[0167.116] ReadFile (in: hFile=0x554, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x246a, lpOverlapped=0x0) returned 1
	[0167.117] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2470, lpOverlapped=0x0) returned 1
	[0167.119] ReadFile (in: hFile=0x554, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.119] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.119] SetEndOfFile (hFile=0x514) returned 1
	[0167.119] CloseHandle (hObject=0x514) returned 1
	[0167.119] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.119] SetEndOfFile (hFile=0x554) returned 1
	[0167.122] CloseHandle (hObject=0x554) returned 1
	[0167.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1
	[0167.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.123] lstrlenW (lpString=".doc") returned 4
	[0167.123] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.123] lstrlenW (lpString=".docx") returned 5
	[0167.123] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.123] lstrlenW (lpString=".pdf") returned 4
	[0167.124] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.124] lstrlenW (lpString=".xls") returned 4
	[0167.124] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.124] lstrlenW (lpString=".xlsx") returned 5
	[0167.124] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.124] lstrlenW (lpString=".ppt") returned 4
	[0167.124] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.124] lstrlenW (lpString=".zip") returned 4
	[0167.124] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.124] lstrlenW (lpString=".rar") returned 4
	[0167.124] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.124] lstrlenW (lpString=".bz2") returned 4
	[0167.124] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.124] lstrlenW (lpString=".7z") returned 3
	[0167.124] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.124] lstrlenW (lpString=".dbf") returned 4
	[0167.124] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.124] lstrlenW (lpString=".1cd") returned 4
	[0167.124] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.124] lstrlenW (lpString=".jpg") returned 4
	[0167.124] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.125] lstrlenW (lpString=".doc") returned 4
	[0167.125] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.125] lstrlenW (lpString=".docx") returned 5
	[0167.125] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.125] lstrlenW (lpString=".pdf") returned 4
	[0167.125] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.125] lstrlenW (lpString=".xls") returned 4
	[0167.125] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.125] lstrlenW (lpString=".xlsx") returned 5
	[0167.125] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.125] lstrlenW (lpString=".ppt") returned 4
	[0167.125] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.125] lstrlenW (lpString=".zip") returned 4
	[0167.125] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.125] lstrlenW (lpString=".rar") returned 4
	[0167.125] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.125] lstrlenW (lpString=".bz2") returned 4
	[0167.125] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.125] lstrlenW (lpString=".7z") returned 3
	[0167.125] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.125] lstrlenW (lpString=".dbf") returned 4
	[0167.125] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.125] lstrlenW (lpString=".1cd") returned 4
	[0167.126] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0167.126] lstrlenW (lpString=".jpg") returned 4
	[0167.126] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.126] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0167.126] lstrlenW (lpString="CMNTY_01.MID") returned 12
	[0167.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.126] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=6970) returned 1
	[0167.127] CloseHandle (hObject=0x554) returned 1
	[0167.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220
	[0167.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.127] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.127] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.128] GetLastError () returned 0x0
	[0167.128] ReadFile (in: hFile=0x554, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x1b3a, lpOverlapped=0x0) returned 1
	[0167.130] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x1b40, lpOverlapped=0x0) returned 1
	[0167.131] ReadFile (in: hFile=0x554, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.131] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.131] SetEndOfFile (hFile=0x514) returned 1
	[0167.131] CloseHandle (hObject=0x514) returned 1
	[0167.131] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.131] SetEndOfFile (hFile=0x554) returned 1
	[0167.135] CloseHandle (hObject=0x554) returned 1
	[0167.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0167.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1
	[0167.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.136] lstrlenW (lpString=".doc") returned 4
	[0167.136] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.136] lstrlenW (lpString=".docx") returned 5
	[0167.136] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.136] lstrlenW (lpString=".pdf") returned 4
	[0167.136] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.136] lstrlenW (lpString=".xls") returned 4
	[0167.136] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.136] lstrlenW (lpString=".xlsx") returned 5
	[0167.136] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.136] lstrlenW (lpString=".ppt") returned 4
	[0167.136] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.136] lstrlenW (lpString=".zip") returned 4
	[0167.136] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.136] lstrlenW (lpString=".rar") returned 4
	[0167.136] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.136] lstrlenW (lpString=".bz2") returned 4
	[0167.136] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.136] lstrlenW (lpString=".7z") returned 3
	[0167.136] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.137] lstrlenW (lpString=".dbf") returned 4
	[0167.137] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.137] lstrlenW (lpString=".1cd") returned 4
	[0167.137] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.137] lstrlenW (lpString=".jpg") returned 4
	[0167.137] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.137] lstrlenW (lpString=".doc") returned 4
	[0167.137] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0167.137] lstrlenW (lpString=".docx") returned 5
	[0167.137] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0167.137] lstrlenW (lpString=".pdf") returned 4
	[0167.137] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0167.137] lstrlenW (lpString=".xls") returned 4
	[0167.137] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0167.137] lstrlenW (lpString=".xlsx") returned 5
	[0167.137] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0167.137] lstrlenW (lpString=".ppt") returned 4
	[0167.137] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0167.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.137] lstrlenW (lpString=".zip") returned 4
	[0167.137] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0167.137] lstrlenW (lpString=".rar") returned 4
	[0167.137] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0167.137] lstrlenW (lpString=".bz2") returned 4
	[0167.138] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0167.138] lstrlenW (lpString=".7z") returned 3
	[0167.138] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0167.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.138] lstrlenW (lpString=".dbf") returned 4
	[0167.138] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0167.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.138] lstrlenW (lpString=".1cd") returned 4
	[0167.138] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0167.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0167.138] lstrlenW (lpString=".jpg") returned 4
	[0167.138] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0167.138] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0167.138] lstrlenW (lpString="EAST_01.MID") returned 11
	[0167.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.139] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=6165) returned 1
	[0167.139] CloseHandle (hObject=0x554) returned 1
	[0167.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220
	[0167.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0167.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.140] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.140] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0167.141] GetLastError () returned 0x0
	[0167.141] ReadFile (in: hFile=0x554, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x1815, lpOverlapped=0x0) returned 1
	[0167.320] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x1820, lpOverlapped=0x0) returned 1
	[0167.322] ReadFile (in: hFile=0x554, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.322] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xea, lpOverlapped=0x0) returned 1
	[0167.322] SetEndOfFile (hFile=0x514) returned 1
	[0167.532] CloseHandle (hObject=0x514) returned 1
	[0167.532] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.532] SetEndOfFile (hFile=0x554) returned 1
	[0168.364] CloseHandle (hObject=0x554) returned 1
	[0168.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1
	[0168.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.365] lstrlenW (lpString=".doc") returned 4
	[0168.365] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.365] lstrlenW (lpString=".docx") returned 5
	[0168.365] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.365] lstrlenW (lpString=".pdf") returned 4
	[0168.365] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.365] lstrlenW (lpString=".xls") returned 4
	[0168.366] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.366] lstrlenW (lpString=".xlsx") returned 5
	[0168.366] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.366] lstrlenW (lpString=".ppt") returned 4
	[0168.366] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.366] lstrlenW (lpString=".zip") returned 4
	[0168.366] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.366] lstrlenW (lpString=".rar") returned 4
	[0168.366] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.366] lstrlenW (lpString=".bz2") returned 4
	[0168.366] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.366] lstrlenW (lpString=".7z") returned 3
	[0168.366] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.366] lstrlenW (lpString=".dbf") returned 4
	[0168.366] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.366] lstrlenW (lpString=".1cd") returned 4
	[0168.366] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.366] lstrlenW (lpString=".jpg") returned 4
	[0168.366] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.366] lstrlenW (lpString=".doc") returned 4
	[0168.367] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.367] lstrlenW (lpString=".docx") returned 5
	[0168.367] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.367] lstrlenW (lpString=".pdf") returned 4
	[0168.367] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.367] lstrlenW (lpString=".xls") returned 4
	[0168.367] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.367] lstrlenW (lpString=".xlsx") returned 5
	[0168.367] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.367] lstrlenW (lpString=".ppt") returned 4
	[0168.367] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.367] lstrlenW (lpString=".zip") returned 4
	[0168.367] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.367] lstrlenW (lpString=".rar") returned 4
	[0168.367] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.367] lstrlenW (lpString=".bz2") returned 4
	[0168.367] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.367] lstrlenW (lpString=".7z") returned 3
	[0168.367] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.367] lstrlenW (lpString=".dbf") returned 4
	[0168.367] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.367] lstrlenW (lpString=".1cd") returned 4
	[0168.367] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0168.368] lstrlenW (lpString=".jpg") returned 4
	[0168.368] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.368] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0168.368] lstrlenW (lpString="MUSIC_01.MID") returned 12
	[0168.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0168.369] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=6880) returned 1
	[0168.369] CloseHandle (hObject=0x554) returned 1
	[0168.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220
	[0168.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0168.370] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.370] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0168.371] GetLastError () returned 0x0
	[0168.371] ReadFile (in: hFile=0x554, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x1ae0, lpOverlapped=0x0) returned 1
	[0168.374] WriteFile (in: hFile=0x4f0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x1af0, lpOverlapped=0x0) returned 1
	[0168.376] ReadFile (in: hFile=0x554, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.376] WriteFile (in: hFile=0x4f0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.376] SetEndOfFile (hFile=0x4f0) returned 1
	[0168.376] CloseHandle (hObject=0x4f0) returned 1
	[0168.376] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.376] SetEndOfFile (hFile=0x554) returned 1
	[0168.379] CloseHandle (hObject=0x554) returned 1
	[0168.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1
	[0168.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.380] lstrlenW (lpString=".doc") returned 4
	[0168.380] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.380] lstrlenW (lpString=".docx") returned 5
	[0168.380] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.380] lstrlenW (lpString=".pdf") returned 4
	[0168.380] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.380] lstrlenW (lpString=".xls") returned 4
	[0168.380] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.380] lstrlenW (lpString=".xlsx") returned 5
	[0168.380] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.380] lstrlenW (lpString=".ppt") returned 4
	[0168.380] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.380] lstrlenW (lpString=".zip") returned 4
	[0168.380] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.380] lstrlenW (lpString=".rar") returned 4
	[0168.380] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.380] lstrlenW (lpString=".bz2") returned 4
	[0168.380] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.380] lstrlenW (lpString=".7z") returned 3
	[0168.381] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.381] lstrlenW (lpString=".dbf") returned 4
	[0168.381] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.381] lstrlenW (lpString=".1cd") returned 4
	[0168.381] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.381] lstrlenW (lpString=".jpg") returned 4
	[0168.381] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.381] lstrlenW (lpString=".doc") returned 4
	[0168.381] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.381] lstrlenW (lpString=".docx") returned 5
	[0168.381] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.381] lstrlenW (lpString=".pdf") returned 4
	[0168.381] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.381] lstrlenW (lpString=".xls") returned 4
	[0168.381] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.381] lstrlenW (lpString=".xlsx") returned 5
	[0168.381] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.381] lstrlenW (lpString=".ppt") returned 4
	[0168.382] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.382] lstrlenW (lpString=".zip") returned 4
	[0168.382] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.382] lstrlenW (lpString=".rar") returned 4
	[0168.382] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.382] lstrlenW (lpString=".bz2") returned 4
	[0168.382] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.382] lstrlenW (lpString=".7z") returned 3
	[0168.382] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.382] lstrlenW (lpString=".dbf") returned 4
	[0168.382] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.382] lstrlenW (lpString=".1cd") returned 4
	[0168.382] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0168.382] lstrlenW (lpString=".jpg") returned 4
	[0168.382] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.382] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0168.382] lstrlenW (lpString="NBOOK_01.MID") returned 12
	[0168.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0168.386] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=5968) returned 1
	[0168.386] CloseHandle (hObject=0x554) returned 1
	[0168.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220
	[0168.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0168.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0168.386] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.386] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0
	[0168.387] GetLastError () returned 0x0
	[0168.387] ReadFile (in: hFile=0x554, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x1750, lpOverlapped=0x0) returned 1
	[0168.389] WriteFile (in: hFile=0x4f0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x1760, lpOverlapped=0x0) returned 1
	[0168.390] ReadFile (in: hFile=0x554, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.390] WriteFile (in: hFile=0x4f0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.390] SetEndOfFile (hFile=0x4f0) returned 1
	[0168.390] CloseHandle (hObject=0x4f0) returned 1
	[0168.390] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.390] SetEndOfFile (hFile=0x554) returned 1
	[0168.394] CloseHandle (hObject=0x554) returned 1
	[0168.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0168.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1
	[0168.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.395] lstrlenW (lpString=".doc") returned 4
	[0168.395] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.395] lstrlenW (lpString=".docx") returned 5
	[0168.395] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.395] lstrlenW (lpString=".pdf") returned 4
	[0168.395] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.395] lstrlenW (lpString=".xls") returned 4
	[0168.395] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.395] lstrlenW (lpString=".xlsx") returned 5
	[0168.395] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.532] lstrlenW (lpString=".ppt") returned 4
	[0168.532] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.532] lstrlenW (lpString=".zip") returned 4
	[0168.532] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.532] lstrlenW (lpString=".rar") returned 4
	[0168.532] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.532] lstrlenW (lpString=".bz2") returned 4
	[0168.532] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.532] lstrlenW (lpString=".7z") returned 3
	[0168.532] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.533] lstrlenW (lpString=".dbf") returned 4
	[0168.533] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.533] lstrlenW (lpString=".1cd") returned 4
	[0168.533] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.533] lstrlenW (lpString=".jpg") returned 4
	[0168.533] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.533] lstrlenW (lpString=".doc") returned 4
	[0168.533] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0168.533] lstrlenW (lpString=".docx") returned 5
	[0168.533] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0168.533] lstrlenW (lpString=".pdf") returned 4
	[0168.533] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0168.533] lstrlenW (lpString=".xls") returned 4
	[0168.533] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0168.533] lstrlenW (lpString=".xlsx") returned 5
	[0168.533] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0168.533] lstrlenW (lpString=".ppt") returned 4
	[0168.533] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0168.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.533] lstrlenW (lpString=".zip") returned 4
	[0168.533] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0168.533] lstrlenW (lpString=".rar") returned 4
	[0168.534] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0168.534] lstrlenW (lpString=".bz2") returned 4
	[0168.534] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0168.534] lstrlenW (lpString=".7z") returned 3
	[0168.534] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0168.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.534] lstrlenW (lpString=".dbf") returned 4
	[0168.534] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0168.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.534] lstrlenW (lpString=".1cd") returned 4
	[0168.534] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0168.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0168.534] lstrlenW (lpString=".jpg") returned 4
	[0168.534] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0168.534] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0168.534] lstrlenW (lpString="PAPER_01.MID") returned 12
	[0168.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.058] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=6763) returned 1
	[0169.058] CloseHandle (hObject=0x550) returned 1
	[0169.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220
	[0169.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.059] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.059] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0169.060] GetLastError () returned 0x0
	[0169.060] ReadFile (in: hFile=0x550, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x1a6b, lpOverlapped=0x0) returned 1
	[0169.062] WriteFile (in: hFile=0x4b8, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x1a70, lpOverlapped=0x0) returned 1
	[0169.063] ReadFile (in: hFile=0x550, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.063] WriteFile (in: hFile=0x4b8, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.063] SetEndOfFile (hFile=0x4b8) returned 1
	[0169.063] CloseHandle (hObject=0x4b8) returned 1
	[0169.063] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.063] SetEndOfFile (hFile=0x550) returned 1
	[0169.066] CloseHandle (hObject=0x550) returned 1
	[0169.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1
	[0169.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.067] lstrlenW (lpString=".doc") returned 4
	[0169.067] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.067] lstrlenW (lpString=".docx") returned 5
	[0169.067] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.067] lstrlenW (lpString=".pdf") returned 4
	[0169.067] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.067] lstrlenW (lpString=".xls") returned 4
	[0169.067] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.067] lstrlenW (lpString=".xlsx") returned 5
	[0169.067] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.067] lstrlenW (lpString=".ppt") returned 4
	[0169.067] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.067] lstrlenW (lpString=".zip") returned 4
	[0169.067] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.067] lstrlenW (lpString=".rar") returned 4
	[0169.067] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.067] lstrlenW (lpString=".bz2") returned 4
	[0169.068] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.068] lstrlenW (lpString=".7z") returned 3
	[0169.068] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.068] lstrlenW (lpString=".dbf") returned 4
	[0169.068] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.068] lstrlenW (lpString=".1cd") returned 4
	[0169.068] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.068] lstrlenW (lpString=".jpg") returned 4
	[0169.068] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.068] lstrlenW (lpString=".doc") returned 4
	[0169.068] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.068] lstrlenW (lpString=".docx") returned 5
	[0169.068] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.068] lstrlenW (lpString=".pdf") returned 4
	[0169.068] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.068] lstrlenW (lpString=".xls") returned 4
	[0169.068] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.068] lstrlenW (lpString=".xlsx") returned 5
	[0169.068] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.068] lstrlenW (lpString=".ppt") returned 4
	[0169.068] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.068] lstrlenW (lpString=".zip") returned 4
	[0169.069] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.069] lstrlenW (lpString=".rar") returned 4
	[0169.069] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.069] lstrlenW (lpString=".bz2") returned 4
	[0169.069] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.069] lstrlenW (lpString=".7z") returned 3
	[0169.069] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.069] lstrlenW (lpString=".dbf") returned 4
	[0169.069] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.069] lstrlenW (lpString=".1cd") returned 4
	[0169.069] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0169.069] lstrlenW (lpString=".jpg") returned 4
	[0169.069] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.069] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.069] lstrlenW (lpString="PARNT_09.MID") returned 12
	[0169.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.070] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=6764) returned 1
	[0169.070] CloseHandle (hObject=0x550) returned 1
	[0169.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220
	[0169.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.071] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.071] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0169.071] GetLastError () returned 0x0
	[0169.071] ReadFile (in: hFile=0x550, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x1a6c, lpOverlapped=0x0) returned 1
	[0169.073] WriteFile (in: hFile=0x4b8, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x1a70, lpOverlapped=0x0) returned 1
	[0169.074] ReadFile (in: hFile=0x550, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.074] WriteFile (in: hFile=0x4b8, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.074] SetEndOfFile (hFile=0x4b8) returned 1
	[0169.074] CloseHandle (hObject=0x4b8) returned 1
	[0169.075] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.075] SetEndOfFile (hFile=0x550) returned 1
	[0169.077] CloseHandle (hObject=0x550) returned 1
	[0169.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1
	[0169.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.078] lstrlenW (lpString=".doc") returned 4
	[0169.078] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.078] lstrlenW (lpString=".docx") returned 5
	[0169.078] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1
	[0169.078] lstrlenW (lpString=".pdf") returned 4
	[0169.078] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.078] lstrlenW (lpString=".xls") returned 4
	[0169.078] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.078] lstrlenW (lpString=".xlsx") returned 5
	[0169.078] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1
	[0169.078] lstrlenW (lpString=".ppt") returned 4
	[0169.078] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.079] lstrlenW (lpString=".zip") returned 4
	[0169.079] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.079] lstrlenW (lpString=".rar") returned 4
	[0169.079] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.079] lstrlenW (lpString=".bz2") returned 4
	[0169.079] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.079] lstrlenW (lpString=".7z") returned 3
	[0169.079] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.079] lstrlenW (lpString=".dbf") returned 4
	[0169.079] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.079] lstrlenW (lpString=".1cd") returned 4
	[0169.079] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.079] lstrlenW (lpString=".jpg") returned 4
	[0169.079] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.079] lstrlenW (lpString=".doc") returned 4
	[0169.079] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.079] lstrlenW (lpString=".docx") returned 5
	[0169.079] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1
	[0169.079] lstrlenW (lpString=".pdf") returned 4
	[0169.079] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.079] lstrlenW (lpString=".xls") returned 4
	[0169.080] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.080] lstrlenW (lpString=".xlsx") returned 5
	[0169.080] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1
	[0169.080] lstrlenW (lpString=".ppt") returned 4
	[0169.080] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.080] lstrlenW (lpString=".zip") returned 4
	[0169.080] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.080] lstrlenW (lpString=".rar") returned 4
	[0169.080] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.080] lstrlenW (lpString=".bz2") returned 4
	[0169.080] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.080] lstrlenW (lpString=".7z") returned 3
	[0169.080] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.080] lstrlenW (lpString=".dbf") returned 4
	[0169.080] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.080] lstrlenW (lpString=".1cd") returned 4
	[0169.080] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0169.080] lstrlenW (lpString=".jpg") returned 4
	[0169.080] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.080] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.080] lstrlenW (lpString="PARNT_10.MID") returned 12
	[0169.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.082] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=5393) returned 1
	[0169.082] CloseHandle (hObject=0x550) returned 1
	[0169.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220
	[0169.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.082] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.083] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8
	[0169.083] GetLastError () returned 0x0
	[0169.083] ReadFile (in: hFile=0x550, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x1511, lpOverlapped=0x0) returned 1
	[0169.085] WriteFile (in: hFile=0x4b8, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x1520, lpOverlapped=0x0) returned 1
	[0169.086] ReadFile (in: hFile=0x550, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.086] WriteFile (in: hFile=0x4b8, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.086] SetEndOfFile (hFile=0x4b8) returned 1
	[0169.086] CloseHandle (hObject=0x4b8) returned 1
	[0169.086] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.086] SetEndOfFile (hFile=0x550) returned 1
	[0169.089] CloseHandle (hObject=0x550) returned 1
	[0169.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1
	[0169.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.091] lstrlenW (lpString=".doc") returned 4
	[0169.091] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.091] lstrlenW (lpString=".docx") returned 5
	[0169.091] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1
	[0169.091] lstrlenW (lpString=".pdf") returned 4
	[0169.091] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.091] lstrlenW (lpString=".xls") returned 4
	[0169.091] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.091] lstrlenW (lpString=".xlsx") returned 5
	[0169.091] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1
	[0169.091] lstrlenW (lpString=".ppt") returned 4
	[0169.091] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.091] lstrlenW (lpString=".zip") returned 4
	[0169.091] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.091] lstrlenW (lpString=".rar") returned 4
	[0169.091] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.091] lstrlenW (lpString=".bz2") returned 4
	[0169.091] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.091] lstrlenW (lpString=".7z") returned 3
	[0169.091] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.091] lstrlenW (lpString=".dbf") returned 4
	[0169.091] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.091] lstrlenW (lpString=".1cd") returned 4
	[0169.091] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.092] lstrlenW (lpString=".jpg") returned 4
	[0169.092] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.092] lstrlenW (lpString=".doc") returned 4
	[0169.092] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.092] lstrlenW (lpString=".docx") returned 5
	[0169.092] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1
	[0169.092] lstrlenW (lpString=".pdf") returned 4
	[0169.092] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.092] lstrlenW (lpString=".xls") returned 4
	[0169.092] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.092] lstrlenW (lpString=".xlsx") returned 5
	[0169.092] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1
	[0169.092] lstrlenW (lpString=".ppt") returned 4
	[0169.092] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.092] lstrlenW (lpString=".zip") returned 4
	[0169.092] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.092] lstrlenW (lpString=".rar") returned 4
	[0169.092] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.092] lstrlenW (lpString=".bz2") returned 4
	[0169.092] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.092] lstrlenW (lpString=".7z") returned 3
	[0169.092] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.092] lstrlenW (lpString=".dbf") returned 4
	[0169.093] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.093] lstrlenW (lpString=".1cd") returned 4
	[0169.093] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0169.093] lstrlenW (lpString=".jpg") returned 4
	[0169.093] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.093] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.093] lstrlenW (lpString="ROAD_01.MID") returned 11
	[0169.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.136] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=5983) returned 1
	[0169.136] CloseHandle (hObject=0x55c) returned 1
	[0169.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220
	[0169.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.140] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.140] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.140] GetLastError () returned 0x0
	[0169.140] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x175f, lpOverlapped=0x0) returned 1
	[0169.142] WriteFile (in: hFile=0x4e0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x1760, lpOverlapped=0x0) returned 1
	[0169.143] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.143] WriteFile (in: hFile=0x4e0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xea, lpOverlapped=0x0) returned 1
	[0169.144] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.144] CloseHandle (hObject=0x4e0) returned 1
	[0169.144] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.144] SetEndOfFile (hFile=0x55c) returned 1
	[0169.177] CloseHandle (hObject=0x55c) returned 1
	[0169.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1
	[0169.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.178] lstrlenW (lpString=".doc") returned 4
	[0169.178] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.178] lstrlenW (lpString=".docx") returned 5
	[0169.178] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.178] lstrlenW (lpString=".pdf") returned 4
	[0169.178] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.178] lstrlenW (lpString=".xls") returned 4
	[0169.179] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.179] lstrlenW (lpString=".xlsx") returned 5
	[0169.179] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.179] lstrlenW (lpString=".ppt") returned 4
	[0169.179] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.179] lstrlenW (lpString=".zip") returned 4
	[0169.179] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.179] lstrlenW (lpString=".rar") returned 4
	[0169.179] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.179] lstrlenW (lpString=".bz2") returned 4
	[0169.179] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.179] lstrlenW (lpString=".7z") returned 3
	[0169.179] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.179] lstrlenW (lpString=".dbf") returned 4
	[0169.179] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.179] lstrlenW (lpString=".1cd") returned 4
	[0169.179] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.179] lstrlenW (lpString=".jpg") returned 4
	[0169.179] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.179] lstrlenW (lpString=".doc") returned 4
	[0169.179] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.179] lstrlenW (lpString=".docx") returned 5
	[0169.180] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.180] lstrlenW (lpString=".pdf") returned 4
	[0169.180] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.180] lstrlenW (lpString=".xls") returned 4
	[0169.180] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.180] lstrlenW (lpString=".xlsx") returned 5
	[0169.180] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.180] lstrlenW (lpString=".ppt") returned 4
	[0169.180] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.180] lstrlenW (lpString=".zip") returned 4
	[0169.180] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.180] lstrlenW (lpString=".rar") returned 4
	[0169.180] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.180] lstrlenW (lpString=".bz2") returned 4
	[0169.180] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.180] lstrlenW (lpString=".7z") returned 3
	[0169.180] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.180] lstrlenW (lpString=".dbf") returned 4
	[0169.180] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.180] lstrlenW (lpString=".1cd") returned 4
	[0169.180] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0169.180] lstrlenW (lpString=".jpg") returned 4
	[0169.180] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.181] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.183] lstrlenW (lpString="SAFRI_01.MID") returned 12
	[0169.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.184] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=10122) returned 1
	[0169.184] CloseHandle (hObject=0x55c) returned 1
	[0169.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220
	[0169.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.184] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.185] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.185] GetLastError () returned 0x0
	[0169.185] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x278a, lpOverlapped=0x0) returned 1
	[0169.187] WriteFile (in: hFile=0x4e0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2790, lpOverlapped=0x0) returned 1
	[0169.188] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.188] WriteFile (in: hFile=0x4e0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.188] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.189] CloseHandle (hObject=0x4e0) returned 1
	[0169.189] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.189] SetEndOfFile (hFile=0x55c) returned 1
	[0169.191] CloseHandle (hObject=0x55c) returned 1
	[0169.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1
	[0169.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.192] lstrlenW (lpString=".doc") returned 4
	[0169.192] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.192] lstrlenW (lpString=".docx") returned 5
	[0169.192] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.192] lstrlenW (lpString=".pdf") returned 4
	[0169.193] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.193] lstrlenW (lpString=".xls") returned 4
	[0169.193] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.193] lstrlenW (lpString=".xlsx") returned 5
	[0169.193] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.193] lstrlenW (lpString=".ppt") returned 4
	[0169.193] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.193] lstrlenW (lpString=".zip") returned 4
	[0169.193] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.193] lstrlenW (lpString=".rar") returned 4
	[0169.193] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.193] lstrlenW (lpString=".bz2") returned 4
	[0169.193] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.193] lstrlenW (lpString=".7z") returned 3
	[0169.193] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.193] lstrlenW (lpString=".dbf") returned 4
	[0169.193] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.193] lstrlenW (lpString=".1cd") returned 4
	[0169.193] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.193] lstrlenW (lpString=".jpg") returned 4
	[0169.193] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.194] lstrlenW (lpString=".doc") returned 4
	[0169.194] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.194] lstrlenW (lpString=".docx") returned 5
	[0169.194] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0169.194] lstrlenW (lpString=".pdf") returned 4
	[0169.194] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.194] lstrlenW (lpString=".xls") returned 4
	[0169.194] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.194] lstrlenW (lpString=".xlsx") returned 5
	[0169.194] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0169.194] lstrlenW (lpString=".ppt") returned 4
	[0169.194] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.194] lstrlenW (lpString=".zip") returned 4
	[0169.194] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.194] lstrlenW (lpString=".rar") returned 4
	[0169.194] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.194] lstrlenW (lpString=".bz2") returned 4
	[0169.194] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.194] lstrlenW (lpString=".7z") returned 3
	[0169.194] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.194] lstrlenW (lpString=".dbf") returned 4
	[0169.194] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.194] lstrlenW (lpString=".1cd") returned 4
	[0169.194] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0169.194] lstrlenW (lpString=".jpg") returned 4
	[0169.194] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.195] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.195] lstrlenW (lpString="SCHOL_02.MID") returned 12
	[0169.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.196] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=5058) returned 1
	[0169.196] CloseHandle (hObject=0x55c) returned 1
	[0169.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220
	[0169.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0169.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0169.197] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.197] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.198] GetLastError () returned 0x0
	[0169.198] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x13c2, lpOverlapped=0x0) returned 1
	[0169.199] WriteFile (in: hFile=0x4e0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x13d0, lpOverlapped=0x0) returned 1
	[0169.200] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.200] WriteFile (in: hFile=0x4e0, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.200] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.201] CloseHandle (hObject=0x4e0) returned 1
	[0169.201] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.201] SetEndOfFile (hFile=0x55c) returned 1
	[0169.204] CloseHandle (hObject=0x55c) returned 1
	[0169.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0169.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1
	[0169.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.205] lstrlenW (lpString=".doc") returned 4
	[0169.205] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.205] lstrlenW (lpString=".docx") returned 5
	[0169.205] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0169.205] lstrlenW (lpString=".pdf") returned 4
	[0169.205] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.205] lstrlenW (lpString=".xls") returned 4
	[0169.205] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.205] lstrlenW (lpString=".xlsx") returned 5
	[0169.205] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0169.205] lstrlenW (lpString=".ppt") returned 4
	[0169.205] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.206] lstrlenW (lpString=".zip") returned 4
	[0169.206] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.206] lstrlenW (lpString=".rar") returned 4
	[0169.206] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.206] lstrlenW (lpString=".bz2") returned 4
	[0169.206] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.206] lstrlenW (lpString=".7z") returned 3
	[0169.206] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.206] lstrlenW (lpString=".dbf") returned 4
	[0169.206] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.206] lstrlenW (lpString=".1cd") returned 4
	[0169.206] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.206] lstrlenW (lpString=".jpg") returned 4
	[0169.475] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.475] lstrlenW (lpString=".doc") returned 4
	[0169.475] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0169.475] lstrlenW (lpString=".docx") returned 5
	[0169.475] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0169.475] lstrlenW (lpString=".pdf") returned 4
	[0169.475] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0169.475] lstrlenW (lpString=".xls") returned 4
	[0169.475] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0169.475] lstrlenW (lpString=".xlsx") returned 5
	[0169.475] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0169.475] lstrlenW (lpString=".ppt") returned 4
	[0169.475] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0169.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.475] lstrlenW (lpString=".zip") returned 4
	[0169.475] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0169.475] lstrlenW (lpString=".rar") returned 4
	[0169.475] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0169.475] lstrlenW (lpString=".bz2") returned 4
	[0169.475] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0169.475] lstrlenW (lpString=".7z") returned 3
	[0169.476] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0169.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.476] lstrlenW (lpString=".dbf") returned 4
	[0169.476] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0169.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.476] lstrlenW (lpString=".1cd") returned 4
	[0169.476] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0169.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0169.476] lstrlenW (lpString=".jpg") returned 4
	[0169.476] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0169.476] lstrcmpiW (lpString1=".MID", lpString2=".money") returned -1
	[0169.476] lstrlenW (lpString="URBAN_01.MID") returned 12
	[0169.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.195] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=13358) returned 1
	[0170.195] CloseHandle (hObject=0x55c) returned 1
	[0170.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220
	[0170.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.198] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.198] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0170.199] GetLastError () returned 0x0
	[0170.199] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x342e, lpOverlapped=0x0) returned 1
	[0170.202] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x3430, lpOverlapped=0x0) returned 1
	[0170.203] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.203] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.203] SetEndOfFile (hFile=0x514) returned 1
	[0170.203] CloseHandle (hObject=0x514) returned 1
	[0170.203] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.203] SetEndOfFile (hFile=0x55c) returned 1
	[0170.206] CloseHandle (hObject=0x55c) returned 1
	[0170.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1
	[0170.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.207] lstrlenW (lpString=".doc") returned 4
	[0170.208] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0170.208] lstrlenW (lpString=".docx") returned 5
	[0170.208] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0170.208] lstrlenW (lpString=".pdf") returned 4
	[0170.208] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0170.208] lstrlenW (lpString=".xls") returned 4
	[0170.208] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0170.208] lstrlenW (lpString=".xlsx") returned 5
	[0170.208] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0170.208] lstrlenW (lpString=".ppt") returned 4
	[0170.208] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0170.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.208] lstrlenW (lpString=".zip") returned 4
	[0170.208] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0170.208] lstrlenW (lpString=".rar") returned 4
	[0170.208] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0170.208] lstrlenW (lpString=".bz2") returned 4
	[0170.208] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0170.208] lstrlenW (lpString=".7z") returned 3
	[0170.208] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0170.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.208] lstrlenW (lpString=".dbf") returned 4
	[0170.208] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0170.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.208] lstrlenW (lpString=".1cd") returned 4
	[0170.208] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0170.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.208] lstrlenW (lpString=".jpg") returned 4
	[0170.209] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0170.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.209] lstrlenW (lpString=".doc") returned 4
	[0170.209] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0170.209] lstrlenW (lpString=".docx") returned 5
	[0170.209] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0170.209] lstrlenW (lpString=".pdf") returned 4
	[0170.209] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0170.209] lstrlenW (lpString=".xls") returned 4
	[0170.209] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0170.209] lstrlenW (lpString=".xlsx") returned 5
	[0170.209] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0170.209] lstrlenW (lpString=".ppt") returned 4
	[0170.209] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0170.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.209] lstrlenW (lpString=".zip") returned 4
	[0170.209] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0170.209] lstrlenW (lpString=".rar") returned 4
	[0170.209] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0170.209] lstrlenW (lpString=".bz2") returned 4
	[0170.209] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0170.209] lstrlenW (lpString=".7z") returned 3
	[0170.209] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0170.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.209] lstrlenW (lpString=".dbf") returned 4
	[0170.209] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0170.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.210] lstrlenW (lpString=".1cd") returned 4
	[0170.210] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0170.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0170.210] lstrlenW (lpString=".jpg") returned 4
	[0170.210] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0170.210] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0170.210] lstrlenW (lpString="Glow Edge.eftx") returned 14
	[0170.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.211] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=54347) returned 1
	[0170.211] CloseHandle (hObject=0x55c) returned 1
	[0170.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220
	[0170.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.212] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.212] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0170.213] GetLastError () returned 0x0
	[0170.213] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xd44b, lpOverlapped=0x0) returned 1
	[0170.216] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xd450, lpOverlapped=0x0) returned 1
	[0170.218] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.218] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0170.218] SetEndOfFile (hFile=0x514) returned 1
	[0170.218] CloseHandle (hObject=0x514) returned 1
	[0170.218] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.218] SetEndOfFile (hFile=0x55c) returned 1
	[0170.221] CloseHandle (hObject=0x55c) returned 1
	[0170.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1
	[0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.226] lstrlenW (lpString=".doc") returned 4
	[0170.226] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.226] lstrlenW (lpString=".docx") returned 5
	[0170.226] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.226] lstrlenW (lpString=".pdf") returned 4
	[0170.226] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.226] lstrlenW (lpString=".xls") returned 4
	[0170.226] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.227] lstrlenW (lpString=".xlsx") returned 5
	[0170.227] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.227] lstrlenW (lpString=".ppt") returned 4
	[0170.227] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.227] lstrlenW (lpString=".zip") returned 4
	[0170.227] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.227] lstrlenW (lpString=".rar") returned 4
	[0170.227] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.227] lstrlenW (lpString=".bz2") returned 4
	[0170.227] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.227] lstrlenW (lpString=".7z") returned 3
	[0170.227] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.227] lstrlenW (lpString=".dbf") returned 4
	[0170.227] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.227] lstrlenW (lpString=".1cd") returned 4
	[0170.227] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.227] lstrlenW (lpString=".jpg") returned 4
	[0170.227] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.227] lstrlenW (lpString=".doc") returned 4
	[0170.227] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.227] lstrlenW (lpString=".docx") returned 5
	[0170.228] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.228] lstrlenW (lpString=".pdf") returned 4
	[0170.228] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.228] lstrlenW (lpString=".xls") returned 4
	[0170.228] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.228] lstrlenW (lpString=".xlsx") returned 5
	[0170.228] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.228] lstrlenW (lpString=".ppt") returned 4
	[0170.228] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.228] lstrlenW (lpString=".zip") returned 4
	[0170.228] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.228] lstrlenW (lpString=".rar") returned 4
	[0170.228] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.228] lstrlenW (lpString=".bz2") returned 4
	[0170.228] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.228] lstrlenW (lpString=".7z") returned 3
	[0170.228] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.228] lstrlenW (lpString=".dbf") returned 4
	[0170.228] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.229] lstrlenW (lpString=".1cd") returned 4
	[0170.229] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0170.229] lstrlenW (lpString=".jpg") returned 4
	[0170.229] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.229] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0170.229] lstrlenW (lpString="Grunge Texture.eftx") returned 19
	[0170.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.230] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=352776) returned 1
	[0170.230] CloseHandle (hObject=0x55c) returned 1
	[0170.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220
	[0170.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0170.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0170.230] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.230] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0170.231] GetLastError () returned 0x0
	[0170.231] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x56208, lpOverlapped=0x0) returned 1
	[0170.613] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x56210, lpOverlapped=0x0) returned 1
	[0170.622] ReadFile (in: hFile=0x55c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.622] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0170.622] SetEndOfFile (hFile=0x514) returned 1
	[0170.622] CloseHandle (hObject=0x514) returned 1
	[0170.622] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.622] SetEndOfFile (hFile=0x55c) returned 1
	[0170.635] CloseHandle (hObject=0x55c) returned 1
	[0170.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0170.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1
	[0170.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.637] lstrlenW (lpString=".doc") returned 4
	[0170.637] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.637] lstrlenW (lpString=".docx") returned 5
	[0170.637] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.637] lstrlenW (lpString=".pdf") returned 4
	[0170.637] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.637] lstrlenW (lpString=".xls") returned 4
	[0170.637] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.637] lstrlenW (lpString=".xlsx") returned 5
	[0170.637] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.637] lstrlenW (lpString=".ppt") returned 4
	[0170.637] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.637] lstrlenW (lpString=".zip") returned 4
	[0170.637] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.637] lstrlenW (lpString=".rar") returned 4
	[0170.638] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.638] lstrlenW (lpString=".bz2") returned 4
	[0170.638] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.638] lstrlenW (lpString=".7z") returned 3
	[0170.638] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.638] lstrlenW (lpString=".dbf") returned 4
	[0170.638] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.638] lstrlenW (lpString=".1cd") returned 4
	[0170.638] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.638] lstrlenW (lpString=".jpg") returned 4
	[0170.638] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.638] lstrlenW (lpString=".doc") returned 4
	[0170.638] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0170.638] lstrlenW (lpString=".docx") returned 5
	[0170.638] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0170.638] lstrlenW (lpString=".pdf") returned 4
	[0170.638] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0170.638] lstrlenW (lpString=".xls") returned 4
	[0170.638] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0170.638] lstrlenW (lpString=".xlsx") returned 5
	[0170.638] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0170.638] lstrlenW (lpString=".ppt") returned 4
	[0170.639] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0170.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.968] lstrlenW (lpString=".zip") returned 4
	[0170.968] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0170.968] lstrlenW (lpString=".rar") returned 4
	[0170.968] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0170.968] lstrlenW (lpString=".bz2") returned 4
	[0170.968] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0170.968] lstrlenW (lpString=".7z") returned 3
	[0170.968] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0170.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.968] lstrlenW (lpString=".dbf") returned 4
	[0170.968] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0170.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.968] lstrlenW (lpString=".1cd") returned 4
	[0170.968] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0170.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0170.968] lstrlenW (lpString=".jpg") returned 4
	[0170.968] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0170.969] lstrcmpiW (lpString1=".eftx", lpString2=".money") returned -1
	[0170.969] lstrlenW (lpString="Riblet.eftx") returned 11
	[0170.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0171.839] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=295074) returned 1
	[0171.839] CloseHandle (hObject=0x548) returned 1
	[0171.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220
	[0171.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0171.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0171.840] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.840] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0171.841] GetLastError () returned 0x0
	[0171.841] ReadFile (in: hFile=0x548, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x480a2, lpOverlapped=0x0) returned 1
	[0171.852] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x480b0, lpOverlapped=0x0) returned 1
	[0171.858] ReadFile (in: hFile=0x548, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.858] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xea, lpOverlapped=0x0) returned 1
	[0171.859] SetEndOfFile (hFile=0x538) returned 1
	[0171.859] CloseHandle (hObject=0x538) returned 1
	[0171.859] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.859] SetEndOfFile (hFile=0x548) returned 1
	[0171.868] CloseHandle (hObject=0x548) returned 1
	[0171.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0171.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1
	[0171.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.869] lstrlenW (lpString=".doc") returned 4
	[0171.869] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.869] lstrlenW (lpString=".docx") returned 5
	[0171.869] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.869] lstrlenW (lpString=".pdf") returned 4
	[0171.869] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.869] lstrlenW (lpString=".xls") returned 4
	[0171.869] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.869] lstrlenW (lpString=".xlsx") returned 5
	[0171.869] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.869] lstrlenW (lpString=".ppt") returned 4
	[0171.869] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.869] lstrlenW (lpString=".zip") returned 4
	[0171.869] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.869] lstrlenW (lpString=".rar") returned 4
	[0171.870] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.870] lstrlenW (lpString=".bz2") returned 4
	[0171.870] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.870] lstrlenW (lpString=".7z") returned 3
	[0171.870] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.870] lstrlenW (lpString=".dbf") returned 4
	[0171.870] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.870] lstrlenW (lpString=".1cd") returned 4
	[0171.870] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.870] lstrlenW (lpString=".jpg") returned 4
	[0171.870] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.870] lstrlenW (lpString=".doc") returned 4
	[0171.870] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0171.870] lstrlenW (lpString=".docx") returned 5
	[0171.870] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0171.870] lstrlenW (lpString=".pdf") returned 4
	[0171.870] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0171.870] lstrlenW (lpString=".xls") returned 4
	[0171.870] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0171.870] lstrlenW (lpString=".xlsx") returned 5
	[0171.870] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0171.870] lstrlenW (lpString=".ppt") returned 4
	[0171.870] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0171.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.871] lstrlenW (lpString=".zip") returned 4
	[0171.871] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0171.871] lstrlenW (lpString=".rar") returned 4
	[0171.871] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0171.871] lstrlenW (lpString=".bz2") returned 4
	[0171.871] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0171.871] lstrlenW (lpString=".7z") returned 3
	[0171.871] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0171.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.871] lstrlenW (lpString=".dbf") returned 4
	[0171.871] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0171.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.871] lstrlenW (lpString=".1cd") returned 4
	[0171.871] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0171.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0171.871] lstrlenW (lpString=".jpg") returned 4
	[0171.871] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0171.871] lstrcmpiW (lpString1=".exe", lpString2=".money") returned -1
	[0171.871] lstrlenW (lpString="Flattener.exe") returned 13
	[0171.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0171.873] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=45664) returned 1
	[0171.873] CloseHandle (hObject=0x548) returned 1
	[0171.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe")) returned 0x220
	[0172.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0172.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0172.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.909] lstrlenW (lpString=".doc") returned 4
	[0172.909] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0172.909] lstrlenW (lpString=".docx") returned 5
	[0172.909] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0172.909] lstrlenW (lpString=".pdf") returned 4
	[0172.909] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0172.909] lstrlenW (lpString=".xls") returned 4
	[0172.909] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0172.909] lstrlenW (lpString=".xlsx") returned 5
	[0172.909] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0172.909] lstrlenW (lpString=".ppt") returned 4
	[0172.909] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0172.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.909] lstrlenW (lpString=".zip") returned 4
	[0172.909] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0172.909] lstrlenW (lpString=".rar") returned 4
	[0172.909] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0172.909] lstrlenW (lpString=".bz2") returned 4
	[0172.909] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0172.909] lstrlenW (lpString=".7z") returned 3
	[0172.909] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0172.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.910] lstrlenW (lpString=".dbf") returned 4
	[0172.910] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0172.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.910] lstrlenW (lpString=".1cd") returned 4
	[0172.910] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0172.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.910] lstrlenW (lpString=".jpg") returned 4
	[0172.910] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0172.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.910] lstrlenW (lpString=".doc") returned 4
	[0172.910] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0172.910] lstrlenW (lpString=".docx") returned 5
	[0172.910] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0172.910] lstrlenW (lpString=".pdf") returned 4
	[0172.910] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0172.910] lstrlenW (lpString=".xls") returned 4
	[0172.910] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0172.910] lstrlenW (lpString=".xlsx") returned 5
	[0172.910] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0172.910] lstrlenW (lpString=".ppt") returned 4
	[0172.910] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0172.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.910] lstrlenW (lpString=".zip") returned 4
	[0172.910] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0172.910] lstrlenW (lpString=".rar") returned 4
	[0172.910] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0172.910] lstrlenW (lpString=".bz2") returned 4
	[0172.910] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0172.911] lstrlenW (lpString=".7z") returned 3
	[0172.911] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0172.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.911] lstrlenW (lpString=".dbf") returned 4
	[0172.911] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0172.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.911] lstrlenW (lpString=".1cd") returned 4
	[0172.911] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0172.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0172.911] lstrlenW (lpString=".jpg") returned 4
	[0172.911] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0172.911] lstrcmpiW (lpString1=".msu", lpString2=".money") returned 1
	[0172.911] lstrlenW (lpString="Windows8-RT-KB2999226-x64.msu") returned 29
	[0172.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0173.303] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=1347630) returned 1
	[0173.303] CloseHandle (hObject=0x530) returned 1
	[0173.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220
	[0173.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0173.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0173.304] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.304] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0173.305] GetLastError () returned 0x0
	[0173.305] ReadFile (in: hFile=0x530, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0173.331] WriteFile (in: hFile=0x520, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0173.528] ReadFile (in: hFile=0x530, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x4903e, lpOverlapped=0x0) returned 1
	[0173.540] WriteFile (in: hFile=0x520, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x49040, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x49040, lpOverlapped=0x0) returned 1
	[0173.548] ReadFile (in: hFile=0x530, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.548] WriteFile (in: hFile=0x520, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0173.548] SetEndOfFile (hFile=0x520) returned 1
	[0173.548] CloseHandle (hObject=0x520) returned 1
	[0173.549] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.549] SetEndOfFile (hFile=0x530) returned 1
	[0173.872] CloseHandle (hObject=0x530) returned 1
	[0173.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 1
	[0174.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.188] lstrlenW (lpString=".doc") returned 4
	[0174.188] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0174.188] lstrlenW (lpString=".docx") returned 5
	[0174.188] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0174.188] lstrlenW (lpString=".pdf") returned 4
	[0174.188] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0174.188] lstrlenW (lpString=".xls") returned 4
	[0174.188] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0174.188] lstrlenW (lpString=".xlsx") returned 5
	[0174.188] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0174.188] lstrlenW (lpString=".ppt") returned 4
	[0174.188] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0174.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.188] lstrlenW (lpString=".zip") returned 4
	[0174.188] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0174.188] lstrlenW (lpString=".rar") returned 4
	[0174.188] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0174.188] lstrlenW (lpString=".bz2") returned 4
	[0174.188] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0174.188] lstrlenW (lpString=".7z") returned 3
	[0174.189] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.189] lstrlenW (lpString=".dbf") returned 4
	[0174.189] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.189] lstrlenW (lpString=".1cd") returned 4
	[0174.189] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.189] lstrlenW (lpString=".jpg") returned 4
	[0174.189] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.189] lstrlenW (lpString=".doc") returned 4
	[0174.189] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0174.189] lstrlenW (lpString=".docx") returned 5
	[0174.189] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0174.189] lstrlenW (lpString=".pdf") returned 4
	[0174.189] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0174.189] lstrlenW (lpString=".xls") returned 4
	[0174.189] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0174.189] lstrlenW (lpString=".xlsx") returned 5
	[0174.189] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0174.189] lstrlenW (lpString=".ppt") returned 4
	[0174.189] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.189] lstrlenW (lpString=".zip") returned 4
	[0174.189] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0174.189] lstrlenW (lpString=".rar") returned 4
	[0174.189] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0174.189] lstrlenW (lpString=".bz2") returned 4
	[0174.189] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0174.190] lstrlenW (lpString=".7z") returned 3
	[0174.190] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0174.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.190] lstrlenW (lpString=".dbf") returned 4
	[0174.190] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0174.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.190] lstrlenW (lpString=".1cd") returned 4
	[0174.190] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0174.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0174.190] lstrlenW (lpString=".jpg") returned 4
	[0174.190] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0174.190] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0174.190] lstrlenW (lpString="AccessR_OEM_Perp-pl.xrm-ms") returned 26
	[0174.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0174.372] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=10639) returned 1
	[0174.372] CloseHandle (hObject=0x558) returned 1
	[0174.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220
	[0174.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0174.534] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.534] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0174.535] GetLastError () returned 0x0
	[0174.535] ReadFile (in: hFile=0x544, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x298f, lpOverlapped=0x0) returned 1
	[0174.537] WriteFile (in: hFile=0x51c, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0174.538] ReadFile (in: hFile=0x544, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.538] WriteFile (in: hFile=0x51c, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x108, lpOverlapped=0x0) returned 1
	[0174.538] SetEndOfFile (hFile=0x51c) returned 1
	[0174.538] CloseHandle (hObject=0x51c) returned 1
	[0174.538] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.538] SetEndOfFile (hFile=0x544) returned 1
	[0174.541] CloseHandle (hObject=0x544) returned 1
	[0174.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0174.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 1
	[0174.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.542] lstrlenW (lpString=".doc") returned 4
	[0174.542] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.542] lstrlenW (lpString=".docx") returned 5
	[0174.542] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.542] lstrlenW (lpString=".pdf") returned 4
	[0174.542] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.542] lstrlenW (lpString=".xls") returned 4
	[0174.542] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.542] lstrlenW (lpString=".xlsx") returned 5
	[0174.542] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.542] lstrlenW (lpString=".ppt") returned 4
	[0174.542] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.542] lstrlenW (lpString=".zip") returned 4
	[0174.542] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.542] lstrlenW (lpString=".rar") returned 4
	[0174.542] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.542] lstrlenW (lpString=".bz2") returned 4
	[0174.543] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.543] lstrlenW (lpString=".7z") returned 3
	[0174.543] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.543] lstrlenW (lpString=".dbf") returned 4
	[0174.543] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.543] lstrlenW (lpString=".1cd") returned 4
	[0174.543] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.543] lstrlenW (lpString=".jpg") returned 4
	[0174.543] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.543] lstrlenW (lpString=".doc") returned 4
	[0174.543] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.543] lstrlenW (lpString=".docx") returned 5
	[0174.543] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.543] lstrlenW (lpString=".pdf") returned 4
	[0174.543] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.543] lstrlenW (lpString=".xls") returned 4
	[0174.543] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.543] lstrlenW (lpString=".xlsx") returned 5
	[0174.543] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.543] lstrlenW (lpString=".ppt") returned 4
	[0174.543] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.543] lstrlenW (lpString=".zip") returned 4
	[0174.543] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.543] lstrlenW (lpString=".rar") returned 4
	[0174.544] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.544] lstrlenW (lpString=".bz2") returned 4
	[0174.544] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.544] lstrlenW (lpString=".7z") returned 3
	[0174.544] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.544] lstrlenW (lpString=".dbf") returned 4
	[0174.544] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.544] lstrlenW (lpString=".1cd") returned 4
	[0174.544] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0174.544] lstrlenW (lpString=".jpg") returned 4
	[0174.544] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.544] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0174.544] lstrlenW (lpString="AccessR_OEM_Perp-ul-oob.xrm-ms") returned 30
	[0174.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0174.653] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11587) returned 1
	[0174.653] CloseHandle (hObject=0x538) returned 1
	[0174.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0174.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0174.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.060] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.060] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.363] GetLastError () returned 0x0
	[0175.363] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d43, lpOverlapped=0x0) returned 1
	[0175.364] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0175.365] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.366] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x110, lpOverlapped=0x0) returned 1
	[0175.366] SetEndOfFile (hFile=0x538) returned 1
	[0175.366] CloseHandle (hObject=0x538) returned 1
	[0175.366] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.366] SetEndOfFile (hFile=0x324) returned 1
	[0175.368] CloseHandle (hObject=0x324) returned 1
	[0175.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0175.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.372] lstrlenW (lpString=".doc") returned 4
	[0175.372] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.372] lstrlenW (lpString=".docx") returned 5
	[0175.372] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.372] lstrlenW (lpString=".pdf") returned 4
	[0175.372] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.372] lstrlenW (lpString=".xls") returned 4
	[0175.372] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.372] lstrlenW (lpString=".xlsx") returned 5
	[0175.372] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.372] lstrlenW (lpString=".ppt") returned 4
	[0175.372] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.372] lstrlenW (lpString=".zip") returned 4
	[0175.372] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.372] lstrlenW (lpString=".rar") returned 4
	[0175.372] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.372] lstrlenW (lpString=".bz2") returned 4
	[0175.372] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.372] lstrlenW (lpString=".7z") returned 3
	[0175.372] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.372] lstrlenW (lpString=".dbf") returned 4
	[0175.372] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.372] lstrlenW (lpString=".1cd") returned 4
	[0175.372] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.372] lstrlenW (lpString=".jpg") returned 4
	[0175.373] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.373] lstrlenW (lpString=".doc") returned 4
	[0175.373] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.373] lstrlenW (lpString=".docx") returned 5
	[0175.373] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.373] lstrlenW (lpString=".pdf") returned 4
	[0175.373] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.373] lstrlenW (lpString=".xls") returned 4
	[0175.373] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.373] lstrlenW (lpString=".xlsx") returned 5
	[0175.373] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.373] lstrlenW (lpString=".ppt") returned 4
	[0175.373] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.373] lstrlenW (lpString=".zip") returned 4
	[0175.373] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.373] lstrlenW (lpString=".rar") returned 4
	[0175.373] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.373] lstrlenW (lpString=".bz2") returned 4
	[0175.373] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.373] lstrlenW (lpString=".7z") returned 3
	[0175.373] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.373] lstrlenW (lpString=".dbf") returned 4
	[0175.373] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.373] lstrlenW (lpString=".1cd") returned 4
	[0175.373] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0175.374] lstrlenW (lpString=".jpg") returned 4
	[0175.374] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.374] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.374] lstrlenW (lpString="AccessR_Trial-ul-oob.xrm-ms") returned 27
	[0175.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.375] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11591) returned 1
	[0175.375] CloseHandle (hObject=0x324) returned 1
	[0175.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220
	[0175.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.375] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.375] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.376] GetLastError () returned 0x0
	[0175.376] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d47, lpOverlapped=0x0) returned 1
	[0175.378] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0175.379] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.379] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0175.379] SetEndOfFile (hFile=0x538) returned 1
	[0175.379] CloseHandle (hObject=0x538) returned 1
	[0175.379] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.379] SetEndOfFile (hFile=0x324) returned 1
	[0175.382] CloseHandle (hObject=0x324) returned 1
	[0175.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 1
	[0175.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.383] lstrlenW (lpString=".doc") returned 4
	[0175.384] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.384] lstrlenW (lpString=".docx") returned 5
	[0175.384] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.384] lstrlenW (lpString=".pdf") returned 4
	[0175.384] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.384] lstrlenW (lpString=".xls") returned 4
	[0175.384] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.384] lstrlenW (lpString=".xlsx") returned 5
	[0175.384] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.384] lstrlenW (lpString=".ppt") returned 4
	[0175.384] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.384] lstrlenW (lpString=".zip") returned 4
	[0175.384] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.384] lstrlenW (lpString=".rar") returned 4
	[0175.384] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.384] lstrlenW (lpString=".bz2") returned 4
	[0175.384] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.384] lstrlenW (lpString=".7z") returned 3
	[0175.384] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.384] lstrlenW (lpString=".dbf") returned 4
	[0175.384] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.384] lstrlenW (lpString=".1cd") returned 4
	[0175.384] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.384] lstrlenW (lpString=".jpg") returned 4
	[0175.384] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.385] lstrlenW (lpString=".doc") returned 4
	[0175.385] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.385] lstrlenW (lpString=".docx") returned 5
	[0175.385] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.385] lstrlenW (lpString=".pdf") returned 4
	[0175.385] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.385] lstrlenW (lpString=".xls") returned 4
	[0175.385] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.385] lstrlenW (lpString=".xlsx") returned 5
	[0175.385] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.385] lstrlenW (lpString=".ppt") returned 4
	[0175.385] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.385] lstrlenW (lpString=".zip") returned 4
	[0175.385] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.385] lstrlenW (lpString=".rar") returned 4
	[0175.385] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.385] lstrlenW (lpString=".bz2") returned 4
	[0175.385] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.385] lstrlenW (lpString=".7z") returned 3
	[0175.385] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.385] lstrlenW (lpString=".dbf") returned 4
	[0175.385] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.385] lstrlenW (lpString=".1cd") returned 4
	[0175.385] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0175.385] lstrlenW (lpString=".jpg") returned 4
	[0175.385] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.386] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.386] lstrlenW (lpString="AccessVL_KMS_Client-ppd.xrm-ms") returned 30
	[0175.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.386] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=6794) returned 1
	[0175.386] CloseHandle (hObject=0x324) returned 1
	[0175.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220
	[0175.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.387] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.387] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.388] GetLastError () returned 0x0
	[0175.388] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x1a8a, lpOverlapped=0x0) returned 1
	[0175.389] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x1a90, lpOverlapped=0x0) returned 1
	[0175.390] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.390] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x110, lpOverlapped=0x0) returned 1
	[0175.391] SetEndOfFile (hFile=0x538) returned 1
	[0175.391] CloseHandle (hObject=0x538) returned 1
	[0175.391] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.391] SetEndOfFile (hFile=0x324) returned 1
	[0175.393] CloseHandle (hObject=0x324) returned 1
	[0175.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 1
	[0175.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.394] lstrlenW (lpString=".doc") returned 4
	[0175.394] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.394] lstrlenW (lpString=".docx") returned 5
	[0175.394] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.394] lstrlenW (lpString=".pdf") returned 4
	[0175.394] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.395] lstrlenW (lpString=".xls") returned 4
	[0175.395] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.395] lstrlenW (lpString=".xlsx") returned 5
	[0175.395] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.395] lstrlenW (lpString=".ppt") returned 4
	[0175.395] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.395] lstrlenW (lpString=".zip") returned 4
	[0175.395] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.395] lstrlenW (lpString=".rar") returned 4
	[0175.395] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.395] lstrlenW (lpString=".bz2") returned 4
	[0175.395] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.395] lstrlenW (lpString=".7z") returned 3
	[0175.395] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.395] lstrlenW (lpString=".dbf") returned 4
	[0175.395] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.395] lstrlenW (lpString=".1cd") returned 4
	[0175.395] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.395] lstrlenW (lpString=".jpg") returned 4
	[0175.395] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.395] lstrlenW (lpString=".doc") returned 4
	[0175.395] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.395] lstrlenW (lpString=".docx") returned 5
	[0175.396] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.396] lstrlenW (lpString=".pdf") returned 4
	[0175.396] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.396] lstrlenW (lpString=".xls") returned 4
	[0175.396] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.396] lstrlenW (lpString=".xlsx") returned 5
	[0175.396] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.396] lstrlenW (lpString=".ppt") returned 4
	[0175.396] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.396] lstrlenW (lpString=".zip") returned 4
	[0175.396] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.396] lstrlenW (lpString=".rar") returned 4
	[0175.396] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.396] lstrlenW (lpString=".bz2") returned 4
	[0175.396] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.396] lstrlenW (lpString=".7z") returned 3
	[0175.396] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.396] lstrlenW (lpString=".dbf") returned 4
	[0175.396] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.396] lstrlenW (lpString=".1cd") returned 4
	[0175.396] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0175.396] lstrlenW (lpString=".jpg") returned 4
	[0175.396] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.397] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.397] lstrlenW (lpString="AccessVL_KMS_Client-ul-oob.xrm-ms") returned 33
	[0175.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.397] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11614) returned 1
	[0175.397] CloseHandle (hObject=0x324) returned 1
	[0175.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220
	[0175.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.398] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.398] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.399] GetLastError () returned 0x0
	[0175.399] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d5e, lpOverlapped=0x0) returned 1
	[0175.443] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0175.480] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.480] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x116, lpOverlapped=0x0) returned 1
	[0175.480] SetEndOfFile (hFile=0x538) returned 1
	[0175.480] CloseHandle (hObject=0x538) returned 1
	[0175.480] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.480] SetEndOfFile (hFile=0x324) returned 1
	[0175.483] CloseHandle (hObject=0x324) returned 1
	[0175.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 1
	[0175.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.484] lstrlenW (lpString=".doc") returned 4
	[0175.484] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.484] lstrlenW (lpString=".docx") returned 5
	[0175.484] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.484] lstrlenW (lpString=".pdf") returned 4
	[0175.484] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.484] lstrlenW (lpString=".xls") returned 4
	[0175.484] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.484] lstrlenW (lpString=".xlsx") returned 5
	[0175.484] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.484] lstrlenW (lpString=".ppt") returned 4
	[0175.484] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.484] lstrlenW (lpString=".zip") returned 4
	[0175.485] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.485] lstrlenW (lpString=".rar") returned 4
	[0175.485] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.485] lstrlenW (lpString=".bz2") returned 4
	[0175.485] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.485] lstrlenW (lpString=".7z") returned 3
	[0175.485] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.485] lstrlenW (lpString=".dbf") returned 4
	[0175.485] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.485] lstrlenW (lpString=".1cd") returned 4
	[0175.485] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.485] lstrlenW (lpString=".jpg") returned 4
	[0175.485] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.485] lstrlenW (lpString=".doc") returned 4
	[0175.485] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.485] lstrlenW (lpString=".docx") returned 5
	[0175.485] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.485] lstrlenW (lpString=".pdf") returned 4
	[0175.485] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.485] lstrlenW (lpString=".xls") returned 4
	[0175.485] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.485] lstrlenW (lpString=".xlsx") returned 5
	[0175.485] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.485] lstrlenW (lpString=".ppt") returned 4
	[0175.485] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.486] lstrlenW (lpString=".zip") returned 4
	[0175.486] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.486] lstrlenW (lpString=".rar") returned 4
	[0175.486] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.486] lstrlenW (lpString=".bz2") returned 4
	[0175.486] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.486] lstrlenW (lpString=".7z") returned 3
	[0175.486] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.486] lstrlenW (lpString=".dbf") returned 4
	[0175.486] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.486] lstrlenW (lpString=".1cd") returned 4
	[0175.486] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0175.486] lstrlenW (lpString=".jpg") returned 4
	[0175.486] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.486] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.486] lstrlenW (lpString="AccessVL_MAK-ppd.xrm-ms") returned 23
	[0175.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.487] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=6729) returned 1
	[0175.487] CloseHandle (hObject=0x324) returned 1
	[0175.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220
	[0175.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.489] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.489] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.490] GetLastError () returned 0x0
	[0175.490] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x1a49, lpOverlapped=0x0) returned 1
	[0175.491] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x1a50, lpOverlapped=0x0) returned 1
	[0175.492] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.492] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x102, lpOverlapped=0x0) returned 1
	[0175.492] SetEndOfFile (hFile=0x538) returned 1
	[0175.492] CloseHandle (hObject=0x538) returned 1
	[0175.493] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.493] SetEndOfFile (hFile=0x324) returned 1
	[0175.495] CloseHandle (hObject=0x324) returned 1
	[0175.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 1
	[0175.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.496] lstrlenW (lpString=".doc") returned 4
	[0175.496] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.496] lstrlenW (lpString=".docx") returned 5
	[0175.497] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.497] lstrlenW (lpString=".pdf") returned 4
	[0175.497] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.497] lstrlenW (lpString=".xls") returned 4
	[0175.497] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.497] lstrlenW (lpString=".xlsx") returned 5
	[0175.497] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.497] lstrlenW (lpString=".ppt") returned 4
	[0175.497] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.497] lstrlenW (lpString=".zip") returned 4
	[0175.497] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.497] lstrlenW (lpString=".rar") returned 4
	[0175.497] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.497] lstrlenW (lpString=".bz2") returned 4
	[0175.497] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.497] lstrlenW (lpString=".7z") returned 3
	[0175.497] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.497] lstrlenW (lpString=".dbf") returned 4
	[0175.497] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.497] lstrlenW (lpString=".1cd") returned 4
	[0175.497] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.497] lstrlenW (lpString=".jpg") returned 4
	[0175.497] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.497] lstrlenW (lpString=".doc") returned 4
	[0175.497] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.498] lstrlenW (lpString=".docx") returned 5
	[0175.498] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.498] lstrlenW (lpString=".pdf") returned 4
	[0175.498] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.498] lstrlenW (lpString=".xls") returned 4
	[0175.498] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.498] lstrlenW (lpString=".xlsx") returned 5
	[0175.498] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.498] lstrlenW (lpString=".ppt") returned 4
	[0175.498] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.498] lstrlenW (lpString=".zip") returned 4
	[0175.498] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.498] lstrlenW (lpString=".rar") returned 4
	[0175.498] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.498] lstrlenW (lpString=".bz2") returned 4
	[0175.498] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.498] lstrlenW (lpString=".7z") returned 3
	[0175.498] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.498] lstrlenW (lpString=".dbf") returned 4
	[0175.498] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.498] lstrlenW (lpString=".1cd") returned 4
	[0175.498] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0175.498] lstrlenW (lpString=".jpg") returned 4
	[0175.498] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.499] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.499] lstrlenW (lpString="AccessVL_MAK-ul-oob.xrm-ms") returned 26
	[0175.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.500] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11581) returned 1
	[0175.500] CloseHandle (hObject=0x324) returned 1
	[0175.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220
	[0175.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.500] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.500] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.501] GetLastError () returned 0x0
	[0175.501] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d3d, lpOverlapped=0x0) returned 1
	[0175.503] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0175.504] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.504] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x108, lpOverlapped=0x0) returned 1
	[0175.504] SetEndOfFile (hFile=0x538) returned 1
	[0175.504] CloseHandle (hObject=0x538) returned 1
	[0175.504] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.504] SetEndOfFile (hFile=0x324) returned 1
	[0175.507] CloseHandle (hObject=0x324) returned 1
	[0175.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 1
	[0175.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.508] lstrlenW (lpString=".doc") returned 4
	[0175.508] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.508] lstrlenW (lpString=".docx") returned 5
	[0175.508] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.508] lstrlenW (lpString=".pdf") returned 4
	[0175.508] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.508] lstrlenW (lpString=".xls") returned 4
	[0175.508] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.508] lstrlenW (lpString=".xlsx") returned 5
	[0175.508] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.508] lstrlenW (lpString=".ppt") returned 4
	[0175.508] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.508] lstrlenW (lpString=".zip") returned 4
	[0175.508] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.508] lstrlenW (lpString=".rar") returned 4
	[0175.508] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.508] lstrlenW (lpString=".bz2") returned 4
	[0175.508] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.509] lstrlenW (lpString=".7z") returned 3
	[0175.509] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.509] lstrlenW (lpString=".dbf") returned 4
	[0175.509] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.509] lstrlenW (lpString=".1cd") returned 4
	[0175.509] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.509] lstrlenW (lpString=".jpg") returned 4
	[0175.509] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.509] lstrlenW (lpString=".doc") returned 4
	[0175.509] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.509] lstrlenW (lpString=".docx") returned 5
	[0175.509] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.509] lstrlenW (lpString=".pdf") returned 4
	[0175.509] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.509] lstrlenW (lpString=".xls") returned 4
	[0175.509] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.509] lstrlenW (lpString=".xlsx") returned 5
	[0175.509] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.509] lstrlenW (lpString=".ppt") returned 4
	[0175.509] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.509] lstrlenW (lpString=".zip") returned 4
	[0175.509] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.509] lstrlenW (lpString=".rar") returned 4
	[0175.509] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.509] lstrlenW (lpString=".bz2") returned 4
	[0175.510] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.510] lstrlenW (lpString=".7z") returned 3
	[0175.510] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.510] lstrlenW (lpString=".dbf") returned 4
	[0175.510] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.510] lstrlenW (lpString=".1cd") returned 4
	[0175.510] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0175.510] lstrlenW (lpString=".jpg") returned 4
	[0175.510] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.510] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0175.510] lstrlenW (lpString="AccessVL_MAK-ul-phn.xrm-ms") returned 26
	[0175.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.511] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=19926) returned 1
	[0175.511] CloseHandle (hObject=0x324) returned 1
	[0175.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220
	[0175.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0175.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0175.512] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.512] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.512] GetLastError () returned 0x0
	[0175.513] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x4dd6, lpOverlapped=0x0) returned 1
	[0175.722] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0175.723] ReadFile (in: hFile=0x324, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.723] WriteFile (in: hFile=0x538, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x108, lpOverlapped=0x0) returned 1
	[0175.723] SetEndOfFile (hFile=0x538) returned 1
	[0175.724] CloseHandle (hObject=0x538) returned 1
	[0175.724] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.724] SetEndOfFile (hFile=0x324) returned 1
	[0175.727] CloseHandle (hObject=0x324) returned 1
	[0175.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0175.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 1
	[0176.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.210] lstrlenW (lpString=".doc") returned 4
	[0176.210] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.210] lstrlenW (lpString=".docx") returned 5
	[0176.210] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.210] lstrlenW (lpString=".pdf") returned 4
	[0176.210] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.210] lstrlenW (lpString=".xls") returned 4
	[0176.210] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.211] lstrlenW (lpString=".xlsx") returned 5
	[0176.211] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.211] lstrlenW (lpString=".ppt") returned 4
	[0176.211] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.211] lstrlenW (lpString=".zip") returned 4
	[0176.211] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.211] lstrlenW (lpString=".rar") returned 4
	[0176.211] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.211] lstrlenW (lpString=".bz2") returned 4
	[0176.211] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.211] lstrlenW (lpString=".7z") returned 3
	[0176.211] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.211] lstrlenW (lpString=".dbf") returned 4
	[0176.211] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.211] lstrlenW (lpString=".1cd") returned 4
	[0176.211] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.211] lstrlenW (lpString=".jpg") returned 4
	[0176.211] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.211] lstrlenW (lpString=".doc") returned 4
	[0176.211] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.211] lstrlenW (lpString=".docx") returned 5
	[0176.211] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.211] lstrlenW (lpString=".pdf") returned 4
	[0176.212] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.212] lstrlenW (lpString=".xls") returned 4
	[0176.212] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.212] lstrlenW (lpString=".xlsx") returned 5
	[0176.212] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.212] lstrlenW (lpString=".ppt") returned 4
	[0176.212] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.212] lstrlenW (lpString=".zip") returned 4
	[0176.212] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.212] lstrlenW (lpString=".rar") returned 4
	[0176.212] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.212] lstrlenW (lpString=".bz2") returned 4
	[0176.212] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.212] lstrlenW (lpString=".7z") returned 3
	[0176.212] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.212] lstrlenW (lpString=".dbf") returned 4
	[0176.212] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.212] lstrlenW (lpString=".1cd") returned 4
	[0176.212] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0176.212] lstrlenW (lpString=".jpg") returned 4
	[0176.212] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.212] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0176.213] lstrlenW (lpString="ExcelR_Grace-ppd.xrm-ms") returned 23
	[0176.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0176.723] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=20841) returned 1
	[0176.723] CloseHandle (hObject=0x3d8) returned 1
	[0176.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220
	[0176.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0177.266] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.266] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.636] GetLastError () returned 0x0
	[0177.636] ReadFile (in: hFile=0x4e0, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x5169, lpOverlapped=0x0) returned 1
	[0177.649] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x5170, lpOverlapped=0x0) returned 1
	[0177.652] ReadFile (in: hFile=0x4e0, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.652] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x102, lpOverlapped=0x0) returned 1
	[0177.652] SetEndOfFile (hFile=0x514) returned 1
	[0177.652] CloseHandle (hObject=0x514) returned 1
	[0177.652] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.652] SetEndOfFile (hFile=0x4e0) returned 1
	[0177.655] CloseHandle (hObject=0x4e0) returned 1
	[0177.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 1
	[0177.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.656] lstrlenW (lpString=".doc") returned 4
	[0177.656] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.656] lstrlenW (lpString=".docx") returned 5
	[0177.656] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.657] lstrlenW (lpString=".pdf") returned 4
	[0177.657] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.657] lstrlenW (lpString=".xls") returned 4
	[0177.657] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.657] lstrlenW (lpString=".xlsx") returned 5
	[0177.657] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.657] lstrlenW (lpString=".ppt") returned 4
	[0177.657] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.657] lstrlenW (lpString=".zip") returned 4
	[0177.657] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.657] lstrlenW (lpString=".rar") returned 4
	[0177.657] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.657] lstrlenW (lpString=".bz2") returned 4
	[0177.657] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.657] lstrlenW (lpString=".7z") returned 3
	[0177.657] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.657] lstrlenW (lpString=".dbf") returned 4
	[0177.657] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.657] lstrlenW (lpString=".1cd") returned 4
	[0177.657] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.657] lstrlenW (lpString=".jpg") returned 4
	[0177.657] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.657] lstrlenW (lpString=".doc") returned 4
	[0177.658] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.658] lstrlenW (lpString=".docx") returned 5
	[0177.658] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.658] lstrlenW (lpString=".pdf") returned 4
	[0177.658] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.658] lstrlenW (lpString=".xls") returned 4
	[0177.658] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.658] lstrlenW (lpString=".xlsx") returned 5
	[0177.658] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.658] lstrlenW (lpString=".ppt") returned 4
	[0177.658] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.658] lstrlenW (lpString=".zip") returned 4
	[0177.658] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.658] lstrlenW (lpString=".rar") returned 4
	[0177.658] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.658] lstrlenW (lpString=".bz2") returned 4
	[0177.658] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.658] lstrlenW (lpString=".7z") returned 3
	[0177.658] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.658] lstrlenW (lpString=".dbf") returned 4
	[0177.658] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.658] lstrlenW (lpString=".1cd") returned 4
	[0177.658] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0177.658] lstrlenW (lpString=".jpg") returned 4
	[0177.658] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.659] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0177.659] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 42
	[0177.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0177.660] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11219) returned 1
	[0177.660] CloseHandle (hObject=0x4e0) returned 1
	[0177.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0177.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0177.660] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.660] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.661] GetLastError () returned 0x0
	[0177.661] ReadFile (in: hFile=0x4e0, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2bd3, lpOverlapped=0x0) returned 1
	[0177.665] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0177.667] ReadFile (in: hFile=0x4e0, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.667] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x128, lpOverlapped=0x0) returned 1
	[0177.667] SetEndOfFile (hFile=0x514) returned 1
	[0177.667] CloseHandle (hObject=0x514) returned 1
	[0177.667] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.667] SetEndOfFile (hFile=0x4e0) returned 1
	[0177.670] CloseHandle (hObject=0x4e0) returned 1
	[0177.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0177.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0177.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.671] lstrlenW (lpString=".doc") returned 4
	[0177.671] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.671] lstrlenW (lpString=".docx") returned 5
	[0177.671] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.671] lstrlenW (lpString=".pdf") returned 4
	[0177.671] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.671] lstrlenW (lpString=".xls") returned 4
	[0177.672] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.672] lstrlenW (lpString=".xlsx") returned 5
	[0177.672] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.672] lstrlenW (lpString=".ppt") returned 4
	[0177.672] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.672] lstrlenW (lpString=".zip") returned 4
	[0177.672] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.672] lstrlenW (lpString=".rar") returned 4
	[0177.672] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.672] lstrlenW (lpString=".bz2") returned 4
	[0177.672] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.672] lstrlenW (lpString=".7z") returned 3
	[0177.672] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.672] lstrlenW (lpString=".dbf") returned 4
	[0177.672] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.672] lstrlenW (lpString=".1cd") returned 4
	[0177.672] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.672] lstrlenW (lpString=".jpg") returned 4
	[0177.672] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.672] lstrlenW (lpString=".doc") returned 4
	[0177.672] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.672] lstrlenW (lpString=".docx") returned 5
	[0177.672] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.672] lstrlenW (lpString=".pdf") returned 4
	[0177.673] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.673] lstrlenW (lpString=".xls") returned 4
	[0177.673] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.673] lstrlenW (lpString=".xlsx") returned 5
	[0177.673] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.673] lstrlenW (lpString=".ppt") returned 4
	[0177.673] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.673] lstrlenW (lpString=".zip") returned 4
	[0177.673] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.673] lstrlenW (lpString=".rar") returned 4
	[0177.673] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.673] lstrlenW (lpString=".bz2") returned 4
	[0177.673] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.673] lstrlenW (lpString=".7z") returned 3
	[0177.673] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.673] lstrlenW (lpString=".dbf") returned 4
	[0177.673] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.673] lstrlenW (lpString=".1cd") returned 4
	[0177.673] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0177.673] lstrlenW (lpString=".jpg") returned 4
	[0177.673] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.674] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0177.674] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 43
	[0177.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0177.674] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=22224) returned 1
	[0177.674] CloseHandle (hObject=0x4e0) returned 1
	[0177.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0177.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0177.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0177.675] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.675] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.676] GetLastError () returned 0x0
	[0177.676] ReadFile (in: hFile=0x4e0, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x56d0, lpOverlapped=0x0) returned 1
	[0177.679] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x56e0, lpOverlapped=0x0) returned 1
	[0178.044] ReadFile (in: hFile=0x4e0, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.044] WriteFile (in: hFile=0x514, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x12a, lpOverlapped=0x0) returned 1
	[0178.044] SetEndOfFile (hFile=0x514) returned 1
	[0178.045] CloseHandle (hObject=0x514) returned 1
	[0178.045] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.045] SetEndOfFile (hFile=0x4e0) returned 1
	[0178.051] CloseHandle (hObject=0x4e0) returned 1
	[0178.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0178.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.053] lstrlenW (lpString=".doc") returned 4
	[0178.053] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.053] lstrlenW (lpString=".docx") returned 5
	[0178.053] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.053] lstrlenW (lpString=".pdf") returned 4
	[0178.053] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.053] lstrlenW (lpString=".xls") returned 4
	[0178.053] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.053] lstrlenW (lpString=".xlsx") returned 5
	[0178.053] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.053] lstrlenW (lpString=".ppt") returned 4
	[0178.053] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.053] lstrlenW (lpString=".zip") returned 4
	[0178.053] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.053] lstrlenW (lpString=".rar") returned 4
	[0178.053] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.053] lstrlenW (lpString=".bz2") returned 4
	[0178.053] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.053] lstrlenW (lpString=".7z") returned 3
	[0178.053] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.053] lstrlenW (lpString=".dbf") returned 4
	[0178.053] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.053] lstrlenW (lpString=".1cd") returned 4
	[0178.053] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.054] lstrlenW (lpString=".jpg") returned 4
	[0178.054] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.054] lstrlenW (lpString=".doc") returned 4
	[0178.054] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.054] lstrlenW (lpString=".docx") returned 5
	[0178.054] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.054] lstrlenW (lpString=".pdf") returned 4
	[0178.054] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.054] lstrlenW (lpString=".xls") returned 4
	[0178.054] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.054] lstrlenW (lpString=".xlsx") returned 5
	[0178.054] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.054] lstrlenW (lpString=".ppt") returned 4
	[0178.054] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.054] lstrlenW (lpString=".zip") returned 4
	[0178.054] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.054] lstrlenW (lpString=".rar") returned 4
	[0178.054] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.054] lstrlenW (lpString=".bz2") returned 4
	[0178.054] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.054] lstrlenW (lpString=".7z") returned 3
	[0178.054] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.054] lstrlenW (lpString=".dbf") returned 4
	[0178.054] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.055] lstrlenW (lpString=".1cd") returned 4
	[0178.055] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0178.055] lstrlenW (lpString=".jpg") returned 4
	[0178.055] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.073] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.073] lstrlenW (lpString="HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 34
	[0178.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0178.074] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=21917) returned 1
	[0178.074] CloseHandle (hObject=0x54c) returned 1
	[0178.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220
	[0178.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0178.075] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.075] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0178.075] GetLastError () returned 0x0
	[0178.075] ReadFile (in: hFile=0x54c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x559d, lpOverlapped=0x0) returned 1
	[0178.088] WriteFile (in: hFile=0x51c, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x55a0, lpOverlapped=0x0) returned 1
	[0178.090] ReadFile (in: hFile=0x54c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.090] WriteFile (in: hFile=0x51c, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x118, lpOverlapped=0x0) returned 1
	[0178.090] SetEndOfFile (hFile=0x51c) returned 1
	[0178.090] CloseHandle (hObject=0x51c) returned 1
	[0178.090] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.090] SetEndOfFile (hFile=0x54c) returned 1
	[0178.099] CloseHandle (hObject=0x54c) returned 1
	[0178.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0178.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 1
	[0178.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.823] lstrlenW (lpString=".doc") returned 4
	[0178.823] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.823] lstrlenW (lpString=".docx") returned 5
	[0178.823] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.823] lstrlenW (lpString=".pdf") returned 4
	[0178.823] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.823] lstrlenW (lpString=".xls") returned 4
	[0178.823] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.823] lstrlenW (lpString=".xlsx") returned 5
	[0178.823] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.823] lstrlenW (lpString=".ppt") returned 4
	[0178.823] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.823] lstrlenW (lpString=".zip") returned 4
	[0178.823] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.823] lstrlenW (lpString=".rar") returned 4
	[0178.823] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.823] lstrlenW (lpString=".bz2") returned 4
	[0178.823] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.823] lstrlenW (lpString=".7z") returned 3
	[0178.823] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.823] lstrlenW (lpString=".dbf") returned 4
	[0178.823] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.823] lstrlenW (lpString=".1cd") returned 4
	[0178.823] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.823] lstrlenW (lpString=".jpg") returned 4
	[0178.823] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.824] lstrlenW (lpString=".doc") returned 4
	[0178.824] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.824] lstrlenW (lpString=".docx") returned 5
	[0178.824] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.824] lstrlenW (lpString=".pdf") returned 4
	[0178.824] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.824] lstrlenW (lpString=".xls") returned 4
	[0178.824] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.824] lstrlenW (lpString=".xlsx") returned 5
	[0178.824] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.824] lstrlenW (lpString=".ppt") returned 4
	[0178.824] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.824] lstrlenW (lpString=".zip") returned 4
	[0178.824] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.824] lstrlenW (lpString=".rar") returned 4
	[0178.824] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.824] lstrlenW (lpString=".bz2") returned 4
	[0178.824] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.824] lstrlenW (lpString=".7z") returned 3
	[0178.824] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.824] lstrlenW (lpString=".dbf") returned 4
	[0178.824] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.824] lstrlenW (lpString=".1cd") returned 4
	[0178.824] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0178.825] lstrlenW (lpString=".jpg") returned 4
	[0178.825] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.825] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0178.825] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 37
	[0178.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4
	[0178.869] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11621) returned 1
	[0178.870] CloseHandle (hObject=0x4e4) returned 1
	[0178.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220
	[0178.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0178.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0179.762] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.762] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0179.764] GetLastError () returned 0x0
	[0179.764] ReadFile (in: hFile=0x500, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0179.766] WriteFile (in: hFile=0x444, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0179.768] ReadFile (in: hFile=0x500, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.768] WriteFile (in: hFile=0x444, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0179.768] SetEndOfFile (hFile=0x444) returned 1
	[0179.768] CloseHandle (hObject=0x444) returned 1
	[0179.768] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.768] SetEndOfFile (hFile=0x500) returned 1
	[0179.772] CloseHandle (hObject=0x500) returned 1
	[0179.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 1
	[0179.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.774] lstrlenW (lpString=".doc") returned 4
	[0179.774] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.774] lstrlenW (lpString=".docx") returned 5
	[0179.774] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.774] lstrlenW (lpString=".pdf") returned 4
	[0179.774] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.774] lstrlenW (lpString=".xls") returned 4
	[0179.774] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.774] lstrlenW (lpString=".xlsx") returned 5
	[0179.774] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.774] lstrlenW (lpString=".ppt") returned 4
	[0179.774] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.775] lstrlenW (lpString=".zip") returned 4
	[0179.775] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.775] lstrlenW (lpString=".rar") returned 4
	[0179.775] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.775] lstrlenW (lpString=".bz2") returned 4
	[0179.775] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.775] lstrlenW (lpString=".7z") returned 3
	[0179.775] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.775] lstrlenW (lpString=".dbf") returned 4
	[0179.775] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.775] lstrlenW (lpString=".1cd") returned 4
	[0179.775] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.775] lstrlenW (lpString=".jpg") returned 4
	[0179.775] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.775] lstrlenW (lpString=".doc") returned 4
	[0179.775] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.775] lstrlenW (lpString=".docx") returned 5
	[0179.775] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.775] lstrlenW (lpString=".pdf") returned 4
	[0179.776] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.776] lstrlenW (lpString=".xls") returned 4
	[0179.776] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.776] lstrlenW (lpString=".xlsx") returned 5
	[0179.776] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.776] lstrlenW (lpString=".ppt") returned 4
	[0179.776] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.776] lstrlenW (lpString=".zip") returned 4
	[0179.776] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.776] lstrlenW (lpString=".rar") returned 4
	[0179.776] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.776] lstrlenW (lpString=".bz2") returned 4
	[0179.776] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.776] lstrlenW (lpString=".7z") returned 3
	[0179.776] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.776] lstrlenW (lpString=".dbf") returned 4
	[0179.776] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.776] lstrlenW (lpString=".1cd") returned 4
	[0179.776] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0179.776] lstrlenW (lpString=".jpg") returned 4
	[0179.776] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.777] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0179.777] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 34
	[0179.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0179.778] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=22094) returned 1
	[0179.778] CloseHandle (hObject=0x500) returned 1
	[0179.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220
	[0179.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0179.779] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.779] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0179.780] GetLastError () returned 0x0
	[0179.780] ReadFile (in: hFile=0x500, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x564e, lpOverlapped=0x0) returned 1
	[0179.783] WriteFile (in: hFile=0x444, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0179.784] ReadFile (in: hFile=0x500, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.784] WriteFile (in: hFile=0x444, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x118, lpOverlapped=0x0) returned 1
	[0179.785] SetEndOfFile (hFile=0x444) returned 1
	[0179.785] CloseHandle (hObject=0x444) returned 1
	[0179.785] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.785] SetEndOfFile (hFile=0x500) returned 1
	[0179.788] CloseHandle (hObject=0x500) returned 1
	[0179.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0179.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 1
	[0179.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.790] lstrlenW (lpString=".doc") returned 4
	[0179.790] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.790] lstrlenW (lpString=".docx") returned 5
	[0179.790] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.790] lstrlenW (lpString=".pdf") returned 4
	[0179.790] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.791] lstrlenW (lpString=".xls") returned 4
	[0179.791] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.791] lstrlenW (lpString=".xlsx") returned 5
	[0179.791] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.791] lstrlenW (lpString=".ppt") returned 4
	[0179.791] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.791] lstrlenW (lpString=".zip") returned 4
	[0179.791] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.791] lstrlenW (lpString=".rar") returned 4
	[0179.791] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.791] lstrlenW (lpString=".bz2") returned 4
	[0179.791] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.791] lstrlenW (lpString=".7z") returned 3
	[0179.791] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.791] lstrlenW (lpString=".dbf") returned 4
	[0179.791] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.791] lstrlenW (lpString=".1cd") returned 4
	[0179.791] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.791] lstrlenW (lpString=".jpg") returned 4
	[0179.791] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.792] lstrlenW (lpString=".doc") returned 4
	[0179.792] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.792] lstrlenW (lpString=".docx") returned 5
	[0179.792] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.792] lstrlenW (lpString=".pdf") returned 4
	[0179.792] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.792] lstrlenW (lpString=".xls") returned 4
	[0179.792] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.792] lstrlenW (lpString=".xlsx") returned 5
	[0179.792] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.792] lstrlenW (lpString=".ppt") returned 4
	[0179.792] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.792] lstrlenW (lpString=".zip") returned 4
	[0179.792] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.792] lstrlenW (lpString=".rar") returned 4
	[0179.792] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.792] lstrlenW (lpString=".bz2") returned 4
	[0179.792] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.792] lstrlenW (lpString=".7z") returned 3
	[0179.792] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.792] lstrlenW (lpString=".dbf") returned 4
	[0179.793] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.793] lstrlenW (lpString=".1cd") returned 4
	[0179.793] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0179.793] lstrlenW (lpString=".jpg") returned 4
	[0179.793] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.793] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0179.793] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 37
	[0179.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0179.799] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11621) returned 1
	[0179.799] CloseHandle (hObject=0x500) returned 1
	[0179.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 0x220
	[0179.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0179.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0179.800] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.800] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0179.801] GetLastError () returned 0x0
	[0179.801] ReadFile (in: hFile=0x500, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0180.075] WriteFile (in: hFile=0x444, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0180.076] ReadFile (in: hFile=0x500, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.076] WriteFile (in: hFile=0x444, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0180.076] SetEndOfFile (hFile=0x444) returned 1
	[0180.076] CloseHandle (hObject=0x444) returned 1
	[0180.076] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.076] SetEndOfFile (hFile=0x500) returned 1
	[0180.079] CloseHandle (hObject=0x500) returned 1
	[0180.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 1
	[0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.184] lstrlenW (lpString=".doc") returned 4
	[0180.184] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.184] lstrlenW (lpString=".docx") returned 5
	[0180.184] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.184] lstrlenW (lpString=".pdf") returned 4
	[0180.184] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.184] lstrlenW (lpString=".xls") returned 4
	[0180.184] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.184] lstrlenW (lpString=".xlsx") returned 5
	[0180.184] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.184] lstrlenW (lpString=".ppt") returned 4
	[0180.184] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.185] lstrlenW (lpString=".zip") returned 4
	[0180.185] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.185] lstrlenW (lpString=".rar") returned 4
	[0180.185] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.185] lstrlenW (lpString=".bz2") returned 4
	[0180.185] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.185] lstrlenW (lpString=".7z") returned 3
	[0180.185] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.185] lstrlenW (lpString=".dbf") returned 4
	[0180.185] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.185] lstrlenW (lpString=".1cd") returned 4
	[0180.185] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.185] lstrlenW (lpString=".jpg") returned 4
	[0180.185] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.185] lstrlenW (lpString=".doc") returned 4
	[0180.185] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.185] lstrlenW (lpString=".docx") returned 5
	[0180.185] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.185] lstrlenW (lpString=".pdf") returned 4
	[0180.185] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.185] lstrlenW (lpString=".xls") returned 4
	[0180.185] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.185] lstrlenW (lpString=".xlsx") returned 5
	[0180.185] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.185] lstrlenW (lpString=".ppt") returned 4
	[0180.186] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.186] lstrlenW (lpString=".zip") returned 4
	[0180.186] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.186] lstrlenW (lpString=".rar") returned 4
	[0180.186] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.186] lstrlenW (lpString=".bz2") returned 4
	[0180.186] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.186] lstrlenW (lpString=".7z") returned 3
	[0180.186] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.186] lstrlenW (lpString=".dbf") returned 4
	[0180.186] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.186] lstrlenW (lpString=".1cd") returned 4
	[0180.186] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0180.186] lstrlenW (lpString=".jpg") returned 4
	[0180.186] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.186] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.186] lstrlenW (lpString="HomeBusinessR_Retail3-ppd.xrm-ms") returned 32
	[0180.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0180.187] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=22092) returned 1
	[0180.187] CloseHandle (hObject=0x424) returned 1
	[0180.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 0x220
	[0180.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0180.188] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.188] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0180.188] GetLastError () returned 0x0
	[0180.188] ReadFile (in: hFile=0x424, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x564c, lpOverlapped=0x0) returned 1
	[0180.203] WriteFile (in: hFile=0x55c, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0180.204] ReadFile (in: hFile=0x424, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.205] WriteFile (in: hFile=0x55c, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x114, lpOverlapped=0x0) returned 1
	[0180.205] SetEndOfFile (hFile=0x55c) returned 1
	[0180.205] CloseHandle (hObject=0x55c) returned 1
	[0180.205] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.205] SetEndOfFile (hFile=0x424) returned 1
	[0180.208] CloseHandle (hObject=0x424) returned 1
	[0180.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 1
	[0180.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.209] lstrlenW (lpString=".doc") returned 4
	[0180.209] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.209] lstrlenW (lpString=".docx") returned 5
	[0180.209] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.209] lstrlenW (lpString=".pdf") returned 4
	[0180.209] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.209] lstrlenW (lpString=".xls") returned 4
	[0180.209] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.209] lstrlenW (lpString=".xlsx") returned 5
	[0180.209] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.209] lstrlenW (lpString=".ppt") returned 4
	[0180.209] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.209] lstrlenW (lpString=".zip") returned 4
	[0180.209] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.209] lstrlenW (lpString=".rar") returned 4
	[0180.209] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.209] lstrlenW (lpString=".bz2") returned 4
	[0180.209] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.210] lstrlenW (lpString=".7z") returned 3
	[0180.210] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.210] lstrlenW (lpString=".dbf") returned 4
	[0180.210] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.210] lstrlenW (lpString=".1cd") returned 4
	[0180.210] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.210] lstrlenW (lpString=".jpg") returned 4
	[0180.210] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.210] lstrlenW (lpString=".doc") returned 4
	[0180.210] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0180.210] lstrlenW (lpString=".docx") returned 5
	[0180.210] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0180.210] lstrlenW (lpString=".pdf") returned 4
	[0180.210] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0180.210] lstrlenW (lpString=".xls") returned 4
	[0180.210] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0180.210] lstrlenW (lpString=".xlsx") returned 5
	[0180.210] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0180.210] lstrlenW (lpString=".ppt") returned 4
	[0180.210] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0180.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.210] lstrlenW (lpString=".zip") returned 4
	[0180.210] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0180.210] lstrlenW (lpString=".rar") returned 4
	[0180.210] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0180.210] lstrlenW (lpString=".bz2") returned 4
	[0180.211] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0180.211] lstrlenW (lpString=".7z") returned 3
	[0180.211] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0180.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.211] lstrlenW (lpString=".dbf") returned 4
	[0180.211] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0180.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.211] lstrlenW (lpString=".1cd") returned 4
	[0180.211] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0180.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0180.211] lstrlenW (lpString=".jpg") returned 4
	[0180.211] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0180.211] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0180.211] lstrlenW (lpString="HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 35
	[0180.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0180.212] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=19958) returned 1
	[0180.212] CloseHandle (hObject=0x424) returned 1
	[0180.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 0x220
	[0180.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0180.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0180.213] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.213] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0180.214] GetLastError () returned 0x0
	[0180.214] ReadFile (in: hFile=0x424, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x4df6, lpOverlapped=0x0) returned 1
	[0180.218] WriteFile (in: hFile=0x55c, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0180.219] ReadFile (in: hFile=0x424, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.219] WriteFile (in: hFile=0x55c, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0180.220] SetEndOfFile (hFile=0x55c) returned 1
	[0180.220] CloseHandle (hObject=0x55c) returned 1
	[0180.223] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.223] SetEndOfFile (hFile=0x424) returned 1
	[0180.230] CloseHandle (hObject=0x424) returned 1
	[0180.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0180.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 1
	[0181.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.050] lstrlenW (lpString=".doc") returned 4
	[0181.051] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.051] lstrlenW (lpString=".docx") returned 5
	[0181.051] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.051] lstrlenW (lpString=".pdf") returned 4
	[0181.051] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.051] lstrlenW (lpString=".xls") returned 4
	[0181.051] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.051] lstrlenW (lpString=".xlsx") returned 5
	[0181.051] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.051] lstrlenW (lpString=".ppt") returned 4
	[0181.051] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.051] lstrlenW (lpString=".zip") returned 4
	[0181.051] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.051] lstrlenW (lpString=".rar") returned 4
	[0181.051] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.051] lstrlenW (lpString=".bz2") returned 4
	[0181.051] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.051] lstrlenW (lpString=".7z") returned 3
	[0181.051] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.051] lstrlenW (lpString=".dbf") returned 4
	[0181.051] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.051] lstrlenW (lpString=".1cd") returned 4
	[0181.051] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.051] lstrlenW (lpString=".jpg") returned 4
	[0181.051] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.052] lstrlenW (lpString=".doc") returned 4
	[0181.052] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0181.052] lstrlenW (lpString=".docx") returned 5
	[0181.052] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0181.052] lstrlenW (lpString=".pdf") returned 4
	[0181.052] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0181.052] lstrlenW (lpString=".xls") returned 4
	[0181.052] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0181.052] lstrlenW (lpString=".xlsx") returned 5
	[0181.052] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0181.052] lstrlenW (lpString=".ppt") returned 4
	[0181.052] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0181.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.052] lstrlenW (lpString=".zip") returned 4
	[0181.052] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0181.052] lstrlenW (lpString=".rar") returned 4
	[0181.052] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0181.052] lstrlenW (lpString=".bz2") returned 4
	[0181.052] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0181.052] lstrlenW (lpString=".7z") returned 3
	[0181.052] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0181.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.052] lstrlenW (lpString=".dbf") returned 4
	[0181.052] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0181.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.052] lstrlenW (lpString=".1cd") returned 4
	[0181.052] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0181.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0181.052] lstrlenW (lpString=".jpg") returned 4
	[0181.052] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0181.053] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0181.053] lstrlenW (lpString="HomeBusinessR_Trial2-pl.xrm-ms") returned 30
	[0181.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0181.182] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11171) returned 1
	[0181.182] CloseHandle (hObject=0x424) returned 1
	[0181.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 0x220
	[0181.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0182.580] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.588] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0182.873] GetLastError () returned 0x0
	[0182.873] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2ba3, lpOverlapped=0x0) returned 1
	[0182.874] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0182.876] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.877] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x110, lpOverlapped=0x0) returned 1
	[0182.877] SetEndOfFile (hFile=0x530) returned 1
	[0182.877] CloseHandle (hObject=0x530) returned 1
	[0182.877] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.877] SetEndOfFile (hFile=0x3ac) returned 1
	[0182.879] CloseHandle (hObject=0x3ac) returned 1
	[0182.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 1
	[0182.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.881] lstrlenW (lpString=".doc") returned 4
	[0182.881] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.881] lstrlenW (lpString=".docx") returned 5
	[0182.881] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.881] lstrlenW (lpString=".pdf") returned 4
	[0182.881] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.881] lstrlenW (lpString=".xls") returned 4
	[0182.881] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.881] lstrlenW (lpString=".xlsx") returned 5
	[0182.882] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.882] lstrlenW (lpString=".ppt") returned 4
	[0182.882] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.882] lstrlenW (lpString=".zip") returned 4
	[0182.882] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.882] lstrlenW (lpString=".rar") returned 4
	[0182.882] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.882] lstrlenW (lpString=".bz2") returned 4
	[0182.882] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.882] lstrlenW (lpString=".7z") returned 3
	[0182.882] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.882] lstrlenW (lpString=".dbf") returned 4
	[0182.882] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.882] lstrlenW (lpString=".1cd") returned 4
	[0182.882] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.882] lstrlenW (lpString=".jpg") returned 4
	[0182.882] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.882] lstrlenW (lpString=".doc") returned 4
	[0182.882] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.882] lstrlenW (lpString=".docx") returned 5
	[0182.882] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.882] lstrlenW (lpString=".pdf") returned 4
	[0182.882] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.882] lstrlenW (lpString=".xls") returned 4
	[0182.883] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.883] lstrlenW (lpString=".xlsx") returned 5
	[0182.883] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.883] lstrlenW (lpString=".ppt") returned 4
	[0182.883] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.883] lstrlenW (lpString=".zip") returned 4
	[0182.883] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.883] lstrlenW (lpString=".rar") returned 4
	[0182.883] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.883] lstrlenW (lpString=".bz2") returned 4
	[0182.883] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.883] lstrlenW (lpString=".7z") returned 3
	[0182.883] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.883] lstrlenW (lpString=".dbf") returned 4
	[0182.883] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.883] lstrlenW (lpString=".1cd") returned 4
	[0182.883] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0182.883] lstrlenW (lpString=".jpg") returned 4
	[0182.883] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.883] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0182.883] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 35
	[0182.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0182.884] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11612) returned 1
	[0182.884] CloseHandle (hObject=0x3ac) returned 1
	[0182.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0182.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0182.885] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.885] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0182.886] GetLastError () returned 0x0
	[0182.886] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d5c, lpOverlapped=0x0) returned 1
	[0182.887] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0182.888] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.888] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0182.888] SetEndOfFile (hFile=0x530) returned 1
	[0182.889] CloseHandle (hObject=0x530) returned 1
	[0182.889] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.889] SetEndOfFile (hFile=0x3ac) returned 1
	[0182.892] CloseHandle (hObject=0x3ac) returned 1
	[0182.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0182.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.893] lstrlenW (lpString=".doc") returned 4
	[0182.893] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.893] lstrlenW (lpString=".docx") returned 5
	[0182.893] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.893] lstrlenW (lpString=".pdf") returned 4
	[0182.893] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.893] lstrlenW (lpString=".xls") returned 4
	[0182.893] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.893] lstrlenW (lpString=".xlsx") returned 5
	[0182.893] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.893] lstrlenW (lpString=".ppt") returned 4
	[0182.893] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.893] lstrlenW (lpString=".zip") returned 4
	[0182.893] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.893] lstrlenW (lpString=".rar") returned 4
	[0182.894] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.894] lstrlenW (lpString=".bz2") returned 4
	[0182.894] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.894] lstrlenW (lpString=".7z") returned 3
	[0182.894] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.894] lstrlenW (lpString=".dbf") returned 4
	[0182.894] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.894] lstrlenW (lpString=".1cd") returned 4
	[0182.894] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.894] lstrlenW (lpString=".jpg") returned 4
	[0182.894] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.894] lstrlenW (lpString=".doc") returned 4
	[0182.894] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.894] lstrlenW (lpString=".docx") returned 5
	[0182.894] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.894] lstrlenW (lpString=".pdf") returned 4
	[0182.894] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.894] lstrlenW (lpString=".xls") returned 4
	[0182.894] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.894] lstrlenW (lpString=".xlsx") returned 5
	[0182.894] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.894] lstrlenW (lpString=".ppt") returned 4
	[0182.894] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.894] lstrlenW (lpString=".zip") returned 4
	[0182.895] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.895] lstrlenW (lpString=".rar") returned 4
	[0182.895] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.895] lstrlenW (lpString=".bz2") returned 4
	[0182.895] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.895] lstrlenW (lpString=".7z") returned 3
	[0182.895] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.895] lstrlenW (lpString=".dbf") returned 4
	[0182.895] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.895] lstrlenW (lpString=".1cd") returned 4
	[0182.895] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0182.895] lstrlenW (lpString=".jpg") returned 4
	[0182.895] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.895] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0182.895] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 35
	[0182.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0182.896] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=19957) returned 1
	[0182.896] CloseHandle (hObject=0x3ac) returned 1
	[0182.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0182.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0182.897] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.897] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0182.897] GetLastError () returned 0x0
	[0182.897] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x4df5, lpOverlapped=0x0) returned 1
	[0182.899] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0182.901] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.901] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0182.901] SetEndOfFile (hFile=0x530) returned 1
	[0182.901] CloseHandle (hObject=0x530) returned 1
	[0182.901] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.901] SetEndOfFile (hFile=0x3ac) returned 1
	[0182.904] CloseHandle (hObject=0x3ac) returned 1
	[0182.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0182.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0182.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.905] lstrlenW (lpString=".doc") returned 4
	[0182.905] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.905] lstrlenW (lpString=".docx") returned 5
	[0182.905] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.905] lstrlenW (lpString=".pdf") returned 4
	[0182.905] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.905] lstrlenW (lpString=".xls") returned 4
	[0182.906] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.906] lstrlenW (lpString=".xlsx") returned 5
	[0182.906] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.906] lstrlenW (lpString=".ppt") returned 4
	[0182.906] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.906] lstrlenW (lpString=".zip") returned 4
	[0182.906] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.906] lstrlenW (lpString=".rar") returned 4
	[0182.906] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.906] lstrlenW (lpString=".bz2") returned 4
	[0182.906] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.906] lstrlenW (lpString=".7z") returned 3
	[0182.906] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.906] lstrlenW (lpString=".dbf") returned 4
	[0182.906] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.906] lstrlenW (lpString=".1cd") returned 4
	[0182.906] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.906] lstrlenW (lpString=".jpg") returned 4
	[0182.906] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.906] lstrlenW (lpString=".doc") returned 4
	[0182.906] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0182.906] lstrlenW (lpString=".docx") returned 5
	[0182.906] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0182.906] lstrlenW (lpString=".pdf") returned 4
	[0182.907] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0182.907] lstrlenW (lpString=".xls") returned 4
	[0182.907] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0182.907] lstrlenW (lpString=".xlsx") returned 5
	[0182.907] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0182.907] lstrlenW (lpString=".ppt") returned 4
	[0182.907] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0182.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.907] lstrlenW (lpString=".zip") returned 4
	[0182.907] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0182.907] lstrlenW (lpString=".rar") returned 4
	[0182.907] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0182.907] lstrlenW (lpString=".bz2") returned 4
	[0182.907] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0182.907] lstrlenW (lpString=".7z") returned 3
	[0182.907] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0182.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.907] lstrlenW (lpString=".dbf") returned 4
	[0182.907] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0182.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.907] lstrlenW (lpString=".1cd") returned 4
	[0182.907] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0182.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0182.907] lstrlenW (lpString=".jpg") returned 4
	[0182.907] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0182.907] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0182.907] lstrlenW (lpString="HomeStudentR_Retail-pl.xrm-ms") returned 29
	[0182.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0182.908] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=10651) returned 1
	[0182.908] CloseHandle (hObject=0x3ac) returned 1
	[0182.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 0x220
	[0182.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0182.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0182.909] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.909] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0182.913] GetLastError () returned 0x0
	[0182.913] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x299b, lpOverlapped=0x0) returned 1
	[0183.226] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x29a0, lpOverlapped=0x0) returned 1
	[0183.227] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.227] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0183.227] SetEndOfFile (hFile=0x530) returned 1
	[0183.227] CloseHandle (hObject=0x530) returned 1
	[0183.227] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.228] SetEndOfFile (hFile=0x3ac) returned 1
	[0183.230] CloseHandle (hObject=0x3ac) returned 1
	[0183.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 1
	[0183.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.232] lstrlenW (lpString=".doc") returned 4
	[0183.232] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.232] lstrlenW (lpString=".docx") returned 5
	[0183.232] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.232] lstrlenW (lpString=".pdf") returned 4
	[0183.232] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.232] lstrlenW (lpString=".xls") returned 4
	[0183.232] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.232] lstrlenW (lpString=".xlsx") returned 5
	[0183.232] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.232] lstrlenW (lpString=".ppt") returned 4
	[0183.232] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.232] lstrlenW (lpString=".zip") returned 4
	[0183.232] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.232] lstrlenW (lpString=".rar") returned 4
	[0183.232] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.232] lstrlenW (lpString=".bz2") returned 4
	[0183.232] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.232] lstrlenW (lpString=".7z") returned 3
	[0183.232] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.232] lstrlenW (lpString=".dbf") returned 4
	[0183.232] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.232] lstrlenW (lpString=".1cd") returned 4
	[0183.232] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.232] lstrlenW (lpString=".jpg") returned 4
	[0183.232] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.233] lstrlenW (lpString=".doc") returned 4
	[0183.233] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.233] lstrlenW (lpString=".docx") returned 5
	[0183.233] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.233] lstrlenW (lpString=".pdf") returned 4
	[0183.233] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.233] lstrlenW (lpString=".xls") returned 4
	[0183.233] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.233] lstrlenW (lpString=".xlsx") returned 5
	[0183.233] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.233] lstrlenW (lpString=".ppt") returned 4
	[0183.233] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.233] lstrlenW (lpString=".zip") returned 4
	[0183.233] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.233] lstrlenW (lpString=".rar") returned 4
	[0183.233] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.233] lstrlenW (lpString=".bz2") returned 4
	[0183.233] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.233] lstrlenW (lpString=".7z") returned 3
	[0183.233] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.233] lstrlenW (lpString=".dbf") returned 4
	[0183.233] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.233] lstrlenW (lpString=".1cd") returned 4
	[0183.233] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0183.234] lstrlenW (lpString=".jpg") returned 4
	[0183.234] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.234] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.234] lstrlenW (lpString="HomeStudentR_Trial2-ul-oob.xrm-ms") returned 33
	[0183.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.234] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11620) returned 1
	[0183.234] CloseHandle (hObject=0x3ac) returned 1
	[0183.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 0x220
	[0183.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.235] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.235] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0183.236] GetLastError () returned 0x0
	[0183.236] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d64, lpOverlapped=0x0) returned 1
	[0183.237] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0183.239] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.239] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x116, lpOverlapped=0x0) returned 1
	[0183.239] SetEndOfFile (hFile=0x530) returned 1
	[0183.239] CloseHandle (hObject=0x530) returned 1
	[0183.239] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.239] SetEndOfFile (hFile=0x3ac) returned 1
	[0183.242] CloseHandle (hObject=0x3ac) returned 1
	[0183.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 1
	[0183.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.243] lstrlenW (lpString=".doc") returned 4
	[0183.243] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.243] lstrlenW (lpString=".docx") returned 5
	[0183.243] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.243] lstrlenW (lpString=".pdf") returned 4
	[0183.243] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.243] lstrlenW (lpString=".xls") returned 4
	[0183.243] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.244] lstrlenW (lpString=".xlsx") returned 5
	[0183.244] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.244] lstrlenW (lpString=".ppt") returned 4
	[0183.244] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.244] lstrlenW (lpString=".zip") returned 4
	[0183.244] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.244] lstrlenW (lpString=".rar") returned 4
	[0183.244] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.244] lstrlenW (lpString=".bz2") returned 4
	[0183.244] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.244] lstrlenW (lpString=".7z") returned 3
	[0183.244] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.244] lstrlenW (lpString=".dbf") returned 4
	[0183.244] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.244] lstrlenW (lpString=".1cd") returned 4
	[0183.244] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.244] lstrlenW (lpString=".jpg") returned 4
	[0183.244] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.244] lstrlenW (lpString=".doc") returned 4
	[0183.244] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.244] lstrlenW (lpString=".docx") returned 5
	[0183.244] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.244] lstrlenW (lpString=".pdf") returned 4
	[0183.244] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.245] lstrlenW (lpString=".xls") returned 4
	[0183.245] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.245] lstrlenW (lpString=".xlsx") returned 5
	[0183.245] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.245] lstrlenW (lpString=".ppt") returned 4
	[0183.245] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.245] lstrlenW (lpString=".zip") returned 4
	[0183.245] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.245] lstrlenW (lpString=".rar") returned 4
	[0183.245] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.245] lstrlenW (lpString=".bz2") returned 4
	[0183.245] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.245] lstrlenW (lpString=".7z") returned 3
	[0183.245] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.245] lstrlenW (lpString=".dbf") returned 4
	[0183.245] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.245] lstrlenW (lpString=".1cd") returned 4
	[0183.245] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0183.245] lstrlenW (lpString=".jpg") returned 4
	[0183.245] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.245] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.245] lstrlenW (lpString="MondoR_BypassTrial180-pl.xrm-ms") returned 31
	[0183.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.260] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11175) returned 1
	[0183.260] CloseHandle (hObject=0x3ac) returned 1
	[0183.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0183.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.261] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.261] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0183.262] GetLastError () returned 0x0
	[0183.262] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2ba7, lpOverlapped=0x0) returned 1
	[0183.264] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0183.265] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.265] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x112, lpOverlapped=0x0) returned 1
	[0183.265] SetEndOfFile (hFile=0x530) returned 1
	[0183.265] CloseHandle (hObject=0x530) returned 1
	[0183.266] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.266] SetEndOfFile (hFile=0x3ac) returned 1
	[0183.270] CloseHandle (hObject=0x3ac) returned 1
	[0183.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0183.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 1
	[0183.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.271] lstrlenW (lpString=".doc") returned 4
	[0183.271] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.271] lstrlenW (lpString=".docx") returned 5
	[0183.271] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.271] lstrlenW (lpString=".pdf") returned 4
	[0183.271] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.272] lstrlenW (lpString=".xls") returned 4
	[0183.272] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.272] lstrlenW (lpString=".xlsx") returned 5
	[0183.272] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.272] lstrlenW (lpString=".ppt") returned 4
	[0183.272] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.272] lstrlenW (lpString=".zip") returned 4
	[0183.272] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.272] lstrlenW (lpString=".rar") returned 4
	[0183.272] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.272] lstrlenW (lpString=".bz2") returned 4
	[0183.272] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.272] lstrlenW (lpString=".7z") returned 3
	[0183.272] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.272] lstrlenW (lpString=".dbf") returned 4
	[0183.272] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.272] lstrlenW (lpString=".1cd") returned 4
	[0183.272] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.272] lstrlenW (lpString=".jpg") returned 4
	[0183.272] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.272] lstrlenW (lpString=".doc") returned 4
	[0183.272] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0183.272] lstrlenW (lpString=".docx") returned 5
	[0183.272] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0183.273] lstrlenW (lpString=".pdf") returned 4
	[0183.273] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0183.273] lstrlenW (lpString=".xls") returned 4
	[0183.273] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0183.273] lstrlenW (lpString=".xlsx") returned 5
	[0183.273] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0183.273] lstrlenW (lpString=".ppt") returned 4
	[0183.273] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0183.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.273] lstrlenW (lpString=".zip") returned 4
	[0183.273] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0183.273] lstrlenW (lpString=".rar") returned 4
	[0183.273] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0183.273] lstrlenW (lpString=".bz2") returned 4
	[0183.273] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0183.273] lstrlenW (lpString=".7z") returned 3
	[0183.273] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0183.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.273] lstrlenW (lpString=".dbf") returned 4
	[0183.273] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0183.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.273] lstrlenW (lpString=".1cd") returned 4
	[0183.273] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0183.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0183.273] lstrlenW (lpString=".jpg") returned 4
	[0183.273] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0183.273] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0183.274] lstrlenW (lpString="MondoR_BypassTrial180-ppd.xrm-ms") returned 32
	[0183.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.274] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=26538) returned 1
	[0183.274] CloseHandle (hObject=0x3ac) returned 1
	[0183.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0183.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0183.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0183.275] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.275] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0183.276] GetLastError () returned 0x0
	[0183.276] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x67aa, lpOverlapped=0x0) returned 1
	[0183.448] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0183.793] ReadFile (in: hFile=0x3ac, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.793] WriteFile (in: hFile=0x530, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x114, lpOverlapped=0x0) returned 1
	[0183.793] SetEndOfFile (hFile=0x530) returned 1
	[0183.796] CloseHandle (hObject=0x530) returned 1
	[0183.799] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.799] SetEndOfFile (hFile=0x3ac) returned 1
	[0183.938] CloseHandle (hObject=0x3ac) returned 1
	[0183.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0184.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0185.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.512] lstrlenW (lpString=".doc") returned 4
	[0185.512] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.512] lstrlenW (lpString=".docx") returned 5
	[0185.512] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.512] lstrlenW (lpString=".pdf") returned 4
	[0185.512] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.512] lstrlenW (lpString=".xls") returned 4
	[0185.512] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.512] lstrlenW (lpString=".xlsx") returned 5
	[0185.512] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.512] lstrlenW (lpString=".ppt") returned 4
	[0185.512] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.512] lstrlenW (lpString=".zip") returned 4
	[0185.512] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.512] lstrlenW (lpString=".rar") returned 4
	[0185.512] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.512] lstrlenW (lpString=".bz2") returned 4
	[0185.512] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.512] lstrlenW (lpString=".7z") returned 3
	[0185.512] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.512] lstrlenW (lpString=".dbf") returned 4
	[0185.512] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.512] lstrlenW (lpString=".1cd") returned 4
	[0185.513] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.513] lstrlenW (lpString=".jpg") returned 4
	[0185.513] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.513] lstrlenW (lpString=".doc") returned 4
	[0185.513] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.513] lstrlenW (lpString=".docx") returned 5
	[0185.513] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.513] lstrlenW (lpString=".pdf") returned 4
	[0185.513] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.513] lstrlenW (lpString=".xls") returned 4
	[0185.513] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.513] lstrlenW (lpString=".xlsx") returned 5
	[0185.513] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.513] lstrlenW (lpString=".ppt") returned 4
	[0185.513] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.513] lstrlenW (lpString=".zip") returned 4
	[0185.513] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.513] lstrlenW (lpString=".rar") returned 4
	[0185.513] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.513] lstrlenW (lpString=".bz2") returned 4
	[0185.513] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.513] lstrlenW (lpString=".7z") returned 3
	[0185.513] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.513] lstrlenW (lpString=".dbf") returned 4
	[0185.513] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.514] lstrlenW (lpString=".1cd") returned 4
	[0185.514] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0185.514] lstrlenW (lpString=".jpg") returned 4
	[0185.514] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.514] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.514] lstrlenW (lpString="MondoR_Subscription2-ul-oob.xrm-ms") returned 34
	[0185.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0185.514] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11616) returned 1
	[0185.515] CloseHandle (hObject=0x444) returned 1
	[0185.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 0x220
	[0185.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0185.515] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.515] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0185.516] GetLastError () returned 0x0
	[0185.516] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d60, lpOverlapped=0x0) returned 1
	[0185.518] WriteFile (in: hFile=0x324, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0185.519] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.519] WriteFile (in: hFile=0x324, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x118, lpOverlapped=0x0) returned 1
	[0185.519] SetEndOfFile (hFile=0x324) returned 1
	[0185.519] CloseHandle (hObject=0x324) returned 1
	[0185.519] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.519] SetEndOfFile (hFile=0x444) returned 1
	[0185.522] CloseHandle (hObject=0x444) returned 1
	[0185.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 1
	[0185.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.523] lstrlenW (lpString=".doc") returned 4
	[0185.523] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.523] lstrlenW (lpString=".docx") returned 5
	[0185.523] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.523] lstrlenW (lpString=".pdf") returned 4
	[0185.523] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.523] lstrlenW (lpString=".xls") returned 4
	[0185.523] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.523] lstrlenW (lpString=".xlsx") returned 5
	[0185.523] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.523] lstrlenW (lpString=".ppt") returned 4
	[0185.523] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.523] lstrlenW (lpString=".zip") returned 4
	[0185.523] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.523] lstrlenW (lpString=".rar") returned 4
	[0185.523] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.523] lstrlenW (lpString=".bz2") returned 4
	[0185.523] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.524] lstrlenW (lpString=".7z") returned 3
	[0185.524] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.524] lstrlenW (lpString=".dbf") returned 4
	[0185.524] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.524] lstrlenW (lpString=".1cd") returned 4
	[0185.524] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.524] lstrlenW (lpString=".jpg") returned 4
	[0185.524] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.524] lstrlenW (lpString=".doc") returned 4
	[0185.524] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.524] lstrlenW (lpString=".docx") returned 5
	[0185.524] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.524] lstrlenW (lpString=".pdf") returned 4
	[0185.524] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.524] lstrlenW (lpString=".xls") returned 4
	[0185.524] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.524] lstrlenW (lpString=".xlsx") returned 5
	[0185.524] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.524] lstrlenW (lpString=".ppt") returned 4
	[0185.524] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.524] lstrlenW (lpString=".zip") returned 4
	[0185.524] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.524] lstrlenW (lpString=".rar") returned 4
	[0185.525] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.525] lstrlenW (lpString=".bz2") returned 4
	[0185.525] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.525] lstrlenW (lpString=".7z") returned 3
	[0185.525] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.525] lstrlenW (lpString=".dbf") returned 4
	[0185.525] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.525] lstrlenW (lpString=".1cd") returned 4
	[0185.525] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0185.525] lstrlenW (lpString=".jpg") returned 4
	[0185.525] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.525] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.525] lstrlenW (lpString="MondoR_SubTest-pl.xrm-ms") returned 24
	[0185.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0185.526] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11147) returned 1
	[0185.526] CloseHandle (hObject=0x444) returned 1
	[0185.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 0x220
	[0185.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0185.526] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.527] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0185.528] GetLastError () returned 0x0
	[0185.528] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2b8b, lpOverlapped=0x0) returned 1
	[0185.530] WriteFile (in: hFile=0x324, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0185.531] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.531] WriteFile (in: hFile=0x324, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x104, lpOverlapped=0x0) returned 1
	[0185.531] SetEndOfFile (hFile=0x324) returned 1
	[0185.531] CloseHandle (hObject=0x324) returned 1
	[0185.531] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.531] SetEndOfFile (hFile=0x444) returned 1
	[0185.534] CloseHandle (hObject=0x444) returned 1
	[0185.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 1
	[0185.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.535] lstrlenW (lpString=".doc") returned 4
	[0185.535] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.535] lstrlenW (lpString=".docx") returned 5
	[0185.535] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.535] lstrlenW (lpString=".pdf") returned 4
	[0185.535] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.535] lstrlenW (lpString=".xls") returned 4
	[0185.535] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.535] lstrlenW (lpString=".xlsx") returned 5
	[0185.535] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.535] lstrlenW (lpString=".ppt") returned 4
	[0185.535] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.535] lstrlenW (lpString=".zip") returned 4
	[0185.535] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.535] lstrlenW (lpString=".rar") returned 4
	[0185.535] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.535] lstrlenW (lpString=".bz2") returned 4
	[0185.536] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.536] lstrlenW (lpString=".7z") returned 3
	[0185.536] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.536] lstrlenW (lpString=".dbf") returned 4
	[0185.536] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.536] lstrlenW (lpString=".1cd") returned 4
	[0185.536] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.536] lstrlenW (lpString=".jpg") returned 4
	[0185.536] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.536] lstrlenW (lpString=".doc") returned 4
	[0185.536] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.536] lstrlenW (lpString=".docx") returned 5
	[0185.536] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.536] lstrlenW (lpString=".pdf") returned 4
	[0185.536] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.536] lstrlenW (lpString=".xls") returned 4
	[0185.536] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.536] lstrlenW (lpString=".xlsx") returned 5
	[0185.536] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.536] lstrlenW (lpString=".ppt") returned 4
	[0185.536] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.536] lstrlenW (lpString=".zip") returned 4
	[0185.536] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.536] lstrlenW (lpString=".rar") returned 4
	[0185.537] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.537] lstrlenW (lpString=".bz2") returned 4
	[0185.537] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.537] lstrlenW (lpString=".7z") returned 3
	[0185.537] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.537] lstrlenW (lpString=".dbf") returned 4
	[0185.537] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.537] lstrlenW (lpString=".1cd") returned 4
	[0185.537] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0185.537] lstrlenW (lpString=".jpg") returned 4
	[0185.537] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.537] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.537] lstrlenW (lpString="MondoR_SubTest-ppd.xrm-ms") returned 25
	[0185.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0185.538] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=26524) returned 1
	[0185.538] CloseHandle (hObject=0x444) returned 1
	[0185.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 0x220
	[0185.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0185.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0185.539] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.539] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0185.539] GetLastError () returned 0x0
	[0185.539] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x679c, lpOverlapped=0x0) returned 1
	[0185.541] WriteFile (in: hFile=0x324, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0185.543] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.543] WriteFile (in: hFile=0x324, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x106, lpOverlapped=0x0) returned 1
	[0185.543] SetEndOfFile (hFile=0x324) returned 1
	[0185.543] CloseHandle (hObject=0x324) returned 1
	[0185.543] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.543] SetEndOfFile (hFile=0x444) returned 1
	[0185.546] CloseHandle (hObject=0x444) returned 1
	[0185.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0185.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 1
	[0185.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.547] lstrlenW (lpString=".doc") returned 4
	[0185.547] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.547] lstrlenW (lpString=".docx") returned 5
	[0185.547] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.547] lstrlenW (lpString=".pdf") returned 4
	[0185.547] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.547] lstrlenW (lpString=".xls") returned 4
	[0185.547] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.547] lstrlenW (lpString=".xlsx") returned 5
	[0185.548] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.548] lstrlenW (lpString=".ppt") returned 4
	[0185.548] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.548] lstrlenW (lpString=".zip") returned 4
	[0185.548] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.548] lstrlenW (lpString=".rar") returned 4
	[0185.548] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.548] lstrlenW (lpString=".bz2") returned 4
	[0185.548] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.548] lstrlenW (lpString=".7z") returned 3
	[0185.548] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.548] lstrlenW (lpString=".dbf") returned 4
	[0185.548] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.548] lstrlenW (lpString=".1cd") returned 4
	[0185.548] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.548] lstrlenW (lpString=".jpg") returned 4
	[0185.548] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.548] lstrlenW (lpString=".doc") returned 4
	[0185.548] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0185.548] lstrlenW (lpString=".docx") returned 5
	[0185.548] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0185.548] lstrlenW (lpString=".pdf") returned 4
	[0185.548] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0185.549] lstrlenW (lpString=".xls") returned 4
	[0185.549] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0185.549] lstrlenW (lpString=".xlsx") returned 5
	[0185.549] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0185.549] lstrlenW (lpString=".ppt") returned 4
	[0185.549] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0185.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.549] lstrlenW (lpString=".zip") returned 4
	[0185.549] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0185.549] lstrlenW (lpString=".rar") returned 4
	[0185.549] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0185.549] lstrlenW (lpString=".bz2") returned 4
	[0185.549] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0185.549] lstrlenW (lpString=".7z") returned 3
	[0185.549] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0185.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.549] lstrlenW (lpString=".dbf") returned 4
	[0185.549] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0185.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.549] lstrlenW (lpString=".1cd") returned 4
	[0185.549] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0185.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0185.549] lstrlenW (lpString=".jpg") returned 4
	[0185.549] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0185.549] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0185.549] lstrlenW (lpString="MondoR_SubTest-ul-oob.xrm-ms") returned 28
	[0185.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0185.550] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11591) returned 1
	[0185.550] CloseHandle (hObject=0x444) returned 1
	[0185.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 0x220
	[0186.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.218] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.218] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0186.219] GetLastError () returned 0x0
	[0186.219] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d47, lpOverlapped=0x0) returned 1
	[0186.221] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0186.222] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.223] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0186.223] SetEndOfFile (hFile=0x328) returned 1
	[0186.223] CloseHandle (hObject=0x328) returned 1
	[0186.223] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.223] SetEndOfFile (hFile=0x53c) returned 1
	[0186.242] CloseHandle (hObject=0x53c) returned 1
	[0186.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 1
	[0186.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.244] lstrlenW (lpString=".doc") returned 4
	[0186.244] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.244] lstrlenW (lpString=".docx") returned 5
	[0186.244] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.244] lstrlenW (lpString=".pdf") returned 4
	[0186.244] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.244] lstrlenW (lpString=".xls") returned 4
	[0186.244] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.244] lstrlenW (lpString=".xlsx") returned 5
	[0186.244] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.244] lstrlenW (lpString=".ppt") returned 4
	[0186.244] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.244] lstrlenW (lpString=".zip") returned 4
	[0186.244] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.244] lstrlenW (lpString=".rar") returned 4
	[0186.244] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.244] lstrlenW (lpString=".bz2") returned 4
	[0186.244] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.244] lstrlenW (lpString=".7z") returned 3
	[0186.244] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.244] lstrlenW (lpString=".dbf") returned 4
	[0186.244] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.245] lstrlenW (lpString=".1cd") returned 4
	[0186.245] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.245] lstrlenW (lpString=".jpg") returned 4
	[0186.245] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.245] lstrlenW (lpString=".doc") returned 4
	[0186.245] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.245] lstrlenW (lpString=".docx") returned 5
	[0186.245] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.245] lstrlenW (lpString=".pdf") returned 4
	[0186.245] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.245] lstrlenW (lpString=".xls") returned 4
	[0186.245] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.245] lstrlenW (lpString=".xlsx") returned 5
	[0186.245] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.245] lstrlenW (lpString=".ppt") returned 4
	[0186.245] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.245] lstrlenW (lpString=".zip") returned 4
	[0186.245] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.245] lstrlenW (lpString=".rar") returned 4
	[0186.245] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.245] lstrlenW (lpString=".bz2") returned 4
	[0186.245] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.245] lstrlenW (lpString=".7z") returned 3
	[0186.245] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.246] lstrlenW (lpString=".dbf") returned 4
	[0186.246] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.246] lstrlenW (lpString=".1cd") returned 4
	[0186.273] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0186.273] lstrlenW (lpString=".jpg") returned 4
	[0186.273] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.273] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.273] lstrlenW (lpString="MondoR_SubTrial-pl.xrm-ms") returned 25
	[0186.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.274] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11151) returned 1
	[0186.274] CloseHandle (hObject=0x53c) returned 1
	[0186.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 0x220
	[0186.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0186.275] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.275] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0186.276] GetLastError () returned 0x0
	[0186.276] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2b8f, lpOverlapped=0x0) returned 1
	[0186.491] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0186.492] ReadFile (in: hFile=0x53c, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.492] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x106, lpOverlapped=0x0) returned 1
	[0186.492] SetEndOfFile (hFile=0x328) returned 1
	[0186.493] CloseHandle (hObject=0x328) returned 1
	[0186.493] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.493] SetEndOfFile (hFile=0x53c) returned 1
	[0186.602] CloseHandle (hObject=0x53c) returned 1
	[0186.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0186.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 1
	[0186.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.874] lstrlenW (lpString=".doc") returned 4
	[0186.874] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.874] lstrlenW (lpString=".docx") returned 5
	[0186.874] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.874] lstrlenW (lpString=".pdf") returned 4
	[0186.874] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.874] lstrlenW (lpString=".xls") returned 4
	[0186.874] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.874] lstrlenW (lpString=".xlsx") returned 5
	[0186.874] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.874] lstrlenW (lpString=".ppt") returned 4
	[0186.874] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.874] lstrlenW (lpString=".zip") returned 4
	[0186.874] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.874] lstrlenW (lpString=".rar") returned 4
	[0186.874] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.874] lstrlenW (lpString=".bz2") returned 4
	[0186.874] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.874] lstrlenW (lpString=".7z") returned 3
	[0186.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.874] lstrlenW (lpString=".dbf") returned 4
	[0186.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.874] lstrlenW (lpString=".1cd") returned 4
	[0186.875] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.875] lstrlenW (lpString=".jpg") returned 4
	[0186.875] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.875] lstrlenW (lpString=".doc") returned 4
	[0186.875] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0186.875] lstrlenW (lpString=".docx") returned 5
	[0186.875] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0186.875] lstrlenW (lpString=".pdf") returned 4
	[0186.875] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0186.875] lstrlenW (lpString=".xls") returned 4
	[0186.875] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0186.875] lstrlenW (lpString=".xlsx") returned 5
	[0186.875] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0186.875] lstrlenW (lpString=".ppt") returned 4
	[0186.875] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0186.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.875] lstrlenW (lpString=".zip") returned 4
	[0186.875] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0186.875] lstrlenW (lpString=".rar") returned 4
	[0186.875] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0186.875] lstrlenW (lpString=".bz2") returned 4
	[0186.875] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0186.875] lstrlenW (lpString=".7z") returned 3
	[0186.875] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0186.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.875] lstrlenW (lpString=".dbf") returned 4
	[0186.875] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0186.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.876] lstrlenW (lpString=".1cd") returned 4
	[0186.876] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0186.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0186.876] lstrlenW (lpString=".jpg") returned 4
	[0186.876] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0186.876] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0186.876] lstrlenW (lpString="O365BusinessR_Subscription-ul-oob.xrm-ms") returned 40
	[0186.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0186.876] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11647) returned 1
	[0186.876] CloseHandle (hObject=0x444) returned 1
	[0186.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 0x220
	[0186.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0186.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0186.877] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.877] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0186.878] GetLastError () returned 0x0
	[0186.878] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d7f, lpOverlapped=0x0) returned 1
	[0186.879] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0186.880] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.880] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x124, lpOverlapped=0x0) returned 1
	[0186.881] SetEndOfFile (hFile=0x328) returned 1
	[0186.881] CloseHandle (hObject=0x328) returned 1
	[0186.881] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.881] SetEndOfFile (hFile=0x444) returned 1
	[0187.023] CloseHandle (hObject=0x444) returned 1
	[0187.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 1
	[0187.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.024] lstrlenW (lpString=".doc") returned 4
	[0187.024] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.024] lstrlenW (lpString=".docx") returned 5
	[0187.024] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.024] lstrlenW (lpString=".pdf") returned 4
	[0187.024] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.025] lstrlenW (lpString=".xls") returned 4
	[0187.025] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.025] lstrlenW (lpString=".xlsx") returned 5
	[0187.025] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.025] lstrlenW (lpString=".ppt") returned 4
	[0187.025] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.025] lstrlenW (lpString=".zip") returned 4
	[0187.025] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.025] lstrlenW (lpString=".rar") returned 4
	[0187.025] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.025] lstrlenW (lpString=".bz2") returned 4
	[0187.025] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.025] lstrlenW (lpString=".7z") returned 3
	[0187.025] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.025] lstrlenW (lpString=".dbf") returned 4
	[0187.025] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.025] lstrlenW (lpString=".1cd") returned 4
	[0187.025] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.025] lstrlenW (lpString=".jpg") returned 4
	[0187.025] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.025] lstrlenW (lpString=".doc") returned 4
	[0187.025] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.025] lstrlenW (lpString=".docx") returned 5
	[0187.025] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.026] lstrlenW (lpString=".pdf") returned 4
	[0187.026] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.026] lstrlenW (lpString=".xls") returned 4
	[0187.026] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.026] lstrlenW (lpString=".xlsx") returned 5
	[0187.026] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.026] lstrlenW (lpString=".ppt") returned 4
	[0187.026] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.026] lstrlenW (lpString=".zip") returned 4
	[0187.026] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.026] lstrlenW (lpString=".rar") returned 4
	[0187.026] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.026] lstrlenW (lpString=".bz2") returned 4
	[0187.026] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.026] lstrlenW (lpString=".7z") returned 3
	[0187.026] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.026] lstrlenW (lpString=".dbf") returned 4
	[0187.026] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.026] lstrlenW (lpString=".1cd") returned 4
	[0187.026] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0187.026] lstrlenW (lpString=".jpg") returned 4
	[0187.026] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.026] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.027] lstrlenW (lpString="O365BusinessR_SubTest-pl.xrm-ms") returned 31
	[0187.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.028] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11175) returned 1
	[0187.028] CloseHandle (hObject=0x444) returned 1
	[0187.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 0x220
	[0187.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.028] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.028] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0187.029] GetLastError () returned 0x0
	[0187.029] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2ba7, lpOverlapped=0x0) returned 1
	[0187.032] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0187.034] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.034] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x112, lpOverlapped=0x0) returned 1
	[0187.034] SetEndOfFile (hFile=0x328) returned 1
	[0187.034] CloseHandle (hObject=0x328) returned 1
	[0187.034] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.034] SetEndOfFile (hFile=0x444) returned 1
	[0187.036] CloseHandle (hObject=0x444) returned 1
	[0187.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 1
	[0187.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.038] lstrlenW (lpString=".doc") returned 4
	[0187.038] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.038] lstrlenW (lpString=".docx") returned 5
	[0187.038] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.038] lstrlenW (lpString=".pdf") returned 4
	[0187.038] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.038] lstrlenW (lpString=".xls") returned 4
	[0187.038] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.038] lstrlenW (lpString=".xlsx") returned 5
	[0187.038] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.038] lstrlenW (lpString=".ppt") returned 4
	[0187.038] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.038] lstrlenW (lpString=".zip") returned 4
	[0187.038] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.038] lstrlenW (lpString=".rar") returned 4
	[0187.038] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.038] lstrlenW (lpString=".bz2") returned 4
	[0187.038] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.038] lstrlenW (lpString=".7z") returned 3
	[0187.038] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.038] lstrlenW (lpString=".dbf") returned 4
	[0187.038] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.038] lstrlenW (lpString=".1cd") returned 4
	[0187.038] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.038] lstrlenW (lpString=".jpg") returned 4
	[0187.039] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.039] lstrlenW (lpString=".doc") returned 4
	[0187.039] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.039] lstrlenW (lpString=".docx") returned 5
	[0187.039] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.039] lstrlenW (lpString=".pdf") returned 4
	[0187.039] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.039] lstrlenW (lpString=".xls") returned 4
	[0187.039] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.039] lstrlenW (lpString=".xlsx") returned 5
	[0187.039] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.039] lstrlenW (lpString=".ppt") returned 4
	[0187.039] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.039] lstrlenW (lpString=".zip") returned 4
	[0187.039] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.039] lstrlenW (lpString=".rar") returned 4
	[0187.039] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.039] lstrlenW (lpString=".bz2") returned 4
	[0187.039] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.039] lstrlenW (lpString=".7z") returned 3
	[0187.039] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.039] lstrlenW (lpString=".dbf") returned 4
	[0187.039] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.039] lstrlenW (lpString=".1cd") returned 4
	[0187.039] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0187.040] lstrlenW (lpString=".jpg") returned 4
	[0187.040] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.040] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.040] lstrlenW (lpString="O365BusinessR_SubTest-ppd.xrm-ms") returned 32
	[0187.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.040] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=22465) returned 1
	[0187.040] CloseHandle (hObject=0x444) returned 1
	[0187.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 0x220
	[0187.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.041] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.041] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0187.042] GetLastError () returned 0x0
	[0187.042] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x57c1, lpOverlapped=0x0) returned 1
	[0187.044] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x57d0, lpOverlapped=0x0) returned 1
	[0187.045] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.045] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x114, lpOverlapped=0x0) returned 1
	[0187.045] SetEndOfFile (hFile=0x328) returned 1
	[0187.045] CloseHandle (hObject=0x328) returned 1
	[0187.045] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.045] SetEndOfFile (hFile=0x444) returned 1
	[0187.048] CloseHandle (hObject=0x444) returned 1
	[0187.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 1
	[0187.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.049] lstrlenW (lpString=".doc") returned 4
	[0187.049] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.049] lstrlenW (lpString=".docx") returned 5
	[0187.049] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.049] lstrlenW (lpString=".pdf") returned 4
	[0187.049] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.049] lstrlenW (lpString=".xls") returned 4
	[0187.050] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.050] lstrlenW (lpString=".xlsx") returned 5
	[0187.050] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.050] lstrlenW (lpString=".ppt") returned 4
	[0187.050] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.050] lstrlenW (lpString=".zip") returned 4
	[0187.050] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.050] lstrlenW (lpString=".rar") returned 4
	[0187.050] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.050] lstrlenW (lpString=".bz2") returned 4
	[0187.050] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.050] lstrlenW (lpString=".7z") returned 3
	[0187.050] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.050] lstrlenW (lpString=".dbf") returned 4
	[0187.050] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.050] lstrlenW (lpString=".1cd") returned 4
	[0187.050] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.050] lstrlenW (lpString=".jpg") returned 4
	[0187.050] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.050] lstrlenW (lpString=".doc") returned 4
	[0187.050] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.050] lstrlenW (lpString=".docx") returned 5
	[0187.050] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.050] lstrlenW (lpString=".pdf") returned 4
	[0187.050] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.051] lstrlenW (lpString=".xls") returned 4
	[0187.051] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.051] lstrlenW (lpString=".xlsx") returned 5
	[0187.051] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.051] lstrlenW (lpString=".ppt") returned 4
	[0187.051] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.051] lstrlenW (lpString=".zip") returned 4
	[0187.051] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.051] lstrlenW (lpString=".rar") returned 4
	[0187.051] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.051] lstrlenW (lpString=".bz2") returned 4
	[0187.051] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.051] lstrlenW (lpString=".7z") returned 3
	[0187.051] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.051] lstrlenW (lpString=".dbf") returned 4
	[0187.051] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.051] lstrlenW (lpString=".1cd") returned 4
	[0187.051] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0187.051] lstrlenW (lpString=".jpg") returned 4
	[0187.051] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.051] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.051] lstrlenW (lpString="O365BusinessR_SubTest-ul-oob.xrm-ms") returned 35
	[0187.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.052] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11626) returned 1
	[0187.052] CloseHandle (hObject=0x444) returned 1
	[0187.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 0x220
	[0187.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.053] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.053] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0187.053] GetLastError () returned 0x0
	[0187.053] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d6a, lpOverlapped=0x0) returned 1
	[0187.283] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0187.284] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.284] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0187.284] SetEndOfFile (hFile=0x328) returned 1
	[0187.284] CloseHandle (hObject=0x328) returned 1
	[0187.284] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.284] SetEndOfFile (hFile=0x444) returned 1
	[0187.287] CloseHandle (hObject=0x444) returned 1
	[0187.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 1
	[0187.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.288] lstrlenW (lpString=".doc") returned 4
	[0187.288] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.288] lstrlenW (lpString=".docx") returned 5
	[0187.288] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.289] lstrlenW (lpString=".pdf") returned 4
	[0187.289] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.289] lstrlenW (lpString=".xls") returned 4
	[0187.289] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.289] lstrlenW (lpString=".xlsx") returned 5
	[0187.289] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.289] lstrlenW (lpString=".ppt") returned 4
	[0187.289] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.289] lstrlenW (lpString=".zip") returned 4
	[0187.289] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.289] lstrlenW (lpString=".rar") returned 4
	[0187.289] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.289] lstrlenW (lpString=".bz2") returned 4
	[0187.289] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.289] lstrlenW (lpString=".7z") returned 3
	[0187.289] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.289] lstrlenW (lpString=".dbf") returned 4
	[0187.289] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.289] lstrlenW (lpString=".1cd") returned 4
	[0187.289] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.289] lstrlenW (lpString=".jpg") returned 4
	[0187.289] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.289] lstrlenW (lpString=".doc") returned 4
	[0187.289] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.289] lstrlenW (lpString=".docx") returned 5
	[0187.290] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.290] lstrlenW (lpString=".pdf") returned 4
	[0187.290] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.290] lstrlenW (lpString=".xls") returned 4
	[0187.290] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.290] lstrlenW (lpString=".xlsx") returned 5
	[0187.290] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.290] lstrlenW (lpString=".ppt") returned 4
	[0187.290] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.290] lstrlenW (lpString=".zip") returned 4
	[0187.290] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.290] lstrlenW (lpString=".rar") returned 4
	[0187.290] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.290] lstrlenW (lpString=".bz2") returned 4
	[0187.290] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.290] lstrlenW (lpString=".7z") returned 3
	[0187.290] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.290] lstrlenW (lpString=".dbf") returned 4
	[0187.290] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.290] lstrlenW (lpString=".1cd") returned 4
	[0187.290] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0187.290] lstrlenW (lpString=".jpg") returned 4
	[0187.290] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.290] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.291] lstrlenW (lpString="O365HomePremR_Subscription1-ppd.xrm-ms") returned 38
	[0187.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.291] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=26541) returned 1
	[0187.292] CloseHandle (hObject=0x444) returned 1
	[0187.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 0x220
	[0187.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.292] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.292] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0187.293] GetLastError () returned 0x0
	[0187.293] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0187.295] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0187.297] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.297] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x120, lpOverlapped=0x0) returned 1
	[0187.297] SetEndOfFile (hFile=0x328) returned 1
	[0187.297] CloseHandle (hObject=0x328) returned 1
	[0187.297] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.297] SetEndOfFile (hFile=0x444) returned 1
	[0187.300] CloseHandle (hObject=0x444) returned 1
	[0187.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 1
	[0187.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.301] lstrlenW (lpString=".doc") returned 4
	[0187.301] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.301] lstrlenW (lpString=".docx") returned 5
	[0187.301] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.301] lstrlenW (lpString=".pdf") returned 4
	[0187.301] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.301] lstrlenW (lpString=".xls") returned 4
	[0187.301] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.301] lstrlenW (lpString=".xlsx") returned 5
	[0187.301] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.301] lstrlenW (lpString=".ppt") returned 4
	[0187.302] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.302] lstrlenW (lpString=".zip") returned 4
	[0187.302] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.302] lstrlenW (lpString=".rar") returned 4
	[0187.302] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.302] lstrlenW (lpString=".bz2") returned 4
	[0187.302] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.302] lstrlenW (lpString=".7z") returned 3
	[0187.302] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.302] lstrlenW (lpString=".dbf") returned 4
	[0187.302] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.302] lstrlenW (lpString=".1cd") returned 4
	[0187.302] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.302] lstrlenW (lpString=".jpg") returned 4
	[0187.302] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.302] lstrlenW (lpString=".doc") returned 4
	[0187.302] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.302] lstrlenW (lpString=".docx") returned 5
	[0187.302] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.302] lstrlenW (lpString=".pdf") returned 4
	[0187.302] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.302] lstrlenW (lpString=".xls") returned 4
	[0187.302] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.303] lstrlenW (lpString=".xlsx") returned 5
	[0187.303] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.303] lstrlenW (lpString=".ppt") returned 4
	[0187.303] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.303] lstrlenW (lpString=".zip") returned 4
	[0187.303] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.303] lstrlenW (lpString=".rar") returned 4
	[0187.303] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.303] lstrlenW (lpString=".bz2") returned 4
	[0187.303] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.303] lstrlenW (lpString=".7z") returned 3
	[0187.303] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.303] lstrlenW (lpString=".dbf") returned 4
	[0187.303] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.303] lstrlenW (lpString=".1cd") returned 4
	[0187.303] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0187.303] lstrlenW (lpString=".jpg") returned 4
	[0187.303] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.303] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.303] lstrlenW (lpString="O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 41
	[0187.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.304] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11651) returned 1
	[0187.304] CloseHandle (hObject=0x444) returned 1
	[0187.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 0x220
	[0187.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.305] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.305] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0187.306] GetLastError () returned 0x0
	[0187.306] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0187.307] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0187.308] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.308] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x126, lpOverlapped=0x0) returned 1
	[0187.308] SetEndOfFile (hFile=0x328) returned 1
	[0187.309] CloseHandle (hObject=0x328) returned 1
	[0187.309] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.309] SetEndOfFile (hFile=0x444) returned 1
	[0187.311] CloseHandle (hObject=0x444) returned 1
	[0187.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 1
	[0187.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.312] lstrlenW (lpString=".doc") returned 4
	[0187.312] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.313] lstrlenW (lpString=".docx") returned 5
	[0187.313] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.313] lstrlenW (lpString=".pdf") returned 4
	[0187.313] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.313] lstrlenW (lpString=".xls") returned 4
	[0187.313] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.313] lstrlenW (lpString=".xlsx") returned 5
	[0187.313] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.313] lstrlenW (lpString=".ppt") returned 4
	[0187.313] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.313] lstrlenW (lpString=".zip") returned 4
	[0187.313] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.313] lstrlenW (lpString=".rar") returned 4
	[0187.313] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.313] lstrlenW (lpString=".bz2") returned 4
	[0187.313] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.313] lstrlenW (lpString=".7z") returned 3
	[0187.313] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.313] lstrlenW (lpString=".dbf") returned 4
	[0187.313] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.313] lstrlenW (lpString=".1cd") returned 4
	[0187.314] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.314] lstrlenW (lpString=".jpg") returned 4
	[0187.314] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.314] lstrlenW (lpString=".doc") returned 4
	[0187.314] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.314] lstrlenW (lpString=".docx") returned 5
	[0187.314] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.314] lstrlenW (lpString=".pdf") returned 4
	[0187.314] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.314] lstrlenW (lpString=".xls") returned 4
	[0187.314] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.314] lstrlenW (lpString=".xlsx") returned 5
	[0187.314] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.314] lstrlenW (lpString=".ppt") returned 4
	[0187.314] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.314] lstrlenW (lpString=".zip") returned 4
	[0187.314] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.314] lstrlenW (lpString=".rar") returned 4
	[0187.314] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.314] lstrlenW (lpString=".bz2") returned 4
	[0187.314] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.314] lstrlenW (lpString=".7z") returned 3
	[0187.314] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.314] lstrlenW (lpString=".dbf") returned 4
	[0187.314] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.315] lstrlenW (lpString=".1cd") returned 4
	[0187.315] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0187.315] lstrlenW (lpString=".jpg") returned 4
	[0187.315] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.315] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.315] lstrlenW (lpString="O365HomePremR_Subscription2-pl.xrm-ms") returned 37
	[0187.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.315] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11199) returned 1
	[0187.316] CloseHandle (hObject=0x444) returned 1
	[0187.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 0x220
	[0187.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.316] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.316] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0187.317] GetLastError () returned 0x0
	[0187.317] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0187.642] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0187.643] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.643] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0187.643] SetEndOfFile (hFile=0x328) returned 1
	[0187.643] CloseHandle (hObject=0x328) returned 1
	[0187.643] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.643] SetEndOfFile (hFile=0x444) returned 1
	[0187.646] CloseHandle (hObject=0x444) returned 1
	[0187.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 1
	[0187.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.648] lstrlenW (lpString=".doc") returned 4
	[0187.648] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.648] lstrlenW (lpString=".docx") returned 5
	[0187.648] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.648] lstrlenW (lpString=".pdf") returned 4
	[0187.648] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.648] lstrlenW (lpString=".xls") returned 4
	[0187.648] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.648] lstrlenW (lpString=".xlsx") returned 5
	[0187.648] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.648] lstrlenW (lpString=".ppt") returned 4
	[0187.648] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.648] lstrlenW (lpString=".zip") returned 4
	[0187.648] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.648] lstrlenW (lpString=".rar") returned 4
	[0187.648] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.648] lstrlenW (lpString=".bz2") returned 4
	[0187.649] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.649] lstrlenW (lpString=".7z") returned 3
	[0187.649] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.649] lstrlenW (lpString=".dbf") returned 4
	[0187.649] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.649] lstrlenW (lpString=".1cd") returned 4
	[0187.649] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.649] lstrlenW (lpString=".jpg") returned 4
	[0187.649] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.649] lstrlenW (lpString=".doc") returned 4
	[0187.649] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.649] lstrlenW (lpString=".docx") returned 5
	[0187.649] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.649] lstrlenW (lpString=".pdf") returned 4
	[0187.649] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.649] lstrlenW (lpString=".xls") returned 4
	[0187.649] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.649] lstrlenW (lpString=".xlsx") returned 5
	[0187.649] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.649] lstrlenW (lpString=".ppt") returned 4
	[0187.649] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.649] lstrlenW (lpString=".zip") returned 4
	[0187.649] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.649] lstrlenW (lpString=".rar") returned 4
	[0187.649] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.650] lstrlenW (lpString=".bz2") returned 4
	[0187.650] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.650] lstrlenW (lpString=".7z") returned 3
	[0187.650] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.650] lstrlenW (lpString=".dbf") returned 4
	[0187.650] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.650] lstrlenW (lpString=".1cd") returned 4
	[0187.650] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0187.650] lstrlenW (lpString=".jpg") returned 4
	[0187.650] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.650] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.650] lstrlenW (lpString="O365HomePremR_Subscription5-pl.xrm-ms") returned 37
	[0187.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.651] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11199) returned 1
	[0187.651] CloseHandle (hObject=0x444) returned 1
	[0187.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 0x220
	[0187.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.652] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.652] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0187.653] GetLastError () returned 0x0
	[0187.653] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0187.654] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0187.655] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.655] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0187.655] SetEndOfFile (hFile=0x328) returned 1
	[0187.656] CloseHandle (hObject=0x328) returned 1
	[0187.656] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.656] SetEndOfFile (hFile=0x444) returned 1
	[0187.662] CloseHandle (hObject=0x444) returned 1
	[0187.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 1
	[0187.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.663] lstrlenW (lpString=".doc") returned 4
	[0187.664] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.664] lstrlenW (lpString=".docx") returned 5
	[0187.664] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.664] lstrlenW (lpString=".pdf") returned 4
	[0187.664] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.664] lstrlenW (lpString=".xls") returned 4
	[0187.664] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.664] lstrlenW (lpString=".xlsx") returned 5
	[0187.664] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.664] lstrlenW (lpString=".ppt") returned 4
	[0187.664] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.664] lstrlenW (lpString=".zip") returned 4
	[0187.664] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.664] lstrlenW (lpString=".rar") returned 4
	[0187.664] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.664] lstrlenW (lpString=".bz2") returned 4
	[0187.664] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.664] lstrlenW (lpString=".7z") returned 3
	[0187.664] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.664] lstrlenW (lpString=".dbf") returned 4
	[0187.664] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.664] lstrlenW (lpString=".1cd") returned 4
	[0187.664] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.664] lstrlenW (lpString=".jpg") returned 4
	[0187.664] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.665] lstrlenW (lpString=".doc") returned 4
	[0187.665] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.665] lstrlenW (lpString=".docx") returned 5
	[0187.665] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.665] lstrlenW (lpString=".pdf") returned 4
	[0187.665] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.665] lstrlenW (lpString=".xls") returned 4
	[0187.665] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.665] lstrlenW (lpString=".xlsx") returned 5
	[0187.665] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.665] lstrlenW (lpString=".ppt") returned 4
	[0187.665] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.665] lstrlenW (lpString=".zip") returned 4
	[0187.665] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.665] lstrlenW (lpString=".rar") returned 4
	[0187.665] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.665] lstrlenW (lpString=".bz2") returned 4
	[0187.665] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.665] lstrlenW (lpString=".7z") returned 3
	[0187.665] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.665] lstrlenW (lpString=".dbf") returned 4
	[0187.665] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.665] lstrlenW (lpString=".1cd") returned 4
	[0187.665] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0187.665] lstrlenW (lpString=".jpg") returned 4
	[0187.665] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.667] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.667] lstrlenW (lpString="O365HomePremR_Subscription5-ppd.xrm-ms") returned 38
	[0187.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.667] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=26541) returned 1
	[0187.667] CloseHandle (hObject=0x444) returned 1
	[0187.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 0x220
	[0187.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.668] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.668] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0187.669] GetLastError () returned 0x0
	[0187.669] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0187.671] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0187.672] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.673] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x120, lpOverlapped=0x0) returned 1
	[0187.673] SetEndOfFile (hFile=0x328) returned 1
	[0187.673] CloseHandle (hObject=0x328) returned 1
	[0187.673] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.673] SetEndOfFile (hFile=0x444) returned 1
	[0187.676] CloseHandle (hObject=0x444) returned 1
	[0187.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0187.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 1
	[0187.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.677] lstrlenW (lpString=".doc") returned 4
	[0187.677] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.677] lstrlenW (lpString=".docx") returned 5
	[0187.677] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.677] lstrlenW (lpString=".pdf") returned 4
	[0187.677] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.677] lstrlenW (lpString=".xls") returned 4
	[0187.677] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.677] lstrlenW (lpString=".xlsx") returned 5
	[0187.677] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.677] lstrlenW (lpString=".ppt") returned 4
	[0187.677] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.678] lstrlenW (lpString=".zip") returned 4
	[0187.678] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.678] lstrlenW (lpString=".rar") returned 4
	[0187.678] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.678] lstrlenW (lpString=".bz2") returned 4
	[0187.678] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.678] lstrlenW (lpString=".7z") returned 3
	[0187.678] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.678] lstrlenW (lpString=".dbf") returned 4
	[0187.678] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.678] lstrlenW (lpString=".1cd") returned 4
	[0187.678] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.678] lstrlenW (lpString=".jpg") returned 4
	[0187.678] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.678] lstrlenW (lpString=".doc") returned 4
	[0187.678] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0187.678] lstrlenW (lpString=".docx") returned 5
	[0187.678] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0187.678] lstrlenW (lpString=".pdf") returned 4
	[0187.678] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0187.678] lstrlenW (lpString=".xls") returned 4
	[0187.678] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0187.678] lstrlenW (lpString=".xlsx") returned 5
	[0187.678] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0187.679] lstrlenW (lpString=".ppt") returned 4
	[0187.679] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0187.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.679] lstrlenW (lpString=".zip") returned 4
	[0187.679] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0187.679] lstrlenW (lpString=".rar") returned 4
	[0187.679] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0187.679] lstrlenW (lpString=".bz2") returned 4
	[0187.679] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0187.679] lstrlenW (lpString=".7z") returned 3
	[0187.679] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0187.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.679] lstrlenW (lpString=".dbf") returned 4
	[0187.679] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0187.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.679] lstrlenW (lpString=".1cd") returned 4
	[0187.679] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0187.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0187.679] lstrlenW (lpString=".jpg") returned 4
	[0187.679] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0187.679] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0187.679] lstrlenW (lpString="O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 41
	[0187.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.680] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11651) returned 1
	[0187.680] CloseHandle (hObject=0x444) returned 1
	[0187.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 0x220
	[0187.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0187.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0187.681] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.681] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0187.682] GetLastError () returned 0x0
	[0187.682] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0188.008] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0188.009] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.009] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x126, lpOverlapped=0x0) returned 1
	[0188.009] SetEndOfFile (hFile=0x328) returned 1
	[0188.009] CloseHandle (hObject=0x328) returned 1
	[0188.009] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.009] SetEndOfFile (hFile=0x444) returned 1
	[0188.012] CloseHandle (hObject=0x444) returned 1
	[0188.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 1
	[0188.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.014] lstrlenW (lpString=".doc") returned 4
	[0188.014] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.014] lstrlenW (lpString=".docx") returned 5
	[0188.014] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.014] lstrlenW (lpString=".pdf") returned 4
	[0188.014] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.014] lstrlenW (lpString=".xls") returned 4
	[0188.014] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.014] lstrlenW (lpString=".xlsx") returned 5
	[0188.014] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.014] lstrlenW (lpString=".ppt") returned 4
	[0188.014] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.014] lstrlenW (lpString=".zip") returned 4
	[0188.014] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.014] lstrlenW (lpString=".rar") returned 4
	[0188.014] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.014] lstrlenW (lpString=".bz2") returned 4
	[0188.014] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.014] lstrlenW (lpString=".7z") returned 3
	[0188.014] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.014] lstrlenW (lpString=".dbf") returned 4
	[0188.014] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.015] lstrlenW (lpString=".1cd") returned 4
	[0188.015] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.015] lstrlenW (lpString=".jpg") returned 4
	[0188.015] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.015] lstrlenW (lpString=".doc") returned 4
	[0188.015] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.015] lstrlenW (lpString=".docx") returned 5
	[0188.015] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.015] lstrlenW (lpString=".pdf") returned 4
	[0188.015] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.015] lstrlenW (lpString=".xls") returned 4
	[0188.015] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.015] lstrlenW (lpString=".xlsx") returned 5
	[0188.015] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.015] lstrlenW (lpString=".ppt") returned 4
	[0188.015] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.015] lstrlenW (lpString=".zip") returned 4
	[0188.015] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.015] lstrlenW (lpString=".rar") returned 4
	[0188.015] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.015] lstrlenW (lpString=".bz2") returned 4
	[0188.015] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.015] lstrlenW (lpString=".7z") returned 3
	[0188.015] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.015] lstrlenW (lpString=".dbf") returned 4
	[0188.016] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.016] lstrlenW (lpString=".1cd") returned 4
	[0188.016] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0188.016] lstrlenW (lpString=".jpg") returned 4
	[0188.016] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.016] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0188.016] lstrlenW (lpString="O365HomePremR_SubTest4-pl.xrm-ms") returned 32
	[0188.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0188.019] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11179) returned 1
	[0188.019] CloseHandle (hObject=0x444) returned 1
	[0188.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 0x220
	[0188.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0188.020] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.020] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0188.021] GetLastError () returned 0x0
	[0188.021] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0188.022] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0188.024] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.024] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x114, lpOverlapped=0x0) returned 1
	[0188.024] SetEndOfFile (hFile=0x328) returned 1
	[0188.024] CloseHandle (hObject=0x328) returned 1
	[0188.024] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.024] SetEndOfFile (hFile=0x444) returned 1
	[0188.027] CloseHandle (hObject=0x444) returned 1
	[0188.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 1
	[0188.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.028] lstrlenW (lpString=".doc") returned 4
	[0188.028] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.028] lstrlenW (lpString=".docx") returned 5
	[0188.028] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.028] lstrlenW (lpString=".pdf") returned 4
	[0188.028] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.028] lstrlenW (lpString=".xls") returned 4
	[0188.029] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.029] lstrlenW (lpString=".xlsx") returned 5
	[0188.029] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.029] lstrlenW (lpString=".ppt") returned 4
	[0188.029] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.029] lstrlenW (lpString=".zip") returned 4
	[0188.029] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.029] lstrlenW (lpString=".rar") returned 4
	[0188.029] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.029] lstrlenW (lpString=".bz2") returned 4
	[0188.029] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.029] lstrlenW (lpString=".7z") returned 3
	[0188.029] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.029] lstrlenW (lpString=".dbf") returned 4
	[0188.029] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.029] lstrlenW (lpString=".1cd") returned 4
	[0188.029] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.029] lstrlenW (lpString=".jpg") returned 4
	[0188.029] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.029] lstrlenW (lpString=".doc") returned 4
	[0188.029] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.029] lstrlenW (lpString=".docx") returned 5
	[0188.029] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.029] lstrlenW (lpString=".pdf") returned 4
	[0188.029] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.030] lstrlenW (lpString=".xls") returned 4
	[0188.030] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.030] lstrlenW (lpString=".xlsx") returned 5
	[0188.030] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.030] lstrlenW (lpString=".ppt") returned 4
	[0188.030] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.030] lstrlenW (lpString=".zip") returned 4
	[0188.030] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.030] lstrlenW (lpString=".rar") returned 4
	[0188.030] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.030] lstrlenW (lpString=".bz2") returned 4
	[0188.030] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.030] lstrlenW (lpString=".7z") returned 3
	[0188.030] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.030] lstrlenW (lpString=".dbf") returned 4
	[0188.030] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.030] lstrlenW (lpString=".1cd") returned 4
	[0188.030] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0188.030] lstrlenW (lpString=".jpg") returned 4
	[0188.030] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.030] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0188.030] lstrlenW (lpString="O365HomePremR_SubTest4-ppd.xrm-ms") returned 33
	[0188.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0188.031] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=23134) returned 1
	[0188.031] CloseHandle (hObject=0x444) returned 1
	[0188.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 0x220
	[0188.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0188.032] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.032] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0188.033] GetLastError () returned 0x0
	[0188.033] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0188.035] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0188.036] ReadFile (in: hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesRead=0x3a9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.036] WriteFile (in: hFile=0x328, lpBuffer=0x465a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x465a020*, lpNumberOfBytesWritten=0x3a9fc94*=0x116, lpOverlapped=0x0) returned 1
	[0188.036] SetEndOfFile (hFile=0x328) returned 1
	[0188.036] CloseHandle (hObject=0x328) returned 1
	[0188.036] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.036] SetEndOfFile (hFile=0x444) returned 1
	[0188.039] CloseHandle (hObject=0x444) returned 1
	[0188.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[admin@stex777.com].money", dwFileAttributes=0x220) returned 1
	[0188.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 1
	[0188.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.040] lstrlenW (lpString=".doc") returned 4
	[0188.040] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.040] lstrlenW (lpString=".docx") returned 5
	[0188.040] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.040] lstrlenW (lpString=".pdf") returned 4
	[0188.040] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.041] lstrlenW (lpString=".xls") returned 4
	[0188.041] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.041] lstrlenW (lpString=".xlsx") returned 5
	[0188.041] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.041] lstrlenW (lpString=".ppt") returned 4
	[0188.041] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.041] lstrlenW (lpString=".zip") returned 4
	[0188.041] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.041] lstrlenW (lpString=".rar") returned 4
	[0188.041] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.041] lstrlenW (lpString=".bz2") returned 4
	[0188.041] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.041] lstrlenW (lpString=".7z") returned 3
	[0188.041] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.041] lstrlenW (lpString=".dbf") returned 4
	[0188.041] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.041] lstrlenW (lpString=".1cd") returned 4
	[0188.041] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.041] lstrlenW (lpString=".jpg") returned 4
	[0188.041] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.041] lstrlenW (lpString=".doc") returned 4
	[0188.041] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0188.041] lstrlenW (lpString=".docx") returned 5
	[0188.041] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0188.041] lstrlenW (lpString=".pdf") returned 4
	[0188.042] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0188.042] lstrlenW (lpString=".xls") returned 4
	[0188.042] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0188.042] lstrlenW (lpString=".xlsx") returned 5
	[0188.042] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0188.042] lstrlenW (lpString=".ppt") returned 4
	[0188.042] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0188.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.042] lstrlenW (lpString=".zip") returned 4
	[0188.042] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0188.042] lstrlenW (lpString=".rar") returned 4
	[0188.042] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0188.042] lstrlenW (lpString=".bz2") returned 4
	[0188.042] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0188.042] lstrlenW (lpString=".7z") returned 3
	[0188.042] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0188.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.042] lstrlenW (lpString=".dbf") returned 4
	[0188.042] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0188.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.042] lstrlenW (lpString=".1cd") returned 4
	[0188.042] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0188.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0188.042] lstrlenW (lpString=".jpg") returned 4
	[0188.042] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0188.042] lstrcmpiW (lpString1=".xrm-ms", lpString2=".money") returned 1
	[0188.042] lstrlenW (lpString="O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 36
	[0188.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0188.043] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3a9ff14 | out: lpFileSize=0x3a9ff14*=11630) returned 1
	[0188.043] CloseHandle (hObject=0x444) returned 1
	[0188.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 0x220
	[0188.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money")) returned 0xffffffff
	[0188.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0188.044] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.044] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[admin@stex777.com].money" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[admin@stex777.com].money"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0188.045] GetLastError () returned 0x0
	[0188.045] ReadFile (hFile=0x444, lpBuffer=0x465a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a9fecc, lpOverlapped=0x0) 

Thread:
	id = 51
	os_tid = 0xe30

	[0153.997] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4461728
	[0153.997] lstrlenW (lpString="C:") returned 2
	[0153.997] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3bdfcf8 | out: lpFindFileData=0x3bdfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x4ef210
	[0153.998] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0153.998] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0153.998] lstrlenW (lpString="$GetCurrent") returned 11
	[0153.998] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0153.998] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4471730
	[0153.998] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0153.998] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4ef250
	[0153.998] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0153.998] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0153.998] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0153.998] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0153.998] lstrlenW (lpString="Logs") returned 4
	[0153.998] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0153.999] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4482740
	[0153.999] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0153.999] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName=".", cAlternateFileName="")) returned 0x4ef290
	[0154.000] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="..", cAlternateFileName="")) returned 1
	[0154.000] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd838e407, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd838e407, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd83b4615, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DOWNLE~1.MON")) returned 1
	[0154.000] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[admin@stex777.com].money") returned 75
	[0154.000] lstrlenW (lpString=".1cd") returned 4
	[0154.000] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0154.000] lstrlenW (lpString=".3ds") returned 4
	[0154.000] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0154.000] lstrlenW (lpString=".3fr") returned 4
	[0154.000] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0154.000] lstrlenW (lpString=".3g2") returned 4
	[0154.000] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0154.000] lstrlenW (lpString=".3gp") returned 4
	[0154.000] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0154.000] lstrlenW (lpString=".7z") returned 3
	[0154.000] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0154.000] lstrlenW (lpString=".accda") returned 6
	[0154.000] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0154.000] lstrlenW (lpString=".accdb") returned 6
	[0154.000] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0154.000] lstrlenW (lpString=".accdc") returned 6
	[0154.001] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0154.001] lstrlenW (lpString=".accde") returned 6
	[0154.001] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0154.001] lstrlenW (lpString=".accdt") returned 6
	[0154.001] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0154.001] lstrlenW (lpString=".accdw") returned 6
	[0154.001] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0154.001] lstrlenW (lpString=".adb") returned 4
	[0154.001] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0154.001] lstrlenW (lpString=".adp") returned 4
	[0154.001] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0154.001] lstrlenW (lpString=".ai") returned 3
	[0154.001] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0154.001] lstrlenW (lpString=".ai3") returned 4
	[0154.001] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0154.001] lstrlenW (lpString=".ai4") returned 4
	[0154.001] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0154.001] lstrlenW (lpString=".ai5") returned 4
	[0154.001] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0154.001] lstrlenW (lpString=".ai6") returned 4
	[0154.001] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0154.001] lstrlenW (lpString=".ai7") returned 4
	[0154.001] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0154.001] lstrlenW (lpString=".ai8") returned 4
	[0154.001] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0154.001] lstrlenW (lpString=".anim") returned 5
	[0154.001] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0154.001] lstrlenW (lpString=".arw") returned 4
	[0154.001] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0154.001] lstrlenW (lpString=".as") returned 3
	[0154.001] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0154.001] lstrlenW (lpString=".asa") returned 4
	[0154.002] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".asc") returned 4
	[0154.002] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".ascx") returned 5
	[0154.002] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0154.002] lstrlenW (lpString=".asm") returned 4
	[0154.002] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".asmx") returned 5
	[0154.002] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0154.002] lstrlenW (lpString=".asp") returned 4
	[0154.002] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".aspx") returned 5
	[0154.002] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0154.002] lstrlenW (lpString=".asr") returned 4
	[0154.002] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".asx") returned 4
	[0154.002] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".avi") returned 4
	[0154.002] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".avs") returned 4
	[0154.002] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".backup") returned 7
	[0154.002] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0154.002] lstrlenW (lpString=".bak") returned 4
	[0154.002] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".bay") returned 4
	[0154.002] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".bd") returned 3
	[0154.002] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0154.002] lstrlenW (lpString=".bin") returned 4
	[0154.002] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".bmp") returned 4
	[0154.002] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0154.002] lstrlenW (lpString=".bz2") returned 4
	[0154.003] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0154.003] lstrlenW (lpString=".c") returned 2
	[0154.003] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0154.003] lstrlenW (lpString=".cdr") returned 4
	[0154.003] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0154.003] lstrlenW (lpString=".cer") returned 4
	[0154.003] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0154.003] lstrlenW (lpString=".cf") returned 3
	[0154.003] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0154.003] lstrlenW (lpString=".cfc") returned 4
	[0154.003] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0154.003] lstrlenW (lpString=".cfm") returned 4
	[0154.003] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0154.003] lstrlenW (lpString=".cfml") returned 5
	[0154.003] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0154.003] lstrlenW (lpString=".cfu") returned 4
	[0154.003] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0154.003] lstrlenW (lpString=".chm") returned 4
	[0154.003] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0154.003] lstrlenW (lpString=".cin") returned 4
	[0154.003] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0154.003] lstrlenW (lpString=".class") returned 6
	[0154.003] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0154.003] lstrlenW (lpString=".clx") returned 4
	[0154.003] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0154.003] lstrlenW (lpString=".config") returned 7
	[0154.003] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0154.003] lstrlenW (lpString=".cpp") returned 4
	[0154.003] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0154.003] lstrlenW (lpString=".cr2") returned 4
	[0154.003] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0154.003] lstrlenW (lpString=".crt") returned 4
	[0154.003] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".crw") returned 4
	[0154.004] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".cs") returned 3
	[0154.004] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0154.004] lstrlenW (lpString=".css") returned 4
	[0154.004] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".csv") returned 4
	[0154.004] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".cub") returned 4
	[0154.004] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".dae") returned 4
	[0154.004] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".dat") returned 4
	[0154.004] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".db") returned 3
	[0154.004] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0154.004] lstrlenW (lpString=".dbf") returned 4
	[0154.004] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".dbx") returned 4
	[0154.004] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".dc3") returned 4
	[0154.004] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".dcm") returned 4
	[0154.004] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".dcr") returned 4
	[0154.004] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".der") returned 4
	[0154.004] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".dib") returned 4
	[0154.004] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0154.004] lstrlenW (lpString=".dic") returned 4
	[0154.004] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0154.005] lstrlenW (lpString=".dif") returned 4
	[0154.005] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0154.005] lstrlenW (lpString=".divx") returned 5
	[0154.005] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0154.005] lstrlenW (lpString=".djvu") returned 5
	[0154.005] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0154.005] lstrlenW (lpString=".dng") returned 4
	[0154.005] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0154.005] lstrlenW (lpString=".doc") returned 4
	[0154.005] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0154.005] lstrlenW (lpString=".docm") returned 5
	[0154.005] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0154.005] lstrlenW (lpString=".docx") returned 5
	[0154.005] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0154.005] lstrlenW (lpString=".dot") returned 4
	[0154.005] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0154.005] lstrlenW (lpString=".dotm") returned 5
	[0154.005] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0154.005] lstrlenW (lpString=".dotx") returned 5
	[0154.005] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0154.005] lstrlenW (lpString=".dpx") returned 4
	[0154.005] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0154.005] lstrlenW (lpString=".dqy") returned 4
	[0154.005] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0154.005] lstrlenW (lpString=".dsn") returned 4
	[0154.005] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0154.005] lstrlenW (lpString=".dt") returned 3
	[0154.005] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0154.005] lstrlenW (lpString=".dtd") returned 4
	[0154.005] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0154.005] lstrlenW (lpString=".dwg") returned 4
	[0154.005] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0154.005] lstrlenW (lpString=".dwt") returned 4
	[0154.005] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0154.006] lstrlenW (lpString=".dx") returned 3
	[0154.006] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0154.006] lstrlenW (lpString=".dxf") returned 4
	[0154.006] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0154.006] lstrlenW (lpString=".edml") returned 5
	[0154.006] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0154.006] lstrlenW (lpString=".efd") returned 4
	[0154.006] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0154.006] lstrlenW (lpString=".elf") returned 4
	[0154.006] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0154.006] lstrlenW (lpString=".emf") returned 4
	[0154.006] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0154.006] lstrlenW (lpString=".emz") returned 4
	[0154.006] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0154.006] lstrlenW (lpString=".epf") returned 4
	[0154.006] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0154.006] lstrlenW (lpString=".eps") returned 4
	[0154.006] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0154.006] lstrlenW (lpString=".epsf") returned 5
	[0154.006] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0154.006] lstrlenW (lpString=".epsp") returned 5
	[0154.006] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0154.006] lstrlenW (lpString=".erf") returned 4
	[0154.006] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0154.006] lstrlenW (lpString=".exr") returned 4
	[0154.006] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0154.006] lstrlenW (lpString=".f4v") returned 4
	[0154.006] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0154.006] lstrlenW (lpString=".fido") returned 5
	[0154.006] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0154.006] lstrlenW (lpString=".flm") returned 4
	[0154.006] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".flv") returned 4
	[0154.007] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".frm") returned 4
	[0154.007] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".fxg") returned 4
	[0154.007] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".geo") returned 4
	[0154.007] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".gif") returned 4
	[0154.007] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".grs") returned 4
	[0154.007] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".gz") returned 3
	[0154.007] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0154.007] lstrlenW (lpString=".h") returned 2
	[0154.007] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0154.007] lstrlenW (lpString=".hdr") returned 4
	[0154.007] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".hpp") returned 4
	[0154.007] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".hta") returned 4
	[0154.007] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".htc") returned 4
	[0154.007] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".htm") returned 4
	[0154.007] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".html") returned 5
	[0154.007] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0154.007] lstrlenW (lpString=".icb") returned 4
	[0154.007] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".ics") returned 4
	[0154.007] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0154.007] lstrlenW (lpString=".iff") returned 4
	[0154.007] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".inc") returned 4
	[0154.008] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".indd") returned 5
	[0154.008] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0154.008] lstrlenW (lpString=".ini") returned 4
	[0154.008] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".iqy") returned 4
	[0154.008] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".j2c") returned 4
	[0154.008] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".j2k") returned 4
	[0154.008] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".java") returned 5
	[0154.008] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0154.008] lstrlenW (lpString=".jp2") returned 4
	[0154.008] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".jpc") returned 4
	[0154.008] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".jpe") returned 4
	[0154.008] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".jpeg") returned 5
	[0154.008] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0154.008] lstrlenW (lpString=".jpf") returned 4
	[0154.008] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".jpg") returned 4
	[0154.008] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".jpx") returned 4
	[0154.008] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".js") returned 3
	[0154.008] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0154.008] lstrlenW (lpString=".jsf") returned 4
	[0154.008] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0154.008] lstrlenW (lpString=".json") returned 5
	[0154.009] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0154.009] lstrlenW (lpString=".jsp") returned 4
	[0154.009] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".kdc") returned 4
	[0154.009] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".kmz") returned 4
	[0154.009] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".kwm") returned 4
	[0154.009] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".lasso") returned 6
	[0154.009] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0154.009] lstrlenW (lpString=".lbi") returned 4
	[0154.009] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".lgf") returned 4
	[0154.009] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".lgp") returned 4
	[0154.009] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".log") returned 4
	[0154.009] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".m1v") returned 4
	[0154.009] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".m4a") returned 4
	[0154.009] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".m4v") returned 4
	[0154.009] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".max") returned 4
	[0154.009] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".md") returned 3
	[0154.009] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0154.009] lstrlenW (lpString=".mda") returned 4
	[0154.009] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0154.009] lstrlenW (lpString=".mdb") returned 4
	[0154.009] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mde") returned 4
	[0154.010] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mdf") returned 4
	[0154.010] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mdw") returned 4
	[0154.010] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mef") returned 4
	[0154.010] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mft") returned 4
	[0154.010] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mfw") returned 4
	[0154.010] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mht") returned 4
	[0154.010] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mhtml") returned 6
	[0154.010] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0154.010] lstrlenW (lpString=".mka") returned 4
	[0154.010] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mkidx") returned 6
	[0154.010] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0154.010] lstrlenW (lpString=".mkv") returned 4
	[0154.010] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mos") returned 4
	[0154.010] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mov") returned 4
	[0154.010] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mp3") returned 4
	[0154.010] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mp4") returned 4
	[0154.010] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0154.010] lstrlenW (lpString=".mpeg") returned 5
	[0154.010] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0154.010] lstrlenW (lpString=".mpg") returned 4
	[0154.011] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".mpv") returned 4
	[0154.011] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".mrw") returned 4
	[0154.011] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".msg") returned 4
	[0154.011] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".mxl") returned 4
	[0154.011] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".myd") returned 4
	[0154.011] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".myi") returned 4
	[0154.011] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".nef") returned 4
	[0154.011] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".nrw") returned 4
	[0154.011] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".obj") returned 4
	[0154.011] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".odb") returned 4
	[0154.011] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".odc") returned 4
	[0154.011] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".odm") returned 4
	[0154.011] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".odp") returned 4
	[0154.011] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".ods") returned 4
	[0154.011] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".oft") returned 4
	[0154.011] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0154.011] lstrlenW (lpString=".one") returned 4
	[0154.011] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".onepkg") returned 7
	[0154.012] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0154.012] lstrlenW (lpString=".onetoc2") returned 8
	[0154.012] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0154.012] lstrlenW (lpString=".opt") returned 4
	[0154.012] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".oqy") returned 4
	[0154.012] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".orf") returned 4
	[0154.012] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".p12") returned 4
	[0154.012] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".p7b") returned 4
	[0154.012] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".p7c") returned 4
	[0154.012] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".pam") returned 4
	[0154.012] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".pbm") returned 4
	[0154.012] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".pct") returned 4
	[0154.012] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".pcx") returned 4
	[0154.012] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".pdd") returned 4
	[0154.012] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".pdf") returned 4
	[0154.012] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0154.012] lstrlenW (lpString=".pdp") returned 4
	[0154.012] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0154.013] lstrlenW (lpString=".pef") returned 4
	[0154.013] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0154.013] lstrlenW (lpString=".pem") returned 4
	[0154.013] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0154.013] lstrlenW (lpString=".pff") returned 4
	[0154.013] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0154.013] lstrlenW (lpString=".pfm") returned 4
	[0154.013] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0154.013] lstrlenW (lpString=".pfx") returned 4
	[0154.013] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0154.013] lstrlenW (lpString=".pgm") returned 4
	[0154.013] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0154.013] lstrlenW (lpString=".php") returned 4
	[0154.013] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0154.013] lstrlenW (lpString=".php3") returned 5
	[0154.013] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0154.013] lstrlenW (lpString=".php4") returned 5
	[0154.013] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0154.013] lstrlenW (lpString=".php5") returned 5
	[0154.013] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0154.013] lstrlenW (lpString=".phtml") returned 6
	[0154.013] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0154.013] lstrlenW (lpString=".pict") returned 5
	[0154.013] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0154.013] lstrlenW (lpString=".pl") returned 3
	[0154.013] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0154.013] lstrlenW (lpString=".pls") returned 4
	[0154.013] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0154.013] lstrlenW (lpString=".pm") returned 3
	[0154.013] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0154.013] lstrlenW (lpString=".png") returned 4
	[0154.013] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0154.013] lstrlenW (lpString=".pnm") returned 4
	[0154.014] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0154.014] lstrlenW (lpString=".pot") returned 4
	[0154.014] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0154.014] lstrlenW (lpString=".potm") returned 5
	[0154.014] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0154.014] lstrlenW (lpString=".potx") returned 5
	[0154.014] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0154.014] lstrlenW (lpString=".ppa") returned 4
	[0154.014] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0154.014] lstrlenW (lpString=".ppam") returned 5
	[0154.014] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0154.014] lstrlenW (lpString=".ppm") returned 4
	[0154.014] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0154.014] lstrlenW (lpString=".pps") returned 4
	[0154.014] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0154.014] lstrlenW (lpString=".ppsm") returned 5
	[0154.014] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0154.014] lstrlenW (lpString=".ppt") returned 4
	[0154.014] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0154.014] lstrlenW (lpString=".pptm") returned 5
	[0154.014] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0154.014] lstrlenW (lpString=".pptx") returned 5
	[0154.014] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0154.014] lstrlenW (lpString=".prn") returned 4
	[0154.014] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0154.014] lstrlenW (lpString=".ps") returned 3
	[0154.014] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0154.014] lstrlenW (lpString=".psb") returned 4
	[0154.014] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0154.014] lstrlenW (lpString=".psd") returned 4
	[0154.014] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0154.014] lstrlenW (lpString=".pst") returned 4
	[0154.014] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0154.014] lstrlenW (lpString=".ptx") returned 4
	[0154.015] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0154.015] lstrlenW (lpString=".pub") returned 4
	[0154.015] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0154.015] lstrlenW (lpString=".pwm") returned 4
	[0154.015] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0154.015] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8426f15, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="OOBE_2~1.MON")) returned 1
	[0154.015] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83da953, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd83da953, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8400cf6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARTNE~1.MON")) returned 1
	[0154.015] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83da953, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd83da953, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8400cf6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARTNE~1.MON")) returned 0
	[0154.015] FindClose (in: hFindFile=0x4ef290 | out: hFindFile=0x4ef290) returned 1
	[0154.016] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4482740 | out: hHeap=0x4c0000) returned 1
	[0154.016] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0154.016] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4482740
	[0154.016] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName=".", cAlternateFileName="")) returned 0x4ef290
	[0154.017] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="..", cAlternateFileName="")) returned 1
	[0154.017] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8879283, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8879283, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd88c5690, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="GetCurrentOOBE.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="GETCUR~2.MON")) returned 1
	[0154.017] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8400cf6, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8400cf6, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8400cf6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="GetCurrentRollback.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="GETCUR~1.MON")) returned 1
	[0154.017] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88c5690, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd88c5690, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c7f0c4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="PartnerSetupComplete.cmd.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARTNE~1.MON")) returned 1
	[0154.017] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88eb90b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd88eb90b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8911ad0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="preoobe.cmd.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PREOOB~1.MON")) returned 1
	[0154.017] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8911ad0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8911ad0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8911ad0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="SetupComplete.cmd.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPC~1.MON")) returned 1
	[0154.017] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8911ad0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8911ad0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8911ad0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xfffff044, dwReserved1=0x315, cFileName="SetupComplete.cmd.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPC~1.MON")) returned 0
	[0154.017] FindClose (in: hFindFile=0x4ef290 | out: hFindFile=0x4ef290) returned 1
	[0154.018] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4482740 | out: hHeap=0x4c0000) returned 1
	[0154.018] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xd8426f15, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8426f15, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0154.018] FindClose (in: hFindFile=0x4ef250 | out: hFindFile=0x4ef250) returned 1
	[0154.018] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4471730 | out: hHeap=0x4c0000) returned 1
	[0154.018] FindNextFileW (in: hFindFile=0x4ef210, lpFindFileData=0x3bdfcf8 | out: lpFindFileData=0x3bdfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0154.018] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4471730
	[0154.018] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName=".", cAlternateFileName="")) returned 0x4ef250
	[0154.018] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="..", cAlternateFileName="")) returned 1
	[0154.019] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd876e0d4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0154.019] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.019] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0xffffe7b9, nFileSizeHigh=0xffffe7b9, nFileSizeLow=0xecd, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="", cAlternateFileName="R\x08")) returned 0xffffffff
	[0154.019] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.019] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5010a3e, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x5010a3e, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0154.019] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.019] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5010a3e, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x5010a3e, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x4ef290
	[0154.019] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5010a3e, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x5010a3e, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.019] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5010a3e, ftCreationTime.dwHighDateTime=0x1d590a2, ftLastAccessTime.dwLowDateTime=0x5010a3e, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x5010a3e, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0154.019] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd876e0d4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd876e0d4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="desktop.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DESKTO~1.MON")) returned 1
	[0154.019] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd876e0d4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd876e0d4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd876e0d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="desktop.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DESKTO~1.MON")) returned 0
	[0154.019] FindClose (in: hFindFile=0x4ef290 | out: hFindFile=0x4ef290) returned 1
	[0154.020] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.020] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5010a3e, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x5010a3e, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0154.020] FindClose (in: hFindFile=0x4ef250 | out: hFindFile=0x4ef250) returned 1
	[0154.020] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4471730 | out: hHeap=0x4c0000) returned 1
	[0154.020] FindNextFileW (in: hFindFile=0x4ef210, lpFindFileData=0x3bdfcf8 | out: lpFindFileData=0x3bdfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0154.020] FindNextFileW (in: hFindFile=0x4ef210, lpFindFileData=0x3bdfcf8 | out: lpFindFileData=0x3bdfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xdd798e9e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdd798e9e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0154.020] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0154.020] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212") returned 1
	[0154.020] lstrlenW (lpString="588bce7c90097ed212") returned 18
	[0154.020] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="588bce7c90097ed212") returned 1
	[0154.020] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4471730
	[0154.020] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0154.020] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xdd798e9e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdd798e9e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName=".", cAlternateFileName="")) returned 0x4ef250
	[0154.024] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xdd798e9e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdd798e9e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="..", cAlternateFileName="")) returned 1
	[0154.025] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1025", cAlternateFileName="")) returned 1
	[0154.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0154.025] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1
	[0154.025] lstrlenW (lpString="1025") returned 4
	[0154.025] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1
	[0154.025] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0154.025] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x4ef290
	[0154.027] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.027] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8b27fef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8b27fef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8b7402a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.027] lstrlenW (lpString="eula.rtf.id-B4197730.[admin@stex777.com].money") returned 46
	[0154.027] lstrlenW (lpString=".1cd") returned 4
	[0154.027] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0154.027] lstrlenW (lpString=".3ds") returned 4
	[0154.027] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0154.027] lstrlenW (lpString=".3fr") returned 4
	[0154.027] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0154.027] lstrlenW (lpString=".3g2") returned 4
	[0154.027] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0154.027] lstrlenW (lpString=".3gp") returned 4
	[0154.027] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0154.027] lstrlenW (lpString=".7z") returned 3
	[0154.027] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0154.028] lstrlenW (lpString=".accda") returned 6
	[0154.028] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0154.028] lstrlenW (lpString=".accdb") returned 6
	[0154.028] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0154.028] lstrlenW (lpString=".accdc") returned 6
	[0154.028] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0154.028] lstrlenW (lpString=".accde") returned 6
	[0154.028] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0154.028] lstrlenW (lpString=".accdt") returned 6
	[0154.028] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0154.028] lstrlenW (lpString=".accdw") returned 6
	[0154.028] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0154.028] lstrlenW (lpString=".adb") returned 4
	[0154.028] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0154.028] lstrlenW (lpString=".adp") returned 4
	[0154.028] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0154.028] lstrlenW (lpString=".ai") returned 3
	[0154.028] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0154.028] lstrlenW (lpString=".ai3") returned 4
	[0154.028] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0154.028] lstrlenW (lpString=".ai4") returned 4
	[0154.028] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0154.028] lstrlenW (lpString=".ai5") returned 4
	[0154.028] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0154.028] lstrlenW (lpString=".ai6") returned 4
	[0154.028] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0154.028] lstrlenW (lpString=".ai7") returned 4
	[0154.028] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0154.029] lstrlenW (lpString=".ai8") returned 4
	[0154.029] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0154.029] lstrlenW (lpString=".anim") returned 5
	[0154.029] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0154.029] lstrlenW (lpString=".arw") returned 4
	[0154.029] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0154.029] lstrlenW (lpString=".as") returned 3
	[0154.029] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0154.029] lstrlenW (lpString=".asa") returned 4
	[0154.029] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0154.029] lstrlenW (lpString=".asc") returned 4
	[0154.029] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0154.029] lstrlenW (lpString=".ascx") returned 5
	[0154.029] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0154.029] lstrlenW (lpString=".asm") returned 4
	[0154.029] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0154.029] lstrlenW (lpString=".asmx") returned 5
	[0154.029] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0154.029] lstrlenW (lpString=".asp") returned 4
	[0154.029] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0154.029] lstrlenW (lpString=".aspx") returned 5
	[0154.029] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0154.029] lstrlenW (lpString=".asr") returned 4
	[0154.029] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0154.029] lstrlenW (lpString=".asx") returned 4
	[0154.029] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0154.029] lstrlenW (lpString=".avi") returned 4
	[0154.029] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0154.029] lstrlenW (lpString=".avs") returned 4
	[0154.029] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0154.029] lstrlenW (lpString=".backup") returned 7
	[0154.029] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0154.030] lstrlenW (lpString=".bak") returned 4
	[0154.030] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".bay") returned 4
	[0154.030] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".bd") returned 3
	[0154.030] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0154.030] lstrlenW (lpString=".bin") returned 4
	[0154.030] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".bmp") returned 4
	[0154.030] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".bz2") returned 4
	[0154.030] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".c") returned 2
	[0154.030] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0154.030] lstrlenW (lpString=".cdr") returned 4
	[0154.030] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".cer") returned 4
	[0154.030] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".cf") returned 3
	[0154.030] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0154.030] lstrlenW (lpString=".cfc") returned 4
	[0154.030] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".cfm") returned 4
	[0154.030] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".cfml") returned 5
	[0154.030] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0154.030] lstrlenW (lpString=".cfu") returned 4
	[0154.030] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".chm") returned 4
	[0154.030] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".cin") returned 4
	[0154.030] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0154.030] lstrlenW (lpString=".class") returned 6
	[0154.030] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0154.031] lstrlenW (lpString=".clx") returned 4
	[0154.031] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".config") returned 7
	[0154.031] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0154.031] lstrlenW (lpString=".cpp") returned 4
	[0154.031] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".cr2") returned 4
	[0154.031] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".crt") returned 4
	[0154.031] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".crw") returned 4
	[0154.031] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".cs") returned 3
	[0154.031] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0154.031] lstrlenW (lpString=".css") returned 4
	[0154.031] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".csv") returned 4
	[0154.031] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".cub") returned 4
	[0154.031] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".dae") returned 4
	[0154.031] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".dat") returned 4
	[0154.031] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".db") returned 3
	[0154.031] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0154.031] lstrlenW (lpString=".dbf") returned 4
	[0154.031] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".dbx") returned 4
	[0154.031] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".dc3") returned 4
	[0154.031] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0154.031] lstrlenW (lpString=".dcm") returned 4
	[0154.031] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0154.032] lstrlenW (lpString=".dcr") returned 4
	[0154.032] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0154.032] lstrlenW (lpString=".der") returned 4
	[0154.032] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0154.032] lstrlenW (lpString=".dib") returned 4
	[0154.032] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0154.032] lstrlenW (lpString=".dic") returned 4
	[0154.032] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0154.032] lstrlenW (lpString=".dif") returned 4
	[0154.032] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0154.032] lstrlenW (lpString=".divx") returned 5
	[0154.032] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0154.032] lstrlenW (lpString=".djvu") returned 5
	[0154.032] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0154.032] lstrlenW (lpString=".dng") returned 4
	[0154.032] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0154.032] lstrlenW (lpString=".doc") returned 4
	[0154.032] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0154.032] lstrlenW (lpString=".docm") returned 5
	[0154.032] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0154.032] lstrlenW (lpString=".docx") returned 5
	[0154.032] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0154.032] lstrlenW (lpString=".dot") returned 4
	[0154.032] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0154.032] lstrlenW (lpString=".dotm") returned 5
	[0154.032] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0154.032] lstrlenW (lpString=".dotx") returned 5
	[0154.032] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0154.032] lstrlenW (lpString=".dpx") returned 4
	[0154.032] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0154.032] lstrlenW (lpString=".dqy") returned 4
	[0154.032] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0154.032] lstrlenW (lpString=".dsn") returned 4
	[0154.032] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".dt") returned 3
	[0154.033] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0154.033] lstrlenW (lpString=".dtd") returned 4
	[0154.033] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".dwg") returned 4
	[0154.033] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".dwt") returned 4
	[0154.033] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".dx") returned 3
	[0154.033] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0154.033] lstrlenW (lpString=".dxf") returned 4
	[0154.033] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".edml") returned 5
	[0154.033] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0154.033] lstrlenW (lpString=".efd") returned 4
	[0154.033] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".elf") returned 4
	[0154.033] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".emf") returned 4
	[0154.033] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".emz") returned 4
	[0154.033] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".epf") returned 4
	[0154.033] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".eps") returned 4
	[0154.033] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".epsf") returned 5
	[0154.033] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0154.033] lstrlenW (lpString=".epsp") returned 5
	[0154.033] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0154.033] lstrlenW (lpString=".erf") returned 4
	[0154.033] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0154.033] lstrlenW (lpString=".exr") returned 4
	[0154.034] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".f4v") returned 4
	[0154.034] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".fido") returned 5
	[0154.034] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0154.034] lstrlenW (lpString=".flm") returned 4
	[0154.034] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".flv") returned 4
	[0154.034] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".frm") returned 4
	[0154.034] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".fxg") returned 4
	[0154.034] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".geo") returned 4
	[0154.034] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".gif") returned 4
	[0154.034] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".grs") returned 4
	[0154.034] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".gz") returned 3
	[0154.034] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0154.034] lstrlenW (lpString=".h") returned 2
	[0154.034] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0154.034] lstrlenW (lpString=".hdr") returned 4
	[0154.034] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".hpp") returned 4
	[0154.034] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".hta") returned 4
	[0154.034] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".htc") returned 4
	[0154.034] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".htm") returned 4
	[0154.034] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0154.034] lstrlenW (lpString=".html") returned 5
	[0154.035] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0154.035] lstrlenW (lpString=".icb") returned 4
	[0154.035] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".ics") returned 4
	[0154.035] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".iff") returned 4
	[0154.035] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".inc") returned 4
	[0154.035] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".indd") returned 5
	[0154.035] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0154.035] lstrlenW (lpString=".ini") returned 4
	[0154.035] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".iqy") returned 4
	[0154.035] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".j2c") returned 4
	[0154.035] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".j2k") returned 4
	[0154.035] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".java") returned 5
	[0154.035] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0154.035] lstrlenW (lpString=".jp2") returned 4
	[0154.035] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".jpc") returned 4
	[0154.035] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".jpe") returned 4
	[0154.035] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".jpeg") returned 5
	[0154.035] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0154.035] lstrlenW (lpString=".jpf") returned 4
	[0154.035] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".jpg") returned 4
	[0154.035] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0154.035] lstrlenW (lpString=".jpx") returned 4
	[0154.036] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".js") returned 3
	[0154.036] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0154.036] lstrlenW (lpString=".jsf") returned 4
	[0154.036] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".json") returned 5
	[0154.036] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0154.036] lstrlenW (lpString=".jsp") returned 4
	[0154.036] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".kdc") returned 4
	[0154.036] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".kmz") returned 4
	[0154.036] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".kwm") returned 4
	[0154.036] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".lasso") returned 6
	[0154.036] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0154.036] lstrlenW (lpString=".lbi") returned 4
	[0154.036] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".lgf") returned 4
	[0154.036] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".lgp") returned 4
	[0154.036] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".log") returned 4
	[0154.036] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".m1v") returned 4
	[0154.036] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".m4a") returned 4
	[0154.036] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".m4v") returned 4
	[0154.036] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0154.036] lstrlenW (lpString=".max") returned 4
	[0154.036] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".md") returned 3
	[0154.037] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0154.037] lstrlenW (lpString=".mda") returned 4
	[0154.037] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mdb") returned 4
	[0154.037] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mde") returned 4
	[0154.037] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mdf") returned 4
	[0154.037] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mdw") returned 4
	[0154.037] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mef") returned 4
	[0154.037] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mft") returned 4
	[0154.037] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mfw") returned 4
	[0154.037] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mht") returned 4
	[0154.037] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mhtml") returned 6
	[0154.037] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0154.037] lstrlenW (lpString=".mka") returned 4
	[0154.037] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mkidx") returned 6
	[0154.037] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0154.037] lstrlenW (lpString=".mkv") returned 4
	[0154.037] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mos") returned 4
	[0154.037] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0154.037] lstrlenW (lpString=".mov") returned 4
	[0154.037] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".mp3") returned 4
	[0154.038] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".mp4") returned 4
	[0154.038] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".mpeg") returned 5
	[0154.038] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0154.038] lstrlenW (lpString=".mpg") returned 4
	[0154.038] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".mpv") returned 4
	[0154.038] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".mrw") returned 4
	[0154.038] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".msg") returned 4
	[0154.038] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".mxl") returned 4
	[0154.038] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".myd") returned 4
	[0154.038] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".myi") returned 4
	[0154.038] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".nef") returned 4
	[0154.038] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".nrw") returned 4
	[0154.038] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".obj") returned 4
	[0154.038] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".odb") returned 4
	[0154.038] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".odc") returned 4
	[0154.038] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0154.038] lstrlenW (lpString=".odm") returned 4
	[0154.038] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".odp") returned 4
	[0154.039] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".ods") returned 4
	[0154.039] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".oft") returned 4
	[0154.039] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".one") returned 4
	[0154.039] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".onepkg") returned 7
	[0154.039] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0154.039] lstrlenW (lpString=".onetoc2") returned 8
	[0154.039] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0154.039] lstrlenW (lpString=".opt") returned 4
	[0154.039] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".oqy") returned 4
	[0154.039] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".orf") returned 4
	[0154.039] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".p12") returned 4
	[0154.039] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".p7b") returned 4
	[0154.039] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".p7c") returned 4
	[0154.039] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".pam") returned 4
	[0154.039] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".pbm") returned 4
	[0154.039] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".pct") returned 4
	[0154.039] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".pcx") returned 4
	[0154.039] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0154.039] lstrlenW (lpString=".pdd") returned 4
	[0154.039] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0154.040] lstrlenW (lpString=".pdf") returned 4
	[0154.040] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0154.040] lstrlenW (lpString=".pdp") returned 4
	[0154.040] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0154.040] lstrlenW (lpString=".pef") returned 4
	[0154.040] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0154.040] lstrlenW (lpString=".pem") returned 4
	[0154.040] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0154.040] lstrlenW (lpString=".pff") returned 4
	[0154.040] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0154.040] lstrlenW (lpString=".pfm") returned 4
	[0154.040] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0154.040] lstrlenW (lpString=".pfx") returned 4
	[0154.040] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0154.040] lstrlenW (lpString=".pgm") returned 4
	[0154.040] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0154.040] lstrlenW (lpString=".php") returned 4
	[0154.040] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0154.040] lstrlenW (lpString=".php3") returned 5
	[0154.040] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0154.040] lstrlenW (lpString=".php4") returned 5
	[0154.040] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0154.040] lstrlenW (lpString=".php5") returned 5
	[0154.040] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0154.040] lstrlenW (lpString=".phtml") returned 6
	[0154.040] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0154.040] lstrlenW (lpString=".pict") returned 5
	[0154.040] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0154.040] lstrlenW (lpString=".pl") returned 3
	[0154.040] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0154.040] lstrlenW (lpString=".pls") returned 4
	[0154.040] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0154.040] lstrlenW (lpString=".pm") returned 3
	[0154.040] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0154.041] lstrlenW (lpString=".png") returned 4
	[0154.041] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0154.041] lstrlenW (lpString=".pnm") returned 4
	[0154.041] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0154.041] lstrlenW (lpString=".pot") returned 4
	[0154.041] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0154.041] lstrlenW (lpString=".potm") returned 5
	[0154.041] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0154.041] lstrlenW (lpString=".potx") returned 5
	[0154.041] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0154.041] lstrlenW (lpString=".ppa") returned 4
	[0154.041] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0154.041] lstrlenW (lpString=".ppam") returned 5
	[0154.041] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0154.041] lstrlenW (lpString=".ppm") returned 4
	[0154.041] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0154.041] lstrlenW (lpString=".pps") returned 4
	[0154.041] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0154.041] lstrlenW (lpString=".ppsm") returned 5
	[0154.041] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0154.041] lstrlenW (lpString=".ppt") returned 4
	[0154.041] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0154.041] lstrlenW (lpString=".pptm") returned 5
	[0154.041] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0154.041] lstrlenW (lpString=".pptx") returned 5
	[0154.041] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0154.041] lstrlenW (lpString=".prn") returned 4
	[0154.041] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0154.041] lstrlenW (lpString=".ps") returned 3
	[0154.041] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0154.041] lstrlenW (lpString=".psb") returned 4
	[0154.041] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0154.042] lstrlenW (lpString=".psd") returned 4
	[0154.042] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0154.042] lstrlenW (lpString=".pst") returned 4
	[0154.042] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0154.042] lstrlenW (lpString=".ptx") returned 4
	[0154.042] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0154.042] lstrlenW (lpString=".pub") returned 4
	[0154.042] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0154.042] lstrlenW (lpString=".pwm") returned 4
	[0154.042] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0154.042] lstrlenW (lpString=".pxr") returned 4
	[0154.042] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0154.042] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8be6b3b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8be6b3b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c0c941, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.042] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c7f0c4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ca52be, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.042] FindNextFileW (in: hFindFile=0x4ef290, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c7f0c4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ca52be, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.042] FindClose (in: hFindFile=0x4ef290 | out: hFindFile=0x4ef290) returned 1
	[0154.043] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.043] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1028", cAlternateFileName="")) returned 1
	[0154.043] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.043] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70c70
	[0154.445] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.448] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8b27fef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8b27fef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8b4de2a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.455] lstrlenW (lpString="eula.rtf.id-B4197730.[admin@stex777.com].money") returned 46
	[0154.459] lstrlenW (lpString=".1cd") returned 4
	[0154.459] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0154.461] lstrlenW (lpString=".3ds") returned 4
	[0154.461] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0154.462] lstrlenW (lpString=".3fr") returned 4
	[0154.462] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0154.463] lstrlenW (lpString=".3g2") returned 4
	[0154.464] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0154.466] lstrlenW (lpString=".3gp") returned 4
	[0154.466] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0154.468] lstrlenW (lpString=".7z") returned 3
	[0154.468] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0154.468] lstrlenW (lpString=".accda") returned 6
	[0154.472] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0154.474] lstrlenW (lpString=".accdb") returned 6
	[0154.475] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0154.475] lstrlenW (lpString=".accdc") returned 6
	[0154.478] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0154.478] lstrlenW (lpString=".accde") returned 6
	[0154.478] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0154.478] lstrlenW (lpString=".accdt") returned 6
	[0154.478] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0154.478] lstrlenW (lpString=".accdw") returned 6
	[0154.478] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0154.478] lstrlenW (lpString=".adb") returned 4
	[0154.478] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0154.478] lstrlenW (lpString=".adp") returned 4
	[0154.478] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0154.478] lstrlenW (lpString=".ai") returned 3
	[0154.478] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0154.478] lstrlenW (lpString=".ai3") returned 4
	[0154.478] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0154.478] lstrlenW (lpString=".ai4") returned 4
	[0154.478] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0154.478] lstrlenW (lpString=".ai5") returned 4
	[0154.478] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0154.478] lstrlenW (lpString=".ai6") returned 4
	[0154.478] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0154.478] lstrlenW (lpString=".ai7") returned 4
	[0154.478] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0154.478] lstrlenW (lpString=".ai8") returned 4
	[0154.479] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0154.479] lstrlenW (lpString=".anim") returned 5
	[0154.479] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0154.479] lstrlenW (lpString=".arw") returned 4
	[0154.479] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0154.479] lstrlenW (lpString=".as") returned 3
	[0154.479] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0154.479] lstrlenW (lpString=".asa") returned 4
	[0154.479] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0154.479] lstrlenW (lpString=".asc") returned 4
	[0154.479] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0154.479] lstrlenW (lpString=".ascx") returned 5
	[0154.479] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0154.479] lstrlenW (lpString=".asm") returned 4
	[0154.479] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0154.479] lstrlenW (lpString=".asmx") returned 5
	[0154.479] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0154.479] lstrlenW (lpString=".asp") returned 4
	[0154.479] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0154.479] lstrlenW (lpString=".aspx") returned 5
	[0154.479] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0154.479] lstrlenW (lpString=".asr") returned 4
	[0154.479] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0154.479] lstrlenW (lpString=".asx") returned 4
	[0154.479] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0154.479] lstrlenW (lpString=".avi") returned 4
	[0154.479] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0154.479] lstrlenW (lpString=".avs") returned 4
	[0154.479] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0154.479] lstrlenW (lpString=".backup") returned 7
	[0154.479] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0154.479] lstrlenW (lpString=".bak") returned 4
	[0154.479] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0154.479] lstrlenW (lpString=".bay") returned 4
	[0154.480] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0154.480] lstrlenW (lpString=".bd") returned 3
	[0154.480] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0154.480] lstrlenW (lpString=".bin") returned 4
	[0154.480] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0154.480] lstrlenW (lpString=".bmp") returned 4
	[0154.480] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0154.480] lstrlenW (lpString=".bz2") returned 4
	[0154.480] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0154.480] lstrlenW (lpString=".c") returned 2
	[0154.480] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0154.480] lstrlenW (lpString=".cdr") returned 4
	[0154.480] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0154.480] lstrlenW (lpString=".cer") returned 4
	[0154.480] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0154.480] lstrlenW (lpString=".cf") returned 3
	[0154.480] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0154.480] lstrlenW (lpString=".cfc") returned 4
	[0154.480] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0154.480] lstrlenW (lpString=".cfm") returned 4
	[0154.480] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0154.480] lstrlenW (lpString=".cfml") returned 5
	[0154.480] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0154.480] lstrlenW (lpString=".cfu") returned 4
	[0154.480] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0154.480] lstrlenW (lpString=".chm") returned 4
	[0154.480] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0154.480] lstrlenW (lpString=".cin") returned 4
	[0154.480] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0154.480] lstrlenW (lpString=".class") returned 6
	[0154.480] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0154.480] lstrlenW (lpString=".clx") returned 4
	[0154.480] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".config") returned 7
	[0154.481] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0154.481] lstrlenW (lpString=".cpp") returned 4
	[0154.481] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".cr2") returned 4
	[0154.481] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".crt") returned 4
	[0154.481] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".crw") returned 4
	[0154.481] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".cs") returned 3
	[0154.481] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0154.481] lstrlenW (lpString=".css") returned 4
	[0154.481] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".csv") returned 4
	[0154.481] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".cub") returned 4
	[0154.481] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".dae") returned 4
	[0154.481] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".dat") returned 4
	[0154.481] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".db") returned 3
	[0154.481] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0154.481] lstrlenW (lpString=".dbf") returned 4
	[0154.481] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".dbx") returned 4
	[0154.481] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".dc3") returned 4
	[0154.481] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".dcm") returned 4
	[0154.481] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0154.481] lstrlenW (lpString=".dcr") returned 4
	[0154.482] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0154.482] lstrlenW (lpString=".der") returned 4
	[0154.482] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0154.482] lstrlenW (lpString=".dib") returned 4
	[0154.482] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0154.482] lstrlenW (lpString=".dic") returned 4
	[0154.482] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0154.482] lstrlenW (lpString=".dif") returned 4
	[0154.482] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0154.482] lstrlenW (lpString=".divx") returned 5
	[0154.482] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0154.482] lstrlenW (lpString=".djvu") returned 5
	[0154.482] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0154.482] lstrlenW (lpString=".dng") returned 4
	[0154.482] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0154.482] lstrlenW (lpString=".doc") returned 4
	[0154.482] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0154.482] lstrlenW (lpString=".docm") returned 5
	[0154.482] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0154.482] lstrlenW (lpString=".docx") returned 5
	[0154.482] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0154.482] lstrlenW (lpString=".dot") returned 4
	[0154.482] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0154.482] lstrlenW (lpString=".dotm") returned 5
	[0154.482] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0154.482] lstrlenW (lpString=".dotx") returned 5
	[0154.482] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0154.482] lstrlenW (lpString=".dpx") returned 4
	[0154.482] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0154.482] lstrlenW (lpString=".dqy") returned 4
	[0154.482] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0154.482] lstrlenW (lpString=".dsn") returned 4
	[0154.482] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".dt") returned 3
	[0154.483] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0154.483] lstrlenW (lpString=".dtd") returned 4
	[0154.483] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".dwg") returned 4
	[0154.483] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".dwt") returned 4
	[0154.483] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".dx") returned 3
	[0154.483] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0154.483] lstrlenW (lpString=".dxf") returned 4
	[0154.483] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".edml") returned 5
	[0154.483] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0154.483] lstrlenW (lpString=".efd") returned 4
	[0154.483] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".elf") returned 4
	[0154.483] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".emf") returned 4
	[0154.483] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".emz") returned 4
	[0154.483] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".epf") returned 4
	[0154.483] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".eps") returned 4
	[0154.483] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".epsf") returned 5
	[0154.483] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0154.483] lstrlenW (lpString=".epsp") returned 5
	[0154.483] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0154.483] lstrlenW (lpString=".erf") returned 4
	[0154.483] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0154.483] lstrlenW (lpString=".exr") returned 4
	[0154.484] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".f4v") returned 4
	[0154.484] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".fido") returned 5
	[0154.484] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0154.484] lstrlenW (lpString=".flm") returned 4
	[0154.484] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".flv") returned 4
	[0154.484] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".frm") returned 4
	[0154.484] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".fxg") returned 4
	[0154.484] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".geo") returned 4
	[0154.484] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".gif") returned 4
	[0154.484] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".grs") returned 4
	[0154.484] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".gz") returned 3
	[0154.484] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0154.484] lstrlenW (lpString=".h") returned 2
	[0154.484] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0154.484] lstrlenW (lpString=".hdr") returned 4
	[0154.484] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".hpp") returned 4
	[0154.484] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".hta") returned 4
	[0154.484] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".htc") returned 4
	[0154.484] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0154.484] lstrlenW (lpString=".htm") returned 4
	[0154.485] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".html") returned 5
	[0154.485] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0154.485] lstrlenW (lpString=".icb") returned 4
	[0154.485] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".ics") returned 4
	[0154.485] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".iff") returned 4
	[0154.485] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".inc") returned 4
	[0154.485] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".indd") returned 5
	[0154.485] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0154.485] lstrlenW (lpString=".ini") returned 4
	[0154.485] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".iqy") returned 4
	[0154.485] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".j2c") returned 4
	[0154.485] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".j2k") returned 4
	[0154.485] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".java") returned 5
	[0154.485] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0154.485] lstrlenW (lpString=".jp2") returned 4
	[0154.485] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".jpc") returned 4
	[0154.485] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".jpe") returned 4
	[0154.485] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0154.485] lstrlenW (lpString=".jpeg") returned 5
	[0154.485] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0154.485] lstrlenW (lpString=".jpf") returned 4
	[0154.485] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".jpg") returned 4
	[0154.486] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".jpx") returned 4
	[0154.486] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".js") returned 3
	[0154.486] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0154.486] lstrlenW (lpString=".jsf") returned 4
	[0154.486] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".json") returned 5
	[0154.486] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0154.486] lstrlenW (lpString=".jsp") returned 4
	[0154.486] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".kdc") returned 4
	[0154.486] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".kmz") returned 4
	[0154.486] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".kwm") returned 4
	[0154.486] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".lasso") returned 6
	[0154.486] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0154.486] lstrlenW (lpString=".lbi") returned 4
	[0154.486] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".lgf") returned 4
	[0154.486] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".lgp") returned 4
	[0154.486] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".log") returned 4
	[0154.486] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".m1v") returned 4
	[0154.486] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".m4a") returned 4
	[0154.486] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0154.486] lstrlenW (lpString=".m4v") returned 4
	[0154.487] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".max") returned 4
	[0154.487] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".md") returned 3
	[0154.487] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0154.487] lstrlenW (lpString=".mda") returned 4
	[0154.487] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".mdb") returned 4
	[0154.487] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".mde") returned 4
	[0154.487] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".mdf") returned 4
	[0154.487] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".mdw") returned 4
	[0154.487] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".mef") returned 4
	[0154.487] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".mft") returned 4
	[0154.487] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".mfw") returned 4
	[0154.487] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".mht") returned 4
	[0154.487] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".mhtml") returned 6
	[0154.487] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0154.487] lstrlenW (lpString=".mka") returned 4
	[0154.487] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".mkidx") returned 6
	[0154.487] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0154.487] lstrlenW (lpString=".mkv") returned 4
	[0154.487] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0154.487] lstrlenW (lpString=".mos") returned 4
	[0154.488] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".mov") returned 4
	[0154.488] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".mp3") returned 4
	[0154.488] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".mp4") returned 4
	[0154.488] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".mpeg") returned 5
	[0154.488] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0154.488] lstrlenW (lpString=".mpg") returned 4
	[0154.488] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".mpv") returned 4
	[0154.488] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".mrw") returned 4
	[0154.488] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".msg") returned 4
	[0154.488] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".mxl") returned 4
	[0154.488] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".myd") returned 4
	[0154.488] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".myi") returned 4
	[0154.488] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".nef") returned 4
	[0154.488] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".nrw") returned 4
	[0154.488] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".obj") returned 4
	[0154.488] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0154.488] lstrlenW (lpString=".odb") returned 4
	[0154.488] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".odc") returned 4
	[0154.489] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".odm") returned 4
	[0154.489] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".odp") returned 4
	[0154.489] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".ods") returned 4
	[0154.489] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".oft") returned 4
	[0154.489] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".one") returned 4
	[0154.489] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".onepkg") returned 7
	[0154.489] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0154.489] lstrlenW (lpString=".onetoc2") returned 8
	[0154.489] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0154.489] lstrlenW (lpString=".opt") returned 4
	[0154.489] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".oqy") returned 4
	[0154.489] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".orf") returned 4
	[0154.489] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".p12") returned 4
	[0154.489] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".p7b") returned 4
	[0154.489] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0154.489] lstrlenW (lpString=".p7c") returned 4
	[0154.489] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pam") returned 4
	[0154.490] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pbm") returned 4
	[0154.490] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pct") returned 4
	[0154.490] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pcx") returned 4
	[0154.490] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pdd") returned 4
	[0154.490] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pdf") returned 4
	[0154.490] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pdp") returned 4
	[0154.490] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pef") returned 4
	[0154.490] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pem") returned 4
	[0154.490] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pff") returned 4
	[0154.490] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pfm") returned 4
	[0154.490] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pfx") returned 4
	[0154.490] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".pgm") returned 4
	[0154.490] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".php") returned 4
	[0154.490] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0154.490] lstrlenW (lpString=".php3") returned 5
	[0154.490] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0154.490] lstrlenW (lpString=".php4") returned 5
	[0154.490] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0154.490] lstrlenW (lpString=".php5") returned 5
	[0154.491] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0154.491] lstrlenW (lpString=".phtml") returned 6
	[0154.491] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0154.491] lstrlenW (lpString=".pict") returned 5
	[0154.491] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0154.491] lstrlenW (lpString=".pl") returned 3
	[0154.491] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0154.491] lstrlenW (lpString=".pls") returned 4
	[0154.491] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0154.491] lstrlenW (lpString=".pm") returned 3
	[0154.491] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0154.491] lstrlenW (lpString=".png") returned 4
	[0154.491] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0154.491] lstrlenW (lpString=".pnm") returned 4
	[0154.491] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0154.491] lstrlenW (lpString=".pot") returned 4
	[0154.491] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0154.491] lstrlenW (lpString=".potm") returned 5
	[0154.491] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0154.491] lstrlenW (lpString=".potx") returned 5
	[0154.491] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0154.491] lstrlenW (lpString=".ppa") returned 4
	[0154.491] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0154.491] lstrlenW (lpString=".ppam") returned 5
	[0154.491] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0154.491] lstrlenW (lpString=".ppm") returned 4
	[0154.491] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0154.491] lstrlenW (lpString=".pps") returned 4
	[0154.491] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0154.491] lstrlenW (lpString=".ppsm") returned 5
	[0154.491] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0154.491] lstrlenW (lpString=".ppt") returned 4
	[0154.491] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".pptm") returned 5
	[0154.492] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0154.492] lstrlenW (lpString=".pptx") returned 5
	[0154.492] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0154.492] lstrlenW (lpString=".prn") returned 4
	[0154.492] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".ps") returned 3
	[0154.492] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0154.492] lstrlenW (lpString=".psb") returned 4
	[0154.492] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".psd") returned 4
	[0154.492] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".pst") returned 4
	[0154.492] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".ptx") returned 4
	[0154.492] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".pub") returned 4
	[0154.492] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".pwm") returned 4
	[0154.492] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".pxr") returned 4
	[0154.492] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".py") returned 3
	[0154.492] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0154.492] lstrlenW (lpString=".qt") returned 3
	[0154.492] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0154.492] lstrlenW (lpString=".r3d") returned 4
	[0154.492] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".raf") returned 4
	[0154.492] lstrcmpiW (lpString1=".raf", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".rar") returned 4
	[0154.492] lstrcmpiW (lpString1=".rar", lpString2="oney") returned -1
	[0154.492] lstrlenW (lpString=".raw") returned 4
	[0154.492] lstrcmpiW (lpString1=".raw", lpString2="oney") returned -1
	[0154.493] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8b7402a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8b7402a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ba3ef8, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.493] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8ca52be, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8ca52be, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ca52be, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.493] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8ca52be, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8ca52be, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ca52be, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.493] FindClose (in: hFindFile=0x3e70c70 | out: hFindFile=0x3e70c70) returned 1
	[0154.494] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.494] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8bc0527, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8bc0527, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1029", cAlternateFileName="")) returned 1
	[0154.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.494] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8bc0527, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8bc0527, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70b30
	[0154.494] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8bc0527, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8bc0527, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.494] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8b7402a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8b7402a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8ba3ef8, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.495] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8bc0527, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8bc0527, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8bc0527, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.495] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd924ef58, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd924ef58, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9274e6a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.495] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd924ef58, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd924ef58, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9274e6a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.495] FindClose (in: hFindFile=0x3e70b30 | out: hFindFile=0x3e70b30) returned 1
	[0154.496] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.496] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c32d6d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1030", cAlternateFileName="")) returned 1
	[0154.496] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.496] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c32d6d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70cf0
	[0154.496] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c32d6d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.497] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c32d6d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c32d6d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.497] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c0c941, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c0c941, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9143c0c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.497] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9274e6a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9274e6a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9274e6a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.497] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9274e6a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9274e6a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9274e6a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.497] FindClose (in: hFindFile=0x3e70cf0 | out: hFindFile=0x3e70cf0) returned 1
	[0154.498] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.498] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c7f0c4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1031", cAlternateFileName="")) returned 1
	[0154.498] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.498] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c7f0c4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70e30
	[0154.499] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd8c7f0c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c7f0c4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.499] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c32d6d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c32d6d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c58e7d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.499] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd8c58e7d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd8c58e7d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd8c58e7d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.499] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd929b3c8, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd929b3c8, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd929b3c8, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.499] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd929b3c8, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd929b3c8, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd929b3c8, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.499] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0154.500] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.500] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd90d1785, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd90d1785, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1032", cAlternateFileName="")) returned 1
	[0154.500] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.500] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd90d1785, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd90d1785, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70f70
	[0154.501] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd90d1785, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd90d1785, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.501] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd90ab659, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd90ab659, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd90ab659, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.501] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd90d1785, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd90d1785, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd90d1785, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.501] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd94d7644, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd94d7644, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd94fd7fa, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.501] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd94d7644, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd94d7644, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd94fd7fa, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.501] FindClose (in: hFindFile=0x3e70f70 | out: hFindFile=0x3e70f70) returned 1
	[0154.502] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.502] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9143c0c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9143c0c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1033", cAlternateFileName="")) returned 1
	[0154.502] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.502] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9143c0c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9143c0c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70eb0
	[0154.503] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9143c0c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9143c0c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.503] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd90f7ae6, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd90f7ae6, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd911dc06, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.503] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd911dc06, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd911dc06, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd911dc06, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.503] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd94fd7fa, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd94fd7fa, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd985369f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.503] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd94fd7fa, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd94fd7fa, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd985369f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.503] FindClose (in: hFindFile=0x3e70eb0 | out: hFindFile=0x3e70eb0) returned 1
	[0154.504] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.504] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd95e30ce, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd95e30ce, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1035", cAlternateFileName="")) returned 1
	[0154.504] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.504] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd95e30ce, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd95e30ce, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70f30
	[0154.505] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd95e30ce, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd95e30ce, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.505] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd95c9487, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd95c9487, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd95d5a18, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.505] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd95e30ce, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd95e30ce, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd95e30ce, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.505] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd985369f, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd985369f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd985369f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.505] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd985369f, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd985369f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd985369f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.505] FindClose (in: hFindFile=0x3e70f30 | out: hFindFile=0x3e70f30) returned 1
	[0154.506] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.506] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1036", cAlternateFileName="")) returned 1
	[0154.506] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.506] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70eb0
	[0154.507] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.507] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd960976b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd960976b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.507] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd960976b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd960976b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd99120d4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.507] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd98798c0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd98798c0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd98798c0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.507] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd98798c0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd98798c0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd98798c0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.507] FindClose (in: hFindFile=0x3e70eb0 | out: hFindFile=0x3e70eb0) returned 1
	[0154.508] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.508] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e6f59b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e6f59b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1037", cAlternateFileName="")) returned 1
	[0154.508] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.508] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e6f59b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e6f59b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70bf0
	[0154.509] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e6f59b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e6f59b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.509] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d18114, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d18114, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e493d9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.509] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d18114, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d18114, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d3e206, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.509] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e493d9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e493d9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e493d9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.509] FindNextFileW (in: hFindFile=0x3e70bf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e493d9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e493d9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e493d9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.509] FindClose (in: hFindFile=0x3e70bf0 | out: hFindFile=0x3e70bf0) returned 1
	[0154.510] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.510] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a433e3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a433e3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1038", cAlternateFileName="")) returned 1
	[0154.510] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.510] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a433e3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a433e3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70cf0
	[0154.511] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a433e3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a433e3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.511] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd99d0df5, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd99d0df5, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a1d1bf, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.511] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a1d1bf, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a1d1bf, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a433e3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.511] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9fc6ae2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9fc6ae2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fc6ae2, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.511] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9fc6ae2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9fc6ae2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fc6ae2, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.511] FindClose (in: hFindFile=0x3e70cf0 | out: hFindFile=0x3e70cf0) returned 1
	[0154.512] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.512] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a8faca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a8faca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1040", cAlternateFileName="")) returned 1
	[0154.512] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.512] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a8faca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a8faca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e709b0
	[0154.513] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9a8faca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a8faca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.513] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a433e3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a433e3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a6964c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.513] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a433e3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a433e3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a6964c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.513] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda418e98, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda418e98, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda43f0d0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.513] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda418e98, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda418e98, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda43f0d0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.513] FindClose (in: hFindFile=0x3e709b0 | out: hFindFile=0x3e709b0) returned 1
	[0154.514] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.514] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9fecd0a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fecd0a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1041", cAlternateFileName="")) returned 1
	[0154.514] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.514] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9fecd0a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fecd0a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70db0
	[0154.515] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9fecd0a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fecd0a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.515] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a6964c, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a6964c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9a8faca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.515] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9a8faca, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9a8faca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9fecd0a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.515] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda43f0d0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda43f0d0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda43f0d0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.515] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda43f0d0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda43f0d0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda43f0d0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.515] FindClose (in: hFindFile=0x3e70db0 | out: hFindFile=0x3e70db0) returned 1
	[0154.516] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.516] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9adbde1, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9adbde1, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1042", cAlternateFileName="")) returned 1
	[0154.516] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.516] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9adbde1, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9adbde1, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70db0
	[0154.647] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9adbde1, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9adbde1, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.647] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9ab5b33, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9ab5b33, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9ab5b33, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.647] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9ab5b33, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9ab5b33, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9adbde1, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.647] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda4656d3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda4656d3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda4656d3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.647] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda4656d3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda4656d3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda4656d3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.647] FindClose (in: hFindFile=0x3e70db0 | out: hFindFile=0x3e70db0) returned 1
	[0154.647] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.647] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9d8a7e4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d8a7e4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1043", cAlternateFileName="")) returned 1
	[0154.647] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.647] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9d8a7e4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d8a7e4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70f70
	[0154.649] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9d8a7e4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d8a7e4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.649] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d64483, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d64483, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d8a7e4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.649] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d3e206, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d3e206, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9d64483, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.649] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda4656d3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda4656d3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda4656d3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.649] FindNextFileW (in: hFindFile=0x3e70f70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda4656d3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda4656d3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda4656d3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.649] FindClose (in: hFindFile=0x3e70f70 | out: hFindFile=0x3e70f70) returned 1
	[0154.650] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.650] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dd6d2c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dd6d2c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1044", cAlternateFileName="")) returned 1
	[0154.650] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.650] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dd6d2c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dd6d2c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70a70
	[0154.652] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dd6d2c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dd6d2c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.652] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d8a7e4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d8a7e4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9db0b47, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.652] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9d8a7e4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9d8a7e4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9db0b47, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.652] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa0edc9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa0edc9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa815e2, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.652] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa0edc9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa0edc9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa815e2, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.652] FindClose (in: hFindFile=0x3e70a70 | out: hFindFile=0x3e70a70) returned 1
	[0154.653] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.653] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dfcfe0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dfcfe0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1045", cAlternateFileName="")) returned 1
	[0154.653] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.653] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dfcfe0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dfcfe0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70eb0
	[0154.655] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9dfcfe0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dfcfe0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.656] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9db0b47, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9db0b47, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dfcfe0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.656] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9dd6d2c, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9dd6d2c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dd6d2c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.656] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda48b6e0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda48b6e0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5bcb62, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.656] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda48b6e0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda48b6e0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5bcb62, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.656] FindClose (in: hFindFile=0x3e70eb0 | out: hFindFile=0x3e70eb0) returned 1
	[0154.657] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.657] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e2309f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e2309f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1046", cAlternateFileName="")) returned 1
	[0154.657] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.657] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e2309f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e2309f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70f30
	[0154.659] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9e2309f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e2309f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.659] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9dfcfe0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9dfcfe0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9dfcfe0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.659] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e2309f, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e2309f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e2309f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.659] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5bcb62, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5bcb62, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5bcb62, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.659] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5bcb62, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5bcb62, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5bcb62, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.659] FindClose (in: hFindFile=0x3e70f30 | out: hFindFile=0x3e70f30) returned 1
	[0154.660] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.660] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f2e3fb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f2e3fb, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1049", cAlternateFileName="")) returned 1
	[0154.660] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.660] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f2e3fb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f2e3fb, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70e30
	[0154.662] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f2e3fb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f2e3fb, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.662] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e493d9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e493d9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f07f1e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.662] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e6f59b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e6f59b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e6f59b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.662] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5e2aef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5e2aef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5e2aef, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.662] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5e2aef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5e2aef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda5e2aef, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.662] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0154.663] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.663] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda275802, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda275802, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1053", cAlternateFileName="")) returned 1
	[0154.663] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.663] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda275802, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda275802, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70a70
	[0154.665] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda275802, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda275802, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.665] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e957fd, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e957fd, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9e957fd, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.665] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9e957fd, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9e957fd, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda275802, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.665] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5e2aef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5e2aef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda608fd0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.665] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda5e2aef, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda5e2aef, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda608fd0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.665] FindClose (in: hFindFile=0x3e70a70 | out: hFindFile=0x3e70a70) returned 1
	[0154.667] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.667] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f54614, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f54614, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="1055", cAlternateFileName="")) returned 1
	[0154.667] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.668] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f54614, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f54614, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e71030
	[0154.670] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xd9f54614, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f54614, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.670] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9f2e3fb, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9f2e3fb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f2e3fb, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.670] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9f2e3fb, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9f2e3fb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd9f54614, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.670] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda608fd0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda608fd0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaaa765b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.670] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda608fd0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda608fd0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaaa765b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.670] FindClose (in: hFindFile=0x3e71030 | out: hFindFile=0x3e71030) returned 1
	[0154.671] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.671] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda334073, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda334073, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="2052", cAlternateFileName="")) returned 1
	[0154.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.671] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda334073, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda334073, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e71030
	[0154.673] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda334073, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda334073, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.673] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd9f54614, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xd9f54614, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2e7e05, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.673] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda30deac, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda334073, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.673] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda950364, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda950364, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda950364, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.673] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda950364, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda950364, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda950364, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.673] FindClose (in: hFindFile=0x3e71030 | out: hFindFile=0x3e71030) returned 1
	[0154.674] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.674] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda22a896, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda22a896, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="2070", cAlternateFileName="")) returned 1
	[0154.674] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.674] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda22a896, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda22a896, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70e30
	[0154.675] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda22a896, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda22a896, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.675] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda1dccce, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda1dccce, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda202e2f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.675] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda202e2f, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda202e2f, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda202e2f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.675] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda97642e, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda97642e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda97642e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.676] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda97642e, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda97642e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda97642e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.676] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0154.676] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.676] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda29b80c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda29b80c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="3076", cAlternateFileName="")) returned 1
	[0154.676] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.677] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda29b80c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda29b80c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e709b0
	[0154.678] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda29b80c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda29b80c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.678] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda22a896, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda22a896, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda22a896, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.678] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda275802, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda275802, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda29b80c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.678] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda97642e, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda97642e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda97642e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.678] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda97642e, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda97642e, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda97642e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.678] FindClose (in: hFindFile=0x3e709b0 | out: hFindFile=0x3e709b0) returned 1
	[0154.679] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.679] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda2c19df, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2c19df, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="3082", cAlternateFileName="")) returned 1
	[0154.679] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.679] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda2c19df, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2c19df, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70ab0
	[0154.681] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda2c19df, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2c19df, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.681] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda29b80c, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda29b80c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2c19df, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="eula.rtf.id-B4197730.[admin@stex777.com].money", cAlternateFileName="EULART~1.MON")) returned 1
	[0154.681] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda76053d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda76053d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda76053d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="LocalizedData.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="LOCALI~1.MON")) returned 1
	[0154.681] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda99c5ca, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda99c5ca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda99c5ca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 1
	[0154.681] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda99c5ca, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda99c5ca, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda99c5ca, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SetupResources.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPR~1.MON")) returned 0
	[0154.681] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0154.682] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.682] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda30deac, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Client", cAlternateFileName="")) returned 1
	[0154.682] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.682] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda30deac, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70d30
	[0154.877] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda30deac, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.881] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda2e7e05, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda2e7e05, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda2e7e05, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Parameterinfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARAME~1.MON")) returned 1
	[0154.889] lstrlenW (lpString="Parameterinfo.xml.id-B4197730.[admin@stex777.com].money") returned 55
	[0154.889] lstrlenW (lpString=".1cd") returned 4
	[0154.890] lstrcmpiW (lpString1=".1cd", lpString2="oney") returned -1
	[0154.890] lstrlenW (lpString=".3ds") returned 4
	[0154.890] lstrcmpiW (lpString1=".3ds", lpString2="oney") returned -1
	[0154.890] lstrlenW (lpString=".3fr") returned 4
	[0154.907] lstrcmpiW (lpString1=".3fr", lpString2="oney") returned -1
	[0154.907] lstrlenW (lpString=".3g2") returned 4
	[0154.908] lstrcmpiW (lpString1=".3g2", lpString2="oney") returned -1
	[0154.908] lstrlenW (lpString=".3gp") returned 4
	[0154.908] lstrcmpiW (lpString1=".3gp", lpString2="oney") returned -1
	[0154.908] lstrlenW (lpString=".7z") returned 3
	[0154.908] lstrcmpiW (lpString1=".7z", lpString2="ney") returned -1
	[0154.908] lstrlenW (lpString=".accda") returned 6
	[0154.908] lstrcmpiW (lpString1=".accda", lpString2=".money") returned -1
	[0154.908] lstrlenW (lpString=".accdb") returned 6
	[0154.908] lstrcmpiW (lpString1=".accdb", lpString2=".money") returned -1
	[0154.908] lstrlenW (lpString=".accdc") returned 6
	[0154.908] lstrcmpiW (lpString1=".accdc", lpString2=".money") returned -1
	[0154.908] lstrlenW (lpString=".accde") returned 6
	[0154.908] lstrcmpiW (lpString1=".accde", lpString2=".money") returned -1
	[0154.908] lstrlenW (lpString=".accdt") returned 6
	[0154.908] lstrcmpiW (lpString1=".accdt", lpString2=".money") returned -1
	[0154.908] lstrlenW (lpString=".accdw") returned 6
	[0154.908] lstrcmpiW (lpString1=".accdw", lpString2=".money") returned -1
	[0154.908] lstrlenW (lpString=".adb") returned 4
	[0154.908] lstrcmpiW (lpString1=".adb", lpString2="oney") returned -1
	[0154.908] lstrlenW (lpString=".adp") returned 4
	[0154.908] lstrcmpiW (lpString1=".adp", lpString2="oney") returned -1
	[0154.908] lstrlenW (lpString=".ai") returned 3
	[0154.908] lstrcmpiW (lpString1=".ai", lpString2="ney") returned -1
	[0154.908] lstrlenW (lpString=".ai3") returned 4
	[0154.908] lstrcmpiW (lpString1=".ai3", lpString2="oney") returned -1
	[0154.908] lstrlenW (lpString=".ai4") returned 4
	[0154.908] lstrcmpiW (lpString1=".ai4", lpString2="oney") returned -1
	[0154.908] lstrlenW (lpString=".ai5") returned 4
	[0154.908] lstrcmpiW (lpString1=".ai5", lpString2="oney") returned -1
	[0154.908] lstrlenW (lpString=".ai6") returned 4
	[0154.908] lstrcmpiW (lpString1=".ai6", lpString2="oney") returned -1
	[0154.908] lstrlenW (lpString=".ai7") returned 4
	[0154.909] lstrcmpiW (lpString1=".ai7", lpString2="oney") returned -1
	[0154.909] lstrlenW (lpString=".ai8") returned 4
	[0154.909] lstrcmpiW (lpString1=".ai8", lpString2="oney") returned -1
	[0154.909] lstrlenW (lpString=".anim") returned 5
	[0154.909] lstrcmpiW (lpString1=".anim", lpString2="money") returned -1
	[0154.909] lstrlenW (lpString=".arw") returned 4
	[0154.909] lstrcmpiW (lpString1=".arw", lpString2="oney") returned -1
	[0154.909] lstrlenW (lpString=".as") returned 3
	[0154.909] lstrcmpiW (lpString1=".as", lpString2="ney") returned -1
	[0154.909] lstrlenW (lpString=".asa") returned 4
	[0154.909] lstrcmpiW (lpString1=".asa", lpString2="oney") returned -1
	[0154.909] lstrlenW (lpString=".asc") returned 4
	[0154.909] lstrcmpiW (lpString1=".asc", lpString2="oney") returned -1
	[0154.909] lstrlenW (lpString=".ascx") returned 5
	[0154.909] lstrcmpiW (lpString1=".ascx", lpString2="money") returned -1
	[0154.909] lstrlenW (lpString=".asm") returned 4
	[0154.909] lstrcmpiW (lpString1=".asm", lpString2="oney") returned -1
	[0154.909] lstrlenW (lpString=".asmx") returned 5
	[0154.909] lstrcmpiW (lpString1=".asmx", lpString2="money") returned -1
	[0154.909] lstrlenW (lpString=".asp") returned 4
	[0154.909] lstrcmpiW (lpString1=".asp", lpString2="oney") returned -1
	[0154.909] lstrlenW (lpString=".aspx") returned 5
	[0154.909] lstrcmpiW (lpString1=".aspx", lpString2="money") returned -1
	[0154.909] lstrlenW (lpString=".asr") returned 4
	[0154.909] lstrcmpiW (lpString1=".asr", lpString2="oney") returned -1
	[0154.909] lstrlenW (lpString=".asx") returned 4
	[0154.909] lstrcmpiW (lpString1=".asx", lpString2="oney") returned -1
	[0154.909] lstrlenW (lpString=".avi") returned 4
	[0154.909] lstrcmpiW (lpString1=".avi", lpString2="oney") returned -1
	[0154.909] lstrlenW (lpString=".avs") returned 4
	[0154.909] lstrcmpiW (lpString1=".avs", lpString2="oney") returned -1
	[0154.909] lstrlenW (lpString=".backup") returned 7
	[0154.909] lstrcmpiW (lpString1=".backup", lpString2="].money") returned -1
	[0154.910] lstrlenW (lpString=".bak") returned 4
	[0154.910] lstrcmpiW (lpString1=".bak", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".bay") returned 4
	[0154.910] lstrcmpiW (lpString1=".bay", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".bd") returned 3
	[0154.910] lstrcmpiW (lpString1=".bd", lpString2="ney") returned -1
	[0154.910] lstrlenW (lpString=".bin") returned 4
	[0154.910] lstrcmpiW (lpString1=".bin", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".bmp") returned 4
	[0154.910] lstrcmpiW (lpString1=".bmp", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".bz2") returned 4
	[0154.910] lstrcmpiW (lpString1=".bz2", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".c") returned 2
	[0154.910] lstrcmpiW (lpString1=".c", lpString2="ey") returned -1
	[0154.910] lstrlenW (lpString=".cdr") returned 4
	[0154.910] lstrcmpiW (lpString1=".cdr", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".cer") returned 4
	[0154.910] lstrcmpiW (lpString1=".cer", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".cf") returned 3
	[0154.910] lstrcmpiW (lpString1=".cf", lpString2="ney") returned -1
	[0154.910] lstrlenW (lpString=".cfc") returned 4
	[0154.910] lstrcmpiW (lpString1=".cfc", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".cfm") returned 4
	[0154.910] lstrcmpiW (lpString1=".cfm", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".cfml") returned 5
	[0154.910] lstrcmpiW (lpString1=".cfml", lpString2="money") returned -1
	[0154.910] lstrlenW (lpString=".cfu") returned 4
	[0154.910] lstrcmpiW (lpString1=".cfu", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".chm") returned 4
	[0154.910] lstrcmpiW (lpString1=".chm", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".cin") returned 4
	[0154.910] lstrcmpiW (lpString1=".cin", lpString2="oney") returned -1
	[0154.910] lstrlenW (lpString=".class") returned 6
	[0154.911] lstrcmpiW (lpString1=".class", lpString2=".money") returned -1
	[0154.911] lstrlenW (lpString=".clx") returned 4
	[0154.911] lstrcmpiW (lpString1=".clx", lpString2="oney") returned -1
	[0154.911] lstrlenW (lpString=".config") returned 7
	[0154.911] lstrcmpiW (lpString1=".config", lpString2="].money") returned -1
	[0154.911] lstrlenW (lpString=".cpp") returned 4
	[0154.911] lstrcmpiW (lpString1=".cpp", lpString2="oney") returned -1
	[0154.911] lstrlenW (lpString=".cr2") returned 4
	[0154.911] lstrcmpiW (lpString1=".cr2", lpString2="oney") returned -1
	[0154.911] lstrlenW (lpString=".crt") returned 4
	[0154.911] lstrcmpiW (lpString1=".crt", lpString2="oney") returned -1
	[0154.911] lstrlenW (lpString=".crw") returned 4
	[0154.911] lstrcmpiW (lpString1=".crw", lpString2="oney") returned -1
	[0154.911] lstrlenW (lpString=".cs") returned 3
	[0154.911] lstrcmpiW (lpString1=".cs", lpString2="ney") returned -1
	[0154.911] lstrlenW (lpString=".css") returned 4
	[0154.911] lstrcmpiW (lpString1=".css", lpString2="oney") returned -1
	[0154.911] lstrlenW (lpString=".csv") returned 4
	[0154.911] lstrcmpiW (lpString1=".csv", lpString2="oney") returned -1
	[0154.911] lstrlenW (lpString=".cub") returned 4
	[0154.911] lstrcmpiW (lpString1=".cub", lpString2="oney") returned -1
	[0154.911] lstrlenW (lpString=".dae") returned 4
	[0154.911] lstrcmpiW (lpString1=".dae", lpString2="oney") returned -1
	[0154.911] lstrlenW (lpString=".dat") returned 4
	[0154.911] lstrcmpiW (lpString1=".dat", lpString2="oney") returned -1
	[0154.911] lstrlenW (lpString=".db") returned 3
	[0154.911] lstrcmpiW (lpString1=".db", lpString2="ney") returned -1
	[0154.911] lstrlenW (lpString=".dbf") returned 4
	[0154.911] lstrcmpiW (lpString1=".dbf", lpString2="oney") returned -1
	[0154.911] lstrlenW (lpString=".dbx") returned 4
	[0154.912] lstrcmpiW (lpString1=".dbx", lpString2="oney") returned -1
	[0154.912] lstrlenW (lpString=".dc3") returned 4
	[0154.912] lstrcmpiW (lpString1=".dc3", lpString2="oney") returned -1
	[0154.912] lstrlenW (lpString=".dcm") returned 4
	[0154.912] lstrcmpiW (lpString1=".dcm", lpString2="oney") returned -1
	[0154.912] lstrlenW (lpString=".dcr") returned 4
	[0154.912] lstrcmpiW (lpString1=".dcr", lpString2="oney") returned -1
	[0154.912] lstrlenW (lpString=".der") returned 4
	[0154.912] lstrcmpiW (lpString1=".der", lpString2="oney") returned -1
	[0154.912] lstrlenW (lpString=".dib") returned 4
	[0154.912] lstrcmpiW (lpString1=".dib", lpString2="oney") returned -1
	[0154.912] lstrlenW (lpString=".dic") returned 4
	[0154.912] lstrcmpiW (lpString1=".dic", lpString2="oney") returned -1
	[0154.912] lstrlenW (lpString=".dif") returned 4
	[0154.912] lstrcmpiW (lpString1=".dif", lpString2="oney") returned -1
	[0154.912] lstrlenW (lpString=".divx") returned 5
	[0154.912] lstrcmpiW (lpString1=".divx", lpString2="money") returned -1
	[0154.912] lstrlenW (lpString=".djvu") returned 5
	[0154.912] lstrcmpiW (lpString1=".djvu", lpString2="money") returned -1
	[0154.912] lstrlenW (lpString=".dng") returned 4
	[0154.912] lstrcmpiW (lpString1=".dng", lpString2="oney") returned -1
	[0154.912] lstrlenW (lpString=".doc") returned 4
	[0154.912] lstrcmpiW (lpString1=".doc", lpString2="oney") returned -1
	[0154.912] lstrlenW (lpString=".docm") returned 5
	[0154.912] lstrcmpiW (lpString1=".docm", lpString2="money") returned -1
	[0154.912] lstrlenW (lpString=".docx") returned 5
	[0154.912] lstrcmpiW (lpString1=".docx", lpString2="money") returned -1
	[0154.912] lstrlenW (lpString=".dot") returned 4
	[0154.912] lstrcmpiW (lpString1=".dot", lpString2="oney") returned -1
	[0154.912] lstrlenW (lpString=".dotm") returned 5
	[0154.912] lstrcmpiW (lpString1=".dotm", lpString2="money") returned -1
	[0154.912] lstrlenW (lpString=".dotx") returned 5
	[0154.913] lstrcmpiW (lpString1=".dotx", lpString2="money") returned -1
	[0154.913] lstrlenW (lpString=".dpx") returned 4
	[0154.913] lstrcmpiW (lpString1=".dpx", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".dqy") returned 4
	[0154.913] lstrcmpiW (lpString1=".dqy", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".dsn") returned 4
	[0154.913] lstrcmpiW (lpString1=".dsn", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".dt") returned 3
	[0154.913] lstrcmpiW (lpString1=".dt", lpString2="ney") returned -1
	[0154.913] lstrlenW (lpString=".dtd") returned 4
	[0154.913] lstrcmpiW (lpString1=".dtd", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".dwg") returned 4
	[0154.913] lstrcmpiW (lpString1=".dwg", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".dwt") returned 4
	[0154.913] lstrcmpiW (lpString1=".dwt", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".dx") returned 3
	[0154.913] lstrcmpiW (lpString1=".dx", lpString2="ney") returned -1
	[0154.913] lstrlenW (lpString=".dxf") returned 4
	[0154.913] lstrcmpiW (lpString1=".dxf", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".edml") returned 5
	[0154.913] lstrcmpiW (lpString1=".edml", lpString2="money") returned -1
	[0154.913] lstrlenW (lpString=".efd") returned 4
	[0154.913] lstrcmpiW (lpString1=".efd", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".elf") returned 4
	[0154.913] lstrcmpiW (lpString1=".elf", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".emf") returned 4
	[0154.913] lstrcmpiW (lpString1=".emf", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".emz") returned 4
	[0154.913] lstrcmpiW (lpString1=".emz", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".epf") returned 4
	[0154.913] lstrcmpiW (lpString1=".epf", lpString2="oney") returned -1
	[0154.913] lstrlenW (lpString=".eps") returned 4
	[0154.914] lstrcmpiW (lpString1=".eps", lpString2="oney") returned -1
	[0154.914] lstrlenW (lpString=".epsf") returned 5
	[0154.914] lstrcmpiW (lpString1=".epsf", lpString2="money") returned -1
	[0154.914] lstrlenW (lpString=".epsp") returned 5
	[0154.914] lstrcmpiW (lpString1=".epsp", lpString2="money") returned -1
	[0154.914] lstrlenW (lpString=".erf") returned 4
	[0154.914] lstrcmpiW (lpString1=".erf", lpString2="oney") returned -1
	[0154.914] lstrlenW (lpString=".exr") returned 4
	[0154.914] lstrcmpiW (lpString1=".exr", lpString2="oney") returned -1
	[0154.914] lstrlenW (lpString=".f4v") returned 4
	[0154.914] lstrcmpiW (lpString1=".f4v", lpString2="oney") returned -1
	[0154.914] lstrlenW (lpString=".fido") returned 5
	[0154.914] lstrcmpiW (lpString1=".fido", lpString2="money") returned -1
	[0154.914] lstrlenW (lpString=".flm") returned 4
	[0154.914] lstrcmpiW (lpString1=".flm", lpString2="oney") returned -1
	[0154.914] lstrlenW (lpString=".flv") returned 4
	[0154.914] lstrcmpiW (lpString1=".flv", lpString2="oney") returned -1
	[0154.914] lstrlenW (lpString=".frm") returned 4
	[0154.914] lstrcmpiW (lpString1=".frm", lpString2="oney") returned -1
	[0154.914] lstrlenW (lpString=".fxg") returned 4
	[0154.914] lstrcmpiW (lpString1=".fxg", lpString2="oney") returned -1
	[0154.914] lstrlenW (lpString=".geo") returned 4
	[0154.914] lstrcmpiW (lpString1=".geo", lpString2="oney") returned -1
	[0154.914] lstrlenW (lpString=".gif") returned 4
	[0154.914] lstrcmpiW (lpString1=".gif", lpString2="oney") returned -1
	[0154.914] lstrlenW (lpString=".grs") returned 4
	[0154.914] lstrcmpiW (lpString1=".grs", lpString2="oney") returned -1
	[0154.914] lstrlenW (lpString=".gz") returned 3
	[0154.914] lstrcmpiW (lpString1=".gz", lpString2="ney") returned -1
	[0154.914] lstrlenW (lpString=".h") returned 2
	[0154.914] lstrcmpiW (lpString1=".h", lpString2="ey") returned -1
	[0154.914] lstrlenW (lpString=".hdr") returned 4
	[0154.914] lstrcmpiW (lpString1=".hdr", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".hpp") returned 4
	[0154.915] lstrcmpiW (lpString1=".hpp", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".hta") returned 4
	[0154.915] lstrcmpiW (lpString1=".hta", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".htc") returned 4
	[0154.915] lstrcmpiW (lpString1=".htc", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".htm") returned 4
	[0154.915] lstrcmpiW (lpString1=".htm", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".html") returned 5
	[0154.915] lstrcmpiW (lpString1=".html", lpString2="money") returned -1
	[0154.915] lstrlenW (lpString=".icb") returned 4
	[0154.915] lstrcmpiW (lpString1=".icb", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".ics") returned 4
	[0154.915] lstrcmpiW (lpString1=".ics", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".iff") returned 4
	[0154.915] lstrcmpiW (lpString1=".iff", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".inc") returned 4
	[0154.915] lstrcmpiW (lpString1=".inc", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".indd") returned 5
	[0154.915] lstrcmpiW (lpString1=".indd", lpString2="money") returned -1
	[0154.915] lstrlenW (lpString=".ini") returned 4
	[0154.915] lstrcmpiW (lpString1=".ini", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".iqy") returned 4
	[0154.915] lstrcmpiW (lpString1=".iqy", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".j2c") returned 4
	[0154.915] lstrcmpiW (lpString1=".j2c", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".j2k") returned 4
	[0154.915] lstrcmpiW (lpString1=".j2k", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".java") returned 5
	[0154.915] lstrcmpiW (lpString1=".java", lpString2="money") returned -1
	[0154.915] lstrlenW (lpString=".jp2") returned 4
	[0154.915] lstrcmpiW (lpString1=".jp2", lpString2="oney") returned -1
	[0154.915] lstrlenW (lpString=".jpc") returned 4
	[0154.916] lstrcmpiW (lpString1=".jpc", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".jpe") returned 4
	[0154.916] lstrcmpiW (lpString1=".jpe", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".jpeg") returned 5
	[0154.916] lstrcmpiW (lpString1=".jpeg", lpString2="money") returned -1
	[0154.916] lstrlenW (lpString=".jpf") returned 4
	[0154.916] lstrcmpiW (lpString1=".jpf", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".jpg") returned 4
	[0154.916] lstrcmpiW (lpString1=".jpg", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".jpx") returned 4
	[0154.916] lstrcmpiW (lpString1=".jpx", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".js") returned 3
	[0154.916] lstrcmpiW (lpString1=".js", lpString2="ney") returned -1
	[0154.916] lstrlenW (lpString=".jsf") returned 4
	[0154.916] lstrcmpiW (lpString1=".jsf", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".json") returned 5
	[0154.916] lstrcmpiW (lpString1=".json", lpString2="money") returned -1
	[0154.916] lstrlenW (lpString=".jsp") returned 4
	[0154.916] lstrcmpiW (lpString1=".jsp", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".kdc") returned 4
	[0154.916] lstrcmpiW (lpString1=".kdc", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".kmz") returned 4
	[0154.916] lstrcmpiW (lpString1=".kmz", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".kwm") returned 4
	[0154.916] lstrcmpiW (lpString1=".kwm", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".lasso") returned 6
	[0154.916] lstrcmpiW (lpString1=".lasso", lpString2=".money") returned -1
	[0154.916] lstrlenW (lpString=".lbi") returned 4
	[0154.916] lstrcmpiW (lpString1=".lbi", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".lgf") returned 4
	[0154.916] lstrcmpiW (lpString1=".lgf", lpString2="oney") returned -1
	[0154.916] lstrlenW (lpString=".lgp") returned 4
	[0154.917] lstrcmpiW (lpString1=".lgp", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".log") returned 4
	[0154.917] lstrcmpiW (lpString1=".log", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".m1v") returned 4
	[0154.917] lstrcmpiW (lpString1=".m1v", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".m4a") returned 4
	[0154.917] lstrcmpiW (lpString1=".m4a", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".m4v") returned 4
	[0154.917] lstrcmpiW (lpString1=".m4v", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".max") returned 4
	[0154.917] lstrcmpiW (lpString1=".max", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".md") returned 3
	[0154.917] lstrcmpiW (lpString1=".md", lpString2="ney") returned -1
	[0154.917] lstrlenW (lpString=".mda") returned 4
	[0154.917] lstrcmpiW (lpString1=".mda", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".mdb") returned 4
	[0154.917] lstrcmpiW (lpString1=".mdb", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".mde") returned 4
	[0154.917] lstrcmpiW (lpString1=".mde", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".mdf") returned 4
	[0154.917] lstrcmpiW (lpString1=".mdf", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".mdw") returned 4
	[0154.917] lstrcmpiW (lpString1=".mdw", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".mef") returned 4
	[0154.917] lstrcmpiW (lpString1=".mef", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".mft") returned 4
	[0154.917] lstrcmpiW (lpString1=".mft", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".mfw") returned 4
	[0154.917] lstrcmpiW (lpString1=".mfw", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".mht") returned 4
	[0154.917] lstrcmpiW (lpString1=".mht", lpString2="oney") returned -1
	[0154.917] lstrlenW (lpString=".mhtml") returned 6
	[0154.917] lstrcmpiW (lpString1=".mhtml", lpString2=".money") returned -1
	[0154.918] lstrlenW (lpString=".mka") returned 4
	[0154.918] lstrcmpiW (lpString1=".mka", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".mkidx") returned 6
	[0154.918] lstrcmpiW (lpString1=".mkidx", lpString2=".money") returned -1
	[0154.918] lstrlenW (lpString=".mkv") returned 4
	[0154.918] lstrcmpiW (lpString1=".mkv", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".mos") returned 4
	[0154.918] lstrcmpiW (lpString1=".mos", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".mov") returned 4
	[0154.918] lstrcmpiW (lpString1=".mov", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".mp3") returned 4
	[0154.918] lstrcmpiW (lpString1=".mp3", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".mp4") returned 4
	[0154.918] lstrcmpiW (lpString1=".mp4", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".mpeg") returned 5
	[0154.918] lstrcmpiW (lpString1=".mpeg", lpString2="money") returned -1
	[0154.918] lstrlenW (lpString=".mpg") returned 4
	[0154.918] lstrcmpiW (lpString1=".mpg", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".mpv") returned 4
	[0154.918] lstrcmpiW (lpString1=".mpv", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".mrw") returned 4
	[0154.918] lstrcmpiW (lpString1=".mrw", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".msg") returned 4
	[0154.918] lstrcmpiW (lpString1=".msg", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".mxl") returned 4
	[0154.918] lstrcmpiW (lpString1=".mxl", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".myd") returned 4
	[0154.918] lstrcmpiW (lpString1=".myd", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".myi") returned 4
	[0154.918] lstrcmpiW (lpString1=".myi", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".nef") returned 4
	[0154.918] lstrcmpiW (lpString1=".nef", lpString2="oney") returned -1
	[0154.918] lstrlenW (lpString=".nrw") returned 4
	[0154.919] lstrcmpiW (lpString1=".nrw", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".obj") returned 4
	[0154.919] lstrcmpiW (lpString1=".obj", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".odb") returned 4
	[0154.919] lstrcmpiW (lpString1=".odb", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".odc") returned 4
	[0154.919] lstrcmpiW (lpString1=".odc", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".odm") returned 4
	[0154.919] lstrcmpiW (lpString1=".odm", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".odp") returned 4
	[0154.919] lstrcmpiW (lpString1=".odp", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".ods") returned 4
	[0154.919] lstrcmpiW (lpString1=".ods", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".oft") returned 4
	[0154.919] lstrcmpiW (lpString1=".oft", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".one") returned 4
	[0154.919] lstrcmpiW (lpString1=".one", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".onepkg") returned 7
	[0154.919] lstrcmpiW (lpString1=".onepkg", lpString2="].money") returned -1
	[0154.919] lstrlenW (lpString=".onetoc2") returned 8
	[0154.919] lstrcmpiW (lpString1=".onetoc2", lpString2="m].money") returned -1
	[0154.919] lstrlenW (lpString=".opt") returned 4
	[0154.919] lstrcmpiW (lpString1=".opt", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".oqy") returned 4
	[0154.919] lstrcmpiW (lpString1=".oqy", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".orf") returned 4
	[0154.919] lstrcmpiW (lpString1=".orf", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".p12") returned 4
	[0154.919] lstrcmpiW (lpString1=".p12", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".p7b") returned 4
	[0154.919] lstrcmpiW (lpString1=".p7b", lpString2="oney") returned -1
	[0154.919] lstrlenW (lpString=".p7c") returned 4
	[0154.919] lstrcmpiW (lpString1=".p7c", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pam") returned 4
	[0154.920] lstrcmpiW (lpString1=".pam", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pbm") returned 4
	[0154.920] lstrcmpiW (lpString1=".pbm", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pct") returned 4
	[0154.920] lstrcmpiW (lpString1=".pct", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pcx") returned 4
	[0154.920] lstrcmpiW (lpString1=".pcx", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pdd") returned 4
	[0154.920] lstrcmpiW (lpString1=".pdd", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pdf") returned 4
	[0154.920] lstrcmpiW (lpString1=".pdf", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pdp") returned 4
	[0154.920] lstrcmpiW (lpString1=".pdp", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pef") returned 4
	[0154.920] lstrcmpiW (lpString1=".pef", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pem") returned 4
	[0154.920] lstrcmpiW (lpString1=".pem", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pff") returned 4
	[0154.920] lstrcmpiW (lpString1=".pff", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pfm") returned 4
	[0154.920] lstrcmpiW (lpString1=".pfm", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pfx") returned 4
	[0154.920] lstrcmpiW (lpString1=".pfx", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".pgm") returned 4
	[0154.920] lstrcmpiW (lpString1=".pgm", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".php") returned 4
	[0154.920] lstrcmpiW (lpString1=".php", lpString2="oney") returned -1
	[0154.920] lstrlenW (lpString=".php3") returned 5
	[0154.920] lstrcmpiW (lpString1=".php3", lpString2="money") returned -1
	[0154.920] lstrlenW (lpString=".php4") returned 5
	[0154.920] lstrcmpiW (lpString1=".php4", lpString2="money") returned -1
	[0154.920] lstrlenW (lpString=".php5") returned 5
	[0154.921] lstrcmpiW (lpString1=".php5", lpString2="money") returned -1
	[0154.921] lstrlenW (lpString=".phtml") returned 6
	[0154.921] lstrcmpiW (lpString1=".phtml", lpString2=".money") returned 1
	[0154.921] lstrlenW (lpString=".pict") returned 5
	[0154.921] lstrcmpiW (lpString1=".pict", lpString2="money") returned -1
	[0154.921] lstrlenW (lpString=".pl") returned 3
	[0154.921] lstrcmpiW (lpString1=".pl", lpString2="ney") returned -1
	[0154.921] lstrlenW (lpString=".pls") returned 4
	[0154.921] lstrcmpiW (lpString1=".pls", lpString2="oney") returned -1
	[0154.921] lstrlenW (lpString=".pm") returned 3
	[0154.921] lstrcmpiW (lpString1=".pm", lpString2="ney") returned -1
	[0154.921] lstrlenW (lpString=".png") returned 4
	[0154.921] lstrcmpiW (lpString1=".png", lpString2="oney") returned -1
	[0154.921] lstrlenW (lpString=".pnm") returned 4
	[0154.921] lstrcmpiW (lpString1=".pnm", lpString2="oney") returned -1
	[0154.921] lstrlenW (lpString=".pot") returned 4
	[0154.921] lstrcmpiW (lpString1=".pot", lpString2="oney") returned -1
	[0154.921] lstrlenW (lpString=".potm") returned 5
	[0154.921] lstrcmpiW (lpString1=".potm", lpString2="money") returned -1
	[0154.921] lstrlenW (lpString=".potx") returned 5
	[0154.921] lstrcmpiW (lpString1=".potx", lpString2="money") returned -1
	[0154.921] lstrlenW (lpString=".ppa") returned 4
	[0154.921] lstrcmpiW (lpString1=".ppa", lpString2="oney") returned -1
	[0154.921] lstrlenW (lpString=".ppam") returned 5
	[0154.921] lstrcmpiW (lpString1=".ppam", lpString2="money") returned -1
	[0154.921] lstrlenW (lpString=".ppm") returned 4
	[0154.921] lstrcmpiW (lpString1=".ppm", lpString2="oney") returned -1
	[0154.921] lstrlenW (lpString=".pps") returned 4
	[0154.921] lstrcmpiW (lpString1=".pps", lpString2="oney") returned -1
	[0154.921] lstrlenW (lpString=".ppsm") returned 5
	[0154.921] lstrcmpiW (lpString1=".ppsm", lpString2="money") returned -1
	[0154.922] lstrlenW (lpString=".ppt") returned 4
	[0154.922] lstrcmpiW (lpString1=".ppt", lpString2="oney") returned -1
	[0154.922] lstrlenW (lpString=".pptm") returned 5
	[0154.922] lstrcmpiW (lpString1=".pptm", lpString2="money") returned -1
	[0154.922] lstrlenW (lpString=".pptx") returned 5
	[0154.922] lstrcmpiW (lpString1=".pptx", lpString2="money") returned -1
	[0154.922] lstrlenW (lpString=".prn") returned 4
	[0154.922] lstrcmpiW (lpString1=".prn", lpString2="oney") returned -1
	[0154.922] lstrlenW (lpString=".ps") returned 3
	[0154.922] lstrcmpiW (lpString1=".ps", lpString2="ney") returned -1
	[0154.922] lstrlenW (lpString=".psb") returned 4
	[0154.922] lstrcmpiW (lpString1=".psb", lpString2="oney") returned -1
	[0154.922] lstrlenW (lpString=".psd") returned 4
	[0154.922] lstrcmpiW (lpString1=".psd", lpString2="oney") returned -1
	[0154.922] lstrlenW (lpString=".pst") returned 4
	[0154.922] lstrcmpiW (lpString1=".pst", lpString2="oney") returned -1
	[0154.922] lstrlenW (lpString=".ptx") returned 4
	[0154.922] lstrcmpiW (lpString1=".ptx", lpString2="oney") returned -1
	[0154.922] lstrlenW (lpString=".pub") returned 4
	[0154.922] lstrcmpiW (lpString1=".pub", lpString2="oney") returned -1
	[0154.922] lstrlenW (lpString=".pwm") returned 4
	[0154.922] lstrcmpiW (lpString1=".pwm", lpString2="oney") returned -1
	[0154.922] lstrlenW (lpString=".pxr") returned 4
	[0154.922] lstrcmpiW (lpString1=".pxr", lpString2="oney") returned -1
	[0154.922] lstrlenW (lpString=".py") returned 3
	[0154.922] lstrcmpiW (lpString1=".py", lpString2="ney") returned -1
	[0154.922] lstrlenW (lpString=".qt") returned 3
	[0154.922] lstrcmpiW (lpString1=".qt", lpString2="ney") returned -1
	[0154.922] lstrlenW (lpString=".r3d") returned 4
	[0154.922] lstrcmpiW (lpString1=".r3d", lpString2="oney") returned -1
	[0154.922] lstrlenW (lpString=".raf") returned 4
	[0154.923] lstrcmpiW (lpString1=".raf", lpString2="oney") returned -1
	[0154.923] lstrlenW (lpString=".rar") returned 4
	[0154.923] lstrcmpiW (lpString1=".rar", lpString2="oney") returned -1
	[0154.923] lstrlenW (lpString=".raw") returned 4
	[0154.923] lstrcmpiW (lpString1=".raw", lpString2="oney") returned -1
	[0154.923] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda30deac, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7ac959, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="UiInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="UIINFO~1.MON")) returned 1
	[0154.923] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda30deac, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda30deac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7ac959, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="UiInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="UIINFO~1.MON")) returned 0
	[0154.923] FindClose (in: hFindFile=0x3e70d30 | out: hFindFile=0x3e70d30) returned 1
	[0154.924] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.924] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda334073, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda334073, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda334073, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="DHtmlHeader.html.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DHTMLH~1.MON")) returned 1
	[0154.924] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdae611a5, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdae611a5, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdae8746a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="DisplayIcon.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DISPLA~1.MON")) returned 1
	[0154.924] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda81eec4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda81eec4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Extended", cAlternateFileName="")) returned 1
	[0154.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.924] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda81eec4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda81eec4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e70b30
	[0154.925] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xda81eec4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda81eec4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.925] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda35b1c3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda35b1c3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda35b1c3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Parameterinfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARAME~1.MON")) returned 1
	[0154.925] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda3805e2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda3805e2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda89181c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="UiInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="UIINFO~1.MON")) returned 1
	[0154.925] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda3805e2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda3805e2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda89181c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="UiInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="UIINFO~1.MON")) returned 0
	[0154.925] FindClose (in: hFindFile=0x3e70b30 | out: hFindFile=0x3e70b30) returned 1
	[0154.926] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.926] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0154.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0154.926] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName=".", cAlternateFileName="")) returned 0x3e709b0
	[0154.927] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="..", cAlternateFileName="")) returned 1
	[0154.927] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa0edc9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa0edc9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa0edc9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Print.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PRINTI~1.MON")) returned 1
	[0154.927] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa0edc9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa0edc9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa350c3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Rotate1.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="ROTATE~1.MON")) returned 1
	[0154.927] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa350c3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa350c3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa350c3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Rotate2.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="ROTATE~2.MON")) returned 1
	[0154.927] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa815e2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa815e2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaa815e2, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Rotate3.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="ROTATE~3.MON")) returned 1
	[0154.927] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaa815e2, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaa815e2, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaf9248a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Rotate4.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="ROTATE~4.MON")) returned 1
	[0154.928] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaaa765b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaaa765b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaacda84, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Rotate5.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="ROB1B7~1.MON")) returned 1
	[0154.928] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaacda84, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaacda84, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaacda84, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Rotate6.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="RO3937~1.MON")) returned 1
	[0154.928] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaacda84, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaacda84, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaaf3b65, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Rotate7.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="RO591E~1.MON")) returned 1
	[0154.928] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaed3878, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaed3878, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaed3878, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Rotate8.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="RO9DE5~1.MON")) returned 1
	[0154.928] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdae8746a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdae8746a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaead790, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Save.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SAVEIC~1.MON")) returned 1
	[0154.928] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaead790, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaead790, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaead790, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="Setup.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPI~1.MON")) returned 1
	[0154.928] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaed3878, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaed3878, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaed3878, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="stop.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="STOPIC~1.MON")) returned 1
	[0154.928] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaefbd26, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaefbd26, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaefbd26, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SysReqMet.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SYSREQ~1.MON")) returned 1
	[0154.929] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaf1fda9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaf1fda9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdb2caa4d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="SysReqNotMet.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SYSREQ~2.MON")) returned 1
	[0154.929] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaf1fda9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaf1fda9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaf1fda9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="warn.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WARNIC~1.MON")) returned 1
	[0154.929] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdaf1fda9, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdaf1fda9, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaf1fda9, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe7b9, dwReserved1=0xecf, cFileName="warn.ico.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WARNIC~1.MON")) returned 0
	[0154.929] FindClose (in: hFindFile=0x3e709b0 | out: hFindFile=0x3e709b0) returned 1
	[0154.930] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0154.930] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda67b7b7, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda67b7b7, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda6a17a0, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="header.bmp.id-B4197730.[admin@stex777.com].money", cAlternateFileName="HEADER~1.MON")) returned 1
	[0154.930] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xdd13096f, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="netfx_Core.mzz.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NETFX_~1.MON")) returned 1
	[0154.930] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xdbc5405a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="netfx_Core_x64.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NETFX_~2.MON")) returned 1
	[0154.930] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdb1be6cf, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdb1be6cf, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdb5531fc, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="netfx_Core_x86.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NETFX_~3.MON")) returned 1
	[0154.930] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xdd798e9e, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="netfx_Extended.mzz.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NETFX_~4.MON")) returned 1
	[0154.930] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdb97f1b4, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdb97f1b4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdbf4eca5, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="netfx_Extended_x64.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NE0B87~1.MON")) returned 1
	[0154.930] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdbc5405a, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdbc5405a, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdbdf7798, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="netfx_Extended_x86.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="NE563F~1.MON")) returned 1
	[0154.930] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda6a17a0, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda6a17a0, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda6c7b45, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="ParameterInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="PARAME~1.MON")) returned 1
	[0154.931] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdbf9b228, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdbf9b228, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdcb60bf7, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="RGB9RAST_x64.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="RGB9RA~1.MON")) returned 1
	[0154.931] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc1d7516, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdc1d7516, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdc1d7516, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="RGB9Rast_x86.msi.id-B4197730.[admin@stex777.com].money", cAlternateFileName="RGB9RA~2.MON")) returned 1
	[0154.931] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc1d7516, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdc1d7516, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdc1ff6cb, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Setup.exe.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPE~1.MON")) returned 1
	[0154.931] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc1ff6cb, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdc1ff6cb, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdcb3a9ce, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="SetupEngine.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPE~2.MON")) returned 1
	[0154.931] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdcb60bf7, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdcb60bf7, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdcb8744b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="SetupUi.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPU~2.MON")) returned 1
	[0154.931] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda6edc88, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda6edc88, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdaaf3b65, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="SetupUi.xsd.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPU~1.MON")) returned 1
	[0154.931] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdcbae0b1, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdcbae0b1, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdd04b973, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="SetupUtility.exe.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SETUPU~3.MON")) returned 1
	[0154.931] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda7868ac, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda7868ac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7868ac, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="SplashScreen.bmp.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SPLASH~1.MON")) returned 1
	[0154.931] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdcfd94f6, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdcfd94f6, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdcfd94f6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="sqmapi.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="SQMAPI~1.MON")) returned 1
	[0154.932] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda7868ac, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda7868ac, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7868ac, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Strings.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="STRING~1.MON")) returned 1
	[0154.932] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdab1c36b, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdab1c36b, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdab1c36b, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="UiInfo.xml.id-B4197730.[admin@stex777.com].money", cAlternateFileName="UIINFO~1.MON")) returned 1
	[0154.932] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xda7d2c66, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda7d2c66, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7d2c66, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="watermark.bmp.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WATERM~1.MON")) returned 1
	[0154.932] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xde63697c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WINDOW~1.MON")) returned 1
	[0154.932] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xddec302a, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WINDOW~2.MON")) returned 1
	[0154.932] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xde822da6, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WINDOW~3.MON")) returned 1
	[0154.932] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xde5dca31, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WINDOW~4.MON")) returned 1
	[0154.932] FindNextFileW (in: hFindFile=0x4ef250, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xde5dca31, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[admin@stex777.com].money", cAlternateFileName="WINDOW~4.MON")) returned 0
	[0154.933] FindClose (in: hFindFile=0x4ef250 | out: hFindFile=0x4ef250) returned 1
	[0154.933] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4471730 | out: hHeap=0x4c0000) returned 1
	[0154.933] FindNextFileW (in: hFindFile=0x4ef210, lpFindFileData=0x3bdfcf8 | out: lpFindFileData=0x3bdfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xda7f8d37, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7f8d37, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0154.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4471730
	[0154.934] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xda7f8d37, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7f8d37, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName=".", cAlternateFileName="")) returned 0x3e70bb0
	[0155.128] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xda7f8d37, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7f8d37, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="..", cAlternateFileName="")) returned 1
	[0155.128] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="BCD", cAlternateFileName="")) returned 1
	[0155.128] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0155.128] lstrlenW (lpString="BCD.LOG") returned 7
	[0155.128] lstrlenW (lpString=".1cd") returned 4
	[0155.128] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0155.128] lstrlenW (lpString=".3ds") returned 4
	[0155.128] lstrcmpiW (lpString1=".3ds", lpString2=".LOG") returned -1
	[0155.128] lstrlenW (lpString=".3fr") returned 4
	[0155.128] lstrcmpiW (lpString1=".3fr", lpString2=".LOG") returned -1
	[0155.128] lstrlenW (lpString=".3g2") returned 4
	[0155.128] lstrcmpiW (lpString1=".3g2", lpString2=".LOG") returned -1
	[0155.128] lstrlenW (lpString=".3gp") returned 4
	[0155.128] lstrcmpiW (lpString1=".3gp", lpString2=".LOG") returned -1
	[0155.128] lstrlenW (lpString=".7z") returned 3
	[0155.129] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0155.129] lstrlenW (lpString=".accda") returned 6
	[0155.129] lstrcmpiW (lpString1=".accda", lpString2="CD.LOG") returned -1
	[0155.129] lstrlenW (lpString=".accdb") returned 6
	[0155.129] lstrcmpiW (lpString1=".accdb", lpString2="CD.LOG") returned -1
	[0155.129] lstrlenW (lpString=".accdc") returned 6
	[0155.129] lstrcmpiW (lpString1=".accdc", lpString2="CD.LOG") returned -1
	[0155.129] lstrlenW (lpString=".accde") returned 6
	[0155.129] lstrcmpiW (lpString1=".accde", lpString2="CD.LOG") returned -1
	[0155.129] lstrlenW (lpString=".accdt") returned 6
	[0155.129] lstrcmpiW (lpString1=".accdt", lpString2="CD.LOG") returned -1
	[0155.129] lstrlenW (lpString=".accdw") returned 6
	[0155.129] lstrcmpiW (lpString1=".accdw", lpString2="CD.LOG") returned -1
	[0155.129] lstrlenW (lpString=".adb") returned 4
	[0155.129] lstrcmpiW (lpString1=".adb", lpString2=".LOG") returned -1
	[0155.129] lstrlenW (lpString=".adp") returned 4
	[0155.129] lstrcmpiW (lpString1=".adp", lpString2=".LOG") returned -1
	[0155.129] lstrlenW (lpString=".ai") returned 3
	[0155.129] lstrcmpiW (lpString1=".ai", lpString2="LOG") returned -1
	[0155.129] lstrlenW (lpString=".ai3") returned 4
	[0155.129] lstrcmpiW (lpString1=".ai3", lpString2=".LOG") returned -1
	[0155.129] lstrlenW (lpString=".ai4") returned 4
	[0155.129] lstrcmpiW (lpString1=".ai4", lpString2=".LOG") returned -1
	[0155.129] lstrlenW (lpString=".ai5") returned 4
	[0155.129] lstrcmpiW (lpString1=".ai5", lpString2=".LOG") returned -1
	[0155.129] lstrlenW (lpString=".ai6") returned 4
	[0155.129] lstrcmpiW (lpString1=".ai6", lpString2=".LOG") returned -1
	[0155.129] lstrlenW (lpString=".ai7") returned 4
	[0155.129] lstrcmpiW (lpString1=".ai7", lpString2=".LOG") returned -1
	[0155.129] lstrlenW (lpString=".ai8") returned 4
	[0155.129] lstrcmpiW (lpString1=".ai8", lpString2=".LOG") returned -1
	[0155.129] lstrlenW (lpString=".anim") returned 5
	[0155.129] lstrcmpiW (lpString1=".anim", lpString2="D.LOG") returned -1
	[0155.130] lstrlenW (lpString=".arw") returned 4
	[0155.130] lstrcmpiW (lpString1=".arw", lpString2=".LOG") returned -1
	[0155.130] lstrlenW (lpString=".as") returned 3
	[0155.130] lstrcmpiW (lpString1=".as", lpString2="LOG") returned -1
	[0155.130] lstrlenW (lpString=".asa") returned 4
	[0155.130] lstrcmpiW (lpString1=".asa", lpString2=".LOG") returned -1
	[0155.131] lstrlenW (lpString=".asc") returned 4
	[0155.131] lstrcmpiW (lpString1=".asc", lpString2=".LOG") returned -1
	[0155.131] lstrlenW (lpString=".ascx") returned 5
	[0155.131] lstrcmpiW (lpString1=".ascx", lpString2="D.LOG") returned -1
	[0155.131] lstrlenW (lpString=".asm") returned 4
	[0155.131] lstrcmpiW (lpString1=".asm", lpString2=".LOG") returned -1
	[0155.131] lstrlenW (lpString=".asmx") returned 5
	[0155.131] lstrcmpiW (lpString1=".asmx", lpString2="D.LOG") returned -1
	[0155.131] lstrlenW (lpString=".asp") returned 4
	[0155.131] lstrcmpiW (lpString1=".asp", lpString2=".LOG") returned -1
	[0155.131] lstrlenW (lpString=".aspx") returned 5
	[0155.131] lstrcmpiW (lpString1=".aspx", lpString2="D.LOG") returned -1
	[0155.131] lstrlenW (lpString=".asr") returned 4
	[0155.131] lstrcmpiW (lpString1=".asr", lpString2=".LOG") returned -1
	[0155.131] lstrlenW (lpString=".asx") returned 4
	[0155.131] lstrcmpiW (lpString1=".asx", lpString2=".LOG") returned -1
	[0155.131] lstrlenW (lpString=".avi") returned 4
	[0155.131] lstrcmpiW (lpString1=".avi", lpString2=".LOG") returned -1
	[0155.131] lstrlenW (lpString=".avs") returned 4
	[0155.131] lstrcmpiW (lpString1=".avs", lpString2=".LOG") returned -1
	[0155.131] lstrlenW (lpString=".backup") returned 7
	[0155.131] lstrcmpiW (lpString1=".backup", lpString2="BCD.LOG") returned -1
	[0155.131] lstrlenW (lpString=".bak") returned 4
	[0155.131] lstrcmpiW (lpString1=".bak", lpString2=".LOG") returned -1
	[0155.131] lstrlenW (lpString=".bay") returned 4
	[0155.131] lstrcmpiW (lpString1=".bay", lpString2=".LOG") returned -1
	[0155.131] lstrlenW (lpString=".bd") returned 3
	[0155.131] lstrcmpiW (lpString1=".bd", lpString2="LOG") returned -1
	[0155.132] lstrlenW (lpString=".bin") returned 4
	[0155.132] lstrcmpiW (lpString1=".bin", lpString2=".LOG") returned -1
	[0155.132] lstrlenW (lpString=".bmp") returned 4
	[0155.132] lstrcmpiW (lpString1=".bmp", lpString2=".LOG") returned -1
	[0155.132] lstrlenW (lpString=".bz2") returned 4
	[0155.132] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0155.132] lstrlenW (lpString=".c") returned 2
	[0155.132] lstrcmpiW (lpString1=".c", lpString2="OG") returned -1
	[0155.132] lstrlenW (lpString=".cdr") returned 4
	[0155.132] lstrcmpiW (lpString1=".cdr", lpString2=".LOG") returned -1
	[0155.132] lstrlenW (lpString=".cer") returned 4
	[0155.132] lstrcmpiW (lpString1=".cer", lpString2=".LOG") returned -1
	[0155.132] lstrlenW (lpString=".cf") returned 3
	[0155.132] lstrcmpiW (lpString1=".cf", lpString2="LOG") returned -1
	[0155.132] lstrlenW (lpString=".cfc") returned 4
	[0155.132] lstrcmpiW (lpString1=".cfc", lpString2=".LOG") returned -1
	[0155.132] lstrlenW (lpString=".cfm") returned 4
	[0155.132] lstrcmpiW (lpString1=".cfm", lpString2=".LOG") returned -1
	[0155.132] lstrlenW (lpString=".cfml") returned 5
	[0155.132] lstrcmpiW (lpString1=".cfml", lpString2="D.LOG") returned -1
	[0155.132] lstrlenW (lpString=".cfu") returned 4
	[0155.132] lstrcmpiW (lpString1=".cfu", lpString2=".LOG") returned -1
	[0155.132] lstrlenW (lpString=".chm") returned 4
	[0155.132] lstrcmpiW (lpString1=".chm", lpString2=".LOG") returned -1
	[0155.132] lstrlenW (lpString=".cin") returned 4
	[0155.132] lstrcmpiW (lpString1=".cin", lpString2=".LOG") returned -1
	[0155.132] lstrlenW (lpString=".class") returned 6
	[0155.132] lstrcmpiW (lpString1=".class", lpString2="CD.LOG") returned -1
	[0155.132] lstrlenW (lpString=".clx") returned 4
	[0155.132] lstrcmpiW (lpString1=".clx", lpString2=".LOG") returned -1
	[0155.132] lstrlenW (lpString=".config") returned 7
	[0155.132] lstrcmpiW (lpString1=".config", lpString2="BCD.LOG") returned -1
	[0155.133] lstrlenW (lpString=".cpp") returned 4
	[0155.133] lstrcmpiW (lpString1=".cpp", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".cr2") returned 4
	[0155.133] lstrcmpiW (lpString1=".cr2", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".crt") returned 4
	[0155.133] lstrcmpiW (lpString1=".crt", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".crw") returned 4
	[0155.133] lstrcmpiW (lpString1=".crw", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".cs") returned 3
	[0155.133] lstrcmpiW (lpString1=".cs", lpString2="LOG") returned -1
	[0155.133] lstrlenW (lpString=".css") returned 4
	[0155.133] lstrcmpiW (lpString1=".css", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".csv") returned 4
	[0155.133] lstrcmpiW (lpString1=".csv", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".cub") returned 4
	[0155.133] lstrcmpiW (lpString1=".cub", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".dae") returned 4
	[0155.133] lstrcmpiW (lpString1=".dae", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".dat") returned 4
	[0155.133] lstrcmpiW (lpString1=".dat", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".db") returned 3
	[0155.133] lstrcmpiW (lpString1=".db", lpString2="LOG") returned -1
	[0155.133] lstrlenW (lpString=".dbf") returned 4
	[0155.133] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".dbx") returned 4
	[0155.133] lstrcmpiW (lpString1=".dbx", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".dc3") returned 4
	[0155.133] lstrcmpiW (lpString1=".dc3", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".dcm") returned 4
	[0155.133] lstrcmpiW (lpString1=".dcm", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".dcr") returned 4
	[0155.133] lstrcmpiW (lpString1=".dcr", lpString2=".LOG") returned -1
	[0155.133] lstrlenW (lpString=".der") returned 4
	[0155.134] lstrcmpiW (lpString1=".der", lpString2=".LOG") returned -1
	[0155.134] lstrlenW (lpString=".dib") returned 4
	[0155.134] lstrcmpiW (lpString1=".dib", lpString2=".LOG") returned -1
	[0155.134] lstrlenW (lpString=".dic") returned 4
	[0155.134] lstrcmpiW (lpString1=".dic", lpString2=".LOG") returned -1
	[0155.134] lstrlenW (lpString=".dif") returned 4
	[0155.134] lstrcmpiW (lpString1=".dif", lpString2=".LOG") returned -1
	[0155.134] lstrlenW (lpString=".divx") returned 5
	[0155.134] lstrcmpiW (lpString1=".divx", lpString2="D.LOG") returned -1
	[0155.134] lstrlenW (lpString=".djvu") returned 5
	[0155.134] lstrcmpiW (lpString1=".djvu", lpString2="D.LOG") returned -1
	[0155.134] lstrlenW (lpString=".dng") returned 4
	[0155.134] lstrcmpiW (lpString1=".dng", lpString2=".LOG") returned -1
	[0155.134] lstrlenW (lpString=".doc") returned 4
	[0155.134] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0155.134] lstrlenW (lpString=".docm") returned 5
	[0155.134] lstrcmpiW (lpString1=".docm", lpString2="D.LOG") returned -1
	[0155.134] lstrlenW (lpString=".docx") returned 5
	[0155.134] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0155.134] lstrlenW (lpString=".dot") returned 4
	[0155.134] lstrcmpiW (lpString1=".dot", lpString2=".LOG") returned -1
	[0155.134] lstrlenW (lpString=".dotm") returned 5
	[0155.134] lstrcmpiW (lpString1=".dotm", lpString2="D.LOG") returned -1
	[0155.134] lstrlenW (lpString=".dotx") returned 5
	[0155.134] lstrcmpiW (lpString1=".dotx", lpString2="D.LOG") returned -1
	[0155.134] lstrlenW (lpString=".dpx") returned 4
	[0155.134] lstrcmpiW (lpString1=".dpx", lpString2=".LOG") returned -1
	[0155.134] lstrlenW (lpString=".dqy") returned 4
	[0155.134] lstrcmpiW (lpString1=".dqy", lpString2=".LOG") returned -1
	[0155.134] lstrlenW (lpString=".dsn") returned 4
	[0155.134] lstrcmpiW (lpString1=".dsn", lpString2=".LOG") returned -1
	[0155.134] lstrlenW (lpString=".dt") returned 3
	[0155.135] lstrcmpiW (lpString1=".dt", lpString2="LOG") returned -1
	[0155.135] lstrlenW (lpString=".dtd") returned 4
	[0155.135] lstrcmpiW (lpString1=".dtd", lpString2=".LOG") returned -1
	[0155.135] lstrlenW (lpString=".dwg") returned 4
	[0155.135] lstrcmpiW (lpString1=".dwg", lpString2=".LOG") returned -1
	[0155.135] lstrlenW (lpString=".dwt") returned 4
	[0155.135] lstrcmpiW (lpString1=".dwt", lpString2=".LOG") returned -1
	[0155.135] lstrlenW (lpString=".dx") returned 3
	[0155.135] lstrcmpiW (lpString1=".dx", lpString2="LOG") returned -1
	[0155.135] lstrlenW (lpString=".dxf") returned 4
	[0155.135] lstrcmpiW (lpString1=".dxf", lpString2=".LOG") returned -1
	[0155.135] lstrlenW (lpString=".edml") returned 5
	[0155.135] lstrcmpiW (lpString1=".edml", lpString2="D.LOG") returned -1
	[0155.135] lstrlenW (lpString=".efd") returned 4
	[0155.135] lstrcmpiW (lpString1=".efd", lpString2=".LOG") returned -1
	[0155.135] lstrlenW (lpString=".elf") returned 4
	[0155.135] lstrcmpiW (lpString1=".elf", lpString2=".LOG") returned -1
	[0155.135] lstrlenW (lpString=".emf") returned 4
	[0155.135] lstrcmpiW (lpString1=".emf", lpString2=".LOG") returned -1
	[0155.135] lstrlenW (lpString=".emz") returned 4
	[0155.135] lstrcmpiW (lpString1=".emz", lpString2=".LOG") returned -1
	[0155.135] lstrlenW (lpString=".epf") returned 4
	[0155.135] lstrcmpiW (lpString1=".epf", lpString2=".LOG") returned -1
	[0155.135] lstrlenW (lpString=".eps") returned 4
	[0155.135] lstrcmpiW (lpString1=".eps", lpString2=".LOG") returned -1
	[0155.135] lstrlenW (lpString=".epsf") returned 5
	[0155.135] lstrcmpiW (lpString1=".epsf", lpString2="D.LOG") returned -1
	[0155.135] lstrlenW (lpString=".epsp") returned 5
	[0155.135] lstrcmpiW (lpString1=".epsp", lpString2="D.LOG") returned -1
	[0155.135] lstrlenW (lpString=".erf") returned 4
	[0155.135] lstrcmpiW (lpString1=".erf", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".exr") returned 4
	[0155.136] lstrcmpiW (lpString1=".exr", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".f4v") returned 4
	[0155.136] lstrcmpiW (lpString1=".f4v", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".fido") returned 5
	[0155.136] lstrcmpiW (lpString1=".fido", lpString2="D.LOG") returned -1
	[0155.136] lstrlenW (lpString=".flm") returned 4
	[0155.136] lstrcmpiW (lpString1=".flm", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".flv") returned 4
	[0155.136] lstrcmpiW (lpString1=".flv", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".frm") returned 4
	[0155.136] lstrcmpiW (lpString1=".frm", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".fxg") returned 4
	[0155.136] lstrcmpiW (lpString1=".fxg", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".geo") returned 4
	[0155.136] lstrcmpiW (lpString1=".geo", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".gif") returned 4
	[0155.136] lstrcmpiW (lpString1=".gif", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".grs") returned 4
	[0155.136] lstrcmpiW (lpString1=".grs", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".gz") returned 3
	[0155.136] lstrcmpiW (lpString1=".gz", lpString2="LOG") returned -1
	[0155.136] lstrlenW (lpString=".h") returned 2
	[0155.136] lstrcmpiW (lpString1=".h", lpString2="OG") returned -1
	[0155.136] lstrlenW (lpString=".hdr") returned 4
	[0155.136] lstrcmpiW (lpString1=".hdr", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".hpp") returned 4
	[0155.136] lstrcmpiW (lpString1=".hpp", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".hta") returned 4
	[0155.136] lstrcmpiW (lpString1=".hta", lpString2=".LOG") returned -1
	[0155.136] lstrlenW (lpString=".htc") returned 4
	[0155.136] lstrcmpiW (lpString1=".htc", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".htm") returned 4
	[0155.137] lstrcmpiW (lpString1=".htm", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".html") returned 5
	[0155.137] lstrcmpiW (lpString1=".html", lpString2="D.LOG") returned -1
	[0155.137] lstrlenW (lpString=".icb") returned 4
	[0155.137] lstrcmpiW (lpString1=".icb", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".ics") returned 4
	[0155.137] lstrcmpiW (lpString1=".ics", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".iff") returned 4
	[0155.137] lstrcmpiW (lpString1=".iff", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".inc") returned 4
	[0155.137] lstrcmpiW (lpString1=".inc", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".indd") returned 5
	[0155.137] lstrcmpiW (lpString1=".indd", lpString2="D.LOG") returned -1
	[0155.137] lstrlenW (lpString=".ini") returned 4
	[0155.137] lstrcmpiW (lpString1=".ini", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".iqy") returned 4
	[0155.137] lstrcmpiW (lpString1=".iqy", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".j2c") returned 4
	[0155.137] lstrcmpiW (lpString1=".j2c", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".j2k") returned 4
	[0155.137] lstrcmpiW (lpString1=".j2k", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".java") returned 5
	[0155.137] lstrcmpiW (lpString1=".java", lpString2="D.LOG") returned -1
	[0155.137] lstrlenW (lpString=".jp2") returned 4
	[0155.137] lstrcmpiW (lpString1=".jp2", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".jpc") returned 4
	[0155.137] lstrcmpiW (lpString1=".jpc", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".jpe") returned 4
	[0155.137] lstrcmpiW (lpString1=".jpe", lpString2=".LOG") returned -1
	[0155.137] lstrlenW (lpString=".jpeg") returned 5
	[0155.137] lstrcmpiW (lpString1=".jpeg", lpString2="D.LOG") returned -1
	[0155.137] lstrlenW (lpString=".jpf") returned 4
	[0155.137] lstrcmpiW (lpString1=".jpf", lpString2=".LOG") returned -1
	[0155.138] lstrlenW (lpString=".jpg") returned 4
	[0155.138] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0155.138] lstrlenW (lpString=".jpx") returned 4
	[0155.138] lstrcmpiW (lpString1=".jpx", lpString2=".LOG") returned -1
	[0155.138] lstrlenW (lpString=".js") returned 3
	[0155.138] lstrcmpiW (lpString1=".js", lpString2="LOG") returned -1
	[0155.138] lstrlenW (lpString=".jsf") returned 4
	[0155.138] lstrcmpiW (lpString1=".jsf", lpString2=".LOG") returned -1
	[0155.138] lstrlenW (lpString=".json") returned 5
	[0155.138] lstrcmpiW (lpString1=".json", lpString2="D.LOG") returned -1
	[0155.138] lstrlenW (lpString=".jsp") returned 4
	[0155.138] lstrcmpiW (lpString1=".jsp", lpString2=".LOG") returned -1
	[0155.138] lstrlenW (lpString=".kdc") returned 4
	[0155.138] lstrcmpiW (lpString1=".kdc", lpString2=".LOG") returned -1
	[0155.138] lstrlenW (lpString=".kmz") returned 4
	[0155.138] lstrcmpiW (lpString1=".kmz", lpString2=".LOG") returned -1
	[0155.138] lstrlenW (lpString=".kwm") returned 4
	[0155.138] lstrcmpiW (lpString1=".kwm", lpString2=".LOG") returned -1
	[0155.138] lstrlenW (lpString=".lasso") returned 6
	[0155.138] lstrcmpiW (lpString1=".lasso", lpString2="CD.LOG") returned -1
	[0155.138] lstrlenW (lpString=".lbi") returned 4
	[0155.138] lstrcmpiW (lpString1=".lbi", lpString2=".LOG") returned -1
	[0155.138] lstrlenW (lpString=".lgf") returned 4
	[0155.138] lstrcmpiW (lpString1=".lgf", lpString2=".LOG") returned -1
	[0155.138] lstrlenW (lpString=".lgp") returned 4
	[0155.138] lstrcmpiW (lpString1=".lgp", lpString2=".LOG") returned -1
	[0155.138] lstrlenW (lpString=".log") returned 4
	[0155.138] lstrcmpiW (lpString1=".log", lpString2=".LOG") returned 0
	[0155.138] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0155.138] lstrlenW (lpString="BCD.LOG1") returned 8
	[0155.138] lstrlenW (lpString=".1cd") returned 4
	[0155.139] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0155.139] lstrlenW (lpString=".3ds") returned 4
	[0155.139] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1
	[0155.139] lstrlenW (lpString=".3fr") returned 4
	[0155.139] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1
	[0155.139] lstrlenW (lpString=".3g2") returned 4
	[0155.139] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1
	[0155.139] lstrlenW (lpString=".3gp") returned 4
	[0155.139] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1
	[0155.139] lstrlenW (lpString=".7z") returned 3
	[0155.139] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0155.139] lstrlenW (lpString=".accda") returned 6
	[0155.139] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1
	[0155.139] lstrlenW (lpString=".accdb") returned 6
	[0155.139] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1
	[0155.139] lstrlenW (lpString=".accdc") returned 6
	[0155.139] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1
	[0155.139] lstrlenW (lpString=".accde") returned 6
	[0155.139] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1
	[0155.139] lstrlenW (lpString=".accdt") returned 6
	[0155.139] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1
	[0155.139] lstrlenW (lpString=".accdw") returned 6
	[0155.139] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1
	[0155.139] lstrlenW (lpString=".adb") returned 4
	[0155.139] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1
	[0155.139] lstrlenW (lpString=".adp") returned 4
	[0155.139] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1
	[0155.139] lstrlenW (lpString=".ai") returned 3
	[0155.139] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1
	[0155.139] lstrlenW (lpString=".ai3") returned 4
	[0155.139] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1
	[0155.139] lstrlenW (lpString=".ai4") returned 4
	[0155.139] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1
	[0155.139] lstrlenW (lpString=".ai5") returned 4
	[0155.140] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1
	[0155.140] lstrlenW (lpString=".ai6") returned 4
	[0155.140] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1
	[0155.140] lstrlenW (lpString=".ai7") returned 4
	[0155.140] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1
	[0155.140] lstrlenW (lpString=".ai8") returned 4
	[0155.140] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1
	[0155.140] lstrlenW (lpString=".anim") returned 5
	[0155.140] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1
	[0155.140] lstrlenW (lpString=".arw") returned 4
	[0155.140] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1
	[0155.140] lstrlenW (lpString=".as") returned 3
	[0155.140] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1
	[0155.140] lstrlenW (lpString=".asa") returned 4
	[0155.140] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1
	[0155.140] lstrlenW (lpString=".asc") returned 4
	[0155.140] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1
	[0155.140] lstrlenW (lpString=".ascx") returned 5
	[0155.140] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1
	[0155.140] lstrlenW (lpString=".asm") returned 4
	[0155.140] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1
	[0155.140] lstrlenW (lpString=".asmx") returned 5
	[0155.140] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1
	[0155.140] lstrlenW (lpString=".asp") returned 4
	[0155.140] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1
	[0155.140] lstrlenW (lpString=".aspx") returned 5
	[0155.140] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1
	[0155.140] lstrlenW (lpString=".asr") returned 4
	[0155.140] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1
	[0155.140] lstrlenW (lpString=".asx") returned 4
	[0155.140] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1
	[0155.140] lstrlenW (lpString=".avi") returned 4
	[0155.140] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".avs") returned 4
	[0155.141] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".backup") returned 7
	[0155.141] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1
	[0155.141] lstrlenW (lpString=".bak") returned 4
	[0155.141] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".bay") returned 4
	[0155.141] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".bd") returned 3
	[0155.141] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1
	[0155.141] lstrlenW (lpString=".bin") returned 4
	[0155.141] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".bmp") returned 4
	[0155.141] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".bz2") returned 4
	[0155.141] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".c") returned 2
	[0155.141] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1
	[0155.141] lstrlenW (lpString=".cdr") returned 4
	[0155.141] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".cer") returned 4
	[0155.141] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".cf") returned 3
	[0155.141] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1
	[0155.141] lstrlenW (lpString=".cfc") returned 4
	[0155.141] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".cfm") returned 4
	[0155.141] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".cfml") returned 5
	[0155.141] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1
	[0155.141] lstrlenW (lpString=".cfu") returned 4
	[0155.141] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1
	[0155.141] lstrlenW (lpString=".chm") returned 4
	[0155.141] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".cin") returned 4
	[0155.142] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".class") returned 6
	[0155.142] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1
	[0155.142] lstrlenW (lpString=".clx") returned 4
	[0155.142] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".config") returned 7
	[0155.142] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1
	[0155.142] lstrlenW (lpString=".cpp") returned 4
	[0155.142] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".cr2") returned 4
	[0155.142] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".crt") returned 4
	[0155.142] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".crw") returned 4
	[0155.142] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".cs") returned 3
	[0155.142] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1
	[0155.142] lstrlenW (lpString=".css") returned 4
	[0155.142] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".csv") returned 4
	[0155.142] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".cub") returned 4
	[0155.142] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".dae") returned 4
	[0155.142] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".dat") returned 4
	[0155.142] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".db") returned 3
	[0155.142] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1
	[0155.142] lstrlenW (lpString=".dbf") returned 4
	[0155.142] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0155.142] lstrlenW (lpString=".dbx") returned 4
	[0155.143] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1
	[0155.143] lstrlenW (lpString=".dc3") returned 4
	[0155.143] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1
	[0155.143] lstrlenW (lpString=".dcm") returned 4
	[0155.143] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1
	[0155.143] lstrlenW (lpString=".dcr") returned 4
	[0155.143] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1
	[0155.143] lstrlenW (lpString=".der") returned 4
	[0155.143] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1
	[0155.143] lstrlenW (lpString=".dib") returned 4
	[0155.143] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1
	[0155.143] lstrlenW (lpString=".dic") returned 4
	[0155.143] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1
	[0155.143] lstrlenW (lpString=".dif") returned 4
	[0155.143] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1
	[0155.143] lstrlenW (lpString=".divx") returned 5
	[0155.143] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1
	[0155.143] lstrlenW (lpString=".djvu") returned 5
	[0155.143] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1
	[0155.143] lstrlenW (lpString=".dng") returned 4
	[0155.143] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1
	[0155.143] lstrlenW (lpString=".doc") returned 4
	[0155.143] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0155.143] lstrlenW (lpString=".docm") returned 5
	[0155.143] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1
	[0155.143] lstrlenW (lpString=".docx") returned 5
	[0155.143] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0155.143] lstrlenW (lpString=".dot") returned 4
	[0155.143] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1
	[0155.143] lstrlenW (lpString=".dotm") returned 5
	[0155.143] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1
	[0155.143] lstrlenW (lpString=".dotx") returned 5
	[0155.144] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1
	[0155.144] lstrlenW (lpString=".dpx") returned 4
	[0155.144] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1
	[0155.144] lstrlenW (lpString=".dqy") returned 4
	[0155.144] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1
	[0155.144] lstrlenW (lpString=".dsn") returned 4
	[0155.144] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1
	[0155.144] lstrlenW (lpString=".dt") returned 3
	[0155.144] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1
	[0155.144] lstrlenW (lpString=".dtd") returned 4
	[0155.144] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1
	[0155.144] lstrlenW (lpString=".dwg") returned 4
	[0155.144] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1
	[0155.144] lstrlenW (lpString=".dwt") returned 4
	[0155.144] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1
	[0155.144] lstrlenW (lpString=".dx") returned 3
	[0155.144] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1
	[0155.144] lstrlenW (lpString=".dxf") returned 4
	[0155.144] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1
	[0155.144] lstrlenW (lpString=".edml") returned 5
	[0155.144] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1
	[0155.144] lstrlenW (lpString=".efd") returned 4
	[0155.144] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1
	[0155.144] lstrlenW (lpString=".elf") returned 4
	[0155.144] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1
	[0155.144] lstrlenW (lpString=".emf") returned 4
	[0155.144] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1
	[0155.144] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0155.145] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0155.145] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4481738
	[0155.145] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName=".", cAlternateFileName="")) returned 0x3e70cf0
	[0155.145] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="..", cAlternateFileName="")) returned 1
	[0155.145] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.146] FindNextFileW (in: hFindFile=0x3e70cf0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.146] FindClose (in: hFindFile=0x3e70cf0 | out: hFindFile=0x3e70cf0) returned 1
	[0155.146] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4481738 | out: hHeap=0x4c0000) returned 1
	[0155.146] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0155.146] lstrlenW (lpString="bootspaces.dll") returned 14
	[0155.146] lstrlenW (lpString=".1cd") returned 4
	[0155.146] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.146] lstrlenW (lpString=".3ds") returned 4
	[0155.146] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0155.146] lstrlenW (lpString=".3fr") returned 4
	[0155.146] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0155.146] lstrlenW (lpString=".3g2") returned 4
	[0155.146] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0155.146] lstrlenW (lpString=".3gp") returned 4
	[0155.146] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0155.146] lstrlenW (lpString=".7z") returned 3
	[0155.146] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.146] lstrlenW (lpString=".accda") returned 6
	[0155.146] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1
	[0155.146] lstrlenW (lpString=".accdb") returned 6
	[0155.146] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1
	[0155.146] lstrlenW (lpString=".accdc") returned 6
	[0155.146] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1
	[0155.147] lstrlenW (lpString=".accde") returned 6
	[0155.147] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1
	[0155.147] lstrlenW (lpString=".accdt") returned 6
	[0155.147] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1
	[0155.147] lstrlenW (lpString=".accdw") returned 6
	[0155.147] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1
	[0155.147] lstrlenW (lpString=".adb") returned 4
	[0155.147] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0155.147] lstrlenW (lpString=".adp") returned 4
	[0155.147] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0155.147] lstrlenW (lpString=".ai") returned 3
	[0155.147] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0155.147] lstrlenW (lpString=".ai3") returned 4
	[0155.147] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0155.147] lstrlenW (lpString=".ai4") returned 4
	[0155.147] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0155.147] lstrlenW (lpString=".ai5") returned 4
	[0155.147] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0155.147] lstrlenW (lpString=".ai6") returned 4
	[0155.147] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0155.147] lstrlenW (lpString=".ai7") returned 4
	[0155.147] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0155.147] lstrlenW (lpString=".ai8") returned 4
	[0155.147] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0155.147] lstrlenW (lpString=".anim") returned 5
	[0155.147] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1
	[0155.147] lstrlenW (lpString=".arw") returned 4
	[0155.147] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0155.147] lstrlenW (lpString=".as") returned 3
	[0155.147] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0155.147] lstrlenW (lpString=".asa") returned 4
	[0155.147] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0155.148] lstrlenW (lpString=".asc") returned 4
	[0155.148] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0155.148] lstrlenW (lpString=".ascx") returned 5
	[0155.148] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1
	[0155.148] lstrlenW (lpString=".asm") returned 4
	[0155.148] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0155.148] lstrlenW (lpString=".asmx") returned 5
	[0155.148] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1
	[0155.148] lstrlenW (lpString=".asp") returned 4
	[0155.148] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0155.148] lstrlenW (lpString=".aspx") returned 5
	[0155.148] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1
	[0155.148] lstrlenW (lpString=".asr") returned 4
	[0155.148] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0155.148] lstrlenW (lpString=".asx") returned 4
	[0155.148] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0155.148] lstrlenW (lpString=".avi") returned 4
	[0155.148] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0155.148] lstrlenW (lpString=".avs") returned 4
	[0155.148] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0155.148] lstrlenW (lpString=".backup") returned 7
	[0155.148] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1
	[0155.148] lstrlenW (lpString=".bak") returned 4
	[0155.148] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0155.148] lstrlenW (lpString=".bay") returned 4
	[0155.148] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0155.148] lstrlenW (lpString=".bd") returned 3
	[0155.148] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0155.148] lstrlenW (lpString=".bin") returned 4
	[0155.148] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0155.148] lstrlenW (lpString=".bmp") returned 4
	[0155.148] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".bz2") returned 4
	[0155.149] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".c") returned 2
	[0155.149] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0155.149] lstrlenW (lpString=".cdr") returned 4
	[0155.149] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".cer") returned 4
	[0155.149] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".cf") returned 3
	[0155.149] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0155.149] lstrlenW (lpString=".cfc") returned 4
	[0155.149] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".cfm") returned 4
	[0155.149] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".cfml") returned 5
	[0155.149] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1
	[0155.149] lstrlenW (lpString=".cfu") returned 4
	[0155.149] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".chm") returned 4
	[0155.149] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".cin") returned 4
	[0155.149] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".class") returned 6
	[0155.149] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1
	[0155.149] lstrlenW (lpString=".clx") returned 4
	[0155.149] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".config") returned 7
	[0155.149] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1
	[0155.149] lstrlenW (lpString=".cpp") returned 4
	[0155.149] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".cr2") returned 4
	[0155.149] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0155.149] lstrlenW (lpString=".crt") returned 4
	[0155.150] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".crw") returned 4
	[0155.150] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".cs") returned 3
	[0155.150] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0155.150] lstrlenW (lpString=".css") returned 4
	[0155.150] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".csv") returned 4
	[0155.150] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".cub") returned 4
	[0155.150] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".dae") returned 4
	[0155.150] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".dat") returned 4
	[0155.150] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".db") returned 3
	[0155.150] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0155.150] lstrlenW (lpString=".dbf") returned 4
	[0155.150] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".dbx") returned 4
	[0155.150] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".dc3") returned 4
	[0155.150] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".dcm") returned 4
	[0155.150] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".dcr") returned 4
	[0155.150] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".der") returned 4
	[0155.150] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".dib") returned 4
	[0155.150] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0155.150] lstrlenW (lpString=".dic") returned 4
	[0155.150] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0155.151] lstrlenW (lpString=".dif") returned 4
	[0155.151] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0155.151] lstrlenW (lpString=".divx") returned 5
	[0155.151] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1
	[0155.151] lstrlenW (lpString=".djvu") returned 5
	[0155.151] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1
	[0155.151] lstrlenW (lpString=".dng") returned 4
	[0155.151] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0155.151] lstrlenW (lpString=".doc") returned 4
	[0155.151] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.151] lstrlenW (lpString=".docm") returned 5
	[0155.151] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1
	[0155.151] lstrlenW (lpString=".docx") returned 5
	[0155.151] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0155.151] lstrlenW (lpString=".dot") returned 4
	[0155.151] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0155.151] lstrlenW (lpString=".dotm") returned 5
	[0155.151] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1
	[0155.151] lstrlenW (lpString=".dotx") returned 5
	[0155.151] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1
	[0155.151] lstrlenW (lpString=".dpx") returned 4
	[0155.151] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0155.151] lstrlenW (lpString=".dqy") returned 4
	[0155.151] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0155.151] lstrlenW (lpString=".dsn") returned 4
	[0155.151] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0155.151] lstrlenW (lpString=".dt") returned 3
	[0155.151] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0155.151] lstrlenW (lpString=".dtd") returned 4
	[0155.151] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0155.151] lstrlenW (lpString=".dwg") returned 4
	[0155.151] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0155.151] lstrlenW (lpString=".dwt") returned 4
	[0155.152] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0155.152] lstrlenW (lpString=".dx") returned 3
	[0155.152] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0155.152] lstrlenW (lpString=".dxf") returned 4
	[0155.152] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0155.152] lstrlenW (lpString=".edml") returned 5
	[0155.152] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1
	[0155.152] lstrlenW (lpString=".efd") returned 4
	[0155.152] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0155.152] lstrlenW (lpString=".elf") returned 4
	[0155.152] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0155.152] lstrlenW (lpString=".emf") returned 4
	[0155.152] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0155.152] lstrlenW (lpString=".emz") returned 4
	[0155.152] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0155.152] lstrlenW (lpString=".epf") returned 4
	[0155.152] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0155.152] lstrlenW (lpString=".eps") returned 4
	[0155.152] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0155.152] lstrlenW (lpString=".epsf") returned 5
	[0155.152] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1
	[0155.152] lstrlenW (lpString=".epsp") returned 5
	[0155.152] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1
	[0155.152] lstrlenW (lpString=".erf") returned 4
	[0155.152] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0155.152] lstrlenW (lpString=".exr") returned 4
	[0155.152] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0155.152] lstrlenW (lpString=".f4v") returned 4
	[0155.152] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0155.152] lstrlenW (lpString=".fido") returned 5
	[0155.152] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1
	[0155.152] lstrlenW (lpString=".flm") returned 4
	[0155.153] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".flv") returned 4
	[0155.153] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".frm") returned 4
	[0155.153] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".fxg") returned 4
	[0155.153] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".geo") returned 4
	[0155.153] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".gif") returned 4
	[0155.153] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".grs") returned 4
	[0155.153] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".gz") returned 3
	[0155.153] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0155.153] lstrlenW (lpString=".h") returned 2
	[0155.153] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0155.153] lstrlenW (lpString=".hdr") returned 4
	[0155.153] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".hpp") returned 4
	[0155.153] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".hta") returned 4
	[0155.153] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".htc") returned 4
	[0155.153] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".htm") returned 4
	[0155.153] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".html") returned 5
	[0155.153] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1
	[0155.153] lstrlenW (lpString=".icb") returned 4
	[0155.153] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0155.153] lstrlenW (lpString=".ics") returned 4
	[0155.153] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".iff") returned 4
	[0155.154] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".inc") returned 4
	[0155.154] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".indd") returned 5
	[0155.154] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1
	[0155.154] lstrlenW (lpString=".ini") returned 4
	[0155.154] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".iqy") returned 4
	[0155.154] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".j2c") returned 4
	[0155.154] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".j2k") returned 4
	[0155.154] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".java") returned 5
	[0155.154] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1
	[0155.154] lstrlenW (lpString=".jp2") returned 4
	[0155.154] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".jpc") returned 4
	[0155.154] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".jpe") returned 4
	[0155.154] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".jpeg") returned 5
	[0155.154] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1
	[0155.154] lstrlenW (lpString=".jpf") returned 4
	[0155.154] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".jpg") returned 4
	[0155.154] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".jpx") returned 4
	[0155.154] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0155.154] lstrlenW (lpString=".js") returned 3
	[0155.154] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0155.155] lstrlenW (lpString=".jsf") returned 4
	[0155.155] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".json") returned 5
	[0155.155] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1
	[0155.155] lstrlenW (lpString=".jsp") returned 4
	[0155.155] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".kdc") returned 4
	[0155.155] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".kmz") returned 4
	[0155.155] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".kwm") returned 4
	[0155.155] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".lasso") returned 6
	[0155.155] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1
	[0155.155] lstrlenW (lpString=".lbi") returned 4
	[0155.155] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".lgf") returned 4
	[0155.155] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".lgp") returned 4
	[0155.155] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".log") returned 4
	[0155.155] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".m1v") returned 4
	[0155.155] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".m4a") returned 4
	[0155.155] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".m4v") returned 4
	[0155.155] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".max") returned 4
	[0155.155] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0155.155] lstrlenW (lpString=".md") returned 3
	[0155.155] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0155.155] lstrlenW (lpString=".mda") returned 4
	[0155.156] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mdb") returned 4
	[0155.156] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mde") returned 4
	[0155.156] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mdf") returned 4
	[0155.156] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mdw") returned 4
	[0155.156] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mef") returned 4
	[0155.156] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mft") returned 4
	[0155.156] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mfw") returned 4
	[0155.156] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mht") returned 4
	[0155.156] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mhtml") returned 6
	[0155.156] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1
	[0155.156] lstrlenW (lpString=".mka") returned 4
	[0155.156] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mkidx") returned 6
	[0155.156] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1
	[0155.156] lstrlenW (lpString=".mkv") returned 4
	[0155.156] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mos") returned 4
	[0155.156] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mov") returned 4
	[0155.156] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mp3") returned 4
	[0155.156] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0155.156] lstrlenW (lpString=".mp4") returned 4
	[0155.156] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".mpeg") returned 5
	[0155.157] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1
	[0155.157] lstrlenW (lpString=".mpg") returned 4
	[0155.157] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".mpv") returned 4
	[0155.157] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".mrw") returned 4
	[0155.157] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".msg") returned 4
	[0155.157] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".mxl") returned 4
	[0155.157] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".myd") returned 4
	[0155.157] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".myi") returned 4
	[0155.157] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".nef") returned 4
	[0155.157] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".nrw") returned 4
	[0155.157] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".obj") returned 4
	[0155.157] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".odb") returned 4
	[0155.157] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".odc") returned 4
	[0155.157] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".odm") returned 4
	[0155.157] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".odp") returned 4
	[0155.157] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0155.157] lstrlenW (lpString=".ods") returned 4
	[0155.157] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".oft") returned 4
	[0155.158] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".one") returned 4
	[0155.158] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".onepkg") returned 7
	[0155.158] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1
	[0155.158] lstrlenW (lpString=".onetoc2") returned 8
	[0155.158] lstrcmpiW (lpString1=".onetoc2", lpString2="aces.dll") returned -1
	[0155.158] lstrlenW (lpString=".opt") returned 4
	[0155.158] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".oqy") returned 4
	[0155.158] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".orf") returned 4
	[0155.158] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".p12") returned 4
	[0155.158] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".p7b") returned 4
	[0155.158] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".p7c") returned 4
	[0155.158] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".pam") returned 4
	[0155.158] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".pbm") returned 4
	[0155.158] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".pct") returned 4
	[0155.158] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".pcx") returned 4
	[0155.158] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".pdd") returned 4
	[0155.158] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".pdf") returned 4
	[0155.158] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.158] lstrlenW (lpString=".pdp") returned 4
	[0155.159] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0155.159] lstrlenW (lpString=".pef") returned 4
	[0155.159] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0155.159] lstrlenW (lpString=".pem") returned 4
	[0155.159] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0155.159] lstrlenW (lpString=".pff") returned 4
	[0155.159] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0155.159] lstrlenW (lpString=".pfm") returned 4
	[0155.159] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0155.159] lstrlenW (lpString=".pfx") returned 4
	[0155.159] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0155.159] lstrlenW (lpString=".pgm") returned 4
	[0155.159] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0155.159] lstrlenW (lpString=".php") returned 4
	[0155.159] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0155.159] lstrlenW (lpString=".php3") returned 5
	[0155.159] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1
	[0155.159] lstrlenW (lpString=".php4") returned 5
	[0155.159] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1
	[0155.159] lstrlenW (lpString=".php5") returned 5
	[0155.159] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1
	[0155.159] lstrlenW (lpString=".phtml") returned 6
	[0155.159] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1
	[0155.159] lstrlenW (lpString=".pict") returned 5
	[0155.159] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1
	[0155.159] lstrlenW (lpString=".pl") returned 3
	[0155.159] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0155.159] lstrlenW (lpString=".pls") returned 4
	[0155.159] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0155.159] lstrlenW (lpString=".pm") returned 3
	[0155.159] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0155.159] lstrlenW (lpString=".png") returned 4
	[0155.159] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0155.160] lstrlenW (lpString=".pnm") returned 4
	[0155.160] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0155.160] lstrlenW (lpString=".pot") returned 4
	[0155.160] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0155.160] lstrlenW (lpString=".potm") returned 5
	[0155.160] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1
	[0155.160] lstrlenW (lpString=".potx") returned 5
	[0155.160] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1
	[0155.160] lstrlenW (lpString=".ppa") returned 4
	[0155.160] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0155.160] lstrlenW (lpString=".ppam") returned 5
	[0155.160] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1
	[0155.160] lstrlenW (lpString=".ppm") returned 4
	[0155.160] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0155.160] lstrlenW (lpString=".pps") returned 4
	[0155.160] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0155.160] lstrlenW (lpString=".ppsm") returned 5
	[0155.160] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1
	[0155.160] lstrlenW (lpString=".ppt") returned 4
	[0155.160] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.160] lstrlenW (lpString=".pptm") returned 5
	[0155.160] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1
	[0155.160] lstrlenW (lpString=".pptx") returned 5
	[0155.160] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1
	[0155.160] lstrlenW (lpString=".prn") returned 4
	[0155.160] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0155.160] lstrlenW (lpString=".ps") returned 3
	[0155.160] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0155.160] lstrlenW (lpString=".psb") returned 4
	[0155.160] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0155.160] lstrlenW (lpString=".psd") returned 4
	[0155.160] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0155.160] lstrlenW (lpString=".pst") returned 4
	[0155.160] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0155.161] lstrlenW (lpString=".ptx") returned 4
	[0155.161] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0155.161] lstrlenW (lpString=".pub") returned 4
	[0155.161] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0155.161] lstrlenW (lpString=".pwm") returned 4
	[0155.161] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0155.161] lstrlenW (lpString=".pxr") returned 4
	[0155.161] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0155.161] lstrlenW (lpString=".py") returned 3
	[0155.161] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0155.161] lstrlenW (lpString=".qt") returned 3
	[0155.161] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0155.161] lstrlenW (lpString=".r3d") returned 4
	[0155.161] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0155.161] lstrlenW (lpString=".raf") returned 4
	[0155.392] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0155.392] lstrlenW (lpString=".rar") returned 4
	[0155.392] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.392] lstrlenW (lpString=".raw") returned 4
	[0155.392] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0155.392] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xda7f8d37, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xda7f8d37, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xda7f8d37, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="BOOTSTAT.DAT.id-B4197730.[admin@stex777.com].money", cAlternateFileName="BOOTST~1.MON")) returned 1
	[0155.393] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0155.393] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0155.393] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4494fe8
	[0155.394] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName=".", cAlternateFileName="")) returned 0x3e70af0
	[0155.394] FindNextFileW (in: hFindFile=0x3e70af0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="..", cAlternateFileName="")) returned 1
	[0155.394] FindNextFileW (in: hFindFile=0x3e70af0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.394] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.394] lstrlenW (lpString=".1cd") returned 4
	[0155.394] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.394] lstrlenW (lpString=".3ds") returned 4
	[0155.394] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.394] lstrlenW (lpString=".3fr") returned 4
	[0155.394] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.394] lstrlenW (lpString=".3g2") returned 4
	[0155.394] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.394] lstrlenW (lpString=".3gp") returned 4
	[0155.394] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.394] lstrlenW (lpString=".7z") returned 3
	[0155.394] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.394] lstrlenW (lpString=".accda") returned 6
	[0155.394] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0155.395] lstrlenW (lpString=".accdb") returned 6
	[0155.395] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0155.395] lstrlenW (lpString=".accdc") returned 6
	[0155.395] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0155.395] lstrlenW (lpString=".accde") returned 6
	[0155.395] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0155.395] lstrlenW (lpString=".accdt") returned 6
	[0155.395] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0155.395] lstrlenW (lpString=".accdw") returned 6
	[0155.395] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0155.395] lstrlenW (lpString=".adb") returned 4
	[0155.395] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.395] lstrlenW (lpString=".adp") returned 4
	[0155.395] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.395] lstrlenW (lpString=".ai") returned 3
	[0155.395] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.395] lstrlenW (lpString=".ai3") returned 4
	[0155.395] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.395] lstrlenW (lpString=".ai4") returned 4
	[0155.395] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.395] lstrlenW (lpString=".ai5") returned 4
	[0155.395] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.395] lstrlenW (lpString=".ai6") returned 4
	[0155.395] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.395] lstrlenW (lpString=".ai7") returned 4
	[0155.395] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.395] lstrlenW (lpString=".ai8") returned 4
	[0155.395] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.395] lstrlenW (lpString=".anim") returned 5
	[0155.395] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0155.395] lstrlenW (lpString=".arw") returned 4
	[0155.396] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.396] lstrlenW (lpString=".as") returned 3
	[0155.396] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.396] lstrlenW (lpString=".asa") returned 4
	[0155.396] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.396] lstrlenW (lpString=".asc") returned 4
	[0155.396] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.396] lstrlenW (lpString=".ascx") returned 5
	[0155.396] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0155.396] lstrlenW (lpString=".asm") returned 4
	[0155.396] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.396] lstrlenW (lpString=".asmx") returned 5
	[0155.396] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0155.396] lstrlenW (lpString=".asp") returned 4
	[0155.396] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.396] lstrlenW (lpString=".aspx") returned 5
	[0155.396] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0155.396] lstrlenW (lpString=".asr") returned 4
	[0155.396] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.396] lstrlenW (lpString=".asx") returned 4
	[0155.396] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.396] lstrlenW (lpString=".avi") returned 4
	[0155.396] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.396] lstrlenW (lpString=".avs") returned 4
	[0155.396] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.396] lstrlenW (lpString=".backup") returned 7
	[0155.396] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0155.396] lstrlenW (lpString=".bak") returned 4
	[0155.396] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0155.396] lstrlenW (lpString=".bay") returned 4
	[0155.396] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0155.397] lstrlenW (lpString=".bd") returned 3
	[0155.397] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0155.397] lstrlenW (lpString=".bin") returned 4
	[0155.397] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0155.397] lstrlenW (lpString=".bmp") returned 4
	[0155.397] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0155.397] lstrlenW (lpString=".bz2") returned 4
	[0155.397] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.397] lstrlenW (lpString=".c") returned 2
	[0155.397] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0155.397] lstrlenW (lpString=".cdr") returned 4
	[0155.397] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0155.397] lstrlenW (lpString=".cer") returned 4
	[0155.397] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0155.397] lstrlenW (lpString=".cf") returned 3
	[0155.397] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0155.397] lstrlenW (lpString=".cfc") returned 4
	[0155.397] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0155.397] lstrlenW (lpString=".cfm") returned 4
	[0155.397] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0155.397] lstrlenW (lpString=".cfml") returned 5
	[0155.397] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0155.397] lstrlenW (lpString=".cfu") returned 4
	[0155.397] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0155.397] lstrlenW (lpString=".chm") returned 4
	[0155.397] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0155.397] lstrlenW (lpString=".cin") returned 4
	[0155.397] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0155.397] lstrlenW (lpString=".class") returned 6
	[0155.397] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0155.397] lstrlenW (lpString=".clx") returned 4
	[0155.397] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".config") returned 7
	[0155.398] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0155.398] lstrlenW (lpString=".cpp") returned 4
	[0155.398] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".cr2") returned 4
	[0155.398] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".crt") returned 4
	[0155.398] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".crw") returned 4
	[0155.398] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".cs") returned 3
	[0155.398] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0155.398] lstrlenW (lpString=".css") returned 4
	[0155.398] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".csv") returned 4
	[0155.398] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".cub") returned 4
	[0155.398] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".dae") returned 4
	[0155.398] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".dat") returned 4
	[0155.398] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".db") returned 3
	[0155.398] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0155.398] lstrlenW (lpString=".dbf") returned 4
	[0155.398] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".dbx") returned 4
	[0155.398] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".dc3") returned 4
	[0155.398] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".dcm") returned 4
	[0155.398] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0155.398] lstrlenW (lpString=".dcr") returned 4
	[0155.399] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0155.399] lstrlenW (lpString=".der") returned 4
	[0155.399] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0155.399] lstrlenW (lpString=".dib") returned 4
	[0155.399] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0155.399] lstrlenW (lpString=".dic") returned 4
	[0155.399] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0155.399] lstrlenW (lpString=".dif") returned 4
	[0155.399] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0155.399] lstrlenW (lpString=".divx") returned 5
	[0155.399] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0155.399] lstrlenW (lpString=".djvu") returned 5
	[0155.399] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0155.399] lstrlenW (lpString=".dng") returned 4
	[0155.399] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0155.399] lstrlenW (lpString=".doc") returned 4
	[0155.399] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.399] lstrlenW (lpString=".docm") returned 5
	[0155.399] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0155.399] lstrlenW (lpString=".docx") returned 5
	[0155.399] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.399] lstrlenW (lpString=".dot") returned 4
	[0155.399] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0155.399] lstrlenW (lpString=".dotm") returned 5
	[0155.399] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0155.399] lstrlenW (lpString=".dotx") returned 5
	[0155.399] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0155.399] lstrlenW (lpString=".dpx") returned 4
	[0155.399] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0155.399] lstrlenW (lpString=".dqy") returned 4
	[0155.399] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0155.399] lstrlenW (lpString=".dsn") returned 4
	[0155.399] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0155.400] lstrlenW (lpString=".dt") returned 3
	[0155.400] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0155.400] lstrlenW (lpString=".dtd") returned 4
	[0155.400] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0155.400] lstrlenW (lpString=".dwg") returned 4
	[0155.400] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0155.400] lstrlenW (lpString=".dwt") returned 4
	[0155.400] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0155.400] lstrlenW (lpString=".dx") returned 3
	[0155.400] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0155.400] lstrlenW (lpString=".dxf") returned 4
	[0155.400] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0155.400] lstrlenW (lpString=".edml") returned 5
	[0155.400] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0155.400] lstrlenW (lpString=".efd") returned 4
	[0155.400] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0155.400] lstrlenW (lpString=".elf") returned 4
	[0155.400] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0155.400] lstrlenW (lpString=".emf") returned 4
	[0155.400] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0155.400] lstrlenW (lpString=".emz") returned 4
	[0155.400] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0155.400] lstrlenW (lpString=".epf") returned 4
	[0155.400] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0155.400] lstrlenW (lpString=".eps") returned 4
	[0155.400] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0155.400] lstrlenW (lpString=".epsf") returned 5
	[0155.400] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0155.400] lstrlenW (lpString=".epsp") returned 5
	[0155.400] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0155.400] lstrlenW (lpString=".erf") returned 4
	[0155.400] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0155.401] lstrlenW (lpString=".exr") returned 4
	[0155.401] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0155.401] lstrlenW (lpString=".f4v") returned 4
	[0155.401] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0155.401] lstrlenW (lpString=".fido") returned 5
	[0155.401] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0155.401] lstrlenW (lpString=".flm") returned 4
	[0155.401] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0155.401] lstrlenW (lpString=".flv") returned 4
	[0155.401] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0155.401] lstrlenW (lpString=".frm") returned 4
	[0155.401] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0155.401] lstrlenW (lpString=".fxg") returned 4
	[0155.401] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0155.401] lstrlenW (lpString=".geo") returned 4
	[0155.401] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0155.401] lstrlenW (lpString=".gif") returned 4
	[0155.401] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0155.401] lstrlenW (lpString=".grs") returned 4
	[0155.401] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0155.401] lstrlenW (lpString=".gz") returned 3
	[0155.401] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0155.401] lstrlenW (lpString=".h") returned 2
	[0155.401] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0155.402] lstrlenW (lpString=".hdr") returned 4
	[0155.402] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".hpp") returned 4
	[0155.402] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".hta") returned 4
	[0155.402] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".htc") returned 4
	[0155.402] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".htm") returned 4
	[0155.402] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".html") returned 5
	[0155.402] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0155.402] lstrlenW (lpString=".icb") returned 4
	[0155.402] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".ics") returned 4
	[0155.402] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".iff") returned 4
	[0155.402] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".inc") returned 4
	[0155.402] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".indd") returned 5
	[0155.402] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0155.402] lstrlenW (lpString=".ini") returned 4
	[0155.402] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".iqy") returned 4
	[0155.402] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".j2c") returned 4
	[0155.402] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".j2k") returned 4
	[0155.402] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0155.402] lstrlenW (lpString=".java") returned 5
	[0155.402] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0155.402] lstrlenW (lpString=".jp2") returned 4
	[0155.403] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".jpc") returned 4
	[0155.403] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".jpe") returned 4
	[0155.403] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".jpeg") returned 5
	[0155.403] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0155.403] lstrlenW (lpString=".jpf") returned 4
	[0155.403] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".jpg") returned 4
	[0155.403] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".jpx") returned 4
	[0155.403] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".js") returned 3
	[0155.403] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0155.403] lstrlenW (lpString=".jsf") returned 4
	[0155.403] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".json") returned 5
	[0155.403] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0155.403] lstrlenW (lpString=".jsp") returned 4
	[0155.403] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".kdc") returned 4
	[0155.403] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".kmz") returned 4
	[0155.403] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".kwm") returned 4
	[0155.403] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".lasso") returned 6
	[0155.403] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0155.403] lstrlenW (lpString=".lbi") returned 4
	[0155.403] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0155.403] lstrlenW (lpString=".lgf") returned 4
	[0155.403] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".lgp") returned 4
	[0155.404] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".log") returned 4
	[0155.404] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".m1v") returned 4
	[0155.404] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".m4a") returned 4
	[0155.404] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".m4v") returned 4
	[0155.404] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".max") returned 4
	[0155.404] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".md") returned 3
	[0155.404] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0155.404] lstrlenW (lpString=".mda") returned 4
	[0155.404] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".mdb") returned 4
	[0155.404] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".mde") returned 4
	[0155.404] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".mdf") returned 4
	[0155.404] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".mdw") returned 4
	[0155.404] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".mef") returned 4
	[0155.404] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".mft") returned 4
	[0155.404] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".mfw") returned 4
	[0155.404] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0155.404] lstrlenW (lpString=".mht") returned 4
	[0155.404] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0155.405] lstrlenW (lpString=".mhtml") returned 6
	[0155.405] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0155.405] lstrlenW (lpString=".mka") returned 4
	[0155.405] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0155.405] lstrlenW (lpString=".mkidx") returned 6
	[0155.405] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0155.405] lstrlenW (lpString=".mkv") returned 4
	[0155.405] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0155.405] lstrlenW (lpString=".mos") returned 4
	[0155.405] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0155.405] lstrlenW (lpString=".mov") returned 4
	[0155.405] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0155.405] lstrlenW (lpString=".mp3") returned 4
	[0155.405] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0155.405] lstrlenW (lpString=".mp4") returned 4
	[0155.405] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0155.405] lstrlenW (lpString=".mpeg") returned 5
	[0155.405] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0155.405] lstrlenW (lpString=".mpg") returned 4
	[0155.405] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0155.405] lstrlenW (lpString=".mpv") returned 4
	[0155.405] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0155.405] lstrlenW (lpString=".mrw") returned 4
	[0155.405] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0155.405] lstrlenW (lpString=".msg") returned 4
	[0155.405] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0155.405] lstrlenW (lpString=".mxl") returned 4
	[0155.405] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0155.405] lstrlenW (lpString=".myd") returned 4
	[0155.405] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0155.405] lstrlenW (lpString=".myi") returned 4
	[0155.405] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0155.405] lstrlenW (lpString=".nef") returned 4
	[0155.406] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".nrw") returned 4
	[0155.406] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".obj") returned 4
	[0155.406] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".odb") returned 4
	[0155.406] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".odc") returned 4
	[0155.406] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".odm") returned 4
	[0155.406] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".odp") returned 4
	[0155.406] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".ods") returned 4
	[0155.406] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".oft") returned 4
	[0155.406] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".one") returned 4
	[0155.406] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".onepkg") returned 7
	[0155.406] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0155.406] lstrlenW (lpString=".onetoc2") returned 8
	[0155.406] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0155.406] lstrlenW (lpString=".opt") returned 4
	[0155.406] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".oqy") returned 4
	[0155.406] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".orf") returned 4
	[0155.406] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".p12") returned 4
	[0155.406] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0155.406] lstrlenW (lpString=".p7b") returned 4
	[0155.406] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".p7c") returned 4
	[0155.407] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pam") returned 4
	[0155.407] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pbm") returned 4
	[0155.407] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pct") returned 4
	[0155.407] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pcx") returned 4
	[0155.407] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pdd") returned 4
	[0155.407] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pdf") returned 4
	[0155.407] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pdp") returned 4
	[0155.407] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pef") returned 4
	[0155.407] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pem") returned 4
	[0155.407] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pff") returned 4
	[0155.407] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pfm") returned 4
	[0155.407] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pfx") returned 4
	[0155.407] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".pgm") returned 4
	[0155.407] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".php") returned 4
	[0155.407] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0155.407] lstrlenW (lpString=".php3") returned 5
	[0155.407] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0155.408] lstrlenW (lpString=".php4") returned 5
	[0155.408] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0155.408] lstrlenW (lpString=".php5") returned 5
	[0155.408] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0155.408] lstrlenW (lpString=".phtml") returned 6
	[0155.408] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0155.408] lstrlenW (lpString=".pict") returned 5
	[0155.408] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0155.408] lstrlenW (lpString=".pl") returned 3
	[0155.408] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0155.408] lstrlenW (lpString=".pls") returned 4
	[0155.408] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0155.408] lstrlenW (lpString=".pm") returned 3
	[0155.408] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0155.408] lstrlenW (lpString=".png") returned 4
	[0155.408] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0155.408] lstrlenW (lpString=".pnm") returned 4
	[0155.408] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0155.408] lstrlenW (lpString=".pot") returned 4
	[0155.408] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0155.408] lstrlenW (lpString=".potm") returned 5
	[0155.408] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0155.408] lstrlenW (lpString=".potx") returned 5
	[0155.408] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0155.408] lstrlenW (lpString=".ppa") returned 4
	[0155.408] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0155.408] lstrlenW (lpString=".ppam") returned 5
	[0155.408] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0155.408] lstrlenW (lpString=".ppm") returned 4
	[0155.408] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0155.408] lstrlenW (lpString=".pps") returned 4
	[0155.408] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0155.409] lstrlenW (lpString=".ppsm") returned 5
	[0155.409] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0155.409] lstrlenW (lpString=".ppt") returned 4
	[0155.409] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.409] lstrlenW (lpString=".pptm") returned 5
	[0155.409] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0155.409] lstrlenW (lpString=".pptx") returned 5
	[0155.409] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0155.409] lstrlenW (lpString=".prn") returned 4
	[0155.409] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0155.409] lstrlenW (lpString=".ps") returned 3
	[0155.409] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0155.409] lstrlenW (lpString=".psb") returned 4
	[0155.409] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0155.409] lstrlenW (lpString=".psd") returned 4
	[0155.409] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0155.409] lstrlenW (lpString=".pst") returned 4
	[0155.409] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0155.409] lstrlenW (lpString=".ptx") returned 4
	[0155.409] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0155.409] lstrlenW (lpString=".pub") returned 4
	[0155.409] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0155.409] lstrlenW (lpString=".pwm") returned 4
	[0155.409] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0155.409] lstrlenW (lpString=".pxr") returned 4
	[0155.409] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0155.409] lstrlenW (lpString=".py") returned 3
	[0155.409] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0155.409] lstrlenW (lpString=".qt") returned 3
	[0155.409] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0155.409] lstrlenW (lpString=".r3d") returned 4
	[0155.409] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0155.409] lstrlenW (lpString=".raf") returned 4
	[0155.410] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0155.410] lstrlenW (lpString=".rar") returned 4
	[0155.410] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.410] lstrlenW (lpString=".raw") returned 4
	[0155.410] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1
	[0155.410] FindNextFileW (in: hFindFile=0x3e70af0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.410] FindNextFileW (in: hFindFile=0x3e70af0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.410] FindClose (in: hFindFile=0x3e70af0 | out: hFindFile=0x3e70af0) returned 1
	[0155.410] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.410] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0155.410] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4494fe8
	[0155.410] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13
	[0155.410] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName=".", cAlternateFileName="")) returned 0x3e70e30
	[0155.410] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="..", cAlternateFileName="")) returned 1
	[0155.410] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.411] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.411] lstrlenW (lpString=".1cd") returned 4
	[0155.411] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.411] lstrlenW (lpString=".3ds") returned 4
	[0155.411] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.411] lstrlenW (lpString=".3fr") returned 4
	[0155.411] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.411] lstrlenW (lpString=".3g2") returned 4
	[0155.411] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.411] lstrlenW (lpString=".3gp") returned 4
	[0155.411] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.411] lstrlenW (lpString=".7z") returned 3
	[0155.411] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.411] lstrlenW (lpString=".accda") returned 6
	[0155.411] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0155.411] lstrlenW (lpString=".accdb") returned 6
	[0155.411] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0155.411] lstrlenW (lpString=".accdc") returned 6
	[0155.411] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0155.411] lstrlenW (lpString=".accde") returned 6
	[0155.411] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0155.411] lstrlenW (lpString=".accdt") returned 6
	[0155.411] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0155.411] lstrlenW (lpString=".accdw") returned 6
	[0155.411] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0155.411] lstrlenW (lpString=".adb") returned 4
	[0155.411] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.411] lstrlenW (lpString=".adp") returned 4
	[0155.411] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.411] lstrlenW (lpString=".ai") returned 3
	[0155.411] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.411] lstrlenW (lpString=".ai3") returned 4
	[0155.411] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".ai4") returned 4
	[0155.412] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".ai5") returned 4
	[0155.412] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".ai6") returned 4
	[0155.412] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".ai7") returned 4
	[0155.412] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".ai8") returned 4
	[0155.412] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".anim") returned 5
	[0155.412] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0155.412] lstrlenW (lpString=".arw") returned 4
	[0155.412] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".as") returned 3
	[0155.412] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.412] lstrlenW (lpString=".asa") returned 4
	[0155.412] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".asc") returned 4
	[0155.412] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".ascx") returned 5
	[0155.412] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0155.412] lstrlenW (lpString=".asm") returned 4
	[0155.412] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".asmx") returned 5
	[0155.412] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0155.412] lstrlenW (lpString=".asp") returned 4
	[0155.412] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".aspx") returned 5
	[0155.412] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0155.412] lstrlenW (lpString=".asr") returned 4
	[0155.412] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.412] lstrlenW (lpString=".asx") returned 4
	[0155.413] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".avi") returned 4
	[0155.413] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".avs") returned 4
	[0155.413] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".backup") returned 7
	[0155.413] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0155.413] lstrlenW (lpString=".bak") returned 4
	[0155.413] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".bay") returned 4
	[0155.413] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".bd") returned 3
	[0155.413] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0155.413] lstrlenW (lpString=".bin") returned 4
	[0155.413] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".bmp") returned 4
	[0155.413] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".bz2") returned 4
	[0155.413] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".c") returned 2
	[0155.413] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0155.413] lstrlenW (lpString=".cdr") returned 4
	[0155.413] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".cer") returned 4
	[0155.413] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".cf") returned 3
	[0155.413] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0155.413] lstrlenW (lpString=".cfc") returned 4
	[0155.413] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".cfm") returned 4
	[0155.413] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0155.413] lstrlenW (lpString=".cfml") returned 5
	[0155.414] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0155.414] lstrlenW (lpString=".cfu") returned 4
	[0155.414] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".chm") returned 4
	[0155.414] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".cin") returned 4
	[0155.414] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".class") returned 6
	[0155.414] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0155.414] lstrlenW (lpString=".clx") returned 4
	[0155.414] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".config") returned 7
	[0155.414] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0155.414] lstrlenW (lpString=".cpp") returned 4
	[0155.414] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".cr2") returned 4
	[0155.414] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".crt") returned 4
	[0155.414] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".crw") returned 4
	[0155.414] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".cs") returned 3
	[0155.414] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0155.414] lstrlenW (lpString=".css") returned 4
	[0155.414] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".csv") returned 4
	[0155.414] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".cub") returned 4
	[0155.414] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".dae") returned 4
	[0155.414] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0155.414] lstrlenW (lpString=".dat") returned 4
	[0155.415] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".db") returned 3
	[0155.415] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0155.415] lstrlenW (lpString=".dbf") returned 4
	[0155.415] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".dbx") returned 4
	[0155.415] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".dc3") returned 4
	[0155.415] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".dcm") returned 4
	[0155.415] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".dcr") returned 4
	[0155.415] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".der") returned 4
	[0155.415] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".dib") returned 4
	[0155.415] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".dic") returned 4
	[0155.415] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".dif") returned 4
	[0155.415] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".divx") returned 5
	[0155.415] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0155.415] lstrlenW (lpString=".djvu") returned 5
	[0155.415] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0155.415] lstrlenW (lpString=".dng") returned 4
	[0155.415] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".doc") returned 4
	[0155.415] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.415] lstrlenW (lpString=".docm") returned 5
	[0155.415] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0155.415] lstrlenW (lpString=".docx") returned 5
	[0155.415] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.416] lstrlenW (lpString=".dot") returned 4
	[0155.416] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0155.416] lstrlenW (lpString=".dotm") returned 5
	[0155.416] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0155.416] lstrlenW (lpString=".dotx") returned 5
	[0155.416] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0155.416] lstrlenW (lpString=".dpx") returned 4
	[0155.416] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0155.416] lstrlenW (lpString=".dqy") returned 4
	[0155.416] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0155.416] lstrlenW (lpString=".dsn") returned 4
	[0155.416] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0155.416] lstrlenW (lpString=".dt") returned 3
	[0155.416] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0155.416] lstrlenW (lpString=".dtd") returned 4
	[0155.416] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0155.416] lstrlenW (lpString=".dwg") returned 4
	[0155.416] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0155.416] lstrlenW (lpString=".dwt") returned 4
	[0155.416] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0155.416] lstrlenW (lpString=".dx") returned 3
	[0155.416] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0155.416] lstrlenW (lpString=".dxf") returned 4
	[0155.416] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0155.416] lstrlenW (lpString=".edml") returned 5
	[0155.416] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0155.416] lstrlenW (lpString=".efd") returned 4
	[0155.417] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".elf") returned 4
	[0155.417] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".emf") returned 4
	[0155.417] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".emz") returned 4
	[0155.417] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".epf") returned 4
	[0155.417] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".eps") returned 4
	[0155.417] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".epsf") returned 5
	[0155.417] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0155.417] lstrlenW (lpString=".epsp") returned 5
	[0155.417] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0155.417] lstrlenW (lpString=".erf") returned 4
	[0155.417] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".exr") returned 4
	[0155.417] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".f4v") returned 4
	[0155.417] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".fido") returned 5
	[0155.417] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0155.417] lstrlenW (lpString=".flm") returned 4
	[0155.417] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".flv") returned 4
	[0155.417] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".frm") returned 4
	[0155.417] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".fxg") returned 4
	[0155.417] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0155.417] lstrlenW (lpString=".geo") returned 4
	[0155.418] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".gif") returned 4
	[0155.418] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".grs") returned 4
	[0155.418] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".gz") returned 3
	[0155.418] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0155.418] lstrlenW (lpString=".h") returned 2
	[0155.418] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0155.418] lstrlenW (lpString=".hdr") returned 4
	[0155.418] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".hpp") returned 4
	[0155.418] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".hta") returned 4
	[0155.418] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".htc") returned 4
	[0155.418] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".htm") returned 4
	[0155.418] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".html") returned 5
	[0155.418] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0155.418] lstrlenW (lpString=".icb") returned 4
	[0155.418] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".ics") returned 4
	[0155.418] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".iff") returned 4
	[0155.418] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".inc") returned 4
	[0155.418] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0155.418] lstrlenW (lpString=".indd") returned 5
	[0155.419] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0155.419] lstrlenW (lpString=".ini") returned 4
	[0155.419] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0155.419] lstrlenW (lpString=".iqy") returned 4
	[0155.419] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0155.419] lstrlenW (lpString=".j2c") returned 4
	[0155.419] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0155.419] lstrlenW (lpString=".j2k") returned 4
	[0155.419] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0155.419] lstrlenW (lpString=".java") returned 5
	[0155.419] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0155.419] lstrlenW (lpString=".jp2") returned 4
	[0155.419] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0155.419] lstrlenW (lpString=".jpc") returned 4
	[0155.419] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0155.419] lstrlenW (lpString=".jpe") returned 4
	[0155.419] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0155.419] lstrlenW (lpString=".jpeg") returned 5
	[0155.419] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0155.419] lstrlenW (lpString=".jpf") returned 4
	[0155.419] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0155.419] lstrlenW (lpString=".jpg") returned 4
	[0155.419] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.419] lstrlenW (lpString=".jpx") returned 4
	[0155.419] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0155.419] lstrlenW (lpString=".js") returned 3
	[0155.419] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0155.419] lstrlenW (lpString=".jsf") returned 4
	[0155.419] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0155.419] lstrlenW (lpString=".json") returned 5
	[0155.419] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0155.420] lstrlenW (lpString=".jsp") returned 4
	[0155.420] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".kdc") returned 4
	[0155.420] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".kmz") returned 4
	[0155.420] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".kwm") returned 4
	[0155.420] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".lasso") returned 6
	[0155.420] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0155.420] lstrlenW (lpString=".lbi") returned 4
	[0155.420] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".lgf") returned 4
	[0155.420] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".lgp") returned 4
	[0155.420] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".log") returned 4
	[0155.420] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".m1v") returned 4
	[0155.420] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".m4a") returned 4
	[0155.420] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".m4v") returned 4
	[0155.420] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".max") returned 4
	[0155.420] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".md") returned 3
	[0155.420] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0155.420] lstrlenW (lpString=".mda") returned 4
	[0155.420] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0155.420] lstrlenW (lpString=".mdb") returned 4
	[0155.420] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mde") returned 4
	[0155.421] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mdf") returned 4
	[0155.421] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mdw") returned 4
	[0155.421] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mef") returned 4
	[0155.421] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mft") returned 4
	[0155.421] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mfw") returned 4
	[0155.421] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mht") returned 4
	[0155.421] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mhtml") returned 6
	[0155.421] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0155.421] lstrlenW (lpString=".mka") returned 4
	[0155.421] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mkidx") returned 6
	[0155.421] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0155.421] lstrlenW (lpString=".mkv") returned 4
	[0155.421] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mos") returned 4
	[0155.421] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mov") returned 4
	[0155.421] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mp3") returned 4
	[0155.421] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mp4") returned 4
	[0155.421] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0155.421] lstrlenW (lpString=".mpeg") returned 5
	[0155.421] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0155.422] lstrlenW (lpString=".mpg") returned 4
	[0155.422] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0155.422] lstrlenW (lpString=".mpv") returned 4
	[0155.422] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0155.422] lstrlenW (lpString=".mrw") returned 4
	[0155.422] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0155.422] lstrlenW (lpString=".msg") returned 4
	[0155.422] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0155.422] lstrlenW (lpString=".mxl") returned 4
	[0155.422] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0155.422] lstrlenW (lpString=".myd") returned 4
	[0155.422] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0155.422] lstrlenW (lpString=".myi") returned 4
	[0155.422] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0155.422] lstrlenW (lpString=".nef") returned 4
	[0155.422] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0155.422] lstrlenW (lpString=".nrw") returned 4
	[0155.422] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0155.422] lstrlenW (lpString=".obj") returned 4
	[0155.422] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0155.422] lstrlenW (lpString=".odb") returned 4
	[0155.422] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0155.422] lstrlenW (lpString=".odc") returned 4
	[0155.422] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0155.422] lstrlenW (lpString=".odm") returned 4
	[0155.422] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0155.422] lstrlenW (lpString=".odp") returned 4
	[0155.422] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0155.422] lstrlenW (lpString=".ods") returned 4
	[0155.422] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0155.422] lstrlenW (lpString=".oft") returned 4
	[0155.422] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".one") returned 4
	[0155.423] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".onepkg") returned 7
	[0155.423] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0155.423] lstrlenW (lpString=".onetoc2") returned 8
	[0155.423] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0155.423] lstrlenW (lpString=".opt") returned 4
	[0155.423] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".oqy") returned 4
	[0155.423] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".orf") returned 4
	[0155.423] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".p12") returned 4
	[0155.423] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".p7b") returned 4
	[0155.423] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".p7c") returned 4
	[0155.423] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".pam") returned 4
	[0155.423] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".pbm") returned 4
	[0155.423] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".pct") returned 4
	[0155.423] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".pcx") returned 4
	[0155.423] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".pdd") returned 4
	[0155.423] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0155.423] lstrlenW (lpString=".pdf") returned 4
	[0155.423] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.424] lstrlenW (lpString=".pdp") returned 4
	[0155.424] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0155.424] lstrlenW (lpString=".pef") returned 4
	[0155.424] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0155.424] lstrlenW (lpString=".pem") returned 4
	[0155.424] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0155.424] lstrlenW (lpString=".pff") returned 4
	[0155.424] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0155.424] lstrlenW (lpString=".pfm") returned 4
	[0155.424] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0155.424] lstrlenW (lpString=".pfx") returned 4
	[0155.424] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0155.424] lstrlenW (lpString=".pgm") returned 4
	[0155.424] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0155.424] lstrlenW (lpString=".php") returned 4
	[0155.424] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0155.424] lstrlenW (lpString=".php3") returned 5
	[0155.424] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0155.424] lstrlenW (lpString=".php4") returned 5
	[0155.424] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0155.424] lstrlenW (lpString=".php5") returned 5
	[0155.424] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0155.424] lstrlenW (lpString=".phtml") returned 6
	[0155.424] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0155.424] lstrlenW (lpString=".pict") returned 5
	[0155.424] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0155.424] lstrlenW (lpString=".pl") returned 3
	[0155.424] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0155.424] lstrlenW (lpString=".pls") returned 4
	[0155.424] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0155.424] lstrlenW (lpString=".pm") returned 3
	[0155.424] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0155.425] lstrlenW (lpString=".png") returned 4
	[0155.425] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0155.425] lstrlenW (lpString=".pnm") returned 4
	[0155.425] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0155.425] lstrlenW (lpString=".pot") returned 4
	[0155.425] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0155.425] lstrlenW (lpString=".potm") returned 5
	[0155.425] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0155.425] lstrlenW (lpString=".potx") returned 5
	[0155.425] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0155.425] lstrlenW (lpString=".ppa") returned 4
	[0155.425] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0155.425] lstrlenW (lpString=".ppam") returned 5
	[0155.425] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0155.425] lstrlenW (lpString=".ppm") returned 4
	[0155.425] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0155.425] lstrlenW (lpString=".pps") returned 4
	[0155.425] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0155.425] lstrlenW (lpString=".ppsm") returned 5
	[0155.425] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0155.425] lstrlenW (lpString=".ppt") returned 4
	[0155.425] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.425] lstrlenW (lpString=".pptm") returned 5
	[0155.425] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0155.425] lstrlenW (lpString=".pptx") returned 5
	[0155.425] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0155.425] lstrlenW (lpString=".prn") returned 4
	[0155.425] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0155.425] lstrlenW (lpString=".ps") returned 3
	[0155.425] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0155.425] lstrlenW (lpString=".psb") returned 4
	[0155.425] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0155.426] lstrlenW (lpString=".psd") returned 4
	[0155.426] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0155.426] lstrlenW (lpString=".pst") returned 4
	[0155.426] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0155.426] lstrlenW (lpString=".ptx") returned 4
	[0155.426] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0155.426] lstrlenW (lpString=".pub") returned 4
	[0155.426] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0155.426] lstrlenW (lpString=".pwm") returned 4
	[0155.426] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0155.426] lstrlenW (lpString=".pxr") returned 4
	[0155.426] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0155.426] lstrlenW (lpString=".py") returned 3
	[0155.426] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0155.426] lstrlenW (lpString=".qt") returned 3
	[0155.426] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0155.426] lstrlenW (lpString=".r3d") returned 4
	[0155.426] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0155.426] lstrlenW (lpString=".raf") returned 4
	[0155.426] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0155.426] lstrlenW (lpString=".rar") returned 4
	[0155.426] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.426] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.426] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.427] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0155.427] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.427] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0155.427] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4494fe8
	[0155.427] lstrlenW (lpString="C:\\Boot\\de-DE") returned 13
	[0155.427] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName=".", cAlternateFileName="")) returned 0x3e70ef0
	[0155.427] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="..", cAlternateFileName="")) returned 1
	[0155.427] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.427] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.427] lstrlenW (lpString=".1cd") returned 4
	[0155.427] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.427] lstrlenW (lpString=".3ds") returned 4
	[0155.427] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.427] lstrlenW (lpString=".3fr") returned 4
	[0155.427] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.427] lstrlenW (lpString=".3g2") returned 4
	[0155.427] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.427] lstrlenW (lpString=".3gp") returned 4
	[0155.427] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.427] lstrlenW (lpString=".7z") returned 3
	[0155.427] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.427] lstrlenW (lpString=".accda") returned 6
	[0155.428] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0155.428] lstrlenW (lpString=".accdb") returned 6
	[0155.428] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0155.428] lstrlenW (lpString=".accdc") returned 6
	[0155.428] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0155.428] lstrlenW (lpString=".accde") returned 6
	[0155.428] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0155.428] lstrlenW (lpString=".accdt") returned 6
	[0155.428] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0155.428] lstrlenW (lpString=".accdw") returned 6
	[0155.428] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0155.428] lstrlenW (lpString=".adb") returned 4
	[0155.428] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.428] lstrlenW (lpString=".adp") returned 4
	[0155.428] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.428] lstrlenW (lpString=".ai") returned 3
	[0155.428] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.428] lstrlenW (lpString=".ai3") returned 4
	[0155.428] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.428] lstrlenW (lpString=".ai4") returned 4
	[0155.428] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.428] lstrlenW (lpString=".ai5") returned 4
	[0155.428] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.428] lstrlenW (lpString=".ai6") returned 4
	[0155.428] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.428] lstrlenW (lpString=".ai7") returned 4
	[0155.428] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.428] lstrlenW (lpString=".ai8") returned 4
	[0155.428] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.428] lstrlenW (lpString=".anim") returned 5
	[0155.428] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0155.428] lstrlenW (lpString=".arw") returned 4
	[0155.429] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.429] lstrlenW (lpString=".as") returned 3
	[0155.429] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.429] lstrlenW (lpString=".asa") returned 4
	[0155.429] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.429] lstrlenW (lpString=".asc") returned 4
	[0155.429] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.429] lstrlenW (lpString=".ascx") returned 5
	[0155.429] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0155.429] lstrlenW (lpString=".asm") returned 4
	[0155.429] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.429] lstrlenW (lpString=".asmx") returned 5
	[0155.429] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0155.429] lstrlenW (lpString=".asp") returned 4
	[0155.429] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.429] lstrlenW (lpString=".aspx") returned 5
	[0155.429] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0155.429] lstrlenW (lpString=".asr") returned 4
	[0155.429] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.429] lstrlenW (lpString=".asx") returned 4
	[0155.429] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.429] lstrlenW (lpString=".avi") returned 4
	[0155.429] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.429] lstrlenW (lpString=".avs") returned 4
	[0155.429] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.429] lstrlenW (lpString=".backup") returned 7
	[0155.429] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0155.429] lstrlenW (lpString=".bak") returned 4
	[0155.429] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0155.429] lstrlenW (lpString=".bay") returned 4
	[0155.429] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0155.429] lstrlenW (lpString=".bd") returned 3
	[0155.430] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0155.430] lstrlenW (lpString=".bin") returned 4
	[0155.430] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0155.430] lstrlenW (lpString=".bmp") returned 4
	[0155.430] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0155.430] lstrlenW (lpString=".bz2") returned 4
	[0155.430] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.430] lstrlenW (lpString=".c") returned 2
	[0155.430] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0155.430] lstrlenW (lpString=".cdr") returned 4
	[0155.430] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0155.430] lstrlenW (lpString=".cer") returned 4
	[0155.430] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0155.430] lstrlenW (lpString=".cf") returned 3
	[0155.430] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0155.430] lstrlenW (lpString=".cfc") returned 4
	[0155.430] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0155.430] lstrlenW (lpString=".cfm") returned 4
	[0155.430] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0155.430] lstrlenW (lpString=".cfml") returned 5
	[0155.430] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0155.430] lstrlenW (lpString=".cfu") returned 4
	[0155.430] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0155.430] lstrlenW (lpString=".chm") returned 4
	[0155.430] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0155.430] lstrlenW (lpString=".cin") returned 4
	[0155.430] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0155.430] lstrlenW (lpString=".class") returned 6
	[0155.430] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0155.430] lstrlenW (lpString=".clx") returned 4
	[0155.430] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0155.430] lstrlenW (lpString=".config") returned 7
	[0155.430] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0155.431] lstrlenW (lpString=".cpp") returned 4
	[0155.431] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".cr2") returned 4
	[0155.431] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".crt") returned 4
	[0155.431] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".crw") returned 4
	[0155.431] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".cs") returned 3
	[0155.431] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0155.431] lstrlenW (lpString=".css") returned 4
	[0155.431] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".csv") returned 4
	[0155.431] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".cub") returned 4
	[0155.431] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".dae") returned 4
	[0155.431] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".dat") returned 4
	[0155.431] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".db") returned 3
	[0155.431] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0155.431] lstrlenW (lpString=".dbf") returned 4
	[0155.431] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".dbx") returned 4
	[0155.431] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".dc3") returned 4
	[0155.431] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".dcm") returned 4
	[0155.431] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0155.431] lstrlenW (lpString=".dcr") returned 4
	[0155.432] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0155.432] lstrlenW (lpString=".der") returned 4
	[0155.432] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0155.432] lstrlenW (lpString=".dib") returned 4
	[0155.432] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0155.432] lstrlenW (lpString=".dic") returned 4
	[0155.432] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0155.432] lstrlenW (lpString=".dif") returned 4
	[0155.432] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0155.432] lstrlenW (lpString=".divx") returned 5
	[0155.432] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0155.432] lstrlenW (lpString=".djvu") returned 5
	[0155.432] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0155.432] lstrlenW (lpString=".dng") returned 4
	[0155.432] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0155.432] lstrlenW (lpString=".doc") returned 4
	[0155.539] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.539] lstrlenW (lpString=".docm") returned 5
	[0155.539] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0155.539] lstrlenW (lpString=".docx") returned 5
	[0155.539] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.539] lstrlenW (lpString=".dot") returned 4
	[0155.539] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0155.539] lstrlenW (lpString=".dotm") returned 5
	[0155.539] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0155.539] lstrlenW (lpString=".dotx") returned 5
	[0155.539] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0155.539] lstrlenW (lpString=".dpx") returned 4
	[0155.539] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0155.539] lstrlenW (lpString=".dqy") returned 4
	[0155.539] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0155.539] lstrlenW (lpString=".dsn") returned 4
	[0155.539] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0155.539] lstrlenW (lpString=".dt") returned 3
	[0155.539] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0155.539] lstrlenW (lpString=".dtd") returned 4
	[0155.539] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0155.539] lstrlenW (lpString=".dwg") returned 4
	[0155.539] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0155.539] lstrlenW (lpString=".dwt") returned 4
	[0155.539] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0155.540] lstrlenW (lpString=".dx") returned 3
	[0155.540] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0155.540] lstrlenW (lpString=".dxf") returned 4
	[0155.540] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0155.540] lstrlenW (lpString=".edml") returned 5
	[0155.540] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0155.540] lstrlenW (lpString=".efd") returned 4
	[0155.540] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0155.540] lstrlenW (lpString=".elf") returned 4
	[0155.540] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0155.540] lstrlenW (lpString=".emf") returned 4
	[0155.540] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0155.540] lstrlenW (lpString=".emz") returned 4
	[0155.540] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0155.540] lstrlenW (lpString=".epf") returned 4
	[0155.540] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0155.540] lstrlenW (lpString=".eps") returned 4
	[0155.540] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0155.540] lstrlenW (lpString=".epsf") returned 5
	[0155.540] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0155.540] lstrlenW (lpString=".epsp") returned 5
	[0155.540] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0155.540] lstrlenW (lpString=".erf") returned 4
	[0155.540] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0155.540] lstrlenW (lpString=".exr") returned 4
	[0155.540] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0155.540] lstrlenW (lpString=".f4v") returned 4
	[0155.540] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0155.540] lstrlenW (lpString=".fido") returned 5
	[0155.540] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0155.540] lstrlenW (lpString=".flm") returned 4
	[0155.541] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".flv") returned 4
	[0155.541] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".frm") returned 4
	[0155.541] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".fxg") returned 4
	[0155.541] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".geo") returned 4
	[0155.541] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".gif") returned 4
	[0155.541] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".grs") returned 4
	[0155.541] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".gz") returned 3
	[0155.541] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0155.541] lstrlenW (lpString=".h") returned 2
	[0155.541] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0155.541] lstrlenW (lpString=".hdr") returned 4
	[0155.541] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".hpp") returned 4
	[0155.541] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".hta") returned 4
	[0155.541] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".htc") returned 4
	[0155.541] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".htm") returned 4
	[0155.541] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0155.541] lstrlenW (lpString=".html") returned 5
	[0155.541] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0155.541] lstrlenW (lpString=".icb") returned 4
	[0155.542] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".ics") returned 4
	[0155.542] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".iff") returned 4
	[0155.542] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".inc") returned 4
	[0155.542] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".indd") returned 5
	[0155.542] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0155.542] lstrlenW (lpString=".ini") returned 4
	[0155.542] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".iqy") returned 4
	[0155.542] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".j2c") returned 4
	[0155.542] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".j2k") returned 4
	[0155.542] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".java") returned 5
	[0155.542] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0155.542] lstrlenW (lpString=".jp2") returned 4
	[0155.542] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".jpc") returned 4
	[0155.542] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".jpe") returned 4
	[0155.542] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".jpeg") returned 5
	[0155.542] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0155.542] lstrlenW (lpString=".jpf") returned 4
	[0155.542] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".jpg") returned 4
	[0155.542] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.542] lstrlenW (lpString=".jpx") returned 4
	[0155.542] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".js") returned 3
	[0155.543] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0155.543] lstrlenW (lpString=".jsf") returned 4
	[0155.543] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".json") returned 5
	[0155.543] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0155.543] lstrlenW (lpString=".jsp") returned 4
	[0155.543] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".kdc") returned 4
	[0155.543] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".kmz") returned 4
	[0155.543] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".kwm") returned 4
	[0155.543] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".lasso") returned 6
	[0155.543] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0155.543] lstrlenW (lpString=".lbi") returned 4
	[0155.543] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".lgf") returned 4
	[0155.543] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".lgp") returned 4
	[0155.543] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".log") returned 4
	[0155.543] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".m1v") returned 4
	[0155.543] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".m4a") returned 4
	[0155.543] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".m4v") returned 4
	[0155.543] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0155.543] lstrlenW (lpString=".max") returned 4
	[0155.543] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".md") returned 3
	[0155.544] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0155.544] lstrlenW (lpString=".mda") returned 4
	[0155.544] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mdb") returned 4
	[0155.544] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mde") returned 4
	[0155.544] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mdf") returned 4
	[0155.544] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mdw") returned 4
	[0155.544] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mef") returned 4
	[0155.544] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mft") returned 4
	[0155.544] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mfw") returned 4
	[0155.544] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mht") returned 4
	[0155.544] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mhtml") returned 6
	[0155.544] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0155.544] lstrlenW (lpString=".mka") returned 4
	[0155.544] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mkidx") returned 6
	[0155.544] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0155.544] lstrlenW (lpString=".mkv") returned 4
	[0155.544] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mos") returned 4
	[0155.544] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0155.544] lstrlenW (lpString=".mov") returned 4
	[0155.544] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0155.545] lstrlenW (lpString=".mp3") returned 4
	[0155.545] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0155.545] lstrlenW (lpString=".mp4") returned 4
	[0155.545] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0155.545] lstrlenW (lpString=".mpeg") returned 5
	[0155.545] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0155.545] lstrlenW (lpString=".mpg") returned 4
	[0155.545] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0155.545] lstrlenW (lpString=".mpv") returned 4
	[0155.545] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0155.545] lstrlenW (lpString=".mrw") returned 4
	[0155.545] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0155.545] lstrlenW (lpString=".msg") returned 4
	[0155.545] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0155.545] lstrlenW (lpString=".mxl") returned 4
	[0155.545] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0155.545] lstrlenW (lpString=".myd") returned 4
	[0155.545] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0155.545] lstrlenW (lpString=".myi") returned 4
	[0155.545] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0155.545] lstrlenW (lpString=".nef") returned 4
	[0155.545] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0155.545] lstrlenW (lpString=".nrw") returned 4
	[0155.545] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0155.545] lstrlenW (lpString=".obj") returned 4
	[0155.545] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0155.545] lstrlenW (lpString=".odb") returned 4
	[0155.545] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0155.545] lstrlenW (lpString=".odc") returned 4
	[0155.545] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0155.545] lstrlenW (lpString=".odm") returned 4
	[0155.545] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".odp") returned 4
	[0155.546] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".ods") returned 4
	[0155.546] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".oft") returned 4
	[0155.546] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".one") returned 4
	[0155.546] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".onepkg") returned 7
	[0155.546] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0155.546] lstrlenW (lpString=".onetoc2") returned 8
	[0155.546] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0155.546] lstrlenW (lpString=".opt") returned 4
	[0155.546] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".oqy") returned 4
	[0155.546] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".orf") returned 4
	[0155.546] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".p12") returned 4
	[0155.546] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".p7b") returned 4
	[0155.546] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".p7c") returned 4
	[0155.546] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".pam") returned 4
	[0155.546] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".pbm") returned 4
	[0155.546] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".pct") returned 4
	[0155.546] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".pcx") returned 4
	[0155.546] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0155.546] lstrlenW (lpString=".pdd") returned 4
	[0155.547] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0155.547] lstrlenW (lpString=".pdf") returned 4
	[0155.547] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.547] lstrlenW (lpString=".pdp") returned 4
	[0155.547] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0155.547] lstrlenW (lpString=".pef") returned 4
	[0155.547] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0155.547] lstrlenW (lpString=".pem") returned 4
	[0155.547] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0155.547] lstrlenW (lpString=".pff") returned 4
	[0155.547] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0155.547] lstrlenW (lpString=".pfm") returned 4
	[0155.547] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0155.547] lstrlenW (lpString=".pfx") returned 4
	[0155.547] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0155.547] lstrlenW (lpString=".pgm") returned 4
	[0155.547] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0155.547] lstrlenW (lpString=".php") returned 4
	[0155.547] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0155.547] lstrlenW (lpString=".php3") returned 5
	[0155.547] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0155.547] lstrlenW (lpString=".php4") returned 5
	[0155.547] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0155.547] lstrlenW (lpString=".php5") returned 5
	[0155.547] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0155.547] lstrlenW (lpString=".phtml") returned 6
	[0155.547] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0155.547] lstrlenW (lpString=".pict") returned 5
	[0155.547] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0155.547] lstrlenW (lpString=".pl") returned 3
	[0155.547] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0155.547] lstrlenW (lpString=".pls") returned 4
	[0155.548] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0155.548] lstrlenW (lpString=".pm") returned 3
	[0155.548] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0155.548] lstrlenW (lpString=".png") returned 4
	[0155.548] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0155.548] lstrlenW (lpString=".pnm") returned 4
	[0155.548] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0155.548] lstrlenW (lpString=".pot") returned 4
	[0155.548] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0155.548] lstrlenW (lpString=".potm") returned 5
	[0155.548] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0155.548] lstrlenW (lpString=".potx") returned 5
	[0155.548] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0155.548] lstrlenW (lpString=".ppa") returned 4
	[0155.548] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0155.548] lstrlenW (lpString=".ppam") returned 5
	[0155.548] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0155.548] lstrlenW (lpString=".ppm") returned 4
	[0155.548] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0155.548] lstrlenW (lpString=".pps") returned 4
	[0155.548] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0155.548] lstrlenW (lpString=".ppsm") returned 5
	[0155.548] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0155.548] lstrlenW (lpString=".ppt") returned 4
	[0155.548] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.548] lstrlenW (lpString=".pptm") returned 5
	[0155.548] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0155.548] lstrlenW (lpString=".pptx") returned 5
	[0155.548] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0155.548] lstrlenW (lpString=".prn") returned 4
	[0155.548] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0155.548] lstrlenW (lpString=".ps") returned 3
	[0155.549] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0155.549] lstrlenW (lpString=".psb") returned 4
	[0155.549] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0155.549] lstrlenW (lpString=".psd") returned 4
	[0155.549] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0155.549] lstrlenW (lpString=".pst") returned 4
	[0155.549] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0155.549] lstrlenW (lpString=".ptx") returned 4
	[0155.549] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0155.549] lstrlenW (lpString=".pub") returned 4
	[0155.549] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0155.549] lstrlenW (lpString=".pwm") returned 4
	[0155.549] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0155.549] lstrlenW (lpString=".pxr") returned 4
	[0155.549] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0155.549] lstrlenW (lpString=".py") returned 3
	[0155.549] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0155.549] lstrlenW (lpString=".qt") returned 3
	[0155.549] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0155.549] lstrlenW (lpString=".r3d") returned 4
	[0155.549] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0155.549] lstrlenW (lpString=".raf") returned 4
	[0155.549] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0155.549] lstrlenW (lpString=".rar") returned 4
	[0155.549] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.549] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.550] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.550] FindClose (in: hFindFile=0x3e70ef0 | out: hFindFile=0x3e70ef0) returned 1
	[0155.550] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.550] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0155.550] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4494fe8
	[0155.550] lstrlenW (lpString="C:\\Boot\\el-GR") returned 13
	[0155.550] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName=".", cAlternateFileName="")) returned 0x3e71030
	[0155.550] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="..", cAlternateFileName="")) returned 1
	[0155.550] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.550] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.550] lstrlenW (lpString=".1cd") returned 4
	[0155.550] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.550] lstrlenW (lpString=".3ds") returned 4
	[0155.550] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.550] lstrlenW (lpString=".3fr") returned 4
	[0155.550] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.550] lstrlenW (lpString=".3g2") returned 4
	[0155.550] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.550] lstrlenW (lpString=".3gp") returned 4
	[0155.551] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.551] lstrlenW (lpString=".7z") returned 3
	[0155.551] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.551] lstrlenW (lpString=".accda") returned 6
	[0155.551] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0155.551] lstrlenW (lpString=".accdb") returned 6
	[0155.551] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0155.551] lstrlenW (lpString=".accdc") returned 6
	[0155.551] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0155.551] lstrlenW (lpString=".accde") returned 6
	[0155.551] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0155.551] lstrlenW (lpString=".accdt") returned 6
	[0155.551] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0155.551] lstrlenW (lpString=".accdw") returned 6
	[0155.551] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0155.551] lstrlenW (lpString=".adb") returned 4
	[0155.551] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.551] lstrlenW (lpString=".adp") returned 4
	[0155.551] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.551] lstrlenW (lpString=".ai") returned 3
	[0155.551] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.551] lstrlenW (lpString=".ai3") returned 4
	[0155.551] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.551] lstrlenW (lpString=".ai4") returned 4
	[0155.551] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.551] lstrlenW (lpString=".ai5") returned 4
	[0155.551] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.551] lstrlenW (lpString=".ai6") returned 4
	[0155.551] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.551] lstrlenW (lpString=".ai7") returned 4
	[0155.551] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.551] lstrlenW (lpString=".ai8") returned 4
	[0155.551] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.552] lstrlenW (lpString=".anim") returned 5
	[0155.552] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0155.552] lstrlenW (lpString=".arw") returned 4
	[0155.552] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.552] lstrlenW (lpString=".as") returned 3
	[0155.552] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.552] lstrlenW (lpString=".asa") returned 4
	[0155.552] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.552] lstrlenW (lpString=".asc") returned 4
	[0155.552] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.552] lstrlenW (lpString=".ascx") returned 5
	[0155.552] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0155.552] lstrlenW (lpString=".asm") returned 4
	[0155.552] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.552] lstrlenW (lpString=".asmx") returned 5
	[0155.552] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0155.552] lstrlenW (lpString=".asp") returned 4
	[0155.552] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.552] lstrlenW (lpString=".aspx") returned 5
	[0155.552] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0155.552] lstrlenW (lpString=".asr") returned 4
	[0155.552] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.552] lstrlenW (lpString=".asx") returned 4
	[0155.552] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.552] lstrlenW (lpString=".avi") returned 4
	[0155.552] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.552] lstrlenW (lpString=".avs") returned 4
	[0155.552] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.552] lstrlenW (lpString=".backup") returned 7
	[0155.552] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0155.552] lstrlenW (lpString=".bak") returned 4
	[0155.552] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".bay") returned 4
	[0155.553] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".bd") returned 3
	[0155.553] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0155.553] lstrlenW (lpString=".bin") returned 4
	[0155.553] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".bmp") returned 4
	[0155.553] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".bz2") returned 4
	[0155.553] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".c") returned 2
	[0155.553] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0155.553] lstrlenW (lpString=".cdr") returned 4
	[0155.553] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".cer") returned 4
	[0155.553] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".cf") returned 3
	[0155.553] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0155.553] lstrlenW (lpString=".cfc") returned 4
	[0155.553] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".cfm") returned 4
	[0155.553] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".cfml") returned 5
	[0155.553] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0155.553] lstrlenW (lpString=".cfu") returned 4
	[0155.553] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".chm") returned 4
	[0155.553] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".cin") returned 4
	[0155.553] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0155.553] lstrlenW (lpString=".class") returned 6
	[0155.553] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0155.553] lstrlenW (lpString=".clx") returned 4
	[0155.554] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".config") returned 7
	[0155.554] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0155.554] lstrlenW (lpString=".cpp") returned 4
	[0155.554] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".cr2") returned 4
	[0155.554] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".crt") returned 4
	[0155.554] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".crw") returned 4
	[0155.554] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".cs") returned 3
	[0155.554] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0155.554] lstrlenW (lpString=".css") returned 4
	[0155.554] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".csv") returned 4
	[0155.554] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".cub") returned 4
	[0155.554] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".dae") returned 4
	[0155.554] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".dat") returned 4
	[0155.554] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".db") returned 3
	[0155.554] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0155.554] lstrlenW (lpString=".dbf") returned 4
	[0155.554] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".dbx") returned 4
	[0155.554] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".dc3") returned 4
	[0155.554] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0155.554] lstrlenW (lpString=".dcm") returned 4
	[0155.555] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0155.555] lstrlenW (lpString=".dcr") returned 4
	[0155.555] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0155.555] lstrlenW (lpString=".der") returned 4
	[0155.555] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0155.555] lstrlenW (lpString=".dib") returned 4
	[0155.555] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0155.555] lstrlenW (lpString=".dic") returned 4
	[0155.555] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0155.555] lstrlenW (lpString=".dif") returned 4
	[0155.555] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0155.555] lstrlenW (lpString=".divx") returned 5
	[0155.555] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0155.555] lstrlenW (lpString=".djvu") returned 5
	[0155.555] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0155.555] lstrlenW (lpString=".dng") returned 4
	[0155.555] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0155.555] lstrlenW (lpString=".doc") returned 4
	[0155.555] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.555] lstrlenW (lpString=".docm") returned 5
	[0155.555] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0155.555] lstrlenW (lpString=".docx") returned 5
	[0155.555] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.555] lstrlenW (lpString=".dot") returned 4
	[0155.555] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0155.555] lstrlenW (lpString=".dotm") returned 5
	[0155.555] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0155.555] lstrlenW (lpString=".dotx") returned 5
	[0155.555] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0155.555] lstrlenW (lpString=".dpx") returned 4
	[0155.555] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0155.555] lstrlenW (lpString=".dqy") returned 4
	[0155.555] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".dsn") returned 4
	[0155.556] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".dt") returned 3
	[0155.556] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0155.556] lstrlenW (lpString=".dtd") returned 4
	[0155.556] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".dwg") returned 4
	[0155.556] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".dwt") returned 4
	[0155.556] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".dx") returned 3
	[0155.556] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0155.556] lstrlenW (lpString=".dxf") returned 4
	[0155.556] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".edml") returned 5
	[0155.556] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0155.556] lstrlenW (lpString=".efd") returned 4
	[0155.556] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".elf") returned 4
	[0155.556] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".emf") returned 4
	[0155.556] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".emz") returned 4
	[0155.556] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".epf") returned 4
	[0155.556] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".eps") returned 4
	[0155.556] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0155.556] lstrlenW (lpString=".epsf") returned 5
	[0155.556] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0155.556] lstrlenW (lpString=".epsp") returned 5
	[0155.556] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0155.556] lstrlenW (lpString=".erf") returned 4
	[0155.557] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0155.557] lstrlenW (lpString=".exr") returned 4
	[0155.557] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0155.557] lstrlenW (lpString=".f4v") returned 4
	[0155.557] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0155.557] lstrlenW (lpString=".fido") returned 5
	[0155.557] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0155.557] lstrlenW (lpString=".flm") returned 4
	[0155.557] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0155.557] lstrlenW (lpString=".flv") returned 4
	[0155.557] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0155.557] lstrlenW (lpString=".frm") returned 4
	[0155.557] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0155.557] lstrlenW (lpString=".fxg") returned 4
	[0155.557] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0155.557] lstrlenW (lpString=".geo") returned 4
	[0155.557] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0155.557] lstrlenW (lpString=".gif") returned 4
	[0155.557] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0155.557] lstrlenW (lpString=".grs") returned 4
	[0155.557] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0155.557] lstrlenW (lpString=".gz") returned 3
	[0155.557] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0155.557] lstrlenW (lpString=".h") returned 2
	[0155.557] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0155.557] lstrlenW (lpString=".hdr") returned 4
	[0155.557] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".hpp") returned 4
	[0155.558] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".hta") returned 4
	[0155.558] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".htc") returned 4
	[0155.558] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".htm") returned 4
	[0155.558] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".html") returned 5
	[0155.558] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0155.558] lstrlenW (lpString=".icb") returned 4
	[0155.558] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".ics") returned 4
	[0155.558] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".iff") returned 4
	[0155.558] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".inc") returned 4
	[0155.558] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".indd") returned 5
	[0155.558] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0155.558] lstrlenW (lpString=".ini") returned 4
	[0155.558] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".iqy") returned 4
	[0155.558] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".j2c") returned 4
	[0155.558] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".j2k") returned 4
	[0155.558] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0155.558] lstrlenW (lpString=".java") returned 5
	[0155.558] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0155.558] lstrlenW (lpString=".jp2") returned 4
	[0155.558] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".jpc") returned 4
	[0155.559] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".jpe") returned 4
	[0155.559] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".jpeg") returned 5
	[0155.559] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0155.559] lstrlenW (lpString=".jpf") returned 4
	[0155.559] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".jpg") returned 4
	[0155.559] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".jpx") returned 4
	[0155.559] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".js") returned 3
	[0155.559] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0155.559] lstrlenW (lpString=".jsf") returned 4
	[0155.559] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".json") returned 5
	[0155.559] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0155.559] lstrlenW (lpString=".jsp") returned 4
	[0155.559] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".kdc") returned 4
	[0155.559] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".kmz") returned 4
	[0155.559] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".kwm") returned 4
	[0155.559] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".lasso") returned 6
	[0155.559] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0155.559] lstrlenW (lpString=".lbi") returned 4
	[0155.559] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0155.559] lstrlenW (lpString=".lgf") returned 4
	[0155.560] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".lgp") returned 4
	[0155.560] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".log") returned 4
	[0155.560] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".m1v") returned 4
	[0155.560] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".m4a") returned 4
	[0155.560] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".m4v") returned 4
	[0155.560] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".max") returned 4
	[0155.560] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".md") returned 3
	[0155.560] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0155.560] lstrlenW (lpString=".mda") returned 4
	[0155.560] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".mdb") returned 4
	[0155.560] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".mde") returned 4
	[0155.560] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".mdf") returned 4
	[0155.560] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".mdw") returned 4
	[0155.560] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".mef") returned 4
	[0155.560] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".mft") returned 4
	[0155.560] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".mfw") returned 4
	[0155.560] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0155.560] lstrlenW (lpString=".mht") returned 4
	[0155.561] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0155.561] lstrlenW (lpString=".mhtml") returned 6
	[0155.561] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0155.561] lstrlenW (lpString=".mka") returned 4
	[0155.561] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0155.561] lstrlenW (lpString=".mkidx") returned 6
	[0155.561] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0155.561] lstrlenW (lpString=".mkv") returned 4
	[0155.561] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0155.561] lstrlenW (lpString=".mos") returned 4
	[0155.561] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0155.561] lstrlenW (lpString=".mov") returned 4
	[0155.561] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0155.561] lstrlenW (lpString=".mp3") returned 4
	[0155.561] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0155.561] lstrlenW (lpString=".mp4") returned 4
	[0155.561] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0155.561] lstrlenW (lpString=".mpeg") returned 5
	[0155.561] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0155.561] lstrlenW (lpString=".mpg") returned 4
	[0155.561] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0155.561] lstrlenW (lpString=".mpv") returned 4
	[0155.561] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0155.561] lstrlenW (lpString=".mrw") returned 4
	[0155.561] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0155.561] lstrlenW (lpString=".msg") returned 4
	[0155.561] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0155.561] lstrlenW (lpString=".mxl") returned 4
	[0155.561] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0155.561] lstrlenW (lpString=".myd") returned 4
	[0155.561] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0155.561] lstrlenW (lpString=".myi") returned 4
	[0155.562] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".nef") returned 4
	[0155.562] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".nrw") returned 4
	[0155.562] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".obj") returned 4
	[0155.562] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".odb") returned 4
	[0155.562] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".odc") returned 4
	[0155.562] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".odm") returned 4
	[0155.562] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".odp") returned 4
	[0155.562] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".ods") returned 4
	[0155.562] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".oft") returned 4
	[0155.562] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".one") returned 4
	[0155.562] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".onepkg") returned 7
	[0155.562] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0155.562] lstrlenW (lpString=".onetoc2") returned 8
	[0155.562] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0155.562] lstrlenW (lpString=".opt") returned 4
	[0155.562] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".oqy") returned 4
	[0155.562] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0155.562] lstrlenW (lpString=".orf") returned 4
	[0155.562] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".p12") returned 4
	[0155.563] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".p7b") returned 4
	[0155.563] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".p7c") returned 4
	[0155.563] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pam") returned 4
	[0155.563] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pbm") returned 4
	[0155.563] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pct") returned 4
	[0155.563] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pcx") returned 4
	[0155.563] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pdd") returned 4
	[0155.563] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pdf") returned 4
	[0155.563] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pdp") returned 4
	[0155.563] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pef") returned 4
	[0155.563] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pem") returned 4
	[0155.563] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pff") returned 4
	[0155.563] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pfm") returned 4
	[0155.563] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pfx") returned 4
	[0155.563] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0155.563] lstrlenW (lpString=".pgm") returned 4
	[0155.563] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0155.564] lstrlenW (lpString=".php") returned 4
	[0155.564] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0155.564] lstrlenW (lpString=".php3") returned 5
	[0155.564] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0155.564] lstrlenW (lpString=".php4") returned 5
	[0155.564] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0155.564] lstrlenW (lpString=".php5") returned 5
	[0155.564] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0155.564] lstrlenW (lpString=".phtml") returned 6
	[0155.564] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0155.564] lstrlenW (lpString=".pict") returned 5
	[0155.564] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0155.564] lstrlenW (lpString=".pl") returned 3
	[0155.564] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0155.564] lstrlenW (lpString=".pls") returned 4
	[0155.564] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0155.564] lstrlenW (lpString=".pm") returned 3
	[0155.564] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0155.564] lstrlenW (lpString=".png") returned 4
	[0155.564] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0155.564] lstrlenW (lpString=".pnm") returned 4
	[0155.564] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0155.564] lstrlenW (lpString=".pot") returned 4
	[0155.564] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0155.564] lstrlenW (lpString=".potm") returned 5
	[0155.564] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0155.564] lstrlenW (lpString=".potx") returned 5
	[0155.564] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0155.564] lstrlenW (lpString=".ppa") returned 4
	[0155.564] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0155.564] lstrlenW (lpString=".ppam") returned 5
	[0155.564] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0155.564] lstrlenW (lpString=".ppm") returned 4
	[0155.565] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0155.565] lstrlenW (lpString=".pps") returned 4
	[0155.565] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0155.565] lstrlenW (lpString=".ppsm") returned 5
	[0155.565] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0155.565] lstrlenW (lpString=".ppt") returned 4
	[0155.565] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.565] lstrlenW (lpString=".pptm") returned 5
	[0155.565] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0155.565] lstrlenW (lpString=".pptx") returned 5
	[0155.565] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0155.565] lstrlenW (lpString=".prn") returned 4
	[0155.565] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0155.565] lstrlenW (lpString=".ps") returned 3
	[0155.565] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0155.565] lstrlenW (lpString=".psb") returned 4
	[0155.565] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0155.565] lstrlenW (lpString=".psd") returned 4
	[0155.565] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0155.565] lstrlenW (lpString=".pst") returned 4
	[0155.565] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0155.565] lstrlenW (lpString=".ptx") returned 4
	[0155.565] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0155.565] lstrlenW (lpString=".pub") returned 4
	[0155.565] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0155.565] lstrlenW (lpString=".pwm") returned 4
	[0155.565] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0155.565] lstrlenW (lpString=".pxr") returned 4
	[0155.565] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0155.565] lstrlenW (lpString=".py") returned 3
	[0155.565] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0155.565] lstrlenW (lpString=".qt") returned 3
	[0155.565] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0155.566] lstrlenW (lpString=".r3d") returned 4
	[0155.566] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0155.566] lstrlenW (lpString=".raf") returned 4
	[0155.566] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0155.566] lstrlenW (lpString=".rar") returned 4
	[0155.566] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.566] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.566] FindNextFileW (in: hFindFile=0x3e71030, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.566] FindClose (in: hFindFile=0x3e71030 | out: hFindFile=0x3e71030) returned 1
	[0155.566] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.566] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0155.566] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4494fe8
	[0155.566] lstrlenW (lpString="C:\\Boot\\en-GB") returned 13
	[0155.566] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName=".", cAlternateFileName="")) returned 0x3e709b0
	[0155.566] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="..", cAlternateFileName="")) returned 1
	[0155.566] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.567] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.567] lstrlenW (lpString=".1cd") returned 4
	[0155.567] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.567] lstrlenW (lpString=".3ds") returned 4
	[0155.567] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.567] lstrlenW (lpString=".3fr") returned 4
	[0155.567] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.567] lstrlenW (lpString=".3g2") returned 4
	[0155.567] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.567] lstrlenW (lpString=".3gp") returned 4
	[0155.567] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.567] lstrlenW (lpString=".7z") returned 3
	[0155.567] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.567] lstrlenW (lpString=".accda") returned 6
	[0155.567] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0155.567] lstrlenW (lpString=".accdb") returned 6
	[0155.567] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0155.567] lstrlenW (lpString=".accdc") returned 6
	[0155.567] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0155.567] lstrlenW (lpString=".accde") returned 6
	[0155.567] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0155.567] lstrlenW (lpString=".accdt") returned 6
	[0155.567] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0155.567] lstrlenW (lpString=".accdw") returned 6
	[0155.567] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0155.567] lstrlenW (lpString=".adb") returned 4
	[0155.567] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.567] lstrlenW (lpString=".adp") returned 4
	[0155.567] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.567] lstrlenW (lpString=".ai") returned 3
	[0155.567] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.567] lstrlenW (lpString=".ai3") returned 4
	[0155.568] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.568] lstrlenW (lpString=".ai4") returned 4
	[0155.568] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.568] lstrlenW (lpString=".ai5") returned 4
	[0155.568] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.568] lstrlenW (lpString=".ai6") returned 4
	[0155.568] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.568] lstrlenW (lpString=".ai7") returned 4
	[0155.568] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.568] lstrlenW (lpString=".ai8") returned 4
	[0155.568] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.568] lstrlenW (lpString=".anim") returned 5
	[0155.568] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0155.568] lstrlenW (lpString=".arw") returned 4
	[0155.568] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.568] lstrlenW (lpString=".as") returned 3
	[0155.568] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.568] lstrlenW (lpString=".asa") returned 4
	[0155.568] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.568] lstrlenW (lpString=".asc") returned 4
	[0155.568] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.568] lstrlenW (lpString=".ascx") returned 5
	[0155.568] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0155.568] lstrlenW (lpString=".asm") returned 4
	[0155.568] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.568] lstrlenW (lpString=".asmx") returned 5
	[0155.568] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0155.568] lstrlenW (lpString=".asp") returned 4
	[0155.568] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.568] lstrlenW (lpString=".aspx") returned 5
	[0155.568] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0155.568] lstrlenW (lpString=".asr") returned 4
	[0155.569] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".asx") returned 4
	[0155.569] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".avi") returned 4
	[0155.569] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".avs") returned 4
	[0155.569] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".backup") returned 7
	[0155.569] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0155.569] lstrlenW (lpString=".bak") returned 4
	[0155.569] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".bay") returned 4
	[0155.569] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".bd") returned 3
	[0155.569] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0155.569] lstrlenW (lpString=".bin") returned 4
	[0155.569] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".bmp") returned 4
	[0155.569] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".bz2") returned 4
	[0155.569] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".c") returned 2
	[0155.569] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0155.569] lstrlenW (lpString=".cdr") returned 4
	[0155.569] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".cer") returned 4
	[0155.569] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".cf") returned 3
	[0155.569] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0155.569] lstrlenW (lpString=".cfc") returned 4
	[0155.569] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0155.569] lstrlenW (lpString=".cfm") returned 4
	[0155.569] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".cfml") returned 5
	[0155.570] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0155.570] lstrlenW (lpString=".cfu") returned 4
	[0155.570] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".chm") returned 4
	[0155.570] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".cin") returned 4
	[0155.570] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".class") returned 6
	[0155.570] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0155.570] lstrlenW (lpString=".clx") returned 4
	[0155.570] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".config") returned 7
	[0155.570] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0155.570] lstrlenW (lpString=".cpp") returned 4
	[0155.570] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".cr2") returned 4
	[0155.570] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".crt") returned 4
	[0155.570] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".crw") returned 4
	[0155.570] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".cs") returned 3
	[0155.570] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0155.570] lstrlenW (lpString=".css") returned 4
	[0155.570] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".csv") returned 4
	[0155.570] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".cub") returned 4
	[0155.570] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0155.570] lstrlenW (lpString=".dae") returned 4
	[0155.570] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".dat") returned 4
	[0155.571] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".db") returned 3
	[0155.571] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0155.571] lstrlenW (lpString=".dbf") returned 4
	[0155.571] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".dbx") returned 4
	[0155.571] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".dc3") returned 4
	[0155.571] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".dcm") returned 4
	[0155.571] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".dcr") returned 4
	[0155.571] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".der") returned 4
	[0155.571] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".dib") returned 4
	[0155.571] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".dic") returned 4
	[0155.571] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".dif") returned 4
	[0155.571] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".divx") returned 5
	[0155.571] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0155.571] lstrlenW (lpString=".djvu") returned 5
	[0155.571] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0155.571] lstrlenW (lpString=".dng") returned 4
	[0155.571] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".doc") returned 4
	[0155.571] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.571] lstrlenW (lpString=".docm") returned 5
	[0155.571] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0155.571] lstrlenW (lpString=".docx") returned 5
	[0155.572] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.572] lstrlenW (lpString=".dot") returned 4
	[0155.572] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0155.572] lstrlenW (lpString=".dotm") returned 5
	[0155.572] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0155.572] lstrlenW (lpString=".dotx") returned 5
	[0155.572] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0155.572] lstrlenW (lpString=".dpx") returned 4
	[0155.572] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0155.572] lstrlenW (lpString=".dqy") returned 4
	[0155.572] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0155.572] lstrlenW (lpString=".dsn") returned 4
	[0155.572] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0155.572] lstrlenW (lpString=".dt") returned 3
	[0155.572] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0155.572] lstrlenW (lpString=".dtd") returned 4
	[0155.572] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0155.572] lstrlenW (lpString=".dwg") returned 4
	[0155.572] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0155.572] lstrlenW (lpString=".dwt") returned 4
	[0155.572] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0155.572] lstrlenW (lpString=".dx") returned 3
	[0155.572] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0155.572] lstrlenW (lpString=".dxf") returned 4
	[0155.572] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0155.572] lstrlenW (lpString=".edml") returned 5
	[0155.572] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0155.572] lstrlenW (lpString=".efd") returned 4
	[0155.572] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0155.572] lstrlenW (lpString=".elf") returned 4
	[0155.572] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0155.572] lstrlenW (lpString=".emf") returned 4
	[0155.572] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0155.573] lstrlenW (lpString=".emz") returned 4
	[0155.573] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0155.573] lstrlenW (lpString=".epf") returned 4
	[0155.701] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0155.701] lstrlenW (lpString=".eps") returned 4
	[0155.701] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0155.701] lstrlenW (lpString=".epsf") returned 5
	[0155.701] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0155.701] lstrlenW (lpString=".epsp") returned 5
	[0155.701] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0155.701] lstrlenW (lpString=".erf") returned 4
	[0155.701] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".exr") returned 4
	[0155.702] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".f4v") returned 4
	[0155.702] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".fido") returned 5
	[0155.702] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0155.702] lstrlenW (lpString=".flm") returned 4
	[0155.702] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".flv") returned 4
	[0155.702] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".frm") returned 4
	[0155.702] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".fxg") returned 4
	[0155.702] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".geo") returned 4
	[0155.702] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".gif") returned 4
	[0155.702] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".grs") returned 4
	[0155.702] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".gz") returned 3
	[0155.702] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0155.702] lstrlenW (lpString=".h") returned 2
	[0155.702] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0155.702] lstrlenW (lpString=".hdr") returned 4
	[0155.702] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".hpp") returned 4
	[0155.702] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".hta") returned 4
	[0155.702] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".htc") returned 4
	[0155.702] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0155.702] lstrlenW (lpString=".htm") returned 4
	[0155.703] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".html") returned 5
	[0155.703] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0155.703] lstrlenW (lpString=".icb") returned 4
	[0155.703] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".ics") returned 4
	[0155.703] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".iff") returned 4
	[0155.703] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".inc") returned 4
	[0155.703] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".indd") returned 5
	[0155.703] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0155.703] lstrlenW (lpString=".ini") returned 4
	[0155.703] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".iqy") returned 4
	[0155.703] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".j2c") returned 4
	[0155.703] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".j2k") returned 4
	[0155.703] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".java") returned 5
	[0155.703] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0155.703] lstrlenW (lpString=".jp2") returned 4
	[0155.703] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".jpc") returned 4
	[0155.703] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".jpe") returned 4
	[0155.703] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0155.703] lstrlenW (lpString=".jpeg") returned 5
	[0155.703] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0155.703] lstrlenW (lpString=".jpf") returned 4
	[0155.703] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".jpg") returned 4
	[0155.704] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".jpx") returned 4
	[0155.704] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".js") returned 3
	[0155.704] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0155.704] lstrlenW (lpString=".jsf") returned 4
	[0155.704] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".json") returned 5
	[0155.704] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0155.704] lstrlenW (lpString=".jsp") returned 4
	[0155.704] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".kdc") returned 4
	[0155.704] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".kmz") returned 4
	[0155.704] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".kwm") returned 4
	[0155.704] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".lasso") returned 6
	[0155.704] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0155.704] lstrlenW (lpString=".lbi") returned 4
	[0155.704] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".lgf") returned 4
	[0155.704] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".lgp") returned 4
	[0155.704] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".log") returned 4
	[0155.704] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".m1v") returned 4
	[0155.704] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".m4a") returned 4
	[0155.704] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0155.704] lstrlenW (lpString=".m4v") returned 4
	[0155.705] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".max") returned 4
	[0155.705] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".md") returned 3
	[0155.705] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0155.705] lstrlenW (lpString=".mda") returned 4
	[0155.705] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".mdb") returned 4
	[0155.705] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".mde") returned 4
	[0155.705] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".mdf") returned 4
	[0155.705] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".mdw") returned 4
	[0155.705] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".mef") returned 4
	[0155.705] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".mft") returned 4
	[0155.705] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".mfw") returned 4
	[0155.705] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".mht") returned 4
	[0155.705] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".mhtml") returned 6
	[0155.705] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0155.705] lstrlenW (lpString=".mka") returned 4
	[0155.705] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".mkidx") returned 6
	[0155.705] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0155.705] lstrlenW (lpString=".mkv") returned 4
	[0155.705] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0155.705] lstrlenW (lpString=".mos") returned 4
	[0155.706] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0155.706] lstrlenW (lpString=".mov") returned 4
	[0155.706] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0155.706] lstrlenW (lpString=".mp3") returned 4
	[0155.706] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0155.706] lstrlenW (lpString=".mp4") returned 4
	[0155.706] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0155.706] lstrlenW (lpString=".mpeg") returned 5
	[0155.706] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0155.706] lstrlenW (lpString=".mpg") returned 4
	[0155.706] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0155.706] lstrlenW (lpString=".mpv") returned 4
	[0155.706] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0155.706] lstrlenW (lpString=".mrw") returned 4
	[0155.706] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0155.706] lstrlenW (lpString=".msg") returned 4
	[0155.706] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0155.706] lstrlenW (lpString=".mxl") returned 4
	[0155.706] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0155.706] lstrlenW (lpString=".myd") returned 4
	[0155.706] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0155.706] lstrlenW (lpString=".myi") returned 4
	[0155.706] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0155.706] lstrlenW (lpString=".nef") returned 4
	[0155.706] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0155.706] lstrlenW (lpString=".nrw") returned 4
	[0155.706] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0155.706] lstrlenW (lpString=".obj") returned 4
	[0155.706] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0155.706] lstrlenW (lpString=".odb") returned 4
	[0155.706] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0155.706] lstrlenW (lpString=".odc") returned 4
	[0155.706] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0155.706] lstrlenW (lpString=".odm") returned 4
	[0155.707] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".odp") returned 4
	[0155.707] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".ods") returned 4
	[0155.707] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".oft") returned 4
	[0155.707] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".one") returned 4
	[0155.707] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".onepkg") returned 7
	[0155.707] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0155.707] lstrlenW (lpString=".onetoc2") returned 8
	[0155.707] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0155.707] lstrlenW (lpString=".opt") returned 4
	[0155.707] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".oqy") returned 4
	[0155.707] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".orf") returned 4
	[0155.707] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".p12") returned 4
	[0155.707] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".p7b") returned 4
	[0155.707] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".p7c") returned 4
	[0155.707] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".pam") returned 4
	[0155.707] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".pbm") returned 4
	[0155.707] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".pct") returned 4
	[0155.707] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0155.707] lstrlenW (lpString=".pcx") returned 4
	[0155.707] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0155.708] lstrlenW (lpString=".pdd") returned 4
	[0155.708] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0155.708] lstrlenW (lpString=".pdf") returned 4
	[0155.708] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.708] lstrlenW (lpString=".pdp") returned 4
	[0155.708] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0155.708] lstrlenW (lpString=".pef") returned 4
	[0155.708] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0155.708] lstrlenW (lpString=".pem") returned 4
	[0155.708] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0155.708] lstrlenW (lpString=".pff") returned 4
	[0155.708] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0155.708] lstrlenW (lpString=".pfm") returned 4
	[0155.708] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0155.708] lstrlenW (lpString=".pfx") returned 4
	[0155.708] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0155.708] lstrlenW (lpString=".pgm") returned 4
	[0155.708] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0155.708] lstrlenW (lpString=".php") returned 4
	[0155.708] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0155.708] lstrlenW (lpString=".php3") returned 5
	[0155.708] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0155.708] lstrlenW (lpString=".php4") returned 5
	[0155.708] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0155.708] lstrlenW (lpString=".php5") returned 5
	[0155.708] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0155.708] lstrlenW (lpString=".phtml") returned 6
	[0155.708] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0155.708] lstrlenW (lpString=".pict") returned 5
	[0155.708] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0155.708] lstrlenW (lpString=".pl") returned 3
	[0155.708] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0155.709] lstrlenW (lpString=".pls") returned 4
	[0155.709] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0155.709] lstrlenW (lpString=".pm") returned 3
	[0155.709] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0155.709] lstrlenW (lpString=".png") returned 4
	[0155.709] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0155.709] lstrlenW (lpString=".pnm") returned 4
	[0155.709] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0155.709] lstrlenW (lpString=".pot") returned 4
	[0155.709] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0155.709] lstrlenW (lpString=".potm") returned 5
	[0155.709] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0155.709] lstrlenW (lpString=".potx") returned 5
	[0155.709] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0155.709] lstrlenW (lpString=".ppa") returned 4
	[0155.709] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0155.709] lstrlenW (lpString=".ppam") returned 5
	[0155.709] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0155.709] lstrlenW (lpString=".ppm") returned 4
	[0155.709] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0155.709] lstrlenW (lpString=".pps") returned 4
	[0155.709] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0155.709] lstrlenW (lpString=".ppsm") returned 5
	[0155.709] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0155.709] lstrlenW (lpString=".ppt") returned 4
	[0155.709] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.709] lstrlenW (lpString=".pptm") returned 5
	[0155.709] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0155.709] lstrlenW (lpString=".pptx") returned 5
	[0155.709] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0155.710] lstrlenW (lpString=".prn") returned 4
	[0155.710] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0155.710] lstrlenW (lpString=".ps") returned 3
	[0155.710] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0155.710] lstrlenW (lpString=".psb") returned 4
	[0155.710] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0155.710] lstrlenW (lpString=".psd") returned 4
	[0155.710] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0155.710] lstrlenW (lpString=".pst") returned 4
	[0155.710] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0155.710] lstrlenW (lpString=".ptx") returned 4
	[0155.710] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0155.710] lstrlenW (lpString=".pub") returned 4
	[0155.710] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0155.710] lstrlenW (lpString=".pwm") returned 4
	[0155.710] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0155.710] lstrlenW (lpString=".pxr") returned 4
	[0155.710] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0155.710] lstrlenW (lpString=".py") returned 3
	[0155.710] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0155.710] lstrlenW (lpString=".qt") returned 3
	[0155.710] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0155.710] lstrlenW (lpString=".r3d") returned 4
	[0155.710] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0155.710] lstrlenW (lpString=".raf") returned 4
	[0155.710] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0155.710] lstrlenW (lpString=".rar") returned 4
	[0155.710] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.710] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0155.711] FindClose (in: hFindFile=0x3e709b0 | out: hFindFile=0x3e709b0) returned 1
	[0155.711] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.711] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="en-US", cAlternateFileName="")) returned 1
	[0155.711] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4494fe8
	[0155.711] lstrlenW (lpString="C:\\Boot\\en-US") returned 13
	[0155.711] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName=".", cAlternateFileName="")) returned 0x3e70ff0
	[0155.711] FindNextFileW (in: hFindFile=0x3e70ff0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="..", cAlternateFileName="")) returned 1
	[0155.711] FindNextFileW (in: hFindFile=0x3e70ff0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.711] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.711] lstrlenW (lpString=".1cd") returned 4
	[0155.711] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.711] lstrlenW (lpString=".3ds") returned 4
	[0155.711] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.711] lstrlenW (lpString=".3fr") returned 4
	[0155.711] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.711] lstrlenW (lpString=".3g2") returned 4
	[0155.711] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.711] lstrlenW (lpString=".3gp") returned 4
	[0155.711] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.711] lstrlenW (lpString=".7z") returned 3
	[0155.711] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.712] lstrlenW (lpString=".accda") returned 6
	[0155.712] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0155.712] lstrlenW (lpString=".accdb") returned 6
	[0155.712] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0155.712] lstrlenW (lpString=".accdc") returned 6
	[0155.712] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0155.712] lstrlenW (lpString=".accde") returned 6
	[0155.712] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0155.712] lstrlenW (lpString=".accdt") returned 6
	[0155.712] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0155.712] lstrlenW (lpString=".accdw") returned 6
	[0155.712] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0155.712] lstrlenW (lpString=".adb") returned 4
	[0155.712] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.712] lstrlenW (lpString=".adp") returned 4
	[0155.712] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.712] lstrlenW (lpString=".ai") returned 3
	[0155.712] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.712] lstrlenW (lpString=".ai3") returned 4
	[0155.712] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.712] lstrlenW (lpString=".ai4") returned 4
	[0155.712] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.712] lstrlenW (lpString=".ai5") returned 4
	[0155.712] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.712] lstrlenW (lpString=".ai6") returned 4
	[0155.712] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.712] lstrlenW (lpString=".ai7") returned 4
	[0155.712] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.712] lstrlenW (lpString=".ai8") returned 4
	[0155.712] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.712] lstrlenW (lpString=".anim") returned 5
	[0155.712] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0155.712] lstrlenW (lpString=".arw") returned 4
	[0155.713] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.713] lstrlenW (lpString=".as") returned 3
	[0155.713] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.713] lstrlenW (lpString=".asa") returned 4
	[0155.713] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.713] lstrlenW (lpString=".asc") returned 4
	[0155.713] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.713] lstrlenW (lpString=".ascx") returned 5
	[0155.713] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0155.713] lstrlenW (lpString=".asm") returned 4
	[0155.713] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.713] lstrlenW (lpString=".asmx") returned 5
	[0155.713] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0155.713] lstrlenW (lpString=".asp") returned 4
	[0155.713] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.713] lstrlenW (lpString=".aspx") returned 5
	[0155.713] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0155.713] lstrlenW (lpString=".asr") returned 4
	[0155.713] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.713] lstrlenW (lpString=".asx") returned 4
	[0155.713] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.713] lstrlenW (lpString=".avi") returned 4
	[0155.713] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.713] lstrlenW (lpString=".avs") returned 4
	[0155.715] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.715] lstrlenW (lpString=".backup") returned 7
	[0155.715] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0155.715] lstrlenW (lpString=".bak") returned 4
	[0155.715] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0155.715] lstrlenW (lpString=".bay") returned 4
	[0155.715] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0155.715] lstrlenW (lpString=".bd") returned 3
	[0155.715] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0155.715] lstrlenW (lpString=".bin") returned 4
	[0155.715] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0155.715] lstrlenW (lpString=".bmp") returned 4
	[0155.715] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0155.715] lstrlenW (lpString=".bz2") returned 4
	[0155.715] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.715] lstrlenW (lpString=".c") returned 2
	[0155.715] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0155.716] lstrlenW (lpString=".cdr") returned 4
	[0155.716] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0155.716] lstrlenW (lpString=".cer") returned 4
	[0155.716] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0155.716] lstrlenW (lpString=".cf") returned 3
	[0155.716] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0155.716] lstrlenW (lpString=".cfc") returned 4
	[0155.716] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0155.716] lstrlenW (lpString=".cfm") returned 4
	[0155.716] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0155.716] lstrlenW (lpString=".cfml") returned 5
	[0155.716] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0155.716] lstrlenW (lpString=".cfu") returned 4
	[0155.716] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0155.716] lstrlenW (lpString=".chm") returned 4
	[0155.716] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0155.716] lstrlenW (lpString=".cin") returned 4
	[0155.716] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0155.716] lstrlenW (lpString=".class") returned 6
	[0155.716] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0155.716] lstrlenW (lpString=".clx") returned 4
	[0155.716] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0155.716] lstrlenW (lpString=".config") returned 7
	[0155.716] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0155.716] lstrlenW (lpString=".cpp") returned 4
	[0155.716] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0155.716] lstrlenW (lpString=".cr2") returned 4
	[0155.716] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0155.716] lstrlenW (lpString=".crt") returned 4
	[0155.716] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0155.716] lstrlenW (lpString=".crw") returned 4
	[0155.716] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".cs") returned 3
	[0155.717] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0155.717] lstrlenW (lpString=".css") returned 4
	[0155.717] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".csv") returned 4
	[0155.717] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".cub") returned 4
	[0155.717] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".dae") returned 4
	[0155.717] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".dat") returned 4
	[0155.717] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".db") returned 3
	[0155.717] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0155.717] lstrlenW (lpString=".dbf") returned 4
	[0155.717] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".dbx") returned 4
	[0155.717] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".dc3") returned 4
	[0155.717] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".dcm") returned 4
	[0155.717] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".dcr") returned 4
	[0155.717] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".der") returned 4
	[0155.717] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".dib") returned 4
	[0155.717] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".dic") returned 4
	[0155.717] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0155.717] lstrlenW (lpString=".dif") returned 4
	[0155.717] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0155.718] lstrlenW (lpString=".divx") returned 5
	[0155.718] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0155.718] lstrlenW (lpString=".djvu") returned 5
	[0155.718] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0155.718] lstrlenW (lpString=".dng") returned 4
	[0155.718] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0155.718] lstrlenW (lpString=".doc") returned 4
	[0155.718] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.718] lstrlenW (lpString=".docm") returned 5
	[0155.718] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0155.718] lstrlenW (lpString=".docx") returned 5
	[0155.718] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.718] lstrlenW (lpString=".dot") returned 4
	[0155.718] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0155.718] lstrlenW (lpString=".dotm") returned 5
	[0155.718] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0155.718] lstrlenW (lpString=".dotx") returned 5
	[0155.718] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0155.718] lstrlenW (lpString=".dpx") returned 4
	[0155.718] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0155.718] lstrlenW (lpString=".dqy") returned 4
	[0155.718] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0155.718] lstrlenW (lpString=".dsn") returned 4
	[0155.718] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0155.718] lstrlenW (lpString=".dt") returned 3
	[0155.718] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0155.718] lstrlenW (lpString=".dtd") returned 4
	[0155.718] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0155.718] lstrlenW (lpString=".dwg") returned 4
	[0155.718] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0155.718] lstrlenW (lpString=".dwt") returned 4
	[0155.718] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".dx") returned 3
	[0155.719] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0155.719] lstrlenW (lpString=".dxf") returned 4
	[0155.719] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".edml") returned 5
	[0155.719] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0155.719] lstrlenW (lpString=".efd") returned 4
	[0155.719] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".elf") returned 4
	[0155.719] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".emf") returned 4
	[0155.719] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".emz") returned 4
	[0155.719] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".epf") returned 4
	[0155.719] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".eps") returned 4
	[0155.719] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".epsf") returned 5
	[0155.719] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0155.719] lstrlenW (lpString=".epsp") returned 5
	[0155.719] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0155.719] lstrlenW (lpString=".erf") returned 4
	[0155.719] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".exr") returned 4
	[0155.719] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".f4v") returned 4
	[0155.719] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".fido") returned 5
	[0155.719] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0155.719] lstrlenW (lpString=".flm") returned 4
	[0155.719] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0155.719] lstrlenW (lpString=".flv") returned 4
	[0155.720] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".frm") returned 4
	[0155.720] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".fxg") returned 4
	[0155.720] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".geo") returned 4
	[0155.720] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".gif") returned 4
	[0155.720] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".grs") returned 4
	[0155.720] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".gz") returned 3
	[0155.720] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0155.720] lstrlenW (lpString=".h") returned 2
	[0155.720] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0155.720] lstrlenW (lpString=".hdr") returned 4
	[0155.720] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".hpp") returned 4
	[0155.720] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".hta") returned 4
	[0155.720] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".htc") returned 4
	[0155.720] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".htm") returned 4
	[0155.720] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".html") returned 5
	[0155.720] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0155.720] lstrlenW (lpString=".icb") returned 4
	[0155.720] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".ics") returned 4
	[0155.720] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0155.720] lstrlenW (lpString=".iff") returned 4
	[0155.721] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".inc") returned 4
	[0155.721] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".indd") returned 5
	[0155.721] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0155.721] lstrlenW (lpString=".ini") returned 4
	[0155.721] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".iqy") returned 4
	[0155.721] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".j2c") returned 4
	[0155.721] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".j2k") returned 4
	[0155.721] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".java") returned 5
	[0155.721] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0155.721] lstrlenW (lpString=".jp2") returned 4
	[0155.721] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".jpc") returned 4
	[0155.721] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".jpe") returned 4
	[0155.721] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".jpeg") returned 5
	[0155.721] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0155.721] lstrlenW (lpString=".jpf") returned 4
	[0155.721] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".jpg") returned 4
	[0155.721] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".jpx") returned 4
	[0155.721] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0155.721] lstrlenW (lpString=".js") returned 3
	[0155.721] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0155.722] lstrlenW (lpString=".jsf") returned 4
	[0155.722] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".json") returned 5
	[0155.722] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0155.722] lstrlenW (lpString=".jsp") returned 4
	[0155.722] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".kdc") returned 4
	[0155.722] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".kmz") returned 4
	[0155.722] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".kwm") returned 4
	[0155.722] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".lasso") returned 6
	[0155.722] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0155.722] lstrlenW (lpString=".lbi") returned 4
	[0155.722] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".lgf") returned 4
	[0155.722] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".lgp") returned 4
	[0155.722] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".log") returned 4
	[0155.722] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".m1v") returned 4
	[0155.722] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".m4a") returned 4
	[0155.722] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".m4v") returned 4
	[0155.722] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".max") returned 4
	[0155.722] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0155.722] lstrlenW (lpString=".md") returned 3
	[0155.723] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0155.723] lstrlenW (lpString=".mda") returned 4
	[0155.723] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mdb") returned 4
	[0155.723] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mde") returned 4
	[0155.723] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mdf") returned 4
	[0155.723] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mdw") returned 4
	[0155.723] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mef") returned 4
	[0155.723] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mft") returned 4
	[0155.723] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mfw") returned 4
	[0155.723] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mht") returned 4
	[0155.723] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mhtml") returned 6
	[0155.723] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0155.723] lstrlenW (lpString=".mka") returned 4
	[0155.723] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mkidx") returned 6
	[0155.723] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0155.723] lstrlenW (lpString=".mkv") returned 4
	[0155.723] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mos") returned 4
	[0155.723] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0155.723] lstrlenW (lpString=".mov") returned 4
	[0155.723] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0155.724] lstrlenW (lpString=".mp3") returned 4
	[0155.724] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0155.724] lstrlenW (lpString=".mp4") returned 4
	[0155.724] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0155.724] lstrlenW (lpString=".mpeg") returned 5
	[0155.724] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0155.724] lstrlenW (lpString=".mpg") returned 4
	[0155.724] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0155.724] lstrlenW (lpString=".mpv") returned 4
	[0155.724] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0155.724] lstrlenW (lpString=".mrw") returned 4
	[0155.724] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0155.724] lstrlenW (lpString=".msg") returned 4
	[0155.724] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0155.724] lstrlenW (lpString=".mxl") returned 4
	[0155.724] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0155.724] lstrlenW (lpString=".myd") returned 4
	[0155.724] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0155.724] lstrlenW (lpString=".myi") returned 4
	[0155.724] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0155.724] lstrlenW (lpString=".nef") returned 4
	[0155.724] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0155.724] lstrlenW (lpString=".nrw") returned 4
	[0155.724] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0155.724] lstrlenW (lpString=".obj") returned 4
	[0155.724] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0155.724] lstrlenW (lpString=".odb") returned 4
	[0155.724] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0155.724] lstrlenW (lpString=".odc") returned 4
	[0155.725] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".odm") returned 4
	[0155.725] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".odp") returned 4
	[0155.725] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".ods") returned 4
	[0155.725] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".oft") returned 4
	[0155.725] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".one") returned 4
	[0155.725] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".onepkg") returned 7
	[0155.725] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0155.725] lstrlenW (lpString=".onetoc2") returned 8
	[0155.725] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0155.725] lstrlenW (lpString=".opt") returned 4
	[0155.725] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".oqy") returned 4
	[0155.725] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".orf") returned 4
	[0155.725] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".p12") returned 4
	[0155.725] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".p7b") returned 4
	[0155.725] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".p7c") returned 4
	[0155.725] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".pam") returned 4
	[0155.725] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".pbm") returned 4
	[0155.725] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0155.725] lstrlenW (lpString=".pct") returned 4
	[0155.726] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".pcx") returned 4
	[0155.726] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".pdd") returned 4
	[0155.726] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".pdf") returned 4
	[0155.726] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".pdp") returned 4
	[0155.726] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".pef") returned 4
	[0155.726] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".pem") returned 4
	[0155.726] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".pff") returned 4
	[0155.726] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".pfm") returned 4
	[0155.726] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".pfx") returned 4
	[0155.726] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".pgm") returned 4
	[0155.726] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".php") returned 4
	[0155.726] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0155.726] lstrlenW (lpString=".php3") returned 5
	[0155.726] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0155.726] lstrlenW (lpString=".php4") returned 5
	[0155.726] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0155.726] lstrlenW (lpString=".php5") returned 5
	[0155.726] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0155.726] lstrlenW (lpString=".phtml") returned 6
	[0155.726] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0155.726] lstrlenW (lpString=".pict") returned 5
	[0155.727] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0155.727] lstrlenW (lpString=".pl") returned 3
	[0155.727] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0155.727] lstrlenW (lpString=".pls") returned 4
	[0155.727] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0155.727] lstrlenW (lpString=".pm") returned 3
	[0155.727] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0155.727] lstrlenW (lpString=".png") returned 4
	[0155.727] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0155.727] lstrlenW (lpString=".pnm") returned 4
	[0155.727] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0155.727] lstrlenW (lpString=".pot") returned 4
	[0155.727] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0155.727] lstrlenW (lpString=".potm") returned 5
	[0155.727] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0155.727] lstrlenW (lpString=".potx") returned 5
	[0155.727] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0155.727] lstrlenW (lpString=".ppa") returned 4
	[0155.727] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0155.727] lstrlenW (lpString=".ppam") returned 5
	[0155.727] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0155.727] lstrlenW (lpString=".ppm") returned 4
	[0155.727] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0155.727] lstrlenW (lpString=".pps") returned 4
	[0155.727] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0155.727] lstrlenW (lpString=".ppsm") returned 5
	[0155.727] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0155.727] lstrlenW (lpString=".ppt") returned 4
	[0155.727] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.728] lstrlenW (lpString=".pptm") returned 5
	[0155.728] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0155.728] lstrlenW (lpString=".pptx") returned 5
	[0155.728] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0155.728] lstrlenW (lpString=".prn") returned 4
	[0155.728] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0155.728] lstrlenW (lpString=".ps") returned 3
	[0155.728] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0155.728] lstrlenW (lpString=".psb") returned 4
	[0155.728] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0155.728] lstrlenW (lpString=".psd") returned 4
	[0155.728] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0155.728] lstrlenW (lpString=".pst") returned 4
	[0155.728] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0155.728] lstrlenW (lpString=".ptx") returned 4
	[0155.728] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0155.728] lstrlenW (lpString=".pub") returned 4
	[0155.728] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0155.728] lstrlenW (lpString=".pwm") returned 4
	[0155.728] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0155.728] lstrlenW (lpString=".pxr") returned 4
	[0155.728] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0155.728] lstrlenW (lpString=".py") returned 3
	[0155.728] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0155.728] lstrlenW (lpString=".qt") returned 3
	[0155.728] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0155.728] lstrlenW (lpString=".r3d") returned 4
	[0155.728] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0155.728] lstrlenW (lpString=".raf") returned 4
	[0155.728] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0155.728] lstrlenW (lpString=".rar") returned 4
	[0155.729] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0155.729] FindNextFileW (in: hFindFile=0x3e70ff0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.729] FindNextFileW (in: hFindFile=0x3e70ff0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0155.729] FindClose (in: hFindFile=0x3e70ff0 | out: hFindFile=0x3e70ff0) returned 1
	[0155.729] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.729] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0155.729] lstrlenW (lpString="C:\\Boot\\es-ES") returned 13
	[0155.729] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Boot\\es-ES") returned 1
	[0155.729] lstrlenW (lpString="es-ES") returned 5
	[0155.729] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="es-ES") returned -1
	[0155.729] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4494fe8
	[0155.729] lstrlenW (lpString="C:\\Boot\\es-ES") returned 13
	[0155.729] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName=".", cAlternateFileName="")) returned 0x3e70a70
	[0155.730] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="..", cAlternateFileName="")) returned 1
	[0155.730] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0155.730] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0155.730] lstrlenW (lpString=".1cd") returned 4
	[0155.730] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.730] lstrlenW (lpString=".3ds") returned 4
	[0155.730] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.730] lstrlenW (lpString=".3fr") returned 4
	[0155.730] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.730] lstrlenW (lpString=".3g2") returned 4
	[0155.730] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.730] lstrlenW (lpString=".3gp") returned 4
	[0155.730] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.730] lstrlenW (lpString=".7z") returned 3
	[0155.730] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.730] lstrlenW (lpString=".accda") returned 6
	[0155.730] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0155.730] lstrlenW (lpString=".accdb") returned 6
	[0155.730] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0155.730] lstrlenW (lpString=".accdc") returned 6
	[0155.730] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0155.730] lstrlenW (lpString=".accde") returned 6
	[0155.730] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0155.730] lstrlenW (lpString=".accdt") returned 6
	[0155.730] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0155.730] lstrlenW (lpString=".accdw") returned 6
	[0155.730] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0155.730] lstrlenW (lpString=".adb") returned 4
	[0155.731] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".adp") returned 4
	[0155.731] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".ai") returned 3
	[0155.731] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.731] lstrlenW (lpString=".ai3") returned 4
	[0155.731] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".ai4") returned 4
	[0155.731] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".ai5") returned 4
	[0155.731] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".ai6") returned 4
	[0155.731] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".ai7") returned 4
	[0155.731] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".ai8") returned 4
	[0155.731] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".anim") returned 5
	[0155.731] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0155.731] lstrlenW (lpString=".arw") returned 4
	[0155.731] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".as") returned 3
	[0155.731] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.731] lstrlenW (lpString=".asa") returned 4
	[0155.731] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".asc") returned 4
	[0155.731] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".ascx") returned 5
	[0155.731] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0155.731] lstrlenW (lpString=".asm") returned 4
	[0155.731] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.731] lstrlenW (lpString=".asmx") returned 5
	[0155.732] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0155.732] lstrlenW (lpString=".asp") returned 4
	[0155.732] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.732] lstrlenW (lpString=".aspx") returned 5
	[0155.732] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0155.732] lstrlenW (lpString=".asr") returned 4
	[0155.732] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.732] lstrlenW (lpString=".asx") returned 4
	[0155.732] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.732] lstrlenW (lpString=".avi") returned 4
	[0155.732] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.732] lstrlenW (lpString=".avs") returned 4
	[0155.732] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.732] lstrlenW (lpString=".backup") returned 7
	[0155.732] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0155.732] lstrlenW (lpString=".bak") returned 4
	[0155.732] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0155.732] lstrlenW (lpString=".bay") returned 4
	[0155.732] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0155.732] lstrlenW (lpString=".bd") returned 3
	[0155.732] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0155.732] lstrlenW (lpString=".bin") returned 4
	[0155.732] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0155.732] lstrlenW (lpString=".bmp") returned 4
	[0155.732] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0155.732] lstrlenW (lpString=".bz2") returned 4
	[0155.732] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0155.732] lstrlenW (lpString=".c") returned 2
	[0155.732] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0155.732] lstrlenW (lpString=".cdr") returned 4
	[0155.732] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0155.732] lstrlenW (lpString=".cer") returned 4
	[0155.733] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0155.733] lstrlenW (lpString=".cf") returned 3
	[0155.733] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0155.733] lstrlenW (lpString=".cfc") returned 4
	[0155.733] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0155.733] lstrlenW (lpString=".cfm") returned 4
	[0155.733] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0155.733] lstrlenW (lpString=".cfml") returned 5
	[0155.733] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0155.733] lstrlenW (lpString=".cfu") returned 4
	[0155.733] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0155.733] lstrlenW (lpString=".chm") returned 4
	[0155.733] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0155.733] lstrlenW (lpString=".cin") returned 4
	[0155.733] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0155.733] lstrlenW (lpString=".class") returned 6
	[0155.733] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0155.733] lstrlenW (lpString=".clx") returned 4
	[0155.733] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0155.733] lstrlenW (lpString=".config") returned 7
	[0155.733] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0155.733] lstrlenW (lpString=".cpp") returned 4
	[0155.733] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0155.733] lstrlenW (lpString=".cr2") returned 4
	[0155.733] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0155.733] lstrlenW (lpString=".crt") returned 4
	[0155.733] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0155.733] lstrlenW (lpString=".crw") returned 4
	[0155.733] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0155.733] lstrlenW (lpString=".cs") returned 3
	[0155.733] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0155.733] lstrlenW (lpString=".css") returned 4
	[0155.733] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".csv") returned 4
	[0155.734] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".cub") returned 4
	[0155.734] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".dae") returned 4
	[0155.734] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".dat") returned 4
	[0155.734] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".db") returned 3
	[0155.734] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0155.734] lstrlenW (lpString=".dbf") returned 4
	[0155.734] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".dbx") returned 4
	[0155.734] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".dc3") returned 4
	[0155.734] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".dcm") returned 4
	[0155.734] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".dcr") returned 4
	[0155.734] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".der") returned 4
	[0155.734] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".dib") returned 4
	[0155.734] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".dic") returned 4
	[0155.734] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".dif") returned 4
	[0155.734] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0155.734] lstrlenW (lpString=".divx") returned 5
	[0155.735] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0155.735] lstrlenW (lpString=".djvu") returned 5
	[0155.735] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0155.735] lstrlenW (lpString=".dng") returned 4
	[0155.735] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0155.735] lstrlenW (lpString=".doc") returned 4
	[0155.735] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0155.735] lstrlenW (lpString=".docm") returned 5
	[0155.735] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0155.735] lstrlenW (lpString=".docx") returned 5
	[0155.735] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0155.735] lstrlenW (lpString=".dot") returned 4
	[0155.735] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0155.735] lstrlenW (lpString=".dotm") returned 5
	[0155.735] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0155.735] lstrlenW (lpString=".dotx") returned 5
	[0155.735] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0155.735] lstrlenW (lpString=".dpx") returned 4
	[0155.735] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0155.735] lstrlenW (lpString=".dqy") returned 4
	[0155.735] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0155.735] lstrlenW (lpString=".dsn") returned 4
	[0155.735] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0155.735] lstrlenW (lpString=".dt") returned 3
	[0155.735] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0155.735] lstrlenW (lpString=".dtd") returned 4
	[0155.735] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0155.735] lstrlenW (lpString=".dwg") returned 4
	[0155.735] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0155.735] lstrlenW (lpString=".dwt") returned 4
	[0155.736] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0155.736] lstrlenW (lpString=".dx") returned 3
	[0155.736] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0155.736] lstrlenW (lpString=".dxf") returned 4
	[0155.736] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0155.736] lstrlenW (lpString=".edml") returned 5
	[0155.736] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0155.736] lstrlenW (lpString=".efd") returned 4
	[0155.736] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0155.736] lstrlenW (lpString=".elf") returned 4
	[0155.736] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0155.736] lstrlenW (lpString=".emf") returned 4
	[0155.736] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0155.736] lstrlenW (lpString=".emz") returned 4
	[0155.736] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0155.736] lstrlenW (lpString=".epf") returned 4
	[0155.736] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0155.736] lstrlenW (lpString=".eps") returned 4
	[0155.736] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0155.736] lstrlenW (lpString=".epsf") returned 5
	[0155.736] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0155.736] lstrlenW (lpString=".epsp") returned 5
	[0155.736] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0155.736] lstrlenW (lpString=".erf") returned 4
	[0155.736] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0155.736] lstrlenW (lpString=".exr") returned 4
	[0155.736] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0155.736] lstrlenW (lpString=".f4v") returned 4
	[0155.736] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0155.736] lstrlenW (lpString=".fido") returned 5
	[0155.737] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0155.737] lstrlenW (lpString=".flm") returned 4
	[0155.737] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".flv") returned 4
	[0155.737] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".frm") returned 4
	[0155.737] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".fxg") returned 4
	[0155.737] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".geo") returned 4
	[0155.737] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".gif") returned 4
	[0155.737] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".grs") returned 4
	[0155.737] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".gz") returned 3
	[0155.737] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0155.737] lstrlenW (lpString=".h") returned 2
	[0155.737] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0155.737] lstrlenW (lpString=".hdr") returned 4
	[0155.737] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".hpp") returned 4
	[0155.737] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".hta") returned 4
	[0155.737] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".htc") returned 4
	[0155.737] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".htm") returned 4
	[0155.737] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0155.737] lstrlenW (lpString=".html") returned 5
	[0155.737] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0155.737] lstrlenW (lpString=".icb") returned 4
	[0155.738] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".ics") returned 4
	[0155.738] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".iff") returned 4
	[0155.738] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".inc") returned 4
	[0155.738] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".indd") returned 5
	[0155.738] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0155.738] lstrlenW (lpString=".ini") returned 4
	[0155.738] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".iqy") returned 4
	[0155.738] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".j2c") returned 4
	[0155.738] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".j2k") returned 4
	[0155.738] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".java") returned 5
	[0155.738] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0155.738] lstrlenW (lpString=".jp2") returned 4
	[0155.738] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".jpc") returned 4
	[0155.738] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".jpe") returned 4
	[0155.738] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".jpeg") returned 5
	[0155.738] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0155.738] lstrlenW (lpString=".jpf") returned 4
	[0155.738] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".jpg") returned 4
	[0155.738] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0155.738] lstrlenW (lpString=".jpx") returned 4
	[0155.739] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".js") returned 3
	[0155.739] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0155.739] lstrlenW (lpString=".jsf") returned 4
	[0155.739] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".json") returned 5
	[0155.739] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0155.739] lstrlenW (lpString=".jsp") returned 4
	[0155.739] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".kdc") returned 4
	[0155.739] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".kmz") returned 4
	[0155.739] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".kwm") returned 4
	[0155.739] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".lasso") returned 6
	[0155.739] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0155.739] lstrlenW (lpString=".lbi") returned 4
	[0155.739] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".lgf") returned 4
	[0155.739] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".lgp") returned 4
	[0155.739] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".log") returned 4
	[0155.739] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".m1v") returned 4
	[0155.739] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".m4a") returned 4
	[0155.739] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".m4v") returned 4
	[0155.739] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0155.739] lstrlenW (lpString=".max") returned 4
	[0155.740] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".md") returned 3
	[0155.740] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0155.740] lstrlenW (lpString=".mda") returned 4
	[0155.740] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".mdb") returned 4
	[0155.740] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".mde") returned 4
	[0155.740] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".mdf") returned 4
	[0155.740] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".mdw") returned 4
	[0155.740] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".mef") returned 4
	[0155.740] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".mft") returned 4
	[0155.740] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".mfw") returned 4
	[0155.740] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".mht") returned 4
	[0155.740] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".mhtml") returned 6
	[0155.740] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0155.740] lstrlenW (lpString=".mka") returned 4
	[0155.740] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".mkidx") returned 6
	[0155.740] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0155.740] lstrlenW (lpString=".mkv") returned 4
	[0155.740] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0155.740] lstrlenW (lpString=".mos") returned 4
	[0155.740] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0155.741] lstrlenW (lpString=".mov") returned 4
	[0155.741] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0155.741] lstrlenW (lpString=".mp3") returned 4
	[0155.741] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0155.741] lstrlenW (lpString=".mp4") returned 4
	[0155.741] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0155.741] lstrlenW (lpString=".mpeg") returned 5
	[0155.741] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0155.741] lstrlenW (lpString=".mpg") returned 4
	[0155.741] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0155.741] lstrlenW (lpString=".mpv") returned 4
	[0155.741] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0155.741] lstrlenW (lpString=".mrw") returned 4
	[0155.741] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0155.741] lstrlenW (lpString=".msg") returned 4
	[0155.741] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0155.741] lstrlenW (lpString=".mxl") returned 4
	[0155.741] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0155.741] lstrlenW (lpString=".myd") returned 4
	[0155.741] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0155.741] lstrlenW (lpString=".myi") returned 4
	[0155.741] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0155.741] lstrlenW (lpString=".nef") returned 4
	[0155.741] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0155.741] lstrlenW (lpString=".nrw") returned 4
	[0155.741] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0155.741] lstrlenW (lpString=".obj") returned 4
	[0155.741] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0155.741] lstrlenW (lpString=".odb") returned 4
	[0155.741] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0155.741] lstrlenW (lpString=".odc") returned 4
	[0155.741] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".odm") returned 4
	[0155.742] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".odp") returned 4
	[0155.742] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".ods") returned 4
	[0155.742] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".oft") returned 4
	[0155.742] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".one") returned 4
	[0155.742] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".onepkg") returned 7
	[0155.742] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0155.742] lstrlenW (lpString=".onetoc2") returned 8
	[0155.742] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0155.742] lstrlenW (lpString=".opt") returned 4
	[0155.742] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".oqy") returned 4
	[0155.742] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".orf") returned 4
	[0155.742] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".p12") returned 4
	[0155.742] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".p7b") returned 4
	[0155.742] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".p7c") returned 4
	[0155.742] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".pam") returned 4
	[0155.742] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".pbm") returned 4
	[0155.742] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".pct") returned 4
	[0155.742] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0155.742] lstrlenW (lpString=".pcx") returned 4
	[0155.743] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0155.743] lstrlenW (lpString=".pdd") returned 4
	[0155.743] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0155.743] lstrlenW (lpString=".pdf") returned 4
	[0155.743] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0155.743] lstrlenW (lpString=".pdp") returned 4
	[0155.743] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0155.743] lstrlenW (lpString=".pef") returned 4
	[0155.743] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0155.743] lstrlenW (lpString=".pem") returned 4
	[0155.743] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0155.743] lstrlenW (lpString=".pff") returned 4
	[0155.743] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0155.743] lstrlenW (lpString=".pfm") returned 4
	[0155.743] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0155.743] lstrlenW (lpString=".pfx") returned 4
	[0155.743] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0155.743] lstrlenW (lpString=".pgm") returned 4
	[0155.743] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0155.743] lstrlenW (lpString=".php") returned 4
	[0155.743] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0155.743] lstrlenW (lpString=".php3") returned 5
	[0155.743] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0155.743] lstrlenW (lpString=".php4") returned 5
	[0155.743] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0155.743] lstrlenW (lpString=".php5") returned 5
	[0155.743] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0155.743] lstrlenW (lpString=".phtml") returned 6
	[0155.743] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0155.743] lstrlenW (lpString=".pict") returned 5
	[0155.743] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0155.744] lstrlenW (lpString=".pl") returned 3
	[0155.744] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0155.744] lstrlenW (lpString=".pls") returned 4
	[0155.744] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0155.744] lstrlenW (lpString=".pm") returned 3
	[0155.744] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0155.744] lstrlenW (lpString=".png") returned 4
	[0155.744] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0155.744] lstrlenW (lpString=".pnm") returned 4
	[0155.744] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0155.744] lstrlenW (lpString=".pot") returned 4
	[0155.744] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0155.744] lstrlenW (lpString=".potm") returned 5
	[0155.744] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0155.744] lstrlenW (lpString=".potx") returned 5
	[0155.744] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0155.744] lstrlenW (lpString=".ppa") returned 4
	[0155.744] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0155.744] lstrlenW (lpString=".ppam") returned 5
	[0155.744] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0155.744] lstrlenW (lpString=".ppm") returned 4
	[0155.744] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0155.744] lstrlenW (lpString=".pps") returned 4
	[0155.744] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0155.744] lstrlenW (lpString=".ppsm") returned 5
	[0155.744] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0155.744] lstrlenW (lpString=".ppt") returned 4
	[0155.744] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0155.744] lstrlenW (lpString=".pptm") returned 5
	[0155.744] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0155.854] lstrlenW (lpString=".pptx") returned 5
	[0155.854] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0155.854] lstrlenW (lpString=".prn") returned 4
	[0155.862] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0155.862] lstrlenW (lpString=".ps") returned 3
	[0155.862] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0155.862] lstrlenW (lpString=".psb") returned 4
	[0155.862] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0155.862] lstrlenW (lpString=".psd") returned 4
	[0155.862] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0155.862] lstrlenW (lpString=".pst") returned 4
	[0155.862] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0155.862] lstrlenW (lpString=".ptx") returned 4
	[0155.862] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0155.862] lstrlenW (lpString=".pub") returned 4
	[0155.862] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0155.862] lstrlenW (lpString=".pwm") returned 4
	[0155.862] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0155.862] lstrlenW (lpString=".pxr") returned 4
	[0155.862] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0155.862] lstrlenW (lpString=".py") returned 3
	[0155.862] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0155.862] lstrlenW (lpString=".qt") returned 3
	[0155.862] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0155.862] lstrlenW (lpString=".r3d") returned 4
	[0155.862] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0155.862] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.863] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0155.863] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.863] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0155.863] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.863] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0155.863] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.863] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0155.865] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.866] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0155.866] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.866] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0155.866] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.866] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0155.866] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.866] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0155.866] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.866] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0155.867] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.867] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0155.867] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.867] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0155.867] FindNextFileW (in: hFindFile=0x3e70ff0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0155.867] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.867] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0155.867] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.867] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0155.868] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.868] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0155.868] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.868] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0155.868] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.868] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0155.868] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.868] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0155.868] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.869] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0155.869] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.869] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0155.869] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.869] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0155.870] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e60078 | out: hHeap=0x4c0000) returned 1
	[0155.870] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe19a, dwReserved1=0x19b, cFileName="en-US", cAlternateFileName="")) returned 0
	[0155.870] FindClose (in: hFindFile=0x3e70e30 | out: hFindFile=0x3e70e30) returned 1
	[0155.870] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.870] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0155.871] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.871] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0155.871] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.871] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0155.871] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.871] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0155.871] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.871] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0155.871] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.871] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0155.872] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.872] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0155.872] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.872] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0155.872] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.872] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0155.872] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.872] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0155.873] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.873] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0155.873] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.873] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0155.873] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0155.873] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0155.873] FindClose (in: hFindFile=0x3e70bb0 | out: hFindFile=0x3e70bb0) returned 1
	[0155.873] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4471730 | out: hHeap=0x4c0000) returned 1
	[0155.875] FindNextFileW (in: hFindFile=0x4ef210, lpFindFileData=0x3bdfcf8 | out: lpFindFileData=0x3bdfcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x779f0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0155.876] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4471730 | out: hHeap=0x4c0000) returned 1
	[0155.876] FindNextFileW (in: hFindFile=0x4ef210, lpFindFileData=0x3bdfcf8 | out: lpFindFileData=0x3bdfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0155.876] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4471730 | out: hHeap=0x4c0000) returned 1
	[0155.876] FindNextFileW (in: hFindFile=0x4ef210, lpFindFileData=0x3bdfcf8 | out: lpFindFileData=0x3bdfcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xef0d5076, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0155.882] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4471730 | out: hHeap=0x4c0000) returned 1
	[0155.882] FindNextFileW (in: hFindFile=0x4ef210, lpFindFileData=0x3bdfcf8 | out: lpFindFileData=0x3bdfcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xf0ac0a43, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0155.936] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4471730 | out: hHeap=0x4c0000) returned 1
	[0155.936] FindNextFileW (in: hFindFile=0x4ef210, lpFindFileData=0x3bdfcf8 | out: lpFindFileData=0x3bdfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xdae14ced, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdae14ced, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0155.938] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0155.939] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3fd3fe0, ftCreationTime.dwHighDateTime=0x1d57bea, ftLastAccessTime.dwLowDateTime=0xc3ed2370, ftLastAccessTime.dwHighDateTime=0x1d5372a, ftLastWriteTime.dwLowDateTime=0xc3ed2370, ftLastWriteTime.dwHighDateTime=0x1d5372a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffddff, dwReserved1=0x4, cFileName="guests production meanwhile.exe", cAlternateFileName="GUESTS~1.EXE")) returned 1
	[0155.942] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b6fd0 | out: hHeap=0x4c0000) returned 1
	[0155.942] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="ink", cAlternateFileName="")) returned 1
	[0155.945] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fe8 | out: hHeap=0x4c0000) returned 1
	[0155.945] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0155.945] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fe8 | out: hHeap=0x4c0000) returned 1
	[0155.945] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="Content.xml", cAlternateFileName="")) returned 1
	[0155.946] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fe8 | out: hHeap=0x4c0000) returned 1
	[0155.946] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0155.946] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fe8 | out: hHeap=0x4c0000) returned 1
	[0155.946] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0155.947] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fe8 | out: hHeap=0x4c0000) returned 1
	[0155.947] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0155.947] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fe8 | out: hHeap=0x4c0000) returned 1
	[0155.947] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0155.947] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x52e878, Size=0x4000) returned 0x3e62088
	[0155.948] FindNextFileW (in: hFindFile=0x3e70d30, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0155.948] FindClose (in: hFindFile=0x3e70d30 | out: hFindFile=0x3e70d30) returned 1
	[0155.948] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fe8 | out: hHeap=0x4c0000) returned 1
	[0155.948] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="en-US", cAlternateFileName="")) returned 1
	[0155.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US") returned 56
	[0155.948] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US") returned 1
	[0155.948] lstrlenW (lpString="en-US") returned 5
	[0155.948] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-US") returned -1
	[0155.948] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x44c7fe8
	[0155.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US") returned 56
	[0155.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e70bb0
	[0155.950] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.950] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1
	[0155.950] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0155.950] lstrlenW (lpString=".1cd") returned 4
	[0155.950] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0155.950] lstrlenW (lpString=".3ds") returned 4
	[0155.950] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0155.950] lstrlenW (lpString=".3fr") returned 4
	[0155.950] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0155.950] lstrlenW (lpString=".3g2") returned 4
	[0155.950] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0155.950] lstrlenW (lpString=".3gp") returned 4
	[0155.950] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0155.950] lstrlenW (lpString=".7z") returned 3
	[0155.950] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0155.950] lstrlenW (lpString=".accda") returned 6
	[0155.950] lstrcmpiW (lpString1=".accda", lpString2="ct.avi") returned -1
	[0155.950] lstrlenW (lpString=".accdb") returned 6
	[0155.950] lstrcmpiW (lpString1=".accdb", lpString2="ct.avi") returned -1
	[0155.950] lstrlenW (lpString=".accdc") returned 6
	[0155.950] lstrcmpiW (lpString1=".accdc", lpString2="ct.avi") returned -1
	[0155.950] lstrlenW (lpString=".accde") returned 6
	[0155.950] lstrcmpiW (lpString1=".accde", lpString2="ct.avi") returned -1
	[0155.950] lstrlenW (lpString=".accdt") returned 6
	[0155.950] lstrcmpiW (lpString1=".accdt", lpString2="ct.avi") returned -1
	[0155.950] lstrlenW (lpString=".accdw") returned 6
	[0155.950] lstrcmpiW (lpString1=".accdw", lpString2="ct.avi") returned -1
	[0155.950] lstrlenW (lpString=".adb") returned 4
	[0155.951] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0155.951] lstrlenW (lpString=".adp") returned 4
	[0155.951] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0155.951] lstrlenW (lpString=".ai") returned 3
	[0155.951] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0155.951] lstrlenW (lpString=".ai3") returned 4
	[0155.951] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0155.951] lstrlenW (lpString=".ai4") returned 4
	[0155.951] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0155.951] lstrlenW (lpString=".ai5") returned 4
	[0155.951] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0155.951] lstrlenW (lpString=".ai6") returned 4
	[0155.951] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0155.951] lstrlenW (lpString=".ai7") returned 4
	[0155.951] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0155.951] lstrlenW (lpString=".ai8") returned 4
	[0155.951] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0155.951] lstrlenW (lpString=".anim") returned 5
	[0155.951] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1
	[0155.951] lstrlenW (lpString=".arw") returned 4
	[0155.951] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0155.951] lstrlenW (lpString=".as") returned 3
	[0155.951] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0155.951] lstrlenW (lpString=".asa") returned 4
	[0155.951] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0155.951] lstrlenW (lpString=".asc") returned 4
	[0155.951] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0155.951] lstrlenW (lpString=".ascx") returned 5
	[0155.951] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1
	[0155.951] lstrlenW (lpString=".asm") returned 4
	[0155.951] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0155.952] lstrlenW (lpString=".asmx") returned 5
	[0155.952] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1
	[0155.952] lstrlenW (lpString=".asp") returned 4
	[0155.952] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0155.952] lstrlenW (lpString=".aspx") returned 5
	[0155.952] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1
	[0155.952] lstrlenW (lpString=".asr") returned 4
	[0155.952] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0155.952] lstrlenW (lpString=".asx") returned 4
	[0155.952] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0155.952] lstrlenW (lpString=".avi") returned 4
	[0155.952] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0155.952] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1
	[0155.952] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0155.952] lstrlenW (lpString=".1cd") returned 4
	[0155.952] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0155.952] lstrlenW (lpString=".3ds") returned 4
	[0155.952] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0155.952] lstrlenW (lpString=".3fr") returned 4
	[0155.952] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0155.952] lstrlenW (lpString=".3g2") returned 4
	[0155.952] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0155.952] lstrlenW (lpString=".3gp") returned 4
	[0155.952] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0155.952] lstrlenW (lpString=".7z") returned 3
	[0155.952] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0155.952] lstrlenW (lpString=".accda") returned 6
	[0155.952] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1
	[0155.952] lstrlenW (lpString=".accdb") returned 6
	[0155.952] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1
	[0155.952] lstrlenW (lpString=".accdc") returned 6
	[0155.953] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1
	[0155.953] lstrlenW (lpString=".accde") returned 6
	[0155.953] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1
	[0155.953] lstrlenW (lpString=".accdt") returned 6
	[0155.953] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1
	[0155.953] lstrlenW (lpString=".accdw") returned 6
	[0155.953] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1
	[0155.953] lstrlenW (lpString=".adb") returned 4
	[0155.953] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0155.953] lstrlenW (lpString=".adp") returned 4
	[0155.953] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0155.953] lstrlenW (lpString=".ai") returned 3
	[0155.953] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0155.953] lstrlenW (lpString=".ai3") returned 4
	[0155.953] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0155.953] lstrlenW (lpString=".ai4") returned 4
	[0155.953] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0155.953] lstrlenW (lpString=".ai5") returned 4
	[0155.953] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0155.953] lstrlenW (lpString=".ai6") returned 4
	[0155.953] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0155.953] lstrlenW (lpString=".ai7") returned 4
	[0155.953] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0155.953] lstrlenW (lpString=".ai8") returned 4
	[0155.953] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0155.953] lstrlenW (lpString=".anim") returned 5
	[0155.953] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1
	[0155.953] lstrlenW (lpString=".arw") returned 4
	[0155.953] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0155.953] lstrlenW (lpString=".as") returned 3
	[0155.953] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0155.954] lstrlenW (lpString=".asa") returned 4
	[0155.954] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0155.954] lstrlenW (lpString=".asc") returned 4
	[0155.954] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0155.954] lstrlenW (lpString=".ascx") returned 5
	[0155.954] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1
	[0155.954] lstrlenW (lpString=".asm") returned 4
	[0155.954] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0155.954] lstrlenW (lpString=".asmx") returned 5
	[0155.954] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1
	[0155.954] lstrlenW (lpString=".asp") returned 4
	[0155.954] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0155.954] lstrlenW (lpString=".aspx") returned 5
	[0155.954] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1
	[0155.954] lstrlenW (lpString=".asr") returned 4
	[0155.954] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0155.954] lstrlenW (lpString=".asx") returned 4
	[0155.954] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0155.954] lstrlenW (lpString=".avi") returned 4
	[0155.954] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0155.954] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1
	[0155.954] lstrlenW (lpString="boxed-join.avi") returned 14
	[0155.954] lstrlenW (lpString=".1cd") returned 4
	[0155.954] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0155.954] lstrlenW (lpString=".3ds") returned 4
	[0155.954] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0155.954] lstrlenW (lpString=".3fr") returned 4
	[0155.954] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0155.954] lstrlenW (lpString=".3g2") returned 4
	[0155.954] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0155.955] lstrlenW (lpString=".3gp") returned 4
	[0155.955] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0155.955] lstrlenW (lpString=".7z") returned 3
	[0155.955] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0155.955] lstrlenW (lpString=".accda") returned 6
	[0155.955] lstrcmpiW (lpString1=".accda", lpString2="in.avi") returned -1
	[0155.955] lstrlenW (lpString=".accdb") returned 6
	[0155.955] lstrcmpiW (lpString1=".accdb", lpString2="in.avi") returned -1
	[0155.955] lstrlenW (lpString=".accdc") returned 6
	[0155.955] lstrcmpiW (lpString1=".accdc", lpString2="in.avi") returned -1
	[0155.955] lstrlenW (lpString=".accde") returned 6
	[0155.955] lstrcmpiW (lpString1=".accde", lpString2="in.avi") returned -1
	[0155.955] lstrlenW (lpString=".accdt") returned 6
	[0155.955] lstrcmpiW (lpString1=".accdt", lpString2="in.avi") returned -1
	[0155.955] lstrlenW (lpString=".accdw") returned 6
	[0155.955] lstrcmpiW (lpString1=".accdw", lpString2="in.avi") returned -1
	[0155.955] lstrlenW (lpString=".adb") returned 4
	[0155.955] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0155.955] lstrlenW (lpString=".adp") returned 4
	[0155.955] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0155.955] lstrlenW (lpString=".ai") returned 3
	[0155.955] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0155.955] lstrlenW (lpString=".ai3") returned 4
	[0155.955] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0155.955] lstrlenW (lpString=".ai4") returned 4
	[0155.955] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0155.955] lstrlenW (lpString=".ai5") returned 4
	[0155.955] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0155.955] lstrlenW (lpString=".ai6") returned 4
	[0155.955] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0155.955] lstrlenW (lpString=".ai7") returned 4
	[0155.955] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0155.955] lstrlenW (lpString=".ai8") returned 4
	[0155.956] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0155.956] lstrlenW (lpString=".anim") returned 5
	[0155.956] lstrcmpiW (lpString1=".anim", lpString2="n.avi") returned -1
	[0155.956] lstrlenW (lpString=".arw") returned 4
	[0155.956] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0155.956] lstrlenW (lpString=".as") returned 3
	[0155.956] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0155.956] lstrlenW (lpString=".asa") returned 4
	[0155.956] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0155.956] lstrlenW (lpString=".asc") returned 4
	[0155.956] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0155.956] lstrlenW (lpString=".ascx") returned 5
	[0155.956] lstrcmpiW (lpString1=".ascx", lpString2="n.avi") returned -1
	[0155.956] lstrlenW (lpString=".asm") returned 4
	[0155.956] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0155.956] lstrlenW (lpString=".asmx") returned 5
	[0155.956] lstrcmpiW (lpString1=".asmx", lpString2="n.avi") returned -1
	[0155.956] lstrlenW (lpString=".asp") returned 4
	[0155.956] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0155.956] lstrlenW (lpString=".aspx") returned 5
	[0155.956] lstrcmpiW (lpString1=".aspx", lpString2="n.avi") returned -1
	[0155.956] lstrlenW (lpString=".asr") returned 4
	[0155.956] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0155.956] lstrlenW (lpString=".asx") returned 4
	[0155.956] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0155.956] lstrlenW (lpString=".avi") returned 4
	[0155.956] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0155.956] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1
	[0155.956] lstrlenW (lpString="boxed-split.avi") returned 15
	[0155.957] lstrlenW (lpString=".1cd") returned 4
	[0155.957] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0155.957] lstrlenW (lpString=".3ds") returned 4
	[0155.957] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0155.957] lstrlenW (lpString=".3fr") returned 4
	[0155.957] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0155.957] lstrlenW (lpString=".3g2") returned 4
	[0155.957] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0155.957] lstrlenW (lpString=".3gp") returned 4
	[0155.957] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0155.957] lstrlenW (lpString=".7z") returned 3
	[0155.957] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0155.957] lstrlenW (lpString=".accda") returned 6
	[0155.957] lstrcmpiW (lpString1=".accda", lpString2="it.avi") returned -1
	[0155.957] lstrlenW (lpString=".accdb") returned 6
	[0155.957] lstrcmpiW (lpString1=".accdb", lpString2="it.avi") returned -1
	[0155.957] lstrlenW (lpString=".accdc") returned 6
	[0155.957] lstrcmpiW (lpString1=".accdc", lpString2="it.avi") returned -1
	[0155.957] lstrlenW (lpString=".accde") returned 6
	[0155.957] lstrcmpiW (lpString1=".accde", lpString2="it.avi") returned -1
	[0155.957] lstrlenW (lpString=".accdt") returned 6
	[0155.957] lstrcmpiW (lpString1=".accdt", lpString2="it.avi") returned -1
	[0155.957] lstrlenW (lpString=".accdw") returned 6
	[0155.957] lstrcmpiW (lpString1=".accdw", lpString2="it.avi") returned -1
	[0155.957] lstrlenW (lpString=".adb") returned 4
	[0155.957] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0155.957] lstrlenW (lpString=".adp") returned 4
	[0155.957] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0155.957] lstrlenW (lpString=".ai") returned 3
	[0155.957] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0155.957] lstrlenW (lpString=".ai3") returned 4
	[0155.957] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".ai4") returned 4
	[0155.958] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".ai5") returned 4
	[0155.958] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".ai6") returned 4
	[0155.958] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".ai7") returned 4
	[0155.958] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".ai8") returned 4
	[0155.958] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".anim") returned 5
	[0155.958] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1
	[0155.958] lstrlenW (lpString=".arw") returned 4
	[0155.958] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".as") returned 3
	[0155.958] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0155.958] lstrlenW (lpString=".asa") returned 4
	[0155.958] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".asc") returned 4
	[0155.958] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".ascx") returned 5
	[0155.958] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1
	[0155.958] lstrlenW (lpString=".asm") returned 4
	[0155.958] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".asmx") returned 5
	[0155.958] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1
	[0155.958] lstrlenW (lpString=".asp") returned 4
	[0155.958] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".aspx") returned 5
	[0155.958] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1
	[0155.958] lstrlenW (lpString=".asr") returned 4
	[0155.958] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0155.958] lstrlenW (lpString=".asx") returned 4
	[0155.959] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0155.959] lstrlenW (lpString=".avi") returned 4
	[0155.959] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0155.959] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="correct.avi", cAlternateFileName="")) returned 1
	[0155.959] lstrlenW (lpString="correct.avi") returned 11
	[0155.959] lstrlenW (lpString=".1cd") returned 4
	[0155.959] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0155.959] lstrlenW (lpString=".3ds") returned 4
	[0155.959] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0155.959] lstrlenW (lpString=".3fr") returned 4
	[0155.959] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0155.959] lstrlenW (lpString=".3g2") returned 4
	[0155.959] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0155.959] lstrlenW (lpString=".3gp") returned 4
	[0155.959] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0155.959] lstrlenW (lpString=".7z") returned 3
	[0155.959] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0155.959] lstrlenW (lpString=".accda") returned 6
	[0155.959] lstrcmpiW (lpString1=".accda", lpString2="ct.avi") returned -1
	[0155.959] lstrlenW (lpString=".accdb") returned 6
	[0155.959] lstrcmpiW (lpString1=".accdb", lpString2="ct.avi") returned -1
	[0155.959] lstrlenW (lpString=".accdc") returned 6
	[0155.959] lstrcmpiW (lpString1=".accdc", lpString2="ct.avi") returned -1
	[0155.959] lstrlenW (lpString=".accde") returned 6
	[0155.959] lstrcmpiW (lpString1=".accde", lpString2="ct.avi") returned -1
	[0155.959] lstrlenW (lpString=".accdt") returned 6
	[0155.959] lstrcmpiW (lpString1=".accdt", lpString2="ct.avi") returned -1
	[0155.959] lstrlenW (lpString=".accdw") returned 6
	[0155.959] lstrcmpiW (lpString1=".accdw", lpString2="ct.avi") returned -1
	[0155.959] lstrlenW (lpString=".adb") returned 4
	[0155.959] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0155.959] lstrlenW (lpString=".adp") returned 4
	[0155.960] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0155.960] lstrlenW (lpString=".ai") returned 3
	[0155.960] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0155.960] lstrlenW (lpString=".ai3") returned 4
	[0155.960] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0155.960] lstrlenW (lpString=".ai4") returned 4
	[0155.960] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0155.960] lstrlenW (lpString=".ai5") returned 4
	[0155.960] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0155.960] lstrlenW (lpString=".ai6") returned 4
	[0155.960] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0155.960] lstrlenW (lpString=".ai7") returned 4
	[0155.960] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0155.960] lstrlenW (lpString=".ai8") returned 4
	[0155.960] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0155.960] lstrlenW (lpString=".anim") returned 5
	[0155.960] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1
	[0155.960] lstrlenW (lpString=".arw") returned 4
	[0155.960] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0155.960] lstrlenW (lpString=".as") returned 3
	[0155.960] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0155.960] lstrlenW (lpString=".asa") returned 4
	[0155.960] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0155.960] lstrlenW (lpString=".asc") returned 4
	[0155.960] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0155.960] lstrlenW (lpString=".ascx") returned 5
	[0155.960] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1
	[0155.960] lstrlenW (lpString=".asm") returned 4
	[0155.960] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0155.960] lstrlenW (lpString=".asmx") returned 5
	[0155.960] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1
	[0155.960] lstrlenW (lpString=".asp") returned 4
	[0155.961] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0155.961] lstrlenW (lpString=".aspx") returned 5
	[0155.961] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1
	[0155.961] lstrlenW (lpString=".asr") returned 4
	[0155.961] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0155.961] lstrlenW (lpString=".asx") returned 4
	[0155.961] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0155.961] lstrlenW (lpString=".avi") returned 4
	[0155.961] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0155.961] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="delete.avi", cAlternateFileName="")) returned 1
	[0155.961] lstrlenW (lpString="delete.avi") returned 10
	[0155.961] lstrlenW (lpString=".1cd") returned 4
	[0155.961] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0155.961] lstrlenW (lpString=".3ds") returned 4
	[0155.961] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0155.961] lstrlenW (lpString=".3fr") returned 4
	[0155.961] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0155.961] lstrlenW (lpString=".3g2") returned 4
	[0155.961] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0155.961] lstrlenW (lpString=".3gp") returned 4
	[0155.961] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0155.961] lstrlenW (lpString=".7z") returned 3
	[0155.961] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0155.961] lstrlenW (lpString=".accda") returned 6
	[0155.961] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1
	[0155.961] lstrlenW (lpString=".accdb") returned 6
	[0155.961] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1
	[0155.961] lstrlenW (lpString=".accdc") returned 6
	[0155.961] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1
	[0155.961] lstrlenW (lpString=".accde") returned 6
	[0155.962] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1
	[0155.962] lstrlenW (lpString=".accdt") returned 6
	[0155.962] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1
	[0155.962] lstrlenW (lpString=".accdw") returned 6
	[0155.962] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1
	[0155.962] lstrlenW (lpString=".adb") returned 4
	[0155.962] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0155.962] lstrlenW (lpString=".adp") returned 4
	[0155.962] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0155.962] lstrlenW (lpString=".ai") returned 3
	[0155.962] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0155.962] lstrlenW (lpString=".ai3") returned 4
	[0155.962] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0155.962] lstrlenW (lpString=".ai4") returned 4
	[0155.962] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0155.962] lstrlenW (lpString=".ai5") returned 4
	[0155.962] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0155.962] lstrlenW (lpString=".ai6") returned 4
	[0155.962] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0155.962] lstrlenW (lpString=".ai7") returned 4
	[0155.962] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0155.962] lstrlenW (lpString=".ai8") returned 4
	[0155.962] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0155.962] lstrlenW (lpString=".anim") returned 5
	[0155.962] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1
	[0155.962] lstrlenW (lpString=".arw") returned 4
	[0155.962] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0155.962] lstrlenW (lpString=".as") returned 3
	[0155.962] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0155.962] lstrlenW (lpString=".asa") returned 4
	[0155.962] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0155.962] lstrlenW (lpString=".asc") returned 4
	[0155.963] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0155.963] lstrlenW (lpString=".ascx") returned 5
	[0155.963] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1
	[0155.963] lstrlenW (lpString=".asm") returned 4
	[0155.963] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0155.963] lstrlenW (lpString=".asmx") returned 5
	[0155.963] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1
	[0155.963] lstrlenW (lpString=".asp") returned 4
	[0155.963] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0155.963] lstrlenW (lpString=".aspx") returned 5
	[0155.963] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1
	[0155.963] lstrlenW (lpString=".asr") returned 4
	[0155.963] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0155.963] lstrlenW (lpString=".asx") returned 4
	[0155.963] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0155.963] lstrlenW (lpString=".avi") returned 4
	[0155.963] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0155.963] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1
	[0155.963] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27
	[0155.963] lstrlenW (lpString=".1cd") returned 4
	[0155.963] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0155.963] lstrlenW (lpString=".3ds") returned 4
	[0155.963] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0155.963] lstrlenW (lpString=".3fr") returned 4
	[0155.963] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0155.963] lstrlenW (lpString=".3g2") returned 4
	[0155.964] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0155.964] lstrlenW (lpString=".3gp") returned 4
	[0155.964] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0155.964] lstrlenW (lpString=".7z") returned 3
	[0155.964] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0155.964] lstrlenW (lpString=".accda") returned 6
	[0155.964] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0155.964] lstrlenW (lpString=".accdb") returned 6
	[0155.964] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0155.964] lstrlenW (lpString=".accdc") returned 6
	[0155.964] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0155.964] lstrlenW (lpString=".accde") returned 6
	[0155.964] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0155.964] lstrlenW (lpString=".accdt") returned 6
	[0155.964] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0155.964] lstrlenW (lpString=".accdw") returned 6
	[0155.964] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0155.964] lstrlenW (lpString=".adb") returned 4
	[0155.964] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0155.964] lstrlenW (lpString=".adp") returned 4
	[0155.964] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0155.964] lstrlenW (lpString=".ai") returned 3
	[0155.964] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0155.964] lstrlenW (lpString=".ai3") returned 4
	[0155.964] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0155.964] lstrlenW (lpString=".ai4") returned 4
	[0155.964] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0155.964] lstrlenW (lpString=".ai5") returned 4
	[0155.964] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0155.964] lstrlenW (lpString=".ai6") returned 4
	[0155.964] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0155.965] lstrlenW (lpString=".ai7") returned 4
	[0155.965] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0155.965] lstrlenW (lpString=".ai8") returned 4
	[0155.965] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0155.965] lstrlenW (lpString=".anim") returned 5
	[0155.965] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0155.965] lstrlenW (lpString=".arw") returned 4
	[0155.965] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0155.965] lstrlenW (lpString=".as") returned 3
	[0155.965] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0155.965] lstrlenW (lpString=".asa") returned 4
	[0155.965] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0155.965] lstrlenW (lpString=".asc") returned 4
	[0155.965] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0155.965] lstrlenW (lpString=".ascx") returned 5
	[0155.965] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0155.965] lstrlenW (lpString=".asm") returned 4
	[0155.965] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0155.965] lstrlenW (lpString=".asmx") returned 5
	[0155.965] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0155.965] lstrlenW (lpString=".asp") returned 4
	[0155.965] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0155.965] lstrlenW (lpString=".aspx") returned 5
	[0155.965] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0155.965] lstrlenW (lpString=".asr") returned 4
	[0155.965] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0155.965] lstrlenW (lpString=".asx") returned 4
	[0155.965] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0155.965] lstrlenW (lpString=".avi") returned 4
	[0155.965] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0155.965] lstrlenW (lpString=".avs") returned 4
	[0155.965] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0155.967] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fe8 | out: hHeap=0x4c0000) returned 1
	[0155.967] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0155.967] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0155.967] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0155.968] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0155.968] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0155.968] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0155.968] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0155.968] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0155.968] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0155.969] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0155.969] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0155.969] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0155.970] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0156.175] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0156.177] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1
	[0156.211] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.212] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1
	[0156.212] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.212] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1
	[0156.214] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.214] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1
	[0156.214] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.214] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1
	[0156.214] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.214] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1
	[0156.214] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.214] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1
	[0156.215] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.215] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1
	[0156.215] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.215] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1
	[0156.215] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.215] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1
	[0156.215] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.215] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0156.215] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.215] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0156.216] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.216] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0156.216] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.216] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1
	[0156.216] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.216] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1
	[0156.217] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.217] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0156.217] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.217] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0156.218] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.218] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1
	[0156.218] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.218] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0156.218] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.218] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0156.218] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.218] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="micaut.dll", cAlternateFileName="")) returned 1
	[0156.218] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.219] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0156.219] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.219] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0156.219] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.219] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0156.219] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.219] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0156.219] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.219] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0156.219] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.219] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="rtscom.dll", cAlternateFileName="")) returned 1
	[0156.220] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.220] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1
	[0156.220] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.220] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0156.220] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.220] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1
	[0156.220] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.220] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0156.220] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.221] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1
	[0156.221] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.221] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="TipRes.dll", cAlternateFileName="")) returned 1
	[0156.221] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.221] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0156.221] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.221] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0156.221] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.222] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0156.222] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.222] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0156.222] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0156.222] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b6fd0 | out: hHeap=0x4c0000) returned 1
	[0156.223] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="MSInfo", cAlternateFileName="")) returned 1
	[0156.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.224] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1
	[0156.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.224] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="OFFICE16", cAlternateFileName="")) returned 1
	[0156.226] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.226] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0
	[0156.226] FindClose (in: hFindFile=0x3e70bb0 | out: hFindFile=0x3e70bb0) returned 1
	[0156.226] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.226] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0156.226] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.226] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1
	[0156.226] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.226] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xdac974c4, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdac974c4, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0156.228] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.228] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="TextConv", cAlternateFileName="")) returned 1
	[0156.228] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.228] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="en-US", cAlternateFileName="")) returned 0
	[0156.228] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0156.228] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.228] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="Triedit", cAlternateFileName="")) returned 1
	[0156.228] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.228] FindNextFileW (in: hFindFile=0x3e70ab0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="en-US", cAlternateFileName="")) returned 0
	[0156.228] FindClose (in: hFindFile=0x3e70ab0 | out: hFindFile=0x3e70ab0) returned 1
	[0156.228] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.228] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="VC", cAlternateFileName="")) returned 1
	[0156.239] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.239] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="VGX", cAlternateFileName="")) returned 1
	[0156.239] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.239] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="VSTO", cAlternateFileName="")) returned 1
	[0156.250] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b6fd0 | out: hHeap=0x4c0000) returned 1
	[0156.250] FindNextFileW (in: hFindFile=0x3e70db0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5ca907d, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xe5ca907d, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xe5ca907d, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x18986, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe.id-B4197730.[admin@stex777.com].money", cAlternateFileName="VSTOIN~1.MON")) returned 1
	[0156.250] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.250] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe66a4bb3, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xe66a4bb3, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xe66a4bb3, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x29178, dwReserved0=0xffffe203, dwReserved1=0x3, cFileName="vstoee.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="VSTOEE~3.MON")) returned 1
	[0156.250] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.252] FindNextFileW (in: hFindFile=0x3e70ef0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="VSTO", cAlternateFileName="")) returned 0
	[0156.252] FindClose (in: hFindFile=0x3e70ef0 | out: hFindFile=0x3e70ef0) returned 1
	[0156.252] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.252] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522e8750, ftCreationTime.dwHighDateTime=0x1d5187c, ftLastAccessTime.dwLowDateTime=0xfff26e00, ftLastAccessTime.dwHighDateTime=0x1d53317, ftLastWriteTime.dwLowDateTime=0xfff26e00, ftLastWriteTime.dwHighDateTime=0x1d53317, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffddff, dwReserved1=0x4, cFileName="screensaver.exe", cAlternateFileName="SCREEN~1.EXE")) returned 1
	[0156.252] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.253] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffddff, dwReserved1=0x4, cFileName="System", cAlternateFileName="")) returned 1
	[0156.257] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.257] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1
	[0156.257] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x3e62088, Size=0x4000) returned 0x3e62088
	[0156.257] FindNextFileW (in: hFindFile=0x3e70e30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1
	[0156.257] lstrlenW (lpString="msadomd28.tlb") returned 13
	[0156.257] lstrlenW (lpString=".1cd") returned 4
	[0156.258] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0156.258] lstrlenW (lpString=".3ds") returned 4
	[0156.258] lstrcmpiW (lpString1=".3ds", lpString2=".tlb") returned -1
	[0156.258] lstrlenW (lpString=".3fr") returned 4
	[0156.258] lstrcmpiW (lpString1=".3fr", lpString2=".tlb") returned -1
	[0156.258] lstrlenW (lpString=".3g2") returned 4
	[0156.258] lstrcmpiW (lpString1=".3g2", lpString2=".tlb") returned -1
	[0156.258] lstrlenW (lpString=".3gp") returned 4
	[0156.258] lstrcmpiW (lpString1=".3gp", lpString2=".tlb") returned -1
	[0156.258] lstrlenW (lpString=".7z") returned 3
	[0156.258] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0156.258] lstrlenW (lpString=".accda") returned 6
	[0156.258] lstrcmpiW (lpString1=".accda", lpString2="28.tlb") returned -1
	[0156.258] lstrlenW (lpString=".accdb") returned 6
	[0156.258] lstrcmpiW (lpString1=".accdb", lpString2="28.tlb") returned -1
	[0156.258] lstrlenW (lpString=".accdc") returned 6
	[0156.258] lstrcmpiW (lpString1=".accdc", lpString2="28.tlb") returned -1
	[0156.258] lstrlenW (lpString=".accde") returned 6
	[0156.258] lstrcmpiW (lpString1=".accde", lpString2="28.tlb") returned -1
	[0156.258] lstrlenW (lpString=".accdt") returned 6
	[0156.258] lstrcmpiW (lpString1=".accdt", lpString2="28.tlb") returned -1
	[0156.258] lstrlenW (lpString=".accdw") returned 6
	[0156.258] lstrcmpiW (lpString1=".accdw", lpString2="28.tlb") returned -1
	[0156.258] lstrlenW (lpString=".adb") returned 4
	[0156.258] lstrcmpiW (lpString1=".adb", lpString2=".tlb") returned -1
	[0156.258] lstrlenW (lpString=".adp") returned 4
	[0156.258] lstrcmpiW (lpString1=".adp", lpString2=".tlb") returned -1
	[0156.258] lstrlenW (lpString=".ai") returned 3
	[0156.258] lstrcmpiW (lpString1=".ai", lpString2="tlb") returned -1
	[0156.258] lstrlenW (lpString=".ai3") returned 4
	[0156.258] lstrcmpiW (lpString1=".ai3", lpString2=".tlb") returned -1
	[0156.258] lstrlenW (lpString=".ai4") returned 4
	[0156.258] lstrcmpiW (lpString1=".ai4", lpString2=".tlb") returned -1
	[0156.259] lstrlenW (lpString=".ai5") returned 4
	[0156.259] lstrcmpiW (lpString1=".ai5", lpString2=".tlb") returned -1
	[0156.259] lstrlenW (lpString=".ai6") returned 4
	[0156.259] lstrcmpiW (lpString1=".ai6", lpString2=".tlb") returned -1
	[0156.259] lstrlenW (lpString=".ai7") returned 4
	[0156.259] lstrcmpiW (lpString1=".ai7", lpString2=".tlb") returned -1
	[0156.259] lstrlenW (lpString=".ai8") returned 4
	[0156.259] lstrcmpiW (lpString1=".ai8", lpString2=".tlb") returned -1
	[0156.259] lstrlenW (lpString=".anim") returned 5
	[0156.259] lstrcmpiW (lpString1=".anim", lpString2="8.tlb") returned -1
	[0156.259] lstrlenW (lpString=".arw") returned 4
	[0156.259] lstrcmpiW (lpString1=".arw", lpString2=".tlb") returned -1
	[0156.259] lstrlenW (lpString=".as") returned 3
	[0156.259] lstrcmpiW (lpString1=".as", lpString2="tlb") returned -1
	[0156.259] lstrlenW (lpString=".asa") returned 4
	[0156.259] lstrcmpiW (lpString1=".asa", lpString2=".tlb") returned -1
	[0156.259] lstrlenW (lpString=".asc") returned 4
	[0156.259] lstrcmpiW (lpString1=".asc", lpString2=".tlb") returned -1
	[0156.259] lstrlenW (lpString=".ascx") returned 5
	[0156.259] lstrcmpiW (lpString1=".ascx", lpString2="8.tlb") returned -1
	[0156.259] lstrlenW (lpString=".asm") returned 4
	[0156.259] lstrcmpiW (lpString1=".asm", lpString2=".tlb") returned -1
	[0156.259] lstrlenW (lpString=".asmx") returned 5
	[0156.259] lstrcmpiW (lpString1=".asmx", lpString2="8.tlb") returned -1
	[0156.259] lstrlenW (lpString=".asp") returned 4
	[0156.259] lstrcmpiW (lpString1=".asp", lpString2=".tlb") returned -1
	[0156.259] lstrlenW (lpString=".aspx") returned 5
	[0156.259] lstrcmpiW (lpString1=".aspx", lpString2="8.tlb") returned -1
	[0156.259] lstrlenW (lpString=".asr") returned 4
	[0156.259] lstrcmpiW (lpString1=".asr", lpString2=".tlb") returned -1
	[0156.260] lstrlenW (lpString=".asx") returned 4
	[0156.260] lstrcmpiW (lpString1=".asx", lpString2=".tlb") returned -1
	[0156.260] lstrlenW (lpString=".avi") returned 4
	[0156.260] lstrcmpiW (lpString1=".avi", lpString2=".tlb") returned -1
	[0156.260] lstrlenW (lpString=".avs") returned 4
	[0156.260] lstrcmpiW (lpString1=".avs", lpString2=".tlb") returned -1
	[0156.260] lstrlenW (lpString=".backup") returned 7
	[0156.260] lstrcmpiW (lpString1=".backup", lpString2="d28.tlb") returned -1
	[0156.260] lstrlenW (lpString=".bak") returned 4
	[0156.260] lstrcmpiW (lpString1=".bak", lpString2=".tlb") returned -1
	[0156.260] lstrlenW (lpString=".bay") returned 4
	[0156.260] lstrcmpiW (lpString1=".bay", lpString2=".tlb") returned -1
	[0156.260] lstrlenW (lpString=".bd") returned 3
	[0156.260] lstrcmpiW (lpString1=".bd", lpString2="tlb") returned -1
	[0156.260] lstrlenW (lpString=".bin") returned 4
	[0156.260] lstrcmpiW (lpString1=".bin", lpString2=".tlb") returned -1
	[0156.260] lstrlenW (lpString=".bmp") returned 4
	[0156.260] lstrcmpiW (lpString1=".bmp", lpString2=".tlb") returned -1
	[0156.260] lstrlenW (lpString=".bz2") returned 4
	[0156.260] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0156.260] lstrlenW (lpString=".c") returned 2
	[0156.260] lstrcmpiW (lpString1=".c", lpString2="lb") returned -1
	[0156.260] lstrlenW (lpString=".cdr") returned 4
	[0156.260] lstrcmpiW (lpString1=".cdr", lpString2=".tlb") returned -1
	[0156.260] lstrlenW (lpString=".cer") returned 4
	[0156.260] lstrcmpiW (lpString1=".cer", lpString2=".tlb") returned -1
	[0156.260] lstrlenW (lpString=".cf") returned 3
	[0156.260] lstrcmpiW (lpString1=".cf", lpString2="tlb") returned -1
	[0156.260] lstrlenW (lpString=".cfc") returned 4
	[0156.260] lstrcmpiW (lpString1=".cfc", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".cfm") returned 4
	[0156.261] lstrcmpiW (lpString1=".cfm", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".cfml") returned 5
	[0156.261] lstrcmpiW (lpString1=".cfml", lpString2="8.tlb") returned -1
	[0156.261] lstrlenW (lpString=".cfu") returned 4
	[0156.261] lstrcmpiW (lpString1=".cfu", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".chm") returned 4
	[0156.261] lstrcmpiW (lpString1=".chm", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".cin") returned 4
	[0156.261] lstrcmpiW (lpString1=".cin", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".class") returned 6
	[0156.261] lstrcmpiW (lpString1=".class", lpString2="28.tlb") returned -1
	[0156.261] lstrlenW (lpString=".clx") returned 4
	[0156.261] lstrcmpiW (lpString1=".clx", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".config") returned 7
	[0156.261] lstrcmpiW (lpString1=".config", lpString2="d28.tlb") returned -1
	[0156.261] lstrlenW (lpString=".cpp") returned 4
	[0156.261] lstrcmpiW (lpString1=".cpp", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".cr2") returned 4
	[0156.261] lstrcmpiW (lpString1=".cr2", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".crt") returned 4
	[0156.261] lstrcmpiW (lpString1=".crt", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".crw") returned 4
	[0156.261] lstrcmpiW (lpString1=".crw", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".cs") returned 3
	[0156.261] lstrcmpiW (lpString1=".cs", lpString2="tlb") returned -1
	[0156.261] lstrlenW (lpString=".css") returned 4
	[0156.261] lstrcmpiW (lpString1=".css", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".csv") returned 4
	[0156.261] lstrcmpiW (lpString1=".csv", lpString2=".tlb") returned -1
	[0156.261] lstrlenW (lpString=".cub") returned 4
	[0156.261] lstrcmpiW (lpString1=".cub", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".dae") returned 4
	[0156.262] lstrcmpiW (lpString1=".dae", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".dat") returned 4
	[0156.262] lstrcmpiW (lpString1=".dat", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".db") returned 3
	[0156.262] lstrcmpiW (lpString1=".db", lpString2="tlb") returned -1
	[0156.262] lstrlenW (lpString=".dbf") returned 4
	[0156.262] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".dbx") returned 4
	[0156.262] lstrcmpiW (lpString1=".dbx", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".dc3") returned 4
	[0156.262] lstrcmpiW (lpString1=".dc3", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".dcm") returned 4
	[0156.262] lstrcmpiW (lpString1=".dcm", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".dcr") returned 4
	[0156.262] lstrcmpiW (lpString1=".dcr", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".der") returned 4
	[0156.262] lstrcmpiW (lpString1=".der", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".dib") returned 4
	[0156.262] lstrcmpiW (lpString1=".dib", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".dic") returned 4
	[0156.262] lstrcmpiW (lpString1=".dic", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".dif") returned 4
	[0156.262] lstrcmpiW (lpString1=".dif", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".divx") returned 5
	[0156.262] lstrcmpiW (lpString1=".divx", lpString2="8.tlb") returned -1
	[0156.262] lstrlenW (lpString=".djvu") returned 5
	[0156.262] lstrcmpiW (lpString1=".djvu", lpString2="8.tlb") returned -1
	[0156.262] lstrlenW (lpString=".dng") returned 4
	[0156.262] lstrcmpiW (lpString1=".dng", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".doc") returned 4
	[0156.262] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0156.262] lstrlenW (lpString=".docm") returned 5
	[0156.263] lstrcmpiW (lpString1=".docm", lpString2="8.tlb") returned -1
	[0156.263] lstrlenW (lpString=".docx") returned 5
	[0156.263] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1
	[0156.263] lstrlenW (lpString=".dot") returned 4
	[0156.263] lstrcmpiW (lpString1=".dot", lpString2=".tlb") returned -1
	[0156.263] lstrlenW (lpString=".dotm") returned 5
	[0156.263] lstrcmpiW (lpString1=".dotm", lpString2="8.tlb") returned -1
	[0156.263] lstrlenW (lpString=".dotx") returned 5
	[0156.263] lstrcmpiW (lpString1=".dotx", lpString2="8.tlb") returned -1
	[0156.263] lstrlenW (lpString=".dpx") returned 4
	[0156.263] lstrcmpiW (lpString1=".dpx", lpString2=".tlb") returned -1
	[0156.263] lstrlenW (lpString=".dqy") returned 4
	[0156.263] lstrcmpiW (lpString1=".dqy", lpString2=".tlb") returned -1
	[0156.263] lstrlenW (lpString=".dsn") returned 4
	[0156.263] lstrcmpiW (lpString1=".dsn", lpString2=".tlb") returned -1
	[0156.263] lstrlenW (lpString=".dt") returned 3
	[0156.263] lstrcmpiW (lpString1=".dt", lpString2="tlb") returned -1
	[0156.263] lstrlenW (lpString=".dtd") returned 4
	[0156.263] lstrcmpiW (lpString1=".dtd", lpString2=".tlb") returned -1
	[0156.263] lstrlenW (lpString=".dwg") returned 4
	[0156.263] lstrcmpiW (lpString1=".dwg", lpString2=".tlb") returned -1
	[0156.263] lstrlenW (lpString=".dwt") returned 4
	[0156.263] lstrcmpiW (lpString1=".dwt", lpString2=".tlb") returned -1
	[0156.263] lstrlenW (lpString=".dx") returned 3
	[0156.263] lstrcmpiW (lpString1=".dx", lpString2="tlb") returned -1
	[0156.263] lstrlenW (lpString=".dxf") returned 4
	[0156.263] lstrcmpiW (lpString1=".dxf", lpString2=".tlb") returned -1
	[0156.263] lstrlenW (lpString=".edml") returned 5
	[0156.263] lstrcmpiW (lpString1=".edml", lpString2="8.tlb") returned -1
	[0156.263] lstrlenW (lpString=".efd") returned 4
	[0156.264] lstrcmpiW (lpString1=".efd", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".elf") returned 4
	[0156.264] lstrcmpiW (lpString1=".elf", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".emf") returned 4
	[0156.264] lstrcmpiW (lpString1=".emf", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".emz") returned 4
	[0156.264] lstrcmpiW (lpString1=".emz", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".epf") returned 4
	[0156.264] lstrcmpiW (lpString1=".epf", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".eps") returned 4
	[0156.264] lstrcmpiW (lpString1=".eps", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".epsf") returned 5
	[0156.264] lstrcmpiW (lpString1=".epsf", lpString2="8.tlb") returned -1
	[0156.264] lstrlenW (lpString=".epsp") returned 5
	[0156.264] lstrcmpiW (lpString1=".epsp", lpString2="8.tlb") returned -1
	[0156.264] lstrlenW (lpString=".erf") returned 4
	[0156.264] lstrcmpiW (lpString1=".erf", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".exr") returned 4
	[0156.264] lstrcmpiW (lpString1=".exr", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".f4v") returned 4
	[0156.264] lstrcmpiW (lpString1=".f4v", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".fido") returned 5
	[0156.264] lstrcmpiW (lpString1=".fido", lpString2="8.tlb") returned -1
	[0156.264] lstrlenW (lpString=".flm") returned 4
	[0156.264] lstrcmpiW (lpString1=".flm", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".flv") returned 4
	[0156.264] lstrcmpiW (lpString1=".flv", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".frm") returned 4
	[0156.264] lstrcmpiW (lpString1=".frm", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".fxg") returned 4
	[0156.264] lstrcmpiW (lpString1=".fxg", lpString2=".tlb") returned -1
	[0156.264] lstrlenW (lpString=".geo") returned 4
	[0156.265] lstrcmpiW (lpString1=".geo", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".gif") returned 4
	[0156.265] lstrcmpiW (lpString1=".gif", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".grs") returned 4
	[0156.265] lstrcmpiW (lpString1=".grs", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".gz") returned 3
	[0156.265] lstrcmpiW (lpString1=".gz", lpString2="tlb") returned -1
	[0156.265] lstrlenW (lpString=".h") returned 2
	[0156.265] lstrcmpiW (lpString1=".h", lpString2="lb") returned -1
	[0156.265] lstrlenW (lpString=".hdr") returned 4
	[0156.265] lstrcmpiW (lpString1=".hdr", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".hpp") returned 4
	[0156.265] lstrcmpiW (lpString1=".hpp", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".hta") returned 4
	[0156.265] lstrcmpiW (lpString1=".hta", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".htc") returned 4
	[0156.265] lstrcmpiW (lpString1=".htc", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".htm") returned 4
	[0156.265] lstrcmpiW (lpString1=".htm", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".html") returned 5
	[0156.265] lstrcmpiW (lpString1=".html", lpString2="8.tlb") returned -1
	[0156.265] lstrlenW (lpString=".icb") returned 4
	[0156.265] lstrcmpiW (lpString1=".icb", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".ics") returned 4
	[0156.265] lstrcmpiW (lpString1=".ics", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".iff") returned 4
	[0156.265] lstrcmpiW (lpString1=".iff", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".inc") returned 4
	[0156.265] lstrcmpiW (lpString1=".inc", lpString2=".tlb") returned -1
	[0156.265] lstrlenW (lpString=".indd") returned 5
	[0156.265] lstrcmpiW (lpString1=".indd", lpString2="8.tlb") returned -1
	[0156.266] lstrlenW (lpString=".ini") returned 4
	[0156.266] lstrcmpiW (lpString1=".ini", lpString2=".tlb") returned -1
	[0156.266] lstrlenW (lpString=".iqy") returned 4
	[0156.266] lstrcmpiW (lpString1=".iqy", lpString2=".tlb") returned -1
	[0156.266] lstrlenW (lpString=".j2c") returned 4
	[0156.266] lstrcmpiW (lpString1=".j2c", lpString2=".tlb") returned -1
	[0156.266] lstrlenW (lpString=".j2k") returned 4
	[0156.266] lstrcmpiW (lpString1=".j2k", lpString2=".tlb") returned -1
	[0156.266] lstrlenW (lpString=".java") returned 5
	[0156.266] lstrcmpiW (lpString1=".java", lpString2="8.tlb") returned -1
	[0156.266] lstrlenW (lpString=".jp2") returned 4
	[0156.266] lstrcmpiW (lpString1=".jp2", lpString2=".tlb") returned -1
	[0156.266] lstrlenW (lpString=".jpc") returned 4
	[0156.266] lstrcmpiW (lpString1=".jpc", lpString2=".tlb") returned -1
	[0156.266] lstrlenW (lpString=".jpe") returned 4
	[0156.266] lstrcmpiW (lpString1=".jpe", lpString2=".tlb") returned -1
	[0156.266] lstrlenW (lpString=".jpeg") returned 5
	[0156.266] lstrcmpiW (lpString1=".jpeg", lpString2="8.tlb") returned -1
	[0156.266] lstrlenW (lpString=".jpf") returned 4
	[0156.266] lstrcmpiW (lpString1=".jpf", lpString2=".tlb") returned -1
	[0156.266] lstrlenW (lpString=".jpg") returned 4
	[0156.266] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0156.266] lstrlenW (lpString=".jpx") returned 4
	[0156.266] lstrcmpiW (lpString1=".jpx", lpString2=".tlb") returned -1
	[0156.266] lstrlenW (lpString=".js") returned 3
	[0156.266] lstrcmpiW (lpString1=".js", lpString2="tlb") returned -1
	[0156.266] lstrlenW (lpString=".jsf") returned 4
	[0156.266] lstrcmpiW (lpString1=".jsf", lpString2=".tlb") returned -1
	[0156.266] lstrlenW (lpString=".json") returned 5
	[0156.266] lstrcmpiW (lpString1=".json", lpString2="8.tlb") returned -1
	[0156.266] lstrlenW (lpString=".jsp") returned 4
	[0156.267] lstrcmpiW (lpString1=".jsp", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".kdc") returned 4
	[0156.267] lstrcmpiW (lpString1=".kdc", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".kmz") returned 4
	[0156.267] lstrcmpiW (lpString1=".kmz", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".kwm") returned 4
	[0156.267] lstrcmpiW (lpString1=".kwm", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".lasso") returned 6
	[0156.267] lstrcmpiW (lpString1=".lasso", lpString2="28.tlb") returned -1
	[0156.267] lstrlenW (lpString=".lbi") returned 4
	[0156.267] lstrcmpiW (lpString1=".lbi", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".lgf") returned 4
	[0156.267] lstrcmpiW (lpString1=".lgf", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".lgp") returned 4
	[0156.267] lstrcmpiW (lpString1=".lgp", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".log") returned 4
	[0156.267] lstrcmpiW (lpString1=".log", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".m1v") returned 4
	[0156.267] lstrcmpiW (lpString1=".m1v", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".m4a") returned 4
	[0156.267] lstrcmpiW (lpString1=".m4a", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".m4v") returned 4
	[0156.267] lstrcmpiW (lpString1=".m4v", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".max") returned 4
	[0156.267] lstrcmpiW (lpString1=".max", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".md") returned 3
	[0156.267] lstrcmpiW (lpString1=".md", lpString2="tlb") returned -1
	[0156.267] lstrlenW (lpString=".mda") returned 4
	[0156.267] lstrcmpiW (lpString1=".mda", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".mdb") returned 4
	[0156.267] lstrcmpiW (lpString1=".mdb", lpString2=".tlb") returned -1
	[0156.267] lstrlenW (lpString=".mde") returned 4
	[0156.268] lstrcmpiW (lpString1=".mde", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mdf") returned 4
	[0156.268] lstrcmpiW (lpString1=".mdf", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mdw") returned 4
	[0156.268] lstrcmpiW (lpString1=".mdw", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mef") returned 4
	[0156.268] lstrcmpiW (lpString1=".mef", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mft") returned 4
	[0156.268] lstrcmpiW (lpString1=".mft", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mfw") returned 4
	[0156.268] lstrcmpiW (lpString1=".mfw", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mht") returned 4
	[0156.268] lstrcmpiW (lpString1=".mht", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mhtml") returned 6
	[0156.268] lstrcmpiW (lpString1=".mhtml", lpString2="28.tlb") returned -1
	[0156.268] lstrlenW (lpString=".mka") returned 4
	[0156.268] lstrcmpiW (lpString1=".mka", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mkidx") returned 6
	[0156.268] lstrcmpiW (lpString1=".mkidx", lpString2="28.tlb") returned -1
	[0156.268] lstrlenW (lpString=".mkv") returned 4
	[0156.268] lstrcmpiW (lpString1=".mkv", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mos") returned 4
	[0156.268] lstrcmpiW (lpString1=".mos", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mov") returned 4
	[0156.268] lstrcmpiW (lpString1=".mov", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mp3") returned 4
	[0156.268] lstrcmpiW (lpString1=".mp3", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mp4") returned 4
	[0156.268] lstrcmpiW (lpString1=".mp4", lpString2=".tlb") returned -1
	[0156.268] lstrlenW (lpString=".mpeg") returned 5
	[0156.268] lstrcmpiW (lpString1=".mpeg", lpString2="8.tlb") returned -1
	[0156.268] lstrlenW (lpString=".mpg") returned 4
	[0156.269] lstrcmpiW (lpString1=".mpg", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".mpv") returned 4
	[0156.269] lstrcmpiW (lpString1=".mpv", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".mrw") returned 4
	[0156.269] lstrcmpiW (lpString1=".mrw", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".msg") returned 4
	[0156.269] lstrcmpiW (lpString1=".msg", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".mxl") returned 4
	[0156.269] lstrcmpiW (lpString1=".mxl", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".myd") returned 4
	[0156.269] lstrcmpiW (lpString1=".myd", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".myi") returned 4
	[0156.269] lstrcmpiW (lpString1=".myi", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".nef") returned 4
	[0156.269] lstrcmpiW (lpString1=".nef", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".nrw") returned 4
	[0156.269] lstrcmpiW (lpString1=".nrw", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".obj") returned 4
	[0156.269] lstrcmpiW (lpString1=".obj", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".odb") returned 4
	[0156.269] lstrcmpiW (lpString1=".odb", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".odc") returned 4
	[0156.269] lstrcmpiW (lpString1=".odc", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".odm") returned 4
	[0156.269] lstrcmpiW (lpString1=".odm", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".odp") returned 4
	[0156.269] lstrcmpiW (lpString1=".odp", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".ods") returned 4
	[0156.269] lstrcmpiW (lpString1=".ods", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".oft") returned 4
	[0156.269] lstrcmpiW (lpString1=".oft", lpString2=".tlb") returned -1
	[0156.269] lstrlenW (lpString=".one") returned 4
	[0156.270] lstrcmpiW (lpString1=".one", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".onepkg") returned 7
	[0156.270] lstrcmpiW (lpString1=".onepkg", lpString2="d28.tlb") returned -1
	[0156.270] lstrlenW (lpString=".onetoc2") returned 8
	[0156.270] lstrcmpiW (lpString1=".onetoc2", lpString2="md28.tlb") returned -1
	[0156.270] lstrlenW (lpString=".opt") returned 4
	[0156.270] lstrcmpiW (lpString1=".opt", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".oqy") returned 4
	[0156.270] lstrcmpiW (lpString1=".oqy", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".orf") returned 4
	[0156.270] lstrcmpiW (lpString1=".orf", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".p12") returned 4
	[0156.270] lstrcmpiW (lpString1=".p12", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".p7b") returned 4
	[0156.270] lstrcmpiW (lpString1=".p7b", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".p7c") returned 4
	[0156.270] lstrcmpiW (lpString1=".p7c", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".pam") returned 4
	[0156.270] lstrcmpiW (lpString1=".pam", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".pbm") returned 4
	[0156.270] lstrcmpiW (lpString1=".pbm", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".pct") returned 4
	[0156.270] lstrcmpiW (lpString1=".pct", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".pcx") returned 4
	[0156.270] lstrcmpiW (lpString1=".pcx", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".pdd") returned 4
	[0156.270] lstrcmpiW (lpString1=".pdd", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".pdf") returned 4
	[0156.270] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".pdp") returned 4
	[0156.270] lstrcmpiW (lpString1=".pdp", lpString2=".tlb") returned -1
	[0156.270] lstrlenW (lpString=".pef") returned 4
	[0156.271] lstrcmpiW (lpString1=".pef", lpString2=".tlb") returned -1
	[0156.271] lstrlenW (lpString=".pem") returned 4
	[0156.271] lstrcmpiW (lpString1=".pem", lpString2=".tlb") returned -1
	[0156.271] lstrlenW (lpString=".pff") returned 4
	[0156.271] lstrcmpiW (lpString1=".pff", lpString2=".tlb") returned -1
	[0156.271] lstrlenW (lpString=".pfm") returned 4
	[0156.271] lstrcmpiW (lpString1=".pfm", lpString2=".tlb") returned -1
	[0156.271] lstrlenW (lpString=".pfx") returned 4
	[0156.271] lstrcmpiW (lpString1=".pfx", lpString2=".tlb") returned -1
	[0156.271] lstrlenW (lpString=".pgm") returned 4
	[0156.271] lstrcmpiW (lpString1=".pgm", lpString2=".tlb") returned -1
	[0156.271] lstrlenW (lpString=".php") returned 4
	[0156.271] lstrcmpiW (lpString1=".php", lpString2=".tlb") returned -1
	[0156.271] lstrlenW (lpString=".php3") returned 5
	[0156.271] lstrcmpiW (lpString1=".php3", lpString2="8.tlb") returned -1
	[0156.271] lstrlenW (lpString=".php4") returned 5
	[0156.271] lstrcmpiW (lpString1=".php4", lpString2="8.tlb") returned -1
	[0156.271] lstrlenW (lpString=".php5") returned 5
	[0156.271] lstrcmpiW (lpString1=".php5", lpString2="8.tlb") returned -1
	[0156.271] lstrlenW (lpString=".phtml") returned 6
	[0156.271] lstrcmpiW (lpString1=".phtml", lpString2="28.tlb") returned -1
	[0156.271] lstrlenW (lpString=".pict") returned 5
	[0156.271] lstrcmpiW (lpString1=".pict", lpString2="8.tlb") returned -1
	[0156.271] lstrlenW (lpString=".pl") returned 3
	[0156.271] lstrcmpiW (lpString1=".pl", lpString2="tlb") returned -1
	[0156.271] lstrlenW (lpString=".pls") returned 4
	[0156.271] lstrcmpiW (lpString1=".pls", lpString2=".tlb") returned -1
	[0156.271] lstrlenW (lpString=".pm") returned 3
	[0156.271] lstrcmpiW (lpString1=".pm", lpString2="tlb") returned -1
	[0156.271] lstrlenW (lpString=".png") returned 4
	[0156.271] lstrcmpiW (lpString1=".png", lpString2=".tlb") returned -1
	[0156.272] lstrlenW (lpString=".pnm") returned 4
	[0156.272] lstrcmpiW (lpString1=".pnm", lpString2=".tlb") returned -1
	[0156.272] lstrlenW (lpString=".pot") returned 4
	[0156.272] lstrcmpiW (lpString1=".pot", lpString2=".tlb") returned -1
	[0156.272] lstrlenW (lpString=".potm") returned 5
	[0156.272] lstrcmpiW (lpString1=".potm", lpString2="8.tlb") returned -1
	[0156.272] lstrlenW (lpString=".potx") returned 5
	[0156.272] lstrcmpiW (lpString1=".potx", lpString2="8.tlb") returned -1
	[0156.272] lstrlenW (lpString=".ppa") returned 4
	[0156.272] lstrcmpiW (lpString1=".ppa", lpString2=".tlb") returned -1
	[0156.272] lstrlenW (lpString=".ppam") returned 5
	[0156.272] lstrcmpiW (lpString1=".ppam", lpString2="8.tlb") returned -1
	[0156.272] lstrlenW (lpString=".ppm") returned 4
	[0156.272] lstrcmpiW (lpString1=".ppm", lpString2=".tlb") returned -1
	[0156.272] lstrlenW (lpString=".pps") returned 4
	[0156.272] lstrcmpiW (lpString1=".pps", lpString2=".tlb") returned -1
	[0156.272] lstrlenW (lpString=".ppsm") returned 5
	[0156.272] lstrcmpiW (lpString1=".ppsm", lpString2="8.tlb") returned -1
	[0156.272] lstrlenW (lpString=".ppt") returned 4
	[0156.272] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0156.272] lstrlenW (lpString=".pptm") returned 5
	[0156.272] lstrcmpiW (lpString1=".pptm", lpString2="8.tlb") returned -1
	[0156.272] lstrlenW (lpString=".pptx") returned 5
	[0156.272] lstrcmpiW (lpString1=".pptx", lpString2="8.tlb") returned -1
	[0156.272] lstrlenW (lpString=".prn") returned 4
	[0156.272] lstrcmpiW (lpString1=".prn", lpString2=".tlb") returned -1
	[0156.272] lstrlenW (lpString=".ps") returned 3
	[0156.272] lstrcmpiW (lpString1=".ps", lpString2="tlb") returned -1
	[0156.272] lstrlenW (lpString=".psb") returned 4
	[0156.272] lstrcmpiW (lpString1=".psb", lpString2=".tlb") returned -1
	[0156.273] lstrlenW (lpString=".psd") returned 4
	[0156.273] lstrcmpiW (lpString1=".psd", lpString2=".tlb") returned -1
	[0156.273] lstrlenW (lpString=".pst") returned 4
	[0156.273] lstrcmpiW (lpString1=".pst", lpString2=".tlb") returned -1
	[0156.273] lstrlenW (lpString=".ptx") returned 4
	[0156.273] lstrcmpiW (lpString1=".ptx", lpString2=".tlb") returned -1
	[0156.273] lstrlenW (lpString=".pub") returned 4
	[0156.273] lstrcmpiW (lpString1=".pub", lpString2=".tlb") returned -1
	[0156.273] lstrlenW (lpString=".pwm") returned 4
	[0156.273] lstrcmpiW (lpString1=".pwm", lpString2=".tlb") returned -1
	[0156.273] lstrlenW (lpString=".pxr") returned 4
	[0156.273] lstrcmpiW (lpString1=".pxr", lpString2=".tlb") returned -1
	[0156.273] lstrlenW (lpString=".py") returned 3
	[0156.273] lstrcmpiW (lpString1=".py", lpString2="tlb") returned -1
	[0156.273] lstrlenW (lpString=".qt") returned 3
	[0156.273] lstrcmpiW (lpString1=".qt", lpString2="tlb") returned -1
	[0156.273] lstrlenW (lpString=".r3d") returned 4
	[0156.273] lstrcmpiW (lpString1=".r3d", lpString2=".tlb") returned -1
	[0156.273] lstrlenW (lpString=".raf") returned 4
	[0156.273] lstrcmpiW (lpString1=".raf", lpString2=".tlb") returned -1
	[0156.273] lstrlenW (lpString=".rar") returned 4
	[0156.273] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0156.273] lstrlenW (lpString=".raw") returned 4
	[0156.273] lstrcmpiW (lpString1=".raw", lpString2=".tlb") returned -1
	[0156.274] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.274] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1
	[0156.274] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.274] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="msadc", cAlternateFileName="")) returned 1
	[0156.364] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.364] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1
	[0156.364] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.364] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1
	[0156.364] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.364] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1
	[0156.365] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.365] FindNextFileW (in: hFindFile=0x3e70c70, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x1dfe, dwReserved1=0xfffffbfb, cFileName="wab32.dll", cAlternateFileName="")) returned 1
	[0156.365] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.367] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffddff, dwReserved1=0x4, cFileName="System", cAlternateFileName="")) returned 0
	[0156.367] FindClose (in: hFindFile=0x3e709b0 | out: hFindFile=0x3e709b0) returned 1
	[0156.367] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0156.367] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdae14ced, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xdae14ced, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdae14ced, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="desktop.ini.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DESKTO~1.MON")) returned 1
	[0156.367] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.367] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0xffffddff, dwReserved1=0x4, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1
	[0156.368] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.368] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5ba10, ftCreationTime.dwHighDateTime=0x1d509b6, ftLastAccessTime.dwLowDateTime=0xa8f1d660, ftLastAccessTime.dwHighDateTime=0x1d50d4a, ftLastWriteTime.dwLowDateTime=0xa8f1d660, ftLastWriteTime.dwHighDateTime=0x1d50d4a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffddff, dwReserved1=0x4, cFileName="percentage.exe", cAlternateFileName="PERCEN~1.EXE")) returned 1
	[0156.368] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0156.368] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0xffffddff, dwReserved1=0x4, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0156.368] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0156.368] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Java", cAlternateFileName="")) returned 1
	[0156.370] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.370] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe69537f8, ftCreationTime.dwHighDateTime=0x1d590a1, ftLastAccessTime.dwLowDateTime=0xe69537f8, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xe69537f8, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x753c, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll.id-B4197730.[admin@stex777.com].money", cAlternateFileName="DT_SHM~1.MON")) returned 1
	[0156.372] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.372] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1
	[0156.372] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x3e62088, Size=0x4000) returned 0x3e62088
	[0156.373] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8af971e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmiregistry.exe", cAlternateFileName="RMIREG~1.EXE")) returned 1
	[0156.373] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.373] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1
	[0156.373] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0156.373] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1
	[0156.435] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.435] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1
	[0156.435] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.435] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1
	[0156.436] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.436] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1
	[0156.438] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.438] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1
	[0156.439] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.439] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1
	[0156.441] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.441] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1
	[0156.973] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0156.973] FindNextFileW (in: hFindFile=0x3e70d70, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors.properties", cAlternateFileName="CURSOR~1.PRO")) returned 1
	[0156.974] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0156.974] FindNextFileW (in: hFindFile=0x3e70bb0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0
	[0156.974] FindClose (in: hFindFile=0x3e70bb0 | out: hFindFile=0x3e70bb0) returned 1
	[0156.974] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0156.974] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1
	[0157.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0157.183] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1
	[0157.426] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44a5fc0 | out: hHeap=0x4c0000) returned 1
	[0157.426] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1
	[0157.427] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x3e62088, Size=0x4000) returned 0x44a5fc0
	[0157.427] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90a30aa, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90a30aa, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa7233eb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x340865b, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt.jar", cAlternateFileName="")) returned 1
	[0157.567] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3e62088, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.567] FindNextFileW (in: hFindFile=0x3e70eb0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfd6, dwReserved0=0x3e62088, dwReserved1=0x2e0000, cFileName="blacklist", cAlternateFileName="BLACKL~1")) returned 1
	[0157.568] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0157.568] FindNextFileW (in: hFindFile=0x3e70b30, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1
	[0157.568] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0157.571] FindNextFileW (in: hFindFile=0x3e709b0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0157.571] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3e30060 | out: hHeap=0x4c0000) returned 1
	[0157.571] FindNextFileW (in: hFindFile=0x3e70f30, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffddff, dwReserved1=0x4, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0
	[0157.571] FindClose (in: hFindFile=0x3e70f30 | out: hFindFile=0x3e70f30) returned 1
	[0157.571] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0157.571] FindNextFileW (in: hFindFile=0x3e70a70, lpFindFileData=0x3bdfa7c | out: lpFindFileData=0x3bdfa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdbab04c7, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xdbab04c7, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10ce, dwReserved1=0xffffc9b9, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1
	[0159.286] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4508008 | out: hHeap=0x4c0000) returned 1
	[0159.286] FindNextFileW (in: hFindFile=0x3e707b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xde73e0a5, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xde73e0a5, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffddff, dwReserved1=0x4, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1
	[0159.479] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4508008 | out: hHeap=0x4c0000) returned 1
	[0159.479] FindNextFileW (in: hFindFile=0x3e707b0, lpFindFileData=0x3bdf800 | out: lpFindFileData=0x3bdf800*(dwFileAttributes=0x10010, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13bf80f9, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x13bf80f9, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffddff, dwReserved1=0x4, cFileName="root", cAlternateFileName="")) returned 1
	[0159.792] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0159.792] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10010, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13bf80f9, ftLastAccessTime.dwHighDateTime=0x1d590a2, ftLastWriteTime.dwLowDateTime=0x13bf80f9, ftLastWriteTime.dwHighDateTime=0x1d590a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1
	[0159.975] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x44a5fc0, Size=0x8000) returned 0x3eeefe8
	[0159.975] FindNextFileW (in: hFindFile=0x3e70430, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf55e30d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf55e30d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf55e30d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1
	[0159.976] lstrlenW (lpString="NA00042_.WMF") returned 12
	[0159.976] lstrlenW (lpString=".1cd") returned 4
	[0159.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.976] lstrlenW (lpString=".3ds") returned 4
	[0159.976] lstrcmpiW (lpString1=".3ds", lpString2=".WMF") returned -1
	[0159.976] lstrlenW (lpString=".3fr") returned 4
	[0159.976] lstrcmpiW (lpString1=".3fr", lpString2=".WMF") returned -1
	[0159.976] lstrlenW (lpString=".3g2") returned 4
	[0159.976] lstrcmpiW (lpString1=".3g2", lpString2=".WMF") returned -1
	[0159.976] lstrlenW (lpString=".3gp") returned 4
	[0159.976] lstrcmpiW (lpString1=".3gp", lpString2=".WMF") returned -1
	[0159.976] lstrlenW (lpString=".7z") returned 3
	[0159.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.976] lstrlenW (lpString=".accda") returned 6
	[0159.976] lstrcmpiW (lpString1=".accda", lpString2="2_.WMF") returned -1
	[0159.976] lstrlenW (lpString=".accdb") returned 6
	[0159.976] lstrcmpiW (lpString1=".accdb", lpString2="2_.WMF") returned -1
	[0159.976] lstrlenW (lpString=".accdc") returned 6
	[0159.976] lstrcmpiW (lpString1=".accdc", lpString2="2_.WMF") returned -1
	[0159.976] lstrlenW (lpString=".accde") returned 6
	[0159.976] lstrcmpiW (lpString1=".accde", lpString2="2_.WMF") returned -1
	[0159.976] lstrlenW (lpString=".accdt") returned 6
	[0159.976] lstrcmpiW (lpString1=".accdt", lpString2="2_.WMF") returned -1
	[0159.976] lstrlenW (lpString=".accdw") returned 6
	[0159.976] lstrcmpiW (lpString1=".accdw", lpString2="2_.WMF") returned -1
	[0159.976] lstrlenW (lpString=".adb") returned 4
	[0159.976] lstrcmpiW (lpString1=".adb", lpString2=".WMF") returned -1
	[0159.976] lstrlenW (lpString=".adp") returned 4
	[0159.976] lstrcmpiW (lpString1=".adp", lpString2=".WMF") returned -1
	[0159.976] lstrlenW (lpString=".ai") returned 3
	[0159.977] lstrcmpiW (lpString1=".ai", lpString2="WMF") returned -1
	[0159.977] lstrlenW (lpString=".ai3") returned 4
	[0159.977] lstrcmpiW (lpString1=".ai3", lpString2=".WMF") returned -1
	[0159.977] lstrlenW (lpString=".ai4") returned 4
	[0159.977] lstrcmpiW (lpString1=".ai4", lpString2=".WMF") returned -1
	[0159.977] lstrlenW (lpString=".ai5") returned 4
	[0159.977] lstrcmpiW (lpString1=".ai5", lpString2=".WMF") returned -1
	[0159.977] lstrlenW (lpString=".ai6") returned 4
	[0159.977] lstrcmpiW (lpString1=".ai6", lpString2=".WMF") returned -1
	[0159.977] lstrlenW (lpString=".ai7") returned 4
	[0159.977] lstrcmpiW (lpString1=".ai7", lpString2=".WMF") returned -1
	[0159.977] lstrlenW (lpString=".ai8") returned 4
	[0159.977] lstrcmpiW (lpString1=".ai8", lpString2=".WMF") returned -1
	[0159.977] lstrlenW (lpString=".anim") returned 5
	[0159.977] lstrcmpiW (lpString1=".anim", lpString2="_.WMF") returned -1
	[0159.977] lstrlenW (lpString=".arw") returned 4
	[0159.977] lstrcmpiW (lpString1=".arw", lpString2=".WMF") returned -1
	[0159.977] lstrlenW (lpString=".as") returned 3
	[0159.977] lstrcmpiW (lpString1=".as", lpString2="WMF") returned -1
	[0159.977] lstrlenW (lpString=".asa") returned 4
	[0159.977] lstrcmpiW (lpString1=".asa", lpString2=".WMF") returned -1
	[0159.977] lstrlenW (lpString=".asc") returned 4
	[0159.977] lstrcmpiW (lpString1=".asc", lpString2=".WMF") returned -1
	[0159.977] lstrlenW (lpString=".ascx") returned 5
	[0159.977] lstrcmpiW (lpString1=".ascx", lpString2="_.WMF") returned -1
	[0159.977] lstrlenW (lpString=".asm") returned 4
	[0159.977] lstrcmpiW (lpString1=".asm", lpString2=".WMF") returned -1
	[0159.977] lstrlenW (lpString=".asmx") returned 5
	[0159.977] lstrcmpiW (lpString1=".asmx", lpString2="_.WMF") returned -1
	[0159.977] lstrlenW (lpString=".asp") returned 4
	[0159.977] lstrcmpiW (lpString1=".asp", lpString2=".WMF") returned -1
	[0159.978] lstrlenW (lpString=".aspx") returned 5
	[0159.978] lstrcmpiW (lpString1=".aspx", lpString2="_.WMF") returned -1
	[0159.978] lstrlenW (lpString=".asr") returned 4
	[0159.978] lstrcmpiW (lpString1=".asr", lpString2=".WMF") returned -1
	[0159.978] lstrlenW (lpString=".asx") returned 4
	[0159.978] lstrcmpiW (lpString1=".asx", lpString2=".WMF") returned -1
	[0159.978] lstrlenW (lpString=".avi") returned 4
	[0159.978] lstrcmpiW (lpString1=".avi", lpString2=".WMF") returned -1
	[0159.978] lstrlenW (lpString=".avs") returned 4
	[0159.978] lstrcmpiW (lpString1=".avs", lpString2=".WMF") returned -1
	[0159.978] lstrlenW (lpString=".backup") returned 7
	[0159.978] lstrcmpiW (lpString1=".backup", lpString2="42_.WMF") returned -1
	[0159.978] lstrlenW (lpString=".bak") returned 4
	[0159.978] lstrcmpiW (lpString1=".bak", lpString2=".WMF") returned -1
	[0159.978] lstrlenW (lpString=".bay") returned 4
	[0159.978] lstrcmpiW (lpString1=".bay", lpString2=".WMF") returned -1
	[0159.978] lstrlenW (lpString=".bd") returned 3
	[0159.978] lstrcmpiW (lpString1=".bd", lpString2="WMF") returned -1
	[0159.978] lstrlenW (lpString=".bin") returned 4
	[0159.978] lstrcmpiW (lpString1=".bin", lpString2=".WMF") returned -1
	[0159.978] lstrlenW (lpString=".bmp") returned 4
	[0159.978] lstrcmpiW (lpString1=".bmp", lpString2=".WMF") returned -1
	[0159.978] lstrlenW (lpString=".bz2") returned 4
	[0159.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.978] lstrlenW (lpString=".c") returned 2
	[0159.978] lstrcmpiW (lpString1=".c", lpString2="MF") returned -1
	[0159.978] lstrlenW (lpString=".cdr") returned 4
	[0159.978] lstrcmpiW (lpString1=".cdr", lpString2=".WMF") returned -1
	[0159.978] lstrlenW (lpString=".cer") returned 4
	[0159.978] lstrcmpiW (lpString1=".cer", lpString2=".WMF") returned -1
	[0159.979] lstrlenW (lpString=".cf") returned 3
	[0159.979] lstrcmpiW (lpString1=".cf", lpString2="WMF") returned -1
	[0159.979] lstrlenW (lpString=".cfc") returned 4
	[0159.979] lstrcmpiW (lpString1=".cfc", lpString2=".WMF") returned -1
	[0159.979] lstrlenW (lpString=".cfm") returned 4
	[0159.979] lstrcmpiW (lpString1=".cfm", lpString2=".WMF") returned -1
	[0159.979] lstrlenW (lpString=".cfml") returned 5
	[0159.979] lstrcmpiW (lpString1=".cfml", lpString2="_.WMF") returned -1
	[0159.979] lstrlenW (lpString=".cfu") returned 4
	[0159.979] lstrcmpiW (lpString1=".cfu", lpString2=".WMF") returned -1
	[0159.979] lstrlenW (lpString=".chm") returned 4
	[0159.979] lstrcmpiW (lpString1=".chm", lpString2=".WMF") returned -1
	[0159.979] lstrlenW (lpString=".cin") returned 4
	[0159.979] lstrcmpiW (lpString1=".cin", lpString2=".WMF") returned -1
	[0159.979] lstrlenW (lpString=".class") returned 6
	[0159.979] lstrcmpiW (lpString1=".class", lpString2="2_.WMF") returned -1
	[0159.979] lstrlenW (lpString=".clx") returned 4
	[0159.979] lstrcmpiW (lpString1=".clx", lpString2=".WMF") returned -1
	[0159.979] lstrlenW (lpString=".config") returned 7
	[0159.979] lstrcmpiW (lpString1=".config", lpString2="42_.WMF") returned -1
	[0159.979] lstrlenW (lpString=".cpp") returned 4
	[0159.979] lstrcmpiW (lpString1=".cpp", lpString2=".WMF") returned -1
	[0159.979] lstrlenW (lpString=".cr2") returned 4
	[0159.979] lstrcmpiW (lpString1=".cr2", lpString2=".WMF") returned -1
	[0159.979] lstrlenW (lpString=".crt") returned 4
	[0159.979] lstrcmpiW (lpString1=".crt", lpString2=".WMF") returned -1
	[0159.979] lstrlenW (lpString=".crw") returned 4
	[0159.979] lstrcmpiW (lpString1=".crw", lpString2=".WMF") returned -1
	[0159.979] lstrlenW (lpString=".cs") returned 3
	[0159.979] lstrcmpiW (lpString1=".cs", lpString2="WMF") returned -1
	[0159.979] lstrlenW (lpString=".css") returned 4
	[0159.979] lstrcmpiW (lpString1=".css", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".csv") returned 4
	[0159.980] lstrcmpiW (lpString1=".csv", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".cub") returned 4
	[0159.980] lstrcmpiW (lpString1=".cub", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".dae") returned 4
	[0159.980] lstrcmpiW (lpString1=".dae", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".dat") returned 4
	[0159.980] lstrcmpiW (lpString1=".dat", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".db") returned 3
	[0159.980] lstrcmpiW (lpString1=".db", lpString2="WMF") returned -1
	[0159.980] lstrlenW (lpString=".dbf") returned 4
	[0159.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".dbx") returned 4
	[0159.980] lstrcmpiW (lpString1=".dbx", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".dc3") returned 4
	[0159.980] lstrcmpiW (lpString1=".dc3", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".dcm") returned 4
	[0159.980] lstrcmpiW (lpString1=".dcm", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".dcr") returned 4
	[0159.980] lstrcmpiW (lpString1=".dcr", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".der") returned 4
	[0159.980] lstrcmpiW (lpString1=".der", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".dib") returned 4
	[0159.980] lstrcmpiW (lpString1=".dib", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".dic") returned 4
	[0159.980] lstrcmpiW (lpString1=".dic", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".dif") returned 4
	[0159.980] lstrcmpiW (lpString1=".dif", lpString2=".WMF") returned -1
	[0159.980] lstrlenW (lpString=".divx") returned 5
	[0159.980] lstrcmpiW (lpString1=".divx", lpString2="_.WMF") returned -1
	[0159.980] lstrlenW (lpString=".djvu") returned 5
	[0159.981] lstrcmpiW (lpString1=".djvu", lpString2="_.WMF") returned -1
	[0159.981] lstrlenW (lpString=".dng") returned 4
	[0159.981] lstrcmpiW (lpString1=".dng", lpString2=".WMF") returned -1
	[0159.981] lstrlenW (lpString=".doc") returned 4
	[0159.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.981] lstrlenW (lpString=".docm") returned 5
	[0159.981] lstrcmpiW (lpString1=".docm", lpString2="_.WMF") returned -1
	[0159.981] lstrlenW (lpString=".docx") returned 5
	[0159.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0159.981] lstrlenW (lpString=".dot") returned 4
	[0159.981] lstrcmpiW (lpString1=".dot", lpString2=".WMF") returned -1
	[0159.981] lstrlenW (lpString=".dotm") returned 5
	[0159.981] lstrcmpiW (lpString1=".dotm", lpString2="_.WMF") returned -1
	[0159.981] lstrlenW (lpString=".dotx") returned 5
	[0159.981] lstrcmpiW (lpString1=".dotx", lpString2="_.WMF") returned -1
	[0159.981] lstrlenW (lpString=".dpx") returned 4
	[0159.981] lstrcmpiW (lpString1=".dpx", lpString2=".WMF") returned -1
	[0159.981] lstrlenW (lpString=".dqy") returned 4
	[0159.981] lstrcmpiW (lpString1=".dqy", lpString2=".WMF") returned -1
	[0159.981] lstrlenW (lpString=".dsn") returned 4
	[0159.981] lstrcmpiW (lpString1=".dsn", lpString2=".WMF") returned -1
	[0159.981] lstrlenW (lpString=".dt") returned 3
	[0159.981] lstrcmpiW (lpString1=".dt", lpString2="WMF") returned -1
	[0159.981] lstrlenW (lpString=".dtd") returned 4
	[0159.981] lstrcmpiW (lpString1=".dtd", lpString2=".WMF") returned -1
	[0159.981] lstrlenW (lpString=".dwg") returned 4
	[0159.981] lstrcmpiW (lpString1=".dwg", lpString2=".WMF") returned -1
	[0159.981] lstrlenW (lpString=".dwt") returned 4
	[0159.981] lstrcmpiW (lpString1=".dwt", lpString2=".WMF") returned -1
	[0159.981] lstrlenW (lpString=".dx") returned 3
	[0159.981] lstrcmpiW (lpString1=".dx", lpString2="WMF") returned -1
	[0159.981] lstrlenW (lpString=".dxf") returned 4
	[0159.982] lstrcmpiW (lpString1=".dxf", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".edml") returned 5
	[0159.982] lstrcmpiW (lpString1=".edml", lpString2="_.WMF") returned -1
	[0159.982] lstrlenW (lpString=".efd") returned 4
	[0159.982] lstrcmpiW (lpString1=".efd", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".elf") returned 4
	[0159.982] lstrcmpiW (lpString1=".elf", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".emf") returned 4
	[0159.982] lstrcmpiW (lpString1=".emf", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".emz") returned 4
	[0159.982] lstrcmpiW (lpString1=".emz", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".epf") returned 4
	[0159.982] lstrcmpiW (lpString1=".epf", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".eps") returned 4
	[0159.982] lstrcmpiW (lpString1=".eps", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".epsf") returned 5
	[0159.982] lstrcmpiW (lpString1=".epsf", lpString2="_.WMF") returned -1
	[0159.982] lstrlenW (lpString=".epsp") returned 5
	[0159.982] lstrcmpiW (lpString1=".epsp", lpString2="_.WMF") returned -1
	[0159.982] lstrlenW (lpString=".erf") returned 4
	[0159.982] lstrcmpiW (lpString1=".erf", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".exr") returned 4
	[0159.982] lstrcmpiW (lpString1=".exr", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".f4v") returned 4
	[0159.982] lstrcmpiW (lpString1=".f4v", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".fido") returned 5
	[0159.982] lstrcmpiW (lpString1=".fido", lpString2="_.WMF") returned -1
	[0159.982] lstrlenW (lpString=".flm") returned 4
	[0159.982] lstrcmpiW (lpString1=".flm", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".flv") returned 4
	[0159.982] lstrcmpiW (lpString1=".flv", lpString2=".WMF") returned -1
	[0159.982] lstrlenW (lpString=".frm") returned 4
	[0159.983] lstrcmpiW (lpString1=".frm", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".fxg") returned 4
	[0159.983] lstrcmpiW (lpString1=".fxg", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".geo") returned 4
	[0159.983] lstrcmpiW (lpString1=".geo", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".gif") returned 4
	[0159.983] lstrcmpiW (lpString1=".gif", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".grs") returned 4
	[0159.983] lstrcmpiW (lpString1=".grs", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".gz") returned 3
	[0159.983] lstrcmpiW (lpString1=".gz", lpString2="WMF") returned -1
	[0159.983] lstrlenW (lpString=".h") returned 2
	[0159.983] lstrcmpiW (lpString1=".h", lpString2="MF") returned -1
	[0159.983] lstrlenW (lpString=".hdr") returned 4
	[0159.983] lstrcmpiW (lpString1=".hdr", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".hpp") returned 4
	[0159.983] lstrcmpiW (lpString1=".hpp", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".hta") returned 4
	[0159.983] lstrcmpiW (lpString1=".hta", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".htc") returned 4
	[0159.983] lstrcmpiW (lpString1=".htc", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".htm") returned 4
	[0159.983] lstrcmpiW (lpString1=".htm", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".html") returned 5
	[0159.983] lstrcmpiW (lpString1=".html", lpString2="_.WMF") returned -1
	[0159.983] lstrlenW (lpString=".icb") returned 4
	[0159.983] lstrcmpiW (lpString1=".icb", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".ics") returned 4
	[0159.983] lstrcmpiW (lpString1=".ics", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".iff") returned 4
	[0159.983] lstrcmpiW (lpString1=".iff", lpString2=".WMF") returned -1
	[0159.983] lstrlenW (lpString=".inc") returned 4
	[0159.983] lstrcmpiW (lpString1=".inc", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".indd") returned 5
	[0159.984] lstrcmpiW (lpString1=".indd", lpString2="_.WMF") returned -1
	[0159.984] lstrlenW (lpString=".ini") returned 4
	[0159.984] lstrcmpiW (lpString1=".ini", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".iqy") returned 4
	[0159.984] lstrcmpiW (lpString1=".iqy", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".j2c") returned 4
	[0159.984] lstrcmpiW (lpString1=".j2c", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".j2k") returned 4
	[0159.984] lstrcmpiW (lpString1=".j2k", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".java") returned 5
	[0159.984] lstrcmpiW (lpString1=".java", lpString2="_.WMF") returned -1
	[0159.984] lstrlenW (lpString=".jp2") returned 4
	[0159.984] lstrcmpiW (lpString1=".jp2", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".jpc") returned 4
	[0159.984] lstrcmpiW (lpString1=".jpc", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".jpe") returned 4
	[0159.984] lstrcmpiW (lpString1=".jpe", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".jpeg") returned 5
	[0159.984] lstrcmpiW (lpString1=".jpeg", lpString2="_.WMF") returned -1
	[0159.984] lstrlenW (lpString=".jpf") returned 4
	[0159.984] lstrcmpiW (lpString1=".jpf", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".jpg") returned 4
	[0159.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".jpx") returned 4
	[0159.984] lstrcmpiW (lpString1=".jpx", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".js") returned 3
	[0159.984] lstrcmpiW (lpString1=".js", lpString2="WMF") returned -1
	[0159.984] lstrlenW (lpString=".jsf") returned 4
	[0159.984] lstrcmpiW (lpString1=".jsf", lpString2=".WMF") returned -1
	[0159.984] lstrlenW (lpString=".json") returned 5
	[0159.984] lstrcmpiW (lpString1=".json", lpString2="_.WMF") returned -1
	[0159.985] lstrlenW (lpString=".jsp") returned 4
	[0159.985] lstrcmpiW (lpString1=".jsp", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".kdc") returned 4
	[0159.985] lstrcmpiW (lpString1=".kdc", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".kmz") returned 4
	[0159.985] lstrcmpiW (lpString1=".kmz", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".kwm") returned 4
	[0159.985] lstrcmpiW (lpString1=".kwm", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".lasso") returned 6
	[0159.985] lstrcmpiW (lpString1=".lasso", lpString2="2_.WMF") returned -1
	[0159.985] lstrlenW (lpString=".lbi") returned 4
	[0159.985] lstrcmpiW (lpString1=".lbi", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".lgf") returned 4
	[0159.985] lstrcmpiW (lpString1=".lgf", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".lgp") returned 4
	[0159.985] lstrcmpiW (lpString1=".lgp", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".log") returned 4
	[0159.985] lstrcmpiW (lpString1=".log", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".m1v") returned 4
	[0159.985] lstrcmpiW (lpString1=".m1v", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".m4a") returned 4
	[0159.985] lstrcmpiW (lpString1=".m4a", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".m4v") returned 4
	[0159.985] lstrcmpiW (lpString1=".m4v", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".max") returned 4
	[0159.985] lstrcmpiW (lpString1=".max", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".md") returned 3
	[0159.985] lstrcmpiW (lpString1=".md", lpString2="WMF") returned -1
	[0159.985] lstrlenW (lpString=".mda") returned 4
	[0159.985] lstrcmpiW (lpString1=".mda", lpString2=".WMF") returned -1
	[0159.985] lstrlenW (lpString=".mdb") returned 4
	[0159.985] lstrcmpiW (lpString1=".mdb", lpString2=".WMF") returned -1
	[0159.986] lstrlenW (lpString=".mde") returned 4
	[0159.986] lstrcmpiW (lpString1=".mde", lpString2=".WMF") returned -1
	[0159.986] lstrlenW (lpString=".mdf") returned 4
	[0159.986] lstrcmpiW (lpString1=".mdf", lpString2=".WMF") returned -1
	[0159.986] lstrlenW (lpString=".mdw") returned 4
	[0159.986] lstrcmpiW (lpString1=".mdw", lpString2=".WMF") returned -1
	[0159.986] lstrlenW (lpString=".mef") returned 4
	[0159.986] lstrcmpiW (lpString1=".mef", lpString2=".WMF") returned -1
	[0159.986] lstrlenW (lpString=".mft") returned 4
	[0159.986] lstrcmpiW (lpString1=".mft", lpString2=".WMF") returned -1
	[0159.986] lstrlenW (lpString=".mfw") returned 4
	[0159.986] lstrcmpiW (lpString1=".mfw", lpString2=".WMF") returned -1
	[0159.986] lstrlenW (lpString=".mht") returned 4
	[0159.986] lstrcmpiW (lpString1=".mht", lpString2=".WMF") returned -1
	[0160.340] lstrlenW (lpString=".mhtml") returned 6
	[0160.343] lstrcmpiW (lpString1=".mhtml", lpString2="2_.WMF") returned -1
	[0160.365] lstrlenW (lpString=".mka") returned 4
	[0160.365] lstrcmpiW (lpString1=".mka", lpString2=".WMF") returned -1
	[0160.365] lstrlenW (lpString=".mkidx") returned 6
	[0160.365] lstrcmpiW (lpString1=".mkidx", lpString2="2_.WMF") returned -1
	[0160.365] lstrlenW (lpString=".mkv") returned 4
	[0160.365] lstrcmpiW (lpString1=".mkv", lpString2=".WMF") returned -1
	[0160.365] lstrlenW (lpString=".mos") returned 4
	[0160.365] lstrcmpiW (lpString1=".mos", lpString2=".WMF") returned -1
	[0160.365] lstrlenW (lpString=".mov") returned 4
	[0160.365] lstrcmpiW (lpString1=".mov", lpString2=".WMF") returned -1
	[0160.365] lstrlenW (lpString=".mp3") returned 4
	[0160.365] lstrcmpiW (lpString1=".mp3", lpString2=".WMF") returned -1
	[0160.365] lstrlenW (lpString=".mp4") returned 4
	[0160.365] lstrcmpiW (lpString1=".mp4", lpString2=".WMF") returned -1
	[0160.365] lstrlenW (lpString=".mpeg") returned 5
	[0160.365] lstrcmpiW (lpString1=".mpeg", lpString2="_.WMF") returned -1
	[0160.365] lstrlenW (lpString=".mpg") returned 4
	[0160.365] lstrcmpiW (lpString1=".mpg", lpString2=".WMF") returned -1
	[0160.365] lstrlenW (lpString=".mpv") returned 4
	[0160.365] lstrcmpiW (lpString1=".mpv", lpString2=".WMF") returned -1
	[0160.365] lstrlenW (lpString=".mrw") returned 4
	[0160.365] lstrcmpiW (lpString1=".mrw", lpString2=".WMF") returned -1
	[0160.365] lstrlenW (lpString=".msg") returned 4
	[0160.365] lstrcmpiW (lpString1=".msg", lpString2=".WMF") returned -1
	[0160.365] lstrlenW (lpString=".mxl") returned 4
	[0160.366] lstrcmpiW (lpString1=".mxl", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".myd") returned 4
	[0160.366] lstrcmpiW (lpString1=".myd", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".myi") returned 4
	[0160.366] lstrcmpiW (lpString1=".myi", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".nef") returned 4
	[0160.366] lstrcmpiW (lpString1=".nef", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".nrw") returned 4
	[0160.366] lstrcmpiW (lpString1=".nrw", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".obj") returned 4
	[0160.366] lstrcmpiW (lpString1=".obj", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".odb") returned 4
	[0160.366] lstrcmpiW (lpString1=".odb", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".odc") returned 4
	[0160.366] lstrcmpiW (lpString1=".odc", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".odm") returned 4
	[0160.366] lstrcmpiW (lpString1=".odm", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".odp") returned 4
	[0160.366] lstrcmpiW (lpString1=".odp", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".ods") returned 4
	[0160.366] lstrcmpiW (lpString1=".ods", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".oft") returned 4
	[0160.366] lstrcmpiW (lpString1=".oft", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".one") returned 4
	[0160.366] lstrcmpiW (lpString1=".one", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".onepkg") returned 7
	[0160.366] lstrcmpiW (lpString1=".onepkg", lpString2="42_.WMF") returned -1
	[0160.366] lstrlenW (lpString=".onetoc2") returned 8
	[0160.366] lstrcmpiW (lpString1=".onetoc2", lpString2="042_.WMF") returned -1
	[0160.366] lstrlenW (lpString=".opt") returned 4
	[0160.366] lstrcmpiW (lpString1=".opt", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".oqy") returned 4
	[0160.366] lstrcmpiW (lpString1=".oqy", lpString2=".WMF") returned -1
	[0160.366] lstrlenW (lpString=".orf") returned 4
	[0160.367] lstrcmpiW (lpString1=".orf", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".p12") returned 4
	[0160.367] lstrcmpiW (lpString1=".p12", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".p7b") returned 4
	[0160.367] lstrcmpiW (lpString1=".p7b", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".p7c") returned 4
	[0160.367] lstrcmpiW (lpString1=".p7c", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pam") returned 4
	[0160.367] lstrcmpiW (lpString1=".pam", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pbm") returned 4
	[0160.367] lstrcmpiW (lpString1=".pbm", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pct") returned 4
	[0160.367] lstrcmpiW (lpString1=".pct", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pcx") returned 4
	[0160.367] lstrcmpiW (lpString1=".pcx", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pdd") returned 4
	[0160.367] lstrcmpiW (lpString1=".pdd", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pdf") returned 4
	[0160.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pdp") returned 4
	[0160.367] lstrcmpiW (lpString1=".pdp", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pef") returned 4
	[0160.367] lstrcmpiW (lpString1=".pef", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pem") returned 4
	[0160.367] lstrcmpiW (lpString1=".pem", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pff") returned 4
	[0160.367] lstrcmpiW (lpString1=".pff", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pfm") returned 4
	[0160.367] lstrcmpiW (lpString1=".pfm", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pfx") returned 4
	[0160.367] lstrcmpiW (lpString1=".pfx", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".pgm") returned 4
	[0160.367] lstrcmpiW (lpString1=".pgm", lpString2=".WMF") returned -1
	[0160.367] lstrlenW (lpString=".php") returned 4
	[0160.368] lstrcmpiW (lpString1=".php", lpString2=".WMF") returned -1
	[0160.368] lstrlenW (lpString=".php3") returned 5
	[0160.368] lstrcmpiW (lpString1=".php3", lpString2="_.WMF") returned -1
	[0160.368] lstrlenW (lpString=".php4") returned 5
	[0160.368] lstrcmpiW (lpString1=".php4", lpString2="_.WMF") returned -1
	[0160.368] lstrlenW (lpString=".php5") returned 5
	[0160.368] lstrcmpiW (lpString1=".php5", lpString2="_.WMF") returned -1
	[0160.368] lstrlenW (lpString=".phtml") returned 6
	[0160.368] lstrcmpiW (lpString1=".phtml", lpString2="2_.WMF") returned -1
	[0160.368] lstrlenW (lpString=".pict") returned 5
	[0160.368] lstrcmpiW (lpString1=".pict", lpString2="_.WMF") returned -1
	[0160.368] lstrlenW (lpString=".pl") returned 3
	[0160.368] lstrcmpiW (lpString1=".pl", lpString2="WMF") returned -1
	[0160.368] lstrlenW (lpString=".pls") returned 4
	[0160.368] lstrcmpiW (lpString1=".pls", lpString2=".WMF") returned -1
	[0160.368] lstrlenW (lpString=".pm") returned 3
	[0160.368] lstrcmpiW (lpString1=".pm", lpString2="WMF") returned -1
	[0160.368] lstrlenW (lpString=".png") returned 4
	[0160.368] lstrcmpiW (lpString1=".png", lpString2=".WMF") returned -1
	[0160.368] lstrlenW (lpString=".pnm") returned 4
	[0160.368] lstrcmpiW (lpString1=".pnm", lpString2=".WMF") returned -1
	[0160.368] lstrlenW (lpString=".pot") returned 4
	[0160.368] lstrcmpiW (lpString1=".pot", lpString2=".WMF") returned -1
	[0160.368] lstrlenW (lpString=".potm") returned 5
	[0160.368] lstrcmpiW (lpString1=".potm", lpString2="_.WMF") returned -1
	[0160.368] lstrlenW (lpString=".potx") returned 5
	[0160.368] lstrcmpiW (lpString1=".potx", lpString2="_.WMF") returned -1
	[0160.368] lstrlenW (lpString=".ppa") returned 4
	[0160.368] lstrcmpiW (lpString1=".ppa", lpString2=".WMF") returned -1
	[0160.368] lstrlenW (lpString=".ppam") returned 5
	[0160.368] lstrcmpiW (lpString1=".ppam", lpString2="_.WMF") returned -1
	[0160.368] lstrlenW (lpString=".ppm") returned 4
	[0160.369] lstrcmpiW (lpString1=".ppm", lpString2=".WMF") returned -1
	[0160.369] lstrlenW (lpString=".pps") returned 4
	[0160.369] lstrcmpiW (lpString1=".pps", lpString2=".WMF") returned -1
	[0160.369] lstrlenW (lpString=".ppsm") returned 5
	[0160.369] lstrcmpiW (lpString1=".ppsm", lpString2="_.WMF") returned -1
	[0160.369] lstrlenW (lpString=".ppt") returned 4
	[0160.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.369] lstrlenW (lpString=".pptm") returned 5
	[0160.369] lstrcmpiW (lpString1=".pptm", lpString2="_.WMF") returned -1
	[0160.369] lstrlenW (lpString=".pptx") returned 5
	[0160.369] lstrcmpiW (lpString1=".pptx", lpString2="_.WMF") returned -1
	[0160.369] lstrlenW (lpString=".prn") returned 4
	[0160.369] lstrcmpiW (lpString1=".prn", lpString2=".WMF") returned -1
	[0160.369] lstrlenW (lpString=".ps") returned 3
	[0160.369] lstrcmpiW (lpString1=".ps", lpString2="WMF") returned -1
	[0160.369] lstrlenW (lpString=".psb") returned 4
	[0160.369] lstrcmpiW (lpString1=".psb", lpString2=".WMF") returned -1
	[0160.369] lstrlenW (lpString=".psd") returned 4
	[0160.369] lstrcmpiW (lpString1=".psd", lpString2=".WMF") returned -1
	[0160.369] lstrlenW (lpString=".pst") returned 4
	[0160.369] lstrcmpiW (lpString1=".pst", lpString2=".WMF") returned -1
	[0160.369] lstrlenW (lpString=".ptx") returned 4
	[0160.369] lstrcmpiW (lpString1=".ptx", lpString2=".WMF") returned -1
	[0160.369] lstrlenW (lpString=".pub") returned 4
	[0160.369] lstrcmpiW (lpString1=".pub", lpString2=".WMF") returned -1
	[0160.369] lstrlenW (lpString=".pwm") returned 4
	[0160.369] lstrcmpiW (lpString1=".pwm", lpString2=".WMF") returned -1
	[0160.369] lstrlenW (lpString=".pxr") returned 4
	[0160.369] lstrcmpiW (lpString1=".pxr", lpString2=".WMF") returned -1
	[0160.369] lstrlenW (lpString=".py") returned 3
	[0160.369] lstrcmpiW (lpString1=".py", lpString2="WMF") returned -1
	[0160.369] lstrlenW (lpString=".qt") returned 3
	[0160.369] lstrcmpiW (lpString1=".qt", lpString2="WMF") returned -1
	[0160.370] lstrlenW (lpString=".r3d") returned 4
	[0160.370] lstrcmpiW (lpString1=".r3d", lpString2=".WMF") returned -1
	[0160.370] lstrlenW (lpString=".raf") returned 4
	[0160.370] lstrcmpiW (lpString1=".raf", lpString2=".WMF") returned -1
	[0160.370] lstrlenW (lpString=".rar") returned 4
	[0160.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.370] lstrlenW (lpString=".raw") returned 4
	[0160.370] lstrcmpiW (lpString1=".raw", lpString2=".WMF") returned -1
	[0160.381] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0160.381] FindNextFileW (in: hFindFile=0x3e702f0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0160.383] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0160.383] FindNextFileW (in: hFindFile=0x3e70370, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0
	[0160.383] FindClose (in: hFindFile=0x3e70370 | out: hFindFile=0x3e70370) returned 1
	[0160.383] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0160.383] FindNextFileW (in: hFindFile=0x3e702f0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0
	[0160.383] FindClose (in: hFindFile=0x3e702f0 | out: hFindFile=0x3e702f0) returned 1
	[0160.383] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0160.383] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1
	[0160.386] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0160.386] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1
	[0160.387] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0160.387] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1
	[0160.389] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0160.389] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1
	[0160.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0160.390] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1
	[0160.393] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0160.393] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1
	[0160.394] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0160.394] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0160.398] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0160.398] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1
	[0160.399] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x3eeefe8, Size=0x10000) returned 0x458e9d8
	[0160.399] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2daee42, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2daee42, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe30113f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d3d, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessVL_MAK-ul-oob.xrm-ms", cAlternateFileName="AC2E1B~1.XRM")) returned 1
	[0160.465] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x458e9d8, Size=0x20000) returned 0x458e9d8
	[0160.465] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe62bb50d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe62bb50d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe637a07d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f42, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms", cAlternateFileName="O3737D~1.XRM")) returned 1
	[0160.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x458e9d8, Size=0x40000) returned 0x45ae9e0
	[0160.484] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec0037aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xec0037aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xec0c233c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x53a4, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VisioProO365R_Subscription-ppd.xrm-ms", cAlternateFileName="VI8A1E~1.XRM")) returned 1
	[0160.491] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0160.491] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1
	[0160.491] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0160.491] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1
	[0160.494] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0160.494] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0160.495] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0160.495] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0160.495] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0160.495] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1
	[0160.497] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0160.497] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0
	[0160.497] FindClose (in: hFindFile=0x3e70570 | out: hFindFile=0x3e70570) returned 1
	[0160.497] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0160.497] FindNextFileW (in: hFindFile=0x3e702b0, lpFindFileData=0x3bdf584 | out: lpFindFileData=0x3bdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1
	[0160.498] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0160.498] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1
	[0160.500] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0160.500] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1
	[0160.876] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0160.877] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1
	[0160.932] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0160.932] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1
	[0161.027] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0161.027] FindNextFileW (in: hFindFile=0x3e70470, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1
	[0161.030] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0161.031] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1
	[0161.113] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0161.113] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1
	[0161.458] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0161.458] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1
	[0161.553] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0161.553] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1
	[0161.672] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0161.672] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1
	[0161.677] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.677] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1
	[0161.680] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.680] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1
	[0161.682] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.682] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1
	[0161.684] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.684] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1
	[0161.686] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.686] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1
	[0161.687] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.687] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1
	[0161.689] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.689] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1
	[0161.692] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.692] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1
	[0161.694] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.694] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1
	[0161.696] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.696] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1
	[0161.698] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.698] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1
	[0161.700] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.700] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1
	[0161.702] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.702] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1
	[0161.703] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0161.703] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1
	[0162.112] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460e9f8 | out: hHeap=0x4c0000) returned 1
	[0162.112] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1
	[0162.113] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.113] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1
	[0162.115] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.115] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1
	[0162.116] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.116] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1
	[0162.118] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.118] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1
	[0162.119] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.119] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1
	[0162.121] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.121] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1
	[0162.123] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.123] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1
	[0162.124] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.124] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1
	[0162.126] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.126] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1
	[0162.129] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.129] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1
	[0162.131] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.131] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1
	[0162.132] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.132] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1
	[0162.134] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.134] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0162.135] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.135] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1
	[0162.137] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.137] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1
	[0162.138] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.138] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1
	[0162.140] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.140] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1
	[0162.141] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.141] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1
	[0162.535] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.536] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1
	[0162.537] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.537] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1
	[0162.539] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.539] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0162.540] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.540] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1
	[0162.542] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.542] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1
	[0162.543] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.544] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1
	[0162.545] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.545] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1
	[0162.547] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.547] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1
	[0162.548] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.549] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1
	[0162.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANS") returned 109
	[0162.549] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANS") returned 1
	[0162.549] lstrlenW (lpString="zh-HANS") returned 7
	[0162.549] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-HANS") returned -1
	[0162.549] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x44d7ff0
	[0162.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANS") returned 109
	[0162.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANS\\*", lpFindFileData=0x3bde918 | out: lpFindFileData=0x3bde918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e703f0
	[0162.550] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x3bde918 | out: lpFindFileData=0x3bde918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.550] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x3bde918 | out: lpFindFileData=0x3bde918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9992797, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9992797, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1
	[0162.550] lstrlenW (lpString="Microsoft.Mashup.Client.Excel.resources.dll") returned 43
	[0162.550] lstrlenW (lpString=".1cd") returned 4
	[0162.550] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0162.550] lstrlenW (lpString=".3ds") returned 4
	[0162.550] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0162.550] lstrlenW (lpString=".3fr") returned 4
	[0162.550] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0162.550] lstrlenW (lpString=".3g2") returned 4
	[0162.550] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0162.550] lstrlenW (lpString=".3gp") returned 4
	[0162.550] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0162.550] lstrlenW (lpString=".7z") returned 3
	[0162.550] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0162.550] lstrlenW (lpString=".accda") returned 6
	[0162.550] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1
	[0162.550] lstrlenW (lpString=".accdb") returned 6
	[0162.550] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1
	[0162.550] lstrlenW (lpString=".accdc") returned 6
	[0162.550] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1
	[0162.550] lstrlenW (lpString=".accde") returned 6
	[0162.550] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1
	[0162.550] lstrlenW (lpString=".accdt") returned 6
	[0162.551] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1
	[0162.551] lstrlenW (lpString=".accdw") returned 6
	[0162.551] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1
	[0162.551] lstrlenW (lpString=".adb") returned 4
	[0162.551] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0162.551] lstrlenW (lpString=".adp") returned 4
	[0162.551] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0162.551] lstrlenW (lpString=".ai") returned 3
	[0162.551] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0162.551] lstrlenW (lpString=".ai3") returned 4
	[0162.551] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0162.551] lstrlenW (lpString=".ai4") returned 4
	[0162.551] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0162.551] lstrlenW (lpString=".ai5") returned 4
	[0162.551] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0162.551] lstrlenW (lpString=".ai6") returned 4
	[0162.551] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0162.551] lstrlenW (lpString=".ai7") returned 4
	[0162.551] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0162.551] lstrlenW (lpString=".ai8") returned 4
	[0162.551] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0162.551] lstrlenW (lpString=".anim") returned 5
	[0162.551] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1
	[0162.551] lstrlenW (lpString=".arw") returned 4
	[0162.551] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0162.551] lstrlenW (lpString=".as") returned 3
	[0162.551] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0162.551] lstrlenW (lpString=".asa") returned 4
	[0162.551] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0162.551] lstrlenW (lpString=".asc") returned 4
	[0162.551] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0162.551] lstrlenW (lpString=".ascx") returned 5
	[0162.552] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1
	[0162.552] lstrlenW (lpString=".asm") returned 4
	[0162.552] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0162.552] lstrlenW (lpString=".asmx") returned 5
	[0162.552] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1
	[0162.552] lstrlenW (lpString=".asp") returned 4
	[0162.552] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0162.552] lstrlenW (lpString=".aspx") returned 5
	[0162.552] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1
	[0162.552] lstrlenW (lpString=".asr") returned 4
	[0162.552] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0162.552] lstrlenW (lpString=".asx") returned 4
	[0162.552] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0162.552] lstrlenW (lpString=".avi") returned 4
	[0162.552] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0162.552] lstrlenW (lpString=".avs") returned 4
	[0162.552] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0162.552] lstrlenW (lpString=".backup") returned 7
	[0162.552] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1
	[0162.552] lstrlenW (lpString=".bak") returned 4
	[0162.552] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0162.552] lstrlenW (lpString=".bay") returned 4
	[0162.552] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0162.552] lstrlenW (lpString=".bd") returned 3
	[0162.552] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0162.552] lstrlenW (lpString=".bin") returned 4
	[0162.552] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0162.552] lstrlenW (lpString=".bmp") returned 4
	[0162.552] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0162.552] lstrlenW (lpString=".bz2") returned 4
	[0162.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0162.553] lstrlenW (lpString=".c") returned 2
	[0162.553] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0162.553] lstrlenW (lpString=".cdr") returned 4
	[0162.553] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0162.553] lstrlenW (lpString=".cer") returned 4
	[0162.553] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0162.553] lstrlenW (lpString=".cf") returned 3
	[0162.553] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0162.553] lstrlenW (lpString=".cfc") returned 4
	[0162.553] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0162.553] lstrlenW (lpString=".cfm") returned 4
	[0162.553] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0162.553] lstrlenW (lpString=".cfml") returned 5
	[0162.553] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1
	[0162.553] lstrlenW (lpString=".cfu") returned 4
	[0162.553] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0162.553] lstrlenW (lpString=".chm") returned 4
	[0162.553] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0162.553] lstrlenW (lpString=".cin") returned 4
	[0162.553] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0162.553] lstrlenW (lpString=".class") returned 6
	[0162.553] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1
	[0162.553] lstrlenW (lpString=".clx") returned 4
	[0162.553] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0162.553] lstrlenW (lpString=".config") returned 7
	[0162.553] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1
	[0162.553] lstrlenW (lpString=".cpp") returned 4
	[0162.553] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0162.553] lstrlenW (lpString=".cr2") returned 4
	[0162.553] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0162.553] lstrlenW (lpString=".crt") returned 4
	[0162.554] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".crw") returned 4
	[0162.554] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".cs") returned 3
	[0162.554] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0162.554] lstrlenW (lpString=".css") returned 4
	[0162.554] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".csv") returned 4
	[0162.554] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".cub") returned 4
	[0162.554] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".dae") returned 4
	[0162.554] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".dat") returned 4
	[0162.554] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".db") returned 3
	[0162.554] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0162.554] lstrlenW (lpString=".dbf") returned 4
	[0162.554] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".dbx") returned 4
	[0162.554] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".dc3") returned 4
	[0162.554] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".dcm") returned 4
	[0162.554] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".dcr") returned 4
	[0162.554] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".der") returned 4
	[0162.554] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".dib") returned 4
	[0162.554] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0162.554] lstrlenW (lpString=".dic") returned 4
	[0162.555] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0162.555] lstrlenW (lpString=".dif") returned 4
	[0162.555] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0162.555] lstrlenW (lpString=".divx") returned 5
	[0162.555] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1
	[0162.555] lstrlenW (lpString=".djvu") returned 5
	[0162.555] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1
	[0162.555] lstrlenW (lpString=".dng") returned 4
	[0162.555] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0162.555] lstrlenW (lpString=".doc") returned 4
	[0162.555] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0162.555] lstrlenW (lpString=".docm") returned 5
	[0162.555] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1
	[0162.555] lstrlenW (lpString=".docx") returned 5
	[0162.555] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0162.555] lstrlenW (lpString=".dot") returned 4
	[0162.555] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0162.555] lstrlenW (lpString=".dotm") returned 5
	[0162.555] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1
	[0162.555] lstrlenW (lpString=".dotx") returned 5
	[0162.555] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1
	[0162.555] lstrlenW (lpString=".dpx") returned 4
	[0162.555] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0162.555] lstrlenW (lpString=".dqy") returned 4
	[0162.555] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0162.555] lstrlenW (lpString=".dsn") returned 4
	[0162.555] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0162.555] lstrlenW (lpString=".dt") returned 3
	[0162.555] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0162.555] lstrlenW (lpString=".dtd") returned 4
	[0162.555] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0162.555] lstrlenW (lpString=".dwg") returned 4
	[0162.556] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".dwt") returned 4
	[0162.556] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".dx") returned 3
	[0162.556] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0162.556] lstrlenW (lpString=".dxf") returned 4
	[0162.556] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".edml") returned 5
	[0162.556] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1
	[0162.556] lstrlenW (lpString=".efd") returned 4
	[0162.556] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".elf") returned 4
	[0162.556] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".emf") returned 4
	[0162.556] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".emz") returned 4
	[0162.556] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".epf") returned 4
	[0162.556] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".eps") returned 4
	[0162.556] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".epsf") returned 5
	[0162.556] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1
	[0162.556] lstrlenW (lpString=".epsp") returned 5
	[0162.556] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1
	[0162.556] lstrlenW (lpString=".erf") returned 4
	[0162.556] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".exr") returned 4
	[0162.556] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".f4v") returned 4
	[0162.556] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0162.556] lstrlenW (lpString=".fido") returned 5
	[0162.557] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1
	[0162.557] lstrlenW (lpString=".flm") returned 4
	[0162.557] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".flv") returned 4
	[0162.557] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".frm") returned 4
	[0162.557] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".fxg") returned 4
	[0162.557] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".geo") returned 4
	[0162.557] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".gif") returned 4
	[0162.557] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".grs") returned 4
	[0162.557] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".gz") returned 3
	[0162.557] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0162.557] lstrlenW (lpString=".h") returned 2
	[0162.557] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0162.557] lstrlenW (lpString=".hdr") returned 4
	[0162.557] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".hpp") returned 4
	[0162.557] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".hta") returned 4
	[0162.557] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".htc") returned 4
	[0162.557] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".htm") returned 4
	[0162.557] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0162.557] lstrlenW (lpString=".html") returned 5
	[0162.557] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1
	[0162.557] lstrlenW (lpString=".icb") returned 4
	[0162.558] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".ics") returned 4
	[0162.558] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".iff") returned 4
	[0162.558] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".inc") returned 4
	[0162.558] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".indd") returned 5
	[0162.558] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1
	[0162.558] lstrlenW (lpString=".ini") returned 4
	[0162.558] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".iqy") returned 4
	[0162.558] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".j2c") returned 4
	[0162.558] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".j2k") returned 4
	[0162.558] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".java") returned 5
	[0162.558] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1
	[0162.558] lstrlenW (lpString=".jp2") returned 4
	[0162.558] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".jpc") returned 4
	[0162.558] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".jpe") returned 4
	[0162.558] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".jpeg") returned 5
	[0162.558] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1
	[0162.558] lstrlenW (lpString=".jpf") returned 4
	[0162.558] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".jpg") returned 4
	[0162.558] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0162.558] lstrlenW (lpString=".jpx") returned 4
	[0162.559] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".js") returned 3
	[0162.559] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0162.559] lstrlenW (lpString=".jsf") returned 4
	[0162.559] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".json") returned 5
	[0162.559] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1
	[0162.559] lstrlenW (lpString=".jsp") returned 4
	[0162.559] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".kdc") returned 4
	[0162.559] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".kmz") returned 4
	[0162.559] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".kwm") returned 4
	[0162.559] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".lasso") returned 6
	[0162.559] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1
	[0162.559] lstrlenW (lpString=".lbi") returned 4
	[0162.559] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".lgf") returned 4
	[0162.559] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".lgp") returned 4
	[0162.559] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".log") returned 4
	[0162.559] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".m1v") returned 4
	[0162.559] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".m4a") returned 4
	[0162.559] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0162.559] lstrlenW (lpString=".m4v") returned 4
	[0162.559] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".max") returned 4
	[0162.560] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".md") returned 3
	[0162.560] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0162.560] lstrlenW (lpString=".mda") returned 4
	[0162.560] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".mdb") returned 4
	[0162.560] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".mde") returned 4
	[0162.560] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".mdf") returned 4
	[0162.560] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".mdw") returned 4
	[0162.560] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".mef") returned 4
	[0162.560] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".mft") returned 4
	[0162.560] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".mfw") returned 4
	[0162.560] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".mht") returned 4
	[0162.560] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".mhtml") returned 6
	[0162.560] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1
	[0162.560] lstrlenW (lpString=".mka") returned 4
	[0162.560] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".mkidx") returned 6
	[0162.560] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1
	[0162.560] lstrlenW (lpString=".mkv") returned 4
	[0162.560] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0162.560] lstrlenW (lpString=".mos") returned 4
	[0162.560] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".mov") returned 4
	[0162.561] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".mp3") returned 4
	[0162.561] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".mp4") returned 4
	[0162.561] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".mpeg") returned 5
	[0162.561] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1
	[0162.561] lstrlenW (lpString=".mpg") returned 4
	[0162.561] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".mpv") returned 4
	[0162.561] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".mrw") returned 4
	[0162.561] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".msg") returned 4
	[0162.561] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".mxl") returned 4
	[0162.561] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".myd") returned 4
	[0162.561] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".myi") returned 4
	[0162.561] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".nef") returned 4
	[0162.561] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".nrw") returned 4
	[0162.561] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".obj") returned 4
	[0162.561] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".odb") returned 4
	[0162.561] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0162.561] lstrlenW (lpString=".odc") returned 4
	[0162.561] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".odm") returned 4
	[0162.562] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".odp") returned 4
	[0162.562] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".ods") returned 4
	[0162.562] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".oft") returned 4
	[0162.562] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".one") returned 4
	[0162.562] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".onepkg") returned 7
	[0162.562] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1
	[0162.562] lstrlenW (lpString=".onetoc2") returned 8
	[0162.562] lstrcmpiW (lpString1=".onetoc2", lpString2="rces.dll") returned -1
	[0162.562] lstrlenW (lpString=".opt") returned 4
	[0162.562] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".oqy") returned 4
	[0162.562] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".orf") returned 4
	[0162.562] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".p12") returned 4
	[0162.562] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".p7b") returned 4
	[0162.562] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".p7c") returned 4
	[0162.562] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".pam") returned 4
	[0162.562] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".pbm") returned 4
	[0162.562] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".pct") returned 4
	[0162.562] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0162.562] lstrlenW (lpString=".pcx") returned 4
	[0162.563] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0162.563] lstrlenW (lpString=".pdd") returned 4
	[0162.563] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0162.563] lstrlenW (lpString=".pdf") returned 4
	[0162.563] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0162.563] lstrlenW (lpString=".pdp") returned 4
	[0162.563] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0162.563] lstrlenW (lpString=".pef") returned 4
	[0162.563] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0162.563] lstrlenW (lpString=".pem") returned 4
	[0162.563] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0162.563] lstrlenW (lpString=".pff") returned 4
	[0162.563] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0162.563] lstrlenW (lpString=".pfm") returned 4
	[0162.563] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0162.563] lstrlenW (lpString=".pfx") returned 4
	[0162.563] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0162.563] lstrlenW (lpString=".pgm") returned 4
	[0162.563] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0162.563] lstrlenW (lpString=".php") returned 4
	[0162.563] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0162.563] lstrlenW (lpString=".php3") returned 5
	[0162.563] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1
	[0162.563] lstrlenW (lpString=".php4") returned 5
	[0162.563] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1
	[0162.563] lstrlenW (lpString=".php5") returned 5
	[0162.563] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1
	[0162.563] lstrlenW (lpString=".phtml") returned 6
	[0162.563] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1
	[0162.563] lstrlenW (lpString=".pict") returned 5
	[0162.563] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1
	[0162.563] lstrlenW (lpString=".pl") returned 3
	[0162.564] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0162.564] lstrlenW (lpString=".pls") returned 4
	[0162.564] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0162.564] lstrlenW (lpString=".pm") returned 3
	[0162.564] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0162.564] lstrlenW (lpString=".png") returned 4
	[0162.564] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0162.564] lstrlenW (lpString=".pnm") returned 4
	[0162.564] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0162.564] lstrlenW (lpString=".pot") returned 4
	[0162.564] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0162.564] lstrlenW (lpString=".potm") returned 5
	[0162.564] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1
	[0162.564] lstrlenW (lpString=".potx") returned 5
	[0162.564] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1
	[0162.564] lstrlenW (lpString=".ppa") returned 4
	[0162.564] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0162.564] lstrlenW (lpString=".ppam") returned 5
	[0162.564] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1
	[0162.564] lstrlenW (lpString=".ppm") returned 4
	[0162.564] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0162.564] lstrlenW (lpString=".pps") returned 4
	[0162.565] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0162.565] lstrlenW (lpString=".ppsm") returned 5
	[0162.565] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1
	[0162.565] lstrlenW (lpString=".ppt") returned 4
	[0162.565] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0162.565] lstrlenW (lpString=".pptm") returned 5
	[0162.565] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1
	[0162.565] lstrlenW (lpString=".pptx") returned 5
	[0162.565] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1
	[0162.565] lstrlenW (lpString=".prn") returned 4
	[0162.565] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0162.565] lstrlenW (lpString=".ps") returned 3
	[0162.565] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0162.565] lstrlenW (lpString=".psb") returned 4
	[0162.565] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0162.565] lstrlenW (lpString=".psd") returned 4
	[0162.565] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0162.565] lstrlenW (lpString=".pst") returned 4
	[0162.565] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0162.565] lstrlenW (lpString=".ptx") returned 4
	[0162.565] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0162.565] lstrlenW (lpString=".pub") returned 4
	[0162.565] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0162.565] lstrlenW (lpString=".pwm") returned 4
	[0162.565] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0162.565] lstrlenW (lpString=".pxr") returned 4
	[0162.565] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0162.565] lstrlenW (lpString=".py") returned 3
	[0162.565] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0162.565] lstrlenW (lpString=".qt") returned 3
	[0162.566] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0162.566] lstrlenW (lpString=".r3d") returned 4
	[0162.566] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0162.568] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.568] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1
	[0162.569] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.569] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0
	[0162.569] FindClose (in: hFindFile=0x3e707f0 | out: hFindFile=0x3e707f0) returned 1
	[0162.569] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45fe9f0 | out: hHeap=0x4c0000) returned 1
	[0162.570] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0
	[0162.570] FindClose (in: hFindFile=0x3e70770 | out: hFindFile=0x3e70770) returned 1
	[0162.570] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ee9e8 | out: hHeap=0x4c0000) returned 1
	[0162.570] FindNextFileW (in: hFindFile=0x3e704f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1
	[0162.572] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0162.572] FindNextFileW (in: hFindFile=0x3e704f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1
	[0162.575] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.575] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0162.578] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.578] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1
	[0162.580] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.580] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0162.856] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0162.856] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0162.857] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.857] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0162.859] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.859] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0162.861] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.861] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0162.862] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.862] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0162.864] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.864] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0162.865] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x45ae9e0, Size=0x80000) returned 0x5229020
	[0162.873] FindNextFileW (in: hFindFile=0x3e70370, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4edc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerViewRes.eu.xap", cAlternateFileName="POWERV~1.XAP")) returned 1
	[0162.874] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.876] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0162.877] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.877] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0162.879] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.879] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1
	[0162.881] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.881] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0162.883] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.883] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0162.884] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.884] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0162.886] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.886] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0162.888] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.888] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0162.889] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.889] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0162.891] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0162.891] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0163.328] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0163.335] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1
	[0163.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk") returned 81
	[0163.340] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk") returned 1
	[0163.341] lstrlenW (lpString="kk") returned 2
	[0163.341] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="kk") returned -1
	[0163.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x451cfe8
	[0163.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk") returned 81
	[0163.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\*", lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e70770
	[0163.343] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.343] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc34bb5b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc34bb5b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14bf1c4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4a40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1
	[0163.343] lstrlenW (lpString="AdHocReportingExcelClient.dll") returned 29
	[0163.343] lstrlenW (lpString=".1cd") returned 4
	[0163.343] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0163.343] lstrlenW (lpString=".3ds") returned 4
	[0163.343] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0163.343] lstrlenW (lpString=".3fr") returned 4
	[0163.343] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0163.343] lstrlenW (lpString=".3g2") returned 4
	[0163.343] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0163.343] lstrlenW (lpString=".3gp") returned 4
	[0163.343] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0163.343] lstrlenW (lpString=".7z") returned 3
	[0163.343] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0163.343] lstrlenW (lpString=".accda") returned 6
	[0163.343] lstrcmpiW (lpString1=".accda", lpString2="nt.dll") returned -1
	[0163.343] lstrlenW (lpString=".accdb") returned 6
	[0163.343] lstrcmpiW (lpString1=".accdb", lpString2="nt.dll") returned -1
	[0163.343] lstrlenW (lpString=".accdc") returned 6
	[0163.344] lstrcmpiW (lpString1=".accdc", lpString2="nt.dll") returned -1
	[0163.344] lstrlenW (lpString=".accde") returned 6
	[0163.344] lstrcmpiW (lpString1=".accde", lpString2="nt.dll") returned -1
	[0163.344] lstrlenW (lpString=".accdt") returned 6
	[0163.344] lstrcmpiW (lpString1=".accdt", lpString2="nt.dll") returned -1
	[0163.344] lstrlenW (lpString=".accdw") returned 6
	[0163.344] lstrcmpiW (lpString1=".accdw", lpString2="nt.dll") returned -1
	[0163.344] lstrlenW (lpString=".adb") returned 4
	[0163.344] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0163.344] lstrlenW (lpString=".adp") returned 4
	[0163.344] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0163.344] lstrlenW (lpString=".ai") returned 3
	[0163.344] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0163.344] lstrlenW (lpString=".ai3") returned 4
	[0163.344] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0163.344] lstrlenW (lpString=".ai4") returned 4
	[0163.344] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0163.344] lstrlenW (lpString=".ai5") returned 4
	[0163.344] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0163.344] lstrlenW (lpString=".ai6") returned 4
	[0163.344] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0163.344] lstrlenW (lpString=".ai7") returned 4
	[0163.344] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0163.344] lstrlenW (lpString=".ai8") returned 4
	[0163.344] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0163.344] lstrlenW (lpString=".anim") returned 5
	[0163.344] lstrcmpiW (lpString1=".anim", lpString2="t.dll") returned -1
	[0163.344] lstrlenW (lpString=".arw") returned 4
	[0163.344] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0163.344] lstrlenW (lpString=".as") returned 3
	[0163.344] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0163.344] lstrlenW (lpString=".asa") returned 4
	[0163.344] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0163.345] lstrlenW (lpString=".asc") returned 4
	[0163.345] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0163.345] lstrlenW (lpString=".ascx") returned 5
	[0163.345] lstrcmpiW (lpString1=".ascx", lpString2="t.dll") returned -1
	[0163.345] lstrlenW (lpString=".asm") returned 4
	[0163.345] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0163.345] lstrlenW (lpString=".asmx") returned 5
	[0163.345] lstrcmpiW (lpString1=".asmx", lpString2="t.dll") returned -1
	[0163.345] lstrlenW (lpString=".asp") returned 4
	[0163.345] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0163.345] lstrlenW (lpString=".aspx") returned 5
	[0163.345] lstrcmpiW (lpString1=".aspx", lpString2="t.dll") returned -1
	[0163.345] lstrlenW (lpString=".asr") returned 4
	[0163.345] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0163.345] lstrlenW (lpString=".asx") returned 4
	[0163.345] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0163.345] lstrlenW (lpString=".avi") returned 4
	[0163.345] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0163.345] lstrlenW (lpString=".avs") returned 4
	[0163.345] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0163.345] lstrlenW (lpString=".backup") returned 7
	[0163.345] lstrcmpiW (lpString1=".backup", lpString2="ent.dll") returned -1
	[0163.345] lstrlenW (lpString=".bak") returned 4
	[0163.345] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0163.345] lstrlenW (lpString=".bay") returned 4
	[0163.345] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0163.345] lstrlenW (lpString=".bd") returned 3
	[0163.345] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0163.345] lstrlenW (lpString=".bin") returned 4
	[0163.345] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0163.346] lstrlenW (lpString=".bmp") returned 4
	[0163.346] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0163.346] lstrlenW (lpString=".bz2") returned 4
	[0163.346] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0163.346] lstrlenW (lpString=".c") returned 2
	[0163.346] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0163.346] lstrlenW (lpString=".cdr") returned 4
	[0163.346] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0163.346] lstrlenW (lpString=".cer") returned 4
	[0163.346] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0163.346] lstrlenW (lpString=".cf") returned 3
	[0163.346] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0163.346] lstrlenW (lpString=".cfc") returned 4
	[0163.346] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0163.346] lstrlenW (lpString=".cfm") returned 4
	[0163.346] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0163.346] lstrlenW (lpString=".cfml") returned 5
	[0163.346] lstrcmpiW (lpString1=".cfml", lpString2="t.dll") returned -1
	[0163.346] lstrlenW (lpString=".cfu") returned 4
	[0163.346] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0163.346] lstrlenW (lpString=".chm") returned 4
	[0163.346] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0163.346] lstrlenW (lpString=".cin") returned 4
	[0163.346] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0163.346] lstrlenW (lpString=".class") returned 6
	[0163.346] lstrcmpiW (lpString1=".class", lpString2="nt.dll") returned -1
	[0163.346] lstrlenW (lpString=".clx") returned 4
	[0163.346] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0163.346] lstrlenW (lpString=".config") returned 7
	[0163.346] lstrcmpiW (lpString1=".config", lpString2="ent.dll") returned -1
	[0163.346] lstrlenW (lpString=".cpp") returned 4
	[0163.347] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".cr2") returned 4
	[0163.347] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".crt") returned 4
	[0163.347] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".crw") returned 4
	[0163.347] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".cs") returned 3
	[0163.347] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0163.347] lstrlenW (lpString=".css") returned 4
	[0163.347] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".csv") returned 4
	[0163.347] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".cub") returned 4
	[0163.347] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".dae") returned 4
	[0163.347] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".dat") returned 4
	[0163.347] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".db") returned 3
	[0163.347] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0163.347] lstrlenW (lpString=".dbf") returned 4
	[0163.347] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".dbx") returned 4
	[0163.347] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".dc3") returned 4
	[0163.347] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".dcm") returned 4
	[0163.347] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0163.347] lstrlenW (lpString=".dcr") returned 4
	[0163.347] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0163.348] lstrlenW (lpString=".der") returned 4
	[0163.348] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0163.348] lstrlenW (lpString=".dib") returned 4
	[0163.348] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0163.348] lstrlenW (lpString=".dic") returned 4
	[0163.348] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0163.348] lstrlenW (lpString=".dif") returned 4
	[0163.348] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0163.348] lstrlenW (lpString=".divx") returned 5
	[0163.348] lstrcmpiW (lpString1=".divx", lpString2="t.dll") returned -1
	[0163.348] lstrlenW (lpString=".djvu") returned 5
	[0163.348] lstrcmpiW (lpString1=".djvu", lpString2="t.dll") returned -1
	[0163.348] lstrlenW (lpString=".dng") returned 4
	[0163.348] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0163.348] lstrlenW (lpString=".doc") returned 4
	[0163.348] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0163.348] lstrlenW (lpString=".docm") returned 5
	[0163.348] lstrcmpiW (lpString1=".docm", lpString2="t.dll") returned -1
	[0163.348] lstrlenW (lpString=".docx") returned 5
	[0163.348] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0163.348] lstrlenW (lpString=".dot") returned 4
	[0163.348] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0163.348] lstrlenW (lpString=".dotm") returned 5
	[0163.348] lstrcmpiW (lpString1=".dotm", lpString2="t.dll") returned -1
	[0163.348] lstrlenW (lpString=".dotx") returned 5
	[0163.348] lstrcmpiW (lpString1=".dotx", lpString2="t.dll") returned -1
	[0163.348] lstrlenW (lpString=".dpx") returned 4
	[0163.348] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0163.348] lstrlenW (lpString=".dqy") returned 4
	[0163.348] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".dsn") returned 4
	[0163.349] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".dt") returned 3
	[0163.349] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0163.349] lstrlenW (lpString=".dtd") returned 4
	[0163.349] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".dwg") returned 4
	[0163.349] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".dwt") returned 4
	[0163.349] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".dx") returned 3
	[0163.349] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0163.349] lstrlenW (lpString=".dxf") returned 4
	[0163.349] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".edml") returned 5
	[0163.349] lstrcmpiW (lpString1=".edml", lpString2="t.dll") returned -1
	[0163.349] lstrlenW (lpString=".efd") returned 4
	[0163.349] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".elf") returned 4
	[0163.349] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".emf") returned 4
	[0163.349] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".emz") returned 4
	[0163.349] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".epf") returned 4
	[0163.349] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".eps") returned 4
	[0163.349] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0163.349] lstrlenW (lpString=".epsf") returned 5
	[0163.349] lstrcmpiW (lpString1=".epsf", lpString2="t.dll") returned -1
	[0163.349] lstrlenW (lpString=".epsp") returned 5
	[0163.349] lstrcmpiW (lpString1=".epsp", lpString2="t.dll") returned -1
	[0163.350] lstrlenW (lpString=".erf") returned 4
	[0163.350] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".exr") returned 4
	[0163.350] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".f4v") returned 4
	[0163.350] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".fido") returned 5
	[0163.350] lstrcmpiW (lpString1=".fido", lpString2="t.dll") returned -1
	[0163.350] lstrlenW (lpString=".flm") returned 4
	[0163.350] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".flv") returned 4
	[0163.350] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".frm") returned 4
	[0163.350] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".fxg") returned 4
	[0163.350] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".geo") returned 4
	[0163.350] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".gif") returned 4
	[0163.350] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".grs") returned 4
	[0163.350] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".gz") returned 3
	[0163.350] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0163.350] lstrlenW (lpString=".h") returned 2
	[0163.350] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0163.350] lstrlenW (lpString=".hdr") returned 4
	[0163.350] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".hpp") returned 4
	[0163.350] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".hta") returned 4
	[0163.351] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".htc") returned 4
	[0163.351] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".htm") returned 4
	[0163.351] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".html") returned 5
	[0163.351] lstrcmpiW (lpString1=".html", lpString2="t.dll") returned -1
	[0163.351] lstrlenW (lpString=".icb") returned 4
	[0163.351] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".ics") returned 4
	[0163.351] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".iff") returned 4
	[0163.351] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".inc") returned 4
	[0163.351] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".indd") returned 5
	[0163.351] lstrcmpiW (lpString1=".indd", lpString2="t.dll") returned -1
	[0163.351] lstrlenW (lpString=".ini") returned 4
	[0163.351] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".iqy") returned 4
	[0163.351] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".j2c") returned 4
	[0163.351] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".j2k") returned 4
	[0163.351] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".java") returned 5
	[0163.351] lstrcmpiW (lpString1=".java", lpString2="t.dll") returned -1
	[0163.351] lstrlenW (lpString=".jp2") returned 4
	[0163.351] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".jpc") returned 4
	[0163.351] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".jpe") returned 4
	[0163.352] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".jpeg") returned 5
	[0163.352] lstrcmpiW (lpString1=".jpeg", lpString2="t.dll") returned -1
	[0163.352] lstrlenW (lpString=".jpf") returned 4
	[0163.352] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".jpg") returned 4
	[0163.352] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".jpx") returned 4
	[0163.352] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".js") returned 3
	[0163.352] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0163.352] lstrlenW (lpString=".jsf") returned 4
	[0163.352] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".json") returned 5
	[0163.352] lstrcmpiW (lpString1=".json", lpString2="t.dll") returned -1
	[0163.352] lstrlenW (lpString=".jsp") returned 4
	[0163.352] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".kdc") returned 4
	[0163.352] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".kmz") returned 4
	[0163.352] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".kwm") returned 4
	[0163.352] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".lasso") returned 6
	[0163.352] lstrcmpiW (lpString1=".lasso", lpString2="nt.dll") returned -1
	[0163.352] lstrlenW (lpString=".lbi") returned 4
	[0163.352] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".lgf") returned 4
	[0163.352] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0163.352] lstrlenW (lpString=".lgp") returned 4
	[0163.353] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".log") returned 4
	[0163.353] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".m1v") returned 4
	[0163.353] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".m4a") returned 4
	[0163.353] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".m4v") returned 4
	[0163.353] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".max") returned 4
	[0163.353] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".md") returned 3
	[0163.353] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0163.353] lstrlenW (lpString=".mda") returned 4
	[0163.353] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".mdb") returned 4
	[0163.353] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".mde") returned 4
	[0163.353] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".mdf") returned 4
	[0163.353] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".mdw") returned 4
	[0163.353] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".mef") returned 4
	[0163.353] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".mft") returned 4
	[0163.353] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".mfw") returned 4
	[0163.353] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0163.353] lstrlenW (lpString=".mht") returned 4
	[0163.353] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".mhtml") returned 6
	[0163.354] lstrcmpiW (lpString1=".mhtml", lpString2="nt.dll") returned -1
	[0163.354] lstrlenW (lpString=".mka") returned 4
	[0163.354] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".mkidx") returned 6
	[0163.354] lstrcmpiW (lpString1=".mkidx", lpString2="nt.dll") returned -1
	[0163.354] lstrlenW (lpString=".mkv") returned 4
	[0163.354] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".mos") returned 4
	[0163.354] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".mov") returned 4
	[0163.354] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".mp3") returned 4
	[0163.354] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".mp4") returned 4
	[0163.354] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".mpeg") returned 5
	[0163.354] lstrcmpiW (lpString1=".mpeg", lpString2="t.dll") returned -1
	[0163.354] lstrlenW (lpString=".mpg") returned 4
	[0163.354] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".mpv") returned 4
	[0163.354] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".mrw") returned 4
	[0163.354] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".msg") returned 4
	[0163.354] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".mxl") returned 4
	[0163.354] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".myd") returned 4
	[0163.354] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0163.354] lstrlenW (lpString=".myi") returned 4
	[0163.355] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".nef") returned 4
	[0163.355] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".nrw") returned 4
	[0163.355] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".obj") returned 4
	[0163.355] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".odb") returned 4
	[0163.355] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".odc") returned 4
	[0163.355] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".odm") returned 4
	[0163.355] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".odp") returned 4
	[0163.355] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".ods") returned 4
	[0163.355] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".oft") returned 4
	[0163.355] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".one") returned 4
	[0163.355] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".onepkg") returned 7
	[0163.355] lstrcmpiW (lpString1=".onepkg", lpString2="ent.dll") returned -1
	[0163.355] lstrlenW (lpString=".onetoc2") returned 8
	[0163.355] lstrcmpiW (lpString1=".onetoc2", lpString2="ient.dll") returned -1
	[0163.355] lstrlenW (lpString=".opt") returned 4
	[0163.355] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".oqy") returned 4
	[0163.355] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0163.355] lstrlenW (lpString=".orf") returned 4
	[0163.355] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".p12") returned 4
	[0163.356] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".p7b") returned 4
	[0163.356] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".p7c") returned 4
	[0163.356] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pam") returned 4
	[0163.356] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pbm") returned 4
	[0163.356] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pct") returned 4
	[0163.356] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pcx") returned 4
	[0163.356] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pdd") returned 4
	[0163.356] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pdf") returned 4
	[0163.356] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pdp") returned 4
	[0163.356] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pef") returned 4
	[0163.356] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pem") returned 4
	[0163.356] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pff") returned 4
	[0163.356] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pfm") returned 4
	[0163.356] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pfx") returned 4
	[0163.356] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0163.356] lstrlenW (lpString=".pgm") returned 4
	[0163.357] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0163.357] lstrlenW (lpString=".php") returned 4
	[0163.357] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0163.357] lstrlenW (lpString=".php3") returned 5
	[0163.357] lstrcmpiW (lpString1=".php3", lpString2="t.dll") returned -1
	[0163.357] lstrlenW (lpString=".php4") returned 5
	[0163.357] lstrcmpiW (lpString1=".php4", lpString2="t.dll") returned -1
	[0163.357] lstrlenW (lpString=".php5") returned 5
	[0163.357] lstrcmpiW (lpString1=".php5", lpString2="t.dll") returned -1
	[0163.357] lstrlenW (lpString=".phtml") returned 6
	[0163.357] lstrcmpiW (lpString1=".phtml", lpString2="nt.dll") returned -1
	[0163.357] lstrlenW (lpString=".pict") returned 5
	[0163.357] lstrcmpiW (lpString1=".pict", lpString2="t.dll") returned -1
	[0163.357] lstrlenW (lpString=".pl") returned 3
	[0163.357] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0163.357] lstrlenW (lpString=".pls") returned 4
	[0163.357] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0163.357] lstrlenW (lpString=".pm") returned 3
	[0163.357] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0163.357] lstrlenW (lpString=".png") returned 4
	[0163.357] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0163.357] lstrlenW (lpString=".pnm") returned 4
	[0163.357] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0163.357] lstrlenW (lpString=".pot") returned 4
	[0163.357] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0163.357] lstrlenW (lpString=".potm") returned 5
	[0163.357] lstrcmpiW (lpString1=".potm", lpString2="t.dll") returned -1
	[0163.357] lstrlenW (lpString=".potx") returned 5
	[0163.357] lstrcmpiW (lpString1=".potx", lpString2="t.dll") returned -1
	[0163.357] lstrlenW (lpString=".ppa") returned 4
	[0163.357] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0163.357] lstrlenW (lpString=".ppam") returned 5
	[0163.358] lstrcmpiW (lpString1=".ppam", lpString2="t.dll") returned -1
	[0163.358] lstrlenW (lpString=".ppm") returned 4
	[0163.358] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0163.358] lstrlenW (lpString=".pps") returned 4
	[0163.358] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0163.358] lstrlenW (lpString=".ppsm") returned 5
	[0163.358] lstrcmpiW (lpString1=".ppsm", lpString2="t.dll") returned -1
	[0163.358] lstrlenW (lpString=".ppt") returned 4
	[0163.358] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0163.358] lstrlenW (lpString=".pptm") returned 5
	[0163.358] lstrcmpiW (lpString1=".pptm", lpString2="t.dll") returned -1
	[0163.358] lstrlenW (lpString=".pptx") returned 5
	[0163.358] lstrcmpiW (lpString1=".pptx", lpString2="t.dll") returned -1
	[0163.358] lstrlenW (lpString=".prn") returned 4
	[0163.358] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0163.358] lstrlenW (lpString=".ps") returned 3
	[0163.358] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0163.358] lstrlenW (lpString=".psb") returned 4
	[0163.358] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0163.358] lstrlenW (lpString=".psd") returned 4
	[0163.358] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0163.358] lstrlenW (lpString=".pst") returned 4
	[0163.358] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0163.358] lstrlenW (lpString=".ptx") returned 4
	[0163.358] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0163.358] lstrlenW (lpString=".pub") returned 4
	[0163.358] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0163.358] lstrlenW (lpString=".pwm") returned 4
	[0163.358] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0163.358] lstrlenW (lpString=".pxr") returned 4
	[0163.358] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0163.358] lstrlenW (lpString=".py") returned 3
	[0163.359] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0163.359] lstrlenW (lpString=".qt") returned 3
	[0163.359] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0163.359] lstrlenW (lpString=".r3d") returned 4
	[0163.359] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0163.359] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.360] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0163.362] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.362] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0163.363] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.363] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0163.365] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.365] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0163.367] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.367] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0163.368] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.368] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0163.370] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.370] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0163.376] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.376] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1
	[0163.776] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.777] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0163.782] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.782] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0163.783] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.784] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0163.785] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.785] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0163.787] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.787] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0163.788] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.788] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1
	[0163.790] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.790] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1
	[0163.791] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.791] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0163.793] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.793] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0163.795] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.795] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0163.796] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.796] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0163.798] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.798] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0163.800] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.800] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0163.802] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.802] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1
	[0163.803] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.803] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1
	[0163.805] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.805] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0
	[0163.805] FindClose (in: hFindFile=0x3e701b0 | out: hFindFile=0x3e701b0) returned 1
	[0163.805] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0163.805] FindNextFileW (in: hFindFile=0x3e704f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1
	[0163.807] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0163.807] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0164.192] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.192] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0164.195] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.195] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1
	[0164.197] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.197] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0164.199] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.199] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0164.201] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.201] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0164.203] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.203] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0164.205] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.205] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1
	[0164.206] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.206] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0164.208] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.208] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0164.210] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.210] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0164.212] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.212] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0164.214] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.214] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0164.216] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.217] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1
	[0164.219] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.219] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0164.221] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.221] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0164.223] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.223] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0164.441] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.441] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0164.523] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.523] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0164.547] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0164.547] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interop.MSDASC.dll", cAlternateFileName="INTERO~1.DLL")) returned 1
	[0165.130] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.130] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0165.132] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.132] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1
	[0165.134] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.134] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0165.136] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.136] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0165.138] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.138] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0165.140] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.140] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDXQueryGenerator.DLL", cAlternateFileName="MDXQUE~1.DLL")) returned 1
	[0165.206] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.206] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0165.220] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.220] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0165.222] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.222] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1
	[0165.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.225] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.dll", cAlternateFileName="POWERP~1.DLL")) returned 1
	[0165.227] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.227] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0165.229] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.229] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.dll", cAlternateFileName="REPORT~1.DLL")) returned 1
	[0165.229] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.229] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1026", cAlternateFileName="")) returned 1
	[0165.230] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.230] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10266", cAlternateFileName="")) returned 1
	[0165.230] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.230] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1027", cAlternateFileName="")) returned 1
	[0165.230] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.230] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1028", cAlternateFileName="")) returned 1
	[0165.230] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.231] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1029", cAlternateFileName="")) returned 1
	[0165.231] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.231] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1030", cAlternateFileName="")) returned 1
	[0165.231] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.231] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1
	[0165.231] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.231] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1032", cAlternateFileName="")) returned 1
	[0165.232] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.232] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1
	[0165.232] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.232] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1035", cAlternateFileName="")) returned 1
	[0165.232] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.232] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1
	[0165.233] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.233] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1037", cAlternateFileName="")) returned 1
	[0165.233] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.233] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1038", cAlternateFileName="")) returned 1
	[0165.233] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.233] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1
	[0165.234] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.234] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1
	[0165.234] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.234] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1
	[0165.234] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.234] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1043", cAlternateFileName="")) returned 1
	[0165.234] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.235] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1044", cAlternateFileName="")) returned 1
	[0165.235] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.235] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1045", cAlternateFileName="")) returned 1
	[0165.235] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.235] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1
	[0165.235] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.235] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1048", cAlternateFileName="")) returned 1
	[0165.236] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.236] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1
	[0165.667] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0165.667] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1050", cAlternateFileName="")) returned 1
	[0165.667] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.667] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1051", cAlternateFileName="")) returned 1
	[0165.668] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.668] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1053", cAlternateFileName="")) returned 1
	[0165.668] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.668] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1054", cAlternateFileName="")) returned 1
	[0165.668] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.668] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1055", cAlternateFileName="")) returned 1
	[0165.669] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.669] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1057", cAlternateFileName="")) returned 1
	[0165.669] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.669] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1058", cAlternateFileName="")) returned 1
	[0165.671] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.671] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1060", cAlternateFileName="")) returned 1
	[0165.671] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.671] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1061", cAlternateFileName="")) returned 1
	[0165.672] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.672] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1062", cAlternateFileName="")) returned 1
	[0165.672] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.672] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1063", cAlternateFileName="")) returned 1
	[0165.672] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.672] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1066", cAlternateFileName="")) returned 1
	[0165.673] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.673] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1069", cAlternateFileName="")) returned 1
	[0165.673] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.673] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1081", cAlternateFileName="")) returned 1
	[0165.673] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.673] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1086", cAlternateFileName="")) returned 1
	[0165.674] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.674] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1087", cAlternateFileName="")) returned 1
	[0165.674] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.674] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1110", cAlternateFileName="")) returned 1
	[0165.674] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.674] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1
	[0165.684] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.685] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2070", cAlternateFileName="")) returned 1
	[0165.685] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.685] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2074", cAlternateFileName="")) returned 1
	[0165.685] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.685] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1
	[0165.686] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.686] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 1
	[0165.686] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0165.686] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 0
	[0165.686] FindClose (in: hFindFile=0x3e707f0 | out: hFindFile=0x3e707f0) returned 1
	[0165.686] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.686] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0165.688] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.688] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0165.691] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.691] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0165.693] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.693] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0165.695] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.695] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0165.697] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.697] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1
	[0165.699] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.699] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0165.702] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.702] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0165.704] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.704] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0165.706] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.706] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0165.708] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0165.709] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f913, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracedefinition110.xml", cAlternateFileName="TRACED~1.XML")) returned 1
	[0166.085] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.085] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0166.144] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.144] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1
	[0166.410] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.410] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1
	[0166.465] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.465] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0
	[0166.465] FindClose (in: hFindFile=0x3e705b0 | out: hFindFile=0x3e705b0) returned 1
	[0166.465] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0166.465] FindNextFileW (in: hFindFile=0x3e704f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c5a96a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d4a250, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x163c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1
	[0166.466] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0166.466] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b680, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AdeModule.dll", cAlternateFileName="ADEMOD~1.DLL")) returned 1
	[0166.690] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0166.691] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 1
	[0166.956] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.956] FindNextFileW (in: hFindFile=0x3e705f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 0
	[0166.956] FindClose (in: hFindFile=0x3e705f0 | out: hFindFile=0x3e705f0) returned 1
	[0166.956] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0166.956] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1
	[0166.958] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0166.958] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cf4318, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf7e60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1
	[0166.960] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0166.960] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c80c48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c80c48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca4703d4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ee58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1
	[0166.963] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.963] FindNextFileW (in: hFindFile=0x3e702f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b60d2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6b60d2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b60d2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x90e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1
	[0166.964] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0166.964] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="cpprest140_2_6.dll", cAlternateFileName="CPPRES~1.DLL")) returned 1
	[0166.967] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.967] FindNextFileW (in: hFindFile=0x3e707f0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0
	[0166.967] FindClose (in: hFindFile=0x3e707f0 | out: hFindFile=0x3e707f0) returned 1
	[0166.967] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.967] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0166.967] FindClose (in: hFindFile=0x3e703b0 | out: hFindFile=0x3e703b0) returned 1
	[0166.967] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0166.967] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4d40834, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x17dec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1
	[0166.973] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.973] FindNextFileW (in: hFindFile=0x3e70670, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0166.973] FindClose (in: hFindFile=0x3e70670 | out: hFindFile=0x3e70670) returned 1
	[0166.973] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0166.973] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4dd9107, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x15f450, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1
	[0166.974] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.974] FindNextFileW (in: hFindFile=0x3e70370, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1
	[0166.975] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.975] FindNextFileW (in: hFindFile=0x3e70370, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 1
	[0166.976] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.976] FindNextFileW (in: hFindFile=0x3e70370, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 0
	[0166.976] FindClose (in: hFindFile=0x3e70370 | out: hFindFile=0x3e70370) returned 1
	[0166.976] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.976] FindNextFileW (in: hFindFile=0x3e704f0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1
	[0166.977] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0166.977] FindNextFileW (in: hFindFile=0x3e701b0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0
	[0166.978] FindClose (in: hFindFile=0x3e701b0 | out: hFindFile=0x3e701b0) returned 1
	[0166.978] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0166.978] FindNextFileW (in: hFindFile=0x3e704f0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0
	[0166.978] FindClose (in: hFindFile=0x3e704f0 | out: hFindFile=0x3e704f0) returned 1
	[0166.978] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0166.978] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sounds", cAlternateFileName="")) returned 1
	[0166.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds") returned 61
	[0166.978] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds") returned 1
	[0166.978] lstrlenW (lpString="Sounds") returned 6
	[0166.978] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Sounds") returned -1
	[0166.978] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x451cfe8
	[0166.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds") returned 61
	[0166.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\*", lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e705b0
	[0166.979] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.979] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18a3b641, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197321ed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197321ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="People", cAlternateFileName="")) returned 1
	[0166.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People") returned 68
	[0166.979] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People") returned 1
	[0166.979] lstrlenW (lpString="People") returned 6
	[0166.979] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="People") returned -1
	[0166.979] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x45ae9e8
	[0166.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People") returned 68
	[0166.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\*", lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18a3b641, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197321ed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197321ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e702f0
	[0166.980] FindNextFileW (in: hFindFile=0x3e702f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18a3b641, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197321ed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197321ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0166.980] FindNextFileW (in: hFindFile=0x3e702f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18aadbcf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18aadbcf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6bd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COUGH.WAV", cAlternateFileName="")) returned 1
	[0166.980] lstrlenW (lpString="COUGH.WAV") returned 9
	[0166.980] lstrlenW (lpString=".1cd") returned 4
	[0166.980] lstrcmpiW (lpString1=".1cd", lpString2=".WAV") returned -1
	[0166.980] lstrlenW (lpString=".3ds") returned 4
	[0166.980] lstrcmpiW (lpString1=".3ds", lpString2=".WAV") returned -1
	[0166.980] lstrlenW (lpString=".3fr") returned 4
	[0166.980] lstrcmpiW (lpString1=".3fr", lpString2=".WAV") returned -1
	[0166.980] lstrlenW (lpString=".3g2") returned 4
	[0166.980] lstrcmpiW (lpString1=".3g2", lpString2=".WAV") returned -1
	[0166.980] lstrlenW (lpString=".3gp") returned 4
	[0166.980] lstrcmpiW (lpString1=".3gp", lpString2=".WAV") returned -1
	[0166.981] lstrlenW (lpString=".7z") returned 3
	[0166.981] lstrcmpiW (lpString1=".7z", lpString2="WAV") returned -1
	[0166.981] lstrlenW (lpString=".accda") returned 6
	[0166.981] lstrcmpiW (lpString1=".accda", lpString2="GH.WAV") returned -1
	[0166.981] lstrlenW (lpString=".accdb") returned 6
	[0166.981] lstrcmpiW (lpString1=".accdb", lpString2="GH.WAV") returned -1
	[0166.981] lstrlenW (lpString=".accdc") returned 6
	[0166.981] lstrcmpiW (lpString1=".accdc", lpString2="GH.WAV") returned -1
	[0166.981] lstrlenW (lpString=".accde") returned 6
	[0166.981] lstrcmpiW (lpString1=".accde", lpString2="GH.WAV") returned -1
	[0166.981] lstrlenW (lpString=".accdt") returned 6
	[0166.981] lstrcmpiW (lpString1=".accdt", lpString2="GH.WAV") returned -1
	[0166.981] lstrlenW (lpString=".accdw") returned 6
	[0166.981] lstrcmpiW (lpString1=".accdw", lpString2="GH.WAV") returned -1
	[0166.981] lstrlenW (lpString=".adb") returned 4
	[0166.981] lstrcmpiW (lpString1=".adb", lpString2=".WAV") returned -1
	[0166.981] lstrlenW (lpString=".adp") returned 4
	[0166.981] lstrcmpiW (lpString1=".adp", lpString2=".WAV") returned -1
	[0166.981] lstrlenW (lpString=".ai") returned 3
	[0166.981] lstrcmpiW (lpString1=".ai", lpString2="WAV") returned -1
	[0166.981] lstrlenW (lpString=".ai3") returned 4
	[0166.981] lstrcmpiW (lpString1=".ai3", lpString2=".WAV") returned -1
	[0166.981] lstrlenW (lpString=".ai4") returned 4
	[0166.981] lstrcmpiW (lpString1=".ai4", lpString2=".WAV") returned -1
	[0166.982] lstrlenW (lpString=".ai5") returned 4
	[0166.982] lstrcmpiW (lpString1=".ai5", lpString2=".WAV") returned -1
	[0166.982] lstrlenW (lpString=".ai6") returned 4
	[0166.982] lstrcmpiW (lpString1=".ai6", lpString2=".WAV") returned -1
	[0166.982] lstrlenW (lpString=".ai7") returned 4
	[0166.982] lstrcmpiW (lpString1=".ai7", lpString2=".WAV") returned -1
	[0166.982] lstrlenW (lpString=".ai8") returned 4
	[0166.982] lstrcmpiW (lpString1=".ai8", lpString2=".WAV") returned -1
	[0166.982] lstrlenW (lpString=".anim") returned 5
	[0166.982] lstrcmpiW (lpString1=".anim", lpString2="H.WAV") returned -1
	[0166.982] lstrlenW (lpString=".arw") returned 4
	[0166.982] lstrcmpiW (lpString1=".arw", lpString2=".WAV") returned -1
	[0166.982] lstrlenW (lpString=".as") returned 3
	[0166.982] lstrcmpiW (lpString1=".as", lpString2="WAV") returned -1
	[0166.982] lstrlenW (lpString=".asa") returned 4
	[0166.982] lstrcmpiW (lpString1=".asa", lpString2=".WAV") returned -1
	[0166.982] lstrlenW (lpString=".asc") returned 4
	[0166.982] lstrcmpiW (lpString1=".asc", lpString2=".WAV") returned -1
	[0166.982] lstrlenW (lpString=".ascx") returned 5
	[0166.982] lstrcmpiW (lpString1=".ascx", lpString2="H.WAV") returned -1
	[0166.982] lstrlenW (lpString=".asm") returned 4
	[0166.982] lstrcmpiW (lpString1=".asm", lpString2=".WAV") returned -1
	[0166.982] lstrlenW (lpString=".asmx") returned 5
	[0166.982] lstrcmpiW (lpString1=".asmx", lpString2="H.WAV") returned -1
	[0166.982] lstrlenW (lpString=".asp") returned 4
	[0166.982] lstrcmpiW (lpString1=".asp", lpString2=".WAV") returned -1
	[0166.982] lstrlenW (lpString=".aspx") returned 5
	[0166.982] lstrcmpiW (lpString1=".aspx", lpString2="H.WAV") returned -1
	[0166.982] lstrlenW (lpString=".asr") returned 4
	[0166.983] lstrcmpiW (lpString1=".asr", lpString2=".WAV") returned -1
	[0166.983] lstrlenW (lpString=".asx") returned 4
	[0166.983] lstrcmpiW (lpString1=".asx", lpString2=".WAV") returned -1
	[0166.983] lstrlenW (lpString=".avi") returned 4
	[0166.983] lstrcmpiW (lpString1=".avi", lpString2=".WAV") returned -1
	[0166.983] lstrlenW (lpString=".avs") returned 4
	[0166.983] lstrcmpiW (lpString1=".avs", lpString2=".WAV") returned -1
	[0166.983] lstrlenW (lpString=".backup") returned 7
	[0166.983] lstrcmpiW (lpString1=".backup", lpString2="UGH.WAV") returned -1
	[0166.983] lstrlenW (lpString=".bak") returned 4
	[0166.983] lstrcmpiW (lpString1=".bak", lpString2=".WAV") returned -1
	[0166.983] lstrlenW (lpString=".bay") returned 4
	[0166.983] lstrcmpiW (lpString1=".bay", lpString2=".WAV") returned -1
	[0166.983] lstrlenW (lpString=".bd") returned 3
	[0166.983] lstrcmpiW (lpString1=".bd", lpString2="WAV") returned -1
	[0166.983] lstrlenW (lpString=".bin") returned 4
	[0166.983] lstrcmpiW (lpString1=".bin", lpString2=".WAV") returned -1
	[0166.983] lstrlenW (lpString=".bmp") returned 4
	[0166.983] lstrcmpiW (lpString1=".bmp", lpString2=".WAV") returned -1
	[0166.983] lstrlenW (lpString=".bz2") returned 4
	[0166.983] lstrcmpiW (lpString1=".bz2", lpString2=".WAV") returned -1
	[0166.983] lstrlenW (lpString=".c") returned 2
	[0166.983] lstrcmpiW (lpString1=".c", lpString2="AV") returned -1
	[0166.983] lstrlenW (lpString=".cdr") returned 4
	[0166.983] lstrcmpiW (lpString1=".cdr", lpString2=".WAV") returned -1
	[0166.984] lstrlenW (lpString=".cer") returned 4
	[0166.984] lstrcmpiW (lpString1=".cer", lpString2=".WAV") returned -1
	[0166.984] lstrlenW (lpString=".cf") returned 3
	[0166.984] lstrcmpiW (lpString1=".cf", lpString2="WAV") returned -1
	[0166.984] lstrlenW (lpString=".cfc") returned 4
	[0166.984] lstrcmpiW (lpString1=".cfc", lpString2=".WAV") returned -1
	[0166.984] lstrlenW (lpString=".cfm") returned 4
	[0166.984] lstrcmpiW (lpString1=".cfm", lpString2=".WAV") returned -1
	[0166.984] lstrlenW (lpString=".cfml") returned 5
	[0166.984] lstrcmpiW (lpString1=".cfml", lpString2="H.WAV") returned -1
	[0166.984] lstrlenW (lpString=".cfu") returned 4
	[0166.984] lstrcmpiW (lpString1=".cfu", lpString2=".WAV") returned -1
	[0166.984] lstrlenW (lpString=".chm") returned 4
	[0166.984] lstrcmpiW (lpString1=".chm", lpString2=".WAV") returned -1
	[0166.984] lstrlenW (lpString=".cin") returned 4
	[0166.984] lstrcmpiW (lpString1=".cin", lpString2=".WAV") returned -1
	[0166.984] lstrlenW (lpString=".class") returned 6
	[0166.984] lstrcmpiW (lpString1=".class", lpString2="GH.WAV") returned -1
	[0166.984] lstrlenW (lpString=".clx") returned 4
	[0166.984] lstrcmpiW (lpString1=".clx", lpString2=".WAV") returned -1
	[0166.984] lstrlenW (lpString=".config") returned 7
	[0166.984] lstrcmpiW (lpString1=".config", lpString2="UGH.WAV") returned -1
	[0166.984] lstrlenW (lpString=".cpp") returned 4
	[0166.984] lstrcmpiW (lpString1=".cpp", lpString2=".WAV") returned -1
	[0166.984] lstrlenW (lpString=".cr2") returned 4
	[0166.984] lstrcmpiW (lpString1=".cr2", lpString2=".WAV") returned -1
	[0166.984] lstrlenW (lpString=".crt") returned 4
	[0166.985] lstrcmpiW (lpString1=".crt", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".crw") returned 4
	[0166.985] lstrcmpiW (lpString1=".crw", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".cs") returned 3
	[0166.985] lstrcmpiW (lpString1=".cs", lpString2="WAV") returned -1
	[0166.985] lstrlenW (lpString=".css") returned 4
	[0166.985] lstrcmpiW (lpString1=".css", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".csv") returned 4
	[0166.985] lstrcmpiW (lpString1=".csv", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".cub") returned 4
	[0166.985] lstrcmpiW (lpString1=".cub", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".dae") returned 4
	[0166.985] lstrcmpiW (lpString1=".dae", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".dat") returned 4
	[0166.985] lstrcmpiW (lpString1=".dat", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".db") returned 3
	[0166.985] lstrcmpiW (lpString1=".db", lpString2="WAV") returned -1
	[0166.985] lstrlenW (lpString=".dbf") returned 4
	[0166.985] lstrcmpiW (lpString1=".dbf", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".dbx") returned 4
	[0166.985] lstrcmpiW (lpString1=".dbx", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".dc3") returned 4
	[0166.985] lstrcmpiW (lpString1=".dc3", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".dcm") returned 4
	[0166.985] lstrcmpiW (lpString1=".dcm", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".dcr") returned 4
	[0166.985] lstrcmpiW (lpString1=".dcr", lpString2=".WAV") returned -1
	[0166.985] lstrlenW (lpString=".der") returned 4
	[0166.985] lstrcmpiW (lpString1=".der", lpString2=".WAV") returned -1
	[0166.986] lstrlenW (lpString=".dib") returned 4
	[0166.986] lstrcmpiW (lpString1=".dib", lpString2=".WAV") returned -1
	[0166.986] lstrlenW (lpString=".dic") returned 4
	[0166.986] lstrcmpiW (lpString1=".dic", lpString2=".WAV") returned -1
	[0166.986] lstrlenW (lpString=".dif") returned 4
	[0166.986] lstrcmpiW (lpString1=".dif", lpString2=".WAV") returned -1
	[0166.986] lstrlenW (lpString=".divx") returned 5
	[0166.986] lstrcmpiW (lpString1=".divx", lpString2="H.WAV") returned -1
	[0166.986] lstrlenW (lpString=".djvu") returned 5
	[0166.986] lstrcmpiW (lpString1=".djvu", lpString2="H.WAV") returned -1
	[0166.986] lstrlenW (lpString=".dng") returned 4
	[0166.986] lstrcmpiW (lpString1=".dng", lpString2=".WAV") returned -1
	[0166.986] lstrlenW (lpString=".doc") returned 4
	[0166.986] lstrcmpiW (lpString1=".doc", lpString2=".WAV") returned -1
	[0166.986] lstrlenW (lpString=".docm") returned 5
	[0166.986] lstrcmpiW (lpString1=".docm", lpString2="H.WAV") returned -1
	[0166.986] lstrlenW (lpString=".docx") returned 5
	[0166.986] lstrcmpiW (lpString1=".docx", lpString2="H.WAV") returned -1
	[0166.986] lstrlenW (lpString=".dot") returned 4
	[0166.986] lstrcmpiW (lpString1=".dot", lpString2=".WAV") returned -1
	[0166.986] lstrlenW (lpString=".dotm") returned 5
	[0166.986] lstrcmpiW (lpString1=".dotm", lpString2="H.WAV") returned -1
	[0166.986] lstrlenW (lpString=".dotx") returned 5
	[0166.986] lstrcmpiW (lpString1=".dotx", lpString2="H.WAV") returned -1
	[0166.986] lstrlenW (lpString=".dpx") returned 4
	[0166.986] lstrcmpiW (lpString1=".dpx", lpString2=".WAV") returned -1
	[0166.986] lstrlenW (lpString=".dqy") returned 4
	[0166.986] lstrcmpiW (lpString1=".dqy", lpString2=".WAV") returned -1
	[0166.986] lstrlenW (lpString=".dsn") returned 4
	[0166.987] lstrcmpiW (lpString1=".dsn", lpString2=".WAV") returned -1
	[0166.987] lstrlenW (lpString=".dt") returned 3
	[0166.987] lstrcmpiW (lpString1=".dt", lpString2="WAV") returned -1
	[0166.987] lstrlenW (lpString=".dtd") returned 4
	[0166.987] lstrcmpiW (lpString1=".dtd", lpString2=".WAV") returned -1
	[0166.987] lstrlenW (lpString=".dwg") returned 4
	[0166.987] lstrcmpiW (lpString1=".dwg", lpString2=".WAV") returned -1
	[0166.987] lstrlenW (lpString=".dwt") returned 4
	[0166.987] lstrcmpiW (lpString1=".dwt", lpString2=".WAV") returned -1
	[0166.987] lstrlenW (lpString=".dx") returned 3
	[0166.987] lstrcmpiW (lpString1=".dx", lpString2="WAV") returned -1
	[0166.987] lstrlenW (lpString=".dxf") returned 4
	[0166.987] lstrcmpiW (lpString1=".dxf", lpString2=".WAV") returned -1
	[0166.987] lstrlenW (lpString=".edml") returned 5
	[0166.987] lstrcmpiW (lpString1=".edml", lpString2="H.WAV") returned -1
	[0166.987] lstrlenW (lpString=".efd") returned 4
	[0166.987] lstrcmpiW (lpString1=".efd", lpString2=".WAV") returned -1
	[0166.987] lstrlenW (lpString=".elf") returned 4
	[0166.987] lstrcmpiW (lpString1=".elf", lpString2=".WAV") returned -1
	[0166.987] lstrlenW (lpString=".emf") returned 4
	[0166.987] lstrcmpiW (lpString1=".emf", lpString2=".WAV") returned -1
	[0166.987] lstrlenW (lpString=".emz") returned 4
	[0166.987] lstrcmpiW (lpString1=".emz", lpString2=".WAV") returned -1
	[0166.987] lstrlenW (lpString=".epf") returned 4
	[0166.987] lstrcmpiW (lpString1=".epf", lpString2=".WAV") returned -1
	[0166.987] lstrlenW (lpString=".eps") returned 4
	[0166.987] lstrcmpiW (lpString1=".eps", lpString2=".WAV") returned -1
	[0166.988] lstrlenW (lpString=".epsf") returned 5
	[0166.988] lstrcmpiW (lpString1=".epsf", lpString2="H.WAV") returned -1
	[0166.988] lstrlenW (lpString=".epsp") returned 5
	[0166.988] lstrcmpiW (lpString1=".epsp", lpString2="H.WAV") returned -1
	[0166.988] lstrlenW (lpString=".erf") returned 4
	[0166.988] lstrcmpiW (lpString1=".erf", lpString2=".WAV") returned -1
	[0166.988] lstrlenW (lpString=".exr") returned 4
	[0166.988] lstrcmpiW (lpString1=".exr", lpString2=".WAV") returned -1
	[0166.988] lstrlenW (lpString=".f4v") returned 4
	[0166.988] lstrcmpiW (lpString1=".f4v", lpString2=".WAV") returned -1
	[0166.988] lstrlenW (lpString=".fido") returned 5
	[0166.988] lstrcmpiW (lpString1=".fido", lpString2="H.WAV") returned -1
	[0166.988] lstrlenW (lpString=".flm") returned 4
	[0166.988] lstrcmpiW (lpString1=".flm", lpString2=".WAV") returned -1
	[0166.988] lstrlenW (lpString=".flv") returned 4
	[0166.988] lstrcmpiW (lpString1=".flv", lpString2=".WAV") returned -1
	[0166.988] lstrlenW (lpString=".frm") returned 4
	[0166.988] lstrcmpiW (lpString1=".frm", lpString2=".WAV") returned -1
	[0166.988] lstrlenW (lpString=".fxg") returned 4
	[0166.988] lstrcmpiW (lpString1=".fxg", lpString2=".WAV") returned -1
	[0166.988] lstrlenW (lpString=".geo") returned 4
	[0166.988] lstrcmpiW (lpString1=".geo", lpString2=".WAV") returned -1
	[0166.988] lstrlenW (lpString=".gif") returned 4
	[0166.988] lstrcmpiW (lpString1=".gif", lpString2=".WAV") returned -1
	[0166.988] lstrlenW (lpString=".grs") returned 4
	[0166.988] lstrcmpiW (lpString1=".grs", lpString2=".WAV") returned -1
	[0166.988] lstrlenW (lpString=".gz") returned 3
	[0166.988] lstrcmpiW (lpString1=".gz", lpString2="WAV") returned -1
	[0166.988] lstrlenW (lpString=".h") returned 2
	[0166.989] lstrcmpiW (lpString1=".h", lpString2="AV") returned -1
	[0166.989] lstrlenW (lpString=".hdr") returned 4
	[0166.989] lstrcmpiW (lpString1=".hdr", lpString2=".WAV") returned -1
	[0166.989] lstrlenW (lpString=".hpp") returned 4
	[0166.989] lstrcmpiW (lpString1=".hpp", lpString2=".WAV") returned -1
	[0166.989] lstrlenW (lpString=".hta") returned 4
	[0166.989] lstrcmpiW (lpString1=".hta", lpString2=".WAV") returned -1
	[0166.989] lstrlenW (lpString=".htc") returned 4
	[0166.989] lstrcmpiW (lpString1=".htc", lpString2=".WAV") returned -1
	[0166.989] lstrlenW (lpString=".htm") returned 4
	[0166.989] lstrcmpiW (lpString1=".htm", lpString2=".WAV") returned -1
	[0166.989] lstrlenW (lpString=".html") returned 5
	[0166.989] lstrcmpiW (lpString1=".html", lpString2="H.WAV") returned -1
	[0166.989] lstrlenW (lpString=".icb") returned 4
	[0166.989] lstrcmpiW (lpString1=".icb", lpString2=".WAV") returned -1
	[0166.989] lstrlenW (lpString=".ics") returned 4
	[0166.989] lstrcmpiW (lpString1=".ics", lpString2=".WAV") returned -1
	[0166.989] lstrlenW (lpString=".iff") returned 4
	[0166.989] lstrcmpiW (lpString1=".iff", lpString2=".WAV") returned -1
	[0166.989] lstrlenW (lpString=".inc") returned 4
	[0166.989] lstrcmpiW (lpString1=".inc", lpString2=".WAV") returned -1
	[0166.989] lstrlenW (lpString=".indd") returned 5
	[0166.989] lstrcmpiW (lpString1=".indd", lpString2="H.WAV") returned -1
	[0166.989] lstrlenW (lpString=".ini") returned 4
	[0166.989] lstrcmpiW (lpString1=".ini", lpString2=".WAV") returned -1
	[0166.989] lstrlenW (lpString=".iqy") returned 4
	[0166.989] lstrcmpiW (lpString1=".iqy", lpString2=".WAV") returned -1
	[0166.989] lstrlenW (lpString=".j2c") returned 4
	[0166.989] lstrcmpiW (lpString1=".j2c", lpString2=".WAV") returned -1
	[0166.990] lstrlenW (lpString=".j2k") returned 4
	[0166.990] lstrcmpiW (lpString1=".j2k", lpString2=".WAV") returned -1
	[0166.990] lstrlenW (lpString=".java") returned 5
	[0167.253] lstrcmpiW (lpString1=".java", lpString2="H.WAV") returned -1
	[0167.253] lstrlenW (lpString=".jp2") returned 4
	[0167.253] lstrcmpiW (lpString1=".jp2", lpString2=".WAV") returned -1
	[0167.253] lstrlenW (lpString=".jpc") returned 4
	[0167.253] lstrcmpiW (lpString1=".jpc", lpString2=".WAV") returned -1
	[0167.253] lstrlenW (lpString=".jpe") returned 4
	[0167.253] lstrcmpiW (lpString1=".jpe", lpString2=".WAV") returned -1
	[0167.253] lstrlenW (lpString=".jpeg") returned 5
	[0167.253] lstrcmpiW (lpString1=".jpeg", lpString2="H.WAV") returned -1
	[0167.253] lstrlenW (lpString=".jpf") returned 4
	[0167.253] lstrcmpiW (lpString1=".jpf", lpString2=".WAV") returned -1
	[0167.253] lstrlenW (lpString=".jpg") returned 4
	[0167.253] lstrcmpiW (lpString1=".jpg", lpString2=".WAV") returned -1
	[0167.253] lstrlenW (lpString=".jpx") returned 4
	[0167.253] lstrcmpiW (lpString1=".jpx", lpString2=".WAV") returned -1
	[0167.253] lstrlenW (lpString=".js") returned 3
	[0167.253] lstrcmpiW (lpString1=".js", lpString2="WAV") returned -1
	[0167.253] lstrlenW (lpString=".jsf") returned 4
	[0167.254] lstrcmpiW (lpString1=".jsf", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".json") returned 5
	[0167.254] lstrcmpiW (lpString1=".json", lpString2="H.WAV") returned -1
	[0167.254] lstrlenW (lpString=".jsp") returned 4
	[0167.254] lstrcmpiW (lpString1=".jsp", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".kdc") returned 4
	[0167.254] lstrcmpiW (lpString1=".kdc", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".kmz") returned 4
	[0167.254] lstrcmpiW (lpString1=".kmz", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".kwm") returned 4
	[0167.254] lstrcmpiW (lpString1=".kwm", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".lasso") returned 6
	[0167.254] lstrcmpiW (lpString1=".lasso", lpString2="GH.WAV") returned -1
	[0167.254] lstrlenW (lpString=".lbi") returned 4
	[0167.254] lstrcmpiW (lpString1=".lbi", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".lgf") returned 4
	[0167.254] lstrcmpiW (lpString1=".lgf", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".lgp") returned 4
	[0167.254] lstrcmpiW (lpString1=".lgp", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".log") returned 4
	[0167.254] lstrcmpiW (lpString1=".log", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".m1v") returned 4
	[0167.254] lstrcmpiW (lpString1=".m1v", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".m4a") returned 4
	[0167.254] lstrcmpiW (lpString1=".m4a", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".m4v") returned 4
	[0167.254] lstrcmpiW (lpString1=".m4v", lpString2=".WAV") returned -1
	[0167.254] lstrlenW (lpString=".max") returned 4
	[0167.255] lstrcmpiW (lpString1=".max", lpString2=".WAV") returned -1
	[0167.255] lstrlenW (lpString=".md") returned 3
	[0167.255] lstrcmpiW (lpString1=".md", lpString2="WAV") returned -1
	[0167.255] lstrlenW (lpString=".mda") returned 4
	[0167.255] lstrcmpiW (lpString1=".mda", lpString2=".WAV") returned -1
	[0167.255] lstrlenW (lpString=".mdb") returned 4
	[0167.255] lstrcmpiW (lpString1=".mdb", lpString2=".WAV") returned -1
	[0167.255] lstrlenW (lpString=".mde") returned 4
	[0167.255] lstrcmpiW (lpString1=".mde", lpString2=".WAV") returned -1
	[0167.255] lstrlenW (lpString=".mdf") returned 4
	[0167.255] lstrcmpiW (lpString1=".mdf", lpString2=".WAV") returned -1
	[0167.255] lstrlenW (lpString=".mdw") returned 4
	[0167.255] lstrcmpiW (lpString1=".mdw", lpString2=".WAV") returned -1
	[0167.255] lstrlenW (lpString=".mef") returned 4
	[0167.255] lstrcmpiW (lpString1=".mef", lpString2=".WAV") returned -1
	[0167.255] lstrlenW (lpString=".mft") returned 4
	[0167.255] lstrcmpiW (lpString1=".mft", lpString2=".WAV") returned -1
	[0167.255] lstrlenW (lpString=".mfw") returned 4
	[0167.255] lstrcmpiW (lpString1=".mfw", lpString2=".WAV") returned -1
	[0167.255] lstrlenW (lpString=".mht") returned 4
	[0167.255] lstrcmpiW (lpString1=".mht", lpString2=".WAV") returned -1
	[0167.255] lstrlenW (lpString=".mhtml") returned 6
	[0167.255] lstrcmpiW (lpString1=".mhtml", lpString2="GH.WAV") returned -1
	[0167.255] lstrlenW (lpString=".mka") returned 4
	[0167.255] lstrcmpiW (lpString1=".mka", lpString2=".WAV") returned -1
	[0167.255] lstrlenW (lpString=".mkidx") returned 6
	[0167.255] lstrcmpiW (lpString1=".mkidx", lpString2="GH.WAV") returned -1
	[0167.255] lstrlenW (lpString=".mkv") returned 4
	[0167.256] lstrcmpiW (lpString1=".mkv", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".mos") returned 4
	[0167.256] lstrcmpiW (lpString1=".mos", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".mov") returned 4
	[0167.256] lstrcmpiW (lpString1=".mov", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".mp3") returned 4
	[0167.256] lstrcmpiW (lpString1=".mp3", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".mp4") returned 4
	[0167.256] lstrcmpiW (lpString1=".mp4", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".mpeg") returned 5
	[0167.256] lstrcmpiW (lpString1=".mpeg", lpString2="H.WAV") returned -1
	[0167.256] lstrlenW (lpString=".mpg") returned 4
	[0167.256] lstrcmpiW (lpString1=".mpg", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".mpv") returned 4
	[0167.256] lstrcmpiW (lpString1=".mpv", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".mrw") returned 4
	[0167.256] lstrcmpiW (lpString1=".mrw", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".msg") returned 4
	[0167.256] lstrcmpiW (lpString1=".msg", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".mxl") returned 4
	[0167.256] lstrcmpiW (lpString1=".mxl", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".myd") returned 4
	[0167.256] lstrcmpiW (lpString1=".myd", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".myi") returned 4
	[0167.256] lstrcmpiW (lpString1=".myi", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".nef") returned 4
	[0167.256] lstrcmpiW (lpString1=".nef", lpString2=".WAV") returned -1
	[0167.256] lstrlenW (lpString=".nrw") returned 4
	[0167.257] lstrcmpiW (lpString1=".nrw", lpString2=".WAV") returned -1
	[0167.257] lstrlenW (lpString=".obj") returned 4
	[0167.257] lstrcmpiW (lpString1=".obj", lpString2=".WAV") returned -1
	[0167.257] lstrlenW (lpString=".odb") returned 4
	[0167.257] lstrcmpiW (lpString1=".odb", lpString2=".WAV") returned -1
	[0167.257] lstrlenW (lpString=".odc") returned 4
	[0167.257] lstrcmpiW (lpString1=".odc", lpString2=".WAV") returned -1
	[0167.257] lstrlenW (lpString=".odm") returned 4
	[0167.257] lstrcmpiW (lpString1=".odm", lpString2=".WAV") returned -1
	[0167.257] lstrlenW (lpString=".odp") returned 4
	[0167.257] lstrcmpiW (lpString1=".odp", lpString2=".WAV") returned -1
	[0167.257] lstrlenW (lpString=".ods") returned 4
	[0167.257] lstrcmpiW (lpString1=".ods", lpString2=".WAV") returned -1
	[0167.257] lstrlenW (lpString=".oft") returned 4
	[0167.257] lstrcmpiW (lpString1=".oft", lpString2=".WAV") returned -1
	[0167.257] lstrlenW (lpString=".one") returned 4
	[0167.257] lstrcmpiW (lpString1=".one", lpString2=".WAV") returned -1
	[0167.257] lstrlenW (lpString=".onepkg") returned 7
	[0167.257] lstrcmpiW (lpString1=".onepkg", lpString2="UGH.WAV") returned -1
	[0167.257] lstrlenW (lpString=".onetoc2") returned 8
	[0167.257] lstrcmpiW (lpString1=".onetoc2", lpString2="OUGH.WAV") returned -1
	[0167.257] lstrlenW (lpString=".opt") returned 4
	[0167.257] lstrcmpiW (lpString1=".opt", lpString2=".WAV") returned -1
	[0167.257] lstrlenW (lpString=".oqy") returned 4
	[0167.257] lstrcmpiW (lpString1=".oqy", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".orf") returned 4
	[0167.258] lstrcmpiW (lpString1=".orf", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".p12") returned 4
	[0167.258] lstrcmpiW (lpString1=".p12", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".p7b") returned 4
	[0167.258] lstrcmpiW (lpString1=".p7b", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".p7c") returned 4
	[0167.258] lstrcmpiW (lpString1=".p7c", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".pam") returned 4
	[0167.258] lstrcmpiW (lpString1=".pam", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".pbm") returned 4
	[0167.258] lstrcmpiW (lpString1=".pbm", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".pct") returned 4
	[0167.258] lstrcmpiW (lpString1=".pct", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".pcx") returned 4
	[0167.258] lstrcmpiW (lpString1=".pcx", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".pdd") returned 4
	[0167.258] lstrcmpiW (lpString1=".pdd", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".pdf") returned 4
	[0167.258] lstrcmpiW (lpString1=".pdf", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".pdp") returned 4
	[0167.258] lstrcmpiW (lpString1=".pdp", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".pef") returned 4
	[0167.258] lstrcmpiW (lpString1=".pef", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".pem") returned 4
	[0167.258] lstrcmpiW (lpString1=".pem", lpString2=".WAV") returned -1
	[0167.258] lstrlenW (lpString=".pff") returned 4
	[0167.258] lstrcmpiW (lpString1=".pff", lpString2=".WAV") returned -1
	[0167.259] lstrlenW (lpString=".pfm") returned 4
	[0167.259] lstrcmpiW (lpString1=".pfm", lpString2=".WAV") returned -1
	[0167.259] lstrlenW (lpString=".pfx") returned 4
	[0167.259] lstrcmpiW (lpString1=".pfx", lpString2=".WAV") returned -1
	[0167.259] lstrlenW (lpString=".pgm") returned 4
	[0167.259] lstrcmpiW (lpString1=".pgm", lpString2=".WAV") returned -1
	[0167.259] lstrlenW (lpString=".php") returned 4
	[0167.259] lstrcmpiW (lpString1=".php", lpString2=".WAV") returned -1
	[0167.259] lstrlenW (lpString=".php3") returned 5
	[0167.259] lstrcmpiW (lpString1=".php3", lpString2="H.WAV") returned -1
	[0167.259] lstrlenW (lpString=".php4") returned 5
	[0167.259] lstrcmpiW (lpString1=".php4", lpString2="H.WAV") returned -1
	[0167.259] lstrlenW (lpString=".php5") returned 5
	[0167.259] lstrcmpiW (lpString1=".php5", lpString2="H.WAV") returned -1
	[0167.259] lstrlenW (lpString=".phtml") returned 6
	[0167.259] lstrcmpiW (lpString1=".phtml", lpString2="GH.WAV") returned -1
	[0167.259] lstrlenW (lpString=".pict") returned 5
	[0167.259] lstrcmpiW (lpString1=".pict", lpString2="H.WAV") returned -1
	[0167.259] lstrlenW (lpString=".pl") returned 3
	[0167.259] lstrcmpiW (lpString1=".pl", lpString2="WAV") returned -1
	[0167.259] lstrlenW (lpString=".pls") returned 4
	[0167.259] lstrcmpiW (lpString1=".pls", lpString2=".WAV") returned -1
	[0167.259] lstrlenW (lpString=".pm") returned 3
	[0167.259] lstrcmpiW (lpString1=".pm", lpString2="WAV") returned -1
	[0167.259] lstrlenW (lpString=".png") returned 4
	[0167.259] lstrcmpiW (lpString1=".png", lpString2=".WAV") returned -1
	[0167.259] lstrlenW (lpString=".pnm") returned 4
	[0167.260] lstrcmpiW (lpString1=".pnm", lpString2=".WAV") returned -1
	[0167.260] lstrlenW (lpString=".pot") returned 4
	[0167.260] lstrcmpiW (lpString1=".pot", lpString2=".WAV") returned -1
	[0167.260] lstrlenW (lpString=".potm") returned 5
	[0167.260] lstrcmpiW (lpString1=".potm", lpString2="H.WAV") returned -1
	[0167.260] lstrlenW (lpString=".potx") returned 5
	[0167.260] lstrcmpiW (lpString1=".potx", lpString2="H.WAV") returned -1
	[0167.260] lstrlenW (lpString=".ppa") returned 4
	[0167.260] lstrcmpiW (lpString1=".ppa", lpString2=".WAV") returned -1
	[0167.260] lstrlenW (lpString=".ppam") returned 5
	[0167.260] lstrcmpiW (lpString1=".ppam", lpString2="H.WAV") returned -1
	[0167.260] lstrlenW (lpString=".ppm") returned 4
	[0167.260] lstrcmpiW (lpString1=".ppm", lpString2=".WAV") returned -1
	[0167.260] lstrlenW (lpString=".pps") returned 4
	[0167.260] lstrcmpiW (lpString1=".pps", lpString2=".WAV") returned -1
	[0167.260] lstrlenW (lpString=".ppsm") returned 5
	[0167.260] lstrcmpiW (lpString1=".ppsm", lpString2="H.WAV") returned -1
	[0167.260] lstrlenW (lpString=".ppt") returned 4
	[0167.260] lstrcmpiW (lpString1=".ppt", lpString2=".WAV") returned -1
	[0167.260] lstrlenW (lpString=".pptm") returned 5
	[0167.260] lstrcmpiW (lpString1=".pptm", lpString2="H.WAV") returned -1
	[0167.260] lstrlenW (lpString=".pptx") returned 5
	[0167.260] lstrcmpiW (lpString1=".pptx", lpString2="H.WAV") returned -1
	[0167.260] lstrlenW (lpString=".prn") returned 4
	[0167.260] lstrcmpiW (lpString1=".prn", lpString2=".WAV") returned -1
	[0167.260] lstrlenW (lpString=".ps") returned 3
	[0167.260] lstrcmpiW (lpString1=".ps", lpString2="WAV") returned -1
	[0167.260] lstrlenW (lpString=".psb") returned 4
	[0167.260] lstrcmpiW (lpString1=".psb", lpString2=".WAV") returned -1
	[0167.261] lstrlenW (lpString=".psd") returned 4
	[0167.261] lstrcmpiW (lpString1=".psd", lpString2=".WAV") returned -1
	[0167.261] lstrlenW (lpString=".pst") returned 4
	[0167.261] lstrcmpiW (lpString1=".pst", lpString2=".WAV") returned -1
	[0167.261] lstrlenW (lpString=".ptx") returned 4
	[0167.261] lstrcmpiW (lpString1=".ptx", lpString2=".WAV") returned -1
	[0167.261] lstrlenW (lpString=".pub") returned 4
	[0167.261] lstrcmpiW (lpString1=".pub", lpString2=".WAV") returned -1
	[0167.261] lstrlenW (lpString=".pwm") returned 4
	[0167.261] lstrcmpiW (lpString1=".pwm", lpString2=".WAV") returned -1
	[0167.261] lstrlenW (lpString=".pxr") returned 4
	[0167.261] lstrcmpiW (lpString1=".pxr", lpString2=".WAV") returned -1
	[0167.262] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0167.262] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1
	[0167.579] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0167.579] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1
	[0167.581] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0167.581] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0
	[0167.581] FindClose (in: hFindFile=0x3e705b0 | out: hFindFile=0x3e705b0) returned 1
	[0167.581] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0167.581] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolBMPs", cAlternateFileName="")) returned 1
	[0167.583] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0167.583] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolData", cAlternateFileName="")) returned 1
	[0167.586] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0167.586] FindNextFileW (in: hFindFile=0x3e702f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1
	[0167.586] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0167.586] FindNextFileW (in: hFindFile=0x3e702f0, lpFindFileData=0x3bdeb94 | out: lpFindFileData=0x3bdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 0
	[0167.586] FindClose (in: hFindFile=0x3e702f0 | out: hFindFile=0x3e702f0) returned 1
	[0167.586] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0167.586] FindNextFileW (in: hFindFile=0x3e70370, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0
	[0167.586] FindClose (in: hFindFile=0x3e70370 | out: hFindFile=0x3e70370) returned 1
	[0167.586] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0167.586] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1
	[0167.589] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0167.589] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 0
	[0167.589] FindClose (in: hFindFile=0x3e700b0 | out: hFindFile=0x3e700b0) returned 1
	[0167.589] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0167.592] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd36584, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdf403dbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf58154c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf370c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1
	[0167.595] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0167.595] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1
	[0167.595] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0167.595] FindNextFileW (in: hFindFile=0x3e70130, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SOLVER", cAlternateFileName="")) returned 0
	[0167.595] FindClose (in: hFindFile=0x3e70130 | out: hFindFile=0x3e70130) returned 1
	[0167.595] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0167.595] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LogoImages", cAlternateFileName="LOGOIM~1")) returned 1
	[0167.604] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0167.604] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4d0d64, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979a48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="lync.exe", cAlternateFileName="")) returned 1
	[0167.608] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0167.608] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x38b7c4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1
	[0167.610] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0167.611] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1
	[0167.611] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0167.611] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1
	[0167.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ca") returned 56
	[0167.611] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ca") returned 1
	[0167.611] lstrlenW (lpString="ca") returned 2
	[0167.611] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ca") returned -1
	[0167.611] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x451cfe8
	[0167.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ca") returned 56
	[0167.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ca\\*", lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e703f0
	[0168.413] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.413] FindNextFileW (in: hFindFile=0x3e703f0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="msipc.dll.mui", cAlternateFileName="MSIPCD~1.MUI")) returned 1
	[0168.414] lstrlenW (lpString="msipc.dll.mui") returned 13
	[0168.414] lstrlenW (lpString=".1cd") returned 4
	[0168.414] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.414] lstrlenW (lpString=".3ds") returned 4
	[0168.414] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0168.414] lstrlenW (lpString=".3fr") returned 4
	[0168.414] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0168.414] lstrlenW (lpString=".3g2") returned 4
	[0168.414] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0168.414] lstrlenW (lpString=".3gp") returned 4
	[0168.414] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0168.414] lstrlenW (lpString=".7z") returned 3
	[0168.414] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.414] lstrlenW (lpString=".accda") returned 6
	[0168.414] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1
	[0168.414] lstrlenW (lpString=".accdb") returned 6
	[0168.414] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1
	[0168.414] lstrlenW (lpString=".accdc") returned 6
	[0168.414] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1
	[0168.414] lstrlenW (lpString=".accde") returned 6
	[0168.414] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1
	[0168.414] lstrlenW (lpString=".accdt") returned 6
	[0168.414] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1
	[0168.414] lstrlenW (lpString=".accdw") returned 6
	[0168.414] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1
	[0168.414] lstrlenW (lpString=".adb") returned 4
	[0168.414] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0168.415] lstrlenW (lpString=".adp") returned 4
	[0168.415] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0168.415] lstrlenW (lpString=".ai") returned 3
	[0168.415] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0168.415] lstrlenW (lpString=".ai3") returned 4
	[0168.415] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0168.415] lstrlenW (lpString=".ai4") returned 4
	[0168.415] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0168.415] lstrlenW (lpString=".ai5") returned 4
	[0168.415] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0168.415] lstrlenW (lpString=".ai6") returned 4
	[0168.415] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0168.415] lstrlenW (lpString=".ai7") returned 4
	[0168.415] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0168.415] lstrlenW (lpString=".ai8") returned 4
	[0168.415] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0168.415] lstrlenW (lpString=".anim") returned 5
	[0168.415] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1
	[0168.415] lstrlenW (lpString=".arw") returned 4
	[0168.415] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0168.415] lstrlenW (lpString=".as") returned 3
	[0168.415] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0168.415] lstrlenW (lpString=".asa") returned 4
	[0168.415] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0168.415] lstrlenW (lpString=".asc") returned 4
	[0168.415] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0168.415] lstrlenW (lpString=".ascx") returned 5
	[0168.415] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1
	[0168.416] lstrlenW (lpString=".asm") returned 4
	[0168.416] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0168.416] lstrlenW (lpString=".asmx") returned 5
	[0168.416] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1
	[0168.416] lstrlenW (lpString=".asp") returned 4
	[0168.416] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0168.416] lstrlenW (lpString=".aspx") returned 5
	[0168.416] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1
	[0168.416] lstrlenW (lpString=".asr") returned 4
	[0168.416] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0168.416] lstrlenW (lpString=".asx") returned 4
	[0168.416] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0168.416] lstrlenW (lpString=".avi") returned 4
	[0168.416] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0168.416] lstrlenW (lpString=".avs") returned 4
	[0168.416] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0168.416] lstrlenW (lpString=".backup") returned 7
	[0168.416] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1
	[0168.416] lstrlenW (lpString=".bak") returned 4
	[0168.416] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0168.416] lstrlenW (lpString=".bay") returned 4
	[0168.416] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0168.416] lstrlenW (lpString=".bd") returned 3
	[0168.416] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0168.416] lstrlenW (lpString=".bin") returned 4
	[0168.416] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0168.416] lstrlenW (lpString=".bmp") returned 4
	[0168.416] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0168.417] lstrlenW (lpString=".bz2") returned 4
	[0168.417] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.417] lstrlenW (lpString=".c") returned 2
	[0168.417] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0168.417] lstrlenW (lpString=".cdr") returned 4
	[0168.417] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0168.417] lstrlenW (lpString=".cer") returned 4
	[0168.417] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0168.417] lstrlenW (lpString=".cf") returned 3
	[0168.417] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0168.417] lstrlenW (lpString=".cfc") returned 4
	[0168.417] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0168.417] lstrlenW (lpString=".cfm") returned 4
	[0168.417] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0168.417] lstrlenW (lpString=".cfml") returned 5
	[0168.417] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1
	[0168.417] lstrlenW (lpString=".cfu") returned 4
	[0168.417] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0168.417] lstrlenW (lpString=".chm") returned 4
	[0168.417] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0168.417] lstrlenW (lpString=".cin") returned 4
	[0168.417] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0168.417] lstrlenW (lpString=".class") returned 6
	[0168.417] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1
	[0168.417] lstrlenW (lpString=".clx") returned 4
	[0168.417] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0168.417] lstrlenW (lpString=".config") returned 7
	[0168.417] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1
	[0168.417] lstrlenW (lpString=".cpp") returned 4
	[0168.418] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".cr2") returned 4
	[0168.418] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".crt") returned 4
	[0168.418] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".crw") returned 4
	[0168.418] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".cs") returned 3
	[0168.418] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0168.418] lstrlenW (lpString=".css") returned 4
	[0168.418] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".csv") returned 4
	[0168.418] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".cub") returned 4
	[0168.418] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".dae") returned 4
	[0168.418] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".dat") returned 4
	[0168.418] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".db") returned 3
	[0168.418] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0168.418] lstrlenW (lpString=".dbf") returned 4
	[0168.418] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".dbx") returned 4
	[0168.418] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".dc3") returned 4
	[0168.418] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0168.418] lstrlenW (lpString=".dcm") returned 4
	[0168.419] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0168.419] lstrlenW (lpString=".dcr") returned 4
	[0168.419] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0168.419] lstrlenW (lpString=".der") returned 4
	[0168.419] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0168.419] lstrlenW (lpString=".dib") returned 4
	[0168.419] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0168.419] lstrlenW (lpString=".dic") returned 4
	[0168.419] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0168.419] lstrlenW (lpString=".dif") returned 4
	[0168.419] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0168.419] lstrlenW (lpString=".divx") returned 5
	[0168.419] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1
	[0168.419] lstrlenW (lpString=".djvu") returned 5
	[0168.419] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1
	[0168.419] lstrlenW (lpString=".dng") returned 4
	[0168.419] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0168.419] lstrlenW (lpString=".doc") returned 4
	[0168.419] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.419] lstrlenW (lpString=".docm") returned 5
	[0168.419] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1
	[0168.419] lstrlenW (lpString=".docx") returned 5
	[0168.419] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.419] lstrlenW (lpString=".dot") returned 4
	[0168.419] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0168.419] lstrlenW (lpString=".dotm") returned 5
	[0168.419] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1
	[0168.419] lstrlenW (lpString=".dotx") returned 5
	[0168.420] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1
	[0168.420] lstrlenW (lpString=".dpx") returned 4
	[0168.420] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0168.420] lstrlenW (lpString=".dqy") returned 4
	[0168.420] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0168.420] lstrlenW (lpString=".dsn") returned 4
	[0168.420] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0168.420] lstrlenW (lpString=".dt") returned 3
	[0168.420] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0168.420] lstrlenW (lpString=".dtd") returned 4
	[0168.420] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0168.420] lstrlenW (lpString=".dwg") returned 4
	[0168.420] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0168.420] lstrlenW (lpString=".dwt") returned 4
	[0168.420] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0168.420] lstrlenW (lpString=".dx") returned 3
	[0168.420] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0168.420] lstrlenW (lpString=".dxf") returned 4
	[0168.420] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0168.420] lstrlenW (lpString=".edml") returned 5
	[0168.420] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1
	[0168.420] lstrlenW (lpString=".efd") returned 4
	[0168.420] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0168.420] lstrlenW (lpString=".elf") returned 4
	[0168.420] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0168.421] lstrlenW (lpString=".emf") returned 4
	[0168.421] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0168.421] lstrlenW (lpString=".emz") returned 4
	[0168.421] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0168.421] lstrlenW (lpString=".epf") returned 4
	[0168.421] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0168.421] lstrlenW (lpString=".eps") returned 4
	[0168.421] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0168.421] lstrlenW (lpString=".epsf") returned 5
	[0168.421] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1
	[0168.421] lstrlenW (lpString=".epsp") returned 5
	[0168.421] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1
	[0168.421] lstrlenW (lpString=".erf") returned 4
	[0168.421] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0168.421] lstrlenW (lpString=".exr") returned 4
	[0168.421] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0168.421] lstrlenW (lpString=".f4v") returned 4
	[0168.421] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0168.421] lstrlenW (lpString=".fido") returned 5
	[0168.421] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1
	[0168.421] lstrlenW (lpString=".flm") returned 4
	[0168.421] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0168.421] lstrlenW (lpString=".flv") returned 4
	[0168.421] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0168.421] lstrlenW (lpString=".frm") returned 4
	[0168.421] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0168.421] lstrlenW (lpString=".fxg") returned 4
	[0168.421] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0168.422] lstrlenW (lpString=".geo") returned 4
	[0168.422] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0168.422] lstrlenW (lpString=".gif") returned 4
	[0168.422] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0168.422] lstrlenW (lpString=".grs") returned 4
	[0168.422] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0168.422] lstrlenW (lpString=".gz") returned 3
	[0168.422] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0168.422] lstrlenW (lpString=".h") returned 2
	[0168.422] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0168.422] lstrlenW (lpString=".hdr") returned 4
	[0168.422] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0168.422] lstrlenW (lpString=".hpp") returned 4
	[0168.422] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0168.422] lstrlenW (lpString=".hta") returned 4
	[0168.422] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0168.422] lstrlenW (lpString=".htc") returned 4
	[0168.422] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0168.422] lstrlenW (lpString=".htm") returned 4
	[0168.422] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0168.422] lstrlenW (lpString=".html") returned 5
	[0168.422] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1
	[0168.422] lstrlenW (lpString=".icb") returned 4
	[0168.422] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0168.422] lstrlenW (lpString=".ics") returned 4
	[0168.423] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0168.423] lstrlenW (lpString=".iff") returned 4
	[0168.423] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0168.423] lstrlenW (lpString=".inc") returned 4
	[0168.423] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0168.423] lstrlenW (lpString=".indd") returned 5
	[0168.423] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1
	[0168.423] lstrlenW (lpString=".ini") returned 4
	[0168.423] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0168.423] lstrlenW (lpString=".iqy") returned 4
	[0168.423] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0168.423] lstrlenW (lpString=".j2c") returned 4
	[0168.423] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0168.423] lstrlenW (lpString=".j2k") returned 4
	[0168.423] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0168.423] lstrlenW (lpString=".java") returned 5
	[0168.423] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1
	[0168.423] lstrlenW (lpString=".jp2") returned 4
	[0168.423] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0168.423] lstrlenW (lpString=".jpc") returned 4
	[0168.423] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0168.423] lstrlenW (lpString=".jpe") returned 4
	[0168.423] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0168.423] lstrlenW (lpString=".jpeg") returned 5
	[0168.423] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1
	[0168.423] lstrlenW (lpString=".jpf") returned 4
	[0168.423] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0168.423] lstrlenW (lpString=".jpg") returned 4
	[0168.424] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.424] lstrlenW (lpString=".jpx") returned 4
	[0168.424] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0168.424] lstrlenW (lpString=".js") returned 3
	[0168.424] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0168.424] lstrlenW (lpString=".jsf") returned 4
	[0168.424] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0168.424] lstrlenW (lpString=".json") returned 5
	[0168.424] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1
	[0168.424] lstrlenW (lpString=".jsp") returned 4
	[0168.424] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0168.424] lstrlenW (lpString=".kdc") returned 4
	[0168.424] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0168.424] lstrlenW (lpString=".kmz") returned 4
	[0168.424] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0168.424] lstrlenW (lpString=".kwm") returned 4
	[0168.424] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0168.424] lstrlenW (lpString=".lasso") returned 6
	[0168.424] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1
	[0168.424] lstrlenW (lpString=".lbi") returned 4
	[0168.424] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0168.424] lstrlenW (lpString=".lgf") returned 4
	[0168.424] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0168.424] lstrlenW (lpString=".lgp") returned 4
	[0168.424] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0168.424] lstrlenW (lpString=".log") returned 4
	[0168.424] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0168.424] lstrlenW (lpString=".m1v") returned 4
	[0168.425] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".m4a") returned 4
	[0168.425] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".m4v") returned 4
	[0168.425] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".max") returned 4
	[0168.425] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".md") returned 3
	[0168.425] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0168.425] lstrlenW (lpString=".mda") returned 4
	[0168.425] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".mdb") returned 4
	[0168.425] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".mde") returned 4
	[0168.425] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".mdf") returned 4
	[0168.425] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".mdw") returned 4
	[0168.425] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".mef") returned 4
	[0168.425] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".mft") returned 4
	[0168.425] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".mfw") returned 4
	[0168.425] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".mht") returned 4
	[0168.425] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0168.425] lstrlenW (lpString=".mhtml") returned 6
	[0168.425] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1
	[0168.426] lstrlenW (lpString=".mka") returned 4
	[0168.426] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0168.426] lstrlenW (lpString=".mkidx") returned 6
	[0168.426] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1
	[0168.426] lstrlenW (lpString=".mkv") returned 4
	[0168.426] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0168.426] lstrlenW (lpString=".mos") returned 4
	[0168.426] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0168.426] lstrlenW (lpString=".mov") returned 4
	[0168.426] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0168.426] lstrlenW (lpString=".mp3") returned 4
	[0168.426] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0168.426] lstrlenW (lpString=".mp4") returned 4
	[0168.426] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0168.426] lstrlenW (lpString=".mpeg") returned 5
	[0168.426] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1
	[0168.426] lstrlenW (lpString=".mpg") returned 4
	[0168.426] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0168.426] lstrlenW (lpString=".mpv") returned 4
	[0168.426] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0168.426] lstrlenW (lpString=".mrw") returned 4
	[0168.426] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0168.426] lstrlenW (lpString=".msg") returned 4
	[0168.426] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0168.426] lstrlenW (lpString=".mxl") returned 4
	[0168.426] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0168.426] lstrlenW (lpString=".myd") returned 4
	[0168.427] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".myi") returned 4
	[0168.427] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".nef") returned 4
	[0168.427] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".nrw") returned 4
	[0168.427] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".obj") returned 4
	[0168.427] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".odb") returned 4
	[0168.427] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".odc") returned 4
	[0168.427] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".odm") returned 4
	[0168.427] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".odp") returned 4
	[0168.427] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".ods") returned 4
	[0168.427] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".oft") returned 4
	[0168.427] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".one") returned 4
	[0168.427] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0168.427] lstrlenW (lpString=".onepkg") returned 7
	[0168.427] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1
	[0168.427] lstrlenW (lpString=".onetoc2") returned 8
	[0168.427] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1
	[0168.427] lstrlenW (lpString=".opt") returned 4
	[0168.428] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".oqy") returned 4
	[0168.428] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".orf") returned 4
	[0168.428] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".p12") returned 4
	[0168.428] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".p7b") returned 4
	[0168.428] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".p7c") returned 4
	[0168.428] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".pam") returned 4
	[0168.428] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".pbm") returned 4
	[0168.428] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".pct") returned 4
	[0168.428] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".pcx") returned 4
	[0168.428] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".pdd") returned 4
	[0168.428] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".pdf") returned 4
	[0168.428] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".pdp") returned 4
	[0168.428] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".pef") returned 4
	[0168.428] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".pem") returned 4
	[0168.428] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".pff") returned 4
	[0168.428] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0168.428] lstrlenW (lpString=".pfm") returned 4
	[0168.429] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0168.429] lstrlenW (lpString=".pfx") returned 4
	[0168.429] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0168.429] lstrlenW (lpString=".pgm") returned 4
	[0168.429] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0168.429] lstrlenW (lpString=".php") returned 4
	[0168.429] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0168.429] lstrlenW (lpString=".php3") returned 5
	[0168.429] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1
	[0168.429] lstrlenW (lpString=".php4") returned 5
	[0168.429] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1
	[0168.429] lstrlenW (lpString=".php5") returned 5
	[0168.429] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1
	[0168.429] lstrlenW (lpString=".phtml") returned 6
	[0168.429] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1
	[0168.429] lstrlenW (lpString=".pict") returned 5
	[0168.429] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1
	[0168.429] lstrlenW (lpString=".pl") returned 3
	[0168.429] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0168.429] lstrlenW (lpString=".pls") returned 4
	[0168.429] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0168.429] lstrlenW (lpString=".pm") returned 3
	[0168.429] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0168.429] lstrlenW (lpString=".png") returned 4
	[0168.429] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0168.429] lstrlenW (lpString=".pnm") returned 4
	[0168.429] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0168.429] lstrlenW (lpString=".pot") returned 4
	[0168.429] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0168.429] lstrlenW (lpString=".potm") returned 5
	[0168.429] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1
	[0168.430] lstrlenW (lpString=".potx") returned 5
	[0168.430] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1
	[0168.430] lstrlenW (lpString=".ppa") returned 4
	[0168.430] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0168.430] lstrlenW (lpString=".ppam") returned 5
	[0168.430] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1
	[0168.430] lstrlenW (lpString=".ppm") returned 4
	[0168.430] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0168.430] lstrlenW (lpString=".pps") returned 4
	[0168.430] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0168.430] lstrlenW (lpString=".ppsm") returned 5
	[0168.430] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1
	[0168.431] lstrlenW (lpString=".ppt") returned 4
	[0168.431] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.431] lstrlenW (lpString=".pptm") returned 5
	[0168.431] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1
	[0168.431] lstrlenW (lpString=".pptx") returned 5
	[0168.431] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1
	[0168.431] lstrlenW (lpString=".prn") returned 4
	[0168.431] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0168.431] lstrlenW (lpString=".ps") returned 3
	[0168.431] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0168.431] lstrlenW (lpString=".psb") returned 4
	[0168.431] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0168.431] lstrlenW (lpString=".psd") returned 4
	[0168.431] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0168.431] lstrlenW (lpString=".pst") returned 4
	[0168.431] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0168.431] lstrlenW (lpString=".ptx") returned 4
	[0168.431] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0168.431] lstrlenW (lpString=".pub") returned 4
	[0168.431] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0168.431] lstrlenW (lpString=".pwm") returned 4
	[0168.431] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0168.431] lstrlenW (lpString=".pxr") returned 4
	[0168.431] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0168.431] lstrlenW (lpString=".py") returned 3
	[0168.431] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0168.431] lstrlenW (lpString=".qt") returned 3
	[0168.431] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0168.431] lstrlenW (lpString=".r3d") returned 4
	[0168.432] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0168.432] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.432] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1
	[0168.432] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.432] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1
	[0168.433] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.433] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1
	[0168.433] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.433] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el", cAlternateFileName="")) returned 1
	[0168.433] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.433] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1
	[0168.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.434] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1
	[0168.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.434] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1
	[0168.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.434] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1
	[0168.435] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.435] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi", cAlternateFileName="")) returned 1
	[0168.435] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.435] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1
	[0168.435] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.435] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1
	[0168.436] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.436] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1
	[0168.436] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.436] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1
	[0168.436] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.436] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1
	[0168.436] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.436] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1
	[0168.437] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.437] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1
	[0168.437] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.437] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fcc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipcsecproc.dll", cAlternateFileName="IPCSEC~1.DLL")) returned 1
	[0168.437] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.437] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1
	[0168.438] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.438] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1
	[0168.438] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.438] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1
	[0168.438] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.438] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1
	[0168.439] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.439] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1
	[0168.439] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.439] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ms", cAlternateFileName="")) returned 1
	[0168.439] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.439] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b3ce622, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msipc.dll", cAlternateFileName="")) returned 1
	[0168.440] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.440] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1
	[0168.440] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.440] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl", cAlternateFileName="")) returned 1
	[0168.440] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.440] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt", cAlternateFileName="")) returned 1
	[0168.441] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.441] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0168.441] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.441] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1
	[0168.441] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.441] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1
	[0168.441] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.442] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1
	[0168.442] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.442] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1
	[0168.442] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.442] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-BA", cAlternateFileName="SR-CYR~1")) returned 1
	[0168.443] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.443] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-CS", cAlternateFileName="SR-CYR~2")) returned 1
	[0168.443] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.443] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0168.443] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.443] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1
	[0168.444] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.444] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th", cAlternateFileName="")) returned 1
	[0168.444] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.444] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1
	[0168.444] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.444] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1
	[0168.444] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.444] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1
	[0168.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.445] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0168.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.445] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0168.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0168.445] FindNextFileW (in: hFindFile=0x3e701f0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0168.445] FindClose (in: hFindFile=0x3e701f0 | out: hFindFile=0x3e701f0) returned 1
	[0168.446] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0168.446] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b382177, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1
	[0168.446] lstrlenW (lpString="MSO0127.ACL") returned 11
	[0168.446] lstrlenW (lpString=".1cd") returned 4
	[0168.446] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1
	[0168.446] lstrlenW (lpString=".3ds") returned 4
	[0168.446] lstrcmpiW (lpString1=".3ds", lpString2=".ACL") returned -1
	[0168.446] lstrlenW (lpString=".3fr") returned 4
	[0168.446] lstrcmpiW (lpString1=".3fr", lpString2=".ACL") returned -1
	[0168.446] lstrlenW (lpString=".3g2") returned 4
	[0168.446] lstrcmpiW (lpString1=".3g2", lpString2=".ACL") returned -1
	[0168.446] lstrlenW (lpString=".3gp") returned 4
	[0168.446] lstrcmpiW (lpString1=".3gp", lpString2=".ACL") returned -1
	[0168.446] lstrlenW (lpString=".7z") returned 3
	[0168.446] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1
	[0168.446] lstrlenW (lpString=".accda") returned 6
	[0168.446] lstrcmpiW (lpString1=".accda", lpString2="27.ACL") returned -1
	[0168.446] lstrlenW (lpString=".accdb") returned 6
	[0168.446] lstrcmpiW (lpString1=".accdb", lpString2="27.ACL") returned -1
	[0168.446] lstrlenW (lpString=".accdc") returned 6
	[0168.446] lstrcmpiW (lpString1=".accdc", lpString2="27.ACL") returned -1
	[0168.446] lstrlenW (lpString=".accde") returned 6
	[0168.446] lstrcmpiW (lpString1=".accde", lpString2="27.ACL") returned -1
	[0168.446] lstrlenW (lpString=".accdt") returned 6
	[0168.446] lstrcmpiW (lpString1=".accdt", lpString2="27.ACL") returned -1
	[0168.447] lstrlenW (lpString=".accdw") returned 6
	[0168.447] lstrcmpiW (lpString1=".accdw", lpString2="27.ACL") returned -1
	[0168.447] lstrlenW (lpString=".adb") returned 4
	[0168.447] lstrcmpiW (lpString1=".adb", lpString2=".ACL") returned 1
	[0168.447] lstrlenW (lpString=".adp") returned 4
	[0168.447] lstrcmpiW (lpString1=".adp", lpString2=".ACL") returned 1
	[0168.447] lstrlenW (lpString=".ai") returned 3
	[0168.447] lstrcmpiW (lpString1=".ai", lpString2="ACL") returned -1
	[0168.447] lstrlenW (lpString=".ai3") returned 4
	[0168.447] lstrcmpiW (lpString1=".ai3", lpString2=".ACL") returned 1
	[0168.447] lstrlenW (lpString=".ai4") returned 4
	[0168.447] lstrcmpiW (lpString1=".ai4", lpString2=".ACL") returned 1
	[0168.447] lstrlenW (lpString=".ai5") returned 4
	[0168.447] lstrcmpiW (lpString1=".ai5", lpString2=".ACL") returned 1
	[0168.447] lstrlenW (lpString=".ai6") returned 4
	[0168.447] lstrcmpiW (lpString1=".ai6", lpString2=".ACL") returned 1
	[0168.447] lstrlenW (lpString=".ai7") returned 4
	[0168.447] lstrcmpiW (lpString1=".ai7", lpString2=".ACL") returned 1
	[0168.447] lstrlenW (lpString=".ai8") returned 4
	[0168.447] lstrcmpiW (lpString1=".ai8", lpString2=".ACL") returned 1
	[0168.447] lstrlenW (lpString=".anim") returned 5
	[0168.447] lstrcmpiW (lpString1=".anim", lpString2="7.ACL") returned -1
	[0168.447] lstrlenW (lpString=".arw") returned 4
	[0168.447] lstrcmpiW (lpString1=".arw", lpString2=".ACL") returned 1
	[0168.447] lstrlenW (lpString=".as") returned 3
	[0168.447] lstrcmpiW (lpString1=".as", lpString2="ACL") returned -1
	[0168.447] lstrlenW (lpString=".asa") returned 4
	[0168.447] lstrcmpiW (lpString1=".asa", lpString2=".ACL") returned 1
	[0168.448] lstrlenW (lpString=".asc") returned 4
	[0168.448] lstrcmpiW (lpString1=".asc", lpString2=".ACL") returned 1
	[0168.448] lstrlenW (lpString=".ascx") returned 5
	[0168.448] lstrcmpiW (lpString1=".ascx", lpString2="7.ACL") returned -1
	[0168.448] lstrlenW (lpString=".asm") returned 4
	[0168.448] lstrcmpiW (lpString1=".asm", lpString2=".ACL") returned 1
	[0168.448] lstrlenW (lpString=".asmx") returned 5
	[0168.448] lstrcmpiW (lpString1=".asmx", lpString2="7.ACL") returned -1
	[0168.448] lstrlenW (lpString=".asp") returned 4
	[0168.448] lstrcmpiW (lpString1=".asp", lpString2=".ACL") returned 1
	[0168.448] lstrlenW (lpString=".aspx") returned 5
	[0168.448] lstrcmpiW (lpString1=".aspx", lpString2="7.ACL") returned -1
	[0168.541] lstrlenW (lpString=".asr") returned 4
	[0168.541] lstrcmpiW (lpString1=".asr", lpString2=".ACL") returned 1
	[0168.542] lstrlenW (lpString=".asx") returned 4
	[0168.542] lstrcmpiW (lpString1=".asx", lpString2=".ACL") returned 1
	[0168.542] lstrlenW (lpString=".avi") returned 4
	[0168.542] lstrcmpiW (lpString1=".avi", lpString2=".ACL") returned 1
	[0168.542] lstrlenW (lpString=".avs") returned 4
	[0168.542] lstrcmpiW (lpString1=".avs", lpString2=".ACL") returned 1
	[0168.542] lstrlenW (lpString=".backup") returned 7
	[0168.542] lstrcmpiW (lpString1=".backup", lpString2="127.ACL") returned -1
	[0168.542] lstrlenW (lpString=".bak") returned 4
	[0168.542] lstrcmpiW (lpString1=".bak", lpString2=".ACL") returned 1
	[0168.542] lstrlenW (lpString=".bay") returned 4
	[0168.542] lstrcmpiW (lpString1=".bay", lpString2=".ACL") returned 1
	[0168.542] lstrlenW (lpString=".bd") returned 3
	[0168.542] lstrcmpiW (lpString1=".bd", lpString2="ACL") returned -1
	[0168.542] lstrlenW (lpString=".bin") returned 4
	[0168.542] lstrcmpiW (lpString1=".bin", lpString2=".ACL") returned 1
	[0168.542] lstrlenW (lpString=".bmp") returned 4
	[0168.542] lstrcmpiW (lpString1=".bmp", lpString2=".ACL") returned 1
	[0168.542] lstrlenW (lpString=".bz2") returned 4
	[0168.542] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1
	[0168.542] lstrlenW (lpString=".c") returned 2
	[0168.542] lstrcmpiW (lpString1=".c", lpString2="CL") returned -1
	[0168.542] lstrlenW (lpString=".cdr") returned 4
	[0168.543] lstrcmpiW (lpString1=".cdr", lpString2=".ACL") returned 1
	[0168.543] lstrlenW (lpString=".cer") returned 4
	[0168.543] lstrcmpiW (lpString1=".cer", lpString2=".ACL") returned 1
	[0168.543] lstrlenW (lpString=".cf") returned 3
	[0168.543] lstrcmpiW (lpString1=".cf", lpString2="ACL") returned -1
	[0168.543] lstrlenW (lpString=".cfc") returned 4
	[0168.543] lstrcmpiW (lpString1=".cfc", lpString2=".ACL") returned 1
	[0168.543] lstrlenW (lpString=".cfm") returned 4
	[0168.543] lstrcmpiW (lpString1=".cfm", lpString2=".ACL") returned 1
	[0168.543] lstrlenW (lpString=".cfml") returned 5
	[0168.543] lstrcmpiW (lpString1=".cfml", lpString2="7.ACL") returned -1
	[0168.543] lstrlenW (lpString=".cfu") returned 4
	[0168.543] lstrcmpiW (lpString1=".cfu", lpString2=".ACL") returned 1
	[0168.543] lstrlenW (lpString=".chm") returned 4
	[0168.543] lstrcmpiW (lpString1=".chm", lpString2=".ACL") returned 1
	[0168.543] lstrlenW (lpString=".cin") returned 4
	[0168.543] lstrcmpiW (lpString1=".cin", lpString2=".ACL") returned 1
	[0168.543] lstrlenW (lpString=".class") returned 6
	[0168.543] lstrcmpiW (lpString1=".class", lpString2="27.ACL") returned -1
	[0168.543] lstrlenW (lpString=".clx") returned 4
	[0168.543] lstrcmpiW (lpString1=".clx", lpString2=".ACL") returned 1
	[0168.543] lstrlenW (lpString=".config") returned 7
	[0168.543] lstrcmpiW (lpString1=".config", lpString2="127.ACL") returned -1
	[0168.543] lstrlenW (lpString=".cpp") returned 4
	[0168.543] lstrcmpiW (lpString1=".cpp", lpString2=".ACL") returned 1
	[0168.543] lstrlenW (lpString=".cr2") returned 4
	[0168.543] lstrcmpiW (lpString1=".cr2", lpString2=".ACL") returned 1
	[0168.543] lstrlenW (lpString=".crt") returned 4
	[0168.543] lstrcmpiW (lpString1=".crt", lpString2=".ACL") returned 1
	[0168.544] lstrlenW (lpString=".crw") returned 4
	[0168.544] lstrcmpiW (lpString1=".crw", lpString2=".ACL") returned 1
	[0168.544] lstrlenW (lpString=".cs") returned 3
	[0168.544] lstrcmpiW (lpString1=".cs", lpString2="ACL") returned -1
	[0168.544] lstrlenW (lpString=".css") returned 4
	[0168.544] lstrcmpiW (lpString1=".css", lpString2=".ACL") returned 1
	[0168.544] lstrlenW (lpString=".csv") returned 4
	[0168.544] lstrcmpiW (lpString1=".csv", lpString2=".ACL") returned 1
	[0168.544] lstrlenW (lpString=".cub") returned 4
	[0168.544] lstrcmpiW (lpString1=".cub", lpString2=".ACL") returned 1
	[0168.544] lstrlenW (lpString=".dae") returned 4
	[0168.544] lstrcmpiW (lpString1=".dae", lpString2=".ACL") returned 1
	[0168.544] lstrlenW (lpString=".dat") returned 4
	[0168.544] lstrcmpiW (lpString1=".dat", lpString2=".ACL") returned 1
	[0168.544] lstrlenW (lpString=".db") returned 3
	[0168.544] lstrcmpiW (lpString1=".db", lpString2="ACL") returned -1
	[0168.544] lstrlenW (lpString=".dbf") returned 4
	[0168.544] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1
	[0168.544] lstrlenW (lpString=".dbx") returned 4
	[0168.544] lstrcmpiW (lpString1=".dbx", lpString2=".ACL") returned 1
	[0168.544] lstrlenW (lpString=".dc3") returned 4
	[0168.544] lstrcmpiW (lpString1=".dc3", lpString2=".ACL") returned 1
	[0168.544] lstrlenW (lpString=".dcm") returned 4
	[0168.544] lstrcmpiW (lpString1=".dcm", lpString2=".ACL") returned 1
	[0168.544] lstrlenW (lpString=".dcr") returned 4
	[0168.545] lstrcmpiW (lpString1=".dcr", lpString2=".ACL") returned 1
	[0168.545] lstrlenW (lpString=".der") returned 4
	[0168.545] lstrcmpiW (lpString1=".der", lpString2=".ACL") returned 1
	[0168.545] lstrlenW (lpString=".dib") returned 4
	[0168.545] lstrcmpiW (lpString1=".dib", lpString2=".ACL") returned 1
	[0168.545] lstrlenW (lpString=".dic") returned 4
	[0168.545] lstrcmpiW (lpString1=".dic", lpString2=".ACL") returned 1
	[0168.545] lstrlenW (lpString=".dif") returned 4
	[0168.545] lstrcmpiW (lpString1=".dif", lpString2=".ACL") returned 1
	[0168.545] lstrlenW (lpString=".divx") returned 5
	[0168.545] lstrcmpiW (lpString1=".divx", lpString2="7.ACL") returned -1
	[0168.545] lstrlenW (lpString=".djvu") returned 5
	[0168.545] lstrcmpiW (lpString1=".djvu", lpString2="7.ACL") returned -1
	[0168.545] lstrlenW (lpString=".dng") returned 4
	[0168.545] lstrcmpiW (lpString1=".dng", lpString2=".ACL") returned 1
	[0168.545] lstrlenW (lpString=".doc") returned 4
	[0168.545] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1
	[0168.545] lstrlenW (lpString=".docm") returned 5
	[0168.545] lstrcmpiW (lpString1=".docm", lpString2="7.ACL") returned -1
	[0168.545] lstrlenW (lpString=".docx") returned 5
	[0168.545] lstrcmpiW (lpString1=".docx", lpString2="7.ACL") returned -1
	[0168.545] lstrlenW (lpString=".dot") returned 4
	[0168.545] lstrcmpiW (lpString1=".dot", lpString2=".ACL") returned 1
	[0168.545] lstrlenW (lpString=".dotm") returned 5
	[0168.545] lstrcmpiW (lpString1=".dotm", lpString2="7.ACL") returned -1
	[0168.545] lstrlenW (lpString=".dotx") returned 5
	[0168.545] lstrcmpiW (lpString1=".dotx", lpString2="7.ACL") returned -1
	[0168.545] lstrlenW (lpString=".dpx") returned 4
	[0168.545] lstrcmpiW (lpString1=".dpx", lpString2=".ACL") returned 1
	[0168.545] lstrlenW (lpString=".dqy") returned 4
	[0168.545] lstrcmpiW (lpString1=".dqy", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".dsn") returned 4
	[0168.546] lstrcmpiW (lpString1=".dsn", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".dt") returned 3
	[0168.546] lstrcmpiW (lpString1=".dt", lpString2="ACL") returned -1
	[0168.546] lstrlenW (lpString=".dtd") returned 4
	[0168.546] lstrcmpiW (lpString1=".dtd", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".dwg") returned 4
	[0168.546] lstrcmpiW (lpString1=".dwg", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".dwt") returned 4
	[0168.546] lstrcmpiW (lpString1=".dwt", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".dx") returned 3
	[0168.546] lstrcmpiW (lpString1=".dx", lpString2="ACL") returned -1
	[0168.546] lstrlenW (lpString=".dxf") returned 4
	[0168.546] lstrcmpiW (lpString1=".dxf", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".edml") returned 5
	[0168.546] lstrcmpiW (lpString1=".edml", lpString2="7.ACL") returned -1
	[0168.546] lstrlenW (lpString=".efd") returned 4
	[0168.546] lstrcmpiW (lpString1=".efd", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".elf") returned 4
	[0168.546] lstrcmpiW (lpString1=".elf", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".emf") returned 4
	[0168.546] lstrcmpiW (lpString1=".emf", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".emz") returned 4
	[0168.546] lstrcmpiW (lpString1=".emz", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".epf") returned 4
	[0168.546] lstrcmpiW (lpString1=".epf", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".eps") returned 4
	[0168.546] lstrcmpiW (lpString1=".eps", lpString2=".ACL") returned 1
	[0168.546] lstrlenW (lpString=".epsf") returned 5
	[0168.546] lstrcmpiW (lpString1=".epsf", lpString2="7.ACL") returned -1
	[0168.546] lstrlenW (lpString=".epsp") returned 5
	[0168.547] lstrcmpiW (lpString1=".epsp", lpString2="7.ACL") returned -1
	[0168.547] lstrlenW (lpString=".erf") returned 4
	[0168.547] lstrcmpiW (lpString1=".erf", lpString2=".ACL") returned 1
	[0168.547] lstrlenW (lpString=".exr") returned 4
	[0168.547] lstrcmpiW (lpString1=".exr", lpString2=".ACL") returned 1
	[0168.547] lstrlenW (lpString=".f4v") returned 4
	[0168.547] lstrcmpiW (lpString1=".f4v", lpString2=".ACL") returned 1
	[0168.547] lstrlenW (lpString=".fido") returned 5
	[0168.547] lstrcmpiW (lpString1=".fido", lpString2="7.ACL") returned -1
	[0168.547] lstrlenW (lpString=".flm") returned 4
	[0168.547] lstrcmpiW (lpString1=".flm", lpString2=".ACL") returned 1
	[0168.547] lstrlenW (lpString=".flv") returned 4
	[0168.547] lstrcmpiW (lpString1=".flv", lpString2=".ACL") returned 1
	[0168.547] lstrlenW (lpString=".frm") returned 4
	[0168.547] lstrcmpiW (lpString1=".frm", lpString2=".ACL") returned 1
	[0168.547] lstrlenW (lpString=".fxg") returned 4
	[0168.547] lstrcmpiW (lpString1=".fxg", lpString2=".ACL") returned 1
	[0168.547] lstrlenW (lpString=".geo") returned 4
	[0168.547] lstrcmpiW (lpString1=".geo", lpString2=".ACL") returned 1
	[0168.547] lstrlenW (lpString=".gif") returned 4
	[0168.547] lstrcmpiW (lpString1=".gif", lpString2=".ACL") returned 1
	[0168.547] lstrlenW (lpString=".grs") returned 4
	[0168.547] lstrcmpiW (lpString1=".grs", lpString2=".ACL") returned 1
	[0168.547] lstrlenW (lpString=".gz") returned 3
	[0168.547] lstrcmpiW (lpString1=".gz", lpString2="ACL") returned -1
	[0168.547] lstrlenW (lpString=".h") returned 2
	[0168.547] lstrcmpiW (lpString1=".h", lpString2="CL") returned -1
	[0168.547] lstrlenW (lpString=".hdr") returned 4
	[0168.547] lstrcmpiW (lpString1=".hdr", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".hpp") returned 4
	[0168.548] lstrcmpiW (lpString1=".hpp", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".hta") returned 4
	[0168.548] lstrcmpiW (lpString1=".hta", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".htc") returned 4
	[0168.548] lstrcmpiW (lpString1=".htc", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".htm") returned 4
	[0168.548] lstrcmpiW (lpString1=".htm", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".html") returned 5
	[0168.548] lstrcmpiW (lpString1=".html", lpString2="7.ACL") returned -1
	[0168.548] lstrlenW (lpString=".icb") returned 4
	[0168.548] lstrcmpiW (lpString1=".icb", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".ics") returned 4
	[0168.548] lstrcmpiW (lpString1=".ics", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".iff") returned 4
	[0168.548] lstrcmpiW (lpString1=".iff", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".inc") returned 4
	[0168.548] lstrcmpiW (lpString1=".inc", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".indd") returned 5
	[0168.548] lstrcmpiW (lpString1=".indd", lpString2="7.ACL") returned -1
	[0168.548] lstrlenW (lpString=".ini") returned 4
	[0168.548] lstrcmpiW (lpString1=".ini", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".iqy") returned 4
	[0168.548] lstrcmpiW (lpString1=".iqy", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".j2c") returned 4
	[0168.548] lstrcmpiW (lpString1=".j2c", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".j2k") returned 4
	[0168.548] lstrcmpiW (lpString1=".j2k", lpString2=".ACL") returned 1
	[0168.548] lstrlenW (lpString=".java") returned 5
	[0168.549] lstrcmpiW (lpString1=".java", lpString2="7.ACL") returned -1
	[0168.549] lstrlenW (lpString=".jp2") returned 4
	[0168.549] lstrcmpiW (lpString1=".jp2", lpString2=".ACL") returned 1
	[0168.549] lstrlenW (lpString=".jpc") returned 4
	[0168.549] lstrcmpiW (lpString1=".jpc", lpString2=".ACL") returned 1
	[0168.549] lstrlenW (lpString=".jpe") returned 4
	[0168.549] lstrcmpiW (lpString1=".jpe", lpString2=".ACL") returned 1
	[0168.549] lstrlenW (lpString=".jpeg") returned 5
	[0168.549] lstrcmpiW (lpString1=".jpeg", lpString2="7.ACL") returned -1
	[0168.549] lstrlenW (lpString=".jpf") returned 4
	[0168.549] lstrcmpiW (lpString1=".jpf", lpString2=".ACL") returned 1
	[0168.549] lstrlenW (lpString=".jpg") returned 4
	[0168.549] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1
	[0168.549] lstrlenW (lpString=".jpx") returned 4
	[0168.549] lstrcmpiW (lpString1=".jpx", lpString2=".ACL") returned 1
	[0168.549] lstrlenW (lpString=".js") returned 3
	[0168.549] lstrcmpiW (lpString1=".js", lpString2="ACL") returned -1
	[0168.549] lstrlenW (lpString=".jsf") returned 4
	[0168.549] lstrcmpiW (lpString1=".jsf", lpString2=".ACL") returned 1
	[0168.549] lstrlenW (lpString=".json") returned 5
	[0168.549] lstrcmpiW (lpString1=".json", lpString2="7.ACL") returned -1
	[0168.549] lstrlenW (lpString=".jsp") returned 4
	[0168.549] lstrcmpiW (lpString1=".jsp", lpString2=".ACL") returned 1
	[0168.549] lstrlenW (lpString=".kdc") returned 4
	[0168.549] lstrcmpiW (lpString1=".kdc", lpString2=".ACL") returned 1
	[0168.549] lstrlenW (lpString=".kmz") returned 4
	[0168.549] lstrcmpiW (lpString1=".kmz", lpString2=".ACL") returned 1
	[0168.549] lstrlenW (lpString=".kwm") returned 4
	[0168.550] lstrcmpiW (lpString1=".kwm", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".lasso") returned 6
	[0168.550] lstrcmpiW (lpString1=".lasso", lpString2="27.ACL") returned -1
	[0168.550] lstrlenW (lpString=".lbi") returned 4
	[0168.550] lstrcmpiW (lpString1=".lbi", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".lgf") returned 4
	[0168.550] lstrcmpiW (lpString1=".lgf", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".lgp") returned 4
	[0168.550] lstrcmpiW (lpString1=".lgp", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".log") returned 4
	[0168.550] lstrcmpiW (lpString1=".log", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".m1v") returned 4
	[0168.550] lstrcmpiW (lpString1=".m1v", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".m4a") returned 4
	[0168.550] lstrcmpiW (lpString1=".m4a", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".m4v") returned 4
	[0168.550] lstrcmpiW (lpString1=".m4v", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".max") returned 4
	[0168.550] lstrcmpiW (lpString1=".max", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".md") returned 3
	[0168.550] lstrcmpiW (lpString1=".md", lpString2="ACL") returned -1
	[0168.550] lstrlenW (lpString=".mda") returned 4
	[0168.550] lstrcmpiW (lpString1=".mda", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".mdb") returned 4
	[0168.550] lstrcmpiW (lpString1=".mdb", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".mde") returned 4
	[0168.550] lstrcmpiW (lpString1=".mde", lpString2=".ACL") returned 1
	[0168.550] lstrlenW (lpString=".mdf") returned 4
	[0168.550] lstrcmpiW (lpString1=".mdf", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mdw") returned 4
	[0168.551] lstrcmpiW (lpString1=".mdw", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mef") returned 4
	[0168.551] lstrcmpiW (lpString1=".mef", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mft") returned 4
	[0168.551] lstrcmpiW (lpString1=".mft", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mfw") returned 4
	[0168.551] lstrcmpiW (lpString1=".mfw", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mht") returned 4
	[0168.551] lstrcmpiW (lpString1=".mht", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mhtml") returned 6
	[0168.551] lstrcmpiW (lpString1=".mhtml", lpString2="27.ACL") returned -1
	[0168.551] lstrlenW (lpString=".mka") returned 4
	[0168.551] lstrcmpiW (lpString1=".mka", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mkidx") returned 6
	[0168.551] lstrcmpiW (lpString1=".mkidx", lpString2="27.ACL") returned -1
	[0168.551] lstrlenW (lpString=".mkv") returned 4
	[0168.551] lstrcmpiW (lpString1=".mkv", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mos") returned 4
	[0168.551] lstrcmpiW (lpString1=".mos", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mov") returned 4
	[0168.551] lstrcmpiW (lpString1=".mov", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mp3") returned 4
	[0168.551] lstrcmpiW (lpString1=".mp3", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mp4") returned 4
	[0168.551] lstrcmpiW (lpString1=".mp4", lpString2=".ACL") returned 1
	[0168.551] lstrlenW (lpString=".mpeg") returned 5
	[0168.551] lstrcmpiW (lpString1=".mpeg", lpString2="7.ACL") returned -1
	[0168.552] lstrlenW (lpString=".mpg") returned 4
	[0168.552] lstrcmpiW (lpString1=".mpg", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".mpv") returned 4
	[0168.552] lstrcmpiW (lpString1=".mpv", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".mrw") returned 4
	[0168.552] lstrcmpiW (lpString1=".mrw", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".msg") returned 4
	[0168.552] lstrcmpiW (lpString1=".msg", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".mxl") returned 4
	[0168.552] lstrcmpiW (lpString1=".mxl", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".myd") returned 4
	[0168.552] lstrcmpiW (lpString1=".myd", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".myi") returned 4
	[0168.552] lstrcmpiW (lpString1=".myi", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".nef") returned 4
	[0168.552] lstrcmpiW (lpString1=".nef", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".nrw") returned 4
	[0168.552] lstrcmpiW (lpString1=".nrw", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".obj") returned 4
	[0168.552] lstrcmpiW (lpString1=".obj", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".odb") returned 4
	[0168.552] lstrcmpiW (lpString1=".odb", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".odc") returned 4
	[0168.552] lstrcmpiW (lpString1=".odc", lpString2=".ACL") returned 1
	[0168.552] lstrlenW (lpString=".odm") returned 4
	[0168.552] lstrcmpiW (lpString1=".odm", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".odp") returned 4
	[0168.553] lstrcmpiW (lpString1=".odp", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".ods") returned 4
	[0168.553] lstrcmpiW (lpString1=".ods", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".oft") returned 4
	[0168.553] lstrcmpiW (lpString1=".oft", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".one") returned 4
	[0168.553] lstrcmpiW (lpString1=".one", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".onepkg") returned 7
	[0168.553] lstrcmpiW (lpString1=".onepkg", lpString2="127.ACL") returned -1
	[0168.553] lstrlenW (lpString=".onetoc2") returned 8
	[0168.553] lstrcmpiW (lpString1=".onetoc2", lpString2="0127.ACL") returned -1
	[0168.553] lstrlenW (lpString=".opt") returned 4
	[0168.553] lstrcmpiW (lpString1=".opt", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".oqy") returned 4
	[0168.553] lstrcmpiW (lpString1=".oqy", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".orf") returned 4
	[0168.553] lstrcmpiW (lpString1=".orf", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".p12") returned 4
	[0168.553] lstrcmpiW (lpString1=".p12", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".p7b") returned 4
	[0168.553] lstrcmpiW (lpString1=".p7b", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".p7c") returned 4
	[0168.553] lstrcmpiW (lpString1=".p7c", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".pam") returned 4
	[0168.553] lstrcmpiW (lpString1=".pam", lpString2=".ACL") returned 1
	[0168.553] lstrlenW (lpString=".pbm") returned 4
	[0168.554] lstrcmpiW (lpString1=".pbm", lpString2=".ACL") returned 1
	[0168.554] lstrlenW (lpString=".pct") returned 4
	[0168.554] lstrcmpiW (lpString1=".pct", lpString2=".ACL") returned 1
	[0168.554] lstrlenW (lpString=".pcx") returned 4
	[0168.554] lstrcmpiW (lpString1=".pcx", lpString2=".ACL") returned 1
	[0168.554] lstrlenW (lpString=".pdd") returned 4
	[0168.554] lstrcmpiW (lpString1=".pdd", lpString2=".ACL") returned 1
	[0168.554] lstrlenW (lpString=".pdf") returned 4
	[0168.554] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1
	[0168.554] lstrlenW (lpString=".pdp") returned 4
	[0168.554] lstrcmpiW (lpString1=".pdp", lpString2=".ACL") returned 1
	[0168.554] lstrlenW (lpString=".pef") returned 4
	[0168.554] lstrcmpiW (lpString1=".pef", lpString2=".ACL") returned 1
	[0168.554] lstrlenW (lpString=".pem") returned 4
	[0168.554] lstrcmpiW (lpString1=".pem", lpString2=".ACL") returned 1
	[0168.554] lstrlenW (lpString=".pff") returned 4
	[0168.554] lstrcmpiW (lpString1=".pff", lpString2=".ACL") returned 1
	[0168.554] lstrlenW (lpString=".pfm") returned 4
	[0168.554] lstrcmpiW (lpString1=".pfm", lpString2=".ACL") returned 1
	[0168.555] lstrlenW (lpString=".pfx") returned 4
	[0168.555] lstrcmpiW (lpString1=".pfx", lpString2=".ACL") returned 1
	[0168.555] lstrlenW (lpString=".pgm") returned 4
	[0168.555] lstrcmpiW (lpString1=".pgm", lpString2=".ACL") returned 1
	[0168.555] lstrlenW (lpString=".php") returned 4
	[0168.555] lstrcmpiW (lpString1=".php", lpString2=".ACL") returned 1
	[0168.555] lstrlenW (lpString=".php3") returned 5
	[0168.555] lstrcmpiW (lpString1=".php3", lpString2="7.ACL") returned -1
	[0168.555] lstrlenW (lpString=".php4") returned 5
	[0168.555] lstrcmpiW (lpString1=".php4", lpString2="7.ACL") returned -1
	[0168.555] lstrlenW (lpString=".php5") returned 5
	[0168.555] lstrcmpiW (lpString1=".php5", lpString2="7.ACL") returned -1
	[0168.555] lstrlenW (lpString=".phtml") returned 6
	[0168.555] lstrcmpiW (lpString1=".phtml", lpString2="27.ACL") returned -1
	[0168.555] lstrlenW (lpString=".pict") returned 5
	[0168.555] lstrcmpiW (lpString1=".pict", lpString2="7.ACL") returned -1
	[0168.555] lstrlenW (lpString=".pl") returned 3
	[0168.555] lstrcmpiW (lpString1=".pl", lpString2="ACL") returned -1
	[0168.555] lstrlenW (lpString=".pls") returned 4
	[0168.555] lstrcmpiW (lpString1=".pls", lpString2=".ACL") returned 1
	[0168.555] lstrlenW (lpString=".pm") returned 3
	[0168.555] lstrcmpiW (lpString1=".pm", lpString2="ACL") returned -1
	[0168.555] lstrlenW (lpString=".png") returned 4
	[0168.555] lstrcmpiW (lpString1=".png", lpString2=".ACL") returned 1
	[0168.555] lstrlenW (lpString=".pnm") returned 4
	[0168.555] lstrcmpiW (lpString1=".pnm", lpString2=".ACL") returned 1
	[0168.555] lstrlenW (lpString=".pot") returned 4
	[0168.555] lstrcmpiW (lpString1=".pot", lpString2=".ACL") returned 1
	[0168.556] lstrlenW (lpString=".potm") returned 5
	[0168.556] lstrcmpiW (lpString1=".potm", lpString2="7.ACL") returned -1
	[0168.556] lstrlenW (lpString=".potx") returned 5
	[0168.556] lstrcmpiW (lpString1=".potx", lpString2="7.ACL") returned -1
	[0168.556] lstrlenW (lpString=".ppa") returned 4
	[0168.556] lstrcmpiW (lpString1=".ppa", lpString2=".ACL") returned 1
	[0168.556] lstrlenW (lpString=".ppam") returned 5
	[0168.556] lstrcmpiW (lpString1=".ppam", lpString2="7.ACL") returned -1
	[0168.556] lstrlenW (lpString=".ppm") returned 4
	[0168.556] lstrcmpiW (lpString1=".ppm", lpString2=".ACL") returned 1
	[0168.556] lstrlenW (lpString=".pps") returned 4
	[0168.556] lstrcmpiW (lpString1=".pps", lpString2=".ACL") returned 1
	[0168.556] lstrlenW (lpString=".ppsm") returned 5
	[0168.556] lstrcmpiW (lpString1=".ppsm", lpString2="7.ACL") returned -1
	[0168.556] lstrlenW (lpString=".ppt") returned 4
	[0168.556] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1
	[0168.556] lstrlenW (lpString=".pptm") returned 5
	[0168.556] lstrcmpiW (lpString1=".pptm", lpString2="7.ACL") returned -1
	[0168.556] lstrlenW (lpString=".pptx") returned 5
	[0168.556] lstrcmpiW (lpString1=".pptx", lpString2="7.ACL") returned -1
	[0168.556] lstrlenW (lpString=".prn") returned 4
	[0168.556] lstrcmpiW (lpString1=".prn", lpString2=".ACL") returned 1
	[0168.556] lstrlenW (lpString=".ps") returned 3
	[0168.556] lstrcmpiW (lpString1=".ps", lpString2="ACL") returned -1
	[0168.556] lstrlenW (lpString=".psb") returned 4
	[0168.556] lstrcmpiW (lpString1=".psb", lpString2=".ACL") returned 1
	[0168.556] lstrlenW (lpString=".psd") returned 4
	[0168.556] lstrcmpiW (lpString1=".psd", lpString2=".ACL") returned 1
	[0168.556] lstrlenW (lpString=".pst") returned 4
	[0168.557] lstrcmpiW (lpString1=".pst", lpString2=".ACL") returned 1
	[0168.557] lstrlenW (lpString=".ptx") returned 4
	[0168.557] lstrcmpiW (lpString1=".ptx", lpString2=".ACL") returned 1
	[0168.557] lstrlenW (lpString=".pub") returned 4
	[0168.557] lstrcmpiW (lpString1=".pub", lpString2=".ACL") returned 1
	[0168.557] lstrlenW (lpString=".pwm") returned 4
	[0168.557] lstrcmpiW (lpString1=".pwm", lpString2=".ACL") returned 1
	[0168.557] lstrlenW (lpString=".pxr") returned 4
	[0168.557] lstrcmpiW (lpString1=".pxr", lpString2=".ACL") returned 1
	[0168.557] lstrlenW (lpString=".py") returned 3
	[0168.557] lstrcmpiW (lpString1=".py", lpString2="ACL") returned -1
	[0168.557] lstrlenW (lpString=".qt") returned 3
	[0168.557] lstrcmpiW (lpString1=".qt", lpString2="ACL") returned -1
	[0168.557] lstrlenW (lpString=".r3d") returned 4
	[0168.557] lstrcmpiW (lpString1=".r3d", lpString2=".ACL") returned 1
	[0168.557] lstrlenW (lpString=".raf") returned 4
	[0168.557] lstrcmpiW (lpString1=".raf", lpString2=".ACL") returned 1
	[0168.557] lstrlenW (lpString=".rar") returned 4
	[0168.557] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1
	[0168.557] lstrlenW (lpString=".raw") returned 4
	[0168.557] lstrcmpiW (lpString1=".raw", lpString2=".ACL") returned 1
	[0168.558] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe24e42d8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe24e42d8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2661a3d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOCF.DLL", cAlternateFileName="")) returned 1
	[0168.558] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf16bd2da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6070, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOCFUIUTILITIESDLL.DLL", cAlternateFileName="MSOCFU~1.DLL")) returned 1
	[0168.558] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b382177, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b3a83c3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xed650, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOCR.DLL", cAlternateFileName="")) returned 1
	[0168.558] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2169a085, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24c3218, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOCRRES.ORP", cAlternateFileName="")) returned 1
	[0168.558] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x152c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msoetwres.dll", cAlternateFileName="MSOETW~1.DLL")) returned 1
	[0168.559] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed388c20, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed388c20, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xede4358a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa6b0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msoev.exe", cAlternateFileName="")) returned 1
	[0168.559] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3a5762f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19c60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1
	[0168.559] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2f5480d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOHEVI.DLL", cAlternateFileName="")) returned 1
	[0168.559] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe238cd90, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe238cd90, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe24e42d8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17060, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1
	[0168.560] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1be16917, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c648aa6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x66250, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msoia.exe", cAlternateFileName="")) returned 1
	[0168.560] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5e80, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msoianetutil.dll", cAlternateFileName="MSOIAN~1.DLL")) returned 1
	[0168.560] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2a8cc4b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2a8cc4b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2c30669, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x31ac0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOSB.DLL", cAlternateFileName="")) returned 1
	[0168.560] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6081126, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x380c8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOSREC.EXE", cAlternateFileName="")) returned 1
	[0168.560] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb654e78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc078, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOSTYLE.DLL", cAlternateFileName="")) returned 1
	[0168.560] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe1de33ea, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef07151c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xef3deb63, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x74860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOSYNC.EXE", cAlternateFileName="")) returned 1
	[0168.561] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed388c20, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed388c20, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xed5eb1ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xac58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msotd.exe", cAlternateFileName="")) returned 1
	[0168.561] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8d0c8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msotdaddin.dll", cAlternateFileName="MSOTDA~1.DLL")) returned 1
	[0168.561] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msotelemetry.dll", cAlternateFileName="MSOTEL~1.DLL")) returned 1
	[0168.561] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe261555e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe261555e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2720687, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9be60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOUC.EXE", cAlternateFileName="")) returned 1
	[0168.561] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1
	[0168.562] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca4703d4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca4703d4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9eedd13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x67ac0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOUTL.OLB", cAlternateFileName="")) returned 1
	[0168.562] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x7f63b8, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x7f63b8, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x46860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOUTLS.DLL", cAlternateFileName="")) returned 1
	[0168.562] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b580a61, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b580a61, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b580a61, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x14840, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSPJEVTS.DLL", cAlternateFileName="")) returned 1
	[0168.563] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x66a68, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSPPT.OLB", cAlternateFileName="")) returned 1
	[0168.563] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c2c3dcb, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0xe80e8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSPRJ.OLB", cAlternateFileName="")) returned 1
	[0168.563] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc3605252, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc3605252, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd4ff3b77, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4d8a8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msproof7.dll", cAlternateFileName="")) returned 1
	[0168.563] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca4703d4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca4703d4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb0f5967, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x214298, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSPST32.DLL", cAlternateFileName="")) returned 1
	[0168.563] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc33c8ea0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd4f0ed48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd5124e28, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd02e48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSPUB.EXE", cAlternateFileName="")) returned 1
	[0168.564] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3bb225, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc3bb225, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc6b6198, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="mspub.exe.manifest", cAlternateFileName="MSPUBE~1.MAN")) returned 1
	[0168.564] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x41874, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSPUB.TLB", cAlternateFileName="")) returned 1
	[0168.564] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c66ecc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSPUB.VisualElementsManifest.xml", cAlternateFileName="MSPUBV~1.XML")) returned 1
	[0168.564] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe1c8beb8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee37a832, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xef39274d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xcea40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSQRY32.EXE", cAlternateFileName="")) returned 1
	[0168.564] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbdc8437, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x27230, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSRTEDIT.DLL", cAlternateFileName="")) returned 1
	[0168.565] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd1bd051, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdec4432c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdec90856, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1
	[0168.565] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x834f7581, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1
	[0168.565] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd1e31f2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdec6a56c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdecb6a42, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1
	[0168.565] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c66ecc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe3040, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSWORD.OLB", cAlternateFileName="")) returned 1
	[0168.565] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa4e8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSYUBIN7.DLL", cAlternateFileName="")) returned 1
	[0168.566] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb013b61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x462700, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSZIP.DIC", cAlternateFileName="")) returned 1
	[0168.566] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c6e13e3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e13, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="muauth.cab", cAlternateFileName="")) returned 1
	[0168.566] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae22cc9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MYSL.ICO", cAlternateFileName="")) returned 1
	[0168.566] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9a04f26, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1ae48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1
	[0168.566] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf035e09d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5868, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1
	[0168.567] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2366bd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2366bd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2471bd1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1f268, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NAMECONTROLSERVER.EXE", cAlternateFileName="NAMECO~1.EXE")) returned 1
	[0168.567] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b7e331c, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b7e331c, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x4c0c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1
	[0168.567] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c6e13e3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4630f, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NativeHostAnnotationApp.xap", cAlternateFileName="NATIVE~1.XAP")) returned 1
	[0168.567] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c648aa6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a6a9, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NativeHostPollApp.xap", cAlternateFileName="NATIVE~2.XAP")) returned 1
	[0168.567] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c98fe3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x794a98, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NL7Data0011.DLL", cAlternateFileName="NL7DAT~1.DLL")) returned 1
	[0168.567] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c72d887, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2602f8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NL7Lexicons0011.DLL", cAlternateFileName="NL7LEX~1.DLL")) returned 1
	[0168.568] lstrlenW (lpString="NL7Lexicons0011.DLL") returned 19
	[0168.568] lstrlenW (lpString=".1cd") returned 4
	[0168.568] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0168.568] lstrlenW (lpString=".3ds") returned 4
	[0168.568] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1
	[0168.568] lstrlenW (lpString=".3fr") returned 4
	[0168.568] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1
	[0168.568] lstrlenW (lpString=".3g2") returned 4
	[0168.568] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1
	[0168.568] lstrlenW (lpString=".3gp") returned 4
	[0168.568] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1
	[0168.568] lstrlenW (lpString=".7z") returned 3
	[0168.568] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0168.568] lstrlenW (lpString=".accda") returned 6
	[0168.568] lstrcmpiW (lpString1=".accda", lpString2="11.DLL") returned -1
	[0168.568] lstrlenW (lpString=".accdb") returned 6
	[0168.568] lstrcmpiW (lpString1=".accdb", lpString2="11.DLL") returned -1
	[0168.568] lstrlenW (lpString=".accdc") returned 6
	[0168.568] lstrcmpiW (lpString1=".accdc", lpString2="11.DLL") returned -1
	[0168.568] lstrlenW (lpString=".accde") returned 6
	[0168.568] lstrcmpiW (lpString1=".accde", lpString2="11.DLL") returned -1
	[0168.568] lstrlenW (lpString=".accdt") returned 6
	[0168.568] lstrcmpiW (lpString1=".accdt", lpString2="11.DLL") returned -1
	[0168.568] lstrlenW (lpString=".accdw") returned 6
	[0168.568] lstrcmpiW (lpString1=".accdw", lpString2="11.DLL") returned -1
	[0168.568] lstrlenW (lpString=".adb") returned 4
	[0168.568] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1
	[0168.569] lstrlenW (lpString=".adp") returned 4
	[0168.569] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1
	[0168.569] lstrlenW (lpString=".ai") returned 3
	[0168.569] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1
	[0168.569] lstrlenW (lpString=".ai3") returned 4
	[0168.569] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1
	[0168.569] lstrlenW (lpString=".ai4") returned 4
	[0168.569] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1
	[0168.569] lstrlenW (lpString=".ai5") returned 4
	[0168.569] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1
	[0168.569] lstrlenW (lpString=".ai6") returned 4
	[0168.569] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1
	[0168.569] lstrlenW (lpString=".ai7") returned 4
	[0168.569] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1
	[0168.569] lstrlenW (lpString=".ai8") returned 4
	[0168.569] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1
	[0168.569] lstrlenW (lpString=".anim") returned 5
	[0168.569] lstrcmpiW (lpString1=".anim", lpString2="1.DLL") returned -1
	[0168.569] lstrlenW (lpString=".arw") returned 4
	[0168.569] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1
	[0168.569] lstrlenW (lpString=".as") returned 3
	[0168.569] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1
	[0168.569] lstrlenW (lpString=".asa") returned 4
	[0168.569] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1
	[0168.569] lstrlenW (lpString=".asc") returned 4
	[0168.569] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1
	[0168.569] lstrlenW (lpString=".ascx") returned 5
	[0168.569] lstrcmpiW (lpString1=".ascx", lpString2="1.DLL") returned -1
	[0168.570] lstrlenW (lpString=".asm") returned 4
	[0168.570] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1
	[0168.570] lstrlenW (lpString=".asmx") returned 5
	[0168.570] lstrcmpiW (lpString1=".asmx", lpString2="1.DLL") returned -1
	[0168.570] lstrlenW (lpString=".asp") returned 4
	[0168.570] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1
	[0168.570] lstrlenW (lpString=".aspx") returned 5
	[0168.570] lstrcmpiW (lpString1=".aspx", lpString2="1.DLL") returned -1
	[0168.570] lstrlenW (lpString=".asr") returned 4
	[0168.570] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1
	[0168.570] lstrlenW (lpString=".asx") returned 4
	[0168.570] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1
	[0168.570] lstrlenW (lpString=".avi") returned 4
	[0168.570] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1
	[0168.570] lstrlenW (lpString=".avs") returned 4
	[0168.570] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1
	[0168.570] lstrlenW (lpString=".backup") returned 7
	[0168.570] lstrcmpiW (lpString1=".backup", lpString2="011.DLL") returned -1
	[0168.570] lstrlenW (lpString=".bak") returned 4
	[0168.570] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1
	[0168.570] lstrlenW (lpString=".bay") returned 4
	[0168.570] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1
	[0168.570] lstrlenW (lpString=".bd") returned 3
	[0168.570] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1
	[0168.570] lstrlenW (lpString=".bin") returned 4
	[0168.570] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1
	[0168.570] lstrlenW (lpString=".bmp") returned 4
	[0168.570] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1
	[0168.571] lstrlenW (lpString=".bz2") returned 4
	[0168.571] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0168.571] lstrlenW (lpString=".c") returned 2
	[0168.571] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1
	[0168.571] lstrlenW (lpString=".cdr") returned 4
	[0168.571] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1
	[0168.571] lstrlenW (lpString=".cer") returned 4
	[0168.571] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1
	[0168.571] lstrlenW (lpString=".cf") returned 3
	[0168.571] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1
	[0168.571] lstrlenW (lpString=".cfc") returned 4
	[0168.571] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1
	[0168.571] lstrlenW (lpString=".cfm") returned 4
	[0168.571] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1
	[0168.571] lstrlenW (lpString=".cfml") returned 5
	[0168.571] lstrcmpiW (lpString1=".cfml", lpString2="1.DLL") returned -1
	[0168.571] lstrlenW (lpString=".cfu") returned 4
	[0168.571] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1
	[0168.571] lstrlenW (lpString=".chm") returned 4
	[0168.571] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1
	[0168.571] lstrlenW (lpString=".cin") returned 4
	[0168.571] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1
	[0168.571] lstrlenW (lpString=".class") returned 6
	[0168.571] lstrcmpiW (lpString1=".class", lpString2="11.DLL") returned -1
	[0168.571] lstrlenW (lpString=".clx") returned 4
	[0168.571] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1
	[0168.571] lstrlenW (lpString=".config") returned 7
	[0168.571] lstrcmpiW (lpString1=".config", lpString2="011.DLL") returned -1
	[0168.571] lstrlenW (lpString=".cpp") returned 4
	[0168.572] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1
	[0168.572] lstrlenW (lpString=".cr2") returned 4
	[0168.572] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1
	[0168.572] lstrlenW (lpString=".crt") returned 4
	[0168.572] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1
	[0168.572] lstrlenW (lpString=".crw") returned 4
	[0168.572] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1
	[0168.572] lstrlenW (lpString=".cs") returned 3
	[0168.572] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1
	[0168.572] lstrlenW (lpString=".css") returned 4
	[0168.572] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1
	[0168.572] lstrlenW (lpString=".csv") returned 4
	[0168.572] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1
	[0168.572] lstrlenW (lpString=".cub") returned 4
	[0168.572] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1
	[0168.572] lstrlenW (lpString=".dae") returned 4
	[0168.572] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1
	[0168.572] lstrlenW (lpString=".dat") returned 4
	[0168.572] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1
	[0168.572] lstrlenW (lpString=".db") returned 3
	[0168.572] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1
	[0168.572] lstrlenW (lpString=".dbf") returned 4
	[0168.572] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0168.572] lstrlenW (lpString=".dbx") returned 4
	[0168.572] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1
	[0168.572] lstrlenW (lpString=".dc3") returned 4
	[0168.573] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1
	[0168.573] lstrlenW (lpString=".dcm") returned 4
	[0168.573] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1
	[0168.573] lstrlenW (lpString=".dcr") returned 4
	[0168.573] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1
	[0168.573] lstrlenW (lpString=".der") returned 4
	[0168.573] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1
	[0168.573] lstrlenW (lpString=".dib") returned 4
	[0168.573] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1
	[0168.573] lstrlenW (lpString=".dic") returned 4
	[0168.573] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1
	[0168.573] lstrlenW (lpString=".dif") returned 4
	[0168.573] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1
	[0168.573] lstrlenW (lpString=".divx") returned 5
	[0168.573] lstrcmpiW (lpString1=".divx", lpString2="1.DLL") returned -1
	[0168.573] lstrlenW (lpString=".djvu") returned 5
	[0168.573] lstrcmpiW (lpString1=".djvu", lpString2="1.DLL") returned -1
	[0168.573] lstrlenW (lpString=".dng") returned 4
	[0168.573] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1
	[0168.573] lstrlenW (lpString=".doc") returned 4
	[0168.573] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0168.573] lstrlenW (lpString=".docm") returned 5
	[0168.573] lstrcmpiW (lpString1=".docm", lpString2="1.DLL") returned -1
	[0168.573] lstrlenW (lpString=".docx") returned 5
	[0168.573] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1
	[0168.573] lstrlenW (lpString=".dot") returned 4
	[0168.574] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1
	[0168.574] lstrlenW (lpString=".dotm") returned 5
	[0168.574] lstrcmpiW (lpString1=".dotm", lpString2="1.DLL") returned -1
	[0168.574] lstrlenW (lpString=".dotx") returned 5
	[0168.574] lstrcmpiW (lpString1=".dotx", lpString2="1.DLL") returned -1
	[0168.574] lstrlenW (lpString=".dpx") returned 4
	[0168.574] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1
	[0168.574] lstrlenW (lpString=".dqy") returned 4
	[0168.574] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1
	[0168.574] lstrlenW (lpString=".dsn") returned 4
	[0168.574] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1
	[0168.574] lstrlenW (lpString=".dt") returned 3
	[0168.574] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1
	[0168.574] lstrlenW (lpString=".dtd") returned 4
	[0168.574] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1
	[0168.574] lstrlenW (lpString=".dwg") returned 4
	[0168.574] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1
	[0168.574] lstrlenW (lpString=".dwt") returned 4
	[0168.574] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1
	[0168.574] lstrlenW (lpString=".dx") returned 3
	[0168.574] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1
	[0168.574] lstrlenW (lpString=".dxf") returned 4
	[0168.574] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1
	[0168.574] lstrlenW (lpString=".edml") returned 5
	[0168.574] lstrcmpiW (lpString1=".edml", lpString2="1.DLL") returned -1
	[0168.574] lstrlenW (lpString=".efd") returned 4
	[0168.574] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1
	[0168.575] lstrlenW (lpString=".elf") returned 4
	[0168.575] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1
	[0168.575] lstrlenW (lpString=".emf") returned 4
	[0168.575] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1
	[0168.575] lstrlenW (lpString=".emz") returned 4
	[0168.575] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1
	[0168.575] lstrlenW (lpString=".epf") returned 4
	[0168.575] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1
	[0168.575] lstrlenW (lpString=".eps") returned 4
	[0168.575] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1
	[0168.575] lstrlenW (lpString=".epsf") returned 5
	[0168.575] lstrcmpiW (lpString1=".epsf", lpString2="1.DLL") returned -1
	[0168.575] lstrlenW (lpString=".epsp") returned 5
	[0168.575] lstrcmpiW (lpString1=".epsp", lpString2="1.DLL") returned -1
	[0168.575] lstrlenW (lpString=".erf") returned 4
	[0168.575] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1
	[0168.575] lstrlenW (lpString=".exr") returned 4
	[0168.575] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1
	[0168.575] lstrlenW (lpString=".f4v") returned 4
	[0168.575] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1
	[0168.575] lstrlenW (lpString=".fido") returned 5
	[0168.575] lstrcmpiW (lpString1=".fido", lpString2="1.DLL") returned -1
	[0168.575] lstrlenW (lpString=".flm") returned 4
	[0168.575] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1
	[0168.575] lstrlenW (lpString=".flv") returned 4
	[0168.575] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1
	[0168.575] lstrlenW (lpString=".frm") returned 4
	[0168.576] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1
	[0168.576] lstrlenW (lpString=".fxg") returned 4
	[0168.576] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1
	[0168.576] lstrlenW (lpString=".geo") returned 4
	[0168.576] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1
	[0168.576] lstrlenW (lpString=".gif") returned 4
	[0168.576] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1
	[0168.576] lstrlenW (lpString=".grs") returned 4
	[0168.576] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1
	[0168.576] lstrlenW (lpString=".gz") returned 3
	[0168.576] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1
	[0168.576] lstrlenW (lpString=".h") returned 2
	[0168.635] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1
	[0168.635] lstrlenW (lpString=".hdr") returned 4
	[0168.635] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1
	[0168.635] lstrlenW (lpString=".hpp") returned 4
	[0168.635] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1
	[0168.635] lstrlenW (lpString=".hta") returned 4
	[0168.635] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1
	[0168.635] lstrlenW (lpString=".htc") returned 4
	[0168.635] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1
	[0168.635] lstrlenW (lpString=".htm") returned 4
	[0168.635] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1
	[0168.635] lstrlenW (lpString=".html") returned 5
	[0168.636] lstrcmpiW (lpString1=".html", lpString2="1.DLL") returned -1
	[0168.636] lstrlenW (lpString=".icb") returned 4
	[0168.636] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1
	[0168.636] lstrlenW (lpString=".ics") returned 4
	[0168.636] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1
	[0168.636] lstrlenW (lpString=".iff") returned 4
	[0168.636] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1
	[0168.636] lstrlenW (lpString=".inc") returned 4
	[0168.636] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1
	[0168.636] lstrlenW (lpString=".indd") returned 5
	[0168.636] lstrcmpiW (lpString1=".indd", lpString2="1.DLL") returned -1
	[0168.636] lstrlenW (lpString=".ini") returned 4
	[0168.636] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1
	[0168.636] lstrlenW (lpString=".iqy") returned 4
	[0168.636] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1
	[0168.636] lstrlenW (lpString=".j2c") returned 4
	[0168.636] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1
	[0168.636] lstrlenW (lpString=".j2k") returned 4
	[0168.636] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1
	[0168.636] lstrlenW (lpString=".java") returned 5
	[0168.636] lstrcmpiW (lpString1=".java", lpString2="1.DLL") returned -1
	[0168.636] lstrlenW (lpString=".jp2") returned 4
	[0168.636] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1
	[0168.636] lstrlenW (lpString=".jpc") returned 4
	[0168.637] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1
	[0168.637] lstrlenW (lpString=".jpe") returned 4
	[0168.637] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1
	[0168.637] lstrlenW (lpString=".jpeg") returned 5
	[0168.637] lstrcmpiW (lpString1=".jpeg", lpString2="1.DLL") returned -1
	[0168.637] lstrlenW (lpString=".jpf") returned 4
	[0168.637] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1
	[0168.637] lstrlenW (lpString=".jpg") returned 4
	[0168.637] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0168.637] lstrlenW (lpString=".jpx") returned 4
	[0168.637] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1
	[0168.637] lstrlenW (lpString=".js") returned 3
	[0168.637] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1
	[0168.637] lstrlenW (lpString=".jsf") returned 4
	[0168.637] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1
	[0168.637] lstrlenW (lpString=".json") returned 5
	[0168.637] lstrcmpiW (lpString1=".json", lpString2="1.DLL") returned -1
	[0168.637] lstrlenW (lpString=".jsp") returned 4
	[0168.637] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1
	[0168.637] lstrlenW (lpString=".kdc") returned 4
	[0168.637] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1
	[0168.637] lstrlenW (lpString=".kmz") returned 4
	[0168.637] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1
	[0168.637] lstrlenW (lpString=".kwm") returned 4
	[0168.637] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1
	[0168.637] lstrlenW (lpString=".lasso") returned 6
	[0168.637] lstrcmpiW (lpString1=".lasso", lpString2="11.DLL") returned -1
	[0168.637] lstrlenW (lpString=".lbi") returned 4
	[0168.638] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1
	[0168.638] lstrlenW (lpString=".lgf") returned 4
	[0168.638] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1
	[0168.638] lstrlenW (lpString=".lgp") returned 4
	[0168.638] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1
	[0168.638] lstrlenW (lpString=".log") returned 4
	[0168.638] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1
	[0168.638] lstrlenW (lpString=".m1v") returned 4
	[0168.638] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1
	[0168.638] lstrlenW (lpString=".m4a") returned 4
	[0168.638] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1
	[0168.638] lstrlenW (lpString=".m4v") returned 4
	[0168.638] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1
	[0168.638] lstrlenW (lpString=".max") returned 4
	[0168.638] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1
	[0168.638] lstrlenW (lpString=".md") returned 3
	[0168.638] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1
	[0168.638] lstrlenW (lpString=".mda") returned 4
	[0168.638] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1
	[0168.638] lstrlenW (lpString=".mdb") returned 4
	[0168.638] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1
	[0168.638] lstrlenW (lpString=".mde") returned 4
	[0168.638] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1
	[0168.638] lstrlenW (lpString=".mdf") returned 4
	[0168.638] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mdw") returned 4
	[0168.639] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mef") returned 4
	[0168.639] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mft") returned 4
	[0168.639] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mfw") returned 4
	[0168.639] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mht") returned 4
	[0168.639] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mhtml") returned 6
	[0168.639] lstrcmpiW (lpString1=".mhtml", lpString2="11.DLL") returned -1
	[0168.639] lstrlenW (lpString=".mka") returned 4
	[0168.639] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mkidx") returned 6
	[0168.639] lstrcmpiW (lpString1=".mkidx", lpString2="11.DLL") returned -1
	[0168.639] lstrlenW (lpString=".mkv") returned 4
	[0168.639] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mos") returned 4
	[0168.639] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mov") returned 4
	[0168.639] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mp3") returned 4
	[0168.639] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mp4") returned 4
	[0168.639] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1
	[0168.639] lstrlenW (lpString=".mpeg") returned 5
	[0168.639] lstrcmpiW (lpString1=".mpeg", lpString2="1.DLL") returned -1
	[0168.639] lstrlenW (lpString=".mpg") returned 4
	[0168.640] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".mpv") returned 4
	[0168.640] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".mrw") returned 4
	[0168.640] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".msg") returned 4
	[0168.640] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".mxl") returned 4
	[0168.640] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".myd") returned 4
	[0168.640] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".myi") returned 4
	[0168.640] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".nef") returned 4
	[0168.640] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".nrw") returned 4
	[0168.640] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".obj") returned 4
	[0168.640] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".odb") returned 4
	[0168.640] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".odc") returned 4
	[0168.640] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".odm") returned 4
	[0168.640] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".odp") returned 4
	[0168.640] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1
	[0168.640] lstrlenW (lpString=".ods") returned 4
	[0168.641] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".oft") returned 4
	[0168.641] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".one") returned 4
	[0168.641] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".onepkg") returned 7
	[0168.641] lstrcmpiW (lpString1=".onepkg", lpString2="011.DLL") returned -1
	[0168.641] lstrlenW (lpString=".onetoc2") returned 8
	[0168.641] lstrcmpiW (lpString1=".onetoc2", lpString2="0011.DLL") returned -1
	[0168.641] lstrlenW (lpString=".opt") returned 4
	[0168.641] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".oqy") returned 4
	[0168.641] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".orf") returned 4
	[0168.641] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".p12") returned 4
	[0168.641] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".p7b") returned 4
	[0168.641] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".p7c") returned 4
	[0168.641] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".pam") returned 4
	[0168.641] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".pbm") returned 4
	[0168.641] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".pct") returned 4
	[0168.641] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1
	[0168.641] lstrlenW (lpString=".pcx") returned 4
	[0168.642] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1
	[0168.642] lstrlenW (lpString=".pdd") returned 4
	[0168.642] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1
	[0168.642] lstrlenW (lpString=".pdf") returned 4
	[0168.642] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0168.642] lstrlenW (lpString=".pdp") returned 4
	[0168.642] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1
	[0168.642] lstrlenW (lpString=".pef") returned 4
	[0168.642] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1
	[0168.642] lstrlenW (lpString=".pem") returned 4
	[0168.642] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1
	[0168.642] lstrlenW (lpString=".pff") returned 4
	[0168.642] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1
	[0168.642] lstrlenW (lpString=".pfm") returned 4
	[0168.642] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1
	[0168.642] lstrlenW (lpString=".pfx") returned 4
	[0168.642] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1
	[0168.642] lstrlenW (lpString=".pgm") returned 4
	[0168.642] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1
	[0168.642] lstrlenW (lpString=".php") returned 4
	[0168.642] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1
	[0168.642] lstrlenW (lpString=".php3") returned 5
	[0168.642] lstrcmpiW (lpString1=".php3", lpString2="1.DLL") returned -1
	[0168.642] lstrlenW (lpString=".php4") returned 5
	[0168.642] lstrcmpiW (lpString1=".php4", lpString2="1.DLL") returned -1
	[0168.642] lstrlenW (lpString=".php5") returned 5
	[0168.642] lstrcmpiW (lpString1=".php5", lpString2="1.DLL") returned -1
	[0168.642] lstrlenW (lpString=".phtml") returned 6
	[0168.643] lstrcmpiW (lpString1=".phtml", lpString2="11.DLL") returned -1
	[0168.643] lstrlenW (lpString=".pict") returned 5
	[0168.643] lstrcmpiW (lpString1=".pict", lpString2="1.DLL") returned -1
	[0168.643] lstrlenW (lpString=".pl") returned 3
	[0168.643] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1
	[0168.643] lstrlenW (lpString=".pls") returned 4
	[0168.643] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1
	[0168.643] lstrlenW (lpString=".pm") returned 3
	[0168.643] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1
	[0168.643] lstrlenW (lpString=".png") returned 4
	[0168.643] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1
	[0168.643] lstrlenW (lpString=".pnm") returned 4
	[0168.643] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1
	[0168.643] lstrlenW (lpString=".pot") returned 4
	[0168.643] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1
	[0168.643] lstrlenW (lpString=".potm") returned 5
	[0168.643] lstrcmpiW (lpString1=".potm", lpString2="1.DLL") returned -1
	[0168.643] lstrlenW (lpString=".potx") returned 5
	[0168.643] lstrcmpiW (lpString1=".potx", lpString2="1.DLL") returned -1
	[0168.643] lstrlenW (lpString=".ppa") returned 4
	[0168.643] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1
	[0168.643] lstrlenW (lpString=".ppam") returned 5
	[0168.643] lstrcmpiW (lpString1=".ppam", lpString2="1.DLL") returned -1
	[0168.643] lstrlenW (lpString=".ppm") returned 4
	[0168.643] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1
	[0168.643] lstrlenW (lpString=".pps") returned 4
	[0168.643] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1
	[0168.643] lstrlenW (lpString=".ppsm") returned 5
	[0168.644] lstrcmpiW (lpString1=".ppsm", lpString2="1.DLL") returned -1
	[0168.644] lstrlenW (lpString=".ppt") returned 4
	[0168.644] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0168.644] lstrlenW (lpString=".pptm") returned 5
	[0168.644] lstrcmpiW (lpString1=".pptm", lpString2="1.DLL") returned -1
	[0168.644] lstrlenW (lpString=".pptx") returned 5
	[0168.644] lstrcmpiW (lpString1=".pptx", lpString2="1.DLL") returned -1
	[0168.644] lstrlenW (lpString=".prn") returned 4
	[0168.644] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1
	[0168.644] lstrlenW (lpString=".ps") returned 3
	[0168.644] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1
	[0168.644] lstrlenW (lpString=".psb") returned 4
	[0168.644] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1
	[0168.644] lstrlenW (lpString=".psd") returned 4
	[0168.644] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1
	[0168.644] lstrlenW (lpString=".pst") returned 4
	[0168.644] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1
	[0168.644] lstrlenW (lpString=".ptx") returned 4
	[0168.644] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1
	[0168.644] lstrlenW (lpString=".pub") returned 4
	[0168.644] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1
	[0168.644] lstrlenW (lpString=".pwm") returned 4
	[0168.644] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1
	[0168.644] lstrlenW (lpString=".pxr") returned 4
	[0168.644] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1
	[0168.644] lstrlenW (lpString=".py") returned 3
	[0168.644] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1
	[0168.644] lstrlenW (lpString=".qt") returned 3
	[0168.644] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1
	[0168.645] lstrlenW (lpString=".r3d") returned 4
	[0168.645] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1
	[0168.645] lstrlenW (lpString=".raf") returned 4
	[0168.645] lstrcmpiW (lpString1=".raf", lpString2=".DLL") returned 1
	[0168.645] lstrlenW (lpString=".rar") returned 4
	[0168.645] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0168.645] lstrlenW (lpString=".raw") returned 4
	[0168.645] lstrcmpiW (lpString1=".raw", lpString2=".DLL") returned 1
	[0168.645] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5196662, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc5196662, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd8c7380a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x55bef8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NL7MODELS0009.dll", cAlternateFileName="NL7MOD~1.DLL")) returned 1
	[0168.645] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5208c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc5208c8f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd97ecd84, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5dd8f8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NL7MODELS000A.dll", cAlternateFileName="NL7MOD~2.DLL")) returned 1
	[0168.645] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc527b37f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc527b37f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd928f97c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x546ef8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NL7MODELS000C.dll", cAlternateFileName="NL7MOD~3.DLL")) returned 1
	[0168.646] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c779d41, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6ad698, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NL7Models0011.DLL", cAlternateFileName="NL7MOD~4.DLL")) returned 1
	[0168.646] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2a40778, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2a40778, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2c7cb2a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa320, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NPSPWRAP.DLL", cAlternateFileName="")) returned 1
	[0168.646] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc34153d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd50d8964, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd52c882e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1165048, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OART.DLL", cAlternateFileName="")) returned 1
	[0168.646] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c79ffa0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3262b0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OARTODF.DLL", cAlternateFileName="")) returned 1
	[0168.647] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddd0ee4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddd0ee4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa3dba42, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x37c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OCHelper.dll", cAlternateFileName="")) returned 1
	[0168.647] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd41f54a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcd41f54a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdecb6a42, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x103668, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ocimport.dll", cAlternateFileName="")) returned 1
	[0168.647] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OCIntlDate.dll", cAlternateFileName="OCINTL~1.DLL")) returned 1
	[0168.647] lstrlenW (lpString="OCIntlDate.dll") returned 14
	[0168.647] lstrlenW (lpString=".1cd") returned 4
	[0168.647] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.647] lstrlenW (lpString=".3ds") returned 4
	[0168.647] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0168.647] lstrlenW (lpString=".3fr") returned 4
	[0168.648] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0168.648] lstrlenW (lpString=".3g2") returned 4
	[0168.648] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0168.648] lstrlenW (lpString=".3gp") returned 4
	[0168.648] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0168.648] lstrlenW (lpString=".7z") returned 3
	[0168.648] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.648] lstrlenW (lpString=".accda") returned 6
	[0168.648] lstrcmpiW (lpString1=".accda", lpString2="te.dll") returned -1
	[0168.648] lstrlenW (lpString=".accdb") returned 6
	[0168.648] lstrcmpiW (lpString1=".accdb", lpString2="te.dll") returned -1
	[0168.648] lstrlenW (lpString=".accdc") returned 6
	[0168.648] lstrcmpiW (lpString1=".accdc", lpString2="te.dll") returned -1
	[0168.648] lstrlenW (lpString=".accde") returned 6
	[0168.648] lstrcmpiW (lpString1=".accde", lpString2="te.dll") returned -1
	[0168.648] lstrlenW (lpString=".accdt") returned 6
	[0168.648] lstrcmpiW (lpString1=".accdt", lpString2="te.dll") returned -1
	[0168.648] lstrlenW (lpString=".accdw") returned 6
	[0168.648] lstrcmpiW (lpString1=".accdw", lpString2="te.dll") returned -1
	[0168.648] lstrlenW (lpString=".adb") returned 4
	[0168.648] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0168.648] lstrlenW (lpString=".adp") returned 4
	[0168.648] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0168.648] lstrlenW (lpString=".ai") returned 3
	[0168.648] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0168.649] lstrlenW (lpString=".ai3") returned 4
	[0168.649] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0168.649] lstrlenW (lpString=".ai4") returned 4
	[0168.649] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0168.649] lstrlenW (lpString=".ai5") returned 4
	[0168.649] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0168.649] lstrlenW (lpString=".ai6") returned 4
	[0168.649] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0168.649] lstrlenW (lpString=".ai7") returned 4
	[0168.649] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0168.649] lstrlenW (lpString=".ai8") returned 4
	[0168.649] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0168.649] lstrlenW (lpString=".anim") returned 5
	[0168.649] lstrcmpiW (lpString1=".anim", lpString2="e.dll") returned -1
	[0168.649] lstrlenW (lpString=".arw") returned 4
	[0168.649] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0168.649] lstrlenW (lpString=".as") returned 3
	[0168.649] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0168.649] lstrlenW (lpString=".asa") returned 4
	[0168.649] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0168.649] lstrlenW (lpString=".asc") returned 4
	[0168.649] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0168.649] lstrlenW (lpString=".ascx") returned 5
	[0168.649] lstrcmpiW (lpString1=".ascx", lpString2="e.dll") returned -1
	[0168.649] lstrlenW (lpString=".asm") returned 4
	[0168.649] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0168.649] lstrlenW (lpString=".asmx") returned 5
	[0168.649] lstrcmpiW (lpString1=".asmx", lpString2="e.dll") returned -1
	[0168.650] lstrlenW (lpString=".asp") returned 4
	[0168.650] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0168.650] lstrlenW (lpString=".aspx") returned 5
	[0168.650] lstrcmpiW (lpString1=".aspx", lpString2="e.dll") returned -1
	[0168.650] lstrlenW (lpString=".asr") returned 4
	[0168.650] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0168.650] lstrlenW (lpString=".asx") returned 4
	[0168.650] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0168.650] lstrlenW (lpString=".avi") returned 4
	[0168.650] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0168.650] lstrlenW (lpString=".avs") returned 4
	[0168.650] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0168.650] lstrlenW (lpString=".backup") returned 7
	[0168.650] lstrcmpiW (lpString1=".backup", lpString2="ate.dll") returned -1
	[0168.650] lstrlenW (lpString=".bak") returned 4
	[0168.650] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0168.650] lstrlenW (lpString=".bay") returned 4
	[0168.650] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0168.650] lstrlenW (lpString=".bd") returned 3
	[0168.650] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0168.650] lstrlenW (lpString=".bin") returned 4
	[0168.650] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0168.650] lstrlenW (lpString=".bmp") returned 4
	[0168.650] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0168.650] lstrlenW (lpString=".bz2") returned 4
	[0168.650] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.650] lstrlenW (lpString=".c") returned 2
	[0168.650] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0168.651] lstrlenW (lpString=".cdr") returned 4
	[0168.651] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0168.651] lstrlenW (lpString=".cer") returned 4
	[0168.651] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0168.651] lstrlenW (lpString=".cf") returned 3
	[0168.651] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0168.651] lstrlenW (lpString=".cfc") returned 4
	[0168.651] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0168.651] lstrlenW (lpString=".cfm") returned 4
	[0168.651] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0168.651] lstrlenW (lpString=".cfml") returned 5
	[0168.651] lstrcmpiW (lpString1=".cfml", lpString2="e.dll") returned -1
	[0168.651] lstrlenW (lpString=".cfu") returned 4
	[0168.651] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0168.651] lstrlenW (lpString=".chm") returned 4
	[0168.651] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0168.651] lstrlenW (lpString=".cin") returned 4
	[0168.651] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0168.651] lstrlenW (lpString=".class") returned 6
	[0168.651] lstrcmpiW (lpString1=".class", lpString2="te.dll") returned -1
	[0168.651] lstrlenW (lpString=".clx") returned 4
	[0168.651] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0168.651] lstrlenW (lpString=".config") returned 7
	[0168.651] lstrcmpiW (lpString1=".config", lpString2="ate.dll") returned -1
	[0168.651] lstrlenW (lpString=".cpp") returned 4
	[0168.651] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0168.651] lstrlenW (lpString=".cr2") returned 4
	[0168.651] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0168.651] lstrlenW (lpString=".crt") returned 4
	[0168.652] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".crw") returned 4
	[0168.652] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".cs") returned 3
	[0168.652] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0168.652] lstrlenW (lpString=".css") returned 4
	[0168.652] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".csv") returned 4
	[0168.652] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".cub") returned 4
	[0168.652] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".dae") returned 4
	[0168.652] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".dat") returned 4
	[0168.652] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".db") returned 3
	[0168.652] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0168.652] lstrlenW (lpString=".dbf") returned 4
	[0168.652] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".dbx") returned 4
	[0168.652] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".dc3") returned 4
	[0168.652] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".dcm") returned 4
	[0168.652] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".dcr") returned 4
	[0168.652] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0168.652] lstrlenW (lpString=".der") returned 4
	[0168.653] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0168.653] lstrlenW (lpString=".dib") returned 4
	[0168.653] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0168.653] lstrlenW (lpString=".dic") returned 4
	[0168.653] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0168.653] lstrlenW (lpString=".dif") returned 4
	[0168.653] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0168.653] lstrlenW (lpString=".divx") returned 5
	[0168.653] lstrcmpiW (lpString1=".divx", lpString2="e.dll") returned -1
	[0168.653] lstrlenW (lpString=".djvu") returned 5
	[0168.653] lstrcmpiW (lpString1=".djvu", lpString2="e.dll") returned -1
	[0168.653] lstrlenW (lpString=".dng") returned 4
	[0168.653] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0168.653] lstrlenW (lpString=".doc") returned 4
	[0168.653] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.653] lstrlenW (lpString=".docm") returned 5
	[0168.653] lstrcmpiW (lpString1=".docm", lpString2="e.dll") returned -1
	[0168.653] lstrlenW (lpString=".docx") returned 5
	[0168.653] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0168.653] lstrlenW (lpString=".dot") returned 4
	[0168.653] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0168.653] lstrlenW (lpString=".dotm") returned 5
	[0168.653] lstrcmpiW (lpString1=".dotm", lpString2="e.dll") returned -1
	[0168.653] lstrlenW (lpString=".dotx") returned 5
	[0168.653] lstrcmpiW (lpString1=".dotx", lpString2="e.dll") returned -1
	[0168.653] lstrlenW (lpString=".dpx") returned 4
	[0168.653] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0168.653] lstrlenW (lpString=".dqy") returned 4
	[0168.654] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0168.654] lstrlenW (lpString=".dsn") returned 4
	[0168.654] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0168.654] lstrlenW (lpString=".dt") returned 3
	[0168.654] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0168.654] lstrlenW (lpString=".dtd") returned 4
	[0168.654] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0168.654] lstrlenW (lpString=".dwg") returned 4
	[0168.654] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0168.654] lstrlenW (lpString=".dwt") returned 4
	[0168.654] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0168.654] lstrlenW (lpString=".dx") returned 3
	[0168.654] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0168.654] lstrlenW (lpString=".dxf") returned 4
	[0168.654] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0168.654] lstrlenW (lpString=".edml") returned 5
	[0168.654] lstrcmpiW (lpString1=".edml", lpString2="e.dll") returned -1
	[0168.654] lstrlenW (lpString=".efd") returned 4
	[0168.654] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0168.654] lstrlenW (lpString=".elf") returned 4
	[0168.654] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0168.654] lstrlenW (lpString=".emf") returned 4
	[0168.654] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0168.654] lstrlenW (lpString=".emz") returned 4
	[0168.654] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0168.654] lstrlenW (lpString=".epf") returned 4
	[0168.654] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0168.654] lstrlenW (lpString=".eps") returned 4
	[0168.654] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0168.655] lstrlenW (lpString=".epsf") returned 5
	[0168.655] lstrcmpiW (lpString1=".epsf", lpString2="e.dll") returned -1
	[0168.655] lstrlenW (lpString=".epsp") returned 5
	[0168.655] lstrcmpiW (lpString1=".epsp", lpString2="e.dll") returned -1
	[0168.655] lstrlenW (lpString=".erf") returned 4
	[0168.655] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0168.655] lstrlenW (lpString=".exr") returned 4
	[0168.655] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0168.655] lstrlenW (lpString=".f4v") returned 4
	[0168.655] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0168.655] lstrlenW (lpString=".fido") returned 5
	[0168.655] lstrcmpiW (lpString1=".fido", lpString2="e.dll") returned -1
	[0168.655] lstrlenW (lpString=".flm") returned 4
	[0168.655] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0168.655] lstrlenW (lpString=".flv") returned 4
	[0168.655] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0168.655] lstrlenW (lpString=".frm") returned 4
	[0168.655] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0168.655] lstrlenW (lpString=".fxg") returned 4
	[0168.655] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0168.655] lstrlenW (lpString=".geo") returned 4
	[0168.655] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0168.655] lstrlenW (lpString=".gif") returned 4
	[0168.655] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0168.655] lstrlenW (lpString=".grs") returned 4
	[0168.655] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0168.655] lstrlenW (lpString=".gz") returned 3
	[0168.655] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0168.656] lstrlenW (lpString=".h") returned 2
	[0168.656] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0168.656] lstrlenW (lpString=".hdr") returned 4
	[0168.656] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0168.656] lstrlenW (lpString=".hpp") returned 4
	[0168.656] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0168.656] lstrlenW (lpString=".hta") returned 4
	[0168.656] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0168.656] lstrlenW (lpString=".htc") returned 4
	[0168.656] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0168.656] lstrlenW (lpString=".htm") returned 4
	[0168.656] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0168.656] lstrlenW (lpString=".html") returned 5
	[0168.656] lstrcmpiW (lpString1=".html", lpString2="e.dll") returned -1
	[0168.656] lstrlenW (lpString=".icb") returned 4
	[0168.656] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0168.656] lstrlenW (lpString=".ics") returned 4
	[0168.656] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0168.656] lstrlenW (lpString=".iff") returned 4
	[0168.656] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0168.656] lstrlenW (lpString=".inc") returned 4
	[0168.656] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0168.656] lstrlenW (lpString=".indd") returned 5
	[0168.656] lstrcmpiW (lpString1=".indd", lpString2="e.dll") returned -1
	[0168.656] lstrlenW (lpString=".ini") returned 4
	[0168.657] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0168.657] lstrlenW (lpString=".iqy") returned 4
	[0168.657] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0168.657] lstrlenW (lpString=".j2c") returned 4
	[0168.657] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0168.657] lstrlenW (lpString=".j2k") returned 4
	[0168.657] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0168.657] lstrlenW (lpString=".java") returned 5
	[0168.657] lstrcmpiW (lpString1=".java", lpString2="e.dll") returned -1
	[0168.657] lstrlenW (lpString=".jp2") returned 4
	[0168.657] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0168.657] lstrlenW (lpString=".jpc") returned 4
	[0168.657] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0168.657] lstrlenW (lpString=".jpe") returned 4
	[0168.657] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0168.657] lstrlenW (lpString=".jpeg") returned 5
	[0168.657] lstrcmpiW (lpString1=".jpeg", lpString2="e.dll") returned -1
	[0168.657] lstrlenW (lpString=".jpf") returned 4
	[0168.657] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0168.657] lstrlenW (lpString=".jpg") returned 4
	[0168.657] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.657] lstrlenW (lpString=".jpx") returned 4
	[0168.657] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0168.657] lstrlenW (lpString=".js") returned 3
	[0168.657] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0168.657] lstrlenW (lpString=".jsf") returned 4
	[0168.657] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0168.657] lstrlenW (lpString=".json") returned 5
	[0168.658] lstrcmpiW (lpString1=".json", lpString2="e.dll") returned -1
	[0168.658] lstrlenW (lpString=".jsp") returned 4
	[0168.658] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0168.658] lstrlenW (lpString=".kdc") returned 4
	[0168.658] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0168.658] lstrlenW (lpString=".kmz") returned 4
	[0168.658] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0168.658] lstrlenW (lpString=".kwm") returned 4
	[0168.658] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0168.658] lstrlenW (lpString=".lasso") returned 6
	[0168.658] lstrcmpiW (lpString1=".lasso", lpString2="te.dll") returned -1
	[0168.658] lstrlenW (lpString=".lbi") returned 4
	[0168.658] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0168.658] lstrlenW (lpString=".lgf") returned 4
	[0168.658] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0168.658] lstrlenW (lpString=".lgp") returned 4
	[0168.658] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0168.658] lstrlenW (lpString=".log") returned 4
	[0168.658] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0168.658] lstrlenW (lpString=".m1v") returned 4
	[0168.658] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0168.658] lstrlenW (lpString=".m4a") returned 4
	[0168.658] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0168.658] lstrlenW (lpString=".m4v") returned 4
	[0168.658] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0168.659] lstrlenW (lpString=".max") returned 4
	[0168.659] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0168.659] lstrlenW (lpString=".md") returned 3
	[0168.659] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0168.659] lstrlenW (lpString=".mda") returned 4
	[0168.659] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0168.659] lstrlenW (lpString=".mdb") returned 4
	[0168.659] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0168.659] lstrlenW (lpString=".mde") returned 4
	[0168.659] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0168.659] lstrlenW (lpString=".mdf") returned 4
	[0168.659] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0168.659] lstrlenW (lpString=".mdw") returned 4
	[0168.659] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0168.659] lstrlenW (lpString=".mef") returned 4
	[0168.659] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0168.659] lstrlenW (lpString=".mft") returned 4
	[0168.659] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0168.659] lstrlenW (lpString=".mfw") returned 4
	[0168.659] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0168.659] lstrlenW (lpString=".mht") returned 4
	[0168.659] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0168.659] lstrlenW (lpString=".mhtml") returned 6
	[0168.659] lstrcmpiW (lpString1=".mhtml", lpString2="te.dll") returned -1
	[0168.659] lstrlenW (lpString=".mka") returned 4
	[0168.659] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".mkidx") returned 6
	[0168.660] lstrcmpiW (lpString1=".mkidx", lpString2="te.dll") returned -1
	[0168.660] lstrlenW (lpString=".mkv") returned 4
	[0168.660] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".mos") returned 4
	[0168.660] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".mov") returned 4
	[0168.660] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".mp3") returned 4
	[0168.660] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".mp4") returned 4
	[0168.660] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".mpeg") returned 5
	[0168.660] lstrcmpiW (lpString1=".mpeg", lpString2="e.dll") returned -1
	[0168.660] lstrlenW (lpString=".mpg") returned 4
	[0168.660] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".mpv") returned 4
	[0168.660] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".mrw") returned 4
	[0168.660] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".msg") returned 4
	[0168.660] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".mxl") returned 4
	[0168.660] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".myd") returned 4
	[0168.660] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".myi") returned 4
	[0168.660] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0168.660] lstrlenW (lpString=".nef") returned 4
	[0168.661] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0168.661] lstrlenW (lpString=".nrw") returned 4
	[0168.661] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0168.661] lstrlenW (lpString=".obj") returned 4
	[0168.661] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0168.661] lstrlenW (lpString=".odb") returned 4
	[0168.661] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0168.661] lstrlenW (lpString=".odc") returned 4
	[0168.661] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0168.661] lstrlenW (lpString=".odm") returned 4
	[0168.661] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0168.661] lstrlenW (lpString=".odp") returned 4
	[0168.661] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0168.661] lstrlenW (lpString=".ods") returned 4
	[0168.661] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0168.661] lstrlenW (lpString=".oft") returned 4
	[0168.661] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0168.661] lstrlenW (lpString=".one") returned 4
	[0168.661] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0168.661] lstrlenW (lpString=".onepkg") returned 7
	[0168.661] lstrcmpiW (lpString1=".onepkg", lpString2="ate.dll") returned -1
	[0168.661] lstrlenW (lpString=".onetoc2") returned 8
	[0168.661] lstrcmpiW (lpString1=".onetoc2", lpString2="Date.dll") returned -1
	[0168.661] lstrlenW (lpString=".opt") returned 4
	[0168.661] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0168.661] lstrlenW (lpString=".oqy") returned 4
	[0168.662] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".orf") returned 4
	[0168.662] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".p12") returned 4
	[0168.662] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".p7b") returned 4
	[0168.662] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".p7c") returned 4
	[0168.662] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".pam") returned 4
	[0168.662] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".pbm") returned 4
	[0168.662] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".pct") returned 4
	[0168.662] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".pcx") returned 4
	[0168.662] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".pdd") returned 4
	[0168.662] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".pdf") returned 4
	[0168.662] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".pdp") returned 4
	[0168.662] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".pef") returned 4
	[0168.662] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0168.662] lstrlenW (lpString=".pem") returned 4
	[0168.662] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0168.663] lstrlenW (lpString=".pff") returned 4
	[0168.663] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0168.663] lstrlenW (lpString=".pfm") returned 4
	[0168.663] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0168.663] lstrlenW (lpString=".pfx") returned 4
	[0168.663] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0168.663] lstrlenW (lpString=".pgm") returned 4
	[0168.663] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0168.663] lstrlenW (lpString=".php") returned 4
	[0168.663] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0168.663] lstrlenW (lpString=".php3") returned 5
	[0168.663] lstrcmpiW (lpString1=".php3", lpString2="e.dll") returned -1
	[0168.663] lstrlenW (lpString=".php4") returned 5
	[0168.663] lstrcmpiW (lpString1=".php4", lpString2="e.dll") returned -1
	[0168.663] lstrlenW (lpString=".php5") returned 5
	[0168.663] lstrcmpiW (lpString1=".php5", lpString2="e.dll") returned -1
	[0168.663] lstrlenW (lpString=".phtml") returned 6
	[0168.663] lstrcmpiW (lpString1=".phtml", lpString2="te.dll") returned -1
	[0168.663] lstrlenW (lpString=".pict") returned 5
	[0168.663] lstrcmpiW (lpString1=".pict", lpString2="e.dll") returned -1
	[0168.663] lstrlenW (lpString=".pl") returned 3
	[0168.663] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0168.663] lstrlenW (lpString=".pls") returned 4
	[0168.663] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0168.663] lstrlenW (lpString=".pm") returned 3
	[0168.664] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0168.664] lstrlenW (lpString=".png") returned 4
	[0168.664] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0168.664] lstrlenW (lpString=".pnm") returned 4
	[0168.664] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0168.664] lstrlenW (lpString=".pot") returned 4
	[0168.664] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0168.664] lstrlenW (lpString=".potm") returned 5
	[0168.664] lstrcmpiW (lpString1=".potm", lpString2="e.dll") returned -1
	[0168.664] lstrlenW (lpString=".potx") returned 5
	[0168.664] lstrcmpiW (lpString1=".potx", lpString2="e.dll") returned -1
	[0168.664] lstrlenW (lpString=".ppa") returned 4
	[0168.664] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0168.664] lstrlenW (lpString=".ppam") returned 5
	[0168.664] lstrcmpiW (lpString1=".ppam", lpString2="e.dll") returned -1
	[0168.664] lstrlenW (lpString=".ppm") returned 4
	[0168.664] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0168.664] lstrlenW (lpString=".pps") returned 4
	[0168.664] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0168.664] lstrlenW (lpString=".ppsm") returned 5
	[0168.664] lstrcmpiW (lpString1=".ppsm", lpString2="e.dll") returned -1
	[0168.664] lstrlenW (lpString=".ppt") returned 4
	[0168.664] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.664] lstrlenW (lpString=".pptm") returned 5
	[0168.664] lstrcmpiW (lpString1=".pptm", lpString2="e.dll") returned -1
	[0168.664] lstrlenW (lpString=".pptx") returned 5
	[0168.664] lstrcmpiW (lpString1=".pptx", lpString2="e.dll") returned -1
	[0168.664] lstrlenW (lpString=".prn") returned 4
	[0168.665] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0168.665] lstrlenW (lpString=".ps") returned 3
	[0168.665] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0168.665] lstrlenW (lpString=".psb") returned 4
	[0168.665] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0168.665] lstrlenW (lpString=".psd") returned 4
	[0168.665] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0168.665] lstrlenW (lpString=".pst") returned 4
	[0168.665] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0168.665] lstrlenW (lpString=".ptx") returned 4
	[0168.665] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0168.665] lstrlenW (lpString=".pub") returned 4
	[0168.665] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0168.665] lstrlenW (lpString=".pwm") returned 4
	[0168.665] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0168.665] lstrlenW (lpString=".pxr") returned 4
	[0168.665] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0168.665] lstrlenW (lpString=".py") returned 3
	[0168.665] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0168.665] lstrlenW (lpString=".qt") returned 3
	[0168.665] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0168.665] lstrlenW (lpString=".r3d") returned 4
	[0168.665] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0168.665] lstrlenW (lpString=".raf") returned 4
	[0168.665] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0168.665] lstrlenW (lpString=".rar") returned 4
	[0168.665] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.665] lstrlenW (lpString=".raw") returned 4
	[0168.666] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0168.669] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c7ec45a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10c6b0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ocmsptls.dll", cAlternateFileName="")) returned 1
	[0168.670] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c7c61f2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9c848, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OcOffice.dll", cAlternateFileName="")) returned 1
	[0168.670] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c8126b0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f74a8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ocogl.dll", cAlternateFileName="")) returned 1
	[0168.670] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c8126b0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15956, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Ocomprivate.zip", cAlternateFileName="OCOMPR~1.ZIP")) returned 1
	[0168.670] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c8126b0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x247ab8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ocpptview.dll", cAlternateFileName="OCPPTV~1.DLL")) returned 1
	[0168.670] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c838905, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x55cc0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ocppvwintl.dll", cAlternateFileName="OCPPVW~1.DLL")) returned 1
	[0168.671] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed3aee76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3aee76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda6387a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1e06d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OcPubMgr.exe", cAlternateFileName="")) returned 1
	[0168.671] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd41f54a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcd41f54a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdecb6a42, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xdaaa8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ocrec.dll", cAlternateFileName="")) returned 1
	[0168.671] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c838905, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4a6b0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OCSAEXT.dll", cAlternateFileName="")) returned 1
	[0168.671] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb9038f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13ac0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OFFRHD.DLL", cAlternateFileName="")) returned 1
	[0168.671] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x607cb8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OIMG.DLL", cAlternateFileName="")) returned 1
	[0168.672] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x40c60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1
	[0168.672] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca4703d4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca829e1e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb11bbad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63d2c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OLMAPI32.DLL", cAlternateFileName="")) returned 1
	[0168.913] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x172bc, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OMML2MML.XSL", cAlternateFileName="")) returned 1
	[0168.914] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2ec8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OMSMAIN.DLL", cAlternateFileName="")) returned 1
	[0168.914] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x53ad8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OMSXP32.DLL", cAlternateFileName="")) returned 1
	[0168.914] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39078, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1
	[0168.914] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x316d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1
	[0168.914] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca57b43c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca57b43c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb0cf768, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9de60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONBttnOL.dll", cAlternateFileName="")) returned 1
	[0168.914] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6164f96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x376c8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONBttnPPT.dll", cAlternateFileName="ONBTTN~2.DLL")) returned 1
	[0168.915] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x54ef2e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x37c58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONBttnWD.dll", cAlternateFileName="")) returned 1
	[0168.915] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1c8ab024, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OneNote", cAlternateFileName="")) returned 1
	[0168.915] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x454d000
	[0168.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\*", lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1c8ab024, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e70630
	[0168.917] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1c8ab024, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0168.917] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c884dc0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c884dc0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prnms006.inf", cAlternateFileName="")) returned 1
	[0168.917] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c884dc0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c884dc0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prnSendToOneNote.cat", cAlternateFileName="PRNSEN~2.CAT")) returned 1
	[0168.917] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c884dc0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c884dc0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x265e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prnSendToOneNote_win7.cat", cAlternateFileName="PRNSEN~1.CAT")) returned 1
	[0168.918] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c884dc0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c884dc0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prnSendToOneNote_win7.inf", cAlternateFileName="PRNSEN~1.INF")) returned 1
	[0168.918] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c884dc0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c884dc0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SendToOneNote-manifest.ini", cAlternateFileName="SENDTO~1.INI")) returned 1
	[0168.918] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c884dc0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c884dc0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SendToOneNote-PipelineConfig.xml", cAlternateFileName="SENDTO~1.XML")) returned 1
	[0168.918] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c884dc0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c884dc0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SendToOneNote.gpd", cAlternateFileName="SENDTO~1.GPD")) returned 1
	[0168.918] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c8ab024, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c8ab024, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SendToOneNote.ini", cAlternateFileName="SENDTO~2.INI")) returned 1
	[0168.918] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x180d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SendToOneNoteFilter.dll", cAlternateFileName="SENDTO~1.DLL")) returned 1
	[0168.919] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c8ab024, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c8ab024, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SendToOneNoteNames.gpd", cAlternateFileName="SENDTO~2.GPD")) returned 1
	[0168.919] FindNextFileW (in: hFindFile=0x3e70630, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c8ab024, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c8ab024, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SendToOneNoteNames.gpd", cAlternateFileName="SENDTO~2.GPD")) returned 0
	[0168.919] FindClose (in: hFindFile=0x3e70630 | out: hFindFile=0x3e70630) returned 1
	[0168.920] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0168.920] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4ae41a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdb652e29, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcec30aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205e48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1
	[0168.920] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c884dc0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTE.VisualElementsManifest.xml", cAlternateFileName="ONENOT~1.XML")) returned 1
	[0168.920] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4fa8f4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcb4fa8f4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcb4fa8f4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2a0b0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTEM.EXE", cAlternateFileName="")) returned 1
	[0168.920] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x313650, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONFILTER.DLL", cAlternateFileName="")) returned 1
	[0168.920] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4cd4a32, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19a88, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1
	[0168.921] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4d4679, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdc4086cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4f6fc9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xed9050, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONMAIN.DLL", cAlternateFileName="")) returned 1
	[0168.921] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x605aed7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b6c8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONPPTAddin.dll", cAlternateFileName="ONPPTA~1.DLL")) returned 1
	[0168.921] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb7f57ea, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcb7f57ea, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd01a5a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8dbe58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONRES.DLL", cAlternateFileName="")) returned 1
	[0168.921] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c858, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONWordAddin.dll", cAlternateFileName="ONWORD~1.DLL")) returned 1
	[0168.921] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4ebdfb8, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x1bbad0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ORGCHART.DLL", cAlternateFileName="")) returned 1
	[0168.922] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd42039, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa4690, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ORGCHART.EXE", cAlternateFileName="")) returned 1
	[0168.922] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4ee42e7, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xacac8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ORGCHWIZ.DLL", cAlternateFileName="")) returned 1
	[0168.922] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1702fda, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1702fda, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x174f451, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x32ad8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ORGWIZ.EXE", cAlternateFileName="")) returned 1
	[0168.922] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c8d1261, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1938c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OSF.DLL", cAlternateFileName="")) returned 1
	[0168.922] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd29ce0e8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd29ce0e8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b4b84a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa060, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OSFPROXY.DLL", cAlternateFileName="")) returned 1
	[0168.922] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa060, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OSFROAMINGPROXY.DLL", cAlternateFileName="OSFROA~1.DLL")) returned 1
	[0168.923] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x308c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OSFSHARED.DLL", cAlternateFileName="OSFSHA~1.DLL")) returned 1
	[0168.923] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x77060, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OSFUI.DLL", cAlternateFileName="")) returned 1
	[0168.923] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca57b43c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca57b43c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca5a1676, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c4a8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLCTL.DLL", cAlternateFileName="")) returned 1
	[0168.923] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x380000, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLFLTR.DAT", cAlternateFileName="")) returned 1
	[0168.923] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xab940, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLFLTR.DLL", cAlternateFileName="")) returned 1
	[0168.923] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbce68, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLMIME.DLL", cAlternateFileName="")) returned 1
	[0168.924] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca57b43c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xda982389, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcec30aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x212b448, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLOOK.EXE", cAlternateFileName="")) returned 1
	[0168.924] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca850099, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca850099, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca850099, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x740, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLOOK.EXE.MANIFEST", cAlternateFileName="OUTLOO~1.MAN")) returned 1
	[0168.924] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1c91d744, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLOOK.VisualElementsManifest.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1
	[0168.924] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc86400, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc86400, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OutlookAutoDiscover", cAlternateFileName="OUTLOO~1")) returned 1
	[0168.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x454d000
	[0168.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\*", lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc86400, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc86400, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e700b0
	[0168.925] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc86400, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc86400, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0168.925] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c91d744, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c91d744, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c91d744, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1
	[0168.925] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c91d744, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c91d744, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c91d744, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BTINTERNET.NET.XML", cAlternateFileName="BTINTE~1.XML")) returned 1
	[0168.926] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c91d744, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c91d744, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c91d744, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BTOPENWORLD.COM.XML", cAlternateFileName="BTOPEN~1.XML")) returned 1
	[0168.926] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c91d744, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c91d744, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c91d744, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FLASH.NET.XML", cAlternateFileName="FLASHN~1.XML")) returned 1
	[0168.926] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c969bd6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c969bd6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c969bd6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GMAIL.COM.XML", cAlternateFileName="GMAILC~1.XML")) returned 1
	[0168.927] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c943977, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c943977, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NL.ROGERS.COM.XML", cAlternateFileName="NLROGE~1.XML")) returned 1
	[0168.927] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c943977, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c943977, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NVBELL.NET.XML", cAlternateFileName="NVBELL~1.XML")) returned 1
	[0168.927] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c943977, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c943977, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PACBELL.NET.XML", cAlternateFileName="PACBEL~1.XML")) returned 1
	[0168.927] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c943977, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c943977, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRODIGY.NET.XML", cAlternateFileName="PRODIG~1.XML")) returned 1
	[0168.927] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c943977, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c943977, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ROGERS.COM.XML", cAlternateFileName="ROGERS~1.XML")) returned 1
	[0168.928] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c943977, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c943977, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SBCGLOBAL.NET.XML", cAlternateFileName="SBCGLO~1.XML")) returned 1
	[0168.928] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c943977, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c943977, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SNET.NET.XML", cAlternateFileName="SNETNE~1.XML")) returned 1
	[0168.928] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c943977, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c943977, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SWBELL.NET.XML", cAlternateFileName="SWBELL~1.XML")) returned 1
	[0168.928] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c943977, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c943977, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c943977, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TALK21.COM.XML", cAlternateFileName="TALK21~1.XML")) returned 1
	[0168.928] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d33f7b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d33f7b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d33f7b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WANS.NET.XML", cAlternateFileName="WANSNE~1.XML")) returned 1
	[0168.928] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c969bd6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c969bd6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c98fe3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.CA.XML", cAlternateFileName="YA4C16~1.XML")) returned 1
	[0168.929] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d33f7b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d33f7b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d33f7b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.CO.ID.XML", cAlternateFileName="YA6C44~1.XML")) returned 1
	[0168.929] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c969bd6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c969bd6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c969bd6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.CO.IN.XML", cAlternateFileName="YA8E91~1.XML")) returned 1
	[0168.929] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c969bd6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c969bd6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c969bd6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.CO.JP.XML", cAlternateFileName="YA40E5~1.XML")) returned 1
	[0168.929] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c969bd6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c969bd6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c969bd6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.CO.KR.XML", cAlternateFileName="YAHOOC~4.XML")) returned 1
	[0168.929] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c969bd6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c969bd6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c969bd6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.CO.NZ.XML", cAlternateFileName="YAHOOC~1.XML")) returned 1
	[0168.929] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c969bd6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c969bd6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c969bd6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.CO.TH.XML", cAlternateFileName="YACB7D~1.XML")) returned 1
	[0168.929] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c969bd6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c969bd6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c969bd6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.CO.UK.XML", cAlternateFileName="YAHOOC~3.XML")) returned 1
	[0168.929] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c969bd6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c969bd6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c969bd6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.AR.XML", cAlternateFileName="YAHOOC~2.XML")) returned 1
	[0168.930] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c98fe3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c98fe3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c98fe3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.AU.XML", cAlternateFileName="YA02CD~1.XML")) returned 1
	[0168.930] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d2f32c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d2f32c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.BR.XML", cAlternateFileName="YA6DAE~1.XML")) returned 1
	[0168.930] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c98fe3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c98fe3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.CN.XML", cAlternateFileName="YA819F~1.XML")) returned 1
	[0168.930] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c98fe3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c98fe3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.HK.XML", cAlternateFileName="YA56AC~1.XML")) returned 1
	[0168.930] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c969bd6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c969bd6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c98fe3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.MX.XML", cAlternateFileName="YAEA08~1.XML")) returned 1
	[0168.930] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c98fe3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c98fe3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c98fe3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.MY.XML", cAlternateFileName="YA0670~1.XML")) returned 1
	[0168.931] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.PH.XML", cAlternateFileName="YA6D1B~1.XML")) returned 1
	[0168.931] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c98fe3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c98fe3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c98fe3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.SG.XML", cAlternateFileName="YAC50A~1.XML")) returned 1
	[0168.931] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c969bd6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c969bd6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c98fe3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.TW.XML", cAlternateFileName="YAB0F6~1.XML")) returned 1
	[0168.931] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c98fe3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c98fe3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.VN.XML", cAlternateFileName="YA38FD~1.XML")) returned 1
	[0168.931] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1fc39fa2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1fc39fa2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc6021a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.COM.XML", cAlternateFileName="YA531A~1.XML")) returned 1
	[0168.931] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1fc86400, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1fc86400, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc86400, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.DE.XML", cAlternateFileName="YAHOOD~1.XML")) returned 1
	[0168.931] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c98fe3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c98fe3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.ES.XML", cAlternateFileName="YAHOOE~1.XML")) returned 1
	[0168.932] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c9b60b5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c9b60b5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.FR.XML", cAlternateFileName="YAHOOF~1.XML")) returned 1
	[0168.932] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c9b60b5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c9b60b5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9dc2d6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.HK.XML", cAlternateFileName="YAHOOH~1.XML")) returned 1
	[0168.932] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c9b60b5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c9b60b5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.IE.XML", cAlternateFileName="YAHOOI~2.XML")) returned 1
	[0168.932] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c9b60b5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c9b60b5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.IT.XML", cAlternateFileName="YAHOOI~1.XML")) returned 1
	[0168.932] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c9b60b5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c9b60b5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x331, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.JP.XML", cAlternateFileName="YAHOOJ~1.XML")) returned 1
	[0168.932] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c9b60b5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c9b60b5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.NO.XML", cAlternateFileName="YAHOON~1.XML")) returned 1
	[0168.932] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c98fe3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c98fe3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.PL.XML", cAlternateFileName="YAHOOP~1.XML")) returned 1
	[0168.932] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.SE.XML", cAlternateFileName="YAHOOS~1.XML")) returned 1
	[0168.933] FindNextFileW (in: hFindFile=0x3e700b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YAHOO.SE.XML", cAlternateFileName="YAHOOS~1.XML")) returned 0
	[0168.933] FindClose (in: hFindFile=0x3e700b0 | out: hFindFile=0x3e700b0) returned 1
	[0168.933] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0168.933] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x656d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1
	[0168.934] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb438, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLRPC.DLL", cAlternateFileName="")) returned 1
	[0168.934] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x146b8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLVBS.DLL", cAlternateFileName="")) returned 1
	[0168.934] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2981bec, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2981bec, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2a8cc4b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29f6c8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OWSSUPP.DLL", cAlternateFileName="")) returned 1
	[0168.934] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc348b22, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc39fa2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc39fa2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PAGESIZE", cAlternateFileName="")) returned 1
	[0168.934] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x454d000
	[0168.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\*", lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc348b22, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc39fa2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc39fa2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e703b0
	[0168.935] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc348b22, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc39fa2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc39fa2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0168.935] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc348b22, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc348b22, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc3bb225, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1
	[0168.935] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c9b60b5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c9b60b5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15b1fa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL002.XML", cAlternateFileName="")) returned 1
	[0168.936] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d2f32c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d2f32c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d2f32c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3562e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL010.XML", cAlternateFileName="")) returned 1
	[0168.936] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c9b60b5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1c9b60b5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c9b60b5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1390, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL011.XML", cAlternateFileName="")) returned 1
	[0168.936] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcb89a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL012.XML", cAlternateFileName="")) returned 1
	[0168.936] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22cf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL016.XML", cAlternateFileName="")) returned 1
	[0168.936] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d2f32c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d2f32c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d2f32c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x101bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL020.XML", cAlternateFileName="")) returned 1
	[0168.936] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24c9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL022.XML", cAlternateFileName="")) returned 1
	[0168.936] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f4e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL026.XML", cAlternateFileName="")) returned 1
	[0168.937] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d2f32c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d2f32c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a3e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL027.XML", cAlternateFileName="")) returned 1
	[0168.937] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d2f32c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d2f32c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d2f32c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x266a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL044.XML", cAlternateFileName="")) returned 1
	[0168.937] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7457f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x104bba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL048.XML", cAlternateFileName="")) returned 1
	[0168.937] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x59f76, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL054.XML", cAlternateFileName="")) returned 1
	[0168.937] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x26c44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL058.XML", cAlternateFileName="")) returned 1
	[0168.937] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d33f7b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8e394, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL065.XML", cAlternateFileName="")) returned 1
	[0168.937] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d33f7b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d33f7b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d33f7b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xacb30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL075.XML", cAlternateFileName="")) returned 1
	[0168.937] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d33f7b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d33f7b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d33f7b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6134, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL077.XML", cAlternateFileName="")) returned 1
	[0168.938] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d319566, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d319566, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d33f7b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x753, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL078.XML", cAlternateFileName="")) returned 1
	[0168.938] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d33f7b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d33f7b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc39fa2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcffca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL081.XML", cAlternateFileName="")) returned 1
	[0168.938] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1fc13dfb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1fc13dfb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc86400, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x38d3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL082.XML", cAlternateFileName="")) returned 1
	[0168.938] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1f09a814, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1f09a814, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc13dfb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8cda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL083.XML", cAlternateFileName="")) returned 1
	[0168.938] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d3659fb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d3659fb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d3659fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa88e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL086.XML", cAlternateFileName="")) returned 1
	[0168.938] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d33f7b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d33f7b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d33f7b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL087.XML", cAlternateFileName="")) returned 1
	[0168.939] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d33f7b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d33f7b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d3659fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb532, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL089.XML", cAlternateFileName="")) returned 1
	[0168.939] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d33f7b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d33f7b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d3659fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1aaea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL090.XML", cAlternateFileName="")) returned 1
	[0168.939] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d3659fb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d3659fb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7b7e3f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19a22, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL092.XML", cAlternateFileName="")) returned 1
	[0168.939] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d33f7b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d33f7b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d3659fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb3da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL093.XML", cAlternateFileName="")) returned 1
	[0168.939] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1f0c0a66, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1f0c0a66, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc39fa2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3ccc2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL095.XML", cAlternateFileName="")) returned 1
	[0168.939] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d3659fb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d3659fb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d3659fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a58e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL096.XML", cAlternateFileName="")) returned 1
	[0168.939] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d3659fb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d3659fb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7b7e3f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x80ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL097.XML", cAlternateFileName="")) returned 1
	[0168.939] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d3659fb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d3659fb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d3659fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe730, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL102.XML", cAlternateFileName="")) returned 1
	[0168.940] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d3659fb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d3659fb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5a1d84, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27aee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL103.XML", cAlternateFileName="")) returned 1
	[0168.940] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d3659fb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d3659fb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7b7e3f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL104.XML", cAlternateFileName="")) returned 1
	[0168.940] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d3659fb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d3659fb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5a1d84, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x23124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL105.XML", cAlternateFileName="")) returned 1
	[0168.940] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d3659fb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d3659fb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d3659fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9ae4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL106.XML", cAlternateFileName="")) returned 1
	[0168.940] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d3659fb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d3659fb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d3659fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d5c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL107.XML", cAlternateFileName="")) returned 1
	[0168.940] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5a1d84, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5a1d84, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5a1d84, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2dbec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL108.XML", cAlternateFileName="")) returned 1
	[0168.941] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5a1d84, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5a1d84, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5a1d84, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL109.XML", cAlternateFileName="")) returned 1
	[0168.941] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5a1d84, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5a1d84, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7457f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcdbee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL110.XML", cAlternateFileName="")) returned 1
	[0168.941] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d3659fb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d3659fb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc39fa2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x40198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL111.XML", cAlternateFileName="")) returned 1
	[0168.941] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5a1d84, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5a1d84, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5a1d84, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x789e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL112.XML", cAlternateFileName="")) returned 1
	[0168.941] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1fc39fa2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1fc39fa2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc39fa2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e08a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL115.XML", cAlternateFileName="")) returned 1
	[0168.941] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d791bfc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7b7e3f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x169ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL116.XML", cAlternateFileName="")) returned 1
	[0168.941] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5c7ff6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5c7ff6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5c7ff6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x412c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL117.XML", cAlternateFileName="")) returned 1
	[0168.941] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5c7ff6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5c7ff6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5c7ff6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2763a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL118.XML", cAlternateFileName="")) returned 1
	[0168.942] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5c7ff6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5c7ff6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5c7ff6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa002, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL119.XML", cAlternateFileName="")) returned 1
	[0168.942] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5c7ff6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5c7ff6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5c7ff6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGLBL120.XML", cAlternateFileName="")) returned 1
	[0168.942] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc348b22, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc348b22, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc68ff65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2247e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN001.XML", cAlternateFileName="")) returned 1
	[0168.942] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5a1d84, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5a1d84, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5c7ff6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xeb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN002.XML", cAlternateFileName="")) returned 1
	[0168.942] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5a1d84, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5a1d84, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5c7ff6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN010.XML", cAlternateFileName="")) returned 1
	[0168.942] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5a1d84, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5a1d84, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5c7ff6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe2d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN011.XML", cAlternateFileName="")) returned 1
	[0168.942] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5a1d84, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5a1d84, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5c7ff6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2936, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN020.XML", cAlternateFileName="")) returned 1
	[0168.943] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d7457f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d7457f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7b7e3f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x167d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN022.XML", cAlternateFileName="")) returned 1
	[0168.943] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5ee242, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5ee242, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7457f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN026.XML", cAlternateFileName="")) returned 1
	[0168.943] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5ee242, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5ee242, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5ee242, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN027.XML", cAlternateFileName="")) returned 1
	[0168.943] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5c7ff6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5c7ff6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7457f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN044.XML", cAlternateFileName="")) returned 1
	[0168.943] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5c7ff6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5c7ff6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5c7ff6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xae7d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN048.XML", cAlternateFileName="")) returned 1
	[0168.943] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5c7ff6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5c7ff6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5ee242, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN054.XML", cAlternateFileName="")) returned 1
	[0168.943] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5c7ff6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5c7ff6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5ee242, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN058.XML", cAlternateFileName="")) returned 1
	[0168.943] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d5c7ff6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d5c7ff6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5c7ff6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbb8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN065.XML", cAlternateFileName="")) returned 1
	[0168.944] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d7457f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d7457f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d76b9e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9ff4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN075.XML", cAlternateFileName="")) returned 1
	[0168.944] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d7457f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d7457f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d76b9e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdbdc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN081.XML", cAlternateFileName="")) returned 1
	[0168.944] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d7457f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d7457f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7457f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x31a78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN082.XML", cAlternateFileName="")) returned 1
	[0168.944] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d7457f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d7457f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d76b9e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN086.XML", cAlternateFileName="")) returned 1
	[0168.944] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1f001f8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1f001f8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1f001f8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN089.XML", cAlternateFileName="")) returned 1
	[0168.944] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d7457f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d7457f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7457f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN090.XML", cAlternateFileName="")) returned 1
	[0168.944] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d7457f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d7457f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7457f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb76, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN092.XML", cAlternateFileName="")) returned 1
	[0168.945] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d791bfc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7b7e3f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN095.XML", cAlternateFileName="")) returned 1
	[0168.945] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d76b9e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d76b9e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7b7e3f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN096.XML", cAlternateFileName="")) returned 1
	[0168.945] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d76b9e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d76b9e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7b7e3f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11424, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN097.XML", cAlternateFileName="")) returned 1
	[0168.945] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d76b9e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d76b9e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7b7e3f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN102.XML", cAlternateFileName="")) returned 1
	[0168.945] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d76b9e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d76b9e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d791bfc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN103.XML", cAlternateFileName="")) returned 1
	[0168.945] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d76b9e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d76b9e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d76b9e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb66, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN105.XML", cAlternateFileName="")) returned 1
	[0168.945] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d76b9e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d76b9e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d791bfc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN107.XML", cAlternateFileName="")) returned 1
	[0168.946] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d76b9e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d76b9e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d76b9e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN108.XML", cAlternateFileName="")) returned 1
	[0168.946] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d76b9e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d76b9e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d76b9e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN109.XML", cAlternateFileName="")) returned 1
	[0168.946] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d76b9e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1d76b9e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d76b9e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcae0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN110.XML", cAlternateFileName="")) returned 1
	[0168.946] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1f09a814, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1f09a814, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1f0c0a66, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45792, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN111.XML", cAlternateFileName="")) returned 1
	[0168.946] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1f09a814, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1f09a814, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc86400, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5a4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN114.XML", cAlternateFileName="")) returned 1
	[0168.946] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1f0280f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1f0280f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1f09a814, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x23c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PGMN120.XML", cAlternateFileName="")) returned 1
	[0168.946] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc348b22, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc348b22, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcfce125, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x943e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PG_INDEX.XML", cAlternateFileName="")) returned 1
	[0168.946] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc348b22, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc348b22, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcfce125, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x943e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PG_INDEX.XML", cAlternateFileName="")) returned 0
	[0168.947] FindClose (in: hFindFile=0x3e703b0 | out: hFindFile=0x3e703b0) returned 1
	[0168.947] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0168.947] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2169a085, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2be48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PDFREFLOW.EXE", cAlternateFileName="PDFREF~1.EXE")) returned 1
	[0168.948] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4f30656, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xdda50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PE.DLL", cAlternateFileName="")) returned 1
	[0168.948] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e4e8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PEOPLEDATAHANDLER.DLL", cAlternateFileName="PEOPLE~1.DLL")) returned 1
	[0169.114] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x834f7581, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x55aa8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PerfBoost.exe", cAlternateFileName="PERFBO~1.EXE")) returned 1
	[0169.114] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b63f68c, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b63f68c, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b63f68c, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x32ea8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PJCALEND.DLL", cAlternateFileName="")) returned 1
	[0169.114] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc26397db, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc26397db, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc274482a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1
	[0169.114] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc6030bfe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd95b0a45, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd97c6b3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c40b0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="POWERPNT.EXE", cAlternateFileName="")) returned 1
	[0169.114] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc6030bfe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc6030bfe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc6ac53aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfe0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="powerpnt.exe.manifest", cAlternateFileName="POWERP~1.MAN")) returned 1
	[0169.115] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x215db4dd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="POWERPNT.VisualElementsManifest.xml", cAlternateFileName="POWERP~1.XML")) returned 1
	[0169.115] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc6030bfe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd95d6d40, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d24004, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1178848, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PPCORE.DLL", cAlternateFileName="")) returned 1
	[0169.115] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc6246d3c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc6246d3c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb141e15, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13a640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PPRESOURCES.DLL", cAlternateFileName="PPRESO~1.DLL")) returned 1
	[0169.115] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d278, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PPSLAX.DLL", cAlternateFileName="")) returned 1
	[0169.115] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x21057dcc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x21673e23, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x359640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PPTICO.EXE", cAlternateFileName="")) returned 1
	[0169.115] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ccc9d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x18ccc9d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x18f2ea7, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x32ed0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PROJIMPT.EXE", cAlternateFileName="")) returned 1
	[0169.116] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x436ad46, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x274a8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PROJMODL.DLL", cAlternateFileName="")) returned 1
	[0169.116] FindNextFileW (in: hFindFile=0x3e70570, lpFindFileData=0x3bdf308 | out: lpFindFileData=0x3bdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc39bed4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb0d2731, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb0d2731, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1
	[0169.116] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x454d000
	[0169.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\*", lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc39bed4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb0d2731, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb0d2731, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e70770
	[0169.522] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc39bed4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb0d2731, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb0d2731, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0169.522] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1
	[0169.522] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x455d008
	[0169.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1033\\*", lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e703b0
	[0169.648] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.648] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd928f97c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8b050, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR8EN.DLL", cAlternateFileName="")) returned 1
	[0169.648] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd928f97c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8b050, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR8EN.DLL", cAlternateFileName="")) returned 0
	[0169.648] FindClose (in: hFindFile=0x3e703b0 | out: hFindFile=0x3e703b0) returned 1
	[0169.649] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0169.649] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1
	[0169.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x455d008
	[0169.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1036\\*", lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e705b0
	[0169.649] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.649] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf31b5d3e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf31b5d3e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafed902, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8aab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR8FR.DLL", cAlternateFileName="")) returned 1
	[0169.649] FindNextFileW (in: hFindFile=0x3e705b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf31b5d3e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf31b5d3e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafed902, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8aab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR8FR.DLL", cAlternateFileName="")) returned 0
	[0169.649] FindClose (in: hFindFile=0x3e705b0 | out: hFindFile=0x3e705b0) returned 1
	[0169.649] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0169.649] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1
	[0169.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x455d008
	[0169.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\3082\\*", lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e703b0
	[0169.650] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.650] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb039dcc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b050, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR8ES.DLL", cAlternateFileName="")) returned 1
	[0169.650] FindNextFileW (in: hFindFile=0x3e703b0, lpFindFileData=0x3bdee10 | out: lpFindFileData=0x3bdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb039dcc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b050, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR8ES.DLL", cAlternateFileName="")) returned 0
	[0169.650] FindClose (in: hFindFile=0x3e703b0 | out: hFindFile=0x3e703b0) returned 1
	[0169.650] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0169.650] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8en.dub", cAlternateFileName="")) returned 1
	[0169.650] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9328217, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x801fc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSGR8EN.LEX", cAlternateFileName="")) returned 1
	[0169.650] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb039dcc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb039dcc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb039dcc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8es.dub", cAlternateFileName="")) returned 1
	[0169.651] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb013b61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb013b61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb16b0a3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x69217c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSGR8ES.LEX", cAlternateFileName="")) returned 1
	[0169.651] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb0d2731, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb0d2731, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb0d2731, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8fr.dub", cAlternateFileName="")) returned 1
	[0169.651] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb0d2731, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb0d2731, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb1dd7cb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7740a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSGR8FR.LEX", cAlternateFileName="")) returned 1
	[0169.651] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd8e49f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x266d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSHY7EN.DLL", cAlternateFileName="")) returned 1
	[0169.651] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf00d5872, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb1dd7cb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x74400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSHY7EN.LEX", cAlternateFileName="")) returned 1
	[0169.652] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1b5bbeb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b5bbeb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b5bbeb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x26c68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSHY7ES.DLL", cAlternateFileName="")) returned 1
	[0169.652] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e0a643, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb1dd7cb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSHY7ES.LEX", cAlternateFileName="")) returned 1
	[0169.652] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefe4d066, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefebf763, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x26c68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSHY7FR.DLL", cAlternateFileName="")) returned 1
	[0169.652] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef9622ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef9622ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb1dd7cb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSHY7FR.LEX", cAlternateFileName="")) returned 1
	[0169.652] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5360180, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc5360180, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc5360180, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSP7EN.dub", cAlternateFileName="")) returned 1
	[0169.652] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5360180, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc5360180, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd93746c2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x186200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSP7EN.LEX", cAlternateFileName="")) returned 1
	[0169.653] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc53863b3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc53863b3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc53863b3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSP7ES.dub", cAlternateFileName="")) returned 1
	[0169.653] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc54dd8eb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc54dd8eb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd943329c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1ec600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSP7ES.LEX", cAlternateFileName="")) returned 1
	[0169.653] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc541ed37, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc541ed37, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc541ed37, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSP7FR.dub", cAlternateFileName="")) returned 1
	[0169.653] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc541ed37, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc541ed37, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd945950a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c6a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSP7FR.LEX", cAlternateFileName="")) returned 1
	[0169.654] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc39bed4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc39bed4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd52c882e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc64c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msspell7.dll", cAlternateFileName="")) returned 1
	[0169.654] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefe00baf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb203a02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x64068, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msth8EN.DLL", cAlternateFileName="")) returned 1
	[0169.654] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4692737, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x34d200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msth8EN.LEX", cAlternateFileName="")) returned 1
	[0169.654] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf03d07a0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb29c380, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x63ac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msth8ES.DLL", cAlternateFileName="")) returned 1
	[0169.654] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4cd4a32, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4cd4a32, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb8b847f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x40b800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msth8ES.LEX", cAlternateFileName="")) returned 1
	[0169.655] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf43e3cb7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5972d3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x64068, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msth8FR.DLL", cAlternateFileName="")) returned 1
	[0169.655] FindNextFileW (in: hFindFile=0x3e70770, lpFindFileData=0x3bdf08c | out: lpFindFileData=0x3bdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf13e86a9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13e86a9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5972d3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msth8FR.LEX", cAlternateFileName="")) returned 1
	[0169.657] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0169.657] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x454d000
	[0169.661] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0169.672] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0169.673] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0169.674] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0169.674] lstrlenW (lpString="SAVASWEB.DLL") returned 12
	[0169.674] lstrlenW (lpString=".1cd") returned 4
	[0169.674] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0169.674] lstrlenW (lpString=".3ds") returned 4
	[0169.674] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1
	[0169.674] lstrlenW (lpString=".3fr") returned 4
	[0169.674] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1
	[0169.674] lstrlenW (lpString=".3g2") returned 4
	[0169.674] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1
	[0169.674] lstrlenW (lpString=".3gp") returned 4
	[0169.674] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1
	[0169.674] lstrlenW (lpString=".7z") returned 3
	[0169.674] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0169.674] lstrlenW (lpString=".accda") returned 6
	[0169.674] lstrcmpiW (lpString1=".accda", lpString2="EB.DLL") returned -1
	[0169.674] lstrlenW (lpString=".accdb") returned 6
	[0169.674] lstrcmpiW (lpString1=".accdb", lpString2="EB.DLL") returned -1
	[0169.675] lstrlenW (lpString=".accdc") returned 6
	[0169.675] lstrcmpiW (lpString1=".accdc", lpString2="EB.DLL") returned -1
	[0169.675] lstrlenW (lpString=".accde") returned 6
	[0169.675] lstrcmpiW (lpString1=".accde", lpString2="EB.DLL") returned -1
	[0169.675] lstrlenW (lpString=".accdt") returned 6
	[0169.675] lstrcmpiW (lpString1=".accdt", lpString2="EB.DLL") returned -1
	[0169.675] lstrlenW (lpString=".accdw") returned 6
	[0169.675] lstrcmpiW (lpString1=".accdw", lpString2="EB.DLL") returned -1
	[0169.675] lstrlenW (lpString=".adb") returned 4
	[0169.675] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1
	[0169.675] lstrlenW (lpString=".adp") returned 4
	[0169.675] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1
	[0169.675] lstrlenW (lpString=".ai") returned 3
	[0169.675] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1
	[0169.675] lstrlenW (lpString=".ai3") returned 4
	[0169.675] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1
	[0169.675] lstrlenW (lpString=".ai4") returned 4
	[0169.675] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1
	[0169.675] lstrlenW (lpString=".ai5") returned 4
	[0169.675] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1
	[0169.675] lstrlenW (lpString=".ai6") returned 4
	[0169.675] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1
	[0169.675] lstrlenW (lpString=".ai7") returned 4
	[0169.675] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1
	[0169.676] lstrlenW (lpString=".ai8") returned 4
	[0169.676] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1
	[0169.676] lstrlenW (lpString=".anim") returned 5
	[0169.676] lstrcmpiW (lpString1=".anim", lpString2="B.DLL") returned -1
	[0169.676] lstrlenW (lpString=".arw") returned 4
	[0169.676] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1
	[0169.676] lstrlenW (lpString=".as") returned 3
	[0169.676] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1
	[0169.676] lstrlenW (lpString=".asa") returned 4
	[0169.676] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1
	[0169.676] lstrlenW (lpString=".asc") returned 4
	[0169.676] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1
	[0169.676] lstrlenW (lpString=".ascx") returned 5
	[0169.676] lstrcmpiW (lpString1=".ascx", lpString2="B.DLL") returned -1
	[0169.676] lstrlenW (lpString=".asm") returned 4
	[0169.676] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1
	[0169.676] lstrlenW (lpString=".asmx") returned 5
	[0169.676] lstrcmpiW (lpString1=".asmx", lpString2="B.DLL") returned -1
	[0169.676] lstrlenW (lpString=".asp") returned 4
	[0169.676] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1
	[0169.676] lstrlenW (lpString=".aspx") returned 5
	[0169.676] lstrcmpiW (lpString1=".aspx", lpString2="B.DLL") returned -1
	[0169.676] lstrlenW (lpString=".asr") returned 4
	[0169.676] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1
	[0169.676] lstrlenW (lpString=".asx") returned 4
	[0169.676] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1
	[0169.676] lstrlenW (lpString=".avi") returned 4
	[0169.677] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1
	[0169.677] lstrlenW (lpString=".avs") returned 4
	[0169.677] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1
	[0169.677] lstrlenW (lpString=".backup") returned 7
	[0169.677] lstrcmpiW (lpString1=".backup", lpString2="WEB.DLL") returned -1
	[0169.677] lstrlenW (lpString=".bak") returned 4
	[0169.677] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1
	[0169.677] lstrlenW (lpString=".bay") returned 4
	[0169.677] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1
	[0169.677] lstrlenW (lpString=".bd") returned 3
	[0169.677] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1
	[0169.677] lstrlenW (lpString=".bin") returned 4
	[0169.677] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1
	[0169.677] lstrlenW (lpString=".bmp") returned 4
	[0169.677] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1
	[0169.677] lstrlenW (lpString=".bz2") returned 4
	[0169.677] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0169.677] lstrlenW (lpString=".c") returned 2
	[0169.677] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1
	[0169.677] lstrlenW (lpString=".cdr") returned 4
	[0169.677] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1
	[0169.677] lstrlenW (lpString=".cer") returned 4
	[0169.677] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1
	[0169.677] lstrlenW (lpString=".cf") returned 3
	[0169.677] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1
	[0169.677] lstrlenW (lpString=".cfc") returned 4
	[0169.677] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1
	[0169.677] lstrlenW (lpString=".cfm") returned 4
	[0169.677] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1
	[0169.678] lstrlenW (lpString=".cfml") returned 5
	[0169.678] lstrcmpiW (lpString1=".cfml", lpString2="B.DLL") returned -1
	[0169.678] lstrlenW (lpString=".cfu") returned 4
	[0169.678] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1
	[0169.678] lstrlenW (lpString=".chm") returned 4
	[0169.678] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1
	[0169.678] lstrlenW (lpString=".cin") returned 4
	[0169.678] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1
	[0169.678] lstrlenW (lpString=".class") returned 6
	[0169.678] lstrcmpiW (lpString1=".class", lpString2="EB.DLL") returned -1
	[0169.678] lstrlenW (lpString=".clx") returned 4
	[0169.678] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1
	[0169.678] lstrlenW (lpString=".config") returned 7
	[0169.678] lstrcmpiW (lpString1=".config", lpString2="WEB.DLL") returned -1
	[0169.678] lstrlenW (lpString=".cpp") returned 4
	[0169.678] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1
	[0169.678] lstrlenW (lpString=".cr2") returned 4
	[0169.678] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1
	[0169.678] lstrlenW (lpString=".crt") returned 4
	[0169.678] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1
	[0169.678] lstrlenW (lpString=".crw") returned 4
	[0169.678] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1
	[0169.678] lstrlenW (lpString=".cs") returned 3
	[0169.678] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1
	[0169.678] lstrlenW (lpString=".css") returned 4
	[0169.678] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1
	[0169.678] lstrlenW (lpString=".csv") returned 4
	[0169.678] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1
	[0169.678] lstrlenW (lpString=".cub") returned 4
	[0169.679] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".dae") returned 4
	[0169.679] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".dat") returned 4
	[0169.679] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".db") returned 3
	[0169.679] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1
	[0169.679] lstrlenW (lpString=".dbf") returned 4
	[0169.679] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".dbx") returned 4
	[0169.679] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".dc3") returned 4
	[0169.679] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".dcm") returned 4
	[0169.679] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".dcr") returned 4
	[0169.679] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".der") returned 4
	[0169.679] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".dib") returned 4
	[0169.679] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".dic") returned 4
	[0169.679] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".dif") returned 4
	[0169.679] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1
	[0169.679] lstrlenW (lpString=".divx") returned 5
	[0169.679] lstrcmpiW (lpString1=".divx", lpString2="B.DLL") returned -1
	[0169.679] lstrlenW (lpString=".djvu") returned 5
	[0169.679] lstrcmpiW (lpString1=".djvu", lpString2="B.DLL") returned -1
	[0169.679] lstrlenW (lpString=".dng") returned 4
	[0169.680] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1
	[0169.680] lstrlenW (lpString=".doc") returned 4
	[0169.680] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0169.680] lstrlenW (lpString=".docm") returned 5
	[0169.680] lstrcmpiW (lpString1=".docm", lpString2="B.DLL") returned -1
	[0169.680] lstrlenW (lpString=".docx") returned 5
	[0169.680] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1
	[0169.680] lstrlenW (lpString=".dot") returned 4
	[0169.680] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1
	[0169.680] lstrlenW (lpString=".dotm") returned 5
	[0169.680] lstrcmpiW (lpString1=".dotm", lpString2="B.DLL") returned -1
	[0169.680] lstrlenW (lpString=".dotx") returned 5
	[0169.680] lstrcmpiW (lpString1=".dotx", lpString2="B.DLL") returned -1
	[0169.680] lstrlenW (lpString=".dpx") returned 4
	[0169.680] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1
	[0169.680] lstrlenW (lpString=".dqy") returned 4
	[0169.680] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1
	[0169.680] lstrlenW (lpString=".dsn") returned 4
	[0169.680] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1
	[0169.680] lstrlenW (lpString=".dt") returned 3
	[0169.680] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1
	[0169.680] lstrlenW (lpString=".dtd") returned 4
	[0169.680] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1
	[0169.680] lstrlenW (lpString=".dwg") returned 4
	[0169.680] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1
	[0169.680] lstrlenW (lpString=".dwt") returned 4
	[0169.680] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1
	[0169.680] lstrlenW (lpString=".dx") returned 3
	[0169.680] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1
	[0169.681] lstrlenW (lpString=".dxf") returned 4
	[0169.681] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1
	[0169.681] lstrlenW (lpString=".edml") returned 5
	[0169.681] lstrcmpiW (lpString1=".edml", lpString2="B.DLL") returned -1
	[0169.681] lstrlenW (lpString=".efd") returned 4
	[0169.681] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1
	[0169.681] lstrlenW (lpString=".elf") returned 4
	[0169.681] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1
	[0169.681] lstrlenW (lpString=".emf") returned 4
	[0169.681] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1
	[0169.681] lstrlenW (lpString=".emz") returned 4
	[0169.681] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1
	[0169.681] lstrlenW (lpString=".epf") returned 4
	[0169.681] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1
	[0169.681] lstrlenW (lpString=".eps") returned 4
	[0169.681] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1
	[0169.681] lstrlenW (lpString=".epsf") returned 5
	[0169.681] lstrcmpiW (lpString1=".epsf", lpString2="B.DLL") returned -1
	[0169.681] lstrlenW (lpString=".epsp") returned 5
	[0169.681] lstrcmpiW (lpString1=".epsp", lpString2="B.DLL") returned -1
	[0169.681] lstrlenW (lpString=".erf") returned 4
	[0169.681] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1
	[0169.681] lstrlenW (lpString=".exr") returned 4
	[0169.681] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1
	[0169.681] lstrlenW (lpString=".f4v") returned 4
	[0169.681] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1
	[0169.681] lstrlenW (lpString=".fido") returned 5
	[0169.681] lstrcmpiW (lpString1=".fido", lpString2="B.DLL") returned -1
	[0169.682] lstrlenW (lpString=".flm") returned 4
	[0169.682] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1
	[0169.682] lstrlenW (lpString=".flv") returned 4
	[0169.682] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1
	[0169.682] lstrlenW (lpString=".frm") returned 4
	[0169.682] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1
	[0169.682] lstrlenW (lpString=".fxg") returned 4
	[0169.682] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1
	[0169.682] lstrlenW (lpString=".geo") returned 4
	[0169.682] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1
	[0169.682] lstrlenW (lpString=".gif") returned 4
	[0169.682] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1
	[0169.682] lstrlenW (lpString=".grs") returned 4
	[0169.682] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1
	[0169.682] lstrlenW (lpString=".gz") returned 3
	[0169.682] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1
	[0169.682] lstrlenW (lpString=".h") returned 2
	[0169.682] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1
	[0169.682] lstrlenW (lpString=".hdr") returned 4
	[0169.682] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1
	[0169.682] lstrlenW (lpString=".hpp") returned 4
	[0169.682] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1
	[0169.682] lstrlenW (lpString=".hta") returned 4
	[0169.805] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1
	[0169.805] lstrlenW (lpString=".htc") returned 4
	[0169.805] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1
	[0169.805] lstrlenW (lpString=".htm") returned 4
	[0169.805] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1
	[0169.805] lstrlenW (lpString=".html") returned 5
	[0169.805] lstrcmpiW (lpString1=".html", lpString2="B.DLL") returned -1
	[0169.805] lstrlenW (lpString=".icb") returned 4
	[0169.805] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1
	[0169.805] lstrlenW (lpString=".ics") returned 4
	[0169.807] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1
	[0169.807] lstrlenW (lpString=".iff") returned 4
	[0169.807] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1
	[0169.812] lstrlenW (lpString=".inc") returned 4
	[0169.812] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1
	[0169.812] lstrlenW (lpString=".indd") returned 5
	[0169.812] lstrcmpiW (lpString1=".indd", lpString2="B.DLL") returned -1
	[0169.812] lstrlenW (lpString=".ini") returned 4
	[0169.812] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1
	[0169.812] lstrlenW (lpString=".iqy") returned 4
	[0169.812] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1
	[0169.812] lstrlenW (lpString=".j2c") returned 4
	[0169.812] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1
	[0169.812] lstrlenW (lpString=".j2k") returned 4
	[0169.812] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1
	[0169.812] lstrlenW (lpString=".java") returned 5
	[0169.812] lstrcmpiW (lpString1=".java", lpString2="B.DLL") returned -1
	[0169.812] lstrlenW (lpString=".jp2") returned 4
	[0169.813] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1
	[0169.813] lstrlenW (lpString=".jpc") returned 4
	[0169.813] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1
	[0169.813] lstrlenW (lpString=".jpe") returned 4
	[0169.813] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1
	[0169.813] lstrlenW (lpString=".jpeg") returned 5
	[0169.813] lstrcmpiW (lpString1=".jpeg", lpString2="B.DLL") returned -1
	[0169.813] lstrlenW (lpString=".jpf") returned 4
	[0169.813] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1
	[0169.813] lstrlenW (lpString=".jpg") returned 4
	[0169.813] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0169.813] lstrlenW (lpString=".jpx") returned 4
	[0169.813] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1
	[0169.813] lstrlenW (lpString=".js") returned 3
	[0169.813] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1
	[0169.813] lstrlenW (lpString=".jsf") returned 4
	[0169.813] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1
	[0169.813] lstrlenW (lpString=".json") returned 5
	[0169.813] lstrcmpiW (lpString1=".json", lpString2="B.DLL") returned -1
	[0169.813] lstrlenW (lpString=".jsp") returned 4
	[0169.813] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1
	[0169.813] lstrlenW (lpString=".kdc") returned 4
	[0169.813] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1
	[0169.813] lstrlenW (lpString=".kmz") returned 4
	[0169.813] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1
	[0169.813] lstrlenW (lpString=".kwm") returned 4
	[0169.813] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1
	[0169.813] lstrlenW (lpString=".lasso") returned 6
	[0169.814] lstrcmpiW (lpString1=".lasso", lpString2="EB.DLL") returned -1
	[0169.814] lstrlenW (lpString=".lbi") returned 4
	[0169.814] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".lgf") returned 4
	[0169.814] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".lgp") returned 4
	[0169.814] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".log") returned 4
	[0169.814] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".m1v") returned 4
	[0169.814] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".m4a") returned 4
	[0169.814] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".m4v") returned 4
	[0169.814] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".max") returned 4
	[0169.814] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".md") returned 3
	[0169.814] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1
	[0169.814] lstrlenW (lpString=".mda") returned 4
	[0169.814] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".mdb") returned 4
	[0169.814] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".mde") returned 4
	[0169.814] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".mdf") returned 4
	[0169.814] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1
	[0169.814] lstrlenW (lpString=".mdw") returned 4
	[0169.814] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1
	[0169.815] lstrlenW (lpString=".mef") returned 4
	[0169.815] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1
	[0169.815] lstrlenW (lpString=".mft") returned 4
	[0169.815] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1
	[0169.815] lstrlenW (lpString=".mfw") returned 4
	[0169.815] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1
	[0169.815] lstrlenW (lpString=".mht") returned 4
	[0169.815] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1
	[0169.815] lstrlenW (lpString=".mhtml") returned 6
	[0169.815] lstrcmpiW (lpString1=".mhtml", lpString2="EB.DLL") returned -1
	[0169.815] lstrlenW (lpString=".mka") returned 4
	[0169.815] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1
	[0169.815] lstrlenW (lpString=".mkidx") returned 6
	[0169.815] lstrcmpiW (lpString1=".mkidx", lpString2="EB.DLL") returned -1
	[0169.815] lstrlenW (lpString=".mkv") returned 4
	[0169.815] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1
	[0169.815] lstrlenW (lpString=".mos") returned 4
	[0169.815] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1
	[0169.815] lstrlenW (lpString=".mov") returned 4
	[0169.815] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1
	[0169.815] lstrlenW (lpString=".mp3") returned 4
	[0169.815] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1
	[0169.815] lstrlenW (lpString=".mp4") returned 4
	[0169.815] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1
	[0169.815] lstrlenW (lpString=".mpeg") returned 5
	[0169.815] lstrcmpiW (lpString1=".mpeg", lpString2="B.DLL") returned -1
	[0169.815] lstrlenW (lpString=".mpg") returned 4
	[0169.815] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".mpv") returned 4
	[0169.816] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".mrw") returned 4
	[0169.816] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".msg") returned 4
	[0169.816] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".mxl") returned 4
	[0169.816] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".myd") returned 4
	[0169.816] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".myi") returned 4
	[0169.816] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".nef") returned 4
	[0169.816] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".nrw") returned 4
	[0169.816] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".obj") returned 4
	[0169.816] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".odb") returned 4
	[0169.816] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".odc") returned 4
	[0169.816] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".odm") returned 4
	[0169.816] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".odp") returned 4
	[0169.816] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".ods") returned 4
	[0169.816] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1
	[0169.816] lstrlenW (lpString=".oft") returned 4
	[0169.817] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1
	[0169.817] lstrlenW (lpString=".one") returned 4
	[0169.817] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1
	[0169.817] lstrlenW (lpString=".onepkg") returned 7
	[0169.817] lstrcmpiW (lpString1=".onepkg", lpString2="WEB.DLL") returned -1
	[0169.817] lstrlenW (lpString=".onetoc2") returned 8
	[0169.817] lstrcmpiW (lpString1=".onetoc2", lpString2="SWEB.DLL") returned -1
	[0169.817] lstrlenW (lpString=".opt") returned 4
	[0169.817] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1
	[0169.817] lstrlenW (lpString=".oqy") returned 4
	[0169.817] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1
	[0169.817] lstrlenW (lpString=".orf") returned 4
	[0169.817] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1
	[0169.817] lstrlenW (lpString=".p12") returned 4
	[0169.817] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1
	[0169.817] lstrlenW (lpString=".p7b") returned 4
	[0169.817] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1
	[0169.817] lstrlenW (lpString=".p7c") returned 4
	[0169.817] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1
	[0169.817] lstrlenW (lpString=".pam") returned 4
	[0169.817] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1
	[0169.817] lstrlenW (lpString=".pbm") returned 4
	[0169.817] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1
	[0169.817] lstrlenW (lpString=".pct") returned 4
	[0169.817] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1
	[0169.817] lstrlenW (lpString=".pcx") returned 4
	[0169.817] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1
	[0169.818] lstrlenW (lpString=".pdd") returned 4
	[0169.818] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1
	[0169.818] lstrlenW (lpString=".pdf") returned 4
	[0169.818] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0169.818] lstrlenW (lpString=".pdp") returned 4
	[0169.818] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1
	[0169.818] lstrlenW (lpString=".pef") returned 4
	[0169.818] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1
	[0169.818] lstrlenW (lpString=".pem") returned 4
	[0169.818] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1
	[0169.818] lstrlenW (lpString=".pff") returned 4
	[0169.818] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1
	[0169.818] lstrlenW (lpString=".pfm") returned 4
	[0169.818] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1
	[0169.818] lstrlenW (lpString=".pfx") returned 4
	[0169.818] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1
	[0169.818] lstrlenW (lpString=".pgm") returned 4
	[0169.818] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1
	[0169.818] lstrlenW (lpString=".php") returned 4
	[0169.818] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1
	[0169.818] lstrlenW (lpString=".php3") returned 5
	[0169.818] lstrcmpiW (lpString1=".php3", lpString2="B.DLL") returned -1
	[0169.818] lstrlenW (lpString=".php4") returned 5
	[0169.818] lstrcmpiW (lpString1=".php4", lpString2="B.DLL") returned -1
	[0169.818] lstrlenW (lpString=".php5") returned 5
	[0169.818] lstrcmpiW (lpString1=".php5", lpString2="B.DLL") returned -1
	[0169.818] lstrlenW (lpString=".phtml") returned 6
	[0169.818] lstrcmpiW (lpString1=".phtml", lpString2="EB.DLL") returned -1
	[0169.819] lstrlenW (lpString=".pict") returned 5
	[0169.819] lstrcmpiW (lpString1=".pict", lpString2="B.DLL") returned -1
	[0169.819] lstrlenW (lpString=".pl") returned 3
	[0169.819] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1
	[0169.819] lstrlenW (lpString=".pls") returned 4
	[0169.819] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1
	[0169.819] lstrlenW (lpString=".pm") returned 3
	[0169.819] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1
	[0169.819] lstrlenW (lpString=".png") returned 4
	[0169.819] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1
	[0169.819] lstrlenW (lpString=".pnm") returned 4
	[0169.819] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1
	[0169.819] lstrlenW (lpString=".pot") returned 4
	[0169.819] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1
	[0169.819] lstrlenW (lpString=".potm") returned 5
	[0169.819] lstrcmpiW (lpString1=".potm", lpString2="B.DLL") returned -1
	[0169.819] lstrlenW (lpString=".potx") returned 5
	[0169.819] lstrcmpiW (lpString1=".potx", lpString2="B.DLL") returned -1
	[0169.819] lstrlenW (lpString=".ppa") returned 4
	[0169.819] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1
	[0169.819] lstrlenW (lpString=".ppam") returned 5
	[0169.819] lstrcmpiW (lpString1=".ppam", lpString2="B.DLL") returned -1
	[0169.819] lstrlenW (lpString=".ppm") returned 4
	[0169.819] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1
	[0169.819] lstrlenW (lpString=".pps") returned 4
	[0169.820] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1
	[0169.820] lstrlenW (lpString=".ppsm") returned 5
	[0169.820] lstrcmpiW (lpString1=".ppsm", lpString2="B.DLL") returned -1
	[0169.820] lstrlenW (lpString=".ppt") returned 4
	[0169.820] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0169.820] lstrlenW (lpString=".pptm") returned 5
	[0169.820] lstrcmpiW (lpString1=".pptm", lpString2="B.DLL") returned -1
	[0169.820] lstrlenW (lpString=".pptx") returned 5
	[0169.820] lstrcmpiW (lpString1=".pptx", lpString2="B.DLL") returned -1
	[0169.820] lstrlenW (lpString=".prn") returned 4
	[0169.820] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1
	[0169.820] lstrlenW (lpString=".ps") returned 3
	[0169.820] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1
	[0169.820] lstrlenW (lpString=".psb") returned 4
	[0169.820] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1
	[0169.820] lstrlenW (lpString=".psd") returned 4
	[0169.820] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1
	[0169.820] lstrlenW (lpString=".pst") returned 4
	[0169.820] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1
	[0169.820] lstrlenW (lpString=".ptx") returned 4
	[0169.820] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1
	[0169.820] lstrlenW (lpString=".pub") returned 4
	[0169.820] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1
	[0169.820] lstrlenW (lpString=".pwm") returned 4
	[0169.820] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1
	[0169.820] lstrlenW (lpString=".pxr") returned 4
	[0169.821] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1
	[0169.821] lstrlenW (lpString=".py") returned 3
	[0169.821] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1
	[0169.821] lstrlenW (lpString=".qt") returned 3
	[0169.821] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1
	[0169.821] lstrlenW (lpString=".r3d") returned 4
	[0169.821] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1
	[0169.821] lstrlenW (lpString=".raf") returned 4
	[0169.821] lstrcmpiW (lpString1=".raf", lpString2=".DLL") returned 1
	[0169.821] lstrlenW (lpString=".rar") returned 4
	[0169.821] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0169.821] lstrlenW (lpString=".raw") returned 4
	[0169.821] lstrcmpiW (lpString1=".raw", lpString2=".DLL") returned 1
	[0169.823] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0170.020] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0170.020] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0170.444] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0170.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0170.447] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0170.449] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0170.449] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0170.451] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0170.452] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0170.453] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0170.453] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0170.454] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0170.455] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0170.455] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0170.455] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0170.455] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0170.458] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0170.458] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0170.460] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0170.460] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0170.461] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0170.461] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0170.463] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0170.463] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0170.960] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x455d008 | out: hHeap=0x4c0000) returned 1
	[0171.103] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0171.113] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0171.113] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0171.113] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0171.114] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.114] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.118] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.120] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.120] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.120] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.122] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.124] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.124] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.131] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.132] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.134] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.136] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0171.136] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.136] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.137] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.138] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.138] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.139] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.141] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.142] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.507] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.507] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.507] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.507] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.507] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.509] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.509] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.509] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.509] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.510] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.510] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.510] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.510] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.511] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.511] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.511] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.512] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.512] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.512] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.512] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.513] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.513] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.537] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.537] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.537] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.537] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.538] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.538] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.540] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.540] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.540] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.540] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.541] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.541] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.541] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.541] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.542] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.542] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.542] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.543] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.543] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.543] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.543] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.544] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.544] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.544] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.544] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.545] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.545] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.545] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.545] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.546] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.547] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.547] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.547] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.547] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.548] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.548] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.548] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.550] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.550] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.551] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x454d000 | out: hHeap=0x4c0000) returned 1
	[0171.551] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.551] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.551] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.554] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0171.555] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.555] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0171.557] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.557] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.557] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.557] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0171.558] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0171.561] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.562] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.562] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.563] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.563] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.563] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.563] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.564] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.564] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.564] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.564] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.565] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.565] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.566] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7ff0 | out: hHeap=0x4c0000) returned 1
	[0171.981] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.981] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.982] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.983] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.983] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.984] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.985] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0171.985] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.985] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.986] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0171.986] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.986] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.987] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0171.990] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0171.990] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0171.990] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0171.993] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.994] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0171.994] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0171.994] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0171.997] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0171.999] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.000] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.001] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.001] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.001] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.002] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.002] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.002] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.002] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0172.007] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.008] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.008] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.008] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.009] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.013] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.016] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.017] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.042] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.044] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.045] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.045] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.377] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.377] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.377] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.377] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.377] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.378] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.378] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.378] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.378] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0172.383] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0172.386] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0172.387] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.387] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.387] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.388] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.388] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.389] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.389] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.389] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.389] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.389] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.389] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x452cff0 | out: hHeap=0x4c0000) returned 1
	[0172.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.390] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.393] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.394] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.398] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.398] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.398] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.398] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.399] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.399] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.399] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x451cfe8 | out: hHeap=0x4c0000) returned 1
	[0172.400] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x456d010 | out: hHeap=0x4c0000) returned 1
	[0172.400] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.400] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7ff8 | out: hHeap=0x4c0000) returned 1
	[0172.400] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44b2a98 | out: hHeap=0x4c0000) returned 1
	[0172.403] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f8000 | out: hHeap=0x4c0000) returned 1
	[0172.911] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4508008 | out: hHeap=0x4c0000) returned 1
	[0172.913] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0172.913] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.913] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0172.915] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.917] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.917] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.917] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.917] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.918] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.918] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.918] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.918] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.918] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.919] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.920] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0172.920] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.920] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.920] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.920] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.920] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0172.925] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0172.925] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.926] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0172.927] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0172.927] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0172.927] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.927] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0172.931] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0172.931] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0172.932] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0172.935] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.936] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.938] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.939] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.940] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.942] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.943] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.945] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.946] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.947] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.949] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.950] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0172.952] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.069] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.070] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.071] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.073] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.074] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.076] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.077] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.079] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.080] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.082] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.083] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.084] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.086] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.087] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.089] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.090] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.091] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.093] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.094] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.096] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.097] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.099] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.100] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.101] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.103] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.104] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.106] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.107] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.411] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.412] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.413] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.415] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.416] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.418] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.419] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.421] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.422] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.424] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.425] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.427] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.428] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.430] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.431] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.432] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.435] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.437] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.439] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.440] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.441] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.443] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.444] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.446] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.447] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.448] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.450] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.451] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0173.451] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0173.451] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45ae9e8 | out: hHeap=0x4c0000) returned 1
	[0173.452] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x459e9e0 | out: hHeap=0x4c0000) returned 1
	[0173.813] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.814] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.814] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.816] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.817] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.817] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.818] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.819] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.819] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.820] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.821] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.821] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.823] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.824] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.825] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.825] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.825] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.827] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.827] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0173.827] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.828] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0173.828] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.829] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.829] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.830] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.830] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.830] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0173.830] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.830] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.830] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.831] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.831] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.831] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0173.831] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0173.831] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0173.831] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0173.832] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45fea08 | out: hHeap=0x4c0000) returned 1
	[0173.832] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45fea08 | out: hHeap=0x4c0000) returned 1
	[0173.832] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.834] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0173.834] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0173.834] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460ea10 | out: hHeap=0x4c0000) returned 1
	[0173.835] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54d0048 | out: hHeap=0x4c0000) returned 1
	[0173.835] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0173.835] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0173.835] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460ea10 | out: hHeap=0x4c0000) returned 1
	[0173.838] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0173.838] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0173.838] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460ea10 | out: hHeap=0x4c0000) returned 1
	[0173.838] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0173.838] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0173.839] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x460ea10 | out: hHeap=0x4c0000) returned 1
	[0173.839] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54d0048 | out: hHeap=0x4c0000) returned 1
	[0173.840] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45fea08 | out: hHeap=0x4c0000) returned 1
	[0173.840] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4507fe8 | out: hHeap=0x4c0000) returned 1
	[0173.841] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f7fe0 | out: hHeap=0x4c0000) returned 1
	[0173.841] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.028] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f7fe0 | out: hHeap=0x4c0000) returned 1
	[0174.028] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.028] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54d0048 | out: hHeap=0x4c0000) returned 1
	[0174.029] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.029] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.029] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.030] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.030] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.032] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.033] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.035] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.035] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.035] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.035] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.036] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.036] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.036] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.038] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.039] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.041] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.041] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.041] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54d0048 | out: hHeap=0x4c0000) returned 1
	[0174.042] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.042] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.042] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54d0048 | out: hHeap=0x4c0000) returned 1
	[0174.043] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.043] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.044] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.044] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.044] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54d0048 | out: hHeap=0x4c0000) returned 1
	[0174.044] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x458e9d8 | out: hHeap=0x4c0000) returned 1
	[0174.046] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4494fe8 | out: hHeap=0x4c0000) returned 1
	[0174.046] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4471730 | out: hHeap=0x4c0000) returned 1
	[0174.047] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54d0048 | out: hHeap=0x4c0000) returned 1
	[0174.050] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.050] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.051] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.051] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.052] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.054] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.056] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.057] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.057] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.057] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.057] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.057] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.057] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.058] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.059] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.059] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.059] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44f7fe0 | out: hHeap=0x4c0000) returned 1
	[0174.059] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.060] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.060] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.060] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.060] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.061] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.146] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0174.146] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45fea08 | out: hHeap=0x4c0000) returned 1
	[0174.149] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0174.149] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x45be9f0 | out: hHeap=0x4c0000) returned 1
	[0174.151] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.151] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.151] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.151] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0174.151] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.152] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.152] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.152] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0174.152] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.152] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.152] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.152] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0174.152] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.157] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.158] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.159] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.159] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0174.160] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0174.162] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.162] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0174.164] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.164] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.164] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0174.165] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.165] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.165] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0174.166] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x461ea18 | out: hHeap=0x4c0000) returned 1
	[0174.169] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.169] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.169] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.169] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.169] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.169] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.170] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.170] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.170] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.170] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.170] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.170] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.172] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.172] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.172] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.172] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.172] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.176] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.176] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.177] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.177] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.177] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.177] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.177] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.177] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.177] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44d7fd0 | out: hHeap=0x4c0000) returned 1
	[0174.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0174.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44c7fc8 | out: hHeap=0x4c0000) returned 1
	[0174.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x462ea20 | out: hHeap=0x4c0000) returned 1
	[0174.179] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.179] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.180] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.180] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.180] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.180] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.180] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.180] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.181] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.182] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.182] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.182] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.182] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.182] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.182] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.184] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.184] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.184] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.184] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1
	[0174.184] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x44e7fd8 | out: hHeap=0x4c0000) returned 1

Thread:
	id = 55
	os_tid = 0xe44


Thread:
	id = 57
	os_tid = 0xe4c


Thread:
	id = 58
	os_tid = 0xe50


Thread:
	id = 59
	os_tid = 0xe54


Thread:
	id = 60
	os_tid = 0xe58


Thread:
	id = 61
	os_tid = 0xe5c


Process:
	id = "6"
	image_name = "d2.exe"
	filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe"
	page_root = "0x73502000"
	os_pid = "0xdc0"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe\" "
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012a52" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 31
	os_tid = 0xdc4

	[0144.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff74 | out: lpSystemTimeAsFileTime=0x19ff74*(dwLowDateTime=0xc2521b4, dwHighDateTime=0x1d590a2)) 
	[0144.233] GetCurrentProcessId () returned 0xdc0
	[0144.233] GetCurrentThreadId () returned 0xdc4
	[0144.233] GetTickCount () returned 0x1137e8c
	[0144.233] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff6c | out: lpPerformanceCount=0x19ff6c*=5491106259) returned 1
	[0144.303] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x19ff7c, hStdError=0x409539)) 
	[0144.303] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xa80000
	[0144.304] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.304] GetProcAddress (hModule=0x760c0000, lpProcName="FlsAlloc") returned 0x760d4ae0
	[0144.304] GetProcAddress (hModule=0x760c0000, lpProcName="FlsGetValue") returned 0x760d4b20
	[0144.305] GetProcAddress (hModule=0x760c0000, lpProcName="FlsSetValue") returned 0x760d4b40
	[0144.305] GetProcAddress (hModule=0x760c0000, lpProcName="FlsFree") returned 0x760d4b00
	[0144.305] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.305] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.305] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.305] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.305] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.305] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.305] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.305] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.306] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.306] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.306] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.306] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.306] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.306] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.307] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.307] GetProcAddress (hModule=0x760c0000, lpProcName="DecodePointer") returned 0x77a51ec0
	[0144.307] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x214) returned 0xa805a8
	[0144.307] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.307] GetProcAddress (hModule=0x760c0000, lpProcName="DecodePointer") returned 0x77a51ec0
	[0144.307] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0144.307] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0144.307] GetProcAddress (hModule=0x760c0000, lpProcName="DecodePointer") returned 0x77a51ec0
	[0144.308] GetCurrentThreadId () returned 0xdc4
	[0144.308] GetStartupInfoA (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) 
	[0144.308] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x800) returned 0xa807c8
	[0144.308] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0144.308] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0144.308] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0144.308] SetHandleCount (uNumber=0x20) returned 0x20
	[0144.308] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe\" "
	[0144.308] GetEnvironmentStringsW () returned 0x4826c8*
	[0144.308] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x0, Size=0xb04) returned 0xa80fd0
	[0144.309] FreeEnvironmentStringsW (penv=0x4826c8) returned 1
	[0144.309] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4377f0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe")) returned 0x54
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x0, Size=0xb2) returned 0xa81ae0
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x98) returned 0xa81ba0
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x3e) returned 0xa81c40
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x50) returned 0xa81c88
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x6e) returned 0xa81ce0
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x78) returned 0xa81d58
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x62) returned 0xa81dd8
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x28) returned 0xa81e48
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x48) returned 0xa81e78
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x1a) returned 0xa81ec8
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x2e) returned 0xa81ef0
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x56) returned 0xa81f28
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x2a) returned 0xa81f88
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x2e) returned 0xa81fc0
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x44) returned 0xa81ff8
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x1c) returned 0xa82048
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x184) returned 0xa82070
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x7c) returned 0xa82200
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x36) returned 0xa82288
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x3a) returned 0xa822c8
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x90) returned 0xa82310
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x24) returned 0xa823a8
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x30) returned 0xa823d8
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x36) returned 0xa82410
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x48) returned 0xa82450
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x52) returned 0xa824a0
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x3c) returned 0xa82500
	[0144.309] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0xd6) returned 0xa82548
	[0144.310] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x2e) returned 0xa82628
	[0144.310] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x28) returned 0xa82660
	[0144.310] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x1e) returned 0xa82690
	[0144.310] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x2c) returned 0xa826b8
	[0144.310] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x50) returned 0xa826f0
	[0144.310] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x4e) returned 0xa82748
	[0144.310] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x24) returned 0xa827a0
	[0144.310] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x42) returned 0xa827d0
	[0144.310] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x20) returned 0xa82820
	[0144.310] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x38) returned 0xa82848
	[0144.310] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x24) returned 0xa82888
	[0144.310] HeapFree (in: hHeap=0xa80000, dwFlags=0x0, lpMem=0xa80fd0 | out: hHeap=0xa80000) returned 1
	[0144.311] GetLastError () returned 0x0
	[0144.311] SetLastError (dwErrCode=0x0) 
	[0144.311] GetLastError () returned 0x0
	[0144.311] SetLastError (dwErrCode=0x0) 
	[0144.311] GetLastError () returned 0x0
	[0144.311] SetLastError (dwErrCode=0x0) 
	[0144.311] GetACP () returned 0x4e4
	[0144.311] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x0, Size=0x220) returned 0xa828b8
	[0144.311] GetLastError () returned 0x0
	[0144.311] SetLastError (dwErrCode=0x0) 
	[0144.311] IsValidCodePage (CodePage=0x4e4) returned 1
	[0144.311] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1
	[0144.311] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1
	[0144.311] GetLastError () returned 0x0
	[0144.311] SetLastError (dwErrCode=0x0) 
	[0144.311] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f8d8 | out: lpCharType=0x19f8d8) returned 1
	[0144.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0144.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ៯AĀ") returned 256
	[0144.312] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ៯AĀ", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1
	[0144.312] GetLastError () returned 0x0
	[0144.312] SetLastError (dwErrCode=0x0) 
	[0144.312] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1
	[0144.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0144.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0144.312] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0144.312] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0144.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ,\x90±K\x94þ\x19", lpUsedDefaultChar=0x0) returned 256
	[0144.312] GetLastError () returned 0x0
	[0144.312] SetLastError (dwErrCode=0x0) 
	[0144.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0144.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0144.312] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0144.312] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256
	[0144.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ,\x90±K\x94þ\x19", lpUsedDefaultChar=0x0) returned 256
	[0144.312] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x800) returned 0xa80fd0
	[0144.312] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x80) returned 0xa817d8
	[0144.312] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4085ed) returned 0x0
	[0144.313] RtlSizeHeap (HeapHandle=0xa80000, Flags=0x0, MemoryPointer=0xa817d8) returned 0x80
	[0144.313] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.313] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.313] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.313] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.313] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.313] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.313] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.314] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.314] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.314] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.314] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.314] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.314] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.314] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.314] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.314] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.314] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.315] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.315] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.315] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.315] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.315] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.315] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.315] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.315] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.315] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.315] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.315] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.315] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.315] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.315] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.315] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.315] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.316] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.316] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.316] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.316] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.316] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.316] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.316] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.316] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.316] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.316] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.317] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.317] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.317] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.317] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.317] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.317] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.317] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.317] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.317] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.317] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.317] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.317] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.317] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.317] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.317] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.318] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.318] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.318] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.318] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.318] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.318] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.319] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.319] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.319] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.319] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.319] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.319] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.319] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.319] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.319] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.319] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.320] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.320] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.320] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.320] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.320] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.320] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.320] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.320] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.320] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.320] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.321] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.321] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.321] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.321] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.321] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.321] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.321] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.321] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.321] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.321] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.322] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.322] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.322] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.322] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.322] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.322] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.322] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.322] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.322] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.322] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.322] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.322] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.323] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.323] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.323] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.323] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.323] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.323] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.323] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.323] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.323] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.323] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.324] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.324] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.324] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.324] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.324] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.324] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.324] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.324] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.324] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.324] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.324] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.325] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.325] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.325] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.325] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.325] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.325] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.325] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.325] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.325] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.325] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.325] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.326] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.326] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.326] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.326] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.326] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.326] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.326] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.326] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.326] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.326] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.326] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.326] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.327] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.327] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.327] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.327] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.327] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.327] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.327] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.327] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.327] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.327] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.328] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.328] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.328] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.328] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.328] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.328] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.328] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.328] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.328] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.328] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.328] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.328] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.329] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.329] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.329] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.329] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.329] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.329] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.329] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.329] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.329] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.329] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.330] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.330] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.330] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.330] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.330] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.330] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.330] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.330] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.330] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.330] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.330] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.330] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.330] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.330] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.330] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.330] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.330] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.330] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.331] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.331] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.331] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.331] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.331] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.331] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.331] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.331] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.331] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.331] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.331] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.331] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.331] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.331] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.331] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.332] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.332] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.332] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.332] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.332] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.332] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.332] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.332] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.332] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.332] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.332] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.332] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.332] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.380] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.380] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.381] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.381] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.381] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.381] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.381] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.381] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.381] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.381] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.381] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.381] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.381] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.381] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.381] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.381] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.381] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.381] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.381] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.382] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.382] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.382] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.382] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.382] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.382] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.382] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.382] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.382] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.382] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.382] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.382] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.382] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.382] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.382] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.382] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.383] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.383] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.383] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.383] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.383] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.383] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.383] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.383] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.383] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.383] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.383] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.383] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.383] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.383] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.383] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.383] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.383] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.383] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.384] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.384] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.384] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.384] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.384] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.384] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.384] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.384] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.384] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.384] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.384] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.384] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.384] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.384] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.384] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.385] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.385] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.385] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.385] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.385] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.385] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.385] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.385] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.385] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.385] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.385] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.385] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.385] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.385] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.385] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.385] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.386] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.386] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.386] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.386] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.386] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.386] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.386] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.386] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.386] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.386] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.386] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.386] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.386] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.386] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.386] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.386] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.386] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.387] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.387] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.387] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.387] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.387] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.387] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.387] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.387] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.387] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.387] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.387] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.387] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.387] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.387] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.387] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.387] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.387] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.387] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.388] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.388] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.388] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.388] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.388] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.388] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.388] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.388] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.388] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.388] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.388] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.388] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.388] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.388] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.388] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.388] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.388] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.389] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.389] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.389] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.389] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.389] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.389] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.389] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.389] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.389] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.389] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.389] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.389] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.389] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.389] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.389] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.389] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.390] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.390] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.390] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.390] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.390] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.390] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.390] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.390] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.390] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.390] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.390] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.390] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.390] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.390] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.390] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.391] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.391] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.391] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.391] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.391] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.391] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.391] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.391] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.391] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.391] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.391] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.391] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.391] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.391] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.391] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.391] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.391] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.392] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.392] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.392] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.392] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.392] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.392] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.392] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.392] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.392] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.392] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.392] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.392] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.392] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.392] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.392] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.392] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.393] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.393] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.393] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.393] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.393] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.393] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.393] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.393] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.393] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.393] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.393] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.393] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.393] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.393] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.393] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.393] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.394] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.394] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.394] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.394] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.394] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.394] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.394] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.394] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.394] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.394] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.394] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.394] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.394] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.394] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.394] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.394] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.394] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.395] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.395] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.395] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.395] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.395] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.395] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.395] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.395] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.395] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.395] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.395] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.395] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.395] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.396] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.396] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.396] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.396] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.396] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.396] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.396] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.396] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.396] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.396] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.396] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.396] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.396] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.396] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.396] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.396] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.397] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.397] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.397] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.397] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.397] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.397] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.397] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.397] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.397] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.397] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.397] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.397] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.397] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.397] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.397] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.398] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.398] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.398] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.398] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.398] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.398] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.398] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.398] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.398] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.398] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.398] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.398] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.398] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.398] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.398] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.398] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.399] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.399] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.399] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.399] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.399] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.399] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.399] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.399] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.399] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.399] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.399] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.399] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.399] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.399] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.399] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.400] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.400] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.400] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.400] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.400] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.400] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.400] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.400] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.400] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.400] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.400] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.400] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.400] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.400] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.400] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.401] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.401] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.401] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.401] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.401] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.401] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.401] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.401] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.401] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.401] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.401] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.401] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.401] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.401] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.402] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.402] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.402] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.402] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.402] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.402] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.402] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.402] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.402] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.402] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.402] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.402] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.402] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.402] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.402] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.403] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.403] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.403] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.403] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.403] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.403] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.403] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.403] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.403] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.403] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.403] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.403] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.403] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.403] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.403] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.403] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.404] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.404] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.404] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.404] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.404] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.404] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.404] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.404] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.404] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.404] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.404] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.404] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.404] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.404] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.404] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.405] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.405] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.405] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.405] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.405] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.405] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.405] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.405] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.405] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.405] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.405] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.405] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.405] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.405] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.405] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.406] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.406] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.406] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.406] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.406] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.406] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.406] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.406] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.406] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.406] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.406] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.406] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.406] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.406] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.406] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.406] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.407] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.407] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.407] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.407] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.407] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.407] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.407] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.407] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.407] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.407] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.407] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.407] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.407] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.407] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.407] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.407] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.407] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.408] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.408] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0144.408] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0144.408] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0144.408] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.997] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.997] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.997] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.997] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.997] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.997] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.997] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.997] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.997] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.997] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.997] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.997] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.997] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.998] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.998] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.998] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.998] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.998] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.998] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.998] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.998] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.998] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.998] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.998] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.998] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.998] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.998] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.998] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.998] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.998] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.998] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.998] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.998] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.999] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.999] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.999] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.999] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.999] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.999] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.999] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.999] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.999] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.999] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.999] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.999] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.999] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.999] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.999] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.999] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.999] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.999] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0150.999] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0150.999] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.000] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.000] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.000] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.000] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.000] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.000] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.000] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.000] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.000] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.000] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.000] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.000] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.000] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.000] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.000] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.000] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.000] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.000] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.000] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.001] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.001] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.001] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.001] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.001] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.001] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.001] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.001] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.001] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.001] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.001] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.001] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.001] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.001] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.001] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.001] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.001] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.001] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.001] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.001] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.002] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.002] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.002] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.002] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.002] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.002] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.002] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.002] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.002] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.002] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.002] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.002] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.002] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.002] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.002] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.002] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.002] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.002] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.002] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.002] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.003] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.003] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.003] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.003] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.003] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.003] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.003] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.003] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.003] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.003] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.003] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.003] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.003] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.003] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.003] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.003] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.003] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.003] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.003] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.003] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.004] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.004] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.004] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.004] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.004] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.004] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.004] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.004] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.004] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.004] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.004] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.004] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.004] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.004] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.004] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.004] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.004] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.004] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.004] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.005] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.005] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.005] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.005] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.005] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.005] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.005] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.005] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.005] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.005] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.005] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.005] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.005] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.005] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.005] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.005] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.005] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.005] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.005] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.006] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.006] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.006] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.006] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.006] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.006] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.006] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.006] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.006] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.006] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.006] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.006] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.006] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.006] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.006] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.006] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.006] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.006] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.006] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.006] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.007] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.007] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.007] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.007] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.007] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.007] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.007] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.007] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.007] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.007] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.007] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.007] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.007] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.007] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.007] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.007] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.007] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.007] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.007] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.008] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.008] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.008] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.008] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.008] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.008] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.008] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.008] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.008] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.008] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.008] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.008] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.008] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.008] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.008] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.008] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.008] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.008] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.008] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.009] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.009] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.009] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.009] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.009] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.009] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.009] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.009] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.009] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.009] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.009] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.009] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.009] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.009] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.009] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.009] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.009] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.009] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.009] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.010] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.010] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.010] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.010] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.010] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.010] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.010] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.010] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.010] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.010] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.010] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.010] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.010] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.010] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.010] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.010] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.010] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.010] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.010] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.010] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.011] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.011] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.011] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.011] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.011] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.011] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.011] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.011] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.011] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.011] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.011] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.011] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.011] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.011] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.011] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.011] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.011] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.011] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.011] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.011] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.011] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.012] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.012] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.012] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.012] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.012] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.012] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.012] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.012] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.012] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.012] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.012] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.012] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.012] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.012] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.012] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.012] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.012] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.013] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.013] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.013] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.013] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.013] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.013] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.013] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.013] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.013] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.013] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.013] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.013] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.013] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.013] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.013] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.013] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.013] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.013] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.013] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.014] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.014] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.014] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.014] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.014] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.014] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.014] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.014] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.014] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.014] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.014] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.014] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.014] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.014] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.014] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.014] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.014] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.014] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.014] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.014] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.015] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.015] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.015] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.015] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.015] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.015] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.015] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.015] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.015] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.015] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.015] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.015] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.015] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.015] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.015] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.015] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.015] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.015] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.015] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.015] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.016] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.016] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.016] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.016] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.016] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.016] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.016] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.016] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.016] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.016] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.016] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.016] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.016] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.016] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.016] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.016] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.016] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.016] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.017] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.017] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.017] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.017] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.017] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.017] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.017] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.017] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.017] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.017] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.017] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.017] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.017] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.017] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.017] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.017] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.017] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.017] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.018] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.018] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.018] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.018] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.018] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.018] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.018] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.018] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.018] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.018] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.018] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.018] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.018] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.018] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.018] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.018] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.018] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.018] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.018] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.018] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.019] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.019] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.019] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.019] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.019] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.019] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.019] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.019] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.019] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.019] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.019] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.019] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.019] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.019] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.019] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.019] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.019] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.019] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.019] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.020] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.020] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.020] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.020] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.020] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.020] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.020] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.020] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.020] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.020] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.020] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.020] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.020] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.020] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.020] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.020] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.020] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.020] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.020] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.021] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.021] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.021] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.021] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.021] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.021] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.021] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.021] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.021] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.021] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.021] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.021] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.021] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.021] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.021] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.021] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.021] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.021] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.021] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.022] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.022] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.022] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.022] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.022] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.022] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.022] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.022] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.022] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.022] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.022] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.022] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.022] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.022] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.022] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.022] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.022] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.022] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.022] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.023] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0151.023] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0151.036] lstrlenW (lpString="") returned 0
	[0151.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.036] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.036] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.037] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.037] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.038] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.038] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.039] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.039] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.040] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.040] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.041] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.041] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.042] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.042] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.043] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.043] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.084] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.084] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.084] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.084] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.084] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.084] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.084] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.084] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.084] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.084] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.084] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.084] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.085] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.085] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.085] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.085] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.085] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.085] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.085] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.085] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.085] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.085] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.085] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.085] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.085] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.085] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.085] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.085] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.086] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.086] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.086] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.086] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.086] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.086] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.086] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.086] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.086] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.086] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.086] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.086] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.086] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.086] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.086] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.086] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.087] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.087] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.087] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.087] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.087] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.087] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.087] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.087] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.087] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.087] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.087] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.087] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.087] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.087] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.087] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.087] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.088] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.088] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.088] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.088] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.088] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.088] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.088] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.088] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.088] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.088] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.088] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.088] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.088] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.088] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.088] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.088] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.088] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.089] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.089] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.089] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.089] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.089] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.089] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.089] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.089] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.089] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.089] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.089] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.089] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.089] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.089] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.089] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.089] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.090] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.090] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.090] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.090] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.090] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.090] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.090] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.090] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.090] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.090] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.090] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.090] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.090] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.090] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.090] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.091] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.091] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.091] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.091] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.091] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.091] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.091] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.091] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.091] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.091] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.091] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.091] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.091] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.091] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.092] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.092] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.092] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.092] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.092] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.092] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.092] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.092] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.092] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.092] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.092] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.092] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.092] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.092] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.092] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.092] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.093] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.093] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.093] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.093] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.093] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.093] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.093] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.093] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.093] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.093] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.093] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.093] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.093] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.093] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.093] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.093] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.094] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.094] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.094] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.094] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.094] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.094] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.094] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.094] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.094] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.094] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.094] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.094] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.094] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.094] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.094] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.094] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.094] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.095] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.095] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.095] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.095] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.095] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.095] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.095] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.095] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.095] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.095] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.095] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.095] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.095] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.095] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.095] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.095] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.096] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.096] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.096] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.096] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.096] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.096] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.096] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.096] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.096] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.096] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.096] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.096] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.096] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.096] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.096] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.096] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.097] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.097] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.097] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.097] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.097] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.097] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.097] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.097] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.097] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.097] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.097] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.097] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.097] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.097] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.097] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.097] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.097] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.098] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.098] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.098] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.098] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.098] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.098] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.098] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.098] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.098] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.098] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.098] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.098] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.098] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.098] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.098] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.098] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.098] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.099] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.099] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.099] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.099] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.099] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.099] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.099] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.099] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.099] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.099] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.099] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.099] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.099] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.099] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.099] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.099] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.100] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.100] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.100] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.100] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.100] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.100] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.100] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.100] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.100] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.100] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.100] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.100] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.100] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.100] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.100] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.101] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.101] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.101] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.101] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.101] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.101] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.101] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.101] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.101] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.101] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.101] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.101] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.101] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.101] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.101] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.101] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.102] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.102] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.102] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.102] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.102] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.102] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.102] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.102] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.102] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.102] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.102] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.102] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.102] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.102] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.102] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.102] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.103] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.103] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.103] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.103] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.103] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.103] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.103] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.103] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.103] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.103] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.103] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.103] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.103] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.103] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.103] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.103] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.104] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.104] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.104] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.104] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.104] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.104] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.104] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.104] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.105] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.105] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.105] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.105] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.105] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.105] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.105] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.105] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.105] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.106] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.106] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.106] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.106] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.106] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.106] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.106] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.106] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.107] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.107] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.107] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.107] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.107] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.107] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.107] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.107] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.107] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0151.107] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0151.185] VirtualProtect (in: lpAddress=0x4826c8, dwSize=0x13b5f, flNewProtect=0x40, lpflOldProtect=0x19d2c0 | out: lpflOldProtect=0x19d2c0*=0x4) returned 1
	[0151.200] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x760c0000
	[0151.200] GetProcAddress (hModule=0x760c0000, lpProcName="GlobalAlloc") returned 0x760d5750
	[0151.496] GetProcAddress (hModule=0x760c0000, lpProcName="GetLastError") returned 0x760d5010
	[0151.496] GetProcAddress (hModule=0x760c0000, lpProcName="Sleep") returned 0x760d6760
	[0151.496] GetProcAddress (hModule=0x760c0000, lpProcName="VirtualAlloc") returned 0x760d6970
	[0151.497] GetProcAddress (hModule=0x760c0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7610edc0
	[0151.497] GetProcAddress (hModule=0x760c0000, lpProcName="Module32First") returned 0x7610fc90
	[0151.497] GetProcAddress (hModule=0x760c0000, lpProcName="CloseHandle") returned 0x7612eab0
	[0151.497] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0xe4
	[0151.500] Module32First (hSnapshot=0xe4, lpme=0x19cbe8) returned 1
	[0151.500] VirtualAlloc (lpAddress=0x0, dwSize=0x18050, flAllocationType=0x1000, flProtect=0x40) returned 0x1e0000
	[0151.504] GetProcAddress (hModule=0x760c0000, lpProcName="LoadLibraryA") returned 0x760d5a80
	[0151.504] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x760c0000
	[0151.504] GetProcAddress (hModule=0x760c0000, lpProcName="VirtualAlloc") returned 0x760d6970
	[0151.504] GetProcAddress (hModule=0x760c0000, lpProcName="VirtualProtect") returned 0x760d6a30
	[0151.504] GetProcAddress (hModule=0x760c0000, lpProcName="VirtualFree") returned 0x760d69d0
	[0151.504] GetProcAddress (hModule=0x760c0000, lpProcName="GetVersionExA") returned 0x760d56d0
	[0151.504] GetProcAddress (hModule=0x760c0000, lpProcName="TerminateProcess") returned 0x760d67e0
	[0151.504] GetProcAddress (hModule=0x760c0000, lpProcName="ExitProcess") returned 0x760d3cb0
	[0151.504] GetProcAddress (hModule=0x760c0000, lpProcName="SetErrorMode") returned 0x760d6500
	[0151.504] SetErrorMode (uMode=0x400) returned 0x0
	[0151.504] SetErrorMode (uMode=0x0) returned 0x400
	[0151.504] GetVersionExA (in: lpVersionInformation=0x19bb18*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x47a9c8, dwBuildNumber=0x47ae38, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19bb18*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0151.504] VirtualAlloc (lpAddress=0x0, dwSize=0x17200, flAllocationType=0x1000, flProtect=0x4) returned 0x450000
	[0151.507] VirtualProtect (in: lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x40, lpflOldProtect=0x19cba0 | out: lpflOldProtect=0x19cba0*=0x2) returned 1
	[0151.513] VirtualFree (lpAddress=0x450000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0151.513] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x760c0000
	[0151.513] GetProcAddress (hModule=0x760c0000, lpProcName="GetProcAddress") returned 0x760d51b0
	[0151.513] GetProcAddress (hModule=0x760c0000, lpProcName="LoadLibraryA") returned 0x760d5a80
	[0151.513] GetProcAddress (hModule=0x760c0000, lpProcName="WaitForSingleObject") returned 0x7612eca0
	[0151.513] GetProcAddress (hModule=0x760c0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7612ebb0
	[0151.513] GetProcAddress (hModule=0x760c0000, lpProcName="LeaveCriticalSection") returned 0x77a3b250
	[0151.513] GetProcAddress (hModule=0x760c0000, lpProcName="GetLastError") returned 0x760d5010
	[0151.514] GetProcAddress (hModule=0x760c0000, lpProcName="EnterCriticalSection") returned 0x77a3b2d0
	[0151.514] GetProcAddress (hModule=0x760c0000, lpProcName="ReleaseMutex") returned 0x7612ec20
	[0151.514] GetProcAddress (hModule=0x760c0000, lpProcName="CloseHandle") returned 0x7612eab0
	[0151.514] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74350000
	[0151.517] GetProcAddress (hModule=0x74350000, lpProcName="atexit") returned 0x7436c544
	[0151.518] atexit (param_1=0x1e0920) returned 0
	[0151.518] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x760c0000
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="GetProcAddress") returned 0x760d51b0
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="GetModuleHandleW") returned 0x760d50d0
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="FindNextFileW") returned 0x7612ee40
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="FindClose") returned 0x7612ed70
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="MoveFileW") returned 0x7610e500
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="GetFileSizeEx") returned 0x7612ef40
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="GetModuleFileNameW") returned 0x760d5090
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="GetFileAttributesW") returned 0x7612ef10
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="ExitProcess") returned 0x760d3cb0
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="GetCommandLineW") returned 0x760d4cc0
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="GetComputerNameW") returned 0x761032c0
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="GetComputerNameA") returned 0x76103780
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="CreateMutexW") returned 0x7612eb70
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="lstrlenW") returned 0x760d6c70
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="lstrlenA") returned 0x760d6c50
	[0151.519] GetProcAddress (hModule=0x760c0000, lpProcName="GetCurrentProcess") returned 0x7612ea10
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="WaitForSingleObject") returned 0x7612eca0
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="GetLogicalDrives") returned 0x760d0d20
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="GetTickCount") returned 0x7612dd50
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="DeleteFileW") returned 0x7612ed40
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="WideCharToMultiByte") returned 0x760d6b10
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7612ebb0
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="Sleep") returned 0x760d6760
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="LeaveCriticalSection") returned 0x77a3b250
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="ReadFile") returned 0x7612f090
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="CreateFileW") returned 0x7612ed10
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="OpenMutexW") returned 0x7612ebf0
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="EnterCriticalSection") returned 0x77a3b2d0
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="WaitForMultipleObjects") returned 0x7612ec80
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="lstrcmpiW") returned 0x760d6bf0
	[0151.520] GetProcAddress (hModule=0x760c0000, lpProcName="lstrcmpiA") returned 0x760d6bd0
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="DeleteCriticalSection") returned 0x77a1fb90
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="ReleaseMutex") returned 0x7612ec20
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="CloseHandle") returned 0x7612eab0
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="GetVersion") returned 0x760d56c0
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="CreateThread") returned 0x760d46b0
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="ExpandEnvironmentStringsW") returned 0x760d4a40
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="QueryPerformanceCounter") returned 0x760d5da0
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="QueryPerformanceFrequency") returned 0x760d5dc0
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="GetCurrentProcessId") returned 0x7612ea20
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="SetFileAttributesW") returned 0x7612f100
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="GetVolumeInformationW") returned 0x7612f020
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="WriteFile") returned 0x7612f180
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="SetFilePointerEx") returned 0x7612f130
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="SetEndOfFile") returned 0x7612f0e0
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="FindFirstFileW") returned 0x7612edf0
	[0151.521] GetProcAddress (hModule=0x760c0000, lpProcName="GetProcessHeap") returned 0x760d51f0
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="HeapReAlloc") returned 0x77a2f630
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="HeapAlloc") returned 0x77a32dc0
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="HeapFree") returned 0x760d57f0
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="CreatePipe") returned 0x760d4590
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="SetHandleInformation") returned 0x7612eae0
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="CreateProcessW") returned 0x760d4610
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="CompareStringW") returned 0x760d4430
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="CompareStringA") returned 0x760d4410
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="OpenProcess") returned 0x760d5cc0
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="TerminateProcess") returned 0x760d67e0
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="GetSystemTime") returned 0x760d54e0
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="SystemTimeToFileTime") returned 0x760d67a0
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="GetLastError") returned 0x760d5010
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7610edc0
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="Process32NextW") returned 0x7610f8f0
	[0151.522] GetProcAddress (hModule=0x760c0000, lpProcName="Process32FirstW") returned 0x7610f750
	[0151.522] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x774c0000
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="RegOpenKeyExW") returned 0x774de580
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="RegQueryValueExW") returned 0x774de5a0
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="RegSetValueExW") returned 0x774df530
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="RegCloseKey") returned 0x774ded60
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="OpenProcessToken") returned 0x774defb0
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="GetTokenInformation") returned 0x774dee90
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="OpenSCManagerW") returned 0x774e0540
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="OpenServiceW") returned 0x774dfa20
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="CloseServiceHandle") returned 0x774dfc00
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="ControlService") returned 0x774f26d0
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="QueryServiceStatus") returned 0x774e2380
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="EnumDependentServicesW") returned 0x774f2f70
	[0151.523] GetProcAddress (hModule=0x774c0000, lpProcName="EnumServicesStatusExW") returned 0x774dfc80
	[0151.523] LoadLibraryA (lpLibFileName="user32.dll") returned 0x775a0000
	[0151.655] GetProcAddress (hModule=0x775a0000, lpProcName="SystemParametersInfoW") returned 0x775cf210
	[0151.655] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x74b50000
	[0152.577] GetProcAddress (hModule=0x74b50000, lpProcName="ShellExecuteExW") returned 0x74cb4730
	[0152.578] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x779f0000
	[0152.578] GetProcAddress (hModule=0x779f0000, lpProcName="NtQuerySystemInformation") returned 0x77a62070
	[0152.578] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74330000
	[0152.580] GetProcAddress (hModule=0x74330000, lpProcName="WNetCloseEnum") returned 0x74332640
	[0152.580] GetProcAddress (hModule=0x74330000, lpProcName="WNetOpenEnumW") returned 0x74332790
	[0152.580] GetProcAddress (hModule=0x74330000, lpProcName="WNetEnumResourceW") returned 0x74332410
	[0152.580] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x778f0000
	[0152.733] GetProcAddress (hModule=0x778f0000, lpProcName="WSAStartup") returned 0x778f5b40
	[0152.733] GetProcAddress (hModule=0x778f0000, lpProcName="socket") returned 0x77904510
	[0152.733] GetProcAddress (hModule=0x778f0000, lpProcName="send") returned 0x778f5030
	[0152.733] GetProcAddress (hModule=0x778f0000, lpProcName="recv") returned 0x77900c50
	[0152.733] GetProcAddress (hModule=0x778f0000, lpProcName="connect") returned 0x778f5410
	[0152.733] GetProcAddress (hModule=0x778f0000, lpProcName="closesocket") returned 0x77900910
	[0152.733] GetProcAddress (hModule=0x778f0000, lpProcName="gethostbyname") returned 0x77926cb0
	[0152.733] GetProcAddress (hModule=0x778f0000, lpProcName="inet_addr") returned 0x77909160
	[0152.734] GetProcAddress (hModule=0x778f0000, lpProcName="ntohl") returned 0x778f49d0
	[0152.734] GetProcAddress (hModule=0x778f0000, lpProcName="htonl") returned 0x778f49d0
	[0152.734] GetProcAddress (hModule=0x778f0000, lpProcName="htons") returned 0x77908ff0
	[0152.734] GetProcessHeap () returned 0x470000
	[0152.734] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x47b130
	[0152.734] QueryPerformanceCounter (in: lpPerformanceCount=0x19c9f0 | out: lpPerformanceCount=0x19c9f0*=6334272968) returned 1
	[0152.734] GetTickCount () returned 0x1139fd0
	[0152.734] GetCurrentProcessId () returned 0xdc0
	[0152.736] GetTickCount () returned 0x1139fd0
	[0152.736] GetTickCount () returned 0x1139fd0
	[0152.736] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x4a1b88
	[0152.737] GetVersion () returned 0x23f00206
	[0152.737] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x7) returned 0x49b068
	[0152.737] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x49c350
	[0152.737] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x49c350, Size=0x20) returned 0x4a1a48
	[0152.737] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x4a1a48, Size=0x40) returned 0x49bc18
	[0152.737] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0xfffe) returned 0x4a21a8
	[0152.750] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_B93J12A") returned 0x1f0
	[0152.750] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x49b068 | out: hHeap=0x470000) returned 1
	[0152.750] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0152.750] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x49bc18 | out: hHeap=0x470000) returned 1
	[0152.750] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x7) returned 0x49b168
	[0152.750] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x49c3f8
	[0152.750] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x49c3f8, Size=0x20) returned 0x4a1c78
	[0152.750] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x4a1c78, Size=0x40) returned 0x49bc18
	[0152.750] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0xfffe) returned 0x4b21b0
	[0152.750] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_B93J12U") returned 0x1f4
	[0152.750] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x49b168 | out: hHeap=0x470000) returned 1
	[0152.750] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0152.750] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x49bc18 | out: hHeap=0x470000) returned 1
	[0152.750] GetVersion () returned 0x23f00206
	[0152.751] GetCurrentProcess () returned 0xffffffff
	[0152.751] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19c9dc | out: TokenHandle=0x19c9dc*=0x1f8) returned 1
	[0152.751] GetTokenInformation (in: TokenHandle=0x1f8, TokenInformationClass=0x14, TokenInformation=0x19c9d8, TokenInformationLength=0x4, ReturnLength=0x19c9e4 | out: TokenInformation=0x19c9d8, ReturnLength=0x19c9e4) returned 1
	[0152.751] CloseHandle (hObject=0x1f8) returned 1
	[0152.751] WaitForSingleObject (hHandle=0x1f4, dwMilliseconds=0x0) returned 0x102
	[0152.751] ExitProcess (uExitCode=0x0) 
	[0152.956] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) 

Thread:
	id = 32
	os_tid = 0xdc8


Process:
	id = "7"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x30e7a000"
	os_pid = "0xde0"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0xdb4"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012a52" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 33
	os_tid = 0xde4

	[0155.698] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff60c010000
	[0155.698] __set_app_type (_Type=0x1) 
	[0155.698] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff60c026d00) returned 0x0
	[0155.698] __getmainargs (in: _Argc=0x7ff60c049200, _Argv=0x7ff60c049208, _Env=0x7ff60c049210, _DoWildCard=0, _StartInfo=0x7ff60c04921c | out: _Argc=0x7ff60c049200, _Argv=0x7ff60c049208, _Env=0x7ff60c049210) returned 0
	[0155.698] _onexit (_Func=0x7ff60c027fd0) returned 0x7ff60c027fd0
	[0155.698] _onexit (_Func=0x7ff60c027fe0) returned 0x7ff60c027fe0
	[0155.698] _onexit (_Func=0x7ff60c027ff0) returned 0x7ff60c027ff0
	[0155.698] _onexit (_Func=0x7ff60c028000) returned 0x7ff60c028000
	[0155.699] _onexit (_Func=0x7ff60c028010) returned 0x7ff60c028010
	[0155.699] _onexit (_Func=0x7ff60c028020) returned 0x7ff60c028020
	[0155.699] GetCurrentThreadId () returned 0xde4
	[0155.699] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xde4) returned 0x70
	[0155.699] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe92270000
	[0155.700] GetProcAddress (hModule=0x7ffe92270000, lpProcName="SetThreadUILanguage") returned 0x7ffe9228a990
	[0155.700] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0156.045] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0156.045] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2d258ffac8 | out: phkResult=0x2d258ffac8*=0x0) returned 0x2
	[0156.045] VirtualQuery (in: lpAddress=0x2d258ffab4, lpBuffer=0x2d258ffa30, dwLength=0x30 | out: lpBuffer=0x2d258ffa30*(BaseAddress=0x2d258ff000, AllocationBase=0x2d25800000, AllocationProtect=0x4, __alignment1=0xffffe785, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0156.045] VirtualQuery (in: lpAddress=0x2d25800000, lpBuffer=0x2d258ffa30, dwLength=0x30 | out: lpBuffer=0x2d258ffa30*(BaseAddress=0x2d25800000, AllocationBase=0x2d25800000, AllocationProtect=0x4, __alignment1=0xffffe785, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0156.046] VirtualQuery (in: lpAddress=0x2d25801000, lpBuffer=0x2d258ffa30, dwLength=0x30 | out: lpBuffer=0x2d258ffa30*(BaseAddress=0x2d25801000, AllocationBase=0x2d25800000, AllocationProtect=0x4, __alignment1=0xffffe785, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0156.046] VirtualQuery (in: lpAddress=0x2d25804000, lpBuffer=0x2d258ffa30, dwLength=0x30 | out: lpBuffer=0x2d258ffa30*(BaseAddress=0x2d25804000, AllocationBase=0x2d25800000, AllocationProtect=0x4, __alignment1=0xffffe785, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0156.046] VirtualQuery (in: lpAddress=0x2d25900000, lpBuffer=0x2d258ffa30, dwLength=0x30 | out: lpBuffer=0x2d258ffa30*(BaseAddress=0x2d25900000, AllocationBase=0x2d25900000, AllocationProtect=0x4, __alignment1=0xffffe785, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0156.046] GetConsoleOutputCP () returned 0x1b5
	[0156.240] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff60c04fbb0 | out: lpCPInfo=0x7ff60c04fbb0) returned 1
	[0156.240] SetConsoleCtrlHandler (HandlerRoutine=0x7ff60c038150, Add=1) returned 1
	[0156.240] _get_osfhandle (_FileHandle=1) returned 0x258
	[0156.240] GetConsoleMode (in: hConsoleHandle=0x258, lpMode=0x7ff60c04fc04 | out: lpMode=0x7ff60c04fc04) returned 0
	[0156.240] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0156.240] GetConsoleMode (in: hConsoleHandle=0x24c, lpMode=0x7ff60c04fc00 | out: lpMode=0x7ff60c04fc00) returned 0
	[0156.240] _get_osfhandle (_FileHandle=1) returned 0x258
	[0156.240] SetConsoleMode (hConsoleHandle=0x258, dwMode=0x0) returned 0
	[0156.240] _get_osfhandle (_FileHandle=1) returned 0x258
	[0156.240] GetConsoleMode (in: hConsoleHandle=0x258, lpMode=0x7ff60c04fc08 | out: lpMode=0x7ff60c04fc08) returned 0
	[0156.240] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0156.240] GetConsoleMode (in: hConsoleHandle=0x24c, lpMode=0x7ff60c04fc0c | out: lpMode=0x7ff60c04fc0c) returned 0
	[0156.240] GetEnvironmentStringsW () returned 0x15bd1745a40*
	[0156.241] GetProcessHeap () returned 0x15bd1740000
	[0156.241] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xab6) returned 0x15bd1746500
	[0156.241] FreeEnvironmentStringsA (penv="=") returned 1
	[0156.241] GetProcessHeap () returned 0x15bd1740000
	[0156.241] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x8) returned 0x15bd1745a40
	[0156.241] GetEnvironmentStringsW () returned 0x15bd1746fd0*
	[0156.241] GetProcessHeap () returned 0x15bd1740000
	[0156.241] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xab6) returned 0x15bd1747a90
	[0156.241] FreeEnvironmentStringsA (penv="=") returned 1
	[0156.241] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2d258fe978 | out: phkResult=0x2d258fe978*=0x7c) returned 0x0
	[0156.242] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x0, lpData=0x2d258fe990*=0x4, lpcbData=0x2d258fe974*=0x1000) returned 0x2
	[0156.242] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x4, lpData=0x2d258fe990*=0x1, lpcbData=0x2d258fe974*=0x4) returned 0x0
	[0156.242] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x0, lpData=0x2d258fe990*=0x1, lpcbData=0x2d258fe974*=0x1000) returned 0x2
	[0156.242] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x4, lpData=0x2d258fe990*=0x0, lpcbData=0x2d258fe974*=0x4) returned 0x0
	[0156.242] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x4, lpData=0x2d258fe990*=0x40, lpcbData=0x2d258fe974*=0x4) returned 0x0
	[0156.242] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x4, lpData=0x2d258fe990*=0x40, lpcbData=0x2d258fe974*=0x4) returned 0x0
	[0156.242] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x0, lpData=0x2d258fe990*=0x40, lpcbData=0x2d258fe974*=0x1000) returned 0x2
	[0156.242] RegCloseKey (hKey=0x7c) returned 0x0
	[0156.242] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2d258fe978 | out: phkResult=0x2d258fe978*=0x7c) returned 0x0
	[0156.242] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x0, lpData=0x2d258fe990*=0x40, lpcbData=0x2d258fe974*=0x1000) returned 0x2
	[0156.242] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x4, lpData=0x2d258fe990*=0x1, lpcbData=0x2d258fe974*=0x4) returned 0x0
	[0156.242] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x0, lpData=0x2d258fe990*=0x1, lpcbData=0x2d258fe974*=0x1000) returned 0x2
	[0156.242] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x4, lpData=0x2d258fe990*=0x0, lpcbData=0x2d258fe974*=0x4) returned 0x0
	[0156.243] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x4, lpData=0x2d258fe990*=0x9, lpcbData=0x2d258fe974*=0x4) returned 0x0
	[0156.243] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x4, lpData=0x2d258fe990*=0x9, lpcbData=0x2d258fe974*=0x4) returned 0x0
	[0156.243] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2d258fe970, lpData=0x2d258fe990, lpcbData=0x2d258fe974*=0x1000 | out: lpType=0x2d258fe970*=0x0, lpData=0x2d258fe990*=0x9, lpcbData=0x2d258fe974*=0x1000) returned 0x2
	[0156.243] RegCloseKey (hKey=0x7c) returned 0x0
	[0156.243] time (in: timer=0x0 | out: timer=0x0) returned 0x5dbc0dca
	[0156.243] srand (_Seed=0x5dbc0dca) 
	[0156.243] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0156.243] malloc (_Size=0x4000) returned 0x15bd1735530
	[0156.243] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0156.243] malloc (_Size=0xffce) returned 0x15bd1910080
	[0156.244] ??_V@YAXPEAX@Z () returned 0x15bd1910080
	[0156.244] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x15bd1910080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0156.244] malloc (_Size=0xffce) returned 0x15bd1920060
	[0156.245] ??_V@YAXPEAX@Z () returned 0x15bd1920060
	[0156.245] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x15bd1920060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0156.246] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc
	[0156.246] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0156.246] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0156.246] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0156.246] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0156.246] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0156.246] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0156.246] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0156.246] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0156.246] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0156.246] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0156.246] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0156.246] GetProcessHeap () returned 0x15bd1740000
	[0156.246] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1746500) returned 1
	[0156.246] GetEnvironmentStringsW () returned 0x15bd1745a60*
	[0156.246] GetProcessHeap () returned 0x15bd1740000
	[0156.246] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xace) returned 0x15bd1746540
	[0156.246] FreeEnvironmentStringsA (penv="=") returned 1
	[0156.246] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0156.246] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0156.246] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0156.246] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0156.246] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0156.246] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0156.246] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0156.246] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0156.246] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0156.246] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0156.247] malloc (_Size=0xffce) returned 0x15bd1930040
	[0156.247] ??_V@YAXPEAX@Z () returned 0x15bd1930040
	[0156.247] GetProcessHeap () returned 0x15bd1740000
	[0156.247] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x38) returned 0x15bd1748580
	[0156.247] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x15bd1930040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0156.247] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x15bd1930040, lpFilePart=0x2d258ff4f0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x2d258ff4f0*="system32") returned 0x13
	[0156.248] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0156.248] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x2d258ff220 | out: lpFindFileData=0x2d258ff220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x15bd17485c0
	[0156.248] FindClose (in: hFindFile=0x15bd17485c0 | out: hFindFile=0x15bd17485c0) returned 1
	[0156.248] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x2d258ff220 | out: lpFindFileData=0x2d258ff220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xd553903c, ftLastAccessTime.dwHighDateTime=0x1d590a1, ftLastWriteTime.dwLowDateTime=0xd553903c, ftLastWriteTime.dwHighDateTime=0x1d590a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x15bd17485c0
	[0156.248] FindClose (in: hFindFile=0x15bd17485c0 | out: hFindFile=0x15bd17485c0) returned 1
	[0156.248] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0156.249] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0156.249] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0156.249] GetProcessHeap () returned 0x15bd1740000
	[0156.249] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1746540) returned 1
	[0156.249] GetEnvironmentStringsW () returned 0x15bd1745a60*
	[0156.249] GetProcessHeap () returned 0x15bd1740000
	[0156.249] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xafe) returned 0x15bd1746570
	[0156.249] FreeEnvironmentStringsA (penv="=") returned 1
	[0156.249] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x15bd1910080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0156.249] GetProcessHeap () returned 0x15bd1740000
	[0156.249] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1748580) returned 1
	[0156.249] ??_V@YAXPEAX@Z () returned 0x1
	[0156.249] ??_V@YAXPEAX@Z () returned 0x1
	[0156.249] GetProcessHeap () returned 0x15bd1740000
	[0156.249] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x4016) returned 0x15bd1748580
	[0156.249] GetProcessHeap () returned 0x15bd1740000
	[0156.249] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1748580) returned 1
	[0156.249] GetConsoleOutputCP () returned 0x1b5
	[0156.669] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff60c04fbb0 | out: lpCPInfo=0x7ff60c04fbb0) returned 1
	[0156.669] GetUserDefaultLCID () returned 0x409
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff60c04bb78, cchData=8 | out: lpLCData=":") returned 2
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2d258ff8b0, cchData=128 | out: lpLCData="0") returned 2
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2d258ff8b0, cchData=128 | out: lpLCData="0") returned 2
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2d258ff8b0, cchData=128 | out: lpLCData="1") returned 2
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff60c04bb68, cchData=8 | out: lpLCData="/") returned 2
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff60c04bb00, cchData=32 | out: lpLCData="Mon") returned 4
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff60c04bac0, cchData=32 | out: lpLCData="Tue") returned 4
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff60c04ba80, cchData=32 | out: lpLCData="Wed") returned 4
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff60c04ba40, cchData=32 | out: lpLCData="Thu") returned 4
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff60c04ba00, cchData=32 | out: lpLCData="Fri") returned 4
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff60c04b9c0, cchData=32 | out: lpLCData="Sat") returned 4
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff60c04b980, cchData=32 | out: lpLCData="Sun") returned 4
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff60c04bb58, cchData=8 | out: lpLCData=".") returned 2
	[0156.670] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff60c04bb40, cchData=8 | out: lpLCData=",") returned 2
	[0156.670] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0156.672] GetProcessHeap () returned 0x15bd1740000
	[0156.672] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x0, Size=0x20c) returned 0x15bd17470f0
	[0156.672] GetConsoleTitleW (in: lpConsoleTitle=0x15bd17470f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0157.095] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.096] GetFileType (hFile=0x258) returned 0x3
	[0157.096] ApiSetQueryApiSetPresence () returned 0x0
	[0157.097] ResolveDelayLoadedAPI () returned 0x7ffe89f4d990
	[0157.106] BrandingFormatString () returned 0x15bd17462f0
	[0157.114] GetVersion () returned 0x3ad7000a
	[0157.114] _vsnwprintf (in: _Buffer=0x2d258ffa10, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x2d258ff9a8 | out: _Buffer="10.0.15063") returned 10
	[0157.114] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.114] GetFileType (hFile=0x258) returned 0x3
	[0157.114] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff60c057f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0157.114] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff60c057f60, nSize=0x2000, Arguments=0x2d258ff9b0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26
	[0157.114] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.114] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39
	[0157.114] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2d258ff908, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff908*=0x26, lpOverlapped=0x0) returned 1
	[0157.115] _vsnwprintf (in: _Buffer=0x7ff60c057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2d258ff9d8 | out: _Buffer="\r\n") returned 2
	[0157.115] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.115] GetFileType (hFile=0x258) returned 0x3
	[0157.115] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.115] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0157.115] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2d258ff9a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff9a8*=0x2, lpOverlapped=0x0) returned 1
	[0157.115] _vsnwprintf (in: _Buffer=0x7ff60c057f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x2d258ff9d8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52
	[0157.115] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.115] GetFileType (hFile=0x258) returned 0x3
	[0157.115] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.115] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53
	[0157.115] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x2d258ff9a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff9a8*=0x34, lpOverlapped=0x0) returned 1
	[0157.115] _vsnwprintf (in: _Buffer=0x7ff60c057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2d258ff9d8 | out: _Buffer="\r\n") returned 2
	[0157.115] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.115] GetFileType (hFile=0x258) returned 0x3
	[0157.115] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.115] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0157.115] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2d258ff9a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff9a8*=0x2, lpOverlapped=0x0) returned 1
	[0157.116] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe92270000
	[0157.116] GetProcAddress (hModule=0x7ffe92270000, lpProcName="CopyFileExW") returned 0x7ffe9228e830
	[0157.116] GetProcAddress (hModule=0x7ffe92270000, lpProcName="IsDebuggerPresent") returned 0x7ffe9228e300
	[0157.116] GetProcAddress (hModule=0x7ffe92270000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffe91560a40
	[0157.116] ??_V@YAXPEAX@Z () returned 0x1
	[0157.116] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.116] GetFileType (hFile=0x24c) returned 0x3
	[0157.116] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0157.116] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x2d258ff818 | out: TokenHandle=0x2d258ff818*=0x0) returned 0xc000007c
	[0157.116] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x2d258ff818 | out: TokenHandle=0x2d258ff818*=0x94) returned 0x0
	[0157.116] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x2d258ff7c8, TokenInformationLength=0x4, ReturnLength=0x2d258ff7d0 | out: TokenInformation=0x2d258ff7c8, ReturnLength=0x2d258ff7d0) returned 0x0
	[0157.117] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x2d258ff7d0, TokenInformationLength=0x4, ReturnLength=0x2d258ff7c8 | out: TokenInformation=0x2d258ff7d0, ReturnLength=0x2d258ff7c8) returned 0x0
	[0157.117] NtClose (Handle=0x94) returned 0x0
	[0157.123] _vsnwprintf (in: _Buffer=0x7ff60c057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2d258ff658 | out: _Buffer="\r\n") returned 2
	[0157.123] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.123] GetFileType (hFile=0x258) returned 0x3
	[0157.123] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.123] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0157.123] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2d258ff628, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff628*=0x2, lpOverlapped=0x0) returned 1
	[0157.123] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0157.123] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x15bd1910080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0157.124] malloc (_Size=0x107ce) returned 0x15bd1920060
	[0157.124] _vsnwprintf (in: _Buffer=0x15bd1920060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x2d258ff668 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0157.124] _vsnwprintf (in: _Buffer=0x15bd1920086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x2d258ff668 | out: _Buffer=">") returned 1
	[0157.124] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.124] GetFileType (hFile=0x258) returned 0x3
	[0157.124] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.124] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0157.124] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2d258ff658, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff658*=0x14, lpOverlapped=0x0) returned 1
	[0157.124] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.124] GetFileType (hFile=0x24c) returned 0x3
	[0157.124] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.125] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.125] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0157.125] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.125] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.125] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0157.125] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.125] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.125] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0157.125] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.125] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.125] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0157.125] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.125] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.125] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0157.125] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.125] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.125] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0157.126] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.126] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.126] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0157.126] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.126] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.126] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0157.126] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.126] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.126] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0157.126] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.126] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.126] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0157.126] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.126] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.126] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0157.126] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.126] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.126] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0157.126] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.126] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.127] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0157.127] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.127] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.127] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0157.127] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.127] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.127] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0157.127] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.127] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.127] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0157.127] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.127] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.127] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0157.127] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.127] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.127] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0157.127] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.127] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.127] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.128] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0157.128] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.128] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.128] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.128] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0157.128] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.128] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.128] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.128] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1
	[0157.128] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.128] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.128] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.128] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1
	[0157.128] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.128] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.128] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.128] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0157.128] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.128] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.128] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0157.128] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0157.129] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.129] GetFileType (hFile=0x24c) returned 0x3
	[0157.129] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0157.129] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0157.129] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.129] GetFileType (hFile=0x258) returned 0x3
	[0157.129] _get_osfhandle (_FileHandle=1) returned 0x258
	[0157.129] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25
	[0157.129] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2d258ff958, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff958*=0x18, lpOverlapped=0x0) returned 1
	[0157.129] GetProcessHeap () returned 0x15bd1740000
	[0157.129] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x4012) returned 0x15bd1748e90
	[0157.129] GetProcessHeap () returned 0x15bd1740000
	[0157.129] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1748e90) returned 1
	[0157.130] _wcsicmp (_String1="mode", _String2=")") returned 68
	[0157.130] _wcsicmp (_String1="FOR", _String2="mode") returned -7
	[0157.130] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7
	[0157.130] _wcsicmp (_String1="IF", _String2="mode") returned -4
	[0157.130] _wcsicmp (_String1="IF/?", _String2="mode") returned -4
	[0157.130] _wcsicmp (_String1="REM", _String2="mode") returned 5
	[0157.130] _wcsicmp (_String1="REM/?", _String2="mode") returned 5
	[0157.130] GetProcessHeap () returned 0x15bd1740000
	[0157.130] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xb0) returned 0x15bd17477c0
	[0157.130] GetProcessHeap () returned 0x15bd1740000
	[0157.130] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x1a) returned 0x15bd1746330
	[0157.130] GetProcessHeap () returned 0x15bd1740000
	[0157.131] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x38) returned 0x15bd1746500
	[0157.131] GetConsoleOutputCP () returned 0x1b5
	[0157.432] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff60c04fbb0 | out: lpCPInfo=0x7ff60c04fbb0) returned 1
	[0157.436] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0157.753] GetConsoleTitleW (in: lpConsoleTitle=0x2d258ff7a0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0158.221] malloc (_Size=0xffce) returned 0x15bd1930840
	[0158.222] ??_V@YAXPEAX@Z () returned 0x15bd1930840
	[0158.222] malloc (_Size=0xffce) returned 0x15bd1940820
	[0158.222] ??_V@YAXPEAX@Z () returned 0x15bd1940820
	[0158.223] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0158.223] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0158.223] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0158.223] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0158.223] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0158.223] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0158.223] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0158.223] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0158.223] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0158.223] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0158.223] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0158.223] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0158.223] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0158.223] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0158.223] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0158.223] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0158.223] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0158.223] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0158.223] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0158.224] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0158.224] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0158.224] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0158.224] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0158.224] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0158.224] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0158.224] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0158.224] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0158.224] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0158.224] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0158.224] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0158.224] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0158.224] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0158.224] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0158.224] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0158.224] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0158.224] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0158.224] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0158.224] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0158.224] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0158.224] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0158.224] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0158.224] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0158.224] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0158.224] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0158.224] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0158.224] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0158.224] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0158.224] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0158.224] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0158.224] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0158.224] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0158.224] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0158.224] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0158.224] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0158.224] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0158.224] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0158.224] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0158.225] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0158.225] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0158.225] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0158.225] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0158.225] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0158.225] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0158.225] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0158.225] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0158.225] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0158.225] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0158.225] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0158.225] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0158.225] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0158.225] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0158.225] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0158.225] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0158.225] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0158.225] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0158.225] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0158.225] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0158.225] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0158.225] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0158.225] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0158.225] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0158.225] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0158.225] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0158.225] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0158.225] _wcsicmp (_String1="mode", _String2="FOR") returned 7
	[0158.225] _wcsicmp (_String1="mode", _String2="IF") returned 4
	[0158.225] _wcsicmp (_String1="mode", _String2="REM") returned -5
	[0158.225] ??_V@YAXPEAX@Z () returned 0x1
	[0158.226] GetProcessHeap () returned 0x15bd1740000
	[0158.226] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xffde) returned 0x15bd1748e90
	[0158.226] GetProcessHeap () returned 0x15bd1740000
	[0158.226] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x42) returned 0x15bd1747880
	[0158.226] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10
	[0158.227] malloc (_Size=0xffce) returned 0x15bd1940820
	[0158.227] ??_V@YAXPEAX@Z () returned 0x15bd1940820
	[0158.227] GetProcessHeap () returned 0x15bd1740000
	[0158.227] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x1ffac) returned 0x15bd1758e80
	[0158.229] SetErrorMode (uMode=0x0) returned 0x0
	[0158.229] SetErrorMode (uMode=0x1) returned 0x0
	[0158.229] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x15bd1758e90, lpFilePart=0x2d258ff020 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x2d258ff020*="system32") returned 0x13
	[0158.238] SetErrorMode (uMode=0x0) returned 0x1
	[0158.238] GetProcessHeap () returned 0x15bd1740000
	[0158.238] RtlReAllocateHeap (Heap=0x15bd1740000, Flags=0x0, Ptr=0x15bd1758e80, Size=0x42) returned 0x15bd1758e80
	[0158.238] GetProcessHeap () returned 0x15bd1740000
	[0158.238] RtlSizeHeap (HeapHandle=0x15bd1740000, Flags=0x0, MemoryPointer=0x15bd1758e80) returned 0x42
	[0158.238] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc
	[0158.238] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0158.238] GetProcessHeap () returned 0x15bd1740000
	[0158.238] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x1b6) returned 0x15bd17478d0
	[0158.238] GetProcessHeap () returned 0x15bd1740000
	[0158.238] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x35c) returned 0x15bd1758ee0
	[0158.248] GetProcessHeap () returned 0x15bd1740000
	[0158.248] RtlReAllocateHeap (Heap=0x15bd1740000, Flags=0x0, Ptr=0x15bd1758ee0, Size=0x1b8) returned 0x15bd1758ee0
	[0158.248] GetProcessHeap () returned 0x15bd1740000
	[0158.248] RtlSizeHeap (HeapHandle=0x15bd1740000, Flags=0x0, MemoryPointer=0x15bd1758ee0) returned 0x1b8
	[0158.248] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0158.248] GetProcessHeap () returned 0x15bd1740000
	[0158.248] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xe8) returned 0x15bd17590b0
	[0158.250] GetProcessHeap () returned 0x15bd1740000
	[0158.250] RtlReAllocateHeap (Heap=0x15bd1740000, Flags=0x0, Ptr=0x15bd17590b0, Size=0x7e) returned 0x15bd17590b0
	[0158.250] GetProcessHeap () returned 0x15bd1740000
	[0158.250] RtlSizeHeap (HeapHandle=0x15bd1740000, Flags=0x0, MemoryPointer=0x15bd17590b0) returned 0x7e
	[0158.250] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0158.251] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x2d258fed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d258fed90) returned 0x15bd1759140
	[0158.251] GetProcessHeap () returned 0x15bd1740000
	[0158.251] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x0, Size=0x28) returned 0x15bd1746540
	[0158.251] FindClose (in: hFindFile=0x15bd1759140 | out: hFindFile=0x15bd1759140) returned 1
	[0158.251] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x2d258fed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d258fed90) returned 0x15bd1759140
	[0158.251] GetProcessHeap () returned 0x15bd1740000
	[0158.251] RtlReAllocateHeap (Heap=0x15bd1740000, Flags=0x0, Ptr=0x15bd1746540, Size=0x8) returned 0x15bd1746540
	[0158.251] FindClose (in: hFindFile=0x15bd1759140 | out: hFindFile=0x15bd1759140) returned 1
	[0158.251] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1
	[0158.251] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2
	[0158.251] ??_V@YAXPEAX@Z () returned 0x1
	[0158.251] GetConsoleTitleW (in: lpConsoleTitle=0x2d258ff310, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0158.460] GetProcessHeap () returned 0x15bd1740000
	[0158.461] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x21c) returned 0x15bd1759140
	[0158.461] GetConsoleTitleW (in: lpConsoleTitle=0x15bd1759150, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0158.966] GetProcessHeap () returned 0x15bd1740000
	[0158.966] RtlReAllocateHeap (Heap=0x15bd1740000, Flags=0x0, Ptr=0x15bd1759140, Size=0x8c) returned 0x15bd1759140
	[0158.966] GetProcessHeap () returned 0x15bd1740000
	[0158.966] RtlSizeHeap (HeapHandle=0x15bd1740000, Flags=0x0, MemoryPointer=0x15bd1759140) returned 0x8c
	[0158.966] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode  con cp select=1251") returned 1
	[0159.456] GetProcessHeap () returned 0x15bd1740000
	[0159.456] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1759140) returned 1
	[0159.456] InitializeProcThreadAttributeList (in: lpAttributeList=0x2d258ff230, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2d258ff120 | out: lpAttributeList=0x2d258ff230, lpSize=0x2d258ff120) returned 1
	[0159.456] UpdateProcThreadAttribute (in: lpAttributeList=0x2d258ff230, dwFlags=0x0, Attribute=0x60001, lpValue=0x2d258ff10c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2d258ff230, lpPreviousValue=0x0) returned 1
	[0159.456] GetStartupInfoW (in: lpStartupInfo=0x2d258ff1c0 | out: lpStartupInfo=0x2d258ff1c0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x24c, hStdOutput=0x258, hStdError=0x258)) 
	[0159.456] GetProcessHeap () returned 0x15bd1740000
	[0159.456] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x20) returned 0x15bd1747610
	[0159.456] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0159.456] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0159.456] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0159.456] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0159.456] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0159.456] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0159.456] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0159.456] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0159.457] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0159.457] GetProcessHeap () returned 0x15bd1740000
	[0159.457] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1747610) returned 1
	[0159.457] GetProcessHeap () returned 0x15bd1740000
	[0159.457] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x12) returned 0x15bd1747610
	[0159.457] _get_osfhandle (_FileHandle=1) returned 0x258
	[0159.457] SetConsoleMode (hConsoleHandle=0x258, dwMode=0x0) returned 0
	[0159.458] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0159.458] SetConsoleMode (hConsoleHandle=0x24c, dwMode=0x0) returned 0
	[0159.458] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode  con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x2d258ff150*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode  con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2d258ff128 | out: lpCommandLine="mode  con cp select=1251", lpProcessInformation=0x2d258ff128*(hProcess=0x98, hThread=0x94, dwProcessId=0xe60, dwThreadId=0xe64)) returned 1
	[0159.473] CloseHandle (hObject=0x94) returned 1
	[0159.473] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0159.473] GetProcessHeap () returned 0x15bd1740000
	[0159.473] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1746570) returned 1
	[0159.473] GetEnvironmentStringsW () returned 0x15bd1746570*
	[0159.473] GetProcessHeap () returned 0x15bd1740000
	[0159.473] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xafe) returned 0x15bd1759540
	[0159.473] FreeEnvironmentStringsA (penv="=") returned 1
	[0159.474] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe94d10000
	[0159.474] GetProcAddress (hModule=0x7ffe94d10000, lpProcName="NtQueryInformationProcess") returned 0x7ffe94db56b0
	[0159.474] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x2d258fe628, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2d258fe628, ReturnLength=0x0) returned 0x0
	[0159.474] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x1b26ed1000, lpBuffer=0x2d258fe660, nSize=0x7a0, lpNumberOfBytesRead=0x2d258fe620 | out: lpBuffer=0x2d258fe660*, lpNumberOfBytesRead=0x2d258fe620*=0x7a0) returned 1
	[0159.475] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0
	[0167.227] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x2d258ff0a8 | out: lpExitCode=0x2d258ff0a8*=0x0) returned 1
	[0167.227] CloseHandle (hObject=0x98) returned 1
	[0167.227] _vsnwprintf (in: _Buffer=0x2d258ff278, _BufferCount=0x13, _Format="%08X", _ArgList=0x2d258ff0b8 | out: _Buffer="00000000") returned 8
	[0167.227] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0167.227] GetProcessHeap () returned 0x15bd1740000
	[0167.227] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1759540) returned 1
	[0167.227] GetEnvironmentStringsW () returned 0x15bd175ab80*
	[0167.227] GetProcessHeap () returned 0x15bd1740000
	[0167.227] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xb24) returned 0x15bd175b6b0
	[0167.227] FreeEnvironmentStringsA (penv="=") returned 1
	[0167.227] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0167.227] GetProcessHeap () returned 0x15bd1740000
	[0167.227] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd175b6b0) returned 1
	[0167.228] GetEnvironmentStringsW () returned 0x15bd175ab80*
	[0167.228] GetProcessHeap () returned 0x15bd1740000
	[0167.228] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xb24) returned 0x15bd175b6b0
	[0167.228] FreeEnvironmentStringsA (penv="=") returned 1
	[0167.228] GetProcessHeap () returned 0x15bd1740000
	[0167.228] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1747610) returned 1
	[0167.228] DeleteProcThreadAttributeList (in: lpAttributeList=0x2d258ff230 | out: lpAttributeList=0x2d258ff230) 
	[0167.229] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0167.396] ??_V@YAXPEAX@Z () returned 0x1
	[0167.396] _get_osfhandle (_FileHandle=1) returned 0x258
	[0167.396] SetConsoleMode (hConsoleHandle=0x258, dwMode=0x0) returned 0
	[0167.396] _get_osfhandle (_FileHandle=1) returned 0x258
	[0167.396] GetConsoleMode (in: hConsoleHandle=0x258, lpMode=0x7ff60c04fc08 | out: lpMode=0x7ff60c04fc08) returned 0
	[0167.396] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0167.396] GetConsoleMode (in: hConsoleHandle=0x24c, lpMode=0x7ff60c04fc0c | out: lpMode=0x7ff60c04fc0c) returned 0
	[0167.396] GetConsoleOutputCP () returned 0x4e3
	[0168.397] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff60c04fbb0 | out: lpCPInfo=0x7ff60c04fbb0) returned 1
	[0168.397] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0168.623] GetProcessHeap () returned 0x15bd1740000
	[0168.623] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd17590b0) returned 1
	[0168.623] GetProcessHeap () returned 0x15bd1740000
	[0168.623] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1758ee0) returned 1
	[0168.624] GetProcessHeap () returned 0x15bd1740000
	[0168.624] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd17478d0) returned 1
	[0168.624] GetProcessHeap () returned 0x15bd1740000
	[0168.624] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1758e80) returned 1
	[0168.624] GetProcessHeap () returned 0x15bd1740000
	[0168.624] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1747880) returned 1
	[0168.624] GetProcessHeap () returned 0x15bd1740000
	[0168.624] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1748e90) returned 1
	[0168.624] GetProcessHeap () returned 0x15bd1740000
	[0168.624] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1746500) returned 1
	[0168.624] GetProcessHeap () returned 0x15bd1740000
	[0168.624] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1746330) returned 1
	[0168.624] GetProcessHeap () returned 0x15bd1740000
	[0168.624] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd17477c0) returned 1
	[0168.624] _vsnwprintf (in: _Buffer=0x7ff60c057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2d258ff658 | out: _Buffer="\r\n") returned 2
	[0168.624] _get_osfhandle (_FileHandle=1) returned 0x258
	[0168.624] GetFileType (hFile=0x258) returned 0x3
	[0168.624] _get_osfhandle (_FileHandle=1) returned 0x258
	[0168.624] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0168.624] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2d258ff628, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff628*=0x2, lpOverlapped=0x0) returned 1
	[0168.624] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0168.624] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x15bd1910080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0168.624] _vsnwprintf (in: _Buffer=0x15bd1920060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x2d258ff668 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0168.624] _vsnwprintf (in: _Buffer=0x15bd1920086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x2d258ff668 | out: _Buffer=">") returned 1
	[0168.624] _get_osfhandle (_FileHandle=1) returned 0x258
	[0168.624] GetFileType (hFile=0x258) returned 0x3
	[0168.625] _get_osfhandle (_FileHandle=1) returned 0x258
	[0168.625] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0168.625] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2d258ff658, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff658*=0x14, lpOverlapped=0x0) returned 1
	[0168.625] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.625] GetFileType (hFile=0x24c) returned 0x3
	[0168.625] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.625] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.625] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.625] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1
	[0168.625] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.625] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.625] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.625] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1
	[0168.625] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.625] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.625] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.625] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1
	[0168.625] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.625] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.625] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.625] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1
	[0168.626] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.626] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.626] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1
	[0168.626] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.626] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.626] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1
	[0168.626] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.626] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.626] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1
	[0168.626] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.626] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.626] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1
	[0168.626] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.626] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.626] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1
	[0168.627] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.627] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.627] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1
	[0168.627] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.627] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.627] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1
	[0168.627] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.627] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.627] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1
	[0168.627] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.627] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.627] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1
	[0168.627] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.627] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.627] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1
	[0168.627] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.627] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.628] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1
	[0168.628] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.628] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.628] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1
	[0168.628] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.628] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.628] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1
	[0168.628] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.628] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.628] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1
	[0168.628] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.628] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.628] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1
	[0168.628] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.628] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.629] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1
	[0168.629] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.629] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.629] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1
	[0168.629] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.629] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.629] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1
	[0168.629] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.629] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.629] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1
	[0168.629] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.629] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.629] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0168.629] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.629] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.629] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0168.629] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.629] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.630] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.630] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0168.630] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.630] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.630] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.630] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0168.630] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.630] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.630] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.630] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0168.630] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.630] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.630] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.630] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0168.630] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.630] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.630] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.630] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0168.630] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.630] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.630] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.630] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1
	[0168.630] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.630] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.631] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.631] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0168.631] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.631] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.631] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.631] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0168.631] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.631] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.631] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.631] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0168.631] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.631] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.631] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.631] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0168.631] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.631] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.631] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0168.631] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0168.631] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.631] GetFileType (hFile=0x24c) returned 0x3
	[0168.631] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0168.631] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0168.632] _get_osfhandle (_FileHandle=1) returned 0x258
	[0168.632] GetFileType (hFile=0x258) returned 0x3
	[0168.632] _get_osfhandle (_FileHandle=1) returned 0x258
	[0168.632] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37
	[0168.632] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2d258ff958, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff958*=0x24, lpOverlapped=0x0) returned 1
	[0168.632] GetProcessHeap () returned 0x15bd1740000
	[0168.632] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x4012) returned 0x15bd1748e90
	[0168.632] GetProcessHeap () returned 0x15bd1740000
	[0168.632] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1748e90) returned 1
	[0168.633] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0168.633] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0168.633] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0168.633] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0168.633] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0168.633] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0168.633] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0168.633] GetProcessHeap () returned 0x15bd1740000
	[0168.633] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xb0) returned 0x15bd17591a0
	[0168.633] GetProcessHeap () returned 0x15bd1740000
	[0168.633] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x22) returned 0x15bd1746330
	[0168.634] GetProcessHeap () returned 0x15bd1740000
	[0168.634] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x48) returned 0x15bd1759260
	[0168.634] GetConsoleOutputCP () returned 0x4e3
	[0169.113] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff60c04fbb0 | out: lpCPInfo=0x7ff60c04fbb0) returned 1
	[0169.113] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0169.478] GetConsoleTitleW (in: lpConsoleTitle=0x2d258ff7a0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0169.560] malloc (_Size=0xffce) returned 0x15bd1930840
	[0169.560] ??_V@YAXPEAX@Z () returned 0x15bd1930840
	[0169.560] malloc (_Size=0xffce) returned 0x15bd1940820
	[0169.560] ??_V@YAXPEAX@Z () returned 0x15bd1940820
	[0169.560] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0169.560] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0169.560] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0169.560] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0169.560] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0169.560] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0169.560] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0169.561] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0169.562] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0169.563] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0169.563] ??_V@YAXPEAX@Z () returned 0x1
	[0169.563] GetProcessHeap () returned 0x15bd1740000
	[0169.563] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xffde) returned 0x15bd1748e90
	[0169.564] GetProcessHeap () returned 0x15bd1740000
	[0169.564] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x5a) returned 0x15bd17592b0
	[0169.564] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0169.564] malloc (_Size=0xffce) returned 0x15bd1940820
	[0169.564] ??_V@YAXPEAX@Z () returned 0x15bd1940820
	[0169.564] GetProcessHeap () returned 0x15bd1740000
	[0169.564] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x1ffac) returned 0x15bd175c1e0
	[0169.566] SetErrorMode (uMode=0x0) returned 0x0
	[0169.567] SetErrorMode (uMode=0x1) returned 0x0
	[0169.567] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x15bd175c1f0, lpFilePart=0x2d258ff020 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x2d258ff020*="system32") returned 0x13
	[0169.567] SetErrorMode (uMode=0x0) returned 0x1
	[0169.567] GetProcessHeap () returned 0x15bd1740000
	[0169.567] RtlReAllocateHeap (Heap=0x15bd1740000, Flags=0x0, Ptr=0x15bd175c1e0, Size=0x4a) returned 0x15bd175c1e0
	[0169.567] GetProcessHeap () returned 0x15bd1740000
	[0169.567] RtlSizeHeap (HeapHandle=0x15bd1740000, Flags=0x0, MemoryPointer=0x15bd175c1e0) returned 0x4a
	[0169.567] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc
	[0169.567] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0169.567] GetProcessHeap () returned 0x15bd1740000
	[0169.567] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x1b6) returned 0x15bd1758e80
	[0169.567] GetProcessHeap () returned 0x15bd1740000
	[0169.567] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x35c) returned 0x15bd1759b70
	[0169.567] GetProcessHeap () returned 0x15bd1740000
	[0169.567] RtlReAllocateHeap (Heap=0x15bd1740000, Flags=0x0, Ptr=0x15bd1759b70, Size=0x1b8) returned 0x15bd1759b70
	[0169.567] GetProcessHeap () returned 0x15bd1740000
	[0169.567] RtlSizeHeap (HeapHandle=0x15bd1740000, Flags=0x0, MemoryPointer=0x15bd1759b70) returned 0x1b8
	[0169.567] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0169.567] GetProcessHeap () returned 0x15bd1740000
	[0169.567] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xe8) returned 0x15bd1759040
	[0169.567] GetProcessHeap () returned 0x15bd1740000
	[0169.567] RtlReAllocateHeap (Heap=0x15bd1740000, Flags=0x0, Ptr=0x15bd1759040, Size=0x7e) returned 0x15bd1759040
	[0169.567] GetProcessHeap () returned 0x15bd1740000
	[0169.567] RtlSizeHeap (HeapHandle=0x15bd1740000, Flags=0x0, MemoryPointer=0x15bd1759040) returned 0x7e
	[0169.567] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0169.567] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2d258fed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d258fed90) returned 0x15bd17590d0
	[0169.568] FindClose (in: hFindFile=0x15bd17590d0 | out: hFindFile=0x15bd17590d0) returned 1
	[0169.568] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x2d258fed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d258fed90) returned 0xffffffffffffffff
	[0169.568] GetLastError () returned 0x2
	[0169.568] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x2d258fed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d258fed90) returned 0x15bd17590d0
	[0169.568] FindClose (in: hFindFile=0x15bd17590d0 | out: hFindFile=0x15bd17590d0) returned 1
	[0169.568] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0169.568] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0169.568] ??_V@YAXPEAX@Z () returned 0x1
	[0169.568] GetConsoleTitleW (in: lpConsoleTitle=0x2d258ff310, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0169.762] GetProcessHeap () returned 0x15bd1740000
	[0169.762] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x21c) returned 0x15bd17477c0
	[0169.762] GetConsoleTitleW (in: lpConsoleTitle=0x15bd17477d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0170.116] GetProcessHeap () returned 0x15bd1740000
	[0170.116] RtlReAllocateHeap (Heap=0x15bd1740000, Flags=0x0, Ptr=0x15bd17477c0, Size=0xa4) returned 0x15bd17477c0
	[0170.116] GetProcessHeap () returned 0x15bd1740000
	[0170.116] RtlSizeHeap (HeapHandle=0x15bd1740000, Flags=0x0, MemoryPointer=0x15bd17477c0) returned 0xa4
	[0170.116] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin  delete shadows /all /quiet") returned 1
	[0170.792] GetProcessHeap () returned 0x15bd1740000
	[0170.792] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd17477c0) returned 1
	[0170.792] InitializeProcThreadAttributeList (in: lpAttributeList=0x2d258ff230, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2d258ff120 | out: lpAttributeList=0x2d258ff230, lpSize=0x2d258ff120) returned 1
	[0170.792] UpdateProcThreadAttribute (in: lpAttributeList=0x2d258ff230, dwFlags=0x0, Attribute=0x60001, lpValue=0x2d258ff10c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2d258ff230, lpPreviousValue=0x0) returned 1
	[0170.792] GetStartupInfoW (in: lpStartupInfo=0x2d258ff1c0 | out: lpStartupInfo=0x2d258ff1c0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x24c, hStdOutput=0x258, hStdError=0x258)) 
	[0170.792] GetProcessHeap () returned 0x15bd1740000
	[0170.792] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x20) returned 0x15bd1747610
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0170.792] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0170.793] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0170.793] GetProcessHeap () returned 0x15bd1740000
	[0170.793] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1747610) returned 1
	[0170.793] GetProcessHeap () returned 0x15bd1740000
	[0170.793] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x12) returned 0x15bd1747610
	[0170.793] _get_osfhandle (_FileHandle=1) returned 0x258
	[0170.793] SetConsoleMode (hConsoleHandle=0x258, dwMode=0x0) returned 0
	[0170.793] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0170.794] SetConsoleMode (hConsoleHandle=0x24c, dwMode=0x0) returned 0
	[0170.794] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x2d258ff150*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin  delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2d258ff128 | out: lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessInformation=0x2d258ff128*(hProcess=0x94, hThread=0x98, dwProcessId=0xf14, dwThreadId=0xf18)) returned 1
	[0171.099] CloseHandle (hObject=0x98) returned 1
	[0171.099] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0171.099] GetProcessHeap () returned 0x15bd1740000
	[0171.100] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd175b6b0) returned 1
	[0171.100] GetEnvironmentStringsW () returned 0x15bd175ab80*
	[0171.100] GetProcessHeap () returned 0x15bd1740000
	[0171.100] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xb24) returned 0x15bd175b6b0
	[0171.100] FreeEnvironmentStringsA (penv="=") returned 1
	[0171.100] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0x2d258fe628, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2d258fe628, ReturnLength=0x0) returned 0x0
	[0171.100] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0x56247be000, lpBuffer=0x2d258fe660, nSize=0x7a0, lpNumberOfBytesRead=0x2d258fe620 | out: lpBuffer=0x2d258fe660*, lpNumberOfBytesRead=0x2d258fe620*=0x7a0) returned 1
	[0171.100] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0
	[0175.921] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0x2d258ff0a8 | out: lpExitCode=0x2d258ff0a8*=0x2) returned 1
	[0175.921] CloseHandle (hObject=0x94) returned 1
	[0175.921] _vsnwprintf (in: _Buffer=0x2d258ff278, _BufferCount=0x13, _Format="%08X", _ArgList=0x2d258ff0b8 | out: _Buffer="00000002") returned 8
	[0175.921] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0175.921] GetProcessHeap () returned 0x15bd1740000
	[0175.921] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd175b6b0) returned 1
	[0175.922] GetEnvironmentStringsW () returned 0x15bd175ab80*
	[0175.922] GetProcessHeap () returned 0x15bd1740000
	[0175.922] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xb24) returned 0x15bd175b6b0
	[0175.922] FreeEnvironmentStringsA (penv="=") returned 1
	[0175.922] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0175.922] GetProcessHeap () returned 0x15bd1740000
	[0175.922] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd175b6b0) returned 1
	[0175.922] GetEnvironmentStringsW () returned 0x15bd175ab80*
	[0175.922] GetProcessHeap () returned 0x15bd1740000
	[0175.922] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xb24) returned 0x15bd175b6b0
	[0175.922] FreeEnvironmentStringsA (penv="=") returned 1
	[0175.922] GetProcessHeap () returned 0x15bd1740000
	[0175.922] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1747610) returned 1
	[0175.922] DeleteProcThreadAttributeList (in: lpAttributeList=0x2d258ff230 | out: lpAttributeList=0x2d258ff230) 
	[0175.922] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0176.390] ??_V@YAXPEAX@Z () returned 0x1
	[0176.390] _get_osfhandle (_FileHandle=1) returned 0x258
	[0176.390] SetConsoleMode (hConsoleHandle=0x258, dwMode=0x0) returned 0
	[0176.390] _get_osfhandle (_FileHandle=1) returned 0x258
	[0176.390] GetConsoleMode (in: hConsoleHandle=0x258, lpMode=0x7ff60c04fc08 | out: lpMode=0x7ff60c04fc08) returned 0
	[0176.390] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0176.390] GetConsoleMode (in: hConsoleHandle=0x24c, lpMode=0x7ff60c04fc0c | out: lpMode=0x7ff60c04fc0c) returned 0
	[0176.390] GetConsoleOutputCP () returned 0x4e3
	[0176.798] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff60c04fbb0 | out: lpCPInfo=0x7ff60c04fbb0) returned 1
	[0176.798] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0177.040] GetProcessHeap () returned 0x15bd1740000
	[0177.040] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1759040) returned 1
	[0177.040] GetProcessHeap () returned 0x15bd1740000
	[0177.040] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1759b70) returned 1
	[0177.040] GetProcessHeap () returned 0x15bd1740000
	[0177.040] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1758e80) returned 1
	[0177.040] GetProcessHeap () returned 0x15bd1740000
	[0177.040] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd175c1e0) returned 1
	[0177.040] GetProcessHeap () returned 0x15bd1740000
	[0177.040] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd17592b0) returned 1
	[0177.040] GetProcessHeap () returned 0x15bd1740000
	[0177.040] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1748e90) returned 1
	[0177.040] GetProcessHeap () returned 0x15bd1740000
	[0177.040] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1759260) returned 1
	[0177.040] GetProcessHeap () returned 0x15bd1740000
	[0177.040] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1746330) returned 1
	[0177.040] GetProcessHeap () returned 0x15bd1740000
	[0177.040] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd17591a0) returned 1
	[0177.040] _vsnwprintf (in: _Buffer=0x7ff60c057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2d258ff658 | out: _Buffer="\r\n") returned 2
	[0177.040] _get_osfhandle (_FileHandle=1) returned 0x258
	[0177.040] GetFileType (hFile=0x258) returned 0x3
	[0177.041] _get_osfhandle (_FileHandle=1) returned 0x258
	[0177.041] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0177.041] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2d258ff628, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff628*=0x2, lpOverlapped=0x0) returned 1
	[0177.041] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff60c04bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0177.041] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x15bd1910080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0177.041] _vsnwprintf (in: _Buffer=0x15bd1920060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x2d258ff668 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0177.041] _vsnwprintf (in: _Buffer=0x15bd1920086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x2d258ff668 | out: _Buffer=">") returned 1
	[0177.041] _get_osfhandle (_FileHandle=1) returned 0x258
	[0177.041] GetFileType (hFile=0x258) returned 0x3
	[0177.041] _get_osfhandle (_FileHandle=1) returned 0x258
	[0177.041] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0177.041] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2d258ff658, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff658*=0x14, lpOverlapped=0x0) returned 1
	[0177.041] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0177.041] GetFileType (hFile=0x24c) returned 0x3
	[0177.041] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0177.041] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0177.041] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0177.041] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1
	[0177.041] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0177.041] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0177.041] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0177.041] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1
	[0177.041] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0177.042] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0177.042] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0177.042] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1
	[0177.042] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0177.042] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0177.042] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0177.042] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1
	[0177.042] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0177.042] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0177.042] ReadFile (in: hFile=0x24c, lpBuffer=0x7ff60c049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2d258ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesRead=0x2d258ff9b8*=0x1, lpOverlapped=0x0) returned 1
	[0177.042] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=1, lpWideCharStr=0x7ff60c053c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1
	[0177.042] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0177.042] GetFileType (hFile=0x24c) returned 0x3
	[0177.042] _get_osfhandle (_FileHandle=0) returned 0x24c
	[0177.042] SetFilePointer (in: hFile=0x24c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0177.042] _get_osfhandle (_FileHandle=1) returned 0x258
	[0177.042] GetFileType (hFile=0x258) returned 0x3
	[0177.042] _get_osfhandle (_FileHandle=1) returned 0x258
	[0177.042] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff60c049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6
	[0177.042] WriteFile (in: hFile=0x258, lpBuffer=0x7ff60c049970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2d258ff958, lpOverlapped=0x0 | out: lpBuffer=0x7ff60c049970*, lpNumberOfBytesWritten=0x2d258ff958*=0x5, lpOverlapped=0x0) returned 1
	[0177.042] GetProcessHeap () returned 0x15bd1740000
	[0177.042] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x4012) returned 0x15bd1748e90
	[0177.042] GetProcessHeap () returned 0x15bd1740000
	[0177.042] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd1748e90) returned 1
	[0177.043] _wcsicmp (_String1="Exit", _String2=")") returned 60
	[0177.043] _wcsicmp (_String1="FOR", _String2="Exit") returned 1
	[0177.043] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1
	[0177.043] _wcsicmp (_String1="IF", _String2="Exit") returned 4
	[0177.043] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4
	[0177.043] _wcsicmp (_String1="REM", _String2="Exit") returned 13
	[0177.043] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13
	[0177.043] GetProcessHeap () returned 0x15bd1740000
	[0177.043] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0xb0) returned 0x15bd1740730
	[0177.043] GetProcessHeap () returned 0x15bd1740000
	[0177.043] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x1a) returned 0x15bd1746330
	[0177.044] GetConsoleOutputCP () returned 0x4e3
	[0177.227] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff60c04fbb0 | out: lpCPInfo=0x7ff60c04fbb0) returned 1
	[0177.227] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0177.555] GetConsoleTitleW (in: lpConsoleTitle=0x2d258ff7a0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0178.305] malloc (_Size=0xffce) returned 0x15bd1930840
	[0178.306] ??_V@YAXPEAX@Z () returned 0x15bd1930840
	[0178.306] malloc (_Size=0xffce) returned 0x15bd1940820
	[0178.306] ??_V@YAXPEAX@Z () returned 0x15bd1940820
	[0178.306] _wcsicmp (_String1="Exit", _String2="DIR") returned 1
	[0178.306] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6
	[0178.306] _wcsicmp (_String1="Exit", _String2="DEL") returned 1
	[0178.306] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15
	[0178.306] _wcsicmp (_String1="Exit", _String2="COPY") returned 2
	[0178.306] _wcsicmp (_String1="Exit", _String2="CD") returned 2
	[0178.306] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2
	[0178.306] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13
	[0178.306] _wcsicmp (_String1="Exit", _String2="REN") returned -13
	[0178.306] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21
	[0178.306] _wcsicmp (_String1="Exit", _String2="SET") returned -14
	[0178.306] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11
	[0178.306] _wcsicmp (_String1="Exit", _String2="DATE") returned 1
	[0178.306] _wcsicmp (_String1="Exit", _String2="TIME") returned -15
	[0178.306] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11
	[0178.306] _wcsicmp (_String1="Exit", _String2="MD") returned -8
	[0178.306] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8
	[0178.306] _wcsicmp (_String1="Exit", _String2="RD") returned -13
	[0178.306] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13
	[0178.306] _wcsicmp (_String1="Exit", _String2="PATH") returned -11
	[0178.306] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2
	[0178.306] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14
	[0178.306] _wcsicmp (_String1="Exit", _String2="CLS") returned 2
	[0178.306] _wcsicmp (_String1="Exit", _String2="CALL") returned 2
	[0178.306] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17
	[0178.306] _wcsicmp (_String1="Exit", _String2="VER") returned -17
	[0178.306] _wcsicmp (_String1="Exit", _String2="VOL") returned -17
	[0178.306] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0
	[0178.306] ??_V@YAXPEAX@Z () returned 0x1
	[0178.307] GetProcessHeap () returned 0x15bd1740000
	[0178.307] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x14) returned 0x15bd1747610
	[0178.307] GetProcessHeap () returned 0x15bd1740000
	[0178.307] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x1a) returned 0x15bd1746500
	[0178.307] GetProcessHeap () returned 0x15bd1740000
	[0178.307] RtlAllocateHeap (HeapHandle=0x15bd1740000, Flags=0x8, Size=0x21c) returned 0x15bd17477c0
	[0178.307] GetConsoleTitleW (in: lpConsoleTitle=0x15bd17477d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0178.680] GetProcessHeap () returned 0x15bd1740000
	[0178.680] RtlReAllocateHeap (Heap=0x15bd1740000, Flags=0x0, Ptr=0x15bd17477c0, Size=0x64) returned 0x15bd17477c0
	[0178.680] GetProcessHeap () returned 0x15bd1740000
	[0178.680] RtlSizeHeap (HeapHandle=0x15bd1740000, Flags=0x0, MemoryPointer=0x15bd17477c0) returned 0x64
	[0178.680] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1
	[0178.868] GetProcessHeap () returned 0x15bd1740000
	[0178.868] RtlFreeHeap (HeapHandle=0x15bd1740000, Flags=0x0, BaseAddress=0x15bd17477c0) returned 1
	[0178.868] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0179.352] exit (_Code=2) 

Thread:
	id = 56
	os_tid = 0xe48


Process:
	id = "8"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x5321e000"
	os_pid = "0xdf4"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "7"
	os_parent_pid = "0xde0"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012a52" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 37
	os_tid = 0xdf8


Thread:
	id = 46
	os_tid = 0xe1c


Thread:
	id = 52
	os_tid = 0xe38


Thread:
	id = 53
	os_tid = 0xe3c


Thread:
	id = 54
	os_tid = 0xe40


Process:
	id = "9"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x4f661000"
	os_pid = "0x598"
	os_integrity_level = "0x4000"
	os_privileges = "0x260814080"
	monitor_reason = "rpc_server"
	parent_id = "5"
	os_parent_pid = "0xdb4"
	cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000fbb7" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 62
	os_tid = 0xcc0


Thread:
	id = 63
	os_tid = 0xa88


Thread:
	id = 64
	os_tid = 0x9f0


Thread:
	id = 65
	os_tid = 0x9ec


Thread:
	id = 66
	os_tid = 0x9ac


Thread:
	id = 67
	os_tid = 0x698


Thread:
	id = 68
	os_tid = 0x690


Thread:
	id = 69
	os_tid = 0x654


Thread:
	id = 70
	os_tid = 0x650


Thread:
	id = 71
	os_tid = 0x648


Thread:
	id = 72
	os_tid = 0x5ac


Thread:
	id = 73
	os_tid = 0x59c


Process:
	id = "10"
	image_name = "mode.com"
	filename = "c:\\windows\\system32\\mode.com"
	page_root = "0x2db90000"
	os_pid = "0xe60"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "7"
	os_parent_pid = "0xde0"
	cmd_line = "mode  con cp select=1251"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012a52" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 74
	os_tid = 0xe64


Thread:
	id = 75
	os_tid = 0xe6c


Process:
	id = "11"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x2a0cd000"
	os_pid = "0xf14"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "7"
	os_parent_pid = "0xde0"
	cmd_line = "vssadmin  delete shadows /all /quiet"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012a52" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 76
	os_tid = 0xf18


Thread:
	id = 77
	os_tid = 0xf2c


Thread:
	id = 78
	os_tid = 0xf3c


Thread:
	id = 79
	os_tid = 0xf48


Thread:
	id = 80
	os_tid = 0xf4c


Process:
	id = "12"
	image_name = "d2.exe"
	filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe"
	page_root = "0x2a85b000"
	os_pid = "0xf68"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0xdb4"
	cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe\" -a"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012a52" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 81
	os_tid = 0xf6c

	[0175.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff74 | out: lpSystemTimeAsFileTime=0x19ff74*(dwLowDateTime=0x1e8b77ab, dwHighDateTime=0x1d590a2)) 
	[0175.103] GetCurrentProcessId () returned 0xf68
	[0175.103] GetCurrentThreadId () returned 0xf6c
	[0175.103] GetTickCount () returned 0x113f727
	[0175.103] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff6c | out: lpPerformanceCount=0x19ff6c*=8572177939) returned 1
	[0175.113] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) 
	[0175.113] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x750000
	[0175.114] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0175.114] GetProcAddress (hModule=0x760c0000, lpProcName="FlsAlloc") returned 0x760d4ae0
	[0175.115] GetProcAddress (hModule=0x760c0000, lpProcName="FlsGetValue") returned 0x760d4b20
	[0175.115] GetProcAddress (hModule=0x760c0000, lpProcName="FlsSetValue") returned 0x760d4b40
	[0175.115] GetProcAddress (hModule=0x760c0000, lpProcName="FlsFree") returned 0x760d4b00
	[0175.115] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0175.115] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0175.115] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0175.115] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0175.115] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0175.115] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0175.115] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0175.115] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0175.116] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0175.116] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0175.116] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0175.116] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0175.116] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0175.116] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0175.116] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0175.116] GetProcAddress (hModule=0x760c0000, lpProcName="DecodePointer") returned 0x77a51ec0
	[0175.117] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x214) returned 0x7505a8
	[0175.117] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0175.117] GetProcAddress (hModule=0x760c0000, lpProcName="DecodePointer") returned 0x77a51ec0
	[0175.117] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x760c0000
	[0175.117] GetProcAddress (hModule=0x760c0000, lpProcName="EncodePointer") returned 0x77a529e0
	[0175.117] GetProcAddress (hModule=0x760c0000, lpProcName="DecodePointer") returned 0x77a51ec0
	[0175.117] GetCurrentThreadId () returned 0xf6c
	[0175.117] GetStartupInfoA (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) 
	[0175.117] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x800) returned 0x7507c8
	[0175.117] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0175.117] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0175.117] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0175.117] SetHandleCount (uNumber=0x20) returned 0x20
	[0175.117] GetCommandLineW () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe\" -a"
	[0175.118] GetEnvironmentStringsW () returned 0x7c2670*
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0xaca) returned 0x750fd0
	[0175.118] FreeEnvironmentStringsW (penv=0x7c2670) returned 1
	[0175.118] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4377f0, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\d2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\d2.exe")) returned 0x43
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x9a) returned 0x751aa8
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x94) returned 0x751b50
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x3e) returned 0x751bf0
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x50) returned 0x751c38
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x6e) returned 0x751c90
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x78) returned 0x751d08
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x62) returned 0x751d88
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x28) returned 0x751df8
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x48) returned 0x751e28
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x1a) returned 0x751e78
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x2e) returned 0x751ea0
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x56) returned 0x751ed8
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x2a) returned 0x751f38
	[0175.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x2e) returned 0x751f70
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x44) returned 0x751fa8
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x1c) returned 0x751ff8
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x182) returned 0x752020
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x7c) returned 0x7521b0
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x36) returned 0x752238
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x3a) returned 0x752278
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x90) returned 0x7522c0
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x24) returned 0x752358
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x30) returned 0x752388
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x36) returned 0x7523c0
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x48) returned 0x752400
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x52) returned 0x752450
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x3c) returned 0x7524b0
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xd6) returned 0x7524f8
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x2e) returned 0x7525d8
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x1e) returned 0x752610
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x2c) returned 0x752638
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x50) returned 0x752670
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4e) returned 0x7526c8
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x24) returned 0x752720
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x42) returned 0x752750
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x20) returned 0x7527a0
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x38) returned 0x7527c8
	[0175.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x24) returned 0x752808
	[0175.119] HeapFree (in: hHeap=0x750000, dwFlags=0x0, lpMem=0x750fd0 | out: hHeap=0x750000) returned 1
	[0175.120] GetLastError () returned 0x0
	[0175.120] SetLastError (dwErrCode=0x0) 
	[0175.120] GetLastError () returned 0x0
	[0175.120] SetLastError (dwErrCode=0x0) 
	[0175.121] GetLastError () returned 0x0
	[0175.121] SetLastError (dwErrCode=0x0) 
	[0175.121] GetACP () returned 0x4e4
	[0175.121] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x220) returned 0x752838
	[0175.121] GetLastError () returned 0x0
	[0175.121] SetLastError (dwErrCode=0x0) 
	[0175.121] IsValidCodePage (CodePage=0x4e4) returned 1
	[0175.121] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1
	[0175.121] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1
	[0175.121] GetLastError () returned 0x0
	[0175.121] SetLastError (dwErrCode=0x0) 
	[0175.121] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f8d8 | out: lpCharType=0x19f8d8) returned 1
	[0175.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0175.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ៯AĀ") returned 256
	[0175.121] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ៯AĀ", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1
	[0175.121] GetLastError () returned 0x0
	[0175.121] SetLastError (dwErrCode=0x0) 
	[0175.121] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1
	[0175.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0175.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0175.121] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0175.121] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0175.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿXà¥à\x94þ\x19", lpUsedDefaultChar=0x0) returned 256
	[0175.121] GetLastError () returned 0x0
	[0175.121] SetLastError (dwErrCode=0x0) 
	[0175.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0175.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0175.121] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
	[0175.121] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256
	[0175.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿXà¥à\x94þ\x19", lpUsedDefaultChar=0x0) returned 256
	[0175.122] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x800) returned 0x750fd0
	[0175.122] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x80) returned 0x7517d8
	[0175.122] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4085ed) returned 0x0
	[0175.122] RtlSizeHeap (HeapHandle=0x750000, Flags=0x0, MemoryPointer=0x7517d8) returned 0x80
	[0175.122] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.123] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.123] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.123] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.123] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.123] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.123] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.123] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.123] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.123] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.123] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.123] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.123] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.123] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.123] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.123] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.124] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.124] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.124] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.124] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.124] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.124] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.124] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.124] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.124] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.200] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.200] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.200] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.200] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.200] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.200] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.200] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.200] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.200] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.200] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.201] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.201] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.201] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.201] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.201] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.201] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.201] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.201] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.201] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.201] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.201] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.201] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.201] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.201] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.201] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.201] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.201] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.202] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.202] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.202] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.202] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.202] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.202] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.202] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.202] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.202] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.202] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.202] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.202] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.202] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.203] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.203] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.203] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.203] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.203] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.203] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.203] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.203] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.203] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.203] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.203] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.203] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.203] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.203] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.203] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.203] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.203] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.204] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.204] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.204] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.204] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.204] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.204] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.204] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.204] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.204] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.204] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.204] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.204] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.204] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.204] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.204] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.204] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.205] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.205] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.205] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.205] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.205] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.205] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.205] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.205] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.205] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.205] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.205] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.205] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.205] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.205] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.205] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.205] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.205] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.206] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.206] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.206] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.206] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.206] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.206] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.206] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.206] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.206] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.206] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.206] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.206] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.206] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.206] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.206] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.206] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.206] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.206] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.207] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.207] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.207] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.207] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.207] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.207] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.207] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.207] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.207] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.207] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.207] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.207] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.207] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.207] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.207] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.207] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.207] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.208] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.208] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.208] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.208] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.208] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.208] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.208] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.208] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.208] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.208] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.208] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.208] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.208] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.208] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.208] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.208] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.208] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.209] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.209] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.209] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.209] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.209] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.209] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.209] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.209] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.209] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.209] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.209] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.209] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.209] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.209] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.209] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.209] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.209] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.210] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.210] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.210] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.210] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.210] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.210] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.210] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.210] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.210] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.210] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.210] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.210] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.210] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.210] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.210] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.210] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.210] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.211] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.211] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.211] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.211] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.211] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.211] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.211] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.211] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.211] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.211] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.211] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.211] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.211] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.211] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.211] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.211] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.211] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.212] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.212] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.212] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.212] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.212] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.212] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.212] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.212] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.212] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.212] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.212] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.212] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.212] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.212] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.212] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.212] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.212] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.213] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.213] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.213] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.213] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.213] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.213] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.213] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.213] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.213] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.213] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.213] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.213] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.213] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.213] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.213] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.213] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.213] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.213] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.214] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.214] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.214] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.214] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.214] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.214] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.214] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.214] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.214] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.214] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.214] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.214] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.214] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.214] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.214] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.214] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.214] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.215] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.215] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.215] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.215] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.215] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.215] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.215] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.215] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.215] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.215] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.215] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.215] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.215] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.215] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.215] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.215] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.215] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.215] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.216] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.216] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.216] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.216] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.216] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.216] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.216] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.216] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.216] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.216] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.216] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.216] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.216] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.216] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.216] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.216] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.216] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.217] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.217] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.217] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.217] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.217] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.217] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.217] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.217] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.217] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.217] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.217] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.217] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.217] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.217] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.217] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.217] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.217] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.218] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.218] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.218] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.218] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.218] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.218] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.218] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.218] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.218] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.218] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.218] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.218] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.219] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.219] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.219] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.219] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.219] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.219] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.219] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.219] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.219] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.219] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.219] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.219] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.219] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.219] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.219] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.219] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.219] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.220] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.220] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.220] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.220] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.220] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.220] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.220] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.220] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.220] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.220] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.220] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.220] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.220] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.220] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.220] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.220] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.221] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.221] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.221] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.221] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.221] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.221] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.221] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.221] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.221] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.221] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.221] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.221] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.221] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.221] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.221] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.221] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.221] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.221] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.222] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.222] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.222] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.222] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.222] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.222] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.222] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.222] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.222] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.222] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.222] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.222] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.222] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.222] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.222] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.222] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.222] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.223] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.223] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.223] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.223] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.223] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.223] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.223] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.223] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.223] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.223] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.223] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.223] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.223] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.223] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.223] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.223] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.224] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.224] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.224] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.224] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.224] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.224] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.224] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.224] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.224] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.224] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.224] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.224] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.224] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.224] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.224] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.224] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.224] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.224] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.225] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.225] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.225] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.225] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.225] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.225] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.225] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.225] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.225] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.225] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.225] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.225] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.225] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.225] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.225] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.225] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.225] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.226] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.226] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.226] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.226] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.226] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.226] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.226] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.226] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.226] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.226] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.226] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.226] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.226] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.226] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.226] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.226] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.226] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.226] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.227] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.227] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.227] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.227] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.227] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.227] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.227] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.227] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.227] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.227] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.227] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.227] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.227] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.227] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.227] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.227] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.228] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.228] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.228] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.228] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.228] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.228] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.228] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.228] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.228] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.228] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.228] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.228] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.228] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.228] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.228] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.228] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.228] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.228] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.229] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.229] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.229] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.229] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.229] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.229] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.229] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.229] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.229] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.229] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.229] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.229] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.229] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.229] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.229] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.229] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.230] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.230] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.230] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.230] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.230] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.230] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.230] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.230] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.230] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.230] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.230] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.230] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.230] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.230] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.230] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.230] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.230] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.231] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.231] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.231] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.231] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.231] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.231] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.231] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.231] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.231] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.231] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.231] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.231] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.231] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.231] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.231] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.231] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.231] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.231] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.232] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.232] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.232] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.232] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.232] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.232] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.232] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.232] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.232] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.232] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.232] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.232] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.232] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.232] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.232] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.232] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.232] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.232] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.233] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.233] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.233] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.233] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.233] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.233] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.233] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.233] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.233] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.233] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.233] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.233] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.233] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.233] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.233] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.312] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.312] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.312] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.312] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.312] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.312] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.313] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.313] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.313] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.313] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.313] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.313] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.313] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.313] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.313] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.313] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.313] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.313] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.313] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.313] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.313] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.313] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.313] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.313] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.314] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.314] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.314] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.314] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.314] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.314] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.314] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.314] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.314] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.314] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.314] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.314] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.315] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.315] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.315] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.315] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.315] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.315] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.315] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.315] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.315] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.315] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.315] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.315] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.315] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.315] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.315] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.315] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.315] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.316] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.316] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.316] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.316] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.316] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.316] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.316] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.316] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.316] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.316] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.316] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.316] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.317] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.317] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.317] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.317] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.317] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.317] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.317] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.317] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.317] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.317] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.317] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.317] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.317] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.317] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.317] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.317] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.317] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.317] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.318] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.318] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.318] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.318] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.318] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.318] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.318] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.319] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.319] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.319] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.319] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.319] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.319] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.319] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.319] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.319] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.319] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.319] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.320] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.320] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.320] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.320] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.320] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.320] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.320] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.320] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.320] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.320] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.320] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.320] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.321] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.321] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.321] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.321] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.321] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.321] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.321] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0175.321] GetNativeSystemInfo (in: lpSystemInfo=0x19f6c4 | out: lpSystemInfo=0x19f6c4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0175.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8 | out: lpMaxMessageSize=0x19f6bc, lpNextSize=0x19f6b0, lpMessageCount=0x19f6a8, lpReadTimeout=0x19f6b8) returned 0
	[0175.321] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4 | out: lpTimeAdjustment=0x19f6ac, lpTimeIncrement=0x19f6a4, lpTimeAdjustmentDisabled=0x19f6b4) returned 1
	[0187.260] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.260] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.260] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.260] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.260] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.260] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.260] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.260] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.260] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.260] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.260] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.260] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.260] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.261] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.261] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.261] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.261] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.261] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.261] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.261] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.261] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.261] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.261] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.261] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.261] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.261] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.261] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.261] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.261] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.261] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.261] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.262] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.262] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.262] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.262] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.262] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.262] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.262] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.262] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.262] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.262] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.262] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.262] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.262] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.262] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.262] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.262] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.262] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.263] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.263] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.263] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.263] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.263] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.263] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.263] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.263] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.263] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.263] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.263] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.263] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.263] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.263] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.263] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.263] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.263] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.264] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.264] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.264] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.264] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.264] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.264] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.264] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.264] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.264] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.264] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.264] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.264] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.264] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.264] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.264] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.264] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.264] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.264] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.265] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.265] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.265] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.265] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.265] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.265] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.265] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.265] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.265] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.265] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.265] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.265] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.265] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.265] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.265] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.265] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.265] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.266] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.266] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.266] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.266] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.266] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.273] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.273] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.273] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.273] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.273] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.273] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.273] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.273] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.273] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.273] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.273] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.273] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.273] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.273] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.274] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.274] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.274] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.274] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.274] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.274] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.274] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.274] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.274] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.274] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.274] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.274] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.274] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.274] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.274] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.274] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.274] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.275] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.275] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.275] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.275] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.275] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.275] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.275] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.275] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.275] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.275] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.275] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.275] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.275] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.275] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.275] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.275] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.275] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.276] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.276] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.276] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.276] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.276] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.276] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.276] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.276] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.276] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.276] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.276] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.276] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.276] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.276] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.276] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.276] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.276] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.277] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.277] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.277] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.277] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.277] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.277] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.277] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.277] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.277] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.277] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.277] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.277] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.277] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.277] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.277] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.277] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.277] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.278] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.278] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.278] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.278] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.278] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.278] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.278] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.278] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.278] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.278] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.278] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.278] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.278] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.278] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.278] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.278] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.278] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.278] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.279] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.279] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.279] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.279] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.279] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.279] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.279] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.279] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.279] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.279] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.279] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.279] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.279] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.279] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.279] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.279] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.279] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.280] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.280] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.280] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.280] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.280] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.280] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.280] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.280] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.280] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.280] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.280] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.280] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.280] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.280] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.280] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.280] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.280] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.281] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.281] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.281] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.281] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.281] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.281] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.281] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.281] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.281] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.281] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.281] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.281] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.281] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.281] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.281] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.281] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.281] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.281] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.586] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.586] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.586] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.586] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.586] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.586] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.586] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.586] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.587] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.587] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.587] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.587] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.587] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.587] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.587] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.587] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.587] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.587] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.587] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.587] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.587] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.587] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.587] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.587] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.587] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.588] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.588] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.588] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.588] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.588] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.588] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.588] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.588] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.588] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.588] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.588] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.588] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.588] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.588] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.588] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.588] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.588] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.589] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.589] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.589] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.589] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.589] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.589] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.589] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.589] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.589] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.589] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.589] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.589] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.589] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.589] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.589] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.589] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.590] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.590] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.590] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.590] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.590] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.590] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.590] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.590] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.590] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.590] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.591] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.591] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.591] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.591] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.591] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.591] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.591] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.591] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.591] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.592] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.592] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.592] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.592] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.592] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.592] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.592] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.592] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.592] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.593] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.593] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.593] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.593] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.593] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.593] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.593] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.593] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.593] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.593] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.594] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.594] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.594] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.594] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.594] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.594] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.594] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.594] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.594] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.594] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.594] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.594] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.595] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.595] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.595] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.595] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.595] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.595] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.595] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.595] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.595] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.595] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.596] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.596] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.596] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.596] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.596] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.596] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.596] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.596] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.596] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.597] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.597] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.597] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.597] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.597] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.597] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.597] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.597] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.597] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.598] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.598] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.598] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.598] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.598] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.598] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.598] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.598] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.598] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.598] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.599] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.599] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.599] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.599] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.599] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.599] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.599] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.599] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.599] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.600] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.600] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.600] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.600] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.600] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.600] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.600] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.600] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.600] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.601] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.601] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.601] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04 | out: lpTimeAdjustment=0x19ef14, lpTimeIncrement=0x19ef10, lpTimeAdjustmentDisabled=0x19ef04) returned 1
	[0187.601] GetCommMask (in: hFile=0x0, lpEvtMask=0x19ef00 | out: lpEvtMask=0x19ef00) returned 0
	[0187.975] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0xe4
	[0187.977] Module32First (hSnapshot=0xe4, lpme=0x19cbe8) returned 1
	[0187.978] VirtualAlloc (lpAddress=0x0, dwSize=0x18050, flAllocationType=0x1000, flProtect=0x40) returned 0x520000
	[0187.981] GetProcAddress (hModule=0x760c0000, lpProcName="LoadLibraryA") returned 0x760d5a80
	[0187.982] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x760c0000
	[0187.982] GetProcAddress (hModule=0x760c0000, lpProcName="VirtualAlloc") returned 0x760d6970
	[0187.982] GetProcAddress (hModule=0x760c0000, lpProcName="VirtualProtect") returned 0x760d6a30
	[0187.982] GetProcAddress (hModule=0x760c0000, lpProcName="VirtualFree") returned 0x760d69d0
	[0187.982] GetProcAddress (hModule=0x760c0000, lpProcName="GetVersionExA") returned 0x760d56d0
	[0187.982] GetProcAddress (hModule=0x760c0000, lpProcName="TerminateProcess") returned 0x760d67e0
	[0187.982] GetProcAddress (hModule=0x760c0000, lpProcName="ExitProcess") returned 0x760d3cb0
	[0187.982] GetProcAddress (hModule=0x760c0000, lpProcName="SetErrorMode") returned 0x760d6500
	[0187.982] SetErrorMode (uMode=0x400) returned 0x0
	[0187.982] SetErrorMode (uMode=0x0) returned 0x400
	[0187.982] GetVersionExA (in: lpVersionInformation=0x19bb18*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x7ba970, dwBuildNumber=0x7bade0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19bb18*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0187.982] VirtualAlloc (lpAddress=0x0, dwSize=0x17200, flAllocationType=0x1000, flProtect=0x4) returned 0x540000
	[0187.984] VirtualProtect (lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x40, lpflOldProtect=0x19cba0) 

Thread:
	id = 82
	os_tid = 0xf70